platform-types 1.10.738 → 1.10.740

package/dist/auth.d.ts

@@ -153,18 +153,23 @@ declare global {
          * (`storeContactFooter`), and `phone` also on the emisor block of every
          * invoice PDF.
          *
-         * ⚠️ A STORE `email` is also a live DESTINATION from the first day, so the
-         * client must confirm it is a MONITORED business address, not just a
-         * public one:
-         * - it is the `Reply-To` of every store-branded mail to the store's
-         *   customers sent under the platform envelope, so a customer's answer goes
-         *   there;
-         * - it receives the storefront's survey responses (suppressed for a demo
-         *   store);
-         * - it is the one recipient of the scheduled sales digest, once the store
-         *   opts in and is entitled to it;
-         * - it is the last-resort recipient of an integration re-authorisation mail,
-         *   used when the request names no address and the founding admin has none.
+         * ⚠️ A STORE `email` becomes a DESTINATION once its inbox confirms it, so
+         * the client must confirm it is a MONITORED business address, not just a
+         * public one. Registering with it mails a single-use confirmation link
+         * there (platform-branded, valid 48 h), and until that link is followed:
+         * - customer-facing store-branded mail sent under the platform envelope
+         *   carries NO `Reply-To`; once confirmed, the address is that `Reply-To`,
+         *   so a customer's answer goes there. Customer mail never falls back to
+         *   the founder's address;
+         * - the storefront's survey responses (suppressed for a demo store) and
+         *   the scheduled sales digest (once the store opts in and is entitled
+         *   to it) go to the founding admin's verified login email instead, and
+         *   to no one when that account is disabled or its email unverified;
+         *   once confirmed, they go to this address. Without a store `email`
+         *   neither is sent at all;
+         * - an integration re-authorisation mail that names no address goes to
+         *   the founding admin's verified login email, and to this address only
+         *   when that one is unusable AND this one is confirmed.
          *
          * STRICT, like `acquisition`: an unknown key refuses the WHOLE
          * registration, and so does an empty object — send at least one key or

package/dist/cjs/supplier.js

@@ -28,6 +28,23 @@ exports.DEFAULT_PURCHASE_MATCH_TOLERANCE = Object.freeze({ pct: 1 });
  *   store's, or a receipt is not under it.
  * - `PURCHASE_ORDER_NOT_RECEIVABLE` · 409 — the purchase order is `draft` or
  *   `cancelled`.
+ * - `RECEIPT_ALREADY_BILLED` · 409 — a receipt the bill names is already
+ *   covered by another bill (`PurchaseReceipt.billedBy`); `data.receiptIds`
+ *   lists them. Nothing is written.
+ * - `SUPPLIER_INVOICE_EDIT_CONFLICT` · 409 — an edit of a bill that stores or
+ *   writes `receiptIds` (an empty list included) lost to another edit of the
+ *   same bill that landed first and moved only the row version (when the
+ *   `fce` block, the PDF or the payments moved too, that guard's own code
+ *   answers); or a receipt the edit stops naming changed hands since the read;
+ *   or the save met another transaction on the bill or one of its receipts
+ *   in flight, and again on its one retry. Nothing is written; re-read the
+ *   bill and retry.
+ * - `BILL_RECEIPT_CHANGE_TOO_LARGE` · 400 — the receipts the save would mark
+ *   and unmark, plus the bill row, exceed one DynamoDB transaction (100
+ *   items). Nothing is written; save the receipts in smaller steps.
+ * - `PURCHASE_RECEIPTS_READ_TRUNCATED` · 503 — the purchase order's receipt
+ *   read was cut short, so the receipts to mark and the verdict cannot be
+ *   decided. Nothing is written.
  * - `PURCHASE_ORDER_SUPPLIER_MISMATCH` · 400 — the bill's supplier is not the
  *   purchase order's.
  * - `ADMIN_REQUIRED` · 403 — only ADMIN or MANAGER may override.
@@ -40,11 +57,15 @@ exports.DEFAULT_PURCHASE_MATCH_TOLERANCE = Object.freeze({ pct: 1 });
  *   purchase-order line the bill's order does not have, one whose `productId`
  *   differs, one another bill line already names, or names one with no
  *   purchase order on the bill.
- * - `VALIDATION_FAILED` · 400
+ * - `VALIDATION_FAILED` · 400 — includes `receiptIds` naming one receipt twice.
  */
 exports.SUPPLIER_INVOICE_MATCH_ERROR_CODES = [
     'RECEIPT_NOT_ON_PURCHASE_ORDER',
     'PURCHASE_ORDER_NOT_RECEIVABLE',
+    'RECEIPT_ALREADY_BILLED',
+    'SUPPLIER_INVOICE_EDIT_CONFLICT',
+    'BILL_RECEIPT_CHANGE_TOO_LARGE',
+    'PURCHASE_RECEIPTS_READ_TRUNCATED',
     'PURCHASE_ORDER_SUPPLIER_MISMATCH',
     'ADMIN_REQUIRED',
     'SUPPLIER_INVOICE_NOT_FOUND',

package/dist/purchaseReceipt.d.ts

@@ -100,6 +100,15 @@ declare global {
         warehouseId?: string;
         /** Operator note. ⚠️ Never personal data — this row is not scrubbed and has no TTL. */
         notes?: string;
+        /**
+         * SERVER-OWNED. The `invoiceId` of the vendor bill that covers this receipt.
+         * Set and cleared only by the vendor-bill writer (`POST /suppliers
+         * { mode: 'invoice' }`), in the same transaction as that bill's row and
+         * under a condition that refuses a second bill (`409 RECEIPT_ALREADY_BILLED`);
+         * never read from a request body. Absent on a receipt no bill covers, and on
+         * receipts billed before the marker existed.
+         */
+        billedBy?: string;
         items: PurchaseReceiptItem[];
     }
     /** The fields every receipt line carries, whichever quantity and cost it names. */

package/dist/store.d.ts

@@ -409,6 +409,34 @@ declare global {
         /** Unix ms — the registration's own `createdAt`, the instant the STORE item is stamped with. */
         capturedAt: number;
     }
+    /**
+     * The ownership check on the STORE row's `email`: whether whoever reads that
+     * inbox has confirmed it, by following a single-use link the api mailed to it.
+     *
+     * ⚠️ Server-owned: no request body may set it. Every write that puts a NEW
+     * `email` on the row stamps it `pending` for that exact address; the
+     * confirmation link flips it to `verified` only while the row still holds
+     * that address. Clearing `email` KEEPS the record: it names the address it
+     * is about, so it can only vouch for a later `email` that really is that
+     * verified address.
+     *
+     * ABSENT means verified (rows that predate it are grandfathered); a PRESENT
+     * record that is `null` or malformed counts as unverified. The one reader of
+     * "verified" is `isStoreEmailVerified` (`stacks/helpers/storeEmailVerified.ts`).
+     */
+    interface StoreEmailVerification {
+        /** `pending` until the link mailed to `address` is followed, then `verified`. */
+        status: 'pending' | 'verified';
+        /**
+         * The normalised address the record is about. A record whose `address` is
+         * not the row's current `email` says nothing about that email.
+         */
+        address: string;
+        /** Unix ms — when the api stamped it `pending`. */
+        requestedAt: number;
+        /** Unix ms — when the link was followed. Present only once `verified`. */
+        verifiedAt?: number;
+    }
     /**
      * The shop's public address, as every link minter and every client reads it.
      * Computed by the api from server-owned row fields that never reach a client
@@ -529,6 +557,16 @@ declare global {
          * and every operator-created tenant.
          */
         registrationPrefill?: StoreRegistrationPrefill;
+        /**
+         * Whether `email` has been confirmed by its inbox. Admin-only; written only
+         * by the server.
+         *
+         * ⚠️ **Absent means verified.** A row whose `email` predates verification
+         * carries no record, and that address is grandfathered as verified — it is
+         * never backfilled. Only a record that is `pending`, or `verified` for an
+         * address other than the current `email`, makes the email unverified.
+         */
+        emailVerification?: StoreEmailVerification;
         /**
          * Response-time join, not a persisted Store attribute — and TWO different
          * shapes depending on the endpoint: `GET /tenants` (SUPERVISOR) attaches the

package/dist/supplier.d.ts

@@ -215,7 +215,10 @@ declare global {
         /**
          * The receipts this bill covers, each under `purchaseOrderId`. When a write
          * names a purchase order and no receipts, the server stores every receipt
-         * that order had at that moment.
+         * that order had at that moment and no other bill covers. At most one
+         * bill covers a receipt: each one named is marked with this bill's id
+         * (`PurchaseReceipt.billedBy`), and one another bill already covers is
+         * `409 RECEIPT_ALREADY_BILLED`.
          */
         receiptIds?: string[];
         /**
@@ -584,6 +587,23 @@ export declare const DEFAULT_PURCHASE_MATCH_TOLERANCE: Readonly<PurchaseMatchTol
  *   store's, or a receipt is not under it.
  * - `PURCHASE_ORDER_NOT_RECEIVABLE` · 409 — the purchase order is `draft` or
  *   `cancelled`.
+ * - `RECEIPT_ALREADY_BILLED` · 409 — a receipt the bill names is already
+ *   covered by another bill (`PurchaseReceipt.billedBy`); `data.receiptIds`
+ *   lists them. Nothing is written.
+ * - `SUPPLIER_INVOICE_EDIT_CONFLICT` · 409 — an edit of a bill that stores or
+ *   writes `receiptIds` (an empty list included) lost to another edit of the
+ *   same bill that landed first and moved only the row version (when the
+ *   `fce` block, the PDF or the payments moved too, that guard's own code
+ *   answers); or a receipt the edit stops naming changed hands since the read;
+ *   or the save met another transaction on the bill or one of its receipts
+ *   in flight, and again on its one retry. Nothing is written; re-read the
+ *   bill and retry.
+ * - `BILL_RECEIPT_CHANGE_TOO_LARGE` · 400 — the receipts the save would mark
+ *   and unmark, plus the bill row, exceed one DynamoDB transaction (100
+ *   items). Nothing is written; save the receipts in smaller steps.
+ * - `PURCHASE_RECEIPTS_READ_TRUNCATED` · 503 — the purchase order's receipt
+ *   read was cut short, so the receipts to mark and the verdict cannot be
+ *   decided. Nothing is written.
  * - `PURCHASE_ORDER_SUPPLIER_MISMATCH` · 400 — the bill's supplier is not the
  *   purchase order's.
  * - `ADMIN_REQUIRED` · 403 — only ADMIN or MANAGER may override.
@@ -596,9 +616,9 @@ export declare const DEFAULT_PURCHASE_MATCH_TOLERANCE: Readonly<PurchaseMatchTol
  *   purchase-order line the bill's order does not have, one whose `productId`
  *   differs, one another bill line already names, or names one with no
  *   purchase order on the bill.
- * - `VALIDATION_FAILED` · 400
+ * - `VALIDATION_FAILED` · 400 — includes `receiptIds` naming one receipt twice.
  */
-export declare const SUPPLIER_INVOICE_MATCH_ERROR_CODES: readonly ["RECEIPT_NOT_ON_PURCHASE_ORDER", "PURCHASE_ORDER_NOT_RECEIVABLE", "PURCHASE_ORDER_SUPPLIER_MISMATCH", "ADMIN_REQUIRED", "SUPPLIER_INVOICE_NOT_FOUND", "SUPPLIER_INVOICE_MATCH_NOT_EXCEPTION", "INVOICE_LINES_TOTAL_MISMATCH", "INVOICE_LINE_NOT_ON_PURCHASE_ORDER", "VALIDATION_FAILED"];
+export declare const SUPPLIER_INVOICE_MATCH_ERROR_CODES: readonly ["RECEIPT_NOT_ON_PURCHASE_ORDER", "PURCHASE_ORDER_NOT_RECEIVABLE", "RECEIPT_ALREADY_BILLED", "SUPPLIER_INVOICE_EDIT_CONFLICT", "BILL_RECEIPT_CHANGE_TOO_LARGE", "PURCHASE_RECEIPTS_READ_TRUNCATED", "PURCHASE_ORDER_SUPPLIER_MISMATCH", "ADMIN_REQUIRED", "SUPPLIER_INVOICE_NOT_FOUND", "SUPPLIER_INVOICE_MATCH_NOT_EXCEPTION", "INVOICE_LINES_TOTAL_MISMATCH", "INVOICE_LINE_NOT_ON_PURCHASE_ORDER", "VALIDATION_FAILED"];
 export type SupplierInvoiceMatchErrorCode = (typeof SUPPLIER_INVOICE_MATCH_ERROR_CODES)[number];
 /** Every `SupplierInvoicePaymentStatus`, as a runtime value. */
 export declare const SUPPLIER_INVOICE_PAYMENT_STATUSES: readonly ["open", "partial", "paid"];

package/dist/supplier.js

@@ -25,6 +25,23 @@ export const DEFAULT_PURCHASE_MATCH_TOLERANCE = Object.freeze({ pct: 1 });
  *   store's, or a receipt is not under it.
  * - `PURCHASE_ORDER_NOT_RECEIVABLE` · 409 — the purchase order is `draft` or
  *   `cancelled`.
+ * - `RECEIPT_ALREADY_BILLED` · 409 — a receipt the bill names is already
+ *   covered by another bill (`PurchaseReceipt.billedBy`); `data.receiptIds`
+ *   lists them. Nothing is written.
+ * - `SUPPLIER_INVOICE_EDIT_CONFLICT` · 409 — an edit of a bill that stores or
+ *   writes `receiptIds` (an empty list included) lost to another edit of the
+ *   same bill that landed first and moved only the row version (when the
+ *   `fce` block, the PDF or the payments moved too, that guard's own code
+ *   answers); or a receipt the edit stops naming changed hands since the read;
+ *   or the save met another transaction on the bill or one of its receipts
+ *   in flight, and again on its one retry. Nothing is written; re-read the
+ *   bill and retry.
+ * - `BILL_RECEIPT_CHANGE_TOO_LARGE` · 400 — the receipts the save would mark
+ *   and unmark, plus the bill row, exceed one DynamoDB transaction (100
+ *   items). Nothing is written; save the receipts in smaller steps.
+ * - `PURCHASE_RECEIPTS_READ_TRUNCATED` · 503 — the purchase order's receipt
+ *   read was cut short, so the receipts to mark and the verdict cannot be
+ *   decided. Nothing is written.
  * - `PURCHASE_ORDER_SUPPLIER_MISMATCH` · 400 — the bill's supplier is not the
  *   purchase order's.
  * - `ADMIN_REQUIRED` · 403 — only ADMIN or MANAGER may override.
@@ -37,11 +54,15 @@ export const DEFAULT_PURCHASE_MATCH_TOLERANCE = Object.freeze({ pct: 1 });
  *   purchase-order line the bill's order does not have, one whose `productId`
  *   differs, one another bill line already names, or names one with no
  *   purchase order on the bill.
- * - `VALIDATION_FAILED` · 400
+ * - `VALIDATION_FAILED` · 400 — includes `receiptIds` naming one receipt twice.
  */
 export const SUPPLIER_INVOICE_MATCH_ERROR_CODES = [
     'RECEIPT_NOT_ON_PURCHASE_ORDER',
     'PURCHASE_ORDER_NOT_RECEIVABLE',
+    'RECEIPT_ALREADY_BILLED',
+    'SUPPLIER_INVOICE_EDIT_CONFLICT',
+    'BILL_RECEIPT_CHANGE_TOO_LARGE',
+    'PURCHASE_RECEIPTS_READ_TRUNCATED',
     'PURCHASE_ORDER_SUPPLIER_MISMATCH',
     'ADMIN_REQUIRED',
     'SUPPLIER_INVOICE_NOT_FOUND',

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.738",
+	"version": "1.10.740",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",