@hotmeshio/long-tail 0.22.1 → 0.22.2

package/build/api/scan-codes/verb-fill.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fillStep = fillStep;
+const scanCodeService = __importStar(require("../../services/scan-code"));
+const escalationService = __importStar(require("../../services/escalation"));
+const resolve_batch_1 = require("../escalations/resolve-batch");
+const escalation_1 = require("../../types/escalation");
+const types_1 = require("../../types");
+const context_1 = require("./context");
+const grant_1 = require("./grant");
+const locate_1 = require("./locate");
+const subject_1 = require("./subject");
+const STOCK_UNEXPECTED = 'Not one of the items expected here.';
+function readBatch(row) {
+    const meta = (row.metadata ?? {});
+    const pending = meta[escalation_1.ESCALATION_BATCH_KEYS.PENDING];
+    const keys = meta[escalation_1.ESCALATION_BATCH_KEYS.KEYS];
+    if (!Array.isArray(pending))
+        return null;
+    return { pending: pending.map(String), keys: Array.isArray(keys) ? keys.map(String) : pending.map(String) };
+}
+/** The code a batch key names, without its ordinal suffix. */
+function codeOf(key, separator) {
+    const at = key.lastIndexOf(separator);
+    return at > 0 && /^[0-9]+$/.test(key.slice(at + 1)) ? key.slice(0, at) : key;
+}
+function keysFor(keys, target, separator) {
+    return keys.filter((k) => codeOf(k, separator) === target);
+}
+function progress(batch, filledNow) {
+    const remaining = Math.max(0, batch.pending.length - filledNow);
+    return { filled: batch.keys.length - remaining, total: batch.keys.length, remaining };
+}
+async function fillStep(step, ctx) {
+    const options = step.params.fill;
+    const separator = options.separator ?? types_1.SCAN_FILL_SEPARATOR_DEFAULT;
+    // 1. The batch row: the held subject, or the row the scan names
+    const row = options.into === 'subject'
+        ? ctx.subject.row
+        : (await (0, locate_1.locateForStep)(step, ctx, 1))?.escalations[0];
+    if (!row)
+        return null;
+    if (options.into === 'subject' && step.subject?.claimedByOther !== 'allow') {
+        const other = await (0, subject_1.claimedByOther)(row, ctx.auth.userId);
+        if (other)
+            return (0, context_1.refused)(`Claimed by **${other.displayName}**.`);
+    }
+    const batch = readBatch(row);
+    if (!batch)
+        return (0, context_1.conflict)('the held row is not a batch');
+    // 2. Which open slot this scan fills, or why none
+    const tpl = {
+        ...(0, context_1.templateContext)(ctx),
+        fill: {
+            pending: [...new Set(batch.pending.map((k) => codeOf(k, separator)))],
+            total: batch.keys.length,
+            filled: batch.keys.length - batch.pending.length,
+        },
+    };
+    const candidates = keysFor(batch.pending, ctx.parsed.target, separator);
+    if (candidates.length === 0) {
+        const declared = keysFor(batch.keys, ctx.parsed.target, separator);
+        const markdown = declared.length
+            ? `All ${declared.length} of these are already checked off.`
+            : scanCodeService.renderScanCopy(step.refuse?.markdown ?? STOCK_UNEXPECTED, tpl);
+        return (0, context_1.refused)(markdown, {
+            refusal: { markdown, expected: tpl.fill.pending },
+            progress: progress(batch, 0),
+        });
+    }
+    // 3. Spend the badge, then fill; a slot taken since the read moves to the next
+    let payload;
+    try {
+        payload = scanCodeService.interpolateScanTemplate(options.payload ?? { scannedCode: '{scan.code}' }, tpl);
+    }
+    catch (err) {
+        if (err instanceof scanCodeService.ScanTemplateError)
+            return null;
+        throw err;
+    }
+    const notPrimed = (await (0, grant_1.identityGate)(step, ctx)) ?? (await (0, grant_1.spendGrant)(ctx));
+    if (notPrimed)
+        return notPrimed;
+    for (const itemKey of candidates) {
+        const result = await (0, resolve_batch_1.resolveBatchItem)({
+            id: row.id, itemKey, resolverPayload: payload, metadata: (0, context_1.provenance)(ctx),
+        }, ctx.auth);
+        if (result.status === 200) {
+            const data = result.data;
+            const done = data.outcome === 'completed';
+            const filled = progress(batch, batch.pending.length - (done ? 0 : (data.remaining ?? 0)));
+            return (0, context_1.withDone)({
+                status: 200,
+                data: {
+                    outcome: types_1.SCAN_OUTCOMES.EXECUTED,
+                    verb: step.verb,
+                    escalation: { id: row.id, ...data },
+                    progress: filled,
+                    ...(done ? { clearSubject: true } : {}),
+                },
+            }, step, { ...tpl, fill: { ...tpl.fill, ...filled } });
+        }
+        const outcome = result.data?.outcome;
+        if (outcome === 'duplicate-item')
+            continue;
+        if (result.status === 403)
+            return (0, context_1.forbidden)(result.error);
+        if (result.status === 404)
+            return null;
+        if (outcome?.startsWith('already-'))
+            return (0, context_1.refused)('This one is already complete.', { clearSubject: true });
+        return (0, context_1.refused)(result.error ?? STOCK_UNEXPECTED);
+    }
+    const fresh = await escalationService.getEscalation(row.id);
+    const after = fresh ? readBatch(fresh) : null;
+    return (0, context_1.refused)(`All ${keysFor(batch.keys, ctx.parsed.target, separator).length} of these are already checked off.`, {
+        ...(after ? { progress: progress(after, 0) } : {}),
+    });
+}

package/build/api/scan-codes/verbs-subject.d.ts

@@ -0,0 +1,14 @@
+import { type LTEscalationRecord, type ScanExecuteResponse, type ScanStep } from '../../types';
+import type { LTApiResult } from '../../types/sdk';
+import { type StepContext } from './context';
+type ScanResult = LTApiResult<ScanExecuteResponse>;
+/**
+ * The pre-write guard. Returns the refusal when the pairing is wrong, null
+ * when it holds (or the step declares no match).
+ */
+export declare function matchGuard(step: ScanStep, ctx: StepContext, container?: LTEscalationRecord): ScanResult | null;
+/** The subject joins the scanned container; the subject's row is the reciprocal. */
+export declare function accumulateFromSubject(step: ScanStep, ctx: StepContext): Promise<ScanResult | null>;
+/** The subject's own row collects the scanned code. */
+export declare function accumulateIntoSubject(step: ScanStep, ctx: StepContext): Promise<ScanResult | null>;
+export {};

package/build/api/scan-codes/verbs-subject.js

@@ -0,0 +1,270 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchGuard = matchGuard;
+exports.accumulateFromSubject = accumulateFromSubject;
+exports.accumulateIntoSubject = accumulateIntoSubject;
+const scanCodeService = __importStar(require("../../services/scan-code"));
+const escalationService = __importStar(require("../../services/escalation"));
+const accumulate_1 = require("../escalations/accumulate");
+const helpers_1 = require("../escalations/helpers");
+const metadata_1 = require("../escalations/metadata");
+const escalation_1 = require("../../types/escalation");
+const types_1 = require("../../types");
+const context_1 = require("./context");
+const grant_1 = require("./grant");
+const subject_1 = require("./subject");
+// ── Acting on the held subject ──────────────────────────────────────────────
+//
+// The station holds an item; this scan names where it goes. The step checks
+// the pairing first (match), refusing with nothing written when it is wrong,
+// then writes by id in one atomic statement: the subject joins the scanned
+// container with its own row as the reciprocal (from: 'subject'), or the
+// subject's row collects the scanned code (into: 'subject').
+const STOCK_REFUSAL = 'That is not where this one goes.';
+const STOCK_CONFLICT = 'That container just closed. Scan it again, or the next one.';
+const STOCK_PLACED = 'This one is already placed.';
+/** The step's template bags with the subject (and the container, once located). */
+function bags(ctx, container) {
+    return { ...(0, context_1.templateContext)(ctx), ...(container ? { container: container.metadata ?? {} } : {}) };
+}
+/** Refuse the act when someone else holds a live claim on the subject. */
+async function claimGuard(step, ctx, subject) {
+    if (step.subject?.claimedByOther === 'allow')
+        return null;
+    const other = await (0, subject_1.claimedByOther)(subject.row, ctx.auth.userId);
+    return other ? (0, context_1.refused)(`Claimed by **${other.displayName}**.`) : null;
+}
+/** The container the scan names: a pending accumulator under the actor's read scope. */
+async function locateContainer(step, ctx) {
+    const selector = step.params?.accumulate?.container;
+    const scope = await (0, helpers_1.getEscalationReadScope)(ctx.auth.userId);
+    const roles = (0, metadata_1.restrictScopeRoles)(scope.allRoles, scope.global, selector?.roles ?? step.query?.roles);
+    if (roles !== null && roles.length === 0)
+        return null;
+    const found = await escalationService.searchByFacets({
+        roles: roles ?? undefined,
+        types: selector?.types,
+        subtypes: selector?.subtypes,
+        facets: { ...selector?.facets, [ctx.scheme.target_facet]: ctx.parsed.target },
+        status: 'pending',
+        exists: [escalation_1.ESCALATION_ACCUMULATE_KEYS.COUNT],
+        limit: 2,
+    });
+    return found.escalations.filter((row) => row.id !== ctx.subject?.row.id);
+}
+const WHOLE_BAG_TOKEN = /^\{(subject|container)\.([a-zA-Z0-9_]+)\}$/;
+/**
+ * One match.target template as the values it allows. A template that is a
+ * single bag token naming a list facet (`{subject.offeredContainers}`) allows every
+ * entry; anything else renders to one value. A token with nothing to read
+ * allows nothing.
+ */
+function expandTarget(template, tpl) {
+    const whole = template.match(WHOLE_BAG_TOKEN);
+    if (whole) {
+        const value = tpl[whole[1]]?.[whole[2]];
+        if (Array.isArray(value))
+            return value.filter((v) => v !== null && v !== '').map(String);
+    }
+    try {
+        return [scanCodeService.interpolateScanTemplate(template, tpl)];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The pre-write guard. Returns the refusal when the pairing is wrong, null
+ * when it holds (or the step declares no match).
+ */
+function matchGuard(step, ctx, container) {
+    const match = step.match;
+    if (!match)
+        return null;
+    const tpl = bags(ctx, container);
+    const expected = (match.target ?? []).flatMap((t) => expandTarget(t, tpl));
+    const targetOk = match.target === undefined || expected.includes(ctx.parsed.target);
+    const subjectMeta = (ctx.subject?.row.metadata ?? {});
+    const containerMeta = (container?.metadata ?? {});
+    // With no container located there is nothing to compare; the step falls through.
+    const facetsOk = match.facets === undefined || !container || (match.facets.every((f) => subjectMeta[f] !== undefined && subjectMeta[f] !== null && String(subjectMeta[f]) === String(containerMeta[f])));
+    if (targetOk && facetsOk)
+        return null;
+    const markdown = scanCodeService.renderScanCopy(step.refuse?.markdown ?? STOCK_REFUSAL, tpl);
+    return (0, context_1.refused)(markdown, { refusal: { markdown, ...(expected.length ? { expected } : {}) } });
+}
+/** Map a failed add onto what the bench says. 404 falls through. */
+function failedAdd(step, ctx, result, container) {
+    const outcome = result.data?.outcome;
+    if (result.status === 404)
+        return null;
+    if (result.status === 403)
+        return (0, context_1.forbidden)(result.error);
+    if (outcome === 'reciprocal-terminal' || outcome === 'reciprocal-full' || outcome === 'reciprocal-duplicate') {
+        return (0, context_1.refused)(STOCK_PLACED, { clearSubject: true });
+    }
+    if (outcome === 'claimed-by-other' || outcome === 'claim-expired')
+        return (0, context_1.conflict)(result.error);
+    if (result.status === 409) {
+        const markdown = scanCodeService.renderScanCopy(step.refuse?.conflict ?? STOCK_CONFLICT, bags(ctx, container));
+        // A lost race for a shared container: the subject's offer may have moved, so drop it.
+        return (0, context_1.refused)(markdown, { clearSubject: !!step.refuse?.conflict });
+    }
+    return (0, context_1.refused)(result.error ?? STOCK_REFUSAL);
+}
+function rendered(step, ctx, itemKeyDefault) {
+    const tpl = (0, context_1.templateContext)(ctx);
+    try {
+        return {
+            itemKey: scanCodeService.interpolateScanTemplate(step.params?.itemKey ?? itemKeyDefault ?? '', tpl),
+            payload: step.params?.resolverPayload
+                ? scanCodeService.interpolateScanTemplate(step.params.resolverPayload, tpl)
+                : undefined,
+            metadata: {
+                ...(step.params?.metadata ? scanCodeService.interpolateScanTemplate(step.params.metadata, tpl) : {}),
+                ...(0, context_1.provenance)(ctx),
+            },
+        };
+    }
+    catch (err) {
+        if (err instanceof scanCodeService.ScanTemplateError)
+            return null;
+        throw err;
+    }
+}
+/** The subject joins the scanned container; the subject's row is the reciprocal. */
+async function accumulateFromSubject(step, ctx) {
+    const subject = ctx.subject;
+    const claimed = await claimGuard(step, ctx, subject);
+    if (claimed)
+        return claimed;
+    // 1. Locate the container the scan names
+    const containers = await locateContainer(step, ctx);
+    if (containers && containers.length > 1) {
+        return (0, context_1.conflict)(`more than one open container carries ${ctx.scheme.target_facet} = ${ctx.parsed.target}`);
+    }
+    const container = containers?.[0];
+    // 2. Check the pairing before anything is written
+    const mismatch = matchGuard(step, ctx, container);
+    if (mismatch)
+        return mismatch;
+    if (!container) {
+        if (!step.refuse?.missing)
+            return null;
+        return (0, context_1.refused)(scanCodeService.renderScanCopy(step.refuse.missing, bags(ctx)));
+    }
+    // 3. Spend the badge, then write both rows in one statement
+    const values = rendered(step, ctx);
+    if (!values)
+        return null;
+    const notPrimed = (await (0, grant_1.identityGate)(step, ctx)) ?? (await (0, grant_1.spendGrant)(ctx));
+    if (notPrimed)
+        return notPrimed;
+    const result = await (0, accumulate_1.accumulateItem)({
+        id: container.id,
+        itemKey: values.itemKey,
+        payload: values.payload,
+        metadata: values.metadata,
+        reciprocal: { id: subject.row.id },
+    }, ctx.auth);
+    // 4. Report
+    if (result.status !== 200) {
+        if (result.data?.outcome === 'duplicate-item') {
+            return already(step, container);
+        }
+        return failedAdd(step, ctx, result, container);
+    }
+    return (0, context_1.withDone)({
+        status: 200,
+        data: {
+            outcome: types_1.SCAN_OUTCOMES.EXECUTED,
+            verb: step.verb,
+            escalation: { id: container.id, ...result.data },
+            clearSubject: true,
+        },
+    }, step, bags(ctx, container));
+}
+/** The subject's own row collects the scanned code. */
+async function accumulateIntoSubject(step, ctx) {
+    const subject = ctx.subject;
+    const claimed = await claimGuard(step, ctx, subject);
+    if (claimed)
+        return claimed;
+    const mismatch = matchGuard(step, ctx);
+    if (mismatch)
+        return mismatch;
+    const values = rendered(step, ctx, '{scan.target}');
+    if (!values)
+        return null;
+    const notPrimed = (await (0, grant_1.identityGate)(step, ctx)) ?? (await (0, grant_1.spendGrant)(ctx));
+    if (notPrimed)
+        return notPrimed;
+    const result = await (0, accumulate_1.accumulateItem)({
+        id: subject.row.id,
+        itemKey: values.itemKey,
+        payload: values.payload,
+        metadata: values.metadata,
+    }, ctx.auth);
+    if (result.status !== 200) {
+        if (result.data?.outcome === 'duplicate-item') {
+            return already(step, subject.row);
+        }
+        return failedAdd(step, ctx, result);
+    }
+    const data = result.data;
+    return (0, context_1.withDone)({
+        status: 200,
+        data: {
+            outcome: types_1.SCAN_OUTCOMES.EXECUTED,
+            verb: step.verb,
+            escalation: { id: subject.row.id, ...result.data },
+            clearSubject: data.outcome === 'completed',
+        },
+    }, step, bags(ctx));
+}
+/** The item is already where the scan says: harmless, nothing written. */
+function already(step, row) {
+    return {
+        status: 200,
+        data: {
+            outcome: types_1.SCAN_OUTCOMES.EXECUTED,
+            verb: step.verb,
+            escalation: { id: row.id },
+            already: true,
+            clearSubject: true,
+        },
+    };
+}

package/build/api/scan-codes/verbs.d.ts

@@ -18,24 +18,4 @@ export declare function releaseStep(step: ScanStep, ctx: StepContext): Promise<L
  */
 export declare function dispatchChoiceVerb(step: ScanStep, ctx: StepContext, row: Record<string, any>): Promise<LTApiResult<ScanExecuteResponse>>;
 export declare function cancelStep(step: ScanStep, ctx: StepContext): Promise<LTApiResult<ScanExecuteResponse> | null>;
-/**
- * Adds the scanned item to an accumulator. Two modes, one atomic write:
- *
- * - Item-locate (`params.accumulate.containerFacet`): the scan locates the
- *   item's own pending row through the scheme facet, reads the container
- *   facet value it carries, and adds the target to the container that shares
- *   it, writing the item row as the reciprocal in the same statement. An
- *   item with no row, or no container facet, falls through. An item whose
- *   container has closed and whose successor has not parked yet answers
- *   `no_open_container` with the item row, so the station can say "scan
- *   again" instead of showing the bag with no hint.
- * - Container-locate (no `containerFacet`): the scan locates the container
- *   by the scheme facet and adds `params.itemKey` (template).
- *
- * Templates may read `{claim.<facet>}` (the actor's live claim) and, in item
- * mode, `{item.<facet>}` (the located row); an unresolvable token falls
- * through. The write is the SDK's guarded statement; the locate only picks
- * ids. A container already holding the item answers conflict, never a
- * second add.
- */
-export declare function accumulateStep(step: ScanStep, ctx: StepContext): Promise<LTApiResult<ScanExecuteResponse> | null>;
+export { accumulateStep } from './verb-accumulate';

package/build/api/scan-codes/verbs.js

@@ -33,46 +33,34 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.accumulateStep = void 0;
 exports.claimStep = claimStep;
 exports.resolveStep = resolveStep;
 exports.escalateStep = escalateStep;
 exports.releaseStep = releaseStep;
 exports.dispatchChoiceVerb = dispatchChoiceVerb;
 exports.cancelStep = cancelStep;
-exports.accumulateStep = accumulateStep;
 const scanCodeService = __importStar(require("../../services/scan-code"));
 const escalationService = __importStar(require("../../services/escalation"));
 const metadata_1 = require("../escalations/metadata");
-const accumulate_1 = require("../escalations/accumulate");
 const create_1 = require("../escalations/create");
 const claim_1 = require("../escalations/claim");
 const helpers_1 = require("../escalations/helpers");
 const types_1 = require("../../types");
 const context_1 = require("./context");
-const locate_1 = require("./locate");
+const grant_1 = require("./grant");
+const hold_1 = require("./hold");
 // ── Mutating verbs — each a single atomic operation under the ACTOR's RBAC ──
 // ctx.auth is the effective actor: the badged person when a grant rode the
 // request, otherwise the authenticated principal. Attribution and write
 // scoping both derive from it, live, inside the escalation APIs.
-/**
- * Interpolates a step's params, or falls through when a `{claim.…}` or
- * `{item.…}` token has nothing to read: a literal token never reaches a row.
- */
-async function templated(step, ctx, render, item) {
-    const tpl = await (0, context_1.stepTemplate)(step, ctx, item);
-    try {
-        return render(tpl);
-    }
-    catch (err) {
-        if (err instanceof scanCodeService.ScanTemplateError)
-            return null;
-        throw err;
-    }
-}
 async function claimStep(step, ctx) {
-    const metadata = await templated(step, ctx, (tpl) => (0, context_1.interpolatedMetadata)(step, ctx, tpl));
+    const metadata = await (0, context_1.templated)(step, ctx, (tpl) => (0, context_1.interpolatedMetadata)(step, ctx, tpl));
     if (metadata === null)
         return null;
+    const notPrimed = await (0, grant_1.spendGrant)(ctx);
+    if (notPrimed)
+        return notPrimed;
     const result = await (0, metadata_1.claimByMetadata)({
         key: ctx.scheme.target_facet,
         value: ctx.parsed.target,
@@ -94,12 +82,15 @@ async function claimStep(step, ctx) {
  * choice passes the row it showed, so the resolve lands on that row or misses.
  */
 async function resolveStep(step, ctx, presentedId) {
-    const rendered = await templated(step, ctx, (tpl) => ({
+    const rendered = await (0, context_1.templated)(step, ctx, (tpl) => ({
         resolverPayload: scanCodeService.interpolateScanTemplate(step.params?.resolverPayload ?? {}, tpl),
         metadata: (0, context_1.interpolatedMetadata)(step, ctx, tpl),
     }));
     if (rendered === null)
         return null;
+    const notPrimed = await (0, grant_1.spendGrant)(ctx);
+    if (notPrimed)
+        return notPrimed;
     const result = await (0, metadata_1.resolveByMetadata)({
         key: ctx.scheme.target_facet,
         value: ctx.parsed.target,
@@ -116,6 +107,8 @@ async function resolveStep(step, ctx, presentedId) {
         return (0, context_1.forbidden)(result.error);
     if (result.status === 409)
         return (0, context_1.conflict)(result.error);
+    if (result.status === 400 || result.status === 422)
+        return (0, context_1.refused)(result.error ?? 'the payload was not accepted');
     if (result.status !== 200)
         return result;
     const escalation = result.data.escalation
@@ -140,6 +133,9 @@ async function escalateStep(step, ctx) {
         if (cancelled.data?.outcome !== types_1.SCAN_OUTCOMES.EXECUTED)
             return cancelled;
     }
+    const notPrimed = await (0, grant_1.spendGrant)(ctx);
+    if (notPrimed)
+        return notPrimed;
     const created = await (0, create_1.createEscalation)({
         type: step.params?.escalationType ?? 'scan',
         role: step.params.targetRole,
@@ -173,6 +169,9 @@ async function releaseStep(step, ctx) {
     });
     if (escalations.length === 0)
         return null;
+    const notPrimed = await (0, grant_1.spendGrant)(ctx);
+    if (notPrimed)
+        return notPrimed;
     const result = await (0, claim_1.releaseEscalation)({ id: escalations[0].id }, ctx.auth);
     if (result.status === 403)
         return (0, context_1.forbidden)(result.error);
@@ -192,6 +191,8 @@ async function dispatchChoiceVerb(step, ctx, row) {
     switch (step.verb) {
         case types_1.SCAN_VERBS.SHOW_DETAIL:
             return (0, context_1.executed)(row, step); // already located under the actor's scope
+        case types_1.SCAN_VERBS.HOLD:
+            return (await (0, hold_1.holdStep)(step, ctx, row));
         case types_1.SCAN_VERBS.CLAIM:
         case types_1.SCAN_VERBS.CLAIM_SHOW_DETAIL:
             return (await claimStep(step, ctx)) ?? (await missReason(step, ctx, 'the item is no longer claimable'));
@@ -220,6 +221,9 @@ async function missReason(step, ctx, raceMessage) {
 async function cancelStep(step, ctx) {
     // Claim-as-lock: the atomic claim pins the row to this caller (or extends
     // their claim), serializing concurrent double-scans before the cancel.
+    const notPrimed = await (0, grant_1.spendGrant)(ctx);
+    if (notPrimed)
+        return notPrimed;
     const claimed = await (0, metadata_1.claimByMetadata)({
         key: ctx.scheme.target_facet,
         value: ctx.parsed.target,
@@ -237,98 +241,5 @@ async function cancelStep(step, ctx) {
         return (0, context_1.conflict)('Escalation is not cancellable (already terminal)');
     return (0, context_1.executed)(cancelled, step);
 }
-/**
- * Adds the scanned item to an accumulator. Two modes, one atomic write:
- *
- * - Item-locate (`params.accumulate.containerFacet`): the scan locates the
- *   item's own pending row through the scheme facet, reads the container
- *   facet value it carries, and adds the target to the container that shares
- *   it, writing the item row as the reciprocal in the same statement. An
- *   item with no row, or no container facet, falls through. An item whose
- *   container has closed and whose successor has not parked yet answers
- *   `no_open_container` with the item row, so the station can say "scan
- *   again" instead of showing the bag with no hint.
- * - Container-locate (no `containerFacet`): the scan locates the container
- *   by the scheme facet and adds `params.itemKey` (template).
- *
- * Templates may read `{claim.<facet>}` (the actor's live claim) and, in item
- * mode, `{item.<facet>}` (the located row); an unresolvable token falls
- * through. The write is the SDK's guarded statement; the locate only picks
- * ids. A container already holding the item answers conflict, never a
- * second add.
- */
-async function accumulateStep(step, ctx) {
-    const options = step.params?.accumulate;
-    let item;
-    if (options?.containerFacet) {
-        const located = await (0, locate_1.locateForStep)(step, ctx, 1);
-        item = located?.escalations[0];
-        if (!item)
-            return null;
-    }
-    const rendered = await templated(step, ctx, (tpl) => ({
-        payload: step.params?.resolverPayload
-            ? scanCodeService.interpolateScanTemplate(step.params.resolverPayload, tpl)
-            : undefined,
-        metadata: { ...(0, context_1.interpolatedMetadata)(step, ctx, tpl), ...(0, context_1.provenance)(ctx) },
-        itemKey: options?.containerFacet
-            ? ctx.parsed.target
-            : scanCodeService.interpolateScanTemplate(step.params.itemKey, tpl),
-    }), item);
-    if (rendered === null)
-        return null;
-    let request;
-    let container;
-    if (options?.containerFacet && item) {
-        const containerValue = item.metadata?.[options.containerFacet];
-        if (containerValue === undefined || containerValue === null || containerValue === '')
-            return null;
-        container = { facet: options.containerFacet, value: String(containerValue) };
-        request = {
-            key: container.facet,
-            value: container.value,
-            itemKey: rendered.itemKey,
-            payload: rendered.payload,
-            metadata: rendered.metadata,
-            restrictRoles: options.container?.roles ?? options.containerRoles,
-            container: options.container
-                ? { types: options.container.types, subtypes: options.container.subtypes, facets: options.container.facets }
-                : undefined,
-            ...(options.reciprocal === false ? {} : { reciprocal: { id: item.id } }),
-        };
-    }
-    else {
-        request = {
-            key: ctx.scheme.target_facet,
-            value: ctx.parsed.target,
-            itemKey: rendered.itemKey,
-            payload: rendered.payload,
-            metadata: rendered.metadata,
-            restrictRoles: step.query?.roles,
-        };
-    }
-    const result = await (0, accumulate_1.accumulateItemByMetadata)(request, ctx.auth);
-    if (result.status === 404) {
-        if (!container || !item)
-            return null;
-        return {
-            status: 200,
-            data: {
-                outcome: types_1.SCAN_OUTCOMES.NO_OPEN_CONTAINER,
-                verb: step.verb,
-                escalation: item,
-                container,
-                fallback: ctx.rule.fallback,
-                error: `No open container carries ${container.facet} = ${container.value}`,
-            },
-        };
-    }
-    if (result.status === 403)
-        return (0, context_1.forbidden)(result.error);
-    if (result.status === 409)
-        return (0, context_1.conflict)(result.error);
-    if (result.status !== 200)
-        return result;
-    const escalation = result.data.escalationId ? { id: result.data.escalationId, ...result.data } : undefined;
-    return (0, context_1.executed)(escalation, step);
-}
+var verb_accumulate_1 = require("./verb-accumulate");
+Object.defineProperty(exports, "accumulateStep", { enumerable: true, get: function () { return verb_accumulate_1.accumulateStep; } });