Make all five BasketItem fields required constructor params

[loevgaard]

Follow-up to #2, closing the gap it deliberately left open: the nested DTOs were unverified, and BasketItem's all-nullable fields turned out to be wrong.

Verified against the live API

Probe (POST /payments with a basket)	Live API response
basket: [{qty: 2}] (partial item)	400 — item_no, item_name, item_price, vat_rate all is missing
basket: [{item_name: …}]	400 — qty, item_no, item_price, vat_rate is missing
basket: [full item]	201 — stored verbatim
basket: [{}] (empty object item)	201 — stored as [null] (API quirk)
basket: [[]] (empty array item)	HTTP 500 — "unhandled error, the QuickPay development team has been notified"

A basket item is all-or-nothing: if present, all five fields are jointly required — there is no valid BasketItem with a missing field.

The last row matters most: an all-null BasketItem normalized to [] (the nested cousin of the empty-Payload bug fixed in #2 — the send() guard only rewrites the top-level body), and that shape doesn't get a validation error, it crashes Quickpay's backend. Making the fields required makes an empty item unrepresentable, killing that failure mode at the type level.

What

• BasketItem: qty, itemNo, itemName, itemPrice, vatRate are now required, non-nullable constructor parameters (same order as before, so positional callers are unaffected).
• Address: stays all-optional, now documented as verified lenient (the API accepts a partial address — e.g. only name — and stores omitted fields as null).
• Shipping: also probed — verified lenient (partial accepted, stored with nulls), so it stays all-optional too. One gotcha now documented: method, when present, is server-validated against a fixed value set (home_delivery accepted, pickup rejected with does not have a valid value).
• Also verified: an all-empty nested Payload set as a direct property (shipping/invoiceAddress) is stripped from the body entirely by the parent's []-strip, so it never reaches the wire — only empty items inside a list could, which required BasketItem fields now prevent.
• New test: it_serializes_basket_items_as_a_list_of_snake_case_objects.

BC

Breaking for consumers constructing partial BasketItems — but every such request was either rejected by the API or (if fully empty) triggered a server-side 500. Same alpha-window reasoning as #2; should land before 1.0.0 stable.

Tests

PHPUnit (94), PHPStan max, ECS, Rector, Infection all green (covered MSI 76% ≥ 70 gate).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.55%. Comparing base (427fb2d) to head (517421d).

Additional details and impacted files

@@             Coverage Diff              @@
##                1.x       #3      +/-   ##
============================================
+ Coverage     92.30%   92.55%   +0.24%     
  Complexity      148      148              
============================================
  Files            24       24              
  Lines           403      403              
============================================
+ Hits            372      373       +1     
+ Misses           31       30       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.