fix production issues

2026-08-12 16:48:41 -04:00
parent 53de25120a
commit 8fc88ffc14
117 changed files with 4717 additions and 1443 deletions
@@ -0,0 +1,37 @@
+# Commercial and data design updates (Phase 2)
+
+## Plan / entitlement catalog
+
+**Single source of truth:** `packages/types/src/planCatalog.ts`
+
+Exports (via `@rentaldrivego/types` / `api.ts` re-exports):
+
+- `PLAN_PRICES`, `PLAN_ENTITLEMENTS`, capabilities, public marketing map (`launch` → `STARTER`, etc.)
+- Helpers: `getVehicleLimit`, `getPublicMonthlyMajorUnits`, `planHasCapability`
+
+**Consumers:**
+
+- Homepage marketing prices → `apps/homepage/src/content/pricing-config.ts`  
+- API site/subscription fallbacks → `@rentaldrivego/types`  
+- Vehicle fleet limits → catalog first (no duplicate hardcoded fallback table)
+
+Contract tests: `packages/types/src/planCatalog.test.ts` (`npm run test:types`).
+
+## Billing & notifications source of truth
+
+See `docs/BILLING_NOTIFICATION_SOURCE_OF_TRUTH.md`:
+
+| Domain | Canonical | Legacy |
+|--------|-----------|--------|
+| Money | `BillingAccount` / `BillingInvoice` / intents | `SubscriptionInvoice` (compat reads only) |
+| Notifications | `NotificationEvent` → recipients → deliveries + **outbox** | Flat `Notification` |
+
+Dispatch design: outbox worker is the delivery executor; direct transactional email remains allowed for auth/security messages.
+
+## Privacy baseline
+
+`docs/PRIVACY_DATA_MAP.md` inventories data classes, storage, access, and open gaps (field encryption, DSAR automation, privileged-read audit). Ops metrics intentionally exclude PII payloads.
+
+## OpenAPI completeness
+
+Design rule: ops endpoints `/health`, `/ready`, `/metrics` must appear in OpenAPI. CI runs `npm run openapi:coverage` (`scripts/check-openapi-coverage.mjs`).