@openlup/platform 0.23.0 → 0.25.0

package/dist/subscriptions/postgresCommandStore.js

@@ -0,0 +1,172 @@
+import { subscriptionRecord } from "./postgresRenewalStore.js";
+import { NATIVE_SUBSCRIPTION_CAPABILITIES } from "./index.js";
+const refusalCodes = new Set([
+    "multi_cycle_prepaid_unsupported",
+    "subscription_command_addon_not_found",
+    "subscription_command_bundle_total_mismatch",
+    "subscription_command_charge_timing_not_confirmed",
+    "subscription_command_idempotency_conflict",
+    "subscription_command_invalid_composition_constraint",
+    "subscription_command_invalid_input",
+    "subscription_command_not_active",
+    "subscription_command_operation_busy",
+    "subscription_command_pause_forbidden",
+    "subscription_command_payment_blocked",
+    "subscription_command_preview_unsupported",
+    "subscription_command_renewal_terms_missing",
+    "subscription_command_unsupported_action",
+    "subscription_edit_catalog_unavailable",
+    "subscription_edit_invalid_lines",
+    "subscription_edit_invalid_request",
+    "subscription_edit_quote_expired",
+    "subscription_edit_quote_required",
+    "subscription_edit_stale_template",
+    "subscription_edit_window_closed",
+    "subscription_lifecycle_invalid_transition",
+    "subscription_lifecycle_invalid_skip",
+    "subscription_lifecycle_invalid_slide",
+    "subscription_lifecycle_payment_blocked",
+]);
+function refusalReason(reason) {
+    return typeof reason === "string" && refusalCodes.has(reason)
+        ? reason : "subscription_command_invalid_input";
+}
+function commandResult(result) {
+    return result.status === "refused" || result.outcome === "refused"
+        ? { ...result, reason: refusalReason(result.reason) } : result;
+}
+/** N2 owns normalization, locking, quote acceptance, receipts and all writes.
+ * Preview is a separate persisted transaction; apply never executes payment. */
+export function createPostgresSubscriptionCommandStore(binding) {
+    return {
+        preview(input) { return invokeCommand(binding, input, true); },
+        apply(input) { return invokeCommand(binding, input, false); },
+    };
+}
+async function invokeCommand(binding, input, preview, futureTerms) {
+    if (input.action === "multi_cycle_prepaid")
+        return {
+            status: "refused", reason: NATIVE_SUBSCRIPTION_CAPABILITIES.multiCyclePrepaid.refusalCode,
+        };
+    return binding.withTransaction(async (executor) => {
+        const values = [input.actorId, input.clientId, input.idempotencyKey, input.subscriptionId, input.action, input.payload, input.now];
+        // Share N2's actor/key lock so a concurrent preview/apply cannot change
+        // the receipt between this read and native dispatch. Replay ends here,
+        // before any lifecycle function or other potentially writing call.
+        await executor.query("SELECT pg_advisory_xact_lock(hashtextextended($1::uuid::text||':'||$2::text,0))", [input.actorId, input.idempotencyKey]);
+        const stored = await executor.query(`WITH stored AS (
+      SELECT r.*, CASE WHEN $9::boolean THEN jsonb_set(r.command,'{payload}',
+        (r.command->'payload')-ARRAY['coreLines','addonLines','compositionConstraint']) ELSE r.command END AS requested_command
+      FROM public.subscription_command_receipts r WHERE r.actor_id=$1::uuid AND r.idempotency_key=$3::text
+        AND $7::timestamptz IS NOT NULL AND isfinite($7::timestamptz)
+        AND $3::text=btrim($3::text) AND char_length($3::text) BETWEEN 8 AND 180
+        AND $5::text IS NOT NULL AND jsonb_typeof($6::jsonb)='object'
+        AND (NOT $8::boolean OR NOT ($6::jsonb ? 'acceptedQuoteHash'))
+        AND EXISTS(SELECT 1 FROM public.subscriptions WHERE id=$4::uuid AND client_id=$2::uuid)
+    ), receipt AS (
+      SELECT *, CASE WHEN $8::boolean OR status='previewed' THEN
+        jsonb_set(requested_command,'{payload}',(requested_command->'payload')-'acceptedQuoteHash')=
+          jsonb_build_object('clientId',$2::uuid,'subscriptionId',$4::uuid,'action',$5::text,'payload',$6::jsonb-'acceptedQuoteHash')
+        ELSE requested_command=jsonb_build_object('clientId',$2::uuid,'subscriptionId',$4::uuid,'action',$5::text,'payload',$6::jsonb)
+        END AND ($8::boolean OR quote_hash IS NOT DISTINCT FROM ($6::jsonb->>'acceptedQuoteHash')) AS matches
+      FROM stored
+    ) SELECT command, CASE WHEN NOT matches THEN jsonb_build_object('status','refused','reason','subscription_command_idempotency_conflict')
+      WHEN $8::boolean OR status='refused' THEN result
+      WHEN status<>'previewed' THEN result||jsonb_build_object('status','replayed','originalStatus',status,'commandFingerprint',command_fingerprint)
+      END AS response FROM receipt`, [...values, preview, !!futureTerms]);
+        if (stored.rows[0]?.response)
+            return commandResult(subscriptionRecord(stored.rows[0].response));
+        if (futureTerms) {
+            if (stored.rows[0]) {
+                // A matching preview already bound the host translation. Apply that
+                // exact quote even if the host's mutable policy has since changed.
+                values[5] = { ...subscriptionRecord(subscriptionRecord(stored.rows[0].command).payload),
+                    acceptedQuoteHash: input.payload.acceptedQuoteHash };
+            }
+            else {
+                const terms = await futureTerms();
+                if ("outcome" in terms)
+                    return commandResult({ ...terms });
+                values[5] = { ...input.payload, ...terms };
+            }
+        }
+        let result;
+        if (!preview && !Object.hasOwn(input.payload, "acceptedQuoteHash")) {
+            // N2 owns every command's no-op decision. Keep only its terminal noop;
+            // other direct applies must retain their quote requirement without
+            // persisting a speculative quote or refusal from this preview probe.
+            await executor.query("SAVEPOINT subscription_command_noop");
+            const { rows } = await executor.query("SELECT public.subscription_command_preview($1::uuid,$2::uuid,$3::text,$4::uuid,$5::text,$6::jsonb,$7::timestamptz) AS response", values);
+            const candidate = commandResult(subscriptionRecord(rows[0]?.response));
+            if (candidate.status === "noop")
+                result = candidate;
+            else
+                await executor.query("ROLLBACK TO SAVEPOINT subscription_command_noop");
+            await executor.query("RELEASE SAVEPOINT subscription_command_noop");
+        }
+        if (!result) {
+            const name = preview ? "subscription_command_preview" : "subscription_command_apply";
+            const { rows } = await executor.query(`SELECT public.${name}($1::uuid,$2::uuid,$3::text,$4::uuid,$5::text,$6::jsonb,$7::timestamptz) AS response`, values);
+            result = commandResult(subscriptionRecord(rows[0]?.response));
+        }
+        if (preview || result.status === "refused")
+            return result;
+        const receipt = await executor.query(`SELECT command_fingerprint FROM public.subscription_command_receipts
+      WHERE actor_id=$1::uuid AND idempotency_key=$2::text`, [input.actorId, input.idempotencyKey]);
+        if (typeof receipt.rows[0]?.command_fingerprint !== "string")
+            throw new Error("subscription_command_receipt_missing");
+        return { ...result, commandFingerprint: receipt.rows[0].command_fingerprint };
+    });
+}
+/** Trusted customer/operator authorization precedes this adapter. The native
+ * result's subscriptionStatus is the state recorded by the original execution,
+ * including on replay; it is not a fresh read of mutable subscription state. */
+export function createPostgresSubscriptionCommands(binding) {
+    function encode(command) {
+        // This serving adapter never pauses an active subscription. Existing native
+        // callers retain their separate, unchanged lifecycle contract.
+        if (command.action === "pause")
+            return { outcome: "refused", reason: "subscription_command_pause_forbidden" };
+        const { actor, subscriptionId, idempotencyKey, now, action, ...fields } = command;
+        let payload = { ...fields, actorKind: actor.kind };
+        let nativeAction = action === "skip" ? "skip_next_cycle" : action === "slide" ? "slide_next_cycle" : action;
+        if (command.action === "edit_future_terms") {
+            // Preserve the host carriers as well as their native translation in the
+            // actual-command fingerprint. The accepted hash is stripped for preview.
+            payload = { ...payload, requestedCoreLines: command.coreLines, requestedAddonLines: command.addonLines,
+                compositionConstraintRef: command.compositionConstraint };
+            delete payload.coreLines;
+            delete payload.addonLines;
+            delete payload.compositionConstraint;
+            // An empty typed hash means no quote; preserve native no-op replay/probing.
+            if (command.acceptedQuoteHash === "")
+                delete payload.acceptedQuoteHash;
+            nativeAction = "update_package_template";
+        }
+        return { actorId: actor.actorId, clientId: actor.clientId, subscriptionId, idempotencyKey, now, action: nativeAction, payload };
+    }
+    return {
+        capabilities: NATIVE_SUBSCRIPTION_CAPABILITIES,
+        async preview(command) {
+            const input = encode(command);
+            if ("outcome" in input)
+                return input;
+            delete input.payload.acceptedQuoteHash;
+            return invokeCommand(binding, input, true, () => binding.futureTerms(command));
+        },
+        async apply(command) {
+            const input = encode(command);
+            if ("outcome" in input)
+                return input;
+            const result = await invokeCommand(binding, input, false, command.action === "edit_future_terms" ? () => binding.futureTerms(command) : undefined);
+            if (result.status === "refused" || result.outcome === "refused")
+                return { outcome: "refused", reason: refusalReason(result.reason) };
+            if (result.status !== "applied" && result.status !== "replayed" && result.status !== "noop")
+                throw new Error("subscription_command_response_invalid");
+            return { actorId: command.actor.actorId, idempotencyKey: command.idempotencyKey,
+                commandFingerprint: String(result.commandFingerprint), outcome: result.status, subscriptionId: String(result.subscriptionId),
+                originalState: String(result.subscriptionStatus), nextCycleAt: result.nextCycleAt == null ? null : String(result.nextCycleAt),
+                revision: String(result.templateVersion), eventId: result.eventId == null ? null : String(result.eventId) };
+        },
+    };
+}

package/dist/subscriptions/postgresRetryStore.d.ts

@@ -53,6 +53,12 @@ export declare function createPostgresRetryStore(executor: SubscriptionQueryExec
     read(operationId: string): Promise<NativeRetryRow | null>;
     candidates(limit: number, now: string): Promise<NativeRetryRow[]>;
     applyFailure(operationId: string, key: string, input: NativeRetryFailure): Promise<NativeRetryRow>;
+    /** Read the immutable rung receipt against the current case. An interrupted
+     * apply still needs propagation; an already advanced case must not be rewritten. */
+    failureProgress(operationId: string, key: string): Promise<{
+        replayed: boolean;
+        caseAdvanced: boolean;
+    }>;
     openCase(operationId: string, template: string, recoveryPath: string | null): Promise<Record<string, unknown>>;
     authorizeRecovery(operationId: string, tokenId: string, methodRef: string, methodEvidenceRef: string, now: string): Promise<Record<string, unknown>>;
     scheduleRecovery(operationId: string, key: string, authorizationId: string, now: string): Promise<Record<string, unknown>>;

package/dist/subscriptions/postgresRetryStore.js

@@ -34,6 +34,17 @@ export function createPostgresRetryStore(executor) {
         async applyFailure(operationId, key, input) {
             return row(await invoke("subscription_retry_apply_failure", [operationId, key, input]));
         },
+        /** Read the immutable rung receipt against the current case. An interrupted
+         * apply still needs propagation; an already advanced case must not be rewritten. */
+        async failureProgress(operationId, key) {
+            const result = await executor.query(`SELECT true AS replayed,
+        (c.retry_attempt >= (r.result->>'retry_attempt')::integer OR o.state='recovered') AS case_advanced
+        FROM public.subscription_retry_obligations o
+        JOIN public.subscription_retry_receipts r ON r.obligation_id=o.id AND r.kind='failure' AND r.receipt_key=$2::text
+        LEFT JOIN public.subscription_dunning_cases c ON c.id=o.case_id
+        WHERE o.renewal_operation_id=$1::uuid`, [operationId, key]);
+            return { replayed: result.rows.length === 1, caseAdvanced: result.rows[0]?.case_advanced === true };
+        },
         async openCase(operationId, template, recoveryPath) {
             return subscriptionRecord(await invoke("subscription_retry_open_case", [operationId, template, recoveryPath]));
         },

package/dist/subscriptions/postgresStockWaitStore.d.ts

@@ -0,0 +1,62 @@
+import type { StockWaitCase, StockWaitDeficit, StockWaitFrozenCase, StockWaitRecoveryBinding } from "./contracts/stockWait.js";
+import type { RenewalSchedule } from "./contracts/renewal.js";
+import { type NativeRenewalCodec, type SubscriptionQueryExecutor } from "./postgresRenewalStore.js";
+export interface NativeStockWaitBinding {
+    executor: SubscriptionQueryExecutor;
+    withTransaction<T>(work: (executor: SubscriptionQueryExecutor) => Promise<T>): Promise<T>;
+    codec: NativeRenewalCodec;
+    workerId: string;
+}
+export interface NativeStockWaitAdmission {
+    waiting: boolean;
+    caseId: string | null;
+    response: Record<string, unknown>;
+}
+/** Each multi-statement mutation uses the host transaction. Payment execution is
+ * deliberately outside this store. SQL owns stock locks and subtransactions. */
+export declare function createPostgresStockWaitStore(options: NativeStockWaitBinding): {
+    readFrozen(input: RenewalSchedule): Promise<StockWaitFrozenCase | null>;
+    listNormalDue(input: {
+        limit: number;
+        asOf: string;
+    }): Promise<import("./contracts/renewal.js").RenewalDue[]>;
+    deficits(input: {
+        snapshot: import("./contracts/renewal.js").RenewalFrozenSnapshot;
+        operationId: string;
+        now: string;
+    }): Promise<StockWaitDeficit[]>;
+    admit(input: {
+        operationId: string;
+        claimToken: string;
+        snapshot: import("./contracts/renewal.js").RenewalFrozenSnapshot;
+        recovery?: StockWaitRecoveryBinding;
+        now: string;
+    }): Promise<NativeStockWaitAdmission>;
+    enqueue(caseId: string, kind: "started" | "resumed"): Promise<void>;
+    markResumed(orderId: string): Promise<StockWaitCase | null>;
+    listCandidates(input: {
+        limit: number;
+        asOf: string;
+    }): Promise<StockWaitFrozenCase[]>;
+    readFrozenCase(input: StockWaitRecoveryBinding): Promise<StockWaitCase | null>;
+    reserveAndTransition(input: {
+        caseId: string;
+        frozenFingerprint: string;
+        now: string;
+    }): Promise<StockWaitCase>;
+    recoverRefusedSchedule(input: {
+        operationId: string;
+        caseId: string;
+        claimGeneration: number;
+        frozenFingerprint: string;
+        scheduledAt: string;
+        now: string;
+    }): Promise<{
+        outcome: "recovered";
+        operation: import("./contracts/renewal.js").RenewalReadback;
+        replayed: boolean;
+    } | {
+        outcome: "refused";
+        reason: "not_stock_only" | "external_ownership" | "stale_snapshot" | "lease_active" | "inventory_unavailable";
+    }>;
+};

package/dist/subscriptions/postgresStockWaitStore.js

@@ -0,0 +1,174 @@
+import { subscriptionRecord } from "./postgresRenewalStore.js";
+const nullable = (value) => value == null ? null : String(value);
+function binding(value) {
+    const r = subscriptionRecord(value);
+    for (const key of ["caseId", "cycleId", "orderId", "paymentId", "engineIdempotencyKey"]) {
+        if (r[key] !== null && typeof r[key] !== "string")
+            throw new Error("stock_wait_binding_invalid");
+    }
+    return r;
+}
+function array(value) {
+    if (!Array.isArray(value))
+        throw new Error("stock_wait_array_invalid");
+    return value;
+}
+/** Each multi-statement mutation uses the host transaction. Payment execution is
+ * deliberately outside this store. SQL owns stock locks and subtransactions. */
+export function createPostgresStockWaitStore(options) {
+    const { executor, codec } = options;
+    async function invoke(db, name, values) {
+        return (await db.query(`SELECT public.${name}(${values.map((_, i) => `$${i + 1}`).join(",")}) AS response`, values)).rows[0]?.response;
+    }
+    async function deficits(db, value) {
+        const rows = array(value).map(subscriptionRecord);
+        if (rows.length === 0)
+            return [];
+        const catalog = (await db.query("SELECT id,sku,title FROM public.catalog_skus WHERE sku=ANY($1::text[])", [rows.map(r => String(r.sku))])).rows;
+        return rows.map(value => {
+            const r = subscriptionRecord(value);
+            // Catalogue labels enrich the projection; quantities still come only from N3.
+            const item = catalog.find(item => item.sku === r.sku);
+            if (!item)
+                throw new Error("stock_wait_catalog_sku_missing");
+            return { skuId: String(item.id), sku: String(r.sku), displayName: String(item.title), size: null,
+                required: Number(r.requiredUnits), reserved: Number(r.reservedUnits),
+                available: Number(r.availableUnits), missing: Number(r.missingUnits) };
+        });
+    }
+    async function readCase(db, caseId) {
+        const rows = (await db.query(`SELECT public.subscription_stock_wait_read(c.id) AS projection,
+      c.cycle_snapshot,op.identity_key,cycle.id AS bound_cycle_id,ord.id AS bound_order_id,intent.id AS payment_id
+      FROM public.subscription_stock_wait_cases c JOIN public.subscription_renewal_operations op ON op.id=c.renewal_operation_id
+      LEFT JOIN public.subscription_cycles cycle ON cycle.renewal_operation_id=op.id
+      LEFT JOIN public.commerce_orders ord ON ord.renewal_operation_id=op.id
+      LEFT JOIN public.commerce_settlement_intents intent ON intent.renewal_operation_id=op.id WHERE c.id=$1::uuid`, [caseId])).rows;
+        if (!rows[0])
+            return null;
+        const r = subscriptionRecord(rows[0].projection), snapshot = codec.decode(subscriptionRecord(rows[0].cycle_snapshot));
+        if (!["waiting", "stock_secured", "resumed", "closed"].includes(String(r.state)))
+            throw new Error("stock_wait_state_invalid");
+        return { subscriptionId: String(r.subscription_id), scheduledAt: snapshot.scheduledAt, scheduledInstant: snapshot.scheduledInstant,
+            caseId: String(r.id), clientId: String(r.client_id), state: r.state,
+            frozenSnapshot: snapshot, frozenFingerprint: String(r.fingerprint),
+            binding: { caseId, cycleId: nullable(rows[0].bound_cycle_id), orderId: nullable(rows[0].bound_order_id),
+                paymentId: nullable(rows[0].payment_id), engineIdempotencyKey: String(rows[0].identity_key) },
+            deficits: await deficits(db, r.deficits), fulfillmentRef: nullable(r.fulfillment_id), blockReason: nullable(r.block_reason),
+            openedAt: String(r.opened_at), checkedAt: nullable(r.last_checked_at), selectedAt: nullable(r.last_selected_at),
+            securedAt: nullable(r.stock_secured_at), resumedAt: nullable(r.resumed_at), closedAt: nullable(r.closed_at),
+            startedNoticeKey: `subscription_stock_wait:${caseId}:started`, resumedNoticeKey: `subscription_stock_wait:${caseId}:resumed`,
+            noticeEligible: r.waitingNoticeRelevant === true };
+    }
+    async function frozen(db, value) {
+        const r = subscriptionRecord(value), b = binding(r.binding), snapshot = codec.decode(subscriptionRecord(r.snapshot));
+        return { subscriptionId: snapshot.subscriptionId, scheduledAt: snapshot.scheduledAt, scheduledInstant: snapshot.scheduledInstant, operationId: String(r.operationId),
+            case: b.caseId === null ? null : await readCase(db, b.caseId), frozenSnapshot: snapshot,
+            frozenFingerprint: String(r.operationFingerprint), binding: b };
+    }
+    async function recover(db, input) {
+        // Match the SQL lock order, then fence the schedule and generation not present
+        // in N3's SQL signature. No provider-owned refusal is converted to a wait.
+        await db.query(`SELECT id FROM public.subscriptions WHERE id=(SELECT subscription_id
+      FROM public.subscription_renewal_operations WHERE id=$1::uuid) FOR UPDATE`, [input.operationId]);
+        const row = (await db.query(`SELECT op.*,op.scheduled_at=$3::timestamptz AS schedule_matches,c.id AS case_id,c.state AS case_state,
+      EXISTS(SELECT 1 FROM public.fulfillment_inventory_reservations r WHERE r.renewal_operation_id=op.id
+        AND r.status='held' AND r.expires_at>$4::timestamptz) AS live_hold,
+      EXISTS(SELECT 1 FROM public.subscription_cycles WHERE renewal_operation_id=op.id) OR
+      EXISTS(SELECT 1 FROM public.commerce_orders WHERE renewal_operation_id=op.id) OR
+      EXISTS(SELECT 1 FROM public.commerce_settlement_intents WHERE renewal_operation_id=op.id) OR
+      EXISTS(SELECT 1 FROM public.subscription_renewal_outcomes WHERE renewal_operation_id=op.id AND
+        (outcome<>'refused' OR reason IS NULL OR reason NOT IN ('inventory_unavailable','reservation_expired') OR external_ref IS NOT NULL)) AS has_artifacts
+      FROM public.subscription_renewal_operations op LEFT JOIN public.subscription_stock_wait_cases c ON c.renewal_operation_id=op.id
+      WHERE op.id=$1::uuid AND c.id=$2::uuid FOR UPDATE OF op`, [input.operationId, input.caseId, input.scheduledAt, input.now])).rows[0];
+        if (!row || !row.schedule_matches || row.operation_fingerprint !== input.frozenFingerprint) {
+            return { outcome: "refused", reason: "stale_snapshot" };
+        }
+        if (row.has_artifacts || row.attempt_prepared_at != null || row.external_attempt_ref != null || row.external_attempt_acknowledged_at != null) {
+            return { outcome: "refused", reason: "external_ownership" };
+        }
+        if (!(row.state === "refused" && ["inventory_unavailable", "reservation_expired"].includes(String(row.terminal_reason)))
+            && !(row.state === "reserved" && row.case_state === "stock_secured"))
+            return { outcome: "refused", reason: "not_stock_only" };
+        const securedReplay = row.case_state === "stock_secured" && row.state === "reserved" && row.live_hold === true
+            && new Date(String(row.lease_expires_at)).getTime() > Date.parse(input.now)
+            && [input.claimGeneration, input.claimGeneration + 1].includes(Number(row.claim_generation));
+        if (!securedReplay && Number(row.claim_generation) !== input.claimGeneration)
+            return { outcome: "refused", reason: "stale_snapshot" };
+        if (!securedReplay && new Date(String(row.lease_expires_at)).getTime() > Date.parse(input.now))
+            return { outcome: "refused", reason: "lease_active" };
+        const result = subscriptionRecord(await invoke(db, "subscription_stock_wait_recover_refusal", [input.operationId, input.frozenFingerprint, options.workerId, input.now]));
+        if (result.waiting === true)
+            return { outcome: "refused", reason: "inventory_unavailable" };
+        return { outcome: "recovered", operation: codec.readback(result), replayed: result.replayed === true };
+    }
+    const port = {
+        async listCandidates(input) {
+            return options.withTransaction(async (db) => {
+                const values = array(await invoke(db, "subscription_stock_wait_candidates", [input.limit, input.asOf]));
+                const result = [];
+                for (const value of values)
+                    result.push(await frozen(db, value));
+                return result;
+            });
+        },
+        async readFrozenCase(input) {
+            if (input.caseId === null)
+                return null;
+            const result = await readCase(executor, input.caseId);
+            if (result && Object.keys(input).some(key => input[key] !== result.binding[key])) {
+                throw new Error("stock_wait_frozen_binding_changed");
+            }
+            return result;
+        },
+        async reserveAndTransition(input) {
+            return options.withTransaction(async (db) => {
+                const row = (await db.query(`SELECT op.id,op.claim_generation,op.scheduled_at::text FROM public.subscription_stock_wait_cases c
+          JOIN public.subscription_renewal_operations op ON op.id=c.renewal_operation_id WHERE c.id=$1::uuid`, [input.caseId])).rows[0];
+                if (!row)
+                    throw new Error("stock_wait_case_missing");
+                const result = await recover(db, { ...input, operationId: String(row.id), claimGeneration: Number(row.claim_generation), scheduledAt: String(row.scheduled_at) });
+                if (result.outcome === "refused" && result.reason !== "inventory_unavailable")
+                    throw new Error(`stock_wait_${result.reason}`);
+                const current = await readCase(db, input.caseId);
+                if (!current)
+                    throw new Error("stock_wait_case_missing");
+                return current;
+            });
+        },
+        recoverRefusedSchedule(input) { return options.withTransaction(db => recover(db, input)); },
+    };
+    return {
+        ...port,
+        async readFrozen(input) {
+            return options.withTransaction(async (db) => {
+                const value = await invoke(db, "subscription_stock_wait_frozen", [input.subscriptionId, input.scheduledAt]);
+                return value == null ? null : frozen(db, value);
+            });
+        },
+        async listNormalDue(input) {
+            return array(await invoke(executor, "subscription_stock_wait_normal_due", [input.limit, input.asOf])).map(value => codec.due(subscriptionRecord(value)));
+        },
+        async deficits(input) {
+            return options.withTransaction(async (db) => deficits(db, await invoke(db, "subscription_stock_wait_deficits", [codec.encode(input.snapshot), input.operationId, input.now])));
+        },
+        async admit(input) {
+            const request = { operationId: input.operationId, claimToken: input.claimToken, snapshot: codec.encode(input.snapshot),
+                operationFingerprint: codec.fingerprint(input.snapshot), identityKey: codec.identity(input.snapshot), worker: options.workerId };
+            const due = input.recovery ? { stockWaitRecovery: input.recovery } : {};
+            const response = subscriptionRecord(await invoke(executor, "subscription_stock_wait_admit", [request, due, input.now]));
+            if (response.waiting === true && typeof response.caseId !== "string")
+                throw new Error("stock_wait_case_identity_missing");
+            return { waiting: response.waiting === true, caseId: nullable(response.caseId), response };
+        },
+        async enqueue(caseId, kind) {
+            await executor.query(`SELECT public.subscription_stock_wait_enqueue(c,$2::text)
+        FROM public.subscription_stock_wait_cases c WHERE c.id=$1::uuid`, [caseId, kind]);
+        },
+        markResumed(orderId) {
+            return options.withTransaction(async (db) => {
+                const value = await invoke(db, "subscription_stock_wait_mark_resumed", [orderId]);
+                return value == null ? null : readCase(db, String(subscriptionRecord(value).id));
+            });
+        },
+    };
+}

package/dist/subscriptions/services.d.ts

@@ -0,0 +1,31 @@
+import type { SubscriptionCapabilities } from "./contracts/commands.js";
+/** One host executor for a selected population. Construction never starts work. */
+export declare function createSubscriptionServices<Result>(input: {
+    enabled?: boolean;
+    capabilities: SubscriptionCapabilities;
+    readiness(): Promise<{
+        kind: "ready";
+    } | {
+        kind: "refused";
+        code: string;
+    }>;
+    run(): Promise<Result>;
+}): {
+    capabilities: SubscriptionCapabilities;
+    readiness: () => Promise<{
+        kind: "ready";
+    } | {
+        kind: "refused";
+        code: string;
+    } | {
+        readonly kind: "refused";
+        readonly code: "disabled";
+    }>;
+    run(): Promise<Result | {
+        kind: "refused";
+        code: string;
+    } | {
+        readonly kind: "refused";
+        readonly code: "disabled";
+    }>;
+};

package/dist/subscriptions/services.js

@@ -0,0 +1,15 @@
+/** One host executor for a selected population. Construction never starts work. */
+export function createSubscriptionServices(input) {
+    async function readiness() {
+        if (input.enabled !== true)
+            return { kind: "refused", code: "disabled" };
+        return input.readiness();
+    }
+    return {
+        capabilities: input.capabilities, readiness,
+        async run() {
+            const state = await readiness();
+            return state.kind === "ready" ? input.run() : state;
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlup/platform",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "private": false,
   "description": "Runnable server substrate: Node HTTP runtime, BFF dispatch, scheduler, storage, data gateways and bundle composition; development preview.",
   "license": "Apache-2.0",
@@ -31,7 +31,7 @@
     "api:update": "npm run build && node --experimental-strip-types ./scripts/api-contract.ts --update"
   },
   "peerDependencies": {
-    "@openlup/core": "0.23.0",
+    "@openlup/core": "0.25.0",
     "pg": "^8.22.0",
     "@aws-sdk/client-s3": "^3.1144.0",
     "@types/pg": "^8.20.0"
@@ -48,7 +48,7 @@
     }
   },
   "dependencies": {
-    "zod": "^4.4.3"
+    "zod": "^4.6.6"
   },
   "exports": {
     "./http": {

package/release-gates.json

@@ -490,7 +490,21 @@
       "packageSmokeEvidence": [
         "test/packageBoundary.test.ts",
         "test/invoicing/contracts.test.ts",
-        "test/invoicing/portFit.test.ts"
+        "test/invoicing/portFit.test.ts",
+        "test/invoicing/adapterConformance.test.ts",
+        "test/invoicing/issue.test.ts",
+        "test/invoicing/canonicalLines.test.ts",
+        "test/invoicing/paymentReadback.test.ts",
+        "test/invoicing/handoff.test.ts",
+        "test/invoicing/postgresStore.test.ts",
+        "test/invoicing/continuity.test.ts",
+        "test/invoicing/artifacts.test.ts",
+        "test/invoicing/delivery.test.ts",
+        "test/invoicing/readback.test.ts",
+        "test/invoicing/settlementSync.test.ts",
+        "test/invoicing/readModel.test.ts",
+        "test/invoicing/bindings.test.ts",
+        "test/invoicing/sellerRevision.test.ts"
       ],
       "entrypoint": "dist/invoicing/index.d.ts",
       "snapshot": "api/invoicing.api.md"
@@ -510,19 +524,19 @@
   },
   "pack": {
     "code": {
-      "maxPackedBytes": 1126400,
+      "maxPackedBytes": 1228800,
       "maxFiles": 2000
     },
     "docs": {
-      "maxPackedBytes": 49152,
+      "maxPackedBytes": 57344,
       "maxFiles": 10
     },
-    "maxPackedBytes": 1351680,
-    "maxUnpackedBytes": 5734400,
+    "maxPackedBytes": 1474560,
+    "maxUnpackedBytes": 6553600,
     "maxFiles": 2100,
     "baseline": {
-      "version": "0.22.0",
-      "packedBytes": 1185082
+      "version": "0.24.0",
+      "packedBytes": 1355949
     },
     "browserEntries": {
       "./catalog/contracts": 4096,