platform-types 1.10.678 → 1.10.680

package/dist/cjs/emailSuppression.js

@@ -0,0 +1,12 @@
+"use strict";
+// Suppressed email addresses, as a platform MANAGER sees them through
+// `/platform/email-suppression`. Two lists gate a send, and this surface reads both:
+//
+// - the APP list — one DynamoDB row per (store, address) under
+//   `EMAILSUPPRESSION#{storeId}` (or `#PLATFORM`), written by the SES event consumer
+//   or by a MANAGER, and enforced by the send path;
+// - the SES ACCOUNT list — maintained by SES itself. ⚠️ Dev and prod share one AWS
+//   account, so this list is shared across stages while app rows are per stage.
+//
+// ⚠️ Operator surface only. No tenant-tier route returns these shapes.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/index.js

@@ -56,6 +56,7 @@ __exportStar(require("./gating.js"), exports);
 __exportStar(require("./holdingCost.js"), exports);
 __exportStar(require("./demo.js"), exports);
 __exportStar(require("./emailIdentity.js"), exports);
+__exportStar(require("./emailSuppression.js"), exports);
 __exportStar(require("./impersonation.js"), exports);
 __exportStar(require("./imports.js"), exports);
 __exportStar(require("./inventory.js"), exports);

package/dist/cjs/storefrontAssets.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_STOREFRONT_ASSETS = exports.STOREFRONT_ASSET_VARIANTS = void 0;
+const storefrontDesign_ts_1 = require("./storefrontDesign.js");
 exports.STOREFRONT_ASSET_VARIANTS = [
     'original',
     '200x200',
@@ -9,4 +10,5 @@ exports.STOREFRONT_ASSET_VARIANTS = [
     '1200x1200',
     '1600x1600',
 ];
-exports.MAX_STOREFRONT_ASSETS = 200;
+/** The active-asset cap, the same value as `STOREFRONT_DESIGN_LIMITS.activeImages` by construction. */
+exports.MAX_STOREFRONT_ASSETS = storefrontDesign_ts_1.STOREFRONT_DESIGN_LIMITS.activeImages;

package/dist/cjs/storefrontDesign.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STOREFRONT_SOCIAL_HOSTS = exports.STOREFRONT_BENEFIT_ICONS = exports.STOREFRONT_RESERVED_SLUGS = exports.STOREFRONT_CONTACT_FIELDS = exports.STOREFRONT_BUILTIN_DESTINATIONS = exports.STOREFRONT_SECTION_TYPES = exports.STOREFRONT_DESIGN_LIMITS = void 0;
+exports.STOREFRONT_SOCIAL_HOSTS = exports.STOREFRONT_BENEFIT_ICONS = exports.STOREFRONT_RESERVED_SLUGS = exports.STOREFRONT_CONTACT_FIELDS = exports.STOREFRONT_PROTECTED_BUILTIN_DESTINATIONS = exports.STOREFRONT_BUILTIN_DESTINATIONS = exports.STOREFRONT_SECTION_TYPES = exports.STOREFRONT_DESIGN_LIMITS = void 0;
 exports.createStorefrontDesignV1 = createStorefrontDesignV1;
 exports.STOREFRONT_DESIGN_LIMITS = {
     customPages: 20,
@@ -24,6 +24,8 @@ exports.STOREFRONT_DESIGN_LIMITS = {
     seoTitle: 120,
     seoDescription: 320,
     imageAlt: 250,
+    assetFilename: 255,
+    assetSearch: 80,
     activeImages: 200,
     imageDecodedBytes: 4 * 1024 * 1024,
     imagePixels: 32_000_000,
@@ -58,7 +60,21 @@ exports.STOREFRONT_BUILTIN_DESTINATIONS = [
     'cart',
     'account',
     'privacy',
-    'terms',
+];
+/**
+ * The built-in destinations that must stay reachable whatever a design does with
+ * its menus: search, cart, account and the required legal page. Reachability is
+ * owned by the storefront's platform chrome, not by the design: the storefront
+ * always renders these outside merchant menus and footer groups, so no design can
+ * remove or repoint them. A design may still link to them. Editors show them as
+ * fixed, non-editable entries. `parseStorefrontDesign` therefore does not refuse
+ * a document whose menus omit them.
+ */
+exports.STOREFRONT_PROTECTED_BUILTIN_DESTINATIONS = [
+    'search',
+    'cart',
+    'account',
+    'privacy',
 ];
 exports.STOREFRONT_CONTACT_FIELDS = ['email', 'phone', 'whatsapp', 'address', 'hours', 'socials'];
 exports.STOREFRONT_RESERVED_SLUGS = [
@@ -91,6 +107,14 @@ exports.STOREFRONT_RESERVED_SLUGS = [
     'admin',
     'storefront',
     'pagina',
+    'basket',
+    'profile',
+    'favorites',
+    'invoices',
+    'payments',
+    'payment-methods',
+    'user',
+    'mantenimiento',
 ];
 exports.STOREFRONT_BENEFIT_ICONS = ['truck', 'shield', 'credit-card', 'store', 'heart', 'check'];
 exports.STOREFRONT_SOCIAL_HOSTS = {

package/dist/cjs/storefrontTheme.js

@@ -65,6 +65,13 @@ const surfaceTokens = (background, settings, mode, surface, warnings) => {
         disabled: { background: disabledBackground, text: readableText(disabledBackground) },
     };
 };
+/**
+ * The storefront theme for a design's settings overrides.
+ *
+ * Settings resolve from the registry defaults plus the store's own design
+ * overrides ONLY — no GLOBAL or WEB layer takes part — so a consumer uses this
+ * as shipped rather than merging layers of its own first.
+ */
 const resolveStorefrontTheme = (overrides = {}) => {
     const settings = (0, storefrontDesignRegistry_ts_1.resolveStorefrontDesignSettings)(overrides);
     const warnings = [];

package/dist/emailSuppression.d.ts

@@ -0,0 +1,125 @@
+/** Why an app row suppresses. `'bounce'` blocks every send; `'complaint'` every send but transactional. */
+export type EmailSuppressionReason = 'bounce' | 'complaint';
+/** Who wrote the app row: the SES event consumer, or a MANAGER by hand. */
+export type EmailSuppressionSource = 'ses-event' | 'manager';
+/** SES's own reason on an account-list entry. */
+export type SesSuppressionReason = 'BOUNCE' | 'COMPLAINT';
+/** The app row's half of an entry. Fields written before the evidence was kept are absent. */
+export interface EmailSuppressionAppRow {
+    reason: EmailSuppressionReason;
+    source: EmailSuppressionSource;
+    firstSuppressedAt?: number;
+    lastEventAt?: number;
+    bounceType?: 'Permanent' | 'Transient' | 'Undetermined';
+    bounceSubType?: string;
+    /** Remote SMTP diagnostic text, at most 500 bytes. Never message content. */
+    diagnosticCode?: string;
+    sesMessageId?: string;
+    feedbackId?: string;
+    /** Present on a manual add only. */
+    actorUserId?: string;
+    /** Epoch seconds — the row's TTL. */
+    expiresAt: number;
+}
+/** The SES account list's half of an entry. */
+export interface EmailSuppressionSesEntry {
+    reason: SesSuppressionReason;
+    /** The exact spelling SES holds, when it differs from the lowercased `address`. */
+    address?: string;
+    /** ISO-8601, as SES reports it. */
+    lastUpdateTime: string;
+}
+/**
+ * One address in one scope. An address with app rows in two stores is two entries;
+ * the SES half (account-wide) rides on each of them. `storeId: null` is an SES-only
+ * entry with no app row anywhere.
+ */
+export interface EmailSuppressionEntry {
+    address: string;
+    storeId: string | 'PLATFORM' | null;
+    /** The store's display name when `storeId` names a store. */
+    storeName?: string;
+    app: EmailSuppressionAppRow | null;
+    ses: EmailSuppressionSesEntry | null;
+}
+/** `GET /platform/email-suppression` — `data`. Pass `nextCursor` back as `?cursor=`. */
+export interface EmailSuppressionListResponse {
+    items: EmailSuppressionEntry[];
+    nextCursor?: string;
+    /** A source was read up to its cap, so the merged view may be incomplete. */
+    truncated?: boolean;
+}
+/** One SES event for the address, from the store's `EMAILEVENT#` history. */
+export interface EmailSuppressionEvent {
+    storeId: string;
+    sesMessageId: string;
+    eventType: 'Bounce' | 'Complaint' | 'Delivery' | 'Reject' | 'Open' | 'Click';
+    bounceType?: 'Permanent' | 'Transient' | 'Undetermined';
+    createdAt: number;
+}
+/** `GET /platform/email-suppression/{address}` — `data`. */
+export interface EmailSuppressionDetail {
+    address: string;
+    /** One per app row, or a single SES-only entry; empty when the address is on neither list. */
+    entries: EmailSuppressionEntry[];
+    /** The newest events first, at most 20. */
+    events: EmailSuppressionEvent[];
+    /** The event read hit its bound before covering every store. */
+    eventsTruncated?: boolean;
+    /**
+     * `false` — the domain authoritatively accepts no mail (an RFC 7505 null MX, or it
+     * does not exist); `null` — unknown: the lookup did not answer, or the domain has no
+     * MX record and relies on an implicit MX.
+     */
+    mxPresent: boolean | null;
+    /** SES did not answer (throttle or timeout), so each entry's `ses` half is unknown, not absent. */
+    sesUnavailable?: boolean;
+}
+/** A non-blocking caution on a write. */
+export type EmailSuppressionWarning = 
+/** The MX lookup did not answer, or the domain relies on an implicit MX (A/AAAA only). */
+'MX_UNKNOWN'
+/** A permanent NoEmail/General bounce was recorded less than an hour ago. */
+ | 'RECENT_PERMANENT_BOUNCE'
+/** The store roster was read up to its cap, so a store's row may have been missed. */
+ | 'STORE_ROSTER_TRUNCATED';
+/**
+ * What happened to the SES account list. `'skipped'` — this stage does not write the
+ * SES list: dev and prod share one AWS account, so only prod may change it.
+ */
+export type EmailSuppressionSesWrite = 'removed' | 'absent' | 'skipped';
+/** `DELETE /platform/email-suppression/{address}` — body. Omit `storeId` to clear every store's row. */
+export interface EmailSuppressionDeleteRequest {
+    reason: string;
+    storeId?: string;
+}
+/** `DELETE /platform/email-suppression/{address}` — `data`. Idempotent: an absent entry is success. */
+export interface EmailSuppressionDeleteResponse {
+    app: 'removed' | 'absent';
+    ses: EmailSuppressionSesWrite;
+    warnings?: EmailSuppressionWarning[];
+}
+/**
+ * `POST /platform/email-suppression` — body. `'manual'` and `'bounce'` store an app `'bounce'`
+ * row and (prod only) an SES `BOUNCE` entry; `'complaint'` stores an app `'complaint'` row only.
+ * Omit `storeId` to suppress on the platform partition.
+ */
+export interface EmailSuppressionCreateRequest {
+    address: string;
+    reason: EmailSuppressionReason | 'manual';
+    note: string;
+    storeId?: string;
+}
+/** `POST /platform/email-suppression` — `data`. */
+export interface EmailSuppressionCreateResponse {
+    entry: EmailSuppressionEntry;
+    /**
+     * `'skipped'` on a stage that does not write the SES list (see {@link EmailSuppressionSesWrite}),
+     * and for a `'complaint'` add on every stage: the SES account list blocks EVERY send whatever
+     * its reason, so an SES COMPLAINT entry would also stop the transactional mail an app
+     * complaint row lets through.
+     */
+    ses: 'added' | 'skipped';
+    /** SES did not answer the read-back, so `entry.ses` is unknown, not absent. */
+    sesUnavailable?: boolean;
+}

package/dist/emailSuppression.js

@@ -0,0 +1,11 @@
+// Suppressed email addresses, as a platform MANAGER sees them through
+// `/platform/email-suppression`. Two lists gate a send, and this surface reads both:
+//
+// - the APP list — one DynamoDB row per (store, address) under
+//   `EMAILSUPPRESSION#{storeId}` (or `#PLATFORM`), written by the SES event consumer
+//   or by a MANAGER, and enforced by the send path;
+// - the SES ACCOUNT list — maintained by SES itself. ⚠️ Dev and prod share one AWS
+//   account, so this list is shared across stages while app rows are per stage.
+//
+// ⚠️ Operator surface only. No tenant-tier route returns these shapes.
+export {};

package/dist/index.d.ts

@@ -32,6 +32,7 @@ export * from './gating.ts';
 export * from './holdingCost.ts';
 export * from './demo.ts';
 export * from './emailIdentity.ts';
+export * from './emailSuppression.ts';
 export * from './impersonation.ts';
 export * from './imports.ts';
 export * from './inventory.ts';

package/dist/index.js

@@ -40,6 +40,7 @@ export * from "./gating.js";
 export * from "./holdingCost.js";
 export * from "./demo.js";
 export * from "./emailIdentity.js";
+export * from "./emailSuppression.js";
 export * from "./impersonation.js";
 export * from "./imports.js";
 export * from "./inventory.js";

package/dist/storefrontAssets.d.ts

@@ -1,7 +1,8 @@
 export declare const STOREFRONT_ASSET_VARIANTS: readonly ["original", "200x200", "400x400", "800x800", "1200x1200", "1600x1600"];
-export declare const MAX_STOREFRONT_ASSETS = 200;
+/** The active-asset cap, the same value as `STOREFRONT_DESIGN_LIMITS.activeImages` by construction. */
+export declare const MAX_STOREFRONT_ASSETS: 200;
 declare global {
-    type StorefrontAssetErrorCode = 'ROLE_FORBIDDEN' | 'PLAN_UPGRADE_REQUIRED' | 'SUBSCRIPTION_READONLY' | 'STOREFRONT_ASSET_ENTITLEMENT_UNAVAILABLE' | 'STOREFRONT_ASSET_REQUEST_TOO_LARGE' | 'STOREFRONT_ASSET_TIMEOUT' | 'VALIDATION_FAILED' | 'ASSET_ARCHIVE_UNCERTAIN' | 'ASSET_CAPACITY_EXCEEDED' | 'ASSET_NOT_FOUND' | 'ASSET_REQUEST_CONFLICT' | 'ASSET_STORAGE_CONFLICT' | 'ASSET_TOO_LARGE' | 'ASSET_UPLOAD_FAILED' | 'ASSET_UPLOAD_PENDING' | 'ASSET_UPLOAD_UNCERTAIN' | 'INVALID_ACTOR' | 'INVALID_ASSET_CURSOR' | 'INVALID_ASSET_ID' | 'INVALID_ASSET_IMAGE' | 'INVALID_ASSET_LIMIT' | 'INVALID_ASSET_PLACEMENT' | 'INVALID_ASSET_STAGE' | 'INVALID_ASSET_VARIANT' | 'INVALID_REQUEST_ID' | 'INVALID_STORE_CONTEXT' | 'LEGACY_LOGO_MAPPING_CONFLICT';
+    type StorefrontAssetErrorCode = 'ROLE_FORBIDDEN' | 'PLAN_UPGRADE_REQUIRED' | 'SUBSCRIPTION_READONLY' | 'STOREFRONT_ASSET_ENTITLEMENT_UNAVAILABLE' | 'STOREFRONT_ASSET_REQUEST_TOO_LARGE' | 'STOREFRONT_ASSET_TIMEOUT' | 'VALIDATION_FAILED' | 'ASSET_ARCHIVE_UNCERTAIN' | 'ASSET_ARCHIVED' | 'ASSET_CAPACITY_EXCEEDED' | 'ASSET_NOT_FOUND' | 'ASSET_REQUEST_CONFLICT' | 'ASSET_STORAGE_CONFLICT' | 'ASSET_TOO_LARGE' | 'ASSET_UPDATE_UNCERTAIN' | 'ASSET_UPLOAD_FAILED' | 'ASSET_UPLOAD_PENDING' | 'ASSET_UPLOAD_UNCERTAIN' | 'INVALID_ACTOR' | 'INVALID_ASSET_CURSOR' | 'INVALID_ASSET_ID' | 'INVALID_ASSET_IMAGE' | 'INVALID_ASSET_LIMIT' | 'INVALID_ASSET_PLACEMENT' | 'INVALID_ASSET_SEARCH' | 'INVALID_ASSET_STAGE' | 'INVALID_ASSET_VARIANT' | 'INVALID_REQUEST_ID' | 'INVALID_STORE_CONTEXT' | 'LEGACY_LOGO_MAPPING_CONFLICT';
     interface StorefrontAssetResponse {
         message: string;
         data: StorefrontAsset;
@@ -21,18 +22,51 @@ declare global {
         source?: EntitlementSource;
         requiredPlan?: PlanTier | null;
         currentPlan?: PlanTier | null;
+        currentStatus?: SubscriptionStatus;
     }
     type StorefrontAssetVariant = (typeof STOREFRONT_ASSET_VARIANTS)[number];
+    /**
+     * `filename` is the picked file's name, kept as a basename (any directory
+     * part dropped) for the library's search; `label` and `defaultAlt` seed the
+     * editor's picker and a NEW placement's alt — a placement carries its own
+     * `alt`, so neither is ever read at render time. Each is bounded in code
+     * points, and a blank, ill-formed or control-character value is refused
+     * 400 `VALIDATION_FAILED`, never cleaned up.
+     */
     interface StorefrontAssetUploadRequest {
         requestId: string;
         base64: string;
+        filename?: string;
+        label?: string;
+        defaultAlt?: string;
     }
     interface StorefrontAssetArchiveRequest {
         requestId: string;
     }
+    /**
+     * `PATCH /store/design/assets/{assetId}`. An omitted key is left as stored,
+     * `null` clears it. Idempotent by `requestId` like archive: the same body
+     * replays the first answer, a different body under the same `requestId`
+     * answers 409 `ASSET_REQUEST_CONFLICT`. An archived asset answers 409
+     * `ASSET_ARCHIVED`. Editing metadata never touches a draft, published or
+     * historical placement.
+     */
+    interface StorefrontAssetMetadataUpdateRequest {
+        requestId: string;
+        label?: string | null;
+        defaultAlt?: string | null;
+    }
+    /**
+     * `search` matches `filename` and `label` case- and accent-insensitively, as
+     * a substring. ⚠️ The filter applies AFTER `limit` rows of the active list are
+     * read, so a filtered page can hold fewer than `limit` items — even none —
+     * and still carry a `cursor`; follow the cursor until it is absent. A cursor
+     * is bound to the `search` it was minted under.
+     */
     interface StorefrontAssetListQuery {
         limit?: number;
         cursor?: string;
+        search?: string;
     }
     interface StorefrontAssetFieldError {
         path: string;
@@ -48,15 +82,10 @@ declare global {
         height: number;
         contentType: 'image/jpeg' | 'image/png' | 'image/webp';
         createdAt: number;
+        filename?: string;
+        label?: string;
+        defaultAlt?: string;
     }
-    interface StorefrontAssetPlacement {
-        assetId: string;
-        mobileAssetId?: string;
-        alt?: string;
-        decorative: boolean;
-        focalPoint?: {
-            x: number;
-            y: number;
-        };
-    }
+    /** @deprecated Use `StorefrontDesignImagePlacement`; this is the same shape. */
+    type StorefrontAssetPlacement = StorefrontDesignImagePlacement;
 }

package/dist/storefrontAssets.js

@@ -1,3 +1,4 @@
+import { STOREFRONT_DESIGN_LIMITS } from "./storefrontDesign.js";
 export const STOREFRONT_ASSET_VARIANTS = [
     'original',
     '200x200',
@@ -6,4 +7,5 @@ export const STOREFRONT_ASSET_VARIANTS = [
     '1200x1200',
     '1600x1600',
 ];
-export const MAX_STOREFRONT_ASSETS = 200;
+/** The active-asset cap, the same value as `STOREFRONT_DESIGN_LIMITS.activeImages` by construction. */
+export const MAX_STOREFRONT_ASSETS = STOREFRONT_DESIGN_LIMITS.activeImages;

package/dist/storefrontDesign.d.ts

@@ -20,6 +20,8 @@ export declare const STOREFRONT_DESIGN_LIMITS: {
     readonly seoTitle: 120;
     readonly seoDescription: 320;
     readonly imageAlt: 250;
+    readonly assetFilename: 255;
+    readonly assetSearch: 80;
     readonly activeImages: 200;
     readonly imageDecodedBytes: number;
     readonly imagePixels: 32000000;
@@ -34,9 +36,19 @@ export declare const STOREFRONT_DESIGN_LIMITS: {
     readonly contactEmail: 254;
 };
 export declare const STOREFRONT_SECTION_TYPES: readonly ["banner", "imageText", "products", "categories", "brands", "text", "faq", "benefits", "contact", "paymentDelivery"];
-export declare const STOREFRONT_BUILTIN_DESTINATIONS: readonly ["home", "catalogue", "offers", "new", "search", "cart", "account", "privacy", "terms"];
+export declare const STOREFRONT_BUILTIN_DESTINATIONS: readonly ["home", "catalogue", "offers", "new", "search", "cart", "account", "privacy"];
+/**
+ * The built-in destinations that must stay reachable whatever a design does with
+ * its menus: search, cart, account and the required legal page. Reachability is
+ * owned by the storefront's platform chrome, not by the design: the storefront
+ * always renders these outside merchant menus and footer groups, so no design can
+ * remove or repoint them. A design may still link to them. Editors show them as
+ * fixed, non-editable entries. `parseStorefrontDesign` therefore does not refuse
+ * a document whose menus omit them.
+ */
+export declare const STOREFRONT_PROTECTED_BUILTIN_DESTINATIONS: readonly ["search", "cart", "account", "privacy"];
 export declare const STOREFRONT_CONTACT_FIELDS: readonly ["email", "phone", "whatsapp", "address", "hours", "socials"];
-export declare const STOREFRONT_RESERVED_SLUGS: readonly ["home", "index", "api", "auth", "login", "logout", "account", "cart", "checkout", "orders", "search", "products", "product", "producto", "coleccion", "categories", "brands", "sale", "new", "privacy", "terms", "sitemap", "robots", "manifest", "assets", "preview", "admin", "storefront", "pagina"];
+export declare const STOREFRONT_RESERVED_SLUGS: readonly ["home", "index", "api", "auth", "login", "logout", "account", "cart", "checkout", "orders", "search", "products", "product", "producto", "coleccion", "categories", "brands", "sale", "new", "privacy", "terms", "sitemap", "robots", "manifest", "assets", "preview", "admin", "storefront", "pagina", "basket", "profile", "favorites", "invoices", "payments", "payment-methods", "user", "mantenimiento"];
 export declare const STOREFRONT_BENEFIT_ICONS: readonly ["truck", "shield", "credit-card", "store", "heart", "check"];
 export declare const STOREFRONT_SOCIAL_HOSTS: {
     readonly instagram: readonly ["instagram.com", "www.instagram.com"];
@@ -305,6 +317,17 @@ declare global {
         expiresAt: string;
         protocolVersion: 1;
     }
+    /**
+     * The editor access refusals, answered by the shared editor gate
+     * (`stacks/helpers/storefrontEditorGate.ts`) before any editor route reads or
+     * writes: 403 `ROLE_FORBIDDEN` (anything but an exact single-role tenant
+     * ADMIN), 403 `PLAN_UPGRADE_REQUIRED` (storefront entitlement off), 402
+     * `SUBSCRIPTION_READONLY` (a mutating call on a status other than active,
+     * trialing or past_due) and 503 `STOREFRONT_ASSET_ENTITLEMENT_UNAVAILABLE`
+     * (the entitlement could not be read). The 503 keeps the asset library's name
+     * so one gate answers one code on every editor route.
+     */
+    type StorefrontDesignAccessErrorCode = 'ROLE_FORBIDDEN' | 'PLAN_UPGRADE_REQUIRED' | 'SUBSCRIPTION_READONLY' | 'STOREFRONT_ASSET_ENTITLEMENT_UNAVAILABLE';
     type StorefrontDesignFailure = {
         message: string;
         error: 'STOREFRONT_REVISION_CONFLICT';
@@ -314,6 +337,20 @@ declare global {
         message: string;
         error: Exclude<StorefrontDesignErrorCode, 'STOREFRONT_REVISION_CONFLICT'>;
         fieldErrors?: StorefrontDesignFieldError[];
+    } | {
+        message: string;
+        error: 'PLAN_UPGRADE_REQUIRED';
+        feature: 'storefront';
+        currentPlan: PlanTier | null;
+        source?: EntitlementSource;
+        requiredPlan?: PlanTier | null;
+    } | {
+        message: string;
+        error: 'SUBSCRIPTION_READONLY';
+        currentStatus: SubscriptionStatus;
+    } | {
+        message: string;
+        error: 'ROLE_FORBIDDEN' | 'STOREFRONT_ASSET_ENTITLEMENT_UNAVAILABLE';
     };
     type StorefrontDesignDraftResponse = {
         message: string;

package/dist/storefrontDesign.js

@@ -20,6 +20,8 @@ export const STOREFRONT_DESIGN_LIMITS = {
     seoTitle: 120,
     seoDescription: 320,
     imageAlt: 250,
+    assetFilename: 255,
+    assetSearch: 80,
     activeImages: 200,
     imageDecodedBytes: 4 * 1024 * 1024,
     imagePixels: 32_000_000,
@@ -54,7 +56,21 @@ export const STOREFRONT_BUILTIN_DESTINATIONS = [
     'cart',
     'account',
     'privacy',
-    'terms',
+];
+/**
+ * The built-in destinations that must stay reachable whatever a design does with
+ * its menus: search, cart, account and the required legal page. Reachability is
+ * owned by the storefront's platform chrome, not by the design: the storefront
+ * always renders these outside merchant menus and footer groups, so no design can
+ * remove or repoint them. A design may still link to them. Editors show them as
+ * fixed, non-editable entries. `parseStorefrontDesign` therefore does not refuse
+ * a document whose menus omit them.
+ */
+export const STOREFRONT_PROTECTED_BUILTIN_DESTINATIONS = [
+    'search',
+    'cart',
+    'account',
+    'privacy',
 ];
 export const STOREFRONT_CONTACT_FIELDS = ['email', 'phone', 'whatsapp', 'address', 'hours', 'socials'];
 export const STOREFRONT_RESERVED_SLUGS = [
@@ -87,6 +103,14 @@ export const STOREFRONT_RESERVED_SLUGS = [
     'admin',
     'storefront',
     'pagina',
+    'basket',
+    'profile',
+    'favorites',
+    'invoices',
+    'payments',
+    'payment-methods',
+    'user',
+    'mantenimiento',
 ];
 export const STOREFRONT_BENEFIT_ICONS = ['truck', 'shield', 'credit-card', 'store', 'heart', 'check'];
 export const STOREFRONT_SOCIAL_HOSTS = {

package/dist/storefrontTheme.d.ts

@@ -50,5 +50,12 @@ export interface StorefrontResolvedTheme {
     warnings: StorefrontThemeWarning[];
 }
 export declare const storefrontContrastRatio: (foreground: string, background: string) => number;
+/**
+ * The storefront theme for a design's settings overrides.
+ *
+ * Settings resolve from the registry defaults plus the store's own design
+ * overrides ONLY — no GLOBAL or WEB layer takes part — so a consumer uses this
+ * as shipped rather than merging layers of its own first.
+ */
 export declare const resolveStorefrontTheme: (overrides?: Partial<StorefrontDesignSettings>) => StorefrontResolvedTheme;
 export {};

package/dist/storefrontTheme.js

@@ -61,6 +61,13 @@ const surfaceTokens = (background, settings, mode, surface, warnings) => {
         disabled: { background: disabledBackground, text: readableText(disabledBackground) },
     };
 };
+/**
+ * The storefront theme for a design's settings overrides.
+ *
+ * Settings resolve from the registry defaults plus the store's own design
+ * overrides ONLY — no GLOBAL or WEB layer takes part — so a consumer uses this
+ * as shipped rather than merging layers of its own first.
+ */
 export const resolveStorefrontTheme = (overrides = {}) => {
     const settings = resolveStorefrontDesignSettings(overrides);
     const warnings = [];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.678",
+	"version": "1.10.680",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",