@reventlessdev/reventless-spec 3.0.0-alpha.139 → 3.0.0-alpha.141

package/CHANGELOG.md

@@ -3,6 +3,30 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.141 (2026-09-21)
+
+### Bug Fixes
+
+* **deps:** update rescript to 12.3.1 ([ea1ce37](https://github.com/ReventlessDev/reventless-core/commit/ea1ce377297640f6d0d360e6c84c778d59ecbcc5))
+* **deps:** update sury to 11.0.0 ([8715b22](https://github.com/ReventlessDev/reventless-core/commit/8715b22b33856c46ba57518aad151065c123a995))
+
+
+# 3.0.0-alpha.140 (2026-09-21)
+
+* feat(spec)!: typed projection keys ([fc6a018](https://github.com/ReventlessDev/reventless-core/commit/fc6a01811ba788f3289e84a435a09f77fa627e1a))
+### Features
+
+* **core:** references derived from identities, and identity checks ([7cb1376](https://github.com/ReventlessDev/reventless-core/commit/7cb1376e56cdb4e4d5ab5954cd97fd37fd3ba258))
+
+### BREAKING CHANGES
+
+* a projection that keys a row by a payload `string`, or uses
+the envelope id as a `string`, converts explicitly with
+`Target.Id.makeFromString` / `Source.Id.toString`. `StateChangeSlice.Spec` no
+longer requires `module Id`.
+
+
+
 # 3.0.0-alpha.139 (2026-09-21)
 
 ### Features

package/README.md

@@ -96,7 +96,7 @@ Then register it as a ReScript dependency in `rescript.json`:
 }
 ```
 
-Requires ReScript `^12.3.0` (peer dependency).
+Requires ReScript `^12.3.1` (peer dependency).
 
 ## Links
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-spec",
-  "version": "3.0.0-alpha.139",
+  "version": "3.0.0-alpha.141",
   "description": "Specifications for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -23,17 +23,17 @@
   },
   "dependencies": {
     "jsonschema2graphql": "1.1.1",
-    "sury": "11.0.0-rc.2",
-    "sury-ppx": "11.0.0-rc.2",
+    "sury": "11.0.0",
+    "sury-ppx": "11.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.12"
+    "@reventlessdev/rescript-node": "2.0.0-alpha.13"
   },
   "devDependencies": {
-    "rescript": "12.3.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10"
+    "rescript": "12.3.1",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.11"
   },
   "peerDependencies": {
-    "rescript": "12.3.0"
+    "rescript": "^12.3.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"

package/src/components/DcbTag.res.mjs

@@ -54,7 +54,7 @@ function stringForKey(key) {
   return markForKey(Sury.string, key);
 }
 
-let int = Sury.$Metadata_set(Sury.int, dcbTagId, true);
+let int = Sury.$Metadata_set(Sury.int32, dcbTagId, true);
 
 let partition = markPartition(Sury.string);
 
@@ -88,7 +88,7 @@ let derivedPartitionTagSchema = Sury.union([
   })),
   Sury.$schema(s => ({
     TAG: "ByEventType",
-    _0: s.m(Sury.dict(Sury.string))
+    _0: s.m(Sury.record(Sury.string))
   }))
 ]);
 

package/src/components/IdentityCheck.res

@@ -0,0 +1,110 @@
+/**
+Where a plugin's ids and their types disagree. Needs the whole plugin, not one
+file: whether `orderId` names an identity depends on whether any field is typed
+`OrderId.t`, which is also what makes adoption opt-in per plugin — a plugin that
+types nothing is never reported.
+
+- **A field named for one identity and typed as another** (`orderId: CustomerId.t`):
+  the mix-up the types exist to catch. A role name that is no identity of its own
+  (`sellerId: CustomerId.t`) is fine.
+- **An untyped `*Id` whose key has an identity** (`productId: string` beside a
+  `ProductId.t`): the half-migrated state, where the compiler guards some uses and
+  not others.
+*/
+type finding = {sliceName: string, message: string}
+
+// The identity key a `*Id` / `*Ids` name gives by convention.
+let nameKey = (name: string): option<string> =>
+  if name->String.endsWith("Ids") {
+    Some(name->String.slice(~start=0, ~end=name->String.length - 1))
+  } else if name->String.length > 2 && name->String.endsWith("Id") {
+    Some(name)
+  } else {
+    None
+  }
+
+let fieldsOf = (schema: S.t<unknown>): array<(string, S.t<unknown>)> => {
+  let ofObject = (v: S.t<unknown>) =>
+    switch v {
+    | Object({properties}) => properties->Dict.toArray->Array.filter(((n, _)) => n != "TAG")
+    | _ => []
+    }
+  switch schema {
+  | AnyOf({anyOf}) => anyOf->Array.flatMap(ofObject)
+  | other => ofObject(other)
+  }
+}
+
+let slicesFields = (slice: DcbTag.sliceSchemas) =>
+  [slice.commandSchema, slice.consumedEventSchema, slice.eventSchema]->Array.flatMap(fieldsOf)
+
+let check = (slices: array<DcbTag.sliceSchemas>): array<finding> => {
+  let declared: Set.t<string> = Set.make()
+  slices->Array.forEach(slice =>
+    slice
+    ->slicesFields
+    ->Array.forEach(((_, schema)) =>
+      Semantic.fieldIdentityKey(schema)->Option.forEach(k => declared->Set.add(k))
+    )
+  )
+  let seen: Set.t<string> = Set.make()
+  let findings = []
+  slices->Array.forEach(slice =>
+    slice
+    ->slicesFields
+    ->Array.forEach(((name, schema)) => {
+      let message = switch (Semantic.fieldIdentityKey(schema), nameKey(name)) {
+      | (Some(key), Some(named)) if named != key && declared->Set.has(named) =>
+        Some(
+          `${name} is typed as a ${key}, but ${named} is an identity of its own in this plugin. Type it as ${named}'s identity, or rename the field.`,
+        )
+      | (None, Some(named)) if declared->Set.has(named) =>
+        Some(
+          `${name} is a plain string, but ${named} has an identity in this plugin. Type the field with it, so the compiler guards every use.`,
+        )
+      | _ => None
+      }
+      message->Option.forEach(
+        message => {
+          let id = slice.name ++ "\n" ++ message
+          if !(seen->Set.has(id)) {
+            seen->Set.add(id)
+            findings->Array.push({sliceName: slice.name, message})
+          }
+        },
+      )
+    })
+  )
+  findings
+}
+
+/**
+A slice partitioned by an identity another chapter declares: `categoryId`
+partitioning a slice under `Product/`. The chapter is the default home of the
+identity its slices decide about, so the two disagreeing usually means the slice
+or the identity is in the wrong folder. `identityChapters` maps a key to the
+chapter whose folder declares it; an identity declared in another package has
+none and is not checked.
+*/
+let checkChapters = (
+  ~identityChapters: dict<string>,
+  ~partitionBySlice: dict<string>,
+  slices: array<DcbTag.sliceSchemas>,
+): array<finding> =>
+  slices->Array.filterMap(slice =>
+    switch (
+      partitionBySlice->Dict.get(slice.name),
+      slice.moduleUrl->Option.flatMap(DcbTag.chapterOfModuleUrl),
+    ) {
+    | (Some(key), Some(chapter)) =>
+      switch identityChapters->Dict.get(key) {
+      | Some(home) if home != chapter =>
+        Some({
+          sliceName: slice.name,
+          message: `is partitioned by ${key}, which ${home}/ declares, but sits in ${chapter}/. Move the slice or the identity so they share a chapter.`,
+        })
+      | _ => None
+      }
+    | _ => None
+    }
+  )

package/src/components/IdentityCheck.res.mjs

@@ -0,0 +1,103 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as DcbTag$Reventless from "./DcbTag.res.mjs";
+import * as Semantic$Reventless from "../semantic/Semantic.res.mjs";
+
+function nameKey(name) {
+  if (name.endsWith("Ids")) {
+    return name.slice(0, name.length - 1 | 0);
+  } else if (name.length > 2 && name.endsWith("Id")) {
+    return name;
+  } else {
+    return;
+  }
+}
+
+function fieldsOf(schema) {
+  let ofObject = v => {
+    if (v.type === "object") {
+      return Object.entries(v.properties).filter(param => param[0] !== "TAG");
+    } else {
+      return [];
+    }
+  };
+  if (schema.type === "anyOf") {
+    return schema.anyOf.flatMap(ofObject);
+  } else {
+    return ofObject(schema);
+  }
+}
+
+function slicesFields(slice) {
+  return [
+    slice.commandSchema,
+    slice.consumedEventSchema,
+    slice.eventSchema
+  ].flatMap(fieldsOf);
+}
+
+function check(slices) {
+  let declared = new Set();
+  slices.forEach(slice => {
+    slicesFields(slice).forEach(param => Stdlib_Option.forEach(Semantic$Reventless.fieldIdentityKey(param[1]), k => {
+      declared.add(k);
+    }));
+  });
+  let seen = new Set();
+  let findings = [];
+  slices.forEach(slice => {
+    slicesFields(slice).forEach(param => {
+      let name = param[0];
+      let match = Semantic$Reventless.fieldIdentityKey(param[1]);
+      let match$1 = nameKey(name);
+      let message = match !== undefined ? (
+          match$1 !== undefined && match$1 !== match && declared.has(match$1) ? name + ` is typed as a ` + match + `, but ` + match$1 + ` is an identity of its own in this plugin. Type it as ` + match$1 + `'s identity, or rename the field.` : undefined
+        ) : (
+          match$1 !== undefined && declared.has(match$1) ? name + ` is a plain string, but ` + match$1 + ` has an identity in this plugin. Type the field with it, so the compiler guards every use.` : undefined
+        );
+      Stdlib_Option.forEach(message, message => {
+        let id = slice.name + "\n" + message;
+        if (!seen.has(id)) {
+          seen.add(id);
+          findings.push({
+            sliceName: slice.name,
+            message: message
+          });
+          return;
+        }
+      });
+    });
+  });
+  return findings;
+}
+
+function checkChapters(identityChapters, partitionBySlice, slices) {
+  return Stdlib_Array.filterMap(slices, slice => {
+    let match = partitionBySlice[slice.name];
+    let match$1 = Stdlib_Option.flatMap(slice.moduleUrl, DcbTag$Reventless.chapterOfModuleUrl);
+    if (match === undefined) {
+      return;
+    }
+    if (match$1 === undefined) {
+      return;
+    }
+    let home = identityChapters[match];
+    if (home !== undefined && home !== match$1) {
+      return {
+        sliceName: slice.name,
+        message: `is partitioned by ` + match + `, which ` + home + `/ declares, but sits in ` + match$1 + `/. Move the slice or the identity so they share a chapter.`
+      };
+    }
+  });
+}
+
+export {
+  nameKey,
+  fieldsOf,
+  slicesFields,
+  check,
+  checkChapters,
+}
+/* DcbTag-Reventless Not a pure module */

package/src/components/Plugin.res.mjs

@@ -61,7 +61,7 @@ let menuEntrySchema = Sury.$schema(s => ({
   label: s.m(Sury.string),
   icon: s.m(Sury.$option(Sury.string)),
   group: s.m(Sury.$option(Sury.string)),
-  sortOrder: s.m(Sury.int)
+  sortOrder: s.m(Sury.int32)
 }));
 
 let pageManifestEntrySchema = Sury.$schema(s => ({
@@ -100,7 +100,7 @@ let commandDefSchema = Sury.$schema(s => ({
   allowedStates: s.m(Sury.$option(Sury.array(Sury.string))),
   targetState: s.m(Sury.$option(Sury.string)),
   allowedStatesSource: s.m(Sury.$option(Sury.string)),
-  apiExposed: s.m(Sury.$option(Sury.bool)),
+  apiExposed: s.m(Sury.$option(Sury.boolean)),
   requiredAccess: s.m(Sury.$option(Sury.array(Sury.string))),
   ownerField: s.m(Sury.$option(Sury.string))
 }));
@@ -118,7 +118,7 @@ let queryableDefSchema = Sury.$schema(s => ({
   ownerField: s.m(Sury.$option(Sury.string)),
   retiredField: s.m(Sury.$option(Sury.string)),
   retiredValues: s.m(Sury.$option(Sury.array(Sury.string))),
-  namedWhenRetired: s.m(Sury.$option(Sury.bool)),
+  namedWhenRetired: s.m(Sury.$option(Sury.boolean)),
   visibility: s.m(Sury.$option(Sury.string)),
   chapter: s.m(Sury.$option(Sury.string)),
   singleQueryField: s.m(Sury.$option(Sury.string)),

package/src/components/StateChangeSlice.res

@@ -42,17 +42,15 @@ let decide = (state, command) => switch command {
 ```
 */
 /**
-The lean Spec for a StateChangeSlice — types, identity, schemas. State and
-state-evolution functions live in the sibling `Behavior` module type.
+The lean Spec for a StateChangeSlice — types and schemas. State and
+state-evolution functions live in the sibling `Behavior` module type. A slice has
+no identity of its own: it decides about the one its partition field carries.
 */
 module type Spec = {
   /** Logical name of this slice (used as a command topic prefix). */
   let name: string
   let moduleUrl: string
 
-  /** Identity type — always `Id.String` for DCB slices. */
-  module Id: Id.T
-
   /**
   Events this slice reads to build its decision model (in `evolve`).
   Only needs the fields required for the decision — no tag annotations needed.

package/src/components/StateViewSlice.res

@@ -51,6 +51,14 @@ module type Spec = {
   /** Sury schema for the state type — generated automatically by `@schema`. */
   let stateSchema: S.t<state>
 
+  /**
+  What a row is keyed by. `Id.StringPure` (a plain `string`) unless the view
+  declares its identity — `module Key = OrderId` — in which case a projection
+  that keys a row by another entity's id does not compile. Auto-injected by
+  `@@reventless.spec` in a `StateView/` folder.
+  */
+  module Key: Id.T
+
   /**
   Events this view slice projects. Only needs the fields required for the projection —
   no tag annotations needed. May be payload-less where only existence matters.
@@ -114,7 +122,7 @@ module type Projection = {
   Receives the event wrapped in a `consumed` envelope (event + `meta` +
   `recordedAt`); only events declared in `Spec.consumedEvent` — no wildcard needed.
   */
-  let project: consumed<Spec.consumedEvent> => array<Projection.action<string, Spec.state>>
+  let project: consumed<Spec.consumedEvent> => array<Projection.action<Spec.Key.t, Spec.state>>
 
   /** File URL of this Projection module (`import.meta.url`). */
   let moduleUrl: string

package/src/components/TraitCertificate.res.mjs

@@ -5,7 +5,7 @@ import * as Util_Sury$Reventless from "../util/Util_Sury.res.mjs";
 
 let assertionSchema = Sury.$schema(s => ({
   name: s.m(Sury.string),
-  passed: s.m(Sury.bool)
+  passed: s.m(Sury.boolean)
 }));
 
 let schema = Sury.$schema(s => ({
@@ -15,8 +15,8 @@ let schema = Sury.$schema(s => ({
   host: s.m(Sury.string),
   suite: s.m(Sury.string),
   assertions: s.m(Sury.array(assertionSchema)),
-  passed: s.m(Sury.int),
-  failed: s.m(Sury.int)
+  passed: s.m(Sury.int32),
+  failed: s.m(Sury.int32)
 }));
 
 function verified(certificate) {

package/src/components/TraitManifest.res.mjs

@@ -6,7 +6,7 @@ import * as Util_Sury$Reventless from "../util/Util_Sury.res.mjs";
 
 let configFieldSchema = Sury.$schema(s => ({
   name: s.m(Sury.string),
-  required: s.m(Sury.bool)
+  required: s.m(Sury.boolean)
 }));
 
 let schema = Sury.$schema(s => ({
@@ -16,7 +16,7 @@ let schema = Sury.$schema(s => ({
   license: s.m(Sury.string),
   capabilities: s.m(Sury.array(Sury.string)),
   config: s.m(Sury.array(configFieldSchema)),
-  scaffolded: s.m(Sury.bool)
+  scaffolded: s.m(Sury.boolean)
 }));
 
 function render(manifest) {

package/src/generator/PlatformGenerator.res.mjs

@@ -1,6 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
+import * as Sury from "sury";
 import * as Yaml from "yaml";
 import * as Nodefs from "node:fs";
 import * as Nodepath from "node:path";
@@ -73,7 +73,7 @@ if (manifestArg === "") {
             console.log(`Read: ` + pluginName + ` — ` + path + ` (via ` + PlatformManifests$Reventless.describeVia(param.via) + `)`);
             let manifest;
             try {
-              manifest = S.parseOrThrow(JSON.parse(Nodefs.readFileSync(path, "utf8")), CapabilityManifest$Reventless.schema);
+              manifest = Sury.parseOrThrow(JSON.parse(Nodefs.readFileSync(path, "utf8")), CapabilityManifest$Reventless.schema);
             } catch (exn) {
               fail(`could not parse ` + path + ` as a capability manifest`);
               manifest = {

package/src/semantic/Bytes.res.mjs

@@ -29,7 +29,7 @@ function fromFloat(raw) {
   }
 }
 
-let schema = Semantic$Reventless.refined(Sury.float, Semantic$Reventless.Id.bytes, fromFloat);
+let schema = Semantic$Reventless.refined(Sury.number, Semantic$Reventless.Id.bytes, fromFloat);
 
 let units = [
   "B",

package/src/semantic/CalendarDate.res

@@ -40,7 +40,7 @@ external toString: t => string = "%identity"
 
 // Sury's rule, held once. `fromString` runs it rather than restating it, and
 // `schema` is built from `fromString`, so there is exactly one grammar here.
-let grammar: S.t<string> = S.isoDate
+let grammar: S.t<string> = (S.isoDate :> S.t<string>)
 
 /** Validate a raw string as an ISO-8601 calendar day, saying why when it is not one. */
 let fromString = (raw: string): result<t, string> =>

package/src/semantic/CalendarDate.res.mjs

@@ -1,6 +1,5 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
 import * as Sury from "sury";
 import * as Semantic$Reventless from "./Semantic.res.mjs";
 
@@ -9,7 +8,7 @@ let grammar = Sury.isoDate;
 function fromString(raw) {
   let value;
   try {
-    value = S.parseOrThrow(raw, grammar);
+    value = Sury.parseOrThrow(raw, grammar);
   } catch (exn) {
     return {
       TAG: "Error",

package/src/semantic/DateTime.res

@@ -3,14 +3,14 @@ Marks a `string` field as an ISO-8601 instant.
 
 ## The grammar
 
-Sury's `S.isoDateTime`, and nothing added — the same rule the branded scalars
+Sury's `S.utcDateTime`, and nothing added — the same rule the branded scalars
 follow. `S.datetime` is the other binding and is not this one: it *transforms* to
 `Js.Date.t`, changing the field's runtime type, where this keeps the string the
 projection wrote.
 
 ## UTC only
 
-`S.isoDateTime` accepts a `Z` instant and rejects an offset — `2026-03-02T09:00:00+01:00`
+`S.utcDateTime` accepts a `Z` instant and rejects an offset — `2026-03-02T09:00:00+01:00`
 and a bare `2026-03-02T09:00:00` both fail. That is stricter than RFC 3339 and it
 is the strictness worth adopting: every instant the framework produces comes from
 `Message.nowAsISOString`, which is always `Z`. "Instants are stored in UTC" is a
@@ -48,7 +48,7 @@ external toString: t => string = "%identity"
 
 // Sury's rule, held once. `fromString` runs it rather than restating it, and
 // `schema` is built from `fromString`, so there is exactly one grammar here.
-let grammar: S.t<string> = S.isoDateTime
+let grammar: S.t<string> = (S.utcDateTime :> S.t<string>)
 
 /** Validate a raw string as a UTC ISO-8601 instant, saying why when it is not one. */
 let fromString = (raw: string): result<t, string> =>

package/src/semantic/DateTime.res.mjs

@@ -1,16 +1,15 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
 import * as Sury from "sury";
 import * as Primitive_float from "@rescript/runtime/lib/es6/Primitive_float.js";
 import * as Semantic$Reventless from "./Semantic.res.mjs";
 
-let grammar = Sury.isoDateTime;
+let grammar = Sury.utcDateTime;
 
 function fromString(raw) {
   let value;
   try {
-    value = S.parseOrThrow(raw, grammar);
+    value = Sury.parseOrThrow(raw, grammar);
   } catch (exn) {
     return {
       TAG: "Error",

package/src/semantic/Duration.res.mjs

@@ -18,7 +18,7 @@ function fromInt(raw) {
   }
 }
 
-let schema = Semantic$Reventless.refined(Sury.int, Semantic$Reventless.Id.duration, fromInt);
+let schema = Semantic$Reventless.refined(Sury.int32, Semantic$Reventless.Id.duration, fromInt);
 
 let scales = [
   [

package/src/semantic/Email.res

@@ -37,7 +37,7 @@ external toString: t => string = "%identity"
 
 // Sury's check, held once. `fromString` runs it rather than restating it, and
 // `schema` is built from `fromString`, so there is exactly one grammar here.
-let grammar: S.t<string> = S.email
+let grammar: S.t<string> = (S.email :> S.t<string>)
 
 /** Validate a raw string as an email address, saying why when it is not one. */
 let fromString = (raw: string): result<t, string> =>

package/src/semantic/Email.res.mjs

@@ -1,6 +1,5 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
 import * as Sury from "sury";
 import * as Semantic$Reventless from "./Semantic.res.mjs";
 
@@ -9,7 +8,7 @@ let grammar = Sury.email;
 function fromString(raw) {
   let value;
   try {
-    value = S.parseOrThrow(raw, grammar);
+    value = Sury.parseOrThrow(raw, grammar);
   } catch (exn) {
     return {
       TAG: "Error",

package/src/semantic/GeoPoint.res.mjs

@@ -48,12 +48,12 @@ function validateLng(raw) {
   }
 }
 
-let latSchema = S.refine(Sury.float, raw => {
+let latSchema = S.refine(Sury.number, raw => {
   let match = validateLat(raw);
   return match.TAG === "Ok";
 }, "expected a latitude in -90…90", undefined);
 
-let lngSchema = S.refine(Sury.float, raw => {
+let lngSchema = S.refine(Sury.number, raw => {
   let match = validateLng(raw);
   return match.TAG === "Ok";
 }, "expected a longitude in -180…180", undefined);

package/src/semantic/Money.res

@@ -91,7 +91,7 @@ let validateAmount = (amount: float): result<float, string> =>
     The check sits on the field rather than on the pair because wholeness is a
     property of the amount: it does not need the currency, and a rule placed
     where it needs nothing else is a rule that cannot be read wrong. (A
-    record-level refinement is available — sury 11.0.0-rc.2 compiles one
+    record-level refinement is available — sury 11 compiles one
     correctly, where 11-alpha hoisted the result object above the field reads and
     threw `Cannot access 'v0' before initialization` — it is simply not what this
     check wants.) */

package/src/semantic/Money.res.mjs

@@ -28,7 +28,7 @@ function validateAmount(amount) {
   }
 }
 
-let amountSchema = S.refine(Sury.float, amount => {
+let amountSchema = S.refine(Sury.number, amount => {
   let match = validateAmount(amount);
   return match.TAG === "Ok";
 }, "expected a monetary amount", undefined);

package/src/semantic/Offload.res.mjs

@@ -10,7 +10,7 @@ let offloadedRefSchema = Sury.$schema(s => ({
   store: s.m(Sury.string),
   key: s.m(Sury.string),
   hash: s.m(Sury.string),
-  bytes: s.m(Sury.int)
+  bytes: s.m(Sury.int32)
 }));
 
 let sentinelKey = "$offload";

package/src/semantic/Percent.res.mjs

@@ -24,7 +24,7 @@ function fromFloat(raw) {
   }
 }
 
-let schema = Semantic$Reventless.refined(Sury.float, Semantic$Reventless.Id.percent, fromFloat);
+let schema = Semantic$Reventless.refined(Sury.number, Semantic$Reventless.Id.percent, fromFloat);
 
 function format(p) {
   return p.toString() + "%";

package/src/semantic/Semantic.res

@@ -258,6 +258,17 @@ let identityKey = (fieldSchema: S.t<'a>): option<string> =>
   | _ => None
   }
 
+/** The identity a field names, on its own value or on an array's elements. */
+let rec fieldIdentityKey = (fieldSchema: S.t<unknown>): option<string> =>
+  switch identityKey(fieldSchema) {
+  | Some(_) as found => found
+  | None =>
+    switch fieldSchema->unwrapOptional->Option.getOr(fieldSchema) {
+    | Array({additionalItems: Schema(item)}) => fieldIdentityKey(item)
+    | _ => None
+    }
+  }
+
 /** Whether a field's schema carries this specific semantic. */
 let has = (fieldSchema: S.t<'a>, ~id: string): bool =>
   switch get(fieldSchema) {

package/src/semantic/Semantic.res.mjs

@@ -225,6 +225,26 @@ function identityKey(fieldSchema) {
   }
 }
 
+function fieldIdentityKey(_fieldSchema) {
+  while (true) {
+    let fieldSchema = _fieldSchema;
+    let found = identityKey(fieldSchema);
+    if (found !== undefined) {
+      return found;
+    }
+    let match = Stdlib_Option.getOr(unwrapOptional(fieldSchema), fieldSchema);
+    if (match.type !== "array") {
+      return;
+    }
+    let item = match.additionalItems;
+    if (item === "strip" || item === "strict") {
+      return;
+    }
+    _fieldSchema = item;
+    continue;
+  };
+}
+
 function has(fieldSchema, id) {
   let s = getFrom(fieldSchema);
   if (s !== undefined) {
@@ -246,6 +266,7 @@ export {
   getFrom,
   get,
   identityKey,
+  fieldIdentityKey,
   has,
 }
 /* semanticId Not a pure module */

package/src/semantic/Template.res.mjs

@@ -1,6 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
+import * as Sury from "sury";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
@@ -347,7 +347,7 @@ function isWithheld(schema) {
 
 function parseSafely(json, schema) {
   try {
-    return Primitive_option.some(S.parseOrThrow(json, schema));
+    return Primitive_option.some(Sury.parseOrThrow(json, schema));
   } catch (exn) {
     return;
   }
@@ -542,4 +542,4 @@ export {
   renderSource,
   variantSchema,
 }
-/* S Not a pure module */
+/* sury Not a pure module */

package/src/semantic/Url.res

@@ -38,7 +38,7 @@ external toString: t => string = "%identity"
 // to an append-only log, so the address has to survive the round trip as the
 // caller wrote it. `S.uri` is the string-preserving arm — it still rejects what
 // does not parse, and returns exactly what it was given.
-let grammar: S.t<string> = S.uri
+let grammar: S.t<string> = (S.uri :> S.t<string>)
 
 // Schemes are case-insensitive per RFC 3986, and `HTTPS://x` parses fine, so the
 // allowlist has to fold case or it rejects a valid address on a technicality.

package/src/semantic/Url.res.mjs

@@ -1,6 +1,5 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
 import * as Sury from "sury";
 import * as Semantic$Reventless from "./Semantic.res.mjs";
 
@@ -18,7 +17,7 @@ function hasWebScheme(raw) {
 function fromString(raw) {
   let value;
   try {
-    value = S.parseOrThrow(raw, grammar);
+    value = Sury.parseOrThrow(raw, grammar);
   } catch (exn) {
     return {
       TAG: "Error",

package/src/types/AccountsManifest.res.mjs

@@ -1,6 +1,5 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
 import * as Sury from "sury";
 import * as Yaml from "yaml";
 import * as Nodefs from "node:fs";
@@ -25,7 +24,7 @@ function parseString(yamlText) {
   try {
     return {
       TAG: "Ok",
-      _0: S.parseOrThrow(Yaml.parse(yamlText), entriesSchema)
+      _0: Sury.parseOrThrow(Yaml.parse(yamlText), entriesSchema)
     };
   } catch (raw_err) {
     let err = Primitive_exceptions.internalToException(raw_err);

package/src/types/Identity.res.mjs

@@ -15,7 +15,7 @@ let schema = Sury.$schema(s => ({
   userId: s.m(Sury.string),
   username: s.m(Sury.string),
   groups: s.m(Sury.array(Sury.string)),
-  claims: s.m(Sury.$option(Sury.dict(Sury.string))),
+  claims: s.m(Sury.$option(Sury.record(Sury.string))),
   provider: s.m(providerSchema)
 }));
 

package/src/types/Lifecycle.res.mjs

@@ -62,7 +62,7 @@ function entrySchema(_stateSchema) {
   return Sury.$schema(s => ({
     state: s.m(_stateSchema),
     at: s.m(DateTime$Reventless.schema),
-    afterGap: s.m(Sury.$option(Sury.bool))
+    afterGap: s.m(Sury.$option(Sury.boolean))
   }));
 }
 

package/src/types/Message.res.mjs

@@ -16,7 +16,7 @@ let metaSchema = Sury.$schema(s => ({
   causationId: s.m(Sury.$option(Sury.string)),
   traceparent: s.m(Sury.$option(Sury.string)),
   schemaVersion: s.m(Sury.$option(Sury.string)),
-  headers: s.m(Sury.$option(Sury.dict(Sury.string)))
+  headers: s.m(Sury.$option(Sury.record(Sury.string)))
 }));
 
 let contextSchema = Sury.$schema(s => ({
@@ -33,7 +33,7 @@ let commandJsonSchema = Sury.$schema(s => ({
   id: s.m(Sury.string),
   meta: s.m(metaSchema),
   commandJson: s.m(Sury.json),
-  delay: s.m(Sury.$option(Sury.int))
+  delay: s.m(Sury.$option(Sury.int32))
 }));
 
 let fillMissingDefaults = (function(schema, json, scalarFills){

package/src/types/Projection.res

@@ -79,23 +79,60 @@ type action<'id, 'state> =
   /** No-op. Return this when an event should not affect the read model. */
   | Ignore
 
+/**
+The same action keyed by another representation of its ids. `to_` converts the
+ids the action carries; `from` converts back the ids its callbacks receive. The
+storage edge uses it to turn a typed row key into the string a table is keyed by.
+*/
+let mapActionId = (action: action<'a, 's>, ~to_: 'a => 'b, ~from: 'b => 'a): action<'b, 's> =>
+  switch action {
+  | Create(id, state) => Create(to_(id), state)
+  | CreateMany(rows) => CreateMany(rows->Array.map(((id, state)) => (to_(id), state)))
+  | Update(id, f) => Update(to_(id), f)
+  | UpdateMany(ids, f) => UpdateMany(ids->Array.map(to_), (id, state) => f(from(id), state))
+  | UpdateWithDefault(id, default, f) => UpdateWithDefault(to_(id), default, f)
+  | UpdateManyWithDefault(ids, default, f) =>
+    UpdateManyWithDefault(
+      ids->Array.map(to_),
+      id => default(from(id)),
+      (id, state) => f(from(id), state),
+    )
+  | Set(id, state) => Set(to_(id), state)
+  | SetMany(ids, f) => SetMany(ids->Array.map(to_), id => f(from(id)))
+  | Delete(id) => Delete(to_(id))
+  | DeleteMany(ids) => DeleteMany(ids->Array.map(to_))
+  | DeleteIf(id, p) => DeleteIf(to_(id), p)
+  | DeleteManyIf(ids, p) => DeleteManyIf(ids->Array.map(to_), (id, state) => p(from(id), state))
+  | CreateMultiState(id, states) => CreateMultiState(to_(id), states)
+  | UpdateMultiState(id, f) => UpdateMultiState(to_(id), f)
+  | UpdateManyMultiStates(ids, f) =>
+    UpdateManyMultiStates(ids->Array.map(to_), (id, states) => f(from(id), states))
+  | Ignore => Ignore
+  }
+
 /**
 A compiled single-source-to-single-target mapping.
 
 Created by `Projection.Mapping.Make(Source, Target, MappingImpl)`.
 The `project` function receives a full `Message.event'` envelope and returns
-one `action` value.
+one `action` value. Both ends are typed: the envelope id is the source's `Id.t`
+and the row key the target's, so a projection that keys a view by another
+entity's id does not compile. A mapping between different ids converts
+explicitly (`Target.Id.makeFromString`), which marks the seam.
 */
 module type Mapping = {
   //module Source: Source
   //module Target: Target // NOTE: to be destructive substituted
   module SourceId: Id.T
+  type targetId
   @schema
   type sourceEvent
   @schema
   type targetState
 
-  let project: Message.event'<string, sourceEvent> => action<string, targetState>
+  let project: Message.event'<SourceId.t, sourceEvent> => action<targetId, targetState>
+  let targetIdToString: targetId => string
+  let targetIdFromString: string => targetId
   let sourceEventSchema: S.t<sourceEvent>
   let sourceName: string
   let subIdConfig: option<ReadModel.subIdConfig<targetState>>
@@ -116,9 +153,11 @@ module type Mappings = {
 }
 
 module type MappingImpl = {
+  type sourceId
+  type targetId
   type sourceEvent
   type targetState
-  let project: Message.event'<string, sourceEvent> => action<string, targetState>
+  let project: Message.event'<sourceId, sourceEvent> => action<targetId, targetState>
 }
 
 /**
@@ -147,7 +186,9 @@ module Mapping = {
     Target: Target,
     MappingImpl: MappingImpl
       with type sourceEvent := Source.event
-      and type targetState := Target.state,
+      and type targetState := Target.state
+      and type sourceId := Source.Id.t
+      and type targetId := Target.Id.t,
   ): (
     Mapping
       with type targetState = Target.state
@@ -155,11 +196,14 @@ module Mapping = {
       and module SourceId = Source.Id
   ) => {
     module SourceId = Source.Id
+    type targetId = Target.Id.t
     @schema
     type sourceEvent = Source.event
     @schema
     type targetState = Target.state
     let project = MappingImpl.project
+    let targetIdToString = Target.Id.toString
+    let targetIdFromString = Target.Id.makeFromString
     let sourceName = Source.name
     let subIdConfig = Target.subIdConfig
   }

package/src/types/Projection.res.mjs

@@ -1,15 +1,127 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 
+function mapActionId(action, to_, from) {
+  if (typeof action !== "object") {
+    return "Ignore";
+  }
+  switch (action.TAG) {
+    case "Create" :
+      return {
+        TAG: "Create",
+        _0: to_(action._0),
+        _1: action._1
+      };
+    case "CreateMany" :
+      return {
+        TAG: "CreateMany",
+        _0: action._0.map(param => [
+          to_(param[0]),
+          param[1]
+        ])
+      };
+    case "Update" :
+      return {
+        TAG: "Update",
+        _0: to_(action._0),
+        _1: action._1
+      };
+    case "UpdateMany" :
+      let f = action._1;
+      return {
+        TAG: "UpdateMany",
+        _0: action._0.map(to_),
+        _1: (id, state) => f(from(id), state)
+      };
+    case "UpdateWithDefault" :
+      return {
+        TAG: "UpdateWithDefault",
+        _0: to_(action._0),
+        _1: action._1,
+        _2: action._2
+      };
+    case "UpdateManyWithDefault" :
+      let f$1 = action._2;
+      let $$default = action._1;
+      return {
+        TAG: "UpdateManyWithDefault",
+        _0: action._0.map(to_),
+        _1: id => $$default(from(id)),
+        _2: (id, state) => f$1(from(id), state)
+      };
+    case "Set" :
+      return {
+        TAG: "Set",
+        _0: to_(action._0),
+        _1: action._1
+      };
+    case "SetMany" :
+      let f$2 = action._1;
+      return {
+        TAG: "SetMany",
+        _0: action._0.map(to_),
+        _1: id => f$2(from(id))
+      };
+    case "Delete" :
+      return {
+        TAG: "Delete",
+        _0: to_(action._0)
+      };
+    case "DeleteMany" :
+      return {
+        TAG: "DeleteMany",
+        _0: action._0.map(to_)
+      };
+    case "DeleteIf" :
+      return {
+        TAG: "DeleteIf",
+        _0: to_(action._0),
+        _1: action._1
+      };
+    case "DeleteManyIf" :
+      let p = action._1;
+      return {
+        TAG: "DeleteManyIf",
+        _0: action._0.map(to_),
+        _1: (id, state) => p(from(id), state)
+      };
+    case "CreateMultiState" :
+      return {
+        TAG: "CreateMultiState",
+        _0: to_(action._0),
+        _1: action._1
+      };
+    case "UpdateMultiState" :
+      return {
+        TAG: "UpdateMultiState",
+        _0: to_(action._0),
+        _1: action._1
+      };
+    case "UpdateManyMultiStates" :
+      let f$3 = action._1;
+      return {
+        TAG: "UpdateManyMultiStates",
+        _0: action._0.map(to_),
+        _1: (id, states) => f$3(from(id), states)
+      };
+  }
+}
+
 function Make(Source) {
-  return Target => (MappingImpl => ({
-    SourceId: Source.Id,
-    project: MappingImpl.project,
-    sourceEventSchema: Source.eventSchema,
-    sourceName: Source.name,
-    subIdConfig: Target.subIdConfig,
-    targetStateSchema: Target.stateSchema
-  }));
+  return Target => (MappingImpl => {
+    let targetIdToString = Target.Id.toString;
+    let targetIdFromString = Target.Id.makeFromString;
+    return {
+      SourceId: Source.Id,
+      project: MappingImpl.project,
+      targetIdToString: targetIdToString,
+      targetIdFromString: targetIdFromString,
+      sourceEventSchema: Source.eventSchema,
+      sourceName: Source.name,
+      subIdConfig: Target.subIdConfig,
+      targetStateSchema: Target.stateSchema
+    };
+  });
 }
 
 let Mapping = {
@@ -37,6 +149,7 @@ let DcbSource = {
 };
 
 export {
+  mapActionId,
   Mapping,
   Mappings,
   DcbSource,

package/src/types/Schedule.res.mjs

@@ -2,15 +2,15 @@
 
 import * as Sury from "sury";
 
-let yearSchema = Sury.int;
+let yearSchema = Sury.int32;
 
-let monthSchema = Sury.int;
+let monthSchema = Sury.int32;
 
-let daySchema = Sury.int;
+let daySchema = Sury.int32;
 
-let hourSchema = Sury.int;
+let hourSchema = Sury.int32;
 
-let minuteSchema = Sury.int;
+let minuteSchema = Sury.int32;
 
 let rateSchema = Sury.union([
   Sury.$schema(s => ({
@@ -23,15 +23,15 @@ let rateSchema = Sury.union([
   })),
   Sury.$schema(s => ({
     TAG: "Minutes",
-    _0: s.m(Sury.int)
+    _0: s.m(Sury.int32)
   })),
   Sury.$schema(s => ({
     TAG: "Hours",
-    _0: s.m(Sury.int)
+    _0: s.m(Sury.int32)
   })),
   Sury.$schema(s => ({
     TAG: "Days",
-    _0: s.m(Sury.int)
+    _0: s.m(Sury.int32)
   })),
   Sury.$schema(s => ({
     TAG: "Daily",

package/src/util/Util_Sury.res

@@ -7,16 +7,19 @@
 // See docs/plans/sury-11-migration.md.
 
 let toJson: ('a, S.t<'a>) => JSON.t = (value, schema) =>
-  value->S.decodeOrThrow(~from=schema, ~to=S.json)
+  value->S.convertOrThrow(~from=schema, ~to=S.json)
 
 // `~space` defaults to compact, matching the removed `reverseConvertToJsonStringOrThrow`.
 let toJsonString = (value: 'a, schema: S.t<'a>, ~space: int=0): string =>
-  value->S.decodeOrThrow(~from=schema, ~to=space == 0 ? S.jsonString : S.jsonStringWithSpace(space))
+  (value->S.convertOrThrow(
+    ~from=schema,
+    ~to=space == 0 ? S.jsonString : S.jsonStringWithSpace(space),
+  ) :> string)
 
 let fromJson: (JSON.t, S.t<'a>) => 'a = (json, schema) => json->S.parseOrThrow(~to=schema)
 
 let fromJsonString: (string, S.t<'a>) => 'a = (str, schema) =>
-  str->S.decodeOrThrow(~from=S.jsonString, ~to=schema)
+  S.JsonString(str)->S.convertOrThrow(~from=S.jsonString, ~to=schema)
 
 // Sury raises `S.Exn`, which carries `RE_EXN_ID: "S.Exn"` and so is not a `JsExn`
 // even though it is a JS Error at runtime — the usual

package/src/util/Util_Sury.res.mjs

@@ -6,18 +6,20 @@ import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 
 function toJson(value, schema) {
-  return S.decodeOrThrow(value, schema, Sury.json);
+  return S.convertOrThrow(value, schema, undefined, Sury.json);
 }
 
 function toJsonString(value, schema, spaceOpt) {
   let space = spaceOpt !== undefined ? spaceOpt : 0;
-  return S.decodeOrThrow(value, schema, space === 0 ? Sury.jsonString : Sury.jsonStringWithSpace(space));
+  return S.convertOrThrow(value, schema, undefined, space === 0 ? Sury.jsonString : Sury.jsonStringWithSpace(space));
 }
 
-let fromJson = S.parseOrThrow;
+function fromJson(json, schema) {
+  return Sury.parseOrThrow(json, schema);
+}
 
 function fromJsonString(str, schema) {
-  return S.decodeOrThrow(str, Sury.jsonString, schema);
+  return S.convertOrThrow(str, Sury.jsonString, undefined, schema);
 }
 
 function exnMessage(exn, fallbackOpt) {