@sixtyninecommerce/admin 0.10.0 → 0.11.0

package/dist/payments/providers.d.ts

@@ -1,10 +1,14 @@
 import { type Page, type Transport } from '@sixtyninecommerce/core';
 import type { Call } from '../types.js';
+import { type ConnectedAccountModule } from './connected-account.js';
 /**
- * Which credential a store is actually paying through.
+ * Which credential a store's payments actually take.
  *
- * `connect` — an account the store onboarded through the platform.
- * `legacy` — the channel's own per-provider API key, as it has always worked.
+ * `connect` — an account the store's seller onboarded through the platform: a
+ *   payment method pays through it, or the seller is connected and no method
+ *   holds a key.
+ * `legacy` — the payment methods' own per-provider API key, as it has always
+ *   worked, even when the seller is also connected (for card terminals).
  *   Supported indefinitely: a store moves when it chooses to, and both paths
  *   can be fully ready.
  * `none` — neither, so nothing can be charged.
@@ -76,9 +80,9 @@ export interface ProviderOnboardingStart {
  */
 export interface ProviderReadiness {
     provider: string;
-    /** Which credential this verdict is about. Both `connect` and `legacy` can be ready. */
+    /** Which credential the store's payments take. Both `connect` and `legacy` can be ready. */
     path: ProviderCredentialPath;
-    /** `test` or `live` when there is a connection; null on the legacy path. */
+    /** `test` or `live` when the seller holds a live connection, on either path; null without one. */
     mode: string | null;
     connected: boolean;
     /**
@@ -97,14 +101,17 @@ export interface ProviderReadiness {
      * False means the call did not come back — an outage, a timeout — so nothing
      * else here about the credential was verified and `blockers` holds that one
      * sentence. Retry; do NOT send the merchant to reconnect on it. Always true
-     * on the `legacy` path and with no credential, where there is no probe.
+     * where no connection is in use: no connection, or the `legacy` path with a
+     * connection that drives no card terminal.
      */
     providerReachable: boolean;
     /**
      * On the `connect` path: the provider itself accepts the stored credential
-     * RIGHT NOW. On the `legacy` path it means only that the store holds a key on
-     * an enabled method — the server never reads that key here, so a legacy key
-     * the provider has since revoked still reads `true`.
+     * RIGHT NOW. On the `legacy` path it means that the store holds a key on an
+     * enabled method — the server never reads that key here, so a legacy key the
+     * provider has since revoked still reads `true` — and, when the seller's
+     * connection drives card terminals, that the provider accepts that
+     * connection too.
      */
     credentialUsable: boolean;
     methodActive: boolean;
@@ -137,6 +144,50 @@ export interface ProviderReadiness {
      */
     blockers: string[];
 }
+/**
+ * What a provider account can do, and what the merchant must still do for it — the dashboard's
+ * Connect panel reads this. Asked of the provider live where it can be (its onboarding), so
+ * `providerReachable: false` means the onboarding fields are unknown right now, not false.
+ */
+export interface PaymentProviderAccount {
+    provider: string;
+    /** A live connection exists for this store's legal entity. */
+    connected: boolean;
+    /** `pending`, `connected` or `disconnected`; null when the legal entity never connected. */
+    status: string | null;
+    /** The account's PUBLIC id at the provider (a Mollie organization id). */
+    externalId: string | null;
+    /** `test` or `live`, when there is a connection. */
+    mode: string | null;
+    /** What the provider granted the connection. */
+    grantedScopes: string[];
+    /**
+     * What the platform's consent asks for and the grant lacks. Non-empty after a scope wave
+     * (Mollie Connect, 2026-10-08: refunds, onboarding, customers and mandates).
+     */
+    missingScopes: string[];
+    /**
+     * The merchant must consent again: a scope is missing, or the provider refused the grant
+     * (revoked in its dashboard). {@link ProvidersModule.startOnboarding} starts the re-consent
+     * WITHOUT disconnecting; the connection keeps working for what it can still do meanwhile.
+     */
+    reconnectRequired: boolean;
+    /** Since when an operation found the grant unable to do it (ISO-8601); null while none has. */
+    reconnectRequiredAt: string | null;
+    /** The grant covers online payments (hosted checkout, refunds, capture). */
+    onlinePayments: boolean;
+    /** The provider's own onboarding of the account (`needs-data`, `in-review`, `completed`). */
+    onboardingStatus: string | null;
+    /** Whether the provider lets the account take payments; null when unknown. */
+    canReceivePayments: boolean | null;
+    canReceiveSettlements: boolean | null;
+    /** Where the merchant finishes the provider's onboarding — a public link, never a credential. */
+    dashboardUrl: string | null;
+    /** The provider was asked about its onboarding and answered. */
+    providerReachable: boolean;
+    /** The provider profile (website) online payments are taken on, when it has one. */
+    profileId: string | null;
+}
 export interface ProvisionTerminalInput {
     /** What the merchant calls it — "Counter 1". At most 120 characters. */
     label: string;
@@ -219,7 +270,14 @@ export interface ProviderTerminalsModule {
  * `PROVIDER_ALREADY_CONNECTED` (→ `ConflictError`; disconnect first rather than
  * silently re-pointing a store's money), `ONBOARDING_STATE_INVALID`,
  * `PROVIDER_CREDENTIAL_REJECTED`, `TERMINAL_NOT_FOUND` (→ `NotFoundError`),
- * `TERMINAL_REJECTED`, `LIVE_CONNECTION_REFUSED`, and the `INVALID_*` input
+ * `TERMINAL_REJECTED`, `LIVE_CONNECTION_REFUSED`, `RECONNECT_REQUIRED` (the
+ * grant lacks a scope or was revoked: each missing scope arrives as a
+ * `details[].code` of the thrown `PlatformError`, none for a revoked grant;
+ * start the re-consent with {@link ProvidersModule.startOnboarding}),
+ * `PAYMENTS_NOT_ENABLED` (the provider's own onboarding is open:
+ * {@link ProvidersModule.account} answers its `dashboardUrl`),
+ * `PROVIDER_ACCOUNT_MISMATCH`,
+ * `PROVIDER_PAYMENT_REJECTED`, and the `INVALID_*` input
  * refusals (→ `ValidationError`). Assigning a terminal to a location of another
  * channel answers `LOCATION_NOT_IN_CHANNEL`, the same code the rest of the
  * platform uses for that one rule.
@@ -237,7 +295,11 @@ export interface ProvidersModule {
      * Begin connecting this seller's account. Send the merchant to the `url`, and
      * hand the `state` back to {@link completeOnboarding} when they return.
      *
-     * Refused with `PROVIDER_ALREADY_CONNECTED` while a live connection exists.
+     * Refused with `PROVIDER_ALREADY_CONNECTED` while a live connection exists,
+     * UNLESS {@link account} reports `reconnectRequired`: then this starts a
+     * re-consent of the same account and the connection stays live meanwhile. A
+     * re-consent that comes back from ANOTHER account is refused
+     * `PROVIDER_ACCOUNT_MISMATCH` and changes nothing.
      *
      * This is the one call here that takes NO `idempotencyKey`, and it needs
      * none: a repeat replaces the pending attempt rather than creating a second
@@ -261,15 +323,28 @@ export interface ProvidersModule {
     activateMethod(provider: string, method: string, options?: Call): Promise<ProviderConnection>;
     /** Can this store be paid through this provider, and if not, what is missing? */
     readiness(provider: string, options?: ReadinessOptions): Promise<ProviderReadiness>;
+    /**
+     * What the legal entity's account can do and what the merchant must still do: the grant's
+     * scopes against the platform's consent, whether a reconnect is required (and since when),
+     * whether online payments are covered, and the provider's own onboarding. Never refused for a
+     * revoked grant — that is `reconnectRequired: true`. Needs `ReadPaymentMethod`.
+     */
+    account(provider: string, options?: Call): Promise<PaymentProviderAccount>;
     /**
      * End the connection at the provider. False when there was nothing to
      * disconnect. The row stays, marked disconnected.
      */
     disconnect(provider: string, options?: Call): Promise<boolean>;
     terminals: ProviderTerminalsModule;
+    /**
+     * The Stripe Connect account id saved on the store's legal entity (saved, not yet used for
+     * charges). See {@link ConnectedAccountModule}.
+     */
+    connectedAccount: ConnectedAccountModule;
 }
 export declare const PROVIDER_CONNECTIONS_QUERY = "\n  query ProviderConnections {\n    providerConnections { \n  id\n  sellerId\n  provider\n  status\n  externalId\n  scopes\n  activeMethods\n  mode\n  connectedAt\n  disconnectedAt\n  createdAt\n  updatedAt\n }\n  }\n";
 export declare const PROVIDER_READINESS_QUERY = "\n  query PaymentProviderReadiness($provider: String!, $orderId: ID, $locationId: ID) {\n    paymentProviderReadiness(provider: $provider, orderId: $orderId, locationId: $locationId) {\n      \n  provider\n  path\n  mode\n  connected\n  adapterAvailable\n  providerReachable\n  credentialUsable\n  methodActive\n  terminalProvisioned\n  terminalUsableForLocation\n  partialSupported\n  orderPayable\n  overall\n  blockers\n\n    }\n  }\n";
+export declare const PAYMENT_PROVIDER_ACCOUNT_QUERY = "\n  query PaymentProviderAccount($provider: String!) {\n    paymentProviderAccount(provider: $provider) { \n  provider\n  connected\n  status\n  externalId\n  mode\n  grantedScopes\n  missingScopes\n  reconnectRequired\n  reconnectRequiredAt\n  onlinePayments\n  onboardingStatus\n  canReceivePayments\n  canReceiveSettlements\n  dashboardUrl\n  providerReachable\n  profileId\n }\n  }\n";
 export declare const PROVIDER_TERMINALS_QUERY = "\n  query ProviderTerminals($provider: String!) {\n    providerTerminals(provider: $provider) { \n  id\n  externalId\n  label\n  stockLocationId\n  status\n  lastSeenAt\n  createdAt\n  updatedAt\n }\n  }\n";
 export declare const START_ONBOARDING_MUTATION = "\n  mutation StartPaymentProviderOnboarding($provider: String!, $returnUrl: String!) {\n    startPaymentProviderOnboarding(provider: $provider, returnUrl: $returnUrl) {\n      url\n      state\n      mode\n    }\n  }\n";
 export declare const COMPLETE_ONBOARDING_MUTATION = "\n  mutation CompletePaymentProviderOnboarding($provider: String!, $state: String!, $code: String!, $idempotencyKey: String) {\n    completePaymentProviderOnboarding(provider: $provider, state: $state, code: $code, idempotencyKey: $idempotencyKey) {\n      \n  id\n  sellerId\n  provider\n  status\n  externalId\n  scopes\n  activeMethods\n  mode\n  connectedAt\n  disconnectedAt\n  createdAt\n  updatedAt\n\n    }\n  }\n";

package/dist/payments/providers.js

@@ -1,4 +1,5 @@
 import { createPage } from '@sixtyninecommerce/core';
+import { createConnectedAccountModule } from './connected-account.js';
 const CONNECTION_FIELDS = /* GraphQL */ `
   id
   sellerId
@@ -51,6 +52,29 @@ export const PROVIDER_READINESS_QUERY = /* GraphQL */ `
     }
   }
 `;
+const ACCOUNT_FIELDS = /* GraphQL */ `
+  provider
+  connected
+  status
+  externalId
+  mode
+  grantedScopes
+  missingScopes
+  reconnectRequired
+  reconnectRequiredAt
+  onlinePayments
+  onboardingStatus
+  canReceivePayments
+  canReceiveSettlements
+  dashboardUrl
+  providerReachable
+  profileId
+`;
+export const PAYMENT_PROVIDER_ACCOUNT_QUERY = /* GraphQL */ `
+  query PaymentProviderAccount($provider: String!) {
+    paymentProviderAccount(provider: $provider) { ${ACCOUNT_FIELDS} }
+  }
+`;
 export const PROVIDER_TERMINALS_QUERY = /* GraphQL */ `
   query ProviderTerminals($provider: String!) {
     providerTerminals(provider: $provider) { ${TERMINAL_FIELDS} }
@@ -159,10 +183,15 @@ export function createProvidersModule(transport) {
             }, options);
             return data.paymentProviderReadiness;
         },
+        async account(provider, options) {
+            const data = await transport.graphql({ api: 'admin', query: PAYMENT_PROVIDER_ACCOUNT_QUERY, variables: { provider } }, options);
+            return data.paymentProviderAccount;
+        },
         async disconnect(provider, options) {
             const data = await transport.graphql({ api: 'admin', query: DISCONNECT_PROVIDER_MUTATION, variables: { provider } }, options);
             return data.disconnectPaymentProvider;
         },
+        connectedAccount: createConnectedAccountModule(transport),
         terminals: {
             async list(provider, options) {
                 const data = await transport.graphql({ api: 'admin', query: PROVIDER_TERMINALS_QUERY, variables: { provider } }, options);

package/dist/payments/requests.d.ts

@@ -0,0 +1,144 @@
+import type { Transport } from '@sixtyninecommerce/core';
+import type { Call } from '../types.js';
+/**
+ * A payment request's states, in the engine's order (`OrderPaymentRequestStatus`): `OPEN`, then
+ * exactly one of the other three, for good.
+ */
+export declare const PAYMENT_REQUEST_STATUSES: readonly ["OPEN", "PAID", "EXPIRED", "CANCELLED"];
+/** A payment request's state: OPEN, then exactly one of the other three, for good. */
+export type PaymentRequestStatus = (typeof PAYMENT_REQUEST_STATUSES)[number];
+/**
+ * Why a payment request closed: `PAID` (its payment landed), `EXPIRED`,
+ * `CANCELLED` (by staff, `requests.cancel`), `ORDER_SETTLED` (the order's
+ * balance reached zero through another payment), `ORDER_CANCELLED`, or
+ * `ORDER_CURRENCY_CHANGED` (the order is now billed in another currency than
+ * the request asked in: send a new one).
+ */
+export type PaymentRequestCloseReason = (typeof PAYMENT_REQUEST_CLOSE_REASONS)[number];
+/** Every close reason, in the engine's order (`OrderPaymentRequestCloseReason`). */
+export declare const PAYMENT_REQUEST_CLOSE_REASONS: readonly ["PAID", "EXPIRED", "CANCELLED", "ORDER_SETTLED", "ORDER_CANCELLED", "ORDER_CURRENCY_CHANGED"];
+/**
+ * How long a request's link works when `create` names no `expiresAt`: this many days from the
+ * moment the engine creates it. The engine's own default, pinned to it by this package's spec.
+ */
+export declare const PAYMENT_REQUEST_DEFAULT_EXPIRY_DAYS = 14;
+/**
+ * The furthest ahead `create`'s `expiresAt` may be: this many days from the moment the engine
+ * judges it. Later, or not in the future at all, is refused `PAYMENT_REQUEST_EXPIRY_INVALID`.
+ * Pinned to the engine by this package's spec.
+ */
+export declare const PAYMENT_REQUEST_MAX_EXPIRY_DAYS = 90;
+/**
+ * A hosted payment request: the store asks the customer to pay `amount` of an
+ * order through `url`, a stable link that opens the payment provider's
+ * checkout. It moves no money by itself: when the customer pays, the money
+ * lands on the order as one of its payments (`payments.position`), and the
+ * request turns `PAID` naming it.
+ */
+export interface PaymentRequest {
+    id: string;
+    /** ISO-8601. */
+    createdAt: string;
+    orderId: string;
+    orderCode: string;
+    /** Minor units of `currencyCode` the customer is asked for. */
+    amount: number;
+    currencyCode: string;
+    /** The payment method code the customer pays with. */
+    method: string;
+    status: PaymentRequestStatus;
+    /** ISO-8601: when it reached `status` (its expiry, for one EXPIRED and not yet swept). */
+    statusChangedAt: string;
+    /** Null while `OPEN`. */
+    closeReason: PaymentRequestCloseReason | null;
+    /** ISO-8601: after this the link opens no checkout. */
+    expiresAt: string;
+    /**
+     * The link to send the customer (`<host>/pay/<token>`): by email, as a QR
+     * code, in your own app. A capability to PAY this request and nothing else;
+     * it works until the request closes or expires.
+     */
+    url: string;
+    /** Where the provider sends the customer after paying. */
+    redirectUrl: string;
+    /** The order's payment that paid it; null unless `PAID`. */
+    paymentId: string | null;
+    /** How many provider checkouts the link has opened. */
+    attemptCount: number;
+}
+export interface CreatePaymentRequestInput {
+    /** A held (`Parked`) order, or a committed draft, of this store. */
+    orderId: string;
+    /** A payment method code of this store that opens a hosted checkout (Mollie). */
+    method: string;
+    /**
+     * Minor units. Omit it to ask for what the order still owes. Less than that
+     * is a deposit, refused `DEPOSITS_NOT_ENABLED` on a store without deposits.
+     */
+    amount?: number;
+    /**
+     * Where the customer lands after paying: an absolute URL on one of this
+     * store's own sites (`REDIRECT_URL_NOT_ALLOWED` otherwise). Omit it for the
+     * store's storefront.
+     */
+    redirectUrl?: string;
+    /**
+     * ISO-8601. Omit it for {@link PAYMENT_REQUEST_DEFAULT_EXPIRY_DAYS} days from now; at most
+     * {@link PAYMENT_REQUEST_MAX_EXPIRY_DAYS} days ahead.
+     */
+    expiresAt?: string;
+}
+/**
+ * Hosted payment requests (`admin.payments.requests`): ask a customer to pay a
+ * chosen amount of an order through a stable link, without recording the
+ * payment yourself.
+ *
+ * Needs `RequestOrderPayment` (the `order-payments` token template) or
+ * `UpdateOrder` to create and cancel, and `ReadOrder` or `RequestOrderPayment`
+ * to list. Creating one asks the payment method's provider, so the store must
+ * hold that provider's plugin (Mollie).
+ *
+ * Several requests may be open on one order at once, and together they may
+ * ask for more than it owes: each is checked against what the order owes
+ * again when the customer opens the link, so a request the order no longer
+ * owes enough for is refused at the link, never charged. When the order's
+ * balance reaches zero, its other open requests close (`ORDER_SETTLED`).
+ *
+ * Events: `payment.request.created` and `payment.request.closed`
+ * (`status`, `reason_code`, and the payment once `paid`); the money itself is
+ * announced as `payment.partial_recorded` like every payment.
+ */
+export interface PaymentRequestsModule {
+    /**
+     * Ask the customer to pay `input.amount` (default: the balance) of a held
+     * order or a committed draft. Answers the request with its `url`.
+     *
+     * `options.idempotencyKey` is honoured: a repeat under the same key returns
+     * the same request instead of opening a second link.
+     *
+     * Refusals: `PAYMENT_REQUEST_ORDER_NOT_ELIGIBLE` (not a parked order or a
+     * committed draft: `extensions.orderState`), `PAYMENT_REQUEST_NOTHING_OUTSTANDING`,
+     * `AMOUNT_NOT_POSITIVE`, `AMOUNT_EXCEEDS_OUTSTANDING` (`extensions.outstanding`),
+     * `DEPOSITS_NOT_ENABLED`, `PAYMENT_METHOD_NOT_FOUND`,
+     * `PAYMENT_METHOD_UNUSABLE_HERE` (a method that opens no hosted checkout),
+     * `REDIRECT_URL_NOT_ALLOWED`, `PAYMENT_REQUEST_REDIRECT_URL_REQUIRED`,
+     * `PAYMENT_REQUEST_EXPIRY_INVALID` (`extensions.latestExpiresAt`),
+     * `PAYMENT_REQUEST_STORE_REQUIRED` (asked from the platform root or an
+     * organization workspace), `ORDER_NOT_FOUND`.
+     */
+    create(input: CreatePaymentRequestInput, options?: Call): Promise<PaymentRequest>;
+    /**
+     * Cancel an `OPEN` request: its link stops opening a checkout. A payment the
+     * customer already started can still complete; it is then recorded on the
+     * order like any other, and staff decide whether the order keeps it.
+     * `options.idempotencyKey` is honoured. Refusals: `PAYMENT_REQUEST_NOT_OPEN`
+     * (`extensions.status`), `PAYMENT_REQUEST_NOT_FOUND`.
+     */
+    cancel(id: string, options?: Call): Promise<PaymentRequest>;
+    /** Every request of one order, newest first. Refused `ORDER_NOT_FOUND` for another store's order. */
+    list(orderId: string, options?: Call): Promise<PaymentRequest[]>;
+}
+export declare const CREATE_ORDER_PAYMENT_REQUEST_MUTATION = "\n  mutation CreateOrderPaymentRequest(\n    $input: CreateOrderPaymentRequestInput!\n    $idempotencyKey: String\n  ) {\n    createOrderPaymentRequest(input: $input, idempotencyKey: $idempotencyKey) {\n      \n  id\n  createdAt\n  orderId\n  orderCode\n  amount\n  currencyCode\n  method\n  status\n  statusChangedAt\n  closeReason\n  expiresAt\n  url\n  redirectUrl\n  paymentId\n  attemptCount\n\n    }\n  }\n";
+export declare const CANCEL_ORDER_PAYMENT_REQUEST_MUTATION = "\n  mutation CancelOrderPaymentRequest($id: ID!, $idempotencyKey: String) {\n    cancelOrderPaymentRequest(id: $id, idempotencyKey: $idempotencyKey) {\n      \n  id\n  createdAt\n  orderId\n  orderCode\n  amount\n  currencyCode\n  method\n  status\n  statusChangedAt\n  closeReason\n  expiresAt\n  url\n  redirectUrl\n  paymentId\n  attemptCount\n\n    }\n  }\n";
+export declare const ORDER_PAYMENT_REQUESTS_QUERY = "\n  query OrderPaymentRequests($orderId: ID!) {\n    orderPaymentRequests(orderId: $orderId) {\n      \n  id\n  createdAt\n  orderId\n  orderCode\n  amount\n  currencyCode\n  method\n  status\n  statusChangedAt\n  closeReason\n  expiresAt\n  url\n  redirectUrl\n  paymentId\n  attemptCount\n\n    }\n  }\n";
+export declare function createPaymentRequestsModule(transport: Transport): PaymentRequestsModule;

package/dist/payments/requests.js

@@ -0,0 +1,92 @@
+/**
+ * A payment request's states, in the engine's order (`OrderPaymentRequestStatus`): `OPEN`, then
+ * exactly one of the other three, for good.
+ */
+export const PAYMENT_REQUEST_STATUSES = ['OPEN', 'PAID', 'EXPIRED', 'CANCELLED'];
+/** Every close reason, in the engine's order (`OrderPaymentRequestCloseReason`). */
+export const PAYMENT_REQUEST_CLOSE_REASONS = [
+    'PAID',
+    'EXPIRED',
+    'CANCELLED',
+    'ORDER_SETTLED',
+    'ORDER_CANCELLED',
+    'ORDER_CURRENCY_CHANGED',
+];
+/**
+ * How long a request's link works when `create` names no `expiresAt`: this many days from the
+ * moment the engine creates it. The engine's own default, pinned to it by this package's spec.
+ */
+export const PAYMENT_REQUEST_DEFAULT_EXPIRY_DAYS = 14;
+/**
+ * The furthest ahead `create`'s `expiresAt` may be: this many days from the moment the engine
+ * judges it. Later, or not in the future at all, is refused `PAYMENT_REQUEST_EXPIRY_INVALID`.
+ * Pinned to the engine by this package's spec.
+ */
+export const PAYMENT_REQUEST_MAX_EXPIRY_DAYS = 90;
+const PAYMENT_REQUEST_FIELDS = /* GraphQL */ `
+  id
+  createdAt
+  orderId
+  orderCode
+  amount
+  currencyCode
+  method
+  status
+  statusChangedAt
+  closeReason
+  expiresAt
+  url
+  redirectUrl
+  paymentId
+  attemptCount
+`;
+export const CREATE_ORDER_PAYMENT_REQUEST_MUTATION = /* GraphQL */ `
+  mutation CreateOrderPaymentRequest(
+    $input: CreateOrderPaymentRequestInput!
+    $idempotencyKey: String
+  ) {
+    createOrderPaymentRequest(input: $input, idempotencyKey: $idempotencyKey) {
+      ${PAYMENT_REQUEST_FIELDS}
+    }
+  }
+`;
+export const CANCEL_ORDER_PAYMENT_REQUEST_MUTATION = /* GraphQL */ `
+  mutation CancelOrderPaymentRequest($id: ID!, $idempotencyKey: String) {
+    cancelOrderPaymentRequest(id: $id, idempotencyKey: $idempotencyKey) {
+      ${PAYMENT_REQUEST_FIELDS}
+    }
+  }
+`;
+export const ORDER_PAYMENT_REQUESTS_QUERY = /* GraphQL */ `
+  query OrderPaymentRequests($orderId: ID!) {
+    orderPaymentRequests(orderId: $orderId) {
+      ${PAYMENT_REQUEST_FIELDS}
+    }
+  }
+`;
+export function createPaymentRequestsModule(transport) {
+    return {
+        async create(input, options) {
+            const data = await transport.graphql({
+                api: 'admin',
+                query: CREATE_ORDER_PAYMENT_REQUEST_MUTATION,
+                // A variable, not a header: the Admin API takes the key as an argument.
+                // `undefined`, never null: an omitted key stays off the wire.
+                variables: { input, idempotencyKey: options?.idempotencyKey },
+            }, options);
+            return data.createOrderPaymentRequest;
+        },
+        async cancel(id, options) {
+            const data = await transport.graphql({
+                api: 'admin',
+                query: CANCEL_ORDER_PAYMENT_REQUEST_MUTATION,
+                variables: { id, idempotencyKey: options?.idempotencyKey },
+            }, options);
+            return data.cancelOrderPaymentRequest;
+        },
+        async list(orderId, options) {
+            const data = await transport.graphql({ api: 'admin', query: ORDER_PAYMENT_REQUESTS_QUERY, variables: { orderId } }, options);
+            return data.orderPaymentRequests;
+        },
+    };
+}

package/dist/payments/store-credit-fields.d.ts

@@ -0,0 +1,15 @@
+import { type Transport } from '@sixtyninecommerce/core';
+/** The selection of a `StoreCreditMove`. */
+export declare const STORE_CREDIT_MOVE_FIELDS = "accountId amount currencyCode entryIds";
+/** `document` without the fields above: what an engine before them accepts. */
+export declare function withoutStoreCreditFields(document: string): string;
+/**
+ * "This engine does not know that field yet": refused before it ran, never at execution. Shared
+ * with `credit-noted-fields.ts`, the same fallback for the payment position's credit fields.
+ */
+export declare function isUnknownFieldRejection(error: unknown): boolean;
+/**
+ * The transport, sending a document that names the store-credit fields once more without them
+ * when the engine refused it as unknown. Safe for a mutation too: a refused document never ran.
+ */
+export declare function storeCreditAware(transport: Pick<Transport, 'graphql'>): Pick<Transport, 'graphql'>;

package/dist/payments/store-credit-fields.js

@@ -0,0 +1,51 @@
+import { ValidationError } from '@sixtyninecommerce/core';
+/**
+ * The fields incentives sprint 8 PR 3 added to the "credit the customer" answers: the store's
+ * customer-credit `book` on an overpayment option and a fulfilment cancel's settlement, the
+ * cancel's `creditedToStoreCredit`, and the `storeCredit` move; and PR 4's on the invoice
+ * correction's account credit (`book`, `storeCreditEntryIds`). An engine before them refuses a
+ * document naming one of them as a whole, before it runs; the same document without them reads
+ * as it did then (`book`, `storeCredit` and the entries absent, the figure 0).
+ */
+const STORE_CREDIT_FIELDS = [
+    /\bstoreCredit\s*\{[^{}]*\}/g,
+    /\bcreditedToStoreCredit\b/g,
+    /\bstoreCreditEntryIds\b/g,
+    /\bbook\b/g,
+];
+/** The selection of a `StoreCreditMove`. */
+export const STORE_CREDIT_MOVE_FIELDS = 'accountId amount currencyCode entryIds';
+/** `document` without the fields above: what an engine before them accepts. */
+export function withoutStoreCreditFields(document) {
+    return STORE_CREDIT_FIELDS.reduce((text, field) => text.replace(field, ''), document);
+}
+/**
+ * "This engine does not know that field yet": refused before it ran, never at execution. Shared
+ * with `credit-noted-fields.ts`, the same fallback for the payment position's credit fields.
+ */
+export function isUnknownFieldRejection(error) {
+    if (!(error instanceof ValidationError) || error.service !== 'vendure')
+        return false;
+    return (error.code === 'BAD_REQUEST' ||
+        error.code === 'GRAPHQL_VALIDATION_FAILED' ||
+        /Cannot query field/i.test(error.message));
+}
+/**
+ * The transport, sending a document that names the store-credit fields once more without them
+ * when the engine refused it as unknown. Safe for a mutation too: a refused document never ran.
+ */
+export function storeCreditAware(transport) {
+    return {
+        async graphql(call, options) {
+            try {
+                return await transport.graphql(call, options);
+            }
+            catch (error) {
+                const legacy = withoutStoreCreditFields(call.query);
+                if (legacy === call.query || !isUnknownFieldRejection(error))
+                    throw error;
+                return transport.graphql({ ...call, query: legacy }, options);
+            }
+        },
+    };
+}

package/dist/pickups/index.d.ts

@@ -0,0 +1,104 @@
+import type { Transport } from '@sixtyninecommerce/core';
+import type { Call } from '../types.js';
+/**
+ * Store pickup (click & collect, POS C1/33): webshop orders a shopper collects at one of the
+ * store's shops. Placing such an order writes its pickup (`preparing`); "ready" starts the hold
+ * and emails the customer once; the shop's till hands it over (`collected`); a ready pickup not
+ * collected within the location's hold days goes back to stock (`expired`), and the pickup of a
+ * cancelled order is `cancelled`. A location's settings are `admin.locations.pickup/setPickup`.
+ */
+/** The statuses a pickup has today. More may come: read any other value as itself. */
+export declare const STORE_PICKUP_STATUSES: readonly ["preparing", "ready", "collected", "expired", "cancelled"];
+export type StorePickupStatus = (typeof STORE_PICKUP_STATUSES)[number];
+/**
+ * Why the release at expiry moved nothing (D23): `invoice_locked`, the order is invoiced and
+ * locked; `order_state`, the order is past the states a reservation is released from. More may
+ * come.
+ */
+export declare const STORE_PICKUP_RELEASE_BLOCKED: readonly ["invoice_locked", "order_state"];
+export type StorePickupReleaseBlocked = (typeof STORE_PICKUP_RELEASE_BLOCKED)[number];
+/** A webshop order collected at a shop. Instants are ISO-8601 UTC. */
+export interface StorePickup {
+    id: string;
+    orderId: string;
+    orderCode: string;
+    stockLocationId: string;
+    stockLocationName: string;
+    /** {@link STORE_PICKUP_STATUSES}, or a newer status this SDK does not know yet. */
+    status: StorePickupStatus | (string & {});
+    /** The order's customer, for the hand-over's ID check. Customer data: see `redacted`. */
+    customerName: string | null;
+    totalQuantity: number;
+    /** The shop could not hold every item when the order was placed: check stock before "ready". */
+    stockShort: boolean;
+    placedAt: string | null;
+    readyAt: string | null;
+    /** When an uncollected ready pickup goes back to stock. */
+    holdUntil: string | null;
+    collectedAt: string | null;
+    /** When the expiry ran (the stock went back unless `releaseBlocked` says otherwise). */
+    expiredAt: string | null;
+    /** Null unless the release at expiry was refused and nothing moved. */
+    releaseBlocked: StorePickupReleaseBlocked | (string & {}) | null;
+    createdAt: string;
+    /**
+     * Present (`true`) when the caller's customer-data level blanked a field of this answer: an
+     * app installation below `customerData: full` reads `customerName` as null, which is then not
+     * "no name".
+     */
+    redacted?: true;
+}
+/** Which pickups `list` answers. Every field narrows; none is required. */
+export interface StorePickupListFilter {
+    /** One of the store's stock locations. A credential restricted to locations must hold it. */
+    stockLocationId?: string;
+    /** Any of these statuses; all when left out or empty. */
+    statuses?: ReadonlyArray<StorePickupStatus | (string & {})>;
+    /** At most 100; 50 when left out. */
+    take?: number;
+    skip?: number;
+}
+/** A page of pickups, newest first. */
+export interface StorePickupList {
+    items: StorePickup[];
+    /** Every pickup the filter matches, not only this page. */
+    totalItems: number;
+}
+/**
+ * The store's pickups (C1/33). Reading needs `ReadOrder`, "ready" `UpdateOrder`. There is no
+ * hand-over here: that is the till's act, with the order code checked at the counter (D22).
+ *
+ * **Coded refusals**, delivered as GraphQL errors with `extensions.code`:
+ * `STORE_PICKUP_NOT_FOUND` (→ `NotFoundError`) for a pickup that is not this store's;
+ * `STORE_PICKUP_STATE` (→ `BusinessRuleError`) when the pickup's status does not allow the move
+ * (collected, expired, cancelled); and, on a location filter, `LOCATION_NOT_IN_CHANNEL`
+ * (→ `ValidationError`) for another store's location or `LOCATION_NOT_ALLOWED`
+ * (→ `PermissionDeniedError`) for one a restricted credential does not hold.
+ */
+export interface PickupsModule {
+    /**
+     * A page of the store's pickups, newest first. A credential restricted to some locations
+     * sees only theirs.
+     *
+     * @effect read
+     */
+    list(filter?: StorePickupListFilter, options?: Call): Promise<StorePickupList>;
+    /**
+     * The order's pickup, or null when the order is not collected at a shop (or not this
+     * store's).
+     *
+     * @effect read
+     */
+    forOrder(orderId: string, options?: Call): Promise<StorePickup | null>;
+    /**
+     * Mark a pickup ready: the hold starts (the location's hold days) and the customer gets the
+     * ready email, once. Ready again answers the pickup unchanged and sends nothing.
+     *
+     * @effect write
+     */
+    markReady(id: string, options?: Call): Promise<StorePickup>;
+}
+export declare const STORE_PICKUPS_QUERY = "\n  query StorePickups($input: StorePickupListInput) {\n    storePickups(input: $input) {\n      items { \n  id\n  orderId\n  orderCode\n  stockLocationId\n  stockLocationName\n  status\n  customerName\n  totalQuantity\n  stockShort\n  placedAt\n  readyAt\n  holdUntil\n  collectedAt\n  expiredAt\n  releaseBlocked\n  createdAt\n }\n      totalItems\n    }\n  }\n";
+export declare const STORE_PICKUP_FOR_ORDER_QUERY = "\n  query StorePickupForOrder($orderId: ID!) {\n    storePickupForOrder(orderId: $orderId) { \n  id\n  orderId\n  orderCode\n  stockLocationId\n  stockLocationName\n  status\n  customerName\n  totalQuantity\n  stockShort\n  placedAt\n  readyAt\n  holdUntil\n  collectedAt\n  expiredAt\n  releaseBlocked\n  createdAt\n }\n  }\n";
+export declare const MARK_STORE_PICKUP_READY_MUTATION = "\n  mutation MarkStorePickupReady($id: ID!) {\n    markStorePickupReady(id: $id) { \n  id\n  orderId\n  orderCode\n  stockLocationId\n  stockLocationName\n  status\n  customerName\n  totalQuantity\n  stockShort\n  placedAt\n  readyAt\n  holdUntil\n  collectedAt\n  expiredAt\n  releaseBlocked\n  createdAt\n }\n  }\n";
+export declare function createPickupsModule(transport: Transport): PickupsModule;