sinfactura-types 1.10.424 → 1.10.425

package/dist/cjs/index.js

@@ -88,6 +88,7 @@ __exportStar(require("./store.js"), exports);
 __exportStar(require("./storefrontEvent.js"), exports);
 __exportStar(require("./subscription.js"), exports);
 __exportStar(require("./support.js"), exports);
+__exportStar(require("./terminal.js"), exports);
 __exportStar(require("./supplier.js"), exports);
 __exportStar(require("./supplierClaim.js"), exports);
 __exportStar(require("./survey.js"), exports);

package/dist/cjs/terminal.js

@@ -0,0 +1,97 @@
+"use strict";
+// POS terminal sessions — a shared till enrolled once, activated once per shift
+// by a full login, and handed between cashiers by PIN.
+//
+// Four credentials, four lifetimes, and they are NOT interchangeable:
+//
+//   1. The TERMINAL ENROLMENT SECRET — minted by `POST /terminal/pair`, carried
+//      ONLY in the HttpOnly `sf_terminal` cookie (`Path=/terminal`, about one
+//      year, revocable by an admin). It never appears in a JSON body, so no type
+//      here has a slot for it.
+//   2. The TERMINAL ACTIVATION — a full login (password + the TOTP step-up when
+//      the employee has 2FA) performed ON an enrolled terminal. It ends when the
+//      activating employee's shift closes or after 12 hours, whichever comes
+//      first.
+//   3. The OPERATOR TOKEN — a 15-minute access token minted by a PIN inside a
+//      live activation. The PIN only re-selects WHO operates the till; it is
+//      never a standalone authentication.
+//   4. The ELEVATION TOKEN — 90 seconds, single use, bound to one exact action.
+//      Not described here yet; its shapes land with the slice that serves it.
+//
+// ⚠️ Rollout is sliced. ENROLMENT (pairing codes, redeem, list, revoke) is served
+// today. ACTIVATION, the OPERATOR PIN and PIN ENROLMENT are published AHEAD of
+// the routes that serve them, so the app can be built against a fixed shape; a
+// client must treat those routes as absent until the api's deployment is
+// verified, and every such shape says so in its own doc comment.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TERMINAL_PAIRING_CODE_TTL_SECONDS = exports.TERMINAL_ENROLMENT_TTL_SECONDS = exports.TERMINAL_SESSION_ERROR_CODES = exports.TERMINAL_ENROLMENT_ERROR_CODES = void 0;
+/**
+ * `body.error` codes the SERVED enrolment routes refuse with —
+ * `POST /terminal/pair/codes`, `POST /terminal/pair`, `GET /terminal/sessions`
+ * and `DELETE /terminal/sessions/{terminalId}`.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body or path failed its schema.
+ * - `PAIRING_CODE_INVALID` · 400 — `POST /terminal/pair`: the code is unknown or
+ *   has expired. One code for both on purpose; ask the admin for a new one.
+ * - `PAIRING_CODE_CONSUMED` · 409 — `POST /terminal/pair`: the code was already
+ *   redeemed. No second terminal is created. Ask for a new code.
+ * - `TERMINAL_NOT_FOUND` · 404 — `DELETE /terminal/sessions/{terminalId}`: no
+ *   such terminal in the caller's store (another store's terminal answers the
+ *   same, so the route is not an existence oracle).
+ * - `IMPERSONATION_TERMINAL_FORBIDDEN` · 403 — `POST /terminal/pair/codes` under
+ *   an impersonated support session: an enrolment outlives the session, so a
+ *   support operator may not plant one.
+ */
+exports.TERMINAL_ENROLMENT_ERROR_CODES = [
+    'VALIDATION_FAILED',
+    'PAIRING_CODE_INVALID',
+    'PAIRING_CODE_CONSUMED',
+    'TERMINAL_NOT_FOUND',
+    'IMPERSONATION_TERMINAL_FORBIDDEN',
+];
+/**
+ * `body.error` codes the ACTIVATION, OPERATOR-PIN and PIN-ENROLMENT routes will
+ * refuse with — PUBLISHED AHEAD of those routes, which are not served yet.
+ *
+ * Activation also answers the ordinary login refusals (`LOGIN_ERROR_CODES`), its
+ * step-up (`STEP_UP_ERROR_CODES`) and second-factor failures
+ * (`LOGIN_2FA_ERROR_CODES`); they are not repeated here.
+ *
+ * - `TERMINAL_NOT_PAIRED` · 401 — the request carried no `sf_terminal` cookie,
+ *   or one naming an unknown, expired or revoked terminal. Re-pair the till.
+ * - `SHIFT_NOT_OPEN` · 409 — activation by an employee who holds no open shift.
+ * - `TERMINAL_NOT_ACTIVATED` · 401 — a PIN on a terminal with no live
+ *   activation (never activated, its shift closed, or past its 12-hour cap).
+ *   Run the full-login activation again.
+ * - `INVALID_PIN` · 401 — UNIFORM: wrong PIN, unknown employee and employee
+ *   with no PIN set answer the byte-identical body. Nothing distinguishes them.
+ * - `ACCOUNT_LOCKED` · 403 — the employee's PASSWORD lockout is live; the body
+ *   carries `retryAfterSeconds`. A PIN never bypasses a password lockout.
+ * - `PIN_LOCKED` · 429 — too many wrong PINs, for that employee across every
+ *   terminal or on this terminal across every employee. Back off.
+ * - `ROLE_NOT_ALLOWED` · 403 — the employee's roles may not operate a till (a
+ *   PRINTER claim, alone or combined, or no operator role at all).
+ * - `INVALID_PIN_FORMAT` · 400 — `POST /terminal/pin`: not 4–6 digits.
+ * - `WRONG_CREDENTIALS` · 400 — `POST /terminal/pin`: the re-verified password
+ *   did not match.
+ * - `IDEMPOTENCY_KEY_REUSE` · 422 / `IDEMPOTENCY_IN_PROGRESS` · 409 /
+ *   `INVALID_IDEMPOTENCY_KEY` · 400 — the `Idempotency-Key` header's own
+ *   refusals on `POST /terminal/operators`.
+ */
+exports.TERMINAL_SESSION_ERROR_CODES = [
+    'TERMINAL_NOT_PAIRED',
+    'SHIFT_NOT_OPEN',
+    'TERMINAL_NOT_ACTIVATED',
+    'INVALID_PIN',
+    'ACCOUNT_LOCKED',
+    'PIN_LOCKED',
+    'ROLE_NOT_ALLOWED',
+    'INVALID_PIN_FORMAT',
+    'WRONG_CREDENTIALS',
+    'IDEMPOTENCY_KEY_REUSE',
+    'IDEMPOTENCY_IN_PROGRESS',
+    'INVALID_IDEMPOTENCY_KEY',
+];
+/** The `sf_terminal` cookie's lifetime and the pairing code's, in seconds — the two numbers a client may display. */
+exports.TERMINAL_ENROLMENT_TTL_SECONDS = 365 * 24 * 60 * 60;
+exports.TERMINAL_PAIRING_CODE_TTL_SECONDS = 10 * 60;

package/dist/index.d.ts

@@ -64,6 +64,7 @@ export * from './store.ts';
 export * from './storefrontEvent.ts';
 export * from './subscription.ts';
 export * from './support.ts';
+export * from './terminal.ts';
 export * from './supplier.ts';
 export * from './supplierClaim.ts';
 export * from './survey.ts';

package/dist/index.js

@@ -72,6 +72,7 @@ export * from "./store.js";
 export * from "./storefrontEvent.js";
 export * from "./subscription.js";
 export * from "./support.js";
+export * from "./terminal.js";
 export * from "./supplier.js";
 export * from "./supplierClaim.js";
 export * from "./survey.js";

package/dist/terminal.d.ts

@@ -0,0 +1,266 @@
+declare global {
+    /**
+     * One enrolled terminal, as the admin roster reads it.
+     *
+     * ⚠️ An ALLOW-list projection of the stored row: the secret's digest, the
+     * storage keys and the housekeeping `ttl` never reach the wire, and a field
+     * added to the stored row later does not appear here by default.
+     */
+    interface TerminalSummary {
+        /** Server-minted, opaque (`TRM` + 16 hex). The same value a till's cart/order `terminalId` carries once enrolment is wired into sales. */
+        terminalId: string;
+        /** The admin's name for the till, given when the pairing code was minted ("Caja 1"). */
+        label: string;
+        /** When the pairing code was redeemed, unix ms. */
+        pairedAt: number;
+        /** The admin (`USR…`) who minted the pairing code this terminal redeemed. */
+        pairedBy: string;
+        /**
+         * When the enrolment stops being honoured without any admin action, unix
+         * ms — about one year after pairing. Enforced on READ, never by the
+         * cookie's own Max-Age.
+         */
+        expiresAt: number;
+        /** Set once an admin revoked the terminal. A revoked terminal is refused everywhere; re-pair it to use it again. */
+        revokedAt?: number;
+        /** The admin (`USR…`) who revoked it. */
+        revokedBy?: string;
+    }
+    /** `POST /terminal/pair/codes` (adminToken) — mint a single-use pairing code for a till. */
+    interface TerminalPairingCodeRequest {
+        /** The till's display name, 1–40 characters after trimming. */
+        label: string;
+    }
+    /** What `POST /terminal/pair/codes` returns in `data`. */
+    interface TerminalPairingCode {
+        /**
+         * Eight characters from an unambiguous alphabet, rendered `XXXX-XXXX`.
+         * Redeem is case-insensitive and ignores spaces and dashes.
+         *
+         * ⚠️ A live credential until it is redeemed or expires: show it on the
+         * admin's screen, never persist or log it.
+         */
+        pairingCode: string;
+        label: string;
+        /** Unix ms — ten minutes after minting. After this the code is `PAIRING_CODE_INVALID`. */
+        expiresAt: number;
+    }
+    interface TerminalPairingCodeResponse {
+        message: string;
+        data: TerminalPairingCode;
+    }
+    /**
+     * `POST /terminal/pair` (PUBLIC) — the till redeems the code the admin read
+     * to it. Exactly once: the code is consumed and the terminal row created in
+     * one transaction.
+     */
+    interface TerminalPairRequest {
+        pairingCode: string;
+    }
+    /**
+     * `POST /terminal/pair` → `data`. The enrolment SECRET is not here and never
+     * will be: it arrives as the HttpOnly `sf_terminal` cookie on this same
+     * response, so the client must send the request with credentials included.
+     */
+    interface TerminalPair {
+        terminalId: string;
+        label: string;
+    }
+    interface TerminalPairResponse {
+        message: string;
+        data: TerminalPair;
+    }
+    /** `GET /terminal/sessions` (adminToken) → this store's enrolled terminals, revoked ones included until they age out. */
+    interface TerminalListResponse {
+        message: string;
+        data: TerminalSummary[];
+    }
+    /**
+     * `DELETE /terminal/sessions/{terminalId}` (adminToken) → the revoked
+     * terminal. Idempotent: revoking an already-revoked terminal answers 200 with
+     * the STORED `revokedAt`.
+     */
+    interface TerminalRevokeResponse {
+        message: string;
+        data: {
+            terminalId: string;
+            revokedAt: number;
+        };
+    }
+    /**
+     * `POST /terminal/activation` — NOT SERVED YET. Sent from an enrolled till
+     * (the `sf_terminal` cookie rides along); the body is an ordinary login.
+     *
+     * The step-up is the login's own: a 2FA-enrolled employee first receives
+     * `401 REQUIRES_2FA` and re-submits the same body with `totpCode`. A
+     * `totp.enabled` employee is NOT refused — this full login is where the
+     * second factor is performed, once per activation.
+     */
+    interface TerminalActivationRequest {
+        email: string;
+        password: string;
+        /** TOTP step-up code — only after a `REQUIRES_2FA` answer. */
+        totpCode?: string;
+        /** reCAPTCHA v3 token — only after a `CAPTCHA_REQUIRED` answer. */
+        captchaToken?: string;
+    }
+    /** `POST /terminal/activation` → `data` — NOT SERVED YET. */
+    interface TerminalActivation {
+        /** Every operator token minted inside this activation carries it as `activationId`. */
+        activationId: string;
+        terminalId: string;
+        /** The employee (`USR…`) whose full login activated the till. */
+        activatedBy: string;
+        /** Their display name, for the till's header. */
+        activatedByName: string;
+        /**
+         * The activating employee's OPEN shift. The activation ends the moment
+         * this shift closes; activating with no open shift is `409 SHIFT_NOT_OPEN`.
+         */
+        shiftId: string;
+        activatedAt: number;
+        /** The 12-hour hard cap, unix ms. The shift closing ends it sooner. */
+        expiresAt: number;
+    }
+    interface TerminalActivationResponse {
+        message: string;
+        data: TerminalActivation;
+    }
+    /**
+     * `POST /terminal/operators` — NOT SERVED YET. A cashier takes the till
+     * inside a live activation.
+     *
+     * The attempt id rides the `Idempotency-Key` HEADER, not this body: a
+     * retried submission with the same key answers the cached verdict and is not
+     * scored as a second wrong PIN. A different body under the same key is
+     * `IDEMPOTENCY_KEY_REUSE`.
+     */
+    interface TerminalOperatorLoginRequest {
+        /** The employee (`USR…`) taking the till. Always sent — the PIN is never matched against a roster. */
+        employeeId: string;
+        /** 4–6 digits. */
+        pin: string;
+    }
+    /** `POST /terminal/operators` → `data` — NOT SERVED YET. */
+    interface TerminalOperatorSession {
+        /**
+         * A 15-minute access token for every route a `userToken` reaches, held
+         * in MEMORY only. No refresh token is minted: re-entering the PIN is the
+         * only renewal, and the token never outlives its activation.
+         */
+        accessToken: string;
+        /** Unix ms — the token's `exp`. */
+        expiresAt: number;
+        /** The operator-session id — the token's `sid`. */
+        sid: string;
+        terminalId: string;
+        activationId: string;
+        operator: {
+            userId: string;
+            name: string;
+            roles: string;
+        };
+    }
+    interface TerminalOperatorLoginResponse {
+        message: string;
+        data: TerminalOperatorSession;
+    }
+    /**
+     * The operator token's claims, for a client that decodes it for UI state
+     * (`exp` for the idle countdown). NOT SERVED YET.
+     *
+     * ⚠️ ONE live operator per terminal. A second employee's PIN replaces the
+     * terminal's operator session, and the first employee's still-unexpired
+     * token is refused `401` on its very next request (`sid` mismatch). Render
+     * that as "another operator took this till", not as a session error.
+     */
+    interface OperatorSessionClaims {
+        storeId: string;
+        userId: string;
+        /** Space-joined, exactly as every access token carries them. */
+        roles: string;
+        name: string;
+        terminalId: string;
+        sid: string;
+        activationId: string;
+        /** Seconds since epoch, per JWT. */
+        exp: number;
+        iat?: number;
+    }
+    /**
+     * `GET /terminal/operator-sessions` → `data` — NOT SERVED YET. Who holds the
+     * till right now, or `null` when nobody does.
+     */
+    type TerminalOperatorSummary = {
+        userId: string;
+        name: string;
+        startedAt: number;
+    } | null;
+    /**
+     * `POST /terminal/pin` (userToken) — NOT SERVED YET. An employee sets or
+     * replaces their own PIN. The account password is re-verified on the same
+     * request, because a PIN is a credential and a stolen live session must not
+     * be enough to plant one.
+     *
+     * ⚠️ No PIN, digest or attempt counter is ever returned by any route.
+     */
+    interface TerminalPinSetRequest {
+        /** 4–6 digits. */
+        pin: string;
+        password: string;
+    }
+}
+/**
+ * `body.error` codes the SERVED enrolment routes refuse with —
+ * `POST /terminal/pair/codes`, `POST /terminal/pair`, `GET /terminal/sessions`
+ * and `DELETE /terminal/sessions/{terminalId}`.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body or path failed its schema.
+ * - `PAIRING_CODE_INVALID` · 400 — `POST /terminal/pair`: the code is unknown or
+ *   has expired. One code for both on purpose; ask the admin for a new one.
+ * - `PAIRING_CODE_CONSUMED` · 409 — `POST /terminal/pair`: the code was already
+ *   redeemed. No second terminal is created. Ask for a new code.
+ * - `TERMINAL_NOT_FOUND` · 404 — `DELETE /terminal/sessions/{terminalId}`: no
+ *   such terminal in the caller's store (another store's terminal answers the
+ *   same, so the route is not an existence oracle).
+ * - `IMPERSONATION_TERMINAL_FORBIDDEN` · 403 — `POST /terminal/pair/codes` under
+ *   an impersonated support session: an enrolment outlives the session, so a
+ *   support operator may not plant one.
+ */
+export declare const TERMINAL_ENROLMENT_ERROR_CODES: readonly ["VALIDATION_FAILED", "PAIRING_CODE_INVALID", "PAIRING_CODE_CONSUMED", "TERMINAL_NOT_FOUND", "IMPERSONATION_TERMINAL_FORBIDDEN"];
+export type TerminalEnrolmentErrorCode = (typeof TERMINAL_ENROLMENT_ERROR_CODES)[number];
+/**
+ * `body.error` codes the ACTIVATION, OPERATOR-PIN and PIN-ENROLMENT routes will
+ * refuse with — PUBLISHED AHEAD of those routes, which are not served yet.
+ *
+ * Activation also answers the ordinary login refusals (`LOGIN_ERROR_CODES`), its
+ * step-up (`STEP_UP_ERROR_CODES`) and second-factor failures
+ * (`LOGIN_2FA_ERROR_CODES`); they are not repeated here.
+ *
+ * - `TERMINAL_NOT_PAIRED` · 401 — the request carried no `sf_terminal` cookie,
+ *   or one naming an unknown, expired or revoked terminal. Re-pair the till.
+ * - `SHIFT_NOT_OPEN` · 409 — activation by an employee who holds no open shift.
+ * - `TERMINAL_NOT_ACTIVATED` · 401 — a PIN on a terminal with no live
+ *   activation (never activated, its shift closed, or past its 12-hour cap).
+ *   Run the full-login activation again.
+ * - `INVALID_PIN` · 401 — UNIFORM: wrong PIN, unknown employee and employee
+ *   with no PIN set answer the byte-identical body. Nothing distinguishes them.
+ * - `ACCOUNT_LOCKED` · 403 — the employee's PASSWORD lockout is live; the body
+ *   carries `retryAfterSeconds`. A PIN never bypasses a password lockout.
+ * - `PIN_LOCKED` · 429 — too many wrong PINs, for that employee across every
+ *   terminal or on this terminal across every employee. Back off.
+ * - `ROLE_NOT_ALLOWED` · 403 — the employee's roles may not operate a till (a
+ *   PRINTER claim, alone or combined, or no operator role at all).
+ * - `INVALID_PIN_FORMAT` · 400 — `POST /terminal/pin`: not 4–6 digits.
+ * - `WRONG_CREDENTIALS` · 400 — `POST /terminal/pin`: the re-verified password
+ *   did not match.
+ * - `IDEMPOTENCY_KEY_REUSE` · 422 / `IDEMPOTENCY_IN_PROGRESS` · 409 /
+ *   `INVALID_IDEMPOTENCY_KEY` · 400 — the `Idempotency-Key` header's own
+ *   refusals on `POST /terminal/operators`.
+ */
+export declare const TERMINAL_SESSION_ERROR_CODES: readonly ["TERMINAL_NOT_PAIRED", "SHIFT_NOT_OPEN", "TERMINAL_NOT_ACTIVATED", "INVALID_PIN", "ACCOUNT_LOCKED", "PIN_LOCKED", "ROLE_NOT_ALLOWED", "INVALID_PIN_FORMAT", "WRONG_CREDENTIALS", "IDEMPOTENCY_KEY_REUSE", "IDEMPOTENCY_IN_PROGRESS", "INVALID_IDEMPOTENCY_KEY"];
+export type TerminalSessionErrorCode = (typeof TERMINAL_SESSION_ERROR_CODES)[number];
+/** The `sf_terminal` cookie's lifetime and the pairing code's, in seconds — the two numbers a client may display. */
+export declare const TERMINAL_ENROLMENT_TTL_SECONDS: number;
+export declare const TERMINAL_PAIRING_CODE_TTL_SECONDS: number;
+export {};

package/dist/terminal.js

@@ -0,0 +1,94 @@
+// POS terminal sessions — a shared till enrolled once, activated once per shift
+// by a full login, and handed between cashiers by PIN.
+//
+// Four credentials, four lifetimes, and they are NOT interchangeable:
+//
+//   1. The TERMINAL ENROLMENT SECRET — minted by `POST /terminal/pair`, carried
+//      ONLY in the HttpOnly `sf_terminal` cookie (`Path=/terminal`, about one
+//      year, revocable by an admin). It never appears in a JSON body, so no type
+//      here has a slot for it.
+//   2. The TERMINAL ACTIVATION — a full login (password + the TOTP step-up when
+//      the employee has 2FA) performed ON an enrolled terminal. It ends when the
+//      activating employee's shift closes or after 12 hours, whichever comes
+//      first.
+//   3. The OPERATOR TOKEN — a 15-minute access token minted by a PIN inside a
+//      live activation. The PIN only re-selects WHO operates the till; it is
+//      never a standalone authentication.
+//   4. The ELEVATION TOKEN — 90 seconds, single use, bound to one exact action.
+//      Not described here yet; its shapes land with the slice that serves it.
+//
+// ⚠️ Rollout is sliced. ENROLMENT (pairing codes, redeem, list, revoke) is served
+// today. ACTIVATION, the OPERATOR PIN and PIN ENROLMENT are published AHEAD of
+// the routes that serve them, so the app can be built against a fixed shape; a
+// client must treat those routes as absent until the api's deployment is
+// verified, and every such shape says so in its own doc comment.
+/**
+ * `body.error` codes the SERVED enrolment routes refuse with —
+ * `POST /terminal/pair/codes`, `POST /terminal/pair`, `GET /terminal/sessions`
+ * and `DELETE /terminal/sessions/{terminalId}`.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body or path failed its schema.
+ * - `PAIRING_CODE_INVALID` · 400 — `POST /terminal/pair`: the code is unknown or
+ *   has expired. One code for both on purpose; ask the admin for a new one.
+ * - `PAIRING_CODE_CONSUMED` · 409 — `POST /terminal/pair`: the code was already
+ *   redeemed. No second terminal is created. Ask for a new code.
+ * - `TERMINAL_NOT_FOUND` · 404 — `DELETE /terminal/sessions/{terminalId}`: no
+ *   such terminal in the caller's store (another store's terminal answers the
+ *   same, so the route is not an existence oracle).
+ * - `IMPERSONATION_TERMINAL_FORBIDDEN` · 403 — `POST /terminal/pair/codes` under
+ *   an impersonated support session: an enrolment outlives the session, so a
+ *   support operator may not plant one.
+ */
+export const TERMINAL_ENROLMENT_ERROR_CODES = [
+    'VALIDATION_FAILED',
+    'PAIRING_CODE_INVALID',
+    'PAIRING_CODE_CONSUMED',
+    'TERMINAL_NOT_FOUND',
+    'IMPERSONATION_TERMINAL_FORBIDDEN',
+];
+/**
+ * `body.error` codes the ACTIVATION, OPERATOR-PIN and PIN-ENROLMENT routes will
+ * refuse with — PUBLISHED AHEAD of those routes, which are not served yet.
+ *
+ * Activation also answers the ordinary login refusals (`LOGIN_ERROR_CODES`), its
+ * step-up (`STEP_UP_ERROR_CODES`) and second-factor failures
+ * (`LOGIN_2FA_ERROR_CODES`); they are not repeated here.
+ *
+ * - `TERMINAL_NOT_PAIRED` · 401 — the request carried no `sf_terminal` cookie,
+ *   or one naming an unknown, expired or revoked terminal. Re-pair the till.
+ * - `SHIFT_NOT_OPEN` · 409 — activation by an employee who holds no open shift.
+ * - `TERMINAL_NOT_ACTIVATED` · 401 — a PIN on a terminal with no live
+ *   activation (never activated, its shift closed, or past its 12-hour cap).
+ *   Run the full-login activation again.
+ * - `INVALID_PIN` · 401 — UNIFORM: wrong PIN, unknown employee and employee
+ *   with no PIN set answer the byte-identical body. Nothing distinguishes them.
+ * - `ACCOUNT_LOCKED` · 403 — the employee's PASSWORD lockout is live; the body
+ *   carries `retryAfterSeconds`. A PIN never bypasses a password lockout.
+ * - `PIN_LOCKED` · 429 — too many wrong PINs, for that employee across every
+ *   terminal or on this terminal across every employee. Back off.
+ * - `ROLE_NOT_ALLOWED` · 403 — the employee's roles may not operate a till (a
+ *   PRINTER claim, alone or combined, or no operator role at all).
+ * - `INVALID_PIN_FORMAT` · 400 — `POST /terminal/pin`: not 4–6 digits.
+ * - `WRONG_CREDENTIALS` · 400 — `POST /terminal/pin`: the re-verified password
+ *   did not match.
+ * - `IDEMPOTENCY_KEY_REUSE` · 422 / `IDEMPOTENCY_IN_PROGRESS` · 409 /
+ *   `INVALID_IDEMPOTENCY_KEY` · 400 — the `Idempotency-Key` header's own
+ *   refusals on `POST /terminal/operators`.
+ */
+export const TERMINAL_SESSION_ERROR_CODES = [
+    'TERMINAL_NOT_PAIRED',
+    'SHIFT_NOT_OPEN',
+    'TERMINAL_NOT_ACTIVATED',
+    'INVALID_PIN',
+    'ACCOUNT_LOCKED',
+    'PIN_LOCKED',
+    'ROLE_NOT_ALLOWED',
+    'INVALID_PIN_FORMAT',
+    'WRONG_CREDENTIALS',
+    'IDEMPOTENCY_KEY_REUSE',
+    'IDEMPOTENCY_IN_PROGRESS',
+    'INVALID_IDEMPOTENCY_KEY',
+];
+/** The `sf_terminal` cookie's lifetime and the pairing code's, in seconds — the two numbers a client may display. */
+export const TERMINAL_ENROLMENT_TTL_SECONDS = 365 * 24 * 60 * 60;
+export const TERMINAL_PAIRING_CODE_TTL_SECONDS = 10 * 60;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sinfactura-types",
-	"version": "1.10.424",
+	"version": "1.10.425",
 	"description": "Shared wire and entity contracts for the SINFACTURA platform.",
 	"type": "module",
 	"main": "dist/index.js",