@teincfood/core 0.8.2 → 0.8.4

package/dist/domain/orders/service.js

@@ -15,6 +15,7 @@ import { canTransition } from "../../utils/order-transitions";
 import { validateOrderCreateInput } from "../../validation/offline";
 import { drainOne, pullRemoteOrders } from "../../sync/sync-jobs.service";
 import { getAuthToken } from "../../adapters/auth";
+import { canBusinessSync } from "../../sync/sync-guard";
 import { syncLogger } from "../../utils/sync-logger";
 import { getItem } from "../../adapters/kv";
 let backfilled = new Set();
@@ -65,6 +66,9 @@ function isOnline() {
     return isEffectivelyOnline();
 }
 export async function createLocalOrder(businessId, input) {
+    if (!businessId || !canBusinessSync(businessId)) {
+        throw new Error("Cannot create order without active business/login");
+    }
     const isPos = true; // POS terminal always is_pos
     // Online-required gates (single source: sync/online-gates). Cash needs no
     // connectivity; prepaid/mobile-money and delivery do.
@@ -159,6 +163,9 @@ export async function createLocalOrder(businessId, input) {
     return order;
 }
 export async function transitionLocalOrder(businessId, orderId, action) {
+    if (!businessId || !canBusinessSync(businessId)) {
+        throw new Error("Transition requires active business/login");
+    }
     const db = await openSyncDatabase();
     const order = await getOrderById(db, businessId, orderId);
     if (!order)
@@ -196,12 +203,15 @@ export async function transitionLocalOrder(businessId, orderId, action) {
     return updated ?? order;
 }
 export async function listLocalOrders(businessId, filters, page = 1, pageSize = 20) {
+    if (!businessId) {
+        return { data: [], total: 0, page, pageSize, totalPages: 0 };
+    }
     await ensureOrdersBackfilledFromSnapshots(businessId);
     const db = await openSyncDatabase();
     const res = await listOrders(db, businessId, filters, page, pageSize);
     if (res.total === 0) {
         // blank-screen: snapshot fallback already tried — if still empty and online, fetch from cloud now so listing populates without manual refresh
-        if (isOnline() && getAuthToken()) {
+        if (isOnline() && canBusinessSync(businessId)) {
             try {
                 await pullRemoteOrders(businessId);
             }
@@ -223,6 +233,8 @@ export async function listLocalOrders(businessId, filters, page = 1, pageSize =
     return res;
 }
 export async function getLocalOrder(businessId, idOrNumber) {
+    if (!businessId)
+        return null;
     await ensureOrdersBackfilledFromSnapshots(businessId);
     const db = await openSyncDatabase();
     const found = await getOrderById(db, businessId, idOrNumber);

package/dist/hooks/fleet.hooks.js

@@ -6,6 +6,7 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { useSyncExternalStore } from "react";
 import { getActiveBusiness, subscribeBusiness } from "../adapters/business";
+import { getAuthToken, subscribeAuth } from "../adapters/auth";
 import { fleetService } from "../adapters/services";
 import { assertOnlineFor } from "../sync/online-gates";
 import { validateInviteInput } from "../validation/offline";
@@ -26,6 +27,10 @@ function useBusinessId() {
     const id = useSyncExternalStore(subscribeBusiness, () => getActiveBusiness()?.id ?? null, () => null);
     return id ?? undefined;
 }
+function useIsAuthenticated() {
+    const token = useSyncExternalStore(subscribeAuth, () => getAuthToken(), () => null);
+    return !!token;
+}
 const OFFLINE_FIRST = { retry: false, networkMode: "offlineFirst" };
 // Fleet has no SQLite mirror — offline source is the persisted query cache.
 // Reads are cache-first (no online gate): the query is enabled offline so
@@ -37,10 +42,11 @@ function useOnline() {
 // ─── Riders ───
 export function useFleetRidersQuery(enabled = true, filters) {
     const businessId = useBusinessId();
+    const isAuthenticated = useIsAuthenticated();
     return useQuery({
         queryKey: [...FLEET_KEYS.riders(businessId), filters],
         queryFn: () => fleetService.fetchFleetRiders(businessId, 1, 50, filters),
-        enabled: enabled && Boolean(businessId),
+        enabled: enabled && Boolean(businessId) && isAuthenticated,
         placeholderData: (prev) => prev,
         ...OFFLINE_FIRST,
     });
@@ -121,10 +127,11 @@ export function useActivateRiderMutation() {
 }
 export function useJoinRequestsQuery(enabled = true) {
     const businessId = useBusinessId();
+    const isAuthenticated = useIsAuthenticated();
     return useQuery({
         queryKey: FLEET_KEYS.joinRequests(businessId),
         queryFn: () => fleetService.fetchJoinRequests(businessId),
-        enabled: enabled && Boolean(businessId),
+        enabled: enabled && Boolean(businessId) && isAuthenticated,
         placeholderData: (prev) => prev,
         ...OFFLINE_FIRST,
     });
@@ -158,10 +165,11 @@ export function useRejectJoinRequestMutation() {
 }
 export function useFleetInvitationsQuery(enabled = true) {
     const businessId = useBusinessId();
+    const isAuthenticated = useIsAuthenticated();
     return useQuery({
         queryKey: FLEET_KEYS.invitations(businessId),
         queryFn: () => fleetService.fetchInvitations(businessId),
-        enabled: enabled && Boolean(businessId),
+        enabled: enabled && Boolean(businessId) && isAuthenticated,
         placeholderData: (prev) => prev,
         ...OFFLINE_FIRST,
     });
@@ -182,10 +190,11 @@ export function useRevokeInvitationMutation() {
 // ─── Vehicles ───
 export function useFleetVehiclesQuery(enabled = true) {
     const businessId = useBusinessId();
+    const isAuthenticated = useIsAuthenticated();
     return useQuery({
         queryKey: FLEET_KEYS.vehicles(businessId),
         queryFn: () => fleetService.fetchFleetVehicles(businessId),
-        enabled: enabled && Boolean(businessId),
+        enabled: enabled && Boolean(businessId) && isAuthenticated,
         placeholderData: (prev) => prev,
         ...OFFLINE_FIRST,
     });
@@ -219,10 +228,11 @@ export function useRemoveVehicleMutation() {
 // ─── Dashboard ───
 export function useFleetDashboardQuery(enabled = true) {
     const businessId = useBusinessId();
+    const isAuthenticated = useIsAuthenticated();
     return useQuery({
         queryKey: FLEET_KEYS.dashboard(businessId),
         queryFn: () => fleetService.fetchFleetDashboard(businessId),
-        enabled: enabled && Boolean(businessId),
+        enabled: enabled && Boolean(businessId) && isAuthenticated,
         placeholderData: (prev) => prev,
         ...OFFLINE_FIRST,
     });

package/dist/hooks/members.hooks.js

@@ -6,6 +6,7 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { useSyncExternalStore } from "react";
 import { getActiveBusiness, subscribeBusiness } from "../adapters/business";
+import { getAuthToken, subscribeAuth } from "../adapters/auth";
 import { businessService, rolesService, fleetService } from "../adapters/services";
 import { assertOnlineFor } from "../sync/online-gates";
 import { validateInviteInput } from "../validation/offline";
@@ -18,6 +19,10 @@ function useBusinessId() {
     const id = useSyncExternalStore(subscribeBusiness, () => getActiveBusiness()?.id ?? null, () => null);
     return id ?? undefined;
 }
+function useIsAuthenticated() {
+    const token = useSyncExternalStore(subscribeAuth, () => getAuthToken(), () => null);
+    return !!token;
+}
 const OFFLINE_FIRST = { retry: false, networkMode: "offlineFirst" };
 // ─── Keys ───
 export const MEMBER_KEYS = {
@@ -42,10 +47,11 @@ export function useBusinessMembersQuery() {
     const businessId = useBusinessId();
     const cached = useReferenceData("members");
     const online = useIsEffectivelyOnline();
+    const isAuthenticated = useIsAuthenticated();
     const q = useQuery({
         queryKey: MEMBER_KEYS.list(businessId ?? ""),
         queryFn: () => businessService.fetchBusinessMembers(businessId),
-        enabled: Boolean(businessId) && online,
+        enabled: Boolean(businessId) && online && isAuthenticated,
         staleTime: 30 * 1000,
         ...OFFLINE_FIRST,
         placeholderData: cached.data?.payload,
@@ -94,12 +100,13 @@ export function useRemoveMemberMutation() {
 }
 export function useBusinessMemberInvitationsQuery() {
     const businessId = useBusinessId();
-    // No invitations SQLite mirror — never fire while unreachable.
+    // No invitations SQLite mirror — never fire while unreachable or logged-out.
     const online = useIsEffectivelyOnline();
+    const isAuthenticated = useIsAuthenticated();
     return useQuery({
         queryKey: MEMBER_KEYS.invitations(businessId ?? ""),
         queryFn: () => businessService.fetchBusinessMemberInvitations(businessId),
-        enabled: Boolean(businessId) && online,
+        enabled: Boolean(businessId) && online && isAuthenticated,
         ...OFFLINE_FIRST,
     });
 }
@@ -143,12 +150,13 @@ export function useDeleteMemberInvitationMutation() {
 }
 // ─── User invitations ───
 export function useUserInvitationsQuery() {
-    // No invitations SQLite mirror — never fire while unreachable.
+    // User-scoped: requires login. Don't 401 while logged-out.
     const online = useIsEffectivelyOnline();
+    const isAuthenticated = useIsAuthenticated();
     return useQuery({
         queryKey: INVITATION_KEYS.list(),
         queryFn: () => businessService.fetchUserInvitations(),
-        enabled: online,
+        enabled: online && isAuthenticated,
         staleTime: 15000,
         ...OFFLINE_FIRST,
     });
@@ -206,11 +214,12 @@ export function useBusinessRolesQuery(enabled = true) {
     const businessId = useBusinessId();
     const cached = useReferenceData("roles");
     const online = useIsEffectivelyOnline();
+    const isAuthenticated = useIsAuthenticated();
     const q = useQuery({
         queryKey: ROLES_KEYS.forBusiness(businessId),
         queryFn: () => rolesService.fetchBusinessRoles(),
         staleTime: Infinity,
-        enabled: enabled && !!businessId && online,
+        enabled: enabled && !!businessId && online && isAuthenticated,
         ...OFFLINE_FIRST,
         placeholderData: cached.data?.payload,
     });
@@ -221,10 +230,11 @@ export function useBusinessTaxRulesQuery(enabled = true) {
     const businessId = useBusinessId();
     const cached = useReferenceData("tax-rules");
     const online = useIsEffectivelyOnline();
+    const isAuthenticated = useIsAuthenticated();
     const q = useQuery({
         queryKey: TAX_KEYS.list(businessId),
         queryFn: () => businessService.fetchBusinessTaxRules(businessId),
-        enabled: enabled && Boolean(businessId) && online,
+        enabled: enabled && Boolean(businessId) && online && isAuthenticated,
         staleTime: 30 * 1000,
         ...OFFLINE_FIRST,
         placeholderData: cached.data?.payload,

package/dist/index.d.ts

@@ -136,6 +136,7 @@ export { getSyncJobsPendingCount, debugDumpSyncJobs, drainPending } from "./sync
 export { performFullSync } from "./sync/full-sync";
 export { stopHealthProbe } from "./sync/health-probe";
 export { notifyAuthChanged, subscribeAuth } from "./adapters/auth";
+export { isAuthenticated, hasActiveBusiness, canBusinessSync } from "./sync/sync-guard";
 export { ACCESS_EXPIRED_CODE, SESSION_DEAD_CODES, SKIP_AUTH_RETRY, extractAuthFailure, isAccessExpired, isSessionDead, hasAuthRetrySkip, refreshSession, withAuthRetry, } from "./auth/session";
 export type { AuthFailure, SessionTokens } from "./auth/session";
 export { getCachedImagePath, ensureImageCacheDir, getCachedImageInfo, cacheRemoteImage, cacheImageBatch, clearImageCache, pruneImageCache, resolveImageSource, stableCacheUrl } from "./image-cache/service";

package/dist/index.js

@@ -151,6 +151,7 @@ export { getSyncJobsPendingCount, debugDumpSyncJobs, drainPending } from "./sync
 export { performFullSync } from "./sync/full-sync";
 export { stopHealthProbe } from "./sync/health-probe";
 export { notifyAuthChanged, subscribeAuth } from "./adapters/auth";
+export { isAuthenticated, hasActiveBusiness, canBusinessSync } from "./sync/sync-guard";
 // ── Session lifecycle (access-expired → refresh → refresh-expired → logout)
 export { ACCESS_EXPIRED_CODE, SESSION_DEAD_CODES, SKIP_AUTH_RETRY, extractAuthFailure, isAccessExpired, isSessionDead, hasAuthRetrySkip, refreshSession, withAuthRetry, } from "./auth/session";
 // ── Image cache (durable) ──

package/dist/reference/service.js

@@ -13,6 +13,7 @@ import { generateUUID } from "../utils/uuid";
 import { menuService, businessService, rolesService } from "../adapters/services";
 import { cacheImageBatch, pruneImageCache } from "../adapters/image-cache";
 import { getConnectivityState } from "../adapters/connectivity";
+import { canBusinessSync } from "../sync/sync-guard";
 import { getReferenceData, getReferenceVersion, mergeReferenceData, } from "./operations";
 import { fetchReferenceVersions, fetchReferenceData, fetchReferenceChanges, } from "./api";
 const DEFAULT_SYNC_KEYS = [
@@ -33,6 +34,17 @@ class ReferenceSyncService {
         this.isSyncing = false;
     }
     async sync(options) {
+        if (!canBusinessSync(options.businessId)) {
+            syncLogger.debug("ReferenceSync", "Skipping sync — no business/auth", {
+                businessId: options.businessId,
+            });
+            return {
+                synced: [],
+                skipped: options.keys ?? DEFAULT_SYNC_KEYS,
+                failed: [],
+                errors: {},
+            };
+        }
         if (this.isSyncing) {
             return {
                 synced: [],

package/dist/sync/command-builder.js

@@ -8,6 +8,9 @@ import { useAuthStore } from "../adapters/auth";
 import { getAppInstanceId } from "../adapters/devices";
 import { generateCommandId } from "../utils/uuid";
 export function buildCommand(options) {
+    if (!options.businessId) {
+        throw new Error("buildCommand requires businessId — no active business/auth");
+    }
     const user = useAuthStore.getState().user;
     const userId = user?.id ?? "anonymous";
     const deviceId = getAppInstanceId();

package/dist/sync/command-queue.service.js

@@ -15,6 +15,7 @@ import { recordAttempt } from "../utils/attempt-stats";
 import { generateEventId } from "../utils/uuid";
 import { generateLocalCalloutNumber, generateOrderNumberForBusiness, generateOrderNumber, } from "./order-number";
 import { getConnectivityState, subscribeConnectivity } from "../adapters/connectivity";
+import { canBusinessSync } from "./sync-guard";
 const MAX_RETRIES = 5;
 const QUEUED_STATUS_BY_COMMAND = {
     "order:accept": "accepted",
@@ -186,6 +187,8 @@ class CommandQueueService {
         try {
             subscribeConnectivity(() => {
                 const s = getConnectivityState();
+                if (!canBusinessSync())
+                    return;
                 if (s.isCloudReachable === "reachable" && s.isOnline) {
                     this.replay().catch(() => { });
                 }
@@ -234,6 +237,10 @@ class CommandQueueService {
      * Try to execute a single pending command through the current transport.
      */
     async processCommand(command) {
+        if (!canBusinessSync(command.business_id)) {
+            // No active business/session — defer until login+selection.
+            throw new Error("ReplayDeferred: no business/auth, deferring queued command");
+        }
         const db = getSyncDatabase();
         const parsedCommand = {
             command_id: command.command_id,
@@ -348,6 +355,8 @@ class CommandQueueService {
      * ordering consistent; the next replay will retry from the failed command.
      */
     async replay() {
+        if (!canBusinessSync())
+            return;
         recordAttempt("sync_drain", "replay");
         // Join an in-flight replay instead of no-op'ing: concurrent replays
         // (connectivity auto-replay racing an explicit replay) must converge on

package/dist/sync/engine.js

@@ -21,6 +21,7 @@ import { CLOUD_COMMAND_TIMEOUT_MS } from "../utils/constants";
 import { CAPABILITY_BY_COMMAND } from "../reference/capabilities";
 import { getReferenceData } from "../reference/operations";
 import { openSyncDatabase } from "../db/connection";
+import { canBusinessSync } from "./sync-guard";
 function withTimeout(promise, ms) {
     return new Promise((resolve, reject) => {
         const timer = setTimeout(() => {
@@ -53,6 +54,10 @@ export class SyncEngine {
      * quickly instead of blocking the terminal for the full HTTP timeout.
      */
     async execute(command, opts) {
+        if (!command.business_id || !canBusinessSync(command.business_id)) {
+            // No active business/auth — don't route to cloud/LAN or queue with empty bid.
+            throw new Error("Sync requires active business and login — business_id missing or not authenticated");
+        }
         syncLogger.command(command, "issued");
         // Perms guard (offline-capable): block before routing
         const required = CAPABILITY_BY_COMMAND[command.command_type];

package/dist/sync/full-sync.js

@@ -4,21 +4,19 @@
  * overwrites them; then pull merges; final drain pushes any remainder.
  */
 import { getConnectivityState } from "../adapters/connectivity";
-import { getAuthToken } from "../adapters/auth";
 import { getActiveBusiness } from "../adapters/business";
 import { syncLogger } from "../utils/sync-logger";
 import { referenceSyncService } from "../reference/service";
 import { pullRemoteOrders, drainPending } from "./sync-jobs.service";
+import { canBusinessSync } from "./sync-guard";
 let inFlight = null;
 export async function performFullSync(businessId) {
     const bid = businessId ?? getActiveBusiness()?.id;
-    if (!bid)
+    if (!bid || !canBusinessSync(bid))
         return;
     const s = getConnectivityState();
     if (!s.isOnline || s.isCloudReachable === "unreachable")
         return;
-    if (!getAuthToken())
-        return;
     if (inFlight) {
         try {
             await inFlight;

package/dist/sync/sync-guard.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Sync Guard — single predicate for business-scoped sync.
+ *
+ * Option C (Hybrid): health probe stays `isOnline`-only (connectivity UX
+ * while logged-out). Every *business* sync path gates on both auth *and*
+ * active business: no drain, pull, replay, or reference fetch fires until
+ * the user has logged in and a business is selected. User-scoped queries
+ * (invitations, fleet) gate on auth only.
+ */
+export declare function isAuthenticated(): boolean;
+export declare function hasActiveBusiness(): boolean;
+/**
+ * Business sync may run only when both authenticated and a business is selected.
+ * Pass an explicit `businessId` to test that specific id; otherwise reads
+ * the active business store.
+ */
+export declare function canBusinessSync(businessId?: string | null): boolean;

package/dist/sync/sync-guard.js

@@ -0,0 +1,26 @@
+/**
+ * Sync Guard — single predicate for business-scoped sync.
+ *
+ * Option C (Hybrid): health probe stays `isOnline`-only (connectivity UX
+ * while logged-out). Every *business* sync path gates on both auth *and*
+ * active business: no drain, pull, replay, or reference fetch fires until
+ * the user has logged in and a business is selected. User-scoped queries
+ * (invitations, fleet) gate on auth only.
+ */
+import { getAuthToken } from "../adapters/auth";
+import { getActiveBusiness } from "../adapters/business";
+export function isAuthenticated() {
+    return !!getAuthToken();
+}
+export function hasActiveBusiness() {
+    return !!getActiveBusiness()?.id;
+}
+/**
+ * Business sync may run only when both authenticated and a business is selected.
+ * Pass an explicit `businessId` to test that specific id; otherwise reads
+ * the active business store.
+ */
+export function canBusinessSync(businessId) {
+    const bid = businessId ?? getActiveBusiness()?.id;
+    return !!bid && !!getAuthToken();
+}

package/dist/sync/sync-jobs.service.js

@@ -6,7 +6,7 @@
 import { openSyncDatabase } from "../db/connection";
 import { insertOrder } from "../db/operations";
 import { getConnectivityState, subscribeConnectivity } from "../adapters/connectivity";
-import { getAuthToken, getRefreshToken, setAuthTokens, clearAuth, subscribeAuth } from "../adapters/auth";
+import { getRefreshToken, setAuthTokens, clearAuth, subscribeAuth } from "../adapters/auth";
 import { getActiveBusiness, subscribeBusiness } from "../adapters/business";
 import { getHttpClient } from "../adapters/http";
 import { phoenixSocket } from "../realtime/phoenix-socket";
@@ -16,6 +16,7 @@ import { BackoffTracker } from "./backoff";
 import { generateOrderNumber } from "./order-number";
 import { orderSnapshotsService } from "./order-snapshots.service";
 import { getTransitionPath } from "./transition-endpoints";
+import { canBusinessSync, isAuthenticated } from "./sync-guard";
 const inflight = new Map();
 const retryTimers = new Map();
 const backoffTracker = new BackoffTracker();
@@ -33,6 +34,8 @@ function isOnlineForPhx() {
     return s.isOnline && s.isCloudReachable === "reachable";
 }
 function scheduleRetry(businessId) {
+    if (!canBusinessSync(businessId))
+        return;
     if (retryTimers.has(businessId))
         return;
     // Shared backoff curve: 2s doubling to a 5min cap with jitter. Attempts
@@ -43,7 +46,7 @@ function scheduleRetry(businessId) {
     syncLogger.debug("SyncJobs", "scheduleRetry backoff", { businessId, delay });
     const t = setTimeout(() => {
         retryTimers.delete(businessId);
-        if (isOnlineForRest() && getAuthToken() && getActiveBusiness()?.id === businessId) {
+        if (isOnlineForRest() && canBusinessSync(businessId)) {
             syncLogger.debug("SyncJobs", "retry timer fired → drainPending", { businessId });
             void drainPending(businessId);
         }
@@ -184,14 +187,17 @@ async function tryRest(businessId, payload, commandType) {
     }
 }
 export async function drainOne(businessId, entityId) {
+    if (!businessId || !canBusinessSync(businessId)) {
+        syncLogger.debug("SyncJobs", "drainOne early-return — no business/auth", { businessId, entityId });
+        return;
+    }
     recordAttempt("sync_drain", `drainOne ${entityId.slice(0, 8)}`);
     const onlineForRest = isOnlineForRest();
     const onlineForPhx = isOnlineForPhx();
-    const token = getAuthToken();
     const state = getConnectivityState();
-    syncLogger.debug("SyncJobs", "drainOne entry", { businessId, entityId, isOnlineForRest: onlineForRest, isOnlineForPhx: onlineForPhx, isCloudReachable: state.isCloudReachable, hasToken: !!token, inflight: inflight.has(`${businessId}:${entityId}`) });
-    if (!onlineForRest || !token) {
-        syncLogger.debug("SyncJobs", "drainOne early-return gate", { businessId, entityId, onlineForRest, hasToken: !!token, connectivity: state });
+    syncLogger.debug("SyncJobs", "drainOne entry", { businessId, entityId, isOnlineForRest: onlineForRest, isOnlineForPhx: onlineForPhx, isCloudReachable: state.isCloudReachable, hasToken: isAuthenticated(), inflight: inflight.has(`${businessId}:${entityId}`) });
+    if (!onlineForRest) {
+        syncLogger.debug("SyncJobs", "drainOne early-return gate", { businessId, entityId, onlineForRest, hasToken: isAuthenticated(), connectivity: state });
         return;
     }
     const key = `${businessId}:${entityId}`;
@@ -385,11 +391,14 @@ export async function drainOne(businessId, entityId) {
     }
 }
 export async function pullRemoteOrders(businessId) {
+    if (!businessId || !canBusinessSync(businessId)) {
+        syncLogger.debug("SyncJobs", "pullRemoteOrders early-return — no business/auth", { businessId });
+        return;
+    }
     const onlineForRest = isOnlineForRest();
-    const hasToken = !!getAuthToken();
-    syncLogger.debug("SyncJobs", "pullRemoteOrders entry", { businessId, onlineForRest, hasToken });
-    if (!onlineForRest || !hasToken) {
-        syncLogger.debug("SyncJobs", "pullRemoteOrders early-return gate", { businessId, onlineForRest, hasToken, connectivity: getConnectivityState() });
+    syncLogger.debug("SyncJobs", "pullRemoteOrders entry", { businessId, onlineForRest, hasToken: isAuthenticated() });
+    if (!onlineForRest) {
+        syncLogger.debug("SyncJobs", "pullRemoteOrders early-return gate", { businessId, onlineForRest, hasToken: isAuthenticated(), connectivity: getConnectivityState() });
         return;
     }
     try {
@@ -450,12 +459,15 @@ export async function pullRemoteOrders(businessId) {
     }
 }
 export async function drainPending(businessId) {
+    if (!businessId || !canBusinessSync(businessId)) {
+        syncLogger.debug("SyncJobs", "drainPending early-return — no business/auth", { businessId });
+        return;
+    }
     recordAttempt("sync_drain", "drainPending");
     const onlineForRest = isOnlineForRest();
-    const hasToken = !!getAuthToken();
-    syncLogger.debug("SyncJobs", "drainPending entry", { businessId, onlineForRest, hasToken, connectivity: getConnectivityState() });
-    if (!onlineForRest || !hasToken) {
-        syncLogger.debug("SyncJobs", "drainPending early-return gate", { businessId, onlineForRest, hasToken });
+    syncLogger.debug("SyncJobs", "drainPending entry", { businessId, onlineForRest, hasToken: isAuthenticated(), connectivity: getConnectivityState() });
+    if (!onlineForRest) {
+        syncLogger.debug("SyncJobs", "drainPending early-return gate", { businessId, onlineForRest, hasToken: isAuthenticated() });
         return;
     }
     const db = await openSyncDatabase();
@@ -486,30 +498,30 @@ export function setupSyncJobsDrain() {
         return;
     }
     drainSetup = true;
-    syncLogger.debug("SyncJobs", "setupSyncJobsDrain init", { hasBusiness: !!getActiveBusiness()?.id, connectivity: getConnectivityState(), hasToken: !!getAuthToken() });
+    syncLogger.debug("SyncJobs", "setupSyncJobsDrain init", { hasBusiness: !!getActiveBusiness()?.id, connectivity: getConnectivityState(), hasToken: isAuthenticated() });
     const triggerFullSync = (b) => {
-        if (!b || !isOnlineForRest() || !getAuthToken())
+        if (!b || !isOnlineForRest() || !canBusinessSync(b))
             return;
         void import("./full-sync").then((m) => m.performFullSync(b).catch(() => { }));
     };
     try {
         subscribeConnectivity(() => {
             const b = getActiveBusiness()?.id;
-            syncLogger.debug("SyncJobs", "subscribeConnectivity trigger", { businessId: b, connectivity: getConnectivityState(), hasToken: !!getAuthToken() });
+            syncLogger.debug("SyncJobs", "subscribeConnectivity trigger", { businessId: b, connectivity: getConnectivityState(), hasToken: isAuthenticated() });
             triggerFullSync(b);
         });
         subscribeBusiness(() => {
             const bid = getActiveBusiness()?.id;
-            syncLogger.debug("SyncJobs", "subscribeBusiness trigger", { businessId: bid, hasToken: !!getAuthToken(), connectivity: getConnectivityState() });
+            syncLogger.debug("SyncJobs", "subscribeBusiness trigger", { businessId: bid, hasToken: isAuthenticated(), connectivity: getConnectivityState() });
             triggerFullSync(bid);
         });
         subscribeAuth(() => {
             const b = getActiveBusiness()?.id;
-            syncLogger.debug("SyncJobs", "subscribeAuth trigger", { businessId: b, hasToken: !!getAuthToken(), connectivity: getConnectivityState() });
+            syncLogger.debug("SyncJobs", "subscribeAuth trigger", { businessId: b, hasToken: isAuthenticated(), connectivity: getConnectivityState() });
             triggerFullSync(b);
         });
         const b0 = getActiveBusiness()?.id;
-        syncLogger.debug("SyncJobs", "setupSyncJobsDrain initial check", { b0, isOnlineForRest: isOnlineForRest(), hasToken: !!getAuthToken() });
+        syncLogger.debug("SyncJobs", "setupSyncJobsDrain initial check", { b0, isOnlineForRest: isOnlineForRest(), hasToken: isAuthenticated() });
         triggerFullSync(b0);
     }
     catch (e) {

package/dist/utils/order-transitions.js

@@ -22,6 +22,8 @@ export const PIPELINE = ["pending", "accepted", "preparing", "ready", "delivered
 // ── Helpers ───────────────────────────────────────────────────────────────
 export function isUnpaid(order) {
     const o = order;
+    if (o.pos_payment_method === "cash")
+        return false;
     return !o.is_paid && !o.paid_at && !o.payment?.is_paid;
 }
 export function isCancellable(status) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teincfood/core",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "TeincFood shared offline-first core — types, sync engine, local DB, reference data, and repositories for mobile + desktop",
   "type": "module",
   "main": "dist/index.js",