@aglyn/plugins-bookings 1.0.0-beta.143

package/src/lib/server/refund.js

@@ -0,0 +1,292 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+// Leaf import, not the barrel: the specs in this library mock
+// `@aglyn/tenant-data-admin` wholesale, and a permissive stub would turn a
+// reversal that never happened green.
+import { reverseEmailAttributedRevenue } from "@aglyn/tenant-data-admin/server/email-revenue-attribution";
+import { createHash } from "crypto";
+/**
+ * Refund a paid booking (AGL-2315), full or partial, site-admin only.
+ *
+ * This route exists BECAUSE of the destination charge, not alongside it. While
+ * a paid booking settled in Aglyn's own balance there was nothing here to get
+ * wrong: cancelling a booking refunded the guest nothing at all, and any
+ * refund issued by hand simply gave back money Aglyn was already holding. Once
+ * the charge goes to the merchant's connected account that stops being true in
+ * two directions at once, and both are money:
+ *
+ *  - **The guest.** Cancelling a paid booking wrote `status: 'canceled'` from
+ *    the console and moved no money. The slot reopened, the appointment was
+ *    gone, and the guest had paid for it. That was survivable only because the
+ *    platform still held the funds and could be made to give them back; with
+ *    the money at the merchant it is a silent, unrecoverable overcharge.
+ *  - **Aglyn.** A refund on a destination charge that does NOT set
+ *    `reverse_transfer` is paid entirely out of the PLATFORM's balance while
+ *    the merchant keeps the transfer in full. The merchant cancels, the guest
+ *    is made whole, and Aglyn funds the whole concession out of a cut that was
+ *    at most 5% of it. This repo has shipped that exact bug once already, on a
+ *    marketplace partial refund.
+ *
+ * So both switches are sent, and they are two different decisions:
+ *
+ *  - `reverse_transfer` pulls the refunded share back OUT of the merchant's
+ *    account. Stripe prorates it against a partial refund, so a $30 refund on
+ *    a $75 booking claws back $30 of the merchant's $71.25, not all of it.
+ *  - `refund_application_fee` returns Aglyn's commission on the refunded
+ *    share. A refunded appointment earned the platform nothing, and this
+ *    matches `commerce/refund.ts`, which has sent both since AGL-287. The
+ *    DISPUTE path deliberately sends only the reversal — that asymmetry is
+ *    AGL-1809's and is not copied here.
+ *
+ * Two SEPARATE controls guard the money, the AGL-1696 lesson from the order
+ * refund, and conflating them is how that one originally went wrong:
+ *
+ *  - The idempotency key stops a DUPLICATE refund — one attempt sent twice
+ *    because the response was lost or the admin double-clicked. It is minted
+ *    per attempt by the console and deliberately not derived from the booking
+ *    or the amount: two $10 refunds on a $75 booking are two real refunds.
+ *  - The cap stops an OVER-refund — several partials summing past what was
+ *    captured, including two admins refunding at once, where the attempts are
+ *    genuinely distinct and no key can help. That needs the counter read and
+ *    written inside one transaction, BEFORE Stripe is called, so a lost
+ *    response leaves the amount counted and the retry refunds less, never
+ *    more.
+ */ export const bookingRefundHandler = async (req, res)=>{
+    var _req_headers_authorization, _req_body, _body_hostId, _body_bookingId, _ref, _req_headers_idempotencykey;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    if (!process.env.STRIPE_SECRET_KEY) {
+        return res.status(501).json({
+            error: 'Payments are not configured.'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const hostId = String((_body_hostId = body.hostId) != null ? _body_hostId : '');
+    const bookingId = String((_body_bookingId = body.bookingId) != null ? _body_bookingId : '');
+    // `null`/absent means "everything still refundable"; a number is a partial.
+    const amountCents = body.amountCents == null ? null : Number(body.amountCents);
+    // Node lowercases incoming headers, but read both spellings — the plugin API
+    // request type makes no promise about casing.
+    const idempotencyKey = String((_ref = (_req_headers_idempotencykey = req.headers['idempotency-key']) != null ? _req_headers_idempotencykey : req.headers['Idempotency-Key']) != null ? _ref : '').trim().slice(0, 200);
+    if (!hostId || !bookingId) {
+        return res.status(400).json({
+            error: 'Missing hostId or bookingId'
+        });
+    }
+    if (amountCents != null && !(Number.isFinite(amountCents) && amountCents > 0)) {
+        return res.status(400).json({
+            error: 'Invalid refund amount'
+        });
+    }
+    try {
+        var _hostSnapshot_get, _bookingSnapshot_get, _bookingSnapshot_get1;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        // Site ADMIN, not merely a member: this moves money. The same gate
+        // `commerce/refund.ts` applies.
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin') {
+            return res.status(403).json({
+                error: 'Refunds require a site admin'
+            });
+        }
+        const bookingRef = hostRef.collection('bookings').doc(bookingId);
+        const bookingSnapshot = await bookingRef.get();
+        if (!bookingSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown booking'
+            });
+        }
+        const paymentIntentId = String((_bookingSnapshot_get = bookingSnapshot.get('paymentIntentId')) != null ? _bookingSnapshot_get : '');
+        const paidCents = Math.max(0, Math.round(Number((_bookingSnapshot_get1 = bookingSnapshot.get('paidAmountCents')) != null ? _bookingSnapshot_get1 : 0)));
+        if (!paidCents) {
+            return res.status(409).json({
+                error: 'This booking was never paid'
+            });
+        }
+        if (!paymentIntentId) {
+            // A booking paid BEFORE the webhook began recording the PaymentIntent
+            // (AGL-2315). Refundable, but only by hand — and saying so beats a 500
+            // an admin cannot act on.
+            return res.status(409).json({
+                error: 'This booking was paid before refunds were supported here. ' + 'Refund it in the Stripe dashboard, and tick “Reverse transfer” ' + 'so the amount comes back from the merchant account.'
+            });
+        }
+        // Replay a settled attempt before anything else can reject it. This read
+        // is only a short-circuit, never the dedupe primitive — the atomic
+        // `create()` below is.
+        const claimRef = idempotencyKey ? firestore.collection('apiIdempotency').doc(createHash('sha256')// Scoped by the BOOKING, so a client that reused one key across
+        // two bookings cannot dedupe two legitimately distinct refunds.
+        // NOT by the amount: that would swallow a real second partial.
+        .update(`booking-refund:${hostId}:${bookingId}:${idempotencyKey}`).digest('hex')) : null;
+        if (claimRef) {
+            const prior = await claimRef.get();
+            const priorResponse = prior.get('response');
+            if (priorResponse) {
+                var _prior_get;
+                return res.status(Number((_prior_get = prior.get('responseStatus')) != null ? _prior_get : 200)).json(priorResponse);
+            }
+            try {
+                await claimRef.create({
+                    status: 'pending',
+                    startedAtMs: Date.now()
+                });
+            } catch (unused) {
+                // Another attempt with this key is in flight.
+                return res.status(409).json({
+                    error: 'This refund is already being processed'
+                });
+            }
+        }
+        // RESERVE. Read and write the counter in ONE transaction so two concurrent
+        // refunds cannot both see the same `refundedCents` and each send a full
+        // amount to Stripe — the failure the order refund shipped with.
+        let refundCents = 0;
+        let alreadyRefunded = 0;
+        await firestore.runTransaction(async (transaction)=>{
+            var _fresh_get;
+            const fresh = await transaction.get(bookingRef);
+            alreadyRefunded = Math.max(0, Math.round(Number((_fresh_get = fresh.get('refundedCents')) != null ? _fresh_get : 0)));
+            const remaining = paidCents - alreadyRefunded;
+            refundCents = amountCents == null ? remaining : Math.min(Math.round(amountCents), remaining);
+            if (!(refundCents > 0)) {
+                refundCents = 0;
+                return;
+            }
+            transaction.set(bookingRef, {
+                refundedCents: alreadyRefunded + refundCents
+            }, {
+                merge: true
+            });
+        });
+        if (!(refundCents > 0)) {
+            await (claimRef == null ? void 0 : claimRef.delete().catch(()=>undefined));
+            return res.status(400).json({
+                error: 'Nothing left to refund'
+            });
+        }
+        const params = new URLSearchParams({
+            payment_intent: paymentIntentId,
+            amount: String(refundCents),
+            // THE SELLER SHARE COMES BACK. Without this the merchant keeps their
+            // transfer in full and Aglyn funds the entire refund.
+            reverse_transfer: 'true',
+            // ...and so does Aglyn's commission on the refunded share. A refunded
+            // appointment earned the platform nothing.
+            refund_application_fee: 'true'
+        });
+        const response = await fetch('https://api.stripe.com/v1/refunds', {
+            method: 'POST',
+            headers: _extends({
+                Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
+                'Content-Type': 'application/x-www-form-urlencoded'
+            }, claimRef ? {
+                'Idempotency-Key': claimRef.id
+            } : {}),
+            body: params.toString()
+        });
+        const refund = await response.json().catch(()=>({}));
+        if (!response.ok) {
+            console.error('Stripe booking refund error', refund == null ? void 0 : refund.error);
+            // Stripe said no, so we KNOW no money moved: give the reservation back
+            // and let the same attempt be retried.
+            await firestore.runTransaction(async (transaction)=>{
+                var _get;
+                const current = Number((_get = (await transaction.get(bookingRef)).get('refundedCents')) != null ? _get : 0);
+                transaction.set(bookingRef, {
+                    refundedCents: Math.max(0, current - refundCents)
+                }, {
+                    merge: true
+                });
+            }).catch(()=>undefined);
+            await (claimRef == null ? void 0 : claimRef.delete().catch(()=>undefined));
+            return res.status(502).json({
+                error: 'Refund failed'
+            });
+        }
+        // A FULL refund ends the appointment; a partial leaves it standing. The
+        // guest who got half their money back still has the slot, and moving the
+        // booking off `confirmed` would reopen a time the merchant is still
+        // committed to.
+        const totalRefunded = alreadyRefunded + refundCents;
+        const fullyRefunded = totalRefunded >= paidCents;
+        await bookingRef.set(_extends({
+            refundedCents: totalRefunded
+        }, fullyRefunded ? {
+            status: 'canceled'
+        } : {}), {
+            merge: true
+        }).catch(()=>undefined);
+        const payload = {
+            refundedCents: refundCents,
+            totalRefundedCents: totalRefunded,
+            fullyRefunded
+        };
+        await (claimRef == null ? void 0 : claimRef.set({
+            status: 'done',
+            responseStatus: 200,
+            response: payload,
+            settledAtMs: Date.now()
+        }, {
+            merge: true
+        }).catch(()=>undefined));
+        /*
+     * The campaign's side of the ledger.
+     *
+     * A paid booking is credited to the campaign that led to it — the sale
+     * announces itself through `upsertHostContact` with a `purchaseCents` and
+     * this booking's id, exactly as a store order does — so a refunded one
+     * has to stop counting. Without this, a booking site's campaign revenue
+     * could only ever rise.
+     *
+     * Keyed by the BOOKING id, which is what the credit was filed under, so
+     * this needs no email and works for a guest who never became a contact.
+     * Recorded beside the credit rather than subtracted from it, and swallowed
+     * whole: the money has already left the merchant's account and the booking
+     * already records it, so nothing here may fail a refund.
+     */ await reverseEmailAttributedRevenue({
+            hostId,
+            orderId: bookingId,
+            amountCents: refundCents,
+            closedTheOrder: fullyRefunded
+        });
+        return res.status(200).json(payload);
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Refund failed'
+        });
+    }
+};
+
+//# sourceMappingURL=refund.js.map

package/src/lib/server/refund.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/bookings/src/lib/server/refund.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\n// Leaf import, not the barrel: the specs in this library mock\n// `@aglyn/tenant-data-admin` wholesale, and a permissive stub would turn a\n// reversal that never happened green.\nimport { reverseEmailAttributedRevenue } from '@aglyn/tenant-data-admin/server/email-revenue-attribution'\nimport { createHash } from 'crypto'\n\n/**\n * Refund a paid booking (AGL-2315), full or partial, site-admin only.\n *\n * This route exists BECAUSE of the destination charge, not alongside it. While\n * a paid booking settled in Aglyn's own balance there was nothing here to get\n * wrong: cancelling a booking refunded the guest nothing at all, and any\n * refund issued by hand simply gave back money Aglyn was already holding. Once\n * the charge goes to the merchant's connected account that stops being true in\n * two directions at once, and both are money:\n *\n *  - **The guest.** Cancelling a paid booking wrote `status: 'canceled'` from\n *    the console and moved no money. The slot reopened, the appointment was\n *    gone, and the guest had paid for it. That was survivable only because the\n *    platform still held the funds and could be made to give them back; with\n *    the money at the merchant it is a silent, unrecoverable overcharge.\n *  - **Aglyn.** A refund on a destination charge that does NOT set\n *    `reverse_transfer` is paid entirely out of the PLATFORM's balance while\n *    the merchant keeps the transfer in full. The merchant cancels, the guest\n *    is made whole, and Aglyn funds the whole concession out of a cut that was\n *    at most 5% of it. This repo has shipped that exact bug once already, on a\n *    marketplace partial refund.\n *\n * So both switches are sent, and they are two different decisions:\n *\n *  - `reverse_transfer` pulls the refunded share back OUT of the merchant's\n *    account. Stripe prorates it against a partial refund, so a $30 refund on\n *    a $75 booking claws back $30 of the merchant's $71.25, not all of it.\n *  - `refund_application_fee` returns Aglyn's commission on the refunded\n *    share. A refunded appointment earned the platform nothing, and this\n *    matches `commerce/refund.ts`, which has sent both since AGL-287. The\n *    DISPUTE path deliberately sends only the reversal — that asymmetry is\n *    AGL-1809's and is not copied here.\n *\n * Two SEPARATE controls guard the money, the AGL-1696 lesson from the order\n * refund, and conflating them is how that one originally went wrong:\n *\n *  - The idempotency key stops a DUPLICATE refund — one attempt sent twice\n *    because the response was lost or the admin double-clicked. It is minted\n *    per attempt by the console and deliberately not derived from the booking\n *    or the amount: two $10 refunds on a $75 booking are two real refunds.\n *  - The cap stops an OVER-refund — several partials summing past what was\n *    captured, including two admins refunding at once, where the attempts are\n *    genuinely distinct and no key can help. That needs the counter read and\n *    written inside one transaction, BEFORE Stripe is called, so a lost\n *    response leaves the amount counted and the retry refunds less, never\n *    more.\n */\nexport const bookingRefundHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return res.status(501).json({ error: 'Payments are not configured.' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const bookingId = String(body.bookingId ?? '')\n  // `null`/absent means \"everything still refundable\"; a number is a partial.\n  const amountCents = body.amountCents == null ? null : Number(body.amountCents)\n  // Node lowercases incoming headers, but read both spellings — the plugin API\n  // request type makes no promise about casing.\n  const idempotencyKey = String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n  if (!hostId || !bookingId) {\n    return res.status(400).json({ error: 'Missing hostId or bookingId' })\n  }\n  if (amountCents != null && !(Number.isFinite(amountCents) && amountCents > 0)) {\n    return res.status(400).json({ error: 'Invalid refund amount' })\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Site ADMIN, not merely a member: this moves money. The same gate\n    // `commerce/refund.ts` applies.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin') {\n      return res.status(403).json({ error: 'Refunds require a site admin' })\n    }\n    const bookingRef = hostRef.collection('bookings').doc(bookingId)\n    const bookingSnapshot = await bookingRef.get()\n    if (!bookingSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown booking' })\n    }\n    const paymentIntentId = String(bookingSnapshot.get('paymentIntentId') ?? '')\n    const paidCents = Math.max(\n      0,\n      Math.round(Number(bookingSnapshot.get('paidAmountCents') ?? 0)),\n    )\n    if (!paidCents) {\n      return res.status(409).json({ error: 'This booking was never paid' })\n    }\n    if (!paymentIntentId) {\n      // A booking paid BEFORE the webhook began recording the PaymentIntent\n      // (AGL-2315). Refundable, but only by hand — and saying so beats a 500\n      // an admin cannot act on.\n      return res.status(409).json({\n        error:\n          'This booking was paid before refunds were supported here. ' +\n          'Refund it in the Stripe dashboard, and tick “Reverse transfer” ' +\n          'so the amount comes back from the merchant account.',\n      })\n    }\n\n    // Replay a settled attempt before anything else can reject it. This read\n    // is only a short-circuit, never the dedupe primitive — the atomic\n    // `create()` below is.\n    const claimRef = idempotencyKey\n      ? firestore.collection('apiIdempotency').doc(\n          createHash('sha256')\n            // Scoped by the BOOKING, so a client that reused one key across\n            // two bookings cannot dedupe two legitimately distinct refunds.\n            // NOT by the amount: that would swallow a real second partial.\n            .update(`booking-refund:${hostId}:${bookingId}:${idempotencyKey}`)\n            .digest('hex'),\n        )\n      : null\n    if (claimRef) {\n      const prior = await claimRef.get()\n      const priorResponse = prior.get('response')\n      if (priorResponse) {\n        return res\n          .status(Number(prior.get('responseStatus') ?? 200))\n          .json(priorResponse)\n      }\n      try {\n        await claimRef.create({ status: 'pending', startedAtMs: Date.now() })\n      } catch {\n        // Another attempt with this key is in flight.\n        return res\n          .status(409)\n          .json({ error: 'This refund is already being processed' })\n      }\n    }\n\n    // RESERVE. Read and write the counter in ONE transaction so two concurrent\n    // refunds cannot both see the same `refundedCents` and each send a full\n    // amount to Stripe — the failure the order refund shipped with.\n    let refundCents = 0\n    let alreadyRefunded = 0\n    await firestore.runTransaction(async (transaction) => {\n      const fresh = await transaction.get(bookingRef)\n      alreadyRefunded = Math.max(\n        0,\n        Math.round(Number(fresh.get('refundedCents') ?? 0)),\n      )\n      const remaining = paidCents - alreadyRefunded\n      refundCents =\n        amountCents == null\n          ? remaining\n          : Math.min(Math.round(amountCents), remaining)\n      if (!(refundCents > 0)) {\n        refundCents = 0\n        return\n      }\n      transaction.set(\n        bookingRef,\n        { refundedCents: alreadyRefunded + refundCents },\n        { merge: true },\n      )\n    })\n    if (!(refundCents > 0)) {\n      await claimRef?.delete().catch(() => undefined)\n      return res.status(400).json({ error: 'Nothing left to refund' })\n    }\n\n    const params = new URLSearchParams({\n      payment_intent: paymentIntentId,\n      amount: String(refundCents),\n      // THE SELLER SHARE COMES BACK. Without this the merchant keeps their\n      // transfer in full and Aglyn funds the entire refund.\n      reverse_transfer: 'true',\n      // ...and so does Aglyn's commission on the refunded share. A refunded\n      // appointment earned the platform nothing.\n      refund_application_fee: 'true',\n    })\n    const response = await fetch('https://api.stripe.com/v1/refunds', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n        'Content-Type': 'application/x-www-form-urlencoded',\n        ...(claimRef ? { 'Idempotency-Key': claimRef.id } : {}),\n      },\n      body: params.toString(),\n    })\n    const refund = await response.json().catch(() => ({}) as any)\n    if (!response.ok) {\n      console.error('Stripe booking refund error', (refund as any)?.error)\n      // Stripe said no, so we KNOW no money moved: give the reservation back\n      // and let the same attempt be retried.\n      await firestore\n        .runTransaction(async (transaction) => {\n          const current = Number(\n            (await transaction.get(bookingRef)).get('refundedCents') ?? 0,\n          )\n          transaction.set(\n            bookingRef,\n            { refundedCents: Math.max(0, current - refundCents) },\n            { merge: true },\n          )\n        })\n        .catch(() => undefined)\n      await claimRef?.delete().catch(() => undefined)\n      return res.status(502).json({ error: 'Refund failed' })\n    }\n\n    // A FULL refund ends the appointment; a partial leaves it standing. The\n    // guest who got half their money back still has the slot, and moving the\n    // booking off `confirmed` would reopen a time the merchant is still\n    // committed to.\n    const totalRefunded = alreadyRefunded + refundCents\n    const fullyRefunded = totalRefunded >= paidCents\n    await bookingRef\n      .set(\n        {\n          refundedCents: totalRefunded,\n          ...(fullyRefunded ? { status: 'canceled' } : {}),\n        },\n        { merge: true },\n      )\n      .catch(() => undefined)\n\n    const payload = {\n      refundedCents: refundCents,\n      totalRefundedCents: totalRefunded,\n      fullyRefunded,\n    }\n    await claimRef\n      ?.set(\n        {\n          status: 'done',\n          responseStatus: 200,\n          response: payload,\n          settledAtMs: Date.now(),\n        },\n        { merge: true },\n      )\n      .catch(() => undefined)\n    /*\n     * The campaign's side of the ledger.\n     *\n     * A paid booking is credited to the campaign that led to it — the sale\n     * announces itself through `upsertHostContact` with a `purchaseCents` and\n     * this booking's id, exactly as a store order does — so a refunded one\n     * has to stop counting. Without this, a booking site's campaign revenue\n     * could only ever rise.\n     *\n     * Keyed by the BOOKING id, which is what the credit was filed under, so\n     * this needs no email and works for a guest who never became a contact.\n     * Recorded beside the credit rather than subtracted from it, and swallowed\n     * whole: the money has already left the merchant's account and the booking\n     * already records it, so nothing here may fail a refund.\n     */\n    await reverseEmailAttributedRevenue({\n      hostId,\n      orderId: bookingId,\n      amountCents: refundCents,\n      closedTheOrder: fullyRefunded,\n    })\n    return res.status(200).json(payload)\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Refund failed' })\n  }\n}\n"],"names":["firebaseAdmin","reverseEmailAttributedRevenue","createHash","bookingRefundHandler","req","res","body","method","status","json","error","process","env","STRIPE_SECRET_KEY","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","bookingId","amountCents","Number","idempotencyKey","trim","isFinite","hostSnapshot","bookingSnapshot","decoded","app","auth","verifyIdToken","firestore","hostRef","collection","doc","get","exists","memberRole","uid","bookingRef","paymentIntentId","paidCents","Math","max","round","claimRef","update","digest","prior","priorResponse","create","startedAtMs","Date","now","refundCents","alreadyRefunded","runTransaction","transaction","fresh","remaining","min","set","refundedCents","merge","delete","catch","params","URLSearchParams","payment_intent","amount","reverse_transfer","refund_application_fee","response","fetch","Authorization","id","toString","refund","ok","console","current","totalRefunded","fullyRefunded","payload","totalRefundedCents","responseStatus","settledAtMs","orderId","closedTheOrder"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AAExD,8DAA8D;AAC9D,2EAA2E;AAC3E,sCAAsC;AACtC,SAASC,6BAA6B,QAAQ,4DAA2D;AACzG,SAASC,UAAU,QAAQ,SAAQ;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CC,GACD,OAAO,MAAMC,uBAAyC,OAAOC,KAAKC;QAOnCD,4BAM4BA,WACnCE,cACGA,iBAMvBF,MAAAA;IApBF,IAAIA,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI,CAACC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOR,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA+B;IACtE;IACA,MAAMI,gBAAgBC,QAAOX,6BAAAA,IAAIY,OAAO,CAACF,aAAa,YAAzBV,6BAA6B;IAC1D,MAAMa,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOZ,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMJ,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWgB,KAAKC,KAAK,CAACnB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMoB,SAAST,QAAOT,eAAAA,KAAKkB,MAAM,YAAXlB,eAAe;IACrC,MAAMmB,YAAYV,QAAOT,kBAAAA,KAAKmB,SAAS,YAAdnB,kBAAkB;IAC3C,4EAA4E;IAC5E,MAAMoB,cAAcpB,KAAKoB,WAAW,IAAI,OAAO,OAAOC,OAAOrB,KAAKoB,WAAW;IAC7E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAME,iBAAiBb,QACrBX,QAAAA,8BAAAA,IAAIY,OAAO,CAAC,kBAAkB,YAA9BZ,8BAAkCA,IAAIY,OAAO,CAAC,kBAAkB,YAAhEZ,OAAoE,IAEnEyB,IAAI,GACJV,KAAK,CAAC,GAAG;IACZ,IAAI,CAACK,UAAU,CAACC,WAAW;QACzB,OAAOpB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACA,IAAIgB,eAAe,QAAQ,CAAEC,CAAAA,OAAOG,QAAQ,CAACJ,gBAAgBA,cAAc,CAAA,GAAI;QAC7E,OAAOrB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAwB;IAC/D;IAEA,IAAI;YAUkBqB,mBASWC,sBAGXA;QArBpB,MAAMC,UAAU,MAAMjC,cAAckC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACnB;QAC/D,MAAMoB,YAAYrC,cAAckC,GAAG,GAAGG,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMO,eAAe,MAAMO,QAAQG,GAAG;QACtC,IAAI,CAACV,aAAaW,MAAM,EAAE;YACxB,OAAOrC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,mEAAmE;QACnE,gCAAgC;QAChC,MAAMiC,aAAa,EAACZ,oBAAAA,aAAaU,GAAG,CAAC,0BAAjBV,oBAAmC,CAAC,EAAE,CAACE,QAAQW,GAAG,CAAC;QACvE,IAAID,eAAe,SAAS;YAC1B,OAAOtC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA+B;QACtE;QACA,MAAMmC,aAAaP,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAACf;QACtD,MAAMO,kBAAkB,MAAMa,WAAWJ,GAAG;QAC5C,IAAI,CAACT,gBAAgBU,MAAM,EAAE;YAC3B,OAAOrC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAMoC,kBAAkB/B,QAAOiB,uBAAAA,gBAAgBS,GAAG,CAAC,8BAApBT,uBAA0C;QACzE,MAAMe,YAAYC,KAAKC,GAAG,CACxB,GACAD,KAAKE,KAAK,CAACvB,QAAOK,wBAAAA,gBAAgBS,GAAG,CAAC,8BAApBT,wBAA0C;QAE9D,IAAI,CAACe,WAAW;YACd,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA8B;QACrE;QACA,IAAI,CAACoC,iBAAiB;YACpB,sEAAsE;YACtE,uEAAuE;YACvE,0BAA0B;YAC1B,OAAOzC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,+DACA,oEACA;YACJ;QACF;QAEA,yEAAyE;QACzE,mEAAmE;QACnE,uBAAuB;QACvB,MAAMyC,WAAWvB,iBACbS,UAAUE,UAAU,CAAC,kBAAkBC,GAAG,CACxCtC,WAAW,SACT,gEAAgE;QAChE,gEAAgE;QAChE,+DAA+D;SAC9DkD,MAAM,CAAC,CAAC,eAAe,EAAE5B,OAAO,CAAC,EAAEC,UAAU,CAAC,EAAEG,gBAAgB,EAChEyB,MAAM,CAAC,UAEZ;QACJ,IAAIF,UAAU;YACZ,MAAMG,QAAQ,MAAMH,SAASV,GAAG;YAChC,MAAMc,gBAAgBD,MAAMb,GAAG,CAAC;YAChC,IAAIc,eAAe;oBAEAD;gBADjB,OAAOjD,IACJG,MAAM,CAACmB,QAAO2B,aAAAA,MAAMb,GAAG,CAAC,6BAAVa,aAA+B,MAC7C7C,IAAI,CAAC8C;YACV;YACA,IAAI;gBACF,MAAMJ,SAASK,MAAM,CAAC;oBAAEhD,QAAQ;oBAAWiD,aAAaC,KAAKC,GAAG;gBAAG;YACrE,EAAE,eAAM;gBACN,8CAA8C;gBAC9C,OAAOtD,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;oBAAEC,OAAO;gBAAyC;YAC5D;QACF;QAEA,2EAA2E;QAC3E,wEAAwE;QACxE,gEAAgE;QAChE,IAAIkD,cAAc;QAClB,IAAIC,kBAAkB;QACtB,MAAMxB,UAAUyB,cAAc,CAAC,OAAOC;gBAIhBC;YAHpB,MAAMA,QAAQ,MAAMD,YAAYtB,GAAG,CAACI;YACpCgB,kBAAkBb,KAAKC,GAAG,CACxB,GACAD,KAAKE,KAAK,CAACvB,QAAOqC,aAAAA,MAAMvB,GAAG,CAAC,4BAAVuB,aAA8B;YAElD,MAAMC,YAAYlB,YAAYc;YAC9BD,cACElC,eAAe,OACXuC,YACAjB,KAAKkB,GAAG,CAAClB,KAAKE,KAAK,CAACxB,cAAcuC;YACxC,IAAI,CAAEL,CAAAA,cAAc,CAAA,GAAI;gBACtBA,cAAc;gBACd;YACF;YACAG,YAAYI,GAAG,CACbtB,YACA;gBAAEuB,eAAeP,kBAAkBD;YAAY,GAC/C;gBAAES,OAAO;YAAK;QAElB;QACA,IAAI,CAAET,CAAAA,cAAc,CAAA,GAAI;YACtB,OAAMT,4BAAAA,SAAUmB,MAAM,GAAGC,KAAK,CAAC,IAAMlD;YACrC,OAAOhB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QAEA,MAAM8D,SAAS,IAAIC,gBAAgB;YACjCC,gBAAgB5B;YAChB6B,QAAQ5D,OAAO6C;YACf,qEAAqE;YACrE,sDAAsD;YACtDgB,kBAAkB;YAClB,sEAAsE;YACtE,2CAA2C;YAC3CC,wBAAwB;QAC1B;QACA,MAAMC,WAAW,MAAMC,MAAM,qCAAqC;YAChExE,QAAQ;YACRS,SAAS;gBACPgE,eAAe,CAAC,OAAO,EAAErE,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBACxD,gBAAgB;eACZsC,WAAW;gBAAE,mBAAmBA,SAAS8B,EAAE;YAAC,IAAI,CAAC;YAEvD3E,MAAMkE,OAAOU,QAAQ;QACvB;QACA,MAAMC,SAAS,MAAML,SAASrE,IAAI,GAAG8D,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QACnD,IAAI,CAACO,SAASM,EAAE,EAAE;YAChBC,QAAQ3E,KAAK,CAAC,+BAAgCyE,0BAAD,AAACA,OAAgBzE,KAAK;YACnE,uEAAuE;YACvE,uCAAuC;YACvC,MAAM2B,UACHyB,cAAc,CAAC,OAAOC;oBAEnB;gBADF,MAAMuB,UAAU3D,QACd,OAAA,AAAC,CAAA,MAAMoC,YAAYtB,GAAG,CAACI,WAAU,EAAGJ,GAAG,CAAC,4BAAxC,OAA4D;gBAE9DsB,YAAYI,GAAG,CACbtB,YACA;oBAAEuB,eAAepB,KAAKC,GAAG,CAAC,GAAGqC,UAAU1B;gBAAa,GACpD;oBAAES,OAAO;gBAAK;YAElB,GACCE,KAAK,CAAC,IAAMlD;YACf,OAAM8B,4BAAAA,SAAUmB,MAAM,GAAGC,KAAK,CAAC,IAAMlD;YACrC,OAAOhB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QAEA,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,gBAAgB;QAChB,MAAM6E,gBAAgB1B,kBAAkBD;QACxC,MAAM4B,gBAAgBD,iBAAiBxC;QACvC,MAAMF,WACHsB,GAAG,CACF;YACEC,eAAemB;WACXC,gBAAgB;YAAEhF,QAAQ;QAAW,IAAI,CAAC,IAEhD;YAAE6D,OAAO;QAAK,GAEfE,KAAK,CAAC,IAAMlD;QAEf,MAAMoE,UAAU;YACdrB,eAAeR;YACf8B,oBAAoBH;YACpBC;QACF;QACA,OAAMrC,4BAAAA,SACFgB,GAAG,CACH;YACE3D,QAAQ;YACRmF,gBAAgB;YAChBb,UAAUW;YACVG,aAAalC,KAAKC,GAAG;QACvB,GACA;YAAEU,OAAO;QAAK,GAEfE,KAAK,CAAC,IAAMlD;QACf;;;;;;;;;;;;;;KAcC,GACD,MAAMpB,8BAA8B;YAClCuB;YACAqE,SAASpE;YACTC,aAAakC;YACbkC,gBAAgBN;QAClB;QACA,OAAOnF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAACgF;IAC9B,EAAE,OAAO/E,OAAO;QACd2E,QAAQ3E,KAAK,CAACA;QACd,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/server.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginJobHostGate } from '@aglyn/aglyn/server';
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Public open-slot listing (AGL-159): visitors browse a service's next
+ * open times. Server-side because bookings (names/emails) must never be
+ * client-readable — only the derived busy intervals are used here.
+ */
+export declare const slotsHandler: PluginApiHandler;
+/**
+ * Booking creation (AGL-159): validates the slot against the service's
+ * windows AND stored bookings inside a transaction (double-booking safe),
+ * stores the booking, records a lead, emits the `booking` host event, and
+ * sends an env-gated Resend confirmation. Plan gate: the owning org
+ * needs the `bookings` flag (dark-launch workspaces pass).
+ */
+/**
+ * Exported for spec (AGL-2000). The tax decision this handler takes lives in
+ * the ABSENCE of a parameter, and an absence is only a decision if something
+ * asserts it — see `server-booking-tax.spec.ts`.
+ */
+export declare const bookHandler: PluginApiHandler;
+/**
+ * One reminder pass (AGL-160), extracted from its HTTP door in AGL-2431.
+ *
+ * Finds confirmed bookings starting 23–25 hours out (collection-group query,
+ * so one call covers every host), emails each visitor through the env-gated
+ * Resend path, and stamps `reminderSentAt` so re-runs are idempotent.
+ *
+ * WHY THIS IS A FUNCTION NOW. It only ever existed as `POST bookings/reminders`
+ * behind `x-cron-secret`, and nothing anywhere POSTed to it — not
+ * `scheduled-crons.yml`, not `vercel.json` (which has no `crons` key), not
+ * `registerPluginJob`. The route's own docblock said "invoke hourly from the
+ * scheduler" for as long as it has existed. It never ran, for anyone. Same
+ * shape as the two commerce beats in AGL-2227, one plugin over.
+ */
+export declare function scanBookingReminders(
+/** The lockdown gate, injected by the caller (AGL-2495). Not optional. */
+gate: PluginJobHostGate): Promise<{
+    scanned: number;
+    sent: number;
+    skipped: number;
+    skippedLocked: number;
+}>;
+/** Registers the bookings plugin's public (site-facing) API routes (AGL-396). */
+export declare function registerBookingsApi(): void;
+/** Registers the bookings plugin's console-side API routes (AGL-396). */
+export declare function registerBookingsConsoleApi(): void;