@reventlessdev/reventless-local 3.0.0-alpha.274 → 3.0.0-alpha.276

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.276 (2026-10-01)
+
+* feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))
+
+### BREAKING CHANGES
+
+* AllowGroups and AdminGroup are removed — write AllowRoles over
+the plugin's Roles.t, and use Role.admin / Platform.adminGroup(). Spec module
+types declare `type role`, and their rules are Authorization.rule<role>; a spec
+that writes its own rule declares `type role` (Reventless.Role.name for a rule
+over Authorization.permission). Role.name is a private string: make one from a
+string with Role.make.
+
+
+
+# 3.0.0-alpha.275 (2026-10-01)
+
+### Features
+
+* **spec, aws, core, local:** an app declares its environments, and every deployment records its commit ([c7cc925](https://github.com/ReventlessDev/reventless-core/commit/c7cc92573e97742b681a9000cea0bdfd6e9a33fc))
+* **spec, core, gwt, ppx:** a command acts only on what its caller owns ([2636f0e](https://github.com/ReventlessDev/reventless-core/commit/2636f0ee44797ee2c0b0c40a7107cf306113173f))
+
+
 # 3.0.0-alpha.274 (2026-09-29)
 
 **Note:** Version bump only for package @reventlessdev/reventless-local

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.274",
+  "version": "3.0.0-alpha.276",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -37,21 +37,21 @@
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.29",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
+    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
     "@reventlessdev/rescript-node": "2.0.0-alpha.20",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
-    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.132",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.284",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.231",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.148",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.182",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.233",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.286",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.134",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.184",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.156",
     "@reventlessdev/reventless-seed": "1.0.0-alpha.31",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.154"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.150"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.95"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.96"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/Platform.res

@@ -73,6 +73,24 @@ let decodeUiFragmentRegistryEventEnvelope = (eventJson: JSON.t): option<
 // splitApi=true to serve core and plugin APIs on separate ports,
 // backend=Backend.Sqlite({...}) to opt into file-backed SQLite persistence.
 // Usage: module Platform = Platform.MakeWithConfig({let silent = true; let splitApi = false; let cloner = false; let backend = Backend.Memory})
+/** Which group stands for which role, only where the two differ; every other
+    role maps to the group of its own name. Call before `Make()`: the platform
+    resolves roles while it is built, and a mapping stated later is refused. */
+let roleGroups = Reventless.Role.setGroups
+
+/** The groups of a user pool this deployment did not create, which no accounts
+    manifest names. They count as provided by the check that every role a plugin
+    needs has a group. */
+let providedGroups = Reventless.Role.provideGroups
+
+/** The group a role resolves to — the name this platform writes into its
+    directives, its shell configuration and the elevated groups. For code that
+    grants access by group, so it never spells one itself. */
+let groupOf = Reventless.Role.groupOf
+
+/** `groupOf(Role.admin)`. */
+let adminGroup = Reventless.Role.adminGroup
+
 module MakeWithConfig = (
   Config: {
     let silent: bool
@@ -87,6 +105,14 @@ module MakeWithConfig = (
   // …) are no-ops in-memory. envVars are not propagated here because the
   // local platform has no per-component process boundary.
   let _ = Config.commandHandlerConfig
+
+  // What this platform provides for the roles its plugins need: every account it
+  // can sign in as, built-in and manifest alike. The manifest is read here rather
+  // than from the user store, which loads only when the servers start — after
+  // the plugins are built and checked.
+  Reventless.Role.provideGroupsFrom(() =>
+    LocalAuth.knownGroups()->Array.concat(Reventless.AccountsManifest.declaredGroups())
+  )
   // Activate Pulumi mock mode — must happen before any component creation.
   // Idempotent, so safe to call even if TestRunner.setup() was already called.
   let _ = TestRunner.setup()
@@ -1273,6 +1299,7 @@ module MakeWithConfig = (
     ~pluginOutputs=?,
   ) => {
     let environment = Pulumi.Pulumi.getStackName()
+    let provenance = Reventless.DeploymentProvenance.current()
     builtInfos->Array.forEachWithIndex((info, i) => {
       switch ReventlessCore.Plugin_Helpers.onPluginDeployedHook.contents {
       | Some(hook) =>
@@ -1289,6 +1316,8 @@ module MakeWithConfig = (
             deployedAt: Date.make()->Date.toISOString,
             actor: "local",
             deploymentId: Date.make()->Date.toISOString,
+            commit: ?provenance.commit,
+            dirty: ?(provenance.dirty ? Some(true) : None),
             kind: ?info.kind,
             displayName: ?info.displayName,
             vendor: ?info.vendor,
@@ -1786,7 +1815,7 @@ module MakeWithConfig = (
     // structure manually.
     pluginStructuresStore.contents->Dict.set(
       ReventlessCore.Platform_Admin_Structure.pluginId,
-      ReventlessCore.Platform_Admin_Structure.structure,
+      ReventlessCore.Platform_Admin_Structure.structure(),
     )
 
     let pluginQueryDbName = ReventlessCore.PluginsReadModelSpec.name

package/src/Platform.res.mjs

@@ -12,6 +12,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Plugin$Reventless from "@reventlessdev/reventless-spec/src/components/Plugin.res.mjs";
 import * as AnsiStyle$Reventless from "@reventlessdev/reventless-spec/src/AnsiStyle.res.mjs";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
@@ -25,10 +26,12 @@ import * as UiSlots$ReventlessLocal from "./UiSlots.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as LocalBus$ReventlessLocal from "./adapter/LocalBus.res.mjs";
 import * as Api_Naming$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Naming.res.mjs";
+import * as LocalAuth$ReventlessLocal from "./adapter/Auth/LocalAuth.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as UserStore$ReventlessLocal from "./adapter/Auth/UserStore.res.mjs";
 import * as TestRunner$ReventlessLocal from "./test/TestRunner.res.mjs";
 import * as UiFragments$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments.res.mjs";
+import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as ShellConfig$ReventlessLocal from "./ShellConfig.res.mjs";
@@ -43,6 +46,7 @@ import * as PluginBehavior$ReventlessCore from "@reventlessdev/reventless-core/s
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as Plugin_Builder$ReventlessLocal from "./components/Plugin_Builder.res.mjs";
 import * as Counter_Builder$ReventlessLocal from "./components/Counter_Builder.res.mjs";
+import * as DeploymentProvenance$Reventless from "@reventlessdev/reventless-spec/src/types/DeploymentProvenance.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 import * as LocalPluginSpec$ReventlessLocal from "./adapter/LocalPluginSpec.res.mjs";
 import * as NoEventMappings$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/NoEventMappings.res.mjs";
@@ -139,6 +143,7 @@ function decodeUiFragmentRegistryEventEnvelope(eventJson) {
 }
 
 function MakeWithConfig(Config) {
+  Role$Reventless.provideGroupsFrom(() => LocalAuth$ReventlessLocal.knownGroups().concat(AccountsManifest$Reventless.declaredGroups()));
   TestRunner$ReventlessLocal.setup();
   let match = Config.backend;
   if (typeof match !== "object") {
@@ -1069,6 +1074,7 @@ function MakeWithConfig(Config) {
   }));
   let firePluginDeployedHooks = (builtInfos, pluginOutputs) => {
     let environment = Pulumi.getStack();
+    let provenance = DeploymentProvenance$Reventless.current();
     builtInfos.forEach((info, i) => {
       let hook = Plugin_Helpers$ReventlessCore.onPluginDeployedHook.contents;
       if (hook === undefined) {
@@ -1081,6 +1087,8 @@ function MakeWithConfig(Config) {
         let deployedInfo_version = info.version;
         let deployedInfo_deployedAt = new Date().toISOString();
         let deployedInfo_deploymentId = new Date().toISOString();
+        let deployedInfo_commit = provenance.commit;
+        let deployedInfo_dirty = provenance.dirty ? true : undefined;
         let deployedInfo_kind = info.kind;
         let deployedInfo_displayName = info.displayName;
         let deployedInfo_vendor = info.vendor;
@@ -1100,6 +1108,8 @@ function MakeWithConfig(Config) {
           deployedAt: deployedInfo_deployedAt,
           actor: "local",
           deploymentId: deployedInfo_deploymentId,
+          commit: deployedInfo_commit,
+          dirty: deployedInfo_dirty,
           kind: deployedInfo_kind,
           displayName: deployedInfo_displayName,
           vendor: deployedInfo_vendor,
@@ -1354,7 +1364,7 @@ function MakeWithConfig(Config) {
       connectPlugin(plugins$1);
       seedPluginStructuresStore(plugins$1);
     }
-    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure;
+    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure();
     CommandGeneratorResolvers_GraphQL$ReventlessLocal.setPluginStatusGate(field => {
       let parts = field.split("_");
       let pluginPrefix = Stdlib_Option.getOr(parts[0], "");
@@ -1899,6 +1909,7 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let backend = Backend$ReventlessLocal.fromEnv();
+  Role$Reventless.provideGroupsFrom(() => LocalAuth$ReventlessLocal.knownGroups().concat(AccountsManifest$Reventless.declaredGroups()));
   TestRunner$ReventlessLocal.setup();
   if (typeof backend !== "object") {
     BackendState$ReventlessLocal.setMemory();
@@ -2822,6 +2833,7 @@ function Make($star) {
   }));
   let firePluginDeployedHooks = (builtInfos, pluginOutputs) => {
     let environment = Pulumi.getStack();
+    let provenance = DeploymentProvenance$Reventless.current();
     builtInfos.forEach((info, i) => {
       let hook = Plugin_Helpers$ReventlessCore.onPluginDeployedHook.contents;
       if (hook === undefined) {
@@ -2834,6 +2846,8 @@ function Make($star) {
         let deployedInfo_version = info.version;
         let deployedInfo_deployedAt = new Date().toISOString();
         let deployedInfo_deploymentId = new Date().toISOString();
+        let deployedInfo_commit = provenance.commit;
+        let deployedInfo_dirty = provenance.dirty ? true : undefined;
         let deployedInfo_kind = info.kind;
         let deployedInfo_displayName = info.displayName;
         let deployedInfo_vendor = info.vendor;
@@ -2853,6 +2867,8 @@ function Make($star) {
           deployedAt: deployedInfo_deployedAt,
           actor: "local",
           deploymentId: deployedInfo_deploymentId,
+          commit: deployedInfo_commit,
+          dirty: deployedInfo_dirty,
           kind: deployedInfo_kind,
           displayName: deployedInfo_displayName,
           vendor: deployedInfo_vendor,
@@ -3102,7 +3118,7 @@ function Make($star) {
       connectPlugin(plugins$1);
       seedPluginStructuresStore(plugins$1);
     }
-    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure;
+    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure();
     CommandGeneratorResolvers_GraphQL$ReventlessLocal.setPluginStatusGate(field => {
       let parts = field.split("_");
       let pluginPrefix = Stdlib_Option.getOr(parts[0], "");
@@ -3631,6 +3647,14 @@ function Make($star) {
   };
 }
 
+let roleGroups = Role$Reventless.setGroups;
+
+let providedGroups = Role$Reventless.provideGroups;
+
+let groupOf = Role$Reventless.groupOf;
+
+let adminGroup = Role$Reventless.adminGroup;
+
 export {
   log,
   platformGraphQLRef,
@@ -3638,6 +3662,10 @@ export {
   platformMCPRef,
   decodePluginEventEnvelope,
   decodeUiFragmentRegistryEventEnvelope,
+  roleGroups,
+  providedGroups,
+  groupOf,
+  adminGroup,
   MakeWithConfig,
   Make,
 }

package/src/ShellConfig.res

@@ -41,7 +41,12 @@ let manifestUrlOf = (config: ReventlessInfra.Platform.bakedManifest): string =>
 // caller matching no declared group gets and what every existing deployment has.
 let journeyManifestsKey = "journeyManifestUrls"
 
-let computedKeys = ["manifestUrl", journeyManifestsKey, ReventlessCore.Platform_UiSlots.configKey]
+let computedKeys = [
+  "manifestUrl",
+  journeyManifestsKey,
+  ReventlessCore.Platform_UiSlots.configKey,
+  ReventlessCore.Platform_AdminGroup.configKey,
+]
 
 /**
  The overlay this platform puts on top of the shipped `config.json`.
@@ -69,6 +74,8 @@ let overlay = (
     )
   )
 
+  ReventlessCore.Platform_AdminGroup.configEntry()->Option.forEach(((k, v)) => out->Dict.set(k, v))
+
   bakedManifest->Option.forEach(config => {
     out->Dict.set("manifestUrl", JSON.Encode.string(manifestUrlOf(config)))
     // Omitted entirely when nothing is declared, so a single-audience deployment

package/src/ShellConfig.res.mjs

@@ -9,6 +9,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as HostShellDist$ReventlessLocal from "./HostShellDist.res.mjs";
 import * as Platform_UiSlots$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_UiSlots.res.mjs";
+import * as Platform_AdminGroup$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminGroup.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
@@ -26,7 +27,8 @@ let journeyManifestsKey = "journeyManifestUrls";
 let computedKeys = [
   "manifestUrl",
   journeyManifestsKey,
-  Platform_UiSlots$ReventlessCore.configKey
+  Platform_UiSlots$ReventlessCore.configKey,
+  Platform_AdminGroup$ReventlessCore.configKey
 ];
 
 function overlay(bakedManifest, uiSlotsFile, shellConfig) {
@@ -34,6 +36,9 @@ function overlay(bakedManifest, uiSlotsFile, shellConfig) {
   Stdlib_Option.forEach(uiSlotsFile, param => {
     out[Platform_UiSlots$ReventlessCore.configKey] = Platform_UiSlots$ReventlessCore.url;
   });
+  Stdlib_Option.forEach(Platform_AdminGroup$ReventlessCore.configEntry(), param => {
+    out[param[0]] = param[1];
+  });
   Stdlib_Option.forEach(bakedManifest, config => {
     out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(config.key);
     let urls = Platform_BakedManifest$ReventlessCore.journeyUrls(config);

package/src/adapter/Auth/LocalAuth.res

@@ -21,19 +21,22 @@ let defaultUser: Identity.t = {
   provider: InMemory,
 }
 
-let adminUser: Identity.t = {
+// A function, not a value: the administrator's group is the one the platform
+// root maps `Role.admin` to, and this module is evaluated before the root runs.
+let adminUser = (): Identity.t => {
   userId: "local-admin",
   username: "admin",
-  groups: [AdminGroup.name, "User"],
+  groups: [Role.adminGroup(), "User"],
   provider: InMemory,
 }
 
 // ── User registry ─────────────────────────────────────────────────────────
 //
 // A `dict<Identity.t>` keyed by `username`. A4 hydrates this from
-// `.reventless/users.yaml`; tests inject via `registerUser`.
+// `.reventless/users.yaml`; tests inject via `registerUser`. The built-in
+// `admin` is answered on lookup, for the reason above, unless one is registered.
 
-let initialUsers = () => Dict.fromArray([("user", defaultUser), ("admin", adminUser)])
+let initialUsers = () => Dict.fromArray([("user", defaultUser)])
 
 let users: ref<dict<Identity.t>> = ref(initialUsers())
 
@@ -42,7 +45,19 @@ let registerUser = (~username: string, ~identity: Identity.t): unit =>
 
 let resetUsers = (): unit => users := initialUsers()
 
-let lookupUser = (username: string): option<Identity.t> => users.contents->Dict.get(username)
+let lookupUser = (username: string): option<Identity.t> =>
+  switch users.contents->Dict.get(username) {
+  | None if username == "admin" => Some(adminUser())
+  | found => found
+  }
+
+/** The groups of every account this adapter can authenticate as, built-in
+    included — what the local platform provides. */
+let knownGroups = (): array<string> =>
+  users.contents
+  ->Dict.valuesToArray
+  ->Array.concat([adminUser()])
+  ->Array.flatMap(identity => identity.groups)
 
 // ── Header parsing ────────────────────────────────────────────────────────
 

package/src/adapter/Auth/LocalAuth.res.mjs

@@ -6,9 +6,9 @@ import * as Nodepath from "node:path";
 import * as Nodecrypto from "node:crypto";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 
 let defaultUser_groups = ["User"];
@@ -20,29 +20,23 @@ let defaultUser = {
   provider: "InMemory"
 };
 
-let adminUser_groups = [
-  AdminGroup$Reventless.name,
-  "User"
-];
-
-let adminUser = {
-  userId: "local-admin",
-  username: "admin",
-  groups: adminUser_groups,
-  provider: "InMemory"
-};
+function adminUser() {
+  return {
+    userId: "local-admin",
+    username: "admin",
+    groups: [
+      Role$Reventless.adminGroup(),
+      "User"
+    ],
+    provider: "InMemory"
+  };
+}
 
 function initialUsers() {
-  return Object.fromEntries([
-    [
+  return Object.fromEntries([[
       "user",
       defaultUser
-    ],
-    [
-      "admin",
-      adminUser
-    ]
-  ]);
+    ]]);
 }
 
 let users = {
@@ -58,7 +52,16 @@ function resetUsers() {
 }
 
 function lookupUser(username) {
-  return users.contents[username];
+  let found = users.contents[username];
+  if (found !== undefined || username !== "admin") {
+    return found;
+  } else {
+    return adminUser();
+  }
+}
+
+function knownGroups() {
+  return Object.values(users.contents).concat([adminUser()]).flatMap(identity => identity.groups);
 }
 
 function parseGroups(s) {
@@ -329,7 +332,7 @@ async function authenticate(ctx) {
   let userHeader = ctx.headers["X-User".toLowerCase()];
   let groupsHeader = ctx.headers["X-Groups".toLowerCase()];
   if (userHeader !== undefined) {
-    let identity$1 = users.contents[userHeader];
+    let identity$1 = lookupUser(userHeader);
     if (identity$1 === undefined) {
       return "Anonymous";
     }
@@ -371,6 +374,7 @@ export {
   registerUser,
   resetUsers,
   lookupUser,
+  knownGroups,
   parseGroups,
   getHeader,
   Login,

package/src/adapter/PlatformGraphQL_Server.res

@@ -41,7 +41,7 @@ let wrapAdmin = (resolvers: dict<ReventlessGraphqlServer.GraphQL_ServerInstance.
   resolvers
   ->Dict.toArray
   ->Array.forEach(((k, v)) =>
-    wrapped->Dict.set(k, Auth_GraphqlContext.requireGroup(~group=Reventless.AdminGroup.name, v))
+    wrapped->Dict.set(k, Auth_GraphqlContext.requireGroup(~group=Reventless.Role.adminGroup(), v))
   )
   wrapped
 }

package/src/adapter/PlatformGraphQL_Server.res.mjs

@@ -1,6 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Auth_GraphqlContext$ReventlessLocal from "./Auth/Auth_GraphqlContext.res.mjs";
 import * as GraphQL_ServerInstance$ReventlessGraphqlServer from "@reventlessdev/reventless-graphql-server/src/GraphQL_ServerInstance.res.mjs";
 
@@ -9,7 +9,7 @@ let instance = GraphQL_ServerInstance$ReventlessGraphqlServer.make("GraphQL:Plat
 function wrapAdmin(resolvers) {
   let wrapped = {};
   Object.entries(resolvers).forEach(param => {
-    wrapped[param[0]] = Auth_GraphqlContext$ReventlessLocal.requireGroup(AdminGroup$Reventless.name, param[1]);
+    wrapped[param[0]] = Auth_GraphqlContext$ReventlessLocal.requireGroup(Role$Reventless.adminGroup(), param[1]);
   });
   return wrapped;
 }

package/src/reexport/CommandTopic.res.mjs

@@ -18,6 +18,8 @@ let acceptedResultChannel = CommandTopic$ReventlessCore.acceptedResultChannel;
 
 let rejectedResultChannel = CommandTopic$ReventlessCore.rejectedResultChannel;
 
+let ownershipRefusal = CommandTopic$ReventlessCore.ownershipRefusal;
+
 let reportAccepted = CommandTopic$ReventlessCore.reportAccepted;
 
 let reportRejected = CommandTopic$ReventlessCore.reportRejected;
@@ -51,6 +53,7 @@ export {
   fireCommandOutcome,
   acceptedResultChannel,
   rejectedResultChannel,
+  ownershipRefusal,
   reportAccepted,
   reportRejected,
   commandOutcomeToJson,

package/tests/ShellConfigTest.res

@@ -268,3 +268,34 @@ describe("ShellConfig.overlay — journeys", () => {
     )->toBe(true)
   )
 })
+
+describe("ShellConfig.overlay — adminGroup", () => {
+  testSync("is absent while the administrator role keeps its own name", () => {
+    Reventless.Role.clearGroups()
+    expect(
+      ShellConfig.overlay(~bakedManifest=None, ~shellConfig=None)->Dict.keysToArray,
+    )->toEqual([])
+  })
+
+  testSync("carries the group a renamed administrator role maps to", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.admin, "shop-admins")])
+    let out = ShellConfig.overlay(~bakedManifest=None, ~shellConfig=None)
+    Reventless.Role.clearGroups()
+    expect(out->str("adminGroup"))->toEqual(Some("shop-admins"))
+  })
+
+  // Computed from the role mapping, so a passthrough cannot point the shell at
+  // another group than the one the server gates on.
+  testSync("a shellConfig naming it is refused", () =>
+    expect(
+      threw(
+        () =>
+          ShellConfig.overlay(
+            ~bakedManifest=None,
+            ~shellConfig=Some(Dict.fromArray([("adminGroup", JSON.Encode.string("x"))])),
+          )->ignore,
+      ),
+    )->toBe(true)
+  )
+})

package/tests/ShellConfigTest.res.mjs

@@ -5,6 +5,7 @@ import * as Nodeos from "node:os";
 import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as TestRunner$ReventlessLocal from "../src/test/TestRunner.res.mjs";
 import * as ShellConfig$ReventlessLocal from "../src/ShellConfig.res.mjs";
 
@@ -215,6 +216,31 @@ globalThis.describe("ShellConfig.overlay — journeys", () => {
   });
 });
 
+globalThis.describe("ShellConfig.overlay — adminGroup", () => {
+  globalThis.test("is absent while the administrator role keeps its own name", () => {
+    Role$Reventless.clearGroups();
+    globalThis.expect(Object.keys(ShellConfig$ReventlessLocal.overlay(undefined, undefined, undefined))).toEqual([]);
+  });
+  globalThis.test("carries the group a renamed administrator role maps to", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        Role$Reventless.admin,
+        "shop-admins"
+      ]]);
+    let out = ShellConfig$ReventlessLocal.overlay(undefined, undefined, undefined);
+    Role$Reventless.clearGroups();
+    globalThis.expect(str(out, "adminGroup")).toEqual("shop-admins");
+  });
+  globalThis.test("a shellConfig naming it is refused", () => {
+    globalThis.expect(threw(() => {
+      ShellConfig$ReventlessLocal.overlay(undefined, undefined, Object.fromEntries([[
+          "adminGroup",
+          "x"
+        ]]));
+    })).toBe(true);
+  });
+});
+
 export {
   manifest,
   str,

package/tests/adapter/CommandAuthorizationTest.res

@@ -1,7 +1,7 @@
 // Resolver-boundary tests for per-constructor authorization (A3.3 + A3.3b).
 // Mirrors the catalog Category aggregate's command shape: a record-payload
 // constructor `Add({name})` defaulting to AllowAuthenticated, plus a
-// payload-less `Archive` constrained to AllowGroups(["Admin"]).
+// payload-less `Archive` constrained to AllowRoles([Admin]).
 //
 // The PPX emits a `commandAuthorization` switch at compile time (see
 // examples/online-shop-hybrid/catalog/.../Category.res.mjs). This test hand-
@@ -23,11 +23,11 @@ type command =
   | Rename({name: string})
   | Archive
 
-// Matches the shape the PPX emits for `@authorize(AllowGroups(["Admin"]))` on
+// Matches the shape the PPX emits for `@authorize(AllowRoles([Admin]))` on
 // the payload-less `Archive` constructor with a file-level default.
 let commandAuthorization = (cmd: unknown): Reventless.Authorization.permission =>
   if (cmd->Obj.magic: 'a) === "Archive" {
-    AllowGroups(["Admin"])
+    AllowRoles([Reventless.Role.make("Admin")])
   } else {
     AllowAuthenticated
   }
@@ -189,6 +189,30 @@ describe("CommandGeneratorResolvers_GraphQL — per-constructor authorization",
     expect(calls.contents)->toEqual(["Add"])
   })
 
+  // The rule names the role; the resolver checks the group the platform maps it
+  // to, so a deployment that calls its administrators "ops" admits those.
+  testPromise("a renamed role admits its group and refuses the old name", async () => {
+    let (_, _, archiveResolver, calls) = buildFixture(~namespace="Cat8")
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Admin"), "ops")])
+    let asOps = await archiveResolver(
+      JSON.Encode.null,
+      JSON.Encode.object(Dict.make()),
+      ctxFor({...userIdentity, groups: ["ops"]}),
+    )
+    let asAdminGroup = await archiveResolver(
+      JSON.Encode.null,
+      JSON.Encode.object(Dict.make()),
+      ctxFor(adminIdentity),
+    )
+    Reventless.Role.clearGroups()
+    expect((getTypename(asOps), getErrorCode(asAdminGroup)))->toEqual((
+      "CommandAccepted",
+      "Forbidden",
+    ))
+    expect(calls.contents)->toEqual(["Archive"])
+  })
+
   testPromise(
     "payload-less Archive registered as a GraphQL mutation field (no longer filtered)",
     async () => {

package/tests/adapter/CommandAuthorizationTest.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as TestRunner$ReventlessLocal from "../../src/test/TestRunner.res.mjs";
@@ -30,7 +31,7 @@ let commandSchema = Sury.union([
 function commandAuthorization(cmd) {
   if (cmd === "Archive") {
     return {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Admin"]
     };
   } else {
@@ -170,6 +171,27 @@ globalThis.describe("CommandGeneratorResolvers_GraphQL — per-constructor autho
     globalThis.expect(getTypename(response)).toEqual("CommandAccepted");
     globalThis.expect(match[3].contents).toEqual(["Add"]);
   });
+  globalThis.test("a renamed role admits its group and refuses the old name", async () => {
+    let match = buildFixture("Cat8");
+    let archiveResolver = match[2];
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Admin",
+        "ops"
+      ]]);
+    let newrecord = {...userIdentity};
+    let asOps = await archiveResolver(null, {}, ctxFor((newrecord.groups = ["ops"], newrecord)));
+    let asAdminGroup = await archiveResolver(null, {}, ctxFor(adminIdentity));
+    Role$Reventless.clearGroups();
+    globalThis.expect([
+      getTypename(asOps),
+      getErrorCode(asAdminGroup)
+    ]).toEqual([
+      "CommandAccepted",
+      "Forbidden"
+    ]);
+    globalThis.expect(match[3].contents).toEqual(["Archive"]);
+  });
   globalThis.test("payload-less Archive registered as a GraphQL mutation field (no longer filtered)", async () => {
     buildFixture("Cat7");
     let sdl = DomainGraphQL_Server$ReventlessLocal.asInterface.buildSdl();

package/tests/adapter/QueryDbListResolverTest.res

@@ -145,7 +145,8 @@ let buildFixture = async (~name: string, ~indexes: array<Reventless.ReadModel.in
     type state = rowState
     let config = Reventless.ReadModel.config()
     let subIdConfig = None
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 
@@ -646,7 +647,8 @@ let buildSubIdFixture = async (~name: string) => {
       Reventless.ReadModel.subIdField: "lineNo",
       getSubId: (state: lineState) => state.lineNo,
     })
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 

package/tests/adapter/QueryDbResolvedFieldsTest.res

@@ -96,7 +96,8 @@ let buildFixture = async (
     type state = productRow
     let config = Reventless.ReadModel.config()
     let subIdConfig = None
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 
@@ -125,7 +126,8 @@ let buildFixture = async (
       ],
     )
     let subIdConfig = None
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 

package/tests/components/inboundtranslationslice/InboundTranslationSliceCallbackTest.res

@@ -222,7 +222,9 @@ describe("InboundTranslationSlice Callback", () => {
             ),
           )
 
-          let commandAuthorization = (_: command): Reventless.Authorization.permission =>
+          type role = Reventless.Role.name
+
+          let commandAuthorization = (_: command): Reventless.Authorization.rule<role> =>
             AllowAuthenticated
           type lifecycleState = unit
           let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> =>
@@ -289,7 +291,9 @@ describe("InboundTranslationSlice Callback", () => {
 
           let translate = (_input: externalInput) => Ok([])
 
-          let commandAuthorization = (_: command): Reventless.Authorization.permission =>
+          type role = Reventless.Role.name
+
+          let commandAuthorization = (_: command): Reventless.Authorization.rule<role> =>
             AllowAuthenticated
           type lifecycleState = unit
           let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> =>

package/tests/plugin/PluginBehavior_GWT.res.mjs

@@ -9,13 +9,15 @@ let PluginTest = Behavior_GWT$ReventlessGwt.MakeFromAggregate({
   name: PluginSpec$ReventlessCore.name,
   commandSchema: PluginSpec$ReventlessCore.commandSchema,
   eventSchema: PluginSpec$ReventlessCore.eventSchema,
-  errorSchema: PluginSpec$ReventlessCore.errorSchema
+  errorSchema: PluginSpec$ReventlessCore.errorSchema,
+  commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization
 })({
   Spec: {
     name: PluginSpec$ReventlessCore.name,
     commandSchema: PluginSpec$ReventlessCore.commandSchema,
     eventSchema: PluginSpec$ReventlessCore.eventSchema,
-    errorSchema: PluginSpec$ReventlessCore.errorSchema
+    errorSchema: PluginSpec$ReventlessCore.errorSchema,
+    commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization
   },
   initialState: PluginBehavior$ReventlessCore.initialState,
   evolve: PluginBehavior$ReventlessCore.evolve,

package/tests/plugin/UiFragmentRegistry_GWT.res.mjs

@@ -10,7 +10,8 @@ let Test = Behavior_GWT$ReventlessGwt.Make({
   consumedEventSchema: UiFragmentRegistry$ReventlessCore.consumedEventSchema,
   commandSchema: UiFragmentRegistry$ReventlessCore.commandSchema,
   errorSchema: UiFragmentRegistry$ReventlessCore.errorSchema,
-  eventSchema: UiFragmentRegistry$ReventlessCore.eventSchema
+  eventSchema: UiFragmentRegistry$ReventlessCore.eventSchema,
+  commandAuthorization: UiFragmentRegistry$ReventlessCore.commandAuthorization
 })({
   initialState: undefined,
   evolve: UiFragmentRegistry_Behavior$ReventlessCore.evolve,