@teincfood/core 0.10.21 → 0.10.22

package/dist/db/migrations.js

@@ -473,4 +473,28 @@ export const MIGRATIONS = [
             catch { }
         },
     },
+    {
+        version: 14,
+        up: async (db) => {
+            // Fresh local data for the DD-NNNN-MMM order-number cutover.
+            //
+            // Old local rows, queued commands and cached reference data can carry
+            // stale order numbers/statuses and would otherwise be replayed under
+            // the new sequence. Accounts will sign in again after this update, so a
+            // clean local slate is intentional: everything is re-hydrated from the
+            // server on the next login/sync.
+            //
+            // The per-business callout sequence lives in KV, not SQLite, and is
+            // deliberately left untouched so a reset can never reuse an existing
+            // server-side order number.
+            await db.execAsync(`
+          DELETE FROM sync_jobs;
+          DELETE FROM commands;
+          DELETE FROM events;
+          DELETE FROM entity_snapshots;
+          DELETE FROM orders;
+          DELETE FROM reference_data;
+        `);
+        },
+    },
 ];

package/dist/db/operations.js

@@ -384,7 +384,7 @@ export async function upsertServerOrder(db, order, opts = {}) {
  * replaying an older snapshot can never overwrite a newer local status.
  */
 export async function listOrdersWithHlc(db, businessId, limit = 200) {
-    const rows = await db.getAllAsync(`SELECT * FROM orders WHERE business_id = ? AND deleted_at IS NULL ORDER BY inserted_at DESC LIMIT ?;`, businessId, limit);
+    const rows = await db.getAllAsync(`SELECT * FROM orders WHERE business_id = ? AND deleted_at IS NULL ORDER BY inserted_at DESC, rowid DESC LIMIT ?;`, businessId, limit);
     return rows.map((row) => ({
         ...orderRowToSellerOrder(row),
         hlc: row.hlc ?? row.updated_at ?? row.inserted_at,
@@ -433,7 +433,7 @@ export async function listOrders(db, businessId, filters, page = 1, pageSize = 2
     const countRow = await db.getFirstAsync(`SELECT COUNT(*) as c FROM orders WHERE ${whereSql};`, ...args);
     const total = countRow?.c ?? 0;
     const offset = (page - 1) * pageSize;
-    const rows = await db.getAllAsync(`SELECT * FROM orders WHERE ${whereSql} ORDER BY inserted_at DESC LIMIT ? OFFSET ?;`, ...args, pageSize, offset);
+    const rows = await db.getAllAsync(`SELECT * FROM orders WHERE ${whereSql} ORDER BY inserted_at DESC, rowid DESC LIMIT ? OFFSET ?;`, ...args, pageSize, offset);
     return { data: rows.map(orderRowToSellerOrder), total };
 }
 export async function updateOrderStatus(db, businessId, orderId, toStatus, hlc) {

package/dist/domain/orders/order-flow.d.ts

@@ -33,9 +33,10 @@ export declare function getBusinessOrderFlowMode(businessId: string, db?: SQLite
 /**
  * Status a POS/business-app order starts in.
  *
- * Cash sales in direct flow are complete on creation. Anything that still
- * needs money (mobile money / card) must stay `awaiting_payment` first — the
- * backend moves it to `accepted` (staged) or `delivered` (direct) once the
+ * Cash sales in direct flow are complete on creation, except delivery orders:
+ * those must always enter the rider pipeline. Anything that still needs money
+ * (mobile money / card) must stay `awaiting_payment` first — the backend moves
+ * it to `accepted` (staged/delivery) or `delivered` (direct walk-in) once the
  * payment lands.
  */
-export declare function initialPosOrderStatus(paymentMethod: string | null | undefined, mode: OrderFlowMode): "accepted" | "awaiting_payment" | "delivered";
+export declare function initialPosOrderStatus(paymentMethod: string | null | undefined, mode: OrderFlowMode, orderType?: string | null | undefined): "accepted" | "awaiting_payment" | "delivered";

package/dist/domain/orders/order-flow.js

@@ -53,14 +53,17 @@ export async function getBusinessOrderFlowMode(businessId, db) {
 /**
  * Status a POS/business-app order starts in.
  *
- * Cash sales in direct flow are complete on creation. Anything that still
- * needs money (mobile money / card) must stay `awaiting_payment` first — the
- * backend moves it to `accepted` (staged) or `delivered` (direct) once the
+ * Cash sales in direct flow are complete on creation, except delivery orders:
+ * those must always enter the rider pipeline. Anything that still needs money
+ * (mobile money / card) must stay `awaiting_payment` first — the backend moves
+ * it to `accepted` (staged/delivery) or `delivered` (direct walk-in) once the
  * payment lands.
  */
-export function initialPosOrderStatus(paymentMethod, mode) {
+export function initialPosOrderStatus(paymentMethod, mode, orderType = "takeout") {
     const method = paymentMethod ?? "cash";
     if (method !== "cash")
         return "awaiting_payment";
+    if (orderType === "delivery")
+        return "accepted";
     return mode === "direct" ? "delivered" : "accepted";
 }

package/dist/domain/orders/service.js

@@ -80,6 +80,7 @@ export async function createLocalOrder(businessId, input) {
     // Offline validation mirror — backend Order.changeset rules, pre-commit.
     validateOrderCreateInput(input);
     const method = input.pos_payment_method ?? "cash";
+    const orderType = input.order_type ?? "takeout";
     // Business-configurable fulfilment flow (cached business profile, offline).
     // "direct" completes walk-in sales the moment they are rung up; "staged"
     // keeps accept → preparing → ready → completed.
@@ -144,8 +145,10 @@ export async function createLocalOrder(businessId, input) {
         id,
         order_number: orderNumber,
         callout_number: callout,
-        status: isPos ? initialPosOrderStatus(method, flowMode) : "pending",
-        order_type: input.order_type ?? "takeout",
+        status: isPos
+            ? initialPosOrderStatus(method, flowMode, orderType)
+            : "pending",
+        order_type: orderType,
         is_pos: isPos,
         customer_name: input.customer_name ?? null,
         customer_phone: input.customer_phone ?? null,
@@ -222,7 +225,10 @@ export async function transitionLocalOrder(businessId, orderId, action) {
             }
             else {
                 const flowMode = await getBusinessOrderFlowMode(businessId, db);
-                toStatus = flowMode === "direct" ? "delivered" : "accepted";
+                toStatus =
+                    flowMode === "direct" && order.order_type !== "delivery"
+                        ? "delivered"
+                        : "accepted";
             }
         }
         await updateOrderPayment(db, businessId, orderId, { is_paid: true, paid_at: new Date().toISOString() });

package/dist/printer/service.js

@@ -63,7 +63,7 @@ export async function printOrderReceipt(order, opts) {
     if (isTcp) {
         try {
             // Prefer backend escpos when we have a real UUID (not DD-RRR-CCC)
-            const isLocal = /^[0-9]{2}-[0-9]{3}-[0-9]{3}$/.test(order.order_number) || /^[0-9A-F-]{36}$/.test(order.id) === false && order.id === order.order_number;
+            const isLocal = /^[0-9]{2}-[0-9]{3,4}-[0-9]{3}$/.test(order.order_number) || /^[0-9A-F-]{36}$/.test(order.id) === false && order.id === order.order_number;
             if (!isLocal || order.id) {
                 try {
                     escpos = await fetchReceipt(order.id, "escpos");

package/dist/sync/command-queue.service.js

@@ -19,7 +19,7 @@ import { extractApiErrorCode } from "../utils/error";
 import { generateEventId } from "../utils/uuid";
 import { buildItemSnapshots, snapshotsToOrderLines } from "../domain/orders/snapshots";
 import { DEFAULT_ORDER_FLOW_MODE, getBusinessOrderFlowMode, initialPosOrderStatus, } from "../domain/orders/order-flow";
-import { generateLocalCalloutNumber, generateOrderNumberForBusiness, generateOrderNumber, } from "./order-number";
+import { generateLocalCalloutNumber, generateOrderNumberForBusiness, generateOrderNumber, parseOrderNumber, } from "./order-number";
 import { getConnectivityState, subscribeConnectivity } from "../adapters/connectivity";
 import { useAuthStore } from "../adapters/auth";
 import { canBusinessSync } from "./sync-guard";
@@ -121,6 +121,7 @@ function buildOptimisticOrder(command, payload, flowMode) {
     const currencyCode = payload.currency_code ?? "GHS";
     const now = new Date().toISOString();
     const method = payload.pos_payment_method ?? "cash";
+    const orderType = payload.order_type ?? "takeout";
     const isCash = method === "cash";
     const authUser = useAuthStore.getState().user;
     const teller = authUser
@@ -133,11 +134,15 @@ function buildOptimisticOrder(command, payload, flowMode) {
         }
         : null;
     const orderNumber = payload.order_number ?? generateOrderNumberForBusiness(command.business_id);
+    // Keep the optimistic callout in lock-step with the order number that was
+    // already generated by createLocalOrder. Calling the sequence peek here
+    // would point one order ahead.
+    const parsedCallout = parseOrderNumber(orderNumber)?.callout;
     return {
         id: command.entity_id ?? command.command_id,
         order_number: orderNumber,
-        callout_number: generateLocalCalloutNumber(command.business_id),
-        order_type: payload.order_type ?? "takeout",
+        callout_number: parsedCallout ? Number(parsedCallout) : generateLocalCalloutNumber(command.business_id),
+        order_type: orderType,
         is_pos: true,
         customer_name: payload.customer_name ?? null,
         customer_phone: payload.customer_phone ?? null,
@@ -146,7 +151,7 @@ function buildOptimisticOrder(command, payload, flowMode) {
         // Must match createLocalOrder: direct-flow cash sales are born delivered,
         // even when the command is parked in the offline outbox. Hardcoding
         // "accepted" made a completed sale show up on the preparing board.
-        status: initialPosOrderStatus(method, flowMode),
+        status: initialPosOrderStatus(method, flowMode, orderType),
         delivery_id: null,
         delivery_status: null,
         is_paid: isCash,
@@ -437,7 +442,7 @@ class CommandQueueService {
                     try {
                         const payload = command.payload;
                         const on = payload.order_number;
-                        const parsed = on ? on.match(/^([0-9]{2})-([0-9]{3})-([0-9]{3})$/) : null;
+                        const parsed = on ? on.match(/^([0-9]{2})-([0-9]{3,4})-([0-9]{3})$/) : null;
                         if (parsed) {
                             const deviceNumber = parsed[1];
                             const { orderNumber: newOn } = generateOrderNumber(deviceNumber, command.business_id);

package/dist/sync/order-number.d.ts

@@ -1,15 +1,22 @@
 /**
- * Universal order number: DD-RRR-CCC (10 chars)
+ * Universal order number: DD-NNNN-MMM (11 chars)
  * DD = device number 01-99 (leased per business)
- * RRR = random 100-999 per order (crypto)
- * CCC = callout 001-999 global monotonic per device, wraps to 001 (new RRR on wrap)
- * Example: "10-123-001"
+ * NNNN = block number 0001-9999, increments after MMM reaches 999
+ * MMM = order sequence 001-999 inside the current block
+ *
+ * Examples: "10-0001-001" ... "10-0001-999", "10-0002-001".
+ *
+ * The sequence is persisted per business (per device install), so it survives
+ * restarts. Legacy DD-RRR-CCC numbers (7-digit order part) are still accepted
+ * when reading old rows; only new numbers use the block format.
  */
+/** Current (last generated) callout number, for receipt/display fallbacks. */
 export declare function peekCallout(businessId?: string | null): number;
 export declare function generateOrderNumber(deviceNumber: string, businessId?: string | null): {
     orderNumber: string;
     callout: number;
-    random: number;
+    block: number;
+    sequence: number;
 };
 export declare function generateLocalOrderNumber(): string;
 export declare function generateOrderNumberForBusiness(businessId: string): string;
@@ -18,7 +25,7 @@ export declare function isLocalOrderNumber(orderNumber: string): boolean;
 export declare function isOfflineOrderNumber(orderNumber: string): boolean;
 export declare function parseOrderNumber(orderNumber: string): {
     deviceNumber: string;
-    random: string;
+    block: string;
     callout: string;
 } | null;
 export declare function resetCalloutForTests(businessId?: string | null): void;

package/dist/sync/order-number.js

@@ -1,60 +1,67 @@
 /**
- * Universal order number: DD-RRR-CCC (10 chars)
+ * Universal order number: DD-NNNN-MMM (11 chars)
  * DD = device number 01-99 (leased per business)
- * RRR = random 100-999 per order (crypto)
- * CCC = callout 001-999 global monotonic per device, wraps to 001 (new RRR on wrap)
- * Example: "10-123-001"
+ * NNNN = block number 0001-9999, increments after MMM reaches 999
+ * MMM = order sequence 001-999 inside the current block
+ *
+ * Examples: "10-0001-001" ... "10-0001-999", "10-0002-001".
+ *
+ * The sequence is persisted per business (per device install), so it survives
+ * restarts. Legacy DD-RRR-CCC numbers (7-digit order part) are still accepted
+ * when reading old rows; only new numbers use the block format.
  */
 import { getItemSync as getItem, setItemSync as setItem } from "../adapters/kv";
 const CALLOUT_SEQ_KEY = "teinc_callout_seq";
-const ORDER_RANDOM_KEY = "teinc_last_random"; // last RRR for wrap logic debug
-function cryptoRandom100to999() {
-    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-        const arr = new Uint32Array(1);
-        crypto.getRandomValues(arr);
-        return 100 + (arr[0] % 900);
-    }
-    return 100 + Math.floor(Math.random() * 900);
-}
+const ORDERS_PER_BLOCK = 999;
+const MAX_BLOCKS = 9999;
+const MAX_SEQUENCE = ORDERS_PER_BLOCK * MAX_BLOCKS;
 function calloutKeyForBusiness(businessId) {
     return businessId ? `${CALLOUT_SEQ_KEY}:${businessId}` : CALLOUT_SEQ_KEY;
 }
-function getNextCallout(businessId) {
+/** Last consumed sequence number for this business (0 when brand new). */
+function getStoredSequence(businessId) {
+    const key = calloutKeyForBusiness(businessId);
+    // Per-business isolation matters: the legacy global key is a mirror only,
+    // never the starting point for another business (that would leak a
+    // sequence across tenants on the same install).
+    return Number(getItem(key) ?? 0) || 0;
+}
+function sequenceParts(sequence) {
+    const zero = Math.max(0, sequence - 1);
+    return {
+        block: Math.floor(zero / ORDERS_PER_BLOCK) + 1,
+        callout: (zero % ORDERS_PER_BLOCK) + 1,
+    };
+}
+function getNextSequence(businessId) {
     const key = calloutKeyForBusiness(businessId);
-    const stored = getItem(key);
-    let next = (stored ?? 0) + 1;
-    if (next > 999)
-        next = 1;
+    const next = getStoredSequence(businessId) + 1;
+    if (next > MAX_SEQUENCE) {
+        throw new Error(`Order number sequence exhausted for business ${businessId ?? "global"}`);
+    }
     setItem(key, next);
-    // migrate legacy global once: keep global in sync for backward compat
+    // Keep the legacy global key in sync for older readers, but never let a
+    // different business reset it downwards.
     if (businessId) {
-        const legacy = getItem(CALLOUT_SEQ_KEY) ?? 0;
+        const legacy = Number(getItem(CALLOUT_SEQ_KEY) ?? 0) || 0;
         if (legacy < next)
             setItem(CALLOUT_SEQ_KEY, next);
     }
     return next;
 }
+/** Current (last generated) callout number, for receipt/display fallbacks. */
 export function peekCallout(businessId) {
-    const key = calloutKeyForBusiness(businessId);
-    const v = getItem(key);
-    if (v != null)
-        return v;
-    const legacy = getItem(CALLOUT_SEQ_KEY);
-    return legacy ?? 0;
+    const stored = getStoredSequence(businessId);
+    return stored > 0 ? sequenceParts(stored).callout : 0;
 }
 export function generateOrderNumber(deviceNumber, businessId) {
     if (!/^(0[1-9]|[1-9][0-9])$/.test(deviceNumber)) {
         throw new Error(`Invalid deviceNumber ${deviceNumber} — must be 01-99`);
     }
-    const callout = getNextCallout(businessId);
-    let random = cryptoRandom100to999();
-    // On wrap to 001, ensure new random (already new per order, but keep hook)
-    if (callout === 1) {
-        random = cryptoRandom100to999();
-    }
-    setItem(ORDER_RANDOM_KEY, random);
-    const orderNumber = `${deviceNumber}-${String(random).padStart(3, "0")}-${String(callout).padStart(3, "0")}`;
-    return { orderNumber, callout, random };
+    const sequence = getNextSequence(businessId);
+    const { block, callout } = sequenceParts(sequence);
+    const orderNumber = `${deviceNumber}-${String(block).padStart(4, "0")}-${String(callout).padStart(3, "0")}`;
+    return { orderNumber, callout, block, sequence };
 }
 // No legacy fallback — 0.7.0 requires business-scoped device lease via device-lease.service.
 // Kept for internal compat only; callers must supply businessId via generateOrderNumberForBusiness.
@@ -70,22 +77,28 @@ export function generateOrderNumberForBusiness(businessId) {
     return generateOrderNumber(v, businessId).orderNumber;
 }
 export function generateLocalCalloutNumber(businessId) {
-    // kept for SellerOrder.callout_number compatibility — returns next CCC
-    const next = peekCallout(businessId) + 1;
-    return next > 999 ? 1 : next;
+    // Kept for SellerOrder.callout_number compatibility — returns the callout
+    // that the next generated order will use, without consuming it.
+    const sequence = getStoredSequence(businessId) + 1;
+    return sequenceParts(sequence).callout;
 }
-// New canonical check — unified for DD-RRR-CCC
+// Accept both the new DD-NNNN-MMM format and legacy DD-RRR-CCC rows.
 export function isLocalOrderNumber(orderNumber) {
-    return /^[0-9]{2}-[0-9]{3}-[0-9]{3}$/.test(orderNumber);
+    return /^[0-9]{2}-[0-9]{3,4}-[0-9]{3}$/.test(orderNumber);
 }
 export function isOfflineOrderNumber(orderNumber) {
     return isLocalOrderNumber(orderNumber);
 }
 export function parseOrderNumber(orderNumber) {
-    const m = orderNumber.match(/^([0-9]{2})-([0-9]{3})-([0-9]{3})$/);
+    const m = orderNumber.match(/^([0-9]{2})-([0-9]{3,4})-([0-9]{3})$/);
     if (!m)
         return null;
-    return { deviceNumber: m[1], random: m[2], callout: m[3] };
+    return {
+        deviceNumber: m[1],
+        // Normalise legacy 3-digit middles to the new 4-digit block shape.
+        block: m[2].padStart(4, "0"),
+        callout: m[3],
+    };
 }
 // Test helpers
 export function resetCalloutForTests(businessId) {

package/dist/sync/pending-orders.service.d.ts

@@ -27,16 +27,6 @@ export declare function registerPendingOrdersInvalidator(fn: () => void): () =>
  * pipeline, so peers' UIs converge without waiting for a cloud echo.
  */
 export declare function notifyPendingOrdersChanged(): void;
-/**
- * Merge optimistic (queued, unconfirmed) state into a page of listed orders.
- * Called by list queryFns (page 1 only) so offline work is visible:
- *  1. Pending creations (order.create_queued, local or LAN) missing from the
- *     SQLite page are prepended — deduped by id/order_number.
- *  2. Queued transitions only patch the snapshot read model, never the
- *     orders table — overlay snapshot statuses onto base rows so the list
- *     reflects the queued status immediately (converges on replay).
- * Reactivity comes from the invalidator: every apply path above refetches.
- */
 export declare function mergePendingIntoList(base: SellerOrder[], businessId: string, page: number): Promise<SellerOrder[]>;
 /**
  * Load persisted unsynced order:create_queued events into the store.

package/dist/sync/pending-orders.service.js

@@ -70,6 +70,9 @@ export function notifyPendingOrdersChanged() {
  *     reflects the queued status immediately (converges on replay).
  * Reactivity comes from the invalidator: every apply path above refetches.
  */
+function sortByCreatedDesc(orders) {
+    return [...orders].sort((a, b) => String(b.inserted_at ?? "").localeCompare(String(a.inserted_at ?? "")));
+}
 export async function mergePendingIntoList(base, businessId, page) {
     if (page !== 1)
         return base;
@@ -88,7 +91,7 @@ export async function mergePendingIntoList(base, businessId, page) {
         const db = await openSyncDatabase();
         const snaps = await getEntitySnapshotsByType(db, "seller_orders", businessId);
         if (!snaps.length)
-            return merged;
+            return sortByCreatedDesc(merged);
         const statusById = new Map();
         for (const s of snaps) {
             const arr = s.payload?.data ?? [];
@@ -98,7 +101,7 @@ export async function mergePendingIntoList(base, businessId, page) {
             }
         }
         if (!statusById.size)
-            return merged;
+            return sortByCreatedDesc(merged);
         let patched = false;
         merged = merged.map((o) => {
             const want = statusById.get(String(o.id));
@@ -113,7 +116,7 @@ export async function mergePendingIntoList(base, businessId, page) {
         }
     }
     catch { }
-    return merged;
+    return sortByCreatedDesc(merged);
 }
 /**
  * Load persisted unsynced order:create_queued events into the store.

package/dist/sync/sync-jobs.service.js

@@ -481,7 +481,7 @@ export async function drainOne(businessId, entityId) {
         const is409 = rest.status === 409 && rest.code === "ORDER_NUMBER_TAKEN";
         if (is409) {
             const on = (payload.order_number ?? payload.local_order_number);
-            const parsed = on ? String(on).match(/^([0-9]{2})-([0-9]{3})-([0-9]{3})$/) : null;
+            const parsed = on ? String(on).match(/^([0-9]{2})-([0-9]{3,4})-([0-9]{3})$/) : null;
             if (parsed) {
                 const newOn = generateOrderNumber(parsed[1], businessId).orderNumber;
                 const newPayload = { ...payload, order_number: newOn, local_order_number: newOn };

package/dist/sync/use-sync-reconciliation.js

@@ -25,7 +25,7 @@ function isLocalOrderEvent(event) {
     if (!payload)
         return false;
     const localOrderNumber = payload.local_order_number;
-    return typeof localOrderNumber === "string" && /^[0-9]{2}-[0-9]{3}-[0-9]{3}$/.test(localOrderNumber);
+    return typeof localOrderNumber === "string" && /^[0-9]{2}-[0-9]{3,4}-[0-9]{3}$/.test(localOrderNumber);
 }
 const RECONCILE_DEBOUNCE_MS = 400;
 export function useSyncReconciliation() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teincfood/core",
-  "version": "0.10.21",
+  "version": "0.10.22",
   "description": "TeincFood shared offline-first core — types, sync engine, local DB, reference data, and repositories for mobile + desktop",
   "type": "module",
   "main": "dist/index.js",