feat(booth): pay-on-foot at the booth — ticket lookup, pay, exit, voucher, snapshots

Backend: PayStation.lookup (session view + quote in one read); ExitFlow.exitForBooth
reuses the reader path's paid+grace validation (no booth-only unpaid bypass) and
signs vehicle_exit + pulses an exit relay; printExitVoucher reprints the paid ticket
id barcode; site_config.exit_voucher_default (migration 0002) drives the default.
Routes: GET /api/session/:id, POST /api/exit, POST /api/voucher.

Web: BoothPayModal (entry/now/duration/total, tender, 'Printo biletë dalje'),
SnapshotStrip (entry/exit evidence), api.ts client fns, SiteSettings toggle.

apps/server/src/routes/pay.ts

@@ -1,15 +1,21 @@
 import type { FastifyInstance } from "fastify";
+import type { Db } from "@parking/db";
+import { NoPrinterAvailableError } from "@parking/devices";
 import { requireRole } from "../auth.js";
 import {
   NoOpenSessionError,
   NoTariffError,
   type PayStation,
 } from "../pay-station.js";
+import type { ExitFlow } from "../exit-flow.js";
+import { printExitVoucher } from "../booth-print.js";
 
-// Pay-station endpoints (pay-on-foot). The terminal/operator UI quotes a session
-// then takes payment; the payment becomes a signed ledger event. PCI scope stays
-// OUT of the app — actual card capture is a standalone P2PE terminal; here `tender`
-// just records cash vs. card. See wiki/concepts/tariff.md, parking-session.md, bom.md.
+// Booth endpoints (pay-on-foot): look up a session, quote it, take payment, and —
+// when the booth is at/near the exit — open the barrier. The payment becomes a
+// signed ledger event; PCI scope stays OUT of the app (card capture is a standalone
+// P2PE terminal; `tender` just records cash vs. card). The booth exit reuses the
+// SAME validation as the reader path — no booth-only bypass admits an unpaid car.
+// See wiki/concepts/tariff.md, parking-session.md, booth-exit-flow.md, bom.md.
 
 interface QuoteQuery {
   identity: string;
@@ -20,11 +26,76 @@ interface PayBody {
   /** Operator-set amount (lost ticket / dispute) — overrides the computed fee. */
   overrideMinor?: number;
 }
+interface ExitBody {
+  identity: string;
+}
+interface VoucherBody {
+  identity: string;
+}
 
-export async function payRoutes(app: FastifyInstance, payStation: PayStation): Promise<void> {
-  // Cashier/operator/admin operate the pay station; readonly may not.
+export async function payRoutes(
+  app: FastifyInstance,
+  db: Db,
+  payStation: PayStation,
+  exitFlow: ExitFlow,
+): Promise<void> {
+  // Cashier/operator/admin operate the booth; readonly may not.
   const guard = requireRole("admin", "operator", "cashier");
 
+  // Active sessions for the booth list: still-open OR exited-but-within-grace
+  // (barrier unconfirmed → a paid/exited car is presumed possibly-present until
+  // grace expires). Read-only. See wiki/concepts/booth-exit-flow.md.
+  app.get("/api/sessions/active", { preHandler: guard }, async () => ({
+    sessions: payStation.activeSessions(),
+  }));
+
+  // Session lookup for the booth pay/exit modal: entry/exit times, paid state,
+  // amount owed now, walk-back-grace status. Read-only (no side effect).
+  app.get<{ Params: { identity: string } }>(
+    "/api/session/:identity",
+    { preHandler: guard },
+    async (req, reply) => {
+      const identity = (req.params.identity ?? "").trim();
+      if (!identity) return reply.code(400).send({ error: "identity required" });
+      return payStation.lookup(identity);
+    },
+  );
+
+  // Booth-driven exit: validate (paid + grace, or free entry-grace) THEN sign
+  // vehicle_exit + open the barrier. Maps the discriminated result to HTTP:
+  //  - validation reject → 409 with a reason (operator takes payment first),
+  //  - exit signed but barrier didn't open → 200 { opened:false } (payment stands;
+  //    operator opens manually; an anomaly is already signed),
+  //  - clean exit → 200 { opened:true }.
+  app.post<{ Body: ExitBody }>(
+    "/api/exit",
+    { preHandler: guard },
+    async (req, reply) => {
+      const identity = (req.body?.identity ?? "").trim();
+      if (!identity) return reply.code(400).send({ error: "identity required" });
+      const res = await exitFlow.exitForBooth(identity);
+      if (!res.ok) return reply.code(409).send({ error: res.reason, status: res.status });
+      return reply.code(200).send(res);
+    },
+  );
+
+  // Human-intervention barrier re-open for an ACTIVE (paid) session — damaged
+  // ticket / dead scanner / phantom re-close. Re-pulses the exit relay + signs an
+  // anomaly (attributed); NEVER a second vehicle_exit. Refused without a payment
+  // (no-unpaid-bypass). See wiki/concepts/booth-exit-flow.md.
+  app.post<{ Body: ExitBody }>(
+    "/api/barrier/reopen",
+    { preHandler: guard },
+    async (req, reply) => {
+      const identity = (req.body?.identity ?? "").trim();
+      if (!identity) return reply.code(400).send({ error: "identity required" });
+      const operator = req.user?.username;
+      const res = await exitFlow.reopenBarrier(identity, operator);
+      if (!res.ok) return reply.code(409).send({ error: res.reason });
+      return reply.code(200).send(res);
+    },
+  );
+
   // Quote: what does this session owe right now? (No side effect.)
   app.get<{ Querystring: QuoteQuery }>(
     "/api/pay/quote",
@@ -60,6 +131,35 @@ export async function payRoutes(app: FastifyInstance, payStation: PayStation): P
       }
     },
   );
+
+  // Print an exit voucher (the paid ticket id reprinted as a barcode) on the booth
+  // printer. Used when the booth is far from the exit — the customer self-scans the
+  // voucher at the exit reader, which runs the normal validated exit. Requires the
+  // session to be PAID (no free vouchers for unpaid sessions). See booth-exit-flow.md.
+  app.post<{ Body: VoucherBody }>(
+    "/api/voucher",
+    { preHandler: guard },
+    async (req, reply) => {
+      const identity = (req.body?.identity ?? "").trim();
+      if (!identity) return reply.code(400).send({ error: "identity required" });
+      const view = payStation.lookup(identity);
+      if (!view.found || !view.open) {
+        return reply.code(404).send({ error: "no open session for ticket" });
+      }
+      if (view.paidAt == null) {
+        return reply.code(409).send({ error: "session not paid — take payment before printing a voucher" });
+      }
+      try {
+        const printedBy = await printExitVoucher(db, identity, app.log);
+        return reply.code(200).send({ ok: true, printedBy });
+      } catch (err) {
+        if (err instanceof NoPrinterAvailableError) {
+          return reply.code(503).send({ error: err.message });
+        }
+        return reply.code(500).send({ error: (err as Error).message });
+      }
+    },
+  );
 }
 
 function mapError(reply: import("fastify").FastifyReply, err: unknown) {

apps/server/src/routes/site.ts

@@ -21,13 +21,21 @@ type TextField = (typeof TEXT_FIELDS)[number];
 interface SiteConfigBody extends Partial<Record<TextField, string | null>> {
   /** Nominal capacity; null = no limit. */
   capacity?: number | null;
+  /** Default for the booth "print exit ticket" checkbox (booth-geography knob). */
+  exitVoucherDefault?: boolean;
 }
 
-/** Shape returned by GET/PUT: capacity + every metadata field (null when unset). */
-type SiteConfig = { capacity: number | null } & Record<TextField, string | null>;
+/** Shape returned by GET/PUT: capacity + the booth flag + every metadata field. */
+type SiteConfig = { capacity: number | null; exitVoucherDefault: boolean } & Record<
+  TextField,
+  string | null
+>;
 
 function toSiteConfig(row: typeof siteConfig.$inferSelect | undefined): SiteConfig {
-  const out = { capacity: row?.capacity ?? null } as SiteConfig;
+  const out = {
+    capacity: row?.capacity ?? null,
+    exitVoucherDefault: row?.exitVoucherDefault ?? false,
+  } as SiteConfig;
   for (const f of TEXT_FIELDS) out[f] = row?.[f] ?? null;
   return out;
 }
@@ -65,6 +73,12 @@ export async function siteRoutes(app: FastifyInstance, db: Db): Promise<void> {
       }
       patch.capacity = c ?? null;
     }
+    if ("exitVoucherDefault" in body) {
+      if (typeof body.exitVoucherDefault !== "boolean") {
+        return reply.code(400).send({ error: "exitVoucherDefault must be a boolean" });
+      }
+      patch.exitVoucherDefault = body.exitVoucherDefault;
+    }
     for (const f of TEXT_FIELDS) {
       if (f in body) patch[f] = normText(body[f]);
     }