platform-types 1.10.737 → 1.10.739

package/dist/auth.d.ts

@@ -64,9 +64,12 @@ declare global {
      * optionality.
      *
      * ⚠️ NOT interchangeable with {@link CustomerRegisterInput}. The two
-     * registration endpoints differ in four places — `name` and `acquisition`
-     * exist only here, `fullName` is OPTIONAL here and REQUIRED there, and the
-     * address/`afip` block exists only there.
+     * registration endpoints differ in key set AND in rules: `name`,
+     * `acknowledgedSharedCuit`, `acquisition`, `consentTimestamp`,
+     * `consentVersion` and `storeContact` exist only here, and the address block
+     * and `afip` only there; `fullName` is OPTIONAL here and REQUIRED there,
+     * `email` has an 8-character floor here and 5 there, and `cuit` is a bare
+     * length check here and a mod-11 check there.
      *
      * ⚠️ Bounds are stated per field below and are what the server ENFORCES;
      * a violation is `400` and creates nothing at all, not a partial tenant.
@@ -75,13 +78,17 @@ declare global {
      * keys and ignores them. This type deliberately does not declare an index
      * signature: an unknown key buys a client nothing and losing the
      * excess-property check is how a misspelled `fullname` ships silently. The
-     * nested `acquisition` object is the opposite — `.strict()`, so an unknown key
-     * inside it refuses the WHOLE registration.
+     * nested `acquisition` and `storeContact` objects are the opposite —
+     * `.strict()`, so an unknown key inside either refuses the WHOLE
+     * registration.
      */
     interface TenantRegisterInput {
         /** Store name. Trimmed, then 4–40 characters. Required — tenants are never created nameless. */
         name: string;
-        /** Must parse as an email address, and at least 8 characters. Lower-cased server-side. */
+        /**
+         * Must parse as an email address, 8–254 characters. The local part must be
+         * ASCII (`z.email()`), so `dueño@…` is refused. Lower-cased server-side.
+         */
         email: string;
         /** At least 8 characters — the one creation-time floor every password-accepting surface shares. */
         password: string;
@@ -136,6 +143,57 @@ declare global {
          * Its presence is what makes a consent record exist at all.
          */
         consentVersion?: string;
+        /**
+         * The STORE's own contact leaves, prefilled from the signup form.
+         *
+         * ⚠️ Send it ONLY after the merchant has confirmed that each value is a
+         * BUSINESS contact, never by copying the founder's own `phone`/`email`
+         * across silently: both land on the STORE row as `phone`/`email`, which
+         * are printed on every transactional mail to the store's customers
+         * (`storeContactFooter`), and `phone` also on the emisor block of every
+         * invoice PDF.
+         *
+         * ⚠️ A STORE `email` becomes a DESTINATION once its inbox confirms it, so
+         * the client must confirm it is a MONITORED business address, not just a
+         * public one. Registering with it mails a single-use confirmation link
+         * there (platform-branded, valid 48 h), and until that link is followed:
+         * - customer-facing store-branded mail sent under the platform envelope
+         *   carries NO `Reply-To`; once confirmed, the address is that `Reply-To`,
+         *   so a customer's answer goes there. Customer mail never falls back to
+         *   the founder's address;
+         * - the storefront's survey responses (suppressed for a demo store) and
+         *   the scheduled sales digest (once the store opts in and is entitled
+         *   to it) go to the founding admin's verified login email instead, and
+         *   to no one when that account is disabled or its email unverified;
+         *   once confirmed, they go to this address. Without a store `email`
+         *   neither is sent at all;
+         * - an integration re-authorisation mail that names no address goes to
+         *   the founding admin's verified login email, and to this address only
+         *   when that one is unusable AND this one is confirmed.
+         *
+         * STRICT, like `acquisition`: an unknown key refuses the WHOLE
+         * registration, and so does an empty object — send at least one key or
+         * omit the object. `storeContact: null` is refused too: to send no
+         * contact, leave the key ABSENT. `phone` is EXACTLY 10 characters (the founder `phone`
+         * rule); `email` is the founder `email` rule — an email address, 8–254
+         * characters, ASCII local part — and is lower-cased server-side exactly as
+         * the founder `email` is. A violation is a `400` and creates no tenant.
+         *
+         * The api records which keys were sent as the server-owned
+         * {@link Store.registrationPrefill}; a client never sends that.
+         */
+        storeContact?: TenantRegisterStoreContactInput;
+    }
+    /** {@link TenantRegisterInput.storeContact} — at least one key. */
+    interface TenantRegisterStoreContactInput {
+        /** EXACTLY 10 characters. */
+        phone?: string;
+        /**
+         * A valid email address, 8–254 characters — the founder `email` rule. The
+         * local part must be ASCII (the same `z.email()` rule), so `dueño@…` is
+         * refused. Lower-cased server-side.
+         */
+        email?: string;
     }
     /**
      * One `afip` entry as the CUSTOMER registration ACCEPTS it — {@link CustomerAfip}
@@ -159,7 +217,7 @@ declare global {
      * that schema.
      *
      * ⚠️ NOT interchangeable with {@link TenantRegisterInput} — see that type for
-     * the five differences. In particular there is no `acquisition` here: campaign
+     * the differences. In particular there is no `acquisition` here: campaign
      * attribution is a TENANT property, and a value sent on this leg is dropped.
      *
      * ⚠️ Unlike the tenant schema this object is NOT `.loose()`, so an unknown

package/dist/store.d.ts

@@ -388,6 +388,55 @@ declare global {
          */
         userId: string;
     }
+    /** A STORE contact leaf that tenant self-registration may prefill. */
+    type StoreRegistrationPrefillField = 'phone' | 'email';
+    /**
+     * Which top-level contact leaves tenant self-registration wrote onto this
+     * STORE row, and when — the record that `phone` / `email` came from the
+     * signup form (`TenantRegisterInput.storeContact`) rather than from the
+     * store settings.
+     *
+     * ⚠️ Server-owned and forward-only, like {@link StoreAcquisition}: the api
+     * assembles it from the keys `storeContact` actually carried, and no body
+     * may set it — the register body ignores a top-level `registrationPrefill`,
+     * and `POST /store` / `POST /tenants` refuse it `FIELD_SERVER_OWNED`. No
+     * route rewrites or clears it, so it keeps describing the SIGNUP even after
+     * an operator edits the contact leaves it names.
+     */
+    interface StoreRegistrationPrefill {
+        /** The leaves the registration wrote, in `['phone', 'email']` order; never empty. */
+        fields: StoreRegistrationPrefillField[];
+        /** Unix ms — the registration's own `createdAt`, the instant the STORE item is stamped with. */
+        capturedAt: number;
+    }
+    /**
+     * The ownership check on the STORE row's `email`: whether whoever reads that
+     * inbox has confirmed it, by following a single-use link the api mailed to it.
+     *
+     * ⚠️ Server-owned: no request body may set it. Every write that puts a NEW
+     * `email` on the row stamps it `pending` for that exact address; the
+     * confirmation link flips it to `verified` only while the row still holds
+     * that address. Clearing `email` KEEPS the record: it names the address it
+     * is about, so it can only vouch for a later `email` that really is that
+     * verified address.
+     *
+     * ABSENT means verified (rows that predate it are grandfathered); a PRESENT
+     * record that is `null` or malformed counts as unverified. The one reader of
+     * "verified" is `isStoreEmailVerified` (`stacks/helpers/storeEmailVerified.ts`).
+     */
+    interface StoreEmailVerification {
+        /** `pending` until the link mailed to `address` is followed, then `verified`. */
+        status: 'pending' | 'verified';
+        /**
+         * The normalised address the record is about. A record whose `address` is
+         * not the row's current `email` says nothing about that email.
+         */
+        address: string;
+        /** Unix ms — when the api stamped it `pending`. */
+        requestedAt: number;
+        /** Unix ms — when the link was followed. Present only once `verified`. */
+        verifiedAt?: number;
+    }
     /**
      * The shop's public address, as every link minter and every client reads it.
      * Computed by the api from server-owned row fields that never reach a client
@@ -501,6 +550,23 @@ declare global {
          *    permanently absent by construction.
          */
         termsConsent?: StoreTermsConsent;
+        /**
+         * Which contact leaves tenant self-registration prefilled, and when.
+         * Admin-only; absent on every row the signup did not prefill — including
+         * every row written before this shipped (forward-only, never backfilled)
+         * and every operator-created tenant.
+         */
+        registrationPrefill?: StoreRegistrationPrefill;
+        /**
+         * Whether `email` has been confirmed by its inbox. Admin-only; written only
+         * by the server.
+         *
+         * ⚠️ **Absent means verified.** A row whose `email` predates verification
+         * carries no record, and that address is grandfathered as verified — it is
+         * never backfilled. Only a record that is `pending`, or `verified` for an
+         * address other than the current `email`, makes the email unverified.
+         */
+        emailVerification?: StoreEmailVerification;
         /**
          * Response-time join, not a persisted Store attribute — and TWO different
          * shapes depending on the endpoint: `GET /tenants` (SUPERVISOR) attaches the

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.737",
+	"version": "1.10.739",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",