@reventlessdev/reventless-core 3.0.0-alpha.284 → 3.0.0-alpha.286

package/src/components/StateChangeSlice/StateChangeSlice_Callback.res

@@ -102,6 +102,13 @@ module Make = (
     ~eventSchema=Spec.eventSchema,
   )
 
+  // The consumed events whose `@owner` field names who owns what a command acts
+  // on, read off the slice's own schema. Empty for a slice that marks none.
+  let ownerFieldsByEventType = Reventless.Owner.fieldNamesByVariant(
+    Spec.consumedEventSchema->S.castToUnknown,
+  )
+  let actsOnOwned = ownerFieldsByEventType->Dict.keysToArray->Array.length > 0
+
   // Extracts the entity id of a read event from its own tags, for logging
   // which events the decision model was built from. Prefers this slice's
   // partition key, but consumed events from other sources are tagged by their
@@ -153,9 +160,11 @@ module Make = (
   // Capacity is fixed at 100 entries; a per-slice knob is a future refinement
   // (see the plan's Step 4).
   let projectionCacheCapacity = 100
+  // The owners folded so far ride along with the state: a delta read never
+  // sees the event that recorded them.
   let projectionCache: Lru.t<
     string,
-    (Behavior.state, option<Reventless.DcbTag.sequencePosition>),
+    (Behavior.state, option<Reventless.DcbTag.sequencePosition>, array<string>),
   > = Lru.make(~capacity=projectionCacheCapacity)
 
   let resetCache = () => projectionCache->Lru.clear
@@ -227,6 +236,30 @@ module Make = (
     | Some(ByEventType(_)) | None => None
     }
 
+    // The owner fields of a read event, when it lies in this command's own
+    // partition. A cross-partition read (a catalog product) never says who owns
+    // the thing the command acts on, even if its event marks an owner.
+    let ownerFieldsOf = (raw: ReventlessInfra.DcbEventLog.rawSequencedEvent) =>
+      switch (partitionTag, entityId) {
+      | (Some(pt), Some(eid))
+        if actsOnOwned && raw.tags->Reventless.DcbTag.partitionValueOfTags(pt) == eid =>
+        ownerFieldsByEventType->Dict.get(raw.eventType)->Option.getOr([])
+      | _ => []
+      }
+
+    // Before `decide`: an owner-marked slice refuses a caller who does not own
+    // the partition. `None` lets `decide` run.
+    let ownershipRefusal = (owners: array<string>) =>
+      actsOnOwned
+        ? Reventless.OwnerScope.decideActing(
+            ~claim=command'.meta.callerClaim,
+            ~recordedOwners=entityId->Option.map(_ => owners),
+          )->CommandTopic_Helpers.ownershipRefusal(
+            ~component=Spec.name,
+            ~command=cmdJson.commandJson->Message.variantNameOfJson,
+          )
+        : None
+
     // Fail closed: a query that can't be serialized yields `None`, not the empty
     // string. The old `""` fallback made every unserializable query collide on
     // one shared cache slot, so one slice's folded state could seed another's —
@@ -268,9 +301,9 @@ module Make = (
     )
 
     let rec attempt = (~retries) => {
-      let (baseState, afterPos) = switch seed.contents {
-      | Some((state, head)) => (state, head)
-      | None => (Behavior.initialState, None)
+      let (baseState, afterPos, baseOwners) = switch seed.contents {
+      | Some((state, head, owners)) => (state, head, owners)
+      | None => (Behavior.initialState, None, [])
       }
       let cacheHit = seed.contents->Option.isSome
 
@@ -291,15 +324,14 @@ module Make = (
 
       dcbEventLog.readStream(~query, ~after=?afterPos, ~strongConsistency)
       ->Stream.map(raw => {
-        let decoded = decoder.decode(
-          ~eventType=raw.eventType,
-          ~data=raw.data->JSON.Decode.object->Option.getOr(Dict.make()),
-        )
+        let data = raw.data->JSON.Decode.object->Option.getOr(Dict.make())
+        let decoded = decoder.decode(~eventType=raw.eventType, ~data)
         decoded->Option.map(event => (
           event,
           raw.position,
           raw.eventType,
           readEventId(~partitionTag, raw.tags),
+          (ownerFieldsOf(raw), data),
         ))
       })
       ->Stream.flatMap(opt =>
@@ -311,9 +343,9 @@ module Make = (
       // The head accumulator starts at `afterPos` (the seeded head), not `None`,
       // so an empty delta read keeps the cached head — the append must condition
       // on the head that actually exists, not assert "no events exist yet".
-      ->Stream.runFold((baseState, afterPos, []), (
-        (dm, _pos, reads),
-        (event, position, eventType, eventId),
+      ->Stream.runFold((baseState, afterPos, [], baseOwners), (
+        (dm, _pos, reads, owners),
+        (event, position, eventType, eventId, (ownerFields, data)),
       ) => (
         Behavior.evolve(dm, event),
         Some(position),
@@ -323,8 +355,9 @@ module Make = (
           | None => eventType->LogFormat.bold
           },
         ]),
+        owners->Reventless.OwnerScope.recordOwners(~fields=ownerFields, data),
       ))
-      ->Effect.tap(((_, _, reads)) => {
+      ->Effect.tap(((_, _, reads, _)) => {
         // On a warm first attempt, record how many events the delta read
         // returned — near-zero on a healthy hit; a large value means the entity
         // churned between commands, so the cache saved little. Gated to the first
@@ -347,7 +380,7 @@ module Make = (
               : ` [${reads->Array.join(", ")}]`}`,
         )
       })
-      ->Effect.flatMap(((state, headPosition, _)) =>
+      ->Effect.flatMap(((state, headPosition, _, owners)) =>
         // Identity, not content: the decision model folds the whole matched
         // history, so serialising it here makes the line's size a function of
         // how long the entity has been in use.
@@ -357,143 +390,160 @@ module Make = (
               "-",
             )} cmd=${cmdJson->LogFormat.cmdName}`,
         )->Effect.flatMap(_ =>
-          switch Behavior.decide(state, command'.command) {
-          | Ok(newEvents) if newEvents->Array.length == 0 =>
-            // No append, but the read snapshot is valid — cache it for the next command.
-            cachePut((state, headPosition))
-            CommandTopic_Helpers.reportAccepted(
+          switch ownershipRefusal(owners) {
+          | Some({rejected, isDefect}) =>
+            // Refused before `decide`; the read snapshot is still valid.
+            cachePut((state, headPosition, owners))
+            CommandTopic_Helpers.reportRejected(
               ~component=Spec.name,
+              ~cause=AccessRefusal,
               cmdJson.meta.msgId,
-              switch entityId {
-              | Some(eid) => {entityId: eid, eventCount: 0}
-              | None => {eventCount: 0}
-              },
+              rejected,
             )
-            EffectLogger.logInfo(~comp, "no events produced")->Effect.map(_ => Ok("ok"))
-          | Ok(newEvents) =>
-            let rawEvents =
-              newEvents->Array.map(
-                e => encodeEvent(~parentMeta=command'.meta, ~tagKeysByEventType, e),
-              )
-            let eventCount = rawEvents->Array.length->Int.toString
-            let eventDetails =
-              rawEvents
-              ->Array.map(
-                e => {
-                  let fields = switch e.data {
-                  | Object(dict) =>
-                    let f =
-                      dict
-                      ->Dict.toArray
-                      ->Array.map(((k, v)) => `${k}:${v->JSON.stringify}`)
-                      ->Array.join(",")
-                    f == "" ? "" : `({${f}})`
-                  | _ => ""
-                  }
-                  `${LogFormat.bold(e.eventType)}${fields}`
+            let line = `refused: ${rejected.errorDetail} id=${entityId->Option.getOr("-")}`
+
+            (
+              isDefect ? EffectLogger.logError(~comp, line) : EffectLogger.logWarn(~comp, line)
+            )->Effect.map(_ => Ok("rejected"))
+          | None =>
+            switch Behavior.decide(state, command'.command) {
+            | Ok(newEvents) if newEvents->Array.length == 0 =>
+              // No append, but the read snapshot is valid — cache it for the next command.
+              cachePut((state, headPosition, owners))
+              CommandTopic_Helpers.reportAccepted(
+                ~component=Spec.name,
+                cmdJson.meta.msgId,
+                switch entityId {
+                | Some(eid) => {entityId: eid, eventCount: 0}
+                | None => {eventCount: 0}
                 },
               )
-              ->Array.join(", ")
-            let eventJsons = rawEvents->Array.map(e => e.data)->JSON.Encode.array
-            let condition: Reventless.DcbTag.appendCondition = {
-              query,
-              after: ?headPosition,
-            }
-            EffectLogger.logInfo(
-              ~comp,
-              ~detail=eventJsons,
-              `produced ${eventCount} event(s): [${eventDetails}]`,
-            )
-            ->Effect.flatMap(_ => Effect.promise(() => dcbEventLog.append(rawEvents, ~condition)))
-            ->Effect.flatMap(
-              appendResult =>
-                switch appendResult {
-                | Ok(_position) =>
-                  // Cache the decided-on state at the read head (NOT including the
-                  // events we just appended, and NOT the returned position): the
-                  // next command's delta read picks our events up from `headPosition`.
-                  cachePut((state, headPosition))
-                  CommandTopic_Helpers.reportAccepted(
-                    ~component=Spec.name,
-                    cmdJson.meta.msgId,
-                    switch entityId {
-                    | Some(eid) => {entityId: eid, eventCount: rawEvents->Array.length}
-                    | None => {eventCount: rawEvents->Array.length}
-                    },
-                  )
-                  EffectLogger.logInfo(~comp, `append: ${eventCount} event(s)`)->Effect.map(
-                    _ => Ok("ok"),
-                  )
-                | Error(err) =>
-                  // Typed classification (was substring-matching the error string,
-                  // which disagreed with the backends' casing).
-                  let (errorCode, errDetail) = switch err {
-                  | ReventlessInfra.DcbEventLog.Conflict => (
-                      "Conflict",
-                      "conflict: condition check failed",
-                    )
-                  | StorageFailure(msg) => ("AppendFailed", msg)
-                  }
-                  if retries > 0 {
-                    // Re-seed from the just-read snapshot so the retry reads only
-                    // the delta the conflicting writer added, not full history.
-                    seed := Some((state, headPosition))
-                    // Per-slice CloudWatch counter: rising AppendRetry signals a
-                    // slice feeling contention (the metric to watch the eventual
-                    // default with — see dcb-high-contention-handling.md).
-                    Metrics.emitCount(~metric="AppendRetry", ~slice=Spec.name)
-                    EffectLogger.logWarn(
-                      ~comp,
-                      `append failed (retrying ${(maxRetries - retries + 1)
-                          ->Int.toString}/${maxRetries->Int.toString}): ${errDetail}`,
-                    )->Effect.flatMap(_ => attempt(~retries=retries - 1))
-                  } else {
-                    // Retries exhausted — drop any cached snapshot so the next
-                    // command for this entity takes the cold full-read path.
-                    cacheInvalidate()
-
-                    // A surfaced Conflict means the 3-retry loop could not absorb
-                    // the contention — the operator signal for "this slice is hot"
-                    // (consider sharding / async — Issue 10, §4 of the analysis).
-                    if errorCode == "Conflict" {
-                      Metrics.emitCount(~metric="AppendConflict", ~slice=Spec.name)
+              EffectLogger.logInfo(~comp, "no events produced")->Effect.map(_ => Ok("ok"))
+            | Ok(newEvents) =>
+              let rawEvents =
+                newEvents->Array.map(
+                  e => encodeEvent(~parentMeta=command'.meta, ~tagKeysByEventType, e),
+                )
+              let eventCount = rawEvents->Array.length->Int.toString
+              let eventDetails =
+                rawEvents
+                ->Array.map(
+                  e => {
+                    let fields = switch e.data {
+                    | Object(dict) =>
+                      let f =
+                        dict
+                        ->Dict.toArray
+                        ->Array.map(((k, v)) => `${k}:${v->JSON.stringify}`)
+                        ->Array.join(",")
+                      f == "" ? "" : `({${f}})`
+                    | _ => ""
                     }
-                    // Both arms here are storage, not the model: a surfaced Conflict is
-                    // contention the retry loop couldn't absorb, and AppendFailed is the
-                    // store failing. `decide` had already said Ok.
-                    CommandTopic_Helpers.reportRejected(
+                    `${LogFormat.bold(e.eventType)}${fields}`
+                  },
+                )
+                ->Array.join(", ")
+              let eventJsons = rawEvents->Array.map(e => e.data)->JSON.Encode.array
+              let condition: Reventless.DcbTag.appendCondition = {
+                query,
+                after: ?headPosition,
+              }
+              EffectLogger.logInfo(
+                ~comp,
+                ~detail=eventJsons,
+                `produced ${eventCount} event(s): [${eventDetails}]`,
+              )
+              ->Effect.flatMap(_ => Effect.promise(() => dcbEventLog.append(rawEvents, ~condition)))
+              ->Effect.flatMap(
+                appendResult =>
+                  switch appendResult {
+                  | Ok(_position) =>
+                    // Cache the decided-on state at the read head (NOT including the
+                    // events we just appended, and NOT the returned position): the
+                    // next command's delta read picks our events up from `headPosition`.
+                    cachePut((state, headPosition, owners))
+                    CommandTopic_Helpers.reportAccepted(
                       ~component=Spec.name,
-                      ~cause=InfrastructureFailure,
                       cmdJson.meta.msgId,
-                      {errorCode, errorDetail: errDetail},
+                      switch entityId {
+                      | Some(eid) => {entityId: eid, eventCount: rawEvents->Array.length}
+                      | None => {eventCount: rawEvents->Array.length}
+                      },
                     )
-                    EffectLogger.logError(
-                      ~comp,
-                      `append failed, retries exhausted: ${errDetail}`,
-                    )->Effect.map(_ => Error(errDetail))
-                  }
-                },
-            )
-          | Error(error) =>
-            // Business-rule rejection — no append, but the read snapshot is valid; cache it.
-            cachePut((state, headPosition))
-            let errorJson = error->Reventless.Util_Sury.toJson(Spec.errorSchema)
-            let errorCode = errorJson->Message.variantNameOfJson
-            let (_, payloadDict) = errorJson->Message.splitMessage
-            let errorDetail =
-              payloadDict->Dict.toArray->Array.length == 0
-                ? ""
-                : payloadDict->JSON.Encode.object->JSON.stringify
-            CommandTopic_Helpers.reportRejected(
-              ~component=Spec.name,
-              ~cause=DomainRejection,
-              cmdJson.meta.msgId,
-              {errorCode, errorDetail},
-            )
-            EffectLogger.logError(
-              ~comp,
-              `decide rejected: ${errorCode} ${errorDetail}`,
-            )->Effect.map(_ => Ok("rejected"))
+                    EffectLogger.logInfo(~comp, `append: ${eventCount} event(s)`)->Effect.map(
+                      _ => Ok("ok"),
+                    )
+                  | Error(err) =>
+                    // Typed classification (was substring-matching the error string,
+                    // which disagreed with the backends' casing).
+                    let (errorCode, errDetail) = switch err {
+                    | ReventlessInfra.DcbEventLog.Conflict => (
+                        "Conflict",
+                        "conflict: condition check failed",
+                      )
+                    | StorageFailure(msg) => ("AppendFailed", msg)
+                    }
+                    if retries > 0 {
+                      // Re-seed from the just-read snapshot so the retry reads only
+                      // the delta the conflicting writer added, not full history.
+                      seed := Some((state, headPosition, owners))
+                      // Per-slice CloudWatch counter: rising AppendRetry signals a
+                      // slice feeling contention (the metric to watch the eventual
+                      // default with — see dcb-high-contention-handling.md).
+                      Metrics.emitCount(~metric="AppendRetry", ~slice=Spec.name)
+                      EffectLogger.logWarn(
+                        ~comp,
+                        `append failed (retrying ${(maxRetries - retries + 1)
+                            ->Int.toString}/${maxRetries->Int.toString}): ${errDetail}`,
+                      )->Effect.flatMap(_ => attempt(~retries=retries - 1))
+                    } else {
+                      // Retries exhausted — drop any cached snapshot so the next
+                      // command for this entity takes the cold full-read path.
+                      cacheInvalidate()
+
+                      // A surfaced Conflict means the 3-retry loop could not absorb
+                      // the contention — the operator signal for "this slice is hot"
+                      // (consider sharding / async — Issue 10, §4 of the analysis).
+                      if errorCode == "Conflict" {
+                        Metrics.emitCount(~metric="AppendConflict", ~slice=Spec.name)
+                      }
+                      // Both arms here are storage, not the model: a surfaced Conflict is
+                      // contention the retry loop couldn't absorb, and AppendFailed is the
+                      // store failing. `decide` had already said Ok.
+                      CommandTopic_Helpers.reportRejected(
+                        ~component=Spec.name,
+                        ~cause=InfrastructureFailure,
+                        cmdJson.meta.msgId,
+                        {errorCode, errorDetail: errDetail},
+                      )
+                      EffectLogger.logError(
+                        ~comp,
+                        `append failed, retries exhausted: ${errDetail}`,
+                      )->Effect.map(_ => Error(errDetail))
+                    }
+                  },
+              )
+            | Error(error) =>
+              // Business-rule rejection — no append, but the read snapshot is valid; cache it.
+              cachePut((state, headPosition, owners))
+              let errorJson = error->Reventless.Util_Sury.toJson(Spec.errorSchema)
+              let errorCode = errorJson->Message.variantNameOfJson
+              let (_, payloadDict) = errorJson->Message.splitMessage
+              let errorDetail =
+                payloadDict->Dict.toArray->Array.length == 0
+                  ? ""
+                  : payloadDict->JSON.Encode.object->JSON.stringify
+              CommandTopic_Helpers.reportRejected(
+                ~component=Spec.name,
+                ~cause=DomainRejection,
+                cmdJson.meta.msgId,
+                {errorCode, errorDetail},
+              )
+              EffectLogger.logError(
+                ~comp,
+                `decide rejected: ${errorCode} ${errorDetail}`,
+              )->Effect.map(_ => Ok("rejected"))
+            }
           }
         )
       )

package/src/components/StateChangeSlice/StateChangeSlice_Callback.res.mjs

@@ -8,10 +8,12 @@ import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stream$1 from "effect/Stream";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Lru$ReventlessCore from "../../util/Lru.res.mjs";
 import * as DcbDecode$Reventless from "@reventlessdev/reventless-spec/src/components/DcbDecode.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Message$ReventlessCore from "../../Message.res.mjs";
 import * as Metrics$ReventlessCore from "../../util/Metrics.res.mjs";
 import * as LogFormat$ReventlessCore from "../../util/LogFormat.res.mjs";
@@ -37,6 +39,8 @@ function Make(Spec) {
       }
     });
     let scopeShape = DcbTag$Reventless.sliceShapeFromSchemas(Spec.name, Spec.commandSchema, Spec.consumedEventSchema, Spec.eventSchema, undefined);
+    let ownerFieldsByEventType = Owner$Reventless.fieldNamesByVariant(Spec.consumedEventSchema);
+    let actsOnOwned = Object.keys(ownerFieldsByEventType).length !== 0;
     let readEventId = (partitionTag, tags) => {
       let ownTagValues = () => {
         let vals = Stdlib_Array.reduce(tags, [], (acc, t) => {
@@ -104,6 +108,26 @@ function Make(Spec) {
       } else {
         entityId = undefined;
       }
+      let ownerFieldsOf = raw => {
+        if (partitionTag !== undefined) {
+          if (entityId !== undefined) {
+            if (actsOnOwned && DcbTag$Reventless.partitionValueOfTags(raw.tags, partitionTag) === entityId) {
+              return Stdlib_Option.getOr(ownerFieldsByEventType[raw.eventType], []);
+            } else {
+              return [];
+            }
+          } else {
+            return [];
+          }
+        } else {
+          return [];
+        }
+      };
+      let ownershipRefusal = owners => {
+        if (actsOnOwned) {
+          return CommandTopic_Helpers$ReventlessCore.ownershipRefusal(OwnerScope$Reventless.decideActing(command$p.meta.callerClaim, Stdlib_Option.map(entityId, param => owners)), Spec.name, Message$ReventlessCore.variantNameOfJson(cmdJson.commandJson));
+        }
+      };
       let cacheKey = JSON.stringify(query);
       let cacheGet = () => {
         if (cacheKey !== undefined) {
@@ -128,10 +152,12 @@ function Make(Spec) {
         let match = seed.contents;
         let match$1 = match !== undefined ? [
             match[0],
-            match[1]
+            match[1],
+            match[2]
           ] : [
             Behavior.initialState,
-            undefined
+            undefined,
+            []
           ];
         let afterPos = match$1[1];
         let cacheHit = Stdlib_Option.isSome(seed.contents);
@@ -148,12 +174,17 @@ function Make(Spec) {
             break;
         }
         return Effect.flatMap(Effect.tap(Stream$1.runFold(Stream$1.flatMap(Stream$1.map(dcbEventLog.readStream(query, afterPos, strongConsistency), raw => {
-          let decoded = decoder.decode(raw.eventType, Stdlib_Option.getOr(Stdlib_JSON.Decode.object(raw.data), {}));
+          let data = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(raw.data), {});
+          let decoded = decoder.decode(raw.eventType, data);
           return Stdlib_Option.map(decoded, event => [
             event,
             raw.position,
             raw.eventType,
-            readEventId(partitionTag, raw.tags)
+            readEventId(partitionTag, raw.tags),
+            [
+              ownerFieldsOf(raw),
+              data
+            ]
           ]);
         }), opt => {
           if (opt !== undefined) {
@@ -164,14 +195,17 @@ function Make(Spec) {
         }), [
           match$1[0],
           afterPos,
-          []
+          [],
+          match$1[2]
         ], (param, param$1) => {
+          let match = param$1[4];
           let eventId = param$1[3];
           let eventType = param$1[2];
           return [
             Behavior.evolve(param[0], param$1[0]),
             param$1[1],
-            param[2].concat([eventId !== undefined ? LogFormat$ReventlessCore.bold(eventType) + `(` + eventId + `)` : LogFormat$ReventlessCore.bold(eventType)])
+            param[2].concat([eventId !== undefined ? LogFormat$ReventlessCore.bold(eventType) + `(` + eventId + `)` : LogFormat$ReventlessCore.bold(eventType)]),
+            OwnerScope$Reventless.recordOwners(param[3], match[0], match[1])
           ];
         }), param => {
           let reads = param[2];
@@ -184,16 +218,33 @@ function Make(Spec) {
             reads.length === 0 ? "" : ` [` + reads.join(", ") + `]`
           ));
         }), param => {
+          let owners = param[3];
           let headPosition = param[1];
           let state = param[0];
           return Effect.flatMap(EffectLogger$ReventlessCore.logDebug(comp, undefined, `deciding: id=` + Stdlib_Option.getOr(entityId, "-") + ` head=` + Stdlib_Option.getOr(headPosition, "-") + ` cmd=` + LogFormat$ReventlessCore.cmdName(cmdJson)), () => {
+            let match = ownershipRefusal(owners);
+            if (match !== undefined) {
+              let rejected = match.rejected;
+              cachePut([
+                state,
+                headPosition,
+                owners
+              ]);
+              CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "AccessRefusal", cmdJson.meta.msgId, rejected);
+              let line = `refused: ` + rejected.errorDetail + ` id=` + Stdlib_Option.getOr(entityId, "-");
+              return Effect.map(match.isDefect ? EffectLogger$ReventlessCore.logError(comp, undefined, line) : EffectLogger$ReventlessCore.logWarn(comp, undefined, line), () => ({
+                TAG: "Ok",
+                _0: "rejected"
+              }));
+            }
             let newEvents = Behavior.decide(state, command$p.command);
             if (newEvents.TAG === "Ok") {
               let newEvents$1 = newEvents._0;
               if (newEvents$1.length === 0) {
                 cachePut([
                   state,
-                  headPosition
+                  headPosition,
+                  owners
                 ]);
                 CommandTopic_Helpers$ReventlessCore.reportAccepted(Spec.name, cmdJson.meta.msgId, entityId !== undefined ? ({
                     entityId: entityId,
@@ -243,7 +294,8 @@ function Make(Spec) {
                 if (appendResult.TAG === "Ok") {
                   cachePut([
                     state,
-                    headPosition
+                    headPosition,
+                    owners
                   ]);
                   CommandTopic_Helpers$ReventlessCore.reportAccepted(Spec.name, cmdJson.meta.msgId, entityId !== undefined ? ({
                       entityId: entityId,
@@ -270,7 +322,8 @@ function Make(Spec) {
                 if (retries > 0) {
                   seed.contents = [
                     state,
-                    headPosition
+                    headPosition,
+                    owners
                   ];
                   Metrics$ReventlessCore.emitCount("AppendRetry", Spec.name, undefined);
                   return Effect.flatMap(EffectLogger$ReventlessCore.logWarn(comp, undefined, `append failed (retrying ` + ((3 - retries | 0) + 1 | 0).toString() + `/` + (3).toString() + `): ` + errDetail), () => attempt(retries - 1 | 0));
@@ -292,12 +345,13 @@ function Make(Spec) {
             }
             cachePut([
               state,
-              headPosition
+              headPosition,
+              owners
             ]);
             let errorJson = Util_Sury$Reventless.toJson(newEvents._0, Spec.errorSchema);
             let errorCode = Message$ReventlessCore.variantNameOfJson(errorJson);
-            let match = Message$ReventlessCore.splitMessage(errorJson);
-            let payloadDict = match[1];
+            let match$1 = Message$ReventlessCore.splitMessage(errorJson);
+            let payloadDict = match$1[1];
             let errorDetail = Object.entries(payloadDict).length === 0 ? "" : JSON.stringify(payloadDict);
             CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "DomainRejection", cmdJson.meta.msgId, {
               errorCode: errorCode,

package/src/components/StateViewSlice/StateViewSlice_Builder.res

@@ -33,6 +33,7 @@ module Make = (
       let stateSchema = Spec.stateSchema
       let config = Spec.config
       let subIdConfig = Spec.subIdConfig
+      type role = Spec.role
       let authorization = Spec.authorization
       let visibility = Spec.visibility
     }

package/src/plugin/api/PluginBaseFragment.res

@@ -38,7 +38,7 @@ let queryEntries: array<querySchemaEntry> = [
     // read: the entry path uses only the group, and the per-`@index` auth-table
     // pipeline params come from `indexConfig.authorization`, which is untouched.
     authorization: None,
-    permission: PluginsReadModelSpec.authorization,
+    permission: PluginsReadModelSpec.authorization->Reventless.Authorization.named,
     // No `excludeFields`: the three fields this entry used to name are declared
     // `@internal` on the spec, and `deriveObjectTypeWithNested` reads that off the
     // schema itself.

package/src/plugin/api/PluginBaseFragment.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.mjs";
 import * as PluginSpec$ReventlessCore from "../lifecycle/PluginSpec.res.mjs";
 import * as ApiNoApiHelpers$ReventlessCore from "../../components/Api/ApiNoApiHelpers.res.mjs";
@@ -20,7 +21,7 @@ let queryEntries = [{
     stateSchema: PluginsReadModelSpec$ReventlessCore.stateSchema,
     specName: PluginsReadModelSpec$ReventlessCore.name,
     authorization: undefined,
-    permission: PluginsReadModelSpec$ReventlessCore.authorization,
+    permission: Authorization$Reventless.named(PluginsReadModelSpec$ReventlessCore.authorization),
     subIdField: Stdlib_Option.map(undefined, c => c.subIdField),
     indexQueries: indexQueriesOfConfig(PluginsReadModelSpec$ReventlessCore.config)
   }];

package/src/plugin/component/Plugin_Builder.res

@@ -214,7 +214,8 @@ module Make = (
                 ~kind=Aggregate,
                 ~fields=fieldNames,
                 ~commandSchema,
-                ~commandAuthorization=M.Spec.commandAuthorization->Obj.magic,
+                ~commandAuthorization=command =>
+                  M.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
               )
             )
             let aggDef =
@@ -235,7 +236,8 @@ module Make = (
                 cname,
               )
               let syntheticCmd: unknown = hasPayload ? {"TAG": cname}->Obj.magic : cname->Obj.magic
-              let rule = M.Spec.commandAuthorization(syntheticCmd->Obj.magic)
+              let rule =
+                M.Spec.commandAuthorization(syntheticCmd->Obj.magic)->Reventless.Authorization.named
               fieldPermissions->Dict.set(fieldName, rule)
             })
             [
@@ -272,7 +274,7 @@ module Make = (
           returnTypeName: qn.returnTypeName,
           stateSchema: R.Spec.stateSchema->S.castToUnknown,
           authorization: None,
-          permission: R.Spec.authorization,
+          permission: R.Spec.authorization->Reventless.Authorization.named,
           connectionSpec: true,
           ?subIdField,
           indexQueries: ?(indexes->Array.length > 0 ? Some(indexes) : None),
@@ -1149,6 +1151,8 @@ module Make = (
     ~opts=?,
   ) => {
     PluginRuntimeBuilder.registerPluginName(name)
+    // Here, outside any `Output.apply`, so a preview refuses the plugin too.
+    pluginStructure->Option.forEach(s => Reventless.RoleCoverage.check(s, ~plugin=name))
     let version = Reventless.PackageVersion.fromCaller()
     Component.make(
       ~componentType=Plugin.componentType->ComponentType.toString,