@reventlessdev/reventless-infra 3.0.0-alpha.140 → 3.0.0-alpha.142

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.142 (2026-08-15)
+
+### Features
+
+* **core:** curate the pages a shell builds across a plugin's views ([589835a](https://github.com/ReventlessDev/reventless-core/commit/589835a1ad428c5e2dea8bf6e4c64e49d2f67e0d))
+
+
+# 3.0.0-alpha.141 (2026-08-14)
+
+### Features
+
+* **core:** one contract for which refusal a platform gave ([7705c13](https://github.com/ReventlessDev/reventless-core/commit/7705c13ec63f41a3a659bc98cfb45b880fd5b222))
+
+
 # 3.0.0-alpha.140 (2026-08-14)
 
 **Note:** Version bump only for package @reventlessdev/reventless-infra

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-infra",
-  "version": "3.0.0-alpha.140",
+  "version": "3.0.0-alpha.142",
   "description": "Infrastructure types for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -16,9 +16,9 @@
     "sury": "11.0.0-alpha.4",
     "sury-ppx": "11.0.0-alpha.2",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.114",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0"
   },
   "devDependencies": {

package/src/components/Api.res

@@ -53,7 +53,7 @@ type mutationSchemaEntry = {
   authorization?: Reventless.ReadModel.authorization,
   /** Spec-level per-field authorization derived from `Spec.commandAuthorization`,
       keyed by mutation field name. Used by AWS to inject
-      `@aws_auth(cognito_groups: ...)` per field (Stage E2 in
+      `@aws_cognito_user_pools(cognito_groups: ...)` per field (Stage E2 in
       `docs/plans/host-ui-login-core.md`). In-memory enforcement still happens
       at the resolver layer via the same `commandAuthorization` function. */
   fieldPermissions?: dict<Reventless.Authorization.permission>,
@@ -106,7 +106,7 @@ type querySchemaEntry = {
   authorization: option<Reventless.ReadModel.authorization>,
   /** Spec-level read-model authorization derived from `Spec.authorization`.
       Applies to both the single-id and list query fields. Used by AWS to
-      inject `@aws_auth(cognito_groups: ...)` (Stage E2 in
+      inject `@aws_cognito_user_pools(cognito_groups: ...)` (Stage E2 in
       `docs/plans/host-ui-login-core.md`). In-memory enforcement happens at
       the QueryDb resolver via the same field. */
   permission?: Reventless.Authorization.permission,

package/src/types/Platform.res

@@ -114,16 +114,29 @@ type capability =
 // A provisioned geocoding place index, as returned by the framework's geocoding
 // capability helper. A record rather than a bare name so the handle can grow
 // (ARN, data source) without moving every call site.
-/** One plugin's slice of the baked manifest. `views` / `commands` unset ⇒
-    every public component of that kind; set ⇒ exactly the named ones.
+/** One plugin's slice of the baked manifest. `views` / `commands` / `derived`
+    unset ⇒ every public component of that kind; set ⇒ exactly the named ones.
     An include-list rather than an exclude-list, so a component added later
     has to be opted in and cannot silently widen a curated shell's surface.
     A name that matches nothing fails the deploy naming it — a silent no-op
-    here produces a missing page no log explains. */
+    here produces a missing page no log explains.
+
+    `derived` curates the pages a shell builds ACROSS a plugin's views rather
+    than from any one of them — the dashboard, the lifecycle diagrams, the
+    canvases, the schedulers. They belong here for the reason the views do:
+    they are surfaces an audience either has or does not, and a deployment that
+    curated the views a lifecycle page is drawn from and still got the page
+    would have curated nothing. Kinds rather than page names, because what a
+    canvas is CALLED is resolved in the browser from the hints and the modes
+    that deployment registered, and a server validating names it cannot know
+    would fail deploys over a spelling only the shell can check.
+
+    The vocabulary is `Platform_BakedManifest.derivedKinds`. */
 type bakedManifestSelection = {
   plugin: string,
   views?: array<string>,
   commands?: array<string>,
+  derived?: array<string>,
 }
 
 /** Declaration for the baked component manifest — the static JSON a shell