@teincfood/core 0.7.8 → 0.8.0

package/dist/adapters/services.d.ts

@@ -2,25 +2,16 @@
  * Service stubs for pos/seller/kiosk/menu/business/roles.
  * Host apps can replace via setServiceImpls; core defaults to no-op that throws helpful error.
  */
+import type { SellerOrdersResponse, SellerOrderDetailResponse, BusinessDeliveriesResponse } from "../types/api/seller.api";
+import type { PlaceSuggestion, PlaceDetails } from "../types/places";
 export declare const posService: {
-    createPOSOrder: (_businessId: string, _payload: unknown) => Promise<{
-        data: unknown;
-    }>;
     fetchPOSOrderPreview: (_businessId: string, _payload: unknown) => Promise<unknown>;
-    fetchBusinessOrders: (_businessId: string, _params?: unknown) => Promise<unknown>;
+    fetchBusinessOrders: (_businessId: string, _params?: Record<string, string>) => Promise<SellerOrdersResponse>;
 };
 export declare const sellerService: {
-    fetchBusinessOrders: (_businessId: string, _params?: Record<string, unknown>) => Promise<{
-        data: unknown[];
-        pagination: unknown;
-    }>;
-    fetchSellerOrder: (_orderId: string) => Promise<{
-        data: unknown;
-    }>;
-    fetchBusinessDeliveries: (_businessId: string, _params?: Record<string, unknown>) => Promise<{
-        data: unknown[];
-        pagination: unknown;
-    }>;
+    fetchBusinessOrders: (_businessId: string, _params?: Record<string, unknown>) => Promise<SellerOrdersResponse>;
+    fetchSellerOrder: (_orderId: string) => Promise<SellerOrderDetailResponse>;
+    fetchBusinessDeliveries: (_businessId: string, _params?: Record<string, unknown>) => Promise<BusinessDeliveriesResponse>;
     acceptOrder: (_orderId: string) => Promise<{
         data: unknown;
     }>;
@@ -40,6 +31,9 @@ export declare const sellerService: {
         data: unknown;
     }>;
     confirmHandover: (_deliveryId: string) => Promise<unknown>;
+    confirmCashPayment: (_orderId: string) => Promise<{
+        data: unknown;
+    }>;
 };
 export declare const kioskService: {
     assignKioskOrderToRider: (_orderId: string, _riderId: string) => Promise<unknown>;
@@ -51,10 +45,23 @@ export declare const menuService: {
     updateMenuItem: (_itemId: string, _payload: Record<string, unknown>) => Promise<unknown>;
     deleteMenuItem: (_itemId: string) => Promise<unknown>;
     createCategory: (_businessId: string, _payload: Record<string, unknown>) => Promise<unknown>;
+    updateCategory: (_categoryId: string, _payload: Record<string, unknown>) => Promise<unknown>;
+    deleteCategory: (_categoryId: string) => Promise<unknown>;
 };
 export declare const businessService: {
     fetchBusinessMembers: (_businessId: string) => Promise<unknown>;
+    inviteBusinessMember: (_businessId: string, _data: Record<string, unknown>) => Promise<unknown>;
+    removeBusinessMember: (_businessId: string, _userId: string) => Promise<unknown>;
+    fetchBusinessMemberInvitations: (_businessId: string) => Promise<unknown>;
+    revokeBusinessMemberInvitation: (_businessId: string, _invitationId: string) => Promise<unknown>;
+    deleteBusinessMemberInvitation: (_businessId: string, _invitationId: string) => Promise<unknown>;
+    fetchUserInvitations: () => Promise<unknown>;
+    leaveBusiness: (_invitationId: string) => Promise<unknown>;
+    acceptBusinessInvitation: (_data: Record<string, unknown>) => Promise<unknown>;
     fetchBusinessTaxRules: (_businessId: string) => Promise<unknown>;
+    createBusinessTaxRule: (_businessId: string, _data: Record<string, unknown>) => Promise<unknown>;
+    updateTaxRule: (_id: string, _data: Record<string, unknown>) => Promise<unknown>;
+    deleteTaxRule: (_id: string) => Promise<unknown>;
     fetchBusinessById: (_businessId: string) => Promise<unknown>;
     fetchOperatingHours: (_businessId: string) => Promise<unknown>;
     fetchMyBusinessMembership: (_businessId: string) => Promise<unknown>;
@@ -62,6 +69,83 @@ export declare const businessService: {
 export declare const rolesService: {
     fetchBusinessRoles: () => Promise<unknown>;
 };
+export declare const walletService: {
+    fetchAllBalances: () => Promise<unknown>;
+    fetchBusinessWalletBalance: (_businessId: string) => Promise<unknown>;
+    fetchWalletHistory: (_params: {
+        businessId?: string;
+        page?: number;
+        pageSize?: number;
+    }) => Promise<unknown>;
+};
+export declare const deliveryService: {
+    fetchBusinessDeliveries: (_businessId: string, _params?: Record<string, unknown>) => Promise<unknown>;
+    fetchDeliveryDetail: (_deliveryId: string) => Promise<unknown>;
+};
+export declare const dashboardService: {
+    fetchSellerDashboard: (_businessId: string) => Promise<unknown>;
+};
+export declare const analyticsService: {
+    fetchSellerAnalytics: (_businessId: string, _period?: string) => Promise<unknown>;
+    fetchRevenueSummary: (_businessId: string, _period?: string) => Promise<unknown>;
+};
+export declare const placesService: {
+    searchPlaces: (_query: string, _lat?: number, _lng?: number) => Promise<PlaceSuggestion[]>;
+    getPlaceDetails: (_placeId: string) => Promise<PlaceDetails | null>;
+    clearCache: () => Promise<void>;
+};
+export declare const fleetService: {
+    fetchFleetRiders: (_businessId?: string, _page?: number, _pageSize?: number, _filters?: unknown) => Promise<unknown>;
+    fetchFleetRider: (_riderId: string, _businessId?: string) => Promise<unknown>;
+    inviteRider: (_data: Record<string, unknown>, _businessId?: string) => Promise<unknown>;
+    approveRider: (_riderId: string, _businessId?: string) => Promise<unknown>;
+    suspendRider: (_riderId: string, _businessId?: string) => Promise<unknown>;
+    activateRider: (_riderId: string, _businessId?: string) => Promise<unknown>;
+    fetchRiderKyc: (_riderId: string, _businessId?: string) => Promise<unknown>;
+    fetchJoinRequests: (_businessId?: string) => Promise<unknown>;
+    approveJoinRequest: (_requestId: string, _businessId?: string) => Promise<unknown>;
+    rejectJoinRequest: (_requestId: string, _businessId?: string) => Promise<unknown>;
+    fetchInvitations: (_businessId?: string) => Promise<unknown>;
+    revokeInvitation: (_invitationId: string, _businessId?: string) => Promise<unknown>;
+    fetchFleetVehicles: (_businessId?: string) => Promise<unknown>;
+    addVehicle: (_data: Record<string, unknown>, _businessId?: string) => Promise<unknown>;
+    removeVehicle: (_vehicleId: string, _businessId?: string) => Promise<unknown>;
+    fetchFleetDashboard: (_businessId?: string) => Promise<unknown>;
+};
+export declare const riderService: {
+    fetchRiderProfile: () => Promise<unknown>;
+    updateRiderProfile: (_data: Record<string, unknown>) => Promise<unknown>;
+    updateOnlineStatus: (_isOnline: boolean) => Promise<unknown>;
+    fetchRiderMetrics: () => Promise<unknown>;
+    fetchRiderDashboard: () => Promise<unknown>;
+    fetchRiderStatistics: () => Promise<unknown>;
+    fetchAvailableOrders: () => Promise<unknown>;
+    acceptDelivery: (_orderId: string) => Promise<unknown>;
+    selfAssignDelivery: (_orderId: string) => Promise<unknown>;
+    fetchActiveDelivery: () => Promise<unknown>;
+    fetchRiderDeliveries: (_page: number, _pageSize: number, _filters?: Record<string, unknown>) => Promise<unknown>;
+    fetchDeliveryDetail: (_deliveryId: string) => Promise<unknown>;
+    markDeliveryInTransit: (_deliveryId: string) => Promise<unknown>;
+    markDeliveryArrived: (_deliveryId: string) => Promise<unknown>;
+    markDeliveryDelivered: (_deliveryId: string) => Promise<unknown>;
+    markDeliveryFailed: (_deliveryId: string) => Promise<unknown>;
+    markDeliveryReturned: (_deliveryId: string) => Promise<unknown>;
+    confirmDeliveryPickup: (_deliveryId: string) => Promise<unknown>;
+    confirmDeliveryHandover: (_deliveryId: string) => Promise<unknown>;
+    fetchRiderEarnings: () => Promise<unknown>;
+    fetchEarningsBreakdown: () => Promise<unknown>;
+    fetchRiderEarningsSummary: (_period: string) => Promise<unknown>;
+    fetchWalletHistory: (_page?: number, _pageSize?: number) => Promise<unknown>;
+    fetchVehicleInfo: () => Promise<unknown>;
+    createVehicle: (_data: unknown) => Promise<unknown>;
+    fetchDeliveryZones: () => Promise<unknown>;
+    updateDeliveryZones: (_zones: unknown) => Promise<unknown>;
+    toggleDeliveryZone: (_zoneId: string, _enabled: boolean) => Promise<unknown>;
+    fetchNavigationSettings: () => Promise<unknown>;
+    updateNavigationSettings: (_settings: unknown) => Promise<unknown>;
+    fetchNavigationApps: () => Promise<unknown>;
+    fetchVehicleTypes: () => Promise<unknown>;
+};
 export declare function getRegionConfig(_countryCode?: string): {
     currencyCode: string;
 };

package/dist/adapters/services.js

@@ -5,11 +5,10 @@
 function notImpl(name) {
     throw new Error(`Service ${name} not injected. Wire via adapters/services.ts or setHttpClient.`);
 }
-// pos.service
+// pos.service — NOTE: no createPOSOrder slot. Order creation has exactly one
+// path: createLocalOrder (domain/orders/service). Direct-REST creation was
+// removed so the operating-hours gate can never be bypassed.
 export const posService = {
-    createPOSOrder: async (_businessId, _payload) => {
-        notImpl("posService.createPOSOrder");
-    },
     fetchPOSOrderPreview: async (_businessId, _payload) => {
         notImpl("posService.fetchPOSOrderPreview");
     },
@@ -49,6 +48,9 @@ export const sellerService = {
     confirmHandover: async (_deliveryId) => {
         notImpl("sellerService.confirmHandover");
     },
+    confirmCashPayment: async (_orderId) => {
+        notImpl("sellerService.confirmCashPayment");
+    },
 };
 // kiosk.service
 export const kioskService = {
@@ -76,14 +78,53 @@ export const menuService = {
     createCategory: async (_businessId, _payload) => {
         notImpl("menuService.createCategory");
     },
+    updateCategory: async (_categoryId, _payload) => {
+        notImpl("menuService.updateCategory");
+    },
+    deleteCategory: async (_categoryId) => {
+        notImpl("menuService.deleteCategory");
+    },
 };
 export const businessService = {
     fetchBusinessMembers: async (_businessId) => {
         notImpl("businessService.fetchBusinessMembers");
     },
+    inviteBusinessMember: async (_businessId, _data) => {
+        notImpl("businessService.inviteBusinessMember");
+    },
+    removeBusinessMember: async (_businessId, _userId) => {
+        notImpl("businessService.removeBusinessMember");
+    },
+    fetchBusinessMemberInvitations: async (_businessId) => {
+        notImpl("businessService.fetchBusinessMemberInvitations");
+    },
+    revokeBusinessMemberInvitation: async (_businessId, _invitationId) => {
+        notImpl("businessService.revokeBusinessMemberInvitation");
+    },
+    deleteBusinessMemberInvitation: async (_businessId, _invitationId) => {
+        notImpl("businessService.deleteBusinessMemberInvitation");
+    },
+    fetchUserInvitations: async () => {
+        notImpl("businessService.fetchUserInvitations");
+    },
+    leaveBusiness: async (_invitationId) => {
+        notImpl("businessService.leaveBusiness");
+    },
+    acceptBusinessInvitation: async (_data) => {
+        notImpl("businessService.acceptBusinessInvitation");
+    },
     fetchBusinessTaxRules: async (_businessId) => {
         notImpl("businessService.fetchBusinessTaxRules");
     },
+    createBusinessTaxRule: async (_businessId, _data) => {
+        notImpl("businessService.createBusinessTaxRule");
+    },
+    updateTaxRule: async (_id, _data) => {
+        notImpl("businessService.updateTaxRule");
+    },
+    deleteTaxRule: async (_id) => {
+        notImpl("businessService.deleteTaxRule");
+    },
     fetchBusinessById: async (_businessId) => {
         notImpl("businessService.fetchBusinessById");
     },
@@ -99,6 +140,205 @@ export const rolesService = {
         notImpl("rolesService.fetchBusinessRoles");
     },
 };
+// wallet.service — balances + history (hosts inject axios impls)
+export const walletService = {
+    fetchAllBalances: async () => {
+        notImpl("walletService.fetchAllBalances");
+    },
+    fetchBusinessWalletBalance: async (_businessId) => {
+        notImpl("walletService.fetchBusinessWalletBalance");
+    },
+    fetchWalletHistory: async (_params) => {
+        notImpl("walletService.fetchWalletHistory");
+    },
+};
+// delivery.service — business deliveries (hosts inject axios impls)
+export const deliveryService = {
+    fetchBusinessDeliveries: async (_businessId, _params) => {
+        notImpl("deliveryService.fetchBusinessDeliveries");
+    },
+    fetchDeliveryDetail: async (_deliveryId) => {
+        notImpl("deliveryService.fetchDeliveryDetail");
+    },
+};
+// dashboard.service — seller dashboard (hosts inject axios impls)
+export const dashboardService = {
+    fetchSellerDashboard: async (_businessId) => {
+        notImpl("dashboardService.fetchSellerDashboard");
+    },
+};
+// analytics.service — seller analytics + revenue (hosts inject axios impls)
+export const analyticsService = {
+    fetchSellerAnalytics: async (_businessId, _period) => {
+        notImpl("analyticsService.fetchSellerAnalytics");
+    },
+    fetchRevenueSummary: async (_businessId, _period) => {
+        notImpl("analyticsService.fetchRevenueSummary");
+    },
+};
+// places.service — place autocomplete/details (hosts inject axios impls)
+export const placesService = {
+    searchPlaces: async (_query, _lat, _lng) => {
+        notImpl("placesService.searchPlaces");
+        return [];
+    },
+    getPlaceDetails: async (_placeId) => {
+        notImpl("placesService.getPlaceDetails");
+        return null;
+    },
+    clearCache: async () => {
+        notImpl("placesService.clearCache");
+    },
+};
+// fleet.service — fleet management (hosts inject axios impls)
+export const fleetService = {
+    fetchFleetRiders: async (_businessId, _page, _pageSize, _filters) => {
+        notImpl("fleetService.fetchFleetRiders");
+    },
+    fetchFleetRider: async (_riderId, _businessId) => {
+        notImpl("fleetService.fetchFleetRider");
+    },
+    inviteRider: async (_data, _businessId) => {
+        notImpl("fleetService.inviteRider");
+    },
+    approveRider: async (_riderId, _businessId) => {
+        notImpl("fleetService.approveRider");
+    },
+    suspendRider: async (_riderId, _businessId) => {
+        notImpl("fleetService.suspendRider");
+    },
+    activateRider: async (_riderId, _businessId) => {
+        notImpl("fleetService.activateRider");
+    },
+    fetchRiderKyc: async (_riderId, _businessId) => {
+        notImpl("fleetService.fetchRiderKyc");
+    },
+    fetchJoinRequests: async (_businessId) => {
+        notImpl("fleetService.fetchJoinRequests");
+    },
+    approveJoinRequest: async (_requestId, _businessId) => {
+        notImpl("fleetService.approveJoinRequest");
+    },
+    rejectJoinRequest: async (_requestId, _businessId) => {
+        notImpl("fleetService.rejectJoinRequest");
+    },
+    fetchInvitations: async (_businessId) => {
+        notImpl("fleetService.fetchInvitations");
+    },
+    revokeInvitation: async (_invitationId, _businessId) => {
+        notImpl("fleetService.revokeInvitation");
+    },
+    fetchFleetVehicles: async (_businessId) => {
+        notImpl("fleetService.fetchFleetVehicles");
+    },
+    addVehicle: async (_data, _businessId) => {
+        notImpl("fleetService.addVehicle");
+    },
+    removeVehicle: async (_vehicleId, _businessId) => {
+        notImpl("fleetService.removeVehicle");
+    },
+    fetchFleetDashboard: async (_businessId) => {
+        notImpl("fleetService.fetchFleetDashboard");
+    },
+};
+export const riderService = {
+    fetchRiderProfile: async () => {
+        notImpl("riderService.fetchRiderProfile");
+    },
+    updateRiderProfile: async (_data) => {
+        notImpl("riderService.updateRiderProfile");
+    },
+    updateOnlineStatus: async (_isOnline) => {
+        notImpl("riderService.updateOnlineStatus");
+    },
+    fetchRiderMetrics: async () => {
+        notImpl("riderService.fetchRiderMetrics");
+    },
+    fetchRiderDashboard: async () => {
+        notImpl("riderService.fetchRiderDashboard");
+    },
+    fetchRiderStatistics: async () => {
+        notImpl("riderService.fetchRiderStatistics");
+    },
+    fetchAvailableOrders: async () => {
+        notImpl("riderService.fetchAvailableOrders");
+    },
+    acceptDelivery: async (_orderId) => {
+        notImpl("riderService.acceptDelivery");
+    },
+    selfAssignDelivery: async (_orderId) => {
+        notImpl("riderService.selfAssignDelivery");
+    },
+    fetchActiveDelivery: async () => {
+        notImpl("riderService.fetchActiveDelivery");
+    },
+    fetchRiderDeliveries: async (_page, _pageSize, _filters) => {
+        notImpl("riderService.fetchRiderDeliveries");
+    },
+    fetchDeliveryDetail: async (_deliveryId) => {
+        notImpl("riderService.fetchDeliveryDetail");
+    },
+    markDeliveryInTransit: async (_deliveryId) => {
+        notImpl("riderService.markDeliveryInTransit");
+    },
+    markDeliveryArrived: async (_deliveryId) => {
+        notImpl("riderService.markDeliveryArrived");
+    },
+    markDeliveryDelivered: async (_deliveryId) => {
+        notImpl("riderService.markDeliveryDelivered");
+    },
+    markDeliveryFailed: async (_deliveryId) => {
+        notImpl("riderService.markDeliveryFailed");
+    },
+    markDeliveryReturned: async (_deliveryId) => {
+        notImpl("riderService.markDeliveryReturned");
+    },
+    confirmDeliveryPickup: async (_deliveryId) => {
+        notImpl("riderService.confirmDeliveryPickup");
+    },
+    confirmDeliveryHandover: async (_deliveryId) => {
+        notImpl("riderService.confirmDeliveryHandover");
+    },
+    fetchRiderEarnings: async () => {
+        notImpl("riderService.fetchRiderEarnings");
+    },
+    fetchEarningsBreakdown: async () => {
+        notImpl("riderService.fetchEarningsBreakdown");
+    },
+    fetchRiderEarningsSummary: async (_period) => {
+        notImpl("riderService.fetchRiderEarningsSummary");
+    },
+    fetchWalletHistory: async (_page, _pageSize) => {
+        notImpl("riderService.fetchWalletHistory");
+    },
+    fetchVehicleInfo: async () => {
+        notImpl("riderService.fetchVehicleInfo");
+    },
+    createVehicle: async (_data) => {
+        notImpl("riderService.createVehicle");
+    },
+    fetchDeliveryZones: async () => {
+        notImpl("riderService.fetchDeliveryZones");
+    },
+    updateDeliveryZones: async (_zones) => {
+        notImpl("riderService.updateDeliveryZones");
+    },
+    toggleDeliveryZone: async (_zoneId, _enabled) => {
+        notImpl("riderService.toggleDeliveryZone");
+    },
+    fetchNavigationSettings: async () => {
+        notImpl("riderService.fetchNavigationSettings");
+    },
+    updateNavigationSettings: async (_settings) => {
+        notImpl("riderService.updateNavigationSettings");
+    },
+    fetchNavigationApps: async () => {
+        notImpl("riderService.fetchNavigationApps");
+    },
+    fetchVehicleTypes: async () => {
+        notImpl("riderService.fetchVehicleTypes");
+    },
+};
 // region pricing + location stubs for currency utils
 export function getRegionConfig(_countryCode) {
     return { currencyCode: "GHS" };

package/dist/auth/session.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Session lifecycle — single source for access-expired → refresh →
+ * refresh-expired → logout across all host apps.
+ *
+ * Backend contract (verified against TeincFoodBackend):
+ * - expired ACCESS token  → 401 + error.code "TOKEN_EXPIRED" (recoverable:
+ *   refresh once, retry the call)
+ * - expired/invalid REFRESH token → 401 + error.code "REFRESH_FAILED"
+ *   ("Token has expired") or sibling session codes (not recoverable:
+ *   clear auth → host routes to login)
+ *
+ * Host HTTP layers (axios interceptors, fetch wrappers) must NOT implement
+ * their own refresh: they attach tokens + normalize errors, then delegate
+ * classification to isAccessExpired/isSessionDead and recovery to
+ * refreshSession()/clearAuth() here. refreshSession is single-flight because
+ * the backend rotates refresh tokens — two concurrent refreshes with the
+ * same token revoke each other and 401 the session.
+ */
+/** Access token expired — recoverable via one refresh + retry. */
+export declare const ACCESS_EXPIRED_CODE = "TOKEN_EXPIRED";
+/**
+ * Refresh/session dead — not recoverable, the user must sign in again.
+ * Canonical set from the backend auth contract; keep in sync with
+ * auth_controller.ex (REFRESH_FAILED) and plugs/auth.ex.
+ */
+export declare const SESSION_DEAD_CODES: readonly ["REFRESH_FAILED", "TOKEN_INVALID", "SESSION_EXPIRED", "UNAUTHORIZED", "ACCOUNT_DISABLED"];
+export interface AuthFailure {
+    status?: number;
+    code?: string;
+    message?: string;
+}
+/**
+ * Normalize any error shape into { status, code, message }.
+ * Handles: core ApiError ({status, code}), raw axios errors
+ * ({response.status, response.data.error.code}), and host ApiError
+ * wrappers ({status, data.error.code}). Transport codes (ERR_NETWORK,
+ * ECONNABORTED, OFFLINE, …) are never backend codes and are dropped —
+ * only UPPER_SNAKE body codes classify.
+ */
+export declare function extractAuthFailure(e: unknown): AuthFailure;
+/** 401 + TOKEN_EXPIRED: access token dead, refresh may recover. */
+export declare function isAccessExpired(f: AuthFailure): boolean;
+/**
+ * 401/403 + session-dead code: refresh token dead, logout required.
+ * A 401 WITHOUT a code (proxy/gateway/HTML) is never session-dead — the
+ * app keeps working offline instead of logging the user out mid-shift.
+ */
+export declare function isSessionDead(f: AuthFailure): boolean;
+export interface SessionTokens {
+    access_token: string;
+    refresh_token: string;
+}
+/**
+ * Marker key for the refresh call's request config. Host interceptors MUST
+ * honor it (see hasAuthRetrySkip): the refresh request's own 401 must
+ * reject immediately, never recurse into session handling.
+ */
+export declare const SKIP_AUTH_RETRY = "x-teinc-skip-auth-retry";
+export declare function hasAuthRetrySkip(config: unknown): boolean;
+export declare function refreshSession(): Promise<SessionTokens | null>;
+/**
+ * Run fn; on access-expired, refresh once (single-flight) and retry once.
+ * On unrecoverable session death, clearAuth has already run inside
+ * refreshSession — the original error is rethrown for the caller to surface.
+ */
+export declare function withAuthRetry<T>(fn: () => Promise<T>): Promise<T>;

package/dist/auth/session.js

@@ -0,0 +1,172 @@
+/**
+ * Session lifecycle — single source for access-expired → refresh →
+ * refresh-expired → logout across all host apps.
+ *
+ * Backend contract (verified against TeincFoodBackend):
+ * - expired ACCESS token  → 401 + error.code "TOKEN_EXPIRED" (recoverable:
+ *   refresh once, retry the call)
+ * - expired/invalid REFRESH token → 401 + error.code "REFRESH_FAILED"
+ *   ("Token has expired") or sibling session codes (not recoverable:
+ *   clear auth → host routes to login)
+ *
+ * Host HTTP layers (axios interceptors, fetch wrappers) must NOT implement
+ * their own refresh: they attach tokens + normalize errors, then delegate
+ * classification to isAccessExpired/isSessionDead and recovery to
+ * refreshSession()/clearAuth() here. refreshSession is single-flight because
+ * the backend rotates refresh tokens — two concurrent refreshes with the
+ * same token revoke each other and 401 the session.
+ */
+import { clearAuth, getRefreshToken, setAuthTokens, } from "../adapters/auth";
+import { getHttpClient } from "../adapters/http";
+import { syncLogger } from "../utils/sync-logger";
+/** Access token expired — recoverable via one refresh + retry. */
+export const ACCESS_EXPIRED_CODE = "TOKEN_EXPIRED";
+/**
+ * Refresh/session dead — not recoverable, the user must sign in again.
+ * Canonical set from the backend auth contract; keep in sync with
+ * auth_controller.ex (REFRESH_FAILED) and plugs/auth.ex.
+ */
+export const SESSION_DEAD_CODES = [
+    "REFRESH_FAILED",
+    "TOKEN_INVALID",
+    "SESSION_EXPIRED",
+    "UNAUTHORIZED",
+    "ACCOUNT_DISABLED",
+];
+/**
+ * Transport-layer codes (axios / network stack) are never backend session
+ * codes. NOTE: a plain UPPER_SNAKE check is NOT enough — ERR_NETWORK etc.
+ * match it. Explicit denylist.
+ */
+const TRANSPORT_CODE_RE = /^(ERR_|ECONN|ETIMEDOUT|ENOTFOUND|EAI_|EHOST|ENET|EPIPE|OFFLINE)/;
+function asString(v) {
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+/**
+ * Normalize any error shape into { status, code, message }.
+ * Handles: core ApiError ({status, code}), raw axios errors
+ * ({response.status, response.data.error.code}), and host ApiError
+ * wrappers ({status, data.error.code}). Transport codes (ERR_NETWORK,
+ * ECONNABORTED, OFFLINE, …) are never backend codes and are dropped —
+ * only UPPER_SNAKE body codes classify.
+ */
+export function extractAuthFailure(e) {
+    const err = (e ?? {});
+    const status = typeof err.status === "number"
+        ? err.status
+        : err.response?.status;
+    const bodyCode = asString(err.response?.data?.error?.code) ??
+        asString(err.data?.error?.code);
+    const rawCode = asString(err.code);
+    const code = bodyCode ??
+        (rawCode && !TRANSPORT_CODE_RE.test(rawCode) ? rawCode : undefined);
+    const message = asString(err.response?.data?.error?.message) ??
+        asString(err.response?.data?.message) ??
+        asString(err.data?.error?.message) ??
+        asString(err.message);
+    return { status, code, message };
+}
+/** 401 + TOKEN_EXPIRED: access token dead, refresh may recover. */
+export function isAccessExpired(f) {
+    return f.status === 401 && f.code === ACCESS_EXPIRED_CODE;
+}
+/**
+ * 401/403 + session-dead code: refresh token dead, logout required.
+ * A 401 WITHOUT a code (proxy/gateway/HTML) is never session-dead — the
+ * app keeps working offline instead of logging the user out mid-shift.
+ */
+export function isSessionDead(f) {
+    if (f.status !== 401 && f.status !== 403)
+        return false;
+    if (!f.code)
+        return false;
+    return SESSION_DEAD_CODES.includes(f.code);
+}
+/**
+ * Marker key for the refresh call's request config. Host interceptors MUST
+ * honor it (see hasAuthRetrySkip): the refresh request's own 401 must
+ * reject immediately, never recurse into session handling.
+ */
+export const SKIP_AUTH_RETRY = "x-teinc-skip-auth-retry";
+export function hasAuthRetrySkip(config) {
+    try {
+        return (!!config &&
+            typeof config === "object" &&
+            config[SKIP_AUTH_RETRY] === true);
+    }
+    catch {
+        return false;
+    }
+}
+let inflight = null;
+/**
+ * Single-flight refresh. Returns fresh tokens (stored via provider) or
+ * null. Calls clearAuth() (→ host logout) when the backend reports the
+ * refresh token itself expired, or when no refresh token exists.
+ * Never throws — callers treat null as "unrecoverable, surface original".
+ */
+async function doRefresh() {
+    try {
+        const rt = getRefreshToken();
+        if (!rt) {
+            clearAuth();
+            return null;
+        }
+        const http = getHttpClient();
+        const res = await http.post("/auth/refresh", { refresh_token: rt }, { [SKIP_AUTH_RETRY]: true });
+        const body = (res?.data ?? {});
+        const at = body.access_token ?? body.data?.access_token;
+        const nrt = body.refresh_token ?? body.data?.refresh_token;
+        if (!at || !nrt) {
+            // 200 without tokens: ambiguous (proxy? shape drift?) — do NOT
+            // logout on ambiguity; surface as unrecoverable for this call.
+            syncLogger.warn("Session", "Refresh returned no tokens", {});
+            return null;
+        }
+        setAuthTokens(at, nrt);
+        return { access_token: at, refresh_token: nrt };
+    }
+    catch (e) {
+        const failure = extractAuthFailure(e);
+        if (isSessionDead(failure)) {
+            syncLogger.warn("Session", "Refresh token expired — logging out", {
+                code: failure.code,
+            });
+            try {
+                clearAuth();
+            }
+            catch { }
+        }
+        return null;
+    }
+}
+export async function refreshSession() {
+    // NOTE: assign via .finally() — assigning the raw IIFE promise leaves a
+    // stale settled value in `inflight` whenever the body takes a fully
+    // synchronous path (e.g. missing refresh token), pinning every later
+    // caller to that stale outcome forever.
+    if (!inflight) {
+        inflight = doRefresh().finally(() => {
+            inflight = null;
+        });
+    }
+    return inflight;
+}
+/**
+ * Run fn; on access-expired, refresh once (single-flight) and retry once.
+ * On unrecoverable session death, clearAuth has already run inside
+ * refreshSession — the original error is rethrown for the caller to surface.
+ */
+export async function withAuthRetry(fn) {
+    try {
+        return await fn();
+    }
+    catch (e) {
+        if (!isAccessExpired(extractAuthFailure(e)))
+            throw e;
+        const tokens = await refreshSession().catch(() => null);
+        if (!tokens)
+            throw e;
+        return fn();
+    }
+}

package/dist/catalog/hooks.d.ts

@@ -23,3 +23,13 @@ export declare function useUpdateMenuItemMutation(): import("@tanstack/react-que
     payload: Record<string, unknown>;
 }, unknown>;
 export declare function useDeleteMenuItemMutation(): import("@tanstack/react-query").UseMutationResult<unknown, Error, string, unknown>;
+export declare function useToggleItemAvailabilityMutation(): import("@tanstack/react-query").UseMutationResult<unknown, Error, {
+    id: string;
+    available: boolean;
+}, unknown>;
+export declare function useCreateMenuCategoryMutation(): import("@tanstack/react-query").UseMutationResult<unknown, Error, Record<string, unknown>, unknown>;
+export declare function useUpdateMenuCategoryMutation(): import("@tanstack/react-query").UseMutationResult<unknown, Error, {
+    id: string;
+    payload: Record<string, unknown>;
+}, unknown>;
+export declare function useDeleteMenuCategoryMutation(): import("@tanstack/react-query").UseMutationResult<unknown, Error, string, unknown>;