@reventlessdev/reventless-spec 3.0.0-alpha.132 → 3.0.0-alpha.134

package/src/semantic/ImageRef.res

@@ -30,7 +30,6 @@ a field that declares no store.
     })
 ```
 */
-
 /** Transparent `string`; see `Email.t`. */
 type t = string
 
@@ -48,4 +47,5 @@ let fromString = (raw: string): result<t, string> => Media_Ref.check(~what="imag
 
 /** The sury schema for an image-reference field.
     Use with `@s.matches(Reventless.ImageRef.schema)`. */
-let schema: S.t<t> = S.string->Semantic.refined(~id=Semantic.Id.imageRef, ~check=fromString)
+let schema: S.t<t> =
+  S.string->Semantic.refined(~id=Semantic.Id.imageRef, ~check=fromString)

package/src/semantic/MemberRef.res

@@ -55,7 +55,6 @@ declares one there today: a view that carried a scalar *and* the set it was
 drawn from needed a marker saying the two were one thing, and a view whose
 primary is simply the first member has no second field to reconcile.
 */
-
 /** Transparent `string`, as every ref-shaped semantic here is: the marker
     refines an existing field rather than replacing it, so nothing stored
     changes when a field adopts it. */

package/src/semantic/Messaging.res

@@ -11,23 +11,75 @@ A `(channel, address)` pair can be built wrong: `Sms` beside an email address
 compiles and fails at the provider. `recipient` fuses them, so the wrong pair
 does not exist, and the channel is read back off the value that carries it.
 */
+/**
+A delivery route. The selector a recipient chooses per notification kind.
 
-/** A delivery route. The selector a recipient chooses per notification kind, and
-    the granularity a platform provisions at. */
+Three arms, and push stays one of them even though it is provisioned three ways.
+Splitting it would offer a person a choice between notification services, which is
+not a choice anyone has: an app knows its own token, and nobody prefers APNs. The
+service-level discrimination lives on the address and on what a provider
+publishes — see `pushService`.
+*/
 type channel =
   | Email
   | Sms
   | Push
 
+/**
+How a push service names one install.
+
+A variant rather than a string because the shapes differ: two services issue an
+opaque token, and Web Push issues a subscription whose encryption keys are part of
+the address. This applies the rule the file opens with one level down — the wrong
+(service, address) pair stops being constructible for the same reason the wrong
+(channel, address) pair already is.
+*/
+type pushAddress =
+  | Apns({deviceToken: string})
+  | Fcm({registrationToken: string})
+  /** The endpoint is where it goes; the keys are how it is sealed. Requiring them
+        here keeps an unsendable subscription unconstructible. */
+  | WebPush({endpoint: string, p256dh: string, auth: string})
+
+/**
+Which service issued an address — the granularity push is provisioned at.
+
+Email needs no such type: one sender provisioning reaches every mailbox, because
+SMTP routes off the address. Push has no routing layer, so which service can reach
+a device is fixed by which credential the deployment holds, and there is nothing
+in the address to route on.
+*/
+type pushService =
+  /** Apple Push Notification service. Provisioned with a signing key, the team id
+        that issued it and the app's bundle id. */
+  | ApnsService
+  /** Firebase Cloud Messaging, Google's. Provisioned with one service-account
+        credential. */
+  | FcmService
+  /** Standardised rather than vendor-run: the endpoint the browser hands out is
+        itself the service, so one VAPID keypair provisions all of them. */
+  | WebPushService
+
 /** An addressed recipient: the channel and the address it needs, inseparable.
-    Each address is the branded scalar for its channel, so an unparseable one is
-    refused where it is built rather than by the provider. */
+    Email and SMS carry the branded scalar for their channel, so an unparseable one
+    is refused where it is built rather than by the provider; push carries the
+    variant its services issue, and the same property holds by construction. */
 type recipient =
   | ToEmail(Email.t)
   | ToSms(Phone.t)
-  | /** The token the device registered with the push service. Opaque and
-        provider-shaped — unlike an address, nobody else has a grammar for it. */
-  ToPush({deviceToken: string})
+  /** How one install is reached. Not a bare string: the two token services and
+        Web Push do not share a shape, and Web Push is not opaque. */
+  | ToPush(pushAddress)
+
+/** The service that issued a push address. What a provider's published list is
+    checked against, so a token is never handed to the service that cannot use
+    it. */
+let serviceOf = (address: pushAddress): pushService =>
+  switch address {
+  | Apns(_) => ApnsService
+  | Fcm(_) => FcmService
+  | WebPush(_) => WebPushService
+  }
 
 /** The channel a recipient is addressed on. */
 let channelOf = (recipient: recipient): channel =>
@@ -45,6 +97,15 @@ let channelToString = (channel: channel): string =>
   | Push => "Push"
   }
 
+/** The service's name as its own documentation spells it, because that is the
+    word a support conversation about a missing notification is conducted with. */
+let pushServiceToString = (service: pushService): string =>
+  switch service {
+  | ApnsService => "APNs"
+  | FcmService => "FCM"
+  | WebPushService => "Web Push"
+  }
+
 /**
 The `From:` header a deployment's email sender presents as: the bare address, or
 a display name in front of it.
@@ -87,20 +148,28 @@ type receipt = {ref: string}
 /**
 Why a send produced no receipt.
 
-Three constructors because the retry decision turns on the distinction, and
-getting it wrong is expensive in both directions: retrying a refused address
-burns the budget on an outcome that will not change, and abandoning a transient
-outage writes off a message that would have gone.
+The retry decision turns on the distinction, and getting it wrong is expensive in
+both directions: retrying a refused address burns the budget on an outcome that
+will not change, and abandoning a transient outage writes off a message that would
+have gone.
+
+Push needs its own refusal because it is provisioned per service. Once a
+deployment can provision *some* push, `UnsupportedChannel(Push)` would have to
+mean both "no push at all" and "not that service", and the two read the same to
+someone debugging a half-provisioned deployment.
 */
 type failure =
-  | /** The provider could not be reached, or refused the call. Retry. */
-  Unavailable(string)
-  | /** This deployment provisions nothing for this channel. Do not retry — no
+  /** The provider could not be reached, or refused the call. Retry. */
+  | Unavailable(string)
+  /** This deployment provisions nothing for this channel. Do not retry — no
         number of attempts provisions one. */
-  UnsupportedChannel(channel)
-  | /** The provider answered and will not take this message: an address it
+  | UnsupportedChannel(channel)
+  /** This deployment provisions push, but not the service that issued this
+        address. Do not retry — the device is reachable only through its own. */
+  | UnsupportedPushService(pushService)
+  /** The provider answered and will not take this message: an address it
         rejects, a recipient it suppresses. Do not retry. */
-  Refused(string)
+  | Refused(string)
 
 /** The retry rule, stated once. Everything that sweeps a failed send derives
     from it rather than re-reading the constructors. */
@@ -108,6 +177,7 @@ let retriable = (failure: failure): bool =>
   switch failure {
   | Unavailable(_) => true
   | UnsupportedChannel(_)
+  | UnsupportedPushService(_)
   | Refused(_) => false
   }
 
@@ -118,6 +188,8 @@ let failureReason = (failure: failure): string =>
   | Unavailable(reason) => reason
   | UnsupportedChannel(channel) =>
     `this deployment provisions no ${channel->channelToString} channel`
+  | UnsupportedPushService(service) =>
+    `this deployment provisions push, but not ${service->pushServiceToString}`
   | Refused(reason) => reason
   }
 
@@ -138,14 +210,62 @@ because discovering a channel by failing on it costs a real message.
 
 Empty means no channel at all — the shape `none` takes, and the one a deploy-time
 gate exists to catch before it ships.
+
+`pushServices` is the second answer, at the granularity push is actually
+provisioned at. Both are published because the two granularities differ: a
+preference centre reads `channels` because a person picks a channel, and `supports`
+reads `pushServices` because a token is only reachable through its own service.
+Build one through `makeProvider`, which derives the first from the second.
 */
 type provider = {
   channels: array<channel>,
+  pushServices: array<pushService>,
   send: send,
 }
 
-/** Whether this provider can attempt a recipient's channel at all. The check a
-    caller makes before spending a send, and the same rule the provider applies
-    internally, so the two cannot disagree. */
+/**
+Build a provider whose two published answers cannot disagree.
+
+`channels` is derived rather than given: `Push` appears exactly when a push service
+is behind it, so no transport can publish a channel with nothing to reach it on.
+The alternative is that invariant stated in a comment beside two independently
+written fields, which is where invariants go to die.
+
+`emailAndSms` carries the channels the channel itself settles reachability for. A
+`Push` passed there is dropped — `pushServices` is the only thing that provisions
+push — and the switch doing the dropping is exhaustive, so a fourth channel arrives
+here as a compile error rather than as a silent omission.
+*/
+let makeProvider = (
+  ~emailAndSms: array<channel>,
+  ~pushServices: array<pushService>,
+  ~send: send,
+): provider => {
+  channels: emailAndSms
+  ->Array.filter(channel =>
+    switch channel {
+    | Email
+    | Sms => true
+    | Push => false
+    }
+  )
+  ->Array.concat(pushServices->Array.length == 0 ? [] : [Push]),
+  pushServices,
+  send,
+}
+
+/**
+Whether this provider can attempt this recipient at all. The check a caller makes
+before spending a send, and the same rule the provider applies internally, so the
+two cannot disagree.
+
+Push is checked against the issuing service, not against the channel. Answering off
+`channels` would return `true` for an APNs token on a deployment that provisioned
+FCM only — and inferring a channel by failing on it is exactly what publishing the
+list exists to avoid, since a failed send costs a real message.
+*/
 let supports = (provider: provider, ~recipient: recipient): bool =>
-  provider.channels->Array.includes(recipient->channelOf)
+  switch recipient {
+  | ToPush(address) => provider.pushServices->Array.includes(address->serviceOf)
+  | recipient => provider.channels->Array.includes(recipient->channelOf)
+  }

package/src/semantic/Messaging.res.mjs

@@ -1,6 +1,17 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 
+function serviceOf(address) {
+  switch (address.TAG) {
+    case "Apns" :
+      return "ApnsService";
+    case "Fcm" :
+      return "FcmService";
+    case "WebPush" :
+      return "WebPushService";
+  }
+}
+
 function channelOf(recipient) {
   switch (recipient.TAG) {
     case "ToEmail" :
@@ -23,6 +34,17 @@ function channelToString(channel) {
   }
 }
 
+function pushServiceToString(service) {
+  switch (service) {
+    case "ApnsService" :
+      return "APNs";
+    case "FcmService" :
+      return "FCM";
+    case "WebPushService" :
+      return "Web Push";
+  }
+}
+
 function fromHeader(displayName, address) {
   if (displayName === undefined) {
     return address;
@@ -32,35 +54,56 @@ function fromHeader(displayName, address) {
 }
 
 function retriable(failure) {
-  switch (failure.TAG) {
-    case "Unavailable" :
-      return true;
-    case "UnsupportedChannel" :
-    case "Refused" :
-      return false;
-  }
+  return failure.TAG === "Unavailable";
 }
 
 function failureReason(failure) {
   switch (failure.TAG) {
     case "UnsupportedChannel" :
       return `this deployment provisions no ` + channelToString(failure._0) + ` channel`;
+    case "UnsupportedPushService" :
+      return `this deployment provisions push, but not ` + pushServiceToString(failure._0);
     case "Unavailable" :
     case "Refused" :
       return failure._0;
   }
 }
 
+function makeProvider(emailAndSms, pushServices, send) {
+  return {
+    channels: emailAndSms.filter(channel => {
+      switch (channel) {
+        case "Email" :
+        case "Sms" :
+          return true;
+        case "Push" :
+          return false;
+      }
+    }).concat(pushServices.length === 0 ? [] : ["Push"]),
+    pushServices: pushServices,
+    send: send
+  };
+}
+
 function supports(provider, recipient) {
-  return provider.channels.includes(channelOf(recipient));
+  switch (recipient.TAG) {
+    case "ToEmail" :
+    case "ToSms" :
+      return provider.channels.includes(channelOf(recipient));
+    case "ToPush" :
+      return provider.pushServices.includes(serviceOf(recipient._0));
+  }
 }
 
 export {
+  serviceOf,
   channelOf,
   channelToString,
+  pushServiceToString,
   fromHeader,
   retriable,
   failureReason,
+  makeProvider,
   supports,
 }
 /* No side effect */

package/src/semantic/Money.res

@@ -66,7 +66,6 @@ rewrites the wire shape, so stored events no longer decode and projections must
 be rebuilt. Retyping a field in a log that has to survive needs an upcaster
 first; a log that can be discarded can take it today.
 */
-
 /**
 Validate a minor-unit amount, saying why when it is not one.
 
@@ -79,8 +78,9 @@ let validateAmount = (amount: float): result<float, string> =>
   } else if amount !== Math.trunc(amount) {
     Error(
       `an amount is a whole number of a currency's minor units, got ` ++
-      `${Float.toString(amount)}. There is no such thing as a fraction of the ` ++
-      `smallest unit — a major amount converts with Money.ofMajor.`,
+      `${Float.toString(
+          amount,
+        )}. There is no such thing as a fraction of the ` ++ `smallest unit — a major amount converts with Money.ofMajor.`,
     )
   } else {
     Ok(amount)
@@ -96,14 +96,12 @@ let validateAmount = (amount: float): result<float, string> =>
     threw `Cannot access 'v0' before initialization` — it is simply not what this
     check wants.) */
 let amountSchema: S.t<float> =
-  S.float->S.refine(
-    amount =>
-      switch validateAmount(amount) {
-      | Ok(_) => true
-      | Error(_) => false
-      },
-    ~error="expected a monetary amount",
-  )
+  S.float->S.refine(amount =>
+    switch validateAmount(amount) {
+    | Ok(_) => true
+    | Error(_) => false
+    }
+  , ~error="expected a monetary amount")
 
 @schema
 type t = {
@@ -117,7 +115,8 @@ type t = {
 
     Shadows the schema sury-ppx derived from the type above: the derived one is
     the shape, and this adds the marker the shape cannot carry. */
-let schema: S.t<t> = schema->Semantic.mark(~id=Semantic.Id.money)
+let schema: S.t<t> =
+  schema->Semantic.mark(~id=Semantic.Id.money)
 
 /** An amount already counted in minor units. */
 let make = (~amount: float, ~currency: Currency.t): t => {amount, currency}
@@ -208,8 +207,9 @@ let add = (a: t, b: t): result<t, string> =>
   a.currency == b.currency
     ? Ok({amount: a.amount +. b.amount, currency: a.currency})
     : Error(
-        `cannot add ${format(b)} to ${format(a)}: they are different currencies. ` ++
-        `Converting between them needs a rate, which is not something an amount carries.`,
+        `cannot add ${format(b)} to ${format(
+            a,
+          )}: they are different currencies. ` ++ `Converting between them needs a rate, which is not something an amount carries.`,
       )
 
 /** The largest whole number a `float` holds exactly, 2^53 - 1. Bound here
@@ -266,8 +266,9 @@ A negative amount splits away from zero the same way: -€10.00 into three is
 let allocate = (m: t, ~into: int): result<array<t>, string> =>
   if into <= 0 {
     Error(
-      `cannot split ${format(m)} into ${Int.toString(into)} parts: ` ++
-      `a split is into at least one part.`,
+      `cannot split ${format(m)} into ${Int.toString(
+          into,
+        )} parts: ` ++ `a split is into at least one part.`,
     )
   } else {
     let parts = Int.toFloat(into)
@@ -293,8 +294,10 @@ let allocate = (m: t, ~into: int): result<array<t>, string> =>
 let sum = (amounts: array<t>): option<result<t, string>> =>
   switch amounts {
   | [] => None
-  | _ => Some(amounts->Array.reduce(Ok(zero(~currency=(amounts->Array.getUnsafe(0)).currency)), (
-      acc,
-      m,
-    ) => acc->Result.flatMap(total => add(total, m))))
+  | _ =>
+    Some(
+      amounts->Array.reduce(Ok(zero(~currency=(amounts->Array.getUnsafe(0)).currency)), (acc, m) =>
+        acc->Result.flatMap(total => add(total, m))
+      ),
+    )
   }

package/src/semantic/Offload.res

@@ -45,7 +45,6 @@ structure: @s.matches(Offload.optionSchema(~store="pluginStructures", pluginStru
   option<Offload.payload<pluginStructure>>
 ```
 */
-
 /** The reference an offloaded value carries: which store holds it, the
     content-addressed key, the content hash (== the key's basis), and the byte
     length. `hash` is redundant with `key` today (`key` is `sha256/<hash>`) but
@@ -75,7 +74,7 @@ Parameterised by the inner value's schema because the `Inline` arm round-trips
 through it. The `Offloaded` arm round-trips through `offloadedRefSchema` under the
 sentinel key. See the module doc for why this is untagged.
 */
-// Both arms are *declared* (`S.object` / `S.shape`) rather than hand-written as
+let // Both arms are *declared* (`S.object` / `S.shape`) rather than hand-written as
 // `S.transform` pairs, and that is load-bearing, not a style choice. A transform
 // arm is opaque: sury cannot see what it accepts, so it must offer every value to
 // the arm's own serializer and let it reject. Two things follow, both of which bit
@@ -89,7 +88,7 @@ sentinel key. See the module doc for why this is untagged.
 // A declared arm has neither problem: sury derives both directions from the shape,
 // discriminates on it, and never runs user code to find out. One transform arm is
 // enough to bring both failures back, so keep every arm declarative.
-let schema = (inner: S.t<'a>): S.t<payload<'a>> => {
+schema = (inner: S.t<'a>): S.t<payload<'a>> => {
   // Offloaded arm: an object carrying the reserved sentinel key, tried first so an
   // offloaded value is never mistaken for an inline one.
   let offloadedArm = S.object(s => Offloaded(s.field(sentinelKey, offloadedRefSchema)))
@@ -115,7 +114,10 @@ let forStore = (
   ~threshold: option<int>=?,
   inner: S.t<'a>,
 ): S.t<payload<'a>> =>
-  schema(inner)->Semantic.mark(~id=Semantic.Id.offload, ~payload=StoredIn({plugin, store, threshold}))
+  schema(inner)->Semantic.mark(
+    ~id=Semantic.Id.offload,
+    ~payload=StoredIn({plugin, store, threshold}),
+  )
 
 /**
 The codec wrapped for an **optional** field, plus the `StoredIn` marker. This is

package/src/semantic/Percent.res

@@ -13,7 +13,6 @@ fractions are allowed — `99.95` is a percentage.
 }
 ```
 */
-
 /** The percentage's representation. Transparent `float`: the marker refines an
     existing numeric field, so nothing stored changes. */
 type t = float
@@ -27,8 +26,9 @@ let fromFloat = (raw: float): result<t, string> =>
     Error(`a percentage must be a finite number, got ${Float.toString(raw)}`)
   } else if raw < 0.0 || raw > 100.0 {
     Error(
-      `a percentage runs from 0 to 100, got ${Float.toString(raw)}. ` ++
-      `This scale is 0–100, not 0–1 — a fraction multiplies by 100 first.`,
+      `a percentage runs from 0 to 100, got ${Float.toString(
+          raw,
+        )}. ` ++ `This scale is 0–100, not 0–1 — a fraction multiplies by 100 first.`,
     )
   } else {
     Ok(raw)

package/src/semantic/Phone.res

@@ -30,7 +30,6 @@ which is the E.164 limit. No spaces, no punctuation, no leading zero after the
     })
 ```
 */
-
 /** The number's representation. Transparent `string`; see `Email.t`. */
 type t = string
 

package/src/semantic/RowImage.res

@@ -23,11 +23,12 @@ Declaration order rather than a name rule: a view with two image fields has
 already said which one comes first, and guessing from names would let a field
 called `thumbnail` outrank the one the author put at the top.
 */
-
 /** Where the ref string sits, relative to the field that carries it. */
 type shape =
-  | /** The field's own value is the ref. */ Scalar
-  | /** The ref is one member of the field's record. */ Member(string)
+  /** The field's own value is the ref. */
+  | Scalar
+  /** The ref is one member of the field's record. */
+  | Member(string)
 
 type source = {
   field: string,

package/src/semantic/Semantic.res

@@ -9,7 +9,6 @@ semantic is a new value rather than a new branch.
 The payload is a typed variant because the vocabulary is framework-owned and
 closed — which also keeps `Reference.getTarget` total.
 */
-
 /** Which entity a reference field points to. */
 type referenceTarget = {entity: string, plugin: option<string>}
 
@@ -122,18 +121,16 @@ let mark = (schema: S.t<'a>, ~id: string, ~payload: payload=Plain): S.t<'a> =>
 
 /** A schema that validates with `check` and carries the semantic `id`, derived
     from the constructor so no second grammar can drift from it. */
-// sury's refiner takes a fixed message, so `check`'s per-value reason is lost
+let // sury's refiner takes a fixed message, so `check`'s per-value reason is lost
 // here; call the scalar's own `fromString`/`fromFloat` to report which rule broke.
-let refined = (base: S.t<'a>, ~id: string, ~check: 'a => result<'a, string>): S.t<'a> =>
+refined = (base: S.t<'a>, ~id: string, ~check: 'a => result<'a, string>): S.t<'a> =>
   base
-  ->S.refine(
-    value =>
-      switch check(value) {
-      | Ok(_) => true
-      | Error(_) => false
-      },
-    ~error=`expected a valid ${id}`,
-  )
+  ->S.refine(value =>
+    switch check(value) {
+    | Ok(_) => true
+    | Error(_) => false
+    }
+  , ~error=`expected a valid ${id}`)
   ->mark(~id)
 
 /** A value as it should read back to whoever typed it — rejection messages quote

package/src/semantic/StorageRef.res

@@ -50,7 +50,6 @@ wire format, or any stored value changing.
     })
 ```
 */
-
 /** The ref's representation. Transparent `string` on purpose: the marker refines
     an existing `string` field rather than replacing it, so the field's runtime
     representation — and therefore every stored event — is unchanged. A sealed
@@ -61,8 +60,7 @@ type t = string
 external unsafe: string => t = "%identity"
 external toString: t => string = "%identity"
 
-let segmentIsSafe = (segment: string) =>
-  segment !== "" && segment !== "." && segment !== ".."
+let segmentIsSafe = (segment: string) => segment !== "" && segment !== "." && segment !== ".."
 
 /**
 Validate a raw string as a storage ref, saying why when it is not one.
@@ -74,7 +72,9 @@ schema validation cannot drift apart.
 let fromString = (raw: string): result<t, string> =>
   if !String.startsWith(raw, "/") {
     Error(
-      `expected an origin-relative storage ref starting with "/", got ${raw->JSON.Encode.string->JSON.stringify}. External URLs and data: URIs are not storage refs.`,
+      `expected an origin-relative storage ref starting with "/", got ${raw
+        ->JSON.Encode.string
+        ->JSON.stringify}. External URLs and data: URIs are not storage refs.`,
     )
   } else if String.startsWith(raw, "//") {
     Error(`protocol-relative refs are not storage refs: ${raw}`)
@@ -94,7 +94,7 @@ The refinement a ref-holding field validates against, carrying no semantic yet.
 The `Uploadable*` types re-label this rather than restating the grammar, so a
 re-labelling cannot validate differently from what it re-labels.
 */
-// The empty string is admitted as the "no object" sentinel. The fields this
+let // The empty string is admitted as the "no object" sentinel. The fields this
 // marks are non-optional today, and a producer with nothing to reference —
 // a supplier feed carrying no image, say — already writes `""` to mean
 // absence. Rejecting it here would break a legitimate existing value and
@@ -107,16 +107,14 @@ re-labelling cannot validate differently from what it re-labels.
 // sury's refiner is a predicate with a fixed message, so the per-value reason
 // `fromString` returns is not threaded through; call `fromString` directly
 // when the caller needs to report which rule the value broke.
-let refinement: S.t<t> =
-  S.string->S.refine(
-    value =>
-      value === "" ||
-        switch fromString(value) {
-        | Ok(_) => true
-        | Error(_) => false
-        },
-    ~error=`expected an origin-relative storage ref: "/" followed by a prefix and an object path, or "" for no object`,
-  )
+refinement: S.t<t> =
+  S.string->S.refine(value =>
+    value === "" ||
+      switch fromString(value) {
+      | Ok(_) => true
+      | Error(_) => false
+      }
+  , ~error=`expected an origin-relative storage ref: "/" followed by a prefix and an object path, or "" for no object`)
 
 /**
 The sury schema for a field holding a ref into a named store.
@@ -139,8 +137,10 @@ let getStore = (schema: S.t<'a>): option<Semantic.storeTarget> =>
 
 /** How many refs one field holds. */
 type arity =
-  | /** A `string` field: one ref. */ Single
-  | /** An `array<string>` field: zero or more refs. */ Multiple
+  /** A `string` field: one ref. */
+  | Single
+  /** An `array<string>` field: zero or more refs. */
+  | Multiple
 
 /**
 The store a *field* declares, looking through an array wrapper, with the arity

package/src/semantic/Template.res

@@ -6,7 +6,6 @@ Grammar: `{{ path }}`, `{{ path | formatter }}`, `{{# if path }}…{{/ if }}` an
 evaluated, an unresolved path renders a visible placeholder rather than throwing,
 and a field the schema marks `@sensitive` is withheld.
 */
-
 /** A path into the payload, in **wire** field names. `text` is what was written,
     so a placeholder can name it. */
 type path = {text: string, relative: bool, segments: array<string>}
@@ -54,8 +53,7 @@ let parsePath = (raw: string, ~insideEach: bool): result<path, string> => {
       segments->Array.every(segment => segmentGrammar->RegExp.test(segment))
         ? Ok({text, relative, segments})
         : Error(
-            `"${text}" is not a path — segments are letters, digits and ` ++
-            `underscores, separated by dots`,
+            `"${text}" is not a path — segments are letters, digits and ` ++ `underscores, separated by dots`,
           )
     }
   }
@@ -268,10 +266,10 @@ let isWithheld = (schema: option<S.t<unknown>>): bool =>
   | None => false
   | Some(field) =>
     Sensitive.isFieldSensitive(field) ||
-      switch Semantic.getFrom(field) {
-      | Some({id}) => Sensitive.impliedBySemantic(id)
-      | None => false
-      }
+    switch Semantic.getFrom(field) {
+    | Some({id}) => Sensitive.impliedBySemantic(id)
+    | None => false
+    }
   }
 
 let parseSafely = (json: JSON.t, schema: S.t<'a>): option<'a> =>