@openlup/platform 0.16.0 → 0.18.0

package/dist/http/index.d.ts

@@ -4,3 +4,4 @@ export { NODE_HTTP_TIMEOUT_CODE, closeInputAfterResponse, runWithHttpDeadline, t
 export { applySecurityHeaders, contentTypeFor, looksLikeAsset, serveSpaStatic, type NodeSecurityHeaderPolicy, type StaticAssetReader, } from "./security.js";
 export { createDistStaticReader } from "./staticAssets.js";
 export { createNodeHttpRuntime, createRequestHandler, type HttpEntrypointRegistration, type HttpPathEntrypoint, type NodeCsrFallback, type NodeHttpRuntimeOptions, type NodeLegacyRedirect, } from "./runtime.js";
+export { MAX_WEBHOOK_BODY_BYTES, WebhookBodyTooLargeError, readRawBody, verifyHmacSignature, timingSafeStringEqual } from "./webhookSignature.js";

package/dist/http/index.js

@@ -3,3 +3,4 @@ export { NODE_HTTP_TIMEOUT_CODE, closeInputAfterResponse, runWithHttpDeadline, }
 export { applySecurityHeaders, contentTypeFor, looksLikeAsset, serveSpaStatic, } from "./security.js";
 export { createDistStaticReader } from "./staticAssets.js";
 export { createNodeHttpRuntime, createRequestHandler, } from "./runtime.js";
+export { MAX_WEBHOOK_BODY_BYTES, WebhookBodyTooLargeError, readRawBody, verifyHmacSignature, timingSafeStringEqual } from "./webhookSignature.js";

package/dist/http/webhookSignature.d.ts

@@ -0,0 +1,42 @@
+import type { HttpRequest } from "./types.js";
+/** Hard cap on raw webhook body bytes — the payment provider events are well under 256 KiB. */
+export declare const MAX_WEBHOOK_BODY_BYTES = 1048576;
+/** Thrown by readRawBody when the streamed body exceeds MAX_WEBHOOK_BODY_BYTES. */
+export declare class WebhookBodyTooLargeError extends Error {
+    constructor();
+}
+/**
+ * Reads the exact raw request body bytes for provider webhook signature
+ * verification.
+ *
+ * `@vercel/node` (v3, the builder for `/api` functions in this Vite project)
+ * auto-parses `application/json` request bodies into `req.body` and IGNORES the
+ * `export const config = { api: { bodyParser: false } }` opt-out — that opt-out
+ * is a Next.js Pages Router convention, not a vanilla `@vercel/node` one
+ * (verified empirically against the hidden-preview deploy: a JSON payload posted
+ * with `Content-Type: application/json` arrives parsed, the same bytes posted as
+ * `text/plain` arrive raw). Re-serializing the parsed object with
+ * `JSON.stringify` does NOT reproduce the provider's exact bytes — the payment provider signs
+ * pretty-printed JSON, so a compacted re-serialization breaks HMAC verification.
+ *
+ * Reading the underlying request stream FIRST — before touching `req.body`,
+ * whose getter triggers the parse that consumes the stream — preserves the exact
+ * bytes when the platform parses lazily. When `req` is not a stream (unit tests
+ * pass a plain `{ body }` object) or the stream yields nothing (already
+ * consumed), we fall back to `req.body`.
+ */
+export declare function readRawBody(req: HttpRequest): Promise<string>;
+export declare function verifyHmacSignature(input: {
+    rawBody: string;
+    signatureHeader: string | undefined;
+    secret: string;
+}): boolean;
+/**
+ * Constant-time comparison of two shared-secret strings.
+ *
+ * Exported because it is not payment-specific: any route holding a shared token has to compare it
+ * the same way, and a second hand-rolled copy of a security primitive is how one of them quietly
+ * stops being constant-time. The length check comes first because `timingSafeEqual` THROWS on a
+ * length mismatch rather than returning false, and the length of a shared token is not the secret.
+ */
+export declare function timingSafeStringEqual(left: string, right: string): boolean;

package/dist/http/webhookSignature.js

@@ -0,0 +1,86 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** Hard cap on raw webhook body bytes — the payment provider events are well under 256 KiB. */
+export const MAX_WEBHOOK_BODY_BYTES = 1_048_576;
+/** Thrown by readRawBody when the streamed body exceeds MAX_WEBHOOK_BODY_BYTES. */
+export class WebhookBodyTooLargeError extends Error {
+    constructor() {
+        super("Webhook body exceeds maximum size");
+        this.name = "WebhookBodyTooLargeError";
+    }
+}
+/**
+ * Reads the exact raw request body bytes for provider webhook signature
+ * verification.
+ *
+ * `@vercel/node` (v3, the builder for `/api` functions in this Vite project)
+ * auto-parses `application/json` request bodies into `req.body` and IGNORES the
+ * `export const config = { api: { bodyParser: false } }` opt-out — that opt-out
+ * is a Next.js Pages Router convention, not a vanilla `@vercel/node` one
+ * (verified empirically against the hidden-preview deploy: a JSON payload posted
+ * with `Content-Type: application/json` arrives parsed, the same bytes posted as
+ * `text/plain` arrive raw). Re-serializing the parsed object with
+ * `JSON.stringify` does NOT reproduce the provider's exact bytes — the payment provider signs
+ * pretty-printed JSON, so a compacted re-serialization breaks HMAC verification.
+ *
+ * Reading the underlying request stream FIRST — before touching `req.body`,
+ * whose getter triggers the parse that consumes the stream — preserves the exact
+ * bytes when the platform parses lazily. When `req` is not a stream (unit tests
+ * pass a plain `{ body }` object) or the stream yields nothing (already
+ * consumed), we fall back to `req.body`.
+ */
+export async function readRawBody(req) {
+    if (isAsyncIterable(req)) {
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of req) {
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            total += buf.byteLength;
+            // Enforce the cap mid-stream so an oversized body is rejected before it is
+            // fully buffered into memory, not after.
+            if (total > MAX_WEBHOOK_BODY_BYTES)
+                throw new WebhookBodyTooLargeError();
+            chunks.push(buf);
+        }
+        if (chunks.length > 0)
+            return Buffer.concat(chunks).toString("utf8");
+    }
+    if (typeof req.body === "string")
+        return capBody(req.body);
+    if (Buffer.isBuffer(req.body))
+        return capBody(req.body.toString("utf8"));
+    if (req.body && typeof req.body === "object")
+        return capBody(JSON.stringify(req.body));
+    return "";
+}
+function capBody(body) {
+    if (Buffer.byteLength(body, "utf8") > MAX_WEBHOOK_BODY_BYTES) {
+        throw new WebhookBodyTooLargeError();
+    }
+    return body;
+}
+function isAsyncIterable(value) {
+    return (value != null &&
+        typeof value[Symbol.asyncIterator] ===
+            "function");
+}
+export function verifyHmacSignature(input) {
+    if (!input.signatureHeader || !input.secret)
+        return false;
+    return timingSafeStringEqual(input.signatureHeader, hmac(input.rawBody, input.secret));
+}
+function hmac(value, secret) {
+    return createHmac("sha256", secret).update(value).digest("hex");
+}
+/**
+ * Constant-time comparison of two shared-secret strings.
+ *
+ * Exported because it is not payment-specific: any route holding a shared token has to compare it
+ * the same way, and a second hand-rolled copy of a security primitive is how one of them quietly
+ * stops being constant-time. The length check comes first because `timingSafeEqual` THROWS on a
+ * length mismatch rather than returning false, and the length of a shared token is not the secret.
+ */
+export function timingSafeStringEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}

package/dist/identity/customerContracts.d.ts

@@ -1,9 +1,9 @@
 import { z } from "zod";
 export declare const customerLifecycleStageSchema: z.ZodEnum<{
+    inactive: "inactive";
     lead: "lead";
     tester: "tester";
     customer: "customer";
-    inactive: "inactive";
 }>;
 export declare const customerMeRequestSchema: z.ZodObject<{}, z.core.$strict>;
 export declare const customerMeResponseSchema: z.ZodObject<{
@@ -12,10 +12,10 @@ export declare const customerMeResponseSchema: z.ZodObject<{
     firstName: z.ZodNullable<z.ZodString>;
     lastName: z.ZodNullable<z.ZodString>;
     lifecycleStage: z.ZodEnum<{
+        inactive: "inactive";
         lead: "lead";
         tester: "tester";
         customer: "customer";
-        inactive: "inactive";
     }>;
     subscriptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
         subscriptionId: z.ZodGUID;

package/dist/inventory/adminInventory.d.ts

@@ -0,0 +1,13 @@
+import type { z } from "zod";
+import { type InventoryMutationPort, type InventoryReadPort } from "./ports.js";
+interface PgQueryExecutor {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: Record<string, unknown>[];
+    }>;
+}
+/** Operator readback over the same public stock and reservation rail used by renewal. */
+export declare function createPostgresAdminInventoryPort(executor: PgQueryExecutor, config: {
+    stockMasterProvider: string;
+    providerSchema: z.ZodType<string>;
+}, now?: () => string): InventoryReadPort & InventoryMutationPort;
+export {};

package/dist/inventory/adminInventory.js

@@ -0,0 +1,214 @@
+import { createHash } from "node:crypto";
+import { calculateInventoryAtp, availableNow, INVENTORY_CONTRACT_VERSION } from "@openlup/core/inventory";
+import { createInventorySubscriptionForecastResponseSchema } from "./schemas.js";
+import { InventoryPersistenceError, } from "./ports.js";
+const STOCK_SQL = `SELECT sku.id AS sku_id, sku.sku, stock.source_key,
+    stock.for_sale_quantity AS on_hand,
+    COALESCE((SELECT sum(line.quantity)::integer
+      FROM public.fulfillment_inventory_reservation_lines line
+      JOIN public.fulfillment_inventory_reservations reservation ON reservation.id = line.reservation_id
+     WHERE line.sku = stock.sku AND reservation.source_key = stock.source_key
+       AND reservation.status IN ('held', 'committed')), 0) AS reserved,
+    stock.last_synced_at, stock.stale_after,
+    count(*) OVER() AS total_count
+  FROM public.fulfillment_stock_current stock
+  JOIN public.catalog_skus sku ON sku.sku = stock.sku
+ WHERE ($1::uuid IS NULL OR sku.id = $1::uuid)
+   AND ($2::boolean OR stock.for_sale_quantity > 0)
+ ORDER BY stock.updated_at DESC, stock.source_key, stock.sku
+ LIMIT $3::integer OFFSET $4::integer`;
+const RESERVATIONS_SQL = `SELECT reservation.id, order_row.id AS order_id, cycle.id AS cycle_id,
+    CASE reservation.status
+      WHEN 'held' THEN 'reserved' WHEN 'committed' THEN 'reserved'
+      ELSE reservation.status END AS status,
+    reservation.expires_at, reservation.created_at,
+    operation.identity_key, operation.operation_fingerprint, operation.terminal_outcome,
+    count(*) OVER() AS total_count
+  FROM public.fulfillment_inventory_reservations reservation
+  JOIN public.subscription_renewal_operations operation ON operation.id = reservation.renewal_operation_id
+  LEFT JOIN public.subscription_cycles cycle ON cycle.renewal_operation_id = operation.id
+  LEFT JOIN public.commerce_orders order_row ON order_row.renewal_operation_id = operation.id
+ WHERE ($1::text IS NULL OR CASE reservation.status
+      WHEN 'held' THEN 'reserved' WHEN 'committed' THEN 'reserved'
+      ELSE reservation.status END = $1::text)
+   AND ($2::uuid IS NULL OR order_row.id = $2::uuid)
+ ORDER BY reservation.created_at DESC, reservation.id
+  LIMIT $3::integer OFFSET $4::integer`;
+const ATP_SQL = `SELECT sku.id AS sku_id, sku.sku, stock.source_key,
+    stock.for_sale_quantity AS on_hand,
+    COALESCE((SELECT sum(line.quantity)::integer
+      FROM public.fulfillment_inventory_reservation_lines line
+      JOIN public.fulfillment_inventory_reservations reservation ON reservation.id = line.reservation_id
+     WHERE line.sku = stock.sku AND reservation.source_key = stock.source_key
+       AND reservation.status IN ('held', 'committed')), 0) AS reserved,
+    stock.last_synced_at, stock.stale_after, 0 AS total_count
+  FROM public.fulfillment_stock_current stock
+  JOIN public.catalog_skus sku ON sku.sku = stock.sku
+ WHERE sku.id = ANY($1::uuid[])
+   AND stock.inventory_class = 'sellable'
+   AND stock.stale_after > $2::timestamptz
+ ORDER BY stock.source_key, stock.sku`;
+const FORECAST_SQL = `WITH forecast_skus AS (
+    SELECT line.sku
+      FROM public.subscription_renewal_term_lines line
+      JOIN public.subscriptions subscription ON subscription.id = line.subscription_id
+     WHERE subscription.status = 'active'
+    UNION
+    SELECT stock.sku
+      FROM public.fulfillment_stock_current stock
+     WHERE stock.inventory_class = 'sellable'
+  ), sellable_stock AS (
+    SELECT stock.sku,
+           sum(stock.for_sale_quantity)::integer AS for_sale_quantity,
+           max(stock.last_synced_at) AS last_synced_at,
+           min(stock.stale_after) AS stale_after
+      FROM public.fulfillment_stock_current stock
+     WHERE stock.inventory_class = 'sellable'
+     GROUP BY stock.sku
+  )
+  SELECT sku.id AS sku_id, sku.sku,
+    stock.for_sale_quantity, stock.last_synced_at, stock.stale_after,
+    COALESCE(reserved.quantity, 0)::integer AS reserved,
+    COALESCE(demand.days_30, 0)::integer AS days_30,
+    COALESCE(demand.days_45, 0)::integer AS days_45,
+    COALESCE(demand.days_60, 0)::integer AS days_60
+  FROM forecast_skus forecast
+  JOIN public.catalog_skus sku ON sku.sku = forecast.sku
+  LEFT JOIN sellable_stock stock ON stock.sku = forecast.sku
+  LEFT JOIN LATERAL (
+    SELECT sum(line.quantity)::integer AS quantity
+      FROM public.fulfillment_inventory_reservation_lines line
+      JOIN public.fulfillment_inventory_reservations reservation ON reservation.id = line.reservation_id
+     WHERE line.sku = forecast.sku
+       AND reservation.status IN ('held', 'committed')) reserved ON true
+  LEFT JOIN LATERAL (
+    SELECT
+      sum(CASE WHEN subscription.next_cycle_at <= $1::timestamptz + interval '30 days' THEN line.quantity ELSE 0 END)::integer AS days_30,
+      sum(CASE WHEN subscription.next_cycle_at <= $1::timestamptz + interval '45 days' THEN line.quantity ELSE 0 END)::integer AS days_45,
+      sum(CASE WHEN subscription.next_cycle_at <= $1::timestamptz + interval '60 days' THEN line.quantity ELSE 0 END)::integer AS days_60
+      FROM public.subscription_renewal_term_lines line
+      JOIN public.subscriptions subscription ON subscription.id = line.subscription_id
+     WHERE line.sku = forecast.sku AND subscription.status = 'active'
+       AND subscription.next_cycle_at <= $1::timestamptz + ($2::integer * interval '1 day')) demand ON true
+ ORDER BY sku.sku`;
+const ACTIVE_SUBSCRIPTION_COUNT_SQL = `SELECT count(*)::integer AS active_subscription_count
+  FROM public.subscriptions WHERE status = 'active'`;
+/** Operator readback over the same public stock and reservation rail used by renewal. */
+export function createPostgresAdminInventoryPort(executor, config, now = () => new Date().toISOString()) {
+    const forecastResponseSchema = createInventorySubscriptionForecastResponseSchema(config.providerSchema);
+    return {
+        async listStock(request) {
+            const offset = (request.page - 1) * request.pageSize;
+            const result = await executor.query(STOCK_SQL, [
+                request.skuId ?? null, request.includeZero, request.pageSize, offset,
+            ]);
+            const stock = result.rows.map(mapStock);
+            return {
+                contractVersion: INVENTORY_CONTRACT_VERSION,
+                stock: stock.map((line) => ({ ...line, availableNow: availableNow(line) })),
+                totalCount: count(result.rows[0]), page: request.page, pageSize: request.pageSize,
+            };
+        },
+        async listReservations(request) {
+            const offset = (request.page - 1) * request.pageSize;
+            const result = await executor.query(RESERVATIONS_SQL, [
+                request.status ?? null, request.orderId ?? null, request.pageSize, offset,
+            ]);
+            return {
+                contractVersion: INVENTORY_CONTRACT_VERSION,
+                reservations: result.rows.map((row) => ({
+                    id: text(row.id), orderId: text(row.order_id),
+                    subscriptionCycleId: nullableText(row.cycle_id),
+                    status: text(row.status),
+                    kind: "subscription_retry_window",
+                    expiresAt: timestampOrNull(row.expires_at), createdAt: timestamp(row.created_at),
+                })),
+                totalCount: count(result.rows[0]), page: request.page, pageSize: request.pageSize,
+            };
+        },
+        async checkAtp(request) {
+            const result = await executor.query(ATP_SQL, [
+                request.lines.map((line) => line.skuId), request.requestedAt,
+            ]);
+            return calculateInventoryAtp({ request, stock: result.rows.map(mapStock) });
+        },
+        async forecastSubscriptions(request) {
+            const generatedAt = now();
+            const result = await executor.query(FORECAST_SQL, [generatedAt, request.horizonDays]);
+            const activeSubscriptionResult = await executor.query(ACTIVE_SUBSCRIPTION_COUNT_SQL);
+            const skus = result.rows.map((row) => mapForecast(row, generatedAt, request));
+            return forecastResponseSchema.parse({
+                contractVersion: INVENTORY_CONTRACT_VERSION,
+                generatedAt,
+                // Compatibility projection required by the existing admin BFF contract;
+                // the public tables themselves keep source_key opaque.
+                stockMasterProvider: config.stockMasterProvider,
+                horizonDays: request.horizonDays,
+                protectionDays: request.protectionDays,
+                skus,
+                totals: {
+                    activeSubscriptionCount: integer(activeSubscriptionResult.rows[0]?.active_subscription_count),
+                    excludedSubscriptionCount: 0,
+                    missingProviderStockSkuCount: skus.filter((sku) => sku.stockStatus === "missing").length,
+                    staleProviderStockSkuCount: skus.filter((sku) => sku.stockStatus === "stale").length,
+                    horizonShortageSkuCount: skus.filter((sku) => sku.horizonMissingQty > 0).length,
+                    protectionShortageSkuCount: skus.filter((sku) => sku.protectionMissingQty > 0).length,
+                    shortageSkuCount: skus.filter((sku) => sku.missingQty > 0).length,
+                    recommendedProductionQty: skus.reduce((sum, sku) => sum + sku.recommendedProductionQty, 0),
+                },
+            });
+        },
+        async adjustStock() {
+            throw new InventoryPersistenceError("Direct stock is externally observed; use the configured stock-source adapter");
+        },
+    };
+}
+function mapStock(row) {
+    const source = text(row.source_key);
+    return {
+        skuId: text(row.sku_id), sku: text(row.sku),
+        locationId: stableUuid(source), locationCode: source,
+        locationKind: "third_party_logistics", locationStatus: "active", fulfillable: true,
+        lotId: null, lotCode: null, lotStatus: null, expiresAt: null,
+        onHand: integer(row.on_hand), reserved: integer(row.reserved), unavailable: 0,
+        incoming: 0, safetyStock: 0,
+    };
+}
+function mapForecast(row, generatedAt, request) {
+    const sellable = Math.max(0, integer(row.for_sale_quantity) - integer(row.reserved));
+    const horizonDemand = request.horizonDays <= 30 ? integer(row.days_30)
+        : request.horizonDays <= 45 ? integer(row.days_45) : integer(row.days_60);
+    const protectionDemand = request.protectionDays <= 30 ? integer(row.days_30)
+        : request.protectionDays <= 45 ? integer(row.days_45) : integer(row.days_60);
+    const horizonMissingQty = Math.max(0, horizonDemand - sellable);
+    const protectionMissingQty = Math.max(0, protectionDemand - sellable);
+    const staleAfter = timestampOrNull(row.stale_after);
+    const stockStatus = row.for_sale_quantity === null || row.for_sale_quantity === undefined
+        ? "missing"
+        : staleAfter && staleAfter <= generatedAt ? "stale" : "fresh";
+    return {
+        skuId: text(row.sku_id), sku: text(row.sku),
+        providerCurrentForSale: nullableInteger(row.for_sale_quantity),
+        providerStockLastSyncedAt: timestampOrNull(row.last_synced_at),
+        providerStockStaleAfter: staleAfter, stockStatus,
+        openHardReservations: integer(row.reserved), safetyStock: 0, sellableNow: sellable,
+        activeSubscriptionDemand30: integer(row.days_30),
+        activeSubscriptionDemand45: integer(row.days_45),
+        activeSubscriptionDemand60: integer(row.days_60), plannedSupply: 0,
+        coverageDays: null, shortageDate: null,
+        horizonMissingQty, protectionMissingQty,
+        missingQty: Math.max(horizonMissingQty, protectionMissingQty),
+        recommendedProductionQty: Math.max(horizonMissingQty, protectionMissingQty),
+    };
+}
+function stableUuid(value) {
+    const hash = createHash("sha256").update(`inventory-source:${value}`).digest("hex");
+    return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-8${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
+}
+function text(value) { return typeof value === "string" ? value : String(value ?? ""); }
+function nullableText(value) { const result = text(value).trim(); return result || null; }
+function integer(value) { const result = Number(value); return Number.isSafeInteger(result) && result >= 0 ? result : 0; }
+function nullableInteger(value) { return value === null || value === undefined ? null : integer(value); }
+function count(row) { return row ? integer(row.total_count) : 0; }
+function timestamp(value) { return value instanceof Date ? value.toISOString() : text(value); }
+function timestampOrNull(value) { return value === null || value === undefined ? null : timestamp(value); }

package/dist/inventory/contracts/forecast.d.ts

@@ -0,0 +1,86 @@
+export interface InventoryProviderStockLine {
+    skuId: string;
+    sku: string;
+    forSaleQuantity: number;
+    lastSyncedAt: string;
+    staleAfter: string;
+}
+export interface InventoryHardReservationLine {
+    skuId: string;
+    quantity: number;
+}
+/** Structural inputs for dated subscription stock coverage; validation belongs to the caller. */
+export interface SubscriptionForecastProviderStockLine {
+    skuId: string;
+    sku: string;
+    forSaleQuantity: number;
+    lastSyncedAt: string;
+    staleAfter: string;
+}
+export interface SubscriptionForecastHardReservationLine {
+    skuId: string;
+    quantity: number;
+}
+export interface SubscriptionForecastStockLine {
+    skuId: string;
+    sku: string;
+    fulfillable: boolean;
+    locationStatus: string;
+    safetyStock: number;
+}
+export interface SubscriptionForecastDemandLine {
+    skuId: string;
+    sku: string;
+    quantity: number;
+    dueAt: string;
+    status: string;
+}
+export interface SubscriptionForecastSupplyLine {
+    skuId: string;
+    quantity: number;
+    expectedAt: string;
+    status: string;
+}
+export interface SubscriptionForecastCalculationInput {
+    generatedAt: string;
+    horizonDays: number;
+    protectionDays: number;
+    providerCurrent: SubscriptionForecastProviderStockLine[];
+    openHardReservations: SubscriptionForecastHardReservationLine[];
+    stock: SubscriptionForecastStockLine[];
+    demand: SubscriptionForecastDemandLine[];
+    supply: SubscriptionForecastSupplyLine[];
+}
+export interface SubscriptionForecastCounts {
+    activeSubscriptionCount: number;
+    excludedSubscriptionCount: number;
+}
+export interface SubscriptionForecastSku {
+    skuId: string;
+    sku: string;
+    providerCurrentForSale: number | null;
+    providerStockLastSyncedAt: string | null;
+    providerStockStaleAfter: string | null;
+    stockStatus: "missing" | "stale" | "fresh";
+    openHardReservations: number;
+    safetyStock: number;
+    sellableNow: number;
+    activeSubscriptionDemand30: number;
+    activeSubscriptionDemand45: number;
+    activeSubscriptionDemand60: number;
+    plannedSupply: number;
+    coverageDays: number | null;
+    shortageDate: string | null;
+    horizonMissingQty: number;
+    protectionMissingQty: number;
+    missingQty: number;
+    recommendedProductionQty: number;
+}
+export interface SubscriptionForecastTotals extends SubscriptionForecastCounts {
+    missingProviderStockSkuCount: number;
+    staleProviderStockSkuCount: number;
+    horizonShortageSkuCount: number;
+    protectionShortageSkuCount: number;
+    shortageSkuCount: number;
+    recommendedProductionQty: number;
+}

package/dist/inventory/contracts/forecast.js

@@ -0,0 +1 @@
+export {};

package/dist/inventory/contracts/index.d.ts

@@ -0,0 +1,4 @@
+export type { InventoryReservationStatus, AdminInventoryStockRequest, AdminInventoryReservationsRequest, AdminInventoryStockAdjustmentRequest, AdminInventorySubscriptionForecastRequest, InventoryStockListResponse, InventoryReservationsListResponse, InventoryStockAdjustmentResponse, InventorySubscriptionForecastResponse, InventorySubscriptionForecastSku, InventoryForecastDemandLine, InventoryForecastSupplyLine, InventoryForecastResponse, } from "./inventory.js";
+export type { NewPurchaseStockRow, NewPurchaseStockMode, NewPurchaseStockAvailabilityOptions } from "./newPurchaseStock.js";
+export type { ReservationPolicyInput, ReservationPolicy, AutomaticRenewalReservationResult } from "./reservation.js";
+export type { InventoryProviderStockLine, InventoryHardReservationLine, SubscriptionForecastCalculationInput, SubscriptionForecastCounts, SubscriptionForecastSku, SubscriptionForecastTotals } from "./forecast.js";

package/dist/inventory/contracts/index.js

@@ -0,0 +1 @@
+export {};

package/dist/inventory/contracts/inventory.d.ts

@@ -0,0 +1,157 @@
+/** Inventory wire DTOs. Runtime validation belongs to the server entry. */
+export type InventoryReservationStatus = "reserved" | "released" | "consumed" | "expired";
+export type AdminInventoryStockRequest = {
+    page: number;
+    pageSize: number;
+    includeZero: boolean;
+    skuId?: string | undefined;
+    locationId?: string | undefined;
+};
+export type AdminInventoryReservationsRequest = {
+    page: number;
+    pageSize: number;
+    status?: "reserved" | "released" | "consumed" | "expired" | undefined;
+    orderId?: string | undefined;
+};
+export type AdminInventoryStockAdjustmentRequest = {
+    idempotencyKey: string;
+    skuId: string;
+    locationId: string;
+    quantityDelta: number;
+    reason: string;
+    lotId?: string | null | undefined;
+    note?: string | undefined;
+};
+export type AdminInventorySubscriptionForecastRequest = {
+    horizonDays: number;
+    protectionDays: number;
+};
+export type InventoryStockListResponse = {
+    contractVersion: "inventory.v0";
+    stock: {
+        skuId: string;
+        sku: string;
+        locationId: string;
+        locationCode: string;
+        locationKind: "internal_warehouse" | "third_party_logistics" | "supplier" | "quarantine" | "virtual";
+        locationStatus: "active" | "inactive";
+        fulfillable: boolean;
+        lotId: string | null;
+        lotCode: string | null;
+        lotStatus: "expired" | "available" | "quarantined" | "recalled" | null;
+        expiresAt: string | null;
+        onHand: number;
+        reserved: number;
+        unavailable: number;
+        incoming: number;
+        safetyStock: number;
+        availableNow: number;
+    }[];
+    totalCount: number;
+    page: number;
+    pageSize: number;
+};
+export type InventoryReservationsListResponse = {
+    contractVersion: "inventory.v0";
+    reservations: {
+        id: string;
+        orderId: string;
+        subscriptionCycleId: string | null;
+        status: "reserved" | "released" | "consumed" | "expired";
+        kind: "checkout_payment_window" | "subscription_retry_window" | "manual_ops";
+        expiresAt: string | null;
+        createdAt: string;
+    }[];
+    totalCount: number;
+    page: number;
+    pageSize: number;
+};
+export type InventoryStockAdjustmentResponse = {
+    contractVersion: "inventory.v0";
+    replayed: boolean;
+};
+export type InventorySubscriptionForecastResponse = {
+    contractVersion: "inventory.v0";
+    generatedAt: string;
+    stockMasterProvider: string;
+    horizonDays: number;
+    protectionDays: number;
+    skus: {
+        skuId: string;
+        sku: string;
+        providerCurrentForSale: number | null;
+        providerStockLastSyncedAt: string | null;
+        providerStockStaleAfter: string | null;
+        stockStatus: "fresh" | "stale" | "missing";
+        openHardReservations: number;
+        safetyStock: number;
+        sellableNow: number;
+        activeSubscriptionDemand30: number;
+        activeSubscriptionDemand45: number;
+        activeSubscriptionDemand60: number;
+        plannedSupply: number;
+        coverageDays: number | null;
+        shortageDate: string | null;
+        horizonMissingQty: number;
+        protectionMissingQty: number;
+        missingQty: number;
+        recommendedProductionQty: number;
+    }[];
+    totals: {
+        activeSubscriptionCount: number;
+        excludedSubscriptionCount: number;
+        missingProviderStockSkuCount: number;
+        staleProviderStockSkuCount: number;
+        horizonShortageSkuCount: number;
+        protectionShortageSkuCount: number;
+        shortageSkuCount: number;
+        recommendedProductionQty: number;
+    };
+};
+export type InventorySubscriptionForecastSku = {
+    skuId: string;
+    sku: string;
+    providerCurrentForSale: number | null;
+    providerStockLastSyncedAt: string | null;
+    providerStockStaleAfter: string | null;
+    stockStatus: "fresh" | "stale" | "missing";
+    openHardReservations: number;
+    safetyStock: number;
+    sellableNow: number;
+    activeSubscriptionDemand30: number;
+    activeSubscriptionDemand45: number;
+    activeSubscriptionDemand60: number;
+    plannedSupply: number;
+    coverageDays: number | null;
+    shortageDate: string | null;
+    horizonMissingQty: number;
+    protectionMissingQty: number;
+    missingQty: number;
+    recommendedProductionQty: number;
+};
+export type InventoryForecastDemandLine = {
+    subscriptionId: string;
+    subscriptionCycleId: string | null;
+    skuId: string;
+    sku: string;
+    quantity: number;
+    dueAt: string;
+    status: "planned" | "payment_pending" | "paid" | "retry_scheduled" | "skipped" | "cancelled";
+};
+export type InventoryForecastSupplyLine = {
+    skuId: string;
+    quantity: number;
+    expectedAt: string;
+    status: "planned" | "cancelled" | "received";
+};
+export type InventoryForecastResponse = {
+    contractVersion: "inventory.v0";
+    shortages: {
+        skuId: string;
+        sku: string;
+        dueAt: string;
+        demandQuantity: number;
+        availableOrExpectedQuantity: number;
+        missingQuantity: number;
+    }[];
+};

package/dist/inventory/contracts/inventory.js

@@ -0,0 +1 @@
+export {};