platform-types 1.10.723 → 1.10.725

package/dist/account.d.ts

@@ -198,6 +198,12 @@ declare global {
      * and attach the token here. The approval binds the raw body minus the token,
      * which is why the keys marked accepted and IGNORED below are declared at all.
      *
+     * A `customerId` equal to `SYSTEM_CUSTOMER_ID` (the walk-in, see
+     * `isSystemCustomer`) is refused `403 SYSTEM_CUSTOMER_PROTECTED`, credit and
+     * debit alike, with no business row read or written: the walk-in has no cuenta
+     * corriente. Collect a walk-in order's cash through
+     * `POST /orders { mode: 'tender' }` instead.
+     *
      * Held to its schema by `AssertAccountPostRequestMatchesSchema`.
      */
     interface AccountPostRequest extends TerminalElevationAuthorization {

package/dist/cjs/index.js

@@ -114,6 +114,7 @@ __exportStar(require("./terminal.js"), exports);
 __exportStar(require("./supplier.js"), exports);
 __exportStar(require("./supplierClaim.js"), exports);
 __exportStar(require("./survey.js"), exports);
+__exportStar(require("./systemCustomer.js"), exports);
 __exportStar(require("./user.js"), exports);
 __exportStar(require("./userActivity.js"), exports);
 __exportStar(require("./valuation.js"), exports);

package/dist/cjs/systemCustomer.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSystemCustomer = exports.SYSTEM_CUSTOMER_ID = void 0;
+/**
+ * The walk-in ("Consumidor Final") system customer — the ONE definition.
+ *
+ * Every store mints a single CUSTOMER row under this fixed id the first time it
+ * records a walk-in POS sale, so a walk-in order still carries a non-null
+ * `Order.customerId`. It carries no real identity and has no cuenta corriente.
+ * Operator writes that refuse it with `403 SYSTEM_CUSTOMER_PROTECTED` include
+ * `POST /customers` and its merge mode, the address book, contacts and notes
+ * (create and edit), a movement or a balance reprojection on `POST /account`,
+ * a payment link whose target is the customer, and the customer data-rights
+ * modes (data export, anonymize). Map the code wherever it appears; this is
+ * not a closed list.
+ *
+ * A client routes on it instead of hard-coding the literal: collecting cash on a
+ * delivered walk-in order is `POST /orders { mode: 'tender' }`, never a
+ * cuenta-corriente movement.
+ *
+ * ⚠️ Zero imports, deliberately: the server re-exports it from the leaf
+ * `stacks/helpers/protectSystemCustomer.ts` (imported by services and crons),
+ * and a client bundles it without any other contract module.
+ *
+ * The id sits outside the mintable range: the customer counter starts at 1 and
+ * a store's seeded placeholder rows hold `CUST000001`–`CUST000006`.
+ */
+exports.SYSTEM_CUSTOMER_ID = 'CUST000000';
+/** `true` exactly when `customerId` is the walk-in system customer. */
+const isSystemCustomer = (customerId) => customerId === exports.SYSTEM_CUSTOMER_ID;
+exports.isSystemCustomer = isSystemCustomer;

package/dist/index.d.ts

@@ -90,6 +90,7 @@ export * from './terminal.ts';
 export * from './supplier.ts';
 export * from './supplierClaim.ts';
 export * from './survey.ts';
+export * from './systemCustomer.ts';
 export * from './user.ts';
 export * from './userActivity.ts';
 export * from './valuation.ts';

package/dist/index.js

@@ -98,6 +98,7 @@ export * from "./terminal.js";
 export * from "./supplier.js";
 export * from "./supplierClaim.js";
 export * from "./survey.js";
+export * from "./systemCustomer.js";
 export * from "./user.js";
 export * from "./userActivity.js";
 export * from "./valuation.js";

package/dist/subscription.d.ts

@@ -882,8 +882,12 @@ declare global {
          * non-null value for one is refused (`PLAN_GRANT_UNKNOWN_KEY`).
          */
         grants: Record<string, Partial<Record<PlanTier, PlanGrantValue | null>>>;
-        /** Screened operator reason (10-500 characters, no personal data); lands in each tier's audit entry. */
-        reason: string;
+        /**
+         * Optional on a draft edit: the reason that lands in the permanent audit
+         * rows is the publish's (`PlanCataloguePublishInput.reason`). Still
+         * screened when sent (10-500 characters, no personal data).
+         */
+        reason?: string;
         /**
          * Accepted and NOT checked: a grant edit writes the draft, and the echo that
          * gates what readers see is the publish's (`PlanCataloguePublishInput.confirm`).
@@ -891,6 +895,36 @@ declare global {
         confirm?: string;
         /** `true` writes nothing and returns the impact plus the `confirm` string. */
         dryRun?: boolean;
+        /**
+         * The draft revision the editor read (`GET /platform/billing/plans/draft`),
+         * or `null` when there was no draft. Checked when sent: a stale one is
+         * `409 PLAN_CATALOGUE_REVISION_CONFLICT` and nothing is written.
+         */
+        expectedDraftRevision?: string | null;
+    }
+    /**
+     * The body of `PATCH /platform/billing/plans/{tier}`: template fields written
+     * to the DRAFT catalogue only (customers see them after a publish). Every
+     * field is optional; a `null` clears a nullable one. Grants go through
+     * `PATCH /platform/billing/plans/grants` (a body carrying `features` or
+     * `grants` is `400 PLAN_GRANTS_USE_GRANTS_ROUTE`), and the retired `bullets`
+     * copy is refused.
+     */
+    interface PlanTemplatePatchRequest {
+        name?: string;
+        description?: string;
+        displayOrder?: number;
+        isActive?: boolean;
+        isPopular?: boolean;
+        /** `#rgb` or `#rrggbb`; `null` clears it. */
+        color?: string | null;
+        priceMonthlyCents?: number | null;
+        priceAnnualCents?: number | null;
+        currency?: Plan['currency'];
+        /** Optional on a draft edit; still screened when sent. The audited reason is the publish's. */
+        reason?: string;
+        /** As on {@link PlanGrantsWriteRequest.expectedDraftRevision}. */
+        expectedDraftRevision?: string | null;
     }
     /** One key's effective grant on one tier, before and after the write. */
     interface PlanGrantChange {

package/dist/systemCustomer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The walk-in ("Consumidor Final") system customer — the ONE definition.
+ *
+ * Every store mints a single CUSTOMER row under this fixed id the first time it
+ * records a walk-in POS sale, so a walk-in order still carries a non-null
+ * `Order.customerId`. It carries no real identity and has no cuenta corriente.
+ * Operator writes that refuse it with `403 SYSTEM_CUSTOMER_PROTECTED` include
+ * `POST /customers` and its merge mode, the address book, contacts and notes
+ * (create and edit), a movement or a balance reprojection on `POST /account`,
+ * a payment link whose target is the customer, and the customer data-rights
+ * modes (data export, anonymize). Map the code wherever it appears; this is
+ * not a closed list.
+ *
+ * A client routes on it instead of hard-coding the literal: collecting cash on a
+ * delivered walk-in order is `POST /orders { mode: 'tender' }`, never a
+ * cuenta-corriente movement.
+ *
+ * ⚠️ Zero imports, deliberately: the server re-exports it from the leaf
+ * `stacks/helpers/protectSystemCustomer.ts` (imported by services and crons),
+ * and a client bundles it without any other contract module.
+ *
+ * The id sits outside the mintable range: the customer counter starts at 1 and
+ * a store's seeded placeholder rows hold `CUST000001`–`CUST000006`.
+ */
+export declare const SYSTEM_CUSTOMER_ID: "CUST000000";
+/** `true` exactly when `customerId` is the walk-in system customer. */
+export declare const isSystemCustomer: (customerId: string | undefined | null) => customerId is typeof SYSTEM_CUSTOMER_ID;

package/dist/systemCustomer.js

@@ -0,0 +1,27 @@
+/**
+ * The walk-in ("Consumidor Final") system customer — the ONE definition.
+ *
+ * Every store mints a single CUSTOMER row under this fixed id the first time it
+ * records a walk-in POS sale, so a walk-in order still carries a non-null
+ * `Order.customerId`. It carries no real identity and has no cuenta corriente.
+ * Operator writes that refuse it with `403 SYSTEM_CUSTOMER_PROTECTED` include
+ * `POST /customers` and its merge mode, the address book, contacts and notes
+ * (create and edit), a movement or a balance reprojection on `POST /account`,
+ * a payment link whose target is the customer, and the customer data-rights
+ * modes (data export, anonymize). Map the code wherever it appears; this is
+ * not a closed list.
+ *
+ * A client routes on it instead of hard-coding the literal: collecting cash on a
+ * delivered walk-in order is `POST /orders { mode: 'tender' }`, never a
+ * cuenta-corriente movement.
+ *
+ * ⚠️ Zero imports, deliberately: the server re-exports it from the leaf
+ * `stacks/helpers/protectSystemCustomer.ts` (imported by services and crons),
+ * and a client bundles it without any other contract module.
+ *
+ * The id sits outside the mintable range: the customer counter starts at 1 and
+ * a store's seeded placeholder rows hold `CUST000001`–`CUST000006`.
+ */
+export const SYSTEM_CUSTOMER_ID = 'CUST000000';
+/** `true` exactly when `customerId` is the walk-in system customer. */
+export const isSystemCustomer = (customerId) => customerId === SYSTEM_CUSTOMER_ID;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.723",
+	"version": "1.10.725",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",