@reventlessdev/reventless-spec 3.0.0-alpha.127 → 3.0.0-alpha.129

package/CHANGELOG.md

@@ -3,6 +3,58 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.129 (2026-09-04)
+
+### Bug Fixes
+
+* **logging:** let a runtime declare whether a person reads its logs ([df7a6cb](https://github.com/ReventlessDev/reventless-core/commit/df7a6cbdff62b856ea6b9d1f169b913563ba13a1))
+* feat(spec)!: one optional encoding on the wire, with no annotation ([320f91d](https://github.com/ReventlessDev/reventless-core/commit/320f91daa8bd90812a6e82069e7a1cb473041930))
+
+### BREAKING CHANGES
+
+* the two encodings cannot read each other. Stored
+pluginDefinition / pluginStructure payloads and already-deployed plugins must
+go — wipe the platform scope (SEED_RESET_SCOPE=platform), quiesce, and
+redeploy the fleet from one commit. Domain plugin data is untouched.
+
+Two guards had to learn the new shape, both of which defined "optional" as
+has.null and so mistook an omitted key for something to invent:
+
+- Message.fillMissingDefaults reached `return undefined` only below two arms
+  that fire first — an enum's first const, and an object member filled with
+  zeros. Absent option<record> therefore healed to a zero-filled record, not
+  None: on the real schema, dcbEventLog became Some({name: "", eventTopicArn:
+  ""}), which manageSubscriptions would have read as a peer to subscribe to.
+  One line, mirroring the has.null guard, above both arms.
+- PluginDefinitionScalars' walker reported 16 optional fields as newly-added
+  bare required scalars. With both encodings understood, the golden list is
+  unchanged.
+
+The frozen lifecycle corpus holds five real payloads in the old encoding.
+Null-valued keys were stripped mechanically — the rewrite round-trips each
+file unchanged before editing, and a key-by-key diff shows null removals and
+nothing else. The README records it beside the account-id redaction and says
+why it is not a regeneration: no fixture was rebuilt from ReScript types, so
+every generation in its table is still pinned.
+
+check:graphql is unchanged, as expected: SchemaType.fromSury collapses Null
+and Undefined to the same Nullable, so the emitted schema never distinguished
+them.
+
+
+
+# 3.0.0-alpha.128 (2026-09-04)
+
+### Features
+
+* **notifications:** the wording is a table of values, not a switch ([bfcc939](https://github.com/ReventlessDev/reventless-core/commit/bfcc93940b81060d201fd231447fb14dcf48d80e))
+* **plugin:** a slice publishes which topics it subscribes to ([c689695](https://github.com/ReventlessDev/reventless-core/commit/c6896957ecb636204678222ac5a26b30870439cb))
+* **spec,traits:** an image carries the text that goes with it, and a set's first member is its primary ([e4e5845](https://github.com/ReventlessDev/reventless-core/commit/e4e58458aee7b3db5564727d358a3a9767362ca4))
+* **spec:** a field can say it selects one of the values its row already holds ([2ae50c3](https://github.com/ReventlessDev/reventless-core/commit/2ae50c34deee48508a9f1f39e3eef6a5d2f5df00))
+* **spec:** a field can say its value must not be rendered into a message ([3183f53](https://github.com/ReventlessDev/reventless-core/commit/3183f53a0ae667f794bbd1a3d77acf362dfa8e57))
+* **spec:** a message template renders a payload through its own schema ([39e3f61](https://github.com/ReventlessDev/reventless-core/commit/39e3f6126bd831a316323b4663bc37c50cdfc704))
+
+
 # 3.0.0-alpha.127 (2026-09-02)
 
 * feat(aws)!: the messaging sender is configuration, and a stack can choose to only log ([23b8b4b](https://github.com/ReventlessDev/reventless-core/commit/23b8b4bfe9c70555de4d74266ca686cb427485ca))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-spec",
-  "version": "3.0.0-alpha.127",
+  "version": "3.0.0-alpha.129",
   "description": "Specifications for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -24,7 +24,7 @@
     "sury": "11.0.0-rc.2",
     "sury-ppx": "11.0.0-rc.2",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.8"
+    "@reventlessdev/rescript-node": "2.0.0-alpha.9"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/schema/platform-api.graphql

@@ -134,6 +134,7 @@ type Platform_IssuedCommandDef {
 type Platform_OutboundTranslationSliceDef {
   chapter: String
   consumedEventTypes: [String!]!
+  consumedSources: [String!]
   externalSystem: String
   inboundCommandTypes: [String!]!
   name: String!

package/src/AnsiStyle.res

@@ -11,14 +11,23 @@
 @val external _isTty: option<bool> = "process.stdout.isTTY"
 @val external _logFormat: option<string> = "process.env.REVENTLESS_LOG_FORMAT"
 
-// "json" | "text". Explicit REVENTLESS_LOG_FORMAT override always wins; otherwise
-// a TTY stdout ⇒ human-readable text, everything else (Lambda, Fargate, ECS,
-// Azure, GCP, Docker, CI runners, piped stdout) ⇒ structured JSON.
+// What this runtime is, for when stdout cannot say. A local dev platform's logs
+// are read by a person even when its stdout is a pipe — `concurrently`, `tsx
+// watch` and an IDE terminal all pipe — while a Lambda's are read by a collector
+// through a pipe that looks identical. TTY-ness is only a proxy for "a person is
+// reading this", and a pipe is exactly where the proxy fails, so a runtime that
+// knows which it is says so instead of being guessed at.
+let _default: ref<option<string>> = ref(None)
+
+// "json" | "text", in precedence order: an explicit REVENTLESS_LOG_FORMAT, then
+// what the runtime declared itself to be, then the TTY probe — a TTY stdout ⇒
+// text, everything else (Lambda, Fargate, ECS, Docker, CI) ⇒ structured JSON.
 let _resolveFormat = (): string =>
-  switch (_logFormat, _isTty) {
-  | (Some("json"), _) => "json"
-  | (Some("text"), _) => "text"
-  | (_, Some(true)) => "text"
+  switch (_logFormat, _default.contents, _isTty) {
+  | (Some("json"), _, _) => "json"
+  | (Some("text"), _, _) => "text"
+  | (_, Some(declared), _) => declared
+  | (_, None, Some(true)) => "text"
   | _ => "json"
   }
 
@@ -27,6 +36,21 @@ let _resolveFormat = (): string =>
 // keeps every log call off `process.env`.
 let _format = ref(_resolveFormat())
 
+/** Declares what this runtime is, for the pipe case the TTY probe gets wrong.
+    Call it at module init, before anything logs. An explicit
+    REVENTLESS_LOG_FORMAT still wins, so a developer can always ask for the other
+    one. A runtime that says nothing keeps the TTY behaviour. */
+let setDefaultFormat = (format: [#text | #json]) => {
+  _default :=
+    Some(
+      switch format {
+      | #text => "text"
+      | #json => "json"
+      },
+    )
+  _format := _resolveFormat()
+}
+
 /** Test-only: re-evaluate REVENTLESS_LOG_FORMAT / process.stdout.isTTY. */
 let reload = () => _format := _resolveFormat()
 

package/src/AnsiStyle.res.mjs

@@ -1,9 +1,14 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 
+let _default = {
+  contents: undefined
+};
+
 function _resolveFormat() {
   let match = process.env.REVENTLESS_LOG_FORMAT;
-  let match$1 = process.stdout.isTTY;
+  let match$1 = _default.contents;
+  let match$2 = process.stdout.isTTY;
   if (match !== undefined) {
     switch (match) {
       case "json" :
@@ -12,7 +17,9 @@ function _resolveFormat() {
         return "text";
     }
   }
-  if (match$1 !== undefined && match$1) {
+  if (match$1 !== undefined) {
+    return match$1;
+  } else if (match$2 !== undefined && match$2) {
     return "text";
   } else {
     return "json";
@@ -23,6 +30,11 @@ let _format = {
   contents: _resolveFormat()
 };
 
+function setDefaultFormat(format) {
+  _default.contents = format === "text" ? "text" : "json";
+  _format.contents = _resolveFormat();
+}
+
 function reload() {
   _format.contents = _resolveFormat();
 }
@@ -44,8 +56,10 @@ function bold(s) {
 }
 
 export {
+  _default,
   _resolveFormat,
   _format,
+  setDefaultFormat,
   reload,
   isJsonSink,
   useAnsi,

package/src/components/Plugin.res

@@ -73,13 +73,13 @@ type apiSchemaFragment = {encoded: string, protocol: string}
 @schema
 type apiTarget = Domain | Platform
 
-// js_nullable (T | null) is the only optional that passes jsonableValidation inside
-// union variant payloads; nullableAsOption adds `undefined` and fails it.
+// Every optional below carries sury's default `option` encoding: the key is omitted,
+// never written as `null`. That is the shape the rest of the repo already uses
+// (`Message.meta`, `storedEvent.tags`), so there is one optional form on the wire and
+// nothing to annotate. The `T | null` these fields used to carry worked around a sury
+// bug — undefined failing jsonableValidation inside a union variant payload — fixed in
+// 11.0.0-alpha.11. `Offload` below is not an optional wrapper but an either-or codec.
 let apiSchemaFragmentOffloadSchema = Offload.optionSchema(~store="pluginApiFragments", apiSchemaFragmentSchema)
-let dcbEventLogOptionSchema = dcbEventLogDefinitionSchema->S.nullAsOption
-let stringOptionSchema = S.string->S.nullAsOption
-let stringArrayOptionSchema = S.array(S.string)->S.nullAsOption
-let boolOptionSchema = S.bool->S.nullAsOption
 
 // ── UI fragment manifest types ────────────────────────────────────────────────
 
@@ -89,14 +89,14 @@ type panelManifestEntry = {
   title: string,
   description: string,
   positions: array<string>,
-  requiredAccess: @s.matches(stringOptionSchema) option<string>,
+  requiredAccess: option<string>,
 }
 
 @schema
 type menuEntry = {
   label: string,
-  icon: @s.matches(stringOptionSchema) option<string>,
-  group: @s.matches(stringOptionSchema) option<string>,
+  icon: option<string>,
+  group: option<string>,
   sortOrder: int,
 }
 
@@ -105,7 +105,7 @@ type pageManifestEntry = {
   fragmentId: string,
   title: string,
   menuEntry: menuEntry,
-  requiredAccess: @s.matches(stringOptionSchema) option<string>,
+  requiredAccess: option<string>,
 }
 
 @schema
@@ -115,7 +115,7 @@ type uiFragmentManifest = {
   pages: array<pageManifestEntry>,
 }
 
-let uiFragmentManifestOptionSchema = uiFragmentManifestSchema->S.nullAsOption
+let uiFragmentManifestOptionSchema = S.option(uiFragmentManifestSchema)
 
 // ── Plugin structure types (component metadata for Auto UI and event graph) ──
 
@@ -126,7 +126,7 @@ type commandLevel = Collection | Instance
 type fieldReference = {
   fieldName: string,
   entity: string,
-  plugin: @s.matches(stringOptionSchema) option<string>,
+  plugin: option<string>,
 }
 
 @schema
@@ -134,23 +134,23 @@ type commandDef = {
   name: string,
   schema: string,
   level: commandLevel,
-  aggregateIdField: @s.matches(stringOptionSchema) option<string>,
+  aggregateIdField: option<string>,
   mutationField: string,
   references: array<fieldReference>,
   /** The declared *from* set — lifecycle states this command is meaningful in.
       `None` means always available; `Some([])` means never show. */
-  allowedStates: @s.matches(stringArrayOptionSchema) option<array<string>>,
+  allowedStates: option<array<string>>,
   /** The declared *to* state this command's handler writes. `None` with a
       from-set present means the command does not move the row. */
-  targetState: @s.matches(stringOptionSchema) option<string>,
+  targetState: option<string>,
   /** Whether the variant is exposed in the generated API (non-`@noApi`). */
-  apiExposed: @s.matches(boolOptionSchema) option<bool>,
+  apiExposed: option<bool>,
   /** Access keys — any one of them — a caller needs to be *offered* this command.
       A hint derived from the server's rule, never the refusal itself. */
-  requiredAccess: @s.matches(stringArrayOptionSchema) option<array<string>>,
+  requiredAccess: option<array<string>>,
   /** The `@owner` command field the server stamps with the caller's identity; a
       client omits it from a form, since whatever it collects is discarded. */
-  ownerField: @s.matches(stringOptionSchema) option<string>,
+  ownerField: option<string>,
 }
 
 @schema
@@ -168,41 +168,41 @@ type queryableDef = {
   searchableFields: array<string>,
   /** Which rung produced `labelField`, so a consumer can rank it against its own
       rule: `"annotation"` | `"convention"` | `"position"` | `"fallback"`. */
-  labelFieldSource: @s.matches(stringOptionSchema) option<string>,
+  labelFieldSource: option<string>,
   /** The state field holding the row's lifecycle, paired with
       `commandDef.allowedStates`. From `@lifecycle`, else an enum named `lifecycle`. */
-  lifecycleField: @s.matches(stringOptionSchema) option<string>,
+  lifecycleField: option<string>,
   /** The `@owner` state field. Reads of this view are narrowed server-side to a
       non-elevated caller's own rows. */
-  ownerField: @s.matches(stringOptionSchema) option<string>,
+  ownerField: option<string>,
   /** The `@retired` state field withdrawing a row from ordinary reads. From the
       annotation only — no fallback by name, since guessing hides data. */
-  retiredField: @s.matches(stringOptionSchema) option<string>,
+  retiredField: option<string>,
   /** The states a row is retired *in* (state form of `@retired`); `None` is the
       boolean form, where the excluded value is always `true`. */
-  retiredValues: @s.matches(stringArrayOptionSchema) option<array<string>>,
+  retiredValues: option<array<string>>,
   /** Whether the view publishes the by-ids reference door that names a retired row
       to any caller holding a pointer (`@namedWhenRetired`). Never true without
       `retiredField`. */
-  namedWhenRetired: @s.matches(boolOptionSchema) option<bool>,
+  namedWhenRetired: option<bool>,
   /** `@@reventless.visibility`. `Some("Internal")` hides the component from AutoUI;
       it is still carried here for developer tooling. `None` means Public. */
-  visibility: @s.matches(stringOptionSchema) option<string>,
+  visibility: option<string>,
   /** Intra-plugin grouping band, the first non-kind path segment under `src/`.
       `None` renders flat. */
-  chapter: @s.matches(stringOptionSchema) option<string>,
+  chapter: option<string>,
   /** The singular counterpart of `queryField` (`Plugin_Order`), also the prefix of
       the generated input types. Not derivable without `Api_Naming.singularize`. */
-  singleQueryField: @s.matches(stringOptionSchema) option<string>,
+  singleQueryField: option<string>,
   /** The state field identifying a row, as opposed to a reference to another entity.
       `None` means unresolved — no key-derived filter or sort until `@id` is declared. */
-  idField: @s.matches(stringOptionSchema) option<string>,
+  idField: option<string>,
   /** Which rung produced `idField`, as `labelFieldSource` does: `"annotation"` |
       `"convention"` | `"sole"`. */
-  idFieldSource: @s.matches(stringOptionSchema) option<string>,
+  idFieldSource: option<string>,
   /** Access keys — any one of them — a caller needs to be *offered* this view. A
       denied read comes back empty rather than erroring, hence the hint. */
-  requiredAccess: @s.matches(stringArrayOptionSchema) option<array<string>>,
+  requiredAccess: option<array<string>>,
 }
 
 /** One emitted event of a write side. `name` is the variant name, `schema` its
@@ -230,7 +230,7 @@ type writableDef = {
   producedEventTypes: array<string>,
   consumedEventTypes: array<string>,
   linkedViews: array<string>,
-  consistencyRead: @s.matches(stringOptionSchema) option<string>,
+  consistencyRead: option<string>,
   /** Emitted-event field schemas; `[]` when there are none. */
   events: array<eventDef>,
   /** Declared-error field schemas. Required, but a persisted structure predating a
@@ -238,7 +238,7 @@ type writableDef = {
       `[]` on read, and a new one must be added there too. */
   errors: array<errorDef>,
   /** Chapter grouping band — see `queryableDef.chapter`. */
-  chapter: @s.matches(stringOptionSchema) option<string>,
+  chapter: option<string>,
 }
 
 @schema
@@ -248,7 +248,7 @@ type automationSliceDef = {
   producedCommandTypes: array<string>,
   targetName: string,
   /** Chapter grouping band — see `queryableDef.chapter`. */
-  chapter: @s.matches(stringOptionSchema) option<string>,
+  chapter: option<string>,
 }
 
 @schema
@@ -256,11 +256,19 @@ type outboundTranslationSliceDef = {
   name: string,
   consumedEventTypes: array<string>,
   inboundCommandTypes: array<string>,
-  targetName: @s.matches(stringOptionSchema) option<string>,
+  targetName: option<string>,
   // Foreign system this slice publishes to — drives the external box (Event Graph).
-  externalSystem: @s.matches(stringOptionSchema) option<string>,
+  externalSystem: option<string>,
   /** Chapter grouping band — see `queryableDef.chapter`. */
-  chapter: @s.matches(stringOptionSchema) option<string>,
+  chapter: option<string>,
+  /** The topics this slice subscribes to, as `Spec.sourceNames` declares them —
+      an Aggregate's `Spec.name` or a DCB source name. `Some([])` is the declared
+      default and means this plugin's own DCB log; `None` is an older structure
+      that did not publish the field. A different fact from `consumedEventTypes`,
+      which names event types and not where they came from — two topics carrying
+      an event of the same name are indistinguishable there. Optional so an older
+      reader ignores it. */
+  consumedSources: option<array<string>>,
 }
 
 @schema
@@ -269,9 +277,9 @@ type inboundTranslationSliceDef = {
   commandTypes: array<string>,
   targetName: string,
   // Foreign system this slice receives from — drives the external box (Event Graph).
-  externalSystem: @s.matches(stringOptionSchema) option<string>,
+  externalSystem: option<string>,
   /** Chapter grouping band — see `queryableDef.chapter`. */
-  chapter: @s.matches(stringOptionSchema) option<string>,
+  chapter: option<string>,
 }
 
 /** A published event of an extension point and the internal events producing it.
@@ -283,8 +291,6 @@ type publishedEventDef = {
   fromEventTypes: array<string>,
 }
 
-let publishedEventDefArrayOptionSchema = S.array(publishedEventDefSchema)->S.nullAsOption
-
 /** The command direction's producer half: a command an extension point takes and
     the delegate commands it routes to. `name` is EP-qualified, `toCommandTypes`
     plugin-qualified. */
@@ -294,8 +300,6 @@ type acceptedCommandDef = {
   toCommandTypes: array<string>,
 }
 
-let acceptedCommandDefArrayOptionSchema = S.array(acceptedCommandDefSchema)->S.nullAsOption
-
 /** The subscriber's half: a published event and the commands it routes to. A
     delegate command is plugin-qualified, one sent back to the EP is EP-qualified. */
 @schema
@@ -304,8 +308,6 @@ type handledEventDef = {
   toCommandTypes: array<string>,
 }
 
-let handledEventDefArrayOptionSchema = S.array(handledEventDefSchema)->S.nullAsOption
-
 /** The command direction's subscriber half: a command sent back to the port and
     the internal events producing it. `name` is EP-qualified, `fromEventTypes`
     plugin-qualified. */
@@ -315,21 +317,19 @@ type issuedCommandDef = {
   fromEventTypes: array<string>,
 }
 
-let issuedCommandDefArrayOptionSchema = S.array(issuedCommandDefSchema)->S.nullAsOption
-
 @schema
 type extensionDef = {
   name: string,
   delegateNames: array<string>,
   eventTypes: array<string>,
   commandTypes: array<string>,
-  /** Which published event routes to which commands. js_nullable like
+  /** Which published event routes to which commands. Optional like
       `extensionPointDef.commandTypes`; re-emit definitions persisted before it. */
-  handledEvents: @s.matches(handledEventDefArrayOptionSchema) option<array<handledEventDef>>,
+  handledEvents: option<array<handledEventDef>>,
   /** Which internal event sends which command back to the port. `None` means a
       definition persisted before the field, NOT an extension that issues nothing —
       a reader joining the two halves must keep them apart. */
-  issuedCommands: @s.matches(issuedCommandDefArrayOptionSchema) option<array<issuedCommandDef>>,
+  issuedCommands: option<array<issuedCommandDef>>,
 }
 
 /**
@@ -338,28 +338,21 @@ An extension point owned by a plugin, from the producer side.
 `sourceEventTypes` are the `Delegate`'s events feeding the published protocol,
 plugin-qualified to match `writableDef.producedEventTypes`. `commandTypes` is the
 EP's inbound protocol — None (read as []) for a `command = unit` EP, which routes
-nothing. js_nullable is the only JSON-safe optional here (this def is nested in the
-lifecycle Message union); definitions persisted before a field must be re-emitted.
+nothing. Definitions persisted before a field was added must be re-emitted.
 */
 @schema
 type extensionPointDef = {
   name: string,
   delegateNames: array<string>,
   sourceEventTypes: array<string>,
-  commandTypes: @s.matches(stringArrayOptionSchema) option<array<string>>,
+  commandTypes: option<array<string>>,
   /** Which internal event becomes which published event. */
-  publishedEvents: @s.matches(publishedEventDefArrayOptionSchema)
-  option<array<publishedEventDef>>,
+  publishedEvents: option<array<publishedEventDef>>,
   /** Which arriving command becomes which delegate command. `None` means a
       definition persisted before the field, NOT a port that accepts nothing. */
-  acceptedCommands: @s.matches(acceptedCommandDefArrayOptionSchema)
-  option<array<acceptedCommandDef>>,
+  acceptedCommands: option<array<acceptedCommandDef>>,
 }
 
-// js_nullable creates `array | null` (not `| undefined`), which passes sury's
-// jsonableValidation inside the pluginStructure union variant payload.
-let extensionPointDefArrayOptionSchema = S.array(extensionPointDefSchema)->S.nullAsOption
-
 /**
 One field's store requirement, with its provenance.
 
@@ -374,12 +367,9 @@ type requiredStoreDeclaration = {
   store: string,
   component: string,
   field: string,
-  annotation: @s.matches(stringOptionSchema) option<string>,
+  annotation: option<string>,
 }
 
-let requiredStoreDeclarationArrayOptionSchema =
-  S.array(requiredStoreDeclarationSchema)->S.nullAsOption
-
 /**
 One component's capability requirement, with its provenance.
 
@@ -392,9 +382,6 @@ expressible as an annotation on one, which is why the need is declared.
 @schema
 type requiredCapabilityDeclaration = {capability: string, component: string}
 
-let requiredCapabilityDeclarationArrayOptionSchema =
-  S.array(requiredCapabilityDeclarationSchema)->S.nullAsOption
-
 /**
 One graft's provenance: which trait, at which version, on which component.
 
@@ -419,14 +406,13 @@ type traitDeclaration = {
   component: string,
 }
 
-let traitDeclarationArrayOptionSchema = S.array(traitDeclarationSchema)->S.nullAsOption
-
 /**
 Adding a field here? It must be a shape a stale event can be healed into — the
 lifecycle aggregate replays its own log before every decision, so one event that
-fails to decode freezes that plugin's registration. `Message.parseJsonTolerant`
-heals `T | null`, arrays, enums and nested objects; a bare scalar is fabricated
-and warned about. Prefer `js_nullable`. Regression suite:
+fails to decode freezes that plugin's registration. Make it `option`, which
+`Message.parseJsonTolerant` heals to `None` whatever the inner type is. A required
+array heals to `[]` and a required enum to its first variant; a required *scalar*
+is fabricated and warned about, so it is the one shape to avoid. Regression suite:
 `PluginLifecycleCorpusTest` — if it goes red, re-shape the field, not the fixtures.
 */
 @schema
@@ -441,27 +427,23 @@ type pluginStructure = {
   extensions: array<extensionDef>,
   // Extension points owned by this plugin (producer side). Optional so older
   // definitions still decode (absent → None, read as []).
-  extensionPoints: @s.matches(extensionPointDefArrayOptionSchema)
-  option<array<extensionPointDef>>,
+  extensionPoints: option<array<extensionPointDef>>,
   /** The object stores this plugin's fields declare they need, deduplicated and
       qualified as `{plugin}.{store}` even for the same-plugin case. */
-  requiredStores: @s.matches(stringArrayOptionSchema) option<array<string>>,
+  requiredStores: option<array<string>>,
   /** Provenance for `requiredStores`: one entry per declaring `(component, field)`.
       `requiredStores` is derived from it, so the two cannot disagree. */
-  requiredStoreDeclarations: @s.matches(requiredStoreDeclarationArrayOptionSchema)
-  option<array<requiredStoreDeclaration>>,
+  requiredStoreDeclarations: option<array<requiredStoreDeclaration>>,
   /** The platform capabilities this plugin's components declare they need, one
       entry per declaring component. Object stores are not here — a store need is
       a field's, and travels as `requiredStores`. Absent → None, read as []. */
-  requiredCapabilities: @s.matches(requiredCapabilityDeclarationArrayOptionSchema)
-  option<array<requiredCapabilityDeclaration>>,
+  requiredCapabilities: option<array<requiredCapabilityDeclaration>>,
   /** The domain traits grafted into this plugin, one entry per declaring
       component. Absent → None, read as []. The only signal a graft leaves that
       survives into a deployed plugin — every other one (the dependency, the
       variant spread, the rules alias, the conformance binding) is source-side.
       A claim about origin, never about behaviour: see `Trait`. */
-  traitDeclarations: @s.matches(traitDeclarationArrayOptionSchema)
-  option<array<traitDeclaration>>,
+  traitDeclarations: option<array<traitDeclaration>>,
 }
 
 let pluginStructureOffloadSchema = Offload.optionSchema(~store="pluginStructures", pluginStructureSchema)
@@ -488,15 +470,15 @@ type pluginDefinition = {
   apiSchemaFragment: @s.matches(apiSchemaFragmentOffloadSchema) option<Offload.payload<apiSchemaFragment>>,
   // Schema routing in split-API mode: None/"Domain" → DomainApi, Some("Platform") →
   // PlatformApi (and excluded from the DomainApi runtime schema).
-  apiTarget: @s.matches(stringOptionSchema) option<string>,
+  apiTarget: option<string>,
   // Component graph metadata, offloadable like apiSchemaFragment. Absent for older
   // protocol versions.
   structure: @s.matches(pluginStructureOffloadSchema) option<Offload.payload<pluginStructure>>,
   // EventTopic ARN of a bundled DcbEventLog, so the admin can subscribe peer
   // EventCollectors to it. None for plugins without one.
-  dcbEventLog: @s.matches(dcbEventLogOptionSchema) option<dcbEventLogDefinition>,
+  dcbEventLog: option<dcbEventLogDefinition>,
   // Mandatory; `Domain` is resolved as the default in Plugin_Builder. Payload-less
-  // variant → a bare JSON string, so JSON-safe without js_nullable.
+  // variant → a bare JSON string.
   kind: pluginKind,
 }