@reventlessdev/reventless-local 3.0.0-alpha.287 → 3.0.0-alpha.289

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.289 (2026-10-16)
+
+* feat!(inbound): a translation slice can declare a signed webhook URL ([0ad6994](https://github.com/ReventlessDev/reventless-core/commit/0ad69949fcc91c2756c60ca8cb120dd468841d8b))
+
+### BREAKING CHANGES
+
+* InboundTranslationSlice.Spec requires `endpoint`. Specs under
+@@reventless.spec get it from the PPX (republish reventless-ppx with this
+release); hand-written specs add `let endpoint = None`.
+
+
+
+# 3.0.0-alpha.288 (2026-10-16)
+
+**Note:** Version bump only for package @reventlessdev/reventless-local
+
+
+
+
+
 # 3.0.0-alpha.287 (2026-10-16)
 
 * feat!(automation): schedules set by events ([53bc436](https://github.com/ReventlessDev/reventless-core/commit/53bc4363dffce81ef36475728bf0dae704716021))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.287",
+  "version": "3.0.0-alpha.289",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -35,23 +35,23 @@
     "sury": "11.0.0",
     "ws": "^8.18.0",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
     "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.29",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.144",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.296",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.244",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.193",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.298",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.146",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.246",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.195",
     "@reventlessdev/reventless-seed": "1.0.0-alpha.34",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.165",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.160"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.162",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.167"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.101"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.102"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/adapter/Webhook/LocalWebhookRegistry.res

@@ -0,0 +1,64 @@
+// The local platform's webhook routes, served in process: no HTTP server, so a
+// test (or a dev tool) posts a raw body with `post`, which runs the same
+// signature check and dispatch as the AWS Function URL.
+
+open ReventlessCore
+
+let slices: dict<InboundTranslationSlice_Webhook.slice> = Dict.make()
+
+/** Register a slice's route now, and bind its operations when they resolve. A
+    request posted before then waits for them rather than failing. Two slices may
+    not share a path. */
+let register = (
+  ~route: InboundTranslationSlice_Webhook.route,
+  ~operations: Pulumi.Output.t<ReventlessInfra.InboundTranslationSlice.operations>,
+) => {
+  switch slices->Dict.get(route.path) {
+  | Some({route: taken}) =>
+    JsError.throwWithMessage(
+      `webhook path /${route.path} is declared by both ${taken.slice} and ${route.slice}`,
+    )
+  | None => ()
+  }
+  let bind = ref(_ => ())
+  let bound: promise<ReventlessInfra.InboundTranslationSlice.operations> = Promise.make((
+    resolve,
+    _,
+  ) => bind := resolve)
+  let _ = operations->Pulumi.Output.apply(ops => bind.contents(ops))
+  slices->Dict.set(
+    route.path,
+    {
+      route,
+      receive: async (input, ~caller) => await (await bound).receive(input, ~caller, ~door=Webhook),
+      refuse: async (~body, ~errorCode, error) =>
+        await (await bound).refuse(~body, ~errorCode, error),
+    },
+  )
+}
+
+/** Serve one request. Header names are matched case-insensitively. */
+let post = (
+  ~path: string,
+  ~method: string="POST",
+  ~headers: dict<string>=Dict.make(),
+  ~secretOf=?,
+  ~nowSeconds=?,
+  body: string,
+): promise<InboundTranslationSlice_Webhook.response> =>
+  InboundTranslationSlice_Webhook.dispatch(
+    slices->Dict.valuesToArray,
+    ~secretOf?,
+    ~nowSeconds?,
+    {
+      method,
+      path,
+      headers: headers
+      ->Dict.toArray
+      ->Array.map(((name, value)) => (name->String.toLowerCase, value))
+      ->Dict.fromArray,
+      body,
+    },
+  )
+
+let reset = () => slices->Dict.keysToArray->Array.forEach(path => slices->Dict.delete(path))

package/src/adapter/Webhook/LocalWebhookRegistry.res.mjs

@@ -0,0 +1,52 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs";
+
+let slices = {};
+
+function register(route, operations) {
+  let match = slices[route.path];
+  if (match !== undefined) {
+    Stdlib_JsError.throwWithMessage(`webhook path /` + route.path + ` is declared by both ` + match.route.slice + ` and ` + route.slice);
+  }
+  let bind = {
+    contents: param => {}
+  };
+  let bound = new Promise((resolve, param) => {
+    bind.contents = resolve;
+  });
+  operations.apply(ops => bind.contents(ops));
+  slices[route.path] = {
+    route: route,
+    receive: async (input, caller) => await (await bound).receive(input, caller, "Webhook"),
+    refuse: async (body, errorCode, error) => await (await bound).refuse(body, errorCode, error)
+  };
+}
+
+function post(path, methodOpt, headersOpt, secretOf, nowSeconds, body) {
+  let method = methodOpt !== undefined ? methodOpt : "POST";
+  let headers = headersOpt !== undefined ? headersOpt : ({});
+  return InboundTranslationSlice_Webhook$ReventlessCore.dispatch(Object.values(slices), secretOf, nowSeconds, {
+    method: method,
+    path: path,
+    headers: Object.fromEntries(Object.entries(headers).map(param => [
+      param[0].toLowerCase(),
+      param[1]
+    ])),
+    body: body
+  });
+}
+
+function reset() {
+  Object.keys(slices).forEach(path => Stdlib_Dict.$$delete(slices, path));
+}
+
+export {
+  slices,
+  register,
+  post,
+  reset,
+}
+/* InboundTranslationSlice_Webhook-ReventlessCore Not a pure module */

package/src/components/InboundTranslationSlice_Builder.res

@@ -26,7 +26,16 @@ module Make = (Bus: LocalBus.T) => {
     module Translation = Translation
     type component = Inner.component
     let queryDbName = Inner.queryDbName
-    let make = Inner.make
+    let make = (~publishJsons, ~runtime=?, ~opts=?) => {
+      let component = Inner.make(~publishJsons, ~runtime?, ~opts?)
+      Spec.endpoint->Option.forEach(endpoint =>
+        LocalWebhookRegistry.register(
+          ~route=ReventlessCore.InboundTranslationSlice_Webhook.routeOf(~slice=Spec.name, endpoint),
+          ~operations=component->ReventlessCore.Component.operations,
+        )
+      )
+      component
+    }
     // Re-expose operations for test resolution
     let operations: component => Pulumi.Output.t<
       ReventlessCore.InboundTranslationSlice.operations,

package/src/components/InboundTranslationSlice_Builder.res.mjs

@@ -1,9 +1,12 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as LocalQueryDbStorage$ReventlessLocal from "../adapter/QueryDb/LocalQueryDbStorage.res.mjs";
+import * as LocalWebhookRegistry$ReventlessLocal from "../adapter/Webhook/LocalWebhookRegistry.res.mjs";
 import * as QueryDbResolvers_GraphQL$ReventlessLocal from "../adapter/QueryDb/QueryDbResolvers_GraphQL.res.mjs";
 import * as InboundTranslationSlice_Builder$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res.mjs";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs";
 
 function Make(Bus) {
   let QueryDbStorage = LocalQueryDbStorage$ReventlessLocal.Make(Bus);
@@ -21,12 +24,17 @@ function Make(Bus) {
   })(Api);
   let Make$1 = Spec => (Translation => {
     let Inner = CoreMaker.Make(Spec)(Translation);
+    let make = (publishJsons, runtime, opts) => {
+      let component = Inner.make(publishJsons, runtime, opts);
+      Stdlib_Option.forEach(Spec.endpoint, endpoint => LocalWebhookRegistry$ReventlessLocal.register(InboundTranslationSlice_Webhook$ReventlessCore.routeOf(Spec.name, endpoint), Component$ReventlessCore.operations(component)));
+      return component;
+    };
     return {
       Inner: Inner,
       Spec: Spec,
       Translation: Translation,
       queryDbName: Inner.queryDbName,
-      make: Inner.make,
+      make: make,
       operations: Component$ReventlessCore.operations
     };
   });

package/tests/adapter/InboundTranslationMutationTest.res.mjs

@@ -29,7 +29,8 @@ let Callback = InboundTranslationSlice_Callback$ReventlessCore.Make({
   commandSchema: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.commandSchema,
   targetName: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.targetName,
   externalSystem: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.externalSystem,
-  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.authorizationOf
+  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.authorizationOf,
+  endpoint: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.endpoint
 })(PaymentWebhookTranslation);
 
 let scope = "Payments";
@@ -106,7 +107,7 @@ globalThis.describe("InboundTranslationSlice mutation — response envelope", ()
     DomainGraphQL_Server$ReventlessLocal.setScope(scope);
     InboundTranslationResolvers_GraphQL$ReventlessLocal.register(fieldName, InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.externalInputSchema, "AllowAuthenticated", DomainGraphQL_Server$ReventlessLocal.asInterface);
     DomainGraphQL_Server$ReventlessLocal.resetScope();
-    InboundTranslationResolvers_GraphQL$ReventlessLocal.bindReceive(fieldName, (inputJson, caller) => Callback.receive(publishJsons, inputJson, caller));
+    InboundTranslationResolvers_GraphQL$ReventlessLocal.bindReceive(fieldName, (inputJson, caller) => Callback.receive(publishJsons, inputJson, caller, undefined));
   });
   globalThis.test("a successful translation resolves as CommandAccepted, with no errors", async () => {
     let result = await runMutation("completed");
@@ -157,7 +158,8 @@ let CatalogFeedCallback = InboundTranslationSlice_Callback$ReventlessCore.Make({
   commandSchema: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.commandSchema,
   targetName: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.targetName,
   externalSystem: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.externalSystem,
-  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.authorizationOf
+  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.authorizationOf,
+  endpoint: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.endpoint
 })(CatalogFeedTranslation);
 
 let feedField = "Catalog_CatalogFeed";
@@ -173,7 +175,7 @@ globalThis.describe("InboundTranslationSlice mutation — the door", () => {
     DomainGraphQL_Server$ReventlessLocal.setScope("Catalog");
     InboundTranslationResolvers_GraphQL$ReventlessLocal.register(feedField, InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.externalInputSchema, Dcb_Builder$ReventlessCore.inboundDoorPermission(InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.commandSchema, InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.authorizationOf), DomainGraphQL_Server$ReventlessLocal.asInterface);
     DomainGraphQL_Server$ReventlessLocal.resetScope();
-    InboundTranslationResolvers_GraphQL$ReventlessLocal.bindReceive(feedField, (inputJson, caller) => CatalogFeedCallback.receive(publishJsons, inputJson, caller));
+    InboundTranslationResolvers_GraphQL$ReventlessLocal.bindReceive(feedField, (inputJson, caller) => CatalogFeedCallback.receive(publishJsons, inputJson, caller, undefined));
   });
   globalThis.test("a caller holding none of the commands' roles is refused", async () => {
     let node = payload(await runFeed(signedIn(["Ops"]), "product"));

package/tests/components/inboundtranslationslice/InboundTranslationSliceCallbackTest.res

@@ -215,6 +215,7 @@ describe("InboundTranslationSlice Callback", () => {
 
           let targetName = "ConfirmPayment"
           let externalSystem = None
+          let endpoint = None
 
           let translate = (input: externalInput) => Ok(
             input.items->Array.map(
@@ -285,6 +286,7 @@ describe("InboundTranslationSlice Callback", () => {
 
           let targetName = "ConfirmPayment"
           let externalSystem = None
+          let endpoint = None
 
           let translate = (_input: externalInput) => Ok([])
 

package/tests/components/inboundtranslationslice/InboundTranslationSliceCallbackTest.res.mjs

@@ -26,7 +26,8 @@ let Callback = InboundTranslationSlice_Callback$ReventlessCore.Make({
   commandSchema: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.commandSchema,
   targetName: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.targetName,
   externalSystem: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.externalSystem,
-  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.authorizationOf
+  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.authorizationOf,
+  endpoint: InboundTranslationSliceFixtures$ReventlessLocal.PaymentWebhookSpec.endpoint
 })(PaymentWebhookTranslation);
 
 globalThis.describe("InboundTranslationSlice Callback", () => {
@@ -46,7 +47,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         orderId: "ord-1",
         status: "completed"
       };
-      let result = await Callback.receive(mockPublish, inputJson, undefined);
+      let result = await Callback.receive(mockPublish, inputJson, undefined, undefined);
       if (result.TAG === "Ok") {
         let match = result._0;
         globalThis.expect(match.targetIds).toEqual(["ord-1"]);
@@ -77,7 +78,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         orderId: "ord-1",
         status: "pending"
       };
-      let result = await Callback.receive(mockPublish, inputJson, undefined);
+      let result = await Callback.receive(mockPublish, inputJson, undefined, undefined);
       if (result.TAG === "Ok") {
         globalThis.expect(true).toBe(false);
       } else {
@@ -94,7 +95,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
       let inputJson = {
         unexpected: "data"
       };
-      let result = await Callback.receive(mockPublish, inputJson, undefined);
+      let result = await Callback.receive(mockPublish, inputJson, undefined, undefined);
       if (result.TAG === "Ok") {
         globalThis.expect(true).toBe(false);
       } else {
@@ -112,7 +113,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         orderId: "ord-1",
         status: "completed"
       };
-      let result = await Callback.receive(failingPublish, inputJson, undefined);
+      let result = await Callback.receive(failingPublish, inputJson, undefined, undefined);
       if (result.TAG === "Ok") {
         globalThis.expect(true).toBe(false);
       } else {
@@ -131,7 +132,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         paymentId: "pay-1",
         orderId: "ord-1",
         status: "completed"
-      }, undefined);
+      }, undefined, undefined);
       let firstId = InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(first);
       globalThis.expect(Stdlib_Option.isSome(InboundTranslationSlice_Callback$ReventlessCore.takeAuditRow(Callback.auditLog, firstId))).toBe(true);
       globalThis.expect(Object.entries(Callback.auditLog).length).toBe(0);
@@ -139,7 +140,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         paymentId: "pay-1",
         orderId: "ord-1",
         status: "completed"
-      }, undefined);
+      }, undefined, undefined);
       let secondId = InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(second);
       globalThis.expect(secondId === firstId).toBe(false);
       globalThis.expect(Object.entries(Callback.auditLog).length).toBe(1);
@@ -152,7 +153,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         paymentId: "pay-1",
         orderId: "ord-1",
         status: "pending"
-      }, undefined);
+      }, undefined, undefined);
       let id = InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result);
       let row = InboundTranslationSlice_Callback$ReventlessCore.takeAuditRow(Callback.auditLog, id);
       if (row !== undefined) {
@@ -198,7 +199,8 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         commandSchema: commandSchema,
         targetName: "ConfirmPayment",
         externalSystem: undefined,
-        authorizationOf: authorizationOf
+        authorizationOf: authorizationOf,
+        endpoint: undefined
       })(MultiTranslation);
       let publishedCommands = {
         contents: []
@@ -214,7 +216,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
           "pay-3"
         ]
       };
-      let result = await MultiCallback.receive(mockPublish, inputJson, undefined);
+      let result = await MultiCallback.receive(mockPublish, inputJson, undefined, undefined);
       if (result.TAG === "Ok") {
         let match = result._0;
         globalThis.expect(match.targetIds).toEqual([
@@ -260,7 +262,8 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
         commandSchema: commandSchema,
         targetName: "ConfirmPayment",
         externalSystem: undefined,
-        authorizationOf: authorizationOf
+        authorizationOf: authorizationOf,
+        endpoint: undefined
       })(EmptyTranslation);
       let publishedCommands = {
         contents: []
@@ -271,7 +274,7 @@ globalThis.describe("InboundTranslationSlice Callback", () => {
       let inputJson = {
         orderId: "ord-1"
       };
-      let result = await EmptyCallback.receive(mockPublish, inputJson, undefined);
+      let result = await EmptyCallback.receive(mockPublish, inputJson, undefined, undefined);
       if (result.TAG === "Ok") {
         let match = result._0;
         globalThis.expect(match.targetIds).toEqual([]);
@@ -300,7 +303,8 @@ let CatalogFeedCallback = InboundTranslationSlice_Callback$ReventlessCore.Make({
   commandSchema: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.commandSchema,
   targetName: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.targetName,
   externalSystem: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.externalSystem,
-  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.authorizationOf
+  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.authorizationOf,
+  endpoint: InboundTranslationSliceFixtures$ReventlessLocal.CatalogFeedSpec.endpoint
 })(CatalogFeedTranslation);
 
 function caller(groups) {
@@ -336,7 +340,7 @@ globalThis.describe("receive checks each command against its own rule", () => {
     published.contents = [];
   });
   globalThis.test("a caller lacking one command's role is refused, and nothing is published", async () => {
-    let result = await CatalogFeedCallback.receive(publish, catalogInput("both"), caller(["Merchandiser"]));
+    let result = await CatalogFeedCallback.receive(publish, catalogInput("both"), caller(["Merchandiser"]), undefined);
     if (result.TAG === "Ok") {
       globalThis.expect(true).toBe(false);
     } else {
@@ -351,22 +355,22 @@ globalThis.describe("receive checks each command against its own rule", () => {
     let result = await CatalogFeedCallback.receive(publish, catalogInput("both"), caller([
       "Merchandiser",
       "Admin"
-    ]));
+    ]), undefined);
     globalThis.expect(Stdlib_Result.isOk(result)).toBe(true);
     globalThis.expect(published.contents.length).toBe(2);
   });
   globalThis.test("the role one command needs is enough when the input yields only it", async () => {
-    let result = await CatalogFeedCallback.receive(publish, catalogInput("product"), caller(["Merchandiser"]));
+    let result = await CatalogFeedCallback.receive(publish, catalogInput("product"), caller(["Merchandiser"]), undefined);
     globalThis.expect(Stdlib_Result.isOk(result)).toBe(true);
     globalThis.expect(published.contents.length).toBe(1);
   });
   globalThis.test("no caller is the platform itself, and publishes", async () => {
-    let result = await CatalogFeedCallback.receive(publish, catalogInput("both"), undefined);
+    let result = await CatalogFeedCallback.receive(publish, catalogInput("both"), undefined, undefined);
     globalThis.expect(Stdlib_Result.isOk(result)).toBe(true);
     globalThis.expect(published.contents.length).toBe(2);
   });
   globalThis.test("a refusal answers CommandRejected with Forbidden", async () => {
-    let result = await CatalogFeedCallback.receive(publish, catalogInput("both"), Identity$Reventless.anonymous);
+    let result = await CatalogFeedCallback.receive(publish, catalogInput("both"), Identity$Reventless.anonymous, undefined);
     let match = InboundTranslationSlice_Callback$ReventlessCore.receiveResultToOutcome(result);
     switch (match.TAG) {
       case "Rejected" :
@@ -396,7 +400,8 @@ let NoteFeedCallback = InboundTranslationSlice_Callback$ReventlessCore.Make({
   commandSchema: InboundTranslationSliceFixtures$ReventlessLocal.NoteFeedSpec.commandSchema,
   targetName: InboundTranslationSliceFixtures$ReventlessLocal.NoteFeedSpec.targetName,
   externalSystem: InboundTranslationSliceFixtures$ReventlessLocal.NoteFeedSpec.externalSystem,
-  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.NoteFeedSpec.authorizationOf
+  authorizationOf: InboundTranslationSliceFixtures$ReventlessLocal.NoteFeedSpec.authorizationOf,
+  endpoint: InboundTranslationSliceFixtures$ReventlessLocal.NoteFeedSpec.endpoint
 })(NoteFeedTranslation);
 
 globalThis.describe("receive encodes commands with their schema", () => {
@@ -410,7 +415,7 @@ globalThis.describe("receive encodes commands with their schema", () => {
     await NoteFeedCallback.receive(publish, Object.fromEntries([[
         "orderId",
         "ord-1"
-      ]]), undefined);
+      ]]), undefined, undefined);
     let commandJson = published.contents[0].commandJson;
     let decoded = Sury.parseOrThrow(commandJson, InboundTranslationSliceFixtures$ReventlessLocal.NoteFeedSpec.commandSchema);
     globalThis.expect(decoded).toEqual({

package/tests/components/inboundtranslationslice/InboundTranslationSliceFixtures.res

@@ -28,6 +28,7 @@ module PaymentWebhookSpec = {
 
   let targetName = "ConfirmPayment"
   let externalSystem = None
+  let endpoint = None
 
   let translate = (input: externalInput) =>
     switch input.status {
@@ -52,6 +53,7 @@ module CatalogFeedSpec = {
 
   let targetName = "AddProduct"
   let externalSystem = None
+  let endpoint = None
 
   type role = Reventless.Role.name
   let merchandiser = Reventless.Role.make("Merchandiser")
@@ -89,6 +91,7 @@ module NoteFeedSpec = {
 
   let targetName = "Annotate"
   let externalSystem = None
+  let endpoint = None
 
   let translate = (input: externalInput) => Ok([
     (input.orderId, Annotate({orderId: input.orderId, note: None})),

package/tests/components/inboundtranslationslice/InboundTranslationSliceFixtures.res.mjs

@@ -65,6 +65,7 @@ let PaymentWebhookSpec = {
   commandSchema: commandSchema,
   targetName: "ConfirmPayment",
   externalSystem: undefined,
+  endpoint: undefined,
   translate: translate,
   authorizationOf: authorizationOf,
   traits: traits
@@ -160,6 +161,7 @@ let CatalogFeedSpec = {
   commandSchema: commandSchema$1,
   targetName: "AddProduct",
   externalSystem: undefined,
+  endpoint: undefined,
   merchandiser: merchandiser,
   admin: admin,
   authorizationOf: authorizationOf$1,
@@ -206,6 +208,7 @@ let NoteFeedSpec = {
   commandSchema: commandSchema$2,
   targetName: "Annotate",
   externalSystem: undefined,
+  endpoint: undefined,
   translate: translate$2,
   authorizationOf: authorizationOf$2,
   traits: traits$2

package/tests/components/inboundtranslationslice/InboundTranslationWebhookTest.res

@@ -0,0 +1,305 @@
+// The webhook door of an inbound translation slice: signature checks over the raw
+// body, dispatch by path through the local registry, the caller a signed request
+// acts as, and the audit row telling the two doors apart.
+
+@@warning("-44")
+
+open JestGlobals
+
+let _ = TestRunner.setup()
+
+module Webhook = ReventlessCore.InboundTranslationSlice_Webhook
+module Callback = ReventlessCore.InboundTranslationSlice_Callback
+
+let merchandiser = Reventless.Role.make("Merchandiser")
+
+module FeedSpec = {
+  let name = "SignedFeed"
+  let moduleUrl = "signed-feed://spec"
+  @schema type externalInput = {kind: string, id: string}
+  @schema
+  type command =
+    | AddProduct({productId: @s.matches(Reventless.DcbTag.string) string})
+    | AddCategory({categoryId: @s.matches(Reventless.DcbTag.string) string})
+  let targetName = "AddProduct"
+  let externalSystem = None
+  type role = Reventless.Role.name
+  let authorizationOf = (name: string): Reventless.Authorization.rule<role> =>
+    switch name {
+    | "AddProduct" => AllowRoles([merchandiser])
+    | _ => AllowRoles([Reventless.Role.admin])
+    }
+  let endpoint = Some({
+    Reventless.InboundTranslationSlice.path: "/feeds/signed/",
+    auth: SignedBody({
+      header: "X-Signature",
+      prefix: "sha256=",
+      timestampHeader: "X-Timestamp",
+      secret: "feed",
+    }),
+    role: merchandiser,
+  })
+}
+
+let translateFeed = (input: FeedSpec.externalInput) =>
+  switch input.kind {
+  | "product" => Ok([(input.id, FeedSpec.AddProduct({productId: input.id}))])
+  | "category" => Ok([(input.id, FeedSpec.AddCategory({categoryId: input.id}))])
+  | kind => Error(`unknown kind ${kind}`)
+  }
+
+module FeedCallback = Callback.Make(
+  FeedSpec,
+  {
+    let translate = translateFeed
+    let moduleUrl = FeedSpec.moduleUrl
+  },
+)
+
+module OpenSpec = {
+  let name = "OpenFeed"
+  let moduleUrl = "open-feed://spec"
+  @schema type externalInput = {kind: string, id: string}
+  @schema type command = AddProduct({productId: @s.matches(Reventless.DcbTag.string) string})
+  let targetName = "AddProduct"
+  let externalSystem = None
+  type role = Reventless.Role.name
+  let authorizationOf = (_: string): Reventless.Authorization.rule<role> => AllowAuthenticated
+  let endpoint = Some({Reventless.InboundTranslationSlice.path: "open", auth: Open})
+}
+
+module OpenCallback = Callback.Make(
+  OpenSpec,
+  {
+    let translate = (input: OpenSpec.externalInput) => Ok([
+      (input.id, OpenSpec.AddProduct({productId: input.id})),
+    ])
+    let moduleUrl = OpenSpec.moduleUrl
+  },
+)
+
+@schema type input = {id: string}
+
+let published: ref<array<Reventless.Message.commandJson>> = ref([])
+let publishJsons: ReventlessInfra.CommandTopic.publishJsons = async cmds =>
+  published := published.contents->Array.concat(cmds)
+
+let feedOps: ReventlessInfra.InboundTranslationSlice.operations = {
+  receive: (input, ~caller=?, ~door=?) =>
+    FeedCallback.receive(publishJsons, input, ~caller?, ~door?),
+  refuse: async (~body, ~errorCode, error) => FeedCallback.refuse(~body, ~errorCode, error),
+}
+let openOps: ReventlessInfra.InboundTranslationSlice.operations = {
+  receive: (input, ~caller=?, ~door=?) =>
+    OpenCallback.receive(publishJsons, input, ~caller?, ~door?),
+  refuse: async (~body, ~errorCode, error) => OpenCallback.refuse(~body, ~errorCode, error),
+}
+
+// The door an audit row records.
+let viaWebhook: option<ReventlessInfra.InboundTranslationSlice.door> = Some(Webhook)
+let viaMutation: option<ReventlessInfra.InboundTranslationSlice.door> = Some(Mutation)
+
+let secret = "s3cret"
+let now = 1_700_000_000.
+let secretOf = name => name == "feed" ? Some(secret) : None
+
+let signature: Reventless.InboundTranslationSlice.signature = {
+  header: "X-Signature",
+  prefix: "sha256=",
+  timestampHeader: "X-Timestamp",
+  secret: "feed",
+}
+
+let hmac = (~secret, text) =>
+  NodeCrypto.createHmac("sha256", secret)->NodeCrypto.hmacUpdate(text)->NodeCrypto.hmacDigest("hex")
+
+let signedHeaders = (~secret=secret, ~at=now, body) => {
+  let at = at->Float.toString
+  Dict.fromArray([
+    ("x-timestamp", at),
+    ("x-signature", "sha256=" ++ hmac(~secret, `${at}.${body}`)),
+  ])
+}
+
+let body = (~kind="product", ~id="p-1") => `{"kind":"${kind}","id":"${id}"}`
+
+let post = (~path="feeds/signed", ~method=?, ~headers=?, body) =>
+  LocalWebhookRegistry.post(~path, ~method?, ~headers?, ~secretOf, ~nowSeconds=now, body)
+
+let throws = (run: unit => unit): bool =>
+  try {
+    run()
+    false
+  } catch {
+  | _ => true
+  }
+
+let rows = (log: dict<Callback.auditRow>) => log->Dict.valuesToArray
+
+let clear = (log: dict<Callback.auditRow>) =>
+  log->Dict.keysToArray->Array.forEach(key => log->Dict.delete(key))
+
+describe("webhook signature", () => {
+  let check = (~secrets=[secret], ~headers, text) =>
+    Webhook.verify(signature, ~secrets, ~headers, ~body=text, ~nowSeconds=now)
+
+  testSync("a signature by the shared secret passes", () =>
+    expect(check(~headers=signedHeaders(body()), body()))->toEqual(Ok())
+  )
+
+  testSync("a signature by another secret is refused", () =>
+    expect(check(~headers=signedHeaders(~secret="other", body()), body())->Result.isError)->toBe(
+      true,
+    )
+  )
+
+  testSync("a body changed after signing is refused", () =>
+    expect(check(~headers=signedHeaders(body()), body(~id="p-2"))->Result.isError)->toBe(true)
+  )
+
+  testSync(
+    "a timestamp outside the window is refused, so a captured request cannot be replayed",
+    () =>
+      expect(check(~headers=signedHeaders(~at=now -. 301., body()), body())->Result.isError)->toBe(
+        true,
+      ),
+  )
+
+  testSync("a request without the signature header is refused", () => {
+    let headers = signedHeaders(body())
+    headers->Dict.delete("x-signature")
+    expect(check(~headers, body())->Result.isError)->toBe(true)
+  })
+
+  testSync("while a secret is rotated, either one passes", () =>
+    expect(
+      check(
+        ~secrets=Webhook.secretsOf("new, old"),
+        ~headers=signedHeaders(~secret="old", body()),
+        body(),
+      ),
+    )->toEqual(Ok())
+  )
+
+  testSync("a secret is read from a variable named after it", () =>
+    expect(Webhook.secretEnvKey("supplier-feed"))->toBe("REVENTLESS_WEBHOOK_SECRET_SUPPLIER_FEED")
+  )
+})
+
+describe("webhook door", () => {
+  beforeAll(() => {
+    LocalWebhookRegistry.reset()
+    switch (FeedCallback.webhook, OpenCallback.webhook) {
+    | (Some(feed), Some(open_)) =>
+      LocalWebhookRegistry.register(~route=feed, ~operations=Pulumi.Output.make(feedOps))
+      LocalWebhookRegistry.register(~route=open_, ~operations=Pulumi.Output.make(openOps))
+    | _ => JsError.throwWithMessage("fixture specs declare endpoints")
+    }
+  })
+  afterAll(() => LocalWebhookRegistry.reset())
+  beforeEach(() => {
+    published := []
+    clear(FeedCallback.auditLog)
+    clear(OpenCallback.auditLog)
+  })
+
+  testPromise("a signed request publishes its commands as the endpoint's role", async () => {
+    let response = await post(~headers=signedHeaders(body()), body())
+    expect(response.status)->toBe(200)
+    expect(published.contents->Array.map(c => c.id))->toEqual(["p-1"])
+    expect(rows(FeedCallback.auditLog)->Array.map(row => row.door))->toEqual([viaWebhook])
+  })
+
+  testPromise("a command the endpoint's role may not send is refused", async () => {
+    let text = body(~kind="category")
+    let response = await post(~headers=signedHeaders(text), text)
+    expect(response.status)->toBe(403)
+    expect(published.contents)->toEqual([])
+  })
+
+  testPromise("a bad signature is refused before the body is read, with an audit row", async () => {
+    let response = await post(~headers=signedHeaders(~secret="other", body()), body())
+    expect(response.status)->toBe(401)
+    expect(published.contents)->toEqual([])
+    expect(
+      rows(FeedCallback.auditLog)->Array.map(row => (row.status, row.door, row.input)),
+    )->toEqual([(Callback.Failure, viaWebhook, body())])
+  })
+
+  testPromise("a signed body that is not JSON is refused", async () => {
+    let response = await post(~headers=signedHeaders("not json"), "not json")
+    expect(response.status)->toBe(400)
+  })
+
+  testPromise("an unknown path and a wrong method are refused", async () => {
+    let unknown = await post(~path="nowhere", body())
+    let wrongMethod = await post(~method="PUT", ~headers=signedHeaders(body()), body())
+    expect((unknown.status, wrongMethod.status))->toEqual((404, 405))
+  })
+
+  testPromise("a secret the platform lacks fails closed, without an audit row", async () => {
+    let response = await LocalWebhookRegistry.post(
+      ~path="feeds/signed",
+      ~headers=signedHeaders(body()),
+      ~secretOf=_ => None,
+      ~nowSeconds=now,
+      body(),
+    )
+    expect(response.status)->toBe(500)
+    expect(published.contents)->toEqual([])
+    expect(rows(FeedCallback.auditLog))->toEqual([])
+  })
+
+  testPromise("an open URL identifies nobody, so a signed-in rule refuses it", async () => {
+    let response = await post(~path="open", body())
+    expect(response.status)->toBe(403)
+  })
+
+  testPromise("both doors publish the same commands and are told apart in the audit", async () => {
+    let caller: Reventless.Identity.t = {
+      userId: "u-1",
+      username: "alice",
+      groups: [(merchandiser :> string)],
+      provider: InMemory,
+    }
+    let mutationResult = await feedOps.receive(JSON.parseOrThrow(body()), ~caller)
+    let _ = await post(~headers=signedHeaders(body()), body())
+    expect(mutationResult->Result.isOk)->toBe(true)
+    switch published.contents->Array.map(c => c.commandJson) {
+    | [viaMutationCommand, viaWebhookCommand] =>
+      expect(viaWebhookCommand)->toEqual(viaMutationCommand)
+    | commands => expect(commands->Array.length)->toBe(2)
+    }
+    expect(rows(FeedCallback.auditLog)->Array.map(row => row.door))->toEqual([
+      viaMutation,
+      viaWebhook,
+    ])
+  })
+
+  testSync("two slices may not share a path", () =>
+    switch FeedCallback.webhook {
+    | Some(route) =>
+      expect(
+        throws(
+          () => LocalWebhookRegistry.register(~route, ~operations=Pulumi.Output.make(feedOps)),
+        ),
+      )->toBe(true)
+    | None => JsError.throwWithMessage("fixture spec declares an endpoint")
+    }
+  )
+})
+
+describe("which doors a slice has", () => {
+  testSync("@noApi on externalInput withholds the mutation", () =>
+    expect((
+      Callback.exposesMutation(inputSchema->ReventlessInfra.Api.markNoApi->S.castToUnknown),
+      Callback.exposesMutation(inputSchema->S.castToUnknown),
+    ))->toEqual((false, true))
+  )
+
+  testSync("a slice with neither door is refused", () => {
+    let check = (~webhook) =>
+      throws(() => Callback.checkReachable(~plugin="P", ~slice="S", ~mutation=false, ~webhook))
+    expect((check(~webhook=false), check(~webhook=true)))->toEqual((true, false))
+  })
+})

package/tests/components/inboundtranslationslice/InboundTranslationWebhookTest.res.mjs

@@ -0,0 +1,473 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Sury from "sury";
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Api$ReventlessInfra from "@reventlessdev/reventless-infra/src/components/Api.res.mjs";
+import * as TestRunner$ReventlessLocal from "../../../src/test/TestRunner.res.mjs";
+import * as LocalWebhookRegistry$ReventlessLocal from "../../../src/adapter/Webhook/LocalWebhookRegistry.res.mjs";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs";
+import * as InboundTranslationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs";
+
+TestRunner$ReventlessLocal.setup();
+
+let merchandiser = "Merchandiser";
+
+let moduleUrl = "signed-feed://spec";
+
+let externalInputSchema = Sury.$schema(s => ({
+  kind: s.m(Sury.string),
+  id: s.m(Sury.string)
+}));
+
+let commandSchema = Sury.union([
+  Sury.$schema(s => ({
+    TAG: "AddProduct",
+    productId: s.m(DcbTag$Reventless.string)
+  })),
+  Sury.$schema(s => ({
+    TAG: "AddCategory",
+    categoryId: s.m(DcbTag$Reventless.string)
+  }))
+]);
+
+function authorizationOf(name) {
+  if (name === "AddProduct") {
+    return {
+      TAG: "AllowRoles",
+      _0: [merchandiser]
+    };
+  } else {
+    return {
+      TAG: "AllowRoles",
+      _0: [Role$Reventless.admin]
+    };
+  }
+}
+
+let endpoint = {
+  path: "/feeds/signed/",
+  auth: {
+    TAG: "SignedBody",
+    _0: {
+      header: "X-Signature",
+      prefix: "sha256=",
+      timestampHeader: "X-Timestamp",
+      secret: "feed"
+    }
+  },
+  role: merchandiser
+};
+
+let traits = [];
+
+let FeedSpec = {
+  name: "SignedFeed",
+  moduleUrl: moduleUrl,
+  externalInputSchema: externalInputSchema,
+  commandSchema: commandSchema,
+  targetName: "AddProduct",
+  externalSystem: undefined,
+  authorizationOf: authorizationOf,
+  endpoint: endpoint,
+  traits: traits
+};
+
+function translateFeed(input) {
+  let kind = input.kind;
+  switch (kind) {
+    case "category" :
+      return {
+        TAG: "Ok",
+        _0: [[
+            input.id,
+            {
+              TAG: "AddCategory",
+              categoryId: input.id
+            }
+          ]]
+      };
+    case "product" :
+      return {
+        TAG: "Ok",
+        _0: [[
+            input.id,
+            {
+              TAG: "AddProduct",
+              productId: input.id
+            }
+          ]]
+      };
+    default:
+      return {
+        TAG: "Error",
+        _0: `unknown kind ` + kind
+      };
+  }
+}
+
+let FeedCallback = InboundTranslationSlice_Callback$ReventlessCore.Make(FeedSpec)({
+  translate: translateFeed,
+  moduleUrl: moduleUrl
+});
+
+let moduleUrl$1 = "open-feed://spec";
+
+let externalInputSchema$1 = Sury.$schema(s => ({
+  kind: s.m(Sury.string),
+  id: s.m(Sury.string)
+}));
+
+let commandSchema$1 = Sury.$schema(s => ({
+  TAG: "AddProduct",
+  productId: s.m(DcbTag$Reventless.string)
+}));
+
+function authorizationOf$1(param) {
+  return "AllowAuthenticated";
+}
+
+let traits$1 = [];
+
+let OpenSpec_endpoint = {
+  path: "open",
+  auth: "Open"
+};
+
+let OpenSpec = {
+  name: "OpenFeed",
+  moduleUrl: moduleUrl$1,
+  externalInputSchema: externalInputSchema$1,
+  commandSchema: commandSchema$1,
+  targetName: "AddProduct",
+  externalSystem: undefined,
+  authorizationOf: authorizationOf$1,
+  endpoint: OpenSpec_endpoint,
+  traits: traits$1
+};
+
+function translate(input) {
+  return {
+    TAG: "Ok",
+    _0: [[
+        input.id,
+        {
+          TAG: "AddProduct",
+          productId: input.id
+        }
+      ]]
+  };
+}
+
+let OpenCallback = InboundTranslationSlice_Callback$ReventlessCore.Make(OpenSpec)({
+  translate: translate,
+  moduleUrl: moduleUrl$1
+});
+
+let inputSchema = Sury.$schema(s => ({
+  id: s.m(Sury.string)
+}));
+
+let published = {
+  contents: []
+};
+
+async function publishJsons(cmds) {
+  published.contents = published.contents.concat(cmds);
+}
+
+function feedOps_receive(input, caller, door) {
+  return FeedCallback.receive(publishJsons, input, caller, door);
+}
+
+async function feedOps_refuse(body, errorCode, error) {
+  return FeedCallback.refuse(body, errorCode, error);
+}
+
+let feedOps = {
+  receive: feedOps_receive,
+  refuse: feedOps_refuse
+};
+
+function openOps_receive(input, caller, door) {
+  return OpenCallback.receive(publishJsons, input, caller, door);
+}
+
+async function openOps_refuse(body, errorCode, error) {
+  return OpenCallback.refuse(body, errorCode, error);
+}
+
+let openOps = {
+  receive: openOps_receive,
+  refuse: openOps_refuse
+};
+
+let viaWebhook = "Webhook";
+
+let viaMutation = "Mutation";
+
+let secret = "s3cret";
+
+function secretOf(name) {
+  if (name === "feed") {
+    return secret;
+  }
+}
+
+let signature = {
+  header: "X-Signature",
+  prefix: "sha256=",
+  timestampHeader: "X-Timestamp",
+  secret: "feed"
+};
+
+function hmac(secret, text) {
+  return Nodecrypto.createHmac("sha256", secret).update(text).digest("hex");
+}
+
+function signedHeaders(secretOpt, atOpt, body) {
+  let secret$1 = secretOpt !== undefined ? secretOpt : secret;
+  let at = atOpt !== undefined ? atOpt : 1700000000;
+  let at$1 = at.toString();
+  return Object.fromEntries([
+    [
+      "x-timestamp",
+      at$1
+    ],
+    [
+      "x-signature",
+      "sha256=" + hmac(secret$1, at$1 + `.` + body)
+    ]
+  ]);
+}
+
+function body(kindOpt, idOpt) {
+  let kind = kindOpt !== undefined ? kindOpt : "product";
+  let id = idOpt !== undefined ? idOpt : "p-1";
+  return `{"kind":"` + kind + `","id":"` + id + `"}`;
+}
+
+function post(pathOpt, method, headers, body) {
+  let path = pathOpt !== undefined ? pathOpt : "feeds/signed";
+  return LocalWebhookRegistry$ReventlessLocal.post(path, method, headers, secretOf, 1700000000, body);
+}
+
+function throws(run) {
+  try {
+    run();
+    return false;
+  } catch (exn) {
+    return true;
+  }
+}
+
+function rows(log) {
+  return Object.values(log);
+}
+
+function clear(log) {
+  Object.keys(log).forEach(key => Stdlib_Dict.$$delete(log, key));
+}
+
+globalThis.describe("webhook signature", () => {
+  let check = (secretsOpt, headers, text) => {
+    let secrets = secretsOpt !== undefined ? secretsOpt : [secret];
+    return InboundTranslationSlice_Webhook$ReventlessCore.verify(signature, secrets, headers, text, 1700000000);
+  };
+  globalThis.test("a signature by the shared secret passes", () => {
+    globalThis.expect(check(undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined))).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+  globalThis.test("a signature by another secret is refused", () => {
+    globalThis.expect(Stdlib_Result.isError(check(undefined, signedHeaders("other", undefined, body(undefined, undefined)), body(undefined, undefined)))).toBe(true);
+  });
+  globalThis.test("a body changed after signing is refused", () => {
+    globalThis.expect(Stdlib_Result.isError(check(undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, "p-2")))).toBe(true);
+  });
+  globalThis.test("a timestamp outside the window is refused, so a captured request cannot be replayed", () => {
+    globalThis.expect(Stdlib_Result.isError(check(undefined, signedHeaders(undefined, 1700000000 - 301, body(undefined, undefined)), body(undefined, undefined)))).toBe(true);
+  });
+  globalThis.test("a request without the signature header is refused", () => {
+    let headers = signedHeaders(undefined, undefined, body(undefined, undefined));
+    Stdlib_Dict.$$delete(headers, "x-signature");
+    globalThis.expect(Stdlib_Result.isError(check(undefined, headers, body(undefined, undefined)))).toBe(true);
+  });
+  globalThis.test("while a secret is rotated, either one passes", () => {
+    globalThis.expect(check(InboundTranslationSlice_Webhook$ReventlessCore.secretsOf("new, old"), signedHeaders("old", undefined, body(undefined, undefined)), body(undefined, undefined))).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+  globalThis.test("a secret is read from a variable named after it", () => {
+    globalThis.expect(InboundTranslationSlice_Webhook$ReventlessCore.secretEnvKey("supplier-feed")).toBe("REVENTLESS_WEBHOOK_SECRET_SUPPLIER_FEED");
+  });
+});
+
+globalThis.describe("webhook door", () => {
+  globalThis.beforeAll(() => {
+    LocalWebhookRegistry$ReventlessLocal.reset();
+    let match = FeedCallback.webhook;
+    let match$1 = OpenCallback.webhook;
+    if (match !== undefined && match$1 !== undefined) {
+      LocalWebhookRegistry$ReventlessLocal.register(match, Pulumi.output(feedOps));
+      return LocalWebhookRegistry$ReventlessLocal.register(match$1, Pulumi.output(openOps));
+    } else {
+      return Stdlib_JsError.throwWithMessage("fixture specs declare endpoints");
+    }
+  });
+  globalThis.afterAll(() => LocalWebhookRegistry$ReventlessLocal.reset());
+  globalThis.beforeEach(() => {
+    published.contents = [];
+    clear(FeedCallback.auditLog);
+    clear(OpenCallback.auditLog);
+  });
+  globalThis.test("a signed request publishes its commands as the endpoint's role", async () => {
+    let response = await post(undefined, undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect(response.status).toBe(200);
+    globalThis.expect(published.contents.map(c => c.id)).toEqual(["p-1"]);
+    globalThis.expect(Object.values(FeedCallback.auditLog).map(row => row.door)).toEqual([viaWebhook]);
+  });
+  globalThis.test("a command the endpoint's role may not send is refused", async () => {
+    let text = body("category", undefined);
+    let response = await post(undefined, undefined, signedHeaders(undefined, undefined, text), text);
+    globalThis.expect(response.status).toBe(403);
+    globalThis.expect(published.contents).toEqual([]);
+  });
+  globalThis.test("a bad signature is refused before the body is read, with an audit row", async () => {
+    let response = await post(undefined, undefined, signedHeaders("other", undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect(response.status).toBe(401);
+    globalThis.expect(published.contents).toEqual([]);
+    globalThis.expect(Object.values(FeedCallback.auditLog).map(row => [
+      row.status,
+      row.door,
+      row.input
+    ])).toEqual([[
+        "Failure",
+        viaWebhook,
+        body(undefined, undefined)
+      ]]);
+  });
+  globalThis.test("a signed body that is not JSON is refused", async () => {
+    let response = await post(undefined, undefined, signedHeaders(undefined, undefined, "not json"), "not json");
+    globalThis.expect(response.status).toBe(400);
+  });
+  globalThis.test("an unknown path and a wrong method are refused", async () => {
+    let unknown = await post("nowhere", undefined, undefined, body(undefined, undefined));
+    let wrongMethod = await post(undefined, "PUT", signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect([
+      unknown.status,
+      wrongMethod.status
+    ]).toEqual([
+      404,
+      405
+    ]);
+  });
+  globalThis.test("a secret the platform lacks fails closed, without an audit row", async () => {
+    let response = await LocalWebhookRegistry$ReventlessLocal.post("feeds/signed", undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), param => {}, 1700000000, body(undefined, undefined));
+    globalThis.expect(response.status).toBe(500);
+    globalThis.expect(published.contents).toEqual([]);
+    globalThis.expect(Object.values(FeedCallback.auditLog)).toEqual([]);
+  });
+  globalThis.test("an open URL identifies nobody, so a signed-in rule refuses it", async () => {
+    let response = await post("open", undefined, undefined, body(undefined, undefined));
+    globalThis.expect(response.status).toBe(403);
+  });
+  globalThis.test("both doors publish the same commands and are told apart in the audit", async () => {
+    let caller_groups = [merchandiser];
+    let caller = {
+      userId: "u-1",
+      username: "alice",
+      groups: caller_groups,
+      provider: "InMemory"
+    };
+    let mutationResult = await feedOps_receive(JSON.parse(body(undefined, undefined)), caller, undefined);
+    await post(undefined, undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect(Stdlib_Result.isOk(mutationResult)).toBe(true);
+    let commands = published.contents.map(c => c.commandJson);
+    if (commands.length !== 2) {
+      globalThis.expect(commands.length).toBe(2);
+    } else {
+      let viaMutationCommand = commands[0];
+      let viaWebhookCommand = commands[1];
+      globalThis.expect(viaWebhookCommand).toEqual(viaMutationCommand);
+    }
+    globalThis.expect(Object.values(FeedCallback.auditLog).map(row => row.door)).toEqual([
+      viaMutation,
+      viaWebhook
+    ]);
+  });
+  globalThis.test("two slices may not share a path", () => {
+    let route = FeedCallback.webhook;
+    if (route !== undefined) {
+      globalThis.expect(throws(() => LocalWebhookRegistry$ReventlessLocal.register(route, Pulumi.output(feedOps)))).toBe(true);
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("fixture spec declares an endpoint");
+    }
+  });
+});
+
+globalThis.describe("which doors a slice has", () => {
+  globalThis.test("@noApi on externalInput withholds the mutation", () => {
+    globalThis.expect([
+      InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(Api$ReventlessInfra.markNoApi(inputSchema)),
+      InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(inputSchema)
+    ]).toEqual([
+      false,
+      true
+    ]);
+  });
+  globalThis.test("a slice with neither door is refused", () => {
+    let check = webhook => throws(() => InboundTranslationSlice_Callback$ReventlessCore.checkReachable("P", "S", false, webhook));
+    globalThis.expect([
+      check(false),
+      check(true)
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+});
+
+let Webhook;
+
+let Callback;
+
+let now = 1700000000;
+
+export {
+  Webhook,
+  Callback,
+  merchandiser,
+  FeedSpec,
+  translateFeed,
+  FeedCallback,
+  OpenSpec,
+  OpenCallback,
+  inputSchema,
+  published,
+  publishJsons,
+  feedOps,
+  openOps,
+  viaWebhook,
+  viaMutation,
+  secret,
+  now,
+  secretOf,
+  signature,
+  hmac,
+  signedHeaders,
+  body,
+  post,
+  throws,
+  rows,
+  clear,
+}
+/*  Not a pure module */