@reventlessdev/reventless-gwt 1.0.0-alpha.230 → 1.0.0-alpha.232

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.232 (2026-10-01)
+
+### Features
+
+* **spec, core, gwt, ppx:** a command acts only on what its caller owns ([2636f0e](https://github.com/ReventlessDev/reventless-core/commit/2636f0ee44797ee2c0b0c40a7107cf306113173f))
+
+
+# 1.0.0-alpha.231 (2026-09-29)
+
+**Note:** Version bump only for package @reventlessdev/reventless-gwt
+
+
+
+
+
 # 1.0.0-alpha.230 (2026-09-28)
 
 **Note:** Version bump only for package @reventlessdev/reventless-gwt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-gwt",
-  "version": "1.0.0-alpha.230",
+  "version": "1.0.0-alpha.232",
   "description": "Given-When-Then DSLs and test harness for Reventless slice testing",
   "license": "Apache-2.0",
   "jest": {
@@ -16,10 +16,10 @@
     "sury": "11.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.283",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.181",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.19",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.153"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.285",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.183",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.155"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Behavior_GWT.res

@@ -22,6 +22,121 @@ open ReventlessCore
 // and slice users *cannot* use [MakeFromAggregate] (their Spec/Behavior shape
 // differs). Pick the matching entry point.
 
+// ---------------------------------------------------------------------------
+// Who issues the command, for slices and aggregates that mark `@owner` on the
+// events they decide on. `asCaller` names the caller before `whenCmd`; the
+// command is then checked against the owners the given events record, exactly
+// as the handler checks it before `decide`. Without `asCaller` the command
+// carries no caller claim, which the handler reads as the platform acting for
+// itself — so every scenario written before this existed is unchanged.
+// ---------------------------------------------------------------------------
+module Caller = {
+  external unsafeAsString: 'id => string = "%identity"
+
+  /**
+  A caller who owns only what records their id.
+
+  Takes the id as the scenario has it — `Caller.owner(c1)` with `c1: CustomerId.t`,
+  or a plain string — because every `Id.Make` identity is a string on the wire.
+  The type is not checked, and need not be: an id of the wrong entity matches no
+  recorded owner, so it can only be refused, which fails the scenario that
+  expected the owner to act. A value that is not a string at all is refused here.
+  */
+  let owner = (id: 'id): Message.CallerClaim.t =>
+    if Reventless.OwnerScope.isJsString(id) {
+      Owned({userId: id->unsafeAsString})
+    } else {
+      JsError.throwWithMessage(
+        "Caller.owner: expected an id (a string at runtime, such as an Id.Make identity)",
+      )
+    }
+  /** A caller in an elevated group, acting on anyone's behalf. */
+  let operator: Message.CallerClaim.t = Exempt
+  /** A caller with no identity. */
+  let anonymous: Message.CallerClaim.t = Unidentified
+}
+
+module type ActingSpec = {
+  let name: string
+  @schema
+  type history
+  @schema
+  type command
+}
+
+module Acting = (Spec: ActingSpec) => {
+  let caller: ref<option<Message.CallerClaim.t>> = ref(None)
+  let refusal: ref<option<CommandTopic_Helpers.rejectedResult>> = ref(None)
+
+  let ownerFieldsByEventType = Reventless.Owner.fieldNamesByVariant(
+    Spec.historySchema->S.castToUnknown,
+  )
+
+  let asCaller = (history, claim) => {
+    caller := Some(claim)
+    history
+  }
+
+  // Every given event is the command's own history here, so all of them count.
+  // The caller is consumed: the next scenario starts with no claim.
+  let refuses = (history: array<Spec.history>, command: Spec.command): bool => {
+    let claim = caller.contents
+    caller := None
+    refusal := None
+    if ownerFieldsByEventType->Dict.keysToArray->Array.length == 0 {
+      false
+    } else {
+      let owners = history->Array.reduce([], (owners, event) => {
+        let (eventType, data) = event->Message.encode(Spec.historySchema)->Message.splitMessage
+        switch ownerFieldsByEventType->Dict.get(eventType) {
+        | Some(fields) => owners->Reventless.OwnerScope.recordOwners(~fields, data)
+        | None => owners
+        }
+      })
+      refusal :=
+        Reventless.OwnerScope.decideActing(~claim, ~recordedOwners=Some(owners))
+        ->CommandTopic_Helpers.ownershipRefusal(
+          ~component=Spec.name,
+          ~command=command->Message.encode(Spec.commandSchema)->Message.variantNameOfJson,
+        )
+        ->Option.map(r => r.rejected)
+      refusal.contents->Option.isSome
+    }
+  }
+
+  let encRefusal = (r: CommandTopic_Helpers.rejectedResult) =>
+    JSON.Encode.object(
+      Dict.fromArray([
+        ("errorCode", JSON.Encode.string(r.errorCode)),
+        ("errorDetail", JSON.Encode.string(r.errorDetail)),
+      ]),
+    )
+
+  // Any other `then*` after a refused command fails: `decide` never ran, so
+  // there is nothing for it to compare.
+  let unexpectedRefusal = (): option<Outcome.outcome> =>
+    refusal.contents->Option.map(r =>
+      Outcome.fail(
+        ErrorMismatch({expected: JSON.Encode.null, actual: Some(encRefusal(r)), actualEvents: []}),
+      )
+    )
+
+  let thenRefused = (~encEvents, ~decided: option<JSON.t>, events) =>
+    switch refusal.contents {
+    | Some(_) => Outcome.pass
+    | None =>
+      Outcome.fail(
+        ErrorMismatch({
+          expected: JSON.Encode.object(
+            Dict.fromArray([("errorCode", JSON.Encode.string("Forbidden"))]),
+          ),
+          actual: decided,
+          actualEvents: encEvents(events),
+        }),
+      )
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Slice form — replaces the legacy `StateChangeSlice_GWT`.
 // ---------------------------------------------------------------------------
@@ -60,6 +175,10 @@ module type T = {
 
   let givenEvents: array<Spec.consumedEvent> => array<Spec.consumedEvent>
 
+  // Who issues the next `whenCmd`; see `Caller`.
+  module Caller: module type of Caller
+  let asCaller: (array<Spec.consumedEvent>, Message.CallerClaim.t) => array<Spec.consumedEvent>
+
   let whenCmd: (array<Spec.consumedEvent>, Spec.command) => array<Spec.event>
 
   let thenEvent: (array<Spec.event>, Spec.event) => Outcome.outcome
@@ -68,6 +187,8 @@ module type T = {
   let thenEventWithError: (array<Spec.event>, Spec.event, Spec.error) => Outcome.outcome
   let thenEventsWithError: (array<Spec.event>, array<Spec.event>, Spec.error) => Outcome.outcome
   let thenError: (array<Spec.event>, Spec.error) => Outcome.outcome
+  // Refused before `decide` because the caller does not own what it acts on.
+  let thenRefused: array<Spec.event> => Outcome.outcome
 
   // DCB optimistic-concurrency assertions.
   let thenAppendsConditionedOn: (array<Spec.event>, Reventless.DcbTag.query) => Outcome.outcome
@@ -242,6 +363,16 @@ module Make = (Spec: BehaviorSpec, Behavior: Behavior with module Spec := Spec):
   module Core = AssertionCore(Spec)
   let errors = Core.errors
 
+  module Caller = Caller
+  module Guard = Acting({
+    let name = Spec.name
+    type history = Spec.consumedEvent
+    let historySchema = Spec.consumedEventSchema
+    type command = Spec.command
+    let commandSchema = Spec.commandSchema
+  })
+  let asCaller = Guard.asCaller
+
   // DCB append-condition derived inside [whenCmd]; [None] until first call.
   let derivedCondition: ref<option<Reventless.DcbTag.appendCondition>> = ref(None)
 
@@ -379,12 +510,15 @@ module Make = (Spec: BehaviorSpec, Behavior: Behavior with module Spec := Spec):
       }
     }
 
-    let state = currentState(history)
-    switch Behavior.decide(state, command) {
-    | Ok(events) => events
-    | Error(error) =>
-      errors := [error]
+    if Guard.refuses(history, command) {
       []
+    } else {
+      switch Behavior.decide(currentState(history), command) {
+      | Ok(events) => events
+      | Error(error) =>
+        errors := [error]
+        []
+      }
     }
   }
 
@@ -392,7 +526,17 @@ module Make = (Spec: BehaviorSpec, Behavior: Behavior with module Spec := Spec):
   let whenCmd = (history, cmd) => history->exec(cmd)
 
   let checkAppendCondition = (): option<Outcome.outcome> =>
-    appendConditionFailure.contents->Option.map(m => Outcome.fail(m))
+    switch appendConditionFailure.contents {
+    | Some(m) => Some(Outcome.fail(m))
+    | None => Guard.unexpectedRefusal()
+    }
+
+  let thenRefused = events =>
+    Guard.thenRefused(
+      ~encEvents=Core.encEvents,
+      ~decided=errors.contents->Array.get(0)->Option.map(Core.encError),
+      events,
+    )
 
   // The append-condition footgun is surfaced before the shared comparison core
   // runs; `thenAppends*` below bypass it deliberately.
@@ -503,6 +647,10 @@ module type AggregateT = {
 
   let givenEvents: array<Spec.event> => array<Spec.event>
 
+  // Who issues the next `whenCmd`; see `Caller`.
+  module Caller: module type of Caller
+  let asCaller: (array<Spec.event>, Message.CallerClaim.t) => array<Spec.event>
+
   let whenCmd: (array<Spec.event>, Spec.command) => array<Spec.event>
 
   let thenEvent: (array<Spec.event>, Spec.event) => Outcome.outcome
@@ -521,6 +669,8 @@ module type AggregateT = {
   ) => Outcome.outcome
   let thenEventsWithError: (array<Spec.event>, array<Spec.event>, Spec.error) => Outcome.outcome
   let thenError: (array<Spec.event>, Spec.error) => Outcome.outcome
+  // Refused before `decide` because the caller does not own what it acts on.
+  let thenRefused: array<Spec.event> => Outcome.outcome
 }
 
 module MakeFromAggregate = (Spec: AggregateSpec, Behavior: Behavior.T with module Spec = Spec): (
@@ -536,14 +686,27 @@ module MakeFromAggregate = (Spec: AggregateSpec, Behavior: Behavior.T with modul
   module Core = AssertionCore(Spec)
   let errors = Core.errors
 
+  module Caller = Caller
+  module Guard = Acting({
+    let name = Spec.name
+    type history = Spec.event
+    let historySchema = Spec.eventSchema
+    type command = Spec.command
+    let commandSchema = Spec.commandSchema
+  })
+  let asCaller = Guard.asCaller
+
   let exec = (history, command): array<Spec.event> => {
     errors := []
-    let state = currentState(history)
-    switch Behavior.decide(state, command) {
-    | Ok(events) => events
-    | Error(error) =>
-      errors := [error]
+    if Guard.refuses(history, command) {
       []
+    } else {
+      switch Behavior.decide(currentState(history), command) {
+      | Ok(events) => events
+      | Error(error) =>
+        errors := [error]
+        []
+      }
     }
   }
 
@@ -551,20 +714,34 @@ module MakeFromAggregate = (Spec: AggregateSpec, Behavior: Behavior.T with modul
   let whenCmd = (history, cmd) => history->exec(cmd)
 
   // The aggregate flavour has no append-condition footgun, so the shared core's
-  // comparisons are exposed directly; only `thenCompare*` (custom equality) is
-  // specific to this surface.
-  let thenEvents = Core.compareEvents
-  let thenCompareEvents = Core.compareEventsWith
+  // comparisons are exposed directly once a refusal has been ruled out; only
+  // `thenCompare*` (custom equality) is specific to this surface.
+  let unlessRefused = (events, compare) =>
+    switch Guard.unexpectedRefusal() {
+    | Some(o) => o
+    | None => compare(events)
+    }
+  let thenEvents = (events, expected) => events->unlessRefused(Core.compareEvents(_, expected))
+  let thenCompareEvents = (events, expected, cmp) =>
+    events->unlessRefused(Core.compareEventsWith(_, expected, cmp))
   let thenEvent = (events, expectedEvent) => thenEvents(events, [expectedEvent])
   let thenCompareEvent = (events, expectedEvent, cmp) =>
     thenCompareEvents(events, [expectedEvent], cmp)
-  let thenNoEvent = Core.compareNoEvent
+  let thenNoEvent = events => events->unlessRefused(Core.compareNoEvent)
 
-  let thenError = (events, expectedError) => Core.matchesError(events, [], expectedError)
+  let thenError = (events, expectedError) =>
+    events->unlessRefused(Core.matchesError(_, [], expectedError))
 
   let thenEventWithError = (events, expectedEvent, expectedError) =>
-    Core.matchesError(events, [expectedEvent], expectedError)
+    events->unlessRefused(Core.matchesError(_, [expectedEvent], expectedError))
 
   let thenEventsWithError = (events, expectedEvents, expectedError) =>
-    Core.matchesError(events, expectedEvents, expectedError)
+    events->unlessRefused(Core.matchesError(_, expectedEvents, expectedError))
+
+  let thenRefused = events =>
+    Guard.thenRefused(
+      ~encEvents=Core.encEvents,
+      ~decided=errors.contents->Array.get(0)->Option.map(Core.encError),
+      events,
+    )
 }

package/src/Behavior_GWT.res.mjs

@@ -2,15 +2,111 @@
 
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as DcbDecode$Reventless from "@reventlessdev/reventless-spec/src/components/DcbDecode.res.mjs";
 import * as Outcome$ReventlessGwt from "./Outcome.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as JestBind$ReventlessGwt from "./JestBind.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as DcbScopeInference$Reventless from "@reventlessdev/reventless-spec/src/components/DcbScopeInference.res.mjs";
+import * as CommandTopic_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic_Helpers.res.mjs";
+
+function owner(id) {
+  if (OwnerScope$Reventless.isJsString(id)) {
+    return {
+      TAG: "Owned",
+      userId: id
+    };
+  } else {
+    return Stdlib_JsError.throwWithMessage("Caller.owner: expected an id (a string at runtime, such as an Id.Make identity)");
+  }
+}
+
+let Caller = {
+  owner: owner,
+  operator: "Exempt",
+  anonymous: "Unidentified"
+};
+
+function Acting(Spec) {
+  let caller = {
+    contents: undefined
+  };
+  let refusal = {
+    contents: undefined
+  };
+  let ownerFieldsByEventType = Owner$Reventless.fieldNamesByVariant(Spec.historySchema);
+  let asCaller = (history, claim) => {
+    caller.contents = claim;
+    return history;
+  };
+  let refuses = (history, command) => {
+    let claim = caller.contents;
+    caller.contents = undefined;
+    refusal.contents = undefined;
+    if (Object.keys(ownerFieldsByEventType).length === 0) {
+      return false;
+    }
+    let owners = Stdlib_Array.reduce(history, [], (owners, event) => {
+      let match = Message$ReventlessCore.splitMessage(Message$ReventlessCore.encode(event, Spec.historySchema));
+      let fields = ownerFieldsByEventType[match[0]];
+      if (fields !== undefined) {
+        return OwnerScope$Reventless.recordOwners(owners, fields, match[1]);
+      } else {
+        return owners;
+      }
+    });
+    refusal.contents = Stdlib_Option.map(CommandTopic_Helpers$ReventlessCore.ownershipRefusal(OwnerScope$Reventless.decideActing(claim, owners), Spec.name, Message$ReventlessCore.variantNameOfJson(Message$ReventlessCore.encode(command, Spec.commandSchema))), r => r.rejected);
+    return Stdlib_Option.isSome(refusal.contents);
+  };
+  let encRefusal = r => Object.fromEntries([
+    [
+      "errorCode",
+      r.errorCode
+    ],
+    [
+      "errorDetail",
+      r.errorDetail
+    ]
+  ]);
+  let unexpectedRefusal = () => Stdlib_Option.map(refusal.contents, r => Outcome$ReventlessGwt.fail({
+    TAG: "ErrorMismatch",
+    expected: null,
+    actual: encRefusal(r),
+    actualEvents: []
+  }));
+  let thenRefused = (encEvents, decided, events) => {
+    let match = refusal.contents;
+    if (match !== undefined) {
+      return Outcome$ReventlessGwt.pass;
+    } else {
+      return Outcome$ReventlessGwt.fail({
+        TAG: "ErrorMismatch",
+        expected: Object.fromEntries([[
+            "errorCode",
+            "Forbidden"
+          ]]),
+        actual: decided,
+        actualEvents: encEvents(events)
+      });
+    }
+  };
+  return {
+    caller: caller,
+    refusal: refusal,
+    ownerFieldsByEventType: ownerFieldsByEventType,
+    asCaller: asCaller,
+    refuses: refuses,
+    encRefusal: encRefusal,
+    unexpectedRefusal: unexpectedRefusal,
+    thenRefused: thenRefused
+  };
+}
 
 function encodeTag(t) {
   let d = {};
@@ -149,6 +245,7 @@ function Make(Spec) {
       contents: []
     };
     let encEvent = e => Message$ReventlessCore.encode(e, Spec.eventSchema);
+    let encEvents = evs => evs.map(encEvent);
     let encError = err => Message$ReventlessCore.encode(err, Spec.errorSchema);
     let unexpectedError = events => {
       let actual = Stdlib_Option.map(errors.contents[0], encError);
@@ -188,6 +285,55 @@ function Make(Spec) {
         });
       }
     };
+    let name = Spec.name;
+    let historySchema = Spec.consumedEventSchema;
+    let commandSchema = Spec.commandSchema;
+    let caller = {
+      contents: undefined
+    };
+    let refusal = {
+      contents: undefined
+    };
+    let ownerFieldsByEventType = Owner$Reventless.fieldNamesByVariant(historySchema);
+    let asCaller = (history, claim) => {
+      caller.contents = claim;
+      return history;
+    };
+    let refuses = (history, command) => {
+      let claim = caller.contents;
+      caller.contents = undefined;
+      refusal.contents = undefined;
+      if (Object.keys(ownerFieldsByEventType).length === 0) {
+        return false;
+      }
+      let owners = Stdlib_Array.reduce(history, [], (owners, event) => {
+        let match = Message$ReventlessCore.splitMessage(Message$ReventlessCore.encode(event, historySchema));
+        let fields = ownerFieldsByEventType[match[0]];
+        if (fields !== undefined) {
+          return OwnerScope$Reventless.recordOwners(owners, fields, match[1]);
+        } else {
+          return owners;
+        }
+      });
+      refusal.contents = Stdlib_Option.map(CommandTopic_Helpers$ReventlessCore.ownershipRefusal(OwnerScope$Reventless.decideActing(claim, owners), name, Message$ReventlessCore.variantNameOfJson(Message$ReventlessCore.encode(command, commandSchema))), r => r.rejected);
+      return Stdlib_Option.isSome(refusal.contents);
+    };
+    let encRefusal = r => Object.fromEntries([
+      [
+        "errorCode",
+        r.errorCode
+      ],
+      [
+        "errorDetail",
+        r.errorDetail
+      ]
+    ]);
+    let unexpectedRefusal = () => Stdlib_Option.map(refusal.contents, r => Outcome$ReventlessGwt.fail({
+      TAG: "ErrorMismatch",
+      expected: null,
+      actual: encRefusal(r),
+      actualEvents: []
+    }));
     let derivedCondition = {
       contents: undefined
     };
@@ -270,15 +416,41 @@ function Make(Spec) {
           };
         }
       }
-      let state = Stdlib_Array.reduce(history, Behavior.initialState, Behavior.evolve);
-      let events = Behavior.decide(state, cmd);
+      if (refuses(history, cmd)) {
+        return [];
+      }
+      let events = Behavior.decide(Stdlib_Array.reduce(history, Behavior.initialState, Behavior.evolve), cmd);
       if (events.TAG === "Ok") {
         return events._0;
       }
       errors.contents = [events._0];
       return [];
     };
-    let checkAppendCondition = () => Stdlib_Option.map(appendConditionFailure.contents, Outcome$ReventlessGwt.fail);
+    let checkAppendCondition = () => {
+      let m = appendConditionFailure.contents;
+      if (m !== undefined) {
+        return Outcome$ReventlessGwt.fail(m);
+      } else {
+        return unexpectedRefusal();
+      }
+    };
+    let thenRefused = events => {
+      let decided = Stdlib_Option.map(errors.contents[0], encError);
+      let match = refusal.contents;
+      if (match !== undefined) {
+        return Outcome$ReventlessGwt.pass;
+      } else {
+        return Outcome$ReventlessGwt.fail({
+          TAG: "ErrorMismatch",
+          expected: Object.fromEntries([[
+              "errorCode",
+              "Forbidden"
+            ]]),
+          actual: decided,
+          actualEvents: encEvents(events)
+        });
+      }
+    };
     let thenEvents = (events, expectedEvents) => {
       let o = checkAppendCondition();
       if (o !== undefined) {
@@ -383,6 +555,8 @@ function Make(Spec) {
       todo: JestBind$ReventlessGwt.todo,
       test: test,
       givenEvents: givenEvents,
+      Caller: Caller,
+      asCaller: asCaller,
       whenCmd: whenCmd,
       thenEvent: thenEvent,
       thenEvents: thenEvents,
@@ -390,6 +564,7 @@ function Make(Spec) {
       thenEventWithError: thenEventWithError,
       thenEventsWithError: thenEventsWithError,
       thenError: thenError,
+      thenRefused: thenRefused,
       thenAppendsConditionedOn: thenAppendsConditionedOn,
       thenAppendsConditionedOnExactly: thenAppendsConditionedOnExactly
     };
@@ -403,6 +578,7 @@ function MakeFromAggregate(Spec) {
       contents: []
     };
     let encEvent = e => Message$ReventlessCore.encode(e, Spec.eventSchema);
+    let encEvents = evs => evs.map(encEvent);
     let encError = err => Message$ReventlessCore.encode(err, Spec.errorSchema);
     let unexpectedError = events => {
       let actual = Stdlib_Option.map(errors.contents[0], encError);
@@ -413,32 +589,6 @@ function MakeFromAggregate(Spec) {
         actualEvents: events.map(encEvent)
       });
     };
-    let compareEvents = (events, expectedEvents) => {
-      if (errors.contents.length !== 0) {
-        return unexpectedError(events);
-      } else if (Primitive_object.equal(events.map(encEvent), expectedEvents.map(encEvent))) {
-        return Outcome$ReventlessGwt.pass;
-      } else {
-        return Outcome$ReventlessGwt.fail({
-          TAG: "EventsMismatch",
-          expected: expectedEvents.map(encEvent),
-          actual: events.map(encEvent)
-        });
-      }
-    };
-    let compareEventsWith = (events, expectedEvents, cmp) => {
-      if (errors.contents.length !== 0) {
-        return unexpectedError(events);
-      } else if (events.length === expectedEvents.length && Stdlib_Array.zip(events, expectedEvents).every(param => cmp(param[0], param[1]))) {
-        return Outcome$ReventlessGwt.pass;
-      } else {
-        return Outcome$ReventlessGwt.fail({
-          TAG: "EventsMismatch",
-          expected: expectedEvents.map(encEvent),
-          actual: events.map(encEvent)
-        });
-      }
-    };
     let compareNoEvent = events => {
       if (errors.contents.length !== 0) {
         return unexpectedError(events);
@@ -480,41 +630,149 @@ function MakeFromAggregate(Spec) {
         });
       }
     };
+    let name = Spec.name;
+    let historySchema = Spec.eventSchema;
+    let commandSchema = Spec.commandSchema;
+    let caller = {
+      contents: undefined
+    };
+    let refusal = {
+      contents: undefined
+    };
+    let ownerFieldsByEventType = Owner$Reventless.fieldNamesByVariant(historySchema);
+    let asCaller = (history, claim) => {
+      caller.contents = claim;
+      return history;
+    };
+    let refuses = (history, command) => {
+      let claim = caller.contents;
+      caller.contents = undefined;
+      refusal.contents = undefined;
+      if (Object.keys(ownerFieldsByEventType).length === 0) {
+        return false;
+      }
+      let owners = Stdlib_Array.reduce(history, [], (owners, event) => {
+        let match = Message$ReventlessCore.splitMessage(Message$ReventlessCore.encode(event, historySchema));
+        let fields = ownerFieldsByEventType[match[0]];
+        if (fields !== undefined) {
+          return OwnerScope$Reventless.recordOwners(owners, fields, match[1]);
+        } else {
+          return owners;
+        }
+      });
+      refusal.contents = Stdlib_Option.map(CommandTopic_Helpers$ReventlessCore.ownershipRefusal(OwnerScope$Reventless.decideActing(claim, owners), name, Message$ReventlessCore.variantNameOfJson(Message$ReventlessCore.encode(command, commandSchema))), r => r.rejected);
+      return Stdlib_Option.isSome(refusal.contents);
+    };
+    let encRefusal = r => Object.fromEntries([
+      [
+        "errorCode",
+        r.errorCode
+      ],
+      [
+        "errorDetail",
+        r.errorDetail
+      ]
+    ]);
+    let unexpectedRefusal = () => Stdlib_Option.map(refusal.contents, r => Outcome$ReventlessGwt.fail({
+      TAG: "ErrorMismatch",
+      expected: null,
+      actual: encRefusal(r),
+      actualEvents: []
+    }));
     let givenEvents = events => events;
     let whenCmd = (history, cmd) => {
       errors.contents = [];
-      let state = Stdlib_Array.reduce(history, Behavior.initialState, Behavior.evolve);
-      let events = Behavior.decide(state, cmd);
+      if (refuses(history, cmd)) {
+        return [];
+      }
+      let events = Behavior.decide(Stdlib_Array.reduce(history, Behavior.initialState, Behavior.evolve), cmd);
       if (events.TAG === "Ok") {
         return events._0;
       }
       errors.contents = [events._0];
       return [];
     };
-    let thenEvent = (events, expectedEvent) => compareEvents(events, [expectedEvent]);
-    let thenCompareEvent = (events, expectedEvent, cmp) => compareEventsWith(events, [expectedEvent], cmp);
-    let thenError = (events, expectedError) => matchesError(events, [], expectedError);
-    let thenEventWithError = (events, expectedEvent, expectedError) => matchesError(events, [expectedEvent], expectedError);
-    let thenEventsWithError = matchesError;
+    let unlessRefused = (events, compare) => {
+      let o = unexpectedRefusal();
+      if (o !== undefined) {
+        return o;
+      } else {
+        return compare(events);
+      }
+    };
+    let thenEvents = (events, expected) => unlessRefused(events, __x => {
+      if (errors.contents.length !== 0) {
+        return unexpectedError(__x);
+      } else if (Primitive_object.equal(__x.map(encEvent), expected.map(encEvent))) {
+        return Outcome$ReventlessGwt.pass;
+      } else {
+        return Outcome$ReventlessGwt.fail({
+          TAG: "EventsMismatch",
+          expected: expected.map(encEvent),
+          actual: __x.map(encEvent)
+        });
+      }
+    });
+    let thenCompareEvents = (events, expected, cmp) => unlessRefused(events, __x => {
+      if (errors.contents.length !== 0) {
+        return unexpectedError(__x);
+      } else if (__x.length === expected.length && Stdlib_Array.zip(__x, expected).every(param => cmp(param[0], param[1]))) {
+        return Outcome$ReventlessGwt.pass;
+      } else {
+        return Outcome$ReventlessGwt.fail({
+          TAG: "EventsMismatch",
+          expected: expected.map(encEvent),
+          actual: __x.map(encEvent)
+        });
+      }
+    });
+    let thenEvent = (events, expectedEvent) => thenEvents(events, [expectedEvent]);
+    let thenCompareEvent = (events, expectedEvent, cmp) => thenCompareEvents(events, [expectedEvent], cmp);
+    let thenNoEvent = events => unlessRefused(events, compareNoEvent);
+    let thenError = (events, expectedError) => unlessRefused(events, __x => matchesError(__x, [], expectedError));
+    let thenEventWithError = (events, expectedEvent, expectedError) => unlessRefused(events, __x => matchesError(__x, [expectedEvent], expectedError));
+    let thenEventsWithError = (events, expectedEvents, expectedError) => unlessRefused(events, __x => matchesError(__x, expectedEvents, expectedError));
+    let thenRefused = events => {
+      let decided = Stdlib_Option.map(errors.contents[0], encError);
+      let match = refusal.contents;
+      if (match !== undefined) {
+        return Outcome$ReventlessGwt.pass;
+      } else {
+        return Outcome$ReventlessGwt.fail({
+          TAG: "ErrorMismatch",
+          expected: Object.fromEntries([[
+              "errorCode",
+              "Forbidden"
+            ]]),
+          actual: decided,
+          actualEvents: encEvents(events)
+        });
+      }
+    };
     return {
       Spec: Spec,
       describe: JestBind$ReventlessGwt.describe,
       test: test,
       givenEvents: givenEvents,
+      Caller: Caller,
+      asCaller: asCaller,
       whenCmd: whenCmd,
       thenEvent: thenEvent,
       thenCompareEvent: thenCompareEvent,
-      thenNoEvent: compareNoEvent,
+      thenNoEvent: thenNoEvent,
       thenEventWithError: thenEventWithError,
-      thenEvents: compareEvents,
-      thenCompareEvents: compareEventsWith,
+      thenEvents: thenEvents,
+      thenCompareEvents: thenCompareEvents,
       thenEventsWithError: thenEventsWithError,
-      thenError: thenError
+      thenError: thenError,
+      thenRefused: thenRefused
     };
   };
 }
 
 export {
+  Caller,
+  Acting,
   encodeTag,
   encodeQueryItem,
   encodeQuery,
@@ -523,4 +781,4 @@ export {
   Make,
   MakeFromAggregate,
 }
-/* DcbTag-Reventless Not a pure module */
+/* Owner-Reventless Not a pure module */

package/tests/CallerTest.res

@@ -0,0 +1,33 @@
+open JestGlobals
+
+// `Caller.owner` takes an id as a scenario holds it, typed or not, so a test
+// never converts one by hand.
+
+module CustomerId = Reventless.Id.Make({
+  let key = "customerId"
+})
+
+describe("Caller.owner", () => {
+  testSync("takes a typed id as the user id it stands for", () =>
+    expect(Behavior_GWT.Caller.owner(CustomerId.makeFromString("c1")))->toEqual(
+      Reventless.Message.CallerClaim.Owned({userId: "c1"}),
+    )
+  )
+
+  testSync("takes a plain string too", () =>
+    expect(Behavior_GWT.Caller.owner("c1"))->toEqual(
+      Reventless.Message.CallerClaim.Owned({userId: "c1"}),
+    )
+  )
+
+  // Anything that is not a string at runtime is not an id, and comparing it
+  // with a recorded owner would only ever refuse — a silent wrong answer.
+  testSync("refuses a value that is not an id", () =>
+    expect(
+      switch Behavior_GWT.Caller.owner(42) {
+      | _ => false
+      | exception _ => true
+      },
+    )->toBe(true)
+  )
+})

package/tests/CallerTest.res.mjs

@@ -0,0 +1,38 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
+import * as Behavior_GWT$ReventlessGwt from "../src/Behavior_GWT.res.mjs";
+
+let CustomerId = Id$Reventless.Make({
+  key: "customerId"
+});
+
+globalThis.describe("Caller.owner", () => {
+  globalThis.test("takes a typed id as the user id it stands for", () => {
+    globalThis.expect(Behavior_GWT$ReventlessGwt.Caller.owner(CustomerId.makeFromString("c1"))).toEqual({
+      TAG: "Owned",
+      userId: "c1"
+    });
+  });
+  globalThis.test("takes a plain string too", () => {
+    globalThis.expect(Behavior_GWT$ReventlessGwt.Caller.owner("c1")).toEqual({
+      TAG: "Owned",
+      userId: "c1"
+    });
+  });
+  globalThis.test("refuses a value that is not an id", () => {
+    let tmp;
+    try {
+      Behavior_GWT$ReventlessGwt.Caller.owner(42);
+      tmp = false;
+    } catch (exn) {
+      tmp = true;
+    }
+    globalThis.expect(tmp).toBe(true);
+  });
+});
+
+export {
+  CustomerId,
+}
+/* CustomerId Not a pure module */

package/tests/StateChange/ExternalAddCategorySlice_GWT.res.mjs

@@ -39,6 +39,10 @@ let Spec = include.Spec;
 
 let todo = include.todo;
 
+let Caller = include.Caller;
+
+let asCaller = include.asCaller;
+
 let thenEvents = include.thenEvents;
 
 let thenNoEvent = include.thenNoEvent;
@@ -47,6 +51,8 @@ let thenEventWithError = include.thenEventWithError;
 
 let thenEventsWithError = include.thenEventsWithError;
 
+let thenRefused = include.thenRefused;
+
 let thenAppendsConditionedOn = include.thenAppendsConditionedOn;
 
 let thenAppendsConditionedOnExactly = include.thenAppendsConditionedOnExactly;
@@ -57,6 +63,8 @@ export {
   todo,
   test,
   givenEvents,
+  Caller,
+  asCaller,
   whenCmd,
   thenEvent,
   thenEvents,
@@ -64,6 +72,7 @@ export {
   thenEventWithError,
   thenEventsWithError,
   thenError,
+  thenRefused,
   thenAppendsConditionedOn,
   thenAppendsConditionedOnExactly,
 }

package/tests/StateChange/WithFixtures_GWT.res.mjs

@@ -23,6 +23,10 @@ let Spec = include.Spec;
 
 let todo = include.todo;
 
+let Caller = include.Caller;
+
+let asCaller = include.asCaller;
+
 let thenEvents = include.thenEvents;
 
 let thenNoEvent = include.thenNoEvent;
@@ -33,6 +37,8 @@ let thenEventsWithError = include.thenEventsWithError;
 
 let thenError = include.thenError;
 
+let thenRefused = include.thenRefused;
+
 let thenAppendsConditionedOn = include.thenAppendsConditionedOn;
 
 let thenAppendsConditionedOnExactly = include.thenAppendsConditionedOnExactly;
@@ -43,6 +49,8 @@ export {
   todo,
   test,
   givenEvents,
+  Caller,
+  asCaller,
   whenCmd,
   thenEvent,
   thenEvents,
@@ -50,6 +58,7 @@ export {
   thenEventWithError,
   thenEventsWithError,
   thenError,
+  thenRefused,
   thenAppendsConditionedOn,
   thenAppendsConditionedOnExactly,
 }

package/tests/StateChange/WithManualOpen_GWT.res.mjs

@@ -23,6 +23,10 @@ let Spec = include.Spec;
 
 let todo = include.todo;
 
+let Caller = include.Caller;
+
+let asCaller = include.asCaller;
+
 let thenEvents = include.thenEvents;
 
 let thenNoEvent = include.thenNoEvent;
@@ -33,6 +37,8 @@ let thenEventsWithError = include.thenEventsWithError;
 
 let thenError = include.thenError;
 
+let thenRefused = include.thenRefused;
+
 let thenAppendsConditionedOn = include.thenAppendsConditionedOn;
 
 let thenAppendsConditionedOnExactly = include.thenAppendsConditionedOnExactly;
@@ -43,6 +49,8 @@ export {
   todo,
   test,
   givenEvents,
+  Caller,
+  asCaller,
   whenCmd,
   thenEvent,
   thenEvents,
@@ -50,6 +58,7 @@ export {
   thenEventWithError,
   thenEventsWithError,
   thenError,
+  thenRefused,
   thenAppendsConditionedOn,
   thenAppendsConditionedOnExactly,
 }

package/tests/StateChangeSliceGwtTest.res.mjs

@@ -405,6 +405,10 @@ let Spec = include.Spec;
 
 let todo = include.todo;
 
+let Caller = include.Caller;
+
+let asCaller = include.asCaller;
+
 let thenEvents = include.thenEvents;
 
 let thenNoEvent = include.thenNoEvent;
@@ -413,6 +417,8 @@ let thenEventWithError = include.thenEventWithError;
 
 let thenEventsWithError = include.thenEventsWithError;
 
+let thenRefused = include.thenRefused;
+
 export {
   AddCategorySlice,
   AddCategorySliceBehavior,
@@ -421,6 +427,8 @@ export {
   todo,
   test,
   givenEvents,
+  Caller,
+  asCaller,
   whenCmd,
   thenEvent,
   thenEvents,
@@ -428,6 +436,7 @@ export {
   thenEventWithError,
   thenEventsWithError,
   thenError,
+  thenRefused,
   thenAppendsConditionedOn,
   thenAppendsConditionedOnExactly,
   MissingTagSlice,