@reventlessdev/online-shop-hybrid-ordering 1.0.0-alpha.237 → 1.0.0-alpha.239

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.239 (2026-09-16)
+
+* feat(spec)!: infer the DCB partition key per slice, and drop @partitionTag where inference agrees ([6c10161](https://github.com/ReventlessDev/reventless-core/commit/6c101611d438beea4bc9175ae8ea0ea1f6f7493b))
+### Features
+
+* **spec:** let a slice's chapter break a partition-key tie ([2b9ae77](https://github.com/ReventlessDev/reventless-core/commit/2b9ae77e98eb42177d2bdd4977bc62bb7c7911aa))
+
+### BREAKING CHANGES
+
+* DcbTag.derivePartitionTag is removed; a boundary whose
+partition cannot be inferred no longer deploys.
+
+
+
+# 1.0.0-alpha.238 (2026-09-11)
+
+### Bug Fixes
+
+* **spec:** a command that declines to act is not a command that was refused ([0b3d8a4](https://github.com/ReventlessDev/reventless-core/commit/0b3d8a40092ce7ed7801a2aae5d4d7bbed03c179))
+### Features
+
+* **example:** a customer's email carries whether it has been proven ([04885a6](https://github.com/ReventlessDev/reventless-core/commit/04885a66e22ca255172f038b42c120c66c0a76bc))
+* **example:** draw a secret, send it, and record only its hash ([a08cbe8](https://github.com/ReventlessDev/reventless-core/commit/a08cbe854516e68e97b0b81e7a53c55e1415bc29))
+* **example:** one secret at a time, held where a snapshot cannot reach it ([f904c63](https://github.com/ReventlessDev/reventless-core/commit/f904c635858f33043dc1d01c968887fee2000047))
+* **example:** proving an address, and dropping the proof when it changes ([89612ff](https://github.com/ReventlessDev/reventless-core/commit/89612ff338e9a39fddf1b2147b88fb961ee57601))
+
+
 # 1.0.0-alpha.237 (2026-09-09)
 
 **Note:** Version bump only for package @reventlessdev/online-shop-hybrid-ordering

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/online-shop-hybrid-ordering",
-  "version": "1.0.0-alpha.237",
+  "version": "1.0.0-alpha.239",
   "description": "Online Shop Hybrid example — Ordering plugin (Customer aggregate + Order/CatalogProduct DCB)",
   "license": "Apache-2.0",
   "jest": {
@@ -21,15 +21,15 @@
   },
   "dependencies": {
     "sury": "11.0.0-rc.2",
-    "@reventlessdev/online-shop-hybrid-catalog-spec": "1.0.0-alpha.130",
-    "@reventlessdev/online-shop-hybrid-ordering-spec": "1.0.0-alpha.130",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.20",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.208",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.162",
-    "@reventlessdev/reventless-local": "3.0.0-alpha.250",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.134",
-    "@reventlessdev/trait-address-geocoding": "1.0.0-alpha.10",
-    "@reventlessdev/trait-notification": "1.0.0-alpha.10"
+    "@reventlessdev/online-shop-hybrid-ordering-spec": "1.0.0-alpha.132",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.21",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.164",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.210",
+    "@reventlessdev/online-shop-hybrid-catalog-spec": "1.0.0-alpha.132",
+    "@reventlessdev/reventless-local": "3.0.0-alpha.252",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.136",
+    "@reventlessdev/trait-notification": "1.0.0-alpha.12",
+    "@reventlessdev/trait-address-geocoding": "1.0.0-alpha.12"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/ContactVerification.res

@@ -0,0 +1,101 @@
+/**
+Proving that a person controls a contact address.
+
+One secret, expiring, non-replayable, and dropped if the address changes
+underneath it. What a settled proof *entitles* is the host's business and
+deliberately absent: that is the part that would not survive a host swap.
+*/
+/** An address, not a channel. Narrower than `Messaging.recipient` on purpose —
+    a push token is not a claim anyone makes, so the wrong subject is not
+    constructible. */
+type contact =
+  | ByEmail(Reventless.Email.t)
+  | ByPhone(Reventless.Phone.t)
+
+/** Which channels an address is reachable over. One-to-many, which is why
+    address and channel stay separate types; intersected at runtime with the
+    channels the deployment's provider publishes. */
+let channelsFor = (contact: contact): array<Reventless.Messaging.channel> =>
+  switch contact {
+  | ByEmail(_) => [Email]
+  | ByPhone(_) => [Sms]
+  }
+
+/** Total, because being addressable is what makes something a subject. */
+let toRecipient = (contact: contact): Reventless.Messaging.recipient =>
+  switch contact {
+  | ByEmail(email) => ToEmail(email)
+  | ByPhone(phone) => ToSms(phone)
+  }
+
+/** Why the proof is being asked for. The same machinery serves a registration, a
+    contact change, an invitation and a recovery; without this the next four
+    consumers each rebuild it. */
+type purpose =
+  | Registration
+  | ContactChange
+  | Invitation
+  | Recovery
+  | Custom(string)
+
+type subject = {contact: contact, purpose: purpose}
+
+/** How a challenge ended. `Superseded` is the address changing while it was
+    open — a fact about the host, not about the person. */
+type outcome =
+  | Verified
+  | Expired
+  | Superseded
+  | Abandoned
+
+/** What a secret is drawn from — the capability's own vocabulary rather than a
+    second copy of it. A link is followed and a code is typed off a screen, so
+    the two cannot share an alphabet, and the source that draws them is the one
+    place that should say which exist. */
+type alphabet = Reventless.Secrets.alphabet
+
+/** Keyed by channel — not globally, and not by contact. A 32-character link with
+    a 24-hour window is right for email and unusable over SMS, where a human
+    retypes the proof. Keying by contact would look identical today and quietly
+    hard-code one channel per address. */
+type policy = {
+  tokenTtl: Reventless.Duration.t,
+  maxAttempts: int,
+  resendCooldown: Reventless.Duration.t,
+  proofLength: int,
+  proofAlphabet: alphabet,
+}
+
+/** A day to act on, and a long secret because nobody types it. */
+let emailPolicy: policy = {
+  tokenTtl: 86400,
+  maxAttempts: 5,
+  resendCooldown: 60,
+  proofLength: 32,
+  proofAlphabet: UrlSafe,
+}
+
+/** Short-lived and short, because it is read off one screen and typed into
+    another — and fewer attempts, because six digits is a guessable space. */
+let smsPolicy: policy = {
+  tokenTtl: 600,
+  maxAttempts: 3,
+  resendCooldown: 60,
+  proofLength: 6,
+  proofAlphabet: Digits,
+}
+
+/**
+`None` for `Push`, and that is structural rather than unfinished.
+
+A push token is issued to one app install and relayed over an already
+authenticated session, so a challenge echoed back proves only what registering
+the token proved. Push presupposes the session it would be bootstrapping. An
+arm that merely had no policy yet would invite someone to supply one.
+*/
+let policyFor = (channel: Reventless.Messaging.channel): option<policy> =>
+  switch channel {
+  | Email => Some(emailPolicy)
+  | Sms => Some(smsPolicy)
+  | Push => None
+  }

package/src/ContactVerification.res.mjs

@@ -0,0 +1,60 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function channelsFor(contact) {
+  if (contact.TAG === "ByEmail") {
+    return ["Email"];
+  } else {
+    return ["Sms"];
+  }
+}
+
+function toRecipient(contact) {
+  if (contact.TAG === "ByEmail") {
+    return {
+      TAG: "ToEmail",
+      _0: contact._0
+    };
+  } else {
+    return {
+      TAG: "ToSms",
+      _0: contact._0
+    };
+  }
+}
+
+let emailPolicy = {
+  tokenTtl: 86400,
+  maxAttempts: 5,
+  resendCooldown: 60,
+  proofLength: 32,
+  proofAlphabet: "UrlSafe"
+};
+
+let smsPolicy = {
+  tokenTtl: 600,
+  maxAttempts: 3,
+  resendCooldown: 60,
+  proofLength: 6,
+  proofAlphabet: "Digits"
+};
+
+function policyFor(channel) {
+  switch (channel) {
+    case "Email" :
+      return emailPolicy;
+    case "Sms" :
+      return smsPolicy;
+    case "Push" :
+      return;
+  }
+}
+
+export {
+  channelsFor,
+  toRecipient,
+  emailPolicy,
+  smsPolicy,
+  policyFor,
+}
+/* No side effect */

package/src/ContactVerification_Guards.res

@@ -0,0 +1,176 @@
+/**
+The graft's decision rules, compiled once and called by every host: a proof for
+an address the entity has moved off settles nothing, a settled challenge settles
+once, and expiry is decided when the proof arrives rather than on a timer.
+
+The host keeps its own state and builds a `verification` per call from fields it
+already holds. The challenge is *not* host state — an aggregate is snapshotted,
+and a secret in a snapshot is a secret in every backup of one.
+*/
+/** The two fields the rules read, as the host holds them. Its invariant, which
+    every host arm must preserve: `verifiedAddress` is `None` or equal to
+    `contact`. */
+type verification = {
+  contact: ContactVerification.contact,
+  verifiedAddress: option<ContactVerification.contact>,
+}
+
+/** One challenge, as the trait's own ledger holds it. The secret itself is never
+    here — only whether a presented one matched, which the caller decides. */
+type challenge = {
+  contact: ContactVerification.contact,
+  purpose: ContactVerification.purpose,
+  issuedAt: Reventless.DateTime.t,
+  attempts: int,
+  settled: bool,
+}
+
+/** What the host still owes a proof for, or `None` — the stand-down. A host
+    whose current address is already the verified one spends no capability call,
+    the same arm as a map picker having already supplied the point. */
+let contactToVerify = (v: verification): option<ContactVerification.contact> =>
+  v.verifiedAddress == Some(v.contact) ? None : Some(v.contact)
+
+let elapsedSeconds = (~from: Reventless.DateTime.t, ~to_: Reventless.DateTime.t): int =>
+  Int.fromFloat((Reventless.DateTime.millis(to_) -. Reventless.DateTime.millis(from)) /. 1000.)
+
+/** Expiry is decided when the proof arrives, not by a scheduled fire. No
+    process-manager state to keep, and testable without controlling a clock. */
+let hasExpired = (c: challenge, ~now, ~policy: ContactVerification.policy): bool =>
+  elapsedSeconds(~from=c.issuedAt, ~to_=now) >= policy.tokenTtl
+
+/** Why a presented proof settles nothing. Named rather than one blank refusal,
+    because the host tells the subject which of these happened and tells an
+    anonymous caller nothing — that distinction is about who is asking, not about
+    whether the reason is known here. */
+type refusal =
+  /** 🚨 The security control. The host's address changed while this challenge
+      was open, so the proof names an address its presenter may no longer hold.
+      Settling it would be "change the address, then present the old one's link",
+      which is an account takeover. */
+  | AddressSuperseded
+  | ChallengeExpired
+  | AlreadySettled
+  | AttemptsExhausted
+  | ProofMismatch
+
+type proofVerdict =
+  | Settle
+  | Refuse(refusal)
+
+/**
+The order of these checks is a security decision, not a style one.
+
+Supersession is tested before anything else, so a stale challenge is refused on
+the fact that makes it dangerous rather than on whichever of its other
+properties happened to lapse first — a superseded challenge that had also
+expired must not be reported as merely expired. The proof itself is compared
+last, so none of the structural refusals depend on the secret.
+
+`hostContact` is an option because the two flows this competency serves differ
+in whether there *is* a host. Changing an address has one, and supersession is
+checkable. Registering has none — the subject the address will belong to does
+not exist yet — so `None` means "nothing to be superseded by", not "skip the
+check". A ledger that simply does not track the host also passes `None`, and
+relies on the host's own write-back guard, which is why that one is not
+optional.
+*/
+let onProofPresented = (
+  c: challenge,
+  ~hostContact: option<ContactVerification.contact>,
+  ~proofMatches: bool,
+  ~now: Reventless.DateTime.t,
+  ~policy: ContactVerification.policy,
+): proofVerdict =>
+  if hostContact->Option.mapOr(false, held => c.contact != held) {
+    Refuse(AddressSuperseded)
+  } else if c.settled {
+    Refuse(AlreadySettled)
+  } else if hasExpired(c, ~now, ~policy) {
+    Refuse(ChallengeExpired)
+  } else if c.attempts >= policy.maxAttempts {
+    Refuse(AttemptsExhausted)
+  } else if !proofMatches {
+    Refuse(ProofMismatch)
+  } else {
+    Settle
+  }
+
+type verdict = Append | Ignore
+
+/**
+The write-back rule, applied where the host records the outcome.
+
+Two guards, and the first is the same security control `onProofPresented`
+applies to the challenge — deliberately duplicated rather than trusted once. The
+ledger refusing to settle and the host refusing to record are different
+failures: a verdict can reach the host by redelivery, by a replayed command, or
+from a ledger that is simply wrong, and only this one is inside the host's own
+consistency boundary. The second is the ordinary redelivery no-op.
+*/
+let onVerifiedReport = (v: verification, ~contact: ContactVerification.contact): verdict =>
+  if contact != v.contact {
+    Ignore
+  } else if v.verifiedAddress == Some(contact) {
+    Ignore
+  } else {
+    Append
+  }
+
+type issuance =
+  /** Mint a secret and send it. */
+  | Issue
+  /** An open challenge already covers this address, so a redelivered request
+      mints nothing and sends nothing. Commands arrive at least once, and a slice
+      re-publishes until its work clears. */
+  | AlreadyOpen
+
+/**
+Whether a request to challenge an address produces a new secret.
+
+Decided against the ledger's own state and nothing else. The stand-down —
+whether an address is owed a proof at all — is `contactToVerify`, and it belongs
+to whoever reads the host, because a ledger has no host to read. Folding the two
+together read naturally with one host in view and stopped compiling the moment a
+second flow had none.
+*/
+let onIssueRequested = (
+  ~contact: ContactVerification.contact,
+  ~existing: option<challenge>,
+  ~now: Reventless.DateTime.t,
+  ~policy: ContactVerification.policy,
+): issuance =>
+  switch existing {
+  | Some(c) if c.contact == contact && !c.settled && !hasExpired(c, ~now, ~policy) => AlreadyOpen
+  | _ => Issue
+  }
+
+type resend =
+  | Send
+  /** Asked for again too soon, carrying what is left of the cooldown so the host
+      can say when rather than only no. */
+  | TooSoon(Reventless.Duration.t)
+  /** Nothing open to send again. */
+  | NothingOpen
+
+/**
+A deliberate "send it again". The same secret goes out rather than a fresh one,
+so a link already sitting in a mailbox keeps working — minting a new one would
+invalidate the message the person is looking at while they read it.
+*/
+let onResendRequested = (
+  ~contact: ContactVerification.contact,
+  ~existing: option<challenge>,
+  ~now: Reventless.DateTime.t,
+  ~policy: ContactVerification.policy,
+): resend =>
+  switch existing {
+  | None => NothingOpen
+  | Some(c) =>
+    if c.contact != contact || c.settled || hasExpired(c, ~now, ~policy) {
+      NothingOpen
+    } else {
+      let waited = elapsedSeconds(~from=c.issuedAt, ~to_=now)
+      waited >= policy.resendCooldown ? Send : TooSoon(policy.resendCooldown - waited)
+    }
+  }

package/src/ContactVerification_Guards.res.mjs

@@ -0,0 +1,97 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as DateTime$Reventless from "@reventlessdev/reventless-spec/src/semantic/DateTime.res.mjs";
+
+function contactToVerify(v) {
+  if (Primitive_object.equal(v.verifiedAddress, v.contact)) {
+    return;
+  } else {
+    return v.contact;
+  }
+}
+
+function elapsedSeconds(from, to_) {
+  return (DateTime$Reventless.millis(to_) - DateTime$Reventless.millis(from)) / 1000 | 0;
+}
+
+function hasExpired(c, now, policy) {
+  return elapsedSeconds(c.issuedAt, now) >= policy.tokenTtl;
+}
+
+function onProofPresented(c, hostContact, proofMatches, now, policy) {
+  if (Stdlib_Option.mapOr(hostContact, false, held => Primitive_object.notequal(c.contact, held))) {
+    return {
+      TAG: "Refuse",
+      _0: "AddressSuperseded"
+    };
+  } else if (c.settled) {
+    return {
+      TAG: "Refuse",
+      _0: "AlreadySettled"
+    };
+  } else if (hasExpired(c, now, policy)) {
+    return {
+      TAG: "Refuse",
+      _0: "ChallengeExpired"
+    };
+  } else if (c.attempts >= policy.maxAttempts) {
+    return {
+      TAG: "Refuse",
+      _0: "AttemptsExhausted"
+    };
+  } else if (proofMatches) {
+    return "Settle";
+  } else {
+    return {
+      TAG: "Refuse",
+      _0: "ProofMismatch"
+    };
+  }
+}
+
+function onVerifiedReport(v, contact) {
+  if (Primitive_object.notequal(contact, v.contact) || Primitive_object.equal(v.verifiedAddress, contact)) {
+    return "Ignore";
+  } else {
+    return "Append";
+  }
+}
+
+function onIssueRequested(contact, existing, now, policy) {
+  if (existing !== undefined && Primitive_object.equal(existing.contact, contact) && !existing.settled && !hasExpired(existing, now, policy)) {
+    return "AlreadyOpen";
+  } else {
+    return "Issue";
+  }
+}
+
+function onResendRequested(contact, existing, now, policy) {
+  if (existing === undefined) {
+    return "NothingOpen";
+  }
+  if (Primitive_object.notequal(existing.contact, contact) || existing.settled || hasExpired(existing, now, policy)) {
+    return "NothingOpen";
+  }
+  let waited = elapsedSeconds(existing.issuedAt, now);
+  if (waited >= policy.resendCooldown) {
+    return "Send";
+  } else {
+    return {
+      TAG: "TooSoon",
+      _0: policy.resendCooldown - waited | 0
+    };
+  }
+}
+
+export {
+  contactToVerify,
+  elapsedSeconds,
+  hasExpired,
+  onProofPresented,
+  onVerifiedReport,
+  onIssueRequested,
+  onResendRequested,
+}
+/* DateTime-Reventless Not a pure module */

package/src/Customer/Aggregate/Customer.res

@@ -44,6 +44,15 @@ type command =
   // Spliced from the trait, `@noApi` and all: the exclusion is recorded on each
   // member, so it survives the spread and neither is published.
   | ...TraitAddressGeocoding.AddressGeocoding.reportCommands
+  // The verification graft's report back. `@noApi` for the same reason
+  // `SetLocation` is: a client never asserts that an address was proven — it
+  // presents a secret to the slice that issued one, and the slice reports the
+  // verdict here. A public command would let a caller mark any address verified,
+  // which is the whole property being protected.
+  //
+  // Carries the address it is a verdict about, so a verdict for an address the
+  // customer has since changed can be dropped rather than applied.
+  | @noApi MarkEmailVerified({email: string})
   | Deactivate
   // The way back. Deactivation withdraws a customer from ordinary use; it does
   // not erase them, so restoring one needs no payload — the profile is still in
@@ -60,6 +69,10 @@ type event =
   // They are matched unqualified below and in the projections, and sury splices
   // the schema flat, so the wire format is what hand-written arms produced.
   | ...TraitAddressGeocoding.AddressGeocoding.events
+  // Names the address that was proven, not just that one was. `EmailUpdated`
+  // drops it again, which is what keeps "is this address proven?" decidable
+  // instead of assumed.
+  | EmailVerified({email: string})
   | Deactivated
   | Reactivated
 
@@ -109,6 +122,10 @@ let commandTransition = (command: command): Reventless.Transition.t<lifecycleSta
   // geocode landing after deactivation returns `Ok([])` rather than refusing, so
   // it does not park a TODO row in Failed forever.
   | SetLocation(_) | MarkAddressUnresolvable(_) => Unrestricted
+  // Legal in every state for the same reason: a proof settled while the customer
+  // was being deactivated returns `Ok([])` rather than refusing, so the slice
+  // that reported it does not retry forever against a state it cannot change.
+  | MarkEmailVerified(_) => Unrestricted
   | Deactivate => Moves([Customers.Active], Customers.Deactivated)
   // Works because the view's retirement IS a state of its lifecycle rather than
   // a boolean beside one, so the states a command names and the states a row can

package/src/Customer/Aggregate/Customer.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Sury from "sury";
+import * as Api$ReventlessInfra from "@reventlessdev/reventless-infra/src/components/Api.res.mjs";
 import * as AddressGeocoding$TraitAddressGeocoding from "@reventlessdev/trait-address-geocoding/src/AddressGeocoding.res.mjs";
 
 let commandSchema = Sury.union([
@@ -13,6 +14,10 @@ let commandSchema = Sury.union([
     TAG: "UpdateEmail",
     email: s.m(Sury.string)
   })),
+  Sury.$schema(s => ({
+    TAG: "MarkEmailVerified",
+    email: s.m(Sury.string)
+  })),
   Sury.literal("Deactivate"),
   Sury.literal("Reactivate")
 ].concat(AddressGeocoding$TraitAddressGeocoding.addressCommandsSchema.type === "anyOf" ? AddressGeocoding$TraitAddressGeocoding.addressCommandsSchema.anyOf : [AddressGeocoding$TraitAddressGeocoding.addressCommandsSchema]).concat(AddressGeocoding$TraitAddressGeocoding.reportCommandsSchema.type === "anyOf" ? AddressGeocoding$TraitAddressGeocoding.reportCommandsSchema.anyOf : [AddressGeocoding$TraitAddressGeocoding.reportCommandsSchema]));
@@ -27,6 +32,10 @@ let eventSchema = Sury.union([
     TAG: "EmailUpdated",
     email: s.m(Sury.string)
   })),
+  Sury.$schema(s => ({
+    TAG: "EmailVerified",
+    email: s.m(Sury.string)
+  })),
   Sury.literal("Deactivated"),
   Sury.literal("Reactivated")
 ].concat(AddressGeocoding$TraitAddressGeocoding.eventsSchema.type === "anyOf" ? AddressGeocoding$TraitAddressGeocoding.eventsSchema.anyOf : [AddressGeocoding$TraitAddressGeocoding.eventsSchema]));
@@ -61,6 +70,7 @@ function commandTransition(command) {
       };
     case "SetLocation" :
     case "MarkAddressUnresolvable" :
+    case "MarkEmailVerified" :
       return "Unrestricted";
     default:
       return {
@@ -72,6 +82,8 @@ function commandTransition(command) {
 
 let traits = [AddressGeocoding$TraitAddressGeocoding.declaration];
 
+let commandSchema$1 = Api$ReventlessInfra.markNoApiVariants(commandSchema, ["MarkEmailVerified"]);
+
 function commandAuthorization(param) {
   return "AllowAuthenticated";
 }
@@ -85,11 +97,11 @@ let moduleUrl = "@reventlessdev/online-shop-hybrid-ordering/src/Customer/Aggrega
 export {
   name,
   Id,
-  commandSchema,
   eventSchema,
   errorSchema,
   commandTransition,
   traits,
+  commandSchema$1 as commandSchema,
   moduleUrl,
   commandAuthorization,
 }