platform-types 1.10.722 → 1.10.724

package/dist/account.d.ts

@@ -198,6 +198,12 @@ declare global {
      * and attach the token here. The approval binds the raw body minus the token,
      * which is why the keys marked accepted and IGNORED below are declared at all.
      *
+     * A `customerId` equal to `SYSTEM_CUSTOMER_ID` (the walk-in, see
+     * `isSystemCustomer`) is refused `403 SYSTEM_CUSTOMER_PROTECTED`, credit and
+     * debit alike, with no business row read or written: the walk-in has no cuenta
+     * corriente. Collect a walk-in order's cash through
+     * `POST /orders { mode: 'tender' }` instead.
+     *
      * Held to its schema by `AssertAccountPostRequestMatchesSchema`.
      */
     interface AccountPostRequest extends TerminalElevationAuthorization {

package/dist/appointment.d.ts

@@ -959,7 +959,7 @@ declare global {
  * `GET /availability`, an operator queuing a party against a full slot rather
  * than configuring the schedule — so its five refusals are listed above.
  */
-export declare const APPOINTMENT_ERROR_CODES: readonly ["APPOINTMENT_NOT_FOUND", "APPOINTMENT_ID_REQUIRED", "APPOINTMENT_TYPE_DISABLED", "APPOINTMENT_SLOT_UNAVAILABLE", "APPOINTMENT_LEAD_TIME_NOT_MET", "APPOINTMENT_SELF_BOOKING_BLOCKED", "APPOINTMENT_CANCEL_CUTOFF_PASSED", "APPOINTMENT_OUTSIDE_WORKING_HOURS", "APPOINTMENT_TOO_FAR_AHEAD", "APPOINTMENT_ORDER_NOT_FOUND", "APPOINTMENT_ORDER_NOT_SCHEDULABLE", "APPOINTMENT_ORDER_ALREADY_SCHEDULED", "APPOINTMENT_STATUS_TRANSITION_ILLEGAL", "APPOINTMENT_VERSION_CONFLICT", "APPOINTMENT_NOT_CANCELLABLE", "APPOINTMENT_RESCHEDULE_NOOP", "APPOINTMENT_WAITLIST_PARTY_REQUIRED", "APPOINTMENT_WAITLIST_SLOT_AVAILABLE", "APPOINTMENT_WAITLIST_ALREADY_JOINED", "APPOINTMENT_WAITLIST_FULL", "APPOINTMENT_WAITLIST_ENTRY_NOT_FOUND", "INVALID_CURSOR", "RECURRENCE_RULE_MALFORMED", "RECURRENCE_RULE_UNSUPPORTED", "RECURRENCE_UNBOUNDED", "RECURRENCE_TOO_MANY", "APPOINTMENT_NOT_IN_SERIES", "RECURRENCE_SCOPE_REQUIRES_RULE_EDIT", "APPOINTMENT_STATUS_NOT_SCOPEABLE", "RECURRENCE_EXCEPTIONS_UNSUPPORTED", "RECURRENCE_EXCEPTIONS_SCOPE_REQUIRED", "VALIDATION_FAILED", "ROLE_FORBIDDEN", "APPOINTMENT_FEED_SECRET_NOT_CONFIGURED", "APPOINTMENT_FEED_IDENTITY_INVALID"];
+export declare const APPOINTMENT_ERROR_CODES: readonly ["APPOINTMENT_NOT_FOUND", "APPOINTMENT_ID_REQUIRED", "APPOINTMENT_TYPE_DISABLED", "APPOINTMENT_SLOT_UNAVAILABLE", "APPOINTMENT_LEAD_TIME_NOT_MET", "APPOINTMENT_SELF_BOOKING_BLOCKED", "APPOINTMENT_CANCEL_CUTOFF_PASSED", "APPOINTMENT_OUTSIDE_WORKING_HOURS", "APPOINTMENT_TOO_FAR_AHEAD", "APPOINTMENT_ORDER_NOT_FOUND", "APPOINTMENT_ORDER_NOT_SCHEDULABLE", "APPOINTMENT_ORDER_ALREADY_SCHEDULED", "APPOINTMENT_STATUS_TRANSITION_ILLEGAL", "APPOINTMENT_VERSION_CONFLICT", "APPOINTMENT_NOT_CANCELLABLE", "APPOINTMENT_RESCHEDULE_NOOP", "APPOINTMENT_WAITLIST_PARTY_REQUIRED", "APPOINTMENT_WAITLIST_SLOT_AVAILABLE", "APPOINTMENT_WAITLIST_ALREADY_JOINED", "APPOINTMENT_WAITLIST_FULL", "APPOINTMENT_WAITLIST_ENTRY_NOT_FOUND", "INVALID_CURSOR", "RECURRENCE_RULE_MALFORMED", "RECURRENCE_RULE_UNSUPPORTED", "RECURRENCE_UNBOUNDED", "RECURRENCE_TOO_MANY", "APPOINTMENT_NOT_IN_SERIES", "RECURRENCE_SCOPE_REQUIRES_RULE_EDIT", "APPOINTMENT_STATUS_NOT_SCOPEABLE", "RECURRENCE_EXCEPTIONS_UNSUPPORTED", "RECURRENCE_EXCEPTIONS_SCOPE_REQUIRED", "VALIDATION_FAILED", "ROLE_FORBIDDEN", "APPOINTMENT_FEED_SECRET_NOT_CONFIGURED", "APPOINTMENT_FEED_IDENTITY_INVALID", "STORE_MODULE_DISABLED"];
 export type AppointmentErrorCode = (typeof APPOINTMENT_ERROR_CODES)[number];
 /**
  * Which occurrences of a recurring booking an edit applies to —

package/dist/appointment.js

@@ -141,6 +141,8 @@ export const APPOINTMENT_ERROR_CODES = [
     'ROLE_FORBIDDEN',
     'APPOINTMENT_FEED_SECRET_NOT_CONFIGURED',
     'APPOINTMENT_FEED_IDENTITY_INVALID',
+    // The storefront's self-booking surface, while the store has `modules.appointments` off.
+    'STORE_MODULE_DISABLED',
 ];
 /**
  * Which occurrences of a recurring booking an edit applies to —

package/dist/cjs/appointment.js

@@ -144,6 +144,8 @@ exports.APPOINTMENT_ERROR_CODES = [
     'ROLE_FORBIDDEN',
     'APPOINTMENT_FEED_SECRET_NOT_CONFIGURED',
     'APPOINTMENT_FEED_IDENTITY_INVALID',
+    // The storefront's self-booking surface, while the store has `modules.appointments` off.
+    'STORE_MODULE_DISABLED',
 ];
 /**
  * Which occurrences of a recurring booking an edit applies to —

package/dist/cjs/index.js

@@ -114,6 +114,7 @@ __exportStar(require("./terminal.js"), exports);
 __exportStar(require("./supplier.js"), exports);
 __exportStar(require("./supplierClaim.js"), exports);
 __exportStar(require("./survey.js"), exports);
+__exportStar(require("./systemCustomer.js"), exports);
 __exportStar(require("./user.js"), exports);
 __exportStar(require("./userActivity.js"), exports);
 __exportStar(require("./valuation.js"), exports);

package/dist/cjs/store.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CUSTOM_DOMAIN_ROW_LIMIT = exports.CUSTOM_DOMAIN_SLOT_LIMIT = void 0;
+exports.STORE_MODULE_ERROR_CODES = exports.isStoreModuleOn = exports.isStoreModuleKey = exports.STORE_MODULE_KEYS = exports.CUSTOM_DOMAIN_ROW_LIMIT = exports.CUSTOM_DOMAIN_SLOT_LIMIT = void 0;
 /**
  * How many custom-domain rows a store may hold that count: one active domain
  * and one spare, so a replacement can be verified and provisioned before the
@@ -18,3 +18,65 @@ exports.CUSTOM_DOMAIN_SLOT_LIMIT = 2;
  * `409 DOMAIN_ROW_LIMIT` with this value as `limit`.
  */
 exports.CUSTOM_DOMAIN_ROW_LIMIT = 10;
+/**
+ * Every `StoreModuleKey`, in catalogue order — the ONE list. The type is derived
+ * from it, so the `PATCH /store` validator and every client enumerate exactly
+ * the modules the type allows, and a module is added in one place.
+ */
+exports.STORE_MODULE_KEYS = [
+    'attendance',
+    'lots',
+    'stocktake',
+    'purchases',
+    'loyalty',
+    'surveys',
+    'customerZones',
+    'workshop',
+    'appointments',
+    'cash',
+    'multiWarehouse',
+    'quotes',
+    'promotions',
+    'marketing',
+    'fiscalInvoicing',
+    'customerAccounts',
+];
+/** Whether `value` names a module — narrows an untyped key (a request body, a stored row). */
+const isStoreModuleKey = (value) => typeof value === 'string' && exports.STORE_MODULE_KEYS.includes(value);
+exports.isStoreModuleKey = isStoreModuleKey;
+/**
+ * Whether `module` is on for a store whose `config.modules` is `modules`.
+ * ⚠️ Absent is ON: only an explicit `false` turns a module off, so a missing
+ * map, a missing key and `true` all answer `true`.
+ */
+const isStoreModuleOn = (modules, module) => modules?.[module] !== false;
+exports.isStoreModuleOn = isStoreModuleOn;
+/**
+ * Every refusal code the store-module switches put on the wire, beyond the
+ * platform-wide set (`VALIDATION_FAILED`, and `STORE_CONFIG_FORBIDDEN` for a
+ * plain USER writing the privileged leaf):
+ *
+ * - `STORE_MODULE_UNKNOWN` (400) — `PATCH /store` named a key outside
+ *   `STORE_MODULE_KEYS`; `data.module` carries it.
+ * - `STORE_MODULE_NOT_BOOLEAN` (400) — a module's value was not `true`/`false`.
+ * - `STORE_MODULE_WAREHOUSES_ACTIVE` (409) — `multiWarehouse` off while more
+ *   than one depósito is active; `data.activeWarehouses` carries the count.
+ * - `STORE_MODULE_TRANSFER_IN_FLIGHT` (409) — `multiWarehouse` off while a stock
+ *   transfer is in transit or partially received; `data.transferId` names one.
+ * - `STORE_MODULE_CUSTOMER_BALANCES` (409) — `customerAccounts` off while a
+ *   customer carries a non-zero balance; `data.customerId` names one.
+ * - `STORE_MODULE_BALANCE_CHECK_INCOMPLETE` (409) — the bounded balance read
+ *   stopped before it could prove every balance is zero. Retrying is harmless but
+ *   walks the same rows, so a very large customer book keeps answering it.
+ * - `STORE_MODULE_DISABLED` (403) — a server-enforced module is off (storefront
+ *   self-booking, storefront survey); `data.module` names it.
+ */
+exports.STORE_MODULE_ERROR_CODES = [
+    'STORE_MODULE_UNKNOWN',
+    'STORE_MODULE_NOT_BOOLEAN',
+    'STORE_MODULE_WAREHOUSES_ACTIVE',
+    'STORE_MODULE_TRANSFER_IN_FLIGHT',
+    'STORE_MODULE_CUSTOMER_BALANCES',
+    'STORE_MODULE_BALANCE_CHECK_INCOMPLETE',
+    'STORE_MODULE_DISABLED',
+];

package/dist/cjs/systemCustomer.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSystemCustomer = exports.SYSTEM_CUSTOMER_ID = void 0;
+/**
+ * The walk-in ("Consumidor Final") system customer — the ONE definition.
+ *
+ * Every store mints a single CUSTOMER row under this fixed id the first time it
+ * records a walk-in POS sale, so a walk-in order still carries a non-null
+ * `Order.customerId`. It carries no real identity and has no cuenta corriente.
+ * Operator writes that refuse it with `403 SYSTEM_CUSTOMER_PROTECTED` include
+ * `POST /customers` and its merge mode, the address book, contacts and notes
+ * (create and edit), a movement or a balance reprojection on `POST /account`,
+ * a payment link whose target is the customer, and the customer data-rights
+ * modes (data export, anonymize). Map the code wherever it appears; this is
+ * not a closed list.
+ *
+ * A client routes on it instead of hard-coding the literal: collecting cash on a
+ * delivered walk-in order is `POST /orders { mode: 'tender' }`, never a
+ * cuenta-corriente movement.
+ *
+ * ⚠️ Zero imports, deliberately: the server re-exports it from the leaf
+ * `stacks/helpers/protectSystemCustomer.ts` (imported by services and crons),
+ * and a client bundles it without any other contract module.
+ *
+ * The id sits outside the mintable range: the customer counter starts at 1 and
+ * a store's seeded placeholder rows hold `CUST000001`–`CUST000006`.
+ */
+exports.SYSTEM_CUSTOMER_ID = 'CUST000000';
+/** `true` exactly when `customerId` is the walk-in system customer. */
+const isSystemCustomer = (customerId) => customerId === exports.SYSTEM_CUSTOMER_ID;
+exports.isSystemCustomer = isSystemCustomer;

package/dist/index.d.ts

@@ -90,6 +90,7 @@ export * from './terminal.ts';
 export * from './supplier.ts';
 export * from './supplierClaim.ts';
 export * from './survey.ts';
+export * from './systemCustomer.ts';
 export * from './user.ts';
 export * from './userActivity.ts';
 export * from './valuation.ts';

package/dist/index.js

@@ -98,6 +98,7 @@ export * from "./terminal.js";
 export * from "./supplier.js";
 export * from "./supplierClaim.js";
 export * from "./survey.js";
+export * from "./systemCustomer.js";
 export * from "./user.js";
 export * from "./userActivity.js";
 export * from "./valuation.js";

package/dist/store.d.ts

@@ -85,6 +85,19 @@ declare global {
         /** MercadoLibre orders. */
         mercadolibre?: string;
     }
+    /**
+     * One store-wide module a store can switch off for every user — the
+     * catalogue is the shared `domain/STORE_MODULES.md`. Enumerable at runtime as
+     * `STORE_MODULE_KEYS`; read a switch through `isStoreModuleOn`.
+     */
+    type StoreModuleKey = (typeof STORE_MODULE_KEYS)[number];
+    /**
+     * `Store.config.modules`. ⚠️ An ABSENT key is ON — only an explicit `false`
+     * turns a module off, so a store that never wrote the map (every store that
+     * predates it) has every module on. Off HIDES; it never deletes, and the
+     * module's existing records stay readable.
+     */
+    type StoreModules = Partial<Record<StoreModuleKey, boolean>>;
     interface Ecommerce {
         /**
          * The tenant's «Activar tienda online» switch. Written only by the api's
@@ -880,8 +893,50 @@ declare global {
              * Written through `PATCH /store` `config` (admin tier), merged per channel;
              * a channel sent as `null` clears it. Absent, or a channel absent inside
              * it, means that channel's sales use the primary depósito.
+             *
+             * ⚠️ Ignored while `modules.multiWarehouse` is `false`: sales and the
+             * MercadoLibre feed then resolve to the primary depósito (see `modules`),
+             * whatever this holds.
              */
             channelWarehouses?: StoreChannelWarehouses;
+            /**
+             * Store-wide module switches — see `StoreModules`. Written through
+             * `PATCH /store` `config` at the PRIVILEGED tier (ADMIN/SUPERVISOR/MANAGER;
+             * a plain USER is refused `STORE_CONFIG_FORBIDDEN`), merged per key. An
+             * unknown key is refused `400 STORE_MODULE_UNKNOWN`, a non-boolean value
+             * `400 STORE_MODULE_NOT_BOOLEAN`.
+             *
+             * Turning a module OFF is refused while it still carries state:
+             * `multiWarehouse` while more than one depósito is active
+             * (`409 STORE_MODULE_WAREHOUSES_ACTIVE`) or a transfer is in transit or
+             * partially received (`409 STORE_MODULE_TRANSFER_IN_FLIGHT`);
+             * `customerAccounts` while any customer carries a non-zero balance
+             * (`409 STORE_MODULE_CUSTOMER_BALANCES`, or
+             * `409 STORE_MODULE_BALANCE_CHECK_INCOMPLETE` when the bounded read could
+             * not finish).
+             *
+             * Enforced on the server for four modules only:
+             * - `promotions` — applying one is refused `PROMOTION_NOT_ACTIVE` (the
+             *   existing promotion refusal, not `STORE_MODULE_DISABLED`), a grant already
+             *   frozen on a cart stays on the row but derives no money (its
+             *   `promotionEffect` is removed), the storefront checkout and a service
+             *   delivery refuse it `409 CART_PROMOTION_UNAVAILABLE` with
+             *   `data.reason: 'PROMOTION_NOT_ACTIVE'` (removing the grant), and the
+             *   applicable list is empty. A till ticket last written while promotions
+             *   were on (it still carries its `promotionEffect`) converts at the price
+             *   it was sold at.
+             * - `appointments` — storefront availability, booking and rescheduling are
+             *   refused `403 STORE_MODULE_DISABLED`; the shopper's list and cancel stay.
+             * - `surveys` — a storefront survey is refused `403 STORE_MODULE_DISABLED`,
+             *   so none is recorded, broadcast or mailed.
+             * - `multiWarehouse` — every sale resolves to the primary depósito (a
+             *   scoped operator's sale to their own home depósito when the primary is
+             *   outside their scope), and only the primary feeds MercadoLibre.
+             * Every other module is hide-only: its endpoints stay reachable. Public
+             * reads carry only `appointments`, `surveys`, `promotions` and
+             * `customerAccounts`. `PUT /platform/stores/{storeId}` refuses the leaf.
+             */
+            modules?: StoreModules;
         };
         ecommerce?: Ecommerce;
         /**
@@ -1947,3 +2002,39 @@ export declare const CUSTOM_DOMAIN_SLOT_LIMIT = 2;
  * `409 DOMAIN_ROW_LIMIT` with this value as `limit`.
  */
 export declare const CUSTOM_DOMAIN_ROW_LIMIT = 10;
+/**
+ * Every `StoreModuleKey`, in catalogue order — the ONE list. The type is derived
+ * from it, so the `PATCH /store` validator and every client enumerate exactly
+ * the modules the type allows, and a module is added in one place.
+ */
+export declare const STORE_MODULE_KEYS: readonly ["attendance", "lots", "stocktake", "purchases", "loyalty", "surveys", "customerZones", "workshop", "appointments", "cash", "multiWarehouse", "quotes", "promotions", "marketing", "fiscalInvoicing", "customerAccounts"];
+/** Whether `value` names a module — narrows an untyped key (a request body, a stored row). */
+export declare const isStoreModuleKey: (value: unknown) => value is StoreModuleKey;
+/**
+ * Whether `module` is on for a store whose `config.modules` is `modules`.
+ * ⚠️ Absent is ON: only an explicit `false` turns a module off, so a missing
+ * map, a missing key and `true` all answer `true`.
+ */
+export declare const isStoreModuleOn: (modules: StoreModules | null | undefined, module: StoreModuleKey) => boolean;
+/**
+ * Every refusal code the store-module switches put on the wire, beyond the
+ * platform-wide set (`VALIDATION_FAILED`, and `STORE_CONFIG_FORBIDDEN` for a
+ * plain USER writing the privileged leaf):
+ *
+ * - `STORE_MODULE_UNKNOWN` (400) — `PATCH /store` named a key outside
+ *   `STORE_MODULE_KEYS`; `data.module` carries it.
+ * - `STORE_MODULE_NOT_BOOLEAN` (400) — a module's value was not `true`/`false`.
+ * - `STORE_MODULE_WAREHOUSES_ACTIVE` (409) — `multiWarehouse` off while more
+ *   than one depósito is active; `data.activeWarehouses` carries the count.
+ * - `STORE_MODULE_TRANSFER_IN_FLIGHT` (409) — `multiWarehouse` off while a stock
+ *   transfer is in transit or partially received; `data.transferId` names one.
+ * - `STORE_MODULE_CUSTOMER_BALANCES` (409) — `customerAccounts` off while a
+ *   customer carries a non-zero balance; `data.customerId` names one.
+ * - `STORE_MODULE_BALANCE_CHECK_INCOMPLETE` (409) — the bounded balance read
+ *   stopped before it could prove every balance is zero. Retrying is harmless but
+ *   walks the same rows, so a very large customer book keeps answering it.
+ * - `STORE_MODULE_DISABLED` (403) — a server-enforced module is off (storefront
+ *   self-booking, storefront survey); `data.module` names it.
+ */
+export declare const STORE_MODULE_ERROR_CODES: readonly ["STORE_MODULE_UNKNOWN", "STORE_MODULE_NOT_BOOLEAN", "STORE_MODULE_WAREHOUSES_ACTIVE", "STORE_MODULE_TRANSFER_IN_FLIGHT", "STORE_MODULE_CUSTOMER_BALANCES", "STORE_MODULE_BALANCE_CHECK_INCOMPLETE", "STORE_MODULE_DISABLED"];
+export type StoreModuleErrorCode = (typeof STORE_MODULE_ERROR_CODES)[number];

package/dist/store.js

@@ -15,3 +15,63 @@ export const CUSTOM_DOMAIN_SLOT_LIMIT = 2;
  * `409 DOMAIN_ROW_LIMIT` with this value as `limit`.
  */
 export const CUSTOM_DOMAIN_ROW_LIMIT = 10;
+/**
+ * Every `StoreModuleKey`, in catalogue order — the ONE list. The type is derived
+ * from it, so the `PATCH /store` validator and every client enumerate exactly
+ * the modules the type allows, and a module is added in one place.
+ */
+export const STORE_MODULE_KEYS = [
+    'attendance',
+    'lots',
+    'stocktake',
+    'purchases',
+    'loyalty',
+    'surveys',
+    'customerZones',
+    'workshop',
+    'appointments',
+    'cash',
+    'multiWarehouse',
+    'quotes',
+    'promotions',
+    'marketing',
+    'fiscalInvoicing',
+    'customerAccounts',
+];
+/** Whether `value` names a module — narrows an untyped key (a request body, a stored row). */
+export const isStoreModuleKey = (value) => typeof value === 'string' && STORE_MODULE_KEYS.includes(value);
+/**
+ * Whether `module` is on for a store whose `config.modules` is `modules`.
+ * ⚠️ Absent is ON: only an explicit `false` turns a module off, so a missing
+ * map, a missing key and `true` all answer `true`.
+ */
+export const isStoreModuleOn = (modules, module) => modules?.[module] !== false;
+/**
+ * Every refusal code the store-module switches put on the wire, beyond the
+ * platform-wide set (`VALIDATION_FAILED`, and `STORE_CONFIG_FORBIDDEN` for a
+ * plain USER writing the privileged leaf):
+ *
+ * - `STORE_MODULE_UNKNOWN` (400) — `PATCH /store` named a key outside
+ *   `STORE_MODULE_KEYS`; `data.module` carries it.
+ * - `STORE_MODULE_NOT_BOOLEAN` (400) — a module's value was not `true`/`false`.
+ * - `STORE_MODULE_WAREHOUSES_ACTIVE` (409) — `multiWarehouse` off while more
+ *   than one depósito is active; `data.activeWarehouses` carries the count.
+ * - `STORE_MODULE_TRANSFER_IN_FLIGHT` (409) — `multiWarehouse` off while a stock
+ *   transfer is in transit or partially received; `data.transferId` names one.
+ * - `STORE_MODULE_CUSTOMER_BALANCES` (409) — `customerAccounts` off while a
+ *   customer carries a non-zero balance; `data.customerId` names one.
+ * - `STORE_MODULE_BALANCE_CHECK_INCOMPLETE` (409) — the bounded balance read
+ *   stopped before it could prove every balance is zero. Retrying is harmless but
+ *   walks the same rows, so a very large customer book keeps answering it.
+ * - `STORE_MODULE_DISABLED` (403) — a server-enforced module is off (storefront
+ *   self-booking, storefront survey); `data.module` names it.
+ */
+export const STORE_MODULE_ERROR_CODES = [
+    'STORE_MODULE_UNKNOWN',
+    'STORE_MODULE_NOT_BOOLEAN',
+    'STORE_MODULE_WAREHOUSES_ACTIVE',
+    'STORE_MODULE_TRANSFER_IN_FLIGHT',
+    'STORE_MODULE_CUSTOMER_BALANCES',
+    'STORE_MODULE_BALANCE_CHECK_INCOMPLETE',
+    'STORE_MODULE_DISABLED',
+];

package/dist/systemCustomer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The walk-in ("Consumidor Final") system customer — the ONE definition.
+ *
+ * Every store mints a single CUSTOMER row under this fixed id the first time it
+ * records a walk-in POS sale, so a walk-in order still carries a non-null
+ * `Order.customerId`. It carries no real identity and has no cuenta corriente.
+ * Operator writes that refuse it with `403 SYSTEM_CUSTOMER_PROTECTED` include
+ * `POST /customers` and its merge mode, the address book, contacts and notes
+ * (create and edit), a movement or a balance reprojection on `POST /account`,
+ * a payment link whose target is the customer, and the customer data-rights
+ * modes (data export, anonymize). Map the code wherever it appears; this is
+ * not a closed list.
+ *
+ * A client routes on it instead of hard-coding the literal: collecting cash on a
+ * delivered walk-in order is `POST /orders { mode: 'tender' }`, never a
+ * cuenta-corriente movement.
+ *
+ * ⚠️ Zero imports, deliberately: the server re-exports it from the leaf
+ * `stacks/helpers/protectSystemCustomer.ts` (imported by services and crons),
+ * and a client bundles it without any other contract module.
+ *
+ * The id sits outside the mintable range: the customer counter starts at 1 and
+ * a store's seeded placeholder rows hold `CUST000001`–`CUST000006`.
+ */
+export declare const SYSTEM_CUSTOMER_ID: "CUST000000";
+/** `true` exactly when `customerId` is the walk-in system customer. */
+export declare const isSystemCustomer: (customerId: string | undefined | null) => customerId is typeof SYSTEM_CUSTOMER_ID;

package/dist/systemCustomer.js

@@ -0,0 +1,27 @@
+/**
+ * The walk-in ("Consumidor Final") system customer — the ONE definition.
+ *
+ * Every store mints a single CUSTOMER row under this fixed id the first time it
+ * records a walk-in POS sale, so a walk-in order still carries a non-null
+ * `Order.customerId`. It carries no real identity and has no cuenta corriente.
+ * Operator writes that refuse it with `403 SYSTEM_CUSTOMER_PROTECTED` include
+ * `POST /customers` and its merge mode, the address book, contacts and notes
+ * (create and edit), a movement or a balance reprojection on `POST /account`,
+ * a payment link whose target is the customer, and the customer data-rights
+ * modes (data export, anonymize). Map the code wherever it appears; this is
+ * not a closed list.
+ *
+ * A client routes on it instead of hard-coding the literal: collecting cash on a
+ * delivered walk-in order is `POST /orders { mode: 'tender' }`, never a
+ * cuenta-corriente movement.
+ *
+ * ⚠️ Zero imports, deliberately: the server re-exports it from the leaf
+ * `stacks/helpers/protectSystemCustomer.ts` (imported by services and crons),
+ * and a client bundles it without any other contract module.
+ *
+ * The id sits outside the mintable range: the customer counter starts at 1 and
+ * a store's seeded placeholder rows hold `CUST000001`–`CUST000006`.
+ */
+export const SYSTEM_CUSTOMER_ID = 'CUST000000';
+/** `true` exactly when `customerId` is the walk-in system customer. */
+export const isSystemCustomer = (customerId) => customerId === SYSTEM_CUSTOMER_ID;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.722",
+	"version": "1.10.724",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",