@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/cancel-order.d.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Cancelling an order RELEASES its stock (AGL-1808) — the opposite of what the
+ * reversal doors do, and for a structural reason rather than a preference.
+ *
+ * AGL-1797 refused to increment on a refund or a chargeback because the goods
+ * may well be gone: a refund with no return, or a shopper who kept the item and
+ * took the money, leaves stock that incrementing would INVENT. It flags and
+ * lets the merchant answer. Cancellation carries no such question, and the
+ * guarantee is `ORDER_TRANSITIONS`:
+ *
+ *     pending: ['paid', 'cancelled'],
+ *     paid:    ['partially_fulfilled', 'fulfilled', 'cancelled', 'refunded'],
+ *     partially_fulfilled | fulfilled | delivered: no 'cancelled'
+ *
+ * so a cancelled order was never fulfilled and nothing ever shipped. The units
+ * are still on the shelf; the only wrong number is ours.
+ *
+ * THE GUARANTEE HAD TO BE ENFORCED BEFORE IT COULD BE RELIED ON, and that is
+ * why this is a handler rather than a few lines in the console. The transition
+ * table said the right thing but nothing consulted it on the way IN: the order
+ * dialog cancelled with a client `updateDoc`, and `canTransitionOrder` only
+ * decided whether to render the button. The Firestore rules impose no status
+ * machine — an order update is allowed to any admin or editor — so a dialog
+ * held open while the order shipped in another tab (or any other client) could
+ * write `cancelled` straight onto a `fulfilled` order, and an automatic
+ * increment behind that would restock goods already in the post. Re-asking the
+ * transition INSIDE the transaction that writes the status is what turns the
+ * comment into a guarantee, and it is what makes the release safe.
+ *
+ * `pending` RELEASES NOTHING, which is the other half the issue's premise
+ * missed. Stock is decremented when the money lands, not when the order is
+ * written: `draft-order.ts` and the POS card path both open a `pending` order
+ * and decrement only in the webhook that pays it. Incrementing on a cancelled
+ * `pending` order would invent inventory exactly the way AGL-1797 refused to —
+ * so only a `paid` order, the one status reachable here whose sale provably
+ * decremented, releases anything.
+ *
+ * ONE LEDGER, NOT A SECOND STOCK WRITER. The increment goes through
+ * `adjustVariantInventory` and logs an `InventoryAdjustment` per line, the same
+ * pair the sale paths and the products hub's "Adjust stock" write, with the new
+ * `cancellation` reason and the `orderId`. An increment with no ledger row
+ * would leave the hub's stock history unable to explain a count that moved on
+ * its own — the mirror of AGL-1797's argument against writing a row for stock
+ * that had NOT moved.
+ *
+ * ONLY WHAT THE SALE DECREMENTED comes back: `resolveTrackedRestockLines`, the
+ * helper AGL-1797 already built, applies the sale path's own
+ * `variant.inventory != null` test to the products as they stand now. A store
+ * that tracks no stock gets a plain cancellation and no adjustment rows.
+ *
+ * IT FAILS THE CANCEL RATHER THAN LOSING THE RELEASE. `flagOrderRestock`
+ * swallows its errors because the money had already moved and the flag was a
+ * postscript; here the status flip and the stock write are one act, so they
+ * share a transaction and a failure leaves the order uncancelled for the
+ * merchant to retry. A cancelled order whose stock never came back is the
+ * original bug.
+ *
+ * ONCE. The transaction's own read is the guard: a second cancel — a retried
+ * request, two admins clicking together — finds `cancelled`, which
+ * `canTransitionOrder` cannot leave, and returns without touching stock. Two
+ * increments of the same units is the failure mode this shape exists to
+ * prevent, and it is measured rather than asserted (`cancel-order.spec.ts`).
+ *
+ * REACHED FROM THE CONSOLE since AGL-1818: `order-detail-dialog`'s
+ * `handleCancel` POSTs here with the console id token, and the client
+ * `updateDoc` cancel it replaced is gone. (The wiring landed separately from
+ * the route because the dialog belonged to a concurrent agent, AGL-1806,
+ * when the route was written.)
+ */
+export declare const cancelOrderHandler: PluginApiHandler;

package/src/lib/server/cancel-order.js

@@ -0,0 +1,368 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as CommerceModel from "../model/index.js";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { capRestockLines, resolveTrackedRestockLines, saleReleaseCaps } from "./restock-flag.js";
+/**
+ * Cancelling an order RELEASES its stock (AGL-1808) — the opposite of what the
+ * reversal doors do, and for a structural reason rather than a preference.
+ *
+ * AGL-1797 refused to increment on a refund or a chargeback because the goods
+ * may well be gone: a refund with no return, or a shopper who kept the item and
+ * took the money, leaves stock that incrementing would INVENT. It flags and
+ * lets the merchant answer. Cancellation carries no such question, and the
+ * guarantee is `ORDER_TRANSITIONS`:
+ *
+ *     pending: ['paid', 'cancelled'],
+ *     paid:    ['partially_fulfilled', 'fulfilled', 'cancelled', 'refunded'],
+ *     partially_fulfilled | fulfilled | delivered: no 'cancelled'
+ *
+ * so a cancelled order was never fulfilled and nothing ever shipped. The units
+ * are still on the shelf; the only wrong number is ours.
+ *
+ * THE GUARANTEE HAD TO BE ENFORCED BEFORE IT COULD BE RELIED ON, and that is
+ * why this is a handler rather than a few lines in the console. The transition
+ * table said the right thing but nothing consulted it on the way IN: the order
+ * dialog cancelled with a client `updateDoc`, and `canTransitionOrder` only
+ * decided whether to render the button. The Firestore rules impose no status
+ * machine — an order update is allowed to any admin or editor — so a dialog
+ * held open while the order shipped in another tab (or any other client) could
+ * write `cancelled` straight onto a `fulfilled` order, and an automatic
+ * increment behind that would restock goods already in the post. Re-asking the
+ * transition INSIDE the transaction that writes the status is what turns the
+ * comment into a guarantee, and it is what makes the release safe.
+ *
+ * `pending` RELEASES NOTHING, which is the other half the issue's premise
+ * missed. Stock is decremented when the money lands, not when the order is
+ * written: `draft-order.ts` and the POS card path both open a `pending` order
+ * and decrement only in the webhook that pays it. Incrementing on a cancelled
+ * `pending` order would invent inventory exactly the way AGL-1797 refused to —
+ * so only a `paid` order, the one status reachable here whose sale provably
+ * decremented, releases anything.
+ *
+ * ONE LEDGER, NOT A SECOND STOCK WRITER. The increment goes through
+ * `adjustVariantInventory` and logs an `InventoryAdjustment` per line, the same
+ * pair the sale paths and the products hub's "Adjust stock" write, with the new
+ * `cancellation` reason and the `orderId`. An increment with no ledger row
+ * would leave the hub's stock history unable to explain a count that moved on
+ * its own — the mirror of AGL-1797's argument against writing a row for stock
+ * that had NOT moved.
+ *
+ * ONLY WHAT THE SALE DECREMENTED comes back: `resolveTrackedRestockLines`, the
+ * helper AGL-1797 already built, applies the sale path's own
+ * `variant.inventory != null` test to the products as they stand now. A store
+ * that tracks no stock gets a plain cancellation and no adjustment rows.
+ *
+ * IT FAILS THE CANCEL RATHER THAN LOSING THE RELEASE. `flagOrderRestock`
+ * swallows its errors because the money had already moved and the flag was a
+ * postscript; here the status flip and the stock write are one act, so they
+ * share a transaction and a failure leaves the order uncancelled for the
+ * merchant to retry. A cancelled order whose stock never came back is the
+ * original bug.
+ *
+ * ONCE. The transaction's own read is the guard: a second cancel — a retried
+ * request, two admins clicking together — finds `cancelled`, which
+ * `canTransitionOrder` cannot leave, and returns without touching stock. Two
+ * increments of the same units is the failure mode this shape exists to
+ * prevent, and it is measured rather than asserted (`cancel-order.spec.ts`).
+ *
+ * REACHED FROM THE CONSOLE since AGL-1818: `order-detail-dialog`'s
+ * `handleCancel` POSTs here with the console id token, and the client
+ * `updateDoc` cancel it replaced is gone. (The wiring landed separately from
+ * the route because the dialog belonged to a concurrent agent, AGL-1806,
+ * when the route was written.)
+ */ export const cancelOrderHandler = async (req, res)=>{
+    var _req_headers_authorization, _req_body, _body_hostId, _body_orderId;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const hostId = String((_body_hostId = body.hostId) != null ? _body_hostId : '');
+    const orderId = String((_body_orderId = body.orderId) != null ? _body_orderId : '');
+    if (!hostId || !orderId) {
+        return res.status(400).json({
+            error: 'Missing hostId or orderId'
+        });
+    }
+    // Firestore reserves `__…__` ids and `.doc()` throws SYNCHRONOUSLY on one,
+    // which would surface as a 500 on a caller's typo rather than the 400 it is.
+    if (/^__.*__$/.test(hostId) || /^__.*__$/.test(orderId)) {
+        return res.status(400).json({
+            error: 'Missing hostId or orderId'
+        });
+    }
+    try {
+        var _hostSnapshot_get;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        // The role the CLIENT write already had, not a stricter one. Order updates
+        // fall through the rules' host catch-all, which admits `admin` and
+        // `editor` — narrowing to admin here would take the cancel button away
+        // from editors who have always had it, and widening it past what the rules
+        // allow would make this endpoint the way around them.
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin' && memberRole !== 'editor') {
+            return res.status(403).json({
+                error: 'Not permitted'
+            });
+        }
+        const orderRef = hostRef.collection('orders').doc(orderId);
+        const outcome = await firestore.runTransaction(async (transaction)=>{
+            var _snapshot_data, _order_checkoutSessionId;
+            const snapshot = await transaction.get(orderRef);
+            if (!snapshot.exists) {
+                return {
+                    status: 404,
+                    body: {
+                        error: 'Unknown order'
+                    }
+                };
+            }
+            const order = CommerceModel.liftLegacyOrder((_snapshot_data = snapshot.data()) != null ? _snapshot_data : {});
+            // A redelivered click, or the second of two admins. Answered as success
+            // because it IS the state the caller asked for — reporting 409 here
+            // teaches an admin that the cancel failed and invites a third attempt —
+            // but nothing is written, so the units are released exactly once.
+            if (order.status === 'cancelled') {
+                return {
+                    status: 200,
+                    body: {
+                        ok: true,
+                        alreadyCancelled: true,
+                        released: 0,
+                        units: 0
+                    }
+                };
+            }
+            if (!CommerceModel.canTransitionOrder(order.status, 'cancelled')) {
+                return {
+                    status: 409,
+                    body: {
+                        error: `Orders in "${order.status}" cannot cancel`
+                    }
+                };
+            }
+            // A POS CARD order's decrement happens in the webhook that pays it —
+            // and before AGL-1825 it did not happen AT ALL: the paying branch's
+            // decrement was gated on `productId` metadata the register's session
+            // never carried. Releasing such an order restocks units that were never
+            // taken, turning the silent under-count into a silent over-count. The
+            // sale's own ledger is the discriminator: every decrement pairs with a
+            // `reason: 'sale'` row (AGL-1807 closed the last hole, and the AGL-1825
+            // decrement writes them from day one), so a paid card order with no
+            // sale row is one whose sale took nothing — and nothing is released.
+            //
+            // Scoped to card orders (the `pos-card-pending` timeline event) rather
+            // than applied to every order, because one historical path decremented
+            // WITHOUT rows — draft links paid before AGL-1807 — and asking the
+            // ledger to vouch for those would wrongly strand their stock. The
+            // residual is stated plainly: the sibling-shaped decrement/ledger pair
+            // is two swallowed sequential writes, so a card order whose ledger add
+            // alone failed will not release — a bounded under-count on that one
+            // order, visible as a sale missing from the hub's history, against the
+            // alternative of inflating stock on every pre-fix cancel.
+            //
+            // One equality filter, so the automatic single-field index answers it;
+            // the reason test runs here, over the handful of rows one order has.
+            //
+            // THE SAME READ NOW ALSO BOUNDS HOW MUCH COMES BACK (AGL-2149), so it is
+            // no longer scoped to card orders. `adjustVariantInventory` floors at
+            // zero, and that floor silently absorbs the overshoot on a BACKORDER
+            // product: stock 0, `canPurchase` admits the sale because the policy says
+            // to, three units sell, `Math.max(0, 0 + -3)` leaves the count at 0 —
+            // and a `+3` here would hand the merchant three units nobody has and a
+            // stock badge offering them. The sale rows carry `appliedDelta` for
+            // exactly this: `delta` stays the units sold (the merchant's history),
+            // `appliedDelta` says how many the count could actually give up.
+            //
+            // Only lines the ledger DESCRIBES are capped. A pair the ledger says
+            // nothing about restores as before, which is what keeps the pre-AGL-1807
+            // draft links — decremented with no row at all — from having their stock
+            // stranded, and what keeps a single swallowed ledger write from turning
+            // into a lost restock on an unrelated line of the same order.
+            let saleDecremented = true;
+            // The cap rule itself lives beside the restock flag, which now bounds
+            // the question it ASKS by the same ledger this bounds the stock it
+            // RETURNS (AGL-2325). One implementation, so a prompt naming more units
+            // than a cancellation would put back is not expressible.
+            let releaseCap = new Map();
+            if (order.status === 'paid') {
+                var _order_timeline;
+                const orderAdjustments = await transaction.get(hostRef.collection('inventoryAdjustments').where('orderId', '==', orderId));
+                const saleRows = orderAdjustments.docs.filter((row)=>row.get('reason') === 'sale');
+                if (order.channel === 'pos' && ((_order_timeline = order.timeline) != null ? _order_timeline : []).some((event)=>event.event === 'pos-card-pending')) {
+                    saleDecremented = saleRows.length > 0;
+                }
+                releaseCap = saleReleaseCaps(saleRows);
+            }
+            // `paid` is the only status reachable here whose sale decremented; see
+            // the header. Reads happen before any write, as a transaction requires.
+            const { lines, products } = order.status === 'paid' && saleDecremented ? await resolveTrackedRestockLines(hostRef, order, (ref)=>transaction.get(ref)) : {
+                lines: [],
+                products: new Map()
+            };
+            const atMs = Date.now();
+            // Grouped by product, because two lines of one product (two variants, or
+            // the same variant twice) are two deltas against ONE document: writing
+            // them separately would compute both from the same read and land only
+            // the last, silently dropping units.
+            const byProduct = new Map();
+            // Never more than the sale actually took off the shelf (AGL-2149).
+            for (const line of capRestockLines(lines, releaseCap)){
+                var _byProduct_get;
+                byProduct.set(line.productId, [
+                    ...(_byProduct_get = byProduct.get(line.productId)) != null ? _byProduct_get : [],
+                    line
+                ]);
+            }
+            for (const [productId, productLines] of byProduct){
+                const product = products.get(productId);
+                if (!product) continue;
+                let variants = product.variants;
+                for (const line of productLines){
+                    variants = CommerceModel.adjustVariantInventory({
+                        variants
+                    }, line.variantId, line.quantity, // The bucket the sale came out of, for a location-tracked store
+                    // (AGL-286). Absent on every path that decremented the flat count,
+                    // where `adjustVariantInventory` puts it back the same way.
+                    order.locationId || undefined);
+                }
+                // `update()`, not `set(…, { merge: true })` as the sale paths use: the
+                // transaction has just read this product, so it exists, and a product
+                // deleted under us must not be conjured back as a stub holding nothing
+                // but a variants array.
+                transaction.update(hostRef.collection('products').doc(productId), {
+                    variants,
+                    inventory: CommerceModel.productInventory({
+                        variants
+                    }),
+                    updatedAtMs: atMs
+                });
+                for (const line of productLines){
+                    transaction.create(hostRef.collection('inventoryAdjustments').doc(), _extends({
+                        productId,
+                        variantId: line.variantId,
+                        delta: line.quantity,
+                        reason: 'cancellation',
+                        orderId
+                    }, order.locationId ? {
+                        locationId: order.locationId
+                    } : {}, {
+                        atMs
+                    }));
+                }
+            }
+            // From the CAPPED lines, not the order's, so the timeline reports what
+            // was actually put back (AGL-2149).
+            const releasedLines = [
+                ...byProduct.values()
+            ].flat();
+            const units = releasedLines.reduce((sum, line)=>sum + line.quantity, 0);
+            const patch = {
+                status: 'cancelled',
+                timeline: CommerceModel.appendOrderEvent(order, 'cancelled', units > 0 ? `${units} ${units === 1 ? 'unit' : 'units'} returned to stock` : undefined, atMs)
+            };
+            // An open restock question about THIS order's stock, raised by a partial
+            // refund before the cancellation (AGL-1797). The units it asked about are
+            // the ones just put back, so leaving it open would invite the merchant to
+            // restock them a second time from the order dialog — the double-count
+            // that flag exists to avoid. Answered with what actually happened.
+            if (units > 0 && order.restockCheck && !order.restockCheck.resolution) {
+                patch.restockCheck = _extends({}, order.restockCheck, {
+                    resolution: 'restocked',
+                    resolvedAtMs: atMs,
+                    resolvedBy: decoded.uid
+                });
+            }
+            transaction.update(orderRef, patch);
+            return {
+                status: 200,
+                body: {
+                    ok: true,
+                    released: releasedLines.length,
+                    units
+                },
+                // The live Stripe page this cancellation orphans, if any (AGL-2244).
+                // Read inside the transaction that flips the status so the expiry
+                // below cannot act on an order some other writer paid meanwhile.
+                expireSessionId: order.status === 'pending' ? (_order_checkoutSessionId = order.checkoutSessionId) != null ? _order_checkoutSessionId : '' : ''
+            };
+        });
+        // EXPIRE THE PAYMENT LINK (AGL-2244). Cancelling a `pending` draft order or
+        // POS card sale left its Checkout Session live: the URL is on the
+        // customer's phone or in the email the merchant sent, and Stripe keeps it
+        // payable for 24 hours. Paying it captured real money on the merchant's
+        // account and the completing webhook then discarded the event — its
+        // `status !== 'pending'` guard cannot tell a redelivery from a cancelled
+        // order — so the sale existed in Stripe and nowhere in the product: no
+        // order, no stock move, no contact, no notification, not even a timeline
+        // line. The webhook now says so when it happens; this is the half that
+        // stops it happening.
+        //
+        // OUTSIDE the transaction, because it is a network call, and best-effort
+        // by design: the cancellation itself already landed and is what the
+        // merchant asked for. A failure here leaves the pre-existing behaviour
+        // (a payable link) plus the webhook's new record of it, which is strictly
+        // better than failing a cancel that has already released stock. Stripe
+        // answers 400 for a session that is already expired or already paid, and
+        // both are states this has nothing to add to.
+        const expireSessionId = outcome.expireSessionId;
+        if (expireSessionId && process.env.STRIPE_SECRET_KEY) {
+            const expiry = await fetch(`https://api.stripe.com/v1/checkout/sessions/${expireSessionId}/expire`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
+                    'Content-Type': 'application/x-www-form-urlencoded'
+                }
+            }).catch(()=>null);
+            if (!(expiry == null ? void 0 : expiry.ok)) {
+                console.error('Cancelled order: Stripe session not expired, the payment link may still be payable', {
+                    hostId,
+                    orderId,
+                    sessionId: expireSessionId
+                });
+            }
+        }
+        return res.status(outcome.status).json(outcome.body);
+    } catch (error) {
+        // Nothing landed — the transaction is all-or-nothing — so the order is
+        // still open and the merchant can try again. Deliberately NOT the swallow
+        // `flagOrderRestock` uses: there the money had already moved and only a
+        // postscript was at risk; here a swallowed failure is a cancelled order
+        // whose stock never came back, which is the bug this closes.
+        console.error('cancelOrder failed', error);
+        return res.status(500).json({
+            error: 'Cancel failed'
+        });
+    }
+};
+
+//# sourceMappingURL=cancel-order.js.map

package/src/lib/server/cancel-order.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/cancel-order.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport {\n  capRestockLines,\n  resolveTrackedRestockLines,\n  saleReleaseCaps,\n} from './restock-flag'\n\n/**\n * Cancelling an order RELEASES its stock (AGL-1808) — the opposite of what the\n * reversal doors do, and for a structural reason rather than a preference.\n *\n * AGL-1797 refused to increment on a refund or a chargeback because the goods\n * may well be gone: a refund with no return, or a shopper who kept the item and\n * took the money, leaves stock that incrementing would INVENT. It flags and\n * lets the merchant answer. Cancellation carries no such question, and the\n * guarantee is `ORDER_TRANSITIONS`:\n *\n *     pending: ['paid', 'cancelled'],\n *     paid:    ['partially_fulfilled', 'fulfilled', 'cancelled', 'refunded'],\n *     partially_fulfilled | fulfilled | delivered: no 'cancelled'\n *\n * so a cancelled order was never fulfilled and nothing ever shipped. The units\n * are still on the shelf; the only wrong number is ours.\n *\n * THE GUARANTEE HAD TO BE ENFORCED BEFORE IT COULD BE RELIED ON, and that is\n * why this is a handler rather than a few lines in the console. The transition\n * table said the right thing but nothing consulted it on the way IN: the order\n * dialog cancelled with a client `updateDoc`, and `canTransitionOrder` only\n * decided whether to render the button. The Firestore rules impose no status\n * machine — an order update is allowed to any admin or editor — so a dialog\n * held open while the order shipped in another tab (or any other client) could\n * write `cancelled` straight onto a `fulfilled` order, and an automatic\n * increment behind that would restock goods already in the post. Re-asking the\n * transition INSIDE the transaction that writes the status is what turns the\n * comment into a guarantee, and it is what makes the release safe.\n *\n * `pending` RELEASES NOTHING, which is the other half the issue's premise\n * missed. Stock is decremented when the money lands, not when the order is\n * written: `draft-order.ts` and the POS card path both open a `pending` order\n * and decrement only in the webhook that pays it. Incrementing on a cancelled\n * `pending` order would invent inventory exactly the way AGL-1797 refused to —\n * so only a `paid` order, the one status reachable here whose sale provably\n * decremented, releases anything.\n *\n * ONE LEDGER, NOT A SECOND STOCK WRITER. The increment goes through\n * `adjustVariantInventory` and logs an `InventoryAdjustment` per line, the same\n * pair the sale paths and the products hub's \"Adjust stock\" write, with the new\n * `cancellation` reason and the `orderId`. An increment with no ledger row\n * would leave the hub's stock history unable to explain a count that moved on\n * its own — the mirror of AGL-1797's argument against writing a row for stock\n * that had NOT moved.\n *\n * ONLY WHAT THE SALE DECREMENTED comes back: `resolveTrackedRestockLines`, the\n * helper AGL-1797 already built, applies the sale path's own\n * `variant.inventory != null` test to the products as they stand now. A store\n * that tracks no stock gets a plain cancellation and no adjustment rows.\n *\n * IT FAILS THE CANCEL RATHER THAN LOSING THE RELEASE. `flagOrderRestock`\n * swallows its errors because the money had already moved and the flag was a\n * postscript; here the status flip and the stock write are one act, so they\n * share a transaction and a failure leaves the order uncancelled for the\n * merchant to retry. A cancelled order whose stock never came back is the\n * original bug.\n *\n * ONCE. The transaction's own read is the guard: a second cancel — a retried\n * request, two admins clicking together — finds `cancelled`, which\n * `canTransitionOrder` cannot leave, and returns without touching stock. Two\n * increments of the same units is the failure mode this shape exists to\n * prevent, and it is measured rather than asserted (`cancel-order.spec.ts`).\n *\n * REACHED FROM THE CONSOLE since AGL-1818: `order-detail-dialog`'s\n * `handleCancel` POSTs here with the console id token, and the client\n * `updateDoc` cancel it replaced is gone. (The wiring landed separately from\n * the route because the dialog belonged to a concurrent agent, AGL-1806,\n * when the route was written.)\n */\nexport const cancelOrderHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const orderId = String(body.orderId ?? '')\n  if (!hostId || !orderId) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n  // Firestore reserves `__…__` ids and `.doc()` throws SYNCHRONOUSLY on one,\n  // which would surface as a 500 on a caller's typo rather than the 400 it is.\n  if (/^__.*__$/.test(hostId) || /^__.*__$/.test(orderId)) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // The role the CLIENT write already had, not a stricter one. Order updates\n    // fall through the rules' host catch-all, which admits `admin` and\n    // `editor` — narrowing to admin here would take the cancel button away\n    // from editors who have always had it, and widening it past what the rules\n    // allow would make this endpoint the way around them.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not permitted' })\n    }\n    const orderRef = hostRef.collection('orders').doc(orderId)\n\n    const outcome = await firestore.runTransaction(async (transaction) => {\n      const snapshot = await transaction.get(orderRef)\n      if (!snapshot.exists) {\n        return { status: 404, body: { error: 'Unknown order' } }\n      }\n      const order = CommerceModel.liftLegacyOrder(\n        (snapshot.data() ?? {}) as never,\n      )\n      // A redelivered click, or the second of two admins. Answered as success\n      // because it IS the state the caller asked for — reporting 409 here\n      // teaches an admin that the cancel failed and invites a third attempt —\n      // but nothing is written, so the units are released exactly once.\n      if (order.status === 'cancelled') {\n        return {\n          status: 200,\n          body: { ok: true, alreadyCancelled: true, released: 0, units: 0 },\n        }\n      }\n      if (!CommerceModel.canTransitionOrder(order.status, 'cancelled')) {\n        return {\n          status: 409,\n          body: { error: `Orders in \"${order.status}\" cannot cancel` },\n        }\n      }\n\n      // A POS CARD order's decrement happens in the webhook that pays it —\n      // and before AGL-1825 it did not happen AT ALL: the paying branch's\n      // decrement was gated on `productId` metadata the register's session\n      // never carried. Releasing such an order restocks units that were never\n      // taken, turning the silent under-count into a silent over-count. The\n      // sale's own ledger is the discriminator: every decrement pairs with a\n      // `reason: 'sale'` row (AGL-1807 closed the last hole, and the AGL-1825\n      // decrement writes them from day one), so a paid card order with no\n      // sale row is one whose sale took nothing — and nothing is released.\n      //\n      // Scoped to card orders (the `pos-card-pending` timeline event) rather\n      // than applied to every order, because one historical path decremented\n      // WITHOUT rows — draft links paid before AGL-1807 — and asking the\n      // ledger to vouch for those would wrongly strand their stock. The\n      // residual is stated plainly: the sibling-shaped decrement/ledger pair\n      // is two swallowed sequential writes, so a card order whose ledger add\n      // alone failed will not release — a bounded under-count on that one\n      // order, visible as a sale missing from the hub's history, against the\n      // alternative of inflating stock on every pre-fix cancel.\n      //\n      // One equality filter, so the automatic single-field index answers it;\n      // the reason test runs here, over the handful of rows one order has.\n      //\n      // THE SAME READ NOW ALSO BOUNDS HOW MUCH COMES BACK (AGL-2149), so it is\n      // no longer scoped to card orders. `adjustVariantInventory` floors at\n      // zero, and that floor silently absorbs the overshoot on a BACKORDER\n      // product: stock 0, `canPurchase` admits the sale because the policy says\n      // to, three units sell, `Math.max(0, 0 + -3)` leaves the count at 0 —\n      // and a `+3` here would hand the merchant three units nobody has and a\n      // stock badge offering them. The sale rows carry `appliedDelta` for\n      // exactly this: `delta` stays the units sold (the merchant's history),\n      // `appliedDelta` says how many the count could actually give up.\n      //\n      // Only lines the ledger DESCRIBES are capped. A pair the ledger says\n      // nothing about restores as before, which is what keeps the pre-AGL-1807\n      // draft links — decremented with no row at all — from having their stock\n      // stranded, and what keeps a single swallowed ledger write from turning\n      // into a lost restock on an unrelated line of the same order.\n      let saleDecremented = true\n      // The cap rule itself lives beside the restock flag, which now bounds\n      // the question it ASKS by the same ledger this bounds the stock it\n      // RETURNS (AGL-2325). One implementation, so a prompt naming more units\n      // than a cancellation would put back is not expressible.\n      let releaseCap: ReadonlyMap<string, number> = new Map<string, number>()\n      if (order.status === 'paid') {\n        const orderAdjustments = await transaction.get(\n          hostRef\n            .collection('inventoryAdjustments')\n            .where('orderId', '==', orderId),\n        )\n        const saleRows = orderAdjustments.docs.filter(\n          (row) => row.get('reason') === 'sale',\n        )\n        if (\n          order.channel === 'pos' &&\n          (order.timeline ?? []).some(\n            (event) => event.event === 'pos-card-pending',\n          )\n        ) {\n          saleDecremented = saleRows.length > 0\n        }\n        releaseCap = saleReleaseCaps(saleRows)\n      }\n\n      // `paid` is the only status reachable here whose sale decremented; see\n      // the header. Reads happen before any write, as a transaction requires.\n      const { lines, products } =\n        order.status === 'paid' && saleDecremented\n          ? await resolveTrackedRestockLines(hostRef, order, (ref) =>\n              transaction.get(ref),\n            )\n          : {\n              lines: [],\n              products: new Map<string, CommerceModel.HostProduct>(),\n            }\n\n      const atMs = Date.now()\n      // Grouped by product, because two lines of one product (two variants, or\n      // the same variant twice) are two deltas against ONE document: writing\n      // them separately would compute both from the same read and land only\n      // the last, silently dropping units.\n      const byProduct = new Map<string, CommerceModel.OrderRestockLine[]>()\n      // Never more than the sale actually took off the shelf (AGL-2149).\n      for (const line of capRestockLines(lines, releaseCap)) {\n        byProduct.set(line.productId, [\n          ...(byProduct.get(line.productId) ?? []),\n          line,\n        ])\n      }\n      for (const [productId, productLines] of byProduct) {\n        const product = products.get(productId)\n        if (!product) continue\n        let variants = product.variants\n        for (const line of productLines) {\n          variants = CommerceModel.adjustVariantInventory(\n            { variants },\n            line.variantId,\n            line.quantity,\n            // The bucket the sale came out of, for a location-tracked store\n            // (AGL-286). Absent on every path that decremented the flat count,\n            // where `adjustVariantInventory` puts it back the same way.\n            order.locationId || undefined,\n          )\n        }\n        // `update()`, not `set(…, { merge: true })` as the sale paths use: the\n        // transaction has just read this product, so it exists, and a product\n        // deleted under us must not be conjured back as a stub holding nothing\n        // but a variants array.\n        transaction.update(hostRef.collection('products').doc(productId), {\n          variants,\n          inventory: CommerceModel.productInventory({ variants }),\n          updatedAtMs: atMs,\n        })\n        for (const line of productLines) {\n          transaction.create(hostRef.collection('inventoryAdjustments').doc(), {\n            productId,\n            variantId: line.variantId,\n            delta: line.quantity,\n            reason: 'cancellation',\n            orderId,\n            ...(order.locationId ? { locationId: order.locationId } : {}),\n            atMs,\n          } satisfies CommerceModel.InventoryAdjustment)\n        }\n      }\n\n      // From the CAPPED lines, not the order's, so the timeline reports what\n      // was actually put back (AGL-2149).\n      const releasedLines = [...byProduct.values()].flat()\n      const units = releasedLines.reduce((sum, line) => sum + line.quantity, 0)\n      const patch: Record<string, unknown> = {\n        status: 'cancelled',\n        timeline: CommerceModel.appendOrderEvent(\n          order,\n          'cancelled',\n          units > 0\n            ? `${units} ${units === 1 ? 'unit' : 'units'} returned to stock`\n            : undefined,\n          atMs,\n        ),\n      }\n      // An open restock question about THIS order's stock, raised by a partial\n      // refund before the cancellation (AGL-1797). The units it asked about are\n      // the ones just put back, so leaving it open would invite the merchant to\n      // restock them a second time from the order dialog — the double-count\n      // that flag exists to avoid. Answered with what actually happened.\n      if (units > 0 && order.restockCheck && !order.restockCheck.resolution) {\n        patch.restockCheck = {\n          ...order.restockCheck,\n          resolution: 'restocked',\n          resolvedAtMs: atMs,\n          resolvedBy: decoded.uid,\n        } satisfies CommerceModel.OrderRestockCheck\n      }\n      transaction.update(orderRef, patch)\n      return {\n        status: 200,\n        body: { ok: true, released: releasedLines.length, units },\n        // The live Stripe page this cancellation orphans, if any (AGL-2244).\n        // Read inside the transaction that flips the status so the expiry\n        // below cannot act on an order some other writer paid meanwhile.\n        expireSessionId:\n          order.status === 'pending' ? (order.checkoutSessionId ?? '') : '',\n      }\n    })\n    // EXPIRE THE PAYMENT LINK (AGL-2244). Cancelling a `pending` draft order or\n    // POS card sale left its Checkout Session live: the URL is on the\n    // customer's phone or in the email the merchant sent, and Stripe keeps it\n    // payable for 24 hours. Paying it captured real money on the merchant's\n    // account and the completing webhook then discarded the event — its\n    // `status !== 'pending'` guard cannot tell a redelivery from a cancelled\n    // order — so the sale existed in Stripe and nowhere in the product: no\n    // order, no stock move, no contact, no notification, not even a timeline\n    // line. The webhook now says so when it happens; this is the half that\n    // stops it happening.\n    //\n    // OUTSIDE the transaction, because it is a network call, and best-effort\n    // by design: the cancellation itself already landed and is what the\n    // merchant asked for. A failure here leaves the pre-existing behaviour\n    // (a payable link) plus the webhook's new record of it, which is strictly\n    // better than failing a cancel that has already released stock. Stripe\n    // answers 400 for a session that is already expired or already paid, and\n    // both are states this has nothing to add to.\n    const expireSessionId = (outcome as { expireSessionId?: string })\n      .expireSessionId\n    if (expireSessionId && process.env.STRIPE_SECRET_KEY) {\n      const expiry = await fetch(\n        `https://api.stripe.com/v1/checkout/sessions/${expireSessionId}/expire`,\n        {\n          method: 'POST',\n          headers: {\n            Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n            'Content-Type': 'application/x-www-form-urlencoded',\n          },\n        },\n      ).catch(() => null)\n      if (!expiry?.ok) {\n        console.error(\n          'Cancelled order: Stripe session not expired, the payment link may still be payable',\n          { hostId, orderId, sessionId: expireSessionId },\n        )\n      }\n    }\n    return res.status(outcome.status).json(outcome.body)\n  } catch (error) {\n    // Nothing landed — the transaction is all-or-nothing — so the order is\n    // still open and the merchant can try again. Deliberately NOT the swallow\n    // `flagOrderRestock` uses: there the money had already moved and only a\n    // postscript was at risk; here a swallowed failure is a cancelled order\n    // whose stock never came back, which is the bug this closes.\n    console.error('cancelOrder failed', error)\n    return res.status(500).json({ error: 'Cancel failed' })\n  }\n}\n"],"names":["CommerceModel","firebaseAdmin","capRestockLines","resolveTrackedRestockLines","saleReleaseCaps","cancelOrderHandler","req","res","body","method","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","orderId","test","hostSnapshot","decoded","app","auth","verifyIdToken","firestore","hostRef","collection","doc","get","exists","memberRole","uid","orderRef","outcome","runTransaction","transaction","snapshot","order","liftLegacyOrder","data","ok","alreadyCancelled","released","units","canTransitionOrder","saleDecremented","releaseCap","Map","orderAdjustments","where","saleRows","docs","filter","row","channel","timeline","some","event","lines","products","ref","atMs","Date","now","byProduct","line","set","productId","productLines","product","variants","adjustVariantInventory","variantId","quantity","locationId","update","inventory","productInventory","updatedAtMs","create","delta","reason","releasedLines","values","flat","reduce","sum","patch","appendOrderEvent","restockCheck","resolution","resolvedAtMs","resolvedBy","expireSessionId","checkoutSessionId","process","env","STRIPE_SECRET_KEY","expiry","fetch","Authorization","catch","console","sessionId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,mBAAmB,oBAAU;AACzC,SAASC,aAAa,QAAQ,2BAA0B;AAExD,SACEC,eAAe,EACfC,0BAA0B,EAC1BC,eAAe,QACV,oBAAgB;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEC,GACD,OAAO,MAAMC,qBAAuC,OAAOC,KAAKC;QAIjCD,4BAM4BA,WACnCE,cACCA;IAXvB,IAAIF,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,gBAAgBC,QAAOR,6BAAAA,IAAIS,OAAO,CAACF,aAAa,YAAzBP,6BAA6B;IAC1D,MAAMU,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMJ,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWa,KAAKC,KAAK,CAAChB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMiB,SAAST,QAAON,eAAAA,KAAKe,MAAM,YAAXf,eAAe;IACrC,MAAMgB,UAAUV,QAAON,gBAAAA,KAAKgB,OAAO,YAAZhB,gBAAgB;IACvC,IAAI,CAACe,UAAU,CAACC,SAAS;QACvB,OAAOjB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B;IACnE;IACA,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,WAAWa,IAAI,CAACF,WAAW,WAAWE,IAAI,CAACD,UAAU;QACvD,OAAOjB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B;IACnE;IAEA,IAAI;YAakBc;QAZpB,MAAMC,UAAU,MAAM1B,cAAc2B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACd;QAC/D,MAAMe,YAAY9B,cAAc2B,GAAG,GAAGG,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACX;QAClD,MAAMG,eAAe,MAAMM,QAAQG,GAAG;QACtC,IAAI,CAACT,aAAaU,MAAM,EAAE;YACxB,OAAO7B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,2EAA2E;QAC3E,mEAAmE;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,sDAAsD;QACtD,MAAMyB,aAAa,EAACX,oBAAAA,aAAaS,GAAG,CAAC,0BAAjBT,oBAAmC,CAAC,EAAE,CAACC,QAAQW,GAAG,CAAC;QACvE,IAAID,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAO9B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QACA,MAAM2B,WAAWP,QAAQC,UAAU,CAAC,UAAUC,GAAG,CAACV;QAElD,MAAMgB,UAAU,MAAMT,UAAUU,cAAc,CAAC,OAAOC;gBAMjDC,gBAqL+BC;YA1LlC,MAAMD,WAAW,MAAMD,YAAYP,GAAG,CAACI;YACvC,IAAI,CAACI,SAASP,MAAM,EAAE;gBACpB,OAAO;oBAAE1B,QAAQ;oBAAKF,MAAM;wBAAEI,OAAO;oBAAgB;gBAAE;YACzD;YACA,MAAMgC,QAAQ5C,cAAc6C,eAAe,EACxCF,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,CAAC;YAEvB,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,kEAAkE;YAClE,IAAIC,MAAMlC,MAAM,KAAK,aAAa;gBAChC,OAAO;oBACLA,QAAQ;oBACRF,MAAM;wBAAEuC,IAAI;wBAAMC,kBAAkB;wBAAMC,UAAU;wBAAGC,OAAO;oBAAE;gBAClE;YACF;YACA,IAAI,CAAClD,cAAcmD,kBAAkB,CAACP,MAAMlC,MAAM,EAAE,cAAc;gBAChE,OAAO;oBACLA,QAAQ;oBACRF,MAAM;wBAAEI,OAAO,CAAC,WAAW,EAAEgC,MAAMlC,MAAM,CAAC,eAAe,CAAC;oBAAC;gBAC7D;YACF;YAEA,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,0DAA0D;YAC1D,EAAE;YACF,uEAAuE;YACvE,qEAAqE;YACrE,EAAE;YACF,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,qEAAqE;YACrE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,8DAA8D;YAC9D,IAAI0C,kBAAkB;YACtB,sEAAsE;YACtE,mEAAmE;YACnE,wEAAwE;YACxE,yDAAyD;YACzD,IAAIC,aAA0C,IAAIC;YAClD,IAAIV,MAAMlC,MAAM,KAAK,QAAQ;oBAWxBkC;gBAVH,MAAMW,mBAAmB,MAAMb,YAAYP,GAAG,CAC5CH,QACGC,UAAU,CAAC,wBACXuB,KAAK,CAAC,WAAW,MAAMhC;gBAE5B,MAAMiC,WAAWF,iBAAiBG,IAAI,CAACC,MAAM,CAC3C,CAACC,MAAQA,IAAIzB,GAAG,CAAC,cAAc;gBAEjC,IACES,MAAMiB,OAAO,KAAK,SAClB,EAACjB,kBAAAA,MAAMkB,QAAQ,YAAdlB,kBAAkB,EAAE,EAAEmB,IAAI,CACzB,CAACC,QAAUA,MAAMA,KAAK,KAAK,qBAE7B;oBACAZ,kBAAkBK,SAAStC,MAAM,GAAG;gBACtC;gBACAkC,aAAajD,gBAAgBqD;YAC/B;YAEA,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,EAAEQ,KAAK,EAAEC,QAAQ,EAAE,GACvBtB,MAAMlC,MAAM,KAAK,UAAU0C,kBACvB,MAAMjD,2BAA2B6B,SAASY,OAAO,CAACuB,MAChDzB,YAAYP,GAAG,CAACgC,QAElB;gBACEF,OAAO,EAAE;gBACTC,UAAU,IAAIZ;YAChB;YAEN,MAAMc,OAAOC,KAAKC,GAAG;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,qCAAqC;YACrC,MAAMC,YAAY,IAAIjB;YACtB,mEAAmE;YACnE,KAAK,MAAMkB,QAAQtE,gBAAgB+D,OAAOZ,YAAa;oBAE/CkB;gBADNA,UAAUE,GAAG,CAACD,KAAKE,SAAS,EAAE;wBACxBH,iBAAAA,UAAUpC,GAAG,CAACqC,KAAKE,SAAS,aAA5BH,iBAAiC,EAAE;oBACvCC;iBACD;YACH;YACA,KAAK,MAAM,CAACE,WAAWC,aAAa,IAAIJ,UAAW;gBACjD,MAAMK,UAAUV,SAAS/B,GAAG,CAACuC;gBAC7B,IAAI,CAACE,SAAS;gBACd,IAAIC,WAAWD,QAAQC,QAAQ;gBAC/B,KAAK,MAAML,QAAQG,aAAc;oBAC/BE,WAAW7E,cAAc8E,sBAAsB,CAC7C;wBAAED;oBAAS,GACXL,KAAKO,SAAS,EACdP,KAAKQ,QAAQ,EACb,gEAAgE;oBAChE,mEAAmE;oBACnE,4DAA4D;oBAC5DpC,MAAMqC,UAAU,IAAI7D;gBAExB;gBACA,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,wBAAwB;gBACxBsB,YAAYwC,MAAM,CAAClD,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAACwC,YAAY;oBAChEG;oBACAM,WAAWnF,cAAcoF,gBAAgB,CAAC;wBAAEP;oBAAS;oBACrDQ,aAAajB;gBACf;gBACA,KAAK,MAAMI,QAAQG,aAAc;oBAC/BjC,YAAY4C,MAAM,CAACtD,QAAQC,UAAU,CAAC,wBAAwBC,GAAG,IAAI;wBACnEwC;wBACAK,WAAWP,KAAKO,SAAS;wBACzBQ,OAAOf,KAAKQ,QAAQ;wBACpBQ,QAAQ;wBACRhE;uBACIoB,MAAMqC,UAAU,GAAG;wBAAEA,YAAYrC,MAAMqC,UAAU;oBAAC,IAAI,CAAC;wBAC3Db;;gBAEJ;YACF;YAEA,uEAAuE;YACvE,oCAAoC;YACpC,MAAMqB,gBAAgB;mBAAIlB,UAAUmB,MAAM;aAAG,CAACC,IAAI;YAClD,MAAMzC,QAAQuC,cAAcG,MAAM,CAAC,CAACC,KAAKrB,OAASqB,MAAMrB,KAAKQ,QAAQ,EAAE;YACvE,MAAMc,QAAiC;gBACrCpF,QAAQ;gBACRoD,UAAU9D,cAAc+F,gBAAgB,CACtCnD,OACA,aACAM,QAAQ,IACJ,GAAGA,MAAM,CAAC,EAAEA,UAAU,IAAI,SAAS,QAAQ,kBAAkB,CAAC,GAC9D9B,WACJgD;YAEJ;YACA,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,mEAAmE;YACnE,IAAIlB,QAAQ,KAAKN,MAAMoD,YAAY,IAAI,CAACpD,MAAMoD,YAAY,CAACC,UAAU,EAAE;gBACrEH,MAAME,YAAY,GAAG,aAChBpD,MAAMoD,YAAY;oBACrBC,YAAY;oBACZC,cAAc9B;oBACd+B,YAAYxE,QAAQW,GAAG;;YAE3B;YACAI,YAAYwC,MAAM,CAAC3C,UAAUuD;YAC7B,OAAO;gBACLpF,QAAQ;gBACRF,MAAM;oBAAEuC,IAAI;oBAAME,UAAUwC,cAActE,MAAM;oBAAE+B;gBAAM;gBACxD,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjEkD,iBACExD,MAAMlC,MAAM,KAAK,aAAakC,2BAAAA,MAAMyD,iBAAiB,YAAvBzD,2BAA2B,KAAM;YACnE;QACF;QACA,4EAA4E;QAC5E,kEAAkE;QAClE,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,sBAAsB;QACtB,EAAE;QACF,yEAAyE;QACzE,oEAAoE;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAMwD,kBAAkB,AAAC5D,QACtB4D,eAAe;QAClB,IAAIA,mBAAmBE,QAAQC,GAAG,CAACC,iBAAiB,EAAE;YACpD,MAAMC,SAAS,MAAMC,MACnB,CAAC,4CAA4C,EAAEN,gBAAgB,OAAO,CAAC,EACvE;gBACE3F,QAAQ;gBACRM,SAAS;oBACP4F,eAAe,CAAC,OAAO,EAAEL,QAAQC,GAAG,CAACC,iBAAiB,EAAE;oBACxD,gBAAgB;gBAClB;YACF,GACAI,KAAK,CAAC,IAAM;YACd,IAAI,EAACH,0BAAAA,OAAQ1D,EAAE,GAAE;gBACf8D,QAAQjG,KAAK,CACX,sFACA;oBAAEW;oBAAQC;oBAASsF,WAAWV;gBAAgB;YAElD;QACF;QACA,OAAO7F,IAAIG,MAAM,CAAC8B,QAAQ9B,MAAM,EAAEC,IAAI,CAAC6B,QAAQhC,IAAI;IACrD,EAAE,OAAOI,OAAO;QACd,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,6DAA6D;QAC7DiG,QAAQjG,KAAK,CAAC,sBAAsBA;QACpC,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/server/cart-checkout.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Cart checkout (AGL-293): the whole cart in one Stripe Checkout
+ * session on the merchant's account. Every line re-prices from its
+ * product doc, unavailable lines block with a visible error, the
+ * platform fee sums per line by product type (AGL-278 ladder), and the
+ * webhook creates one multi-line order and clears the cart.
+ */
+export declare const cartCheckoutHandler: PluginApiHandler;