@reventlessdev/reventless-core 3.0.0-alpha.292 → 3.0.0-alpha.293

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.293 (2026-10-10)
+
+* feat!: a command's rule is looked up by its name, without a cast ([5f02c40](https://github.com/ReventlessDev/reventless-core/commit/5f02c4081d077bf4a6951d8c9b2b16553a8ca87b))
+
+### BREAKING CHANGES
+
+* a spec that writes `commandAuthorization` by hand writes
+`authorizationOf = (name: string) => …` instead; the PPX refuses the old name.
+
+
+
 # 3.0.0-alpha.292 (2026-10-10)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.292",
+  "version": "3.0.0-alpha.293",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,22 +28,22 @@
   "dependencies": {
     "sury": "11.0.0",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.22",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.189",
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.23",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.39",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.161",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.23"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.162",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.190"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.98"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.99"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/admin/Platform_Admin_Structure.res

@@ -37,8 +37,7 @@ let pluginCommands: array<commandDef> = Plugin_Structure.extractCommandDefs(
   ~isAggregate=true,
   ~mutationFieldFor=variantName =>
     Api_Naming.adminField(~name=PluginSpec.name ++ "_" ++ variantName),
-  ~commandAuthorization=command =>
-    PluginSpec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
+  ~authorizationOf=name => PluginSpec.authorizationOf(name)->Reventless.Authorization.named,
   ~commandTransition=PluginSpec.commandTransition->Obj.magic,
   commandSchema,
 )

package/src/admin/Platform_Admin_Structure.res.mjs

@@ -8,7 +8,7 @@ import * as PluginsReadModelSpec$ReventlessCore from "../plugin/lifecycle/Plugin
 
 let pluginId = "Platform";
 
-let pluginCommands = Plugin_Structure$ReventlessCore.extractCommandDefs(undefined, true, undefined, variantName => Api_Naming$ReventlessCore.adminField(PluginSpec$ReventlessCore.name + "_" + variantName), command => Authorization$Reventless.named(PluginSpec$ReventlessCore.commandAuthorization(command)), PluginSpec$ReventlessCore.commandTransition, undefined, PluginSpec$ReventlessCore.commandSchema);
+let pluginCommands = Plugin_Structure$ReventlessCore.extractCommandDefs(undefined, true, undefined, variantName => Api_Naming$ReventlessCore.adminField(PluginSpec$ReventlessCore.name + "_" + variantName), name => Authorization$Reventless.named(PluginSpec$ReventlessCore.authorizationOf(name)), PluginSpec$ReventlessCore.commandTransition, undefined, PluginSpec$ReventlessCore.commandSchema);
 
 let pluginAggregate_producedEventTypes = [];
 

package/src/admin/UiFragmentRegistry/StateChange/UiFragmentRegistry.res.mjs

@@ -42,7 +42,7 @@ let eventSchema = Sury.union([
 
 let commandSchema$1 = Api$ReventlessInfra.markNoApi(commandSchema);
 
-function commandAuthorization(param) {
+function authorizationOf(param) {
   return "AllowAuthenticated";
 }
 
@@ -70,7 +70,7 @@ export {
   consumedEventSchema,
   commandSchema$1 as commandSchema,
   moduleUrl,
-  commandAuthorization,
+  authorizationOf,
   readConsistency,
   commandTransition,
   traits,

package/src/components/Dcb/Dcb_Builder.res

@@ -92,11 +92,11 @@ let emptyResult: dcbResult = {
 // An inbound slice's door rule, read off its spec.
 let inboundDoorPermission = (
   commandSchema: S.t<'command>,
-  commandAuthorization: 'command => Reventless.Authorization.rule<'role>,
+  authorizationOf: string => Reventless.Authorization.rule<'role>,
 ) =>
   Plugin_Structure.inboundDoorPermission(
     ~commandSchema=commandSchema->S.castToUnknown,
-    ~commandAuthorization=cmd => cmd->commandAuthorization->Reventless.Authorization.named,
+    ~authorizationOf=name => name->authorizationOf->Reventless.Authorization.named,
   )
 
 module Make = (
@@ -544,8 +544,7 @@ module Make = (
                 ~commandSchema,
               )->Array.map(((f, _)) => f),
               ~commandSchema,
-              ~commandAuthorization=command =>
-                S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
+              ~authorizationOf=name => S.Spec.authorizationOf(name)->Reventless.Authorization.named,
             )
           }
         })
@@ -560,8 +559,7 @@ module Make = (
                 ~commandSchema,
               )->Array.map(((f, _)) => f),
               ~commandSchema,
-              ~commandAuthorization=command =>
-                S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
+              ~authorizationOf=name => S.Spec.authorizationOf(name)->Reventless.Authorization.named,
             )
           }
         })
@@ -759,10 +757,7 @@ module Make = (
             registerResolver(
               ~fieldName,
               ~externalInputSchema=ITS.Spec.externalInputSchema->S.castToUnknown,
-              ~permission=?inboundDoorPermission(
-                ITS.Spec.commandSchema,
-                ITS.Spec.commandAuthorization,
-              ),
+              ~permission=?inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf),
             )
           | None => ()
           }
@@ -1066,17 +1061,13 @@ module Make = (
               )
             // One SDL field per constructor, each with its own constructor's args and
             // its own per-constructor authorization rule.
-            let commandAuthorization: unknown => Reventless.Authorization.permission = command =>
-              S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named
             let fieldPermissions = Dict.make()
-            fieldSpecs->Array.forEach(((fieldName, ctor)) => {
-              let hasPayload = Reventless.DcbTag.isVariantPayloadBearing(
-                commandSchema->Obj.magic,
-                ctor,
+            fieldSpecs->Array.forEach(((fieldName, ctor)) =>
+              fieldPermissions->Dict.set(
+                fieldName,
+                S.Spec.authorizationOf(ctor)->Reventless.Authorization.named,
               )
-              let syntheticCmd: unknown = hasPayload ? {"TAG": ctor}->Obj.magic : ctor->Obj.magic
-              fieldPermissions->Dict.set(fieldName, commandAuthorization(syntheticCmd))
-            })
+            )
             Some({
               ReventlessInfra.Api.fieldNames: fieldSpecs->Array.map(((f, _)) => f),
               commandSchema,
@@ -1098,7 +1089,7 @@ module Make = (
           let fieldPermissions = Dict.make()
           inboundDoorPermission(
             ITS.Spec.commandSchema,
-            ITS.Spec.commandAuthorization,
+            ITS.Spec.authorizationOf,
           )->Option.forEach(rule => fieldPermissions->Dict.set(fieldName, rule))
           {
             ReventlessInfra.Api.fieldNames: [fieldName],

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -118,8 +118,8 @@ let emptyResult = {
   eventLogEntries: emptyResult_eventLogEntries
 };
 
-function inboundDoorPermission(commandSchema, commandAuthorization) {
-  return Plugin_Structure$ReventlessCore.inboundDoorPermission(commandSchema, cmd => Authorization$Reventless.named(commandAuthorization(cmd)));
+function inboundDoorPermission(commandSchema, authorizationOf) {
+  return Plugin_Structure$ReventlessCore.inboundDoorPermission(commandSchema, name => Authorization$Reventless.named(authorizationOf(name)));
 }
 
 function Make(DcbEventLogStorage) {
@@ -295,13 +295,13 @@ function Make(DcbEventLogStorage) {
         syncSlices.forEach(S => {
           let commandSchema = S.Spec.commandSchema;
           if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
-            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, command => Authorization$Reventless.named(S.Spec.commandAuthorization(command)));
+            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, name => Authorization$Reventless.named(S.Spec.authorizationOf(name)));
           }
         });
         asyncSlices.forEach(S => {
           let commandSchema = S.Spec.commandSchema;
           if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
-            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, command => Authorization$Reventless.named(S.Spec.commandAuthorization(command)));
+            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, name => Authorization$Reventless.named(S.Spec.authorizationOf(name)));
           }
         });
       }
@@ -397,7 +397,7 @@ function Make(DcbEventLogStorage) {
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
         let registerResolver = HooksConfig.hooks.inboundMutationResolverHook;
         if (registerResolver !== undefined) {
-          registerResolver(fieldName, ITS.Spec.externalInputSchema, inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.commandAuthorization));
+          registerResolver(fieldName, ITS.Spec.externalInputSchema, inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf));
         }
         let bindReceive = HooksConfig.hooks.inboundMutationBindReceiveHook;
         if (bindReceive !== undefined) {
@@ -554,12 +554,7 @@ function Make(DcbEventLogStorage) {
         let sliceDef = Stdlib_Option.flatMap(pluginStructure, s => s.stateChangeSlices.find(d => d.name === S.Spec.name));
         let fieldPermissions = {};
         fieldSpecs.forEach(param => {
-          let ctor = param[1];
-          let hasPayload = DcbTag$Reventless.isVariantPayloadBearing(commandSchema, ctor);
-          let syntheticCmd = hasPayload ? ({
-              TAG: ctor
-            }) : ctor;
-          fieldPermissions[param[0]] = Authorization$Reventless.named(S.Spec.commandAuthorization(syntheticCmd));
+          fieldPermissions[param[0]] = Authorization$Reventless.named(S.Spec.authorizationOf(param[1]));
         });
         return {
           fieldNames: fieldSpecs.map(param => param[0]),
@@ -574,7 +569,7 @@ function Make(DcbEventLogStorage) {
       let mutationEntriesFromInboundSlices = inboundTranslationSlices.map(ITS => {
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
         let fieldPermissions = {};
-        Stdlib_Option.forEach(inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.commandAuthorization), rule => {
+        Stdlib_Option.forEach(inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf), rule => {
           fieldPermissions[fieldName] = rule;
         });
         return {

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res

@@ -168,34 +168,37 @@ module Make = (
       switch Translation.translate(input) {
       | Error(msg) => fail(msg)
       | Ok(pairs) =>
-        // Each command against its own rule; one refused refuses the message.
-        let refused =
-          pairs->Array.find(((_, cmd)) =>
-            !callerAdmits(Spec.commandAuthorization(cmd)->Reventless.Authorization.named, caller)
-          )
-        switch refused {
-        | Some(_) =>
+        switch pairs->Array.reduce(Ok([]), (acc, pair) =>
+          switch (acc, encode(pair)) {
+          | (Ok(msgs), Ok(msg)) => Ok(msgs->Array.concat([msg]))
+          | (Error(_) as failed, _) => failed
+          | (_, Error(msg)) => Error(msg)
+          }
+        ) {
+        | Error(msg) => fail(msg)
+        // Each command against its own rule, read by the name it encodes to; one
+        // refused refuses the message.
+        | Ok(msgs)
+          if msgs->Array.some(({commandJson}) =>
+            !callerAdmits(
+              commandJson
+              ->Reventless.Message.variantNameOfJson
+              ->Spec.authorizationOf
+              ->Reventless.Authorization.named,
+              caller,
+            )
+          ) =>
           fail(
             ~errorCode="Forbidden",
             `${Spec.name}: the caller is not authorized for every command this input translates into`,
           )
-        | None =>
-          switch pairs->Array.reduce(Ok([]), (acc, pair) =>
-            switch (acc, encode(pair)) {
-            | (Ok(msgs), Ok(msg)) => Ok(msgs->Array.concat([msg]))
-            | (Error(_) as failed, _) => failed
-            | (_, Error(msg)) => Error(msg)
-            }
-          ) {
-          | Error(msg) => fail(msg)
-          | Ok([]) => succeed(~requestId, ~inputJson, [])
-          | Ok(msgs) =>
-            try {
-              await publishJsons(msgs)
-              succeed(~requestId, ~inputJson, pairs->Array.map(((targetId, _)) => targetId))
-            } catch {
-            | exn => fail(messageOf(exn, "publish failed"))
-            }
+        | Ok([]) => succeed(~requestId, ~inputJson, [])
+        | Ok(msgs) =>
+          try {
+            await publishJsons(msgs)
+            succeed(~requestId, ~inputJson, pairs->Array.map(((targetId, _)) => targetId))
+          } catch {
+          | exn => fail(messageOf(exn, "publish failed"))
           }
         }
       }

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs

@@ -8,6 +8,7 @@ import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Message$Reventless from "@reventlessdev/reventless-spec/src/types/Message.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
@@ -167,10 +168,6 @@ function Make(Spec) {
         return fail(undefined, msg._0);
       }
       let pairs = msg._0;
-      let refused = pairs.find(param => !callerAdmits(Authorization$Reventless.named(Spec.commandAuthorization(param[1])), caller));
-      if (refused !== undefined) {
-        return fail("Forbidden", Spec.name + `: the caller is not authorized for every command this input translates into`);
-      }
       let msg$1 = Stdlib_Array.reduce(pairs, {
         TAG: "Ok",
         _0: []
@@ -196,6 +193,9 @@ function Make(Spec) {
         return fail(undefined, msg$1._0);
       }
       let msgs = msg$1._0;
+      if (msgs.some(param => !callerAdmits(Authorization$Reventless.named(Spec.authorizationOf(Message$Reventless.variantNameOfJson(param.commandJson))), caller))) {
+        return fail("Forbidden", Spec.name + `: the caller is not authorized for every command this input translates into`);
+      }
       if (msgs.length === 0) {
         return succeed(requestId, inputJson, []);
       }

package/src/plugin/component/Plugin_Builder.res

@@ -214,32 +214,22 @@ module Make = (
                 ~kind=Aggregate,
                 ~fields=fieldNames,
                 ~commandSchema,
-                ~commandAuthorization=command =>
-                  M.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
+                ~authorizationOf=name =>
+                  M.Spec.authorizationOf(name)->Reventless.Authorization.named,
               )
             )
             let aggDef =
               pluginStructure->Option.flatMap(s =>
                 s.aggregates->Array.find(d => d.name == M.Spec.name)
               )
-            // Stage E2 (host-ui-login-core): derive per-field permissions by
-            // evaluating the PPX-generated `commandAuthorization` against a
-            // synthetic command value per constructor. Mirrors the resolver-time
-            // shape from `CommandGeneratorResolvers_GraphQL.syntheticCommand` —
-            // payload-bearing variants compile to `{TAG, ...}`, payload-less to
-            // bare strings.
+            // Each field gated by its own constructor's rule.
             let fieldPermissions = Dict.make()
-            filteredConstructorNames->Array.forEachWithIndex((cname, idx) => {
-              let fieldName = fieldNames->Array.getUnsafe(idx)
-              let hasPayload = Reventless.DcbTag.isVariantPayloadBearing(
-                M.Spec.commandSchema->Obj.magic,
-                cname,
+            filteredConstructorNames->Array.forEachWithIndex((cname, idx) =>
+              fieldPermissions->Dict.set(
+                fieldNames->Array.getUnsafe(idx),
+                M.Spec.authorizationOf(cname)->Reventless.Authorization.named,
               )
-              let syntheticCmd: unknown = hasPayload ? {"TAG": cname}->Obj.magic : cname->Obj.magic
-              let rule =
-                M.Spec.commandAuthorization(syntheticCmd->Obj.magic)->Reventless.Authorization.named
-              fieldPermissions->Dict.set(fieldName, rule)
-            })
+            )
             [
               {
                 ReventlessInfra.Api.fieldNames,

package/src/plugin/component/Plugin_Builder.res.mjs

@@ -176,17 +176,11 @@ function Make(Spec) {
           if (fieldNames.length === 0) {
             return [];
           }
-          Stdlib_Option.forEach(Spec.hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, command => Authorization$Reventless.named(M.Spec.commandAuthorization(command))));
+          Stdlib_Option.forEach(Spec.hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, name => Authorization$Reventless.named(M.Spec.authorizationOf(name))));
           let aggDef = Stdlib_Option.flatMap(pluginStructure, s => s.aggregates.find(d => d.name === M.Spec.name));
           let fieldPermissions = {};
           filteredConstructorNames.forEach((cname, idx) => {
-            let fieldName = fieldNames[idx];
-            let hasPayload = DcbTag$Reventless.isVariantPayloadBearing(M.Spec.commandSchema, cname);
-            let syntheticCmd = hasPayload ? ({
-                TAG: cname
-              }) : cname;
-            let rule = Authorization$Reventless.named(M.Spec.commandAuthorization(syntheticCmd));
-            fieldPermissions[fieldName] = rule;
+            fieldPermissions[fieldNames[idx]] = Authorization$Reventless.named(M.Spec.authorizationOf(cname));
           });
           return [{
               fieldNames: fieldNames,

package/src/plugin/component/Plugin_Helpers.res

@@ -1006,14 +1006,14 @@ type subscriptionInfraParams = {
 type platformHooks = {
   // ── In-memory GraphQL mutation registration ────────────────────────────
   // Phase 1: register SDL + resolver stub synchronously.
-  // `commandAuthorization` is the `command => permission` function from the
-  // aggregate / slice Spec; the resolver evaluates it per-request against
-  // `ctx.identity` to enforce per-constructor authorization rules.
+  // `authorizationOf` is the aggregate / slice Spec's rule by constructor name;
+  // the resolver evaluates it per-request against `ctx.identity` to enforce
+  // per-constructor authorization rules.
   mutationResolverHook?: (
     ~kind: mutationKind,
     ~fields: array<string>,
     ~commandSchema: S.t<unknown>,
-    ~commandAuthorization: unknown => Reventless.Authorization.permission,
+    ~authorizationOf: string => Reventless.Authorization.permission,
   ) => unit,
   // Phase 2: bind generateCommand inside Output.apply.
   mutationBindHook?: (~field: string, ~generateCommand: CommandGenerator.commandGenerator) => unit,
@@ -1158,8 +1158,7 @@ let registerAdminAggregateMutations = (
             ~kind=Aggregate,
             ~fields=fieldNames,
             ~commandSchema,
-            ~commandAuthorization=command =>
-              M.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
+            ~authorizationOf=name => M.Spec.authorizationOf(name)->Reventless.Authorization.named,
           )
         )
       }

package/src/plugin/component/Plugin_Helpers.res.mjs

@@ -541,7 +541,7 @@ function registerAdminAggregateMutations(aggregates, hooks) {
     let fieldNames = filteredConstructorNames.map(cname => Api_Naming$ReventlessCore.adminField(M.Spec.name + "_" + cname));
     aggregateMutationFieldsRegistry[M.Spec.name] = fieldNames;
     if (fieldNames.length !== 0) {
-      return Stdlib_Option.forEach(hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, command => Authorization$Reventless.named(M.Spec.commandAuthorization(command))));
+      return Stdlib_Option.forEach(hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, name => Authorization$Reventless.named(M.Spec.authorizationOf(name))));
     }
   });
 }

package/src/plugin/component/Plugin_Structure.res

@@ -810,28 +810,25 @@ let nonEmpty = (xs: array<string>): option<array<string>> => xs->Array.length >
 let rolesFor = (rule: Reventless.Authorization.permission): option<array<string>> =>
   rule->Reventless.Authorization.rolesOf->Array.map(role => (role :> string))->nonEmpty
 
-// A stand-in for one constructor, the same shape the resolver builds at call time:
-// a payload-bearing variant compiles to `{TAG, ...}`, a payload-less one to a bare
-// string. Enough for the per-command switches the PPX generates, which match on
-// the constructor alone.
+// A stand-in for one constructor: a payload-bearing variant compiles to
+// `{TAG, ...}`, a payload-less one to a bare string. Enough for a spec's
+// `commandTransition`, whose switch matches on the constructor alone.
 let syntheticCommand = (~schema: S.t<unknown>, variantName: string): 'command =>
   Reventless.DcbTag.isVariantPayloadBearing(schema, variantName)
     ? {"TAG": variantName}->Obj.magic
     : variantName->Obj.magic
 
-// Each constructor's rule, read off its stand-in.
+// Each constructor's rule.
 let constructorPermissions = (
   ~commandSchema: S.t<unknown>,
-  ~commandAuthorization: 'command => Reventless.Authorization.permission,
+  ~authorizationOf: string => Reventless.Authorization.permission,
 ): array<Reventless.Authorization.permission> =>
-  Reventless.DcbTag.extractAllVariantNames(commandSchema)->Array.map(variantName =>
-    syntheticCommand(~schema=commandSchema, variantName)->commandAuthorization
-  )
+  Reventless.DcbTag.extractAllVariantNames(commandSchema)->Array.map(authorizationOf)
 
 // An inbound slice's gate where no command exists yet: any constructor's rule.
 // Both the deployed gate and the local resolver apply this one.
-let inboundDoorPermission = (~commandSchema, ~commandAuthorization) =>
-  constructorPermissions(~commandSchema, ~commandAuthorization)->Reventless.Authorization.anyOf
+let inboundDoorPermission = (~commandSchema, ~authorizationOf) =>
+  constructorPermissions(~commandSchema, ~authorizationOf)->Reventless.Authorization.anyOf
 
 // Each mutation argument's GraphQL type onto its property, so a consumer declares
 // the variable the server expects. Mutates the freshly derived schema in place.
@@ -860,13 +857,13 @@ let toCommandDef = (
   ~partitionKey: option<string>=?,
   ~mutationFieldFor: string => string,
   ~parentSchema: S.t<unknown>,
-  // The PPX-generated `command => permission`. Per VARIANT, not per component:
-  // one aggregate carries commands with very different audiences, and a
-  // component-level shortcut would gate `AddProduct` and `PlaceOrder` alike.
-  ~commandAuthorization: unknown => Reventless.Authorization.permission,
-  // The spec's `command => Transition.t<_>`, evaluated per variant the same way
-  // `commandAuthorization` is, and the only declaration of an edge there is —
-  // the PPX injects `Unrestricted` for a spec that writes no switch.
+  // The spec's `authorizationOf`, by constructor name. Per VARIANT, not per
+  // component: one aggregate carries commands with very different audiences,
+  // and a component-level shortcut would gate `AddProduct` and `PlaceOrder` alike.
+  ~authorizationOf: string => Reventless.Authorization.permission,
+  // The spec's `command => Transition.t<_>`, evaluated per variant against a
+  // stand-in, and the only declaration of an edge there is — the PPX injects
+  // `Undeclared` for a spec that writes no switch.
   //
   // Read at `t<string>` because this is the erasure boundary: the spec declares
   // its edges over the linked view's own lifecycle enum, whose arms are
@@ -961,7 +958,7 @@ let toCommandDef = (
       | Some(excluded) => !(excluded->Set.has(variantName))
       | None => true
       }
-    let rule = commandAuthorization(syntheticCommand)
+    let rule = authorizationOf(variantName)
     let requiredAccess = accessKeysFor(rule)
     // See the note on the record's `mutationField` for why a non-exposed
     // variant gets the empty sentinel. It has no callable field, and the
@@ -1032,7 +1029,7 @@ let extractCommandDefs = (
   ~isAggregate,
   ~partitionKey: option<string>=?,
   ~mutationFieldFor: string => string,
-  ~commandAuthorization: unknown => Reventless.Authorization.permission,
+  ~authorizationOf: string => Reventless.Authorization.permission,
   ~commandTransition: unknown => Reventless.Transition.t<string>,
   ~derivedEdgeFor: string => option<Reventless.Plugin.derivedEdge>=_ => None,
   commandSchema: S.t<unknown>,
@@ -1046,7 +1043,7 @@ let extractCommandDefs = (
         ~partitionKey?,
         ~mutationFieldFor,
         ~parentSchema=commandSchema,
-        ~commandAuthorization,
+        ~authorizationOf,
         ~commandTransition,
         ~derivedEdgeFor,
         v,
@@ -1060,7 +1057,7 @@ let extractCommandDefs = (
       ~partitionKey?,
       ~mutationFieldFor,
       ~parentSchema=commandSchema,
-      ~commandAuthorization,
+      ~authorizationOf,
       ~commandTransition,
       ~derivedEdgeFor,
       commandSchema,
@@ -1719,8 +1716,7 @@ let make = (
                 ~commandSchema=SCS.Spec.commandSchema->S.castToUnknown,
                 ~variant=variantName,
               ),
-            ~commandAuthorization=command =>
-              SCS.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
+            ~authorizationOf=name => SCS.Spec.authorizationOf(name)->Reventless.Authorization.named,
             ~commandTransition=SCS.Spec.commandTransition->Obj.magic,
             ~derivedEdgeFor=derivedEdgeFor(~component=SCS.Spec.name, ...),
             SCS.Spec.commandSchema->S.castToUnknown,
@@ -1754,8 +1750,7 @@ let make = (
               ~aggregate=A.Spec.name,
               ~command=variantName,
             ),
-          ~commandAuthorization=command =>
-            A.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
+          ~authorizationOf=name => A.Spec.authorizationOf(name)->Reventless.Authorization.named,
           ~commandTransition=A.Spec.commandTransition->Obj.magic,
           ~derivedEdgeFor=derivedEdgeFor(~component=A.Spec.name, ...),
           A.Spec.commandSchema->S.castToUnknown,
@@ -1834,8 +1829,7 @@ let make = (
       requiredRoles: ?(
         constructorPermissions(
           ~commandSchema=ITS.Spec.commandSchema->S.castToUnknown,
-          ~commandAuthorization=cmd =>
-            ITS.Spec.commandAuthorization(cmd)->Reventless.Authorization.named,
+          ~authorizationOf=name => ITS.Spec.authorizationOf(name)->Reventless.Authorization.named,
         )
         ->Array.flatMap(Reventless.Authorization.rolesOf)
         ->Array.map(role => (role :> string))

package/src/plugin/component/Plugin_Structure.res.mjs

@@ -644,12 +644,12 @@ function syntheticCommand(schema, variantName) {
   }
 }
 
-function constructorPermissions(commandSchema, commandAuthorization) {
-  return DcbTag$Reventless.extractAllVariantNames(commandSchema).map(variantName => commandAuthorization(syntheticCommand(commandSchema, variantName)));
+function constructorPermissions(commandSchema, authorizationOf) {
+  return DcbTag$Reventless.extractAllVariantNames(commandSchema).map(authorizationOf);
 }
 
-function inboundDoorPermission(commandSchema, commandAuthorization) {
-  return Authorization$Reventless.anyOf(constructorPermissions(commandSchema, commandAuthorization));
+function inboundDoorPermission(commandSchema, authorizationOf) {
+  return Authorization$Reventless.anyOf(DcbTag$Reventless.extractAllVariantNames(commandSchema).map(authorizationOf));
 }
 
 function annotateArgTypes(schema, argTypes) {
@@ -666,7 +666,7 @@ function annotateArgTypes(schema, argTypes) {
   return schema;
 }
 
-function toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor, parentSchema, commandAuthorization, commandTransition, derivedEdgeFor, v) {
+function toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor, parentSchema, authorizationOf, commandTransition, derivedEdgeFor, v) {
   let mkDef = (variantName, properties) => {
     let match = commandLevelAndId(isAggregate, partitionKey, variantName, properties);
     let aggregateIdField = match[1];
@@ -708,7 +708,7 @@ function toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor
       let excluded = ApiNoApiHelpers$ReventlessCore.getExcludedVariants(parentSchema);
       apiExposed = excluded !== undefined ? !excluded.has(variantName) : true;
     }
-    let rule = commandAuthorization(syntheticCommand$1);
+    let rule = authorizationOf(variantName);
     let requiredAccess = accessKeysFor(rule);
     let mutationField = apiExposed ? mutationFieldFor(variantName) : "";
     let jsonSchema = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(apiExposed, mutationField, v);
@@ -753,12 +753,12 @@ function toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor
   }
 }
 
-function extractCommandDefs(identityViews, isAggregate, partitionKey, mutationFieldFor, commandAuthorization, commandTransition, derivedEdgeForOpt, commandSchema) {
+function extractCommandDefs(identityViews, isAggregate, partitionKey, mutationFieldFor, authorizationOf, commandTransition, derivedEdgeForOpt, commandSchema) {
   let derivedEdgeFor = derivedEdgeForOpt !== undefined ? derivedEdgeForOpt : param => {};
   if (commandSchema.type === "anyOf") {
-    return Stdlib_Array.filterMap(commandSchema.anyOf, v => toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor, commandSchema, commandAuthorization, commandTransition, derivedEdgeFor, v));
+    return Stdlib_Array.filterMap(commandSchema.anyOf, v => toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor, commandSchema, authorizationOf, commandTransition, derivedEdgeFor, v));
   } else {
-    return Stdlib_Option.mapOr(toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor, commandSchema, commandAuthorization, commandTransition, derivedEdgeFor, commandSchema), [], def => [def]);
+    return Stdlib_Option.mapOr(toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor, commandSchema, authorizationOf, commandTransition, derivedEdgeFor, commandSchema), [], def => [def]);
   }
 }
 
@@ -1226,7 +1226,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let consumed = match$1[1];
     return {
       name: SCS.Spec.name,
-      commands: extractCommandDefs(identityViews, false, partitionBySlice[SCS.Spec.name], variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), command => Authorization$Reventless.named(SCS.Spec.commandAuthorization(command)), SCS.Spec.commandTransition, extra => derivedEdgeFor(SCS.Spec.name, extra), SCS.Spec.commandSchema),
+      commands: extractCommandDefs(identityViews, false, partitionBySlice[SCS.Spec.name], variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), name => Authorization$Reventless.named(SCS.Spec.authorizationOf(name)), SCS.Spec.commandTransition, extra => derivedEdgeFor(SCS.Spec.name, extra), SCS.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: consumed,
       linkedViews: linkedSvsFor(produced),
@@ -1241,7 +1241,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let produced = match[1];
     return {
       name: A.Spec.name,
-      commands: extractCommandDefs(identityViews, true, undefined, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), command => Authorization$Reventless.named(A.Spec.commandAuthorization(command)), A.Spec.commandTransition, extra => derivedEdgeFor(A.Spec.name, extra), A.Spec.commandSchema),
+      commands: extractCommandDefs(identityViews, true, undefined, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), name => Authorization$Reventless.named(A.Spec.authorizationOf(name)), A.Spec.commandTransition, extra => derivedEdgeFor(A.Spec.name, extra), A.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: [],
       linkedViews: linkedSvsFor(produced).concat(linkedReadModelsFor(A.Spec.name)),
@@ -1276,7 +1276,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     targetName: ITS.Spec.targetName,
     externalSystem: ITS.Spec.externalSystem,
     chapter: componentChapters[ITS.Spec.name],
-    requiredRoles: nonEmpty(Array.from(new Set(constructorPermissions(ITS.Spec.commandSchema, cmd => Authorization$Reventless.named(ITS.Spec.commandAuthorization(cmd))).flatMap(Authorization$Reventless.rolesOf).map(role => role)).values()))
+    requiredRoles: nonEmpty(Array.from(new Set(DcbTag$Reventless.extractAllVariantNames(ITS.Spec.commandSchema).map(name => Authorization$Reventless.named(ITS.Spec.authorizationOf(name))).flatMap(Authorization$Reventless.rolesOf).map(role => role)).values()))
   }));
   let tableFailures = [];
   let tableWarnings = [];