@teincfood/core 0.9.14 → 0.9.15

package/dist/db/connection.js

@@ -19,6 +19,7 @@ export async function openSyncDatabase() {
     const driver = getSqliteDriver();
     initPromise = (async () => {
         await runMigrations(driver);
+        await recoverInFlightCommands(driver);
         dbInstance = driver;
         syncLogger.info("SQLite", "Database opened and migrated", {
             name: DB_NAME,
@@ -71,6 +72,30 @@ async function runMigrations(db) {
         await doMigrate();
     }
 }
+/**
+ * Crash recovery: a process kill between `markCommandInFlight` and the
+ * command's terminal update leaves rows stuck in `in_flight`. They are
+ * invisible to the outbox query (which selects pending only), so the order
+ * would silently never sync. Reset them to pending on open so the next replay
+ * picks them up. Idempotent and safe: a fresh process owns all in-flight work.
+ */
+async function recoverInFlightCommands(db) {
+    try {
+        const result = await db.runAsync("UPDATE commands SET status = 'pending', error = NULL, updated_at = ? WHERE status = 'in_flight';", new Date().toISOString());
+        const changes = result?.changes ?? 0;
+        if (changes > 0) {
+            syncLogger.warn("SQLite", "Recovered in-flight commands after restart", {
+                count: changes,
+            });
+        }
+    }
+    catch (error) {
+        // Never block DB open on recovery — replay/backoff still works.
+        syncLogger.error("SQLite", "in-flight recovery failed", {
+            error: String(error),
+        });
+    }
+}
 export async function closeSyncDatabase() {
     if (dbInstance) {
         if (dbInstance.closeAsync)

package/dist/db/operations.d.ts

@@ -8,7 +8,7 @@ export interface InsertCommandInput {
     status?: PersistedCommand["status"];
 }
 export declare function insertCommand(db: SQLiteDatabase, input: InsertCommandInput): Promise<PersistedCommand>;
-export declare function getPendingCommands(db: SQLiteDatabase, limit?: number): Promise<PersistedCommand[]>;
+export declare function getPendingCommands(db: SQLiteDatabase, limit?: number, includeFailed?: boolean): Promise<PersistedCommand[]>;
 export declare function updateCommandStatus(db: SQLiteDatabase, commandId: string, status: PersistedCommand["status"], error?: string, incrementRetry?: boolean): Promise<void>;
 export declare function markCommandInFlight(db: SQLiteDatabase, commandId: string): Promise<void>;
 export declare function deleteCommand(db: SQLiteDatabase, commandId: string): Promise<void>;

package/dist/db/operations.js

@@ -24,10 +24,15 @@ export async function insertCommand(db, input) {
     syncLogger.command(command, "queued");
     return rowToPersistedCommand(row);
 }
-export async function getPendingCommands(db, limit = 100) {
+export async function getPendingCommands(db, limit = 100, includeFailed = false) {
+    // `failed` rows are terminal (permanent rejection / retries exhausted) — they
+    // must NOT be re-fetched by the replay loop, or every failed command would be
+    // re-POSTed and re-toasted on each pass. Diagnostics opts in via
+    // includeFailed for the full outbox dump.
+    const statuses = includeFailed ? "('pending', 'failed')" : "('pending')";
     const rows = await db.getAllAsync(`
       SELECT * FROM commands
-      WHERE status IN ('pending', 'failed')
+      WHERE status IN ${statuses}
       ORDER BY created_at ASC
       LIMIT ?;
     `, limit);

package/dist/hooks/startup-readiness.hooks.d.ts

@@ -0,0 +1,24 @@
+/**
+ * React hook for startup readiness (seller POS/order surfaces).
+ *
+ * Runs one bounded catch-up on mount (and whenever the cloud becomes
+ * reachable), then exposes the local cache readiness so the app can block the
+ * POS with an explicit "preparing offline data" state instead of surprising
+ * the seller with a guard failure at order-tap time.
+ */
+import { type StartupReadiness } from "../sync/startup-readiness";
+export interface UseStartupReadinessOptions {
+    /** Bound the online catch-up attempt. Defaults to 15000ms. */
+    timeoutMs?: number;
+    /** Set false to skip automatic checking. */
+    enabled?: boolean;
+}
+export interface UseStartupReadinessResult {
+    businessId: string | undefined;
+    readiness: StartupReadiness | null;
+    /** True while the catch-up check is running (first load only). */
+    checking: boolean;
+    /** Re-run the readiness check on demand (e.g. a Retry button). */
+    recheck: () => Promise<void>;
+}
+export declare function useStartupReadiness(options?: UseStartupReadinessOptions): UseStartupReadinessResult;

package/dist/hooks/startup-readiness.hooks.js

@@ -0,0 +1,61 @@
+/**
+ * React hook for startup readiness (seller POS/order surfaces).
+ *
+ * Runs one bounded catch-up on mount (and whenever the cloud becomes
+ * reachable), then exposes the local cache readiness so the app can block the
+ * POS with an explicit "preparing offline data" state instead of surprising
+ * the seller with a guard failure at order-tap time.
+ */
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useSyncExternalStore } from "react";
+import { getActiveBusiness, subscribeBusiness } from "../adapters/business";
+import { getConnectivityState, subscribeConnectivity } from "../adapters/connectivity";
+import { ensureStartupReady, } from "../sync/startup-readiness";
+function useActiveBusinessId() {
+    const id = useSyncExternalStore(subscribeBusiness, () => getActiveBusiness()?.id ?? null, () => null);
+    return id ?? undefined;
+}
+function useCloudStatus() {
+    return useSyncExternalStore(subscribeConnectivity, () => getConnectivityState().isCloudReachable, () => "unknown");
+}
+export function useStartupReadiness(options = {}) {
+    const { timeoutMs, enabled = true } = options;
+    const businessId = useActiveBusinessId();
+    const cloudStatus = useCloudStatus();
+    const [readiness, setReadiness] = useState(null);
+    const [checking, setChecking] = useState(false);
+    const runRef = useRef(false);
+    const check = useCallback(async () => {
+        if (!businessId)
+            return;
+        if (runRef.current)
+            return;
+        runRef.current = true;
+        setChecking(true);
+        try {
+            const result = await ensureStartupReady(businessId, { timeoutMs });
+            setReadiness(result);
+        }
+        finally {
+            runRef.current = false;
+            setChecking(false);
+        }
+    }, [businessId, timeoutMs]);
+    // First check when a business is available.
+    useEffect(() => {
+        if (!enabled || !businessId)
+            return;
+        if (readiness)
+            return;
+        void check();
+    }, [enabled, businessId, readiness, check]);
+    // Re-check whenever cloud reachability flips to reachable (data may now sync).
+    useEffect(() => {
+        if (!enabled || !businessId)
+            return;
+        if (cloudStatus !== "reachable")
+            return;
+        void check();
+    }, [enabled, businessId, cloudStatus, check]);
+    return { businessId, readiness, checking, recheck: check };
+}

package/dist/index.d.ts

@@ -54,6 +54,8 @@ export { buildCommand } from "./sync/command-builder";
 export { generateLocalOrderNumber, generateLocalCalloutNumber, isLocalOrderNumber, generateOrderNumber, generateOrderNumberForBusiness, isOfflineOrderNumber, parseOrderNumber, resetCalloutForTests, } from "./sync/order-number";
 export { deviceLeaseService, getDeviceNumber, isOnlineOnly, ensureLease } from "./sync/device-lease.service";
 export { useDeviceLease, ensureDeviceLease } from "./sync/use-device-lease";
+export { getStartupReadiness, ensureStartupReady, REQUIRED_ORDER_KEYS, type StartupReadiness, } from "./sync/startup-readiness";
+export { useStartupReadiness, type UseStartupReadinessOptions, type UseStartupReadinessResult, } from "./hooks/startup-readiness.hooks";
 export * from "./utils/hlc";
 export * from "./reference/lww";
 export { orderSnapshotsService } from "./sync/order-snapshots.service";

package/dist/index.js

@@ -57,6 +57,8 @@ export { buildCommand } from "./sync/command-builder";
 export { generateLocalOrderNumber, generateLocalCalloutNumber, isLocalOrderNumber, generateOrderNumber, generateOrderNumberForBusiness, isOfflineOrderNumber, parseOrderNumber, resetCalloutForTests, } from "./sync/order-number";
 export { deviceLeaseService, getDeviceNumber, isOnlineOnly, ensureLease } from "./sync/device-lease.service";
 export { useDeviceLease, ensureDeviceLease } from "./sync/use-device-lease";
+export { getStartupReadiness, ensureStartupReady, REQUIRED_ORDER_KEYS, } from "./sync/startup-readiness";
+export { useStartupReadiness, } from "./hooks/startup-readiness.hooks";
 export * from "./utils/hlc";
 export * from "./reference/lww";
 export { orderSnapshotsService } from "./sync/order-snapshots.service";

package/dist/sync/command-queue.service.d.ts

@@ -39,8 +39,13 @@ declare class CommandQueueService {
      */
     private absorbIfApplied;
     /**
-     * Replay all pending commands in order. Stops on the first failure to keep
-     * ordering consistent; the next replay will retry from the failed command.
+     * Replay pending commands in FIFO order with entity-aware skip-and-continue.
+     *
+     * Ordering is preserved per entity: a failing command defers only its own
+     * entity_id, so that order's later commands stay queued behind it, while
+     * independent entities keep syncing in the same pass. The pass stops only
+     * when nothing can make progress: no transport at all (REPLAY_NO_TRANSPORT)
+     * or TRANSPORT_FAILURE_BREAKER consecutive network/5xx failures.
      */
     replay(): Promise<void>;
     /**

package/dist/sync/command-queue.service.js

@@ -12,7 +12,7 @@ import { getSyncDatabase, openSyncDatabase } from "../db/connection";
 import { insertCommand, getPendingCommands, markCommandInFlight, updateCommandStatus, deleteCommand, insertEvent, } from "../db/operations";
 import { syncLogger } from "../utils/sync-logger";
 import { recordAttempt } from "../utils/attempt-stats";
-import { TransitionError, isReplayDeferred, TRANSITION_ERROR_CODES } from "./transition-errors";
+import { TransitionError, isReplayDeferred, isReplayNoTransport, TRANSITION_ERROR_CODES } from "./transition-errors";
 import { assertBusinessOpenForCreate } from "../utils/business-hours";
 import { extractApiErrorCode } from "../utils/error";
 import { generateEventId } from "../utils/uuid";
@@ -22,6 +22,13 @@ import { getConnectivityState, subscribeConnectivity } from "../adapters/connect
 import { canBusinessSync } from "./sync-guard";
 import { backoffDelayMs } from "./backoff";
 const MAX_RETRIES = 5;
+/**
+ * Stop a replay pass after this many consecutive transport-level failures
+ * (network/timeout/5xx) so a dead server is not hammered once per queued
+ * command. Any server response (2xx, permanent 4xx) or deferral resets the
+ * counter. The next trigger (connectivity/backoff) starts a fresh pass.
+ */
+const TRANSPORT_FAILURE_BREAKER = 3;
 /**
  * 4xx that deserve another chance: transient races and rate limits, never
  * permanent verdicts. Anything else 4xx (400 validation, 401 session,
@@ -294,10 +301,16 @@ class CommandQueueService {
             // the next trigger (do not mark, do not count). Must reset the
             // in_flight flag first — rows stuck in_flight are invisible to the
             // outbox query and would wedge the queue forever.
-            if (isReplayDeferred(error)) {
+            if (isReplayNoTransport(error)) {
                 await updateCommandStatus(db, command.command_id, "pending", "deferred:no-transport");
                 throw error;
             }
+            // Per-command backoff (retry window or retryable-4xx backoff): leave the
+            // row pending and rethrow so the pass defers just this entity.
+            if (isReplayDeferred(error)) {
+                await updateCommandStatus(db, command.command_id, "pending", "deferred:backoff");
+                throw error;
+            }
             const apiErr = error;
             const message = error instanceof Error ? error.message : String(error);
             // 409 ORDER_NUMBER_TAKEN is retryable once with new RRR (exact backend code, any envelope)
@@ -437,8 +450,13 @@ class CommandQueueService {
         return false;
     }
     /**
-     * Replay all pending commands in order. Stops on the first failure to keep
-     * ordering consistent; the next replay will retry from the failed command.
+     * Replay pending commands in FIFO order with entity-aware skip-and-continue.
+     *
+     * Ordering is preserved per entity: a failing command defers only its own
+     * entity_id, so that order's later commands stay queued behind it, while
+     * independent entities keep syncing in the same pass. The pass stops only
+     * when nothing can make progress: no transport at all (REPLAY_NO_TRANSPORT)
+     * or TRANSPORT_FAILURE_BREAKER consecutive network/5xx failures.
      */
     async replay() {
         if (!canBusinessSync())
@@ -469,21 +487,59 @@ class CommandQueueService {
             syncLogger.info("CommandQueueService", "Replaying commands", {
                 count: pending.length,
             });
+            // Entities deferred in THIS pass (backoff window or a transport failure):
+            // later commands for the same entity are skipped to preserve per-entity
+            // FIFO without blocking independent commands.
+            const deferredEntities = new Set();
+            let consecutiveTransportFailures = 0;
             for (const command of pending) {
+                const entity = command.entity_id;
+                if (entity && deferredEntities.has(entity)) {
+                    syncLogger.debug("CommandQueueService", "Skipping command for deferred entity", {
+                        command_id: command.command_id,
+                        entity_id: entity,
+                    });
+                    continue;
+                }
                 try {
                     await this.processCommand(command);
+                    consecutiveTransportFailures = 0;
                 }
                 catch (e) {
-                    const replayErr = e;
-                    const isNonRetryable = typeof replayErr?.status === "number" &&
-                        replayErr.status >= 400 &&
-                        replayErr.status < 500;
-                    if (isNonRetryable) {
-                        // Already marked permanent in processCommand — continue to next.
+                    // No transport at all: nothing in this pass can succeed — stop.
+                    if (isReplayNoTransport(e)) {
+                        syncLogger.info("CommandQueueService", "Replay stopped: no transport available", {
+                            command_id: command.command_id,
+                        });
+                        break;
+                    }
+                    // Per-command deferral (backoff window / retryable-4xx backoff):
+                    // defer this entity only and keep draining the rest.
+                    if (isReplayDeferred(e)) {
+                        if (entity)
+                            deferredEntities.add(entity);
+                        consecutiveTransportFailures = 0;
                         continue;
                     }
-                    // Network/5xx — stop to preserve ordering; retry later.
-                    break;
+                    const status = e?.status;
+                    const is4xx = typeof status === "number" && status >= 400 && status < 500;
+                    if (is4xx) {
+                        // Permanent/retryable-exhausted 4xx: processCommand already marked
+                        // the row failed (or absorbed it) — continue to the next command.
+                        consecutiveTransportFailures = 0;
+                        continue;
+                    }
+                    // Network/timeout/5xx: defer this entity, continue, but trip the
+                    // breaker if the transport looks dead so we stop hammering.
+                    if (entity)
+                        deferredEntities.add(entity);
+                    consecutiveTransportFailures += 1;
+                    if (consecutiveTransportFailures >= TRANSPORT_FAILURE_BREAKER) {
+                        syncLogger.warn("CommandQueueService", "Replay stopped: transport failure breaker tripped", {
+                            consecutiveTransportFailures,
+                        });
+                        break;
+                    }
                 }
             }
         }
@@ -520,7 +576,7 @@ class CommandQueueService {
     async debugDumpCommands(businessId) {
         try {
             const db = getSyncDatabase();
-            const rows = await getPendingCommands(db, Number.MAX_SAFE_INTEGER);
+            const rows = await getPendingCommands(db, Number.MAX_SAFE_INTEGER, true);
             return rows
                 .filter((c) => !businessId || c.business_id === businessId)
                 .map((c) => ({

package/dist/sync/engine.js

@@ -151,9 +151,11 @@ export class SyncEngine {
             if (attempt === "queue") {
                 // Replays must never re-enqueue-then-delete (the command would eat
                 // itself without executing). If no real transport is available, leave
-                // the row untouched for a later trigger.
+                // the row untouched for a later trigger. Distinct code so the outbox
+                // stops the whole replay pass (nothing can succeed) rather than
+                // skipping just this entity and hammering the rest.
                 if (opts?.forReplay) {
-                    throw new TransitionError(TRANSITION_ERROR_CODES.REPLAY_DEFERRED, "No transport available, keeping command queued");
+                    throw new TransitionError(TRANSITION_ERROR_CODES.REPLAY_NO_TRANSPORT, "No transport available, keeping command queued");
                 }
                 const event = await commandQueueService.enqueue(command);
                 if (queueDespiteEntitlement) {

package/dist/sync/full-sync.d.ts

@@ -1,6 +1,14 @@
 /**
- * Full sync: push → pull → push.
- * Push first so local edits (already HLC-bumped) reach server before pull
- * overwrites them; then pull merges; final drain pushes any remainder.
+ * Full sync: reference → push → pull → push.
+ *
+ * Reference (menu/hours/tax/capabilities) is pulled FIRST and non-blockingly:
+ * every phase is independently swallowed, so a reference failure never
+ * prevents queued orders from flushing. Getting reference in before the order
+ * push means newly-launched terminals can satisfy order-creation prerequisites
+ * (hour/tax/capability guards) in the same cycle.
+ *
+ * Orders still push before the order pull, so local edits (already HLC-bumped)
+ * reach the server before the pull merge could overwrite them. The final
+ * drain flushes anything newly queued or retried after the pull.
  */
 export declare function performFullSync(businessId?: string): Promise<void>;

package/dist/sync/full-sync.js

@@ -1,7 +1,15 @@
 /**
- * Full sync: push → pull → push.
- * Push first so local edits (already HLC-bumped) reach server before pull
- * overwrites them; then pull merges; final drain pushes any remainder.
+ * Full sync: reference → push → pull → push.
+ *
+ * Reference (menu/hours/tax/capabilities) is pulled FIRST and non-blockingly:
+ * every phase is independently swallowed, so a reference failure never
+ * prevents queued orders from flushing. Getting reference in before the order
+ * push means newly-launched terminals can satisfy order-creation prerequisites
+ * (hour/tax/capability guards) in the same cycle.
+ *
+ * Orders still push before the order pull, so local edits (already HLC-bumped)
+ * reach the server before the pull merge could overwrite them. The final
+ * drain flushes anything newly queued or retried after the pull.
  */
 import { getConnectivityState } from "../adapters/connectivity";
 import { getActiveBusiness } from "../adapters/business";
@@ -26,28 +34,30 @@ export async function performFullSync(businessId) {
     }
     const p = (async () => {
         try {
-            syncLogger.info("FullSync", "Starting push→pull→push", { businessId: bid });
-            // 1. Push pending FIFO first — HLC-bumped local edits outrank stale server
+            syncLogger.info("FullSync", "Starting reference→push→pull→push", { businessId: bid });
+            // 1. Reference first (non-blocking): menu/hours/tax/caps so order
+            //    creation prerequisites are present before we flush orders.
             try {
-                await drainPending(bid);
+                await referenceSyncService.sync({ businessId: bid });
             }
             catch (e) {
-                syncLogger.warn("FullSync", "drainPending(pre) failed", { err: String(e) });
+                syncLogger.warn("FullSync", "reference sync failed", { err: String(e) });
             }
-            // 2. Pull remote orders (HLC-guarded) and reference (LWW merge)
+            // 2. Push pending FIFO — HLC-bumped local edits outrank stale server
             try {
-                await pullRemoteOrders(bid);
+                await drainPending(bid);
             }
             catch (e) {
-                syncLogger.warn("FullSync", "pullRemoteOrders failed", { err: String(e) });
+                syncLogger.warn("FullSync", "drainPending(pre) failed", { err: String(e) });
             }
+            // 3. Pull remote orders (HLC-guarded)
             try {
-                await referenceSyncService.sync({ businessId: bid });
+                await pullRemoteOrders(bid);
             }
             catch (e) {
-                syncLogger.warn("FullSync", "reference sync failed", { err: String(e) });
+                syncLogger.warn("FullSync", "pullRemoteOrders failed", { err: String(e) });
             }
-            // 3. Final drain — anything newly queued or retried after pull
+            // 4. Final drain — anything newly queued or retried after pull
             try {
                 await drainPending(bid);
             }

package/dist/sync/startup-readiness.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Startup readiness for the POS/order surfaces.
+ *
+ * The offline-first guards intentionally fail closed (HOURS_NOT_SYNCED,
+ * SUBSCRIPTION_REQUIRED, "no device leased"), which is correct — but if the
+ * required reference data was never loaded, those guards fire at order-tap
+ * time as a surprise. This module lets the app discover the same conditions at
+ * launch: it evaluates the local cache (no network) and, when online, performs
+ * one bounded catch-up sync so a freshly-launched terminal can satisfy the
+ * guards before the seller starts taking orders.
+ *
+ * Seller-only. Fleet/rider surfaces are fully online and never gate here.
+ */
+import type { ReferenceDataKey } from "../reference/types";
+/**
+ * Reference keys required before the app presents itself as ready to take
+ * orders: menu to sell, taxes to price, hours to open, profile/capabilities
+ * for routing + guards, and the signed entitlement proof for gated commands.
+ */
+export declare const REQUIRED_ORDER_KEYS: readonly ReferenceDataKey[];
+export interface StartupReadiness {
+    /** True when every required key is cached and a device number is leased. */
+    ready: boolean;
+    /** Required keys with no cached payload. */
+    missingKeys: ReferenceDataKey[];
+    /** True when no DD-RRR-CCC device number is available (needs one online lease). */
+    needsLease: boolean;
+    /**
+     * True when an entitlement envelope is absent or does not evaluate as
+     * entitled. Informational: cash orders still queue offline, so this does not
+     * by itself block readiness.
+     */
+    entitlementUnverified: boolean;
+}
+/** Evaluate the local cache only (no network). */
+export declare function getStartupReadiness(businessId: string): Promise<StartupReadiness>;
+/**
+ * One bounded catch-up attempt, then evaluate the cache. When offline (or the
+ * cloud is unreachable) this performs no network work and simply reports what
+ * is cached. Never throws.
+ */
+export declare function ensureStartupReady(businessId: string, opts?: {
+    timeoutMs?: number;
+}): Promise<StartupReadiness>;

package/dist/sync/startup-readiness.js

@@ -0,0 +1,115 @@
+/**
+ * Startup readiness for the POS/order surfaces.
+ *
+ * The offline-first guards intentionally fail closed (HOURS_NOT_SYNCED,
+ * SUBSCRIPTION_REQUIRED, "no device leased"), which is correct — but if the
+ * required reference data was never loaded, those guards fire at order-tap
+ * time as a surprise. This module lets the app discover the same conditions at
+ * launch: it evaluates the local cache (no network) and, when online, performs
+ * one bounded catch-up sync so a freshly-launched terminal can satisfy the
+ * guards before the seller starts taking orders.
+ *
+ * Seller-only. Fleet/rider surfaces are fully online and never gate here.
+ */
+import { openSyncDatabase } from "../db/connection";
+import { getReferenceData } from "../reference/operations";
+import { referenceSyncService } from "../reference/service";
+import { evaluateBusinessEntitlements } from "../reference/entitlement-guard";
+import { ensureLease } from "./device-lease.service";
+import { getConnectivityState } from "../adapters/connectivity";
+import { syncLogger } from "../utils/sync-logger";
+/**
+ * Reference keys required before the app presents itself as ready to take
+ * orders: menu to sell, taxes to price, hours to open, profile/capabilities
+ * for routing + guards, and the signed entitlement proof for gated commands.
+ */
+export const REQUIRED_ORDER_KEYS = [
+    "subscription:entitlements",
+    "capabilities",
+    "menu:categories",
+    "menu:items",
+    "tax-rules",
+    "business:profile",
+    "operating-hours",
+];
+/** Evaluate the local cache only (no network). */
+export async function getStartupReadiness(businessId) {
+    const db = await openSyncDatabase();
+    const records = await Promise.all(REQUIRED_ORDER_KEYS.map(async (key) => ({
+        key,
+        rec: await getReferenceData(db, businessId, key),
+    })));
+    const missingKeys = records
+        .filter((r) => !r.rec || r.rec.payload == null)
+        .map((r) => r.key);
+    // ensureLease() hydrates the sync KV from async KV and leases online when
+    // possible; offline with no cache it returns null (caller blocks POS).
+    let deviceNumber = null;
+    try {
+        deviceNumber = await ensureLease(businessId);
+    }
+    catch (e) {
+        syncLogger.warn("StartupReadiness", "lease check failed", { err: String(e) });
+    }
+    const needsLease = !deviceNumber;
+    let entitlementUnverified = missingKeys.includes("subscription:entitlements");
+    if (!entitlementUnverified) {
+        try {
+            const { evaluation } = await evaluateBusinessEntitlements(businessId);
+            entitlementUnverified = !evaluation.entitled;
+        }
+        catch {
+            entitlementUnverified = true;
+        }
+    }
+    return {
+        ready: missingKeys.length === 0 && !needsLease,
+        missingKeys,
+        needsLease,
+        entitlementUnverified,
+    };
+}
+/**
+ * One bounded catch-up attempt, then evaluate the cache. When offline (or the
+ * cloud is unreachable) this performs no network work and simply reports what
+ * is cached. Never throws.
+ */
+export async function ensureStartupReady(businessId, opts) {
+    const timeoutMs = opts?.timeoutMs ?? 15000;
+    const { isOnline, isCloudReachable } = getConnectivityState();
+    if (isOnline && isCloudReachable !== "unreachable") {
+        const catchUp = (async () => {
+            try {
+                await referenceSyncService.sync({ businessId, keys: [...REQUIRED_ORDER_KEYS] });
+            }
+            catch (e) {
+                syncLogger.warn("StartupReadiness", "reference catch-up failed", { err: String(e) });
+            }
+            try {
+                await ensureLease(businessId);
+            }
+            catch (e) {
+                syncLogger.warn("StartupReadiness", "lease catch-up failed", { err: String(e) });
+            }
+        })();
+        await raceWithTimeout(catchUp, timeoutMs);
+    }
+    return getStartupReadiness(businessId);
+}
+/** Resolve after either the promise settles or the timeout elapses. */
+async function raceWithTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(resolve, ms);
+    });
+    try {
+        await Promise.race([
+            promise.then(() => undefined, () => undefined),
+            timeout,
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/dist/sync/transition-errors.d.ts

@@ -18,6 +18,13 @@ export declare const TRANSITION_ERROR_CODES: {
     readonly FORBIDDEN: "FORBIDDEN";
     readonly SUBSCRIPTION_REQUIRED: "SUBSCRIPTION_REQUIRED";
     readonly REPLAY_DEFERRED: "REPLAY_DEFERRED";
+    /**
+     * Replay found no usable transport at all (cloud + LAN both unavailable).
+     * Distinct from REPLAY_DEFERRED (per-command backoff/retryable-4xx) so the
+     * outbox can stop the whole pass instead of skipping just this entity:
+     * nothing can succeed until a transport returns.
+     */
+    readonly REPLAY_NO_TRANSPORT: "REPLAY_NO_TRANSPORT";
     readonly MISSING_RIDER: "MISSING_RIDER";
     readonly NO_DELIVERY: "NO_DELIVERY";
 };
@@ -30,3 +37,4 @@ export declare class TransitionError extends Error {
 export declare function errorCodeOf(error: unknown): string | undefined;
 export declare function isFinalGuardRejection(error: unknown): boolean;
 export declare function isReplayDeferred(error: unknown): boolean;
+export declare function isReplayNoTransport(error: unknown): boolean;

package/dist/sync/transition-errors.js

@@ -18,6 +18,13 @@ export const TRANSITION_ERROR_CODES = {
     FORBIDDEN: "FORBIDDEN",
     SUBSCRIPTION_REQUIRED: "SUBSCRIPTION_REQUIRED",
     REPLAY_DEFERRED: "REPLAY_DEFERRED",
+    /**
+     * Replay found no usable transport at all (cloud + LAN both unavailable).
+     * Distinct from REPLAY_DEFERRED (per-command backoff/retryable-4xx) so the
+     * outbox can stop the whole pass instead of skipping just this entity:
+     * nothing can succeed until a transport returns.
+     */
+    REPLAY_NO_TRANSPORT: "REPLAY_NO_TRANSPORT",
     MISSING_RIDER: "MISSING_RIDER",
     NO_DELIVERY: "NO_DELIVERY",
 };
@@ -59,3 +66,6 @@ export function isFinalGuardRejection(error) {
 export function isReplayDeferred(error) {
     return errorCodeOf(error) === TRANSITION_ERROR_CODES.REPLAY_DEFERRED;
 }
+export function isReplayNoTransport(error) {
+    return errorCodeOf(error) === TRANSITION_ERROR_CODES.REPLAY_NO_TRANSPORT;
+}

package/dist/test-helpers/memory-driver.js

@@ -95,6 +95,18 @@ export function createMemoryDriver() {
                     tables.commands.push(row);
                 return { lastInsertRowId: row.id, changes: 1 };
             }
+            // crash recovery: in_flight -> pending on open
+            if (s.includes("UPDATE commands SET status = 'pending'") && s.includes("WHERE status = 'in_flight'")) {
+                let changes = 0;
+                for (const row of tables.commands) {
+                    if (row.status === "in_flight") {
+                        row.status = "pending";
+                        row.error = null;
+                        changes += 1;
+                    }
+                }
+                return { lastInsertRowId: 0, changes };
+            }
             // commands update status (4- or 5-placeholder variants — always take the
             // LAST arg as command_id; older code assumed 5).
             if (s.includes("UPDATE commands SET status = ?")) {
@@ -365,7 +377,12 @@ export function createMemoryDriver() {
             }
             if (s.includes("SELECT * FROM commands") && s.includes("WHERE status IN")) {
                 const limit = args[args.length - 1];
-                let rows = tables.commands.filter((r) => r.status === "pending" || r.status === "failed").sort((a, b) => (a.created_at < b.created_at ? -1 : 1));
+                // Mirror production: `failed` is terminal and only returned when the
+                // caller opts in (includeFailed -> SQL contains 'failed').
+                const includeFailed = s.includes("'failed'");
+                let rows = tables.commands
+                    .filter((r) => r.status === "pending" || (includeFailed && r.status === "failed"))
+                    .sort((a, b) => (a.created_at < b.created_at ? -1 : 1));
                 if (limit)
                     rows = rows.slice(0, limit);
                 return rows;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teincfood/core",
-  "version": "0.9.14",
+  "version": "0.9.15",
   "description": "TeincFood shared offline-first core — types, sync engine, local DB, reference data, and repositories for mobile + desktop",
   "type": "module",
   "main": "dist/index.js",