@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/model/commerce-stock-holds.d.ts

@@ -0,0 +1,199 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { HostProduct } from './commerce';
+/**
+ * RESERVED STOCK: the arithmetic half of the checkout hold (AGL-2356).
+ *
+ * ## The defect this closes
+ *
+ * AGL-2320 made every stock decrement atomic, so a decrement is never LOST and
+ * the count never shows phantom stock. It could not make the storefront REFUSE
+ * an oversell, and said so: the gate and the decrement are minutes apart with
+ * money moving in between.
+ *
+ *   - `checkout.ts` / `cart-checkout.ts` called `canPurchase` against a plain
+ *     `.get()` when the Stripe Checkout Session was created. Nothing was
+ *     written, so there was no document to contend on — N concurrent shoppers
+ *     all read `inventory: 1`, all passed, and no locking discipline anywhere
+ *     could change that, because a read races nothing.
+ *   - the decrement happened in `billing-webhook.ts` when the session
+ *     completed. By then the shopper has paid, so refusing there would take
+ *     money and withhold goods — worse than the oversell.
+ *
+ * The only correct place to refuse is session creation, and refusing there
+ * requires WRITING. That is what a hold is: a unit spoken for by a live
+ * checkout, subtracted from what the next shopper is offered.
+ *
+ * ## Why the hold does not touch `inventory`
+ *
+ * `inventory` means UNITS ON THE SHELF and half the product reads it that way —
+ * the low-stock crossing alert, the restock queue, `reconcile-stock.ts`, the
+ * ledger's `appliedDelta` cap, the console's own count. A hold is not a unit
+ * leaving the shelf; it is a unit promised to someone who has not paid yet.
+ * Decrementing at hold time and "converting" at settlement would make every one
+ * of those readers wrong for the duration of a checkout, and would make a
+ * released hold indistinguishable from a restock in the ledger.
+ *
+ * So the shelf count is untouched and AVAILABILITY becomes a derived figure:
+ * `inventory` minus the live holds. `decrementVariantStock` is unchanged, which
+ * is the point — settlement is still the same single atomic decrement it was
+ * before this issue, and the hold is simply dropped afterwards.
+ *
+ * ## Why a lapsed hold is a release
+ *
+ * Every read prunes (`pruneStockHolds`), so a hold whose release never arrived
+ * lapses on its own the next time anybody asks. That is what makes a leaked
+ * hold a bounded inconvenience rather than the unbounded, invisible UNDER-sell
+ * this issue was held back for: stock is never stranded waiting on a webhook.
+ * The explicit release paths exist so the merchant and the shopper see the unit
+ * come back promptly, not because correctness depends on them.
+ */
+/** One live reservation on a product, keyed by checkout attempt. */
+export interface StockHold {
+    /** Wall-clock ms after which this hold is void. */
+    expiresAtMs: number;
+    /**
+     * Variant id → units held. A map and not a single number because one cart
+     * can hold two variants of one product, and a product document is the thing
+     * the transaction contends on — collapsing them would make a two-variant
+     * cart reserve the wrong shelf.
+     */
+    units?: Record<string, number>;
+}
+/**
+ * The product fields this file reads. Structural on purpose: `HostProduct`
+ * carries forty fields and the hold arithmetic must not be able to depend on
+ * any of them but these.
+ */
+export interface HeldStockProduct extends Pick<HostProduct, 'variants' | 'oversellPolicy'> {
+    /** Hold key → hold. Absent on every product written before AGL-2356. */
+    stockHolds?: Record<string, StockHold>;
+}
+/**
+ * HOW LONG A UNIT STAYS SPOKEN FOR.
+ *
+ * This number is not free to choose. A hold that lapses while its Checkout
+ * Session can still be PAID reopens the exact window this file closes: the
+ * shopper pays, the webhook decrements, and the unit was sold to someone else
+ * in between. So the floor is the session's own lifetime.
+ *
+ * Stripe's default session lifetime is 24 HOURS, and a 24-hour stock hold is
+ * precisely the trade this issue was blocked on — one abandoned cart standing
+ * on a merchant's last unit for a day. The resolution is not to shorten the
+ * hold below the session; it is to shorten the SESSION. `checkout.ts` and
+ * `cart-checkout.ts` now send `expires_at` at `CHECKOUT_SESSION_TTL_MS`, which
+ * is Stripe's own minimum and the same half-hour the bookings plugin has always
+ * given a held room.
+ *
+ * The hold then outlives the session by `STOCK_HOLD_GRACE_MS`, so the ordering
+ * is always: session dies → `checkout.session.expired` releases → the hold was
+ * still standing when it did. The grace is what keeps clock skew between Stripe
+ * and this process from lapsing a hold under a session that is still payable.
+ */
+/**
+ * 31 minutes, not 30. Stripe REJECTS an `expires_at` less than 30 minutes in
+ * the future, and it measures against its own clock at the moment the request
+ * lands — so a value computed here at exactly the floor fails whenever network
+ * latency or clock skew eats a second. The extra minute is the margin; it is
+ * not a product opinion, and the product opinion is "the shortest session
+ * Stripe will sell us".
+ */
+export declare const CHECKOUT_SESSION_TTL_MS: number;
+/** Cushion between the session expiring and its hold lapsing. */
+export declare const STOCK_HOLD_GRACE_MS: number;
+export declare const STOCK_HOLD_TTL_MS: number;
+/**
+ * What a shopper is told when the units exist but are spoken for.
+ *
+ * Deliberately NOT the bare "Sold out" the empty-shelf refusal uses. The
+ * merchant has stock; someone else is in checkout with it. Naming the wait is
+ * what stops a shopper concluding the store is empty and leaving — the hold
+ * lapses within the half hour and the unit comes back.
+ */
+export declare const STOCK_HELD_MESSAGE: string;
+/**
+ * The product's holds with the lapsed ones dropped.
+ *
+ * Total, not a filter over a trusted shape: a hold whose `expiresAtMs` is
+ * absent or non-numeric is treated as EXPIRED rather than eternal. A merchant
+ * losing a unit forever to one corrupt map entry is the only direction with no
+ * recovery inside the product, and it is exactly the failure mode that kept
+ * this issue out of the launch build.
+ */
+export declare function pruneStockHolds(holds: Record<string, StockHold> | undefined, nowMs: number): Record<string, StockHold>;
+/**
+ * Units of one variant spoken for by live checkouts right now.
+ *
+ * `exceptHoldKey` is how a retry of one attempt does not stand in its own way:
+ * the shopper presses the same button twice, the second press re-derives the
+ * same hold key, and without this exclusion it would be refused the unit it is
+ * already holding.
+ */
+export declare function heldVariantUnits(product: HeldStockProduct | undefined, variantId: string | undefined, nowMs: number, exceptHoldKey?: string): number;
+/** Units held across every variant of a product — the console's figure. */
+export declare function heldProductUnits(product: HeldStockProduct | undefined, nowMs: number): number;
+/**
+ * Units a NEW checkout could take: the shelf minus the live holds.
+ *
+ * `null` when there is no number to answer with — an untracked variant, a
+ * backorder product (whose merchant chose to sell past zero, so availability is
+ * unbounded by construction), or a variant that does not exist. `null` rather
+ * than `Infinity` so a caller cannot do arithmetic on "no limit" and get a
+ * number, and never negative: a shelf that went short under a `backorder`
+ * policy reads as zero available, not as a debt.
+ *
+ * NOTE FOR THIS REPO: `strictNullChecks` is off, so `if (!available)` does NOT
+ * distinguish `null` from `0` here — and `0` is a legitimate, load-bearing
+ * answer meaning "tracked, and none left". Every caller must test `== null`.
+ */
+export declare function availableVariantUnits(product: HeldStockProduct | undefined, variantId: string | undefined, nowMs: number, exceptHoldKey?: string): number | null;
+/**
+ * Is there a hold to take at all?
+ *
+ * False for the cases `availableVariantUnits` answers `null` for — an untracked
+ * or backorder variant has no finite shelf to reserve against, and writing a
+ * hold for one would put a growing map on a document whose availability it can
+ * never change. The same shape as `holdPromotionSlot` skipping an UNCAPPED
+ * promotion: the unlimited case stays off the write path entirely.
+ */
+export declare function stockIsReservable(product: HeldStockProduct | undefined, variantId: string | undefined, nowMs: number): boolean;
+/**
+ * Can this attempt reserve `quantity` units?
+ *
+ * The hold-aware twin of `canPurchase`, and it must agree with it everywhere
+ * `canPurchase` says NO: an untracked variant is always purchasable, a
+ * backorder product always is, a missing variant never is. The single
+ * difference is that a tracked deny-policy variant is measured against the
+ * shelf MINUS what live checkouts are already holding.
+ *
+ * `canPurchase` is still the first test rather than re-derived arithmetic, so
+ * the two cannot drift on the cases they share.
+ */
+export declare function canReserveStock(product: HeldStockProduct | undefined, variantId: string | undefined, quantity?: number, nowMs?: number, exceptHoldKey?: string): boolean;
+/**
+ * What the console prints beside a stock count (AGL-2356).
+ *
+ * The merchant-facing half of the decision, and the reason a hold is not just
+ * an internal optimisation. `inventory` deliberately does not move while a unit
+ * is held, so a merchant looking at "3 in stock" while the storefront refuses
+ * the third sale has no way to reason about it — the number is right and the
+ * behaviour looks wrong. This is what names the gap.
+ *
+ * Empty string when nothing is held, so the row stays exactly as it reads today
+ * on the overwhelming majority of products.
+ */
+export declare function stockHoldLabel(product: HeldStockProduct | undefined, nowMs?: number): string;

package/src/lib/model/commerce-stock-holds.js

@@ -0,0 +1,190 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { canPurchase } from "./commerce.js";
+/**
+ * HOW LONG A UNIT STAYS SPOKEN FOR.
+ *
+ * This number is not free to choose. A hold that lapses while its Checkout
+ * Session can still be PAID reopens the exact window this file closes: the
+ * shopper pays, the webhook decrements, and the unit was sold to someone else
+ * in between. So the floor is the session's own lifetime.
+ *
+ * Stripe's default session lifetime is 24 HOURS, and a 24-hour stock hold is
+ * precisely the trade this issue was blocked on — one abandoned cart standing
+ * on a merchant's last unit for a day. The resolution is not to shorten the
+ * hold below the session; it is to shorten the SESSION. `checkout.ts` and
+ * `cart-checkout.ts` now send `expires_at` at `CHECKOUT_SESSION_TTL_MS`, which
+ * is Stripe's own minimum and the same half-hour the bookings plugin has always
+ * given a held room.
+ *
+ * The hold then outlives the session by `STOCK_HOLD_GRACE_MS`, so the ordering
+ * is always: session dies → `checkout.session.expired` releases → the hold was
+ * still standing when it did. The grace is what keeps clock skew between Stripe
+ * and this process from lapsing a hold under a session that is still payable.
+ */ /**
+ * 31 minutes, not 30. Stripe REJECTS an `expires_at` less than 30 minutes in
+ * the future, and it measures against its own clock at the moment the request
+ * lands — so a value computed here at exactly the floor fails whenever network
+ * latency or clock skew eats a second. The extra minute is the margin; it is
+ * not a product opinion, and the product opinion is "the shortest session
+ * Stripe will sell us".
+ */ export const CHECKOUT_SESSION_TTL_MS = 31 * 60 * 1000;
+/** Cushion between the session expiring and its hold lapsing. */ export const STOCK_HOLD_GRACE_MS = 10 * 60 * 1000;
+export const STOCK_HOLD_TTL_MS = CHECKOUT_SESSION_TTL_MS + STOCK_HOLD_GRACE_MS;
+/**
+ * What a shopper is told when the units exist but are spoken for.
+ *
+ * Deliberately NOT the bare "Sold out" the empty-shelf refusal uses. The
+ * merchant has stock; someone else is in checkout with it. Naming the wait is
+ * what stops a shopper concluding the store is empty and leaving — the hold
+ * lapses within the half hour and the unit comes back.
+ */ export const STOCK_HELD_MESSAGE = 'The last of these is in someone else’s checkout. ' + 'Try again in a few minutes.';
+/**
+ * The product's holds with the lapsed ones dropped.
+ *
+ * Total, not a filter over a trusted shape: a hold whose `expiresAtMs` is
+ * absent or non-numeric is treated as EXPIRED rather than eternal. A merchant
+ * losing a unit forever to one corrupt map entry is the only direction with no
+ * recovery inside the product, and it is exactly the failure mode that kept
+ * this issue out of the launch build.
+ */ export function pruneStockHolds(holds, nowMs) {
+    const live = {};
+    for (const [key, hold] of Object.entries(holds != null ? holds : {})){
+        var _ref;
+        const expiresAtMs = Number(hold == null ? void 0 : hold.expiresAtMs);
+        if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) continue;
+        const units = {};
+        for (const [variantId, raw] of Object.entries((_ref = hold == null ? void 0 : hold.units) != null ? _ref : {})){
+            const count = Math.round(Number(raw));
+            // A non-numeric or non-positive count holds nothing. Coerced rather than
+            // trusted for the same reason as the expiry: a corrupt entry must not be
+            // able to reserve `NaN` units and make every comparison below false.
+            if (Number.isFinite(count) && count > 0) units[variantId] = count;
+        }
+        live[key] = {
+            expiresAtMs,
+            units
+        };
+    }
+    return live;
+}
+/**
+ * Units of one variant spoken for by live checkouts right now.
+ *
+ * `exceptHoldKey` is how a retry of one attempt does not stand in its own way:
+ * the shopper presses the same button twice, the second press re-derives the
+ * same hold key, and without this exclusion it would be refused the unit it is
+ * already holding.
+ */ export function heldVariantUnits(product, variantId, nowMs, exceptHoldKey) {
+    if (!variantId) return 0;
+    const live = pruneStockHolds(product == null ? void 0 : product.stockHolds, nowMs);
+    if (exceptHoldKey) delete live[exceptHoldKey];
+    let held = 0;
+    for (const hold of Object.values(live)){
+        var _ref;
+        var _hold_units;
+        held += Number((_ref = (_hold_units = hold.units) == null ? void 0 : _hold_units[variantId]) != null ? _ref : 0);
+    }
+    return held;
+}
+/** Units held across every variant of a product — the console's figure. */ export function heldProductUnits(product, nowMs) {
+    let held = 0;
+    for (const hold of Object.values(pruneStockHolds(product == null ? void 0 : product.stockHolds, nowMs))){
+        var _hold_units;
+        for (const units of Object.values((_hold_units = hold.units) != null ? _hold_units : {}))held += Number(units);
+    }
+    return held;
+}
+/**
+ * Resolve the variant a purchase refers to, EXACTLY as `canPurchase` does.
+ *
+ * Shared rather than re-derived, because the pre-filter and the in-transaction
+ * re-check disagreeing about which variant they are talking about is a defect
+ * with no visible symptom until the wrong shelf goes negative.
+ */ function resolveVariant(product, variantId) {
+    var _product_variants, _product_variants1;
+    return variantId ? product == null ? void 0 : (_product_variants = product.variants) == null ? void 0 : _product_variants.find((item)=>item.id === variantId) : product == null ? void 0 : (_product_variants1 = product.variants) == null ? void 0 : _product_variants1[0];
+}
+/**
+ * Units a NEW checkout could take: the shelf minus the live holds.
+ *
+ * `null` when there is no number to answer with — an untracked variant, a
+ * backorder product (whose merchant chose to sell past zero, so availability is
+ * unbounded by construction), or a variant that does not exist. `null` rather
+ * than `Infinity` so a caller cannot do arithmetic on "no limit" and get a
+ * number, and never negative: a shelf that went short under a `backorder`
+ * policy reads as zero available, not as a debt.
+ *
+ * NOTE FOR THIS REPO: `strictNullChecks` is off, so `if (!available)` does NOT
+ * distinguish `null` from `0` here — and `0` is a legitimate, load-bearing
+ * answer meaning "tracked, and none left". Every caller must test `== null`.
+ */ export function availableVariantUnits(product, variantId, nowMs, exceptHoldKey) {
+    const variant = resolveVariant(product, variantId);
+    if (!variant) return null;
+    if (variant.inventory == null) return null;
+    if ((product == null ? void 0 : product.oversellPolicy) === 'backorder') return null;
+    const onShelf = Math.round(Number(variant.inventory));
+    if (!Number.isFinite(onShelf)) return null;
+    return Math.max(0, onShelf - heldVariantUnits(product, variant.id, nowMs, exceptHoldKey));
+}
+/**
+ * Is there a hold to take at all?
+ *
+ * False for the cases `availableVariantUnits` answers `null` for — an untracked
+ * or backorder variant has no finite shelf to reserve against, and writing a
+ * hold for one would put a growing map on a document whose availability it can
+ * never change. The same shape as `holdPromotionSlot` skipping an UNCAPPED
+ * promotion: the unlimited case stays off the write path entirely.
+ */ export function stockIsReservable(product, variantId, nowMs) {
+    return availableVariantUnits(product, variantId, nowMs) != null;
+}
+/**
+ * Can this attempt reserve `quantity` units?
+ *
+ * The hold-aware twin of `canPurchase`, and it must agree with it everywhere
+ * `canPurchase` says NO: an untracked variant is always purchasable, a
+ * backorder product always is, a missing variant never is. The single
+ * difference is that a tracked deny-policy variant is measured against the
+ * shelf MINUS what live checkouts are already holding.
+ *
+ * `canPurchase` is still the first test rather than re-derived arithmetic, so
+ * the two cannot drift on the cases they share.
+ */ export function canReserveStock(product, variantId, quantity = 1, nowMs = Date.now(), exceptHoldKey) {
+    if (!product) return false;
+    if (!canPurchase(product, variantId, quantity)) return false;
+    const available = availableVariantUnits(product, variantId, nowMs, exceptHoldKey);
+    // `== null`, never `!available` — see the note on `availableVariantUnits`.
+    if (available == null) return true;
+    return available >= Math.max(1, Math.round(Number(quantity) || 1));
+}
+/**
+ * What the console prints beside a stock count (AGL-2356).
+ *
+ * The merchant-facing half of the decision, and the reason a hold is not just
+ * an internal optimisation. `inventory` deliberately does not move while a unit
+ * is held, so a merchant looking at "3 in stock" while the storefront refuses
+ * the third sale has no way to reason about it — the number is right and the
+ * behaviour looks wrong. This is what names the gap.
+ *
+ * Empty string when nothing is held, so the row stays exactly as it reads today
+ * on the overwhelming majority of products.
+ */ export function stockHoldLabel(product, nowMs = Date.now()) {
+    const held = heldProductUnits(product, nowMs);
+    if (held <= 0) return '';
+    return `${held} reserved in checkout`;
+}
+
+//# sourceMappingURL=commerce-stock-holds.js.map

package/src/lib/model/commerce-stock-holds.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/model/commerce-stock-holds.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { HostProduct } from './commerce'\nimport { canPurchase } from './commerce'\n\n/**\n * RESERVED STOCK: the arithmetic half of the checkout hold (AGL-2356).\n *\n * ## The defect this closes\n *\n * AGL-2320 made every stock decrement atomic, so a decrement is never LOST and\n * the count never shows phantom stock. It could not make the storefront REFUSE\n * an oversell, and said so: the gate and the decrement are minutes apart with\n * money moving in between.\n *\n *   - `checkout.ts` / `cart-checkout.ts` called `canPurchase` against a plain\n *     `.get()` when the Stripe Checkout Session was created. Nothing was\n *     written, so there was no document to contend on — N concurrent shoppers\n *     all read `inventory: 1`, all passed, and no locking discipline anywhere\n *     could change that, because a read races nothing.\n *   - the decrement happened in `billing-webhook.ts` when the session\n *     completed. By then the shopper has paid, so refusing there would take\n *     money and withhold goods — worse than the oversell.\n *\n * The only correct place to refuse is session creation, and refusing there\n * requires WRITING. That is what a hold is: a unit spoken for by a live\n * checkout, subtracted from what the next shopper is offered.\n *\n * ## Why the hold does not touch `inventory`\n *\n * `inventory` means UNITS ON THE SHELF and half the product reads it that way —\n * the low-stock crossing alert, the restock queue, `reconcile-stock.ts`, the\n * ledger's `appliedDelta` cap, the console's own count. A hold is not a unit\n * leaving the shelf; it is a unit promised to someone who has not paid yet.\n * Decrementing at hold time and \"converting\" at settlement would make every one\n * of those readers wrong for the duration of a checkout, and would make a\n * released hold indistinguishable from a restock in the ledger.\n *\n * So the shelf count is untouched and AVAILABILITY becomes a derived figure:\n * `inventory` minus the live holds. `decrementVariantStock` is unchanged, which\n * is the point — settlement is still the same single atomic decrement it was\n * before this issue, and the hold is simply dropped afterwards.\n *\n * ## Why a lapsed hold is a release\n *\n * Every read prunes (`pruneStockHolds`), so a hold whose release never arrived\n * lapses on its own the next time anybody asks. That is what makes a leaked\n * hold a bounded inconvenience rather than the unbounded, invisible UNDER-sell\n * this issue was held back for: stock is never stranded waiting on a webhook.\n * The explicit release paths exist so the merchant and the shopper see the unit\n * come back promptly, not because correctness depends on them.\n */\n\n/** One live reservation on a product, keyed by checkout attempt. */\nexport interface StockHold {\n  /** Wall-clock ms after which this hold is void. */\n  expiresAtMs: number\n  /**\n   * Variant id → units held. A map and not a single number because one cart\n   * can hold two variants of one product, and a product document is the thing\n   * the transaction contends on — collapsing them would make a two-variant\n   * cart reserve the wrong shelf.\n   */\n  units?: Record<string, number>\n}\n\n/**\n * The product fields this file reads. Structural on purpose: `HostProduct`\n * carries forty fields and the hold arithmetic must not be able to depend on\n * any of them but these.\n */\nexport interface HeldStockProduct extends Pick<\n  HostProduct,\n  'variants' | 'oversellPolicy'\n> {\n  /** Hold key → hold. Absent on every product written before AGL-2356. */\n  stockHolds?: Record<string, StockHold>\n}\n\n/**\n * HOW LONG A UNIT STAYS SPOKEN FOR.\n *\n * This number is not free to choose. A hold that lapses while its Checkout\n * Session can still be PAID reopens the exact window this file closes: the\n * shopper pays, the webhook decrements, and the unit was sold to someone else\n * in between. So the floor is the session's own lifetime.\n *\n * Stripe's default session lifetime is 24 HOURS, and a 24-hour stock hold is\n * precisely the trade this issue was blocked on — one abandoned cart standing\n * on a merchant's last unit for a day. The resolution is not to shorten the\n * hold below the session; it is to shorten the SESSION. `checkout.ts` and\n * `cart-checkout.ts` now send `expires_at` at `CHECKOUT_SESSION_TTL_MS`, which\n * is Stripe's own minimum and the same half-hour the bookings plugin has always\n * given a held room.\n *\n * The hold then outlives the session by `STOCK_HOLD_GRACE_MS`, so the ordering\n * is always: session dies → `checkout.session.expired` releases → the hold was\n * still standing when it did. The grace is what keeps clock skew between Stripe\n * and this process from lapsing a hold under a session that is still payable.\n */\n/**\n * 31 minutes, not 30. Stripe REJECTS an `expires_at` less than 30 minutes in\n * the future, and it measures against its own clock at the moment the request\n * lands — so a value computed here at exactly the floor fails whenever network\n * latency or clock skew eats a second. The extra minute is the margin; it is\n * not a product opinion, and the product opinion is \"the shortest session\n * Stripe will sell us\".\n */\nexport const CHECKOUT_SESSION_TTL_MS = 31 * 60 * 1000\n\n/** Cushion between the session expiring and its hold lapsing. */\nexport const STOCK_HOLD_GRACE_MS = 10 * 60 * 1000\n\nexport const STOCK_HOLD_TTL_MS = CHECKOUT_SESSION_TTL_MS + STOCK_HOLD_GRACE_MS\n\n/**\n * What a shopper is told when the units exist but are spoken for.\n *\n * Deliberately NOT the bare \"Sold out\" the empty-shelf refusal uses. The\n * merchant has stock; someone else is in checkout with it. Naming the wait is\n * what stops a shopper concluding the store is empty and leaving — the hold\n * lapses within the half hour and the unit comes back.\n */\nexport const STOCK_HELD_MESSAGE =\n  'The last of these is in someone else’s checkout. ' +\n  'Try again in a few minutes.'\n\n/**\n * The product's holds with the lapsed ones dropped.\n *\n * Total, not a filter over a trusted shape: a hold whose `expiresAtMs` is\n * absent or non-numeric is treated as EXPIRED rather than eternal. A merchant\n * losing a unit forever to one corrupt map entry is the only direction with no\n * recovery inside the product, and it is exactly the failure mode that kept\n * this issue out of the launch build.\n */\nexport function pruneStockHolds(\n  holds: Record<string, StockHold> | undefined,\n  nowMs: number,\n): Record<string, StockHold> {\n  const live: Record<string, StockHold> = {}\n  for (const [key, hold] of Object.entries(holds ?? {})) {\n    const expiresAtMs = Number(hold?.expiresAtMs)\n    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) continue\n    const units: Record<string, number> = {}\n    for (const [variantId, raw] of Object.entries(hold?.units ?? {})) {\n      const count = Math.round(Number(raw))\n      // A non-numeric or non-positive count holds nothing. Coerced rather than\n      // trusted for the same reason as the expiry: a corrupt entry must not be\n      // able to reserve `NaN` units and make every comparison below false.\n      if (Number.isFinite(count) && count > 0) units[variantId] = count\n    }\n    live[key] = { expiresAtMs, units }\n  }\n  return live\n}\n\n/**\n * Units of one variant spoken for by live checkouts right now.\n *\n * `exceptHoldKey` is how a retry of one attempt does not stand in its own way:\n * the shopper presses the same button twice, the second press re-derives the\n * same hold key, and without this exclusion it would be refused the unit it is\n * already holding.\n */\nexport function heldVariantUnits(\n  product: HeldStockProduct | undefined,\n  variantId: string | undefined,\n  nowMs: number,\n  exceptHoldKey?: string,\n): number {\n  if (!variantId) return 0\n  const live = pruneStockHolds(product?.stockHolds, nowMs)\n  if (exceptHoldKey) delete live[exceptHoldKey]\n  let held = 0\n  for (const hold of Object.values(live)) {\n    held += Number(hold.units?.[variantId] ?? 0)\n  }\n  return held\n}\n\n/** Units held across every variant of a product — the console's figure. */\nexport function heldProductUnits(\n  product: HeldStockProduct | undefined,\n  nowMs: number,\n): number {\n  let held = 0\n  for (const hold of Object.values(\n    pruneStockHolds(product?.stockHolds, nowMs),\n  )) {\n    for (const units of Object.values(hold.units ?? {})) held += Number(units)\n  }\n  return held\n}\n\n/**\n * Resolve the variant a purchase refers to, EXACTLY as `canPurchase` does.\n *\n * Shared rather than re-derived, because the pre-filter and the in-transaction\n * re-check disagreeing about which variant they are talking about is a defect\n * with no visible symptom until the wrong shelf goes negative.\n */\nfunction resolveVariant(\n  product: HeldStockProduct | undefined,\n  variantId: string | undefined,\n) {\n  return variantId\n    ? product?.variants?.find((item) => item.id === variantId)\n    : product?.variants?.[0]\n}\n\n/**\n * Units a NEW checkout could take: the shelf minus the live holds.\n *\n * `null` when there is no number to answer with — an untracked variant, a\n * backorder product (whose merchant chose to sell past zero, so availability is\n * unbounded by construction), or a variant that does not exist. `null` rather\n * than `Infinity` so a caller cannot do arithmetic on \"no limit\" and get a\n * number, and never negative: a shelf that went short under a `backorder`\n * policy reads as zero available, not as a debt.\n *\n * NOTE FOR THIS REPO: `strictNullChecks` is off, so `if (!available)` does NOT\n * distinguish `null` from `0` here — and `0` is a legitimate, load-bearing\n * answer meaning \"tracked, and none left\". Every caller must test `== null`.\n */\nexport function availableVariantUnits(\n  product: HeldStockProduct | undefined,\n  variantId: string | undefined,\n  nowMs: number,\n  exceptHoldKey?: string,\n): number | null {\n  const variant = resolveVariant(product, variantId)\n  if (!variant) return null\n  if (variant.inventory == null) return null\n  if (product?.oversellPolicy === 'backorder') return null\n  const onShelf = Math.round(Number(variant.inventory))\n  if (!Number.isFinite(onShelf)) return null\n  return Math.max(\n    0,\n    onShelf - heldVariantUnits(product, variant.id, nowMs, exceptHoldKey),\n  )\n}\n\n/**\n * Is there a hold to take at all?\n *\n * False for the cases `availableVariantUnits` answers `null` for — an untracked\n * or backorder variant has no finite shelf to reserve against, and writing a\n * hold for one would put a growing map on a document whose availability it can\n * never change. The same shape as `holdPromotionSlot` skipping an UNCAPPED\n * promotion: the unlimited case stays off the write path entirely.\n */\nexport function stockIsReservable(\n  product: HeldStockProduct | undefined,\n  variantId: string | undefined,\n  nowMs: number,\n): boolean {\n  return availableVariantUnits(product, variantId, nowMs) != null\n}\n\n/**\n * Can this attempt reserve `quantity` units?\n *\n * The hold-aware twin of `canPurchase`, and it must agree with it everywhere\n * `canPurchase` says NO: an untracked variant is always purchasable, a\n * backorder product always is, a missing variant never is. The single\n * difference is that a tracked deny-policy variant is measured against the\n * shelf MINUS what live checkouts are already holding.\n *\n * `canPurchase` is still the first test rather than re-derived arithmetic, so\n * the two cannot drift on the cases they share.\n */\nexport function canReserveStock(\n  product: HeldStockProduct | undefined,\n  variantId: string | undefined,\n  quantity = 1,\n  nowMs: number = Date.now(),\n  exceptHoldKey?: string,\n): boolean {\n  if (!product) return false\n  if (!canPurchase(product as HostProduct, variantId, quantity)) return false\n  const available = availableVariantUnits(\n    product,\n    variantId,\n    nowMs,\n    exceptHoldKey,\n  )\n  // `== null`, never `!available` — see the note on `availableVariantUnits`.\n  if (available == null) return true\n  return available >= Math.max(1, Math.round(Number(quantity) || 1))\n}\n\n/**\n * What the console prints beside a stock count (AGL-2356).\n *\n * The merchant-facing half of the decision, and the reason a hold is not just\n * an internal optimisation. `inventory` deliberately does not move while a unit\n * is held, so a merchant looking at \"3 in stock\" while the storefront refuses\n * the third sale has no way to reason about it — the number is right and the\n * behaviour looks wrong. This is what names the gap.\n *\n * Empty string when nothing is held, so the row stays exactly as it reads today\n * on the overwhelming majority of products.\n */\nexport function stockHoldLabel(\n  product: HeldStockProduct | undefined,\n  nowMs: number = Date.now(),\n): string {\n  const held = heldProductUnits(product, nowMs)\n  if (held <= 0) return ''\n  return `${held} reserved in checkout`\n}\n"],"names":["canPurchase","CHECKOUT_SESSION_TTL_MS","STOCK_HOLD_GRACE_MS","STOCK_HOLD_TTL_MS","STOCK_HELD_MESSAGE","pruneStockHolds","holds","nowMs","live","key","hold","Object","entries","expiresAtMs","Number","isFinite","units","variantId","raw","count","Math","round","heldVariantUnits","product","exceptHoldKey","stockHolds","held","values","heldProductUnits","resolveVariant","variants","find","item","id","availableVariantUnits","variant","inventory","oversellPolicy","onShelf","max","stockIsReservable","canReserveStock","quantity","Date","now","available","stockHoldLabel"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,WAAW,QAAQ,gBAAY;AA4ExC;;;;;;;;;;;;;;;;;;;;CAoBC,GACD;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0B,KAAK,KAAK,KAAI;AAErD,+DAA+D,GAC/D,OAAO,MAAMC,sBAAsB,KAAK,KAAK,KAAI;AAEjD,OAAO,MAAMC,oBAAoBF,0BAA0BC,oBAAmB;AAE9E;;;;;;;CAOC,GACD,OAAO,MAAME,qBACX,sDACA,8BAA6B;AAE/B;;;;;;;;CAQC,GACD,OAAO,SAASC,gBACdC,KAA4C,EAC5CC,KAAa;IAEb,MAAMC,OAAkC,CAAC;IACzC,KAAK,MAAM,CAACC,KAAKC,KAAK,IAAIC,OAAOC,OAAO,CAACN,gBAAAA,QAAS,CAAC,GAAI;;QACrD,MAAMO,cAAcC,OAAOJ,wBAAAA,KAAMG,WAAW;QAC5C,IAAI,CAACC,OAAOC,QAAQ,CAACF,gBAAgBA,eAAeN,OAAO;QAC3D,MAAMS,QAAgC,CAAC;QACvC,KAAK,MAAM,CAACC,WAAWC,IAAI,IAAIP,OAAOC,OAAO,SAACF,wBAAAA,KAAMM,KAAK,mBAAI,CAAC,GAAI;YAChE,MAAMG,QAAQC,KAAKC,KAAK,CAACP,OAAOI;YAChC,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,IAAIJ,OAAOC,QAAQ,CAACI,UAAUA,QAAQ,GAAGH,KAAK,CAACC,UAAU,GAAGE;QAC9D;QACAX,IAAI,CAACC,IAAI,GAAG;YAAEI;YAAaG;QAAM;IACnC;IACA,OAAOR;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAASc,iBACdC,OAAqC,EACrCN,SAA6B,EAC7BV,KAAa,EACbiB,aAAsB;IAEtB,IAAI,CAACP,WAAW,OAAO;IACvB,MAAMT,OAAOH,gBAAgBkB,2BAAAA,QAASE,UAAU,EAAElB;IAClD,IAAIiB,eAAe,OAAOhB,IAAI,CAACgB,cAAc;IAC7C,IAAIE,OAAO;IACX,KAAK,MAAMhB,QAAQC,OAAOgB,MAAM,CAACnB,MAAO;;YACvBE;QAAfgB,QAAQZ,gBAAOJ,cAAAA,KAAKM,KAAK,qBAAVN,WAAY,CAACO,UAAU,mBAAI;IAC5C;IACA,OAAOS;AACT;AAEA,yEAAyE,GACzE,OAAO,SAASE,iBACdL,OAAqC,EACrChB,KAAa;IAEb,IAAImB,OAAO;IACX,KAAK,MAAMhB,QAAQC,OAAOgB,MAAM,CAC9BtB,gBAAgBkB,2BAAAA,QAASE,UAAU,EAAElB,QACpC;YACiCG;QAAlC,KAAK,MAAMM,SAASL,OAAOgB,MAAM,EAACjB,cAAAA,KAAKM,KAAK,YAAVN,cAAc,CAAC,GAAIgB,QAAQZ,OAAOE;IACtE;IACA,OAAOU;AACT;AAEA;;;;;;CAMC,GACD,SAASG,eACPN,OAAqC,EACrCN,SAA6B;QAGzBM,mBACAA;IAFJ,OAAON,YACHM,4BAAAA,oBAAAA,QAASO,QAAQ,qBAAjBP,kBAAmBQ,IAAI,CAAC,CAACC,OAASA,KAAKC,EAAE,KAAKhB,aAC9CM,4BAAAA,qBAAAA,QAASO,QAAQ,qBAAjBP,kBAAmB,CAAC,EAAE;AAC5B;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASW,sBACdX,OAAqC,EACrCN,SAA6B,EAC7BV,KAAa,EACbiB,aAAsB;IAEtB,MAAMW,UAAUN,eAAeN,SAASN;IACxC,IAAI,CAACkB,SAAS,OAAO;IACrB,IAAIA,QAAQC,SAAS,IAAI,MAAM,OAAO;IACtC,IAAIb,CAAAA,2BAAAA,QAASc,cAAc,MAAK,aAAa,OAAO;IACpD,MAAMC,UAAUlB,KAAKC,KAAK,CAACP,OAAOqB,QAAQC,SAAS;IACnD,IAAI,CAACtB,OAAOC,QAAQ,CAACuB,UAAU,OAAO;IACtC,OAAOlB,KAAKmB,GAAG,CACb,GACAD,UAAUhB,iBAAiBC,SAASY,QAAQF,EAAE,EAAE1B,OAAOiB;AAE3D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASgB,kBACdjB,OAAqC,EACrCN,SAA6B,EAC7BV,KAAa;IAEb,OAAO2B,sBAAsBX,SAASN,WAAWV,UAAU;AAC7D;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASkC,gBACdlB,OAAqC,EACrCN,SAA6B,EAC7ByB,WAAW,CAAC,EACZnC,QAAgBoC,KAAKC,GAAG,EAAE,EAC1BpB,aAAsB;IAEtB,IAAI,CAACD,SAAS,OAAO;IACrB,IAAI,CAACvB,YAAYuB,SAAwBN,WAAWyB,WAAW,OAAO;IACtE,MAAMG,YAAYX,sBAChBX,SACAN,WACAV,OACAiB;IAEF,2EAA2E;IAC3E,IAAIqB,aAAa,MAAM,OAAO;IAC9B,OAAOA,aAAazB,KAAKmB,GAAG,CAAC,GAAGnB,KAAKC,KAAK,CAACP,OAAO4B,aAAa;AACjE;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASI,eACdvB,OAAqC,EACrChB,QAAgBoC,KAAKC,GAAG,EAAE;IAE1B,MAAMlB,OAAOE,iBAAiBL,SAAShB;IACvC,IAAImB,QAAQ,GAAG,OAAO;IACtB,OAAO,GAAGA,KAAK,qBAAqB,CAAC;AACvC"}

package/src/lib/model/commerce-subscription-status.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The TENANT-side live-subscription list — one copy, for the whole plugin
+ * (AGL-1849).
+ *
+ * ## Why this is not `isLiveSubscriptionStatus`
+ *
+ * AGL-1715-EXEMPT: this is a decision about the TENANT's own site members'
+ * subscriptions to the TENANT's products (`hosts/{hostId}/subscriptions`) — a
+ * different Stripe account, a different buyer and a different question from
+ * `isLiveSubscriptionStatus` in `@aglyn/aglyn`, which asks whether an Aglyn org
+ * is paying US. The words coincide only because both are Stripe subscription
+ * statuses. Converging them would tie a shopper's access to a tenant's store to
+ * Aglyn's own billing rules, so the two stay apart deliberately.
+ *
+ * ## Why it is its own file
+ *
+ * It used to be two private `LIVE_STATUSES` sets, in `server/gate.ts` and
+ * `server/member-post.ts`, each carrying its own copy of the marker and its own
+ * allowlist entry. Two copies of a list that decides who has already paid is
+ * the shape AGL-1715 exists to prevent, and the third caller — the
+ * duplicate-subscription guard in `server/checkout.ts` — would have made it
+ * three. Hoisting it to the model gives the tenant side the same single source
+ * the org side has, rather than a fourth transcription of the same three words.
+ *
+ * ## Why `past_due` counts as live
+ *
+ * A subscription in dunning is still a subscription: Stripe is retrying the
+ * card, the member has not cancelled, and access has not lapsed. Dropping it
+ * would revoke a paying member's content the moment a card expired, and — for
+ * the checkout guard — would invite them to buy a SECOND subscription to a
+ * product they are already being billed for, which is precisely the duplicate
+ * this list is used to refuse.
+ *
+ * A cancelled or `incomplete_expired` subscription is NOT live, and that is
+ * equally load-bearing: a member who cancelled must be able to re-subscribe.
+ * A guard built on "has a subscription row" instead of "has a LIVE one" would
+ * lock them out forever (the AGL-1715 lesson, restated on the tenant side).
+ */
+export declare const TENANT_LIVE_SUBSCRIPTION_STATUSES: readonly ["active", "trialing", "past_due"];
+export type TenantLiveSubscriptionStatus = (typeof TENANT_LIVE_SUBSCRIPTION_STATUSES)[number];
+/**
+ * Is this tenant-side subscription status one that still grants access / still
+ * counts as an existing subscription?
+ *
+ * Takes `unknown` on purpose: every caller reads it straight off a Firestore
+ * snapshot, where the field may be absent, a number, or anything else a bad
+ * write left behind. Narrowing here means no caller has to `String(...)` it
+ * defensively and get a `'undefined'` that quietly fails the test for the
+ * wrong reason.
+ */
+export declare function isTenantSubscriptionLive(status: unknown): boolean;

package/src/lib/model/commerce-subscription-status.js

@@ -0,0 +1,76 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The TENANT-side live-subscription list — one copy, for the whole plugin
+ * (AGL-1849).
+ *
+ * ## Why this is not `isLiveSubscriptionStatus`
+ *
+ * AGL-1715-EXEMPT: this is a decision about the TENANT's own site members'
+ * subscriptions to the TENANT's products (`hosts/{hostId}/subscriptions`) — a
+ * different Stripe account, a different buyer and a different question from
+ * `isLiveSubscriptionStatus` in `@aglyn/aglyn`, which asks whether an Aglyn org
+ * is paying US. The words coincide only because both are Stripe subscription
+ * statuses. Converging them would tie a shopper's access to a tenant's store to
+ * Aglyn's own billing rules, so the two stay apart deliberately.
+ *
+ * ## Why it is its own file
+ *
+ * It used to be two private `LIVE_STATUSES` sets, in `server/gate.ts` and
+ * `server/member-post.ts`, each carrying its own copy of the marker and its own
+ * allowlist entry. Two copies of a list that decides who has already paid is
+ * the shape AGL-1715 exists to prevent, and the third caller — the
+ * duplicate-subscription guard in `server/checkout.ts` — would have made it
+ * three. Hoisting it to the model gives the tenant side the same single source
+ * the org side has, rather than a fourth transcription of the same three words.
+ *
+ * ## Why `past_due` counts as live
+ *
+ * A subscription in dunning is still a subscription: Stripe is retrying the
+ * card, the member has not cancelled, and access has not lapsed. Dropping it
+ * would revoke a paying member's content the moment a card expired, and — for
+ * the checkout guard — would invite them to buy a SECOND subscription to a
+ * product they are already being billed for, which is precisely the duplicate
+ * this list is used to refuse.
+ *
+ * A cancelled or `incomplete_expired` subscription is NOT live, and that is
+ * equally load-bearing: a member who cancelled must be able to re-subscribe.
+ * A guard built on "has a subscription row" instead of "has a LIVE one" would
+ * lock them out forever (the AGL-1715 lesson, restated on the tenant side).
+ */ // AGL-1715-EXEMPT: the tenant side's own list, for the reasons set out above —
+// a tenant's site member subscribing to a tenant's product, on the tenant's
+// Stripe account. Not the Aglyn org's subscription to us, so not
+// `isLiveSubscriptionStatus`. (Restated here because the guard wants the marker
+// within 25 lines of the literal, and the reasoning above is longer than that.)
+export const TENANT_LIVE_SUBSCRIPTION_STATUSES = [
+    'active',
+    'trialing',
+    'past_due'
+];
+/**
+ * Is this tenant-side subscription status one that still grants access / still
+ * counts as an existing subscription?
+ *
+ * Takes `unknown` on purpose: every caller reads it straight off a Firestore
+ * snapshot, where the field may be absent, a number, or anything else a bad
+ * write left behind. Narrowing here means no caller has to `String(...)` it
+ * defensively and get a `'undefined'` that quietly fails the test for the
+ * wrong reason.
+ */ export function isTenantSubscriptionLive(status) {
+    return typeof status === 'string' && TENANT_LIVE_SUBSCRIPTION_STATUSES.includes(status);
+}
+
+//# sourceMappingURL=commerce-subscription-status.js.map

package/src/lib/model/commerce-subscription-status.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/model/commerce-subscription-status.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The TENANT-side live-subscription list — one copy, for the whole plugin\n * (AGL-1849).\n *\n * ## Why this is not `isLiveSubscriptionStatus`\n *\n * AGL-1715-EXEMPT: this is a decision about the TENANT's own site members'\n * subscriptions to the TENANT's products (`hosts/{hostId}/subscriptions`) — a\n * different Stripe account, a different buyer and a different question from\n * `isLiveSubscriptionStatus` in `@aglyn/aglyn`, which asks whether an Aglyn org\n * is paying US. The words coincide only because both are Stripe subscription\n * statuses. Converging them would tie a shopper's access to a tenant's store to\n * Aglyn's own billing rules, so the two stay apart deliberately.\n *\n * ## Why it is its own file\n *\n * It used to be two private `LIVE_STATUSES` sets, in `server/gate.ts` and\n * `server/member-post.ts`, each carrying its own copy of the marker and its own\n * allowlist entry. Two copies of a list that decides who has already paid is\n * the shape AGL-1715 exists to prevent, and the third caller — the\n * duplicate-subscription guard in `server/checkout.ts` — would have made it\n * three. Hoisting it to the model gives the tenant side the same single source\n * the org side has, rather than a fourth transcription of the same three words.\n *\n * ## Why `past_due` counts as live\n *\n * A subscription in dunning is still a subscription: Stripe is retrying the\n * card, the member has not cancelled, and access has not lapsed. Dropping it\n * would revoke a paying member's content the moment a card expired, and — for\n * the checkout guard — would invite them to buy a SECOND subscription to a\n * product they are already being billed for, which is precisely the duplicate\n * this list is used to refuse.\n *\n * A cancelled or `incomplete_expired` subscription is NOT live, and that is\n * equally load-bearing: a member who cancelled must be able to re-subscribe.\n * A guard built on \"has a subscription row\" instead of \"has a LIVE one\" would\n * lock them out forever (the AGL-1715 lesson, restated on the tenant side).\n */\n// AGL-1715-EXEMPT: the tenant side's own list, for the reasons set out above —\n// a tenant's site member subscribing to a tenant's product, on the tenant's\n// Stripe account. Not the Aglyn org's subscription to us, so not\n// `isLiveSubscriptionStatus`. (Restated here because the guard wants the marker\n// within 25 lines of the literal, and the reasoning above is longer than that.)\nexport const TENANT_LIVE_SUBSCRIPTION_STATUSES = [\n  'active',\n  'trialing',\n  'past_due',\n] as const\n\nexport type TenantLiveSubscriptionStatus =\n  (typeof TENANT_LIVE_SUBSCRIPTION_STATUSES)[number]\n\n/**\n * Is this tenant-side subscription status one that still grants access / still\n * counts as an existing subscription?\n *\n * Takes `unknown` on purpose: every caller reads it straight off a Firestore\n * snapshot, where the field may be absent, a number, or anything else a bad\n * write left behind. Narrowing here means no caller has to `String(...)` it\n * defensively and get a `'undefined'` that quietly fails the test for the\n * wrong reason.\n */\nexport function isTenantSubscriptionLive(status: unknown): boolean {\n  return (\n    typeof status === 'string' &&\n    (TENANT_LIVE_SUBSCRIPTION_STATUSES as readonly string[]).includes(status)\n  )\n}\n"],"names":["TENANT_LIVE_SUBSCRIPTION_STATUSES","isTenantSubscriptionLive","status","includes"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCC,GACD,+EAA+E;AAC/E,4EAA4E;AAC5E,iEAAiE;AACjE,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,MAAMA,oCAAoC;IAC/C;IACA;IACA;CACD,CAAS;AAKV;;;;;;;;;CASC,GACD,OAAO,SAASC,yBAAyBC,MAAe;IACtD,OACE,OAAOA,WAAW,YAClB,AAACF,kCAAwDG,QAAQ,CAACD;AAEtE"}