@reventlessdev/reventless-spec 3.0.0-alpha.134 → 3.0.0-alpha.135

package/CHANGELOG.md

@@ -3,6 +3,32 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.135 (2026-09-11)
+
+### Bug Fixes
+
+* **spec:** a command that declines to act is not a command that was refused ([0b3d8a4](https://github.com/ReventlessDev/reventless-core/commit/0b3d8a40092ce7ed7801a2aae5d4d7bbed03c179))
+* feat(spec)!: a secret is a capability, so a test can know it in advance ([71507c6](https://github.com/ReventlessDev/reventless-core/commit/71507c6459b49178746f00c5040cb479d7fdade8))
+* feat(spec)!: making a principal is a capability, so the provider is replaceable ([3e59b9b](https://github.com/ReventlessDev/reventless-core/commit/3e59b9b665cc7e4b6b6f156b63b1b6bd0c6181ca))
+### Features
+
+* **aws:** the first administrator is one command, not the console ([5f1a846](https://github.com/ReventlessDev/reventless-core/commit/5f1a84603b21a9feb691a08a148751c6c6e8eca8))
+* **aws:** the rest of the cast is a file, not a comment ([aa23581](https://github.com/ReventlessDev/reventless-core/commit/aa23581f09948a47fb451ec2ecf2fc2bdd8e6ee6))
+* **spec:** preparing a manifest is not an AWS errand ([bd7f8e2](https://github.com/ReventlessDev/reventless-core/commit/bd7f8e2f6132c0cacac2ab839165f21fe91eaf6c))
+
+### BREAKING CHANGES
+
+* Capabilities.t gains a secrets member. A platform that builds
+the record literally no longer compiles until it supplies one;
+Capabilities.none.secrets is the refusing value. Code that spreads
+Capabilities.none is unaffected.
+* Capabilities.t gains an identityProvider member. A platform
+that builds the record literally no longer compiles until it supplies one;
+Capabilities.none.identityProvider is the refusing value to pass while no
+backend exists. Code that spreads Capabilities.none is unaffected.
+
+
+
 # 3.0.0-alpha.134 (2026-09-09)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-spec",
-  "version": "3.0.0-alpha.134",
+  "version": "3.0.0-alpha.135",
   "description": "Specifications for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -9,7 +9,8 @@
     "graft-trait": "./run-graft-trait.mjs",
     "certify-trait": "./run-certify-trait.mjs",
     "trait-manifest": "./run-trait-manifest.mjs",
-    "check-lifecycle": "./run-check-lifecycle.mjs"
+    "check-lifecycle": "./run-check-lifecycle.mjs",
+    "prepare-accounts": "./run-prepare-accounts.mjs"
   },
   "jest": {
     "testMatch": [

package/run-check-lifecycle.mjs

@@ -1,2 +1,3 @@
 #!/usr/bin/env node
-import "./src/lifecycle/CheckLifecycleModel.res.mjs"
+import { main } from "./src/lifecycle/CheckLifecycleModel.res.mjs"
+await main()

package/run-prepare-accounts.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { main } from "./src/types/PrepareAccounts.res.mjs"
+await main()

package/src/components/CapabilityManifest.res

@@ -21,6 +21,9 @@ type kind =
   /** Sending a message, reached through `Capabilities.messaging`. Slice-declared
       like `Geocoding`, and for the same reason carries no `field`. */
   | Messaging
+  /** Making, grouping and unmaking principals, reached through
+      `Capabilities.identityProvider`. Slice-declared, so no `field`. */
+  | IdentityProvider
 
 /** The declaration site: the component's spec name, and — for a store — the field
     carrying the `@storageRef` annotation plus the store exactly as that field
@@ -80,6 +83,7 @@ let fromStructure = (structure: Plugin.pluginStructure): t => {
       kind: switch need {
       | Geocoding => Geocoding
       | Messaging => Messaging
+      | IdentityProvider => IdentityProvider
       },
       key,
       declaredBy: needs->Array.filterMap(

package/src/components/CapabilityManifest.res.mjs

@@ -10,7 +10,8 @@ import * as CapabilityNeed$Reventless from "../semantic/CapabilityNeed.res.mjs";
 let kindSchema = Sury.union([
   Sury.literal("ObjectStore"),
   Sury.literal("Geocoding"),
-  Sury.literal("Messaging")
+  Sury.literal("Messaging"),
+  Sury.literal("IdentityProvider")
 ]);
 
 let provenanceSchema = Sury.$schema(s => ({
@@ -48,7 +49,17 @@ function fromStructure(structure) {
   let capabilityKeys = Belt_SetString.toArray(Belt_SetString.fromArray(needs.map(d => d.capability)));
   let capabilities = Stdlib_Array.filterMap(capabilityKeys, key => Stdlib_Option.map(CapabilityNeed$Reventless.fromString(key), need => {
     let tmp;
-    tmp = need === "Geocoding" ? "Geocoding" : "Messaging";
+    switch (need) {
+      case "Geocoding" :
+        tmp = "Geocoding";
+        break;
+      case "Messaging" :
+        tmp = "Messaging";
+        break;
+      case "IdentityProvider" :
+        tmp = "IdentityProvider";
+        break;
+    }
     return {
       kind: tmp,
       key: key,

package/src/generator/PlatformCodegen.res

@@ -125,6 +125,7 @@ let renderEntry = (entry: unionEntry): result<array<string>, string> =>
   // declared it, with every declaring slice kept as provenance.
   | Geocoding => Ok(renderComments(entry)->Array.concat(["  Geocoding,"]))
   | Messaging => Ok(renderComments(entry)->Array.concat(["  Messaging,"]))
+  | IdentityProvider => Ok(renderComments(entry)->Array.concat(["  IdentityProvider,"]))
   }
 
 /**

package/src/generator/PlatformCodegen.res.mjs

@@ -86,6 +86,11 @@ function renderEntry(entry) {
         TAG: "Ok",
         _0: renderComments(entry).concat(["  Messaging,"])
       };
+    case "IdentityProvider" :
+      return {
+        TAG: "Ok",
+        _0: renderComments(entry).concat(["  IdentityProvider,"])
+      };
   }
 }
 

package/src/lifecycle/CheckLifecycleModel.res

@@ -550,6 +550,18 @@ type derivedCommand = {
       accepted and silent. Kept separately because it is what turns a declared
       state the corpus disagrees with into a contradiction rather than a gap. */
   inertStates: array<string>,
+  /** The strict subset of [inertStates] where the command was *refused* — an
+      error, not an accepted no-op.
+
+      Separate because the two refute different claims. A named from-set says the
+      command **takes effect** from those states, so anything inert there
+      contradicts it. `Unrestricted` says only that the command is **never
+      refused**, which an accepted `Ok([])` agrees with rather than contradicts —
+      returning no events for a command that would change nothing is this
+      codebase's idempotency convention, not evidence the state was illegal.
+      Reading one field for both questions made every idempotent
+      legal-in-every-state command look like a contradiction. */
+  refusedStates: array<string>,
   /** Where the edges land. A relation, not a single value: a command observed
       landing in two states is the signal that the published `targetState` cannot
       carry the model, and that is worth seeing before spending the change. */
@@ -651,6 +663,9 @@ let deriveCommands = (
       inertStates: sortedUnique(
         mine->Array.filterMap(o => o.outcome == Emitted || o.from == noRow ? None : Some(o.from)),
       ),
+      refusedStates: sortedUnique(
+        mine->Array.filterMap(o => o.outcome == Refused && o.from != noRow ? Some(o.from) : None),
+      ),
       targets: sortedUnique(
         effective->Array.filterMap(o => o.to == o.from || o.to == noRow ? None : Some(o.to)),
       ),
@@ -757,14 +772,24 @@ let compare = (
     // effect somewhere agrees with that rather than narrowing it — the corpus
     // covers the states somebody wrote a scenario for, and silence about the
     // rest is not refusal. What DOES refute the claim is a state the command was
-    // exercised in and did nothing: that is the switch and the behaviour
+    // exercised in and **refused**: that is the switch and the behaviour
     // disagreeing about the same row.
+    //
+    // 🚨 **Refused, not merely inert.** `Unrestricted` claims the command is
+    // never refused — it does not claim the command always emits. A state where a
+    // scenario shows it accepted and silent AGREES with that: returning `Ok([])`
+    // for a command that would change nothing is this codebase's idempotency
+    // convention, required because commands arrive at least once. Reading
+    // `inertStates` here marked every such command contradicted, which is the
+    // opposite of what the corpus showed — a verdict redelivered, or landing
+    // after deactivation, is precisely the case the switch declared legal so that
+    // the reporting slice would not retry forever.
     | None if cmd.allowedStatesSource == Some("unrestricted") =>
-      derived.inertStates->Array.forEach(state =>
+      derived.refusedStates->Array.forEach(state =>
         add(
           "contradicted",
           [state],
-          `the switch declares it legal in every state, and a scenario from "${state}" ` ++ `shows it refused or producing nothing`,
+          `the switch declares it legal in every state, and a scenario from "${state}" ` ++ `shows it refused`,
         )
       )
     | None =>
@@ -1378,4 +1403,9 @@ let main = async () => {
   }
 }
 
-let _ = main()
+// 🚨 **No top-level call.** `../../run-check-lifecycle.mjs` invokes [main]; this
+// module only defines it. While the call was here, importing the module *ran the
+// whole check* and then called `NodeProcess.exit`, so nothing in this file could
+// be reached from a test — including [deriveCommands] and [compare], which are
+// pure and are where every verdict is actually decided. That is the same trap
+// `ProvisionIdentity` records having shipped a never-matching guard through.

package/src/lifecycle/CheckLifecycleModel.res.mjs

@@ -469,6 +469,11 @@ function deriveCommands(component, observations, labelled) {
           return o.from;
         }
       })),
+      refusedStates: sortedUnique(Stdlib_Array.filterMap(mine, o => {
+        if (o.outcome === "Refused" && o.from !== noRow) {
+          return o.from;
+        }
+      })),
       targets: sortedUnique(Stdlib_Array.filterMap(effective, o => {
         if (o.to === o.from || o.to === noRow) {
           return;
@@ -531,7 +536,7 @@ function compare(plugin, writable, derived, findings) {
       add("unverified", states, `the switch declares ` + states.length.toString() + ` state(s) and no scenario shows the command taking effect anywhere`);
     }
   } else if (Primitive_object.equal(declared.allowedStatesSource, "unrestricted")) {
-    derived.inertStates.forEach(state => add("contradicted", [state], `the switch declares it legal in every state, and a scenario from "` + state + `" shows it refused or producing nothing`));
+    derived.refusedStates.forEach(state => add("contradicted", [state], `the switch declares it legal in every state, and a scenario from "` + state + `" shows it refused`));
   } else if (derived.allowedStates.length !== 0) {
     add("undeclared", derived.allowedStates, `scenarios show it taking effect from ` + derived.allowedStates.join(", ") + `, and it declares no edge`);
   }
@@ -1086,8 +1091,6 @@ async function main() {
   }
 }
 
-main();
-
 export {
   repoRoot,
   examplesDir,

package/src/semantic/Capabilities.res

@@ -27,6 +27,15 @@ type t = {
   /** Send a message to a person, and say which channels this deployment can
       attempt at all. See `Messaging.provider`. */
   messaging: Messaging.provider,
+  /** Make, group and unmake principals, and say which of those this
+      deployment's provider can do at all. Administrative only — authenticating
+      one is `Auth_Adapter.Provider`'s. See `IdentityProvider.t`. */
+  identityProvider: IdentityProvider.t,
+  /** Unguessable material and a one-way function over it. Injected rather than
+      imported so a test can pin the secret a flow is about to use — a suite
+      cannot assert what a flow does with a value it cannot predict. See
+      `Secrets.t`. */
+  secrets: Secrets.t,
 }
 
 /**
@@ -54,4 +63,12 @@ let none: t = {
     ~recipient as _,
     ~message as _,
   ) => Error(Unavailable("no messaging provider is configured for this platform"))),
+  identityProvider: IdentityProvider.unavailable(
+    ~reason="no identity provider is configured for this platform",
+  ),
+  // Refusing rather than falling back to a weak source. Every runtime has a
+  // cryptographic one, so a platform reaching this arm has skipped wiring rather
+  // than declined to provision — and a guessable token would be accepted
+  // everywhere while looking exactly like a real one.
+  secrets: Secrets.unavailable(~reason="no secret source is configured for this platform"),
 }

package/src/semantic/Capabilities.res.mjs

@@ -1,6 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Secrets$Reventless from "./Secrets.res.mjs";
 import * as Messaging$Reventless from "./Messaging.res.mjs";
+import * as IdentityProvider$Reventless from "./IdentityProvider.res.mjs";
 
 async function none_geocode(param) {
   return {
@@ -20,9 +22,15 @@ let none_messaging = Messaging$Reventless.makeProvider([], [], async (param, par
   }
 }));
 
+let none_identityProvider = IdentityProvider$Reventless.unavailable("no identity provider is configured for this platform");
+
+let none_secrets = Secrets$Reventless.unavailable("no secret source is configured for this platform");
+
 let none = {
   geocode: none_geocode,
-  messaging: none_messaging
+  messaging: none_messaging,
+  identityProvider: none_identityProvider,
+  secrets: none_secrets
 };
 
 export {

package/src/semantic/CapabilityNeed.res

@@ -24,6 +24,16 @@ type t =
         declaration, because a plugin that named `Sms` would fail a deploy it
         could have run on email. */
   | Messaging
+  /** Making, grouping and unmaking principals, reached through
+        `Capabilities.identityProvider`. No payload, for the reason `Geocoding`
+        has none: one identity provider per deployment is a real answer, and a
+        deployment wanting a second pool is the `{alternatives, min}` question
+        `Messaging` already answers by publishing what it provisioned.
+
+        Not authentication. Token issuance and session handling are
+        `Auth_Adapter.Provider`'s, read at a different time — two seams over one
+        provider, the way this type and `Capabilities.t` are already two. */
+  | IdentityProvider
 
 /** The spelling carried in `pluginStructure` and in `capabilities.json`.
     Persisted structures hold strings, not enum members, so a plugin built
@@ -32,6 +42,7 @@ let toString = (need: t): string =>
   switch need {
   | Geocoding => "Geocoding"
   | Messaging => "Messaging"
+  | IdentityProvider => "IdentityProvider"
   }
 
 /** The inverse, for readers of a persisted structure or a committed manifest.
@@ -41,6 +52,7 @@ let fromString = (name: string): option<t> =>
   switch name {
   | "Geocoding" => Some(Geocoding)
   | "Messaging" => Some(Messaging)
+  | "IdentityProvider" => Some(IdentityProvider)
   | _ => None
   }
 

package/src/semantic/CapabilityNeed.res.mjs

@@ -3,10 +3,13 @@
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 
 function toString(need) {
-  if (need === "Geocoding") {
-    return "Geocoding";
-  } else {
-    return "Messaging";
+  switch (need) {
+    case "Geocoding" :
+      return "Geocoding";
+    case "Messaging" :
+      return "Messaging";
+    case "IdentityProvider" :
+      return "IdentityProvider";
   }
 }
 
@@ -14,6 +17,8 @@ function fromString(name) {
   switch (name) {
     case "Geocoding" :
       return "Geocoding";
+    case "IdentityProvider" :
+      return "IdentityProvider";
     case "Messaging" :
       return "Messaging";
     default:

package/src/semantic/IdentityProvider.res

@@ -0,0 +1,127 @@
+/**
+Making, grouping and unmaking principals, so the provider behind them is a
+supplier rather than a call site.
+
+The *administrative* half of identity only. Authentication — token issuance, JWT
+verification, session handling — is `Auth_Adapter.Provider`'s, and stays there:
+the two are read at different times over one provider, exactly as this and
+`CapabilityNeed.t` are.
+
+🚨 **Nothing here is a domain event's business.** `principal` is the provider's
+own handle and must never reach an event log: a log full of one provider's ids
+cannot be migrated to another, which would make the replaceability this
+capability exists for a fiction. What the log holds is the domain's own opaque
+user id; the mapping between the two lives in this capability's store.
+*/
+/** The provider's own handle for a principal. Opaque on purpose — a caller that
+    can read structure out of it is a caller coupled to the provider. */
+type principal = {providerId: string}
+
+/** How a new principal proves it is them. A variant rather than a bare password
+    so a provider offering only federated or passwordless enrolment can refuse
+    the arm it does not implement instead of being handed a secret it will
+    discard. */
+type credential =
+  | Password(string)
+  /** Enrol with no secret held here: the principal sets one through the
+        provider's own flow, or signs in federated. */
+  | NoCredential
+
+/**
+Why an operation did not happen.
+
+Three arms rather than two, and the split is the one geocoding taught: **a
+provider outage is not a verdict.** `Unavailable` must be retried, because a
+caller reaching `createPrincipal` has already recorded that the address was
+proven and the person is entitled to an account. `Refused` is permanent and must
+surface. Collapsing them either loses accounts to a transient blip or retries
+forever against a password policy.
+*/
+type failure =
+  /** The contact is already a principal. A modelled answer, not an exception —
+        which is what a silent idempotent sign-up throws away. */
+  | Conflict
+  /** The provider is down or unreachable. The domain fact stands; retry. */
+  | Unavailable(string)
+  /** Permanently rejected — policy, password rules, a refused attribute. */
+  | Refused(string)
+
+/**
+One thing a provider can be asked to do.
+
+Published rather than fixed, because providers genuinely differ: one bound
+read-only to a corporate directory can create nothing, and one with no group
+model cannot be asked about groups. A caller reads this and degrades, instead of
+discovering the gap as a `Refused` on a live registration.
+
+**`setActiveRole` is deliberately absent.** Narrowing a caller's claims to the
+role they chose happens when a token is *minted* — on Cognito, in a
+pre-token-generation trigger. That is token issuance, which this capability's
+non-goal hands to the auth seam. Admitting it here would grow the surface along
+an axis that has nothing to do with whether the principal store is replaceable,
+which is the one thing this type exists to protect.
+*/
+type operation =
+  | CreatePrincipal
+  | AddToGroup
+  | RemoveFromGroup
+  | DeletePrincipal
+
+let operationToString = (operation: operation): string =>
+  switch operation {
+  | CreatePrincipal => "CreatePrincipal"
+  | AddToGroup => "AddToGroup"
+  | RemoveFromGroup => "RemoveFromGroup"
+  | DeletePrincipal => "DeletePrincipal"
+  }
+
+/**
+The port a caller reaches an identity provider through.
+
+`operations` is the provisioned set this deployment's provider actually
+supports, published rather than inferred. Build one through `make`, so a
+provider cannot claim an operation and omit the function that performs it.
+*/
+type t = {
+  createPrincipal: (
+    ~contact: Messaging.recipient,
+    ~credential: credential,
+    ~groups: array<string>,
+  ) => promise<result<principal, failure>>,
+  addToGroup: (~principal: principal, ~group: string) => promise<result<unit, failure>>,
+  removeFromGroup: (~principal: principal, ~group: string) => promise<result<unit, failure>>,
+  deletePrincipal: (~principal: principal) => promise<result<unit, failure>>,
+  operations: array<operation>,
+}
+
+let make = (~createPrincipal, ~addToGroup, ~removeFromGroup, ~deletePrincipal, ~operations): t => {
+  createPrincipal,
+  addToGroup,
+  removeFromGroup,
+  deletePrincipal,
+  operations,
+}
+
+let supports = (provider: t, ~operation: operation): bool =>
+  provider.operations->Array.includes(operation)
+
+/**
+A provider that performs nothing, answering `Unavailable` on every operation
+with an empty `operations`.
+
+The two say different true things and both are needed. The empty list is what a
+caller reads before offering a flow that cannot complete. The refusal stays
+`Unavailable` rather than `Refused` because a caller that got this far is looking
+at a deployment gap, not at a verdict on the person — and `Refused` would strand
+someone who has already proven their address.
+*/
+let unavailable = (~reason: string): t =>
+  make(
+    ~createPrincipal=async (~contact as _, ~credential as _, ~groups as _) => Error(
+      Unavailable(reason),
+    ),
+    ~addToGroup=async (~principal as _, ~group as _) => Error(Unavailable(reason)),
+    ~removeFromGroup=async (~principal as _, ~group as _) => Error(Unavailable(reason)),
+    ~deletePrincipal=async (~principal as _) => Error(Unavailable(reason)),
+    ~operations=[],
+  )

package/src/semantic/IdentityProvider.res.mjs

@@ -0,0 +1,65 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function operationToString(operation) {
+  switch (operation) {
+    case "CreatePrincipal" :
+      return "CreatePrincipal";
+    case "AddToGroup" :
+      return "AddToGroup";
+    case "RemoveFromGroup" :
+      return "RemoveFromGroup";
+    case "DeletePrincipal" :
+      return "DeletePrincipal";
+  }
+}
+
+function make(createPrincipal, addToGroup, removeFromGroup, deletePrincipal, operations) {
+  return {
+    createPrincipal: createPrincipal,
+    addToGroup: addToGroup,
+    removeFromGroup: removeFromGroup,
+    deletePrincipal: deletePrincipal,
+    operations: operations
+  };
+}
+
+function supports(provider, operation) {
+  return provider.operations.includes(operation);
+}
+
+function unavailable(reason) {
+  return make(async (param, param$1, param$2) => ({
+    TAG: "Error",
+    _0: {
+      TAG: "Unavailable",
+      _0: reason
+    }
+  }), async (param, param$1) => ({
+    TAG: "Error",
+    _0: {
+      TAG: "Unavailable",
+      _0: reason
+    }
+  }), async (param, param$1) => ({
+    TAG: "Error",
+    _0: {
+      TAG: "Unavailable",
+      _0: reason
+    }
+  }), async param => ({
+    TAG: "Error",
+    _0: {
+      TAG: "Unavailable",
+      _0: reason
+    }
+  }), []);
+}
+
+export {
+  operationToString,
+  make,
+  supports,
+  unavailable,
+}
+/* No side effect */

package/src/semantic/Secrets.res

@@ -0,0 +1,76 @@
+/**
+Unguessable material, and a one-way function over it.
+
+Injected rather than imported, and that is the whole point. A runtime global
+would work in production and leave every consumer's *issuance* untestable: a
+suite cannot assert what a flow does with a secret it cannot predict. Handing
+the generator in is what lets a test pin it, exactly as an injected geocoder
+lets a test pin a coordinate.
+
+Not a portability seam like the others — every target runtime has a
+cryptographic source, so this is not a provisioning choice anyone makes. It is
+here because the domain must not reach for one directly, and because a test must
+be able to replace it.
+*/
+/** What a secret is drawn from. Named rather than a charset string so a caller
+    cannot ask for an alphabet nothing checks — and so the two real cases stay
+    distinguishable: one is followed as a link, the other is retyped by a human
+    off a screen. */
+type alphabet =
+  /** `0`–`9`. For a code someone reads and types back. */
+  | Digits
+  /** `A`–`Z`, `a`–`z`, `0`–`9`, `-`, `_`. Survives a URL untouched. */
+  | UrlSafe
+
+/** The one way this fails: nothing here is a verdict about the caller. */
+type failure = Unavailable(string)
+
+/**
+The port a caller reaches a cryptographic source through.
+
+Both members answer `result` rather than a bare string, so a platform that
+provisioned nothing refuses instead of returning something weak. A token is the
+one value where a silent fallback is worse than an error: it would be accepted
+everywhere and guessable by anyone.
+*/
+type t = {
+  /** `length` characters drawn uniformly from `alphabet`. */
+  randomToken: (~length: int, ~alphabet: alphabet) => result<string, failure>,
+  /** One-way, so a challenge can be stored without storing what would answer
+        it. Deterministic: the same input always gives the same digest, which is
+        what lets a presented secret be compared against a held one. */
+  hash: string => result<string, failure>,
+}
+
+/** The characters each alphabet draws from. Exposed so an implementation and a
+    test agree on the set rather than each spelling it. */
+let characters = (alphabet: alphabet): string =>
+  switch alphabet {
+  | Digits => "0123456789"
+  | UrlSafe => "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+  }
+
+/**
+A source that produces nothing, refusing both operations.
+
+Named so a platform passing it is making a statement rather than filling in a
+blank — and refusing rather than degrading, because there is no weaker token
+that would be safe to hand back.
+*/
+let unavailable = (~reason: string): t => {
+  randomToken: (~length as _, ~alphabet as _) => Error(Unavailable(reason)),
+  hash: _ => Error(Unavailable(reason)),
+}
+
+/**
+A source that returns what it was given, for a test that needs to know the
+secret it is about to present.
+
+Here rather than in each suite because a consumer testing issuance needs exactly
+this and should not be inventing it — and because a fixed generator written per
+suite is one that eventually differs from the real one's alphabet.
+*/
+let fixed = (~token: string, ~hash as hashOf: string => string): t => {
+  randomToken: (~length as _, ~alphabet as _) => Ok(token),
+  hash: input => Ok(hashOf(input)),
+}

package/src/semantic/Secrets.res.mjs

@@ -0,0 +1,49 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function characters(alphabet) {
+  if (alphabet === "Digits") {
+    return "0123456789";
+  } else {
+    return "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  }
+}
+
+function unavailable(reason) {
+  return {
+    randomToken: (param, param$1) => ({
+      TAG: "Error",
+      _0: {
+        TAG: "Unavailable",
+        _0: reason
+      }
+    }),
+    hash: param => ({
+      TAG: "Error",
+      _0: {
+        TAG: "Unavailable",
+        _0: reason
+      }
+    })
+  };
+}
+
+function fixed(token, hashOf) {
+  return {
+    randomToken: (param, param$1) => ({
+      TAG: "Ok",
+      _0: token
+    }),
+    hash: input => ({
+      TAG: "Ok",
+      _0: hashOf(input)
+    })
+  };
+}
+
+export {
+  characters,
+  unavailable,
+  fixed,
+}
+/* No side effect */