@openlup/platform 0.27.0 → 0.29.0

package/README.md

@@ -10,18 +10,27 @@ Development preview. This package is part of the publishable set with core and o
 
 It holds the runnable server substrate an OpenLup application composes: the Node HTTP runtime, BFF dispatch, scheduling and job leases, blob storage, data gateways, the node-postgres migration runner and bundle composition. Ports and their contracts stay in `@openlup/core/platform-runtime`.
 
-For the prepared `0.27.0` set, read the [adjacent-release migration and known
-limitations](CHANGELOG.md#0270) before selecting optional services. Experimental
+For the prepared `0.29.0` set, read the [adjacent-release migration and known
+limitations](CHANGELOG.md#0290) before selecting optional services. Experimental
+M13 marketing uses browser-safe `./marketing`, type-only browser-safe
+`./marketing/contracts`, and Node-only `./marketing/server` and
+`./marketing/server/postgres`. Marketing contributions and bindings remain
+inert and default-off. Experimental
+account/support APIs use `./account-support` and the type-only
+`./account-support/contracts`; reference bindings remain inert and default-off.
+Apply the M12 support-authority forwards after complete same-rail predecessors
+and follow the email-correction admission, claim, identity-commit and settlement
+migration notes before replacing retired callers. Experimental
 commerce schemas and ports use `./commerce` and `./commerce/contracts`;
 handlers, adapters and checkout engines use the Node-only `./commerce/server`.
 The commerce contribution and reference binding remain inert and default-off.
-Install the complete native chain through position 86
-(`20261024184600_subscription_retry_candidate_payment_filter.sql`); M11 adds no
-native SQL. Sparse SQL projections are not an install chain. Native runtime
+Install the complete native chain through the M12 support-authority forward
+(`20261026120000_account_support_operator_authority.sql`). Sparse SQL projections
+are not an install chain. Native runtime
 roles need the ATP/exposure EXECUTE and underlying SELECT grants described in
 the release notes.
-Managed hosts apply the complete prefix through `20261025110000`, including
-M11's nine forwards for preference/return ownership, operator receipts,
+Managed hosts apply the complete prefix through `20261026120100`, including
+the current support-authority forward and M11's nine forwards for preference/return ownership, operator receipts,
 acquisition/finalize admission, ATP preview and starter graduation. Legacy
 omitted-country input uses the configured settlement region; neutral commands
 require explicit country. Starter graduation admits 14, 21 or 28 days; rollback
@@ -45,7 +54,7 @@ Adopters must not activate unselected or unready invoicing; installation and
 inert contributions register no runner, worker, route or schedule.
 M06 managed-host proof classes remain pending in the
 [M06 parity ledger](../../docs/platform/plans/oss-m06-stock-reservations-delivery.md#parity-pending-rows).
-Size comparison uses the published `0.26.0` tarball. Preparation and offline
+Size comparison uses the published `0.28.0` tarball. Preparation and offline
 adapter evidence grant no publication or provider-account certification.
 
 Longer module recipes live in the [platform package reference](../../docs/platform/PLATFORM_PACKAGE_REFERENCE.md).
@@ -88,6 +97,12 @@ timestamp used in the webhook's idempotency key.
 | `./inventory` | Experimental schemas/ports, handlers, native stores, projection, injected forecast and SQL descriptor; `./inventory/contracts` DTOs. |
 | `./catalog` | Experimental neutral catalog schemas, drafts, reads, media source packs and publication ports |
 | `./catalog/contracts` | Dependency-free catalog DTOs, media resolver, authority and canonicalization helpers |
+| `./marketing/server` | Node-only acquisition handlers, direct read/evidence factories and research orchestration without `pg`; host responder, authorization, binding and notification copy |
+| `./marketing/server/postgres` | Acquisition case and research evidence PostgreSQL port factories; requires the existing optional `pg` peer |
+| `./marketing/server` (analytics context) | Injected analytics context handler with host persistence, capability and identity bindings |
+| `./marketing`, `./marketing/contracts` | Browser-safe acquisition history, portable prelaunch, survey evidence and newsletter consent schemas; type-only DTOs and acquisition/research ports |
+| `./marketing`, `./marketing/contracts` (analytics) | Browser-safe acquisition and research schemas, injected analytics, paid purchase and consent-time facts; type-only DTOs and ports |
+| `./marketing`, `./marketing/contracts` (SEO and content slots) | Browser-safe JSON-LD serialization and graph builders, URL/hreflang helpers, ordered head data and contact/legal projections; type-only organization, contact, legal-document and privacy-processor content slots |
 | `./commerce`, `./commerce/contracts` | Browser-safe neutral commerce schema cores, generic ports and pure contract helpers |
 | `./commerce/server` | Node-only OMS, returns, native reviews/media and hosted-feedback handlers/adapters and order-detail composition, email consumers, dispatch registry, paid-fulfillment binding and checkout compensation, checkout handlers, runtime and shared paid-order saga |
 | `./pricing` | Experimental price authority, quote computation/handlers, offer projection/cache, readiness and policy tokens |
@@ -98,6 +113,135 @@ timestamp used in the webhook's idempotency key.
 | `./shipping` | Experimental delivery ports, injected-schema handlers, summary/evidence; native flat-rate port + Core schema readiness |
 | `./shipping/contracts` | Type-only delivery, pickup-point, summary and evidence DTOs |
 
+## Marketing contracts
+
+`./marketing` provides acquisition address references, historical case projections,
+list/count reads, portable prelaunch list/detail schemas, idempotency keys, survey submission/evidence/list schemas and
+newsletter consent events/responses. Reference compatibility shims forward the
+same schema objects and load the reference validation wrapper before package
+schemas. The marketing runtime entry configures the shared Zod instance in
+jitless mode before constructing schemas, preserving CSP-safe initialization
+for direct imports as well as reference facades, like the pricing, catalog and
+communications entries. The type-only `./marketing/contracts` entry has no
+runtime initialization. The rich prelaunch DTO and case submit/transition schemas remain application-owned
+and are excluded from the browser entries. The shared
+`acquisitionOpaqueReferenceSchema` lets those retained contracts reuse the exact
+reference syntax. No entry registers a route automatically.
+
+`./marketing/contracts` exports only types. Explicit acquisition DTO shapes are
+checked against the runtime schema inference by an executed TypeScript equality
+witness. Reachable case ports expose list, get, active count and close; the app
+uses the server-only compatibility port for its retired methods. Evidence ports retain survey submission,
+survey listing and consent application. Port types are also forwarded through
+the runtime entry, following the commerce boundary. Both entries forward research schemas or types from the compatibility
+owner, `@openlup/core/marketing/research`; runtime schemas retain object identity.
+Case locale remains `en|pl`, matching the persisted constraint. Widening it requires
+a separate migration. Historical wire values remain unchanged.
+
+The source and built entries have browser graph proofs. The root test runner
+selects `test/marketing/`; the installed consumer checks both public entries,
+compiles typed usage and refuses deep imports. Kiosk and research reference
+contracts/ports continue to consume the core export. The app owns its admin
+response client and host composition.
+
+`./marketing/server` owns acquisition case handlers, list/count and prelaunch
+list/detail factories, survey evidence submit/list and consent application,
+research submit/admin handlers and managed survey orchestration without loading
+`pg`. Select `./marketing/server/postgres` for the two PostgreSQL port factories
+after installing the existing optional `pg` peer. Hosts inject the BFF responder,
+authorization and binding resolvers. Direct case reads receive the host bundle
+predicate at their original guard; prelaunch and evidence dispatch stays in the
+host. Notification HTML and subject are injected separately, preserving
+HTML rendering before the subject clock read. The reference owns retired
+route refusals, raw signed consent ingress and notification copy. PostgreSQL
+SQL, role selection and transaction/pool handling remain unchanged. The
+server-only compatibility command types do not expose retired admission schemas.
+
+Analytics facts share these browser-safe entries. `createNoopAnalytics` implements
+Core's existing analytics port; deployment and advertising defaults remain inert.
+`AnalyticsEventMap<StepName>` retains the host's literal step vocabulary, with
+`string` as the neutral default. Private transport ownership fields and envelopes
+remain host extensions. Types are forwarded type-only by `./marketing/contracts`.
+
+`createAnalyticsDataLayer` owns loader readiness per instance and accepts the host's
+browser/storage access, consent key and change event, `consentSignalNames`, event
+prefix, container reader and deployment callback. `consentSignalNames` supplies
+one `analytics` wire name and the ordered `advertising` wire names. Without it,
+no consent command is pushed and optional event admission returns false, even
+with browser access, a container and stored consent; deployment attempts remain
+independent. Consent commands seed default before update and
+use array-like arguments; advertising grants read marketing consent at push time.
+Revocation denies every signal. Sinks are attempted independently with failure
+isolation and no replay of observations made before consent. Admission booleans
+mean synchronous local acceptance only, never delivery or business acknowledgement.
+
+`createAnalyticsRoutePolicy` requires public paths, redirect sources and all
+sensitive-path sets. Its optional-route predicate preserves broad eligibility;
+deployment URL sanitization admits exact public paths and safe campaign values.
+`projectPaidPurchase` consumes only structural paid-recap facts, preserving
+allocation/grouping, the item cap and ordered suppression reasons without an
+ambient currency policy. `selectMarketingHistoricalConsentTime` selects exact
+native chronology only after host authorization, without changing the local
+grant. The reference retains its narrower checkout-kind admission and all wire
+names. [Purchase equivalence](../../src/checkout/machine/purchasePayloadEquivalence.test.ts)
+and the package analytics witnesses pin these boundaries.
+
+`createAnalyticsContextHandler` in `./marketing/server` accepts a required BFF
+responder, enable reader, persistence resolver, access-token reader, trusted-subject
+resolver, capability mint/hash functions, historical cookie name and `clientIdField`.
+The host supplies the client-id wire field name through `clientIdField`; the strict
+request also keeps `granted` and `explicitGrant`. Grants require a client
+id and existing revoked contexts require an explicit new grant for replacement.
+Only token hashes reach persistence. Enrollment uses only the server-verified
+subject, and invalid bearer grants refuse before writes. Cookie attributes and
+method/flag/origin/schema refusal order are preserved. The host owns flag and
+RPC names, gateway authority, route mounting and observability. Persistence
+operations must reject on failure; null persistence refuses as unavailable.
+There is no default persistence, portable SQL or reference route for this handler.
+An `active` result is a local context fact, never delivery, and telemetry context
+failure never gates commerce. The [context witness](test/marketing/analyticsContext.test.ts)
+exercises the factory through synthetic host bindings.
+
+`./marketing` also provides browser-safe JSON-LD serialization and graph builders,
+route URL/hreflang helpers, an ordered head descriptor and plain contact/legal
+projections. Applications supply identity, origin, routes, locales, images and
+content; the descriptor is plain data for a host head manager. The type-only
+`./marketing/contracts` entry exports shared organization facts and contact,
+legal-document and privacy-processor shapes, also forwarded as types by the
+runtime entry. The package supplies no document wording, processor inventory or
+content policy. The [marketing recipe](../../docs/platform/PLATFORM_PACKAGE_REFERENCE.md#marketing-seo-and-content-slots)
+owns the mechanics and installed-artifact proof.
+
+## Marketing composition
+
+`./composition` exports `createMarketingContribution`, an inert descriptor for
+the `marketing` capability's `./marketing`, `./marketing/contracts` and
+`./marketing/server` entries, with a runtime dependency on `identity/contracts`
+for obligation validation.
+Supply already-bound operations and host schema requirements. Ports, routes and
+triggers share the supplied functions; null ports remain required for Core
+readiness, and handlers retain only registration descriptors. Duplicate handler,
+schedule or route identities refuse. Construction invokes no callable and
+installs no worker, route or schedule. See the
+[composition contract](../../docs/platform/ARCHITECTURE_AND_EXTENSIONS.md#contributions-seams-and-readiness)
+for the host admission boundary.
+
+`./marketing/server` also exports `createMarketingPrivacyContributor` and
+`createMarketingPrivacyBindings`. Explicit enablement and both complete owner
+ports select one contributor; its `exportPersonalData`, `assessErasure` and
+`eraseOrRetain` callables can be passed directly to `createMarketingContribution`.
+Missing ownership makes coverage unavailable and erasure unresolved. Identity
+owns assessment ordering, subscription vetoes, receipt replay and transaction
+rollback; the marketing fence runs only during `eraseOrRetain`. Provider request
+acceptance never proves deletion. The reference leaves marketing unselected,
+so its marketing privacy coverage remains an open gap. See the
+[privacy composition recipe](../../docs/platform/PLATFORM_PACKAGE_REFERENCE.md#marketing-server-composition).
+
+The contributor and binding declarations use identity contract types and local
+structural interfaces compatible with identity's `PersonalDataContributor`.
+They do not reference identity's main entry; `./marketing/server` compiles without
+`pg` or `@types/pg`. Select `./marketing/server/postgres` explicitly for those ports.
+
 ## Commerce contracts
 
 `./composition` exports the inert `createCommerceContribution` for the installed
@@ -251,7 +395,7 @@ SQL (class (b) retention): native uses 14 days and the contributed managed profi
 uses 21 days. There is no TypeScript delay parameter or SQL change.
 The reference browser contract facades initialize their shared Zod instance in
 jitless mode before loading package schemas, preserving CSP-safe construction.
-The package contracts add no global Zod configuration side effect. Browser
+The commerce package contracts add no global Zod configuration side effect. Browser
 conformance bundles the complete commerce entry and both reference facades
 without externals; the raw-upload source is a failing browser control, while
 the complete server entry bundles for Node.
@@ -1041,3 +1185,101 @@ legacy fallback and forward-only migration limits are owned by the
 [M09 migration section](../../docs/platform/DATA_AND_MIGRATIONS.md#m09-invoicing-forward-design-and-control-approval).
 
 OMS read projections are optional. Omitting the host health classifier preserves the original unprojected empty health snapshot (`ok`, no reasons or evidence IDs); it does not evaluate provider health. The reference composition injects its existing classifier and evidence readers.
+
+## Account and support contracts
+
+Experimental `@openlup/platform/account-support` supplies `createAccountReadFacade`
+and the unchanged account-read diagnostic helpers. Inject account and order owner
+ports; delegation preserves their arguments, receivers, results, nulls and thrown
+failures. Authentication, authorization and private profile/market projection stay
+with the host. Importing this entry selects no driver or capability.
+
+`account-support/contracts` is type-only and browser-safe. It declares account,
+Customer 360, self-service command, operator recovery and invoice-access envelopes
+with explicit capability flags. These declarations do not install their services.
+The [account/support reference](../../docs/platform/PLATFORM_PACKAGE_REFERENCE.md#account-and-support-contracts)
+owns the available boundary and later-phase limits.
+
+R2 adds `readAccountSnapshot` with the two-stage fan-out and a store-level recent
+20-order request, stored-money order history/detail, Customer 360 projections
+and M09 invoice history/PDF delegation. `createInvoiceAccess` checks the requested
+document against the owned account/order history before resolving its ticket or
+reading PDF bytes; foreign or unknown documents return `{ kind: "denied" }`. Select pricing, captured line
+presentation, private extensions and fulfillment evidence through typed host
+ports. Missing evidence stays unknown; owner refusals retain their distinctions.
+The default-off reference selections and host-fed read views are unmounted.
+Native Customer 360 uses the existing authorized PostgreSQL support reader;
+account/history/invoice drivers still require explicit host selection.
+Subscription pointer enrichment preserves optional nullable `paymentMethodKind`:
+selected-empty evidence is null, while unread evidence is omitted. Reference
+line presentation explicitly picks the declared display keys before projection.
+
+`createCustomer360ReadFacade({ authorize, journey, summary, diagnostics })`
+requires `authorize(): Promise<boolean>` before every method's source read.
+Refused callers receive `{ kind: "denied" }`; authorized delegates preserve
+arguments, results, nulls and thrown failures. The reference binding supplies
+that authorization once per call, before opening either support scope.
+
+The [account/support reference](../../docs/platform/PLATFORM_PACKAGE_REFERENCE.md#account-and-support-contracts)
+owns the available R1 boundary and later-phase limits.
+
+
+R3 adds `createSelfServiceCommandFacade({ context, capabilities, ...lanes })`,
+returning `SelfServiceCommandFacade` with required host capabilities and every
+managedSubscription, nativeLegacySubscription, subscriptionControl, typed/raw,
+profile, paymentMethod, commerce and recovery output lane. Input lanes are optional.
+Unselected methods return `{ supported: false, refusalCode }`; paymentMethod uses
+the host paymentMethodSetup refusal by identity, commerce uses commerceRecovery,
+and other lanes use a frozen host_binding_required refusal. Every lane guards
+the principal; typed/raw lanes require a supplied clientId equal to context.clientId.
+The trailing `ControlSnapshot = unknown` generic retains the control snapshot type.
+Native legacy routing preserves
+explicit pause and ownership before bundle quote validation. Owner results,
+refusals and nulls retain identity. Supported paymentMethodSetup requires a
+paymentMethod lane; supported commerceRecovery/configuredPurchase require commerce.
+Supported genericBundleCommands/commandBoundReceipts require a selected subscription
+command lane. Missing required lanes refuse customer_self_service_lane_configuration_required.
+`encodeNativeSubscriptionCommand`, `decodeNativeSubscriptionPreview` and
+`createNativeSubscriptionDriver` retain the raw owner protocol and apply key;
+apply never previews. `createPaymentMethodComposition` adapts generic M07
+setupMethod to paymentMethod.execute without owner imports. Native repair is a
+[registered follow-up](../../docs/platform/plans/oss-m12-account-support.md#follow-up-register).
+The default-off reference binding mounts nothing; browser key retention and
+native profile/start remain unselected.
+
+
+R4 adds `createOperatorRecovery`, `createManagedOperatorAuthority`,
+`createPostgresOperatorAuthority`, `operatorAuthorityCapabilities`,
+`moveIdentityForEmailCorrection`, `executeOperatorAccountLink`, `linkThenApply`
+and `ACCOUNT_SUPPORT_MIGRATIONS`. The host injects its transaction/RPC and identity
+ports, verified human operator and recovery-path policy. Recovery token generation
+and SHA-256 hashing use the runtime Web Crypto API without a Node import; the
+host may still inject its opaque-token generator. Managed email admission
+and claim precede identity mutation and settlement. Native lifecycle commands
+delegate to M10, with actual optional owner receipts and named unavailable
+subcases. Link-then-action reports a completed link separately when the second
+command refuses or fails. The reference binding is default-off and unmounted;
+no import provisions authority or activates a route.
+
+R5a adds `createAccountSupportBindings` and `createAccountSupportServices` here,
+and `createAccountSupportContribution` in `/composition`. Supply already bound
+R1–R4/owner operations for one explicit managed/native graph, host capabilities
+and a readiness observer. Each distinct callable receives one guard shared by
+its service, port and route aliases; each entrance re-observes readiness. Disabled
+construction calls no observer. Refusals are `disabled`, `schema_unknown` and
+`schema_unsatisfied`; owner results and thrown failures pass through unchanged.
+A null selected operation remains a required port without an executable binding.
+The separate injected commerce record uses `commerce(key, ...args)` and returns
+`{ kind: "unsupported", code: "host_binding_required" }` for a null record/member.
+The reference host may select real M11 checkout/recovery, ATP and existing effect
+descriptors by supplying its already-built selection through `commerceOwner`
+and its existing registry through `commerceRegistry`. R5b does not construct M11
+or import its adapters; the host supplies the complete account/M11/ATP schema
+and matching enablement/readiness. Keep capability flags unsupported until
+their owner callables are bound. This adds no package export or owner import to
+account-support contracts. One M11 result is forwarded without rewrapping its
+guarded services; unknown stock, unsupported options and handler outcomes retain
+their owner meaning. Contribution descriptors install no routes, handlers,
+schedules or workers. See the
+[reference recipe](../../docs/platform/RUNTIME_AND_SELF_HOSTING.md#opt-in-disposable-subscription-reference)
+for the host's schema and transport obligations.

package/dist/account-support/accountReadFacade.d.ts

@@ -0,0 +1,8 @@
+import type { AccountReadPort } from "./contracts/index.js";
+/** Pure delegation to selected owner reads. Authorization, defaults, diagnostics,
+ * private fields and transport refusal mapping remain with the injected owners.
+ */
+export declare function createAccountReadFacade<Account, OrderList, OrderDetail>(ports: {
+    account: Pick<AccountReadPort<Account, OrderList, OrderDetail>, "getAccount">;
+    orders: Pick<AccountReadPort<Account, OrderList, OrderDetail>, "listOrders" | "getOrderDetail">;
+}): AccountReadPort<Account, OrderList, OrderDetail>;

package/dist/account-support/accountReadFacade.js

@@ -0,0 +1,10 @@
+/** Pure delegation to selected owner reads. Authorization, defaults, diagnostics,
+ * private fields and transport refusal mapping remain with the injected owners.
+ */
+export function createAccountReadFacade(ports) {
+    return {
+        getAccount(userId) { return ports.account.getAccount(userId); },
+        listOrders(userId, input) { return ports.orders.listOrders(userId, input); },
+        getOrderDetail(userId, orderId) { return ports.orders.getOrderDetail(userId, orderId); },
+    };
+}

package/dist/account-support/accountReadModels.d.ts

@@ -0,0 +1,69 @@
+import type { AccountActionRequired, AccountSnapshot, AccountSubscription, AccountSubscriptionLine, AccountOrderSummary } from "./contracts/account.js";
+import type { SubscriptionPaymentMethodStatus } from "./contracts/commands.js";
+export declare const CUSTOMER_ACCOUNT_V2_CONTRACT_VERSION: "customer.account.v3";
+type Row = Record<string, unknown>;
+export interface CustomerSubscriptionEligibilityInput {
+    subscriptionId: string;
+    status: AccountSubscription["status"];
+    nextCycleAt: string | null;
+    editCutoffAt: string | null;
+    paymentMethodKind: string | null;
+    paymentMethodRefPresent: boolean;
+    paymentMethodStatus?: SubscriptionPaymentMethodStatus;
+}
+export interface CustomerSubscriptionEligibility {
+    canEdit: boolean;
+    reason: AccountSubscription["editBlockedReason"];
+}
+export interface SubscriptionActionState {
+    subscriptionId: string;
+    orderId: string | null;
+    blockedReason: AccountActionRequired["blockedReason"];
+    failureCause: AccountActionRequired["failureCause"];
+    recoveryEligible: boolean;
+    dueAt: string | null;
+    nextRetryAt: string | null;
+}
+export interface AccountReadSources<Extension, ChargeEvidence = AccountSubscription["nextCharge"], PaymentEvidence = unknown> {
+    readExtension(clientId: string): Promise<Extension>;
+    /** The selected store applies the bound BEFORE visibility filtering. */
+    readSubscriptionRows(clientId: string, limit: number): Promise<Row[]>;
+    readAddresses(clientId: string): Promise<AccountSnapshot["addresses"]>;
+    readOrdererProfiles(clientId: string): Promise<AccountSnapshot["ordererProfiles"]>;
+    readPaymentPreferences(clientId: string): Promise<AccountSnapshot["paymentPreferences"]>;
+    readDeliveryPreferences(clientId: string): Promise<AccountSnapshot["deliveryPreferences"]>;
+    readOrders(clientId: string, limit: number): Promise<{
+        orders: AccountOrderSummary[];
+    }>;
+    readEvents(clientId: string): Promise<AccountSnapshot["events"]>;
+    readSubscriptionLines(ids: string[]): Promise<Map<string, AccountSubscriptionLine[]>>;
+    readSubscriptionBlockers(ids: string[], nextCycles: Map<string, string | null>): Promise<Map<string, NonNullable<AccountSubscription["editBlockedReason"]>>>;
+    readPauseWindows(ids: string[]): Promise<Map<string, Pick<AccountSubscription, "pausePreset" | "pauseStartedAt" | "pauseEndsAt">>>;
+    readPaymentEvidence(ids: string[]): Promise<Map<string, PaymentEvidence>>;
+    /** Owner interprets M08 refusal; unsupported MUST throw, never return an empty Map. */
+    readDeliveryAlignments(nextCycles: Map<string, string | null>): Promise<Map<string, {
+        state: "protected" | "aligned";
+    }>>;
+    readNextCharges(rows: Row[]): Promise<Map<string, ChargeEvidence>>;
+    readActionStates(ids: string[]): Promise<Map<string, SubscriptionActionState>>;
+}
+export interface AccountReadProjectionPolicy<ChargeEvidence = AccountSubscription["nextCharge"], PaymentEvidence = unknown> {
+    paymentMethodStatus(input: {
+        clientId: string;
+        clientEmail: string | null;
+        row: Row;
+        evidence: PaymentEvidence | undefined;
+    }): SubscriptionPaymentMethodStatus;
+    canUsePaymentMethodForRenewal(status: SubscriptionPaymentMethodStatus): boolean;
+    packageSummary(lines: AccountSubscriptionLine[], constraint: unknown): string | null;
+    /** Pricing authority selects payable-cycle/acquisition shipping precedence. */
+    withNextCharge(recurring: AccountSubscription["recurringPrice"], next: ChargeEvidence | undefined): Pick<AccountSubscription, "recurringPrice" | "nextCharge">;
+}
+/** Two observation stages, including the original nested subscription fan-out. Auth/ownership precedes this call. */
+export declare function readAccountSnapshot<Extension, ChargeEvidence, PaymentEvidence>(sources: AccountReadSources<Extension, ChargeEvidence, PaymentEvidence>, policy: AccountReadProjectionPolicy<ChargeEvidence, PaymentEvidence>, client: Row): Promise<AccountSnapshot<Extension>>;
+export declare function isCustomerVisibleSubscription(row: Row): boolean;
+export declare function recurringPrice(lines: AccountSubscriptionLine[]): AccountSubscription["recurringPrice"];
+export declare function editCutoff(nextCycleAt: string | null, editWindowHours: number | null): string | null;
+export declare function computeEditState(input: CustomerSubscriptionEligibilityInput, blockers: ReadonlyMap<string, NonNullable<AccountSubscription["editBlockedReason"]>>, canUse: AccountReadProjectionPolicy["canUsePaymentMethodForRenewal"]): CustomerSubscriptionEligibility;
+export declare function buildActionRequired(subscriptions: AccountSubscription[], orders: AccountOrderSummary[], states: Map<string, SubscriptionActionState> | undefined, canUse: AccountReadProjectionPolicy["canUsePaymentMethodForRenewal"]): AccountActionRequired[];
+export {};