@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/components/console/order-detail-dialog.component.js

@@ -0,0 +1,976 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import * as CommerceModel from "../../model/index.js";
+import { escapeHtml } from "../../utils/escape-html.js";
+// The CRM's address from the SHARED builder, not the plugin (AGL-2622): the
+// CRM already reaches marketing, and marketing reaches commerce, so an
+// import of the CRM from here would close a cycle between the three
+// plugins. The shared builder is pinned against the CRM's own routes by a
+// spec, so the address is the same one the hub resolves.
+import { crmContactByEmailHref } from "@aglyn/aglyn";
+import { AppLink, useConfirmationContext } from "@aglyn/shared-ui-jsx";
+import { useSnackbar } from "@aglyn/shared-ui-snackstack";
+import { Button, Chip, Dialog, DialogActions, DialogContent, DialogTitle, Divider, Stack, TextField, Tooltip, Typography } from "@mui/material";
+import { doc, runTransaction, updateDoc } from "firebase/firestore";
+import { useParams } from "next/navigation";
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useFirestore, useUser } from "@aglyn/tenant-feature-instance";
+import { authorizedFetch } from "@aglyn/shared-util-http/authorized-token";
+const STATUS_COLOR = {
+    pending: 'warning',
+    paid: 'info',
+    partially_fulfilled: 'info',
+    fulfilled: 'success',
+    delivered: 'success',
+    cancelled: 'default',
+    refunded: 'error'
+};
+/**
+ * The dispute chip's colour (AGL-1796).
+ *
+ * `open` is WARNING rather than error because it is the case that still has a
+ * deadline on it — the merchant can still act, and a red chip on a case they
+ * might win says the money is gone when it is not. `lost` is the one that took
+ * the money, and shares `refunded`'s red for that reason.
+ */ export const DISPUTE_COLOR = {
+    open: 'warning',
+    lost: 'error',
+    won: 'success',
+    settled: 'default'
+};
+const usd = (cents)=>`$${((cents != null ? cents : 0) / 100).toFixed(2)}`;
+/**
+ * Order detail (AGL-287): timeline, line items, totals, and the actions
+ * the status machine allows — fulfill with tracking, refund, cancel, mark
+ * delivered (each a server route that re-asks the transition under the
+ * write), notes, printable packing slip.
+ */ export function OrderDetailDialog(props) {
+    var _STATUS_COLOR_order_status, _order_lineItems, _order_timeline;
+    var _restock_lines;
+    const { hostId, order: rawOrder, onClose } = props;
+    const firestore = useFirestore();
+    const { data: user } = useUser();
+    const { enqueueSnackbar } = useSnackbar();
+    const { confirm } = useConfirmationContext();
+    const [tracking, setTracking] = useState(null);
+    const [note, setNote] = useState('');
+    const [busy, setBusy] = useState(false);
+    const order = rawOrder ? CommerceModel.liftLegacyOrder(rawOrder) : null;
+    const orderId = rawOrder == null ? void 0 : rawOrder.$id;
+    /*
+   * Where the buyer's CONTACT is (AGL-2622). A checkout that carried an
+   * address updated a person in the CRM — a customer, with this order on
+   * their timeline — and the dialog links there by the address, because
+   * the contact's id is minted at capture and nothing on the order holds
+   * it. The Contacts list is the lookup and opens the record on one match.
+   * A guest checkout with no address updated nobody, so there is no link.
+   * Built from the route params already in the URL — no document is read
+   * to draw a link — and absent until they settle, so the dialog never
+   * offers a link to a half-built address.
+   */ const params = useParams();
+    const customerCrmHref = (params == null ? void 0 : params.orgSlug) && (params == null ? void 0 : params.host) && (order == null ? void 0 : order.customerEmail) ? crmContactByEmailHref({
+        orgSlug: String(params.orgSlug),
+        host: String(params.host)
+    }, String(order.customerEmail)) : null;
+    /**
+   * The one client write left in this dialog, and it is timeline-only ON
+   * PURPOSE: notes carry no status, so `ORDER_TRANSITIONS` has nothing to say
+   * about them and they stay out of the server routes' way. Every status
+   * write goes through a route that re-asks the transition under the write —
+   * cancel (AGL-1818), fulfil and mark-delivered (AGL-1819), refund
+   * (AGL-1696). The moment a status rides along with a note, it must move
+   * too; `order-fulfill-wiring.spec.tsx` pins the patch to `timeline` alone.
+   */ const write = useCallback(async (patch)=>{
+        if (!orderId) return;
+        await updateDoc(doc(firestore, 'hosts', hostId, 'orders', orderId), patch);
+    }, [
+        firestore,
+        hostId,
+        orderId
+    ]);
+    /**
+   * Fulfil and mark-delivered go through `/api/commerce/fulfill-order`
+   * (AGL-1819), not a client write — the same stale-dialog hole the cancel
+   * swap (AGL-1818) closed: `can(…)` below only decides whether to RENDER
+   * the buttons, so a dialog held open while the order was refunded in
+   * another tab used to write `fulfilled` straight onto it. The route
+   * re-asks `canTransitionOrder` inside the transaction that writes the
+   * status, and that race now comes back as a 409 carrying the state that
+   * refused.
+   *
+   * The messages follow the AGL-1784/1786 contract — say what happened: a
+   * 409 is the guard refusing, not the machinery failing; the route's own
+   * 500 is a rolled-back transaction (nothing landed, retry is safe and
+   * correct); an answer with no JSON word from the handler, or no answer at
+   * all, is NOT KNOWN — never "nothing happened". A retry is safe in every
+   * case because the route writes once: a repeat finds the order already in
+   * the target status and returns `already` without appending a second copy
+   * of the same fulfillment.
+   */ const transition = useCallback(async (to, extra, copy)=>{
+        if (!orderId) return false;
+        setBusy(true);
+        try {
+            let response;
+            try {
+                response = await authorizedFetch(user, '/api/commerce/fulfill-order', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify(_extends({
+                        hostId,
+                        orderId,
+                        to
+                    }, extra))
+                });
+            } catch (error) {
+                console.error(error);
+                enqueueSnackbar(`The request did not complete, so it is NOT known whether ${copy.subject}. ` + 'Reopen the order to check — retrying is safe, the server ' + 'writes it once.', {
+                    variant: 'error',
+                    allowDuplicate: true
+                });
+                return false;
+            }
+            const payload = await response.json().catch(()=>({}));
+            if (!response.ok) {
+                if (response.status === 409) {
+                    var _ref;
+                    // The transition guard refusing: the order moved on (refunded,
+                    // cancelled) while this dialog was open. The route's message
+                    // names the state that refused it, and nothing was written.
+                    enqueueSnackbar((_ref = payload == null ? void 0 : payload.error) != null ? _ref : `This order can no longer be ${to}`, {
+                        variant: 'warning',
+                        allowDuplicate: true
+                    });
+                } else if ((payload == null ? void 0 : payload.error) && response.status < 500) {
+                    // A refusal that wrote nothing — session, role, or an order that
+                    // is not there. The route's own word, verbatim.
+                    enqueueSnackbar(payload.error, {
+                        variant: 'error',
+                        allowDuplicate: true
+                    });
+                } else if (payload == null ? void 0 : payload.error) {
+                    // The route's 500 is a rolled-back transaction: nothing landed.
+                    // Only the handler's own JSON word licenses saying so.
+                    enqueueSnackbar(`${payload.error} — nothing changed, the order is as it was. Retrying is safe.`, {
+                        variant: 'error',
+                        allowDuplicate: true
+                    });
+                } else {
+                    // No JSON word from the handler (a gateway page, a proxy
+                    // timeout): whether the write landed is NOT known.
+                    enqueueSnackbar(`The ${copy.action} failed (${response.status}) and it is NOT ` + 'known whether it landed. Reopen the order to check — ' + 'retrying is safe, the server writes it once.', {
+                        variant: 'error',
+                        allowDuplicate: true
+                    });
+                }
+                return false;
+            }
+            enqueueSnackbar((payload == null ? void 0 : payload.already) ? copy.already : copy.done, {
+                variant: 'success',
+                persist: false
+            });
+            return true;
+        } finally{
+            setBusy(false);
+        }
+    }, [
+        orderId,
+        user,
+        hostId,
+        enqueueSnackbar
+    ]);
+    const handleFulfill = useCallback(async ()=>{
+        if (!order || !tracking) return;
+        const done = await transition('fulfilled', _extends({}, tracking.carrier ? {
+            carrier: tracking.carrier
+        } : {}, tracking.number ? {
+            trackingNumber: tracking.number
+        } : {}), {
+            done: 'Order fulfilled',
+            already: 'Order was already fulfilled',
+            subject: 'the order was fulfilled',
+            action: 'fulfillment'
+        });
+        // The refused or unknown case keeps the form open — there is nothing to
+        // celebrate, and the tracking is not yet recorded anywhere.
+        if (done) setTracking(null);
+    }, [
+        order,
+        tracking,
+        transition
+    ]);
+    const handleDelivered = useCallback(async ()=>{
+        if (!order) return;
+        await transition('delivered', {}, {
+            done: 'Order marked delivered',
+            already: 'Order was already marked delivered',
+            subject: 'the order was marked delivered',
+            action: 'delivery update'
+        });
+    }, [
+        order,
+        transition
+    ]);
+    /**
+   * Cancel goes through `/api/commerce/cancel-order` (AGL-1818), not a client
+   * write. The status flip and the stock release are one transaction there,
+   * and the route re-asks `canTransitionOrder` under the same lock — the
+   * `can('cancelled')` gate below only decides whether to RENDER the button,
+   * so a dialog held open while the order ships in another tab used to write
+   * `cancelled` straight onto a `fulfilled` order. Now that race comes back
+   * as a 409 carrying the state that refused it.
+   *
+   * The messages follow the AGL-1784/1786 contract — say what happened:
+   * a 409 is the guard refusing, not the cancel machinery failing; the
+   * route's own 500 is a rolled-back transaction (nothing landed, retry is
+   * safe and correct); an answer with no JSON word from the handler, or no
+   * answer at all, is NOT KNOWN — never "nothing happened". A retry is safe
+   * in every case because the route cancels once: a second cancel finds
+   * `cancelled` and returns success without touching stock.
+   */ const handleCancel = useCallback(async ()=>{
+        if (!order || !orderId) return;
+        const confirmed = await confirm({
+            title: 'Cancel this order?',
+            description: 'The buyer is NOT refunded automatically — refund first if they paid.',
+            confirmationText: 'Cancel order',
+            confirmationButtonProps: {
+                color: 'error'
+            }
+        }).then(()=>true).catch(()=>false);
+        if (!confirmed) return;
+        setBusy(true);
+        try {
+            var _ref;
+            let response;
+            try {
+                response = await authorizedFetch(user, '/api/commerce/cancel-order', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({
+                        hostId,
+                        orderId
+                    })
+                });
+            } catch (error) {
+                console.error(error);
+                enqueueSnackbar('The request did not complete, so it is NOT known whether the ' + 'order was canceled. Reopen the order to check — retrying is ' + 'safe, the server cancels once.', {
+                    variant: 'error',
+                    allowDuplicate: true
+                });
+                return;
+            }
+            const payload = await response.json().catch(()=>({}));
+            if (!response.ok) {
+                if (response.status === 409) {
+                    var _ref1;
+                    // The transition guard refusing: the order moved on (shipped,
+                    // refunded) while this dialog was open. The route's message names
+                    // the state that refused it, and nothing was written.
+                    enqueueSnackbar((_ref1 = payload == null ? void 0 : payload.error) != null ? _ref1 : 'This order can no longer be canceled', {
+                        variant: 'warning',
+                        allowDuplicate: true
+                    });
+                } else if ((payload == null ? void 0 : payload.error) && response.status < 500) {
+                    // A refusal that wrote nothing — session, role, or an order that
+                    // is not there. The route's own word, verbatim.
+                    enqueueSnackbar(payload.error, {
+                        variant: 'error',
+                        allowDuplicate: true
+                    });
+                } else if (payload == null ? void 0 : payload.error) {
+                    // The route's 500 is a rolled-back transaction: nothing landed and
+                    // the order is still open. Only the handler's own JSON word
+                    // licenses saying so.
+                    enqueueSnackbar(`${payload.error} — nothing changed, the order is still open. Retrying is safe.`, {
+                        variant: 'error',
+                        allowDuplicate: true
+                    });
+                } else {
+                    // No JSON word from the handler (a gateway page, a proxy timeout):
+                    // whether the cancel landed is NOT known.
+                    enqueueSnackbar(`The cancel failed (${response.status}) and it is NOT known ` + 'whether it landed. Reopen the order to check — retrying is ' + 'safe, the server cancels once.', {
+                        variant: 'error',
+                        allowDuplicate: true
+                    });
+                }
+                return;
+            }
+            const units = Number((_ref = payload == null ? void 0 : payload.units) != null ? _ref : 0);
+            enqueueSnackbar((payload == null ? void 0 : payload.alreadyCancelled) ? 'Order was already canceled' : units > 0 ? `Order canceled — ${units} ${units === 1 ? 'unit' : 'units'} returned to stock` : 'Order canceled', {
+                variant: 'success',
+                persist: false
+            });
+        } finally{
+            setBusy(false);
+        }
+    }, [
+        order,
+        orderId,
+        user,
+        hostId,
+        confirm,
+        enqueueSnackbar
+    ]);
+    /**
+   * Idempotency key for ONE refund attempt (AGL-1696), the same shape the POS
+   * register uses for a sale (AGL-1691).
+   *
+   * Minted lazily so a retry of this attempt — a lost response, a second
+   * click, the admin reopening the dialog after a timeout — reuses it and the
+   * server replays instead of sending the money again. Retired on a definitive
+   * answer, which makes the NEXT refund a new attempt: two partial refunds of
+   * the same amount on the same order are two real refunds, and keying on the
+   * order (or the amount) would silently swallow the second.
+   *
+   * NOT retired on a network failure or a 5xx — that is precisely the window
+   * the key exists to cover.
+   */ const attemptKey = useRef('');
+    useEffect(()=>{
+        attemptKey.current = '';
+    }, [
+        orderId
+    ]);
+    /**
+   * `lineItemIds` scopes the refund to named lines (AGL-2454).
+   *
+   * Without it a partial refund is an AMOUNT and nothing else, so the product
+   * cannot know which goods came back and revokes nothing — a 99%-refunded
+   * order kept its downloads, licence keys, gated pages and verified review.
+   * Naming the lines is the only way that question gets an honest answer, and
+   * the route derives the amount FROM the lines rather than trusting a figure
+   * typed beside them.
+   */ const handleRefund = useCallback(async (lineItemIds)=>{
+        var _order_lineItems, _ref, _ref1, _order_refundedCents;
+        var _order_totals;
+        if (!order || !orderId) return;
+        const lines = (_order_lineItems = order.lineItems) != null ? _order_lineItems : [];
+        const scoped = (lineItemIds != null ? lineItemIds : []).length > 0;
+        // The SERVER's figure, not a second derivation of it. This was
+        // the list value `unitAmountCents x quantity`, which on a discounted order
+        // is more than the buyer paid — so the dialog quoted one number and the
+        // route refunded another. One function answers both.
+        const scopedCents = CommerceModel.orderLineRefundCents(order, lineItemIds != null ? lineItemIds : []);
+        const confirmed = await confirm({
+            title: scoped ? 'Refund this line?' : 'Refund this order?',
+            description: (scoped ? `Refunds ${usd(scopedCents)} for ${(lineItemIds != null ? lineItemIds : []).map((index)=>{
+                var _ref;
+                var _lines_index;
+                return (_ref = (_lines_index = lines[index]) == null ? void 0 : _lines_index.name) != null ? _ref : `line ${index}`;
+            }).join(', ')} through Stripe, and withdraws that line's ` + 'downloads, license keys and gated content. A license key already ' + 'sent to the buyer is retired, not returned to your pool — they ' + 'still hold the string, so reissuing it would give two people one ' + 'working key.' : `Refunds ${usd(((_ref = (_ref1 = (_order_totals = order.totals) == null ? void 0 : _order_totals.totalCents) != null ? _ref1 : order.amountCents) != null ? _ref : 0) - ((_order_refundedCents = order.refundedCents) != null ? _order_refundedCents : 0))} to the buyer through Stripe.`) + // An open INQUIRY keeps this button live on purpose (AGL-1820):
+            // Stripe names a full refund as the way to resolve one before it
+            // escalates to a chargeback. Said here so the admin reads the refund
+            // as the documented exit, not a risk taken against the badge.
+            (CommerceModel.orderHasOpenDispute(order) && !CommerceModel.orderDisputeBlocksRefund(order) ? ' An inquiry is open on this charge — a full refund resolves it' + ' before it can become a chargeback.' : ''),
+            confirmationText: 'Refund',
+            confirmationButtonProps: {
+                color: 'error'
+            }
+        }).then(()=>true).catch(()=>false);
+        if (!confirmed) return;
+        setBusy(true);
+        // `randomUUID` needs a secure context, which the console always is, but
+        // fall back rather than throw on a refund.
+        if (!attemptKey.current) {
+            var _ref2;
+            var _globalThis_crypto_randomUUID, _globalThis_crypto;
+            attemptKey.current = (_ref2 = (_globalThis_crypto = globalThis.crypto) == null ? void 0 : (_globalThis_crypto_randomUUID = _globalThis_crypto.randomUUID) == null ? void 0 : _globalThis_crypto_randomUUID.call(_globalThis_crypto)) != null ? _ref2 : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+        }
+        try {
+            const response = await authorizedFetch(user, '/api/commerce/refund', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Idempotency-Key': attemptKey.current
+                },
+                body: JSON.stringify(_extends({
+                    hostId,
+                    orderId
+                }, scoped ? {
+                    lineItemIds
+                } : {}))
+            });
+            const payload = await response.json();
+            // A definitive answer ends this attempt either way: the next refund is a
+            // new one and must get a new key. A 5xx or a thrown fetch keeps the key,
+            // so pressing Refund again dedupes rather than sends a second transfer.
+            if (response.status < 500) attemptKey.current = '';
+            if (!response.ok) {
+                var _ref3;
+                // A 409 is a guard REFUSING — the status machine, or the open-dispute
+                // block (AGL-1809), whose body explains what to do instead — not the
+                // refund machinery failing. The route wrote nothing, so it surfaces
+                // verbatim as a warning, same as the cancel path's 409 (AGL-1818).
+                enqueueSnackbar((_ref3 = payload == null ? void 0 : payload.error) != null ? _ref3 : 'Refund failed', {
+                    variant: response.status === 409 ? 'warning' : 'error',
+                    allowDuplicate: true
+                });
+            } else {
+                enqueueSnackbar('Refund issued', {
+                    variant: 'success',
+                    persist: false
+                });
+            }
+        } finally{
+            setBusy(false);
+        }
+    }, [
+        order,
+        orderId,
+        user,
+        hostId,
+        confirm,
+        enqueueSnackbar
+    ]);
+    /**
+   * Answer the restock question a reversal flagged (AGL-1806).
+   *
+   * The answer MOVES NO STOCK, which is AGL-1797's ledger argument and it is
+   * binding: the products hub's "Adjust stock" is the one stock writer (it
+   * writes the counts AND the `InventoryAdjustment` row the hub renders as
+   * history), so "Restocked" here is clicked AFTER the merchant used it, and
+   * "No restock" says the goods are not recoverable. Either answer only sets
+   * the `resolution` triple `OrderRestockCheck` declares and says so on the
+   * timeline.
+   *
+   * A TRANSACTION rather than the dialog's plain `write`, keyed on the
+   * rendered `flaggedAtMs`, because an answer must land ONCE. The flag writer
+   * re-asks an ANSWERED question after the next reversal, and the cancel
+   * route (AGL-1808) answers an open one itself when it returns the stock —
+   * so a stale dialog writing blind would either re-answer a settled question
+   * or replace a brand-new one with a resolved copy of the old. The
+   * transaction re-reads on the server (the web SDK will not run one from
+   * cache — the products hub's `writeGuardedBySeed` refusal of unconfirmed
+   * data, by other means) and refuses both cases with the truth: nothing was
+   * written.
+   */ const handleRestockAnswer = useCallback(async (resolution)=>{
+        const check = order == null ? void 0 : order.restockCheck;
+        if (!order || !orderId || !check || check.resolution) return;
+        setBusy(true);
+        try {
+            const reference = doc(firestore, 'hosts', hostId, 'orders', orderId);
+            const verdict = await runTransaction(firestore, async (transaction)=>{
+                var _snapshot_data, _ref;
+                const snapshot = await transaction.get(reference);
+                if (!snapshot.exists()) return 'gone';
+                const current = CommerceModel.liftLegacyOrder((_snapshot_data = snapshot.data()) != null ? _snapshot_data : {});
+                const fresh = current.restockCheck;
+                if (!fresh || fresh.resolution) return 'answered';
+                if (fresh.flaggedAtMs !== check.flaggedAtMs) return 'changed';
+                const resolvedAtMs = Date.now();
+                const uid = String((_ref = user == null ? void 0 : user.uid) != null ? _ref : '');
+                transaction.update(reference, {
+                    restockCheck: _extends({}, fresh, {
+                        resolution,
+                        resolvedAtMs
+                    }, uid ? {
+                        resolvedBy: uid
+                    } : {}),
+                    // The SERVER's timeline, not the dialog's — a note landed from
+                    // another tab must survive the append.
+                    timeline: CommerceModel.appendOrderEvent(current, 'restock-check', resolution === 'restocked' ? 'answered — restocked' : 'answered — no restock', resolvedAtMs)
+                });
+                return 'recorded';
+            });
+            if (verdict === 'recorded') {
+                enqueueSnackbar(resolution === 'restocked' ? 'Recorded as restocked' : 'Recorded — no restock', {
+                    variant: 'success',
+                    persist: false
+                });
+            } else if (verdict === 'answered') {
+                // The cancel route, or another admin, got there first.
+                enqueueSnackbar('This restock question was already answered — nothing changed.', {
+                    variant: 'info',
+                    persist: false
+                });
+            } else if (verdict === 'changed') {
+                // A later reversal re-asked; this dialog shows the OLD question.
+                enqueueSnackbar('The restock question changed while this dialog was open — ' + 'nothing was written. Reopen the order to see the current one.', {
+                    variant: 'warning',
+                    allowDuplicate: true
+                });
+            } else {
+                enqueueSnackbar('This order no longer exists — nothing was written.', {
+                    variant: 'warning',
+                    allowDuplicate: true
+                });
+            }
+        } catch (error) {
+            // A transaction is all-or-nothing, and a thrown one did not commit.
+            console.error(error);
+            enqueueSnackbar('The answer was not recorded — it needs a live connection and the ' + 'editor or admin role. Nothing changed; answering again is safe.', {
+                variant: 'error',
+                allowDuplicate: true
+            });
+        } finally{
+            setBusy(false);
+        }
+    }, [
+        order,
+        orderId,
+        firestore,
+        hostId,
+        user,
+        enqueueSnackbar
+    ]);
+    const handleNote = useCallback(async ()=>{
+        if (!order || !note.trim()) return;
+        await write({
+            timeline: CommerceModel.appendOrderEvent(order, 'note', note.trim().slice(0, 500))
+        });
+        setNote('');
+    }, [
+        order,
+        note,
+        write
+    ]);
+    const handlePackingSlip = useCallback(()=>{
+        var _order_lineItems, _address_city, _address_state, _address_postalCode;
+        if (!order) return;
+        const win = window.open('', '_blank', 'width=600,height=800');
+        if (!win) return;
+        // ESCAPED (AGL-2283). This is `document.write` into an `about:blank`
+        // popup, which INHERITS the console's origin — and `order.shippingAddress`
+        // is copied verbatim from Stripe's `shipping_details`, i.e. typed by the
+        // SHOPPER. A name of `<img src=x onerror=…>` ran script against the
+        // merchant's own authenticated session. React guards nothing here because
+        // none of this is React. Line names and SKUs are merchant-authored and
+        // lower severity, but they are the same construction and get the same
+        // treatment rather than a case-by-case argument.
+        const rows = ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).map((line)=>{
+            var _line_sku;
+            return `<tr><td>${escapeHtml(line.quantity)}×</td><td>${escapeHtml(line.name)}${line.variantLabel ? ` — ${escapeHtml(line.variantLabel)}` : ''}</td><td>${escapeHtml((_line_sku = line.sku) != null ? _line_sku : '')}</td></tr>`;
+        }).join('');
+        const address = order.shippingAddress;
+        win.document.write(`<h2>Packing slip ${escapeHtml(CommerceModel.formatOrderNumber(order, orderId))}</h2>` + (address ? `<p>${[
+            address.name,
+            address.line1,
+            address.line2,
+            `${(_address_city = address.city) != null ? _address_city : ''} ${(_address_state = address.state) != null ? _address_state : ''} ${(_address_postalCode = address.postalCode) != null ? _address_postalCode : ''}`,
+            address.country
+        ].filter(Boolean).map((part)=>escapeHtml(part)).join('<br/>')}</p>` : '') + `<table border="0" cellpadding="6">${rows}</table>`);
+        win.document.close();
+        // Print from the opener, not from an injected inline script (AGL-523) —
+        // the popup inherits this document's CSP, where an un-nonced inline
+        // script is blocked under the enforcing policy. Same reasoning as the POS
+        // receipt.
+        win.focus();
+        win.print();
+    }, [
+        order,
+        orderId
+    ]);
+    if (!order) return null;
+    const totals = order.totals;
+    const can = (to)=>CommerceModel.canTransitionOrder(order.status, to);
+    // A lost chargeback leaves `status: 'refunded'` (AGL-1787), so the status
+    // chip alone tells the merchant they chose this. The badge is the correction.
+    const dispute = CommerceModel.describeOrderDispute(order);
+    const reversal = CommerceModel.splitOrderReversal(order);
+    // The restock question a reversal flagged, while it is still open
+    // (AGL-1806). Absent `resolution` IS the open state — the writer only ever
+    // re-flags an answered check (AGL-1797).
+    const restock = order.restockCheck && !order.restockCheck.resolution ? order.restockCheck : null;
+    // Whether the reversal NAMED the lines this question is about (AGL-2325).
+    // AGL-2454 gave a refund a line selection, and `flagOrderRestock` now scopes
+    // the question to it — so the "we cannot tell which goods came back" caveat
+    // below is true of an amount-only reversal and false of this one. Asked of
+    // the order's own withdrawal record rather than of a flag on the check, so a
+    // prompt written before line indexes existed reads as the amount-only case
+    // it was.
+    const restockLinesNamed = Boolean((restock == null ? void 0 : (_restock_lines = restock.lines) == null ? void 0 : _restock_lines.length) && restock.lines.every((line)=>line.lineIndex != null && CommerceModel.orderLineRefunded(order, line.lineIndex)));
+    return /*#__PURE__*/ _jsxs(Dialog, {
+        open: true,
+        onClose: onClose,
+        maxWidth: "sm",
+        fullWidth: true,
+        children: [
+            /*#__PURE__*/ _jsx(DialogTitle, {
+                children: /*#__PURE__*/ _jsxs(Stack, {
+                    direction: "row",
+                    spacing: 1,
+                    sx: {
+                        alignItems: 'center'
+                    },
+                    children: [
+                        /*#__PURE__*/ _jsx("span", {
+                            children: `Order ${CommerceModel.formatOrderNumber(order, orderId)}`
+                        }),
+                        /*#__PURE__*/ _jsx(Chip, {
+                            label: order.status.replace('_', ' '),
+                            size: "small",
+                            color: (_STATUS_COLOR_order_status = STATUS_COLOR[order.status]) != null ? _STATUS_COLOR_order_status : 'default',
+                            variant: "outlined"
+                        }),
+                        dispute ? /*#__PURE__*/ _jsx(Tooltip, {
+                            title: dispute.detail,
+                            children: /*#__PURE__*/ _jsx(Chip, {
+                                label: dispute.label,
+                                size: "small",
+                                color: DISPUTE_COLOR[dispute.tone],
+                                variant: "filled"
+                            })
+                        }) : null,
+                        order.channel && order.channel !== 'online' ? /*#__PURE__*/ _jsx(Chip, {
+                            label: order.channel,
+                            size: "small",
+                            variant: "outlined"
+                        }) : null
+                    ]
+                })
+            }),
+            /*#__PURE__*/ _jsxs(DialogContent, {
+                sx: {
+                    display: 'flex',
+                    flexDirection: 'column',
+                    gap: 1.5
+                },
+                children: [
+                    /*#__PURE__*/ _jsx(Typography, {
+                        variant: "body2",
+                        color: "text.secondary",
+                        children: [
+                            order.customerName,
+                            order.customerEmail
+                        ].filter(Boolean).join(' · ') || 'Guest buyer'
+                    }),
+                    ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).map((line, index)=>{
+                        // WHAT THIS LINE IS STILL ENTITLED TO, per line (AGL-2454). A refund
+                        // used to be a number on the order and nothing more, so the merchant
+                        // could not see — and the product could not enforce — which goods had
+                        // come back.
+                        const withdrawn = CommerceModel.orderLineRefunded(order, index);
+                        return /*#__PURE__*/ _jsxs(Stack, {
+                            direction: "row",
+                            spacing: 1,
+                            sx: {
+                                alignItems: 'center'
+                            },
+                            children: [
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    sx: _extends({
+                                        flex: 1
+                                    }, withdrawn ? {
+                                        textDecoration: 'line-through'
+                                    } : {}),
+                                    color: withdrawn ? 'text.secondary' : 'text.primary',
+                                    children: `${line.quantity}× ${line.name}` + (line.variantLabel ? ` — ${line.variantLabel}` : '')
+                                }),
+                                withdrawn ? /*#__PURE__*/ _jsx(Chip, {
+                                    label: "refunded",
+                                    size: "small",
+                                    color: "error",
+                                    variant: "outlined"
+                                }) : can('refunded') && !CommerceModel.orderDisputeBlocksRefund(order) ? /*#__PURE__*/ _jsx(Button, {
+                                    size: "small",
+                                    color: "error",
+                                    disabled: busy,
+                                    onClick: ()=>handleRefund([
+                                            index
+                                        ]),
+                                    children: 'Refund line'
+                                }) : null,
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    children: usd(line.unitAmountCents * line.quantity)
+                                })
+                            ]
+                        }, index);
+                    }),
+                    CommerceModel.orderRefundState(order) !== 'none' ? // The state, said in words (AGL-2454). "Partially refunded, no lines
+                    // withdrawn" is the honest reading of an amount-only refund, and it
+                    // is what tells a merchant their buyer still has the downloads.
+                    /*#__PURE__*/ _jsx(Typography, {
+                        variant: "caption",
+                        color: "error",
+                        children: CommerceModel.orderRefundSummary(order)
+                    }) : null,
+                    totals ? /*#__PURE__*/ _jsxs(_Fragment, {
+                        children: [
+                            /*#__PURE__*/ _jsx(Divider, {}),
+                            [
+                                [
+                                    'Items',
+                                    totals.itemsCents
+                                ],
+                                [
+                                    'Shipping',
+                                    totals.shippingCents
+                                ],
+                                [
+                                    'Tax',
+                                    totals.taxCents
+                                ],
+                                [
+                                    'Discount',
+                                    -totals.discountCents
+                                ],
+                                [
+                                    'Total',
+                                    totals.totalCents
+                                ]
+                            ].map(([label, cents])=>/*#__PURE__*/ _jsxs(Stack, {
+                                    direction: "row",
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "body2",
+                                            sx: {
+                                                flex: 1
+                                            },
+                                            color: label === 'Total' ? 'text.primary' : 'text.secondary',
+                                            children: label
+                                        }),
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "body2",
+                                            sx: {
+                                                fontWeight: label === 'Total' ? 600 : 400
+                                            },
+                                            children: `${cents < 0 ? '-' : ''}${usd(Math.abs(cents))}`
+                                        })
+                                    ]
+                                }, label)),
+                            /*#__PURE__*/ _jsx(Typography, {
+                                variant: "caption",
+                                color: "text.secondary",
+                                children: CommerceModel.describeOrderTaxMode(order.taxMode)
+                            }),
+                            reversal.refundedCents ? /*#__PURE__*/ _jsx(Typography, {
+                                variant: "caption",
+                                color: "error",
+                                children: `Refunded ${usd(reversal.refundedCents)}`
+                            }) : null,
+                            reversal.chargedBackCents ? /*#__PURE__*/ _jsx(Typography, {
+                                variant: "caption",
+                                color: "error",
+                                children: `Charged back ${usd(reversal.chargedBackCents)}`
+                            }) : null
+                        ]
+                    }) : null,
+                    restock ? /*#__PURE__*/ _jsxs(_Fragment, {
+                        children: [
+                            /*#__PURE__*/ _jsx(Divider, {}),
+                            /*#__PURE__*/ _jsxs(Stack, {
+                                spacing: 0.5,
+                                children: [
+                                    /*#__PURE__*/ _jsx(Typography, {
+                                        variant: "subtitle2",
+                                        children: 'Restock check'
+                                    }),
+                                    /*#__PURE__*/ _jsx(Typography, {
+                                        variant: "body2",
+                                        color: "text.secondary",
+                                        children: `${restock.units} ${restock.units === 1 ? 'unit' : 'units'} may need restocking after this ${restock.kind === 'chargeback' ? 'chargeback' : 'refund'}.` + // The chargeback default is NO, same as the timeline's
+                                        // wording: the shopper kept the item and took the money.
+                                        (restock.kind === 'chargeback' ? ' The shopper kept the goods unless they actually came back.' : '') + // On a partial the flagged units are the MOST it could be —
+                                        // UNLESS the refund named its lines (AGL-2325), in which
+                                        // case the question is scoped to exactly those and the
+                                        // merchant is only being asked whether the goods came back.
+                                        (restock.fullyReversed ? '' : restockLinesNamed ? ' Only part of the money came back: these are the lines withdrawn by this refund, so the units are theirs — only you know whether the goods came back.' : ' Only part of the money came back, so these units are an upper bound — only you know which goods returned.')
+                                    }),
+                                    restock.lines.map((line, index)=>{
+                                        var _line_name;
+                                        return /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: `${line.quantity}× ${(_line_name = line.name) != null ? _line_name : line.productId}` + (line.variantLabel ? ` — ${line.variantLabel}` : '')
+                                        }, index);
+                                    }),
+                                    /*#__PURE__*/ _jsx(Typography, {
+                                        variant: "caption",
+                                        color: "text.secondary",
+                                        children: 'If goods came back, put them on the shelf with "Adjust ' + 'stock" in the products hub first — these answers move no ' + 'stock, they only clear this question.'
+                                    }),
+                                    /*#__PURE__*/ _jsxs(Stack, {
+                                        direction: "row",
+                                        spacing: 1,
+                                        children: [
+                                            /*#__PURE__*/ _jsx(Button, {
+                                                size: "small",
+                                                variant: "outlined",
+                                                disabled: busy,
+                                                onClick: ()=>handleRestockAnswer('restocked'),
+                                                children: 'Restocked'
+                                            }),
+                                            /*#__PURE__*/ _jsx(Button, {
+                                                size: "small",
+                                                disabled: busy,
+                                                onClick: ()=>handleRestockAnswer('dismissed'),
+                                                children: 'No restock'
+                                            })
+                                        ]
+                                    })
+                                ]
+                            })
+                        ]
+                    }) : null,
+                    /*#__PURE__*/ _jsx(Divider, {}),
+                    /*#__PURE__*/ _jsx(Typography, {
+                        variant: "subtitle2",
+                        children: 'Timeline'
+                    }),
+                    ((_order_timeline = order.timeline) != null ? _order_timeline : []).slice().reverse().map((event, index)=>/*#__PURE__*/ _jsx(Typography, {
+                            variant: "caption",
+                            color: "text.secondary",
+                            children: `${new Date(event.atMs).toLocaleString()} — ${event.event}` + (event.detail ? `: ${event.detail}` : '')
+                        }, index)),
+                    /*#__PURE__*/ _jsxs(Stack, {
+                        direction: "row",
+                        spacing: 1,
+                        children: [
+                            /*#__PURE__*/ _jsx(TextField, {
+                                label: "Add note",
+                                value: note,
+                                onChange: (event)=>setNote(event.target.value),
+                                size: "small",
+                                sx: {
+                                    flex: 1
+                                }
+                            }),
+                            /*#__PURE__*/ _jsx(Button, {
+                                size: "small",
+                                disabled: !note.trim(),
+                                onClick: handleNote,
+                                children: 'Add'
+                            })
+                        ]
+                    }),
+                    tracking ? /*#__PURE__*/ _jsxs(Stack, {
+                        direction: "row",
+                        spacing: 1,
+                        children: [
+                            /*#__PURE__*/ _jsx(TextField, {
+                                label: "Carrier",
+                                value: tracking.carrier,
+                                onChange: (event)=>setTracking(_extends({}, tracking, {
+                                        carrier: event.target.value
+                                    })),
+                                size: "small",
+                                sx: {
+                                    width: 140
+                                },
+                                placeholder: "UPS"
+                            }),
+                            /*#__PURE__*/ _jsx(TextField, {
+                                label: "Tracking number",
+                                value: tracking.number,
+                                onChange: (event)=>setTracking(_extends({}, tracking, {
+                                        number: event.target.value
+                                    })),
+                                size: "small",
+                                sx: {
+                                    flex: 1
+                                }
+                            }),
+                            /*#__PURE__*/ _jsx(Button, {
+                                size: "small",
+                                variant: "contained",
+                                color: "primary",
+                                disabled: busy,
+                                onClick: handleFulfill,
+                                children: 'Fulfill'
+                            })
+                        ]
+                    }) : null,
+                    order.paymentLinkUrl && order.status === 'pending' ? /*#__PURE__*/ _jsx(Button, {
+                        size: "small",
+                        sx: {
+                            alignSelf: 'flex-start'
+                        },
+                        onClick: ()=>{
+                            navigator.clipboard.writeText(String(order.paymentLinkUrl));
+                            enqueueSnackbar('Payment link copied', {
+                                variant: 'success',
+                                persist: false
+                            });
+                        },
+                        children: 'Copy payment link'
+                    }) : null
+                ]
+            }),
+            /*#__PURE__*/ _jsxs(DialogActions, {
+                children: [
+                    customerCrmHref ? /*#__PURE__*/ _jsx(Button, _extends({
+                        component: AppLink
+                    }, {
+                        componentVariant: 'naked',
+                        nativeButton: false
+                    }, {
+                        href: customerCrmHref,
+                        children: 'View customer in CRM'
+                    })) : null,
+                    /*#__PURE__*/ _jsx(Button, {
+                        onClick: handlePackingSlip,
+                        children: 'Packing slip'
+                    }),
+                    can('cancelled') ? /*#__PURE__*/ _jsx(Button, {
+                        color: "error",
+                        disabled: busy,
+                        onClick: handleCancel,
+                        children: 'Cancel order'
+                    }) : null,
+                    can('refunded') ? // Disabled on `orderDisputeBlocksRefund`, NOT the badge's broader
+                    // `orderHasOpenDispute` (AGL-1820): a formal open dispute means the
+                    // bank already pulled the funds and the route answers 409
+                    // (AGL-1809), while an open INQUIRY shows the badge but must keep
+                    // this button live — a full refund is how an inquiry is resolved.
+                    CommerceModel.orderDisputeBlocksRefund(order) ? /*#__PURE__*/ _jsx(Tooltip, {
+                        title: 'A chargeback is open on this order, and refunding would not' + ' withdraw it — the bank has already taken the disputed' + ' amount, so a refund on top would pay the shopper twice.' + ' Respond to the dispute or accept it in the Stripe' + ' dashboard; refund any remainder once it settles.',
+                        children: /*#__PURE__*/ _jsx("span", {
+                            children: /*#__PURE__*/ _jsx(Button, {
+                                color: "error",
+                                disabled: true,
+                                children: 'Refund'
+                            })
+                        })
+                    }) : /*#__PURE__*/ _jsx(Button, {
+                        color: "error",
+                        disabled: busy,
+                        onClick: ()=>handleRefund(),
+                        children: 'Refund'
+                    }) : null,
+                    (can('fulfilled') || can('partially_fulfilled')) && !tracking ? /*#__PURE__*/ _jsx(Button, {
+                        variant: "contained",
+                        color: "primary",
+                        onClick: ()=>setTracking({
+                                carrier: '',
+                                number: ''
+                            }),
+                        children: 'Fulfill…'
+                    }) : null,
+                    can('delivered') ? /*#__PURE__*/ _jsx(Button, {
+                        disabled: busy,
+                        onClick: handleDelivered,
+                        children: 'Mark delivered'
+                    }) : null,
+                    /*#__PURE__*/ _jsx(Button, {
+                        onClick: onClose,
+                        children: 'Close'
+                    })
+                ]
+            })
+        ]
+    });
+}
+OrderDetailDialog.displayName = 'OrderDetailDialog';
+export default OrderDetailDialog;
+
+//# sourceMappingURL=order-detail-dialog.component.js.map