@aglyn/plugins-bookings 1.0.0-beta.199 → 1.0.0-beta.201

package/src/lib/server/billing-webhook.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/bookings/src/lib/server/billing-webhook.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// `after()`, never a bare `void promise` (AGL-2327). This handler runs inside\n// the console's `/api/billing/webhook` invocation, which AGL-1133 measured on\n// production is frozen the moment the response is sent — so fire-and-forget\n// work scheduled any other way simply does not run.\nimport { after } from 'next/server'\n\nimport type { BillingWebhookHandler } from '@aglyn/aglyn/server'\nimport { resolveBrandingProfile } from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  meterHostEmail,\n  renderHostEmailWithTokens,\n  sendGa4Purchase,\n} from '@aglyn/tenant-data-admin'\nimport { captureHostContact } from '@aglyn/tenant-runtime'\nimport {\n  bookingPlatformNetCents,\n  shouldSendBookingPlatformPurchase,\n} from '../model/booking-purchase-analytics'\nimport { sendEmail } from '@aglyn/shared-util-email'\nimport { pluginTaxProfile } from '@aglyn/aglyn/plugin-manager/plugin-tax-profile'\nimport { fileBookingOnCrm } from './booking-crm'\n\n/**\n * Paid-booking section of the platform Stripe webhook (AGL-170/418):\n * payment confirms the pendingPayment hold — relocated verbatim from the\n * console route; registered via registerBookingsConsoleApi.\n */\nexport const bookingsBillingWebhookHandler: BillingWebhookHandler = async ({\n  type,\n  object,\n}) => {\n    // Paid bookings (AGL-170): payment confirms the pendingPayment hold.\n    if (\n      type === 'checkout.session.completed' &&\n      object?.metadata?.type === 'booking-payment' &&\n      object?.payment_status === 'paid'\n    ) {\n      const { hostId, bookingId } = object.metadata ?? {}\n      if (hostId && bookingId) {\n        const firestore = firebaseAdmin.app().firestore()\n        const bookingRef = firestore\n          .collection('hosts')\n          .doc(String(hostId))\n          .collection('bookings')\n          .doc(String(bookingId))\n        // WHAT THE CLIENT HANDED OVER, ALL OF IT. Tax included: this is the\n        // ceiling `refund.ts` reverses against, and the client paid the tax\n        // too — a net figure here would strand part of a refund.\n        const paidAmountCents = Math.max(\n          0,\n          Math.round(Number(object?.amount_total ?? 0)),\n        )\n        // THE MERCHANT'S SERVICE TAX, SEPARATED OUT (AGL-2028).\n        //\n        // `server.ts` charges the merchant's own service rate as an ordinary\n        // `line_items[1]` Stripe is never told is tax (the AGL-1711\n        // construction, which is what keeps the figure the MERCHANT's rather\n        // than something computed against Aglyn's registrations). So\n        // `amount_total` is service-plus-tax while Stripe's own tax fields\n        // read zero, and the session's metadata is the only witness — exactly\n        // as it is for a buy-now sale.\n        const taxCents = Math.max(\n          0,\n          Math.round(Number(object?.metadata?.taxCents ?? 0)),\n        )\n        // The merchant's REVENUE, which is the charge less the tax. Used for\n        // the contact's lifetime value below: tax is collected on behalf of\n        // an authority and is not money the business earned, so counting it\n        // would over-state every service client's worth.\n        const serviceCents = Math.max(0, paidAmountCents - taxCents)\n        // WHAT A REFUND WILL NEED (AGL-2315). A paid booking is now a\n        // destination charge to the merchant's connected account, and\n        // reversing one requires the PaymentIntent — which lives only on this\n        // event. The booking document recorded `paidAmountCents` and nothing\n        // that identifies the charge, so a refund had no handle to pull and\n        // the information was gone the moment the webhook returned. Unlike\n        // most gaps this one cannot be backfilled from our own data later:\n        // every booking taken before this line landed can only be refunded by\n        // hand in the Stripe dashboard.\n        //\n        // `feeCents` is Aglyn's cut as CHARGED, read back off the session's\n        // own metadata rather than re-derived from the org at refund time. The\n        // rate follows the plan (AGL-2289's rule) and the plan moves, so\n        // re-resolving it during a refund would reverse a share that was never\n        // taken. `'0'` is a real recorded answer on the 0%-rate tiers.\n        const paymentIntentId =\n          typeof object?.payment_intent === 'string'\n            ? object.payment_intent\n            : String(object?.payment_intent?.id ?? '')\n        const chargedFeeCents = Math.max(\n          0,\n          Math.round(Number(object?.metadata?.feeCents ?? 0)),\n        )\n        // Redelivery guard (AGL-1755), the AGL-1748 shape. This was an\n        // unconditional merge-set with no status check at all — idempotent\n        // only by accident, because every value it wrote was fixed. A\n        // redelivery re-sent the guest's confirmation and re-metered it, and\n        // the moment this handler carries money to a contact the accident stops\n        // holding: `purchaseCents` is a `FieldValue.increment`, so every retry\n        // would inflate the customer's lifetime value.\n        //\n        // Keyed on the STATUS, not on the document existing: `server.ts` writes\n        // the booking as `pendingPayment` BEFORE it opens the Stripe session,\n        // so existence is guaranteed by the time any event arrives and proves\n        // nothing — the AGL-1748 reasoning, not AGL-1732's `checkoutSessionId`\n        // key, which existed because a sibling event wrote the same path.\n        //\n        // The key is \"not yet confirmed\" rather than \"is pendingPayment\" on\n        // purpose. The lapsed-hold sweeper in `server.ts` cancels a\n        // `pendingPayment` booking after 24h, and refusing a payment that\n        // landed anyway would take the money and record nothing; `confirmed` is\n        // reachable for a PAID booking only by this handler having already run,\n        // so it is an exact \"already processed\" test. The existence check is\n        // new and deliberate: the old merge-set would CREATE a stub booking\n        // from a metadata `bookingId` that pointed at nothing.\n        let booking: Record<string, any> = {}\n        const confirmedNow = await firestore.runTransaction(\n          async (transaction) => {\n            const snapshot = await transaction.get(bookingRef)\n            if (!snapshot.exists) return false\n            if (snapshot.get('status') === 'confirmed') return false\n            // \"Already processed\" is WIDER than `confirmed` once money can\n            // flow back out (AGL-2315). A refunded booking is moved off\n            // `confirmed`, so a redelivery arriving afterwards would otherwise\n            // read as unprocessed and re-confirm an appointment the merchant\n            // has already cancelled and refunded — re-sending the guest a\n            // confirmation for it and re-metering the email. Any evidence this\n            // handler has run before is the real test, and a refund counter or\n            // a recorded PaymentIntent is exactly that evidence.\n            if (\n              Number(snapshot.get('refundedCents') ?? 0) > 0 ||\n              snapshot.get('paymentIntentId')\n            ) {\n              return false\n            }\n            booking = (snapshot.data() as any) ?? {}\n            transaction.set(\n              bookingRef,\n              {\n                status: 'confirmed',\n                paidAmountCents,\n                // WHICH TAX REGIME THIS BOOKING CARRIED (AGL-2028), on the\n                // document the merchant reads — the stamp every other\n                // storefront money door already carries (AGL-2451).\n                //\n                // DERIVED from the one shared derivation, never a constant.\n                // A hand-written \"manual when the metadata says so\" would be\n                // a second rule that can drift from the `storefrontTaxCollected`\n                // row filed for the same Stripe id, which is the exact\n                // disagreement AGL-2451 exists to prevent.\n                //\n                // TWO-ARGUMENT, because the manual line makes Stripe report\n                // `total_details.amount_tax: 0` on a booking that really did\n                // charge the client tax; the one-argument form would stamp\n                // `none` on precisely those. `absent` remains a fourth state\n                // meaning \"recorded before this shipped\".\n                taxMode: pluginTaxProfile().taxModeOf(object, taxCents),\n                // The figure itself. Absent rather than a defaulted `0` — a\n                // zero written through `merge` is the AGL-1758 shape, and\n                // this handler can re-enter (see the widened guard above).\n                ...(taxCents > 0 ? { taxCents } : {}),\n                // The refund handles (AGL-2315). Written inside the same\n                // transaction as the status, so a booking can never read\n                // `confirmed` while the means to refund it are missing.\n                ...(paymentIntentId ? { paymentIntentId } : {}),\n                feeCents: chargedFeeCents,\n                // WHICH CHECKOUT PAID FOR THIS (AGL-2481). The guest's browser\n                // comes back from Stripe holding a session id and nothing\n                // else — a booking id was never in the return URL — so this is\n                // what lets `booking-analytics.ts` answer \"what did I just\n                // buy?\" for the merchant-side `purchase`, and it is written\n                // here because the session id first exists on this event.\n                //\n                // Inside the transaction with the status on purpose: the\n                // lookup refuses anything that is not `confirmed`, so a\n                // booking can never be findable by session id while reading as\n                // unpaid.\n                ...(object?.id ? { checkoutSessionId: String(object.id) } : {}),\n                // NOTE the absent `refundedCents: 0`. Seeding it here would be\n                // the AGL-1758 shape: a defaulted field written through\n                // `merge` destroying the real one. This handler can re-enter\n                // after a refund has already accumulated a counter (see the\n                // widened guard above), and a zero written back over it would\n                // re-open the full amount for refunding a second time. Absent\n                // IS zero — every reader coerces with `?? 0`.\n                expiresAtMs: firebaseAdmin.firestore.FieldValue.delete(),\n                confirmedAt:\n                  firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n              },\n              { merge: true },\n            )\n            return true\n          },\n        )\n        if (!confirmedNow) return\n        // THE RECORD'S MEETING (AGL-2660). Payment is what confirms a paid\n        // booking, so this is where it reaches the CRM: the meeting on the\n        // record's timeline and, when the service asks, the follow-up task.\n        // Inside the idempotency gate for the same reason the GA4 purchase\n        // below is — a redelivery must not file a second meeting — and\n        // through `after()` for the same reason too: this invocation is\n        // frozen the moment the response is sent (AGL-2327). Never thrown:\n        // the writer swallows its own failures, and the catch is for the\n        // scheduling itself.\n        after(() =>\n          fileBookingOnCrm(firestore, {\n            hostId: String(hostId),\n            bookingId: String(bookingId),\n            booking,\n          }).catch(() => undefined),\n        )\n        // AGLYN'S REVENUE ON THIS BOOKING (AGL-2481) — into OUR GA4 property.\n        //\n        // ## Why it is inside the idempotency gate rather than beside it\n        //\n        // This sits AFTER `if (!confirmedNow) return` and that placement is the\n        // whole guard. Stripe redelivers `checkout.session.completed` for up to\n        // three days after any 500, and this endpoint 500s on purpose; a\n        // redelivery re-enters this handler, the transaction above sees a\n        // `confirmed` status (or a refund counter, or a recorded PaymentIntent)\n        // and answers false, and everything below — the contact, the email, and\n        // now this — is skipped. A `purchase` fired before that gate, or beside\n        // it, would inflate our own reported revenue by the redelivery rate.\n        //\n        // `transaction_id` is the checkout session id, which is the same key\n        // the guard turns on, so GA4's own de-duplication is a second\n        // independent line of defence: even if the Firestore guard were ever\n        // bypassed, GA would collapse the repeats.\n        //\n        // ## Platform NET, and the fee is the measured one\n        //\n        // `value` is our fee and not the $95 the guest paid — the AGL-1639\n        // settlement. This is our property, the subscription and marketplace\n        // `purchase` events in it already mean \"what Aglyn was paid\", and a\n        // gross booking figure sitting beside them would make every combined\n        // total, ARPA and revenue audience wrong. The merchant's own gross goes\n        // to the MERCHANT's property, client-side, and the two never meet.\n        //\n        // The figure comes off the session's `metadata.feeCents` — the fee\n        // Stripe actually charged as `application_fee_amount` — never from the\n        // plan's rate re-applied here. See `bookingPlatformNetCents`.\n        //\n        // ## Scheduling and failure posture\n        //\n        // `after()`, never a bare `void` (AGL-2327/AGL-2346): this runs inside\n        // the console's `/api/billing/webhook` invocation, which is frozen the\n        // moment the response is sent, so fire-and-forget work scheduled any\n        // other way simply does not run — the exact way marketplace revenue\n        // reported to nothing. And `.catch()`, because a throw here would\n        // un-claim the Stripe event and turn a missed analytics hit into a\n        // repeated billing side effect.\n        if (shouldSendBookingPlatformPurchase(object)) {\n          const netCents = bookingPlatformNetCents(object)\n          after(() =>\n            sendGa4Purchase({\n              transactionId: String(object?.id ?? ''),\n              value: netCents / 100,\n              currency: String(object?.currency ?? 'usd'),\n              items: [\n                {\n                  // Ids only, no merchant free text. A service name is\n                  // merchant-authored and one edit away from carrying a\n                  // person's name into a dimension in OUR property; the id\n                  // already identifies it. The merchant's own property gets\n                  // the name, because there it is their own content.\n                  item_id: String(booking['serviceId'] ?? bookingId),\n                  item_name: String(booking['serviceId'] ?? bookingId),\n                  item_category: 'booking',\n                  // GA expects the items to sum to `value`; one item, one\n                  // price, and that price is our fee — not the service's.\n                  price: netCents / 100,\n                  quantity: 1,\n                },\n              ],\n              // Booking sessions carry no `ga_client_id` today — nothing\n              // captures one on a tenant site — so this is read for the day\n              // one is stamped and the seed below is what actually resolves.\n              clientId: object?.metadata?.ga_client_id,\n              // ONE PAYING GUEST, ONE SYNTHETIC USER. Seeded from Stripe's\n              // customer where there is one, and otherwise from the guest's\n              // email, which `server.ts` passes as `customer_email` and Stripe\n              // echoes on `customer_details`. The seed is hashed inside\n              // `synthesizeClientId` and never transmitted.\n              //\n              // The booking id is the LAST resort deliberately: it is unique\n              // per appointment, so seeding from it would turn a regular\n              // client into a crowd of one-purchase strangers and make ARPA\n              // nonsense — precisely what that helper's determinism exists to\n              // prevent. Without any seed at all `sendGa4Purchase` returns\n              // `no-client-id` and the event is silently never sent, which is\n              // the void this whole change exists to close.\n              stripeCustomerId:\n                String(object?.customer ?? '') ||\n                String(object?.customer_details?.email ?? '') ||\n                String(bookingId),\n            }).catch(() => undefined),\n          )\n        }\n        // Contacts ingestion (AGL-1755). `server.ts` captures the contact at\n        // REQUEST time, which is the right place — the booking is written\n        // `pendingPayment` and at that moment no money has moved, so passing an\n        // amount there would be a lie. But payment completes HERE, and this\n        // handler never returned to the contact, so a paid booking's money\n        // reached the booking document and nothing else. The same structural\n        // shape as AGL-1748's draft branch: the completion handler does\n        // everything except the contact.\n        //\n        // `source` stays `'booking'` — the same source the request-time capture\n        // used — so the `sources` map still says where this person came from\n        // and no schema change is needed to keep service revenue\n        // distinguishable from product revenue. The second interaction is\n        // deliberate rather than a duplicate: \"Booked X\" and \"Paid for X\" are\n        // two real events, and `mergeContactInteraction` does not dedupe on\n        // `refId`.\n        //\n        // The amount is `amount_total`, the money that moved, per AGL-1698 and\n        // AGL-1711 — the booking document stores no price to re-derive it from.\n        if (booking['email']) {\n          void captureHostContact({\n            hostId: String(hostId),\n            email: booking['email'],\n            ...(booking['name'] ? { name: String(booking['name']) } : {}),\n            source: 'booking',\n            // Paid, so a customer (AGL-2612) — the request-time capture\n            // said `lead`, and this is the door that has seen the money.\n            initialLifecycleStage: 'customer',\n            // The SERVICE, not the charge (AGL-2028). `amount_total` now\n            // includes the merchant's service tax where they set one, and\n            // tax is collected for an authority rather than earned — booking\n            // it as lifetime value would over-state what every service\n            // client is worth. Identical to `paidAmountCents` on the default\n            // store, which sets no rate.\n            ...(serviceCents > 0 ? { purchaseCents: serviceCents } : {}),\n            interaction: {\n              refId: String(bookingId),\n              summary: `Paid for \"${String(\n                booking['serviceName'] ?? 'a service',\n              ).slice(0, 60)}\" ($${(serviceCents / 100).toFixed(2)})`,\n            },\n          })\n        }\n        // Confirmation email now that payment cleared (env-gated inside\n        // sendEmail, which no-ops when Resend isn't configured).\n        if (booking['email']) {\n          const when = new Date(\n            Number(booking['startsAtMs']),\n          ).toLocaleString('en-US', {\n            dateStyle: 'full',\n            timeStyle: 'short',\n          })\n          const fallbackText =\n            `Hi ${booking['name'] ?? ''},\\n\\nPayment received — ` +\n            `\"${booking['serviceName'] ?? 'your booking'}\" is ` +\n            `confirmed for ${when}.\\n\\nReference: ${bookingId}`\n          // Site-owner-designed template when published (AGL-770); null keeps\n          // the built-in copy.\n          const designed = await renderHostEmailWithTokens(\n            firebaseAdmin.app().firestore(),\n            String(hostId),\n            'booking-confirmed',\n            {\n              name: String(booking['name'] ?? ''),\n              'service.name': String(booking['serviceName'] ?? ''),\n              when,\n              timezone: String(booking['timezone'] ?? ''),\n              'booking.ref': String(bookingId),\n            },\n          )\n          // White-label sender identity (White-Label Phase 3), matching the\n          // free-booking path — the store's brand via the one shared resolver.\n          const branding = resolveBrandingProfile(\n            (await getOrgForHost(String(hostId)).catch(() => null))?.org as never,\n          )\n          await sendEmail({\n            to: String(booking['email']),\n            subject:\n              designed?.subject ??\n              `Booking confirmed: ${booking['serviceName'] ?? ''}`,\n            text: designed?.text || fallbackText,\n            ...(designed?.html ? { html: designed.html } : {}),\n            fromName: branding.fromName,\n            sendingIdentity: await hostSendingIdentity(String(hostId)),\n            audience: 'tenant',\n            context: 'paid booking confirmation',\n          })\n          // Cost meter (AGL-1438), matching the free-booking path.\n          // Transactional: the guest has already paid.\n          await meterHostEmail(String(hostId))\n        }\n      }\n    }\n}\n"],"names":["after","resolveBrandingProfile","firebaseAdmin","getOrgForHost","hostSendingIdentity","meterHostEmail","renderHostEmailWithTokens","sendGa4Purchase","captureHostContact","bookingPlatformNetCents","shouldSendBookingPlatformPurchase","sendEmail","pluginTaxProfile","fileBookingOnCrm","bookingsBillingWebhookHandler","type","object","metadata","payment_status","hostId","bookingId","firestore","app","bookingRef","collection","doc","String","paidAmountCents","Math","max","round","Number","amount_total","taxCents","serviceCents","paymentIntentId","payment_intent","id","chargedFeeCents","feeCents","booking","confirmedNow","runTransaction","transaction","snapshot","get","exists","data","set","status","taxMode","taxModeOf","checkoutSessionId","expiresAtMs","FieldValue","delete","confirmedAt","serverTimestamp","merge","catch","undefined","netCents","transactionId","value","currency","items","item_id","item_name","item_category","price","quantity","clientId","ga_client_id","stripeCustomerId","customer","customer_details","email","name","source","initialLifecycleStage","purchaseCents","interaction","refId","summary","slice","toFixed","when","Date","toLocaleString","dateStyle","timeStyle","fallbackText","designed","timezone","branding","org","to","subject","text","html","fromName","sendingIdentity","audience","context"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,oDAAoD;AACpD,SAASA,KAAK,QAAQ,cAAa;AAGnC,SAASC,sBAAsB,QAAQ,sBAAqB;AAC5D,SACEC,aAAa,EACbC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,yBAAyB,EACzBC,eAAe,QACV,2BAA0B;AACjC,SAASC,kBAAkB,QAAQ,wBAAuB;AAC1D,SACEC,uBAAuB,EACvBC,iCAAiC,QAC5B,yCAAqC;AAC5C,SAASC,SAAS,QAAQ,2BAA0B;AACpD,SAASC,gBAAgB,QAAQ,iDAAgD;AACjF,SAASC,gBAAgB,QAAQ,mBAAe;AAEhD;;;;CAIC,GACD,OAAO,MAAMC,gCAAuD,OAAO,EACzEC,IAAI,EACJC,MAAM,EACP;QAIKA;IAHF,qEAAqE;IACrE,IACED,SAAS,gCACTC,CAAAA,2BAAAA,mBAAAA,OAAQC,QAAQ,qBAAhBD,iBAAkBD,IAAI,MAAK,qBAC3BC,CAAAA,0BAAAA,OAAQE,cAAc,MAAK,QAC3B;YAC8BF;QAA9B,MAAM,EAAEG,MAAM,EAAEC,SAAS,EAAE,IAAGJ,oBAAAA,OAAOC,QAAQ,YAAfD,oBAAmB,CAAC;QAClD,IAAIG,UAAUC,WAAW;;gBAyBHJ,mBAyBPA,wBAGOA;YApDpB,MAAMK,YAAYnB,cAAcoB,GAAG,GAAGD,SAAS;YAC/C,MAAME,aAAaF,UAChBG,UAAU,CAAC,SACXC,GAAG,CAACC,OAAOP,SACXK,UAAU,CAAC,YACXC,GAAG,CAACC,OAAON;YACd,oEAAoE;YACpE,oEAAoE;YACpE,yDAAyD;YACzD,MAAMO,kBAAkBC,KAAKC,GAAG,CAC9B,GACAD,KAAKE,KAAK,CAACC,eAAOf,0BAAAA,OAAQgB,YAAY,mBAAI;YAE5C,wDAAwD;YACxD,EAAE;YACF,qEAAqE;YACrE,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,mEAAmE;YACnE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAMC,WAAWL,KAAKC,GAAG,CACvB,GACAD,KAAKE,KAAK,CAACC,gBAAOf,2BAAAA,oBAAAA,OAAQC,QAAQ,qBAAhBD,kBAAkBiB,QAAQ,oBAAI;YAElD,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,iDAAiD;YACjD,MAAMC,eAAeN,KAAKC,GAAG,CAAC,GAAGF,kBAAkBM;YACnD,8DAA8D;YAC9D,8DAA8D;YAC9D,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,gCAAgC;YAChC,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,uEAAuE;YACvE,+DAA+D;YAC/D,MAAME,kBACJ,QAAOnB,0BAAAA,OAAQoB,cAAc,MAAK,WAC9BpB,OAAOoB,cAAc,GACrBV,gBAAOV,2BAAAA,yBAAAA,OAAQoB,cAAc,qBAAtBpB,uBAAwBqB,EAAE,oBAAI;YAC3C,MAAMC,kBAAkBV,KAAKC,GAAG,CAC9B,GACAD,KAAKE,KAAK,CAACC,gBAAOf,2BAAAA,oBAAAA,OAAQC,QAAQ,qBAAhBD,kBAAkBuB,QAAQ,oBAAI;YAElD,+DAA+D;YAC/D,mEAAmE;YACnE,8DAA8D;YAC9D,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,+CAA+C;YAC/C,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,kEAAkE;YAClE,EAAE;YACF,oEAAoE;YACpE,4DAA4D;YAC5D,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,uDAAuD;YACvD,IAAIC,UAA+B,CAAC;YACpC,MAAMC,eAAe,MAAMpB,UAAUqB,cAAc,CACjD,OAAOC;oBAaIC,eAKEA;gBAjBX,MAAMA,WAAW,MAAMD,YAAYE,GAAG,CAACtB;gBACvC,IAAI,CAACqB,SAASE,MAAM,EAAE,OAAO;gBAC7B,IAAIF,SAASC,GAAG,CAAC,cAAc,aAAa,OAAO;gBACnD,+DAA+D;gBAC/D,4DAA4D;gBAC5D,mEAAmE;gBACnE,iEAAiE;gBACjE,8DAA8D;gBAC9D,mEAAmE;gBACnE,mEAAmE;gBACnE,qDAAqD;gBACrD,IACEd,QAAOa,gBAAAA,SAASC,GAAG,CAAC,4BAAbD,gBAAiC,KAAK,KAC7CA,SAASC,GAAG,CAAC,oBACb;oBACA,OAAO;gBACT;gBACAL,WAAWI,iBAAAA,SAASG,IAAI,cAAbH,iBAA2B,CAAC;gBACvCD,YAAYK,GAAG,CACbzB,YACA;oBACE0B,QAAQ;oBACRtB;oBACA,2DAA2D;oBAC3D,sDAAsD;oBACtD,oDAAoD;oBACpD,EAAE;oBACF,4DAA4D;oBAC5D,6DAA6D;oBAC7D,iEAAiE;oBACjE,uDAAuD;oBACvD,2CAA2C;oBAC3C,EAAE;oBACF,4DAA4D;oBAC5D,6DAA6D;oBAC7D,2DAA2D;oBAC3D,6DAA6D;oBAC7D,0CAA0C;oBAC1CuB,SAAStC,mBAAmBuC,SAAS,CAACnC,QAAQiB;mBAI1CA,WAAW,IAAI;oBAAEA;gBAAS,IAAI,CAAC,GAI/BE,kBAAkB;oBAAEA;gBAAgB,IAAI,CAAC;oBAC7CI,UAAUD;mBAYNtB,CAAAA,0BAAAA,OAAQqB,EAAE,IAAG;oBAAEe,mBAAmB1B,OAAOV,OAAOqB,EAAE;gBAAE,IAAI,CAAC;oBAC7D,+DAA+D;oBAC/D,wDAAwD;oBACxD,6DAA6D;oBAC7D,4DAA4D;oBAC5D,8DAA8D;oBAC9D,8DAA8D;oBAC9D,8CAA8C;oBAC9CgB,aAAanD,cAAcmB,SAAS,CAACiC,UAAU,CAACC,MAAM;oBACtDC,aACEtD,cAAcmB,SAAS,CAACiC,UAAU,CAACG,eAAe;oBAEtD;oBAAEC,OAAO;gBAAK;gBAEhB,OAAO;YACT;YAEF,IAAI,CAACjB,cAAc;YACnB,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,+DAA+D;YAC/D,gEAAgE;YAChE,mEAAmE;YACnE,iEAAiE;YACjE,qBAAqB;YACrBzC,MAAM,IACJa,iBAAiBQ,WAAW;oBAC1BF,QAAQO,OAAOP;oBACfC,WAAWM,OAAON;oBAClBoB;gBACF,GAAGmB,KAAK,CAAC,IAAMC;YAEjB,sEAAsE;YACtE,EAAE;YACF,iEAAiE;YACjE,EAAE;YACF,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,EAAE;YACF,qEAAqE;YACrE,8DAA8D;YAC9D,qEAAqE;YACrE,2CAA2C;YAC3C,EAAE;YACF,mDAAmD;YACnD,EAAE;YACF,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,EAAE;YACF,mEAAmE;YACnE,uEAAuE;YACvE,8DAA8D;YAC9D,EAAE;YACF,oCAAoC;YACpC,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,gCAAgC;YAChC,IAAIlD,kCAAkCM,SAAS;gBAC7C,MAAM6C,WAAWpD,wBAAwBO;gBACzChB,MAAM;qCAYkBwC,oBACEA;wBAWZxB,kBAgBDA;2BAvCXT,gBAAgB;wBACduD,eAAepC,eAAOV,0BAAAA,OAAQqB,EAAE,mBAAI;wBACpC0B,OAAOF,WAAW;wBAClBG,UAAUtC,gBAAOV,0BAAAA,OAAQgD,QAAQ,oBAAI;wBACrCC,OAAO;4BACL;gCACE,qDAAqD;gCACrD,sDAAsD;gCACtD,yDAAyD;gCACzD,0DAA0D;gCAC1D,mDAAmD;gCACnDC,SAASxC,QAAOc,qBAAAA,OAAO,CAAC,YAAY,YAApBA,qBAAwBpB;gCACxC+C,WAAWzC,QAAOc,sBAAAA,OAAO,CAAC,YAAY,YAApBA,sBAAwBpB;gCAC1CgD,eAAe;gCACf,wDAAwD;gCACxD,wDAAwD;gCACxDC,OAAOR,WAAW;gCAClBS,UAAU;4BACZ;yBACD;wBACD,2DAA2D;wBAC3D,8DAA8D;wBAC9D,+DAA+D;wBAC/DC,QAAQ,EAAEvD,2BAAAA,mBAAAA,OAAQC,QAAQ,qBAAhBD,iBAAkBwD,YAAY;wBACxC,6DAA6D;wBAC7D,8DAA8D;wBAC9D,iEAAiE;wBACjE,0DAA0D;wBAC1D,8CAA8C;wBAC9C,EAAE;wBACF,+DAA+D;wBAC/D,2DAA2D;wBAC3D,8DAA8D;wBAC9D,gEAAgE;wBAChE,6DAA6D;wBAC7D,gEAAgE;wBAChE,8CAA8C;wBAC9CC,kBACE/C,gBAAOV,0BAAAA,OAAQ0D,QAAQ,oBAAI,OAC3BhD,gBAAOV,2BAAAA,2BAAAA,OAAQ2D,gBAAgB,qBAAxB3D,yBAA0B4D,KAAK,oBAAI,OAC1ClD,OAAON;oBACX,GAAGuC,KAAK,CAAC,IAAMC;;YAEnB;YACA,qEAAqE;YACrE,kEAAkE;YAClE,wEAAwE;YACxE,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,iCAAiC;YACjC,EAAE;YACF,wEAAwE;YACxE,qEAAqE;YACrE,yDAAyD;YACzD,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,WAAW;YACX,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,IAAIpB,OAAO,CAAC,QAAQ,EAAE;oBAmBdA;gBAlBN,KAAKhC,mBAAmB;oBACtBW,QAAQO,OAAOP;oBACfyD,OAAOpC,OAAO,CAAC,QAAQ;mBACnBA,OAAO,CAAC,OAAO,GAAG;oBAAEqC,MAAMnD,OAAOc,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC;oBAC3DsC,QAAQ;oBACR,4DAA4D;oBAC5D,6DAA6D;oBAC7DC,uBAAuB;mBAOnB7C,eAAe,IAAI;oBAAE8C,eAAe9C;gBAAa,IAAI,CAAC;oBAC1D+C,aAAa;wBACXC,OAAOxD,OAAON;wBACd+D,SAAS,CAAC,UAAU,EAAEzD,QACpBc,uBAAAA,OAAO,CAAC,cAAc,YAAtBA,uBAA0B,aAC1B4C,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,AAAClD,CAAAA,eAAe,GAAE,EAAGmD,OAAO,CAAC,GAAG,CAAC,CAAC;oBACzD;;YAEJ;YACA,gEAAgE;YAChE,yDAAyD;YACzD,IAAI7C,OAAO,CAAC,QAAQ,EAAE;oBAQZA,eACFA,uBASWA,gBACUA,uBAENA,0BAaKA;oBANvB;gBA3BH,MAAM8C,OAAO,IAAIC,KACfxD,OAAOS,OAAO,CAAC,aAAa,GAC5BgD,cAAc,CAAC,SAAS;oBACxBC,WAAW;oBACXC,WAAW;gBACb;gBACA,MAAMC,eACJ,CAAC,GAAG,GAAEnD,gBAAAA,OAAO,CAAC,OAAO,YAAfA,gBAAmB,GAAG,wBAAwB,CAAC,GACrD,CAAC,CAAC,GAAEA,wBAAAA,OAAO,CAAC,cAAc,YAAtBA,wBAA0B,eAAe,KAAK,CAAC,GACnD,CAAC,cAAc,EAAE8C,KAAK,gBAAgB,EAAElE,WAAW;gBACrD,oEAAoE;gBACpE,qBAAqB;gBACrB,MAAMwE,WAAW,MAAMtF,0BACrBJ,cAAcoB,GAAG,GAAGD,SAAS,IAC7BK,OAAOP,SACP,qBACA;oBACE0D,MAAMnD,QAAOc,iBAAAA,OAAO,CAAC,OAAO,YAAfA,iBAAmB;oBAChC,gBAAgBd,QAAOc,wBAAAA,OAAO,CAAC,cAAc,YAAtBA,wBAA0B;oBACjD8C;oBACAO,UAAUnE,QAAOc,oBAAAA,OAAO,CAAC,WAAW,YAAnBA,oBAAuB;oBACxC,eAAed,OAAON;gBACxB;gBAEF,kEAAkE;gBAClE,qEAAqE;gBACrE,MAAM0E,WAAW7F,wBACd,QAAA,MAAME,cAAcuB,OAAOP,SAASwC,KAAK,CAAC,IAAM,0BAAjD,AAAC,MAAwDoC,GAAG;gBAE9D,MAAMpF,UAAU;oBACdqF,IAAItE,OAAOc,OAAO,CAAC,QAAQ;oBAC3ByD,OAAO,WACLL,4BAAAA,SAAUK,OAAO,oBACjB,CAAC,mBAAmB,GAAEzD,wBAAAA,OAAO,CAAC,cAAc,YAAtBA,wBAA0B,IAAI;oBACtD0D,MAAMN,CAAAA,4BAAAA,SAAUM,IAAI,KAAIP;mBACpBC,CAAAA,4BAAAA,SAAUO,IAAI,IAAG;oBAAEA,MAAMP,SAASO,IAAI;gBAAC,IAAI,CAAC;oBAChDC,UAAUN,SAASM,QAAQ;oBAC3BC,iBAAiB,MAAMjG,oBAAoBsB,OAAOP;oBAClDmF,UAAU;oBACVC,SAAS;;gBAEX,yDAAyD;gBACzD,6CAA6C;gBAC7C,MAAMlG,eAAeqB,OAAOP;YAC9B;QACF;IACF;AACJ,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/bookings/src/lib/server/billing-webhook.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// `after()`, never a bare `void promise` (AGL-2327). This handler runs inside\n// the console's `/api/billing/webhook` invocation, which AGL-1133 measured on\n// production is frozen the moment the response is sent — so fire-and-forget\n// work scheduled any other way simply does not run.\nimport { after } from 'next/server'\n\nimport type { BillingWebhookHandler } from '@aglyn/aglyn/server'\nimport { resolveBrandingProfile } from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  meterHostEmail,\n  notifyHostManagers,\n  renderHostEmailWithTokens,\n  sendGa4Purchase,\n} from '@aglyn/tenant-data-admin'\nimport { paymentRiskEventFrom } from '@aglyn/aglyn/app-utils/payment-risk'\nimport {\n  recordPaymentRiskOnRecord,\n  settlePaymentRiskDisputeOnRecord,\n} from '@aglyn/tenant-data-admin/server/payment-risk-record'\nimport { captureHostContact } from '@aglyn/tenant-runtime'\nimport {\n  bookingPlatformNetCents,\n  shouldSendBookingPlatformPurchase,\n} from '../model/booking-purchase-analytics'\nimport { sendEmail } from '@aglyn/shared-util-email'\nimport { pluginTaxProfile } from '@aglyn/aglyn/plugin-manager/plugin-tax-profile'\nimport { fileBookingOnCrm } from './booking-crm'\n\n/**\n * Paid-booking section of the platform Stripe webhook (AGL-170/418):\n * payment confirms the pendingPayment hold — relocated verbatim from the\n * console route; registered via registerBookingsConsoleApi.\n */\n/** gRPC `Status.FAILED_PRECONDITION` — Firestore's \"this query needs an index\". */\nconst GRPC_FAILED_PRECONDITION = 9\n\n/**\n * The booking a charge paid for, found by the `paymentIntentId` the paid\n * handler below records (AGL-2315), or null. A missing collection-group\n * index is logged and answered null rather than thrown: no redelivery can\n * fix it, and the dispute then reaches staff through the route's\n * unattributed-dispute alert instead of vanishing.\n */\nasync function findBookingForPayment(\n  paymentIntentId: string,\n): Promise<FirebaseFirestore.QueryDocumentSnapshot | null> {\n  if (!paymentIntentId) return null\n  const matches = await firebaseAdmin\n    .app()\n    .firestore()\n    .collectionGroup('bookings')\n    .where('paymentIntentId', '==', paymentIntentId)\n    .limit(2)\n    .get()\n    .catch((error: { code?: number }) => {\n      if (error?.code !== GRPC_FAILED_PRECONDITION) throw error\n      console.error(\n        'Booking payment lookup needs the collection-group index on ' +\n          'bookings.paymentIntentId (AGL-3360)',\n        error,\n      )\n      return null\n    })\n  // One payment intent pays one booking; two is corrupt data, and stamping\n  // an arbitrary one would tell the wrong merchant.\n  return matches && matches.docs.length === 1 ? matches.docs[0] : null\n}\n\nexport const bookingsBillingWebhookHandler: BillingWebhookHandler = async ({\n  type,\n  object,\n}) => {\n    // Fraud signals on a paid booking (AGL-3360): an issuer's early fraud\n    // warning, a Radar review, or a dispute. Booking deposits never heard\n    // about any of them, so the merchant learned of a chargeback from Stripe\n    // alone. The signal now lands on the BOOKING, through the shared\n    // `paymentRisk` shape every plugin stamps, and the site's managers are\n    // told once. Nothing is refunded or canceled: the merchant decides.\n    const risk = paymentRiskEventFrom(type, object)\n    if (risk) {\n      const booking = await findBookingForPayment(risk.paymentIntentId)\n      if (!booking) return\n      const hostId = String(booking.ref.parent.parent?.id ?? '')\n      await recordPaymentRiskOnRecord(\n        {\n          ref: booking.ref,\n          signal: risk.signal,\n          hostId,\n          subjectLabel: `Booking ${String(booking.get('serviceName') ?? booking.id)}`,\n          link: `/${hostId}/bookings`,\n          notificationType: 'content.booking',\n        },\n        { firestore: firebaseAdmin.app().firestore(), notify: notifyHostManagers },\n      )\n      return { claimed: true, hostId }\n    }\n    // A dispute's outcome, on the signal `created` stamped. Claimed only when\n    // it was NOT lost: a lost booking dispute takes money back that nothing\n    // here reverses or records, which is exactly what the route's\n    // unattributed-dispute alert is for, so staff still hear about it.\n    if (type === 'charge.dispute.closed') {\n      const paymentIntentId =\n        typeof object?.payment_intent === 'string'\n          ? object.payment_intent\n          : String(object?.payment_intent?.id ?? '')\n      const booking = await findBookingForPayment(paymentIntentId)\n      if (!booking) return\n      const outcome = String(object?.status ?? '')\n      await settlePaymentRiskDisputeOnRecord(\n        booking.ref,\n        String(object?.id ?? ''),\n        outcome,\n        { firestore: firebaseAdmin.app().firestore() },\n      )\n      return outcome === 'lost'\n        ? undefined\n        : { claimed: true, hostId: String(booking.ref.parent.parent?.id ?? '') }\n    }\n    // Paid bookings (AGL-170): payment confirms the pendingPayment hold.\n    if (\n      type === 'checkout.session.completed' &&\n      object?.metadata?.type === 'booking-payment' &&\n      object?.payment_status === 'paid'\n    ) {\n      const { hostId, bookingId } = object.metadata ?? {}\n      if (hostId && bookingId) {\n        const firestore = firebaseAdmin.app().firestore()\n        const bookingRef = firestore\n          .collection('hosts')\n          .doc(String(hostId))\n          .collection('bookings')\n          .doc(String(bookingId))\n        // WHAT THE CLIENT HANDED OVER, ALL OF IT. Tax included: this is the\n        // ceiling `refund.ts` reverses against, and the client paid the tax\n        // too — a net figure here would strand part of a refund.\n        const paidAmountCents = Math.max(\n          0,\n          Math.round(Number(object?.amount_total ?? 0)),\n        )\n        // THE MERCHANT'S SERVICE TAX, SEPARATED OUT (AGL-2028).\n        //\n        // `server.ts` charges the merchant's own service rate as an ordinary\n        // `line_items[1]` Stripe is never told is tax (the AGL-1711\n        // construction, which is what keeps the figure the MERCHANT's rather\n        // than something computed against Aglyn's registrations). So\n        // `amount_total` is service-plus-tax while Stripe's own tax fields\n        // read zero, and the session's metadata is the only witness — exactly\n        // as it is for a buy-now sale.\n        const taxCents = Math.max(\n          0,\n          Math.round(Number(object?.metadata?.taxCents ?? 0)),\n        )\n        // The merchant's REVENUE, which is the charge less the tax. Used for\n        // the contact's lifetime value below: tax is collected on behalf of\n        // an authority and is not money the business earned, so counting it\n        // would over-state every service client's worth.\n        const serviceCents = Math.max(0, paidAmountCents - taxCents)\n        // WHAT A REFUND WILL NEED (AGL-2315). A paid booking is now a\n        // destination charge to the merchant's connected account, and\n        // reversing one requires the PaymentIntent — which lives only on this\n        // event. The booking document recorded `paidAmountCents` and nothing\n        // that identifies the charge, so a refund had no handle to pull and\n        // the information was gone the moment the webhook returned. Unlike\n        // most gaps this one cannot be backfilled from our own data later:\n        // every booking taken before this line landed can only be refunded by\n        // hand in the Stripe dashboard.\n        //\n        // `feeCents` is Aglyn's cut as CHARGED, read back off the session's\n        // own metadata rather than re-derived from the org at refund time. The\n        // rate follows the plan (AGL-2289's rule) and the plan moves, so\n        // re-resolving it during a refund would reverse a share that was never\n        // taken. `'0'` is a real recorded answer on the 0%-rate tiers.\n        const paymentIntentId =\n          typeof object?.payment_intent === 'string'\n            ? object.payment_intent\n            : String(object?.payment_intent?.id ?? '')\n        const chargedFeeCents = Math.max(\n          0,\n          Math.round(Number(object?.metadata?.feeCents ?? 0)),\n        )\n        // Redelivery guard (AGL-1755), the AGL-1748 shape. This was an\n        // unconditional merge-set with no status check at all — idempotent\n        // only by accident, because every value it wrote was fixed. A\n        // redelivery re-sent the guest's confirmation and re-metered it, and\n        // the moment this handler carries money to a contact the accident stops\n        // holding: `purchaseCents` is a `FieldValue.increment`, so every retry\n        // would inflate the customer's lifetime value.\n        //\n        // Keyed on the STATUS, not on the document existing: `server.ts` writes\n        // the booking as `pendingPayment` BEFORE it opens the Stripe session,\n        // so existence is guaranteed by the time any event arrives and proves\n        // nothing — the AGL-1748 reasoning, not AGL-1732's `checkoutSessionId`\n        // key, which existed because a sibling event wrote the same path.\n        //\n        // The key is \"not yet confirmed\" rather than \"is pendingPayment\" on\n        // purpose. The lapsed-hold sweeper in `server.ts` cancels a\n        // `pendingPayment` booking after 24h, and refusing a payment that\n        // landed anyway would take the money and record nothing; `confirmed` is\n        // reachable for a PAID booking only by this handler having already run,\n        // so it is an exact \"already processed\" test. The existence check is\n        // new and deliberate: the old merge-set would CREATE a stub booking\n        // from a metadata `bookingId` that pointed at nothing.\n        let booking: Record<string, any> = {}\n        const confirmedNow = await firestore.runTransaction(\n          async (transaction) => {\n            const snapshot = await transaction.get(bookingRef)\n            if (!snapshot.exists) return false\n            if (snapshot.get('status') === 'confirmed') return false\n            // \"Already processed\" is WIDER than `confirmed` once money can\n            // flow back out (AGL-2315). A refunded booking is moved off\n            // `confirmed`, so a redelivery arriving afterwards would otherwise\n            // read as unprocessed and re-confirm an appointment the merchant\n            // has already cancelled and refunded — re-sending the guest a\n            // confirmation for it and re-metering the email. Any evidence this\n            // handler has run before is the real test, and a refund counter or\n            // a recorded PaymentIntent is exactly that evidence.\n            if (\n              Number(snapshot.get('refundedCents') ?? 0) > 0 ||\n              snapshot.get('paymentIntentId')\n            ) {\n              return false\n            }\n            booking = (snapshot.data() as any) ?? {}\n            transaction.set(\n              bookingRef,\n              {\n                status: 'confirmed',\n                paidAmountCents,\n                // WHICH TAX REGIME THIS BOOKING CARRIED (AGL-2028), on the\n                // document the merchant reads — the stamp every other\n                // storefront money door already carries (AGL-2451).\n                //\n                // DERIVED from the one shared derivation, never a constant.\n                // A hand-written \"manual when the metadata says so\" would be\n                // a second rule that can drift from the `storefrontTaxCollected`\n                // row filed for the same Stripe id, which is the exact\n                // disagreement AGL-2451 exists to prevent.\n                //\n                // TWO-ARGUMENT, because the manual line makes Stripe report\n                // `total_details.amount_tax: 0` on a booking that really did\n                // charge the client tax; the one-argument form would stamp\n                // `none` on precisely those. `absent` remains a fourth state\n                // meaning \"recorded before this shipped\".\n                taxMode: pluginTaxProfile().taxModeOf(object, taxCents),\n                // The figure itself. Absent rather than a defaulted `0` — a\n                // zero written through `merge` is the AGL-1758 shape, and\n                // this handler can re-enter (see the widened guard above).\n                ...(taxCents > 0 ? { taxCents } : {}),\n                // The refund handles (AGL-2315). Written inside the same\n                // transaction as the status, so a booking can never read\n                // `confirmed` while the means to refund it are missing.\n                ...(paymentIntentId ? { paymentIntentId } : {}),\n                feeCents: chargedFeeCents,\n                // WHICH CHECKOUT PAID FOR THIS (AGL-2481). The guest's browser\n                // comes back from Stripe holding a session id and nothing\n                // else — a booking id was never in the return URL — so this is\n                // what lets `booking-analytics.ts` answer \"what did I just\n                // buy?\" for the merchant-side `purchase`, and it is written\n                // here because the session id first exists on this event.\n                //\n                // Inside the transaction with the status on purpose: the\n                // lookup refuses anything that is not `confirmed`, so a\n                // booking can never be findable by session id while reading as\n                // unpaid.\n                ...(object?.id ? { checkoutSessionId: String(object.id) } : {}),\n                // NOTE the absent `refundedCents: 0`. Seeding it here would be\n                // the AGL-1758 shape: a defaulted field written through\n                // `merge` destroying the real one. This handler can re-enter\n                // after a refund has already accumulated a counter (see the\n                // widened guard above), and a zero written back over it would\n                // re-open the full amount for refunding a second time. Absent\n                // IS zero — every reader coerces with `?? 0`.\n                expiresAtMs: firebaseAdmin.firestore.FieldValue.delete(),\n                confirmedAt:\n                  firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n              },\n              { merge: true },\n            )\n            return true\n          },\n        )\n        if (!confirmedNow) return\n        // THE RECORD'S MEETING (AGL-2660). Payment is what confirms a paid\n        // booking, so this is where it reaches the CRM: the meeting on the\n        // record's timeline and, when the service asks, the follow-up task.\n        // Inside the idempotency gate for the same reason the GA4 purchase\n        // below is — a redelivery must not file a second meeting — and\n        // through `after()` for the same reason too: this invocation is\n        // frozen the moment the response is sent (AGL-2327). Never thrown:\n        // the writer swallows its own failures, and the catch is for the\n        // scheduling itself.\n        after(() =>\n          fileBookingOnCrm(firestore, {\n            hostId: String(hostId),\n            bookingId: String(bookingId),\n            booking,\n          }).catch(() => undefined),\n        )\n        // AGLYN'S REVENUE ON THIS BOOKING (AGL-2481) — into OUR GA4 property.\n        //\n        // ## Why it is inside the idempotency gate rather than beside it\n        //\n        // This sits AFTER `if (!confirmedNow) return` and that placement is the\n        // whole guard. Stripe redelivers `checkout.session.completed` for up to\n        // three days after any 500, and this endpoint 500s on purpose; a\n        // redelivery re-enters this handler, the transaction above sees a\n        // `confirmed` status (or a refund counter, or a recorded PaymentIntent)\n        // and answers false, and everything below — the contact, the email, and\n        // now this — is skipped. A `purchase` fired before that gate, or beside\n        // it, would inflate our own reported revenue by the redelivery rate.\n        //\n        // `transaction_id` is the checkout session id, which is the same key\n        // the guard turns on, so GA4's own de-duplication is a second\n        // independent line of defence: even if the Firestore guard were ever\n        // bypassed, GA would collapse the repeats.\n        //\n        // ## Platform NET, and the fee is the measured one\n        //\n        // `value` is our fee and not the $95 the guest paid — the AGL-1639\n        // settlement. This is our property, the subscription and marketplace\n        // `purchase` events in it already mean \"what Aglyn was paid\", and a\n        // gross booking figure sitting beside them would make every combined\n        // total, ARPA and revenue audience wrong. The merchant's own gross goes\n        // to the MERCHANT's property, client-side, and the two never meet.\n        //\n        // The figure comes off the session's `metadata.feeCents` — the fee\n        // Stripe actually charged as `application_fee_amount` — never from the\n        // plan's rate re-applied here. See `bookingPlatformNetCents`.\n        //\n        // ## Scheduling and failure posture\n        //\n        // `after()`, never a bare `void` (AGL-2327/AGL-2346): this runs inside\n        // the console's `/api/billing/webhook` invocation, which is frozen the\n        // moment the response is sent, so fire-and-forget work scheduled any\n        // other way simply does not run — the exact way marketplace revenue\n        // reported to nothing. And `.catch()`, because a throw here would\n        // un-claim the Stripe event and turn a missed analytics hit into a\n        // repeated billing side effect.\n        if (shouldSendBookingPlatformPurchase(object)) {\n          const netCents = bookingPlatformNetCents(object)\n          after(() =>\n            sendGa4Purchase({\n              transactionId: String(object?.id ?? ''),\n              value: netCents / 100,\n              currency: String(object?.currency ?? 'usd'),\n              items: [\n                {\n                  // Ids only, no merchant free text. A service name is\n                  // merchant-authored and one edit away from carrying a\n                  // person's name into a dimension in OUR property; the id\n                  // already identifies it. The merchant's own property gets\n                  // the name, because there it is their own content.\n                  item_id: String(booking['serviceId'] ?? bookingId),\n                  item_name: String(booking['serviceId'] ?? bookingId),\n                  item_category: 'booking',\n                  // GA expects the items to sum to `value`; one item, one\n                  // price, and that price is our fee — not the service's.\n                  price: netCents / 100,\n                  quantity: 1,\n                },\n              ],\n              // Booking sessions carry no `ga_client_id` today — nothing\n              // captures one on a tenant site — so this is read for the day\n              // one is stamped and the seed below is what actually resolves.\n              clientId: object?.metadata?.ga_client_id,\n              // ONE PAYING GUEST, ONE SYNTHETIC USER. Seeded from Stripe's\n              // customer where there is one, and otherwise from the guest's\n              // email, which `server.ts` passes as `customer_email` and Stripe\n              // echoes on `customer_details`. The seed is hashed inside\n              // `synthesizeClientId` and never transmitted.\n              //\n              // The booking id is the LAST resort deliberately: it is unique\n              // per appointment, so seeding from it would turn a regular\n              // client into a crowd of one-purchase strangers and make ARPA\n              // nonsense — precisely what that helper's determinism exists to\n              // prevent. Without any seed at all `sendGa4Purchase` returns\n              // `no-client-id` and the event is silently never sent, which is\n              // the void this whole change exists to close.\n              stripeCustomerId:\n                String(object?.customer ?? '') ||\n                String(object?.customer_details?.email ?? '') ||\n                String(bookingId),\n            }).catch(() => undefined),\n          )\n        }\n        // Contacts ingestion (AGL-1755). `server.ts` captures the contact at\n        // REQUEST time, which is the right place — the booking is written\n        // `pendingPayment` and at that moment no money has moved, so passing an\n        // amount there would be a lie. But payment completes HERE, and this\n        // handler never returned to the contact, so a paid booking's money\n        // reached the booking document and nothing else. The same structural\n        // shape as AGL-1748's draft branch: the completion handler does\n        // everything except the contact.\n        //\n        // `source` stays `'booking'` — the same source the request-time capture\n        // used — so the `sources` map still says where this person came from\n        // and no schema change is needed to keep service revenue\n        // distinguishable from product revenue. The second interaction is\n        // deliberate rather than a duplicate: \"Booked X\" and \"Paid for X\" are\n        // two real events, and `mergeContactInteraction` does not dedupe on\n        // `refId`.\n        //\n        // The amount is `amount_total`, the money that moved, per AGL-1698 and\n        // AGL-1711 — the booking document stores no price to re-derive it from.\n        if (booking['email']) {\n          void captureHostContact({\n            hostId: String(hostId),\n            email: booking['email'],\n            ...(booking['name'] ? { name: String(booking['name']) } : {}),\n            source: 'booking',\n            // Paid, so a customer (AGL-2612) — the request-time capture\n            // said `lead`, and this is the door that has seen the money.\n            initialLifecycleStage: 'customer',\n            // The SERVICE, not the charge (AGL-2028). `amount_total` now\n            // includes the merchant's service tax where they set one, and\n            // tax is collected for an authority rather than earned — booking\n            // it as lifetime value would over-state what every service\n            // client is worth. Identical to `paidAmountCents` on the default\n            // store, which sets no rate.\n            ...(serviceCents > 0 ? { purchaseCents: serviceCents } : {}),\n            interaction: {\n              refId: String(bookingId),\n              summary: `Paid for \"${String(\n                booking['serviceName'] ?? 'a service',\n              ).slice(0, 60)}\" ($${(serviceCents / 100).toFixed(2)})`,\n            },\n          })\n        }\n        // Confirmation email now that payment cleared (env-gated inside\n        // sendEmail, which no-ops when Resend isn't configured).\n        if (booking['email']) {\n          const when = new Date(\n            Number(booking['startsAtMs']),\n          ).toLocaleString('en-US', {\n            dateStyle: 'full',\n            timeStyle: 'short',\n          })\n          const fallbackText =\n            `Hi ${booking['name'] ?? ''},\\n\\nPayment received — ` +\n            `\"${booking['serviceName'] ?? 'your booking'}\" is ` +\n            `confirmed for ${when}.\\n\\nReference: ${bookingId}`\n          // Site-owner-designed template when published (AGL-770); null keeps\n          // the built-in copy.\n          const designed = await renderHostEmailWithTokens(\n            firebaseAdmin.app().firestore(),\n            String(hostId),\n            'booking-confirmed',\n            {\n              name: String(booking['name'] ?? ''),\n              'service.name': String(booking['serviceName'] ?? ''),\n              when,\n              timezone: String(booking['timezone'] ?? ''),\n              'booking.ref': String(bookingId),\n            },\n          )\n          // White-label sender identity (White-Label Phase 3), matching the\n          // free-booking path — the store's brand via the one shared resolver.\n          const branding = resolveBrandingProfile(\n            (await getOrgForHost(String(hostId)).catch(() => null))?.org as never,\n          )\n          await sendEmail({\n            to: String(booking['email']),\n            subject:\n              designed?.subject ??\n              `Booking confirmed: ${booking['serviceName'] ?? ''}`,\n            text: designed?.text || fallbackText,\n            ...(designed?.html ? { html: designed.html } : {}),\n            fromName: branding.fromName,\n            sendingIdentity: await hostSendingIdentity(String(hostId)),\n            audience: 'tenant',\n            context: 'paid booking confirmation',\n            // Owed to the recipient by their own booking: the phishing\n            // screen's soft rules never hold it (AGL-3356).\n            owedFor: 'booking',\n          })\n          // Cost meter (AGL-1438), matching the free-booking path.\n          // Transactional: the guest has already paid.\n          await meterHostEmail(String(hostId))\n        }\n      }\n    }\n}\n"],"names":["after","resolveBrandingProfile","firebaseAdmin","getOrgForHost","hostSendingIdentity","meterHostEmail","notifyHostManagers","renderHostEmailWithTokens","sendGa4Purchase","paymentRiskEventFrom","recordPaymentRiskOnRecord","settlePaymentRiskDisputeOnRecord","captureHostContact","bookingPlatformNetCents","shouldSendBookingPlatformPurchase","sendEmail","pluginTaxProfile","fileBookingOnCrm","GRPC_FAILED_PRECONDITION","findBookingForPayment","paymentIntentId","matches","app","firestore","collectionGroup","where","limit","get","catch","error","code","console","docs","length","bookingsBillingWebhookHandler","type","object","risk","booking","hostId","String","ref","parent","id","signal","subjectLabel","link","notificationType","notify","claimed","payment_intent","outcome","status","undefined","metadata","payment_status","bookingId","bookingRef","collection","doc","paidAmountCents","Math","max","round","Number","amount_total","taxCents","serviceCents","chargedFeeCents","feeCents","confirmedNow","runTransaction","transaction","snapshot","exists","data","set","taxMode","taxModeOf","checkoutSessionId","expiresAtMs","FieldValue","delete","confirmedAt","serverTimestamp","merge","netCents","transactionId","value","currency","items","item_id","item_name","item_category","price","quantity","clientId","ga_client_id","stripeCustomerId","customer","customer_details","email","name","source","initialLifecycleStage","purchaseCents","interaction","refId","summary","slice","toFixed","when","Date","toLocaleString","dateStyle","timeStyle","fallbackText","designed","timezone","branding","org","to","subject","text","html","fromName","sendingIdentity","audience","context","owedFor"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,oDAAoD;AACpD,SAASA,KAAK,QAAQ,cAAa;AAGnC,SAASC,sBAAsB,QAAQ,sBAAqB;AAC5D,SACEC,aAAa,EACbC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,kBAAkB,EAClBC,yBAAyB,EACzBC,eAAe,QACV,2BAA0B;AACjC,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SACEC,yBAAyB,EACzBC,gCAAgC,QAC3B,sDAAqD;AAC5D,SAASC,kBAAkB,QAAQ,wBAAuB;AAC1D,SACEC,uBAAuB,EACvBC,iCAAiC,QAC5B,yCAAqC;AAC5C,SAASC,SAAS,QAAQ,2BAA0B;AACpD,SAASC,gBAAgB,QAAQ,iDAAgD;AACjF,SAASC,gBAAgB,QAAQ,mBAAe;AAEhD;;;;CAIC,GACD,iFAAiF,GACjF,MAAMC,2BAA2B;AAEjC;;;;;;CAMC,GACD,eAAeC,sBACbC,eAAuB;IAEvB,IAAI,CAACA,iBAAiB,OAAO;IAC7B,MAAMC,UAAU,MAAMnB,cACnBoB,GAAG,GACHC,SAAS,GACTC,eAAe,CAAC,YAChBC,KAAK,CAAC,mBAAmB,MAAML,iBAC/BM,KAAK,CAAC,GACNC,GAAG,GACHC,KAAK,CAAC,CAACC;QACN,IAAIA,CAAAA,yBAAAA,MAAOC,IAAI,MAAKZ,0BAA0B,MAAMW;QACpDE,QAAQF,KAAK,CACX,gEACE,uCACFA;QAEF,OAAO;IACT;IACF,yEAAyE;IACzE,kDAAkD;IAClD,OAAOR,WAAWA,QAAQW,IAAI,CAACC,MAAM,KAAK,IAAIZ,QAAQW,IAAI,CAAC,EAAE,GAAG;AAClE;AAEA,OAAO,MAAME,gCAAuD,OAAO,EACzEC,IAAI,EACJC,MAAM,EACP;QAkDKA;IAjDF,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,oEAAoE;IACpE,MAAMC,OAAO5B,qBAAqB0B,MAAMC;IACxC,IAAIC,MAAM;kBAS4BC;YANdA;QAFtB,MAAMA,UAAU,MAAMnB,sBAAsBkB,KAAKjB,eAAe;QAChE,IAAI,CAACkB,SAAS;QACd,MAAMC,SAASC,gBAAOF,6BAAAA,QAAQG,GAAG,CAACC,MAAM,CAACA,MAAM,qBAAzBJ,2BAA2BK,EAAE,mBAAI;QACvD,MAAMjC,0BACJ;YACE+B,KAAKH,QAAQG,GAAG;YAChBG,QAAQP,KAAKO,MAAM;YACnBL;YACAM,cAAc,CAAC,QAAQ,EAAEL,QAAOF,eAAAA,QAAQX,GAAG,CAAC,0BAAZW,eAA8BA,QAAQK,EAAE,GAAG;YAC3EG,MAAM,CAAC,CAAC,EAAEP,OAAO,SAAS,CAAC;YAC3BQ,kBAAkB;QACpB,GACA;YAAExB,WAAWrB,cAAcoB,GAAG,GAAGC,SAAS;YAAIyB,QAAQ1C;QAAmB;QAE3E,OAAO;YAAE2C,SAAS;YAAMV;QAAO;IACjC;IACA,0EAA0E;IAC1E,wEAAwE;IACxE,8DAA8D;IAC9D,mEAAmE;IACnE,IAAIJ,SAAS,yBAAyB;;YAIvBC,wBAYuBE;QAfpC,MAAMlB,kBACJ,QAAOgB,0BAAAA,OAAQc,cAAc,MAAK,WAC9Bd,OAAOc,cAAc,GACrBV,gBAAOJ,2BAAAA,yBAAAA,OAAQc,cAAc,qBAAtBd,uBAAwBO,EAAE,oBAAI;QAC3C,MAAML,UAAU,MAAMnB,sBAAsBC;QAC5C,IAAI,CAACkB,SAAS;QACd,MAAMa,UAAUX,gBAAOJ,0BAAAA,OAAQgB,MAAM,oBAAI;QACzC,MAAMzC,iCACJ2B,QAAQG,GAAG,EACXD,gBAAOJ,0BAAAA,OAAQO,EAAE,oBAAI,KACrBQ,SACA;YAAE5B,WAAWrB,cAAcoB,GAAG,GAAGC,SAAS;QAAG;QAE/C,OAAO4B,YAAY,SACfE,YACA;YAAEJ,SAAS;YAAMV,QAAQC,iBAAOF,8BAAAA,QAAQG,GAAG,CAACC,MAAM,CAACA,MAAM,qBAAzBJ,4BAA2BK,EAAE,oBAAI;QAAI;IAC3E;IACA,qEAAqE;IACrE,IACER,SAAS,gCACTC,CAAAA,2BAAAA,mBAAAA,OAAQkB,QAAQ,qBAAhBlB,iBAAkBD,IAAI,MAAK,qBAC3BC,CAAAA,0BAAAA,OAAQmB,cAAc,MAAK,QAC3B;YAC8BnB;QAA9B,MAAM,EAAEG,MAAM,EAAEiB,SAAS,EAAE,IAAGpB,oBAAAA,OAAOkB,QAAQ,YAAflB,oBAAmB,CAAC;QAClD,IAAIG,UAAUiB,WAAW;;gBAyBHpB,mBAyBPA,yBAGOA;YApDpB,MAAMb,YAAYrB,cAAcoB,GAAG,GAAGC,SAAS;YAC/C,MAAMkC,aAAalC,UAChBmC,UAAU,CAAC,SACXC,GAAG,CAACnB,OAAOD,SACXmB,UAAU,CAAC,YACXC,GAAG,CAACnB,OAAOgB;YACd,oEAAoE;YACpE,oEAAoE;YACpE,yDAAyD;YACzD,MAAMI,kBAAkBC,KAAKC,GAAG,CAC9B,GACAD,KAAKE,KAAK,CAACC,gBAAO5B,0BAAAA,OAAQ6B,YAAY,oBAAI;YAE5C,wDAAwD;YACxD,EAAE;YACF,qEAAqE;YACrE,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,mEAAmE;YACnE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAMC,WAAWL,KAAKC,GAAG,CACvB,GACAD,KAAKE,KAAK,CAACC,gBAAO5B,2BAAAA,oBAAAA,OAAQkB,QAAQ,qBAAhBlB,kBAAkB8B,QAAQ,oBAAI;YAElD,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,iDAAiD;YACjD,MAAMC,eAAeN,KAAKC,GAAG,CAAC,GAAGF,kBAAkBM;YACnD,8DAA8D;YAC9D,8DAA8D;YAC9D,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,gCAAgC;YAChC,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM9C,kBACJ,QAAOgB,0BAAAA,OAAQc,cAAc,MAAK,WAC9Bd,OAAOc,cAAc,GACrBV,gBAAOJ,2BAAAA,0BAAAA,OAAQc,cAAc,qBAAtBd,wBAAwBO,EAAE,oBAAI;YAC3C,MAAMyB,kBAAkBP,KAAKC,GAAG,CAC9B,GACAD,KAAKE,KAAK,CAACC,gBAAO5B,2BAAAA,oBAAAA,OAAQkB,QAAQ,qBAAhBlB,kBAAkBiC,QAAQ,oBAAI;YAElD,+DAA+D;YAC/D,mEAAmE;YACnE,8DAA8D;YAC9D,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,+CAA+C;YAC/C,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,kEAAkE;YAClE,EAAE;YACF,oEAAoE;YACpE,4DAA4D;YAC5D,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,uDAAuD;YACvD,IAAI/B,UAA+B,CAAC;YACpC,MAAMgC,eAAe,MAAM/C,UAAUgD,cAAc,CACjD,OAAOC;oBAaIC,eAKEA;gBAjBX,MAAMA,WAAW,MAAMD,YAAY7C,GAAG,CAAC8B;gBACvC,IAAI,CAACgB,SAASC,MAAM,EAAE,OAAO;gBAC7B,IAAID,SAAS9C,GAAG,CAAC,cAAc,aAAa,OAAO;gBACnD,+DAA+D;gBAC/D,4DAA4D;gBAC5D,mEAAmE;gBACnE,iEAAiE;gBACjE,8DAA8D;gBAC9D,mEAAmE;gBACnE,mEAAmE;gBACnE,qDAAqD;gBACrD,IACEqC,QAAOS,gBAAAA,SAAS9C,GAAG,CAAC,4BAAb8C,gBAAiC,KAAK,KAC7CA,SAAS9C,GAAG,CAAC,oBACb;oBACA,OAAO;gBACT;gBACAW,WAAWmC,iBAAAA,SAASE,IAAI,cAAbF,iBAA2B,CAAC;gBACvCD,YAAYI,GAAG,CACbnB,YACA;oBACEL,QAAQ;oBACRQ;oBACA,2DAA2D;oBAC3D,sDAAsD;oBACtD,oDAAoD;oBACpD,EAAE;oBACF,4DAA4D;oBAC5D,6DAA6D;oBAC7D,iEAAiE;oBACjE,uDAAuD;oBACvD,2CAA2C;oBAC3C,EAAE;oBACF,4DAA4D;oBAC5D,6DAA6D;oBAC7D,2DAA2D;oBAC3D,6DAA6D;oBAC7D,0CAA0C;oBAC1CiB,SAAS7D,mBAAmB8D,SAAS,CAAC1C,QAAQ8B;mBAI1CA,WAAW,IAAI;oBAAEA;gBAAS,IAAI,CAAC,GAI/B9C,kBAAkB;oBAAEA;gBAAgB,IAAI,CAAC;oBAC7CiD,UAAUD;mBAYNhC,CAAAA,0BAAAA,OAAQO,EAAE,IAAG;oBAAEoC,mBAAmBvC,OAAOJ,OAAOO,EAAE;gBAAE,IAAI,CAAC;oBAC7D,+DAA+D;oBAC/D,wDAAwD;oBACxD,6DAA6D;oBAC7D,4DAA4D;oBAC5D,8DAA8D;oBAC9D,8DAA8D;oBAC9D,8CAA8C;oBAC9CqC,aAAa9E,cAAcqB,SAAS,CAAC0D,UAAU,CAACC,MAAM;oBACtDC,aACEjF,cAAcqB,SAAS,CAAC0D,UAAU,CAACG,eAAe;oBAEtD;oBAAEC,OAAO;gBAAK;gBAEhB,OAAO;YACT;YAEF,IAAI,CAACf,cAAc;YACnB,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,+DAA+D;YAC/D,gEAAgE;YAChE,mEAAmE;YACnE,iEAAiE;YACjE,qBAAqB;YACrBtE,MAAM,IACJiB,iBAAiBM,WAAW;oBAC1BgB,QAAQC,OAAOD;oBACfiB,WAAWhB,OAAOgB;oBAClBlB;gBACF,GAAGV,KAAK,CAAC,IAAMyB;YAEjB,sEAAsE;YACtE,EAAE;YACF,iEAAiE;YACjE,EAAE;YACF,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,EAAE;YACF,qEAAqE;YACrE,8DAA8D;YAC9D,qEAAqE;YACrE,2CAA2C;YAC3C,EAAE;YACF,mDAAmD;YACnD,EAAE;YACF,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,EAAE;YACF,mEAAmE;YACnE,uEAAuE;YACvE,8DAA8D;YAC9D,EAAE;YACF,oCAAoC;YACpC,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,gCAAgC;YAChC,IAAIvC,kCAAkCsB,SAAS;gBAC7C,MAAMkD,WAAWzE,wBAAwBuB;gBACzCpC,MAAM;qCAYkBsC,oBACEA;wBAWZF,kBAgBDA;2BAvCX5B,gBAAgB;wBACd+E,eAAe/C,eAAOJ,0BAAAA,OAAQO,EAAE,mBAAI;wBACpC6C,OAAOF,WAAW;wBAClBG,UAAUjD,gBAAOJ,0BAAAA,OAAQqD,QAAQ,oBAAI;wBACrCC,OAAO;4BACL;gCACE,qDAAqD;gCACrD,sDAAsD;gCACtD,yDAAyD;gCACzD,0DAA0D;gCAC1D,mDAAmD;gCACnDC,SAASnD,QAAOF,qBAAAA,OAAO,CAAC,YAAY,YAApBA,qBAAwBkB;gCACxCoC,WAAWpD,QAAOF,sBAAAA,OAAO,CAAC,YAAY,YAApBA,sBAAwBkB;gCAC1CqC,eAAe;gCACf,wDAAwD;gCACxD,wDAAwD;gCACxDC,OAAOR,WAAW;gCAClBS,UAAU;4BACZ;yBACD;wBACD,2DAA2D;wBAC3D,8DAA8D;wBAC9D,+DAA+D;wBAC/DC,QAAQ,EAAE5D,2BAAAA,mBAAAA,OAAQkB,QAAQ,qBAAhBlB,iBAAkB6D,YAAY;wBACxC,6DAA6D;wBAC7D,8DAA8D;wBAC9D,iEAAiE;wBACjE,0DAA0D;wBAC1D,8CAA8C;wBAC9C,EAAE;wBACF,+DAA+D;wBAC/D,2DAA2D;wBAC3D,8DAA8D;wBAC9D,gEAAgE;wBAChE,6DAA6D;wBAC7D,gEAAgE;wBAChE,8CAA8C;wBAC9CC,kBACE1D,gBAAOJ,0BAAAA,OAAQ+D,QAAQ,oBAAI,OAC3B3D,gBAAOJ,2BAAAA,2BAAAA,OAAQgE,gBAAgB,qBAAxBhE,yBAA0BiE,KAAK,oBAAI,OAC1C7D,OAAOgB;oBACX,GAAG5B,KAAK,CAAC,IAAMyB;;YAEnB;YACA,qEAAqE;YACrE,kEAAkE;YAClE,wEAAwE;YACxE,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,iCAAiC;YACjC,EAAE;YACF,wEAAwE;YACxE,qEAAqE;YACrE,yDAAyD;YACzD,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,WAAW;YACX,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,IAAIf,OAAO,CAAC,QAAQ,EAAE;oBAmBdA;gBAlBN,KAAK1B,mBAAmB;oBACtB2B,QAAQC,OAAOD;oBACf8D,OAAO/D,OAAO,CAAC,QAAQ;mBACnBA,OAAO,CAAC,OAAO,GAAG;oBAAEgE,MAAM9D,OAAOF,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC;oBAC3DiE,QAAQ;oBACR,4DAA4D;oBAC5D,6DAA6D;oBAC7DC,uBAAuB;mBAOnBrC,eAAe,IAAI;oBAAEsC,eAAetC;gBAAa,IAAI,CAAC;oBAC1DuC,aAAa;wBACXC,OAAOnE,OAAOgB;wBACdoD,SAAS,CAAC,UAAU,EAAEpE,QACpBF,uBAAAA,OAAO,CAAC,cAAc,YAAtBA,uBAA0B,aAC1BuE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,AAAC1C,CAAAA,eAAe,GAAE,EAAG2C,OAAO,CAAC,GAAG,CAAC,CAAC;oBACzD;;YAEJ;YACA,gEAAgE;YAChE,yDAAyD;YACzD,IAAIxE,OAAO,CAAC,QAAQ,EAAE;oBAQZA,eACFA,uBASWA,gBACUA,uBAENA,0BAaKA;oBANvB;gBA3BH,MAAMyE,OAAO,IAAIC,KACfhD,OAAO1B,OAAO,CAAC,aAAa,GAC5B2E,cAAc,CAAC,SAAS;oBACxBC,WAAW;oBACXC,WAAW;gBACb;gBACA,MAAMC,eACJ,CAAC,GAAG,GAAE9E,gBAAAA,OAAO,CAAC,OAAO,YAAfA,gBAAmB,GAAG,wBAAwB,CAAC,GACrD,CAAC,CAAC,GAAEA,wBAAAA,OAAO,CAAC,cAAc,YAAtBA,wBAA0B,eAAe,KAAK,CAAC,GACnD,CAAC,cAAc,EAAEyE,KAAK,gBAAgB,EAAEvD,WAAW;gBACrD,oEAAoE;gBACpE,qBAAqB;gBACrB,MAAM6D,WAAW,MAAM9G,0BACrBL,cAAcoB,GAAG,GAAGC,SAAS,IAC7BiB,OAAOD,SACP,qBACA;oBACE+D,MAAM9D,QAAOF,iBAAAA,OAAO,CAAC,OAAO,YAAfA,iBAAmB;oBAChC,gBAAgBE,QAAOF,wBAAAA,OAAO,CAAC,cAAc,YAAtBA,wBAA0B;oBACjDyE;oBACAO,UAAU9E,QAAOF,oBAAAA,OAAO,CAAC,WAAW,YAAnBA,oBAAuB;oBACxC,eAAeE,OAAOgB;gBACxB;gBAEF,kEAAkE;gBAClE,qEAAqE;gBACrE,MAAM+D,WAAWtH,wBACd,QAAA,MAAME,cAAcqC,OAAOD,SAASX,KAAK,CAAC,IAAM,0BAAjD,AAAC,MAAwD4F,GAAG;gBAE9D,MAAMzG,UAAU;oBACd0G,IAAIjF,OAAOF,OAAO,CAAC,QAAQ;oBAC3BoF,OAAO,WACLL,4BAAAA,SAAUK,OAAO,oBACjB,CAAC,mBAAmB,GAAEpF,wBAAAA,OAAO,CAAC,cAAc,YAAtBA,wBAA0B,IAAI;oBACtDqF,MAAMN,CAAAA,4BAAAA,SAAUM,IAAI,KAAIP;mBACpBC,CAAAA,4BAAAA,SAAUO,IAAI,IAAG;oBAAEA,MAAMP,SAASO,IAAI;gBAAC,IAAI,CAAC;oBAChDC,UAAUN,SAASM,QAAQ;oBAC3BC,iBAAiB,MAAM1H,oBAAoBoC,OAAOD;oBAClDwF,UAAU;oBACVC,SAAS;oBACT,2DAA2D;oBAC3D,gDAAgD;oBAChDC,SAAS;;gBAEX,yDAAyD;gBACzD,6CAA6C;gBAC7C,MAAM5H,eAAemC,OAAOD;YAC9B;QACF;IACF;AACJ,EAAC"}

package/src/lib/server/refund.js

@@ -20,6 +20,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
 // reversal that never happened green.
 import { reverseEmailAttributedRevenue } from "@aglyn/tenant-data-admin/server/email-revenue-attribution";
 import { createHash } from "crypto";
+import { apiIdempotencyExpiry } from "@aglyn/aglyn/app-utils/api-idempotency";
 /**
  * Refund a paid booking (AGL-2315), full or partial, site-admin only.
  *
@@ -157,9 +158,19 @@ import { createHash } from "crypto";
                 return res.status(Number((_prior_get = prior.get('responseStatus')) != null ? _prior_get : 200)).json(priorResponse);
             }
             try {
+                var _hostSnapshot_get1;
+                // The claim's shape is every claim's (`claimApiIdempotency`): its
+                // kind, scope and org name it on the staff claims list, `createdAtMs`
+                // ages it there, and `expiresAt` lets the TTL policy reap it — a
+                // claim stranded by a killed process otherwise holds its key forever.
                 await claimRef.create({
+                    kind: 'booking-refund',
+                    scopeId: hostId,
+                    orgId: String((_hostSnapshot_get1 = hostSnapshot.get('orgId')) != null ? _hostSnapshot_get1 : '') || null,
+                    bookingId,
                     status: 'pending',
-                    startedAtMs: Date.now()
+                    createdAtMs: Date.now(),
+                    expiresAt: apiIdempotencyExpiry()
                 });
             } catch (unused) {
                 // Another attempt with this key is in flight.

package/src/lib/server/refund.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/bookings/src/lib/server/refund.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\n// Leaf import, not the barrel: the specs in this library mock\n// `@aglyn/tenant-data-admin` wholesale, and a permissive stub would turn a\n// reversal that never happened green.\nimport { reverseEmailAttributedRevenue } from '@aglyn/tenant-data-admin/server/email-revenue-attribution'\nimport { createHash } from 'crypto'\n\n/**\n * Refund a paid booking (AGL-2315), full or partial, site-admin only.\n *\n * This route exists BECAUSE of the destination charge, not alongside it. While\n * a paid booking settled in Aglyn's own balance there was nothing here to get\n * wrong: cancelling a booking refunded the guest nothing at all, and any\n * refund issued by hand simply gave back money Aglyn was already holding. Once\n * the charge goes to the merchant's connected account that stops being true in\n * two directions at once, and both are money:\n *\n *  - **The guest.** Cancelling a paid booking wrote `status: 'canceled'` from\n *    the console and moved no money. The slot reopened, the appointment was\n *    gone, and the guest had paid for it. That was survivable only because the\n *    platform still held the funds and could be made to give them back; with\n *    the money at the merchant it is a silent, unrecoverable overcharge.\n *  - **Aglyn.** A refund on a destination charge that does NOT set\n *    `reverse_transfer` is paid entirely out of the PLATFORM's balance while\n *    the merchant keeps the transfer in full. The merchant cancels, the guest\n *    is made whole, and Aglyn funds the whole concession out of a cut that was\n *    at most 5% of it. This repo has shipped that exact bug once already, on a\n *    marketplace partial refund.\n *\n * So both switches are sent, and they are two different decisions:\n *\n *  - `reverse_transfer` pulls the refunded share back OUT of the merchant's\n *    account. Stripe prorates it against a partial refund, so a $30 refund on\n *    a $75 booking claws back $30 of the merchant's $71.25, not all of it.\n *  - `refund_application_fee` returns Aglyn's commission on the refunded\n *    share. A refunded appointment earned the platform nothing, and this\n *    matches `commerce/refund.ts`, which has sent both since AGL-287. The\n *    DISPUTE path deliberately sends only the reversal — that asymmetry is\n *    AGL-1809's and is not copied here.\n *\n * Two SEPARATE controls guard the money, the AGL-1696 lesson from the order\n * refund, and conflating them is how that one originally went wrong:\n *\n *  - The idempotency key stops a DUPLICATE refund — one attempt sent twice\n *    because the response was lost or the admin double-clicked. It is minted\n *    per attempt by the console and deliberately not derived from the booking\n *    or the amount: two $10 refunds on a $75 booking are two real refunds.\n *  - The cap stops an OVER-refund — several partials summing past what was\n *    captured, including two admins refunding at once, where the attempts are\n *    genuinely distinct and no key can help. That needs the counter read and\n *    written inside one transaction, BEFORE Stripe is called, so a lost\n *    response leaves the amount counted and the retry refunds less, never\n *    more.\n */\nexport const bookingRefundHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return res.status(501).json({ error: 'Payments are not configured.' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const bookingId = String(body.bookingId ?? '')\n  // `null`/absent means \"everything still refundable\"; a number is a partial.\n  const amountCents = body.amountCents == null ? null : Number(body.amountCents)\n  // Node lowercases incoming headers, but read both spellings — the plugin API\n  // request type makes no promise about casing.\n  const idempotencyKey = String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n  if (!hostId || !bookingId) {\n    return res.status(400).json({ error: 'Missing hostId or bookingId' })\n  }\n  if (amountCents != null && !(Number.isFinite(amountCents) && amountCents > 0)) {\n    return res.status(400).json({ error: 'Invalid refund amount' })\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Site ADMIN, not merely a member: this moves money. The same gate\n    // `commerce/refund.ts` applies.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin') {\n      return res.status(403).json({ error: 'Refunds require a site admin' })\n    }\n    const bookingRef = hostRef.collection('bookings').doc(bookingId)\n    const bookingSnapshot = await bookingRef.get()\n    if (!bookingSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown booking' })\n    }\n    const paymentIntentId = String(bookingSnapshot.get('paymentIntentId') ?? '')\n    const paidCents = Math.max(\n      0,\n      Math.round(Number(bookingSnapshot.get('paidAmountCents') ?? 0)),\n    )\n    if (!paidCents) {\n      return res.status(409).json({ error: 'This booking was never paid' })\n    }\n    if (!paymentIntentId) {\n      // A booking paid BEFORE the webhook began recording the PaymentIntent\n      // (AGL-2315). Refundable, but only by hand — and saying so beats a 500\n      // an admin cannot act on.\n      return res.status(409).json({\n        error:\n          'This booking was paid before refunds were supported here. ' +\n          'Refund it in the Stripe dashboard, and tick “Reverse transfer” ' +\n          'so the amount comes back from the merchant account.',\n      })\n    }\n\n    // Replay a settled attempt before anything else can reject it. This read\n    // is only a short-circuit, never the dedupe primitive — the atomic\n    // `create()` below is.\n    const claimRef = idempotencyKey\n      ? firestore.collection('apiIdempotency').doc(\n          createHash('sha256')\n            // Scoped by the BOOKING, so a client that reused one key across\n            // two bookings cannot dedupe two legitimately distinct refunds.\n            // NOT by the amount: that would swallow a real second partial.\n            .update(`booking-refund:${hostId}:${bookingId}:${idempotencyKey}`)\n            .digest('hex'),\n        )\n      : null\n    if (claimRef) {\n      const prior = await claimRef.get()\n      const priorResponse = prior.get('response')\n      if (priorResponse) {\n        return res\n          .status(Number(prior.get('responseStatus') ?? 200))\n          .json(priorResponse)\n      }\n      try {\n        await claimRef.create({ status: 'pending', startedAtMs: Date.now() })\n      } catch {\n        // Another attempt with this key is in flight.\n        return res\n          .status(409)\n          .json({ error: 'This refund is already being processed' })\n      }\n    }\n\n    // RESERVE. Read and write the counter in ONE transaction so two concurrent\n    // refunds cannot both see the same `refundedCents` and each send a full\n    // amount to Stripe — the failure the order refund shipped with.\n    let refundCents = 0\n    let alreadyRefunded = 0\n    await firestore.runTransaction(async (transaction) => {\n      const fresh = await transaction.get(bookingRef)\n      alreadyRefunded = Math.max(\n        0,\n        Math.round(Number(fresh.get('refundedCents') ?? 0)),\n      )\n      const remaining = paidCents - alreadyRefunded\n      refundCents =\n        amountCents == null\n          ? remaining\n          : Math.min(Math.round(amountCents), remaining)\n      if (!(refundCents > 0)) {\n        refundCents = 0\n        return\n      }\n      transaction.set(\n        bookingRef,\n        { refundedCents: alreadyRefunded + refundCents },\n        { merge: true },\n      )\n    })\n    if (!(refundCents > 0)) {\n      await claimRef?.delete().catch(() => undefined)\n      return res.status(400).json({ error: 'Nothing left to refund' })\n    }\n\n    const params = new URLSearchParams({\n      payment_intent: paymentIntentId,\n      amount: String(refundCents),\n      // THE SELLER SHARE COMES BACK. Without this the merchant keeps their\n      // transfer in full and Aglyn funds the entire refund.\n      reverse_transfer: 'true',\n      // ...and so does Aglyn's commission on the refunded share. A refunded\n      // appointment earned the platform nothing.\n      refund_application_fee: 'true',\n    })\n    const response = await fetch('https://api.stripe.com/v1/refunds', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n        'Content-Type': 'application/x-www-form-urlencoded',\n        ...(claimRef ? { 'Idempotency-Key': claimRef.id } : {}),\n      },\n      body: params.toString(),\n    })\n    const refund = await response.json().catch(() => ({}) as any)\n    if (!response.ok) {\n      console.error('Stripe booking refund error', (refund as any)?.error)\n      // Stripe said no, so we KNOW no money moved: give the reservation back\n      // and let the same attempt be retried.\n      await firestore\n        .runTransaction(async (transaction) => {\n          const current = Number(\n            (await transaction.get(bookingRef)).get('refundedCents') ?? 0,\n          )\n          transaction.set(\n            bookingRef,\n            { refundedCents: Math.max(0, current - refundCents) },\n            { merge: true },\n          )\n        })\n        .catch(() => undefined)\n      await claimRef?.delete().catch(() => undefined)\n      return res.status(502).json({ error: 'Refund failed' })\n    }\n\n    // A FULL refund ends the appointment; a partial leaves it standing. The\n    // guest who got half their money back still has the slot, and moving the\n    // booking off `confirmed` would reopen a time the merchant is still\n    // committed to.\n    const totalRefunded = alreadyRefunded + refundCents\n    const fullyRefunded = totalRefunded >= paidCents\n    await bookingRef\n      .set(\n        {\n          refundedCents: totalRefunded,\n          ...(fullyRefunded ? { status: 'canceled' } : {}),\n        },\n        { merge: true },\n      )\n      .catch(() => undefined)\n\n    const payload = {\n      refundedCents: refundCents,\n      totalRefundedCents: totalRefunded,\n      fullyRefunded,\n    }\n    await claimRef\n      ?.set(\n        {\n          status: 'done',\n          responseStatus: 200,\n          response: payload,\n          settledAtMs: Date.now(),\n        },\n        { merge: true },\n      )\n      .catch(() => undefined)\n    /*\n     * The campaign's side of the ledger.\n     *\n     * A paid booking is credited to the campaign that led to it — the sale\n     * announces itself through `upsertHostContact` with a `purchaseCents` and\n     * this booking's id, exactly as a store order does — so a refunded one\n     * has to stop counting. Without this, a booking site's campaign revenue\n     * could only ever rise.\n     *\n     * Keyed by the BOOKING id, which is what the credit was filed under, so\n     * this needs no email and works for a guest who never became a contact.\n     * Recorded beside the credit rather than subtracted from it, and swallowed\n     * whole: the money has already left the merchant's account and the booking\n     * already records it, so nothing here may fail a refund.\n     */\n    await reverseEmailAttributedRevenue({\n      hostId,\n      orderId: bookingId,\n      amountCents: refundCents,\n      closedTheOrder: fullyRefunded,\n    })\n    return res.status(200).json(payload)\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Refund failed' })\n  }\n}\n"],"names":["firebaseAdmin","reverseEmailAttributedRevenue","createHash","bookingRefundHandler","req","res","body","method","status","json","error","process","env","STRIPE_SECRET_KEY","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","bookingId","amountCents","Number","idempotencyKey","trim","isFinite","hostSnapshot","bookingSnapshot","decoded","app","auth","verifyIdToken","firestore","hostRef","collection","doc","get","exists","memberRole","uid","bookingRef","paymentIntentId","paidCents","Math","max","round","claimRef","update","digest","prior","priorResponse","create","startedAtMs","Date","now","refundCents","alreadyRefunded","runTransaction","transaction","fresh","remaining","min","set","refundedCents","merge","delete","catch","params","URLSearchParams","payment_intent","amount","reverse_transfer","refund_application_fee","response","fetch","Authorization","id","toString","refund","ok","console","current","totalRefunded","fullyRefunded","payload","totalRefundedCents","responseStatus","settledAtMs","orderId","closedTheOrder"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AAExD,8DAA8D;AAC9D,2EAA2E;AAC3E,sCAAsC;AACtC,SAASC,6BAA6B,QAAQ,4DAA2D;AACzG,SAASC,UAAU,QAAQ,SAAQ;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CC,GACD,OAAO,MAAMC,uBAAyC,OAAOC,KAAKC;QAOnCD,4BAM4BA,WACnCE,cACGA,iBAMvBF,MAAAA;IApBF,IAAIA,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI,CAACC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOR,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA+B;IACtE;IACA,MAAMI,gBAAgBC,QAAOX,6BAAAA,IAAIY,OAAO,CAACF,aAAa,YAAzBV,6BAA6B;IAC1D,MAAMa,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOZ,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMJ,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWgB,KAAKC,KAAK,CAACnB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMoB,SAAST,QAAOT,eAAAA,KAAKkB,MAAM,YAAXlB,eAAe;IACrC,MAAMmB,YAAYV,QAAOT,kBAAAA,KAAKmB,SAAS,YAAdnB,kBAAkB;IAC3C,4EAA4E;IAC5E,MAAMoB,cAAcpB,KAAKoB,WAAW,IAAI,OAAO,OAAOC,OAAOrB,KAAKoB,WAAW;IAC7E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAME,iBAAiBb,QACrBX,QAAAA,8BAAAA,IAAIY,OAAO,CAAC,kBAAkB,YAA9BZ,8BAAkCA,IAAIY,OAAO,CAAC,kBAAkB,YAAhEZ,OAAoE,IAEnEyB,IAAI,GACJV,KAAK,CAAC,GAAG;IACZ,IAAI,CAACK,UAAU,CAACC,WAAW;QACzB,OAAOpB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACA,IAAIgB,eAAe,QAAQ,CAAEC,CAAAA,OAAOG,QAAQ,CAACJ,gBAAgBA,cAAc,CAAA,GAAI;QAC7E,OAAOrB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAwB;IAC/D;IAEA,IAAI;YAUkBqB,mBASWC,sBAGXA;QArBpB,MAAMC,UAAU,MAAMjC,cAAckC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACnB;QAC/D,MAAMoB,YAAYrC,cAAckC,GAAG,GAAGG,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMO,eAAe,MAAMO,QAAQG,GAAG;QACtC,IAAI,CAACV,aAAaW,MAAM,EAAE;YACxB,OAAOrC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,mEAAmE;QACnE,gCAAgC;QAChC,MAAMiC,aAAa,EAACZ,oBAAAA,aAAaU,GAAG,CAAC,0BAAjBV,oBAAmC,CAAC,EAAE,CAACE,QAAQW,GAAG,CAAC;QACvE,IAAID,eAAe,SAAS;YAC1B,OAAOtC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA+B;QACtE;QACA,MAAMmC,aAAaP,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAACf;QACtD,MAAMO,kBAAkB,MAAMa,WAAWJ,GAAG;QAC5C,IAAI,CAACT,gBAAgBU,MAAM,EAAE;YAC3B,OAAOrC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAMoC,kBAAkB/B,QAAOiB,uBAAAA,gBAAgBS,GAAG,CAAC,8BAApBT,uBAA0C;QACzE,MAAMe,YAAYC,KAAKC,GAAG,CACxB,GACAD,KAAKE,KAAK,CAACvB,QAAOK,wBAAAA,gBAAgBS,GAAG,CAAC,8BAApBT,wBAA0C;QAE9D,IAAI,CAACe,WAAW;YACd,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA8B;QACrE;QACA,IAAI,CAACoC,iBAAiB;YACpB,sEAAsE;YACtE,uEAAuE;YACvE,0BAA0B;YAC1B,OAAOzC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,+DACA,oEACA;YACJ;QACF;QAEA,yEAAyE;QACzE,mEAAmE;QACnE,uBAAuB;QACvB,MAAMyC,WAAWvB,iBACbS,UAAUE,UAAU,CAAC,kBAAkBC,GAAG,CACxCtC,WAAW,SACT,gEAAgE;QAChE,gEAAgE;QAChE,+DAA+D;SAC9DkD,MAAM,CAAC,CAAC,eAAe,EAAE5B,OAAO,CAAC,EAAEC,UAAU,CAAC,EAAEG,gBAAgB,EAChEyB,MAAM,CAAC,UAEZ;QACJ,IAAIF,UAAU;YACZ,MAAMG,QAAQ,MAAMH,SAASV,GAAG;YAChC,MAAMc,gBAAgBD,MAAMb,GAAG,CAAC;YAChC,IAAIc,eAAe;oBAEAD;gBADjB,OAAOjD,IACJG,MAAM,CAACmB,QAAO2B,aAAAA,MAAMb,GAAG,CAAC,6BAAVa,aAA+B,MAC7C7C,IAAI,CAAC8C;YACV;YACA,IAAI;gBACF,MAAMJ,SAASK,MAAM,CAAC;oBAAEhD,QAAQ;oBAAWiD,aAAaC,KAAKC,GAAG;gBAAG;YACrE,EAAE,eAAM;gBACN,8CAA8C;gBAC9C,OAAOtD,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;oBAAEC,OAAO;gBAAyC;YAC5D;QACF;QAEA,2EAA2E;QAC3E,wEAAwE;QACxE,gEAAgE;QAChE,IAAIkD,cAAc;QAClB,IAAIC,kBAAkB;QACtB,MAAMxB,UAAUyB,cAAc,CAAC,OAAOC;gBAIhBC;YAHpB,MAAMA,QAAQ,MAAMD,YAAYtB,GAAG,CAACI;YACpCgB,kBAAkBb,KAAKC,GAAG,CACxB,GACAD,KAAKE,KAAK,CAACvB,QAAOqC,aAAAA,MAAMvB,GAAG,CAAC,4BAAVuB,aAA8B;YAElD,MAAMC,YAAYlB,YAAYc;YAC9BD,cACElC,eAAe,OACXuC,YACAjB,KAAKkB,GAAG,CAAClB,KAAKE,KAAK,CAACxB,cAAcuC;YACxC,IAAI,CAAEL,CAAAA,cAAc,CAAA,GAAI;gBACtBA,cAAc;gBACd;YACF;YACAG,YAAYI,GAAG,CACbtB,YACA;gBAAEuB,eAAeP,kBAAkBD;YAAY,GAC/C;gBAAES,OAAO;YAAK;QAElB;QACA,IAAI,CAAET,CAAAA,cAAc,CAAA,GAAI;YACtB,OAAMT,4BAAAA,SAAUmB,MAAM,GAAGC,KAAK,CAAC,IAAMlD;YACrC,OAAOhB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QAEA,MAAM8D,SAAS,IAAIC,gBAAgB;YACjCC,gBAAgB5B;YAChB6B,QAAQ5D,OAAO6C;YACf,qEAAqE;YACrE,sDAAsD;YACtDgB,kBAAkB;YAClB,sEAAsE;YACtE,2CAA2C;YAC3CC,wBAAwB;QAC1B;QACA,MAAMC,WAAW,MAAMC,MAAM,qCAAqC;YAChExE,QAAQ;YACRS,SAAS;gBACPgE,eAAe,CAAC,OAAO,EAAErE,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBACxD,gBAAgB;eACZsC,WAAW;gBAAE,mBAAmBA,SAAS8B,EAAE;YAAC,IAAI,CAAC;YAEvD3E,MAAMkE,OAAOU,QAAQ;QACvB;QACA,MAAMC,SAAS,MAAML,SAASrE,IAAI,GAAG8D,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QACnD,IAAI,CAACO,SAASM,EAAE,EAAE;YAChBC,QAAQ3E,KAAK,CAAC,+BAAgCyE,0BAAD,AAACA,OAAgBzE,KAAK;YACnE,uEAAuE;YACvE,uCAAuC;YACvC,MAAM2B,UACHyB,cAAc,CAAC,OAAOC;oBAEnB;gBADF,MAAMuB,UAAU3D,QACd,OAAA,AAAC,CAAA,MAAMoC,YAAYtB,GAAG,CAACI,WAAU,EAAGJ,GAAG,CAAC,4BAAxC,OAA4D;gBAE9DsB,YAAYI,GAAG,CACbtB,YACA;oBAAEuB,eAAepB,KAAKC,GAAG,CAAC,GAAGqC,UAAU1B;gBAAa,GACpD;oBAAES,OAAO;gBAAK;YAElB,GACCE,KAAK,CAAC,IAAMlD;YACf,OAAM8B,4BAAAA,SAAUmB,MAAM,GAAGC,KAAK,CAAC,IAAMlD;YACrC,OAAOhB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QAEA,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,gBAAgB;QAChB,MAAM6E,gBAAgB1B,kBAAkBD;QACxC,MAAM4B,gBAAgBD,iBAAiBxC;QACvC,MAAMF,WACHsB,GAAG,CACF;YACEC,eAAemB;WACXC,gBAAgB;YAAEhF,QAAQ;QAAW,IAAI,CAAC,IAEhD;YAAE6D,OAAO;QAAK,GAEfE,KAAK,CAAC,IAAMlD;QAEf,MAAMoE,UAAU;YACdrB,eAAeR;YACf8B,oBAAoBH;YACpBC;QACF;QACA,OAAMrC,4BAAAA,SACFgB,GAAG,CACH;YACE3D,QAAQ;YACRmF,gBAAgB;YAChBb,UAAUW;YACVG,aAAalC,KAAKC,GAAG;QACvB,GACA;YAAEU,OAAO;QAAK,GAEfE,KAAK,CAAC,IAAMlD;QACf;;;;;;;;;;;;;;KAcC,GACD,MAAMpB,8BAA8B;YAClCuB;YACAqE,SAASpE;YACTC,aAAakC;YACbkC,gBAAgBN;QAClB;QACA,OAAOnF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAACgF;IAC9B,EAAE,OAAO/E,OAAO;QACd2E,QAAQ3E,KAAK,CAACA;QACd,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/bookings/src/lib/server/refund.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\n// Leaf import, not the barrel: the specs in this library mock\n// `@aglyn/tenant-data-admin` wholesale, and a permissive stub would turn a\n// reversal that never happened green.\nimport { reverseEmailAttributedRevenue } from '@aglyn/tenant-data-admin/server/email-revenue-attribution'\nimport { createHash } from 'crypto'\nimport { apiIdempotencyExpiry } from '@aglyn/aglyn/app-utils/api-idempotency'\n\n/**\n * Refund a paid booking (AGL-2315), full or partial, site-admin only.\n *\n * This route exists BECAUSE of the destination charge, not alongside it. While\n * a paid booking settled in Aglyn's own balance there was nothing here to get\n * wrong: cancelling a booking refunded the guest nothing at all, and any\n * refund issued by hand simply gave back money Aglyn was already holding. Once\n * the charge goes to the merchant's connected account that stops being true in\n * two directions at once, and both are money:\n *\n *  - **The guest.** Cancelling a paid booking wrote `status: 'canceled'` from\n *    the console and moved no money. The slot reopened, the appointment was\n *    gone, and the guest had paid for it. That was survivable only because the\n *    platform still held the funds and could be made to give them back; with\n *    the money at the merchant it is a silent, unrecoverable overcharge.\n *  - **Aglyn.** A refund on a destination charge that does NOT set\n *    `reverse_transfer` is paid entirely out of the PLATFORM's balance while\n *    the merchant keeps the transfer in full. The merchant cancels, the guest\n *    is made whole, and Aglyn funds the whole concession out of a cut that was\n *    at most 5% of it. This repo has shipped that exact bug once already, on a\n *    marketplace partial refund.\n *\n * So both switches are sent, and they are two different decisions:\n *\n *  - `reverse_transfer` pulls the refunded share back OUT of the merchant's\n *    account. Stripe prorates it against a partial refund, so a $30 refund on\n *    a $75 booking claws back $30 of the merchant's $71.25, not all of it.\n *  - `refund_application_fee` returns Aglyn's commission on the refunded\n *    share. A refunded appointment earned the platform nothing, and this\n *    matches `commerce/refund.ts`, which has sent both since AGL-287. The\n *    DISPUTE path deliberately sends only the reversal — that asymmetry is\n *    AGL-1809's and is not copied here.\n *\n * Two SEPARATE controls guard the money, the AGL-1696 lesson from the order\n * refund, and conflating them is how that one originally went wrong:\n *\n *  - The idempotency key stops a DUPLICATE refund — one attempt sent twice\n *    because the response was lost or the admin double-clicked. It is minted\n *    per attempt by the console and deliberately not derived from the booking\n *    or the amount: two $10 refunds on a $75 booking are two real refunds.\n *  - The cap stops an OVER-refund — several partials summing past what was\n *    captured, including two admins refunding at once, where the attempts are\n *    genuinely distinct and no key can help. That needs the counter read and\n *    written inside one transaction, BEFORE Stripe is called, so a lost\n *    response leaves the amount counted and the retry refunds less, never\n *    more.\n */\nexport const bookingRefundHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return res.status(501).json({ error: 'Payments are not configured.' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const bookingId = String(body.bookingId ?? '')\n  // `null`/absent means \"everything still refundable\"; a number is a partial.\n  const amountCents = body.amountCents == null ? null : Number(body.amountCents)\n  // Node lowercases incoming headers, but read both spellings — the plugin API\n  // request type makes no promise about casing.\n  const idempotencyKey = String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n  if (!hostId || !bookingId) {\n    return res.status(400).json({ error: 'Missing hostId or bookingId' })\n  }\n  if (amountCents != null && !(Number.isFinite(amountCents) && amountCents > 0)) {\n    return res.status(400).json({ error: 'Invalid refund amount' })\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Site ADMIN, not merely a member: this moves money. The same gate\n    // `commerce/refund.ts` applies.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin') {\n      return res.status(403).json({ error: 'Refunds require a site admin' })\n    }\n    const bookingRef = hostRef.collection('bookings').doc(bookingId)\n    const bookingSnapshot = await bookingRef.get()\n    if (!bookingSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown booking' })\n    }\n    const paymentIntentId = String(bookingSnapshot.get('paymentIntentId') ?? '')\n    const paidCents = Math.max(\n      0,\n      Math.round(Number(bookingSnapshot.get('paidAmountCents') ?? 0)),\n    )\n    if (!paidCents) {\n      return res.status(409).json({ error: 'This booking was never paid' })\n    }\n    if (!paymentIntentId) {\n      // A booking paid BEFORE the webhook began recording the PaymentIntent\n      // (AGL-2315). Refundable, but only by hand — and saying so beats a 500\n      // an admin cannot act on.\n      return res.status(409).json({\n        error:\n          'This booking was paid before refunds were supported here. ' +\n          'Refund it in the Stripe dashboard, and tick “Reverse transfer” ' +\n          'so the amount comes back from the merchant account.',\n      })\n    }\n\n    // Replay a settled attempt before anything else can reject it. This read\n    // is only a short-circuit, never the dedupe primitive — the atomic\n    // `create()` below is.\n    const claimRef = idempotencyKey\n      ? firestore.collection('apiIdempotency').doc(\n          createHash('sha256')\n            // Scoped by the BOOKING, so a client that reused one key across\n            // two bookings cannot dedupe two legitimately distinct refunds.\n            // NOT by the amount: that would swallow a real second partial.\n            .update(`booking-refund:${hostId}:${bookingId}:${idempotencyKey}`)\n            .digest('hex'),\n        )\n      : null\n    if (claimRef) {\n      const prior = await claimRef.get()\n      const priorResponse = prior.get('response')\n      if (priorResponse) {\n        return res\n          .status(Number(prior.get('responseStatus') ?? 200))\n          .json(priorResponse)\n      }\n      try {\n        // The claim's shape is every claim's (`claimApiIdempotency`): its\n        // kind, scope and org name it on the staff claims list, `createdAtMs`\n        // ages it there, and `expiresAt` lets the TTL policy reap it — a\n        // claim stranded by a killed process otherwise holds its key forever.\n        await claimRef.create({\n          kind: 'booking-refund',\n          scopeId: hostId,\n          orgId: String(hostSnapshot.get('orgId') ?? '') || null,\n          bookingId,\n          status: 'pending',\n          createdAtMs: Date.now(),\n          expiresAt: apiIdempotencyExpiry(),\n        })\n      } catch {\n        // Another attempt with this key is in flight.\n        return res\n          .status(409)\n          .json({ error: 'This refund is already being processed' })\n      }\n    }\n\n    // RESERVE. Read and write the counter in ONE transaction so two concurrent\n    // refunds cannot both see the same `refundedCents` and each send a full\n    // amount to Stripe — the failure the order refund shipped with.\n    let refundCents = 0\n    let alreadyRefunded = 0\n    await firestore.runTransaction(async (transaction) => {\n      const fresh = await transaction.get(bookingRef)\n      alreadyRefunded = Math.max(\n        0,\n        Math.round(Number(fresh.get('refundedCents') ?? 0)),\n      )\n      const remaining = paidCents - alreadyRefunded\n      refundCents =\n        amountCents == null\n          ? remaining\n          : Math.min(Math.round(amountCents), remaining)\n      if (!(refundCents > 0)) {\n        refundCents = 0\n        return\n      }\n      transaction.set(\n        bookingRef,\n        { refundedCents: alreadyRefunded + refundCents },\n        { merge: true },\n      )\n    })\n    if (!(refundCents > 0)) {\n      await claimRef?.delete().catch(() => undefined)\n      return res.status(400).json({ error: 'Nothing left to refund' })\n    }\n\n    const params = new URLSearchParams({\n      payment_intent: paymentIntentId,\n      amount: String(refundCents),\n      // THE SELLER SHARE COMES BACK. Without this the merchant keeps their\n      // transfer in full and Aglyn funds the entire refund.\n      reverse_transfer: 'true',\n      // ...and so does Aglyn's commission on the refunded share. A refunded\n      // appointment earned the platform nothing.\n      refund_application_fee: 'true',\n    })\n    const response = await fetch('https://api.stripe.com/v1/refunds', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n        'Content-Type': 'application/x-www-form-urlencoded',\n        ...(claimRef ? { 'Idempotency-Key': claimRef.id } : {}),\n      },\n      body: params.toString(),\n    })\n    const refund = await response.json().catch(() => ({}) as any)\n    if (!response.ok) {\n      console.error('Stripe booking refund error', (refund as any)?.error)\n      // Stripe said no, so we KNOW no money moved: give the reservation back\n      // and let the same attempt be retried.\n      await firestore\n        .runTransaction(async (transaction) => {\n          const current = Number(\n            (await transaction.get(bookingRef)).get('refundedCents') ?? 0,\n          )\n          transaction.set(\n            bookingRef,\n            { refundedCents: Math.max(0, current - refundCents) },\n            { merge: true },\n          )\n        })\n        .catch(() => undefined)\n      await claimRef?.delete().catch(() => undefined)\n      return res.status(502).json({ error: 'Refund failed' })\n    }\n\n    // A FULL refund ends the appointment; a partial leaves it standing. The\n    // guest who got half their money back still has the slot, and moving the\n    // booking off `confirmed` would reopen a time the merchant is still\n    // committed to.\n    const totalRefunded = alreadyRefunded + refundCents\n    const fullyRefunded = totalRefunded >= paidCents\n    await bookingRef\n      .set(\n        {\n          refundedCents: totalRefunded,\n          ...(fullyRefunded ? { status: 'canceled' } : {}),\n        },\n        { merge: true },\n      )\n      .catch(() => undefined)\n\n    const payload = {\n      refundedCents: refundCents,\n      totalRefundedCents: totalRefunded,\n      fullyRefunded,\n    }\n    await claimRef\n      ?.set(\n        {\n          status: 'done',\n          responseStatus: 200,\n          response: payload,\n          settledAtMs: Date.now(),\n        },\n        { merge: true },\n      )\n      .catch(() => undefined)\n    /*\n     * The campaign's side of the ledger.\n     *\n     * A paid booking is credited to the campaign that led to it — the sale\n     * announces itself through `upsertHostContact` with a `purchaseCents` and\n     * this booking's id, exactly as a store order does — so a refunded one\n     * has to stop counting. Without this, a booking site's campaign revenue\n     * could only ever rise.\n     *\n     * Keyed by the BOOKING id, which is what the credit was filed under, so\n     * this needs no email and works for a guest who never became a contact.\n     * Recorded beside the credit rather than subtracted from it, and swallowed\n     * whole: the money has already left the merchant's account and the booking\n     * already records it, so nothing here may fail a refund.\n     */\n    await reverseEmailAttributedRevenue({\n      hostId,\n      orderId: bookingId,\n      amountCents: refundCents,\n      closedTheOrder: fullyRefunded,\n    })\n    return res.status(200).json(payload)\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Refund failed' })\n  }\n}\n"],"names":["firebaseAdmin","reverseEmailAttributedRevenue","createHash","apiIdempotencyExpiry","bookingRefundHandler","req","res","body","method","status","json","error","process","env","STRIPE_SECRET_KEY","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","bookingId","amountCents","Number","idempotencyKey","trim","isFinite","hostSnapshot","bookingSnapshot","decoded","app","auth","verifyIdToken","firestore","hostRef","collection","doc","get","exists","memberRole","uid","bookingRef","paymentIntentId","paidCents","Math","max","round","claimRef","update","digest","prior","priorResponse","create","kind","scopeId","orgId","createdAtMs","Date","now","expiresAt","refundCents","alreadyRefunded","runTransaction","transaction","fresh","remaining","min","set","refundedCents","merge","delete","catch","params","URLSearchParams","payment_intent","amount","reverse_transfer","refund_application_fee","response","fetch","Authorization","id","toString","refund","ok","console","current","totalRefunded","fullyRefunded","payload","totalRefundedCents","responseStatus","settledAtMs","orderId","closedTheOrder"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AAExD,8DAA8D;AAC9D,2EAA2E;AAC3E,sCAAsC;AACtC,SAASC,6BAA6B,QAAQ,4DAA2D;AACzG,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,oBAAoB,QAAQ,yCAAwC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CC,GACD,OAAO,MAAMC,uBAAyC,OAAOC,KAAKC;QAOnCD,4BAM4BA,WACnCE,cACGA,iBAMvBF,MAAAA;IApBF,IAAIA,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI,CAACC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOR,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA+B;IACtE;IACA,MAAMI,gBAAgBC,QAAOX,6BAAAA,IAAIY,OAAO,CAACF,aAAa,YAAzBV,6BAA6B;IAC1D,MAAMa,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOZ,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMJ,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWgB,KAAKC,KAAK,CAACnB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMoB,SAAST,QAAOT,eAAAA,KAAKkB,MAAM,YAAXlB,eAAe;IACrC,MAAMmB,YAAYV,QAAOT,kBAAAA,KAAKmB,SAAS,YAAdnB,kBAAkB;IAC3C,4EAA4E;IAC5E,MAAMoB,cAAcpB,KAAKoB,WAAW,IAAI,OAAO,OAAOC,OAAOrB,KAAKoB,WAAW;IAC7E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAME,iBAAiBb,QACrBX,QAAAA,8BAAAA,IAAIY,OAAO,CAAC,kBAAkB,YAA9BZ,8BAAkCA,IAAIY,OAAO,CAAC,kBAAkB,YAAhEZ,OAAoE,IAEnEyB,IAAI,GACJV,KAAK,CAAC,GAAG;IACZ,IAAI,CAACK,UAAU,CAACC,WAAW;QACzB,OAAOpB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACA,IAAIgB,eAAe,QAAQ,CAAEC,CAAAA,OAAOG,QAAQ,CAACJ,gBAAgBA,cAAc,CAAA,GAAI;QAC7E,OAAOrB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAwB;IAC/D;IAEA,IAAI;YAUkBqB,mBASWC,sBAGXA;QArBpB,MAAMC,UAAU,MAAMlC,cAAcmC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACnB;QAC/D,MAAMoB,YAAYtC,cAAcmC,GAAG,GAAGG,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMO,eAAe,MAAMO,QAAQG,GAAG;QACtC,IAAI,CAACV,aAAaW,MAAM,EAAE;YACxB,OAAOrC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,mEAAmE;QACnE,gCAAgC;QAChC,MAAMiC,aAAa,EAACZ,oBAAAA,aAAaU,GAAG,CAAC,0BAAjBV,oBAAmC,CAAC,EAAE,CAACE,QAAQW,GAAG,CAAC;QACvE,IAAID,eAAe,SAAS;YAC1B,OAAOtC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA+B;QACtE;QACA,MAAMmC,aAAaP,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAACf;QACtD,MAAMO,kBAAkB,MAAMa,WAAWJ,GAAG;QAC5C,IAAI,CAACT,gBAAgBU,MAAM,EAAE;YAC3B,OAAOrC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAMoC,kBAAkB/B,QAAOiB,uBAAAA,gBAAgBS,GAAG,CAAC,8BAApBT,uBAA0C;QACzE,MAAMe,YAAYC,KAAKC,GAAG,CACxB,GACAD,KAAKE,KAAK,CAACvB,QAAOK,wBAAAA,gBAAgBS,GAAG,CAAC,8BAApBT,wBAA0C;QAE9D,IAAI,CAACe,WAAW;YACd,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA8B;QACrE;QACA,IAAI,CAACoC,iBAAiB;YACpB,sEAAsE;YACtE,uEAAuE;YACvE,0BAA0B;YAC1B,OAAOzC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,+DACA,oEACA;YACJ;QACF;QAEA,yEAAyE;QACzE,mEAAmE;QACnE,uBAAuB;QACvB,MAAMyC,WAAWvB,iBACbS,UAAUE,UAAU,CAAC,kBAAkBC,GAAG,CACxCvC,WAAW,SACT,gEAAgE;QAChE,gEAAgE;QAChE,+DAA+D;SAC9DmD,MAAM,CAAC,CAAC,eAAe,EAAE5B,OAAO,CAAC,EAAEC,UAAU,CAAC,EAAEG,gBAAgB,EAChEyB,MAAM,CAAC,UAEZ;QACJ,IAAIF,UAAU;YACZ,MAAMG,QAAQ,MAAMH,SAASV,GAAG;YAChC,MAAMc,gBAAgBD,MAAMb,GAAG,CAAC;YAChC,IAAIc,eAAe;oBAEAD;gBADjB,OAAOjD,IACJG,MAAM,CAACmB,QAAO2B,aAAAA,MAAMb,GAAG,CAAC,6BAAVa,aAA+B,MAC7C7C,IAAI,CAAC8C;YACV;YACA,IAAI;oBAQcxB;gBAPhB,kEAAkE;gBAClE,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,MAAMoB,SAASK,MAAM,CAAC;oBACpBC,MAAM;oBACNC,SAASlC;oBACTmC,OAAO5C,QAAOgB,qBAAAA,aAAaU,GAAG,CAAC,oBAAjBV,qBAA6B,OAAO;oBAClDN;oBACAjB,QAAQ;oBACRoD,aAAaC,KAAKC,GAAG;oBACrBC,WAAW7D;gBACb;YACF,EAAE,eAAM;gBACN,8CAA8C;gBAC9C,OAAOG,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;oBAAEC,OAAO;gBAAyC;YAC5D;QACF;QAEA,2EAA2E;QAC3E,wEAAwE;QACxE,gEAAgE;QAChE,IAAIsD,cAAc;QAClB,IAAIC,kBAAkB;QACtB,MAAM5B,UAAU6B,cAAc,CAAC,OAAOC;gBAIhBC;YAHpB,MAAMA,QAAQ,MAAMD,YAAY1B,GAAG,CAACI;YACpCoB,kBAAkBjB,KAAKC,GAAG,CACxB,GACAD,KAAKE,KAAK,CAACvB,QAAOyC,aAAAA,MAAM3B,GAAG,CAAC,4BAAV2B,aAA8B;YAElD,MAAMC,YAAYtB,YAAYkB;YAC9BD,cACEtC,eAAe,OACX2C,YACArB,KAAKsB,GAAG,CAACtB,KAAKE,KAAK,CAACxB,cAAc2C;YACxC,IAAI,CAAEL,CAAAA,cAAc,CAAA,GAAI;gBACtBA,cAAc;gBACd;YACF;YACAG,YAAYI,GAAG,CACb1B,YACA;gBAAE2B,eAAeP,kBAAkBD;YAAY,GAC/C;gBAAES,OAAO;YAAK;QAElB;QACA,IAAI,CAAET,CAAAA,cAAc,CAAA,GAAI;YACtB,OAAMb,4BAAAA,SAAUuB,MAAM,GAAGC,KAAK,CAAC,IAAMtD;YACrC,OAAOhB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QAEA,MAAMkE,SAAS,IAAIC,gBAAgB;YACjCC,gBAAgBhC;YAChBiC,QAAQhE,OAAOiD;YACf,qEAAqE;YACrE,sDAAsD;YACtDgB,kBAAkB;YAClB,sEAAsE;YACtE,2CAA2C;YAC3CC,wBAAwB;QAC1B;QACA,MAAMC,WAAW,MAAMC,MAAM,qCAAqC;YAChE5E,QAAQ;YACRS,SAAS;gBACPoE,eAAe,CAAC,OAAO,EAAEzE,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBACxD,gBAAgB;eACZsC,WAAW;gBAAE,mBAAmBA,SAASkC,EAAE;YAAC,IAAI,CAAC;YAEvD/E,MAAMsE,OAAOU,QAAQ;QACvB;QACA,MAAMC,SAAS,MAAML,SAASzE,IAAI,GAAGkE,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QACnD,IAAI,CAACO,SAASM,EAAE,EAAE;YAChBC,QAAQ/E,KAAK,CAAC,+BAAgC6E,0BAAD,AAACA,OAAgB7E,KAAK;YACnE,uEAAuE;YACvE,uCAAuC;YACvC,MAAM2B,UACH6B,cAAc,CAAC,OAAOC;oBAEnB;gBADF,MAAMuB,UAAU/D,QACd,OAAA,AAAC,CAAA,MAAMwC,YAAY1B,GAAG,CAACI,WAAU,EAAGJ,GAAG,CAAC,4BAAxC,OAA4D;gBAE9D0B,YAAYI,GAAG,CACb1B,YACA;oBAAE2B,eAAexB,KAAKC,GAAG,CAAC,GAAGyC,UAAU1B;gBAAa,GACpD;oBAAES,OAAO;gBAAK;YAElB,GACCE,KAAK,CAAC,IAAMtD;YACf,OAAM8B,4BAAAA,SAAUuB,MAAM,GAAGC,KAAK,CAAC,IAAMtD;YACrC,OAAOhB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QAEA,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,gBAAgB;QAChB,MAAMiF,gBAAgB1B,kBAAkBD;QACxC,MAAM4B,gBAAgBD,iBAAiB5C;QACvC,MAAMF,WACH0B,GAAG,CACF;YACEC,eAAemB;WACXC,gBAAgB;YAAEpF,QAAQ;QAAW,IAAI,CAAC,IAEhD;YAAEiE,OAAO;QAAK,GAEfE,KAAK,CAAC,IAAMtD;QAEf,MAAMwE,UAAU;YACdrB,eAAeR;YACf8B,oBAAoBH;YACpBC;QACF;QACA,OAAMzC,4BAAAA,SACFoB,GAAG,CACH;YACE/D,QAAQ;YACRuF,gBAAgB;YAChBb,UAAUW;YACVG,aAAanC,KAAKC,GAAG;QACvB,GACA;YAAEW,OAAO;QAAK,GAEfE,KAAK,CAAC,IAAMtD;QACf;;;;;;;;;;;;;;KAcC,GACD,MAAMrB,8BAA8B;YAClCwB;YACAyE,SAASxE;YACTC,aAAasC;YACbkC,gBAAgBN;QAClB;QACA,OAAOvF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAACoF;IAC9B,EAAE,OAAOnF,OAAO;QACd+E,QAAQ/E,KAAK,CAACA;QACd,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/server.js

@@ -14,7 +14,12 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { checkEntitlement, pluginJobHostGate, registerPluginConfigSchema, registerPluginJob, resolveBrandingProfile, resolveTransactionFeeCents, sanitizeAuthorHtml } from "@aglyn/aglyn/server";
+ */ import { checkEntitlement, registerPluginConfigSchema, registerPluginJob, resolveBrandingProfile, resolveTransactionFeeCents, sanitizeAuthorHtml } from "@aglyn/aglyn/server";
+// The leaf, not the barrel: the console's `x-cron-secret` door asks the
+// site's lockdown directly (AGL-3356) — core's registry has no resolver in
+// the console process — and a spec that substitutes the barrel must still
+// reach the real verdict.
+import { siteLockdownJobGate } from "@aglyn/tenant-data-admin/server/tenant-write-lockdown";
 import { BOOKING_MAX_DAYS_AHEAD, computeOpenSlots, isBookingReminderDue, isSlotOpen, REMINDER_WINDOW_END_HOURS, REMINDER_WINDOW_START_HOURS } from "./model/index.js";
 import { registerBillingWebhookHandler, registerPluginApiRoute } from "@aglyn/aglyn/server";
 import { pluginTaxProfile } from "@aglyn/aglyn/plugin-manager/plugin-tax-profile";
@@ -81,6 +86,7 @@ registerPluginJob({
 });
 import { firebaseAdmin, getOrgForHost, meterHostEmail, notifyHostManagers, attributeCampaignConversion, resolveCampaignTouch, getPluginConfig, resolveOrgIdForHost, renderHostEmailWithTokens, hostSendingIdentity } from "@aglyn/tenant-data-admin";
 import { connectLinkageIsReady } from "@aglyn/tenant-data-admin/server/stripe-account-mode";
+import { checkoutSessionCardAuthenticationParams } from "@aglyn/tenant-data-admin/server/stripe-card-authentication";
 import { emitHostEvent } from "@aglyn/tenant-runtime";
 import recordCapturedContact from "@aglyn/aglyn/plugin-manager/record-captured-contact";
 import { isEmailConfigured, loadHostEmail, renderLoadedHostEmail, sendEmail } from "@aglyn/shared-util-email";
@@ -561,7 +567,8 @@ export const slotsHandler = async (req, res)=>{
             // taxed one files `manual` with the figure, both with no further
             // wiring.
             const params = new URLSearchParams(_extends({
-                mode: 'payment',
+                mode: 'payment'
+            }, checkoutSessionCardAuthenticationParams('payment'), {
                 'line_items[0][quantity]': '1',
                 'line_items[0][price_data][currency]': 'usd',
                 'line_items[0][price_data][unit_amount]': String(Math.round(priceUsd * 100)),
@@ -700,7 +707,10 @@ export const slotsHandler = async (req, res)=>{
                 fromName: branding.fromName,
                 sendingIdentity: await hostSendingIdentity(hostId),
                 audience: 'tenant',
-                context: 'booking confirmation'
+                context: 'booking confirmation',
+                // Owed to the recipient by their own booking: the phishing
+                // screen's soft rules never hold it (AGL-3356).
+                owedFor: 'booking'
             }));
             // Cost meter (AGL-1438). Transactional: counted, never capped — a
             // confirmation the customer never receives reads to them as a booking
@@ -851,7 +861,10 @@ export const slotsHandler = async (req, res)=>{
             fromName: (_brandingByHost_get = brandingByHost.get(hostId)) == null ? void 0 : _brandingByHost_get.fromName,
             sendingIdentity: await hostSendingIdentity(hostId, identityByHost),
             audience: 'tenant',
-            context: 'booking reminder'
+            context: 'booking reminder',
+            // Owed to the recipient by their own booking: the phishing
+            // screen's soft rules never hold it (AGL-3356).
+            owedFor: 'booking'
         }));
         if (result.sent) {
             // Cost meter (AGL-1438). Transactional: a reminder a quota refused is
@@ -930,7 +943,7 @@ export const slotsHandler = async (req, res)=>{
     }
     try {
         // The manual door asks the same question the beat does (AGL-2495).
-        return res.status(200).json(await scanBookingReminders(pluginJobHostGate()));
+        return res.status(200).json(await scanBookingReminders(siteLockdownJobGate()));
     } catch (error) {
         console.error(error);
         return res.status(500).json({