@reventlessdev/reventless-core 3.0.0-alpha.297 → 3.0.0-alpha.299

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.299 (2026-10-17)
+
+**Note:** Version bump only for package @reventlessdev/reventless-core
+
+
+
+
+
+# 3.0.0-alpha.298 (2026-10-16)
+
+* feat!(inbound): a translation slice can declare a signed webhook URL ([0ad6994](https://github.com/ReventlessDev/reventless-core/commit/0ad69949fcc91c2756c60ca8cb120dd468841d8b))
+
+### BREAKING CHANGES
+
+* InboundTranslationSlice.Spec requires `endpoint`. Specs under
+@@reventless.spec get it from the PPX (republish reventless-ppx with this
+release); hand-written specs add `let endpoint = None`.
+
+
+
 # 3.0.0-alpha.297 (2026-10-16)
 
 * fix(auth)!: only operators read the framework's own stores ([a2fd202](https://github.com/ReventlessDev/reventless-core/commit/a2fd2022b6876dae855b185df7f8263353fc971d))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.297",
+  "version": "3.0.0-alpha.299",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,22 +28,22 @@
   "dependencies": {
     "sury": "11.0.0",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.22",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.40",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.194",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.166"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.196",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.168",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.41"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.102"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.103"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/components/Dcb/Dcb_Builder.res

@@ -759,38 +759,51 @@ module Make = (
             ~opts,
           )
           let fieldName = Api_Naming.sliceMutationField(~plugin=name, ~slice=ITS.Spec.name)
+          // `@noApi` on `externalInput` withholds the mutation; the webhook is
+          // then the only door, and a slice with neither could never be reached.
+          let exposed = InboundTranslationSlice_Callback.exposesMutation(
+            ITS.Spec.externalInputSchema->S.castToUnknown,
+          )
+          InboundTranslationSlice_Callback.checkReachable(
+            ~plugin=name,
+            ~slice=ITS.Spec.name,
+            ~mutation=exposed,
+            ~webhook=ITS.Spec.endpoint->Option.isSome,
+          )
 
           switch HooksConfig.hooks.inboundMutationResolverHook {
-          | Some(registerResolver) =>
+          | Some(registerResolver) if exposed =>
             registerResolver(
               ~fieldName,
               ~externalInputSchema=ITS.Spec.externalInputSchema->S.castToUnknown,
               ~permission=?inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf),
             )
-          | None => ()
+          | _ => ()
           }
 
           switch HooksConfig.hooks.inboundMutationBindReceiveHook {
-          | Some(bindReceive) =>
+          | Some(bindReceive) if exposed =>
             let _ =
               its
               ->Component.operations
-              ->Pulumi.Output.apply(ops => bindReceive(~fieldName, ~receive=ops.receive))
-          | None => ()
+              ->Pulumi.Output.apply(ops =>
+                bindReceive(~fieldName, ~receive=(input, ~caller=?) => ops.receive(input, ~caller?))
+              )
+          | _ => ()
           }
 
-          (ITS.Spec.name, fieldName, its, ITS.Spec.externalInputSchema->S.castToUnknown)
+          (ITS.Spec.name, fieldName, its, ITS.Spec.externalInputSchema->S.castToUnknown, exposed)
         })
 
       let inboundTranslationSlicesOutputs =
         inboundTranslationSliceData
-        ->Array.map(((specName, _, its, _)) => (specName, its->Component.outputs))
+        ->Array.map(((specName, _, its, _, _)) => (specName, its->Component.outputs))
         ->Dict.fromArray
 
       // Collect InboundTranslationSlice receive functions for composite handler routing
       let inboundReceiversOutput =
         inboundTranslationSliceData
-        ->Array.map(((_, fieldName, its, _)) =>
+        ->Array.map(((_, fieldName, its, _, _)) =>
           its
           ->Component.operations
           ->Pulumi.Output.apply(ops => (fieldName, ops.receive))
@@ -942,9 +955,10 @@ module Make = (
         ->Dict.valuesToArray
         ->Array.flatMap(outputs => outputs.resources)
 
-      let inboundFieldNames =
-        inboundTranslationSliceData->Array.map(((_, fieldName, _, _)) => fieldName)
-      let inboundSchemas = inboundTranslationSliceData->Array.map(((_, _, _, schema)) => schema)
+      let exposedInbound =
+        inboundTranslationSliceData->Array.filter(((_, _, _, _, exposed)) => exposed)
+      let inboundFieldNames = exposedInbound->Array.map(((_, fieldName, _, _, _)) => fieldName)
+      let inboundSchemas = exposedInbound->Array.map(((_, _, _, schema, _)) => schema)
 
       // Collect DCB mutation field names + TAGs for AppSync resolver creation
       // (excludes @noApi slices — includes both sync and async)
@@ -1092,7 +1106,13 @@ module Make = (
         })
 
       let mutationEntriesFromInboundSlices =
-        inboundTranslationSlices->Array.map((module(ITS: InboundTranslationSlice.T)) => {
+        inboundTranslationSlices
+        ->Array.filter((module(ITS: InboundTranslationSlice.T)) =>
+          InboundTranslationSlice_Callback.exposesMutation(
+            ITS.Spec.externalInputSchema->S.castToUnknown,
+          )
+        )
+        ->Array.map((module(ITS: InboundTranslationSlice.T)) => {
           let fieldName = Api_Naming.sliceMutationField(~plugin=name, ~slice=ITS.Spec.name)
           let fieldPermissions = Dict.make()
           inboundDoorPermission(

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -407,19 +407,22 @@ function Make(DcbEventLogStorage) {
       let inboundTranslationSliceData = inboundTranslationSlices.map(ITS => {
         let its = ITS.make(publishJsons, componentRuntime[ITS.Spec.name], opts);
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
+        let exposed = InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(ITS.Spec.externalInputSchema);
+        InboundTranslationSlice_Callback$ReventlessCore.checkReachable(name, ITS.Spec.name, exposed, Stdlib_Option.isSome(ITS.Spec.endpoint));
         let registerResolver = HooksConfig.hooks.inboundMutationResolverHook;
-        if (registerResolver !== undefined) {
+        if (registerResolver !== undefined && exposed) {
           registerResolver(fieldName, ITS.Spec.externalInputSchema, inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf));
         }
         let bindReceive = HooksConfig.hooks.inboundMutationBindReceiveHook;
-        if (bindReceive !== undefined) {
-          Component$ReventlessCore.operations(its).apply(ops => bindReceive(fieldName, ops.receive));
+        if (bindReceive !== undefined && exposed) {
+          Component$ReventlessCore.operations(its).apply(ops => bindReceive(fieldName, (input, caller) => ops.receive(input, caller, undefined)));
         }
         return [
           ITS.Spec.name,
           fieldName,
           its,
-          ITS.Spec.externalInputSchema
+          ITS.Spec.externalInputSchema,
+          exposed
         ];
       });
       let inboundTranslationSlicesOutputs = Object.fromEntries(inboundTranslationSliceData.map(param => [
@@ -482,7 +485,7 @@ function Make(DcbEventLogStorage) {
             let receiveFn = receivers[event.fieldName];
             if (receiveFn !== undefined) {
               return Effect.promise(async () => {
-                let result = await receiveFn(event.arguments, InboundTranslationSlice_Callback$ReventlessCore.doorCaller(event.identity));
+                let result = await receiveFn(event.arguments, InboundTranslationSlice_Callback$ReventlessCore.doorCaller(event.identity), undefined);
                 return CommandTopic$ReventlessCore.commandOutcomeToJson(InboundTranslationSlice_Callback$ReventlessCore.receiveResultToOutcome(result));
               });
             } else {
@@ -507,8 +510,9 @@ function Make(DcbEventLogStorage) {
       });
       let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources.concat(outputs.queryDb.resources)));
       let asyncDcbResources = Object.values(asyncStateChangeSlicesOutputs).flatMap(outputs => outputs.resources);
-      let inboundFieldNames = inboundTranslationSliceData.map(param => param[1]);
-      let inboundSchemas = inboundTranslationSliceData.map(param => param[3]);
+      let exposedInbound = inboundTranslationSliceData.filter(param => param[4]);
+      let inboundFieldNames = exposedInbound.map(param => param[1]);
+      let inboundSchemas = exposedInbound.map(param => param[3]);
       let dcbMutationData = stateChangeSlices.flatMap(S => {
         let commandSchema = S.Spec.commandSchema;
         if (ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
@@ -578,7 +582,7 @@ function Make(DcbEventLogStorage) {
           consistencyRead: Stdlib_Option.flatMap(sliceDef, d => d.consistencyRead)
         };
       });
-      let mutationEntriesFromInboundSlices = inboundTranslationSlices.map(ITS => {
+      let mutationEntriesFromInboundSlices = inboundTranslationSlices.filter(ITS => InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(ITS.Spec.externalInputSchema)).map(ITS => {
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
         let fieldPermissions = {};
         Stdlib_Option.forEach(inboundDoorPermission(ITS.Spec.commandSchema, ITS.Spec.authorizationOf), rule => {

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res

@@ -81,8 +81,13 @@ module Make = (
         ->Pulumi.Output.all2
         ->Pulumi.Output.apply(((queryDbOps, publishJsonsFn)) => {
           let ops: InboundTranslationSlice.operations = {
-            receive: async (inputJson, ~caller=?) => {
-              let result = await Callback.receive(publishJsonsFn, inputJson, ~caller?)
+            receive: async (inputJson, ~caller=?, ~door=?) => {
+              let result = await Callback.receive(publishJsonsFn, inputJson, ~caller?, ~door?)
+              await syncToQueryDb(queryDbOps, result->InboundTranslationSlice_Callback.requestIdOf)
+              result
+            },
+            refuse: async (~body, ~errorCode, error) => {
+              let result = Callback.refuse(~body, ~errorCode, error)
               await syncToQueryDb(queryDbOps, result->InboundTranslationSlice_Callback.requestIdOf)
               result
             },

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res.mjs

@@ -57,8 +57,13 @@ function Make(QueryDbStorage) {
           let publishJsonsFn = param[1];
           let queryDbOps = param[0];
           return {
-            receive: async (inputJson, caller) => {
-              let result = await Callback.receive(publishJsonsFn, inputJson, caller);
+            receive: async (inputJson, caller, door) => {
+              let result = await Callback.receive(publishJsonsFn, inputJson, caller, door);
+              await syncToQueryDb(queryDbOps, InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result));
+              return result;
+            },
+            refuse: async (body, errorCode, error) => {
+              let result = Callback.refuse(body, errorCode, error);
               await syncToQueryDb(queryDbOps, InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result));
               return result;
             }

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res

@@ -15,6 +15,8 @@ type auditRow = {
   commandCount?: int,
   error?: string,
   receivedAt: string,
+  /** Absent on rows written before the slice had a second door. */
+  door?: ReventlessInfra.InboundTranslationSlice.door,
 }
 
 /** The `CommandResult` a `receive` outcome answers with: the first target as
@@ -76,6 +78,19 @@ type doorInvocation = {
 let doorCaller = (identity: Nullable.t<Reventless.Identity.t>): Reventless.Identity.t =>
   identity->Nullable.toOption->Option.getOr(Reventless.Identity.anonymous)
 
+/** Whether a slice's input is offered as a mutation: not when `externalInput`
+    carries `@noApi`, which leaves the webhook as its only door. */
+let exposesMutation = (externalInputSchema: S.t<unknown>): bool =>
+  !ApiNoApiHelpers.isNoApi(externalInputSchema)
+
+/** Refuse a slice with neither door, which nothing could ever reach. */
+let checkReachable = (~plugin: string, ~slice: string, ~mutation: bool, ~webhook: bool) =>
+  if !mutation && !webhook {
+    JsError.throwWithMessage(
+      `${plugin}: inbound translation slice ${slice} has @noApi on externalInput and declares no endpoint, so nothing can reach it`,
+    )
+  }
+
 module type T = {
   module Spec: Reventless.InboundTranslationSlice.Spec
   module Translation: Reventless.InboundTranslationSlice.Translation with module Spec := Spec
@@ -88,7 +103,18 @@ module type T = {
     ReventlessInfra.CommandTopic.publishJsons,
     JSON.t,
     ~caller: Reventless.Identity.t=?,
+    ~door: ReventlessInfra.InboundTranslationSlice.door=?,
   ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>
+
+  /** Record a webhook request refused before it could be read, and reject it. */
+  let refuse: (
+    ~body: string,
+    ~errorCode: string,
+    string,
+  ) => ReventlessInfra.InboundTranslationSlice.receiveResult
+
+  /** The slice's webhook route, if its spec declares an endpoint. */
+  let webhook: option<InboundTranslationSlice_Webhook.route>
 }
 
 module Make = (
@@ -110,15 +136,12 @@ module Make = (
     exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr(fallback)
 
   // One audit row per request, whatever the outcome.
-  let failWith = (~requestId, ~inputJson, ~errorCode=?, error) => {
-    auditLog->Dict.set(
-      requestId,
-      {input: inputJson->JSON.stringify, status: Failure, error, receivedAt: now()},
-    )
+  let failWith = (~requestId, ~input, ~door, ~errorCode=?, error) => {
+    auditLog->Dict.set(requestId, {input, status: Failure, error, receivedAt: now(), door})
     Error({ReventlessInfra.InboundTranslationSlice.requestId, error, ?errorCode})
   }
 
-  let succeed = (~requestId, ~inputJson, targetIds) => {
+  let succeed = (~requestId, ~inputJson, ~door, targetIds) => {
     let commandCount = targetIds->Array.length
     auditLog->Dict.set(
       requestId,
@@ -128,6 +151,7 @@ module Make = (
         targetIds,
         commandCount,
         receivedAt: now(),
+        door,
       },
     )
     Ok({ReventlessInfra.InboundTranslationSlice.requestId, targetIds, commandCount})
@@ -155,9 +179,12 @@ module Make = (
     publishJsons: ReventlessInfra.CommandTopic.publishJsons,
     inputJson: JSON.t,
     ~caller: option<Reventless.Identity.t>=?,
+    ~door: ReventlessInfra.InboundTranslationSlice.door=Mutation,
   ): ReventlessInfra.InboundTranslationSlice.receiveResult => {
     let requestId = Uuid.v4()
-    let fail = (~errorCode=?, error) => failWith(~requestId, ~inputJson, ~errorCode?, error)
+    let fail = (~errorCode=?, error) =>
+      failWith(~requestId, ~input=inputJson->JSON.stringify, ~door, ~errorCode?, error)
+    let succeed = succeed(~requestId, ~inputJson, ~door, ...)
     let parsed = try Ok(inputJson->S.parseOrThrow(~to=Spec.externalInputSchema)) catch {
     | exn => Error(messageOf(exn, "invalid input"))
     }
@@ -192,16 +219,24 @@ module Make = (
             ~errorCode="Forbidden",
             `${Spec.name}: the caller is not authorized for every command this input translates into`,
           )
-        | Ok([]) => succeed(~requestId, ~inputJson, [])
+        | Ok([]) => succeed([])
         | Ok(msgs) =>
           try {
             await publishJsons(msgs)
-            succeed(~requestId, ~inputJson, pairs->Array.map(((targetId, _)) => targetId))
+            succeed(pairs->Array.map(((targetId, _)) => targetId))
           } catch {
-          | exn => fail(messageOf(exn, "publish failed"))
+          | exn => fail(~errorCode="PublishFailed", messageOf(exn, "publish failed"))
           }
         }
       }
     }
   }
+
+  let refuse = (~body, ~errorCode, error) =>
+    failWith(~requestId=Uuid.v4(), ~input=body, ~door=Webhook, ~errorCode, error)
+
+  let webhook =
+    Spec.endpoint->Option.map(endpoint =>
+      InboundTranslationSlice_Webhook.routeOf(~slice=Spec.name, endpoint)
+    )
 }

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs

@@ -7,6 +7,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Message$Reventless from "@reventlessdev/reventless-spec/src/types/Message.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
@@ -16,6 +17,9 @@ import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types
 import * as Message$ReventlessCore from "../../Message.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
+import * as ApiNoApiHelpers$ReventlessCore from "../Api/ApiNoApiHelpers.res.mjs";
+import * as InboundTranslationSlice$ReventlessInfra from "@reventlessdev/reventless-infra/src/components/InboundTranslationSlice.res.mjs";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "./InboundTranslationSlice_Webhook.res.mjs";
 
 let auditStatusSchema = Sury.union([
   Sury.literal("Success"),
@@ -28,7 +32,8 @@ let auditRowSchema = Sury.$schema(s => ({
   targetIds: s.m(Sury.$option(Sury.array(Sury.string))),
   commandCount: s.m(Sury.$option(Sury.int32)),
   error: s.m(Sury.$option(Sury.string)),
-  receivedAt: s.m(Sury.string)
+  receivedAt: s.m(Sury.string),
+  door: s.m(Sury.$option(InboundTranslationSlice$ReventlessInfra.doorSchema))
 }));
 
 function receiveResultToOutcome(result) {
@@ -87,26 +92,35 @@ function doorCaller(identity) {
   return Stdlib_Option.getOr((identity == null) ? undefined : Primitive_option.some(identity), Identity$Reventless.anonymous);
 }
 
+function exposesMutation(externalInputSchema) {
+  return !ApiNoApiHelpers$ReventlessCore.isNoApi(externalInputSchema);
+}
+
+function checkReachable(plugin, slice, mutation, webhook) {
+  if (!mutation && !webhook) {
+    return Stdlib_JsError.throwWithMessage(plugin + `: inbound translation slice ` + slice + ` has @noApi on externalInput and declares no endpoint, so nothing can reach it`);
+  }
+}
+
 function Make(Spec) {
   return Translation => {
     let auditLog = {};
     let makeMeta = () => Message$ReventlessCore.generateMeta(Spec.targetName, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
     let messageOf = (exn, fallback) => Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), fallback);
-    let succeed = (requestId, inputJson, targetIds) => {
-      let commandCount = targetIds.length;
+    let failWith = (requestId, input, door, errorCode, error) => {
       auditLog[requestId] = {
-        input: JSON.stringify(inputJson),
-        status: "Success",
-        targetIds: targetIds,
-        commandCount: commandCount,
-        receivedAt: new Date().toISOString()
+        input: input,
+        status: "Failure",
+        error: error,
+        receivedAt: new Date().toISOString(),
+        door: door
       };
       return {
-        TAG: "Ok",
+        TAG: "Error",
         _0: {
           requestId: requestId,
-          targetIds: targetIds,
-          commandCount: commandCount
+          error: error,
+          errorCode: errorCode
         }
       };
     };
@@ -129,21 +143,26 @@ function Make(Spec) {
         };
       }
     };
-    let receive = async (publishJsons, inputJson, caller) => {
+    let receive = async (publishJsons, inputJson, caller, doorOpt) => {
+      let door = doorOpt !== undefined ? doorOpt : "Mutation";
       let requestId = Uuid.v4();
-      let fail = (errorCode, error) => {
+      let fail = (errorCode, error) => failWith(requestId, JSON.stringify(inputJson), door, errorCode, error);
+      let succeed = extra => {
+        let commandCount = extra.length;
         auditLog[requestId] = {
           input: JSON.stringify(inputJson),
-          status: "Failure",
-          error: error,
-          receivedAt: new Date().toISOString()
+          status: "Success",
+          targetIds: extra,
+          commandCount: commandCount,
+          receivedAt: new Date().toISOString(),
+          door: door
         };
         return {
-          TAG: "Error",
+          TAG: "Ok",
           _0: {
             requestId: requestId,
-            error: error,
-            errorCode: errorCode
+            targetIds: extra,
+            commandCount: commandCount
           }
         };
       };
@@ -197,20 +216,24 @@ function Make(Spec) {
         return fail("Forbidden", Spec.name + `: the caller is not authorized for every command this input translates into`);
       }
       if (msgs.length === 0) {
-        return succeed(requestId, inputJson, []);
+        return succeed([]);
       }
       try {
         await publishJsons(msgs);
-        return succeed(requestId, inputJson, pairs.map(param => param[0]));
+        return succeed(pairs.map(param => param[0]));
       } catch (raw_exn$1) {
         let exn$1 = Primitive_exceptions.internalToException(raw_exn$1);
-        return fail(undefined, messageOf(exn$1, "publish failed"));
+        return fail("PublishFailed", messageOf(exn$1, "publish failed"));
       }
     };
+    let refuse = (body, errorCode, error) => failWith(Uuid.v4(), body, "Webhook", errorCode, error);
+    let webhook = Stdlib_Option.map(Spec.endpoint, endpoint => InboundTranslationSlice_Webhook$ReventlessCore.routeOf(Spec.name, endpoint));
     return {
       Spec: Spec,
       auditLog: auditLog,
-      receive: receive
+      receive: receive,
+      refuse: refuse,
+      webhook: webhook
     };
   };
 }
@@ -223,6 +246,8 @@ export {
   takeAuditRow,
   callerAdmits,
   doorCaller,
+  exposesMutation,
+  checkReachable,
   Make,
 }
 /* auditStatusSchema Not a pure module */

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res

@@ -0,0 +1,231 @@
+// The HTTP door of an inbound translation slice: find the slice a request's path
+// names, check its signature over the raw body, and hand the parsed body to
+// `receive` as the caller the endpoint stands for. Runtime-pure — the AWS command
+// Lambda and the local registry both serve through it.
+
+type request = {
+  method: string,
+  path: string,
+  /** Header names lower-cased. */
+  headers: dict<string>,
+  /** The body exactly as sent: a signature is over these bytes, not over a re-encoding. */
+  body: string,
+}
+
+type response = {status: int, body: string}
+
+/** An endpoint with its slice's role erased to a role name. */
+type route = {
+  slice: string,
+  path: string,
+  method: string,
+  auth: Reventless.InboundTranslationSlice.webhookAuth,
+  roles: array<Reventless.Role.name>,
+}
+
+/** A route and the slice operations that serve it. `receive` is the webhook door's. */
+type slice = {
+  route: route,
+  receive: (
+    JSON.t,
+    ~caller: Reventless.Identity.t,
+  ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>,
+  refuse: (
+    ~body: string,
+    ~errorCode: string,
+    string,
+  ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>,
+}
+
+let normalizePath = (path: string): string =>
+  path->String.split("/")->Array.filter(segment => segment != "")->Array.join("/")
+
+let routeOf = (
+  ~slice: string,
+  endpoint: Reventless.InboundTranslationSlice.endpointConfig<'role>,
+): route => {
+  slice,
+  path: normalizePath(endpoint.path),
+  method: (endpoint.method->Option.getOr(Post) :> string),
+  auth: endpoint.auth,
+  roles: switch endpoint.role {
+  | Some(role) =>
+    Reventless.Authorization.AllowRoles([role])
+    ->Reventless.Authorization.named
+    ->Reventless.Authorization.rolesOf
+  | None => []
+  },
+}
+
+/** The environment variable a named secret is read from. */
+let secretEnvKey = (name: string): string =>
+  "REVENTLESS_WEBHOOK_SECRET_" ++ name->String.toUpperCase->String.replaceRegExp(/[^A-Z0-9]/g, "_")
+
+/** The secrets a variable holds: several, comma-separated, while one is rotated. */
+let secretsOf = (raw: string): array<string> =>
+  raw->String.split(",")->Array.map(String.trim)->Array.filter(secret => secret != "")
+
+@val external env: dict<string> = "process.env"
+
+let secretFromEnv = (name: string): option<string> => env->Dict.get(secretEnvKey(name))
+
+// Compares every character whatever the first difference, so the time taken does
+// not tell a forger how much of a guess was right.
+let sameText = (a: string, b: string): bool => {
+  let code = (text, i) => text->String.charCodeAt(i)->Option.getOr(0)
+  a->String.length == b->String.length && {
+      let diff = ref(0)
+      for i in 0 to a->String.length - 1 {
+        diff := diff.contents->Int.bitwiseOr(code(a, i)->Int.bitwiseXor(code(b, i)))
+      }
+      diff.contents == 0
+    }
+}
+
+let hmacHex = (~secret: string, text: string): string =>
+  NodeCrypto.createHmac("sha256", secret)->NodeCrypto.hmacUpdate(text)->NodeCrypto.hmacDigest("hex")
+
+/** Whether `body` carries a valid signature by one of `secrets`. */
+let verify = (
+  signature: Reventless.InboundTranslationSlice.signature,
+  ~secrets: array<string>,
+  ~headers: dict<string>,
+  ~body: string,
+  ~nowSeconds: float,
+): result<unit, string> => {
+  let header = name => headers->Dict.get(name->String.toLowerCase)
+  let given = switch (header(signature.header), signature.prefix) {
+  | (None, _) => Error(`missing ${signature.header} header`)
+  | (Some(raw), None) => Ok(raw)
+  | (Some(raw), Some(prefix)) if raw->String.startsWith(prefix) =>
+    Ok(raw->String.slice(~start=prefix->String.length))
+  | (Some(_), Some(prefix)) => Error(`${signature.header} does not start with "${prefix}"`)
+  }
+  let signed = switch signature.timestampHeader {
+  | None => Ok(body)
+  | Some(name) =>
+    switch header(name) {
+    | None => Error(`missing ${name} header`)
+    | Some(raw) =>
+      switch raw->Float.fromString {
+      | None => Error(`${name} is not a time in seconds`)
+      | Some(at)
+        if Math.abs(nowSeconds -. at) >
+        signature.toleranceSeconds->Option.getOr(300)->Int.toFloat =>
+        Error(`${name} is outside the accepted window`)
+      | Some(_) => Ok(`${raw}.${body}`)
+      }
+    }
+  }
+  switch (given, signed) {
+  | (Error(msg), _) | (_, Error(msg)) => Error(msg)
+  | (Ok(given), Ok(text)) =>
+    let given = given->String.trim->String.toLowerCase
+    secrets->Array.some(secret => sameText(hmacHex(~secret, text), given))
+      ? Ok()
+      : Error(`${signature.header} does not match the body`)
+  }
+}
+
+/** Who a request that passed `route.auth` acts as. An open URL identifies nobody. */
+let callerOf = (route: route, ~signed: bool): Reventless.Identity.t =>
+  signed
+    ? {
+        userId: `webhook:${route.slice}`,
+        username: route.slice,
+        groups: route.roles->Array.map(Reventless.Role.groupOf),
+        provider: Custom("webhook"),
+      }
+    : Reventless.Identity.anonymous
+
+let json = (fields: array<(string, JSON.t)>): string =>
+  fields->Dict.fromArray->JSON.Encode.object->JSON.stringify
+
+let plain = (status, error) => {status, body: json([("error", JSON.Encode.string(error))])}
+
+/** The status a sender acts on: 2xx done, 5xx try again, any other 4xx do not. */
+let statusOf = (result: ReventlessInfra.InboundTranslationSlice.receiveResult): int =>
+  switch result {
+  | Ok(_) => 200
+  | Error({errorCode: "Unsigned"}) => 401
+  | Error({errorCode: "InvalidBody"}) => 400
+  | Error({errorCode: "Forbidden"}) => 403
+  | Error({errorCode: "PublishFailed"}) => 503
+  | Error(_) => 422
+  }
+
+let respond = (result: ReventlessInfra.InboundTranslationSlice.receiveResult): response => {
+  status: statusOf(result),
+  body: switch result {
+  | Ok({requestId, commandCount}) =>
+    json([
+      ("requestId", JSON.Encode.string(requestId)),
+      ("commandCount", JSON.Encode.int(commandCount)),
+    ])
+  | Error({requestId, error}) =>
+    json([("requestId", JSON.Encode.string(requestId)), ("error", JSON.Encode.string(error))])
+  },
+}
+
+/** Serve one request on its slice. A secret the platform does not have is a
+    misconfiguration, answered 500 and logged, never treated as open. */
+let serve = async (
+  slice: slice,
+  ~secretOf: string => option<string>=secretFromEnv,
+  ~nowSeconds: float=Date.now() /. 1000.,
+  request: request,
+): response =>
+  if request.method->String.toUpperCase != slice.route.method {
+    plain(405, `${slice.route.path} accepts ${slice.route.method}`)
+  } else {
+    let signed = switch slice.route.auth {
+    | Open => Ok(Ok(false))
+    | SignedBody(signature) =>
+      switch secretOf(signature.secret)->Option.mapOr([], secretsOf) {
+      | [] => Error(secretEnvKey(signature.secret))
+      | secrets =>
+        Ok(
+          verify(
+            signature,
+            ~secrets,
+            ~headers=request.headers,
+            ~body=request.body,
+            ~nowSeconds,
+          )->Result.map(() => true),
+        )
+      }
+    }
+    switch signed {
+    | Error(key) =>
+      EffectLogger.logError(
+        ~comp=`InboundTranslationSlice(${slice.route.slice})`,
+        `webhook secret ${key} is not set; refusing every request`,
+      )->Effect.runSync
+      plain(500, "webhook is not configured")
+    | Ok(Error(msg)) => respond(await slice.refuse(~body=request.body, ~errorCode="Unsigned", msg))
+    | Ok(Ok(signed)) =>
+      switch try Some(JSON.parseOrThrow(request.body)) catch {
+      | _ => None
+      } {
+      | None =>
+        respond(
+          await slice.refuse(~body=request.body, ~errorCode="InvalidBody", "body is not JSON"),
+        )
+      | Some(input) => respond(await slice.receive(input, ~caller=callerOf(slice.route, ~signed)))
+      }
+    }
+  }
+
+/** Serve a request on whichever slice its path names. */
+let dispatch = async (
+  slices: array<slice>,
+  ~secretOf=?,
+  ~nowSeconds=?,
+  request: request,
+): response => {
+  let path = normalizePath(request.path)
+  switch slices->Array.find(slice => slice.route.path == path) {
+  | Some(slice) => await serve(slice, ~secretOf?, ~nowSeconds?, request)
+  | None => plain(404, `no webhook at /${path}`)
+  }
+}

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs

@@ -0,0 +1,294 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Float from "@rescript/runtime/lib/es6/Stdlib_Float.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Effect from "effect/Effect";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
+import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
+
+function normalizePath(path) {
+  return path.split("/").filter(segment => segment !== "").join("/");
+}
+
+function routeOf(slice, endpoint) {
+  let role = endpoint.role;
+  return {
+    slice: slice,
+    path: normalizePath(endpoint.path),
+    method: Stdlib_Option.getOr(endpoint.method, "POST"),
+    auth: endpoint.auth,
+    roles: role !== undefined ? Authorization$Reventless.rolesOf(Authorization$Reventless.named({
+        TAG: "AllowRoles",
+        _0: [Primitive_option.valFromOption(role)]
+      })) : []
+  };
+}
+
+function secretEnvKey(name) {
+  return "REVENTLESS_WEBHOOK_SECRET_" + name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+
+function secretsOf(raw) {
+  return raw.split(",").map(prim => prim.trim()).filter(secret => secret !== "");
+}
+
+function secretFromEnv(name) {
+  return process.env[secretEnvKey(name)];
+}
+
+function sameText(a, b) {
+  let code = (text, i) => Stdlib_Option.getOr(Stdlib_String.charCodeAt(text, i), 0);
+  if (a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0, i_finish = a.length; i < i_finish; ++i) {
+    diff = diff | code(a, i) ^ code(b, i);
+  }
+  return diff === 0;
+}
+
+function hmacHex(secret, text) {
+  return Nodecrypto.createHmac("sha256", secret).update(text).digest("hex");
+}
+
+function verify(signature, secrets, headers, body, nowSeconds) {
+  let match = headers[signature.header.toLowerCase()];
+  let match$1 = signature.prefix;
+  let given = match !== undefined ? (
+      match$1 !== undefined ? (
+          match.startsWith(match$1) ? ({
+              TAG: "Ok",
+              _0: match.slice(match$1.length)
+            }) : ({
+              TAG: "Error",
+              _0: signature.header + ` does not start with "` + match$1 + `"`
+            })
+        ) : ({
+          TAG: "Ok",
+          _0: match
+        })
+    ) : ({
+      TAG: "Error",
+      _0: `missing ` + signature.header + ` header`
+    });
+  let name = signature.timestampHeader;
+  let signed;
+  if (name !== undefined) {
+    let raw = headers[name.toLowerCase()];
+    if (raw !== undefined) {
+      let at = Stdlib_Float.fromString(raw);
+      signed = at !== undefined ? (
+          Math.abs(nowSeconds - at) > Stdlib_Option.getOr(signature.toleranceSeconds, 300) ? ({
+              TAG: "Error",
+              _0: name + ` is outside the accepted window`
+            }) : ({
+              TAG: "Ok",
+              _0: raw + `.` + body
+            })
+        ) : ({
+          TAG: "Error",
+          _0: name + ` is not a time in seconds`
+        });
+    } else {
+      signed = {
+        TAG: "Error",
+        _0: `missing ` + name + ` header`
+      };
+    }
+  } else {
+    signed = {
+      TAG: "Ok",
+      _0: body
+    };
+  }
+  if (given.TAG !== "Ok") {
+    return {
+      TAG: "Error",
+      _0: given._0
+    };
+  }
+  if (signed.TAG !== "Ok") {
+    return {
+      TAG: "Error",
+      _0: signed._0
+    };
+  }
+  let text = signed._0;
+  let given$1 = given._0.trim().toLowerCase();
+  if (secrets.some(secret => sameText(hmacHex(secret, text), given$1))) {
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: signature.header + ` does not match the body`
+    };
+  }
+}
+
+function callerOf(route, signed) {
+  if (signed) {
+    return {
+      userId: `webhook:` + route.slice,
+      username: route.slice,
+      groups: route.roles.map(Role$Reventless.groupOf),
+      provider: {
+        TAG: "Custom",
+        _0: "webhook"
+      }
+    };
+  } else {
+    return Identity$Reventless.anonymous;
+  }
+}
+
+function json(fields) {
+  return JSON.stringify(Object.fromEntries(fields));
+}
+
+function plain(status, error) {
+  return {
+    status: status,
+    body: json([[
+        "error",
+        error
+      ]])
+  };
+}
+
+function statusOf(result) {
+  if (result.TAG === "Ok") {
+    return 200;
+  }
+  switch (result._0.errorCode) {
+    case "Forbidden" :
+      return 403;
+    case "InvalidBody" :
+      return 400;
+    case "PublishFailed" :
+      return 503;
+    case "Unsigned" :
+      return 401;
+    default:
+      return 422;
+  }
+}
+
+function respond(result) {
+  let tmp;
+  if (result.TAG === "Ok") {
+    let match = result._0;
+    tmp = json([
+      [
+        "requestId",
+        match.requestId
+      ],
+      [
+        "commandCount",
+        match.commandCount
+      ]
+    ]);
+  } else {
+    let match$1 = result._0;
+    tmp = json([
+      [
+        "requestId",
+        match$1.requestId
+      ],
+      [
+        "error",
+        match$1.error
+      ]
+    ]);
+  }
+  return {
+    status: statusOf(result),
+    body: tmp
+  };
+}
+
+async function serve(slice, secretOfOpt, nowSecondsOpt, request) {
+  let secretOf = secretOfOpt !== undefined ? secretOfOpt : secretFromEnv;
+  let nowSeconds = nowSecondsOpt !== undefined ? nowSecondsOpt : Date.now() / 1000;
+  if (request.method.toUpperCase() !== slice.route.method) {
+    return plain(405, slice.route.path + ` accepts ` + slice.route.method);
+  }
+  let signature = slice.route.auth;
+  let signed;
+  if (typeof signature !== "object") {
+    signed = {
+      TAG: "Ok",
+      _0: {
+        TAG: "Ok",
+        _0: false
+      }
+    };
+  } else {
+    let signature$1 = signature._0;
+    let secrets = Stdlib_Option.mapOr(secretOf(signature$1.secret), [], secretsOf);
+    signed = secrets.length !== 0 ? ({
+        TAG: "Ok",
+        _0: Stdlib_Result.map(verify(signature$1, secrets, request.headers, request.body, nowSeconds), () => true)
+      }) : ({
+        TAG: "Error",
+        _0: secretEnvKey(signature$1.secret)
+      });
+  }
+  if (signed.TAG === "Ok") {
+    let msg = signed._0;
+    if (msg.TAG !== "Ok") {
+      return respond(await slice.refuse(request.body, "Unsigned", msg._0));
+    }
+    let input;
+    try {
+      input = JSON.parse(request.body);
+    } catch (exn) {
+      input = undefined;
+    }
+    if (input !== undefined) {
+      return respond(await slice.receive(input, callerOf(slice.route, msg._0)));
+    } else {
+      return respond(await slice.refuse(request.body, "InvalidBody", "body is not JSON"));
+    }
+  }
+  Effect.runSync(EffectLogger$ReventlessCore.logError(`InboundTranslationSlice(` + slice.route.slice + `)`, undefined, `webhook secret ` + signed._0 + ` is not set; refusing every request`));
+  return plain(500, "webhook is not configured");
+}
+
+async function dispatch(slices, secretOf, nowSeconds, request) {
+  let path = normalizePath(request.path);
+  let slice = slices.find(slice => slice.route.path === path);
+  if (slice !== undefined) {
+    return await serve(slice, secretOf, nowSeconds, request);
+  } else {
+    return plain(404, `no webhook at /` + path);
+  }
+}
+
+export {
+  normalizePath,
+  routeOf,
+  secretEnvKey,
+  secretsOf,
+  secretFromEnv,
+  sameText,
+  hmacHex,
+  verify,
+  callerOf,
+  json,
+  plain,
+  statusOf,
+  respond,
+  serve,
+  dispatch,
+}
+/* node:crypto Not a pure module */

package/tests/plugin/PluginStructureAccessTest.res

@@ -146,6 +146,7 @@ module PsTwoRuleFeed = {
   @schema type command = AddProduct({sku: string}) | AddCategory({sku: string})
   let targetName = "AddProduct"
   let externalSystem = None
+  let endpoint = None
   type role = Reventless.Role.name
   let authorizationOf = (name: string): Reventless.Authorization.rule<role> =>
     switch name {

package/tests/plugin/PluginStructureAccessTest.res.mjs

@@ -178,6 +178,8 @@ globalThis.describe("requiredAccess derived from the authorization rule", () =>
   });
 });
 
+let name = "PsTwoRuleFeed";
+
 let moduleUrl = "ps-two-rule-feed://spec";
 
 let externalInputSchema = Sury.$schema(s => ({
@@ -195,6 +197,8 @@ let commandSchema = Sury.union([
   }))
 ]);
 
+let targetName = "AddProduct";
+
 function authorizationOf(name) {
   switch (name) {
     case "AddCategory" :
@@ -215,12 +219,13 @@ function authorizationOf(name) {
 let traits = [];
 
 let PsTwoRuleFeed = {
-  name: "PsTwoRuleFeed",
+  name: name,
   moduleUrl: moduleUrl,
   externalInputSchema: externalInputSchema,
   commandSchema: commandSchema,
-  targetName: "AddProduct",
+  targetName: targetName,
   externalSystem: undefined,
+  endpoint: undefined,
   authorizationOf: authorizationOf,
   traits: traits
 };
@@ -241,8 +246,19 @@ function make$3(param, param$1, param$2) {
   return 0;
 }
 
+let PsTwoRuleFeedSlice_Spec = {
+  name: name,
+  moduleUrl: moduleUrl,
+  externalInputSchema: externalInputSchema,
+  commandSchema: commandSchema,
+  targetName: targetName,
+  externalSystem: undefined,
+  authorizationOf: authorizationOf,
+  endpoint: undefined
+};
+
 let PsTwoRuleFeedSlice = {
-  Spec: PsTwoRuleFeed,
+  Spec: PsTwoRuleFeedSlice_Spec,
   Translation: Translation,
   queryDbName: "PsTwoRuleFeedAudit",
   make: make$3