@reventlessdev/online-shop-hybrid-ordering 1.0.0-alpha.235 → 1.0.0-alpha.237

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.237 (2026-09-09)
+
+**Note:** Version bump only for package @reventlessdev/online-shop-hybrid-ordering
+
+
+
+
+
+# 1.0.0-alpha.236 (2026-09-08)
+
+### Features
+
+* **spec:** a field declares the value a form opens it on ([1d541fe](https://github.com/ReventlessDev/reventless-core/commit/1d541fe497e1df2ff48b72e26a06a1b8fd3c9e06))
+
+
 # 1.0.0-alpha.235 (2026-09-08)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/online-shop-hybrid-ordering",
-  "version": "1.0.0-alpha.235",
+  "version": "1.0.0-alpha.237",
   "description": "Online Shop Hybrid example — Ordering plugin (Customer aggregate + Order/CatalogProduct DCB)",
   "license": "Apache-2.0",
   "jest": {
@@ -21,20 +21,20 @@
   },
   "dependencies": {
     "sury": "11.0.0-rc.2",
-    "@reventlessdev/online-shop-hybrid-catalog-spec": "1.0.0-alpha.128",
-    "@reventlessdev/online-shop-hybrid-ordering-spec": "1.0.0-alpha.128",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.160",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.206",
-    "@reventlessdev/reventless-local": "3.0.0-alpha.248",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.132",
-    "@reventlessdev/trait-address-geocoding": "1.0.0-alpha.8",
-    "@reventlessdev/trait-notification": "1.0.0-alpha.8"
+    "@reventlessdev/online-shop-hybrid-catalog-spec": "1.0.0-alpha.130",
+    "@reventlessdev/online-shop-hybrid-ordering-spec": "1.0.0-alpha.130",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.20",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.208",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.162",
+    "@reventlessdev/reventless-local": "3.0.0-alpha.250",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.134",
+    "@reventlessdev/trait-address-geocoding": "1.0.0-alpha.10",
+    "@reventlessdev/trait-notification": "1.0.0-alpha.10"
   },
   "devDependencies": {
     "rescript": "12.3.0",
     "sury-ppx": "11.0.0-rc.2",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.78"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.80"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/CatalogProduct/StateChange/SyncCatalogProduct.res

@@ -35,25 +35,14 @@ type error = unit // always succeeds — sync is idempotent
 
 @schema
 type event =
-  | CatalogProductSynced({
-      productId: string,
-      name: string,
-      price: Reventless.Money.t,
-    })
-  | CatalogProductPriceChanged({
-      productId: string,
-      price: Reventless.Money.t,
-    })
+  | CatalogProductSynced({productId: string, name: string, price: Reventless.Money.t})
+  | CatalogProductPriceChanged({productId: string, price: Reventless.Money.t})
   | CatalogProductWithdrawn({productId: string})
   // Carries the shadow's name and price so the projection can restore the row
   // without a second read: the fold has them in hand at exactly the moment the
   // decision is made, and an event that states what it caused is what makes the
   // projection a pure mapping.
-  | CatalogProductRelisted({
-      productId: string,
-      name: string,
-      price: Reventless.Money.t,
-    })
+  | CatalogProductRelisted({productId: string, name: string, price: Reventless.Money.t})
   | CatalogProductImageChanged({
       productId: string,
       @storageRef("Catalog.productImages") productImage?: Reventless.UploadableImage.t,

package/src/CatalogProduct/StateChange/SyncCatalogProduct_Behavior.res

@@ -24,7 +24,7 @@ let evolve = (state, event) =>
   | CatalogProductPriceChanged({price}) => {...state, price: Some(price)}
   | CatalogProductWithdrawn => {...state, withdrawn: true}
   | CatalogProductRelisted => {...state, withdrawn: false}
-  | CatalogProductImageChanged({productImage: ?productImage}) => {...state, productImage}
+  | CatalogProductImageChanged({?productImage}) => {...state, productImage}
   }
 
 let decide = (state, command) =>
@@ -62,10 +62,10 @@ let decide = (state, command) =>
   // ordinary shape of at-least-once delivery, not a change.
   // Compared as options, so "the picture is gone" is recognised as a change and
   // re-announcing the same absence is not.
-  | ChangeSyncedProductImage({productId, productImage: ?productImage}) =>
+  | ChangeSyncedProductImage({productId, ?productImage}) =>
     if state.productImage == productImage {
       Ok([])
     } else {
-      Ok([CatalogProductImageChanged({productId, productImage: ?productImage})])
+      Ok([CatalogProductImageChanged({productId, ?productImage})])
     }
   }

package/src/CatalogProduct/StateViewStream/AvailableProducts_Projection.res

@@ -3,8 +3,7 @@
 let project = ({event}) =>
   switch event {
   | CatalogProductSynced({productId, name, price}) => [Set(productId, {productId, name, price})]
-  | CatalogProductPriceChanged({productId, price}) =>
-    [Update(productId, p => {...p, price})]
+  | CatalogProductPriceChanged({productId, price}) => [Update(productId, p => {...p, price})]
   // `Delete`, not a flag. This view answers "what can I order", so a withdrawn
   // product leaves it. Marking it instead — `@retired` on the shopper view —
   // would look tidy and be wrong twice over: a shopper is not elevated, so the

package/src/Customer/OutboundTranslation/GeocodeCustomerAddress_Translation.res

@@ -21,19 +21,17 @@ let translate = async (_id, item, ~capabilities: Reventless.Capabilities.t) =>
       ~capabilities,
       ~located=(~point, ~resolvedFrom) => SetLocation({location: point, resolvedFrom}),
       // A verdict for a human, not a coordinate.
-      ~unresolvable=(~subject, ~reason) =>
-        MarkAddressUnresolvable({address: subject, reason}),
+      ~unresolvable=(~subject, ~reason) => MarkAddressUnresolvable({address: subject, reason}),
     )
   )->Result.map(command => Some((item.customerId, command)))
 
 // The budget is spent and the geocoder never answered. Recording the verdict
 // beats leaving the TODO pending forever — and it is why the capability must be
 // declared, since an unprovisioned geocoder reaches here every time.
-let onExhausted = (_id, item: outboundItem, ~lastError) =>
-  Some((
-    item.customerId,
-    MarkAddressUnresolvable({
-      address: item.address,
-      reason: Geocode.exhaustedReason(lastError),
-    }),
-  ))
+let onExhausted = (_id, item: outboundItem, ~lastError) => Some((
+  item.customerId,
+  MarkAddressUnresolvable({
+    address: item.address,
+    reason: Geocode.exhaustedReason(lastError),
+  }),
+))

package/src/Customer/ReadModelStream/Customers_Projections.res

@@ -71,7 +71,7 @@ module CustomerOrdersMapping = Mapping.Make(
         UpdateWithDefault(
           customerId,
           {
-            Customers.customerId: customerId,
+            Customers.customerId,
             email: "",
             address: "",
             // No address from this side; `Registered` fills it in when it arrives.

package/src/Extension/Products_Extension.res

@@ -25,10 +25,8 @@ module Mapping = {
     | ProductRelisted({productId: theId}) => [
         PublishStateChangeSliceCommand(RelistSyncedProduct({productId: theId})),
       ]
-    | ProductImageChanged({productId, productImage: ?productImage}) => [
-        PublishStateChangeSliceCommand(
-          ChangeSyncedProductImage({productId, productImage: ?productImage}),
-        ),
+    | ProductImageChanged({productId, ?productImage}) => [
+        PublishStateChangeSliceCommand(ChangeSyncedProductImage({productId, ?productImage})),
       ]
     }
 

package/src/ExtensionPoint/Orders_ExtensionPointMapping.res

@@ -15,18 +15,18 @@ module Delegate = {
 
 let mapIncomingCommand = (_id, _command, _meta) => []
 
-let mapOutgoingEvent = Some((_id, event, _meta, _queryEngine) =>
-  switch event {
-  | Delegate.OrderPlaced({orderId, customerId, productIds}) =>
-    productIds->Array.map(pid =>
-      PublishEvent(
+let mapOutgoingEvent = Some(
+  (_id, event, _meta, _queryEngine) =>
+    switch event {
+    | Delegate.OrderPlaced({orderId, customerId, productIds}) =>
+      productIds->Array.map(pid => PublishEvent(
         pid,
         OrderingSpec.Orders_ExtensionPoint.ItemOrdered({productId: pid, orderId, customerId}),
-      )
-    )
-  | Delegate.OrderCancelled({orderId, productIds}) =>
-    productIds->Array.map(pid =>
-      PublishEvent(pid, OrderingSpec.Orders_ExtensionPoint.ItemOrderCancelled({productId: pid, orderId}))
-    )
-  }
+      ))
+    | Delegate.OrderCancelled({orderId, productIds}) =>
+      productIds->Array.map(pid => PublishEvent(
+        pid,
+        OrderingSpec.Orders_ExtensionPoint.ItemOrderCancelled({productId: pid, orderId}),
+      ))
+    },
 )

package/src/LifecycleModel.res

@@ -7,14 +7,74 @@
 // annotation where it is silent.
 
 let model: array<Reventless.Plugin.derivedEdge> = [
-  {component: "CancelOrder", command: "CancelOrder", level: Reventless.Plugin.Instance, allowedStates: ["Placed"], targets: ["Cancelled"]},
-  {component: "CancelOrder", command: "ReopenOrder", level: Reventless.Plugin.Instance, allowedStates: ["Cancelled"], targets: ["Placed"]},
-  {component: "Customer", command: "Deactivate", level: Reventless.Plugin.Instance, allowedStates: ["Active"], targets: ["Deactivated"]},
-  {component: "Customer", command: "Reactivate", level: Reventless.Plugin.Instance, allowedStates: ["Deactivated"], targets: ["Active"]},
-  {component: "Customer", command: "Register", level: Reventless.Plugin.Collection, allowedStates: [], targets: ["Active"]},
-  {component: "Customer", command: "SetAddressLocation", level: Reventless.Plugin.Instance, allowedStates: ["Active"], targets: []},
-  {component: "Customer", command: "UpdateAddress", level: Reventless.Plugin.Instance, allowedStates: ["Active"], targets: []},
-  {component: "Customer", command: "UpdateEmail", level: Reventless.Plugin.Instance, allowedStates: ["Active"], targets: []},
-  {component: "PlaceOrder", command: "PlaceOrder", level: Reventless.Plugin.Collection, allowedStates: [], targets: ["Placed"]},
-  {component: "ShipOrder", command: "ShipOrder", level: Reventless.Plugin.Instance, allowedStates: ["Placed"], targets: ["Shipped"]},
+  {
+    component: "CancelOrder",
+    command: "CancelOrder",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Placed"],
+    targets: ["Cancelled"],
+  },
+  {
+    component: "CancelOrder",
+    command: "ReopenOrder",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Cancelled"],
+    targets: ["Placed"],
+  },
+  {
+    component: "Customer",
+    command: "Deactivate",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Active"],
+    targets: ["Deactivated"],
+  },
+  {
+    component: "Customer",
+    command: "Reactivate",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Deactivated"],
+    targets: ["Active"],
+  },
+  {
+    component: "Customer",
+    command: "Register",
+    level: Reventless.Plugin.Collection,
+    allowedStates: [],
+    targets: ["Active"],
+  },
+  {
+    component: "Customer",
+    command: "SetAddressLocation",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Active"],
+    targets: [],
+  },
+  {
+    component: "Customer",
+    command: "UpdateAddress",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Active"],
+    targets: [],
+  },
+  {
+    component: "Customer",
+    command: "UpdateEmail",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Active"],
+    targets: [],
+  },
+  {
+    component: "PlaceOrder",
+    command: "PlaceOrder",
+    level: Reventless.Plugin.Collection,
+    allowedStates: [],
+    targets: ["Placed"],
+  },
+  {
+    component: "ShipOrder",
+    command: "ShipOrder",
+    level: Reventless.Plugin.Instance,
+    allowedStates: ["Placed"],
+    targets: ["Shipped"],
+  },
 ]

package/src/Notification/Automation/NotificationIntake.res

@@ -23,17 +23,17 @@ type todoItem = {ruleId: string, recipientId: string, orderId: string}
 
 @schema
 type command =
-  RequestNotification({
-    recipientId: string,
-    category: NotificationPreferences.category,
-    reference: string,
-    subjectType: string,
-    subjectRef: string,
-    subject: string,
-    body: string,
-    sourceId: string,
-    origin: NotificationPreferences.origin,
-  })
+  | RequestNotification({
+      recipientId: string,
+      category: NotificationPreferences.category,
+      reference: string,
+      subjectType: string,
+      subjectRef: string,
+      subject: string,
+      body: string,
+      sourceId: string,
+      origin: NotificationPreferences.origin,
+    })
 
 let maxRetries = 3
 let heartbeatInterval = 60

package/src/Notification/Automation/NotificationIntake_Automation.res

@@ -112,7 +112,8 @@ module FromOrderingDcb = Mapping.Make(
       | NotificationDeferred({reference}) =>
         Some(reference)
       | OrderPlaced(_)
-      | OrderShipped(_) => None
+      | OrderShipped(_) =>
+        None
       }
   },
 )

package/src/Notification/OutboundTranslation/AnnounceRecipientContact_Translation.res

@@ -14,8 +14,9 @@ let collect = (event, ~sourceId) =>
 // item completes on this returning `Ok`, which is what makes the directory's own
 // `AnnounceRecipient` free to be idempotent: a re-announced address publishes no
 // event, and no row is left waiting for one.
-let translate = async (_id, item: outboundItem, ~capabilities as _) =>
-  Ok(Some((item.recipientId, AnnounceRecipient({recipientId: item.recipientId, email: item.email}))))
+let translate = async (_id, item: outboundItem, ~capabilities as _) => Ok(
+  Some((item.recipientId, AnnounceRecipient({recipientId: item.recipientId, email: item.email}))),
+)
 
 // Unreachable in practice — `translate` cannot fail — but a slice that stays
 // silent has to say so on purpose. If a publish failure ever did exhaust the

package/src/Notification/OutboundTranslation/SendNotification_Translation.res

@@ -20,15 +20,24 @@ let recipientFor = (item: outboundItem) =>
     ->Reventless.Email.fromString
     ->Result.map(email => Reventless.Messaging.ToEmail(email))
   | Sms =>
-    item.address->Reventless.Phone.fromString->Result.map(phone => Reventless.Messaging.ToSms(phone))
-  | Push => Ok(Reventless.Messaging.ToPush({deviceToken: item.address}))
+    item.address
+    ->Reventless.Phone.fromString
+    ->Result.map(phone => Reventless.Messaging.ToSms(phone))
+  // The directory stores a channel beside one flat address, and no push address is
+  // one string: two services issue a token, Web Push issues an endpoint with its
+  // encryption keys, and which service issued this one is not recorded either. So
+  // the pair cannot be re-fused, and refusing says so once rather than guessing a
+  // service and failing at whichever provider. A push transport arrives with the
+  // stored shape it needs, in the commit that justifies the columns.
+  | Push =>
+    Error("a push address names its issuing service, and the directory stores one flat address")
   }
 
 let translate = async (_id, item: outboundItem, ~capabilities: Reventless.Capabilities.t) =>
   switch recipientFor(item) {
-  // An address the directory holds that its own channel's grammar refuses. Not
-  // retryable and not the provider's fault, so it is recorded as a failure
-  // rather than raised: the recipient's row is what needs fixing.
+  // An address the directory holds that its own channel cannot use. Not retryable
+  // and not the provider's fault, so it is recorded as a failure rather than
+  // raised: the recipient's row is what needs fixing.
   | Error(why) =>
     Ok(
       Some((
@@ -78,12 +87,11 @@ let translate = async (_id, item: outboundItem, ~capabilities: Reventless.Capabi
 // The budget is spent and the provider never answered. Recording it beats leaving
 // the row pending forever — and it is the second reason the capability must be
 // declared, since an unprovisioned sender reaches here every single time.
-let onExhausted = (_id, item: outboundItem, ~lastError) =>
-  Some((
-    item.recipientId,
-    RecordDeliveryFailure({
-      recipientId: item.recipientId,
-      reference: item.reference,
-      reason: lastError->Option.getOr("the messaging provider never answered"),
-    }),
-  ))
+let onExhausted = (_id, item: outboundItem, ~lastError) => Some((
+  item.recipientId,
+  RecordDeliveryFailure({
+    recipientId: item.recipientId,
+    reference: item.reference,
+    reason: lastError->Option.getOr("the messaging provider never answered"),
+  }),
+))

package/src/Notification/OutboundTranslation/SendNotification_Translation.res.mjs

@@ -36,11 +36,8 @@ function recipientFor(item) {
       }));
     case "Push" :
       return {
-        TAG: "Ok",
-        _0: {
-          TAG: "ToPush",
-          deviceToken: item.address
-        }
+        TAG: "Error",
+        _0: "a push address names its issuing service, and the directory stores one flat address"
       };
   }
 }

package/src/Notification/StateChange/NotificationPreferences_Behavior.res

@@ -82,7 +82,8 @@ let evolve = (state, event: consumedEvent) =>
 let named = (recipientId, fact: Rules.fact) =>
   switch fact {
   | Claimed(_)
-  | Released(_) => None
+  | Released(_) =>
+    None
   | Deferred({reference, source}) =>
     Some(NotificationDeferred({recipientId, reference, sourceKey: source}))
   | Announced({address}) => Some(RecipientAnnounced({recipientId, email: address}))
@@ -155,9 +156,17 @@ let decide = (state, command) =>
   | AnnounceRecipient({recipientId, email}) =>
     through(state, recipientId, Announce({channel: Email, address: email}))
   | Subscribe({recipientId, category, channel}) =>
-    through(state, recipientId, Subscribe({category: categoryKey(category), channel: channelKey(channel)}))
+    through(
+      state,
+      recipientId,
+      Subscribe({category: categoryKey(category), channel: channelKey(channel)}),
+    )
   | Unsubscribe({recipientId, category, channel}) =>
-    through(state, recipientId, Unsubscribe({category: categoryKey(category), channel: channelKey(channel)}))
+    through(
+      state,
+      recipientId,
+      Unsubscribe({category: categoryKey(category), channel: channelKey(channel)}),
+    )
 
   // The one arm the mapping cannot be pure about: the words and the subject
   // belong to the requester, and the trait's facts carry neither, because a trait

package/src/Notification/StateViewStream/NotificationDeliveries_Projection.res

@@ -21,7 +21,15 @@ let channelName = (channel: NotificationPreferences.channel) =>
 // dropping it is what makes that visible instead of fabricating a half-row.
 let project = ({event, meta}) =>
   switch event {
-  | NotificationRequested({recipientId, category, reference, channel, subjectType, subjectRef, origin}) => [
+  | NotificationRequested({
+      recipientId,
+      category,
+      reference,
+      channel,
+      subjectType,
+      subjectRef,
+      origin,
+    }) => [
       Set(
         reference,
         {
@@ -60,7 +68,14 @@ let project = ({event, meta}) =>
         },
       ),
     ]
-  | NotificationUndeliverable({recipientId, category, reference, subjectType, subjectRef, origin}) => [
+  | NotificationUndeliverable({
+      recipientId,
+      category,
+      reference,
+      subjectType,
+      subjectRef,
+      origin,
+    }) => [
       Set(
         reference,
         {
@@ -79,19 +94,25 @@ let project = ({event, meta}) =>
       ),
     ]
   | NotificationDelivered({reference, providerRef}) => [
-      Update(reference, state => {
-        ...state,
-        outcome: Delivered,
-        detail: providerRef,
-        settledAt: Some(meta.time),
-      }),
+      Update(
+        reference,
+        state => {
+          ...state,
+          outcome: Delivered,
+          detail: providerRef,
+          settledAt: Some(meta.time),
+        },
+      ),
     ]
   | NotificationFailed({reference, reason}) => [
-      Update(reference, state => {
-        ...state,
-        outcome: Failed,
-        detail: reason,
-        settledAt: Some(meta.time),
-      }),
+      Update(
+        reference,
+        state => {
+          ...state,
+          outcome: Failed,
+          detail: reason,
+          settledAt: Some(meta.time),
+        },
+      ),
     ]
   }

package/src/Order/StateChange/CancelOrder.res

@@ -23,10 +23,7 @@ type error =
 
 @schema
 type event =
-  | OrderCancelled({
-      orderId: string,
-      productIds: array<string>,
-    })
+  | OrderCancelled({orderId: string, productIds: array<string>})
   | OrderReopened({orderId: string})
 
 // `ReopenOrder` is the way back out of `Cancelled`, and a real edge of the

package/src/Order/StateChange/PlaceOrder.res

@@ -47,28 +47,30 @@ type shippingMethod =
 @schema
 type lineItem = {
   @ref("AvailableProducts") productId: string,
-  quantity: int,
+  // A line is for one of the thing unless the shopper says otherwise. Without
+  // it a checkout seeded from a picked shelf opens each line blank.
+  @default(1) quantity: int,
 }
 
 @schema
 type command =
-  PlaceOrder({
-    @partitionTag orderId: string,
-    // customerId is payload, not a query key — @noDcbTag stops it auto-tagging.
-    // It is also the order's owner: the resolver overwrites this with the
-    // authenticated caller's id before the command is published, so what a
-    // client sends here is ignored rather than trusted. An operator placing an
-    // order on someone's behalf is exempt and keeps the value they sent.
-    @noDcbTag @owner customerId: string,
-    lineItems: array<lineItem>,
-    shippingMethod: shippingMethod,
-    // A requested delivery slot, chosen at checkout. An optional field — a
-    // Pickup order (or a caller that names no preference) simply omits it, and
-    // an order placed before this field existed carries no key, so adding it
-    // costs the log nothing (the additive path in the plan's adoption table).
-    // One `DateRange.t`, not a guessed `start*`/`end*` name pair.
-    deliveryWindow?: Reventless.DateRange.t,
-  })
+  | PlaceOrder({
+      @partitionTag orderId: string,
+      // customerId is payload, not a query key — @noDcbTag stops it auto-tagging.
+      // It is also the order's owner: the resolver overwrites this with the
+      // authenticated caller's id before the command is published, so what a
+      // client sends here is ignored rather than trusted. An operator placing an
+      // order on someone's behalf is exempt and keeps the value they sent.
+      @noDcbTag @owner customerId: string,
+      lineItems: array<lineItem>,
+      shippingMethod: shippingMethod,
+      // A requested delivery slot, chosen at checkout. An optional field — a
+      // Pickup order (or a caller that names no preference) simply omits it, and
+      // an order placed before this field existed carries no key, so adding it
+      // costs the log nothing (the additive path in the plan's adoption table).
+      // One `DateRange.t`, not a guessed `start*`/`end*` name pair.
+      deliveryWindow?: Reventless.DateRange.t,
+    })
 
 @schema
 type error =
@@ -100,33 +102,33 @@ type orderLine = {
 
 @schema
 type event =
-  OrderPlaced({
-    @partitionTag orderId: string,
-    customerId: string,
-    // Redundant against `lines`, and deliberately so. The extension point
-    // decomposes this into one published `ItemOrdered` per product and
-    // `CancelOrder` folds it, so both keep working untouched — and the public
-    // contract in `ordering-spec` does not move, which is what lets the shop
-    // show quantities without redeploying Catalog in lockstep.
-    productIds: array<string>,
-    lines: array<orderLine>,
-    total: Reventless.Money.t,
-    shippingMethod: shippingMethod,
-    deliveryWindow?: Reventless.DateRange.t,
-    // What the first product was called when this order was placed.
-    //
-    // **Captured, not looked up.** An order is a record of what somebody bought,
-    // and the catalog goes on changing afterwards — a rename, a withdrawal, a
-    // reshoot. Reading the name live would rewrite history every time the shop
-    // tidied its shelves, and would leave an order for a withdrawn product with
-    // nothing to show at all.
-    //
-    // Optional because every order placed before this field existed carries no
-    // key, which is what makes adding it cost the log nothing. A reader treats
-    // absent as "not recorded" rather than as a name.
-    firstProductName?: string,
-    // The picture as it was when the order was placed, frozen for the reason the
-    // name is. A reshoot, a withdrawal or a deletion afterwards leaves this
-    // order showing what the shopper actually bought.
-    @storageRef("Catalog.productImages") firstProductImage?: Reventless.UploadableImage.t,
-  })
+  | OrderPlaced({
+      @partitionTag orderId: string,
+      customerId: string,
+      // Redundant against `lines`, and deliberately so. The extension point
+      // decomposes this into one published `ItemOrdered` per product and
+      // `CancelOrder` folds it, so both keep working untouched — and the public
+      // contract in `ordering-spec` does not move, which is what lets the shop
+      // show quantities without redeploying Catalog in lockstep.
+      productIds: array<string>,
+      lines: array<orderLine>,
+      total: Reventless.Money.t,
+      shippingMethod: shippingMethod,
+      deliveryWindow?: Reventless.DateRange.t,
+      // What the first product was called when this order was placed.
+      //
+      // **Captured, not looked up.** An order is a record of what somebody bought,
+      // and the catalog goes on changing afterwards — a rename, a withdrawal, a
+      // reshoot. Reading the name live would rewrite history every time the shop
+      // tidied its shelves, and would leave an order for a withdrawn product with
+      // nothing to show at all.
+      //
+      // Optional because every order placed before this field existed carries no
+      // key, which is what makes adding it cost the log nothing. A reader treats
+      // absent as "not recorded" rather than as a name.
+      firstProductName?: string,
+      // The picture as it was when the order was placed, frozen for the reason the
+      // name is. A reshoot, a withdrawal or a deletion afterwards leaves this
+      // order showing what the shopper actually bought.
+      @storageRef("Catalog.productImages") firstProductImage?: Reventless.UploadableImage.t,
+    })