@reventlessdev/reventless-core 3.0.0-alpha.254 → 3.0.0-alpha.256

package/CHANGELOG.md

@@ -3,6 +3,54 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.256 (2026-09-04)
+
+* feat(spec)!: one optional encoding on the wire, with no annotation ([320f91d](https://github.com/ReventlessDev/reventless-core/commit/320f91daa8bd90812a6e82069e7a1cb473041930))
+
+### BREAKING CHANGES
+
+* the two encodings cannot read each other. Stored
+pluginDefinition / pluginStructure payloads and already-deployed plugins must
+go — wipe the platform scope (SEED_RESET_SCOPE=platform), quiesce, and
+redeploy the fleet from one commit. Domain plugin data is untouched.
+
+Two guards had to learn the new shape, both of which defined "optional" as
+has.null and so mistook an omitted key for something to invent:
+
+- Message.fillMissingDefaults reached `return undefined` only below two arms
+  that fire first — an enum's first const, and an object member filled with
+  zeros. Absent option<record> therefore healed to a zero-filled record, not
+  None: on the real schema, dcbEventLog became Some({name: "", eventTopicArn:
+  ""}), which manageSubscriptions would have read as a peer to subscribe to.
+  One line, mirroring the has.null guard, above both arms.
+- PluginDefinitionScalars' walker reported 16 optional fields as newly-added
+  bare required scalars. With both encodings understood, the golden list is
+  unchanged.
+
+The frozen lifecycle corpus holds five real payloads in the old encoding.
+Null-valued keys were stripped mechanically — the rewrite round-trips each
+file unchanged before editing, and a key-by-key diff shows null removals and
+nothing else. The README records it beside the account-id redaction and says
+why it is not a regeneration: no fixture was rebuilt from ReScript types, so
+every generation in its table is still pinned.
+
+check:graphql is unchanged, as expected: SchemaType.fromSury collapses Null
+and Undefined to the same Nullable, so the emitted schema never distinguished
+them.
+
+
+
+# 3.0.0-alpha.255 (2026-09-04)
+
+### Features
+
+* **api:** a view says when a second *Id field took its key away ([10b5a4e](https://github.com/ReventlessDev/reventless-core/commit/10b5a4e41b01cfd27146f7f596573af27e4937d9))
+* **plugin:** a slice publishes which topics it subscribes to ([c689695](https://github.com/ReventlessDev/reventless-core/commit/c6896957ecb636204678222ac5a26b30870439cb))
+* **spec,traits:** an image carries the text that goes with it, and a set's first member is its primary ([e4e5845](https://github.com/ReventlessDev/reventless-core/commit/e4e58458aee7b3db5564727d358a3a9767362ca4))
+* **spec:** a field can say it selects one of the values its row already holds ([2ae50c3](https://github.com/ReventlessDev/reventless-core/commit/2ae50c34deee48508a9f1f39e3eef6a5d2f5df00))
+* **spec:** a field can say its value must not be rendered into a message ([3183f53](https://github.com/ReventlessDev/reventless-core/commit/3183f53a0ae667f794bbd1a3d77acf362dfa8e57))
+
+
 # 3.0.0-alpha.254 (2026-09-02)
 
 * feat(aws)!: the messaging sender is configuration, and a stack can choose to only log ([23b8b4b](https://github.com/ReventlessDev/reventless-core/commit/23b8b4bfe9c70555de4d74266ca686cb427485ca))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.254",
+  "version": "3.0.0-alpha.256",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,22 +28,22 @@
   "dependencies": {
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.9",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.8",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.9",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.9",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.8",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.155",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.127",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.34"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.35",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.157",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.129"
   },
   "devDependencies": {
     "rescript": "12.3.0",
     "sury-ppx": "11.0.0-rc.2",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.76"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.77"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/admin/Platform_ComponentDefinitionsApi.res

@@ -31,7 +31,7 @@ let sdlTypes: array<string> = [
   // `idField` to report.
   `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n  namedWhenRetired: Boolean!\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
-  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
+  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n  consumedSources: [String!]\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   // The subscriber's half of the port's translation table — see `handledEventDef`.
   `type Platform_HandledEventDef {\n  name: String!\n  toCommandTypes: [String!]!\n}`,
@@ -193,6 +193,10 @@ let encodeOutboundTranslationSliceDef = (o: outboundTranslationSliceDef): JSON.t
     // the external-system boundary box without workspace access. None → null.
     ("externalSystem", o.externalSystem->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
     ("chapter", o.chapter->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+    // Which topics this slice subscribes to, so a graph consumer can tell two
+    // topics carrying an event of the same name apart. `[]` means this plugin's
+    // own DCB log; null is a structure from before the field existed.
+    ("consumedSources", o.consumedSources->Option.mapOr(JSON.Encode.null, encodeStrings)),
   ])->JSON.Encode.object
 
 let encodeInboundTranslationSliceDef = (i: inboundTranslationSliceDef): JSON.t =>

package/src/admin/Platform_ComponentDefinitionsApi.res.mjs

@@ -12,7 +12,7 @@ let sdlTypes = [
   `type Platform_WriteSideDef {\n  name: String!\n  commands: [Platform_CommandDef!]!\n  linkedViews: [String!]!\n  consistencyRead: String\n  producedEventTypes: [String!]!\n  consumedEventTypes: [String!]!\n  events: [Platform_EventDef!]!\n  errors: [Platform_ErrorDef!]!\n  chapter: String\n}`,
   `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n  namedWhenRetired: Boolean!\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
-  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
+  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n  consumedSources: [String!]\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   `type Platform_HandledEventDef {\n  name: String!\n  toCommandTypes: [String!]!\n}`,
   `type Platform_IssuedCommandDef {\n  name: String!\n  fromEventTypes: [String!]!\n}`,
@@ -303,6 +303,10 @@ function encodeOutboundTranslationSliceDef(o) {
     [
       "chapter",
       Stdlib_Option.mapOr(o.chapter, null, prim => prim)
+    ],
+    [
+      "consumedSources",
+      Stdlib_Option.mapOr(o.consumedSources, null, encodeStrings)
     ]
   ]);
 }

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -300,28 +300,34 @@ let rec scalarOfSchemaType = (st: SchemaType.schemaType): string =>
 let isKeyFieldName = (name: string): bool =>
   name->String.length > 2 && name->String.endsWith("Id")
 
+/** What the ladder below concluded. The two ways to have no key are opposite
+    mistakes, so they are kept apart rather than collapsed into `None`. */
+type keyFieldResolution =
+  | Resolved({field: string, rung: string})
+  | /** Several `*Id` fields and none matching the name — usually a field
+        somebody added to a view that used to have exactly one. */
+  Ambiguous({candidates: array<string>, conventional: string})
+  | NoCandidate
+
 /**
 The field that identifies a row, and which rung answered:
 
 - `"annotation"` — the state declares `@id`. Nothing outranks it.
 - `"convention"` — a field named `<singular entity name>Id` exists
-  (`Products` → `productId`). A guess, but one that can only fire on a field
-  that is actually there.
-- `"sole"` — the state has exactly one `*Id` field, so there is nothing else it
-  could be (`AvailableProducts` → `productId`).
-
-`None` is the honest answer for a state with several `*Id` fields and no name
-match (`ProductDemand`: `productId` + `categoryId`), or with none at all — those
-need `@id`. Convention outranks sole so a view carrying one foreign key and no
-key of its own is not keyed by the foreign key.
+  (`Products` → `productId`).
+- `"sole"` — the state has exactly one `*Id` field (`AvailableProducts`).
+
+Convention outranks sole so a view carrying one foreign key and no key of its own
+is not keyed by the foreign key. `resolveKeyField` is this, with both gaps
+flattened to `None`.
 */
-let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(string, string)> => {
+let classifyKeyField = (~entityName: string, schema: S.t<unknown>): keyFieldResolution => {
   let declared = switch Reventless.StateAnnotations.getSpec(schema) {
   | Some({ids}) => ids->Array.get(0)
   | None => None
   }
   switch declared {
-  | Some(field) => Some((field, "annotation"))
+  | Some(field) => Resolved({field, rung: "annotation"})
   | None =>
     let candidates =
       SchemaType.fromSuryObject(~typeName="", schema)
@@ -333,15 +339,50 @@ let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(strin
       singular->String.slice(~start=0, ~end=1)->String.toLowerCase ++
       singular->String.slice(~start=1, ~end=singular->String.length) ++ "Id"
     if candidates->Array.includes(conventional) {
-      Some((conventional, "convention"))
+      Resolved({field: conventional, rung: "convention"})
     } else if candidates->Array.length == 1 {
-      Some((candidates->Array.getUnsafe(0), "sole"))
+      Resolved({field: candidates->Array.getUnsafe(0), rung: "sole"})
+    } else if Array.length(candidates) == 0 {
+      NoCandidate
     } else {
-      None
+      Ambiguous({candidates, conventional})
     }
   }
 }
 
+let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(string, string)> =>
+  switch classifyKeyField(~entityName, schema) {
+  | Resolved({field, rung}) => Some((field, rung))
+  | Ambiguous(_) | NoCandidate => None
+  }
+
+/**
+What losing the key costs this view, said where the ladder is so a caller only
+has to report it.
+
+Invisible otherwise: the view keeps every field and every row, and loses its
+`<field>Eq` filter and its whole `orderBy` from the schema, so a client's
+narrowing silently becomes a page fetched and filtered on the client.
+
+`None` for `NoCandidate` as well as for a resolved key, and that is the whole
+judgement here. A read model over an aggregate keeps the row's id on the row key
+rather than in its state, so having no `*Id` field is its ordinary shape — warning
+about it would fire on most of them and get the rule silenced. `Ambiguous` is the
+accident: the view HAD a key and a second `*Id` field took it away.
+*/
+let keyFieldGapMessage = (resolution: keyFieldResolution): option<string> =>
+  switch resolution {
+  | Resolved(_) | NoCandidate => None
+  | Ambiguous({candidates, conventional}) =>
+    Some(
+      `has no row key: it declares no @id and its \`*Id\` fields ` ++
+      `(${candidates->Array.join(", ")}) include no "${conventional}" for the name to ` ++
+      `pick. Adding a second \`*Id\` field to a view that had one is what lands here, ` ++
+      `and it costs the view its filter and its whole orderBy in the schema. Declare ` ++
+      `@id on the field that identifies a row.`,
+    )
+  }
+
 // The component name the key-field convention is read against. `specName` is the
 // read model's own `Spec.name`; without it, `returnTypeName` minus its plugin
 // prefix is the same string (`Catalog_Product` → `Product`).

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -244,30 +244,59 @@ function isKeyFieldName(name) {
   }
 }
 
-function resolveKeyField(entityName, schema) {
+function classifyKeyField(entityName, schema) {
   let match = StateAnnotations$Reventless.getSpec(schema);
   let declared = match !== undefined ? match.ids[0] : undefined;
   if (declared !== undefined) {
-    return [
-      declared,
-      "annotation"
-    ];
+    return {
+      TAG: "Resolved",
+      field: declared,
+      rung: "annotation"
+    };
   }
   let candidates = Object.keys(Stdlib_Option.getOr(SchemaType$ReventlessCore.fromSuryObject("", schema), {})).filter(isKeyFieldName);
   let singular = Api_Naming$ReventlessCore.singularize(Api_Naming$ReventlessCore.stripViewSuffix(entityName));
   let conventional = singular.slice(0, 1).toLowerCase() + singular.slice(1, singular.length) + "Id";
   if (candidates.includes(conventional)) {
-    return [
-      conventional,
-      "convention"
-    ];
+    return {
+      TAG: "Resolved",
+      field: conventional,
+      rung: "convention"
+    };
   } else if (candidates.length === 1) {
+    return {
+      TAG: "Resolved",
+      field: candidates[0],
+      rung: "sole"
+    };
+  } else if (candidates.length === 0) {
+    return "NoCandidate";
+  } else {
+    return {
+      TAG: "Ambiguous",
+      candidates: candidates,
+      conventional: conventional
+    };
+  }
+}
+
+function resolveKeyField(entityName, schema) {
+  let match = classifyKeyField(entityName, schema);
+  if (typeof match !== "object" || match.TAG !== "Resolved") {
+    return;
+  } else {
     return [
-      candidates[0],
-      "sole"
+      match.field,
+      match.rung
     ];
-  } else {
+  }
+}
+
+function keyFieldGapMessage(resolution) {
+  if (typeof resolution !== "object" || resolution.TAG === "Resolved") {
     return;
+  } else {
+    return `has no row key: it declares no @id and its \`*Id\` fields ` + (`(` + resolution.candidates.join(", ") + `) include no "` + resolution.conventional + `" for the name to `) + `pick. Adding a second \`*Id\` field to a view that had one is what lands here, and it costs the view its filter and its whole orderBy in the schema. Declare @id on the field that identifies a row.`;
   }
 }
 
@@ -655,7 +684,9 @@ export {
   emptyCapability,
   scalarOfSchemaType,
   isKeyFieldName,
+  classifyKeyField,
   resolveKeyField,
+  keyFieldGapMessage,
   entityNameOf,
   deriveServerCapability,
   validateScanSortAlignment,

package/src/components/Api/SchemaType.res

@@ -60,6 +60,7 @@ let semanticCompositeNames = [
   (Reventless.Semantic.Id.money, "Money"),
   (Reventless.Semantic.Id.dateRange, "DateRange"),
   (Reventless.Semantic.Id.geoPoint, "GeoPoint"),
+  (Reventless.Semantic.Id.captionedImage, "CaptionedImage"),
 ]
 
 let canonicalName = (id: string): option<string> =>

package/src/components/Api/SchemaType.res.mjs

@@ -40,6 +40,10 @@ let semanticCompositeNames = [
   [
     Semantic$Reventless.Id.geoPoint,
     "GeoPoint"
+  ],
+  [
+    Semantic$Reventless.Id.captionedImage,
+    "CaptionedImage"
   ]
 ];
 

package/src/components/Api/SuryToJsonSchema.res

@@ -271,6 +271,24 @@ and withSemantic = (fieldSchema: JSON.t, sem: Reventless.Semantic.t): JSON.t =>
         "x-reventless-semantic-target",
         jsonObject(withOptionalPlugin([("store", str(store))], plugin)),
       )
+    | MemberOf({plugin, view, field, content}) =>
+      // Same channel as the two above, and `view` and `content` are omitted on
+      // the same terms as `plugin`: absent means the collection is on the row
+      // this field is already part of, and that the member's kind is the
+      // reader's own to work out.
+      let optional = (pairs, key, value) =>
+        switch value {
+        | Some(v) => Array.concat(pairs, [(key, str(v))])
+        | None => pairs
+        }
+      obj->Dict.set(
+        "x-reventless-semantic-target",
+        jsonObject(
+          withOptionalPlugin([("field", str(field))], plugin)
+          ->optional("view", view)
+          ->optional("content", content),
+        ),
+      )
     }
     JSON.Encode.object(obj)
   }
@@ -291,10 +309,15 @@ and withSemantic = (fieldSchema: JSON.t, sem: Reventless.Semantic.t): JSON.t =>
 // belongs to, leaving the field a plain string either way. Threading it here
 // also keeps it available on command variants, which carry no annotation spec
 // for `mergeAnnotations` to read.
+// `sensitive` rides here on the same reasoning as `owners`, and is read the same
+// way — off the sury schema by the caller. What it marks is a field whose value
+// must not be rendered into content somebody receives, which is a property of
+// the domain model rather than of the field's shape.
 and objectRefToJsonSchema = (
   ~annotations: option<Reventless.StateAnnotations.stateAnnotationSpec>=?,
   ~optional: array<string>=[],
   ~owners: array<string>=[],
+  ~sensitive: array<string>=[],
   fields: dict<SchemaType.schemaType>,
 ): JSON.t => {
   let props = Dict.make()
@@ -328,6 +351,23 @@ and objectRefToJsonSchema = (
     } else {
       withAnnotations
     }
+    // Last, so it can read the semantic both earlier paths may have written. A
+    // field whose semantic is a way of reaching a particular person is sensitive
+    // whether or not anybody marked it — the annotation is for the values a type
+    // cannot betray.
+    let withAnnotations = switch withAnnotations->JSON.Decode.object {
+    | Some(obj) =>
+      let bySemantic =
+        obj
+        ->Dict.get("x-reventless-semantic")
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.mapOr(false, Reventless.Sensitive.impliedBySemantic)
+      if sensitive->Array.includes(fieldName) || bySemantic {
+        obj->Dict.set("x-reventless-sensitive", JSON.Encode.bool(true))
+      }
+      JSON.Encode.object(obj)
+    | None => withAnnotations
+    }
     props->Dict.set(fieldName, withAnnotations)
     // Optional two ways, because neither source answers alone. `optional` is
     // read off the sury schema and is the only thing that can speak for a
@@ -362,6 +402,7 @@ let deriveObjectSchema = (schema: S.t<unknown>): JSON.t =>
       ~annotations?,
       ~optional=SchemaType.optionalFieldNames(schema),
       ~owners=Reventless.Owner.fieldNames(schema),
+      ~sensitive=Reventless.Sensitive.fieldNames(schema),
       fields,
     )
     // Surface component-level hints on the top-level object schema.

package/src/components/Api/SuryToJsonSchema.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
+import * as Sensitive$Reventless from "@reventlessdev/reventless-spec/src/components/Sensitive.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as SchemaType$ReventlessCore from "./SchemaType.res.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
@@ -232,7 +233,7 @@ function fromSchemaType(st) {
           ]
         ]);
       case "ObjectRef" :
-        return objectRefToJsonSchema(undefined, undefined, undefined, st._1);
+        return objectRefToJsonSchema(undefined, undefined, undefined, undefined, st._1);
       case "Enum" :
         return Object.fromEntries([
           [
@@ -269,7 +270,7 @@ function armToJsonSchema(tag, armType) {
   if (armType.TAG !== "ObjectRef") {
     return fromSchemaType(armType);
   }
-  let base = objectRefToJsonSchema(undefined, undefined, undefined, armType._1);
+  let base = objectRefToJsonSchema(undefined, undefined, undefined, undefined, armType._1);
   let obj = Stdlib_JSON.Decode.object(base);
   if (obj === undefined) {
     return base;
@@ -303,26 +304,47 @@ function withSemantic(fieldSchema, sem) {
   obj["x-reventless-semantic-source"] = "type";
   let match = sem.payload;
   if (typeof match === "object") {
-    if (match.TAG === "ReferenceTo") {
-      let match$1 = match._0;
-      obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
-          "entity",
-          match$1.entity
-        ]], match$1.plugin));
-    } else {
-      let match$2 = match._0;
-      obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
-          "store",
-          match$2.store
-        ]], match$2.plugin));
+    switch (match.TAG) {
+      case "ReferenceTo" :
+        let match$1 = match._0;
+        obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
+            "entity",
+            match$1.entity
+          ]], match$1.plugin));
+        break;
+      case "StoredIn" :
+        let match$2 = match._0;
+        obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
+            "store",
+            match$2.store
+          ]], match$2.plugin));
+        break;
+      case "MemberOf" :
+        let match$3 = match._0;
+        let optional = (pairs, key, value) => {
+          if (value !== undefined) {
+            return pairs.concat([[
+                key,
+                value
+              ]]);
+          } else {
+            return pairs;
+          }
+        };
+        obj["x-reventless-semantic-target"] = Object.fromEntries(optional(optional(withOptionalPlugin([[
+            "field",
+            match$3.field
+          ]], match$3.plugin), "view", match$3.view), "content", match$3.content));
+        break;
     }
   }
   return obj;
 }
 
-function objectRefToJsonSchema(annotations, optionalOpt, ownersOpt, fields) {
+function objectRefToJsonSchema(annotations, optionalOpt, ownersOpt, sensitiveOpt, fields) {
   let optional = optionalOpt !== undefined ? optionalOpt : [];
   let owners = ownersOpt !== undefined ? ownersOpt : [];
+  let sensitive = sensitiveOpt !== undefined ? sensitiveOpt : [];
   let props = {};
   let required = [];
   let internal = Stdlib_Option.getOr(Stdlib_Option.flatMap(annotations, spec => spec.internal), []);
@@ -343,7 +365,18 @@ function objectRefToJsonSchema(annotations, optionalOpt, ownersOpt, fields) {
     } else {
       withAnnotations$1 = withAnnotations;
     }
-    props[fieldName] = withAnnotations$1;
+    let obj$1 = Stdlib_JSON.Decode.object(withAnnotations$1);
+    let withAnnotations$2;
+    if (obj$1 !== undefined) {
+      let bySemantic = Stdlib_Option.mapOr(Stdlib_Option.flatMap(obj$1["x-reventless-semantic"], Stdlib_JSON.Decode.string), false, Sensitive$Reventless.impliedBySemantic);
+      if (sensitive.includes(fieldName) || bySemantic) {
+        obj$1["x-reventless-sensitive"] = true;
+      }
+      withAnnotations$2 = obj$1;
+    } else {
+      withAnnotations$2 = withAnnotations$1;
+    }
+    props[fieldName] = withAnnotations$2;
     if (!optional.includes(fieldName) && !isNullableType(fieldType)) {
       required.push(fieldName);
       return;
@@ -377,7 +410,7 @@ function deriveObjectSchema(schema) {
       ]]);
   }
   let annotations = StateAnnotations$Reventless.getSpec(schema);
-  let objSchema = objectRefToJsonSchema(annotations, SchemaType$ReventlessCore.optionalFieldNames(schema), Owner$Reventless.fieldNames(schema), fields);
+  let objSchema = objectRefToJsonSchema(annotations, SchemaType$ReventlessCore.optionalFieldNames(schema), Owner$Reventless.fieldNames(schema), Sensitive$Reventless.fieldNames(schema), fields);
   if (annotations === undefined) {
     return objSchema;
   }

package/src/components/StateChangeSlice/StateChangeSlice_Callback.res

@@ -37,8 +37,8 @@ module Make = (
     // Encode through the event schema (like the Aggregate path's Message.encode),
     // NOT JSON.stringifyAny: the runtime representation drops `None` option
     // fields entirely, while the consumer side (DcbDecode) parses with the sury
-    // schema — a js_nullable option field would reject the missing key and the
-    // event would be dropped as schema drift.
+    // schema — an encoding that writes `null` for an absent field would reject the
+    // missing key and the event would be dropped as schema drift.
     let json = event->Reventless.Util_Sury.toJson(Spec.eventSchema)
     let (eventType, data) = json->Message.splitMessage
     // Use `extractTagsExpanded` (not `extractTags`) so per-element tags on

package/src/plugin/component/Plugin_Structure.res

@@ -1282,6 +1282,13 @@ let make = (
     | Checked(failures) => failures->Array.forEach(f => retiredFailures->Array.push(f)->ignore)
     }
 
+  // Warned rather than refused: an unkeyed view still answers, just without a
+  // filter or an ordering, and a lint that stops a deploy gets silenced.
+  let recordKeyField = (~entityName, stateSchema) =>
+    GraphQL_FragmentGenerator.classifyKeyField(~entityName, stateSchema)
+    ->GraphQL_FragmentGenerator.keyFieldGapMessage
+    ->Option.forEach(why => log.warn(~comp="Plugin_Structure", `${name}/${entityName} ${why}`))
+
   let readModelDefs =
     readModels
     ->Array.map((
@@ -1300,6 +1307,7 @@ let make = (
       let consumed = qualify(~prefix=name, R.consumedEventNames)
       recordRetired(~entityName=R.Spec.name, stateSchema)
       recordLifecycle(~entityName=R.Spec.name, stateSchema)
+      recordKeyField(~entityName=R.Spec.name, stateSchema)
       ({
         Reventless.Plugin.name: R.Spec.name,
         queryField: qf.listFieldName,
@@ -1340,6 +1348,7 @@ let make = (
       )
       recordRetired(~entityName=SVS.Spec.name, stateSchema)
       recordLifecycle(~entityName=SVS.Spec.name, stateSchema)
+      recordKeyField(~entityName=SVS.Spec.name, stateSchema)
       ({
         Reventless.Plugin.name: SVS.Spec.name,
         queryField: qf.listFieldName,
@@ -1452,6 +1461,10 @@ let make = (
       targetName: OTS.Spec.targetName,
       externalSystem: OTS.Spec.externalSystem,
       chapter: chapterOf(OTS.Spec.name),
+      // Published verbatim, `[]` included: `[]` is the declared default meaning
+      // this plugin's own DCB log, and resolving it here to a derived name would
+      // be a second place that name is spelled.
+      consumedSources: Some(OTS.Spec.sourceNames),
     }: Reventless.Plugin.outboundTranslationSliceDef))
 
   // ── Inbound translation slices ────────────────────────────────────────────

package/src/plugin/component/Plugin_Structure.res.mjs

@@ -962,6 +962,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       retiredFailures.push(f);
     });
   };
+  let recordKeyField = (entityName, stateSchema) => Stdlib_Option.forEach(GraphQL_FragmentGenerator$ReventlessCore.keyFieldGapMessage(GraphQL_FragmentGenerator$ReventlessCore.classifyKeyField(entityName, stateSchema)), why => log.warn("Plugin_Structure", undefined, name + `/` + entityName + ` ` + why));
   let readModelDefs = readModels.map(R => {
     let qf = Api_Naming$ReventlessCore.queryFieldNamesForReadModel(name, R.Spec.name, undefined);
     let stateSchema = R.Spec.stateSchema;
@@ -970,6 +971,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let consumed = qualify(name, R.consumedEventNames);
     recordRetired(R.Spec.name, stateSchema);
     recordLifecycle(R.Spec.name, stateSchema);
+    recordKeyField(R.Spec.name, stateSchema);
     return {
       name: R.Spec.name,
       queryField: qf.listFieldName,
@@ -1001,6 +1003,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let keyField = GraphQL_FragmentGenerator$ReventlessCore.resolveKeyField(SVS.Spec.name, stateSchema);
     recordRetired(SVS.Spec.name, stateSchema);
     recordLifecycle(SVS.Spec.name, stateSchema);
+    recordKeyField(SVS.Spec.name, stateSchema);
     return {
       name: SVS.Spec.name,
       queryField: qf.listFieldName,
@@ -1071,7 +1074,8 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     inboundCommandTypes: qualify(name, DcbTag$Reventless.extractAllVariantNames(OTS.Spec.inboundCommandSchema)),
     targetName: OTS.Spec.targetName,
     externalSystem: OTS.Spec.externalSystem,
-    chapter: componentChapters[OTS.Spec.name]
+    chapter: componentChapters[OTS.Spec.name],
+    consumedSources: OTS.Spec.sourceNames
   }));
   let inboundTranslationSliceDefs = inboundTranslationSlices.map(ITS => ({
     name: ITS.Spec.name,

package/src/plugin/lifecycle/PluginsReadModelSpec.res

@@ -71,7 +71,7 @@ type state = {
   // Admin's manageSubscriptions uses this to wire cross-plugin SNS subscriptions
   // from this plugin's DCB topic → peer EventCollectors (and vice-versa). None
   // for pure-aggregate plugins or for plugins persisted before Phase 4.
-  dcbEventLog: @s.matches(Reventless.Plugin.dcbEventLogOptionSchema) option<Reventless.Plugin.dcbEventLogDefinition>,
+  dcbEventLog: option<Reventless.Plugin.dcbEventLogDefinition>,
   // Business role of the plugin (from pluginDefinition.kind). Lets the admin Plugins
   // view segregate PlatformInfrastructure / Commercial / Marketplace from Domain.
   // @scan opts the field into server-side equality filtering so the connection gains

package/src/plugin/lifecycle/PluginsReadModelSpec.res.mjs

@@ -26,7 +26,7 @@ let stateSchema = Sury.$schema(s => ({
   apiSchemaFragment: s.m(Sury.$option(Sury.json)),
   apiTarget: s.m(Sury.$option(Sury.string)),
   structure: s.m(Sury.$option(Sury.json)),
-  dcbEventLog: s.m(Plugin$Reventless.dcbEventLogOptionSchema),
+  dcbEventLog: s.m(Sury.$option(Plugin$Reventless.dcbEventLogDefinitionSchema)),
   kind: s.m(Sury.$option(Plugin$Reventless.pluginKindSchema)),
   otherConnectedVersions: s.m(Sury.array(Plugin$Reventless.versionSchema))
 }));

package/tests/admin/AdminApiSchemaDriftTest.res

@@ -128,6 +128,7 @@ let outbound: outboundTranslationSliceDef = {
   targetName: Some("Shipment"),
   externalSystem: Some("Shipper"),
   chapter: Some("Fulfilment"),
+  consumedSources: Some(["OrderingDcbEventLog"]),
 }
 
 let inbound: inboundTranslationSliceDef = {