@reventlessdev/reventless-core 3.0.0-alpha.261 → 3.0.0-alpha.263

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.263 (2026-09-16)
+
+* feat(spec)!: infer the DCB partition key per slice, and drop @partitionTag where inference agrees ([6c10161](https://github.com/ReventlessDev/reventless-core/commit/6c101611d438beea4bc9175ae8ea0ea1f6f7493b))
+### Features
+
+* **core:** fail the build when an extension cannot find its slice's partition key ([cf2b093](https://github.com/ReventlessDev/reventless-core/commit/cf2b093dd5dc7cf9425cdac919cd3910fc4aeefd))
+* **spec:** let a slice's chapter break a partition-key tie ([2b9ae77](https://github.com/ReventlessDev/reventless-core/commit/2b9ae77e98eb42177d2bdd4977bc62bb7c7911aa))
+
+### BREAKING CHANGES
+
+* DcbTag.derivePartitionTag is removed; a boundary whose
+partition cannot be inferred no longer deploys.
+
+
+
+# 3.0.0-alpha.262 (2026-09-11)
+
+* feat(spec)!: a secret is a capability, so a test can know it in advance ([71507c6](https://github.com/ReventlessDev/reventless-core/commit/71507c6459b49178746f00c5040cb479d7fdade8))
+### Features
+
+* **aws:** the first administrator is one command, not the console ([5f1a846](https://github.com/ReventlessDev/reventless-core/commit/5f1a84603b21a9feb691a08a148751c6c6e8eca8))
+
+### BREAKING CHANGES
+
+* Capabilities.t gains a secrets member. A platform that builds
+the record literally no longer compiles until it supplies one;
+Capabilities.none.secrets is the refusing value. Code that spreads
+Capabilities.none is unaffected.
+
+
+
 # 3.0.0-alpha.261 (2026-09-09)
 
 **Note:** Version bump only for package @reventlessdev/reventless-core

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.261",
+  "version": "3.0.0-alpha.263",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,16 +29,16 @@
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.33",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.11",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.11",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.12",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.20",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.12",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.21",
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.12",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.11",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.162",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.36",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.134"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.136",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.164",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.37"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Secrets/Secrets_Node_Backend.res

@@ -0,0 +1,60 @@
+// The secret source both platforms use: `node:crypto`, which AWS Lambda and the
+// local runtime both have. One implementation rather than two, for the same
+// reason the log messaging transport is shared — a second copy is one edit away
+// from differing on the part that matters.
+
+let _bytes = (count: int): array<int> => {
+  // Read back as hex and re-split, because the binding treats a Buffer as opaque
+  // — it is only ever stringified or fed to an HMAC. Two hex characters is one
+  // byte, so this is a decode rather than a reinterpretation.
+  let hex = NodeCrypto.randomBytes(count)->NodeCrypto.bufferToString("hex")
+  Array.fromInitializer(~length=count, i =>
+    hex->String.substring(~start=i * 2, ~end=i * 2 + 2)->Int.fromString(~radix=16)->Option.getOr(0)
+  )
+}
+
+/**
+Whether a random byte may be folded into an alphabet of `size`, or must be drawn
+again.
+
+🚨 **`byte % size` is not uniform, and this predicate is the whole defence.** 256
+is not a multiple of 10, so bytes 250–255 fold onto digits 0–5 and make those six
+about four percent likelier each than the other four. An attacker guessing a
+numeric code guesses the likelier half first. Discarding everything at or above
+the largest whole multiple of `size` costs a few extra draws and makes every
+character equally likely.
+
+Separate and named because the skew it prevents is far too small to catch by
+sampling the output — it is checked directly, over every byte value.
+*/
+let accepts = (~byte: int, ~size: int): bool => byte < 256 - mod(256, size)
+
+let _draw = (~length: int, ~from: string): string => {
+  let size = from->String.length
+  let out = []
+  while out->Array.length < length {
+    // Over-draw: most bytes are kept, so one round is nearly always enough, and
+    // a short round simply goes again.
+    _bytes((length - out->Array.length) * 2 + 8)->Array.forEach(byte =>
+      if accepts(~byte, ~size) && out->Array.length < length {
+        out->Array.push(from->String.charAt(mod(byte, size)))
+      }
+    )
+  }
+  out->Array.join("")
+}
+
+/**
+The provider both platforms pass.
+
+`length` is refused rather than clamped when it is not positive: a caller asking
+for a zero-length token has a bug, and answering `""` would hand back something
+that compares equal to nothing and settles every challenge.
+*/
+let provider: Reventless.Secrets.t = {
+  randomToken: (~length, ~alphabet) =>
+    length <= 0
+      ? Error(Unavailable(`a token needs a positive length, not ${length->Int.toString}`))
+      : Ok(_draw(~length, ~from=Reventless.Secrets.characters(alphabet))),
+  hash: input => Ok(NodeCrypto.sha256Hex(input)),
+}

package/src/adapter/Secrets/Secrets_Node_Backend.res.mjs

@@ -0,0 +1,69 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as NodeCrypto from "@reventlessdev/rescript-node/src/NodeCrypto.res.mjs";
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Primitive_int from "@rescript/runtime/lib/es6/Primitive_int.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Secrets$Reventless from "@reventlessdev/reventless-spec/src/semantic/Secrets.res.mjs";
+
+function _bytes(count) {
+  let hex = Nodecrypto.randomBytes(count).toString("hex");
+  return Stdlib_Array.fromInitializer(count, i => Stdlib_Option.getOr(Stdlib_Int.fromString(hex.substring((i << 1), (i << 1) + 2 | 0), 16), 0));
+}
+
+function accepts(byte, size) {
+  return byte < (256 - Primitive_int.mod_(256, size) | 0);
+}
+
+function _draw(length, from) {
+  let size = from.length;
+  let out = [];
+  while (out.length < length) {
+    _bytes(((length - out.length | 0) << 1) + 8 | 0).forEach(byte => {
+      if (accepts(byte, size) && out.length < length) {
+        out.push(from.charAt(Primitive_int.mod_(byte, size)));
+        return;
+      }
+    });
+  };
+  return out.join("");
+}
+
+function provider_randomToken(length, alphabet) {
+  if (length <= 0) {
+    return {
+      TAG: "Error",
+      _0: {
+        TAG: "Unavailable",
+        _0: `a token needs a positive length, not ` + length.toString()
+      }
+    };
+  } else {
+    return {
+      TAG: "Ok",
+      _0: _draw(length, Secrets$Reventless.characters(alphabet))
+    };
+  }
+}
+
+function provider_hash(input) {
+  return {
+    TAG: "Ok",
+    _0: NodeCrypto.sha256Hex(input)
+  };
+}
+
+let provider = {
+  randomToken: provider_randomToken,
+  hash: provider_hash
+};
+
+export {
+  _bytes,
+  accepts,
+  _draw,
+  provider,
+}
+/* NodeCrypto Not a pure module */

package/src/admin/Platform_Admin_Structure.res.mjs

@@ -7,7 +7,7 @@ import * as PluginsReadModelSpec$ReventlessCore from "../plugin/lifecycle/Plugin
 
 let pluginId = "Platform";
 
-let pluginCommands = Plugin_Structure$ReventlessCore.extractCommandDefs(true, variantName => Api_Naming$ReventlessCore.adminField(PluginSpec$ReventlessCore.name + "_" + variantName), PluginSpec$ReventlessCore.commandAuthorization, PluginSpec$ReventlessCore.commandTransition, undefined, PluginSpec$ReventlessCore.commandSchema);
+let pluginCommands = Plugin_Structure$ReventlessCore.extractCommandDefs(true, undefined, variantName => Api_Naming$ReventlessCore.adminField(PluginSpec$ReventlessCore.name + "_" + variantName), PluginSpec$ReventlessCore.commandAuthorization, PluginSpec$ReventlessCore.commandTransition, undefined, PluginSpec$ReventlessCore.commandSchema);
 
 let pluginAggregate_producedEventTypes = [];
 

package/src/components/Aggregate/Aggregate_Builder.res.mjs

@@ -61,7 +61,7 @@ function Make(Spec) {
         let fields = registeredFields !== undefined ? (
             registeredFields.length !== 0 ? registeredFields : []
           ) : [];
-        let generateCommand = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(publishJsons, publishJsonsAndWait, Spec.name, Spec.commandSchema, "Aggregate", undefined);
+        let generateCommand = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(publishJsons, publishJsonsAndWait, Spec.name, Spec.commandSchema, "Aggregate", undefined, undefined);
         fields.forEach(field => bindHandler(field, generateCommand));
       } else {
         let resources = Component$ReventlessCore.outputs(commandTopic).resources;

package/src/components/CommandGenerator/CommandGenerator.res

@@ -7,10 +7,10 @@ The `id` field is the envelope id for the produced command message:
 - For **Aggregates**, it is required — the resolver populates it from the
   GraphQL `id: ID!` argument injected into the mutation SDL.
 - For **DCB StateChangeSlices**, it is optional. When the resolver does not
-  supply one, `makeGenerateCommand` derives the envelope id from the command's
-  `@partitionTag` / `@compositePartitionTag` field(s) using the same helpers
-  the slice itself uses for its decision-model partition key, so envelope id
-  and slice partition key share one source of truth.
+  supply one, `makeGenerateCommand` takes the envelope id from the command's
+  value of the handling slice's partition key — the key `Dcb_Builder` derives
+  for storage and the fence — so envelope id and slice partition key share one
+  source of truth.
 */
 type arguments = {id: string}
 type meta = {ip: array<string>, user: string, info: string}

package/src/components/CommandGenerator/CommandGenerator_Callback.res

@@ -112,6 +112,8 @@ let makeGenerateCommand = (
   ~commandSchema: S.t<unknown>,
   ~componentKind: commandComponentKind,
   ~stripIdFromParams: bool=true,
+  // The handling slice's partition; the envelope id is its value on the command.
+  ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
 ): CommandGenerator.commandGenerator => {
   (payload: CommandGenerator.payload) =>
     Effect.sync(() => {
@@ -157,9 +159,11 @@ let makeGenerateCommand = (
       }
       // Resolve the envelope id.
       // - Aggregates always rely on the resolver-supplied id (id: ID! arg in SDL).
-      // - DCB StateChangeSlices fall back to deriving the id from the command's
-      //   partition tag(s) when the resolver didn't supply one — this is what makes
-      //   @compositePartitionTag work end-to-end without per-call-site id stuffing.
+      // - DCB StateChangeSlices fall back to the value of the handling slice's
+      //   partition field on the command when the resolver didn't supply one —
+      //   what makes @compositePartitionTag work end-to-end without per-call-site
+      //   id stuffing. A command without that field, or a generator that was not
+      //   given the partition (the permissive `S.json` fallback), gets `""`.
       let suppliedId = payload.arguments.id
       let id = switch componentKind {
       | Aggregate => suppliedId
@@ -167,23 +171,12 @@ let makeGenerateCommand = (
         switch (suppliedId->Obj.magic: Nullable.t<string>)->Nullable.toOption {
         | Some(idValue) => idValue
         | None =>
-          try {
-            let derived = Reventless.DcbTag.derivePartitionTag([(serviceName, "", commandSchema)])
-            switch derived {
-            | Simple(pt) =>
-              let tags = Reventless.DcbTag.extractTagsFromJson(commandSchema, commandJson)
-              Reventless.DcbTag.getPartitionTagValue([{tags: tags}], pt)->Option.getOr("")
-            | Composite(spec) =>
-              let tags = Reventless.DcbTag.extractTagsFromJson(commandSchema, commandJson)
-              Reventless.DcbTag.getCompositePartitionKeyValue(tags, spec)
-            }
-          } catch {
-          // Permissive schemas (e.g. S.json on the AppSync direct-invocation path)
-          // have no tagged fields — derivePartitionTag throws. Fall back to "" so
-          // existing transports keep their pre-fix behavior; the slice decoder
-          // surfaces the missing id downstream as it did before.
-          | _ => ""
-          }
+          partitionTag->Option.mapOr("", pt =>
+            Reventless.DcbTag.extractTagsFromJson(
+              commandSchema,
+              commandJson,
+            )->Reventless.DcbTag.partitionValueOfTags(pt)
+          )
         }
       }
       (meta, commandJson, id)

package/src/components/CommandGenerator/CommandGenerator_Callback.res.mjs

@@ -59,7 +59,7 @@ function dropNullArguments(obj) {
   });
 }
 
-function makeGenerateCommand(publishJsons, publishJsonsAndWait, serviceName, commandSchema, componentKind, $staropt$star) {
+function makeGenerateCommand(publishJsons, publishJsonsAndWait, serviceName, commandSchema, componentKind, $staropt$star, partitionTag) {
   return payload => {
     let stripIdFromParams = $staropt$star !== undefined ? $staropt$star : true;
     return Effect.flatMap(Effect.tap(Effect.sync(() => {
@@ -85,28 +85,7 @@ function makeGenerateCommand(publishJsons, publishJsonsAndWait, serviceName, com
           ]].concat(params)) : commandStr;
       let suppliedId = payload.arguments.id;
       let id;
-      if (componentKind === "Aggregate" || !(suppliedId == null)) {
-        id = suppliedId;
-      } else {
-        try {
-          let derived = DcbTag$Reventless.derivePartitionTag([[
-              serviceName,
-              "",
-              commandSchema
-            ]]);
-          if (derived.TAG === "Simple") {
-            let tags = DcbTag$Reventless.extractTagsFromJson(commandSchema, commandJson);
-            id = Stdlib_Option.getOr(DcbTag$Reventless.getPartitionTagValue([{
-                tags: tags
-              }], derived._0), "");
-          } else {
-            let tags$1 = DcbTag$Reventless.extractTagsFromJson(commandSchema, commandJson);
-            id = DcbTag$Reventless.getCompositePartitionKeyValue(tags$1, derived._0);
-          }
-        } catch (exn) {
-          id = "";
-        }
-      }
+      id = componentKind === "Aggregate" || !(suppliedId == null) ? suppliedId : Stdlib_Option.mapOr(partitionTag, "", pt => DcbTag$Reventless.partitionValueOfTags(DcbTag$Reventless.extractTagsFromJson(commandSchema, commandJson), pt));
       return [
         meta,
         commandJson,
@@ -181,7 +160,7 @@ function makeGenerateCommand(publishJsons, publishJsonsAndWait, serviceName, com
 
 function Make(Spec) {
   return AggregateSpec => {
-    let generateCommand = makeGenerateCommand(Spec.publishJsons, Spec.publishJsonsAndWait, AggregateSpec.name, AggregateSpec.commandSchema, "Aggregate", undefined);
+    let generateCommand = makeGenerateCommand(Spec.publishJsons, Spec.publishJsonsAndWait, AggregateSpec.name, AggregateSpec.commandSchema, "Aggregate", undefined, undefined);
     return {
       generateCommand: generateCommand
     };

package/src/components/Dcb/Dcb_Builder.res

@@ -1,26 +1,5 @@
-// Converts a file:// module URL to a path relative to the project root (located by lerna.json),
-// resolving symlinks so workspace packages show their source location rather than node_modules.
-// Falls back to the bare URL string on any error.
 let log = Logger.fromEnv()
 
-let toRelativePath: string => string = %raw(`function toRelativePath(moduleUrl) {
-  try {
-    const fs = process.getBuiltinModule('node:fs');
-    const path = process.getBuiltinModule('node:path');
-    const { fileURLToPath } = process.getBuiltinModule('node:url');
-    const builderReal = fs.realpathSync(fileURLToPath(import.meta.url));
-    const sliceReal = fs.realpathSync(fileURLToPath(moduleUrl));
-    let dir = path.dirname(builderReal);
-    while (dir !== path.dirname(dir)) {
-      if (fs.existsSync(path.join(dir, 'lerna.json'))) break;
-      dir = path.dirname(dir);
-    }
-    return path.relative(dir, sliceReal).replace(/\.mjs$/, '.res');
-  } catch(e) {
-    return moduleUrl.replace('file://', '');
-  }
-}`)
-
 // The tag of one compiled variant arm: `{TAG: "<Name>", …}` for a payload-bearing
 // constructor, a bare string const for a payload-less one.
 let variantTag = (variant: S.t<unknown>) =>
@@ -182,12 +161,6 @@ module Make = (
           Sc.Spec.name,
           Sc.Spec.eventSchema->S.castToUnknown,
         ))
-      let producedNamed =
-        stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) => (
-          Sc.Spec.name,
-          toRelativePath(Sc.Spec.moduleUrl),
-          Sc.Spec.eventSchema->S.castToUnknown,
-        ))
       let consumed =
         stateChangeSlices
         ->Array.map((module(Sc: StateChangeSlice.T)) => (
@@ -253,7 +226,39 @@ module Make = (
         indexes
       }
 
-      let partitionTag = Reventless.DcbTag.derivePartitionTag(producedNamed)
+      let sliceSchemas = stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) => {
+        Reventless.DcbTag.name: Sc.Spec.name,
+        commandSchema: Sc.Spec.commandSchema->S.castToUnknown,
+        consumedEventSchema: Sc.Spec.consumedEventSchema->S.castToUnknown,
+        eventSchema: Sc.Spec.eventSchema->S.castToUnknown,
+        moduleUrl: Sc.Spec.moduleUrl,
+      })
+      let inferenceShapes = sliceSchemas->Array.map(Reventless.DcbTag.sliceShape)
+
+      // A `@partitionTag` inference contradicts would steer storage, fence and read
+      // scope to a key the slice only references, so it stops the build. One that
+      // inference agrees with is noise, and says so.
+      let hintIssues = Reventless.DcbValidation.validatePartitionHintsVsInference(
+        ~shapes=inferenceShapes,
+      )
+      hintIssues.redundancies->Array.forEach(e =>
+        log.info(~comp="Dcb_Builder", `DCB partition (${e.sliceName}): ${e.message}`)
+      )
+      if hintIssues.contradictions->Array.length > 0 {
+        let detail =
+          hintIssues.contradictions
+          ->Array.map(e => `${e.sliceName}: ${e.message}`)
+          ->Array.join(" | ")
+        log.error(~comp="Dcb_Builder", `DCB partition contradiction (${name}): ${detail}`)
+        JsError.throwWithMessage(`DCB partition contradiction (${name}): ${detail}`)
+      }
+
+      // Where each event is stored — and so its fence, and each command's envelope
+      // id. Throws, naming the slice, when a partition cannot be inferred.
+      let boundaryPartition = Reventless.DcbTag.deriveBoundaryPartition(sliceSchemas)
+      let partitionTag = boundaryPartition.partitionTag
+      let partitionTagOf = sliceName =>
+        boundaryPartition->Reventless.DcbTag.slicePartitionTag(sliceName)
 
       // Tag keys declared `@crossPartition` across the produced event schemas.
       // Derived once at build time (the scope is a property of the tag key, and
@@ -325,15 +330,6 @@ module Make = (
       // preserved (generalised rule 3). Safety guard: if any slice's partition is
       // ambiguous we keep the annotated values for the whole boundary rather than
       // thread a partial inference. See docs/plans/done/dcb-tag-scope-inference.md.
-      let inferenceShapes =
-        stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) =>
-          Reventless.DcbTag.sliceShapeFromSchemas(
-            ~name=Sc.Spec.name,
-            ~commandSchema=Sc.Spec.commandSchema->S.castToUnknown,
-            ~consumedEventSchema=Sc.Spec.consumedEventSchema->S.castToUnknown,
-            ~eventSchema=Sc.Spec.eventSchema->S.castToUnknown,
-          )
-        )
       let inferred = Reventless.DcbScopeInference.infer(inferenceShapes)
       if inferred.crossPartitionTagKeys != crossPartitionTagKeys {
         log.info(
@@ -388,14 +384,7 @@ module Make = (
       // (DcbCommandTopicEntryPoint.mjs) route through `DcbTag.deriveEffectiveScope`
       // so the runtime decision query cannot drift from this scope — see
       // docs/analysis/dcb-runtime-scope-annotation-drift.md.
-      let effective = Reventless.DcbTag.deriveEffectiveScope(
-        stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) => {
-          Reventless.DcbTag.name: Sc.Spec.name,
-          commandSchema: Sc.Spec.commandSchema->S.castToUnknown,
-          consumedEventSchema: Sc.Spec.consumedEventSchema->S.castToUnknown,
-          eventSchema: Sc.Spec.eventSchema->S.castToUnknown,
-        }),
-      )
+      let effective = Reventless.DcbTag.deriveEffectiveScope(sliceSchemas)
       let effectiveCrossPartitionTagKeys = effective.crossPartitionTagKeys
       let effectiveTagKeysByEventType = effective.tagKeysByEventType
 
@@ -487,6 +476,7 @@ module Make = (
             ~publishJsons,
             ~tagKeysByEventType=effectiveTagKeysByEventType,
             ~crossPartitionTagKeys=effectiveCrossPartitionTagKeys,
+            ~partitionTag=?partitionTagOf(StateChangeSlice.Spec.name),
             ~runtime=?componentRuntime->Dict.get(StateChangeSlice.Spec.name),
             ~opts,
           )
@@ -507,6 +497,7 @@ module Make = (
             ~publishJsons=asyncPublishJsons,
             ~tagKeysByEventType=effectiveTagKeysByEventType,
             ~crossPartitionTagKeys=effectiveCrossPartitionTagKeys,
+            ~partitionTag=?partitionTagOf(StateChangeSlice.Spec.name),
             ~runtime=?componentRuntime->Dict.get(StateChangeSlice.Spec.name),
             ~opts,
           )
@@ -572,6 +563,7 @@ module Make = (
                   ~commandSchema=S.Spec.commandSchema->Obj.magic,
                   ~componentKind=CommandGenerator_Callback.StateChangeSlice,
                   ~stripIdFromParams=false,
+                  ~partitionTag=?partitionTagOf(S.Spec.name),
                 )
                 Api_Naming.sliceMutationFields(
                   ~plugin=apiNamePrefix,
@@ -602,6 +594,7 @@ module Make = (
                     ~commandSchema=S.Spec.commandSchema->Obj.magic,
                     ~componentKind=CommandGenerator_Callback.StateChangeSlice,
                     ~stripIdFromParams=false,
+                    ~partitionTag=?partitionTagOf(S.Spec.name),
                   )
                   Api_Naming.sliceMutationFields(
                     ~plugin=apiNamePrefix,
@@ -813,7 +806,7 @@ module Make = (
                   `Two DCB slices in "${name}" both declare the command "${tag}". ` ++
                   "Owner stamping resolves a command by that name alone, so it cannot " ++ "tell them apart. Rename one of the constructors.",
                 )
-              | None => byTag->Dict.set(tag, commandSchema)
+              | None => byTag->Dict.set(tag, (commandSchema, partitionTagOf(S.Spec.name)))
               }
             })
           }
@@ -825,7 +818,7 @@ module Make = (
         dcbCommandTopic
         ->Component.operations
         ->Pulumi.Output.apply(ops => {
-          let make = commandSchema =>
+          let make = (commandSchema, partitionTag) =>
             CommandGenerator_Callback.makeGenerateCommand(
               ~publishJsons=ops.publishJsons,
               ~publishJsonsAndWait=?ops.publishJsonsAndWait,
@@ -833,16 +826,19 @@ module Make = (
               ~commandSchema,
               ~componentKind=CommandGenerator_Callback.StateChangeSlice,
               ~stripIdFromParams=false,
+              ~partitionTag?,
             )
           let byTag = Dict.make()
           dcbCommandSchemasByTag
           ->Dict.toArray
-          ->Array.forEach(((tag, schema)) => byTag->Dict.set(tag, make(schema)))
+          ->Array.forEach(((tag, (schema, partitionTag))) =>
+            byTag->Dict.set(tag, make(schema, partitionTag))
+          )
           // A command no slice claims keeps the permissive generator — what every
           // command got before this change — so nothing that reaches this handler
           // by another route starts failing. It also cannot stamp, which is why
           // the unknown case is logged rather than left to look like a success.
-          (byTag, make(S.json->S.castToUnknown))
+          (byTag, make(S.json->S.castToUnknown, None))
         })
 
       let dcbHandler =