@reventlessdev/reventless-core 3.0.0-alpha.296 → 3.0.0-alpha.298

package/CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.298 (2026-10-16)
+
+* feat!(inbound): a translation slice can declare a signed webhook URL ([0ad6994](https://github.com/ReventlessDev/reventless-core/commit/0ad69949fcc91c2756c60ca8cb120dd468841d8b))
+
+### BREAKING CHANGES
+
+* InboundTranslationSlice.Spec requires `endpoint`. Specs under
+@@reventless.spec get it from the PPX (republish reventless-ppx with this
+release); hand-written specs add `let endpoint = None`.
+
+
+
+# 3.0.0-alpha.297 (2026-10-16)
+
+* fix(auth)!: only operators read the framework's own stores ([a2fd202](https://github.com/ReventlessDev/reventless-core/commit/a2fd2022b6876dae855b185df7f8263353fc971d))
+
+### BREAKING CHANGES
+
+* a caller outside the elevated groups is refused the
+framework's to-do, schedule and audit stores. On AWS, a roles-gated
+view's …ByIds, …Refs, …Items and …By<Index> fields refuse callers
+outside its roles.
+
+
+
 # 3.0.0-alpha.296 (2026-10-16)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.296",
+  "version": "3.0.0-alpha.298",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,21 +29,21 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.22",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.40",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.165",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.193"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.41",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.195",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.167"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.101"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.102"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -777,6 +777,21 @@ let mutationArgTypes = (~fieldName: string, variantSchema: S.t<unknown>): option
     out
   })
 
+/** Every query field `generate` emits for an entry, under the same conditions.
+    A platform gating an entry gates each of them: a door left out is open. */
+let queryFieldNamesOf = (entry: querySchemaEntry): array<string> => {
+  let byIds = entry.includeIdParam->Option.getOr(true) && entry.subIdField === None
+  let indexFields =
+    entry.indexQueries
+    ->Option.getOr([])
+    ->Array.filter(ic => !Reventless.ReadModel.isDerivedIndex(ic))
+    ->Array.map(ic => indexQueryFieldName(~singleFieldName=entry.singleFieldName, ~index=ic.index))
+  [entry.singleFieldName, entry.listFieldName]
+  ->Array.concat(byIds ? [entry.listFieldName ++ "ByIds", entry.listFieldName ++ "Refs"] : [])
+  ->Array.concat(entry.subIdField->Option.isSome ? [entry.singleFieldName ++ "Items"] : [])
+  ->Array.concat(indexFields)
+}
+
 // ── Main generate function ─────────────────────────────────────────────────
 
 let generate = (

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -529,6 +529,18 @@ function mutationArgTypes(fieldName, variantSchema) {
   });
 }
 
+function queryFieldNamesOf(entry) {
+  let byIds = Stdlib_Option.getOr(entry.includeIdParam, true) && entry.subIdField === undefined;
+  let indexFields = Stdlib_Option.getOr(entry.indexQueries, []).filter(ic => !ReadModel$Reventless.isDerivedIndex(ic)).map(ic => indexQueryFieldName(entry.singleFieldName, ic.index));
+  return [
+    entry.singleFieldName,
+    entry.listFieldName
+  ].concat(byIds ? [
+      entry.listFieldName + "ByIds",
+      entry.listFieldName + "Refs"
+    ] : []).concat(Stdlib_Option.isSome(entry.subIdField) ? [entry.singleFieldName + "Items"] : []).concat(indexFields);
+}
+
 function generate(mutationEntries, queryEntries) {
   let types = [];
   let mutations = [];
@@ -729,6 +741,7 @@ export {
   deriveIndexQueryField,
   deriveMutationFieldFromObject,
   mutationArgTypes,
+  queryFieldNamesOf,
   generate,
 }
 /* log Not a pure module */

package/src/components/AutomationSlice/AutomationSlice_Builder.res

@@ -63,7 +63,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }
 
@@ -81,7 +81,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }
     module SchedulesQueryDb = QueryDb_Builder.Make(

package/src/components/AutomationSlice/AutomationSlice_Builder.res.mjs

@@ -15,6 +15,7 @@ import * as Clock$Reventless from "@reventlessdev/reventless-spec/src/components
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as EventTopic$ReventlessCore from "../EventTopic/EventTopic.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
@@ -36,6 +37,7 @@ function Make(RuntimeEnvironment) {
       let readsClock = mappedSources.includes(Clock$Reventless.name);
       let moduleUrl = import.meta.url;
       let config = ReadModel$Reventless.config(undefined, undefined, undefined);
+      let authorization = OwnerScope$Reventless.operators();
       let SpecificQueryDb = QueryDb_Builder$ReventlessCore.Make({
         Id: Id$Reventless.$$String,
         name: queryDbName,
@@ -43,13 +45,14 @@ function Make(RuntimeEnvironment) {
         stateSchema: AutomationSlice_Callback$ReventlessCore.todoRowSchema,
         config: config,
         subIdConfig: undefined,
-        authorization: "AllowAuthenticated",
+        authorization: authorization,
         visibility: "Public"
       })(QueryDbStorage)(QueryDbResolvers);
       let schedulesStoreName = Spec.name + "Schedule";
       let schedulesDbName = readsClock ? schedulesStoreName : undefined;
       let moduleUrl$1 = import.meta.url;
       let config$1 = ReadModel$Reventless.config(undefined, undefined, undefined);
+      let authorization$1 = OwnerScope$Reventless.operators();
       let SchedulesQueryDb = QueryDb_Builder$ReventlessCore.Make({
         Id: Id$Reventless.$$String,
         name: schedulesStoreName,
@@ -57,7 +60,7 @@ function Make(RuntimeEnvironment) {
         stateSchema: AutomationSlice_Schedules$ReventlessCore.rowSchema,
         config: config$1,
         subIdConfig: undefined,
-        authorization: "AllowAuthenticated",
+        authorization: authorization$1,
         visibility: "Public"
       })(QueryDbStorage)(QueryDbResolvers);
       let syncSchedules = async (ops, stored) => {

package/src/components/Dcb/Dcb_Builder.res

@@ -759,38 +759,51 @@ module Make = (
             ~opts,
           )
           let fieldName = Api_Naming.sliceMutationField(~plugin=name, ~slice=ITS.Spec.name)
+          // `@noApi` on `externalInput` withholds the mutation; the webhook is
+          // then the only door, and a slice with neither could never be reached.
+          let exposed = InboundTranslationSlice_Callback.exposesMutation(
+            ITS.Spec.externalInputSchema->S.castToUnknown,
+          )
+          InboundTranslationSlice_Callback.checkReachable(
+            ~plugin=name,
+            ~slice=ITS.Spec.name,
+            ~mutation=exposed,
+            ~webhook=ITS.Spec.endpoint->Option.isSome,
+          )
 
           switch HooksConfig.hooks.inboundMutationResolverHook {
-          | Some(registerResolver) =>
+          | Some(registerResolver) if exposed =>
             registerResolver(
               ~fieldName,
               ~externalInputSchema=ITS.Spec.externalInputSchema->S.castToUnknown,
               ~permission=?inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf),
             )
-          | None => ()
+          | _ => ()
           }
 
           switch HooksConfig.hooks.inboundMutationBindReceiveHook {
-          | Some(bindReceive) =>
+          | Some(bindReceive) if exposed =>
             let _ =
               its
               ->Component.operations
-              ->Pulumi.Output.apply(ops => bindReceive(~fieldName, ~receive=ops.receive))
-          | None => ()
+              ->Pulumi.Output.apply(ops =>
+                bindReceive(~fieldName, ~receive=(input, ~caller=?) => ops.receive(input, ~caller?))
+              )
+          | _ => ()
           }
 
-          (ITS.Spec.name, fieldName, its, ITS.Spec.externalInputSchema->S.castToUnknown)
+          (ITS.Spec.name, fieldName, its, ITS.Spec.externalInputSchema->S.castToUnknown, exposed)
         })
 
       let inboundTranslationSlicesOutputs =
         inboundTranslationSliceData
-        ->Array.map(((specName, _, its, _)) => (specName, its->Component.outputs))
+        ->Array.map(((specName, _, its, _, _)) => (specName, its->Component.outputs))
         ->Dict.fromArray
 
       // Collect InboundTranslationSlice receive functions for composite handler routing
       let inboundReceiversOutput =
         inboundTranslationSliceData
-        ->Array.map(((_, fieldName, its, _)) =>
+        ->Array.map(((_, fieldName, its, _, _)) =>
           its
           ->Component.operations
           ->Pulumi.Output.apply(ops => (fieldName, ops.receive))
@@ -942,9 +955,10 @@ module Make = (
         ->Dict.valuesToArray
         ->Array.flatMap(outputs => outputs.resources)
 
-      let inboundFieldNames =
-        inboundTranslationSliceData->Array.map(((_, fieldName, _, _)) => fieldName)
-      let inboundSchemas = inboundTranslationSliceData->Array.map(((_, _, _, schema)) => schema)
+      let exposedInbound =
+        inboundTranslationSliceData->Array.filter(((_, _, _, _, exposed)) => exposed)
+      let inboundFieldNames = exposedInbound->Array.map(((_, fieldName, _, _, _)) => fieldName)
+      let inboundSchemas = exposedInbound->Array.map(((_, _, _, schema, _)) => schema)
 
       // Collect DCB mutation field names + TAGs for AppSync resolver creation
       // (excludes @noApi slices — includes both sync and async)
@@ -1092,7 +1106,13 @@ module Make = (
         })
 
       let mutationEntriesFromInboundSlices =
-        inboundTranslationSlices->Array.map((module(ITS: InboundTranslationSlice.T)) => {
+        inboundTranslationSlices
+        ->Array.filter((module(ITS: InboundTranslationSlice.T)) =>
+          InboundTranslationSlice_Callback.exposesMutation(
+            ITS.Spec.externalInputSchema->S.castToUnknown,
+          )
+        )
+        ->Array.map((module(ITS: InboundTranslationSlice.T)) => {
           let fieldName = Api_Naming.sliceMutationField(~plugin=name, ~slice=ITS.Spec.name)
           let fieldPermissions = Dict.make()
           inboundDoorPermission(
@@ -1138,6 +1158,9 @@ module Make = (
         }
       })
 
+      // What the framework keeps for a slice is read by the deployment's operators.
+      let operators = Reventless.OwnerScope.operators()
+
       let automationEntries = automationSlices->Array.map((module(A: AutomationSlice.T)) => {
         let qn = Api_Naming.queryFieldNamesForSliceQueryDb(~plugin=name, ~queryDbName=A.queryDbName)
         {
@@ -1148,6 +1171,7 @@ module Make = (
             A.Spec.todoItemSchema,
           )->S.castToUnknown,
           authorization: None,
+          permission: operators,
           connectionSpec: true,
         }
       })
@@ -1162,6 +1186,7 @@ module Make = (
             returnTypeName: qn.returnTypeName,
             stateSchema: AutomationSlice_Schedules.rowSchema->S.castToUnknown,
             authorization: None,
+            permission: operators,
             connectionSpec: true,
           }
         })
@@ -1181,6 +1206,7 @@ module Make = (
               O.Spec.outboundItemSchema,
             )->S.castToUnknown,
             authorization: None,
+            permission: operators,
             connectionSpec: true,
           }
         })
@@ -1197,6 +1223,7 @@ module Make = (
             returnTypeName: qn.returnTypeName,
             stateSchema: InboundTranslationSlice_Callback.auditRowSchema->S.castToUnknown,
             authorization: None,
+            permission: operators,
             connectionSpec: true,
           }
         })

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -13,6 +13,7 @@ import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as DcbValidation$Reventless from "@reventlessdev/reventless-spec/src/components/DcbValidation.res.mjs";
@@ -406,19 +407,22 @@ function Make(DcbEventLogStorage) {
       let inboundTranslationSliceData = inboundTranslationSlices.map(ITS => {
         let its = ITS.make(publishJsons, componentRuntime[ITS.Spec.name], opts);
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
+        let exposed = InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(ITS.Spec.externalInputSchema);
+        InboundTranslationSlice_Callback$ReventlessCore.checkReachable(name, ITS.Spec.name, exposed, Stdlib_Option.isSome(ITS.Spec.endpoint));
         let registerResolver = HooksConfig.hooks.inboundMutationResolverHook;
-        if (registerResolver !== undefined) {
+        if (registerResolver !== undefined && exposed) {
           registerResolver(fieldName, ITS.Spec.externalInputSchema, inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf));
         }
         let bindReceive = HooksConfig.hooks.inboundMutationBindReceiveHook;
-        if (bindReceive !== undefined) {
-          Component$ReventlessCore.operations(its).apply(ops => bindReceive(fieldName, ops.receive));
+        if (bindReceive !== undefined && exposed) {
+          Component$ReventlessCore.operations(its).apply(ops => bindReceive(fieldName, (input, caller) => ops.receive(input, caller, undefined)));
         }
         return [
           ITS.Spec.name,
           fieldName,
           its,
-          ITS.Spec.externalInputSchema
+          ITS.Spec.externalInputSchema,
+          exposed
         ];
       });
       let inboundTranslationSlicesOutputs = Object.fromEntries(inboundTranslationSliceData.map(param => [
@@ -481,7 +485,7 @@ function Make(DcbEventLogStorage) {
             let receiveFn = receivers[event.fieldName];
             if (receiveFn !== undefined) {
               return Effect.promise(async () => {
-                let result = await receiveFn(event.arguments, InboundTranslationSlice_Callback$ReventlessCore.doorCaller(event.identity));
+                let result = await receiveFn(event.arguments, InboundTranslationSlice_Callback$ReventlessCore.doorCaller(event.identity), undefined);
                 return CommandTopic$ReventlessCore.commandOutcomeToJson(InboundTranslationSlice_Callback$ReventlessCore.receiveResultToOutcome(result));
               });
             } else {
@@ -506,8 +510,9 @@ function Make(DcbEventLogStorage) {
       });
       let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources.concat(outputs.queryDb.resources)));
       let asyncDcbResources = Object.values(asyncStateChangeSlicesOutputs).flatMap(outputs => outputs.resources);
-      let inboundFieldNames = inboundTranslationSliceData.map(param => param[1]);
-      let inboundSchemas = inboundTranslationSliceData.map(param => param[3]);
+      let exposedInbound = inboundTranslationSliceData.filter(param => param[4]);
+      let inboundFieldNames = exposedInbound.map(param => param[1]);
+      let inboundSchemas = exposedInbound.map(param => param[3]);
       let dcbMutationData = stateChangeSlices.flatMap(S => {
         let commandSchema = S.Spec.commandSchema;
         if (ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
@@ -577,7 +582,7 @@ function Make(DcbEventLogStorage) {
           consistencyRead: Stdlib_Option.flatMap(sliceDef, d => d.consistencyRead)
         };
       });
-      let mutationEntriesFromInboundSlices = inboundTranslationSlices.map(ITS => {
+      let mutationEntriesFromInboundSlices = inboundTranslationSlices.filter(ITS => InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(ITS.Spec.externalInputSchema)).map(ITS => {
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
         let fieldPermissions = {};
         Stdlib_Option.forEach(inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf), rule => {
@@ -612,6 +617,7 @@ function Make(DcbEventLogStorage) {
           resolvedFields: resolvedFields
         };
       });
+      let operators = OwnerScope$Reventless.operators();
       let automationEntries = automationSlices.map(A => {
         let qn = Api_Naming$ReventlessCore.queryFieldNamesForSliceQueryDb(name, A.queryDbName, undefined);
         return {
@@ -620,6 +626,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: AutomationSlice_Callback$ReventlessCore.todoRowSchemaFor(A.Spec.todoItemSchema),
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       });
@@ -631,6 +638,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: AutomationSlice_Schedules$ReventlessCore.rowSchema,
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       }));
@@ -642,6 +650,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchemaFor(O.Spec.outboundItemSchema),
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       });
@@ -653,6 +662,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema,
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       });

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res

@@ -36,7 +36,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }
 
@@ -81,8 +81,13 @@ module Make = (
         ->Pulumi.Output.all2
         ->Pulumi.Output.apply(((queryDbOps, publishJsonsFn)) => {
           let ops: InboundTranslationSlice.operations = {
-            receive: async (inputJson, ~caller=?) => {
-              let result = await Callback.receive(publishJsonsFn, inputJson, ~caller?)
+            receive: async (inputJson, ~caller=?, ~door=?) => {
+              let result = await Callback.receive(publishJsonsFn, inputJson, ~caller?, ~door?)
+              await syncToQueryDb(queryDbOps, result->InboundTranslationSlice_Callback.requestIdOf)
+              result
+            },
+            refuse: async (~body, ~errorCode, error) => {
+              let result = Callback.refuse(~body, ~errorCode, error)
               await syncToQueryDb(queryDbOps, result->InboundTranslationSlice_Callback.requestIdOf)
               result
             },

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res.mjs

@@ -3,6 +3,7 @@
 import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as ComponentType$ReventlessCore from "../../ComponentType.res.mjs";
 import * as QueryDb_Builder$ReventlessCore from "../QueryDb/QueryDb_Builder.res.mjs";
@@ -16,6 +17,7 @@ function Make(QueryDbStorage) {
       let queryDbName = Spec.name + "Audit";
       let moduleUrl = import.meta.url;
       let config = ReadModel$Reventless.config(undefined, undefined, undefined);
+      let authorization = OwnerScope$Reventless.operators();
       let SpecificQueryDb = QueryDb_Builder$ReventlessCore.Make({
         Id: Id$Reventless.$$String,
         name: queryDbName,
@@ -23,7 +25,7 @@ function Make(QueryDbStorage) {
         stateSchema: InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema,
         config: config,
         subIdConfig: undefined,
-        authorization: "AllowAuthenticated",
+        authorization: authorization,
         visibility: "Public"
       })(QueryDbStorage)(QueryDbResolvers);
       let syncToQueryDb = async (queryDbOps, requestId) => {
@@ -55,8 +57,13 @@ function Make(QueryDbStorage) {
           let publishJsonsFn = param[1];
           let queryDbOps = param[0];
           return {
-            receive: async (inputJson, caller) => {
-              let result = await Callback.receive(publishJsonsFn, inputJson, caller);
+            receive: async (inputJson, caller, door) => {
+              let result = await Callback.receive(publishJsonsFn, inputJson, caller, door);
+              await syncToQueryDb(queryDbOps, InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result));
+              return result;
+            },
+            refuse: async (body, errorCode, error) => {
+              let result = Callback.refuse(body, errorCode, error);
               await syncToQueryDb(queryDbOps, InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result));
               return result;
             }

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res

@@ -15,6 +15,8 @@ type auditRow = {
   commandCount?: int,
   error?: string,
   receivedAt: string,
+  /** Absent on rows written before the slice had a second door. */
+  door?: ReventlessInfra.InboundTranslationSlice.door,
 }
 
 /** The `CommandResult` a `receive` outcome answers with: the first target as
@@ -76,6 +78,19 @@ type doorInvocation = {
 let doorCaller = (identity: Nullable.t<Reventless.Identity.t>): Reventless.Identity.t =>
   identity->Nullable.toOption->Option.getOr(Reventless.Identity.anonymous)
 
+/** Whether a slice's input is offered as a mutation: not when `externalInput`
+    carries `@noApi`, which leaves the webhook as its only door. */
+let exposesMutation = (externalInputSchema: S.t<unknown>): bool =>
+  !ApiNoApiHelpers.isNoApi(externalInputSchema)
+
+/** Refuse a slice with neither door, which nothing could ever reach. */
+let checkReachable = (~plugin: string, ~slice: string, ~mutation: bool, ~webhook: bool) =>
+  if !mutation && !webhook {
+    JsError.throwWithMessage(
+      `${plugin}: inbound translation slice ${slice} has @noApi on externalInput and declares no endpoint, so nothing can reach it`,
+    )
+  }
+
 module type T = {
   module Spec: Reventless.InboundTranslationSlice.Spec
   module Translation: Reventless.InboundTranslationSlice.Translation with module Spec := Spec
@@ -88,7 +103,18 @@ module type T = {
     ReventlessInfra.CommandTopic.publishJsons,
     JSON.t,
     ~caller: Reventless.Identity.t=?,
+    ~door: ReventlessInfra.InboundTranslationSlice.door=?,
   ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>
+
+  /** Record a webhook request refused before it could be read, and reject it. */
+  let refuse: (
+    ~body: string,
+    ~errorCode: string,
+    string,
+  ) => ReventlessInfra.InboundTranslationSlice.receiveResult
+
+  /** The slice's webhook route, if its spec declares an endpoint. */
+  let webhook: option<InboundTranslationSlice_Webhook.route>
 }
 
 module Make = (
@@ -110,15 +136,12 @@ module Make = (
     exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr(fallback)
 
   // One audit row per request, whatever the outcome.
-  let failWith = (~requestId, ~inputJson, ~errorCode=?, error) => {
-    auditLog->Dict.set(
-      requestId,
-      {input: inputJson->JSON.stringify, status: Failure, error, receivedAt: now()},
-    )
+  let failWith = (~requestId, ~input, ~door, ~errorCode=?, error) => {
+    auditLog->Dict.set(requestId, {input, status: Failure, error, receivedAt: now(), door})
     Error({ReventlessInfra.InboundTranslationSlice.requestId, error, ?errorCode})
   }
 
-  let succeed = (~requestId, ~inputJson, targetIds) => {
+  let succeed = (~requestId, ~inputJson, ~door, targetIds) => {
     let commandCount = targetIds->Array.length
     auditLog->Dict.set(
       requestId,
@@ -128,6 +151,7 @@ module Make = (
         targetIds,
         commandCount,
         receivedAt: now(),
+        door,
       },
     )
     Ok({ReventlessInfra.InboundTranslationSlice.requestId, targetIds, commandCount})
@@ -155,9 +179,12 @@ module Make = (
     publishJsons: ReventlessInfra.CommandTopic.publishJsons,
     inputJson: JSON.t,
     ~caller: option<Reventless.Identity.t>=?,
+    ~door: ReventlessInfra.InboundTranslationSlice.door=Mutation,
   ): ReventlessInfra.InboundTranslationSlice.receiveResult => {
     let requestId = Uuid.v4()
-    let fail = (~errorCode=?, error) => failWith(~requestId, ~inputJson, ~errorCode?, error)
+    let fail = (~errorCode=?, error) =>
+      failWith(~requestId, ~input=inputJson->JSON.stringify, ~door, ~errorCode?, error)
+    let succeed = succeed(~requestId, ~inputJson, ~door, ...)
     let parsed = try Ok(inputJson->S.parseOrThrow(~to=Spec.externalInputSchema)) catch {
     | exn => Error(messageOf(exn, "invalid input"))
     }
@@ -192,16 +219,24 @@ module Make = (
             ~errorCode="Forbidden",
             `${Spec.name}: the caller is not authorized for every command this input translates into`,
           )
-        | Ok([]) => succeed(~requestId, ~inputJson, [])
+        | Ok([]) => succeed([])
         | Ok(msgs) =>
           try {
             await publishJsons(msgs)
-            succeed(~requestId, ~inputJson, pairs->Array.map(((targetId, _)) => targetId))
+            succeed(pairs->Array.map(((targetId, _)) => targetId))
           } catch {
-          | exn => fail(messageOf(exn, "publish failed"))
+          | exn => fail(~errorCode="PublishFailed", messageOf(exn, "publish failed"))
           }
         }
       }
     }
   }
+
+  let refuse = (~body, ~errorCode, error) =>
+    failWith(~requestId=Uuid.v4(), ~input=body, ~door=Webhook, ~errorCode, error)
+
+  let webhook =
+    Spec.endpoint->Option.map(endpoint =>
+      InboundTranslationSlice_Webhook.routeOf(~slice=Spec.name, endpoint)
+    )
 }