@reventlessdev/online-shop-hybrid-ordering 1.0.0-alpha.299 → 1.0.0-alpha.301

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.301 (2026-10-30)
+
+### Features
+
+* **examples:** the customer's email and address are marked personal data ([768e985](https://github.com/ReventlessDev/reventless-core/commit/768e9853c4943eaad8926b9cb4df55e2a54f4fa8))
+* **trait-address-geocoding:** the address is personal data ([865d811](https://github.com/ReventlessDev/reventless-core/commit/865d811b0dc801a32d7f9de3a50e7a5089a13b48))
+
+
+# 1.0.0-alpha.300 (2026-10-30)
+
+**Note:** Version bump only for package @reventlessdev/online-shop-hybrid-ordering
+
+
+
+
+
 # 1.0.0-alpha.299 (2026-10-30)
 
 **Note:** Version bump only for package @reventlessdev/online-shop-hybrid-ordering

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/online-shop-hybrid-ordering",
-  "version": "1.0.0-alpha.299",
+  "version": "1.0.0-alpha.301",
   "description": "Online Shop Hybrid example — Ordering plugin (Customer aggregate + Order/CatalogProduct DCB)",
   "license": "Apache-2.0",
   "jest": {
@@ -21,15 +21,15 @@
   },
   "dependencies": {
     "sury": "11.0.0",
-    "@reventlessdev/online-shop-hybrid-catalog-spec": "1.0.0-alpha.184",
-    "@reventlessdev/online-shop-hybrid-ordering-spec": "1.0.0-alpha.183",
+    "@reventlessdev/online-shop-hybrid-ordering-spec": "1.0.0-alpha.185",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.269",
+    "@reventlessdev/online-shop-hybrid-catalog-spec": "1.0.0-alpha.186",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.267",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.216",
-    "@reventlessdev/reventless-local": "3.0.0-alpha.310",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.187",
-    "@reventlessdev/trait-address-geocoding": "1.0.0-alpha.69",
-    "@reventlessdev/trait-notification": "1.0.0-alpha.69"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.218",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.189",
+    "@reventlessdev/reventless-local": "3.0.0-alpha.312",
+    "@reventlessdev/trait-notification": "1.0.0-alpha.71",
+    "@reventlessdev/trait-address-geocoding": "1.0.0-alpha.71"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Customer/Aggregate/Customer.res

@@ -27,8 +27,8 @@ module Id = CustomerId
 // wins. That is the whole reason `resolvedFrom` exists.
 @schema
 type command =
-  | Register({email: string, address: string})
-  | UpdateEmail({email: string})
+  | Register({@pii email: string, @pii address: string})
+  | UpdateEmail({@pii email: string})
   // The two public address commands, spliced from the trait: `UpdateAddress` and
   // `SetAddressLocation`. They stayed hand-written here for as long as their
   // lifecycle guard had to live on the constructor; `commandTransition` below
@@ -54,7 +54,7 @@ type command =
   //
   // Carries the address it is a verdict about, so a verdict for an address the
   // customer has since changed can be dropped rather than applied.
-  | @noApi MarkEmailVerified({email: string})
+  | @noApi MarkEmailVerified({@pii email: string})
   | Deactivate
   // The way back. Deactivation withdraws a customer from ordinary use; it does
   // not erase them, so restoring one needs no payload — the profile is still in
@@ -64,8 +64,8 @@ type command =
 
 @schema
 type event =
-  | Registered({email: string, address: string})
-  | EmailUpdated({email: string})
+  | Registered({@pii email: string, @pii address: string})
+  | EmailUpdated({@pii email: string})
   // The geocoding graft's four facts, spliced from the trait rather than copied:
   // `AddressUpdated`, `LocationSet`, `AddressLocated`, `AddressUnresolvable`.
   // They are matched unqualified below and in the projections, and sury splices
@@ -74,7 +74,7 @@ type event =
   // Names the address that was proven, not just that one was. `EmailUpdated`
   // drops it again, which is what keeps "is this address proven?" decidable
   // instead of assumed.
-  | EmailVerified({email: string})
+  | EmailVerified({@pii email: string})
   | Deactivated
   | Reactivated
 

package/src/Customer/Aggregate/Customer.res.mjs

@@ -1,22 +1,23 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Sury from "sury";
+import * as Pii$Reventless from "@reventlessdev/reventless-spec/src/components/Pii.res.mjs";
 import * as Api$ReventlessInfra from "@reventlessdev/reventless-infra/src/components/Api.res.mjs";
 import * as AddressGeocoding$TraitAddressGeocoding from "@reventlessdev/trait-address-geocoding/src/AddressGeocoding.res.mjs";
 
 let commandSchema = Sury.union([
   Sury.$schema(s => ({
     TAG: "Register",
-    email: s.m(Sury.string),
-    address: s.m(Sury.string)
+    email: s.m(Pii$Reventless.mark("$stream", undefined, Sury.string)),
+    address: s.m(Pii$Reventless.mark("$stream", undefined, Sury.string))
   })),
   Sury.$schema(s => ({
     TAG: "UpdateEmail",
-    email: s.m(Sury.string)
+    email: s.m(Pii$Reventless.mark("$stream", undefined, Sury.string))
   })),
   Sury.$schema(s => ({
     TAG: "MarkEmailVerified",
-    email: s.m(Sury.string)
+    email: s.m(Pii$Reventless.mark("$stream", undefined, Sury.string))
   })),
   Sury.literal("Deactivate"),
   Sury.literal("Reactivate")
@@ -25,16 +26,16 @@ let commandSchema = Sury.union([
 let eventSchema = Sury.union([
   Sury.$schema(s => ({
     TAG: "Registered",
-    email: s.m(Sury.string),
-    address: s.m(Sury.string)
+    email: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string)),
+    address: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string))
   })),
   Sury.$schema(s => ({
     TAG: "EmailUpdated",
-    email: s.m(Sury.string)
+    email: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string))
   })),
   Sury.$schema(s => ({
     TAG: "EmailVerified",
-    email: s.m(Sury.string)
+    email: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string))
   })),
   Sury.literal("Deactivated"),
   Sury.literal("Reactivated")

package/src/Customer/Aggregate/Customer_Decision.res

@@ -48,29 +48,54 @@ let initialState = NotCreated
 
 let evolve = (state, event) =>
   switch (state, event) {
+  // A personal field reads `Erased` once its customer is erased; the state then
+  // holds nothing in its place, as a profile never written would.
   | (NotCreated, Registered({email, address})) =>
-    Active({email, address, location: None, locationResolvedFrom: None, verifiedEmail: None})
-  | (Active(s), Registered({email, address})) => Active({...s, email, address})
+    Active({
+      email: email->Reventless.Pii.getOr(""),
+      address: address->Reventless.Pii.getOr(""),
+      location: None,
+      locationResolvedFrom: None,
+      verifiedEmail: None,
+    })
+  | (Active(s), Registered({email, address})) =>
+    Active({
+      ...s,
+      email: email->Reventless.Pii.getOr(""),
+      address: address->Reventless.Pii.getOr(""),
+    })
   // 🚨 A new address is unproven, whatever was proven before. Dropping the token
   // here is the host half of the staleness guard: without it a proof issued for
   // the old address would settle against the new one, which is exactly the
   // "change the address, then present the old link" takeover.
-  | (Active(s), EmailUpdated({email})) => Active({...s, email, verifiedEmail: None})
-  | (Active(s), EmailVerified({email})) => Active({...s, verifiedEmail: Some(email)})
+  | (Active(s), EmailUpdated({email})) =>
+    Active({...s, email: email->Reventless.Pii.getOr(""), verifiedEmail: None})
+  | (Active(s), EmailVerified({email})) =>
+    Active({...s, verifiedEmail: email->Reventless.Pii.toOption})
   // A new address invalidates whatever was known about the old one — dropping
   // both is what puts the row back in front of the geocoding slice.
   | (Active(s), AddressUpdated({address})) =>
-    Active({...s, address, location: None, locationResolvedFrom: None})
+    Active({
+      ...s,
+      address: address->Reventless.Pii.getOr(""),
+      location: None,
+      locationResolvedFrom: None,
+    })
   | (Active(s), LocationSet({location, resolvedFrom})) =>
-    Active({...s, location: Some(location), locationResolvedFrom: Some(resolvedFrom)})
+    Active({
+      ...s,
+      location: Some(location),
+      locationResolvedFrom: resolvedFrom->Reventless.Pii.toOption,
+    })
   // Both halves at once, from a client. `locationResolvedFrom` is the address
   // itself: the caller supplied the pair, so there is nothing left to resolve.
   | (Active(s), AddressLocated({address, location})) =>
+    let address = address->Reventless.Pii.getOr("")
     Active({...s, address, location: Some(location), locationResolvedFrom: Some(address)})
   // Tried, and no usable answer. Recording the address keeps the slice from
   // handing it back for another round.
   | (Active(s), AddressUnresolvable({address})) =>
-    Active({...s, location: None, locationResolvedFrom: Some(address)})
+    Active({...s, location: None, locationResolvedFrom: address->Reventless.Pii.toOption})
   | (
       Active({email, address, location, locationResolvedFrom, verifiedEmail}),
       Customer.Deactivated,
@@ -116,7 +141,8 @@ let verified = (verdict, event) =>
 
 let decide = (state, command) =>
   switch (state, command) {
-  | (NotCreated, Register({email, address})) => Ok([Registered({email, address})])
+  | (NotCreated, Register({email, address})) =>
+    Ok([Registered({email: Value(email), address: Value(address)})])
   | (NotCreated, UpdateEmail(_)) => Error(CustomerNotFound)
   | (NotCreated, UpdateAddress(_)) => Error(CustomerNotFound)
   | (NotCreated, SetAddressLocation(_)) => Error(CustomerNotFound)
@@ -128,32 +154,32 @@ let decide = (state, command) =>
 
   | (Active(_), Register(_)) => Error(CustomerAlreadyRegistered)
   | (Active(s), UpdateEmail({email})) if email == s.email => Ok([])
-  | (Active(_), UpdateEmail({email})) => Ok([EmailUpdated({email: email})])
+  | (Active(_), UpdateEmail({email})) => Ok([EmailUpdated({email: Value(email)})])
   | (Active(s), UpdateAddress({address})) =>
     Guards.onSubjectUpdate(
       resolution(s.address, s.location, s.locationResolvedFrom),
       ~subject=address,
-    )->appended(AddressUpdated({address: address}))
+    )->appended(AddressUpdated({address: Value(address)}))
 
   | (Active(s), SetAddressLocation({address, location})) =>
     Guards.onSuppliedPair(
       resolution(s.address, s.location, s.locationResolvedFrom),
       ~subject=address,
       ~location,
-    )->appended(AddressLocated({address, location}))
+    )->appended(AddressLocated({address: Value(address), location}))
 
   | (Active(s), SetLocation({location, resolvedFrom})) =>
     Guards.onLocationReport(
       resolution(s.address, s.location, s.locationResolvedFrom),
       ~location,
       ~resolvedFrom,
-    )->appended(LocationSet({location, resolvedFrom}))
+    )->appended(LocationSet({location, resolvedFrom: Value(resolvedFrom)}))
 
   | (Active(s), MarkAddressUnresolvable({address, reason})) =>
     Guards.onUnresolvableReport(
       resolution(s.address, s.location, s.locationResolvedFrom),
       ~subject=address,
-    )->appended(AddressUnresolvable({address, reason}))
+    )->appended(AddressUnresolvable({address: Value(address), reason}))
 
   // 🚨 The security control at the host boundary. A verdict naming an address
   // the customer has since changed is dropped rather than applied — and it is
@@ -164,7 +190,7 @@ let decide = (state, command) =>
     Verification.onVerifiedReport(
       verification(s.email, s.verifiedEmail),
       ~contact=ByEmail(email),
-    )->verified(EmailVerified({email: email}))
+    )->verified(EmailVerified({email: Value(email)}))
 
   | (Active(_), Deactivate) => Ok([Customer.Deactivated])
   // Already where the caller is asking it to be.

package/src/Customer/Aggregate/Customer_Decision.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Sury from "sury";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pii$Reventless from "@reventlessdev/reventless-spec/src/components/Pii.res.mjs";
 import * as GeoPoint$Reventless from "@reventlessdev/reventless-spec/src/semantic/GeoPoint.res.mjs";
 import * as ContactVerification_Guards$OrderingPlugin from "../../ContactVerification_Guards.res.mjs";
 import * as AddressGeocoding_Guards$TraitAddressGeocoding from "@reventlessdev/trait-address-geocoding/src/AddressGeocoding_Guards.res.mjs";
@@ -33,8 +34,8 @@ function evolve(state, event) {
     } else {
       return {
         TAG: "Active",
-        email: event.email,
-        address: event.address,
+        email: Pii$Reventless.getOr(event.email, ""),
+        address: Pii$Reventless.getOr(event.address, ""),
         location: undefined,
         locationResolvedFrom: undefined,
         verifiedEmail: undefined
@@ -73,8 +74,8 @@ function evolve(state, event) {
     case "Registered" :
       return {
         TAG: "Active",
-        email: event.email,
-        address: event.address,
+        email: Pii$Reventless.getOr(event.email, ""),
+        address: Pii$Reventless.getOr(event.address, ""),
         location: state.location,
         locationResolvedFrom: state.locationResolvedFrom,
         verifiedEmail: state.verifiedEmail
@@ -82,7 +83,7 @@ function evolve(state, event) {
     case "EmailUpdated" :
       return {
         TAG: "Active",
-        email: event.email,
+        email: Pii$Reventless.getOr(event.email, ""),
         address: state.address,
         location: state.location,
         locationResolvedFrom: state.locationResolvedFrom,
@@ -92,7 +93,7 @@ function evolve(state, event) {
       return {
         TAG: "Active",
         email: state.email,
-        address: event.address,
+        address: Pii$Reventless.getOr(event.address, ""),
         location: undefined,
         locationResolvedFrom: undefined,
         verifiedEmail: state.verifiedEmail
@@ -103,11 +104,11 @@ function evolve(state, event) {
         email: state.email,
         address: state.address,
         location: event.location,
-        locationResolvedFrom: event.resolvedFrom,
+        locationResolvedFrom: Pii$Reventless.toOption(event.resolvedFrom),
         verifiedEmail: state.verifiedEmail
       };
     case "AddressLocated" :
-      let address = event.address;
+      let address = Pii$Reventless.getOr(event.address, "");
       return {
         TAG: "Active",
         email: state.email,
@@ -122,7 +123,7 @@ function evolve(state, event) {
         email: state.email,
         address: state.address,
         location: undefined,
-        locationResolvedFrom: event.address,
+        locationResolvedFrom: Pii$Reventless.toOption(event.address),
         verifiedEmail: state.verifiedEmail
       };
     case "EmailVerified" :
@@ -132,7 +133,7 @@ function evolve(state, event) {
         address: state.address,
         location: state.location,
         locationResolvedFrom: state.locationResolvedFrom,
-        verifiedEmail: event.email
+        verifiedEmail: Pii$Reventless.toOption(event.email)
       };
   }
 }
@@ -198,8 +199,14 @@ function decide(state, command) {
         TAG: "Ok",
         _0: [{
             TAG: "Registered",
-            email: command.email,
-            address: command.address
+            email: {
+              TAG: "Value",
+              _0: command.email
+            },
+            address: {
+              TAG: "Value",
+              _0: command.address
+            }
           }]
       };
     }
@@ -236,7 +243,10 @@ function decide(state, command) {
             TAG: "Ok",
             _0: [{
                 TAG: "EmailUpdated",
-                email: email
+                email: {
+                  TAG: "Value",
+                  _0: email
+                }
               }]
           };
         }
@@ -248,7 +258,10 @@ function decide(state, command) {
           resolvedFrom: state.locationResolvedFrom
         }, address), {
           TAG: "AddressUpdated",
-          address: address
+          address: {
+            TAG: "Value",
+            _0: address
+          }
         });
       case "SetAddressLocation" :
         let location = command.location;
@@ -259,7 +272,10 @@ function decide(state, command) {
           resolvedFrom: state.locationResolvedFrom
         }, address$1, location), {
           TAG: "AddressLocated",
-          address: address$1,
+          address: {
+            TAG: "Value",
+            _0: address$1
+          },
           location: location
         });
       case "SetLocation" :
@@ -272,7 +288,10 @@ function decide(state, command) {
         }, location$1, resolvedFrom), {
           TAG: "LocationSet",
           location: location$1,
-          resolvedFrom: resolvedFrom
+          resolvedFrom: {
+            TAG: "Value",
+            _0: resolvedFrom
+          }
         });
       case "MarkAddressUnresolvable" :
         let address$2 = command.address;
@@ -282,7 +301,10 @@ function decide(state, command) {
           resolvedFrom: state.locationResolvedFrom
         }, address$2), {
           TAG: "AddressUnresolvable",
-          address: address$2,
+          address: {
+            TAG: "Value",
+            _0: address$2
+          },
           reason: command.reason
         });
       case "MarkEmailVerified" :
@@ -292,7 +314,10 @@ function decide(state, command) {
           _0: email$1
         }), {
           TAG: "EmailVerified",
-          email: email$1
+          email: {
+            TAG: "Value",
+            _0: email$1
+          }
         });
     }
   } else {

package/src/Customer/OutboundTranslation/GeocodeCustomerAddress.res

@@ -12,11 +12,11 @@
 // and the conformance suite asserts that this set is no wider than `collect`.
 @schema
 type consumedEvent =
-  | Registered({email: string, address: string})
-  | AddressUpdated({address: string})
+  | Registered({@pii email: string, @pii address: string})
+  | AddressUpdated({@pii address: string})
 
 @schema
-type outboundItem = {customerId: string, address: string}
+type outboundItem = {customerId: string, @pii("customerId") address: string}
 
 @schema
 type inboundCommand =

package/src/Customer/OutboundTranslation/GeocodeCustomerAddress.res.mjs

@@ -1,24 +1,25 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Sury from "sury";
+import * as Pii$Reventless from "@reventlessdev/reventless-spec/src/components/Pii.res.mjs";
 import * as GeoPoint$Reventless from "@reventlessdev/reventless-spec/src/semantic/GeoPoint.res.mjs";
 import * as AddressGeocoding$TraitAddressGeocoding from "@reventlessdev/trait-address-geocoding/src/AddressGeocoding.res.mjs";
 
 let consumedEventSchema = Sury.union([
   Sury.$schema(s => ({
     TAG: "Registered",
-    email: s.m(Sury.string),
-    address: s.m(Sury.string)
+    email: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string)),
+    address: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string))
   })),
   Sury.$schema(s => ({
     TAG: "AddressUpdated",
-    address: s.m(Sury.string)
+    address: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string))
   }))
 ]);
 
 let outboundItemSchema = Sury.$schema(s => ({
   customerId: s.m(Sury.string),
-  address: s.m(Sury.string)
+  address: s.m(Pii$Reventless.mark("customerId", undefined, Sury.string))
 }));
 
 let inboundCommandSchema = Sury.union([

package/src/Customer/OutboundTranslation/GeocodeCustomerAddress_Translation.res

@@ -5,8 +5,15 @@
 // which an aggregate's event payload does not repeat.
 let collect = (event, ~sourceId) =>
   switch event {
-  | Registered({address}) => [(`${sourceId}:${address}`, {customerId: sourceId, address})]
-  | AddressUpdated({address}) => [(`${sourceId}:${address}`, {customerId: sourceId, address})]
+  | Registered({address: Value(address)}) => [
+      (`${sourceId}:${address}`, {customerId: sourceId, address}),
+    ]
+  // An erased customer is owed nothing.
+  | Registered(_) => []
+  | AddressUpdated({address: Value(address)}) => [
+      (`${sourceId}:${address}`, {customerId: sourceId, address}),
+    ]
+  | AddressUpdated(_) => []
   }
 
 // Asking the geocoder and reading its answer are the trait's — including the

package/src/Customer/OutboundTranslation/GeocodeCustomerAddress_Translation.res.mjs

@@ -6,20 +6,36 @@ import * as AddressGeocoding_Translate$TraitAddressGeocoding from "@reventlessde
 function collect(event, sourceId) {
   if (event.TAG === "Registered") {
     let address = event.address;
+    if (typeof address !== "object") {
+      if (address === "Erased") {
+        return [];
+      } else {
+        return [];
+      }
+    }
+    let address$1 = address._0;
     return [[
-        sourceId + `:` + address,
+        sourceId + `:` + address$1,
         {
           customerId: sourceId,
-          address: address
+          address: address$1
         }
       ]];
   }
-  let address$1 = event.address;
+  let address$2 = event.address;
+  if (typeof address$2 !== "object") {
+    if (address$2 === "Erased") {
+      return [];
+    } else {
+      return [];
+    }
+  }
+  let address$3 = address$2._0;
   return [[
-      sourceId + `:` + address$1,
+      sourceId + `:` + address$3,
       {
         customerId: sourceId,
-        address: address$1
+        address: address$3
       }
     ]];
 }

package/src/Customer/OutboundTranslation/VerifyCustomerEmail.res

@@ -11,11 +11,11 @@
 // because a settled address owes nothing and the slice must not re-open it.
 @schema
 type consumedEvent =
-  | Registered({email: string, address: string})
-  | EmailUpdated({email: string})
+  | Registered({@pii email: string, @pii address: string})
+  | EmailUpdated({@pii email: string})
 
 @schema
-type outboundItem = {customerId: string, email: string}
+type outboundItem = {customerId: string, @pii("customerId") email: string}
 
 // Reported to the challenge ledger rather than to `Customer` — the aggregate
 // learns nothing until a proof settles. Mirrors that slice's command exactly.
@@ -23,7 +23,7 @@ type outboundItem = {customerId: string, email: string}
 type inboundCommand =
   | IssueEmailChallenge({
       customerId: CustomerId.t,
-      email: string,
+      @pii("customerId") email: string,
       purpose: string,
       proofHash: string,
       issuedAt: string,

package/src/Customer/OutboundTranslation/VerifyCustomerEmail.res.mjs

@@ -1,30 +1,31 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Sury from "sury";
+import * as Pii$Reventless from "@reventlessdev/reventless-spec/src/components/Pii.res.mjs";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as CustomerId$OrderingPlugin from "../CustomerId.res.mjs";
 
 let consumedEventSchema = Sury.union([
   Sury.$schema(s => ({
     TAG: "Registered",
-    email: s.m(Sury.string),
-    address: s.m(Sury.string)
+    email: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string)),
+    address: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string))
   })),
   Sury.$schema(s => ({
     TAG: "EmailUpdated",
-    email: s.m(Sury.string)
+    email: s.m(Pii$Reventless.marked("$stream", undefined, Sury.string))
   }))
 ]);
 
 let outboundItemSchema = Sury.$schema(s => ({
   customerId: s.m(Sury.string),
-  email: s.m(Sury.string)
+  email: s.m(Pii$Reventless.mark("customerId", undefined, Sury.string))
 }));
 
 let inboundCommandSchema = Sury.$schema(s => ({
   TAG: "IssueEmailChallenge",
   customerId: s.m(DcbTag$Reventless.mark(CustomerId$OrderingPlugin.schema)),
-  email: s.m(Sury.string),
+  email: s.m(Pii$Reventless.mark("customerId", undefined, Sury.string)),
   purpose: s.m(Sury.string),
   proofHash: s.m(Sury.string),
   issuedAt: s.m(Sury.string)

package/src/Customer/OutboundTranslation/VerifyCustomerEmail_Translation.res

@@ -7,8 +7,10 @@ module V = ContactVerification
 // reason. `~sourceId` is the entity id, which an aggregate's payload omits.
 let collect = (event, ~sourceId) =>
   switch event {
-  | Registered({email}) => [(`${sourceId}:${email}`, {customerId: sourceId, email})]
-  | EmailUpdated({email}) => [(`${sourceId}:${email}`, {customerId: sourceId, email})]
+  | Registered({email: Value(email)}) => [(`${sourceId}:${email}`, {customerId: sourceId, email})]
+  | EmailUpdated({email: Value(email)}) => [(`${sourceId}:${email}`, {customerId: sourceId, email})]
+  // An erased customer is owed nothing.
+  | Registered(_) | EmailUpdated(_) => []
   }
 
 let policy = V.emailPolicy

package/src/Customer/OutboundTranslation/VerifyCustomerEmail_Translation.res.mjs

@@ -8,20 +8,36 @@ import * as ContactVerification$OrderingPlugin from "../../ContactVerification.r
 function collect(event, sourceId) {
   if (event.TAG === "Registered") {
     let email = event.email;
+    if (typeof email !== "object") {
+      if (email === "Erased") {
+        return [];
+      } else {
+        return [];
+      }
+    }
+    let email$1 = email._0;
     return [[
-        sourceId + `:` + email,
+        sourceId + `:` + email$1,
         {
           customerId: sourceId,
-          email: email
+          email: email$1
         }
       ]];
   }
-  let email$1 = event.email;
+  let email$2 = event.email;
+  if (typeof email$2 !== "object") {
+    if (email$2 === "Erased") {
+      return [];
+    } else {
+      return [];
+    }
+  }
+  let email$3 = email$2._0;
   return [[
-      sourceId + `:` + email$1,
+      sourceId + `:` + email$3,
       {
         customerId: sourceId,
-        email: email$1
+        email: email$3
       }
     ]];
 }