orders:send-link

orders family

Mail a buyer a signed, short-lived link to their own order history at one shop — the same answer whether or not the address has orders

Effect: ask; Awaits an outcome — the call returns the response below.
Caller: public; The class of authority the caller must already hold, decided from the attested context with no round trip.
Cost: free; What one call costs, so you can budget before acting.
Reversible: yes; The effect can be undone by a later call.
Idempotent: yes; Safe to retry as-is.

Send it with your agent

One click hands your coding agent a prompt that registers the substrate, reads this contract, and makes the call. Launch opens the app; the others copy the prompt.

Claude Code

Codex

Cursor

Gemini CLI

Claude Desktop

ChatGPT

curl -X POST https://one.ie/api/ask/orders:send-link \
  -H "Authorization: Bearer $ONE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": { "slug": "acme", "email": "buyer@example.com" }}'

The key is never in a link. npx -y @oneie/cli login writes it to ~/.config/oneie/key on your machine.

Request

Validated before dispatch — an invalid payload is refused with the fix, never half-applied.

slug string required The SELLER's slug — whose shop to look in, and the workspace bound into the minted token's MAC. The read and the credential use this one value, so a link can never open a shop this call did not name.
email string required A LOOKUP KEY, never an identity. Lower-cased and SHA-256'd (lib/identity/ladder.ts emailHash) and matched against `orders.customer_uid` — the only buyer-shaped column, since 0177 dropped `customer_email`. Never stored, never echoed, and the PII vault is never opened: the mail goes to the address that was submitted, which IS the matched address by construction.

Response

What comes back from the call.

ok boolean True for every accepted request. Reaching D1 at all means this is true.
sent boolean ALWAYS true beside `ok:true`, and it is a statement about the REQUEST, never about a message. A match, a miss, a foreign shop, an unsettled order and a dead mail provider all answer identically — a varying field here would be a membership oracle over the seller's whole customer list, one guess per call.
error string `rate_limited` (one send per address per 15-minute window, counted BEFORE the lookup so the refusal is not an oracle either), `link_not_configured` (the signing secret is unset — fails closed), `no_db`, or the argument refusal, which is the one refusal safe to distinguish because it says nothing about any order.

Traffic

Every call to orders:send-link, counted where it is dispatched — over HTTP or in-process alike. Aggregate only — no actor, no payload, no workspace.

Counting…

Wiring

Every place in the open source that names orders:send-link, and the file that answers it. Read from the tree at build time — a receiver is reached by NAME through one door, so there is no import edge to follow and a grep is the honest shape of the question. Structure, not volume — the count is in Traffic above.

Called from

API route 3

one.ie/web/src/lib/puck/ecommerce-account-blocks.tsx:28
one.ie/web/src/lib/resolvers/storefront/orders-mine.ts:43
one.ie/web/src/pages/api/storefront/send-link.ts:4

→

Answered by

orders:send-link one.ie/web/src/lib/resolvers/commerce.ts:706 Dispatched through POST /api/ask/orders:send-link, after the envelope validates the payload.

orders family · 3 more

orders:fulfil orders:mine orders:status

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "slug": {
      "type": "string",
      "description": "The SELLER's slug — whose shop to look in, and the workspace bound into the minted token's MAC. The read and the credential use this one value, so a link can never open a shop this call did not name."
    },
    "email": {
      "type": "string",
      "description": "A LOOKUP KEY, never an identity. Lower-cased and SHA-256'd (lib/identity/ladder.ts emailHash) and matched against `orders.customer_uid` — the only buyer-shaped column, since 0177 dropped `customer_email`. Never stored, never echoed, and the PII vault is never opened: the mail goes to the address that was submitted, which IS the matched address by construction."
    }
  },
  "required": [
    "slug",
    "email"
  ]
}

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "ok": {
      "description": "True for every accepted request. Reaching D1 at all means this is true.",
      "type": "boolean"
    },
    "sent": {
      "description": "ALWAYS true beside `ok:true`, and it is a statement about the REQUEST, never about a message. A match, a miss, a foreign shop, an unsettled order and a dead mail provider all answer identically — a varying field here would be a membership oracle over the seller's whole customer list, one guess per call.",
      "type": "boolean"
    },
    "error": {
      "description": "`rate_limited` (one send per address per 15-minute window, counted BEFORE the lookup so the refusal is not an oracle either), `link_not_configured` (the signing secret is unset — fails closed), `no_db`, or the argument refusal, which is the one refusal safe to distinguish because it says nothing about any order.",
      "type": "string"
    }
  }
}