@reventlessdev/reventless-core 3.0.0-alpha.261 → 3.0.0-alpha.263

package/src/plugin/component/Plugin_Structure.res

@@ -345,6 +345,40 @@ let reportTranslationTables = (
   }
 }
 
+let describePartition = (pt: Reventless.DcbTag.derivedPartitionTag) =>
+  switch pt {
+  | Simple({key}) => key
+  | Composite({keys}) => keys->Array.join(" + ")
+  | ByEventType(_) => "a key per event type"
+  }
+
+// An extension groups the commands it sends a DCB slice by the slice's partition
+// key, but it infers that key from the slice alone: the command and the events,
+// not what the slice reads. Where the plugin needs those reads — or the chapter —
+// to decide, the two can differ, and the extension would fail or group commands
+// by the wrong id at run time. `expected` is `None` when the plugin itself cannot
+// derive a partition; that failure is the builder's to report.
+let extensionPartitionFailure = (
+  ~label: string,
+  ~delegate: string,
+  ~expected: option<Reventless.DcbTag.derivedPartitionTag>,
+  ~actual: result<Reventless.DcbTag.derivedPartitionTag, string>,
+): option<string> =>
+  switch (expected, actual) {
+  | (None, _) => None
+  | (Some(e), Ok(a)) if e == a => None
+  | (Some(e), outcome) =>
+    let seen = switch outcome {
+    | Ok(a) => `groups its commands by ${a->describePartition}`
+    | Error(reason) => `cannot tell which key to group its commands by (${reason})`
+    }
+    Some(
+      `${label}: the extension ${seen}, but the plugin partitions ${delegate} by ${e->describePartition}. ` ++
+      `An extension sees only the slice's command and events, not what it reads or its chapter — ` ++
+      `add @partitionTag ${e->describePartition} to ${delegate}'s event.`,
+    )
+  }
+
 // A command's declared edge names states belonging to another component's enum,
 // and nothing forces a spec to pick the one its linked view declares. Both sides
 // are in hand here. A state the linked views do not declare raises (this runs at assembly,
@@ -636,7 +670,15 @@ let isCreateCommandName = name =>
     name->String.startsWith(p)
   )
 
-let commandLevelAndId = (~isAggregate, ~variantName, properties: dict<S.t<unknown>>) =>
+// A slice command's id field is the one carrying its slice's partition key, as the
+// boundary infers it; a `@partitionTag` or the first tagged field stands in only
+// where no key was inferred.
+let commandLevelAndId = (
+  ~isAggregate,
+  ~partitionKey: option<string>=?,
+  ~variantName,
+  properties: dict<S.t<unknown>>,
+) =>
   if isAggregate {
     if isCreateCommandName(variantName) {
       (Reventless.Plugin.Collection, None)
@@ -651,9 +693,18 @@ let commandLevelAndId = (~isAggregate, ~variantName, properties: dict<S.t<unknow
         fieldName != "TAG" &&
           (Reventless.DcbTag.isTagged(fieldSchema) || Reventless.DcbTag.isTaggedArray(fieldSchema))
       )
+    let keyOf = ((fieldName, fieldSchema)) =>
+      Reventless.DcbTag.isTaggedArray(fieldSchema)
+        ? Reventless.DcbTag.resolveArrayTagKey(fieldName, fieldSchema)
+        : Reventless.DcbTag.resolveTagKey(fieldName, fieldSchema)
     let taggedField =
-      taggedFields
-      ->Array.find(((_, fieldSchema)) => Reventless.DcbTag.isPartitionTag(fieldSchema))
+      partitionKey
+      ->Option.flatMap(key => taggedFields->Array.find(field => keyOf(field) == key))
+      ->Option.orElse(
+        taggedFields->Array.find(((_, fieldSchema)) =>
+          Reventless.DcbTag.isPartitionTag(fieldSchema)
+        ),
+      )
       ->Option.orElse(taggedFields->Array.get(0))
     switch taggedField {
     | Some((fieldName, _)) =>
@@ -700,6 +751,7 @@ let annotateArgTypes = (schema: JSON.t, argTypes: dict<string>): JSON.t => {
 
 let toCommandDef = (
   ~isAggregate,
+  ~partitionKey: option<string>=?,
   ~mutationFieldFor: string => string,
   ~parentSchema: S.t<unknown>,
   // The PPX-generated `command => permission`. Per VARIANT, not per component:
@@ -727,7 +779,12 @@ let toCommandDef = (
   // empty for a payload-less variant (e.g. `| Archive`), which compiles to a bare
   // `S.literal("Archive")` string rather than an `{TAG, ...}` object.
   let mkDef = (~variantName, ~properties) => {
-    let (guessedLevel, aggregateIdField) = commandLevelAndId(~isAggregate, ~variantName, properties)
+    let (guessedLevel, aggregateIdField) = commandLevelAndId(
+      ~isAggregate,
+      ~partitionKey?,
+      ~variantName,
+      properties,
+    )
     let references = extractReferences(properties)
     // Evaluated against a synthetic value per constructor, the same shape the
     // resolver builds at call time: a payload-bearing variant compiles to
@@ -867,6 +924,7 @@ let toCommandDef = (
 
 let extractCommandDefs = (
   ~isAggregate,
+  ~partitionKey: option<string>=?,
   ~mutationFieldFor: string => string,
   ~commandAuthorization: unknown => Reventless.Authorization.permission,
   ~commandTransition: unknown => Reventless.Transition.t<string>,
@@ -878,6 +936,7 @@ let extractCommandDefs = (
     anyOf->Array.filterMap(v =>
       toCommandDef(
         ~isAggregate,
+        ~partitionKey?,
         ~mutationFieldFor,
         ~parentSchema=commandSchema,
         ~commandAuthorization,
@@ -890,6 +949,7 @@ let extractCommandDefs = (
     // Single-variant command types compile to a bare Object schema, not a Union.
     toCommandDef(
       ~isAggregate,
+      ~partitionKey?,
       ~mutationFieldFor,
       ~parentSchema=commandSchema,
       ~commandAuthorization,
@@ -1445,6 +1505,30 @@ let make = (
 
   // ── Build writable defs ────────────────────────────────────────────────────
 
+  // Non-throwing: this is a description of the plugin, and the builder is what
+  // refuses a boundary whose partitions do not resolve.
+  let dcbSliceSchemas =
+    stateChangeSlices->Array.map((module(SCS: ReventlessInfra.StateChangeSlice.T)) => {
+      Reventless.DcbTag.name: SCS.Spec.name,
+      commandSchema: SCS.Spec.commandSchema->S.castToUnknown,
+      consumedEventSchema: SCS.Spec.consumedEventSchema->S.castToUnknown,
+      eventSchema: SCS.Spec.eventSchema->S.castToUnknown,
+      moduleUrl: SCS.Spec.moduleUrl,
+    })
+  let {partitionBySlice}: Reventless.DcbScopeInference.partitionResolution =
+    dcbSliceSchemas
+    ->Array.map(Reventless.DcbTag.sliceShape)
+    ->Reventless.DcbScopeInference.resolvePartitions
+  let slicePartitionOf = switch Reventless.DcbTag.deriveBoundaryPartition(dcbSliceSchemas) {
+  | boundary =>
+    delegate =>
+      dcbSliceSchemas->Array.some(s => s.name == delegate)
+        ? boundary->Reventless.DcbTag.slicePartitionTag(delegate)
+        : None
+  | exception JsExn(_) => _ => None
+  }
+  let partitionFailures = []
+
   let stateChangeDefs =
     stateChangeSlices->Array.mapWithIndex((module(SCS: ReventlessInfra.StateChangeSlice.T), i) => {
       let (_, produced) = scsProduced->Array.getUnsafe(i)
@@ -1455,6 +1539,7 @@ let make = (
           Reventless.Plugin.name: SCS.Spec.name,
           commands: extractCommandDefs(
             ~isAggregate=false,
+            ~partitionKey=?partitionBySlice->Dict.get(SCS.Spec.name),
             ~mutationFieldFor=variantName =>
               Api_Naming.sliceMutationFieldFor(
                 ~plugin=name,
@@ -1592,6 +1677,12 @@ let make = (
     let eventsByCommand: Dict.t<array<string>> = Dict.make()
     E.mappings->Array.forEach((module(M: E.Mapping)) => {
       let label = `${E.Spec.name} → ${M.delegateName}`
+      extensionPartitionFailure(
+        ~label,
+        ~delegate=M.delegateName,
+        ~expected=slicePartitionOf(M.delegateName),
+        ~actual=M.delegatePartition(),
+      )->Option.forEach(f => partitionFailures->Array.push(f))
       pushAll(
         tableFailures,
         handledTableFailures(
@@ -1965,6 +2056,12 @@ let make = (
   })
 
   reportTranslationTables(~pluginName=name, ~failures=tableFailures, ~warnings=tableWarnings)
+  if partitionFailures->Array.length > 0 {
+    JsError.throwWithMessage(
+      `${name}: an extension cannot group its commands by the target slice's partition key.\n` ++
+      partitionFailures->Array.join("\n"),
+    )
+  }
 
   // Second pass, on purpose: commands are built well before `linkedViews` is
   // assembled, so the check cannot run inline where the defs are made.

package/src/plugin/component/Plugin_Structure.res.mjs

@@ -13,6 +13,7 @@ import * as Trait$Reventless from "@reventlessdev/reventless-spec/src/types/Trai
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Message$Reventless from "@reventlessdev/reventless-spec/src/types/Message.res.mjs";
 import * as Lifecycle$Reventless from "@reventlessdev/reventless-spec/src/types/Lifecycle.res.mjs";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Reference$Reventless from "@reventlessdev/reventless-spec/src/components/Reference.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
@@ -23,6 +24,7 @@ import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.
 import * as CapabilityNeed$Reventless from "@reventlessdev/reventless-spec/src/semantic/CapabilityNeed.res.mjs";
 import * as SchemaType$ReventlessCore from "../../components/Api/SchemaType.res.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
+import * as DcbScopeInference$Reventless from "@reventlessdev/reventless-spec/src/components/DcbScopeInference.res.mjs";
 import * as ApiNoApiHelpers$ReventlessCore from "../../components/Api/ApiNoApiHelpers.res.mjs";
 import * as SuryToJsonSchema$ReventlessCore from "../../components/Api/SuryToJsonSchema.res.mjs";
 import * as Capability_Inference$ReventlessCore from "./Capability_Inference.res.mjs";
@@ -289,6 +291,29 @@ function reportTranslationTables(pluginName, failures, warnings) {
   }
 }
 
+function describePartition(pt) {
+  switch (pt.TAG) {
+    case "Simple" :
+      return pt._0.key;
+    case "Composite" :
+      return pt._0.keys.join(" + ");
+    case "ByEventType" :
+      return "a key per event type";
+  }
+}
+
+function extensionPartitionFailure(label, delegate, expected, actual) {
+  if (expected === undefined) {
+    return;
+  }
+  if (actual.TAG === "Ok" && Primitive_object.equal(expected, actual._0)) {
+    return;
+  }
+  let seen;
+  seen = actual.TAG === "Ok" ? `groups its commands by ` + describePartition(actual._0) : `cannot tell which key to group its commands by (` + actual._0 + `)`;
+  return label + `: the extension ` + seen + `, but the plugin partitions ` + delegate + ` by ` + describePartition(expected) + `. An extension sees only the slice's command and events, not what it reads or its chapter — ` + (`add @partitionTag ` + describePartition(expected) + ` to ` + delegate + `'s event.`);
+}
+
 function checkDeclaredTransitions(pluginName, writables, lifecycleStatesByView) {
   let unvalidated = {
     contents: 0
@@ -492,7 +517,7 @@ function isCreateCommandName(name) {
   ].some(p => name.startsWith(p));
 }
 
-function commandLevelAndId(isAggregate, variantName, properties) {
+function commandLevelAndId(isAggregate, partitionKey, variantName, properties) {
   if (isAggregate) {
     if (isCreateCommandName(variantName)) {
       return [
@@ -518,7 +543,16 @@ function commandLevelAndId(isAggregate, variantName, properties) {
       return false;
     }
   });
-  let taggedField = Stdlib_Option.orElse(taggedFields.find(param => DcbTag$Reventless.isPartitionTag(param[1])), taggedFields[0]);
+  let keyOf = param => {
+    let fieldSchema = param[1];
+    let fieldName = param[0];
+    if (DcbTag$Reventless.isTaggedArray(fieldSchema)) {
+      return DcbTag$Reventless.resolveArrayTagKey(fieldName, fieldSchema);
+    } else {
+      return DcbTag$Reventless.resolveTagKey(fieldName, fieldSchema);
+    }
+  };
+  let taggedField = Stdlib_Option.orElse(Stdlib_Option.orElse(Stdlib_Option.flatMap(partitionKey, key => taggedFields.find(field => keyOf(field) === key)), taggedFields.find(param => DcbTag$Reventless.isPartitionTag(param[1]))), taggedFields[0]);
   if (taggedField === undefined) {
     return [
       "Collection",
@@ -563,9 +597,9 @@ function annotateArgTypes(schema, argTypes) {
   return schema;
 }
 
-function toCommandDef(isAggregate, mutationFieldFor, parentSchema, commandAuthorization, commandTransition, derivedEdgeFor, v) {
+function toCommandDef(isAggregate, partitionKey, mutationFieldFor, parentSchema, commandAuthorization, commandTransition, derivedEdgeFor, v) {
   let mkDef = (variantName, properties) => {
-    let match = commandLevelAndId(isAggregate, variantName, properties);
+    let match = commandLevelAndId(isAggregate, partitionKey, variantName, properties);
     let references = extractReferences(properties);
     let syntheticCommand = DcbTag$Reventless.isVariantPayloadBearing(parentSchema, variantName) ? ({
         TAG: variantName
@@ -649,12 +683,12 @@ function toCommandDef(isAggregate, mutationFieldFor, parentSchema, commandAuthor
   }
 }
 
-function extractCommandDefs(isAggregate, mutationFieldFor, commandAuthorization, commandTransition, derivedEdgeForOpt, commandSchema) {
+function extractCommandDefs(isAggregate, partitionKey, mutationFieldFor, commandAuthorization, commandTransition, derivedEdgeForOpt, commandSchema) {
   let derivedEdgeFor = derivedEdgeForOpt !== undefined ? derivedEdgeForOpt : param => {};
   if (commandSchema.type === "anyOf") {
-    return Stdlib_Array.filterMap(commandSchema.anyOf, v => toCommandDef(isAggregate, mutationFieldFor, commandSchema, commandAuthorization, commandTransition, derivedEdgeFor, v));
+    return Stdlib_Array.filterMap(commandSchema.anyOf, v => toCommandDef(isAggregate, partitionKey, mutationFieldFor, commandSchema, commandAuthorization, commandTransition, derivedEdgeFor, v));
   } else {
-    return Stdlib_Option.mapOr(toCommandDef(isAggregate, mutationFieldFor, commandSchema, commandAuthorization, commandTransition, derivedEdgeFor, commandSchema), [], def => [def]);
+    return Stdlib_Option.mapOr(toCommandDef(isAggregate, partitionKey, mutationFieldFor, commandSchema, commandAuthorization, commandTransition, derivedEdgeFor, commandSchema), [], def => [def]);
   }
 }
 
@@ -1036,6 +1070,37 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       requiredAccess: accessKeysFor(SVS.Spec.authorization)
     };
   });
+  let dcbSliceSchemas = stateChangeSlices.map(SCS => ({
+    name: SCS.Spec.name,
+    commandSchema: SCS.Spec.commandSchema,
+    consumedEventSchema: SCS.Spec.consumedEventSchema,
+    eventSchema: SCS.Spec.eventSchema,
+    moduleUrl: SCS.Spec.moduleUrl
+  }));
+  let match = DcbScopeInference$Reventless.resolvePartitions(dcbSliceSchemas.map(DcbTag$Reventless.sliceShape));
+  let partitionBySlice = match.partitionBySlice;
+  let slicePartitionOf;
+  let exit = 0;
+  let boundary;
+  try {
+    boundary = DcbTag$Reventless.deriveBoundaryPartition(dcbSliceSchemas);
+    exit = 1;
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (exn.RE_EXN_ID === "JsExn") {
+      slicePartitionOf = param => {};
+    } else {
+      throw exn;
+    }
+  }
+  if (exit === 1) {
+    slicePartitionOf = delegate => {
+      if (dcbSliceSchemas.some(s => s.name === delegate)) {
+        return DcbTag$Reventless.slicePartitionTag(boundary, delegate);
+      }
+    };
+  }
+  let partitionFailures = [];
   let stateChangeDefs = stateChangeSlices.map((SCS, i) => {
     let match = scsProduced[i];
     let produced = match[1];
@@ -1043,7 +1108,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let consumed = match$1[1];
     return {
       name: SCS.Spec.name,
-      commands: extractCommandDefs(false, variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), SCS.Spec.commandAuthorization, SCS.Spec.commandTransition, extra => derivedEdgeFor(SCS.Spec.name, extra), SCS.Spec.commandSchema),
+      commands: extractCommandDefs(false, partitionBySlice[SCS.Spec.name], variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), SCS.Spec.commandAuthorization, SCS.Spec.commandTransition, extra => derivedEdgeFor(SCS.Spec.name, extra), SCS.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: consumed,
       linkedViews: linkedSvsFor(produced),
@@ -1058,7 +1123,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let produced = match[1];
     return {
       name: A.Spec.name,
-      commands: extractCommandDefs(true, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), A.Spec.commandAuthorization, A.Spec.commandTransition, extra => derivedEdgeFor(A.Spec.name, extra), A.Spec.commandSchema),
+      commands: extractCommandDefs(true, undefined, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), A.Spec.commandAuthorization, A.Spec.commandTransition, extra => derivedEdgeFor(A.Spec.name, extra), A.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: [],
       linkedViews: linkedSvsFor(produced).concat(linkedReadModelsFor(A.Spec.name)),
@@ -1109,6 +1174,9 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let eventsByCommand = {};
     E.mappings.forEach(M => {
       let label = E.Spec.name + ` → ` + M.delegateName;
+      Stdlib_Option.forEach(extensionPartitionFailure(label, M.delegateName, slicePartitionOf(M.delegateName), M.delegatePartition()), f => {
+        partitionFailures.push(f);
+      });
       pushAll(tableFailures, handledTableFailures(label, M.handledEvents, epEventNames, M.delegateCommandNames.concat(epCommandNames)));
       pushAll(tableFailures, commandTableFailures(label, "issuedCommands", "comes from", M.issuedCommands.map(param => [
         param.name,
@@ -1330,6 +1398,9 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     });
   });
   reportTranslationTables(name, tableFailures, tableWarnings);
+  if (partitionFailures.length !== 0) {
+    Stdlib_JsError.throwWithMessage(name + `: an extension cannot group its commands by the target slice's partition key.\n` + partitionFailures.join("\n"));
+  }
   checkDeclaredTransitions(name, stateChangeDefs.concat(aggregateDefs), lifecycleStatesByView);
   checkLifecycleTopology(name, stateChangeDefs.concat(aggregateDefs), lifecycleStatesByView);
   reportRetiredStates(name, retiredFailures, retiredUnchecked);
@@ -1374,6 +1445,8 @@ export {
   probeMeta,
   probeQueryEngine,
   reportTranslationTables,
+  describePartition,
+  extensionPartitionFailure,
   checkDeclaredTransitions,
   lifecycleTopologyFindings,
   checkLifecycleTopology,

package/tests/Secrets_Node_BackendTest.res

@@ -0,0 +1,141 @@
+open JestGlobals
+
+// The secret source. What matters here is not that it produces characters, but
+// that it produces them uniformly — a token drawn from a skewed distribution is
+// guessable in a way that no other test would notice.
+
+module Secrets = Reventless.Secrets
+module Backend = Secrets_Node_Backend
+
+let token = (~length, ~alphabet) =>
+  Backend.provider.randomToken(~length, ~alphabet)->Result.getOr("")
+
+describe("randomToken", () => {
+  testSync("draws the requested length", () =>
+    expect(
+      [1, 6, 32, 64]->Array.map(length => token(~length, ~alphabet=Digits)->String.length),
+    )->toEqual([1, 6, 32, 64])
+  )
+
+  testSync("draws only from the alphabet it was given", () => {
+    let allowed = Secrets.characters(UrlSafe)
+    expect(
+      token(~length=512, ~alphabet=UrlSafe)
+      ->String.split("")
+      ->Array.every(c => allowed->String.includes(c)),
+    )->toBe(true)
+  })
+
+  testSync("digits are digits", () =>
+    expect(
+      token(~length=512, ~alphabet=Digits)
+      ->String.split("")
+      ->Array.every(c => "0123456789"->String.includes(c)),
+    )->toBe(true)
+  )
+
+  // Not proof of randomness — it is proof the source is not a constant, which is
+  // the failure a fixed or broken binding would produce.
+  testSync("two draws differ", () =>
+    expect(token(~length=32, ~alphabet=UrlSafe) == token(~length=32, ~alphabet=UrlSafe))->toBe(
+      false,
+    )
+  )
+
+  // A zero-length token would compare equal to nothing and settle every
+  // challenge presented against it, so it is refused rather than clamped.
+  testSync("a non-positive length is refused, not clamped", () =>
+    expect(
+      [0, -1]->Array.map(
+        length => Backend.provider.randomToken(~length, ~alphabet=Digits)->Result.isError,
+      ),
+    )->toEqual([true, true])
+  )
+})
+
+// 🚨 Checked over every byte value rather than by sampling the output, and the
+// first attempt here got that wrong. `byte % 10` skews the low six digits by
+// about four percent each — roughly 0.609 of draws landing in the low half
+// against 0.600 for a fair source. At any sample size a test can afford that
+// gap is a couple of standard errors, so a sampled assertion either flakes or,
+// as the first version did, passes happily with the defence deleted.
+describe("accepts — the rejection rule", () => {
+  let rejected = size =>
+    Array.fromInitializer(~length=256, i => i)->Array.filter(byte => !Backend.accepts(~byte, ~size))
+
+  testSync("rejects exactly the bytes that would skew a 10-character alphabet", () =>
+    expect(rejected(10))->toEqual([250, 251, 252, 253, 254, 255])
+  )
+
+  // 64 divides 256 exactly, so nothing needs discarding and a url-safe token
+  // costs no extra draws.
+  testSync("rejects nothing when the alphabet divides evenly", () =>
+    expect(rejected(64))->toEqual([])
+  )
+
+  // What survives always folds onto a whole number of cycles, which is the
+  // property that makes every character equally likely.
+  testSync("what it accepts is a whole multiple of the alphabet", () =>
+    expect(
+      [2, 3, 7, 10, 16, 26, 62, 64]->Array.map(
+        size => mod(256 - rejected(size)->Array.length, size),
+      ),
+    )->toEqual([0, 0, 0, 0, 0, 0, 0, 0])
+  )
+
+  testSync("never discards more than one cycle's worth", () =>
+    expect([3, 7, 10, 26, 62]->Array.map(size => rejected(size)->Array.length < size))->toEqual([
+      true,
+      true,
+      true,
+      true,
+      true,
+    ])
+  )
+})
+
+describe("hash", () => {
+  testSync("is deterministic, which is what lets a proof be compared", () =>
+    expect(Backend.provider.hash("a-secret") == Backend.provider.hash("a-secret"))->toBe(true)
+  )
+
+  testSync("separates different inputs", () =>
+    expect(Backend.provider.hash("a-secret") == Backend.provider.hash("a-secret "))->toBe(false)
+  )
+
+  // One-way: the digest must not carry the secret it was made from.
+  testSync("does not contain its input", () =>
+    expect(
+      Backend.provider.hash("a-secret")
+      ->Result.getOr("")
+      ->String.includes("a-secret"),
+    )->toBe(false)
+  )
+})
+
+describe("Capabilities.none.secrets", () => {
+  // Refusing rather than degrading: there is no weaker token that would be safe
+  // to hand back, so an unwired platform must fail rather than produce one.
+  testSync("refuses both operations", () =>
+    expect((
+      Reventless.Capabilities.none.secrets.randomToken(
+        ~length=32,
+        ~alphabet=UrlSafe,
+      )->Result.isError,
+      Reventless.Capabilities.none.secrets.hash("x")->Result.isError,
+    ))->toEqual((true, true))
+  )
+})
+
+describe("Secrets.fixed", () => {
+  // What a consumer's suite uses to know the secret before presenting it.
+  let provider = Secrets.fixed(~token="known", ~hash=input => `hashed:${input}`)
+
+  testSync("hands back the token it was built with", () =>
+    expect(provider.randomToken(~length=32, ~alphabet=UrlSafe))->toEqual(Ok("known"))
+  )
+
+  testSync("hashes through the function it was given", () =>
+    expect(provider.hash("known"))->toEqual(Ok("hashed:known"))
+  )
+})

package/tests/Secrets_Node_BackendTest.res.mjs

@@ -0,0 +1,152 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Primitive_int from "@rescript/runtime/lib/es6/Primitive_int.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Secrets$Reventless from "@reventlessdev/reventless-spec/src/semantic/Secrets.res.mjs";
+import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
+import * as Secrets_Node_Backend$ReventlessCore from "../src/adapter/Secrets/Secrets_Node_Backend.res.mjs";
+
+function token(length, alphabet) {
+  return Stdlib_Result.getOr(Secrets_Node_Backend$ReventlessCore.provider.randomToken(length, alphabet), "");
+}
+
+globalThis.describe("randomToken", () => {
+  globalThis.test("draws the requested length", () => {
+    globalThis.expect([
+      1,
+      6,
+      32,
+      64
+    ].map(length => token(length, "Digits").length)).toEqual([
+      1,
+      6,
+      32,
+      64
+    ]);
+  });
+  globalThis.test("draws only from the alphabet it was given", () => {
+    let allowed = Secrets$Reventless.characters("UrlSafe");
+    globalThis.expect(token(512, "UrlSafe").split("").every(c => allowed.includes(c))).toBe(true);
+  });
+  globalThis.test("digits are digits", () => {
+    globalThis.expect(token(512, "Digits").split("").every(c => "0123456789".includes(c))).toBe(true);
+  });
+  globalThis.test("two draws differ", () => {
+    globalThis.expect(token(32, "UrlSafe") === token(32, "UrlSafe")).toBe(false);
+  });
+  globalThis.test("a non-positive length is refused, not clamped", () => {
+    globalThis.expect([
+      0,
+      -1
+    ].map(length => Stdlib_Result.isError(Secrets_Node_Backend$ReventlessCore.provider.randomToken(length, "Digits")))).toEqual([
+      true,
+      true
+    ]);
+  });
+});
+
+globalThis.describe("accepts — the rejection rule", () => {
+  let rejected = size => Stdlib_Array.fromInitializer(256, i => i).filter(byte => !Secrets_Node_Backend$ReventlessCore.accepts(byte, size));
+  globalThis.test("rejects exactly the bytes that would skew a 10-character alphabet", () => {
+    globalThis.expect(rejected(10)).toEqual([
+      250,
+      251,
+      252,
+      253,
+      254,
+      255
+    ]);
+  });
+  globalThis.test("rejects nothing when the alphabet divides evenly", () => {
+    globalThis.expect(rejected(64)).toEqual([]);
+  });
+  globalThis.test("what it accepts is a whole multiple of the alphabet", () => {
+    globalThis.expect([
+      2,
+      3,
+      7,
+      10,
+      16,
+      26,
+      62,
+      64
+    ].map(size => Primitive_int.mod_(256 - rejected(size).length | 0, size))).toEqual([
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0
+    ]);
+  });
+  globalThis.test("never discards more than one cycle's worth", () => {
+    globalThis.expect([
+      3,
+      7,
+      10,
+      26,
+      62
+    ].map(size => rejected(size).length < size)).toEqual([
+      true,
+      true,
+      true,
+      true,
+      true
+    ]);
+  });
+});
+
+globalThis.describe("hash", () => {
+  globalThis.test("is deterministic, which is what lets a proof be compared", () => {
+    globalThis.expect(Primitive_object.equal(Secrets_Node_Backend$ReventlessCore.provider.hash("a-secret"), Secrets_Node_Backend$ReventlessCore.provider.hash("a-secret"))).toBe(true);
+  });
+  globalThis.test("separates different inputs", () => {
+    globalThis.expect(Primitive_object.equal(Secrets_Node_Backend$ReventlessCore.provider.hash("a-secret"), Secrets_Node_Backend$ReventlessCore.provider.hash("a-secret "))).toBe(false);
+  });
+  globalThis.test("does not contain its input", () => {
+    globalThis.expect(Stdlib_Result.getOr(Secrets_Node_Backend$ReventlessCore.provider.hash("a-secret"), "").includes("a-secret")).toBe(false);
+  });
+});
+
+globalThis.describe("Capabilities.none.secrets", () => {
+  globalThis.test("refuses both operations", () => {
+    globalThis.expect([
+      Stdlib_Result.isError(Capabilities$Reventless.none.secrets.randomToken(32, "UrlSafe")),
+      Stdlib_Result.isError(Capabilities$Reventless.none.secrets.hash("x"))
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+});
+
+globalThis.describe("Secrets.fixed", () => {
+  let provider = Secrets$Reventless.fixed("known", input => `hashed:` + input);
+  globalThis.test("hands back the token it was built with", () => {
+    globalThis.expect(provider.randomToken(32, "UrlSafe")).toEqual({
+      TAG: "Ok",
+      _0: "known"
+    });
+  });
+  globalThis.test("hashes through the function it was given", () => {
+    globalThis.expect(provider.hash("known")).toEqual({
+      TAG: "Ok",
+      _0: "hashed:known"
+    });
+  });
+});
+
+let Secrets;
+
+let Backend;
+
+export {
+  Secrets,
+  Backend,
+  token,
+}
+/*  Not a pure module */

package/tests/adapter/RuntimeExtensionHookReachTest.res.mjs

@@ -22,7 +22,7 @@ async function publishJsons(cmds) {
   published.contents = published.contents.concat(cmds);
 }
 
-let generateCommand = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(publishJsons, undefined, "Product", commandSchema, "StateChangeSlice", false);
+let generateCommand = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(publishJsons, undefined, "Product", commandSchema, "StateChangeSlice", false, undefined);
 
 function addChair() {
   return {