@openlup/platform 0.22.0 → 0.23.0

package/dist/fulfillment/adapterConformance.js

@@ -88,7 +88,7 @@ export async function runFulfillmentAdapterConformance(subjects) {
             if (!caps.operations.verifyObservation.supported)
                 requireFact(result.kind === "refused" && result.refusal.reason === "unsupported", "unsupported observation");
             if (result.kind === "verified") {
-                requireSame(result.observation, projectObservation(result.observation), "observation allowlist");
+                requireSame(result.observation, projectObservation(result.observation, subject.approveTrackingUrl, subject.observationCodecs), "observation allowlist");
                 const observation = result.observation;
                 const identity = stable({ provider: observation.fact.providerKind, reference: observation.fact.fulfillmentReference,
                     kind: observation.eventKind, outcome: observation.fact.canonicalStatus, occurredAt: observation.fact.occurredAt });

package/dist/fulfillment/bindings.js

@@ -13,7 +13,7 @@ export function createFulfillmentServices(options) {
             return { ready: false, refusal: selected.refusal };
         if (!selected.descriptor.operations.dispatch.supported)
             return { ready: false, refusal: { reason: 'unsupported', phase: 'selection', retryable: false } };
-        if (!store || !provider)
+        if (!store || (config.mode !== "shadow" && !provider))
             return { ready: false, refusal: FULFILLMENT_NATIVE_UNSUPPORTED };
         return observe();
     };

package/dist/fulfillment/contracts/conformance.d.ts

@@ -1,7 +1,7 @@
 import type { FulfillmentCapabilityDescriptor } from "./capabilities.js";
 import type { FulfillmentDispatchPort, FulfillmentDispatchRequest } from "./dispatch.js";
 import type { FulfillmentLabelPort } from "./label.js";
-import type { FulfillmentObservationPort } from "./observation.js";
+import type { FulfillmentObservationPort, FulfillmentObservationCodecs } from "./observation.js";
 import type { FulfillmentReadbackPort } from "./readback.js";
 import type { FulfillmentStockSyncProvider, FulfillmentProductSyncProvider } from "./sync.js";
 import type { FulfillmentStorePort } from "./store.js";
@@ -25,6 +25,8 @@ type SyncFixture<Port> = {
 }[keyof Port];
 /** Offline adapter-owned inputs and exact expected outputs; never real customer data. */
 export interface FulfillmentAdapterConformanceSubject {
+    approveTrackingUrl?(url: string): boolean;
+    observationCodecs?: FulfillmentObservationCodecs;
     subjectId: string;
     adapter: {
         capabilities: FulfillmentCapabilityDescriptor;

package/dist/fulfillment/contracts/dispatch.d.ts

@@ -22,7 +22,7 @@ export interface FulfillmentRefusal {
     phase: "selection" | "prepare" | "claim" | "begin" | "dispatch" | "acknowledge" | "verify" | "normalize" | "apply" | "readback" | "sync";
     retryable: boolean;
 }
-/** Frozen domain input, never copied into command evidence. Credentials stay in adapter closures. */
+/** Frozen domain input. Contact PII stays transient; only allowlisted mapped items enter evidence. Credentials stay in adapter closures. */
 export interface FulfillmentDispatchRequest {
     requestKey: string;
     fulfillmentRef: string;
@@ -52,23 +52,61 @@ export interface FulfillmentDispatchRequest {
         quantity: number;
         productRef: string | null;
         packRef: string | null;
+        lotRef?: string | null;
+        expirationDate?: string | null;
     }[];
     selection: FulfillmentSelection;
 }
 /** Allowlisted durable evidence; fingerprint commits to actual adapter command bytes. */
 export interface DispatchEvidence {
+    redactedFieldCount?: number;
     commandFingerprint: string;
     contactRevision: FulfillmentDispatchRequest["contactRevision"];
     providerRef: string;
     carrierRef: string | null;
     serviceRef: string | null;
+    transcript?: {
+        itemCount: number;
+        items: readonly {
+            skuRef: string;
+            quantity: number;
+            lotRef: string | null;
+            expirationDate: string | null;
+        }[];
+        deliveryKind: DeliveryKind;
+        pickupPointRef: string | null;
+        /** Count of populated reference/date fields redacted by the durable projection. */
+        redactedFieldCount?: number;
+    };
+    mapping?: {
+        source: "dispatch_worker";
+        mode: "shadow" | "stage" | "live";
+        shadowMode: boolean;
+    };
+}
+export interface FulfillmentOperationError {
+    redactedFieldCount?: number;
+    code: string;
+    status: number | null;
+    retryable: boolean;
+    mayHaveSucceeded: boolean;
+    /** Machine cause only; never an arbitrary exception message. */
+    cause?: string;
 }
-export type FulfillmentDispatchResult = {
+export type FulfillmentDispatchResult = ({
+    error?: FulfillmentOperationError;
+    redactedFieldCount?: number;
+} & ({
     kind: "accepted";
     externalRef: string;
     evidence: DispatchEvidence;
     providerAttemptKey: string;
     labelKey: string;
+    recovery?: {
+        source: "persisted_acceptance";
+        proof: "persisted_external_ref";
+        noProviderPost: true;
+    };
 } | {
     kind: "not_dispatched";
     effectMayHaveSucceeded: false;
@@ -77,7 +115,7 @@ export type FulfillmentDispatchResult = {
     kind: "unknown";
     effectMayHaveSucceeded: true;
     refusal: FulfillmentRefusal;
-};
+}));
 export type FulfillmentDispatchPrepareResult = {
     kind: "prepared";
     evidence: DispatchEvidence;

package/dist/fulfillment/contracts/index.d.ts

@@ -1,8 +1,8 @@
-export type { DispatchEvidence, FulfillmentDispatchPrepareResult, FulfillmentSelection, FulfillmentDispatchRequest, FulfillmentDispatchResult, FulfillmentDispatchPort, FulfillmentRefusal } from "./dispatch.js";
+export type { FulfillmentOperationError, DispatchEvidence, FulfillmentDispatchPrepareResult, FulfillmentSelection, FulfillmentDispatchRequest, FulfillmentDispatchResult, FulfillmentDispatchPort, FulfillmentRefusal } from "./dispatch.js";
 export type { LabelDocument, FulfillmentLabelPort } from "./label.js";
 /** G17 local reads/ingress persistence are inline runtime worker inputs; this provider envelope is unchanged. */
-export type { FulfillmentObservation, FulfillmentObservationPort, FulfillmentTrackingReference } from "./observation.js";
-export type { FulfillmentReadbackResult, FulfillmentReadbackPort } from "./readback.js";
+export type { FulfillmentObservation, FulfillmentObservationCodecs, FulfillmentObservationPort, FulfillmentTrackingReference } from "./observation.js";
+export type { FulfillmentReadbackResult, FulfillmentReadbackPort, FulfillmentReconciliationObservation, FulfillmentObservationPagePort } from "./readback.js";
 export type { SyncCursor, StockSnapshot, StockMovement, LocalStock, FulfillmentStockSyncProvider, FulfillmentStockSyncPort, FulfillmentProductSyncProvider, FulfillmentProductSyncPort } from "./sync.js";
 export type { FulfillmentCapabilityDescriptor } from "./capabilities.js";
 export type { DispatchRecord, FulfillmentStorePort, FulfillmentPaidHandoffPort } from "./store.js";

package/dist/fulfillment/contracts/observation.d.ts

@@ -1,8 +1,14 @@
 import type { NormalizedFulfillmentFact } from "@openlup/core/fulfillment";
 import type { CanonicalLocalFulfillmentStatus } from "./index.js";
 import type { FulfillmentRefusal } from "./dispatch.js";
+/** Explicit adopter policy, forwarded through each durable observation projection. */
+export interface FulfillmentObservationCodecs {
+    approveReference?(value: string): boolean;
+    /** Overrides the query/fragment default; HTTPS, no credentials and URL approval still apply. */
+    trackingUrl?(url: string): string | null;
+}
 export interface FulfillmentTrackingReference {
-    trackingNumber: string;
+    trackingNumber: string; /** Normalized carrier kind, never a raw provider code. */
     carrierRef: string | null;
     serviceRef: string | null;
     publicUrl: string | null;
@@ -22,7 +28,17 @@ export interface FulfillmentObservation {
         parcelRef: string | null;
     };
     trackingRefs: readonly FulfillmentTrackingReference[];
+    /** Original provider status tokens; canonical status does not identify an occurrence. */
+    providerStatus?: {
+        primary: string | null;
+        subStatus: string | null;
+    };
     diagnostics?: {
+        redactedFieldCount?: number;
+        admission?: {
+            rejectedTrackingRefs: number;
+            rejectedTrackingUrls: number;
+        };
         refusal?: FulfillmentRefusal;
         stockContention?: {
             sqlState: "55P03";
@@ -48,5 +64,9 @@ export interface FulfillmentObservationPort {
     } | {
         kind: "refused";
         refusal: FulfillmentRefusal;
+        diagnostics?: {
+            invalidTimestamp?: true;
+            rejectedCorrelationRefs?: number;
+        };
     }>;
 }

package/dist/fulfillment/contracts/readback.d.ts

@@ -36,3 +36,24 @@ export interface FulfillmentReadbackPort {
         mode: "command" | "parcel";
     }): Promise<FulfillmentReadbackResult>;
 }
+/** Collection observation is separate from authoritative exact lookup. */
+export type FulfillmentReconciliationObservation = FulfillmentReadbackResult | {
+    kind: "unmapped";
+    externalRef: string | null;
+    evidence: Pick<FulfillmentObservation, "correlation" | "eventKey" | "providerStatus" | "diagnostics">;
+};
+export interface FulfillmentObservationPagePort {
+    readPage(input: {
+        page: number;
+        size: number;
+    }): Promise<{
+        kind: "page";
+        rows: readonly FulfillmentReconciliationObservation[];
+    } | {
+        kind: "page_exhausted";
+    } | {
+        kind: "failed";
+        refusal: FulfillmentRefusal;
+        error?: import("./dispatch.js").FulfillmentOperationError;
+    }>;
+}

package/dist/fulfillment/contracts/store.d.ts

@@ -10,6 +10,9 @@ export interface DispatchRecord {
     status: "draft" | "submitting" | "created" | "uncertain" | "failed" | "cancel_requested" | "cancelled";
     evidence: DispatchEvidence;
     replayed: boolean;
+    acceptance?: Extract<FulfillmentDispatchResult, {
+        kind: "accepted";
+    }> | null;
 }
 export interface FulfillmentStorePort {
     read(requestKey: string): Promise<DispatchRecord | null>;

package/dist/fulfillment/contracts/sync.d.ts

@@ -37,6 +37,53 @@ export interface SyncCursor {
     /** G15: successful sellable coverage gaps; legacy absent values read as []. */
     coverageGapSkus?: readonly string[];
     refusal: FulfillmentRefusal | null;
+    /** Per-entry bounded diagnostics and run evidence in the existing cursor JSON, never raw errors. */
+    syncRunId?: string;
+    counts?: {
+        checked: number;
+        updated: number;
+        movements: number;
+        rejected: number;
+        failures: number;
+        providerCalls: number;
+        readBacks: number;
+    };
+    items?: readonly {
+        kind?: "stock" | "movement";
+        itemIndex: number;
+        skuRef: string | null;
+        status: "recorded" | "failed" | "rejected";
+        reason?: string;
+        activeReserved?: number;
+        sellableNow?: number | null;
+        coverageGapQuantity?: number;
+    }[];
+    alerts?: readonly {
+        skuRef: string;
+        thresholdKind: Exclude<Threshold, "forecast">;
+        severity: "info" | "warning" | "critical";
+        providerForSaleQuantity: number;
+        localAvailableQuantity: number;
+        detectedAt: string;
+        activeReserved?: number;
+        coverageGapQuantity?: number;
+        gapHours?: number;
+        thresholdHours?: number;
+    }[];
+    staleSync?: {
+        gapHours: number;
+        thresholdHours: number;
+        detectedAt: string;
+    };
+    error?: {
+        reason: string;
+        providerError?: {
+            operation: "get_stock" | "get_stock_movements";
+            status: number | null;
+            code: string;
+            retryable: boolean;
+        };
+    } | null;
 }
 export interface LocalStock {
     skuRef: string;
@@ -48,12 +95,21 @@ export interface LocalStock {
 type Threshold = "safety_stock" | "reservation_coverage" | "forecast" | "stale_sync";
 type Conflict = "unknown_sku" | "ean_conflict" | "kind_quantity_conflict";
 export interface FulfillmentStockSyncProvider {
-    getStock(): Promise<StockSnapshot[]>;
+    /** Rejected rows carry only their input index and a closed reason, never an unsafe reference. */
+    getStock(): Promise<(StockSnapshot | {
+        kind: "rejected";
+        itemIndex: number;
+        reason: "invalid_sku_ref";
+    })[]>;
     getStockMovements(input?: {
         startLocalDate?: string;
         endLocalDate?: string;
         size?: number;
-    }): Promise<StockMovement[]>;
+    }): Promise<(StockMovement | {
+        kind: "rejected";
+        itemIndex: number;
+        reason: "invalid_sku_ref";
+    })[]>;
 }
 export interface FulfillmentStockSyncPort {
     readCursor(): Promise<SyncCursor | null>;

package/dist/fulfillment/dispatchProjection.d.ts

@@ -1,6 +1,25 @@
-import type { DispatchEvidence, DispatchRecord, FulfillmentDispatchResult } from "./contracts/index.js";
+import type { DispatchEvidence, DispatchRecord, FulfillmentDispatchRequest, FulfillmentDispatchResult, FulfillmentOperationError } from "./contracts/index.js";
+/** Machine identities only: arbitrary exception prose, URLs and credentials are omitted. */
+export declare function safeDiagnosticCode(value: unknown): string | null;
+export declare function localFailureReason(stage: string, error: unknown, privacy?: {
+    token(value: string | null | undefined, codec?: (value: string) => string | null): string | null;
+    readonly redactedFieldCount: number;
+}): string;
+export declare function operationError(error: Omit<FulfillmentOperationError, "cause"> & {
+    cause?: unknown;
+}): FulfillmentOperationError;
+export declare const reference: (value: unknown) => string | null;
+/** Opaque by default; an explicit allowlist can admit wider incumbent references. */
+export declare function admittedReference(value: string | null | undefined, approve?: (value: string) => boolean): string | null;
+/** One counted sanitizer for durable projections; codecs are explicit host policy. */
+export declare function durableStrings(priorCount?: number): {
+    token(value: string | null | undefined, codec?: (value: string) => string | null): string | null;
+    readonly redactedFieldCount: number;
+};
 /** Copy only the durable allowlist, including when an adapter object has extra runtime properties. */
 export declare function dispatchEvidence(evidence: DispatchEvidence): DispatchEvidence;
+/** Shadow has a local command identity; it never invokes a provider or resolves credentials. */
+export declare function shadowDispatchEvidence(request: FulfillmentDispatchRequest): DispatchEvidence;
 export declare function dispatchResult(result: FulfillmentDispatchResult): FulfillmentDispatchResult;
 export declare function acceptedProviderProof(record: DispatchRecord | null): record is DispatchRecord & {
     externalRef: string;

package/dist/fulfillment/dispatchProjection.js

@@ -1,16 +1,105 @@
+import { createHash } from "node:crypto";
+/** Machine identities only: arbitrary exception prose, URLs and credentials are omitted. */
+export function safeDiagnosticCode(value) {
+    return reference(value) && typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_]{0,95}$/u.test(value) ? value : null;
+}
+export function localFailureReason(stage, error, privacy = durableStrings()) {
+    if (!error || typeof error !== "object")
+        return stage;
+    const fields = error;
+    const diagnostic = (value) => typeof value === "string" ? privacy.token(value, safeDiagnosticCode) : null;
+    const ownCode = diagnostic(fields.code), causeCode = diagnostic(fields.causeCode), causeMessage = diagnostic(fields.causeMessage);
+    const messagePattern = /^([A-Za-z][A-Za-z0-9_]*)(?::([A-Z0-9]{5}))?$/u;
+    const safeMessage = typeof fields.message === "string" ? privacy.token(fields.message, value => messagePattern.test(value) ? value : null) : null;
+    const message = safeMessage?.match(messagePattern);
+    const cause = causeMessage ?? (message && (message[2] || /_(?:failed|down|missing|invalid|conflict|not_found)$/u.test(message[1])) ? safeDiagnosticCode(message[1]) : null);
+    const code = causeCode ?? ownCode ?? message?.[2];
+    return [stage, cause, code].filter(Boolean).join(":");
+}
+export function operationError(error) {
+    const privacy = durableStrings(error.redactedFieldCount);
+    const code = privacy.token(error.code, safeDiagnosticCode) ?? "operation_failed";
+    const cause = typeof error.cause === "string" ? privacy.token(error.cause, value => /^ack(?::[A-Za-z0-9_]{1,96}){0,2}$/u.test(value) ? value.slice(0, 180) : null) : null;
+    return { code, status: Number.isInteger(error.status) && error.status >= 100 && error.status <= 599 ? error.status : null,
+        retryable: error.retryable === true, mayHaveSucceeded: error.mayHaveSucceeded === true,
+        ...(cause ? { cause } : {}), ...(privacy.redactedFieldCount ? { redactedFieldCount: privacy.redactedFieldCount } : {}) };
+}
+// The fulfillment opaque-ID rule; never accept free-form metadata as a reference.
+export const reference = (value) => typeof value === "string"
+    && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value) ? value : null;
+/** Opaque by default; an explicit allowlist can admit wider incumbent references. */
+export function admittedReference(value, approve) {
+    if (typeof value !== "string" || /[\p{Cc}\p{Cf}]/u.test(value))
+        return null;
+    const admitted = approve ? approve(value) : reference(value) !== null;
+    const text = value.trim();
+    return admitted && text && text.length <= 256 && !/[@]|[a-z][a-z0-9+.-]*:\/\//iu.test(text) ? text : null;
+}
+const isoDate = (value) => typeof value === "string"
+    && /^\d{4}-\d\d-\d\d$/u.test(value) && Number.isFinite(Date.parse(value))
+    && new Date(value).toISOString().slice(0, 10) === value ? value : null;
+/** One counted sanitizer for durable projections; codecs are explicit host policy. */
+export function durableStrings(priorCount = 0) {
+    let count = Number.isSafeInteger(priorCount) && priorCount > 0 ? priorCount : 0;
+    return {
+        token(value, codec = reference) {
+            if (value == null)
+                return null;
+            const safe = codec(value);
+            if (safe === null)
+                count += 1;
+            return safe;
+        },
+        get redactedFieldCount() { return count; },
+    };
+}
 /** Copy only the durable allowlist, including when an adapter object has extra runtime properties. */
 export function dispatchEvidence(evidence) {
+    const privacy = durableStrings(evidence.redactedFieldCount ?? evidence.transcript?.redactedFieldCount);
+    const sanitize = privacy.token;
+    const commandFingerprint = evidence.commandFingerprint;
+    const source = evidence.contactRevision.source;
+    const providerRef = sanitize(evidence.providerRef) ?? "redacted", carrierRef = sanitize(evidence.carrierRef), serviceRef = sanitize(evidence.serviceRef);
+    const mode = evidence.mapping ? (sanitize(evidence.mapping.mode) ?? "shadow") : null;
+    const transcript = evidence.transcript ? {
+        itemCount: evidence.transcript.items.length,
+        items: evidence.transcript.items.map(item => ({ skuRef: sanitize(item.skuRef) ?? "redacted", quantity: Number.isSafeInteger(item.quantity) && item.quantity > 0 ? item.quantity : 0,
+            lotRef: sanitize(item.lotRef), expirationDate: sanitize(item.expirationDate, isoDate) })),
+        deliveryKind: evidence.transcript.deliveryKind === "parcel-locker" ? "parcel-locker" : "courier",
+        pickupPointRef: sanitize(evidence.transcript.pickupPointRef),
+        ...(privacy.redactedFieldCount > 0 ? { redactedFieldCount: privacy.redactedFieldCount } : {}),
+    } : null;
     return {
-        commandFingerprint: evidence.commandFingerprint,
-        contactRevision: { schemaVersion: evidence.contactRevision.schemaVersion, source: evidence.contactRevision.source, revision: evidence.contactRevision.revision },
-        providerRef: evidence.providerRef, carrierRef: evidence.carrierRef, serviceRef: evidence.serviceRef,
+        commandFingerprint,
+        contactRevision: { schemaVersion: evidence.contactRevision.schemaVersion, source, revision: evidence.contactRevision.revision },
+        providerRef, carrierRef, serviceRef,
+        ...(transcript ? { transcript } : privacy.redactedFieldCount ? { redactedFieldCount: privacy.redactedFieldCount } : {}),
+        ...(evidence.mapping ? { mapping: { source: "dispatch_worker", mode: mode, shadowMode: evidence.mapping.mode === "shadow" } } : {}),
     };
 }
+/** Shadow has a local command identity; it never invokes a provider or resolves credentials. */
+export function shadowDispatchEvidence(request) {
+    if (!request.selection.providerRef || !request.lines.length || request.lines.some(line => !Number.isSafeInteger(line.quantity) || line.quantity <= 0))
+        throw new Error("dispatch_shadow_command_invalid");
+    return dispatchEvidence({ commandFingerprint: createHash("sha256").update(JSON.stringify(request)).digest("hex"),
+        contactRevision: request.contactRevision, providerRef: request.selection.providerRef,
+        carrierRef: request.selection.carrierRef, serviceRef: request.selection.serviceRef,
+        transcript: { itemCount: request.lines.length, items: request.lines.map(line => ({ skuRef: line.skuRef, quantity: line.quantity,
+                lotRef: line.lotRef ?? null, expirationDate: line.expirationDate ?? null })),
+            deliveryKind: request.selection.deliveryKind, pickupPointRef: request.selection.pickupPoint?.id ?? null } });
+}
 export function dispatchResult(result) {
+    const privacy = durableStrings(result.redactedFieldCount);
+    const externalRef = result.kind === "accepted" ? privacy.token(result.externalRef) ?? "redacted" : null;
+    const refusal = result.kind !== "accepted" ? { reason: (privacy.token(result.refusal.reason) ?? "malformed"),
+        phase: (privacy.token(result.refusal.phase) ?? "normalize"), retryable: result.refusal.retryable } : null;
+    const redactions = privacy.redactedFieldCount ? { redactedFieldCount: privacy.redactedFieldCount } : {};
+    const error = result.error ? { error: operationError({ ...result.error, mayHaveSucceeded: result.kind !== "not_dispatched" }) } : {};
     switch (result.kind) {
-        case "accepted": return { kind: "accepted", externalRef: result.externalRef, providerAttemptKey: result.providerAttemptKey, labelKey: result.labelKey, evidence: dispatchEvidence(result.evidence) };
-        case "not_dispatched": return { kind: "not_dispatched", effectMayHaveSucceeded: false, refusal: { reason: result.refusal.reason, phase: result.refusal.phase, retryable: result.refusal.retryable } };
-        case "unknown": return { kind: "unknown", effectMayHaveSucceeded: true, refusal: { reason: result.refusal.reason, phase: result.refusal.phase, retryable: result.refusal.retryable } };
+        case "accepted": return { kind: "accepted", externalRef: externalRef, providerAttemptKey: result.providerAttemptKey, labelKey: result.labelKey, ...redactions, evidence: dispatchEvidence(result.evidence), ...error,
+            ...(result.recovery ? { recovery: { source: "persisted_acceptance", proof: "persisted_external_ref", noProviderPost: true } } : {}) };
+        case "not_dispatched": return { kind: "not_dispatched", effectMayHaveSucceeded: false, refusal: refusal, ...redactions, ...error };
+        case "unknown": return { kind: "unknown", effectMayHaveSucceeded: true, refusal: refusal, ...redactions, ...error };
     }
 }
 export function acceptedProviderProof(record) {

package/dist/fulfillment/index.d.ts

@@ -5,9 +5,10 @@ export { createOutboxOrderPaidFulfillmentHandler } from "./paidHandoff.js";
 export { collectPaidFulfillmentRecoveryCandidates } from "./paidFulfillmentRecovery.js";
 export { runFulfillmentDispatchWorker } from "./providerDispatchWorker.js";
 export { createFulfillmentCommandLedger } from "./providerCommandLedger.js";
-export { verifyAndNormalizeFulfillmentObservation } from "./verifiedIngress.js";
+export type { FulfillmentIngressCounts, FulfillmentIngressResult } from "./verifiedIngress.js";
+export { verifyAndNormalizeFulfillmentObservation, fulfillmentIngressHttpResult } from "./verifiedIngress.js";
 export { applyFulfillmentObservationEffects } from "./fulfillmentObservationEffects.js";
-export { reconcileFulfillmentObservations } from "./providerReconciliationWorker.js";
+export { reconcileFulfillmentObservations, runFulfillmentReconciliationPage } from "./providerReconciliationWorker.js";
 export { runFulfillmentStockSyncWorker } from "./providerStockSyncWorker.js";
 export { runFulfillmentProductSyncWorker } from "./providerProductSyncWorker.js";
 export { createFulfillmentLowStockEvidenceHandler } from "./lowStockEvidenceHandler.js";

package/dist/fulfillment/index.js

@@ -5,9 +5,9 @@ export { createOutboxOrderPaidFulfillmentHandler } from "./paidHandoff.js";
 export { collectPaidFulfillmentRecoveryCandidates } from "./paidFulfillmentRecovery.js";
 export { runFulfillmentDispatchWorker } from "./providerDispatchWorker.js";
 export { createFulfillmentCommandLedger } from "./providerCommandLedger.js";
-export { verifyAndNormalizeFulfillmentObservation } from "./verifiedIngress.js";
+export { verifyAndNormalizeFulfillmentObservation, fulfillmentIngressHttpResult } from "./verifiedIngress.js";
 export { applyFulfillmentObservationEffects } from "./fulfillmentObservationEffects.js";
-export { reconcileFulfillmentObservations } from "./providerReconciliationWorker.js";
+export { reconcileFulfillmentObservations, runFulfillmentReconciliationPage } from "./providerReconciliationWorker.js";
 export { runFulfillmentStockSyncWorker } from "./providerStockSyncWorker.js";
 export { runFulfillmentProductSyncWorker } from "./providerProductSyncWorker.js";
 export { createFulfillmentLowStockEvidenceHandler } from "./lowStockEvidenceHandler.js";

package/dist/fulfillment/migrations.d.ts

@@ -24,4 +24,9 @@ export declare const FULFILLMENT_MIGRATIONS: readonly [{
     readonly catalogPath: "db/platform/migrations/20261022090000_fulfillment_delivery_alignment.sql";
     readonly sha256: "d9966ae79fe77a0feae8317dc5b46ef2d8196dd0790b1cd0ee1b06ab58061499";
     readonly url: URL;
+}, {
+    readonly position: 76;
+    readonly catalogPath: "db/platform/migrations/20261022165000_fulfillment_stock_evidence_replay_reopen.sql";
+    readonly sha256: "6d132dec2820047f4e337bcf752b3d884600ccc12de03887fe6d6aa5575bc1db";
+    readonly url: URL;
 }];

package/dist/fulfillment/migrations.js

@@ -5,4 +5,5 @@ export const FULFILLMENT_MIGRATIONS = [
     { position: 51, catalogPath: "db/platform/migrations/20260819150000_fulfillment_shipment_sequence.sql", sha256: "906706cf66a6a555aa1219b12eb674d937eaa099abde6da18766310af43aaa9f", url: new URL("../../sql/20260819150000_fulfillment_shipment_sequence.sql", import.meta.url) },
     { position: 73, catalogPath: "db/platform/migrations/20261022080000_fulfillment_command_ledger.sql", sha256: "c6806906cdb0b6931b29f7a5c7c800016e98d04e6ea956f3c1e219a6cdb7e9d1", url: new URL("../../sql/20261022080000_fulfillment_command_ledger.sql", import.meta.url) },
     { position: 74, catalogPath: "db/platform/migrations/20261022090000_fulfillment_delivery_alignment.sql", sha256: "d9966ae79fe77a0feae8317dc5b46ef2d8196dd0790b1cd0ee1b06ab58061499", url: new URL("../../sql/20261022090000_fulfillment_delivery_alignment.sql", import.meta.url) },
+    { position: 76, catalogPath: "db/platform/migrations/20261022165000_fulfillment_stock_evidence_replay_reopen.sql", sha256: "6d132dec2820047f4e337bcf752b3d884600ccc12de03887fe6d6aa5575bc1db", url: new URL("../../sql/20261022165000_fulfillment_stock_evidence_replay_reopen.sql", import.meta.url) },
 ];

package/dist/fulfillment/observationProjection.d.ts

@@ -1,7 +1,28 @@
-import type { CanonicalLocalFulfillmentStatus, FulfillmentObservation } from "./contracts/index.js";
-export declare function projectCorrelation(value: FulfillmentObservation["correlation"]): FulfillmentObservation["correlation"];
+import type { CanonicalLocalFulfillmentStatus, FulfillmentObservation, FulfillmentObservationCodecs } from "./contracts/index.js";
+export declare function projectCorrelation(value: FulfillmentObservation["correlation"], privacy?: {
+    token(value: string | null | undefined, codec?: (value: string) => string | null): string | null;
+    readonly redactedFieldCount: number;
+}, codecs?: FulfillmentObservationCodecs): FulfillmentObservation["correlation"];
+export declare function projectProviderStatus(value: NonNullable<FulfillmentObservation["providerStatus"]>, privacy?: {
+    token(value: string | null | undefined, codec?: (value: string) => string | null): string | null;
+    readonly redactedFieldCount: number;
+}): NonNullable<FulfillmentObservation["providerStatus"]>;
+export type PollEvidence = Pick<FulfillmentObservation, "correlation" | "eventKey" | "providerStatus" | "diagnostics">;
+/** Unknown-status quarantine/ACK evidence has the same privacy boundary as observations. */
+export declare function projectPollEvidence(value: PollEvidence): PollEvidence;
+/** One URL policy: strict default, optional adopter codec, and approval at every sink. */
+export declare function publicTrackingUrl(value: string, approve?: (url: string) => boolean, codec?: (url: string) => string | null): string | null;
+export declare function projectTrackingReference(value: FulfillmentObservation["trackingRefs"][number], privacy?: {
+    token(value: string | null | undefined, codec?: (value: string) => string | null): string | null;
+    readonly redactedFieldCount: number;
+}, approveTrackingUrl?: (url: string) => boolean, codecs?: FulfillmentObservationCodecs): {
+    trackingNumber: string;
+    carrierRef: string | null;
+    serviceRef: string | null;
+    publicUrl: string | null;
+} | null;
 /** New boundary projection: arbitrary adapter properties are never durable. */
-export declare function projectObservation(value: FulfillmentObservation): FulfillmentObservation;
+export declare function projectObservation(value: FulfillmentObservation, approveTrackingUrl?: (url: string) => boolean, codecs?: FulfillmentObservationCodecs): FulfillmentObservation;
 /** Donor finished-picking boundary is narrower than the coarse packing stage. */
 export declare const observationStatusPolicy: {
     consumesStock: (status: CanonicalLocalFulfillmentStatus) => boolean;

package/dist/fulfillment/observationProjection.js

@@ -1,31 +1,84 @@
+import { z } from "zod";
 import { parseFulfillmentFact } from "./normalizedFulfillmentFacts.js";
+import { admittedReference, durableStrings, reference } from "./dispatchProjection.js";
 import { FULFILLMENT_STATUS_MAP } from "./statusMap.js";
-export function projectCorrelation(value) {
-    const { orderRef, fulfillmentRef, externalRef, orderNumber, providerFulfillmentRef, parcelRef } = value;
-    return { orderRef, fulfillmentRef, externalRef, orderNumber, providerFulfillmentRef, parcelRef };
+const timestamp = z.iso.datetime({ offset: true });
+export function projectCorrelation(value, privacy = durableStrings(), codecs = {}) {
+    const token = (value) => privacy.token(value, text => admittedReference(text, codecs.approveReference));
+    return { orderRef: value.orderRef, fulfillmentRef: value.fulfillmentRef, externalRef: token(value.externalRef),
+        orderNumber: token(value.orderNumber), providerFulfillmentRef: token(value.providerFulfillmentRef), parcelRef: value.parcelRef };
+}
+export function projectProviderStatus(value, privacy = durableStrings()) {
+    return { primary: privacy.token(value.primary), subStatus: privacy.token(value.subStatus) };
+}
+function pollEvidence(value, privacy, codecs = {}) {
+    // Host identities and keys composed from admitted parts are already authoritative.
+    return { eventKey: value.eventKey, correlation: projectCorrelation(value.correlation, privacy, codecs),
+        ...(value.providerStatus ? { providerStatus: projectProviderStatus(value.providerStatus, privacy) } : {}) };
+}
+/** Unknown-status quarantine/ACK evidence has the same privacy boundary as observations. */
+export function projectPollEvidence(value) {
+    const privacy = durableStrings(value.diagnostics?.redactedFieldCount);
+    const safe = pollEvidence(value, privacy);
+    return { ...safe, ...(privacy.redactedFieldCount ? { diagnostics: { redactedFieldCount: privacy.redactedFieldCount } } : {}) };
+}
+/** One URL policy: strict default, optional adopter codec, and approval at every sink. */
+export function publicTrackingUrl(value, approve, codec) {
+    try {
+        const candidate = codec ? codec(value) : value;
+        if (!candidate)
+            return null;
+        const url = new URL(candidate);
+        return url.protocol === "https:" && !url.username && !url.password && (codec || (!url.search && !url.hash)) && approve?.(url.href) ? url.href : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function projectTrackingReference(value, privacy = durableStrings(), approveTrackingUrl, codecs = {}) {
+    const token = (value) => privacy.token(value, text => admittedReference(text, codecs.approveReference));
+    const trackingNumber = token(value.trackingNumber);
+    if (trackingNumber === null)
+        return null;
+    const serviceRef = token(value.serviceRef);
+    // Even an opaque-looking derived carrier is unsafe when its service was refused.
+    const carrierRef = privacy.token(value.carrierRef, text => value.serviceRef !== null && serviceRef === null ? null : reference(text));
+    return { trackingNumber, carrierRef, serviceRef,
+        publicUrl: privacy.token(value.publicUrl, url => publicTrackingUrl(url, approveTrackingUrl, codecs.trackingUrl)) };
 }
 /** New boundary projection: arbitrary adapter properties are never durable. */
-export function projectObservation(value) {
+export function projectObservation(value, approveTrackingUrl, codecs = {}) {
+    const privacy = durableStrings(value.diagnostics?.redactedFieldCount), token = privacy.token;
     const diagnostics = {};
+    if (value.diagnostics?.admission) {
+        const count = (value) => Number.isSafeInteger(value) && value > 0 ? value : 0;
+        diagnostics.admission = { rejectedTrackingRefs: count(value.diagnostics.admission.rejectedTrackingRefs), rejectedTrackingUrls: count(value.diagnostics.admission.rejectedTrackingUrls) };
+    }
     if (value.diagnostics?.refusal) {
         const { reason, phase, retryable } = value.diagnostics.refusal;
-        diagnostics.refusal = { reason, phase, retryable };
+        diagnostics.refusal = { reason: token(reason), phase: token(phase), retryable };
     }
     if (value.diagnostics?.stockContention)
         diagnostics.stockContention = { sqlState: "55P03", phase: "provider_stock_consumed", retryable: true };
     if (value.diagnostics?.annotation)
-        diagnostics.annotation = value.diagnostics.annotation;
+        diagnostics.annotation = token(value.diagnostics.annotation);
     if (value.diagnostics?.recoveredPickedReceipt) {
         const { receiptRef, closed } = value.diagnostics.recoveredPickedReceipt;
         diagnostics.recoveredPickedReceipt = { receiptRef, closed };
     }
-    return {
-        fact: parseFulfillmentFact(value.fact), eventKind: value.eventKind, eventKey: value.eventKey,
-        firstReceivedAt: value.firstReceivedAt,
-        correlation: projectCorrelation(value.correlation),
-        trackingRefs: value.trackingRefs.map(({ trackingNumber, carrierRef, serviceRef, publicUrl }) => ({ trackingNumber, carrierRef, serviceRef, publicUrl })),
-        ...(Object.keys(diagnostics).length ? { diagnostics } : {}),
+    const fact = parseFulfillmentFact(value.fact);
+    const safe = {
+        ...pollEvidence(value, privacy, codecs),
+        fact: { ...fact, mapperVersion: token(fact.mapperVersion) ?? "redacted" }, eventKind: (token(value.eventKind) ?? "redacted"),
+        firstReceivedAt: timestamp.parse(value.firstReceivedAt),
+        trackingRefs: value.trackingRefs.flatMap(ref => {
+            const projected = projectTrackingReference(ref, privacy, approveTrackingUrl, codecs);
+            return projected ? [projected] : [];
+        }),
     };
+    if (privacy.redactedFieldCount)
+        diagnostics.redactedFieldCount = privacy.redactedFieldCount;
+    return { ...safe, ...(Object.keys(diagnostics).length ? { diagnostics } : {}) };
 }
 const HANDOVER_STATUSES = new Set(FULFILLMENT_STATUS_MAP.stages.filter(stage => stage.effects.handover).flatMap(stage => stage.localStatus));
 /** Donor finished-picking boundary is narrower than the coarse packing stage. */

package/dist/fulfillment/omnipack/client.d.ts

@@ -19,7 +19,9 @@ export interface OmnipackClient {
     createProduct(payload: Record<string, unknown>, sku: string): Promise<OmnipackProductCreatedEvidence>;
     getProduct(sku: string): Promise<OmnipackProductEvidence>;
     createProductPack(sku: string, payload: Record<string, unknown>, ean: string): Promise<OmnipackProductPackCreatedEvidence>;
-    getStock(): Promise<OmnipackStockEvidence[]>;
+    getStock(options?: {
+        refuseRedirectRetry: boolean;
+    }): Promise<OmnipackStockEvidence[]>;
     getStockMovements(params?: OmnipackQueryParams): Promise<OmnipackStockMovementEvidence[]>;
     getFulfilmentsPage(params?: OmnipackQueryParams): Promise<{
         rows: OmnipackFulfilmentEvidence[];