platform-types 1.10.717 → 1.10.719

package/dist/basket.d.ts

@@ -76,4 +76,27 @@ declare global {
  */
 export declare const BASKET_ERROR_CODES: readonly ["VALIDATION_FAILED", "FOREIGN_INDEX_KEY_ATTRIBUTE", "CART_TARGET_REQUIRED", "CART_NOT_FOUND", "CART_REVIEW_INCOMPLETE", "CART_REVIEW_UNAVAILABLE", "CART_NOT_PARKED", "CART_ALREADY_PARKED", "TERMINAL_INDEX_UNAVAILABLE", "PRODUCT_NOT_FOUND", "PRODUCT_COST_UNKNOWN", "UNIT_QUANTITY_NOT_WHOLE", "BASKET_VERSION_CONFLICT", "BASKET_LINE_LIMIT", "BASKET_SIZE_LIMIT", "UNKNOWN_LINE", "INVALID_PRICE", "LINE_DISCOUNT_NOT_ALLOWED", "LINE_DISCOUNT_EXCEEDS_MAX", "FX_CONVERSION_UNAVAILABLE", "COUPON_NOT_FOUND", "COUPON_NOT_ACTIVE", "COUPON_EXPIRED", "COUPON_EXHAUSTED", "COUPON_MIN_SUBTOTAL", "COUPON_REQUIRES_CUSTOMER", "COUPON_BUDGET_EXHAUSTED", "COUPON_RATE_LIMITED", "COUPON_CURRENCY_MISMATCH", "PROMOTION_NOT_FOUND", "PROMOTION_NOT_ACTIVE", "PROMOTION_NOT_STARTED", "PROMOTION_EXPIRED", "PROMOTION_NOT_CART_APPLICABLE"];
 export type BasketErrorCode = (typeof BASKET_ERROR_CODES)[number];
+/**
+ * The refusals the storefront's POST /basket { mode: 'resume', token } handler
+ * itself answers (an abandoned-cart recovery link). Middleware refusals
+ * (GATING_ERROR_CODES, STOREFRONT_UNAVAILABLE, validation) are separate, and so
+ * are the cart resolver's BasketErrorCode refusals, which the fold or
+ * reinstatement write forwards unchanged once ownership is proven (for example
+ * 409 BASKET_VERSION_CONFLICT, or 404 CART_NOT_FOUND carrying data.cartId when
+ * the fold target was deleted mid-request).
+ *
+ * - CART_RESUME_UNAVAILABLE (404): every reason the link cannot be honoured —
+ *   invalid or expired token, another store, a cart that is gone, converted,
+ *   owned by someone else, held by a till, or already folded into a cart that
+ *   has since gone — with one identical body, so a
+ *   forwarded email is never an existence oracle. Render one neutral message.
+ * - CART_RESUME_INCOMPLETE (503): the caller owns the cart, but whether a live
+ *   cart should receive the recovered lines could not be proven — the read of
+ *   the caller's carts stopped at its row ceiling (200 or more carts) or its
+ *   time budget, or the strong re-read contradicted the index's pick. Nothing
+ *   was written. A ceiling stop repeats until carts are reaped; the others
+ *   clear on retry.
+ */
+export declare const BASKET_RESUME_ERROR_CODES: readonly ["CART_RESUME_UNAVAILABLE", "CART_RESUME_INCOMPLETE"];
+export type BasketResumeErrorCode = (typeof BASKET_RESUME_ERROR_CODES)[number];
 export {};

package/dist/basket.js

@@ -46,3 +46,25 @@ export const BASKET_ERROR_CODES = [
     'PROMOTION_EXPIRED',
     'PROMOTION_NOT_CART_APPLICABLE',
 ];
+/**
+ * The refusals the storefront's POST /basket { mode: 'resume', token } handler
+ * itself answers (an abandoned-cart recovery link). Middleware refusals
+ * (GATING_ERROR_CODES, STOREFRONT_UNAVAILABLE, validation) are separate, and so
+ * are the cart resolver's BasketErrorCode refusals, which the fold or
+ * reinstatement write forwards unchanged once ownership is proven (for example
+ * 409 BASKET_VERSION_CONFLICT, or 404 CART_NOT_FOUND carrying data.cartId when
+ * the fold target was deleted mid-request).
+ *
+ * - CART_RESUME_UNAVAILABLE (404): every reason the link cannot be honoured —
+ *   invalid or expired token, another store, a cart that is gone, converted,
+ *   owned by someone else, held by a till, or already folded into a cart that
+ *   has since gone — with one identical body, so a
+ *   forwarded email is never an existence oracle. Render one neutral message.
+ * - CART_RESUME_INCOMPLETE (503): the caller owns the cart, but whether a live
+ *   cart should receive the recovered lines could not be proven — the read of
+ *   the caller's carts stopped at its row ceiling (200 or more carts) or its
+ *   time budget, or the strong re-read contradicted the index's pick. Nothing
+ *   was written. A ceiling stop repeats until carts are reaped; the others
+ *   clear on retry.
+ */
+export const BASKET_RESUME_ERROR_CODES = ['CART_RESUME_UNAVAILABLE', 'CART_RESUME_INCOMPLETE'];

package/dist/cart.d.ts

@@ -56,15 +56,17 @@ declare global {
         parkedBy?: string;
         /**
          * Epoch ms this ABANDONED cart's lines were folded into another cart by
-         * `POST /basket` `{ mode: 'resume' }`. Set once and never cleared.
+         * `POST /basket` `{ mode: 'resume' }`. Set once; cleared again only when the
+         * fold it was claimed for was REFUSED before writing anything (so the link
+         * can fold the lines on retry).
          *
          * ⚠️ **It is a CONSUMPTION marker, not a timestamp anyone should render.**
          * The fold uses `merge`, which SUMS, and the abandoned row survives with
          * its lines for as long as the recovery link does — so without a marker a
          * refresh, a back-navigation or a component that mounts twice would re-add
          * every quantity, for days. The resume write sets this under
-         * `attribute_not_exists(resumedAt)`, so exactly one caller can ever win and
-         * every replay answers the cart the shopper already has.
+         * `attribute_not_exists(resumedAt)`, so exactly one caller wins each claim
+         * and every replay answers the cart the shopper already has.
          *
          * ⚠️ Absent on the OTHER resume path — a shopper with no second cart has
          * their own cart reinstated in place, which adds nothing and needs no
@@ -806,12 +808,23 @@ declare global {
      * an email, is HMAC-signed, expires, and carries `{ storeId, cartId }` and
      * nothing about a person.
      *
-     * ⚠️ **Every refusal is the SAME 4xx and the same bare code** — an invalid or
-     * expired token, a cart that no longer exists, a cart already converted to an
-     * order, and a cart belonging to a DIFFERENT customer are indistinguishable on
-     * the wire, deliberately. A recovery email gets forwarded; the response must
-     * never tell the reader whether the cart is real. A consumer must therefore
-     * render exactly one neutral message and must not try to explain the failure.
+     * ⚠️ **Every refusal about the LINK is the SAME 404 and the same bare code**
+     * (`CART_RESUME_UNAVAILABLE`) — an invalid or expired token, a cart that no
+     * longer exists, a cart already converted to an order or already folded into
+     * a cart since gone, and a cart belonging to a DIFFERENT customer are
+     * indistinguishable on the wire, deliberately. A recovery email gets
+     * forwarded; the response must never tell the reader whether the cart is
+     * real. A consumer must therefore render exactly one neutral message for it
+     * and must not try to explain the failure.
+     *
+     * Only AFTER ownership is proven can two other kinds of refusal appear, and a
+     * consumer may treat them as retryable: `503 CART_RESUME_INCOMPLETE` (the
+     * caller's other carts could not all be read, so no fold-or-reinstate choice
+     * was made and nothing was written) and the cart resolver's own
+     * {@link BasketErrorCode} refusals, forwarded unchanged from the fold or
+     * reinstatement write (e.g. `409 BASKET_VERSION_CONFLICT`, `404
+     * CART_NOT_FOUND` for a target deleted mid-request). See
+     * `BASKET_RESUME_ERROR_CODES`.
      *
      * ⚠️ On success it answers the ordinary {@link CartActionResponse}. If the
      * caller already holds another cart with lines, the recovered lines are FOLDED

package/dist/cash.d.ts

@@ -468,7 +468,11 @@ declare global {
 }
 /**
  * Refusals from the cash-shift surface — `stacks/lambdas/shifts/*.ts`
- * (`_get`, `_post`, `_patchClose`, `_postMovement`, `_patchReconcile`).
+ * (`_get`, `_post`, `_patchClose`, `_postMovement`, `_patchReconcile`) — plus
+ * the shared drawer write's own `CASH_DRAWER_BUSY`, which `POST /cash`,
+ * `POST`/`DELETE /account` and a cash return answer. A tender or seña does
+ * not: a tender's drawer collision is `SHIFT_NOT_OPEN` or `422 CURRENCY_MISMATCH`,
+ * a seña's `SHIFT_NOT_OPEN` or `409 DEPOSIT_CURRENCY_MISMATCH`.
  *
  * - `INVALID_SHIFT_ID` · 400 · `SHIFT_NOT_FOUND` · 404
  * - `SHIFT_ALREADY_OPEN` · 409 — one open shift per cashier.
@@ -489,15 +493,24 @@ declare global {
  * - `SHIFT_EVENTS_TRUNCATED` · 503 — the event log could not be read in full, so
  *   the totals behind a close or a reconcile would be computed from a partial
  *   ledger.
+ * - `CASH_DRAWER_BUSY` · 409 — emitted by the shared drawer write
+ *   (`drawerWriteRefusal`, `stacks/services/shifts.ts`), not by a `/shifts`
+ *   route: `POST /account` and `POST /cash` answer it when their transaction is
+ *   cancelled by a pure conflict on any item it writes (most often the drawer
+ *   row), as do `DELETE /account` and `POST /orders { mode: 'return' }` on a
+ *   cash leg. Nothing was written; retry the same request.
  * - `SELF_APPROVAL_FORBIDDEN` · 403 — segregation of duties: the cashier who
  *   closed a shift cannot reconcile it.
  * - `INVALID_DENOMINATION` · 400 · `INVALID_CURSOR` · 400
+ * - `WAREHOUSE_NOT_FOUND` · 404 — `GET /shifts?warehouseId=` naming a depósito
+ *   the store does not have (`resolveReportWarehouseFilter`).
  * - `ROLE_FORBIDDEN` · 403 · `VALIDATION_FAILED` · 400
  *
  * ⚠️ Cross-cutting refusals are NOT repeated here — check `GATING_ERROR_CODES`
- * as well.
+ * as well, and `TERMINAL_ELEVATION_ERROR_CODES` for a money-out movement's PIN
+ * elevation.
  */
-export declare const SHIFT_ERROR_CODES: readonly ["INVALID_SHIFT_ID", "SHIFT_NOT_FOUND", "SHIFT_ALREADY_OPEN", "SHIFT_NOT_OPEN", "SHIFT_NOT_CLOSED", "SHIFT_OWNER_MISMATCH", "CURRENCY_MISMATCH", "BUCKET_COUNTS_INVALID", "BUCKET_REVIEW_INVALID", "BUCKET_COUNT_MISSING", "SHIFT_CHANGED", "SHIFT_EVENTS_TRUNCATED", "SELF_APPROVAL_FORBIDDEN", "INVALID_DENOMINATION", "INVALID_CURSOR", "ROLE_FORBIDDEN", "VALIDATION_FAILED"];
+export declare const SHIFT_ERROR_CODES: readonly ["INVALID_SHIFT_ID", "SHIFT_NOT_FOUND", "SHIFT_ALREADY_OPEN", "SHIFT_NOT_OPEN", "SHIFT_NOT_CLOSED", "SHIFT_OWNER_MISMATCH", "CURRENCY_MISMATCH", "BUCKET_COUNTS_INVALID", "BUCKET_REVIEW_INVALID", "BUCKET_COUNT_MISSING", "SHIFT_CHANGED", "SHIFT_EVENTS_TRUNCATED", "CASH_DRAWER_BUSY", "SELF_APPROVAL_FORBIDDEN", "INVALID_DENOMINATION", "INVALID_CURSOR", "WAREHOUSE_NOT_FOUND", "ROLE_FORBIDDEN", "VALIDATION_FAILED"];
 export type ShiftErrorCode = (typeof SHIFT_ERROR_CODES)[number];
 /**
  * Where a {@link ShiftMethodTotal}'s `label` came from.

package/dist/cash.js

@@ -1,6 +1,10 @@
 /**
  * Refusals from the cash-shift surface — `stacks/lambdas/shifts/*.ts`
- * (`_get`, `_post`, `_patchClose`, `_postMovement`, `_patchReconcile`).
+ * (`_get`, `_post`, `_patchClose`, `_postMovement`, `_patchReconcile`) — plus
+ * the shared drawer write's own `CASH_DRAWER_BUSY`, which `POST /cash`,
+ * `POST`/`DELETE /account` and a cash return answer. A tender or seña does
+ * not: a tender's drawer collision is `SHIFT_NOT_OPEN` or `422 CURRENCY_MISMATCH`,
+ * a seña's `SHIFT_NOT_OPEN` or `409 DEPOSIT_CURRENCY_MISMATCH`.
  *
  * - `INVALID_SHIFT_ID` · 400 · `SHIFT_NOT_FOUND` · 404
  * - `SHIFT_ALREADY_OPEN` · 409 — one open shift per cashier.
@@ -21,13 +25,22 @@
  * - `SHIFT_EVENTS_TRUNCATED` · 503 — the event log could not be read in full, so
  *   the totals behind a close or a reconcile would be computed from a partial
  *   ledger.
+ * - `CASH_DRAWER_BUSY` · 409 — emitted by the shared drawer write
+ *   (`drawerWriteRefusal`, `stacks/services/shifts.ts`), not by a `/shifts`
+ *   route: `POST /account` and `POST /cash` answer it when their transaction is
+ *   cancelled by a pure conflict on any item it writes (most often the drawer
+ *   row), as do `DELETE /account` and `POST /orders { mode: 'return' }` on a
+ *   cash leg. Nothing was written; retry the same request.
  * - `SELF_APPROVAL_FORBIDDEN` · 403 — segregation of duties: the cashier who
  *   closed a shift cannot reconcile it.
  * - `INVALID_DENOMINATION` · 400 · `INVALID_CURSOR` · 400
+ * - `WAREHOUSE_NOT_FOUND` · 404 — `GET /shifts?warehouseId=` naming a depósito
+ *   the store does not have (`resolveReportWarehouseFilter`).
  * - `ROLE_FORBIDDEN` · 403 · `VALIDATION_FAILED` · 400
  *
  * ⚠️ Cross-cutting refusals are NOT repeated here — check `GATING_ERROR_CODES`
- * as well.
+ * as well, and `TERMINAL_ELEVATION_ERROR_CODES` for a money-out movement's PIN
+ * elevation.
  */
 export const SHIFT_ERROR_CODES = [
     'INVALID_SHIFT_ID',
@@ -42,9 +55,11 @@ export const SHIFT_ERROR_CODES = [
     'BUCKET_COUNT_MISSING',
     'SHIFT_CHANGED',
     'SHIFT_EVENTS_TRUNCATED',
+    'CASH_DRAWER_BUSY',
     'SELF_APPROVAL_FORBIDDEN',
     'INVALID_DENOMINATION',
     'INVALID_CURSOR',
+    'WAREHOUSE_NOT_FOUND',
     'ROLE_FORBIDDEN',
     'VALIDATION_FAILED',
 ];

package/dist/cjs/basket.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BASKET_ERROR_CODES = void 0;
+exports.BASKET_RESUME_ERROR_CODES = exports.BASKET_ERROR_CODES = void 0;
 /**
  * Domain refusals from POST /baskets (replacement, named actions and park/resume)
  * and GET /baskets?mode=review. Check GATING_ERROR_CODES separately for middleware
@@ -49,3 +49,25 @@ exports.BASKET_ERROR_CODES = [
     'PROMOTION_EXPIRED',
     'PROMOTION_NOT_CART_APPLICABLE',
 ];
+/**
+ * The refusals the storefront's POST /basket { mode: 'resume', token } handler
+ * itself answers (an abandoned-cart recovery link). Middleware refusals
+ * (GATING_ERROR_CODES, STOREFRONT_UNAVAILABLE, validation) are separate, and so
+ * are the cart resolver's BasketErrorCode refusals, which the fold or
+ * reinstatement write forwards unchanged once ownership is proven (for example
+ * 409 BASKET_VERSION_CONFLICT, or 404 CART_NOT_FOUND carrying data.cartId when
+ * the fold target was deleted mid-request).
+ *
+ * - CART_RESUME_UNAVAILABLE (404): every reason the link cannot be honoured —
+ *   invalid or expired token, another store, a cart that is gone, converted,
+ *   owned by someone else, held by a till, or already folded into a cart that
+ *   has since gone — with one identical body, so a
+ *   forwarded email is never an existence oracle. Render one neutral message.
+ * - CART_RESUME_INCOMPLETE (503): the caller owns the cart, but whether a live
+ *   cart should receive the recovered lines could not be proven — the read of
+ *   the caller's carts stopped at its row ceiling (200 or more carts) or its
+ *   time budget, or the strong re-read contradicted the index's pick. Nothing
+ *   was written. A ceiling stop repeats until carts are reaped; the others
+ *   clear on retry.
+ */
+exports.BASKET_RESUME_ERROR_CODES = ['CART_RESUME_UNAVAILABLE', 'CART_RESUME_INCOMPLETE'];

package/dist/cjs/cash.js

@@ -3,7 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.METHOD_LABEL_SOURCES = exports.SHIFT_ERROR_CODES = void 0;
 /**
  * Refusals from the cash-shift surface — `stacks/lambdas/shifts/*.ts`
- * (`_get`, `_post`, `_patchClose`, `_postMovement`, `_patchReconcile`).
+ * (`_get`, `_post`, `_patchClose`, `_postMovement`, `_patchReconcile`) — plus
+ * the shared drawer write's own `CASH_DRAWER_BUSY`, which `POST /cash`,
+ * `POST`/`DELETE /account` and a cash return answer. A tender or seña does
+ * not: a tender's drawer collision is `SHIFT_NOT_OPEN` or `422 CURRENCY_MISMATCH`,
+ * a seña's `SHIFT_NOT_OPEN` or `409 DEPOSIT_CURRENCY_MISMATCH`.
  *
  * - `INVALID_SHIFT_ID` · 400 · `SHIFT_NOT_FOUND` · 404
  * - `SHIFT_ALREADY_OPEN` · 409 — one open shift per cashier.
@@ -24,13 +28,22 @@ exports.METHOD_LABEL_SOURCES = exports.SHIFT_ERROR_CODES = void 0;
  * - `SHIFT_EVENTS_TRUNCATED` · 503 — the event log could not be read in full, so
  *   the totals behind a close or a reconcile would be computed from a partial
  *   ledger.
+ * - `CASH_DRAWER_BUSY` · 409 — emitted by the shared drawer write
+ *   (`drawerWriteRefusal`, `stacks/services/shifts.ts`), not by a `/shifts`
+ *   route: `POST /account` and `POST /cash` answer it when their transaction is
+ *   cancelled by a pure conflict on any item it writes (most often the drawer
+ *   row), as do `DELETE /account` and `POST /orders { mode: 'return' }` on a
+ *   cash leg. Nothing was written; retry the same request.
  * - `SELF_APPROVAL_FORBIDDEN` · 403 — segregation of duties: the cashier who
  *   closed a shift cannot reconcile it.
  * - `INVALID_DENOMINATION` · 400 · `INVALID_CURSOR` · 400
+ * - `WAREHOUSE_NOT_FOUND` · 404 — `GET /shifts?warehouseId=` naming a depósito
+ *   the store does not have (`resolveReportWarehouseFilter`).
  * - `ROLE_FORBIDDEN` · 403 · `VALIDATION_FAILED` · 400
  *
  * ⚠️ Cross-cutting refusals are NOT repeated here — check `GATING_ERROR_CODES`
- * as well.
+ * as well, and `TERMINAL_ELEVATION_ERROR_CODES` for a money-out movement's PIN
+ * elevation.
  */
 exports.SHIFT_ERROR_CODES = [
     'INVALID_SHIFT_ID',
@@ -45,9 +58,11 @@ exports.SHIFT_ERROR_CODES = [
     'BUCKET_COUNT_MISSING',
     'SHIFT_CHANGED',
     'SHIFT_EVENTS_TRUNCATED',
+    'CASH_DRAWER_BUSY',
     'SELF_APPROVAL_FORBIDDEN',
     'INVALID_DENOMINATION',
     'INVALID_CURSOR',
+    'WAREHOUSE_NOT_FOUND',
     'ROLE_FORBIDDEN',
     'VALIDATION_FAILED',
 ];

package/dist/order.d.ts

@@ -1867,6 +1867,39 @@ declare global {
          */
         cancellation?: OrderCancellability;
     }
+    /**
+     * `POST /orders { mode: 'tender' }` — ring one or more tender legs against an
+     * EXISTING order (the append counterpart of the create leg's
+     * {@link CreateOrderRequest.tenders}). Any operator but PRINTER or ACCOUNTANT
+     * (`403 ROLE_FORBIDDEN`).
+     *
+     * `shiftId` attributes the legs to a drawer. An EXPLICIT value must be the
+     * caller's own OPEN shift — anything else is `409 SHIFT_NOT_AVAILABLE`, never
+     * a silent drop. OMITTED resolves the caller's own open drawer; with none, a
+     * cash leg lands on the store's default drawer. At commit the drawer is
+     * re-asserted: one that closed mid-request is `409 SHIFT_NOT_OPEN`, one that
+     * did not declare the order's currency `422 CURRENCY_MISMATCH`.
+     *
+     * The opt-in `Idempotency-Key` and the lost-reply recovery through
+     * `mode: 'collection-attempt'` follow the money-write rule documented on
+     * {@link ORDER_ERROR_CODES} (and {@link OrderCollectionAttemptLookupRequest});
+     * it is not restated here. Every refusal specific to this mode is in that
+     * tuple; a body the schema rejects is `400 VALIDATION_FAILED`, and the
+     * cross-cutting refusals (`ROLE_FORBIDDEN`, `IMPERSONATION_READONLY`, …) are
+     * in `GATING_ERROR_CODES`.
+     *
+     * Tied to its validator (`tenderModeSchema`, `stacks/lambdas/orders/_tender.ts`)
+     * by `AssertOrderTenderRequestMatchesSchema` — `mode` is the router's key.
+     */
+    interface OrderTenderRequest {
+        mode: 'tender';
+        /** `ORD` followed by 6–10 digits. */
+        orderId: string;
+        /** RAW legs — see {@link TenderLegInput}. */
+        tenders: TenderLegInput[];
+        /** 1–100 chars; the caller's own OPEN shift. Omit to use the caller's open drawer. */
+        shiftId?: string;
+    }
     /**
      * `POST /orders { mode: 'deposit' }` — record a SEÑA (a sales deposit) on an
      * existing, undelivered order, as one {@link OrderTender} leg carrying
@@ -1925,7 +1958,7 @@ declare global {
         change?: number;
         /** Required, never defaulted. `true` needs an authorized factura on the order first. */
         freezesPrice: boolean;
-        /** Same semantics as `mode: 'tender'`'s. */
+        /** Same semantics as {@link OrderTenderRequest.shiftId}. */
         shiftId?: string;
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.717",
+	"version": "1.10.719",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",