platform-types 1.10.782 → 1.10.784

package/dist/basket.d.ts

@@ -99,4 +99,60 @@ export type BasketErrorCode = (typeof BASKET_ERROR_CODES)[number];
  */
 export declare const BASKET_RESUME_ERROR_CODES: readonly ["CART_RESUME_UNAVAILABLE", "CART_RESUME_INCOMPLETE"];
 export type BasketResumeErrorCode = (typeof BASKET_RESUME_ERROR_CODES)[number];
+/**
+ * The guest cart token's header, BOTH ways. A shopper with no account sends it
+ * on `GET`, `POST` and `DELETE /basket/guest`, and every successful guest
+ * `POST` answers a fresh one in the same header (exposed to browser JS through
+ * `Access-Control-Expose-Headers`). Keep the newest: each write slides the
+ * 30-day expiry. The first `POST`, sent without one, creates the cart and is
+ * the only way to obtain one. Never put it in a URL or a log.
+ */
+export declare const GUEST_CART_TOKEN_HEADER = "X-Guest-Cart-Token";
+/**
+ * The refusals the guest cart routes answer themselves, beside the cart
+ * resolver's `BasketErrorCode` refusals they forward unchanged.
+ *
+ * - GUEST_CART_TOKEN_INVALID (401): every reason the token cannot be honoured —
+ *   missing, tampered, expired, minted for another store or presented on
+ *   another store's host or `x-store`, revoked by a sign-in merge, or naming a
+ *   cart that is gone, belongs to an account, is held by a till, was checked
+ *   out or was swept as abandoned — with one identical body, so the token is
+ *   never an oracle. Drop the token and start a new guest cart.
+ * - GUEST_CHECKOUT_DISABLED (403): the shop does not sell to guests — it has not
+ *   switched guest checkout on, admits buyers only after approval, or hides
+ *   prices from anonymous visitors. Public `GET /store` reports the same verdict
+ *   as `ecommerce.config.guestCheckoutAvailable`.
+ * - GUEST_CHECKOUT_SIGNED_IN (409): the request carried an `Authorization`
+ *   header. A signed-in buyer is priced and policed as their account, so they
+ *   use `/basket`; nothing was read or written.
+ *
+ * A token-holding guest write must send the `version` it read; a stale one is
+ * `409 CART_CHANGED_SINCE_CONFIRM` with `data: { currentCartVersion }` (the
+ * storefront checkout's code) and writes nothing.
+ */
+export declare const GUEST_CART_ERROR_CODES: readonly ["GUEST_CART_TOKEN_INVALID", "GUEST_CHECKOUT_DISABLED", "GUEST_CHECKOUT_SIGNED_IN"];
+export type GuestCartErrorCode = (typeof GUEST_CART_ERROR_CODES)[number];
+declare global {
+    /**
+     * A guest cart write's body: exactly the `/basket` named-action envelope.
+     * `data` is the cart without buy prices or any server-owned revocation
+     * field. The re-issued token travels in the `X-Guest-Cart-Token` response
+     * header, never in the body.
+     */
+    type GuestCartResponse = CartActionResponse;
+    /**
+     * `POST /basket { mode: 'merge-guest' }` on the SIGNED-IN route: fold the
+     * guest cart the token names into the caller's own cart, re-priced at the
+     * account's terms (overflow in `droppedSkus`), and revoke the token in the
+     * same write that marks the guest cart `converted`. Answers the `/basket`
+     * named-action envelope; a replay of the same token is
+     * `401 GUEST_CART_TOKEN_INVALID`. `version` is the caller's OWN cart
+     * version, as on every other named action.
+     */
+    interface GuestCartMergeRequest {
+        mode: 'merge-guest';
+        guestCartToken: string;
+        version?: number;
+    }
+}
 export {};

package/dist/basket.js

@@ -68,3 +68,39 @@ export const BASKET_ERROR_CODES = [
  *   clear on retry.
  */
 export const BASKET_RESUME_ERROR_CODES = ['CART_RESUME_UNAVAILABLE', 'CART_RESUME_INCOMPLETE'];
+/**
+ * The guest cart token's header, BOTH ways. A shopper with no account sends it
+ * on `GET`, `POST` and `DELETE /basket/guest`, and every successful guest
+ * `POST` answers a fresh one in the same header (exposed to browser JS through
+ * `Access-Control-Expose-Headers`). Keep the newest: each write slides the
+ * 30-day expiry. The first `POST`, sent without one, creates the cart and is
+ * the only way to obtain one. Never put it in a URL or a log.
+ */
+export const GUEST_CART_TOKEN_HEADER = 'X-Guest-Cart-Token';
+/**
+ * The refusals the guest cart routes answer themselves, beside the cart
+ * resolver's `BasketErrorCode` refusals they forward unchanged.
+ *
+ * - GUEST_CART_TOKEN_INVALID (401): every reason the token cannot be honoured —
+ *   missing, tampered, expired, minted for another store or presented on
+ *   another store's host or `x-store`, revoked by a sign-in merge, or naming a
+ *   cart that is gone, belongs to an account, is held by a till, was checked
+ *   out or was swept as abandoned — with one identical body, so the token is
+ *   never an oracle. Drop the token and start a new guest cart.
+ * - GUEST_CHECKOUT_DISABLED (403): the shop does not sell to guests — it has not
+ *   switched guest checkout on, admits buyers only after approval, or hides
+ *   prices from anonymous visitors. Public `GET /store` reports the same verdict
+ *   as `ecommerce.config.guestCheckoutAvailable`.
+ * - GUEST_CHECKOUT_SIGNED_IN (409): the request carried an `Authorization`
+ *   header. A signed-in buyer is priced and policed as their account, so they
+ *   use `/basket`; nothing was read or written.
+ *
+ * A token-holding guest write must send the `version` it read; a stale one is
+ * `409 CART_CHANGED_SINCE_CONFIRM` with `data: { currentCartVersion }` (the
+ * storefront checkout's code) and writes nothing.
+ */
+export const GUEST_CART_ERROR_CODES = [
+    'GUEST_CART_TOKEN_INVALID',
+    'GUEST_CHECKOUT_DISABLED',
+    'GUEST_CHECKOUT_SIGNED_IN',
+];

package/dist/cart.d.ts

@@ -76,6 +76,22 @@ declare global {
          * `parkedAt` and to the POS un-park verb, which happens to share the word.
          */
         resumedAt?: number;
+        /**
+         * SERVER-OWNED, guest carts only: the revocation generation of the guest
+         * cart token. A token carries the generation it was minted at and is refused
+         * once this moves; absent reads as 0. The sign-in merge (`POST /basket
+         * { mode: 'merge-guest' }`) adds 1 in the same write that marks the cart
+         * `converted`. Never sent to a shopper; no client writes it.
+         */
+        guestTokenGeneration?: number;
+        /**
+         * SERVER-OWNED, guest carts only: the random value the write that CREATED
+         * the guest cart stamped, carried by every guest cart token minted for it.
+         * A token is honoured only on a row bearing its own nonce, so a row deleted
+         * and re-created under the same `cartId` never revives an old token. Never
+         * sent to a shopper or an operator; no client writes it.
+         */
+        guestTokenNonce?: string;
         parkedAt?: number;
         version?: number;
         lines: CartLine[];

package/dist/cjs/basket.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BASKET_RESUME_ERROR_CODES = exports.BASKET_ERROR_CODES = void 0;
+exports.GUEST_CART_ERROR_CODES = exports.GUEST_CART_TOKEN_HEADER = exports.BASKET_RESUME_ERROR_CODES = exports.BASKET_ERROR_CODES = void 0;
 /**
  * Domain refusals from POST /baskets (replacement, named actions and park/resume)
  * and GET /baskets?mode=review. Check GATING_ERROR_CODES separately for middleware
@@ -71,3 +71,39 @@ exports.BASKET_ERROR_CODES = [
  *   clear on retry.
  */
 exports.BASKET_RESUME_ERROR_CODES = ['CART_RESUME_UNAVAILABLE', 'CART_RESUME_INCOMPLETE'];
+/**
+ * The guest cart token's header, BOTH ways. A shopper with no account sends it
+ * on `GET`, `POST` and `DELETE /basket/guest`, and every successful guest
+ * `POST` answers a fresh one in the same header (exposed to browser JS through
+ * `Access-Control-Expose-Headers`). Keep the newest: each write slides the
+ * 30-day expiry. The first `POST`, sent without one, creates the cart and is
+ * the only way to obtain one. Never put it in a URL or a log.
+ */
+exports.GUEST_CART_TOKEN_HEADER = 'X-Guest-Cart-Token';
+/**
+ * The refusals the guest cart routes answer themselves, beside the cart
+ * resolver's `BasketErrorCode` refusals they forward unchanged.
+ *
+ * - GUEST_CART_TOKEN_INVALID (401): every reason the token cannot be honoured —
+ *   missing, tampered, expired, minted for another store or presented on
+ *   another store's host or `x-store`, revoked by a sign-in merge, or naming a
+ *   cart that is gone, belongs to an account, is held by a till, was checked
+ *   out or was swept as abandoned — with one identical body, so the token is
+ *   never an oracle. Drop the token and start a new guest cart.
+ * - GUEST_CHECKOUT_DISABLED (403): the shop does not sell to guests — it has not
+ *   switched guest checkout on, admits buyers only after approval, or hides
+ *   prices from anonymous visitors. Public `GET /store` reports the same verdict
+ *   as `ecommerce.config.guestCheckoutAvailable`.
+ * - GUEST_CHECKOUT_SIGNED_IN (409): the request carried an `Authorization`
+ *   header. A signed-in buyer is priced and policed as their account, so they
+ *   use `/basket`; nothing was read or written.
+ *
+ * A token-holding guest write must send the `version` it read; a stale one is
+ * `409 CART_CHANGED_SINCE_CONFIRM` with `data: { currentCartVersion }` (the
+ * storefront checkout's code) and writes nothing.
+ */
+exports.GUEST_CART_ERROR_CODES = [
+    'GUEST_CART_TOKEN_INVALID',
+    'GUEST_CHECKOUT_DISABLED',
+    'GUEST_CHECKOUT_SIGNED_IN',
+];

package/dist/store.d.ts

@@ -158,6 +158,25 @@ declare global {
              * frame), so the storefront can offer the request.
              */
             wholesaleRequests?: boolean;
+            /**
+             * Whether the shop sells to shoppers without an account (server guest
+             * cart, guest checkout). Absent means OFF: a shop opts in. Honoured only
+             * while `registrationMode` is not `'approval'` and `showDefaultPriceList`
+             * is not `0` — a shop that vets every buyer, or hides prices from
+             * anonymous visitors, never sells to a guest whatever this says.
+             * Written by `PATCH /store` (ADMIN) and `PUT /platform/stores/{storeId}`
+             * (MANAGER). Never sent to shoppers as stored: they get
+             * `guestCheckoutAvailable`.
+             */
+            guestCheckout?: boolean;
+            /**
+             * SHOPPER-ONLY, never stored: present on web `GET /store` and the
+             * customer `stores` frame, `true` when the shop accepts guest carts and
+             * guest checkout right now — `guestCheckout` on AND registration open AND
+             * prices shown to anonymous visitors. The guest routes refuse
+             * `403 GUEST_CHECKOUT_DISABLED` whenever this is `false`.
+             */
+            guestCheckoutAvailable?: boolean;
             /**
              * How long a storefront online payment holds the order, in whole
              * minutes: the payment attempt's `expiresAt` and its Checkout Pro
@@ -1840,7 +1859,7 @@ declare global {
          * A stored rule the write could not have produced (an unknown audience, an
          * undeclared key, a non-positive list) fails CLOSED for shoppers: hidden on
          * `GET /store`, refused at checkout, and both catalogs left off the frame.
-         * Operator reads omit it, and `POST /store` keeps it when an existing row
+         * Operator reads omit such a malformed rule (a valid one is kept), and `POST /store` keeps it when an existing row
          * is sent back without `availability`; sending a valid rule replaces it.
          */
         availability?: StorefrontDesignVisibility;

package/dist/wholesaleRequest.d.ts

@@ -78,6 +78,18 @@ declare global {
         /** Unix ms of the decision. Absent while pending. */
         decidedAt?: number;
     }
+    /**
+     * The web `GET /user?mode=wholesale-request` envelope. `audienceClass` is the
+     * caller's effective class — their resolved list's `audienceClass`, by the rule
+     * `GET /store` uses (a deleted list is PUBLICO, retail) — so a buyer already on
+     * a wholesale list with no request reads `wholesale`. Absent when the customer
+     * row is gone.
+     */
+    interface WholesaleRequestReadResponse {
+        message: string;
+        data: WholesaleRequestStatus | null;
+        audienceClass?: 'retail' | 'wholesale';
+    }
     /** The operator's view of one request (admin tier only). */
     interface WholesaleRequest extends WholesaleRequestCompany {
         customerId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.782",
+	"version": "1.10.784",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",