@peabody-soft/mbs-model-ts 1.3.0 → 1.5.0

package/dist/Model.js

@@ -6,14 +6,31 @@ import * as ContainerNames from "./ContainerNames";
 import { IllegalOperationException, InvalidArgumentException } from "./Exceptions";
 import Ids from "./Ids";
 import LiveData from "./LiveData";
+import { canonicalizeBusinessId } from "./Profile";
 import * as ProtoMap from "./ProtoMap";
-import { InternalServerException } from "./ServiceExceptions";
+import { InternalServerException, NotFoundException } from "./ServiceExceptions";
 import ShoppingList from "./ShoppingList";
 import SyncCache from "./SyncCache";
+import * as SyncKeys from "./SyncKeys";
+import SyncState from "./SyncState";
 // The root of the object model, and the only thing a UI has to be given. Call initialize once,
 // then always fetch the current instance via getInstance.
+//
+// THERE IS NO LOCKING, and nothing here makes one call wait for another: a caller makes one call at a time, and awaits it. A
+// setBusinessId that is still reading when signIn reads the business too can publish the business of the anonymous container
+// over the one the customer's link names, with no cart and no orders, and nothing republishes them; two reads at once
+// interleave their pages and their writes. And a store has one tab using it at a time: two tabs on one store each hold a Model
+// of their own, and one tab's deleteBusiness and read again can interleave with the pages another is writing.
+// A queue inside Model would settle the first and not the second, and would not be a small one: signIn calls signOut and
+// businessSyncIn calls updateCart, so each public method would need a twin that does not queue, for these to call. A caller
+// that calls from several places - a UI - queues its calls itself.
 class Model {
     constructor() {
+        // Whether the business that is published, if one is, is one that a read has been through to the end and found to be the
+        // one that _businessId names and to be open. The cache-first publish of a read is of what an earlier read left, and is
+        // neither of those until the read ends - a read that does not end (the network failing, or a refusal) leaves it published
+        // and unvetted. See readJoinBusinessId, which does not take such a business to join.
+        this._isPublishedBusinessVetted = false;
         this._business = new LiveData(null);
         this._profile = new LiveData(null);
         this._authenticationMethod = null;
@@ -50,11 +67,12 @@ class Model {
     // publishes a cached profile before it ever reaches the network, so without this, a retry after
     // such a failure could find _profile already set and trip that same guard despite never having
     // actually signed in.
+    // Throws NotFoundException if the business being browsed cannot be opened - see businessSyncIn.
     async signIn(authenticationMethod, subjectId, authenticationToken) {
         this.beginSignIn(authenticationMethod, subjectId, authenticationToken);
         try {
             const authTokens = await this.requireProfileAuthTokens();
-            await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequestFromCache(await Model.getCache().readProfile(this.requireProfileContainerName())), authTokens);
+            await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequest(await Model.getCache().readProfileCursors(this.requireProfileContainerName())), authTokens);
             if (this._businessId !== null)
                 await this.businessSyncIn();
         }
@@ -66,6 +84,9 @@ class Model {
     // Signs up with the given credentials, creating userToCreate as this subject's profile - for a
     // subject the server has no profile for yet; signIn is what an already known subject uses instead.
     // Also reads in the business being browsed, if any, now signed in as this customer.
+    // Throws NotFoundException if the business being browsed cannot be opened - see businessSyncIn. That is
+    // after the User has been created, and nothing undoes it: the customer stays signed up, and signed in, with
+    // a profile held, whatever the read of the business answered.
     async createUser(authenticationMethod, subjectId, authenticationToken, userToCreate) {
         this.beginSignIn(authenticationMethod, subjectId, authenticationToken);
         const authTokens = await this.requireProfileAuthTokens();
@@ -94,9 +115,20 @@ class Model {
     // This is also how a caller re-reads the shop it is already on, and nulling unconditionally
     // would blank the UI for the length of the read and undo syncBusinessContainer's own
     // cache-first publish two lines later.
+    // Throws NotFoundException if the business cannot be opened - see businessSyncIn. Whatever was cached
+    // is published before the network is asked, unless it is a business that has not turned online shopping
+    // on - see publishBusiness - and is taken back, by publishing none, if the read then finds that the business
+    // cannot be opened.
+    // The businessId is held and used as the server finds a business by it, in lower case and without the spaces round it
+    // (see canonicalizeBusinessId): a url is typed in any case, and /WARM-LOAF and /warm-loaf are one storefront, so, they are
+    // one container, one download, and not a different business to be shown as none first. What is sent to the server is that
+    // form too, which it makes of whatever it is sent, so nothing is lost by it.
     async setBusinessId(businessId) {
-        const isDifferentBusiness = this._businessId !== businessId;
-        this._businessId = businessId;
+        // An id of nothing but spaces has no canonical form - Java refuses it - and is held as it was written: it is the server that
+        // says there is no such business, with the NotFoundException that a UI shows for one, and not this that calls it a mistake
+        const canonicalBusinessId = canonicalizeBusinessId(businessId) || businessId;
+        const isDifferentBusiness = this._businessId !== canonicalBusinessId;
+        this._businessId = canonicalBusinessId;
         if (isDifferentBusiness)
             this.publishBusiness(null);
         await this.businessSyncIn();
@@ -118,8 +150,8 @@ class Model {
     // with updateCartLocalOnly and call this on its own schedule (debounced, on blur, a timer).
     // Safe to call often: hasShoppingListChanged checks against the store's own copy rather than
     // whatever the caller last sent, so a call that matches what is already there returns without a
-    // request. Not a substitute for reading the business, though - a push answers only with whatever
-    // else of this customer's changed, and a call that does not go out brings none of that back.
+    // request. Not a substitute for reading the business, though - a push answers with the messages it
+    // pushed and nothing else, and a call that does not go out brings no change of anybody else's back.
     async updateCart(shoppingList) {
         if (this._profile.value === null)
             return this.updateCartLocalOnly(shoppingList);
@@ -136,13 +168,13 @@ class Model {
     // Nothing is lost by leaving it unsent: it survives a closed tab, the next updateCart sends it,
     // and createOrder reads straight from the store. All a caller gives up is that the server, and so
     // this customer's other devices, hear about the change late.
-    // It also cannot be undone by a stale sync in bringing an older server copy back: the store keeps
-    // whichever copy has the later eTag, and buildPartyPreferencesMessage always dates an amendment
-    // past what it replaces.
+    // It also cannot be undone by a stale sync in bringing an older server copy back: the store
+    // versions an amendment at the update number of the copy it amends, where the later copy wins, and
+    // buildPartyPreferencesMessage always dates an amendment past what it replaces.
     async updateCartLocalOnly(shoppingList) {
         // No membership to derive a message id from while signed out, so one is drawn instead - once,
         // and only once: buildPartyPreferencesMessage keeps amending the same entity by reusing its id,
-        // so a second edit cannot leave two behind. The sender is ENTITY_ID_NULL for want of a User;
+        // so a second edit cannot leave two behind. The sender is ENTITY_ID_NULL for want of a party;
         // the first push after signing in names the real one.
         if (this._profile.value === null)
             return this.storeCartInCache(ContainerNames.forBusiness(this.requireBusinessBeingBrowsed()), Ids.getNewId(proto_Constants.MESSAGE_ENTITY_TYPE_ID), BigInt(proto_Constants.ENTITY_ID_NULL), shoppingList);
@@ -169,7 +201,7 @@ class Model {
         const partyPreferencesMessage = await Model.getCache().readPartyPreferences(target.containerName);
         const shoppingList = partyPreferencesMessage === null
             ? ShoppingList.EMPTY
-            : ProtoMap.buildShoppingList(partyPreferencesMessage);
+            : ProtoMap.buildShoppingList(partyPreferencesMessage, target.countryCode);
         if (shoppingList.existingItems.length === 0)
             throw new IllegalOperationException("The cart holds nothing, so there is no order to place");
         Model.requireDeliveryAddress(target.addresses, fulfillmentMode, deliveryAddressId, deliveryAddress);
@@ -197,9 +229,10 @@ class Model {
     }
     // #region Pushing
     // One push, plus everything that follows a server accepting it. The messages go out in one
-    // request, over this business container's own cursor, and the server answers with what has
-    // changed since - these messages under their assigned update numbers, plus anything else of this
-    // customer's a later sync would also pick up. A server that refuses the push fails the call
+    // request, with how far this business container's reads have got, and the server answers with
+    // these messages under their assigned update numbers, and no more: a push is not a read. They are
+    // stored, and move no cursor, so, the next read is sent them again, and anything somebody else
+    // changed in the meantime comes with them. A server that refuses the push fails the call
     // itself, same as any other Service call on a bad status, so there is nothing left here to check:
     // reaching the write below already means the server took it.
     async pushBusinessMessages(target, messages) {
@@ -242,6 +275,7 @@ class Model {
     // for want of a link token to sign with.
     requireCustomerOfBusiness() {
         const businessId = this.requireBusinessBeingBrowsed();
+        const business = this._business.value;
         const profile = this._profile.value;
         const user = profile?.user ?? null;
         if (profile === null || user === null)
@@ -252,8 +286,9 @@ class Model {
         return {
             businessLink: businessLink,
             containerName: Model.getBusinessContainerName(businessLink),
-            senderId: user.id,
+            senderId: businessLink.partyId,
             addresses: user.addresses,
+            countryCode: business.countryCode,
         };
     }
     // Where an order is delivered: an id into this customer's own address list (the same list
@@ -281,7 +316,18 @@ class Model {
     // businessId. A signed-in customer reads it under their own container instead - see
     // getBusinessContainerName - joining as a customer first if not already linked - see
     // requireBusinessLink.
-    async businessSyncIn() {
+    // Throws NotFoundException, from either, when the business is not one a storefront can open,
+    // whether or not this customer has joined it, and that is the answer to any read of it, the first
+    // or a later one: a business can stop being open after it was cached. The server says so when the
+    // business does not exist, has been deleted, or does not allow customers to join it. Whether it
+    // has turned online shopping on the server does not say: this decides, once everything the server
+    // sent has been read, from the settings that it then holds. What was cached is left as it is,
+    // except that a business that is no longer the one that the businessId names is given up for the
+    // one that is, if there is one: see syncBusinessContainer.
+    // isStartedOver is for the one time that this calls itself: the link that a customer's profile found by the businessId is of
+    // a business that no longer has it, which syncBusinessContainer finds out once it has read the business. The profile is read again,
+    // as it is what said so, and this starts again from what it now says - which may be a business that the customer has to join, or none.
+    async businessSyncIn(isStartedOver = false) {
         const businessId = this._businessId;
         if (businessId === null || businessId.length === 0)
             throw new IllegalOperationException("No business is being browsed, so there is nothing to read");
@@ -295,34 +341,62 @@ class Model {
         const containerName = Model.getBusinessContainerName(link);
         const anonymousName = ContainerNames.forBusiness(businessId);
         // What this device read while nobody was signed in, folded into the container it is read
-        // under now - the same rule the server's own pages take: writeBusiness keeps the later of two
-        // copies per entity by updatedAt. Unconditional, since a returning customer's own container
-        // can easily be the staler of the two.
+        // under now - the same rule the server's own pages take: the later of two copies per entity by
+        // update number is kept, so a tombstone wins over what it deleted. Unconditional, since a
+        // returning customer's own container can easily be the staler of the two. It moves no cursor:
+        // that container has not been read for any of this, and is read from where its own reads got to.
         // Not the cart, which is settled below: the two containers hold it under different ids, so a
         // merge keyed on entity id would file the visitor's as a second cart instead of replacing one.
-        const anonymous = await cache.readBusiness(anonymousName);
+        // Nor one that holds another business than the link is of: what was read under the businessId while nobody was
+        // signed in is of the business that the businessId named then, which is not the one the link is of once the
+        // businessId has been given up and taken by another. Folded in, the one container would hold two businesses, and
+        // which of them it answers with would be decided by nothing - and a cart is the cart of the business it was built in.
+        // One that holds no business at all has nothing to contradict the link with, and is folded in: a cart can be all that a
+        // visit left of it.
+        const anonymousContainer = await cache.readBusiness(anonymousName);
+        const anonymousEntityId = ProtoMap.getBusinessResponseBusinessEntityId(anonymousContainer);
+        const anonymous = anonymousEntityId !== null && anonymousEntityId !== link.businessId ? null : anonymousContainer;
         // Out of the messages just read, rather than a second read of the same container -
         // partyPreferencesMessageFromMessages picks the same one readPartyPreferences(anonymousName)
         // would.
         const anonymousPartyPreferences = anonymous === null ? null : ProtoMap.partyPreferencesMessageFromMessages(anonymous.messages);
         if (anonymous !== null) {
             anonymous.messages = anonymous.messages.filter((message) => !ProtoMap.isPartyPreferencesMessage(message));
-            await cache.writeBusiness(containerName, anonymous);
+            await cache.storeBusiness(containerName, anonymous);
         }
         const authTokens = await this.requireBusinessAuthTokens(containerName, link);
-        await this.syncBusinessContainer(containerName, businessId, ProtoMap.buildAuthTokens(authTokens));
+        // The link names the business by its entity id, which the link token that signs this call has to be of
+        const isBusinessNamed = await this.syncBusinessContainer(containerName, businessId, link.businessId, ProtoMap.buildAuthTokens(authTokens));
+        // The business that the link is of has another businessId now, and the profile that found the link by this one did not know
+        // it. Its container has been given up, and what is asked next of the server is what the profile says: read again, so that
+        // the link is found by this businessId or not, and the businessId that names another business is joined. Once - a profile
+        // that is read again and still finds the same link for the same businessId is the server contradicting itself
+        if (!isBusinessNamed) {
+            if (isStartedOver)
+                throw new InternalServerException(`The business that the link for the businessId ${businessId} is of does not have it, though the profile was read again`);
+            await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequest(await cache.readProfileCursors(this.requireProfileContainerName())), await this.requireProfileAuthTokens());
+            await this.businessSyncIn(true);
+            return;
+        }
         // THE CART A VISITOR BUILT BEFORE SIGNING IN. Signing in changes which container is being
         // browsed, so without this it is simply left behind - and a customer has to build it again
         // having just proved who they are.
         if (anonymousPartyPreferences === null)
             return;
+        // The visitor's cart holds taxes as raw codes, which mean something only within the country of
+        // the business it was built in. The anonymous container is where that was read from, and a cart
+        // is only ever stored once its business has been (see updateCartLocalOnly); failing that, the
+        // business being browsed is the same one.
+        const anonymousCountryCode = ProtoMap.getBusinessResponseCountryCode(anonymous) ?? this._business.value?.countryCode;
+        if (anonymousCountryCode === undefined)
+            throw new IllegalOperationException("The business the visitor's cart was built in is not known, so its taxes cannot be read");
         // Read after the sync, so this is weighed against what the server just settled rather than a
         // local copy about to be replaced. Last written wins, by updatedAt.
         const userPartyPreferences = await cache.readPartyPreferences(containerName);
         if (userPartyPreferences === null ||
             ProtoMap.getMessageUpdatedAt(anonymousPartyPreferences) >
                 ProtoMap.getMessageUpdatedAt(userPartyPreferences))
-            await this.updateCart(ProtoMap.buildShoppingList(anonymousPartyPreferences));
+            await this.updateCart(ProtoMap.buildShoppingList(anonymousPartyPreferences, anonymousCountryCode));
         // Dropped either way, carried over or beaten by the customer's own: the anonymous container is
         // what the next visitor on this device reads, and a settled cart has no business staying there.
         await cache.deletePartyPreferences(anonymousName);
@@ -330,19 +404,130 @@ class Model {
     // The plain businessId-named container: an anonymous read, before signing in or joining, or to
     // learn a business's entity id while joining - see readJoinBusinessId.
     async syncAnonymousBusiness(businessId) {
-        await this.syncBusinessContainer(ContainerNames.forBusiness(businessId), businessId, null);
+        await this.syncBusinessContainer(ContainerNames.forBusiness(businessId), businessId, null, null);
     }
     // One business, cache first: what's already held publishes before the network is touched, so a
     // returning customer sees the shop at once instead of a loading state. Cursors start from
-    // whatever containerName already holds, not zero, so a repeat call asks only what changed - see
-    // ProtoMap.buildBusinessSyncOutRequestFromCache.
-    async syncBusinessContainer(containerName, businessId, firstAuthTokens) {
+    // how far the reads of containerName have got, which it keeps, and not from zero, so a repeat call
+    // asks only what changed - see SyncCache.readBusinessCursors. Each page moves them as it is written.
+    // The business is named to the server by its entity id where this knows it, and by its businessId
+    // only where it does not: a caller that has a BusinessLink has its businessEntityId, and one that
+    // has read the business before has it in the container, from that read. Which of the two is
+    // decided once, by the first request, and every page after it is about the same business named the
+    // same way. The first read of a business by an anonymous visitor names it by its businessId, and its
+    // answer is what makes every later one not have to - except the read that is made again, below,
+    // when the business that the container holds has turned out not to be the one that the businessId names.
+    //
+    // What decides whether the business can be opened is what the container holds once every page has been
+    // read and written, and not what the pages carried, which is only what changed: a read that has nothing
+    // new to send says nothing of what has not changed. It is looked at after every read, whether the read
+    // brought anything or not, and in this order:
+    // 1. That the business the container holds is the one that businessId names. A business keeps its entity
+    //    id when its businessId changes, and another can take the businessId it gave up, so a container that is
+    //    read by the entity id it was left with may hold a business that is not the one that businessId names
+    //    now. The business arrives changed when its businessId does, which is how this is seen, and it is seen
+    //    after the next read however long that is, as it is the container that is looked at. If it is not that
+    //    business, the container is given up and the business is read from the beginning by its businessId,
+    //    once: that finds a business that has it, or none, which the server says with a NotFoundException.
+    //    A read that a link names cannot be read again by the businessId, as a link token is refused with
+    //    one, and the link names the one business that it is of. Its container is given up all the same, and
+    //    it answers false: the link was found from what the profile said of the businessId, which is out of
+    //    date, so the caller starts again from a profile that is read again - see businessSyncIn.
+    //    Answers true when the container holds the business that businessId names.
+    // 2. That the business has turned online shopping on, which is the general settings it holds saying so.
+    //    Settings it holds none of, because it has made none or has deleted them, do not. The server does not
+    //    refuse a business for this, so this is where a business that has not is a NotFoundException, the
+    //    same one as the server's for the businesses it does refuse, to every caller and every read.
+    // 3. That the business has something that a customer can buy: a product that is enabled, that it does not sell
+    //    only offline, and that has a package with a price. A business with none, because it has made none, has
+    //    turned them all off, or sells them all offline, is not a shop that there is anything to show or to order
+    //    from, and is a NotFoundException as well. That is decided from the whole of what the container holds, as
+    //    the first two are, and so it is decided when the last page has been written.
+    // firstAuthTokens are those of the link that businessEntityId is of, and none when that is none: they sign the reads that
+    // name the business by it, and a read by the businessId is signed with nothing, however it came to be made.
+    async syncBusinessContainer(containerName, businessId, businessEntityId, firstAuthTokens) {
         const cache = Model.getCache();
         const cached = await cache.readBusiness(containerName);
-        this.publishBusiness(cached);
-        let request = ProtoMap.buildBusinessSyncOutRequestFromCache(businessId, cached);
-        let authTokens = firstAuthTokens;
-        // What the store accepted - blobs stored plus ids deleted - which decides the publish at the end
+        const cachedBusiness = Model.buildPublishable(cached);
+        this.publish(cachedBusiness); // Unless it is a business that is not open - see publishBusiness
+        this._isPublishedBusinessVetted = false; // Until this has read it to the end
+        // The entity id that an earlier read of this container left in it: what a business is named by when no link names
+        // it. It is how the business was found then, and it may not be what the businessId finds now: a business can have
+        // its businessId given up and taken by another, or changed.
+        const cachedEntityId = ProtoMap.getBusinessResponseBusinessEntityId(cached);
+        // What the store accepted - the blobs it stored - which decides the publish at the end
+        let changeCount;
+        try {
+            changeCount = await this.readBusinessPages(containerName, businessEntityId ?? cachedEntityId ?? businessId, await cache.readBusinessCursors(containerName), ProtoMap.getBusinessResponseAttachmentBaseUrlExpiry(cached), firstAuthTokens);
+        }
+        catch (error) {
+            // The server says that the business cannot be opened: what was published from the cache, before it was asked, is
+            // not what is there. The container is left as it is - deciding that a business is gone is the caller's
+            if (error instanceof NotFoundException)
+                this.publishBusiness(null);
+            throw error;
+        }
+        let held = await cache.readBusiness(containerName);
+        // Whether what was published is no longer what the container holds
+        let isPublishedStale = changeCount !== 0;
+        // Named by the cached entity id, and not by a link, which names the business that it is of and no other
+        if (businessEntityId === null && cachedEntityId !== null && !Model.isBusinessNamed(held, businessId)) {
+            // What has been read of one business is no guide to what has not been read of another, so, none of the container
+            // is kept, nor how far it was read, and the business that the businessId names is read from the beginning. That is with
+            // no attachment url held either, which is why the expiry is zero and not that of the container's: the url it held was the
+            // old business's, which has been given up with it, and a server sent its expiry would take the new business to have it and
+            // send none, leaving every photo of it without one. Signed with nothing, a link token being refused with a businessId
+            await cache.deleteBusiness(containerName);
+            this.publishBusiness(null);
+            await this.readBusinessPages(containerName, businessId, new SyncState(SyncKeys.BUSINESS_SYNC_IN), 0n, null);
+            held = await cache.readBusiness(containerName);
+            isPublishedStale = true;
+        }
+        // What the businessId finds is the business that has it, so, one that does not is the server contradicting itself
+        if (businessEntityId === null && !Model.isBusinessNamed(held, businessId))
+            throw new InternalServerException(`The business that was read for the businessId ${businessId} has the businessId ${ProtoMap.getBusinessResponseBusinessId(held)}`);
+        // Named by a link, which is of a business that no longer has the businessId. It cannot be read again by the businessId,
+        // as a link token is refused with one, so, the container is given up as above and it is the caller's to start again
+        if (businessEntityId !== null && !Model.isBusinessNamed(held, businessId)) {
+            await cache.deleteBusiness(containerName);
+            this.publishBusiness(null);
+            return false;
+        }
+        // A container that holds no business is not one that this can say anything of: that is a failure of its own, and
+        // not a business that has not turned online shopping on - see readJoinBusinessId
+        if (ProtoMap.getBusinessResponseBusinessEntityId(held) !== null && !ProtoMap.isBusinessResponseOnlineShoppingOn(held)) {
+            // What was published from the cache, before the network was asked, is of the business as it was when it was open,
+            // which is not what it is now: nothing of a business that cannot be opened is published, or a customer could be
+            // joined to it - see readJoinBusinessId
+            this.publishBusiness(null);
+            throw new NotFoundException("The business has not turned online shopping on");
+        }
+        // What the container holds now, built once for this and for the publish below: the one that was built from the cache
+        // before the network was asked, when the read has changed nothing of it
+        const business = isPublishedStale ? Model.buildPublishable(held) : cachedBusiness;
+        if (business !== null && business.catalog.productCount === 0) {
+            // Nothing that a customer can buy is a shop that is not found, and is not shown, whatever the cache published
+            this.publishBusiness(null);
+            throw new NotFoundException("The business has nothing that a customer can buy");
+        }
+        // A read the store took nothing from re-renders nobody - already published above from cache,
+        // and nothing here changes what a later read of this container answers
+        if (isPublishedStale)
+            this.publish(business);
+        // What is published now is what was read to the end, and is the business that the businessId names, and is open
+        this._isPublishedBusinessVetted = true;
+        return true;
+    }
+    // Reads every page of a business that the server has for the cursors it is given, and writes each into the
+    // container as it arrives. The business is named by its entity id or by its businessId, which is decided by
+    // the first request, and every page after it is about the same business named the same way. Answers what the
+    // store accepted - the blobs it stored.
+    // firstAuthTokens are those of a link, and a link token is refused with a businessId, so a read that names the business by
+    // it is sent none, whatever it is given: no request that names a businessId carries one, from any of the paths that make it.
+    async readBusinessPages(containerName, business, cursors, attachmentBaseUrlExpiry, firstAuthTokens) {
+        const cache = Model.getCache();
+        let request = ProtoMap.buildBusinessSyncOutRequest(business, cursors, attachmentBaseUrlExpiry);
+        let authTokens = typeof business === "bigint" ? firstAuthTokens : null;
         let changeCount = 0;
         for (;;) {
             const page = await Model.getService().businessSyncOut(request, authTokens);
@@ -355,16 +540,19 @@ class Model {
             // no cursor - which only a server breaking its own ordering can do
             const next = ProtoMap.nextBusinessSyncOutRequest(request, page);
             if (next === null)
-                break;
+                return changeCount;
             // The next page asks from where this one got to, signed with any token this one reissued
             request = next;
             authTokens = ProtoMap.refreshAuthTokens(authTokens, issued);
         }
-        // A read the store took nothing from re-renders nobody - already published above from cache,
-        // and nothing here changes what a later read of this container answers
-        if (changeCount === 0)
-            return;
-        this.publishBusiness(await cache.readBusiness(containerName));
+    }
+    // Whether a response holds the business that businessId names, or holds none at all, which says nothing against it:
+    // only a business that has another businessId is another business. A business id is compared as the server finds
+    // one, in whatever case it is written and however it is padded
+    static isBusinessNamed(response, businessId) {
+        const heldBusinessId = ProtoMap.getBusinessResponseBusinessId(response);
+        return (heldBusinessId === null ||
+            canonicalizeBusinessId(heldBusinessId) === canonicalizeBusinessId(businessId));
     }
     // The BusinessLink of this profile for the named business, joining as a customer first (once) if
     // not linked yet. A business in the profile with no matching link is a server inconsistency, not
@@ -378,7 +566,7 @@ class Model {
         if (Model.findBusinessEntity(profile, businessId) !== null)
             throw new InternalServerException(`This customer has no BusinessLink to business ${businessId}`);
         const joinBusinessId = await this.readJoinBusinessId(businessId);
-        await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequestFromCache(await Model.getCache().readProfile(this.requireProfileContainerName()), joinBusinessId), await this.requireProfileAuthTokens());
+        await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequest(await Model.getCache().readProfileCursors(this.requireProfileContainerName()), joinBusinessId), await this.requireProfileAuthTokens());
         // Attempted once: a join that still leaves no link is the server contradicting itself, not
         // something retrying would fix.
         const joined = this._profile.value;
@@ -388,20 +576,25 @@ class Model {
         return joinedLink;
     }
     // The entity id to join, for a business this profile doesn't list yet. Read off the Business
-    // already held, if an anonymous visit left one behind, or off a fresh anonymous read otherwise.
+    // already held, if an anonymous visit left one behind and read it to the end, or off a fresh anonymous read otherwise.
+    // A business that is only published from the cache, by a read that has not ended, is not one that has been found to
+    // be open and to be the one that the businessId names, and a customer is not joined to it on that account.
     async readJoinBusinessId(businessId) {
         const alreadyHeld = this._business.value;
-        if (alreadyHeld !== null)
+        if (alreadyHeld !== null && this._isPublishedBusinessVetted)
             return alreadyHeld.id;
         await this.syncAnonymousBusiness(businessId);
+        // A business that is not there is a NotFoundException of the read above. Reaching here with none
+        // published is the server answering with no Business at all, which is its own failure
         const business = this._business.value;
         if (business === null)
-            throw new InternalServerException(`Business ${businessId} does not exist`);
+            throw new InternalServerException(`The read of business ${businessId} answered with no Business`);
         return business.id;
     }
     static findBusinessEntity(profile, businessId) {
+        const wanted = canonicalizeBusinessId(businessId);
         for (const business of profile.businesses)
-            if (business.businessId === businessId)
+            if (canonicalizeBusinessId(business.businessId) === wanted)
                 return business;
         return null;
     }
@@ -473,7 +666,7 @@ class Model {
         let hasJoinedBusiness = false;
         for (;;) {
             const page = await Model.getService().profileSyncOut(request, authTokens);
-            changeCount += await this.cacheProfileResponse(containerName, page);
+            changeCount += await this.cacheProfileResponse(containerName, page, true);
             if (ProtoMap.hasJoinedBusinessLink(joinBusinessId, page))
                 hasJoinedLink = true;
             if (ProtoMap.hasJoinedBusiness(joinBusinessId, page))
@@ -524,8 +717,8 @@ class Model {
     //
     // Only a joinBusinessId a server could act on is checked (Java Business.isValidBusinessId's
     // test, which Constants.ENTITY_ID_NULL also fails, so "no join asked" needs no case of its own).
-    // An id that is not a business entity id is not a failure here: a server ignores it rather than
-    // refusing it (see THE MOCKS), and sending one is the caller's bug, not the server's.
+    // An id that is not a business entity id never gets as far as here: a server refuses it (400),
+    // which fails the call itself, and sending one is the caller's bug, not the server's.
     static requireJoinedBusiness(joinBusinessId, hasBusinessLink, hasBusiness) {
         if (Ids.getEntityTypeId(joinBusinessId) !== proto_Constants.BUSINESS_ENTITY_TYPE_ID)
             return;
@@ -544,8 +737,13 @@ class Model {
     // a sign up and an update - so none of them can come to cache a response differently from the
     // others, or file a token in a different place. Publishing is not in here: a read publishes once
     // for a whole loop of these, and the other two once each.
-    async cacheProfileResponse(containerName, response) {
-        const changeCount = await Model.getCache().writeProfile(containerName, response);
+    // Only a page of a read moves the cursors of the container. A sign up and an update are changes this
+    // client made, and the next read brings them back, so, they are stored without moving any.
+    async cacheProfileResponse(containerName, response, isPageOfRead) {
+        const cache = Model.getCache();
+        const changeCount = isPageOfRead
+            ? await cache.writeProfile(containerName, response)
+            : await cache.storeProfile(containerName, response);
         await this.storeIssuedTokens(ProtoMap.getResponseAuthTokens(response), containerName);
         return changeCount;
     }
@@ -560,7 +758,7 @@ class Model {
         const containerName = this.getProfileContainerName();
         if (containerName === null)
             return response;
-        if ((await this.cacheProfileResponse(containerName, response)) !== 0)
+        if ((await this.cacheProfileResponse(containerName, response, false)) !== 0)
             this.publishProfile(await Model.getCache().readProfile(containerName));
         return response;
     }
@@ -633,9 +831,24 @@ class Model {
     // and nothing is lost: a response the store took nothing from can't change what a later read
     // answers.
     // All four calls use this, which is why an update publishes nothing - see writeProfileResponse.
+    // A business that has not turned online shopping on is not published, whatever the container holds of it: what is
+    // published is then no business, as it is a business that cannot be opened, which a read throws for. Without this,
+    // the cache-first publish of a container that a read of such a business left behind would show it again before the
+    // next read is refused, and a customer could be joined to it. A read that finds that a business that it published from
+    // the cache has stopped being open, or that the server says cannot be opened, takes it back: it publishes none.
+    // What is published from the cache is not taken to be open all the same until the read has ended (see
+    // _isPublishedBusinessVetted), which is what readJoinBusinessId goes by.
     publishBusiness(response) {
-        this._business.value =
-            response === null ? null : ProtoMap.buildBusiness(response);
+        this.publish(Model.buildPublishable(response));
+    }
+    publish(business) {
+        this._business.value = business;
+    }
+    // The business that a response holds, or none when there is no response or the business has not turned online shopping on
+    static buildPublishable(response) {
+        return response === null || !ProtoMap.isBusinessResponseOnlineShoppingOn(response)
+            ? null
+            : ProtoMap.buildBusiness(response);
     }
     publishProfile(response) {
         this._profile.value =

package/dist/Package.js

@@ -37,8 +37,8 @@ export default class Package extends Item {
     get photos() {
         return this._photos;
     }
-    // What this package costs; null when the business has not priced it, in which case it cannot be
-    // bought.
+    // What this package costs, with the taxes of its product included (Product.taxes); null when the
+    // business has not priced it, in which case it cannot be bought.
     get price() {
         return this._price;
     }

package/dist/Price.js

@@ -2,6 +2,10 @@ import { amountFromScaledValue } from "./Constants";
 import Item from "./Item";
 // What one package costs: the regular price and the offer price. Exposed unscaled as numbers; they
 // travel multiplied by Constants.AMOUNT_FACTOR and stay well below 2^53, so nothing is lost.
+//
+// BOTH INCLUDE TAXES: the taxes of the product the package belongs to (Product.taxes) are in the
+// price, not added to it, so this is what a customer pays and what a catalog shows. A shopping
+// list stores a price without them, which is why a cart takes the taxes out of one (CartEditor).
 export default class Price extends Item {
     // Only ProtoMap calls this: it is the one place that sees prices still multiplied by
     // Constants.AMOUNT_FACTOR.
@@ -30,8 +34,8 @@ export default class Price extends Item {
     get offerPrice() {
         return this._offerPrice;
     }
-    // What a customer actually pays: the offer price when there is one, else the regular price.
-    // Computed here (not sent), matching the "on offer" definition from Price.proto.
+    // What a customer actually pays, taxes included: the offer price when there is one, else the
+    // regular price. Computed here (not sent), matching the "on offer" definition from Price.proto.
     get finalPrice() {
         return this.isOnOffer ? this._offerPrice : this._regularPrice;
     }

package/dist/Product.d.ts

@@ -14,20 +14,22 @@ export default class Product extends Item {
     private readonly _manufacturerAddress;
     private readonly _taxes;
     private readonly _features;
+    private readonly _isForOfflineSaleOnly;
     private readonly _photos;
-    private readonly _packages;
-    constructor(header: EntityHeader, name: string, description: string | null, productCategoryId: bigint, isDisabled: boolean, _productType: proto_ProductType, _brand: string | null, _isManufacturedByBusiness: boolean | null, _manufacturer: string | null, _manufacturerAddress: Address | null, _taxes: ReadonlyArray<Tax>, _features: ReadonlyArray<string>, _photos: ReadonlyArray<Photo>, _packages: ReadonlyArray<Package>);
+    constructor(header: EntityHeader, name: string, description: string | null, productCategoryId: bigint, isDisabled: boolean, _productType: proto_ProductType, _brand: string | null, _isManufacturedByBusiness: boolean, _manufacturer: string | null, _manufacturerAddress: Address | null, _taxes: ReadonlyArray<Tax>, _features: ReadonlyArray<string>, _isForOfflineSaleOnly: boolean, _photos: ReadonlyArray<Photo>, packages: ReadonlyArray<Package>);
     get productCategoryId(): bigint;
     get productType(): proto_ProductType;
     get brand(): string | null;
-    get isManufacturedByBusiness(): boolean | null;
+    get isManufacturedByBusiness(): boolean;
     get manufacturer(): string | null;
     get manufacturerAddress(): Address | null;
     get taxes(): ReadonlyArray<Tax>;
     get features(): ReadonlyArray<string>;
+    get isForOfflineSaleOnly(): boolean;
     get photos(): ReadonlyArray<Photo>;
     get packages(): ReadonlyArray<Package>;
     get lowestPrice(): Price | null;
     get isOnOffer(): boolean;
     get isBuyable(): boolean;
+    private readonly _packages;
 }