platform-types 1.10.705 → 1.10.707

package/dist/subscription.d.ts

@@ -472,7 +472,7 @@ declare global {
         remaining: number | null;
     }
     /**
-     * Full subscription snapshot. Three producers emit it:
+     * Full subscription snapshot. Four producers emit it:
      *
      * - `GET /subscription` — the full `usage[]`, including the row-counted
      *   `webhooks` / `maxWarehouses` meters. The two are present together or
@@ -481,7 +481,12 @@ declare global {
      * - the `GET /store` subscription embed — WITHOUT those two meters (monthly
      *   and lifetime only) and without `provider`;
      * - the reply of the MANAGER `PUT /platform/stores/{storeId}/subscription` —
-     *   built by the same assembly as `GET /subscription`, meters included.
+     *   built by the same assembly as `GET /subscription`, meters included, read
+     *   strongly consistent after the write;
+     * - the `data` of a `POST /subscription/cancel` that ended a trial with no
+     *   payment method — the same assembly again, read after the write; `data` is
+     *   absent from that 200 only when the read itself failed after the trial had
+     *   already ended. A cancel that reached a provider answers no `data`.
      *
      * The WebSocket only nudges a refetch on subscription/entitlement changes; it
      * never carries this payload.
@@ -500,6 +505,27 @@ declare global {
          * (`externalCustomerId`/`externalSubscriptionId`) are never exposed.
          */
         provider?: SubscriptionProvider;
+        /**
+         * Whether the row holds a live provider subscription that `POST /subscription/cancel`
+         * can act on: a provider subscription id of its rail's kind (Stripe `sub_…`; a
+         * MercadoPago PreApproval id or manual-mode anchor) on a row that is not `canceled`.
+         * Unlike `provider`, never a fallback. Carried by every producer, the `GET /store`
+         * embed included.
+         *
+         * `true` does not promise the portal or a payment-method update — those also depend
+         * on the rail: MercadoPago has no hosted portal (`501 BILLING_NOT_CONFIGURED`), a
+         * manual-mode anchor has no payment method to update (`501`), and a Stripe portal
+         * needs the `cus_` Customer (a MANAGER-set `sub_` row without one is `404`).
+         *
+         * When `false`, those three routes answer `404 NO_SUBSCRIPTION` without calling a
+         * provider — no row, a `cus_`-only Stripe checkout, a canceled row, an id from the
+         * other rail, and any provider-less row — with exactly two cancel exceptions, both
+         * on a provider-less row (no `provider`, provider subscription or customer id):
+         * a `trialing` row that is not the platform store, has a `trialEndsAt` and is not
+         * covered by a courtesy gift (`freeUntil`) has its trial ended (200); and a row no
+         * longer `trialing` that carries `trialEndedFromTier` answers 200 with no write.
+         */
+        hasProviderSubscription: boolean;
         billingCycle: BillingCycle | null;
         currentPeriodStart: number | null;
         currentPeriodEnd: number | null;
@@ -518,13 +544,15 @@ declare global {
          */
         canceledFromTier?: PlanTier | null;
         /**
-         * The paid tier a trial ran on when it lapsed with no payment method —
-         * set only by the grace sweep when it moves a provider-less `trialing`
-         * row (no provider, no provider subscription or customer id) whose
-         * `trialEndsAt` has passed to `basico`/`active`. Cleared (`null`) when
-         * the store re-subscribes to a paid tier or is canceled — a cancel
-         * records its own lost plan in `canceledFromTier`. `null` when absent —
-         * every row that never expired that way, or has moved on since.
+         * The paid tier a trial ran on when it ended with no payment method —
+         * set only when a provider-less `trialing` row (no provider, no provider
+         * subscription or customer id) moves to `basico`/`active`: by the grace
+         * sweep once its `trialEndsAt` has passed, or by `POST /subscription/cancel`
+         * ending it early (that cancel sets this, never `canceledFromTier`).
+         * Cleared (`null`) when the store re-subscribes to a paid tier or a provider
+         * subscription is canceled — that cancel records its own lost plan in
+         * `canceledFromTier`. `null` when absent — every row that never ended a
+         * trial that way, or has moved on since.
          */
         trialEndedFromTier?: PlanTier | null;
         entitlements: SubscriptionEntitlementEntry[];
@@ -633,7 +661,11 @@ declare global {
          * it together with `provider`.
          */
         mode?: 'preapproval' | 'manual';
-        /** The paid tier an expired trial dropped from; `null` when a write cleared it. */
+        /**
+         * The paid tier a trial with no payment method dropped from — one that expired
+         * (the grace sweep) or one the tenant ended through `POST /subscription/cancel`;
+         * `null` when a write cleared it.
+         */
         trialEndedFromTier?: PlanTier | null;
     };
     /**
@@ -648,7 +680,9 @@ declare global {
      * `fullName: ''`), `before` holds the trial's `status`/`planTier`/
      * `trialEndsAt`, and `after` holds `status: 'active'`,
      * `planTier: 'basico'`, `trialEndsAt: null` and `trialEndedFromTier`
-     * (the trial's tier).
+     * (the trial's tier). `subscription.trial_canceled` rows have the same
+     * `before`/`after` and name the tenant user who ended the trial through
+     * `POST /subscription/cancel` as `actor`.
      *
      * ⚠️ The same partition also carries entitlement-override and advancedPricing
      * rows whose `before`/`after` hold different keys, so consumers must read
@@ -726,9 +760,10 @@ declare global {
     }
     /**
      * One tier's `SK: PLAN` template row, as assessed by
-     * `report-plan-catalog-drift` (`POST /platform/operations`). Plan features
-     * are code (`planFeatureMatrix.ts`) and cannot drift; the template row is
-     * the only catalogue state a seeder/admin write can still leave stale.
+     * `report-plan-catalog-drift` (`POST /platform/operations`). Plan feature
+     * DEFAULTS are code (`planFeatureMatrix.ts`) and cannot drift; the template
+     * row — its live `grants` overlay included — is the only catalogue state a
+     * seeder/admin write can still leave stale.
      */
     interface TierCatalogDrift {
         tier: PlanTier;
@@ -742,6 +777,19 @@ declare global {
          * place to echo a catalogue's payment-provider IDs.
          */
         missingProviderIds: string[];
+        /**
+         * Keys in the template row's `grants` overlay that the api does not
+         * declare (retired or misspelt), sorted. Inert — every reader ignores them
+         * and the code default applies — but stored, so they are drift: a `null`
+         * for that key on `PATCH /platform/billing/plans/grants` removes them.
+         */
+        undeclaredGrantKeys: string[];
+        /**
+         * Declared keys whose overlay value has the wrong shape for their type
+         * (a `limit` on a boolean key, a fraction, `-2`), sorted. Ignored on read
+         * exactly like an undeclared key, and reported for the same reason.
+         */
+        malformedGrantKeys: string[];
     }
     /** One store holding at least one `OVERRIDE#` row under a key the api no longer declares. */
     interface OrphanOverrideStore {
@@ -788,7 +836,9 @@ declare global {
     interface PlanCatalogDriftReport {
         /**
          * True when ANY tier lacks a template row, a paid one is missing a provider
-         * identifier, or any store holds an override under an undeclared key.
+         * identifier, a tier's `grants` overlay holds an undeclared key
+         * (`undeclaredGrantKeys`) or a wrong-shape value (`malformedGrantKeys`), or
+         * any store holds an override under an undeclared key.
          *
          * ⚠️ An UNBUILT roster (`orphanOverrides.rosterBuiltAt === null`) does not
          * flip this. A stage whose scan has never completed would otherwise answer
@@ -804,6 +854,112 @@ declare global {
         tiers: TierCatalogDrift[];
         orphanOverrides: OrphanOverrideDrift;
     }
+    /**
+     * One feature's grant on one tier, as `PATCH /platform/billing/plans/grants`
+     * takes and reports it: `{ enabled }` for a boolean key, `{ limit }` for a
+     * numeric or metered one (`-1` = unlimited).
+     */
+    type PlanGrantValue = {
+        enabled: boolean;
+    } | {
+        limit: number;
+    };
+    /**
+     * Body of `PATCH /platform/billing/plans/grants` (MANAGER). One request sets
+     * one or more keys on any tiers, atomically: `grants[key][tier]` is the new
+     * grant, or `null` to drop that tier's overlay entry (the code default
+     * applies again). A value equal to the code default is stored as no entry,
+     * so the overlay stays sparse. The final ladder of every changed key must
+     * rise with `displayOrder` (`FEATURE_LADDER_NON_MONOTONIC` otherwise).
+     */
+    interface PlanGrantsWriteRequest {
+        /**
+         * Keyed by feature key. A `string` key rather than `FeatureKey` because a
+         * `null` may name an undeclared key, to clear an inert overlay entry; a
+         * non-null value for one is refused (`PLAN_GRANT_UNKNOWN_KEY`).
+         */
+        grants: Record<string, Partial<Record<PlanTier, PlanGrantValue | null>>>;
+        /** Screened operator reason (10-500 characters, no personal data); lands in each tier's audit entry. */
+        reason: string;
+        /**
+         * Required on a live write: the comma-joined sorted keys the request
+         * changes — the string a dry run of the same body returns. It names the
+         * keys, not the tiers or values, so it proves the caller meant those keys;
+         * the dry run is where the tiers and the impact are reviewed.
+         */
+        confirm?: string;
+        /** `true` writes nothing and returns the impact plus the `confirm` string. */
+        dryRun?: boolean;
+    }
+    /** One key's effective grant on one tier, before and after the write. */
+    interface PlanGrantChange {
+        key: string;
+        /** `null` for an undeclared key — it has no effective grant on either side. */
+        before: PlanGrantValue | null;
+        after: PlanGrantValue | null;
+    }
+    /**
+     * Stores on a tier that a reduction would bite, for one key: they lose a
+     * boolean feature, or their current usage exceeds a lowered limit. Measured
+     * per store with its own overrides applied, so a store whose override keeps
+     * the old grant is not listed. A `readonly` / `canceled` store is never
+     * examined — its plan already lapsed, so the reduction takes nothing more.
+     */
+    interface PlanGrantImpact {
+        key: string;
+        storeIds: string[];
+        /**
+         * `false` for a lowered limit with no usage counter to compare against
+         * (`priceListsMax`): `storeIds` is then
+         * empty because nothing was measured, never because nothing is over.
+         */
+        measured: boolean;
+    }
+    /** One affected tier in a `PATCH /platform/billing/plans/grants` result. */
+    interface PlanGrantsTierResult {
+        tier: PlanTier;
+        changes: PlanGrantChange[];
+        /**
+         * Stores on this tier, any status: those whose SUBSCRIPTION row is on it
+         * (`planTier-status`) plus, on `profesional` — the tier a store with no
+         * SUBSCRIPTION row resolves to — every store with no row. A lower bound
+         * when `truncated`.
+         */
+        subscribedStores: number;
+        /** Dry run only: per reduced key, the stores it bites. Empty when nothing on this tier is reduced. */
+        impact?: PlanGrantImpact[];
+        /**
+         * Dry run: `impact` is a lower bound — more live stores than the walk
+         * examines (100), the request's time budget ran out, one store could not
+         * be read, or the tier's store list itself is short. Live write (present
+         * only when `true`): the follow-up did not reach every store — the budget
+         * ran out, a frame or grace reconcile failed, or the store list is short;
+         * a `PLAN_GRANTS_FANOUT_INCOMPLETE` error row carries the counts. On a
+         * `storefront` / `customDomain` change, every listed store it did not
+         * settle has a due-now grace entry the hourly storefront grace sweep
+         * reconciles (unless the row says some were not scheduled).
+         */
+        truncated?: boolean;
+        /** Live write only: how many stores the `subscription` socket frame was sent to. */
+        notifiedStores?: number;
+        /**
+         * Live write only, and only when the tier's `storefront` or `customDomain`
+         * changed: how many stores' shop grace a reconcile settled — written
+         * (a lost grant starts the 14-day grace; a regained one clears it) or
+         * already in line. A failed reconcile, a store gone, or a store the budget
+         * did not reach is not counted.
+         */
+        reconciledStores?: number;
+    }
+    /** `data` of `PATCH /platform/billing/plans/grants`. */
+    interface PlanGrantsWriteResult {
+        dryRun: boolean;
+        /** `false` on a dry run and on an identical replay (no change, no write, no audit). */
+        written: boolean;
+        /** The comma-joined sorted changed keys — what a live run must send as `confirm`. Empty when nothing changes. */
+        confirm: string;
+        tiers: PlanGrantsTierResult[];
+    }
 }
 export type BillingProviderName = SubscriptionProvider;
 export type InvoiceSummary = globalThis.InvoiceSummary;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.705",
+	"version": "1.10.707",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",