@reventlessdev/reventless-spec 3.0.0-alpha.133 → 3.0.0-alpha.135

package/src/semantic/Messaging.res.mjs

@@ -1,6 +1,17 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 
+function serviceOf(address) {
+  switch (address.TAG) {
+    case "Apns" :
+      return "ApnsService";
+    case "Fcm" :
+      return "FcmService";
+    case "WebPush" :
+      return "WebPushService";
+  }
+}
+
 function channelOf(recipient) {
   switch (recipient.TAG) {
     case "ToEmail" :
@@ -23,6 +34,17 @@ function channelToString(channel) {
   }
 }
 
+function pushServiceToString(service) {
+  switch (service) {
+    case "ApnsService" :
+      return "APNs";
+    case "FcmService" :
+      return "FCM";
+    case "WebPushService" :
+      return "Web Push";
+  }
+}
+
 function fromHeader(displayName, address) {
   if (displayName === undefined) {
     return address;
@@ -32,35 +54,56 @@ function fromHeader(displayName, address) {
 }
 
 function retriable(failure) {
-  switch (failure.TAG) {
-    case "Unavailable" :
-      return true;
-    case "UnsupportedChannel" :
-    case "Refused" :
-      return false;
-  }
+  return failure.TAG === "Unavailable";
 }
 
 function failureReason(failure) {
   switch (failure.TAG) {
     case "UnsupportedChannel" :
       return `this deployment provisions no ` + channelToString(failure._0) + ` channel`;
+    case "UnsupportedPushService" :
+      return `this deployment provisions push, but not ` + pushServiceToString(failure._0);
     case "Unavailable" :
     case "Refused" :
       return failure._0;
   }
 }
 
+function makeProvider(emailAndSms, pushServices, send) {
+  return {
+    channels: emailAndSms.filter(channel => {
+      switch (channel) {
+        case "Email" :
+        case "Sms" :
+          return true;
+        case "Push" :
+          return false;
+      }
+    }).concat(pushServices.length === 0 ? [] : ["Push"]),
+    pushServices: pushServices,
+    send: send
+  };
+}
+
 function supports(provider, recipient) {
-  return provider.channels.includes(channelOf(recipient));
+  switch (recipient.TAG) {
+    case "ToEmail" :
+    case "ToSms" :
+      return provider.channels.includes(channelOf(recipient));
+    case "ToPush" :
+      return provider.pushServices.includes(serviceOf(recipient._0));
+  }
 }
 
 export {
+  serviceOf,
   channelOf,
   channelToString,
+  pushServiceToString,
   fromHeader,
   retriable,
   failureReason,
+  makeProvider,
   supports,
 }
 /* No side effect */

package/src/semantic/Money.res

@@ -66,7 +66,6 @@ rewrites the wire shape, so stored events no longer decode and projections must
 be rebuilt. Retyping a field in a log that has to survive needs an upcaster
 first; a log that can be discarded can take it today.
 */
-
 /**
 Validate a minor-unit amount, saying why when it is not one.
 
@@ -79,8 +78,9 @@ let validateAmount = (amount: float): result<float, string> =>
   } else if amount !== Math.trunc(amount) {
     Error(
       `an amount is a whole number of a currency's minor units, got ` ++
-      `${Float.toString(amount)}. There is no such thing as a fraction of the ` ++
-      `smallest unit — a major amount converts with Money.ofMajor.`,
+      `${Float.toString(
+          amount,
+        )}. There is no such thing as a fraction of the ` ++ `smallest unit — a major amount converts with Money.ofMajor.`,
     )
   } else {
     Ok(amount)
@@ -96,14 +96,12 @@ let validateAmount = (amount: float): result<float, string> =>
     threw `Cannot access 'v0' before initialization` — it is simply not what this
     check wants.) */
 let amountSchema: S.t<float> =
-  S.float->S.refine(
-    amount =>
-      switch validateAmount(amount) {
-      | Ok(_) => true
-      | Error(_) => false
-      },
-    ~error="expected a monetary amount",
-  )
+  S.float->S.refine(amount =>
+    switch validateAmount(amount) {
+    | Ok(_) => true
+    | Error(_) => false
+    }
+  , ~error="expected a monetary amount")
 
 @schema
 type t = {
@@ -117,7 +115,8 @@ type t = {
 
     Shadows the schema sury-ppx derived from the type above: the derived one is
     the shape, and this adds the marker the shape cannot carry. */
-let schema: S.t<t> = schema->Semantic.mark(~id=Semantic.Id.money)
+let schema: S.t<t> =
+  schema->Semantic.mark(~id=Semantic.Id.money)
 
 /** An amount already counted in minor units. */
 let make = (~amount: float, ~currency: Currency.t): t => {amount, currency}
@@ -208,8 +207,9 @@ let add = (a: t, b: t): result<t, string> =>
   a.currency == b.currency
     ? Ok({amount: a.amount +. b.amount, currency: a.currency})
     : Error(
-        `cannot add ${format(b)} to ${format(a)}: they are different currencies. ` ++
-        `Converting between them needs a rate, which is not something an amount carries.`,
+        `cannot add ${format(b)} to ${format(
+            a,
+          )}: they are different currencies. ` ++ `Converting between them needs a rate, which is not something an amount carries.`,
       )
 
 /** The largest whole number a `float` holds exactly, 2^53 - 1. Bound here
@@ -266,8 +266,9 @@ A negative amount splits away from zero the same way: -€10.00 into three is
 let allocate = (m: t, ~into: int): result<array<t>, string> =>
   if into <= 0 {
     Error(
-      `cannot split ${format(m)} into ${Int.toString(into)} parts: ` ++
-      `a split is into at least one part.`,
+      `cannot split ${format(m)} into ${Int.toString(
+          into,
+        )} parts: ` ++ `a split is into at least one part.`,
     )
   } else {
     let parts = Int.toFloat(into)
@@ -293,8 +294,10 @@ let allocate = (m: t, ~into: int): result<array<t>, string> =>
 let sum = (amounts: array<t>): option<result<t, string>> =>
   switch amounts {
   | [] => None
-  | _ => Some(amounts->Array.reduce(Ok(zero(~currency=(amounts->Array.getUnsafe(0)).currency)), (
-      acc,
-      m,
-    ) => acc->Result.flatMap(total => add(total, m))))
+  | _ =>
+    Some(
+      amounts->Array.reduce(Ok(zero(~currency=(amounts->Array.getUnsafe(0)).currency)), (acc, m) =>
+        acc->Result.flatMap(total => add(total, m))
+      ),
+    )
   }

package/src/semantic/Offload.res

@@ -45,7 +45,6 @@ structure: @s.matches(Offload.optionSchema(~store="pluginStructures", pluginStru
   option<Offload.payload<pluginStructure>>
 ```
 */
-
 /** The reference an offloaded value carries: which store holds it, the
     content-addressed key, the content hash (== the key's basis), and the byte
     length. `hash` is redundant with `key` today (`key` is `sha256/<hash>`) but
@@ -75,7 +74,7 @@ Parameterised by the inner value's schema because the `Inline` arm round-trips
 through it. The `Offloaded` arm round-trips through `offloadedRefSchema` under the
 sentinel key. See the module doc for why this is untagged.
 */
-// Both arms are *declared* (`S.object` / `S.shape`) rather than hand-written as
+let // Both arms are *declared* (`S.object` / `S.shape`) rather than hand-written as
 // `S.transform` pairs, and that is load-bearing, not a style choice. A transform
 // arm is opaque: sury cannot see what it accepts, so it must offer every value to
 // the arm's own serializer and let it reject. Two things follow, both of which bit
@@ -89,7 +88,7 @@ sentinel key. See the module doc for why this is untagged.
 // A declared arm has neither problem: sury derives both directions from the shape,
 // discriminates on it, and never runs user code to find out. One transform arm is
 // enough to bring both failures back, so keep every arm declarative.
-let schema = (inner: S.t<'a>): S.t<payload<'a>> => {
+schema = (inner: S.t<'a>): S.t<payload<'a>> => {
   // Offloaded arm: an object carrying the reserved sentinel key, tried first so an
   // offloaded value is never mistaken for an inline one.
   let offloadedArm = S.object(s => Offloaded(s.field(sentinelKey, offloadedRefSchema)))
@@ -115,7 +114,10 @@ let forStore = (
   ~threshold: option<int>=?,
   inner: S.t<'a>,
 ): S.t<payload<'a>> =>
-  schema(inner)->Semantic.mark(~id=Semantic.Id.offload, ~payload=StoredIn({plugin, store, threshold}))
+  schema(inner)->Semantic.mark(
+    ~id=Semantic.Id.offload,
+    ~payload=StoredIn({plugin, store, threshold}),
+  )
 
 /**
 The codec wrapped for an **optional** field, plus the `StoredIn` marker. This is

package/src/semantic/Percent.res

@@ -13,7 +13,6 @@ fractions are allowed — `99.95` is a percentage.
 }
 ```
 */
-
 /** The percentage's representation. Transparent `float`: the marker refines an
     existing numeric field, so nothing stored changes. */
 type t = float
@@ -27,8 +26,9 @@ let fromFloat = (raw: float): result<t, string> =>
     Error(`a percentage must be a finite number, got ${Float.toString(raw)}`)
   } else if raw < 0.0 || raw > 100.0 {
     Error(
-      `a percentage runs from 0 to 100, got ${Float.toString(raw)}. ` ++
-      `This scale is 0–100, not 0–1 — a fraction multiplies by 100 first.`,
+      `a percentage runs from 0 to 100, got ${Float.toString(
+          raw,
+        )}. ` ++ `This scale is 0–100, not 0–1 — a fraction multiplies by 100 first.`,
     )
   } else {
     Ok(raw)

package/src/semantic/Phone.res

@@ -30,7 +30,6 @@ which is the E.164 limit. No spaces, no punctuation, no leading zero after the
     })
 ```
 */
-
 /** The number's representation. Transparent `string`; see `Email.t`. */
 type t = string
 

package/src/semantic/RowImage.res

@@ -23,11 +23,12 @@ Declaration order rather than a name rule: a view with two image fields has
 already said which one comes first, and guessing from names would let a field
 called `thumbnail` outrank the one the author put at the top.
 */
-
 /** Where the ref string sits, relative to the field that carries it. */
 type shape =
-  | /** The field's own value is the ref. */ Scalar
-  | /** The ref is one member of the field's record. */ Member(string)
+  /** The field's own value is the ref. */
+  | Scalar
+  /** The ref is one member of the field's record. */
+  | Member(string)
 
 type source = {
   field: string,

package/src/semantic/Secrets.res

@@ -0,0 +1,76 @@
+/**
+Unguessable material, and a one-way function over it.
+
+Injected rather than imported, and that is the whole point. A runtime global
+would work in production and leave every consumer's *issuance* untestable: a
+suite cannot assert what a flow does with a secret it cannot predict. Handing
+the generator in is what lets a test pin it, exactly as an injected geocoder
+lets a test pin a coordinate.
+
+Not a portability seam like the others — every target runtime has a
+cryptographic source, so this is not a provisioning choice anyone makes. It is
+here because the domain must not reach for one directly, and because a test must
+be able to replace it.
+*/
+/** What a secret is drawn from. Named rather than a charset string so a caller
+    cannot ask for an alphabet nothing checks — and so the two real cases stay
+    distinguishable: one is followed as a link, the other is retyped by a human
+    off a screen. */
+type alphabet =
+  /** `0`–`9`. For a code someone reads and types back. */
+  | Digits
+  /** `A`–`Z`, `a`–`z`, `0`–`9`, `-`, `_`. Survives a URL untouched. */
+  | UrlSafe
+
+/** The one way this fails: nothing here is a verdict about the caller. */
+type failure = Unavailable(string)
+
+/**
+The port a caller reaches a cryptographic source through.
+
+Both members answer `result` rather than a bare string, so a platform that
+provisioned nothing refuses instead of returning something weak. A token is the
+one value where a silent fallback is worse than an error: it would be accepted
+everywhere and guessable by anyone.
+*/
+type t = {
+  /** `length` characters drawn uniformly from `alphabet`. */
+  randomToken: (~length: int, ~alphabet: alphabet) => result<string, failure>,
+  /** One-way, so a challenge can be stored without storing what would answer
+        it. Deterministic: the same input always gives the same digest, which is
+        what lets a presented secret be compared against a held one. */
+  hash: string => result<string, failure>,
+}
+
+/** The characters each alphabet draws from. Exposed so an implementation and a
+    test agree on the set rather than each spelling it. */
+let characters = (alphabet: alphabet): string =>
+  switch alphabet {
+  | Digits => "0123456789"
+  | UrlSafe => "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+  }
+
+/**
+A source that produces nothing, refusing both operations.
+
+Named so a platform passing it is making a statement rather than filling in a
+blank — and refusing rather than degrading, because there is no weaker token
+that would be safe to hand back.
+*/
+let unavailable = (~reason: string): t => {
+  randomToken: (~length as _, ~alphabet as _) => Error(Unavailable(reason)),
+  hash: _ => Error(Unavailable(reason)),
+}
+
+/**
+A source that returns what it was given, for a test that needs to know the
+secret it is about to present.
+
+Here rather than in each suite because a consumer testing issuance needs exactly
+this and should not be inventing it — and because a fixed generator written per
+suite is one that eventually differs from the real one's alphabet.
+*/
+let fixed = (~token: string, ~hash as hashOf: string => string): t => {
+  randomToken: (~length as _, ~alphabet as _) => Ok(token),
+  hash: input => Ok(hashOf(input)),
+}

package/src/semantic/Secrets.res.mjs

@@ -0,0 +1,49 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function characters(alphabet) {
+  if (alphabet === "Digits") {
+    return "0123456789";
+  } else {
+    return "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  }
+}
+
+function unavailable(reason) {
+  return {
+    randomToken: (param, param$1) => ({
+      TAG: "Error",
+      _0: {
+        TAG: "Unavailable",
+        _0: reason
+      }
+    }),
+    hash: param => ({
+      TAG: "Error",
+      _0: {
+        TAG: "Unavailable",
+        _0: reason
+      }
+    })
+  };
+}
+
+function fixed(token, hashOf) {
+  return {
+    randomToken: (param, param$1) => ({
+      TAG: "Ok",
+      _0: token
+    }),
+    hash: input => ({
+      TAG: "Ok",
+      _0: hashOf(input)
+    })
+  };
+}
+
+export {
+  characters,
+  unavailable,
+  fixed,
+}
+/* No side effect */

package/src/semantic/Semantic.res

@@ -9,7 +9,6 @@ semantic is a new value rather than a new branch.
 The payload is a typed variant because the vocabulary is framework-owned and
 closed — which also keeps `Reference.getTarget` total.
 */
-
 /** Which entity a reference field points to. */
 type referenceTarget = {entity: string, plugin: option<string>}
 
@@ -122,18 +121,16 @@ let mark = (schema: S.t<'a>, ~id: string, ~payload: payload=Plain): S.t<'a> =>
 
 /** A schema that validates with `check` and carries the semantic `id`, derived
     from the constructor so no second grammar can drift from it. */
-// sury's refiner takes a fixed message, so `check`'s per-value reason is lost
+let // sury's refiner takes a fixed message, so `check`'s per-value reason is lost
 // here; call the scalar's own `fromString`/`fromFloat` to report which rule broke.
-let refined = (base: S.t<'a>, ~id: string, ~check: 'a => result<'a, string>): S.t<'a> =>
+refined = (base: S.t<'a>, ~id: string, ~check: 'a => result<'a, string>): S.t<'a> =>
   base
-  ->S.refine(
-    value =>
-      switch check(value) {
-      | Ok(_) => true
-      | Error(_) => false
-      },
-    ~error=`expected a valid ${id}`,
-  )
+  ->S.refine(value =>
+    switch check(value) {
+    | Ok(_) => true
+    | Error(_) => false
+    }
+  , ~error=`expected a valid ${id}`)
   ->mark(~id)
 
 /** A value as it should read back to whoever typed it — rejection messages quote

package/src/semantic/StorageRef.res

@@ -50,7 +50,6 @@ wire format, or any stored value changing.
     })
 ```
 */
-
 /** The ref's representation. Transparent `string` on purpose: the marker refines
     an existing `string` field rather than replacing it, so the field's runtime
     representation — and therefore every stored event — is unchanged. A sealed
@@ -61,8 +60,7 @@ type t = string
 external unsafe: string => t = "%identity"
 external toString: t => string = "%identity"
 
-let segmentIsSafe = (segment: string) =>
-  segment !== "" && segment !== "." && segment !== ".."
+let segmentIsSafe = (segment: string) => segment !== "" && segment !== "." && segment !== ".."
 
 /**
 Validate a raw string as a storage ref, saying why when it is not one.
@@ -74,7 +72,9 @@ schema validation cannot drift apart.
 let fromString = (raw: string): result<t, string> =>
   if !String.startsWith(raw, "/") {
     Error(
-      `expected an origin-relative storage ref starting with "/", got ${raw->JSON.Encode.string->JSON.stringify}. External URLs and data: URIs are not storage refs.`,
+      `expected an origin-relative storage ref starting with "/", got ${raw
+        ->JSON.Encode.string
+        ->JSON.stringify}. External URLs and data: URIs are not storage refs.`,
     )
   } else if String.startsWith(raw, "//") {
     Error(`protocol-relative refs are not storage refs: ${raw}`)
@@ -94,7 +94,7 @@ The refinement a ref-holding field validates against, carrying no semantic yet.
 The `Uploadable*` types re-label this rather than restating the grammar, so a
 re-labelling cannot validate differently from what it re-labels.
 */
-// The empty string is admitted as the "no object" sentinel. The fields this
+let // The empty string is admitted as the "no object" sentinel. The fields this
 // marks are non-optional today, and a producer with nothing to reference —
 // a supplier feed carrying no image, say — already writes `""` to mean
 // absence. Rejecting it here would break a legitimate existing value and
@@ -107,16 +107,14 @@ re-labelling cannot validate differently from what it re-labels.
 // sury's refiner is a predicate with a fixed message, so the per-value reason
 // `fromString` returns is not threaded through; call `fromString` directly
 // when the caller needs to report which rule the value broke.
-let refinement: S.t<t> =
-  S.string->S.refine(
-    value =>
-      value === "" ||
-        switch fromString(value) {
-        | Ok(_) => true
-        | Error(_) => false
-        },
-    ~error=`expected an origin-relative storage ref: "/" followed by a prefix and an object path, or "" for no object`,
-  )
+refinement: S.t<t> =
+  S.string->S.refine(value =>
+    value === "" ||
+      switch fromString(value) {
+      | Ok(_) => true
+      | Error(_) => false
+      }
+  , ~error=`expected an origin-relative storage ref: "/" followed by a prefix and an object path, or "" for no object`)
 
 /**
 The sury schema for a field holding a ref into a named store.
@@ -139,8 +137,10 @@ let getStore = (schema: S.t<'a>): option<Semantic.storeTarget> =>
 
 /** How many refs one field holds. */
 type arity =
-  | /** A `string` field: one ref. */ Single
-  | /** An `array<string>` field: zero or more refs. */ Multiple
+  /** A `string` field: one ref. */
+  | Single
+  /** An `array<string>` field: zero or more refs. */
+  | Multiple
 
 /**
 The store a *field* declares, looking through an array wrapper, with the arity

package/src/semantic/Template.res

@@ -6,7 +6,6 @@ Grammar: `{{ path }}`, `{{ path | formatter }}`, `{{# if path }}…{{/ if }}` an
 evaluated, an unresolved path renders a visible placeholder rather than throwing,
 and a field the schema marks `@sensitive` is withheld.
 */
-
 /** A path into the payload, in **wire** field names. `text` is what was written,
     so a placeholder can name it. */
 type path = {text: string, relative: bool, segments: array<string>}
@@ -54,8 +53,7 @@ let parsePath = (raw: string, ~insideEach: bool): result<path, string> => {
       segments->Array.every(segment => segmentGrammar->RegExp.test(segment))
         ? Ok({text, relative, segments})
         : Error(
-            `"${text}" is not a path — segments are letters, digits and ` ++
-            `underscores, separated by dots`,
+            `"${text}" is not a path — segments are letters, digits and ` ++ `underscores, separated by dots`,
           )
     }
   }
@@ -268,10 +266,10 @@ let isWithheld = (schema: option<S.t<unknown>>): bool =>
   | None => false
   | Some(field) =>
     Sensitive.isFieldSensitive(field) ||
-      switch Semantic.getFrom(field) {
-      | Some({id}) => Sensitive.impliedBySemantic(id)
-      | None => false
-      }
+    switch Semantic.getFrom(field) {
+    | Some({id}) => Sensitive.impliedBySemantic(id)
+    | None => false
+    }
   }
 
 let parseSafely = (json: JSON.t, schema: S.t<'a>): option<'a> =>

package/src/semantic/UploadableFile.res

@@ -14,7 +14,6 @@ representation, no media-type restriction on what may be uploaded. See
     })
 ```
 */
-
 type t = string
 
 external unsafe: string => t = "%identity"

package/src/semantic/UploadableImage.res

@@ -31,7 +31,6 @@ does, and only because the store is derived from it.
     })
 ```
 */
-
 /** Transparent `string`, for `StorageRef.t`'s reason: the marker refines an
     existing field rather than replacing it, so nothing stored changes. */
 type t = string

package/src/semantic/Url.res

@@ -24,7 +24,6 @@ they actually hold and render correctly on their own.
     })
 ```
 */
-
 /** The address's representation. Transparent `string`; see `Email.t`. */
 type t = string
 
@@ -56,8 +55,9 @@ let fromString = (raw: string): result<t, string> =>
       Ok(value)
     } else {
       Error(
-        `a URL field takes an http:// or https:// address, got ${Semantic.showString(raw)}. ` ++
-        `Use Email or Phone for mailto:/tel:, and a storage ref for an uploaded object.`,
+        `a URL field takes an http:// or https:// address, got ${Semantic.showString(
+            raw,
+          )}. ` ++ `Use Email or Phone for mailto:/tel:, and a storage ref for an uploaded object.`,
       )
     }
   | exception _ =>