@sixtyninecommerce/admin 0.8.0 → 0.9.0

package/dist/stored-value/index.js

@@ -0,0 +1,130 @@
+const ACCOUNT_FIELDS = `
+  id
+  createdAt
+  updatedAt
+  kind
+  unit
+  customerId
+  codeLast4
+  expiresAt
+  expiresOn
+  status
+  balance
+  spendable
+`;
+export const STORED_VALUE_ACCOUNTS_QUERY = /* GraphQL */ `
+  query StoredValueAccounts($customerId: ID, $kind: String, $take: Int, $skip: Int) {
+    storedValueAccounts(customerId: $customerId, kind: $kind, take: $take, skip: $skip) {
+      items { ${ACCOUNT_FIELDS} }
+      totalItems
+    }
+  }
+`;
+export const STORED_VALUE_ACCOUNT_QUERY = /* GraphQL */ `
+  query StoredValueAccount($id: ID!) {
+    storedValueAccount(id: $id) { ${ACCOUNT_FIELDS} }
+  }
+`;
+export const STORED_VALUE_STATEMENT_QUERY = /* GraphQL */ `
+  query StoredValueStatement($accountId: ID!, $from: DateTime, $to: DateTime, $take: Int, $skip: Int) {
+    storedValueStatement(accountId: $accountId, from: $from, to: $to, take: $take, skip: $skip) {
+      account { ${ACCOUNT_FIELDS} }
+      openingBalance
+      closingBalance
+      totalItems
+      entries {
+        id createdAt occurredAt entryType amount balanceAfter unit sourceType sourceId paymentId
+        orderId locationId actorType actorId onBehalfOfRef deviceRef reason
+      }
+    }
+  }
+`;
+export const STORED_VALUE_LIABILITY_QUERY = /* GraphQL */ `
+  query StoredValueLiability($at: DateTime, $kind: String, $locationId: ID) {
+    storedValueLiability(at: $at, kind: $kind, locationId: $locationId) {
+      unit kind accounts issued redeemed reversed adjusted expired forfeited outstanding
+    }
+  }
+`;
+export const ISSUE_STORED_VALUE_MUTATION = /* GraphQL */ `
+  mutation IssueStoredValue($input: IssueStoredValueInput!, $idempotencyKey: String) {
+    issueStoredValue(input: $input, idempotencyKey: $idempotencyKey) { ${ACCOUNT_FIELDS} }
+  }
+`;
+export const ADJUST_STORED_VALUE_MUTATION = /* GraphQL */ `
+  mutation AdjustStoredValue($input: AdjustStoredValueInput!, $idempotencyKey: String) {
+    adjustStoredValue(input: $input, idempotencyKey: $idempotencyKey) { ${ACCOUNT_FIELDS} }
+  }
+`;
+export const BLOCK_STORED_VALUE_MUTATION = /* GraphQL */ `
+  mutation BlockStoredValueAccount($id: ID!, $reason: String!) {
+    blockStoredValueAccount(id: $id, reason: $reason) { ${ACCOUNT_FIELDS} }
+  }
+`;
+export const UNBLOCK_STORED_VALUE_MUTATION = /* GraphQL */ `
+  mutation UnblockStoredValueAccount($id: ID!, $reason: String!) {
+    unblockStoredValueAccount(id: $id, reason: $reason) { ${ACCOUNT_FIELDS} }
+  }
+`;
+export const SET_STORED_VALUE_EXPIRY_MUTATION = /* GraphQL */ `
+  mutation SetStoredValueAccountExpiry(
+    $id: ID!
+    $expiresOn: String
+    $reason: String!
+    $idempotencyKey: String
+  ) {
+    setStoredValueAccountExpiry(
+      id: $id
+      expiresOn: $expiresOn
+      reason: $reason
+      idempotencyKey: $idempotencyKey
+    ) { ${ACCOUNT_FIELDS} }
+  }
+`;
+export const REDEEM_STORED_VALUE_MUTATION = /* GraphQL */ `
+  mutation RedeemStoredValue($input: RedeemStoredValueInput!, $idempotencyKey: String) {
+    redeemStoredValue(input: $input, idempotencyKey: $idempotencyKey) {
+      orderId
+      paymentId
+      accountId
+      amount
+    }
+  }
+`;
+export function createStoredValueModule(transport) {
+    const read = async (query, variables, options) => transport.graphql({ api: 'admin', query, variables }, options);
+    // The key is an ARGUMENT on the Admin API; `undefined` keeps an omitted key off the wire.
+    const write = async (query, variables, options) => transport.graphql({ api: 'admin', query, variables: { ...variables, idempotencyKey: options?.idempotencyKey } }, options);
+    return {
+        async accounts(filter = {}, options) {
+            return (await read(STORED_VALUE_ACCOUNTS_QUERY, filter, options)).storedValueAccounts;
+        },
+        async account(id, options) {
+            return (await read(STORED_VALUE_ACCOUNT_QUERY, { id }, options)).storedValueAccount;
+        },
+        async statement(accountId, window = {}, options) {
+            return (await read(STORED_VALUE_STATEMENT_QUERY, { accountId, ...window }, options)).storedValueStatement;
+        },
+        async liability(filter = {}, options) {
+            return (await read(STORED_VALUE_LIABILITY_QUERY, filter, options)).storedValueLiability;
+        },
+        async issue(input, options) {
+            return (await write(ISSUE_STORED_VALUE_MUTATION, { input }, options)).issueStoredValue;
+        },
+        async adjust(input, options) {
+            return (await write(ADJUST_STORED_VALUE_MUTATION, { input }, options)).adjustStoredValue;
+        },
+        async block(id, reason, options) {
+            return (await read(BLOCK_STORED_VALUE_MUTATION, { id, reason }, options)).blockStoredValueAccount;
+        },
+        async unblock(id, reason, options) {
+            return (await read(UNBLOCK_STORED_VALUE_MUTATION, { id, reason }, options)).unblockStoredValueAccount;
+        },
+        async setExpiry(id, expiresOn, reason, options) {
+            return (await write(SET_STORED_VALUE_EXPIRY_MUTATION, { id, expiresOn, reason }, options)).setStoredValueAccountExpiry;
+        },
+        async redeem(input, options) {
+            return (await write(REDEEM_STORED_VALUE_MUTATION, { input }, options)).redeemStoredValue;
+        },
+    };
+}

package/dist/tenant/capabilities.d.ts

@@ -83,6 +83,16 @@ export interface CapabilityManifest {
      * Optional because a platform older than this field simply does not send it.
      */
     assertionAudience?: string | null;
+    /**
+     * Whether this store is a sandbox (`platform.provisionStore({ sandbox: true })`,
+     * spec §6.6): test-mode payments only, no ERP or marketing push, left out of
+     * platform metrics, purged past retention holds. Fixed at provisioning.
+     *
+     * `null` when the platform could not read the flag this time (such an answer
+     * is never cached, so `refresh()` asks again); absent from a platform older
+     * than this field. Treat anything but `true` as "not a sandbox".
+     */
+    sandbox?: boolean | null;
     /** A member added after this SDK release arrives camelised and untouched. */
     [extra: string]: unknown;
 }

package/dist/tenant/entitlements.d.ts

@@ -0,0 +1,35 @@
+import type { Transport } from '@sixtyninecommerce/core';
+import type { Call } from '../types.js';
+/** Where a plugin grant of the active store comes from. */
+export type TenantEntitlementSource = 'channel' | 'organization';
+/**
+ * One plugin the ACTIVE store may use: its own grant, or one its organization holds for every
+ * member store and its workspace. A plugin with no row is not granted.
+ */
+export interface TenantEntitlement {
+    /** The plugin's catalog key (`pos`, `afas`, `product-feeds`, …), exactly as the engine sends it. */
+    pluginKey: string;
+    /**
+     * `channel` for the store's own grant, `organization` for one granted to its whole organization.
+     * When both exist the store's own row wins, so a key appears once. A string on the wire: a newer
+     * engine may answer a source this SDK does not name yet.
+     */
+    source: TenantEntitlementSource | (string & {});
+}
+/**
+ * The plugin grants of the ACTIVE store (plan W9-4, spec §9.2 `tenant` "entitlements (read)").
+ *
+ * `admin.tenant.entitlements(call?)` reads the engine's own union of the store's and its
+ * organization's grants, the one it reads to allow a plugin's back-office operations. The grant
+ * rows are read on every call, so a grant switched in Platform → Plugins answers on the next one.
+ * Only which organization a store belongs to is remembered, up to 60 s per server process: a store
+ * that has just joined an organization may take that long to list its organization's grants.
+ *
+ * Needs `ReadCatalog` or `ReadSettings` on the store; without either the engine answers
+ * `FORBIDDEN` ({@link PermissionDeniedError}, 403). No channel argument: a tenant-scoped
+ * credential reads its own store only, and a SuperAdmin reads any store with that store as the
+ * tenant.
+ */
+export type TenantEntitlementsReader = (call?: Call) => Promise<TenantEntitlement[]>;
+export declare const ACTIVE_PLUGIN_ENTITLEMENTS_QUERY = "\n  query TenantEntitlements {\n    activePluginEntitlements {\n      pluginKey\n      source\n    }\n  }\n";
+export declare function createTenantEntitlementsReader(transport: Transport): TenantEntitlementsReader;

package/dist/tenant/entitlements.js

@@ -0,0 +1,15 @@
+export const ACTIVE_PLUGIN_ENTITLEMENTS_QUERY = /* GraphQL */ `
+  query TenantEntitlements {
+    activePluginEntitlements {
+      pluginKey
+      source
+    }
+  }
+`;
+export function createTenantEntitlementsReader(transport) {
+    return async (call) => {
+        const data = await transport.graphql({ api: 'admin', query: ACTIVE_PLUGIN_ENTITLEMENTS_QUERY }, call);
+        // Only the two fields this type promises, whatever else a newer engine adds to a row.
+        return data.activePluginEntitlements.map(({ pluginKey, source }) => ({ pluginKey, source }));
+    };
+}

package/dist/tenant/field-groups.d.ts

@@ -0,0 +1,64 @@
+import type { Transport } from '@sixtyninecommerce/core';
+import type { Call } from '../types.js';
+/**
+ * One field group's owner on the ACTIVE store: the app installation or personal API token the
+ * store handed it to. A store hands each of the four groups — `price` (Price), `stock` (Stock),
+ * `product_details` (Product details), `customer_details` (Customer details) — to at most one
+ * owner at a time.
+ */
+export interface FieldGroupOwnership {
+    /** `price` | `stock` | `product_details` | `customer_details`. */
+    group: string;
+    /** `app_installation` | `api_token`. A string on the wire: read an unknown value as neither. */
+    ownerKind: 'app_installation' | 'api_token' | (string & {});
+    /** The installation id or the API token id. */
+    ownerId: string;
+    /** The app's name, or the API token's name. */
+    label: string;
+    /** The app's slug for an installation; null for an API token. */
+    appSlug: string | null;
+    /**
+     * True while the owner is suspended (the store suspended the installation, or the platform
+     * suspended the app): its claim stands, so no other app or token can be granted the group,
+     * but nothing is held for it until it resumes. Always false for an API token.
+     */
+    paused: boolean;
+}
+/**
+ * A field group a writer built into the platform already writes into the active store, so it
+ * cannot be handed to an app or API token there (a grant naming it is refused
+ * `FIELD_GROUP_ERP_SYNCED`).
+ */
+export interface FieldGroupSyncSource {
+    /** `price` | `stock` | `product_details` | `customer_details`. */
+    group: string;
+    /**
+     * `exact`: Exact Online is connected and writes all four groups (disconnect it first).
+     * `organization`: the store belongs to an organization, which can share its catalogue into it
+     * at any time and then writes its prices and product details, so they stay with it whether or
+     * not it shares them today. `workspace`: the channel is an organization's workspace, whose
+     * prices and product details are the catalogue the member stores receive. A string on the
+     * wire.
+     */
+    source: 'exact' | 'organization' | 'workspace' | (string & {});
+    /** `Exact Online`, or the organization's name (`organization` and `workspace`). */
+    label: string;
+}
+/**
+ * Every field group's owner on the ACTIVE store (`admin.tenant.fieldGroupOwners(call?)`), in
+ * group order. A group with no entry has no owner. Needs a permission that reads or changes a
+ * group's data (`ReadCatalog`, `ReadProduct`, `ReadCustomer`, `ReadSettings`, or a group's write
+ * permission), `InstallApps` or `ManageApiToken`; anything else is `FORBIDDEN`.
+ */
+export type FieldGroupOwnersReader = (call?: Call) => Promise<FieldGroupOwnership[]>;
+/**
+ * The field groups a built-in writer already writes into the ACTIVE store
+ * (`admin.tenant.fieldGroupSyncSources(call?)`), one entry per group and writer. Same
+ * permissions as {@link FieldGroupOwnersReader}.
+ */
+export type FieldGroupSyncSourcesReader = (call?: Call) => Promise<FieldGroupSyncSource[]>;
+export declare const FIELD_GROUP_OWNERSHIP_FIELDS = "\n  group\n  ownerKind\n  ownerId\n  label\n  appSlug\n  paused\n";
+export declare const FIELD_GROUP_OWNERS_QUERY = "\n  query FieldGroupOwners {\n    fieldGroupOwners { \n  group\n  ownerKind\n  ownerId\n  label\n  appSlug\n  paused\n }\n  }\n";
+export declare const FIELD_GROUP_SYNC_SOURCES_QUERY = "\n  query FieldGroupSyncSources {\n    fieldGroupSyncSources {\n      group\n      source\n      label\n    }\n  }\n";
+export declare function createFieldGroupOwnersReader(transport: Transport): FieldGroupOwnersReader;
+export declare function createFieldGroupSyncSourcesReader(transport: Transport): FieldGroupSyncSourcesReader;

package/dist/tenant/field-groups.js

@@ -0,0 +1,34 @@
+export const FIELD_GROUP_OWNERSHIP_FIELDS = /* GraphQL */ `
+  group
+  ownerKind
+  ownerId
+  label
+  appSlug
+  paused
+`;
+export const FIELD_GROUP_OWNERS_QUERY = /* GraphQL */ `
+  query FieldGroupOwners {
+    fieldGroupOwners { ${FIELD_GROUP_OWNERSHIP_FIELDS} }
+  }
+`;
+export const FIELD_GROUP_SYNC_SOURCES_QUERY = /* GraphQL */ `
+  query FieldGroupSyncSources {
+    fieldGroupSyncSources {
+      group
+      source
+      label
+    }
+  }
+`;
+export function createFieldGroupOwnersReader(transport) {
+    return async (call) => {
+        const data = await transport.graphql({ api: 'admin', query: FIELD_GROUP_OWNERS_QUERY }, call);
+        return data.fieldGroupOwners;
+    };
+}
+export function createFieldGroupSyncSourcesReader(transport) {
+    return async (call) => {
+        const data = await transport.graphql({ api: 'admin', query: FIELD_GROUP_SYNC_SOURCES_QUERY }, call);
+        return data.fieldGroupSyncSources;
+    };
+}

package/dist/tenant/legal-entity.d.ts

@@ -0,0 +1,32 @@
+import { type Transport } from '@sixtyninecommerce/core';
+import { type LegalEntity, type UpdateLegalEntityInput } from '../platform/legal-entities.js';
+import { type TenantLegalEntityNumberingModule } from '../platform/legal-entity-numbering.js';
+import type { Call } from '../types.js';
+/**
+ * `admin.tenant.legalEntity` — the ACTIVE store's legal entity: the company its invoices name
+ * (multi-region spec §7.1). Reading it needs `ReadSettings` on the store. Changing it needs
+ * `UpdateSeller` on EVERY store of the entity, because the entity prints on all of their invoices;
+ * a store sharing its entity with stores the caller does not run reads it with `editable: false`,
+ * and `update` is refused with `SHARED_SELLER_NOT_ALLOWED` (403).
+ */
+export interface LegalEntityModule {
+    /** Null on a store with no legal entity, an organization's workspace and the root channel. */
+    get(call?: Call): Promise<LegalEntity | null>;
+    /**
+     * Changes the fields given and answers the entity. Its legal name, VAT, EORI and registration
+     * numbers are copied onto every one of its stores in the same transaction; the registered office
+     * and time zone are the entity's alone. Two requests: the active store's entity is read first,
+     * and a store with none is refused with `LEGAL_ENTITY_NOT_FOUND` (404) before anything is
+     * written. Refusals from the engine: `SHARED_SELLER_NOT_ALLOWED` (403),
+     * `LEGAL_ENTITY_FIELD_INVALID`, `INVALID_COUNTRY_CODE`, `INVALID_TIMEZONE` (400).
+     */
+    update(input: UpdateLegalEntityInput, call?: Call): Promise<LegalEntity>;
+    /**
+     * The numbering series the active store's legal entity shares with its other stores (B6c):
+     * `get` needs `ReadSettings` on the store; `update` needs `UpdateSettings` on EVERY store of the
+     * entity (`SHARED_SELLER_NOT_ALLOWED`, 403).
+     */
+    numbering: TenantLegalEntityNumberingModule;
+}
+export declare const ACTIVE_LEGAL_ENTITY_QUERY = "\n  query ActiveLegalEntity {\n    activeLegalEntity { \n  id\n  name\n  legalName\n  vatNumber\n  vatNumberUk\n  eoriNumber\n  registrationNumber\n  registeredAddressLine1\n  registeredAddressLine2\n  registeredCity\n  registeredPostalCode\n  registeredProvince\n  registeredCountry\n  timezone\n  stores {\n    id\n    code\n  }\n  storeCount\n  editable\n  createdAt\n  updatedAt\n }\n  }\n";
+export declare function createLegalEntityModule(transport: Transport): LegalEntityModule;

package/dist/tenant/legal-entity.js

@@ -0,0 +1,41 @@
+import { NotFoundError } from '@sixtyninecommerce/core';
+import { LEGAL_ENTITY_FIELDS, legalEntityInputOf, UPDATE_LEGAL_ENTITY_MUTATION, } from '../platform/legal-entities.js';
+import { createTenantLegalEntityNumberingModule, } from '../platform/legal-entity-numbering.js';
+export const ACTIVE_LEGAL_ENTITY_QUERY = /* GraphQL */ `
+  query ActiveLegalEntity {
+    activeLegalEntity { ${LEGAL_ENTITY_FIELDS} }
+  }
+`;
+const ACTIVE_LEGAL_ENTITY_ID_QUERY = /* GraphQL */ `
+  query ActiveLegalEntityId {
+    activeLegalEntity { id }
+  }
+`;
+export function createLegalEntityModule(transport) {
+    return {
+        numbering: createTenantLegalEntityNumberingModule(transport),
+        async get(call) {
+            const data = await transport.graphql({ api: 'admin', query: ACTIVE_LEGAL_ENTITY_QUERY }, call);
+            return data.activeLegalEntity;
+        },
+        async update(input, call) {
+            const active = await transport.graphql({ api: 'admin', query: ACTIVE_LEGAL_ENTITY_ID_QUERY }, call);
+            const id = active.activeLegalEntity?.id;
+            if (!id) {
+                throw new NotFoundError({
+                    code: 'LEGAL_ENTITY_NOT_FOUND',
+                    message: 'The active store has no legal entity to change.',
+                    status: 404,
+                    service: 'vendure',
+                });
+            }
+            const { name: _ignored, ...fields } = input;
+            const data = await transport.graphql({
+                api: 'admin',
+                query: UPDATE_LEGAL_ENTITY_MUTATION,
+                variables: { id, input: legalEntityInputOf(fields) },
+            }, call);
+            return data.updateLegalEntity;
+        },
+    };
+}

package/dist/tenant/notifications.d.ts

@@ -0,0 +1,148 @@
+import type { Transport } from '@sixtyninecommerce/core';
+import type { Call } from '../types.js';
+/**
+ * Who sends a notification event's email for this store (headless spec §8.15).
+ *
+ * - `platform` — the platform renders and sends it. The default.
+ * - `none` — the platform does not. Your own system sends something in its
+ *   place, triggered by the matching platform event (`admin.events`; the
+ *   entry's `replacementEventTypes` names it), and every
+ *   dispatch the platform skips is still recorded on the store's email delivery
+ *   log (status `skipped`, `metadata.skipReason: 'SENDER_NONE'`), so the
+ *   silence is auditable.
+ *
+ * The merchant-facing labels are `admin.meta.catalog().labels.notificationSender`.
+ */
+export type NotificationSender = 'platform' | 'none';
+/**
+ * One piece of a recipient field: a literal address (`text`) or a variable the
+ * platform resolves per email (`var`, e.g. `customer_email`). A field's segments
+ * are joined into one comma-separated list at send time.
+ */
+export type NotificationRecipientSegment = {
+    type: 'text';
+    value: string;
+} | {
+    type: 'var';
+    key: string;
+};
+export interface NotificationRecipients {
+    to: NotificationRecipientSegment[];
+    cc: NotificationRecipientSegment[];
+    bcc: NotificationRecipientSegment[];
+}
+/** One notification event's configuration on the active store. */
+export interface NotificationEventConfig {
+    id: string;
+    /** The notification event key — `order_placed`, `magic_link_login`, … */
+    event: string;
+    /**
+     * `false` switches the email off altogether; nothing is logged for it. Always
+     * `true` for `password_reset`, `email_change` and `account_setup`, which
+     * cannot be switched off.
+     */
+    enabled: boolean;
+    sender: NotificationSender;
+    recipients: NotificationRecipients;
+    /** The email template the platform renders for it. */
+    templateType: string;
+    label: string;
+    description: string;
+    /** `order`, `customer`, `account` (the identity emails), `product` or `operational`. */
+    category: string;
+    /**
+     * The platform event types your system sends this email from when `sender`
+     * is `none` — `['order.created']` for `order_placed`. `null` when no event
+     * the platform emits replaces it; `sender: 'none'` is then refused.
+     */
+    replacementEventTypes: string[] | null;
+}
+export interface UpdateNotificationEventConfigInput {
+    /**
+     * `false` is refused with `EVENT_ALWAYS_ENABLED` ({@link ValidationError}) on
+     * `password_reset`, `email_change` and `account_setup`: each is the only way
+     * a customer resets a password (or sets the first one on an imported
+     * account), confirms a new address, or finishes a storefront registration,
+     * so they are always sent. `magic_link_login` and `customer_invite` can be
+     * switched off.
+     */
+    enabled?: boolean;
+    /**
+     * `none` is refused on the identity emails — the `account` category:
+     * password reset, magic link, invitation, email change, email and chat
+     * verification — with `EVENT_ALWAYS_PLATFORM_SENT` ({@link ValidationError}).
+     * Each carries a one-time credential only the platform can issue, and no
+     * platform event carries one, so there is no event your system could send it
+     * from. What you control there is where its link lands (your head's URL).
+     *
+     * `none` is also refused on an email whose `replacementEventTypes` is `null`,
+     * with `NO_REPLACEMENT_EVENT` ({@link ValidationError}): no platform event is
+     * emitted when it is due, so your system would never know to send it.
+     */
+    sender?: NotificationSender;
+    /**
+     * Each list REPLACES that field's segments; an omitted list is left as it is.
+     *
+     * The identity emails (the `account` category) and `new_customer` carry sign-in
+     * links or codes, and one login serves the person in every store, so they go to
+     * the account holder alone: `to` is the `customer_email` variable, `cc` and
+     * `bcc` are empty, and `list` answers exactly that whatever was stored before.
+     * Any other list on them is refused with `IDENTITY_EMAIL_RECIPIENTS_FIXED`
+     * ({@link ValidationError}); resending the lists `list` answered is accepted.
+     */
+    recipients?: Partial<NotificationRecipients>;
+}
+/**
+ * The store's transactional emails (`admin.tenant.notifications`) — per event:
+ * on or off, who sends it, and to whom.
+ *
+ * Always the ACTIVE channel; no channel argument. Reading and writing both need
+ * `UpdateSettings`. The list is small and fixed (one entry per notification
+ * event the platform knows), so it is a plain array rather than a page.
+ *
+ * Every accepted update puts ONE `notification_config.changed` on the event
+ * stream with the resulting `enabled` and `sender` (never the recipients), so a
+ * head that sends some emails itself can start or stop without polling.
+ *
+ * **A store that takes `settings.email` from its organization**
+ * (`admin.tenant.settingsSources`: locked, or inheritable and not overridden)
+ * sends the emails the platform sends for it by the organization's `enabled`
+ * and recipient lists, or by the platform's default for an event the
+ * organization has none for. `sender` stays the store's own, and an email
+ * your system already sends (`sender: 'none'`) keeps the store's own entry
+ * whole: the organization never changes what your head must do. `list`
+ * answers what applies (a stable `id` also for an event the store holds no
+ * entry of its own for), and `update` refuses any change, `sender` included;
+ * resending an entry as `list` answered it is accepted and changes nothing.
+ * `override('settings.email')` first to change them. The From address stays
+ * the store's own gateway's.
+ *
+ * **Coded refusals**, GraphQL errors mapped by `core`:
+ * - `EVENT_ALWAYS_PLATFORM_SENT` → {@link ValidationError}: `sender: 'none'` on
+ *   an identity email. The message names the event; `details[0].field` is
+ *   `/sender`.
+ * - `EVENT_ALWAYS_ENABLED` → {@link ValidationError}: `enabled: false` on
+ *   `password_reset`, `email_change` or `account_setup`. The message names the
+ *   event and why it cannot be switched off; `details[0].field` is `/enabled`.
+ * - `NO_REPLACEMENT_EVENT` → {@link ValidationError}: `sender: 'none'` on an
+ *   email no emitted platform event replaces (`replacementEventTypes: null`).
+ *   The message names the event, and the event planned to replace it when one
+ *   is; `details[0].field` is `/sender`.
+ * - `IDENTITY_EMAIL_RECIPIENTS_FIXED` → {@link ValidationError}: a recipient
+ *   list on an identity email (or `new_customer`) that names anyone but the
+ *   account holder. `details[].field` names each offending list
+ *   (`/recipientTo`, `/recipientCc`, `/recipientBcc`).
+ * - `INVALID_NOTIFICATION_SENDER` → {@link ValidationError}.
+ * - `NOTIFICATION_EVENT_NOT_FOUND` → {@link NotFoundError}: no such event key.
+ * - `ORGANIZATION_SETTINGS_INHERITED` → {@link BusinessRuleError} (422): the
+ *   store inherits `settings.email` from its organization; override it first.
+ * - `MANAGED_BY_ORGANIZATION` → {@link BusinessRuleError} (422): the
+ *   organization locked `settings.email`.
+ */
+export interface NotificationsModule {
+    list(options?: Call): Promise<NotificationEventConfig[]>;
+    update(event: string, input: UpdateNotificationEventConfigInput, options?: Call): Promise<NotificationEventConfig>;
+}
+export declare const NOTIFICATION_CONFIGS_QUERY = "\n  query NotificationEventConfigs {\n    notificationEventConfigs { \n  id\n  event\n  enabled\n  sender\n  recipientTo { type value key }\n  recipientCc { type value key }\n  recipientBcc { type value key }\n  templateType\n  label\n  description\n  category\n  replacementEventTypes\n }\n  }\n";
+export declare const UPDATE_NOTIFICATION_CONFIG_MUTATION = "\n  mutation UpdateNotificationEventConfig(\n    $event: String!\n    $input: UpdateNotificationEventConfigInput!\n  ) {\n    updateNotificationEventConfig(event: $event, input: $input) { \n  id\n  event\n  enabled\n  sender\n  recipientTo { type value key }\n  recipientCc { type value key }\n  recipientBcc { type value key }\n  templateType\n  label\n  description\n  category\n  replacementEventTypes\n }\n  }\n";
+export declare function createNotificationsModule(transport: Transport): NotificationsModule;

package/dist/tenant/notifications.js

@@ -0,0 +1,79 @@
+const CONFIG_FIELDS = /* GraphQL */ `
+  id
+  event
+  enabled
+  sender
+  recipientTo { type value key }
+  recipientCc { type value key }
+  recipientBcc { type value key }
+  templateType
+  label
+  description
+  category
+  replacementEventTypes
+`;
+export const NOTIFICATION_CONFIGS_QUERY = /* GraphQL */ `
+  query NotificationEventConfigs {
+    notificationEventConfigs { ${CONFIG_FIELDS} }
+  }
+`;
+export const UPDATE_NOTIFICATION_CONFIG_MUTATION = /* GraphQL */ `
+  mutation UpdateNotificationEventConfig(
+    $event: String!
+    $input: UpdateNotificationEventConfigInput!
+  ) {
+    updateNotificationEventConfig(event: $event, input: $input) { ${CONFIG_FIELDS} }
+  }
+`;
+function fromWireSegment(segment) {
+    // The server accepts any `type`; only null members are dropped, never a value.
+    return {
+        type: segment.type,
+        ...(segment.value != null ? { value: segment.value } : {}),
+        ...(segment.key != null ? { key: segment.key } : {}),
+    };
+}
+function fromWire(config) {
+    return {
+        id: config.id,
+        event: config.event,
+        enabled: config.enabled,
+        sender: config.sender,
+        recipients: {
+            to: config.recipientTo.map(fromWireSegment),
+            cc: config.recipientCc.map(fromWireSegment),
+            bcc: config.recipientBcc.map(fromWireSegment),
+        },
+        templateType: config.templateType,
+        label: config.label,
+        description: config.description,
+        category: config.category,
+        replacementEventTypes: config.replacementEventTypes ?? null,
+    };
+}
+function toWireInput(input) {
+    const { recipients } = input;
+    return {
+        ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+        ...(input.sender !== undefined ? { sender: input.sender } : {}),
+        ...(recipients?.to !== undefined ? { recipientTo: recipients.to } : {}),
+        ...(recipients?.cc !== undefined ? { recipientCc: recipients.cc } : {}),
+        ...(recipients?.bcc !== undefined ? { recipientBcc: recipients.bcc } : {}),
+    };
+}
+export function createNotificationsModule(transport) {
+    return {
+        async list(options) {
+            const data = await transport.graphql({ api: 'admin', query: NOTIFICATION_CONFIGS_QUERY }, options);
+            return data.notificationEventConfigs.map(fromWire);
+        },
+        async update(event, input, options) {
+            const data = await transport.graphql({
+                api: 'admin',
+                query: UPDATE_NOTIFICATION_CONFIG_MUTATION,
+                variables: { event, input: toWireInput(input) },
+            }, options);
+            return fromWire(data.updateNotificationEventConfig);
+        },
+    };
+}

package/dist/tenant/retention.d.ts

@@ -19,7 +19,9 @@ export interface ChannelRetention {
     retentionClass: string;
     /**
      * A time-based hold, independent of {@link holds}. While it is in the future
-     * the store cannot be hard-deleted, with no holder involved.
+     * the store cannot be hard-deleted, with no holder involved. It does NOT
+     * refuse a customer erasure (`customers.erase`): the window protects the
+     * store's records, which an erasure keeps. To block erasures, place a hold.
      */
     holdUntil: string | null;
     holds: RetentionHold[];
@@ -44,8 +46,10 @@ export interface SetRetentionInput {
  * **Coded refusals**, all delivered as GraphQL errors with `extensions.code`
  * and mapped by `core` onto the error hierarchy:
  * - `RETENTION_HOLD_ACTIVE` → {@link BusinessRuleError}: `hardDeleteChannel`
- *   refused because a hold stands. It is thrown by the delete, not by these
- *   methods.
+ *   refused because a hold or the `holdUntil` window stands, or
+ *   `customers.erase` refused because a named hold stands (the window alone
+ *   does not refuse an erasure). It is thrown by the delete or the erasure,
+ *   not by these methods.
  * - `RETENTION_HOLD_NOT_YOURS` → {@link PermissionDeniedError}: `release()`
  *   called by a principal that holds none while another's hold stands. A
  *   SuperAdmin overrides and releases every hold.
@@ -63,7 +67,9 @@ export interface RetentionModule {
     set(input: SetRetentionInput, options?: Call): Promise<ChannelRetention>;
     /**
      * Place the CALLING principal's hold. Idempotent per holder: restating
-     * updates the reason and leaves `placedAt` where it was.
+     * updates the reason and leaves `placedAt` where it was. While it stands,
+     * both a hard delete of the store and every customer erasure on it
+     * (`customers.erase`) are refused with `RETENTION_HOLD_ACTIVE`.
      */
     hold(reason: string, options?: Call): Promise<ChannelRetention>;
     /**