sinfactura-types 1.10.262 → 1.10.263

package/dist/auth.d.ts

@@ -280,8 +280,16 @@ declare global {
      * - `wrong_totp` — the step-up code was wrong.
      * - `totp_replay` — an already-used code was presented again and rejected.
      * - `totp_locked` — brute-force lockout active on the TOTP leg.
+     * - `enrollment_required` — the credentials were correct and the store's
+     *   mandatory-2FA grace window has closed on a user who never enrolled. Like
+     *   `requires_2fa` this is NOT a completed login, but it is the opposite
+     *   diagnosis: `requires_2fa` means somebody stalled at a factor they HAVE,
+     *   this means they have none to present. ⚠️ Emitted on OPERATOR logins only
+     *   — the mandate is scoped to operator surfaces, and there is no customer
+     *   enrolment endpoint for a web mandate to be satisfiable against, so a
+     *   `kind: 'CUSTOMER'` row can never carry it.
      */
-    type LoginOutcome = 'success' | 'wrong_password' | 'disabled' | 'blocked' | 'requires_2fa' | 'wrong_totp' | 'totp_replay' | 'totp_locked';
+    type LoginOutcome = 'success' | 'wrong_password' | 'disabled' | 'blocked' | 'requires_2fa' | 'wrong_totp' | 'totp_replay' | 'totp_locked' | 'enrollment_required';
     /**
      * One row of `GET /auth?mode=login-history[&days=N]` — a storefront
      * customer's own login audit trail. The stored row reaches the wire

package/dist/store.d.ts

@@ -499,6 +499,55 @@ declare global {
                  */
                 nextSequence?: number;
             };
+            /**
+             * Per-store mandatory-2FA obligation for OPERATOR logins.
+             *
+             * ⚠️ **It lives on the store row and NOT in the plan entitlement map,
+             * and that placement is the whole design.** The `mandatory2fa` FeatureKey
+             * gates which TIERS may impose the obligation; this leaf records whether a
+             * store actually has. Every other FeatureKey GRANTS a capability, so losing
+             * it withdraws something. This one OBLIGES — so resolving it from the
+             * entitlement map would mean `graceSweep` silently UN-mandating 2FA when it
+             * writes `planTier: 'basico'` on a delinquent store at day 14. A security
+             * posture does not lapse because an invoice did.
+             *
+             * Verified rather than assumed: `graceSweep` writes only `status`,
+             * `planTier`, `canceledFromTier`, `canceledAt` and `updatedAt`, and writes
+             * them to the SUBSCRIPTION row — it touches neither `totp` nor store
+             * config. So an obligation kept here survives the downgrade **by
+             * construction**, with no special case for anyone to remember and nothing
+             * to re-check when the sweep changes.
+             *
+             * Forward-only: absent means no obligation, and nothing backfills it.
+             */
+            mandatory2fa?: {
+                /** Whether operator logins for this store require an enrolled second factor. */
+                enabled: boolean;
+                /**
+                 * ms-epoch the obligation was last turned ON. The grace window runs from
+                 * here.
+                 *
+                 * ⚠️ BE-stamped, never client-writable. A client that could set this
+                 * could set it far enough in the past to close the window on every
+                 * operator at once — which is a lockout, not a configuration change.
+                 */
+                since: number;
+                /**
+                 * Days after `since` during which an unenrolled operator still receives a
+                 * full session — flagged `mustEnroll2fa` — rather than being refused.
+                 *
+                 * ⚠️ **The window is what makes the mandate satisfiable at all, not a
+                 * courtesy.** `/auth/2fa/enroll` and `/auth/2fa/verify-enrollment` both sit
+                 * behind the `userToken` authorizer, and the shipped step-up challenge is
+                 * stateless — it mints no partial token, the client just re-submits the
+                 * credential. So refusing to mint a token leaves an unenrolled operator
+                 * with no way to reach the endpoint that would let them comply: the
+                 * mandate would brick its own remedy. Enrolment happens inside the window;
+                 * once it closes the refusal is safe, because anyone who missed it is
+                 * recovered by an ADMIN toggling `enabled` back off.
+                 */
+                graceDays: number;
+            };
         };
         ecommerce?: Ecommerce;
         photoURL: string;

package/dist/subscription.d.ts

@@ -83,7 +83,7 @@ declare global {
      * quietly missing a feature), but it means the caller must be updated in the
      * same change. Adding a key is never only additive downstream.
      */
-    type FeatureKey = 'maxOrdersMonth' | 'maxInvoicesMonth' | 'maxProducts' | 'maxUsers' | 'maxCustomers' | 'maxStores' | 'priceListsMax' | 'afipInvoicing' | 'suppliers' | 'domesticPayments' | 'stripePayments' | 'cashManagement' | 'multiStore' | 'importExport' | 'advancedReports' | 'customBranding' | 'prioritySupport' | 'whatsappCommerce' | 'aiFeatures' | 'mobileApp' | 'customDomain' | 'advancedPricing' | 'marketplaceChannels' | 'storefront' | 'loyalty' | 'marketing';
+    type FeatureKey = 'maxOrdersMonth' | 'maxInvoicesMonth' | 'maxProducts' | 'maxUsers' | 'maxCustomers' | 'maxStores' | 'priceListsMax' | 'afipInvoicing' | 'suppliers' | 'domesticPayments' | 'stripePayments' | 'cashManagement' | 'multiStore' | 'importExport' | 'advancedReports' | 'customBranding' | 'prioritySupport' | 'whatsappCommerce' | 'aiFeatures' | 'mobileApp' | 'customDomain' | 'advancedPricing' | 'marketplaceChannels' | 'storefront' | 'loyalty' | 'marketing' | 'mandatory2fa';
     /** Resolved entitlements for a specific tenant (matrix + overrides applied). */
     type ResolvedEntitlements = Record<FeatureKey, Entitlement>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sinfactura-types",
-	"version": "1.10.262",
+	"version": "1.10.263",
 	"description": "Shared wire and entity contracts for the SINFACTURA platform.",
 	"type": "module",
 	"main": "dist/index.js",