@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/checkout.js

@@ -0,0 +1,915 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import * as Aglyn from "@aglyn/aglyn/server";
+import * as CommerceModel from "../model/index.js";
+import { claimAttempt, deriveStripeObjectKey } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { connectLinkageIsReady } from "@aglyn/tenant-data-admin/server/stripe-account-mode";
+import { readActiveMemberSession } from "./membership.js";
+import { resolveManualTaxRateId } from "./manual-tax-rate.js";
+import { holdPromotionSlot, promotionHoldKey } from "./promotion-hold.js";
+import { holdStock, stockHoldKey } from "./stock-hold.js";
+import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSessionPayload, resolveNativeCheckoutMode } from "./native-checkout.js";
+/**
+ * Commerce Starter checkout (AGL-90): a site visitor buys a product. The
+ * price ALWAYS comes from the host's product doc (never the request), the
+ * money goes to the host owner's Connect account (AGL-46 onboarding) as a
+ * DESTINATION charge, and the webhook records the order under the host.
+ * 501 without Stripe env.
+ *
+ * Two claims in this comment were stale and are corrected here (AGL-2295),
+ * both in the direction that matters:
+ *
+ *  - The fee is NOT "2%". It is `resolveTransactionFeePct(org, productType)`
+ *    — a per-plan, per-product-type ladder with per-org staff overrides,
+ *    resolved per request. 2% is one cell of sixteen (Starter, physical).
+ *  - Selling is gated on `commerce`, not on `marketplaceSelling` (AGL-470).
+ *    They are different entitlements on different plans: `marketplaceSelling`
+ *    gates the marketplace, and reading this comment as current would gate a
+ *    storefront on the wrong one.
+ */ export const checkoutHandler = async (req, res)=>{
+    var _req_body, _body_hostId, _body_productId, _body_variantId, _body_quantity, _body_couponCode, _body_billing, _ref, _req_headers_idempotencykey;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    if (!process.env.STRIPE_SECRET_KEY) {
+        return res.status(501).json({
+            error: 'Purchases are not configured on this site.'
+        });
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const hostId = String((_body_hostId = body.hostId) != null ? _body_hostId : '');
+    const productId = String((_body_productId = body.productId) != null ? _body_productId : '');
+    const variantId = String((_body_variantId = body.variantId) != null ? _body_variantId : '');
+    const quantity = Math.max(1, Math.min(99, Math.round(Number((_body_quantity = body.quantity) != null ? _body_quantity : 1))));
+    const couponCode = String((_body_couponCode = body.couponCode) != null ? _body_couponCode : '').trim().toUpperCase().slice(0, 40);
+    // Buyer-chosen billing (AGL-545): a request, never an instruction —
+    // the session mode re-resolves from the product doc below.
+    const billingRaw = String((_body_billing = body.billing) != null ? _body_billing : '');
+    const billing = billingRaw === 'once' || billingRaw === 'subscribe' ? billingRaw : undefined;
+    // One buy-now attempt, minted by the product page (AGL-1697). Node
+    // lowercases incoming headers, but read both spellings — the plugin API
+    // request type makes no promise about casing.
+    const idempotencyKey = String((_ref = (_req_headers_idempotencykey = req.headers['idempotency-key']) != null ? _req_headers_idempotencykey : req.headers['Idempotency-Key']) != null ? _ref : '').trim().slice(0, 200);
+    if (!hostId || !productId) {
+        return res.status(400).json({
+            error: 'Missing hostId or productId'
+        });
+    }
+    let claim = null;
+    /**
+   * The coupon redemption slot this attempt reserved (AGL-2453), hoisted so
+   * every refusal below the claim — and the catch — can hand it back. A throw
+   * after the hold is placed is exactly the case where a slot would otherwise
+   * sit invisibly against the merchant's cap until the TTL lapsed.
+   */ let couponSlot = null;
+    let couponHoldKey = '';
+    const releaseCouponSlot = async ()=>{
+        const slot = couponSlot;
+        couponSlot = null;
+        couponHoldKey = '';
+        if (slot) await slot.release();
+    };
+    /**
+   * The units this attempt reserved (AGL-2356), hoisted for the same reason the
+   * coupon slot is: every refusal below the claim — and the catch — has to hand
+   * them back, or an abandoned request stands on a merchant's last unit until
+   * the TTL lapses.
+   */ let stockHold = null;
+    let heldStockKey = '';
+    const releaseStock = async ()=>{
+        const held = stockHold;
+        stockHold = null;
+        heldStockKey = '';
+        if (held) await held.release();
+    };
+    try {
+        var _variant_priceUsd, _req_headers_referer, _storeSettings_get, _ref1, _lifted_type, _variant_weightGrams, _lifted_type1, _lifted_type2, _product_name, _ref2;
+        var _ownerOrg_org, _ownerOrg_org1, _ownerOrg_org2;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const [hostSnapshot, productSnapshot] = await Promise.all([
+            hostRef.get(),
+            hostRef.collection('products').doc(productId).get()
+        ]);
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        const product = productSnapshot.data();
+        if (!product || product.deletedAt) {
+            return res.status(404).json({
+                error: 'Unknown product'
+            });
+        }
+        // Variant pricing (AGL-292): the buyer's selection maps to a variant;
+        // absent variantId keeps the legacy default-variant behavior.
+        const lifted = CommerceModel.liftLegacyProduct(product);
+        const variant = variantId ? lifted.variants.find((item)=>item.id === variantId) : lifted.variants[0];
+        if (!variant) return res.status(404).json({
+            error: 'Unknown variant'
+        });
+        const priceUsd = Number((_variant_priceUsd = variant.priceUsd) != null ? _variant_priceUsd : 0);
+        if (!(priceUsd > 0) || priceUsd > CommerceModel.COMMERCE_MAX_PRICE_USD) {
+            return res.status(400).json({
+                error: 'Product is not purchasable'
+            });
+        }
+        // Inventory (AGL-281): variant-aware, honoring the product's oversell
+        // policy (backorder products keep selling at zero). Enforced here (the
+        // block's display is cosmetic) and decremented by the webhook.
+        //
+        // DELIBERATELY UNCHANGED for subscription sessions. For a PHYSICAL
+        // subscription the gate is honest again since AGL-1750: every paid cycle
+        // mints an order and decrements the variant (the webhook's invoice
+        // branch), so the number this checks now moves as boxes ship. For a
+        // digital or service subscription nothing decrements, and the console
+        // withdraws the field there (`stockTrackingApplies`, AGL-1744) rather
+        // than skipping this gate — it is the one shared by every purchase path,
+        // and skipping it for subscription mode would silently RESUME selling
+        // for any merchant who set 0 to stop new subscribers.
+        if (!CommerceModel.canPurchase(lifted, variant.id, quantity)) {
+            return res.status(409).json({
+                error: 'Sold out'
+            });
+        }
+        // Seller resolution rides the owning org (AGL-238): plan gate from
+        // the org doc, Stripe account from the owner's marketplace profile.
+        const ownerOrg = await getOrgForHost(hostId);
+        const ownerId = ownerOrg == null ? void 0 : (_ownerOrg_org = ownerOrg.org) == null ? void 0 : _ownerOrg_org.ownerUid;
+        if (!ownerId) {
+            return res.status(409).json({
+                error: 'This site cannot sell yet'
+            });
+        }
+        const ownerProfile = await firestore.collection('profiles').doc(String(ownerId)).get();
+        // Storefront selling is the `commerce` entitlement (Starter+) — not
+        // `marketplaceSelling`, which gates the marketplace marketplace (AGL-470).
+        if (!Aglyn.checkEntitlement(ownerOrg.org, 'commerce')) {
+            return res.status(403).json({
+                error: 'Selling is not enabled'
+            });
+        }
+        // Session mode (AGL-545): 'subscribe' only takes effect on
+        // subscriptionOptional products, 'once' never applies to
+        // subscription-only products, and price/interval always come from
+        // the product doc — never the request.
+        const isSubscription = CommerceModel.resolveCheckoutBillingMode(lifted, billing) === 'subscription';
+        // Tiered product types (AGL-470): recurring subscriptions and gift
+        // cards are Business+ entitlements, checked per sale — the product doc
+        // alone must not unlock them. Gated whenever the session ends up in
+        // subscription mode (a subscriptionOptional one-time sale is a plain
+        // order, so it rides the base `commerce` entitlement).
+        if (isSubscription && !Aglyn.checkEntitlement(ownerOrg.org, 'storefrontSubscriptions')) {
+            return res.status(403).json({
+                error: 'Subscription products require a Business plan'
+            });
+        }
+        // ALREADY SUBSCRIBED? (AGL-1849)
+        //
+        // The idempotency key closes the RETRY shape: one attempt, one key, one
+        // subscription. What it cannot close is a deliberate second submit under a
+        // fresh key — `product-detail.tsx` mints a new UUID on every variant /
+        // quantity / billing change — which is two RECURRING charges on one card
+        // for one product, billed forever until someone notices.
+        //
+        // The issue filed this as impossible: the storefront buy-now path is
+        // anonymous, so there is no buyer to ask about. That was half right. The
+        // path admits anonymous buyers, but it is not ONLY anonymous — a signed-in
+        // site member's `aglyn_member_{hostId}` cookie is already on this request
+        // (same-origin `fetch` sends it, and `PluginApiRequest` exposes
+        // `cookies`), and the handler simply never read it. So the guard covers
+        // the case it can actually identify and, deliberately, no more.
+        //
+        // WHAT THIS DOES NOT COVER, stated rather than implied: a logged-out buyer
+        // who types any email at Stripe. There is no identity for them before the
+        // hosted page, and inventing one — forcing sign-in to buy — is a UX change
+        // that belongs to a product decision, not to a duplicate guard. The
+        // honest scope is "a member cannot silently double-subscribe", not "nobody
+        // can".
+        //
+        // Live-status, NOT existence. A member who cancelled must be able to
+        // re-subscribe; refusing on "a subscription row exists" would lock a
+        // returning customer out of paying us, which is the AGL-1715 lesson
+        // restated on the tenant side. `isTenantSubscriptionLive` is the shared
+        // tenant predicate, the same one `gate.ts` grants content access with.
+        if (isSubscription) {
+            var _session_member_get;
+            const session = await readActiveMemberSession(req, hostId);
+            const memberEmail = session.status === 'active' ? String((_session_member_get = session.member.get('email')) != null ? _session_member_get : '') : '';
+            if (memberEmail) {
+                // Scoped by email because that is the join `billing-webhook.ts` writes
+                // — `customerEmail` comes off Stripe's `customer_details` — and it is
+                // the same key `gate.ts` reads. The 10-doc cap matches gate.ts too: a
+                // member with more than ten subscriptions to ONE host is not the
+                // shape this refuses, and an unbounded scan on a checkout path is a
+                // cost with no matching benefit.
+                const existing = await hostRef.collection('subscriptions').where('customerEmail', '==', memberEmail).limit(10).get();
+                const alreadySubscribed = existing.docs.some((docSnapshot)=>docSnapshot.get('productId') === productId && CommerceModel.isTenantSubscriptionLive(docSnapshot.get('status')));
+                if (alreadySubscribed) {
+                    // Above the claim, so the key is never burned: this is a
+                    // deterministic refusal the buyer resolves by cancelling first, and
+                    // a retry must get the same answer rather than a stale replay.
+                    return res.status(409).json({
+                        error: 'You already have an active subscription to this product — ' + 'manage it from your account.',
+                        code: 'already_subscribed'
+                    });
+                }
+            }
+        }
+        if (product.giftCard && !Aglyn.checkEntitlement(ownerOrg.org, 'giftCards')) {
+            return res.status(403).json({
+                error: 'Gift cards require a Business plan'
+            });
+        }
+        const accountId = ownerProfile.get('stripeAccountId');
+        if (!connectLinkageIsReady({
+            accountId,
+            chargesEnabled: ownerProfile.get('stripeChargesEnabled'),
+            accountLivemode: ownerProfile.get('stripeAccountLivemode')
+        }, {
+            subject: `checkout host ${hostId}`
+        })) {
+            return res.status(409).json({
+                error: 'This site has not enabled payments yet'
+            });
+        }
+        // The list price per unit, before any coupon (AGL-1711). This is what the
+        // order's line-item snapshot records, and it is carried in the session
+        // metadata so the webhook never has to re-price from the product doc.
+        const listUnitAmountCents = Math.round(priceUsd * 100);
+        let amountCents = listUnitAmountCents * quantity;
+        // THE DISCOUNTS HUB, ON THIS PATH TOO.
+        //
+        // `hosts/{hostId}/discounts` had exactly one reader — `cart-checkout.ts` —
+        // so a code from the Discounts card worked in the cart and was rejected as
+        // invalid on Buy now. Same goods, same code, two prices depending on which
+        // button the shopper pressed, which is the disagreement AGL-1953 already
+        // closed for TAX on these same two paths.
+        //
+        // Resolved through the SAME `resolveDiscount` the cart uses, so one code
+        // cannot mean two amounts. The legacy AGL-96 coupons below stay as the
+        // fallback for a code the hub does not know, exactly as the cart orders
+        // them.
+        //
+        // Applied by reducing the AMOUNT rather than by minting a session-level
+        // Stripe coupon, which is how this path already applies its legacy coupon.
+        // That difference is load-bearing: buy-now carries its manual tax as a
+        // real `line_items[1]` product line, and a session coupon spreads across
+        // every line — so minting one here would discount the tax line too.
+        const buyNowDiscountLines = [
+            {
+                productId,
+                amountCents: listUnitAmountCents * quantity
+            }
+        ];
+        const hubDiscounts = await hostRef.collection('discounts').limit(100).get();
+        const resolvedDiscount = CommerceModel.resolveDiscount(hubDiscounts.docs.map((docSnapshot)=>_extends({}, docSnapshot.data(), {
+                $id: docSnapshot.id
+            })), _extends({}, couponCode ? {
+            code: couponCode
+        } : {}, {
+            subtotalCents: listUnitAmountCents * quantity,
+            productIds: [
+                productId
+            ],
+            lines: buyNowDiscountLines
+        }));
+        if (resolvedDiscount == null ? void 0 : resolvedDiscount.codeProblem) {
+            return res.status(400).json({
+                error: resolvedDiscount.codeProblem
+            });
+        }
+        let appliedDiscountId = '';
+        if (resolvedDiscount && resolvedDiscount.benefit.kind !== 'none') {
+            // Stripe's charge minimum is 50c — never discount below it, the same
+            // floor the legacy coupon path applies.
+            amountCents = Math.max(50, amountCents - resolvedDiscount.discountCents);
+            appliedDiscountId = resolvedDiscount.discountId;
+        }
+        // Coupons (AGL-96): host-defined percent-off codes; invalid codes are
+        // a visible 400, never a silent full-price charge. Only consulted when the
+        // hub did not already answer for this code.
+        let appliedCoupon = '';
+        if (couponCode && !resolvedDiscount) {
+            var _ref3;
+            const couponSnapshot = await hostRef.collection('coupons').doc(couponCode).get();
+            const coupon = couponSnapshot.data();
+            const percentOff = Number((_ref3 = coupon == null ? void 0 : coupon.percentOff) != null ? _ref3 : 0);
+            const expired = (coupon == null ? void 0 : coupon.expiresAtMs) != null && Number(coupon.expiresAtMs) < Date.now();
+            // A PRE-FILTER, no longer the enforcement (AGL-2453). It answers early so
+            // an obviously spent code 400s before a claim is minted, and it counts
+            // live holds so it agrees with the transaction below — the authority is
+            // `holdPromotionSlot`, which re-asks this same question inside the write.
+            const exhausted = CommerceModel.promotionExhausted(coupon, Date.now());
+            if (!coupon || coupon.enabled === false || expired || !(percentOff > 0 && percentOff <= 100)) {
+                return res.status(400).json({
+                    error: 'Invalid or expired coupon'
+                });
+            }
+            // Named separately from the invalid-code refusal (AGL-2453), and in the
+            // same words the transaction below uses. "Invalid or expired" is wrong
+            // about a code that is perfectly valid and simply spent — and once a live
+            // hold can produce this answer, a shopper told their code is invalid
+            // would stop trying rather than retry a moment later.
+            if (exhausted) {
+                return res.status(400).json({
+                    error: CommerceModel.PROMOTION_EXHAUSTED_MESSAGE
+                });
+            }
+            // Stripe's charge minimum is 50¢ — never discount below it. The
+            // percentage comes off the ORDER total, matching `cart-checkout.ts`'s
+            // `Math.round(itemsCents * percentOff / 100)`, so the same code takes
+            // the same money whichever button the shopper pressed. What the SESSION
+            // is built from this figure is where the two used to diverge — see the
+            // line-item construction below (AGL-2159).
+            amountCents = Math.max(50, Math.round(amountCents * (100 - percentOff) / 100));
+            appliedCoupon = couponCode;
+        }
+        // The platform fee is NOT computed here (AGL-2152): Stripe's processing
+        // cost is charged on the whole card total, so the fee cannot be known
+        // until the manual tax and the shipping options are resolved below. The
+        // per-plan ladder (AGL-284, AGL-278) is read inside the two resolvers
+        // called after the shipping plan — `resolveTransactionFeeCents` for a
+        // one-time sale and `resolveSubscriptionFeePercent` for a subscription.
+        const referer = String((_req_headers_referer = req.headers.referer) != null ? _req_headers_referer : '');
+        const origin = `https://${req.headers.host}`;
+        const backUrl = referer.startsWith('http') ? referer : origin;
+        const separator = backUrl.includes('?') ? '&' : '?';
+        // Taxes (AGL-285): Stripe Tax when the host opted in; manual mode
+        // taxes by store origin here (destination-based arrives with our own
+        // checkout, AGL-296). Exempt products skip both.
+        const storeSettings = await hostRef.collection('settings').doc('store').get();
+        const taxSettings = (_storeSettings_get = storeSettings.get('tax')) != null ? _storeSettings_get : {};
+        // AGL-1999: an unset tax mode is NOT a decision, and it must not sell.
+        // `mode` was `undefined` for every store whose owner never opened the
+        // Taxes card — the default state of every new storefront — and each
+        // branch below tested for a specific string, so no branch was taken, no
+        // tax was computed, and the shopper was charged an untaxed total. See
+        // `commerce-tax-decision.ts` for why refusing beats defaulting to either
+        // mode. `mode: 'none'` is the explicit opt-out and passes straight
+        // through.
+        const taxDecision = CommerceModel.storefrontTaxDecision({
+            settings: taxSettings,
+            taxExempt: lifted.taxExempt
+        });
+        if (taxDecision.kind === 'undecided') {
+            // Above the attempt claim, like every other deterministic refusal on
+            // this path — there is no claim to release yet.
+            return res.status(409).json({
+                error: CommerceModel.STOREFRONT_TAX_UNDECIDED_MESSAGE
+            });
+        }
+        const taxMisconfigured = CommerceModel.storefrontTaxMisconfiguration(taxSettings);
+        if (taxMisconfigured) {
+            // AGL-2145: the merchant DECIDED to collect and the sale would have
+            // charged zero anyway — an unfinished settings card, not a
+            // jurisdiction miss. Refused in the same words and the same place as
+            // the undecided case above.
+            return res.status(409).json({
+                error: taxMisconfigured
+            });
+        }
+        const useStripeTax = taxDecision.kind === 'stripe-automatic';
+        let taxCents = 0;
+        let taxLabel = '';
+        let taxPct = 0;
+        if (taxSettings.mode === 'manual' && !lifted.taxExempt) {
+            var _taxSettings_origin;
+            const rate = CommerceModel.resolveTaxRate(taxSettings, (_taxSettings_origin = taxSettings.origin) != null ? _taxSettings_origin : {});
+            if (rate && !taxSettings.pricesIncludeTax) {
+                taxCents = CommerceModel.computeTaxCents(amountCents, rate.pct);
+                taxLabel = rate.label || `Tax (${rate.pct}%)`;
+                taxPct = rate.pct;
+            }
+        }
+        // Recurring manual tax (AGL-1751). The manual tax cannot ride the
+        // `line_items[1]` product line on a SUBSCRIPTION session: a non-recurring
+        // price in `mode: subscription` is a one-time item, and Stripe bills
+        // one-time items on the FIRST invoice only — so the merchant's tax was
+        // collected once and then, on every renewal the buyer had been shown a
+        // taxed price for, never again. A Stripe Tax Rate attached to the
+        // subscription line recurs: Checkout carries `line_items[][tax_rates]`
+        // onto the subscription item, every invoice applies it, and the figure
+        // lands where the records already look — the session's
+        // `total_details.amount_tax` for the sale (AGL-1732) and the invoice's
+        // own tax fields for each renewal (AGL-1743). No webhook change.
+        //
+        // The rate is created on the PLATFORM account — no Stripe-Account header,
+        // matching the session call below — because that is where the
+        // subscription lives (destination transfer); a connected-account rate id
+        // would not resolve. Tax rates are immutable, so one is minted per
+        // (percentage, label) and cached under the host; a merchant editing their
+        // zone rate misses the cache and mints a fresh object, while the old one
+        // stays behind on the subscriptions that already carry it, exactly as it
+        // should.
+        //
+        // A creation failure is a VISIBLE 502, never a fallback: the one-time
+        // line is this very bug, and a session with no tax at all would
+        // under-collect every invoice silently.
+        // Point of no return (AGL-1697): everything past here creates Stripe
+        // objects — possibly a Tax Rate, then the session. Server-side a retry
+        // looked free, but for `mode: subscription` two completed sessions are
+        // two RECURRING subscriptions for the same member and product. The
+        // shipping refusals BELOW this line release the claim: they are
+        // deterministic asks the shopper answers and retries under the same key,
+        // and the released key re-derives the same digests so Stripe replays the
+        // tax rate rather than minting a twin (AGL-1714's rule).
+        const claimed = await claimAttempt(firestore, {
+            kind: 'commerce-checkout',
+            scopeId: hostId,
+            orgId: String((_ref1 = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.id) != null ? _ref1 : ''),
+            key: idempotencyKey,
+            busyMessage: 'This checkout is already being processed'
+        });
+        if ('replay' in claimed) {
+            return res.status(claimed.replay.status).json(claimed.replay.body);
+        }
+        claim = claimed.claim;
+        // Derived per OBJECT, never the raw digest (AGL-1714): Stripe
+        // parameter-compares a repeated key account-wide, so one digest sent to
+        // `/v1/tax_rates` and then `checkout/sessions` would error the second.
+        const stripeKeyHeader = (object)=>{
+            const derived = deriveStripeObjectKey(claimed.claim.stripeKey, object);
+            return derived ? {
+                'Idempotency-Key': derived
+            } : {};
+        };
+        // THE UNITS ARE RESERVED HERE (AGL-2356), not merely read above.
+        //
+        // The `canPurchase` gate at the top of this handler is a plain `.get()`
+        // compared against a number, and the webhook decremented minutes later
+        // without ever re-asking. Nothing was written, so there was no document to
+        // contend on: every shopper who reached this line while the shelf held one
+        // unit passed it, and they all paid. This is the write that makes them
+        // serialise — see `model/commerce-stock-holds.ts` for why the shelf count
+        // itself deliberately does not move.
+        //
+        // FIRST among the holds, before the coupon slot below: stock is the
+        // likeliest refusal on this path, and reserving a promotion slot for a
+        // basket the store cannot fill is a slot held against the merchant's cap
+        // for nothing.
+        {
+            const held = await holdStock({
+                firestore,
+                hostRef,
+                holdKey: stockHoldKey(claimed.claim.stripeKey),
+                // Empty when there is nothing to reserve ON — an untracked variant or
+                // a `backorder` product, whose merchant chose to sell past zero. See
+                // the note in `cart-checkout.ts`: the unlimited case stays off the
+                // write path entirely, and `holdStock` opens no transaction for it.
+                lines: CommerceModel.stockIsReservable(lifted, variant.id, Date.now()) ? [
+                    {
+                        productId,
+                        variantId: variant.id,
+                        quantity
+                    }
+                ] : [],
+                label: `buy-now ${hostId}/${productId}`
+            });
+            if (!held.ok) {
+                // Nothing has been minted yet, so the key goes back and the same
+                // button works when the units return (AGL-1697). `sold-out` is named
+                // separately from an empty shelf: the merchant HAS stock and someone
+                // else is in checkout with it, and a shopper told "sold out" leaves
+                // while a shopper told to wait a few minutes comes back.
+                await releaseStock();
+                await claim.release();
+                return res.status(409).json({
+                    error: held.reason === 'sold-out' ? CommerceModel.STOCK_HELD_MESSAGE : 'Sold out'
+                });
+            }
+            if (held.holdKey) {
+                stockHold = held;
+                heldStockKey = held.holdKey;
+            }
+        }
+        // THE COUPON SLOT IS RESERVED HERE (AGL-2453), not merely read above.
+        //
+        // The check at the top of this handler was a comparison against a plain
+        // `.get()`, and the webhook incremented `redemptions` minutes later without
+        // re-asking — so a cap of one admitted every shopper who reached checkout
+        // before the first of them paid. Placed BELOW the claim because the hold is
+        // keyed by the attempt: a retry of one attempt must re-claim its own slot
+        // rather than be refused by it.
+        //
+        // Buy-now runs no automatic-discount path — `resolveDiscount` is the cart's
+        // — so the typed coupon is the only counter this handler can burn.
+        if (appliedCoupon || appliedDiscountId) {
+            const slot = await holdPromotionSlot({
+                firestore,
+                // The hub discount and the legacy coupon are two counters and only one
+                // of them can be in play — the hub answers first and the legacy block
+                // is skipped when it did.
+                ref: appliedDiscountId ? hostRef.collection('discounts').doc(appliedDiscountId) : hostRef.collection('coupons').doc(appliedCoupon),
+                holdKey: promotionHoldKey(claimed.claim.stripeKey),
+                label: appliedDiscountId ? `discount ${appliedDiscountId}` : `coupon ${appliedCoupon}`
+            });
+            if (!slot.ok) {
+                // Nothing has been minted yet, so this is retryable and the key goes
+                // back (AGL-1697). Exhaustion is named; anything else reads as the
+                // same invalid-code refusal the pre-filter above would have given.
+                await releaseCouponSlot();
+                await releaseStock();
+                await claim.release();
+                return res.status(400).json({
+                    error: slot.reason === 'exhausted' ? CommerceModel.PROMOTION_EXHAUSTED_MESSAGE : 'Invalid or expired coupon'
+                });
+            }
+            if (slot.holdKey) {
+                couponSlot = slot;
+                couponHoldKey = slot.holdKey;
+            }
+        }
+        // Minting and caching now live in `manual-tax-rate.ts` (AGL-1953), which
+        // the cart path needs too — two copies of a money-shaped cache is how two
+        // paths quietly diverge. Behaviour here is unchanged.
+        let recurringTaxRateId = '';
+        if (isSubscription && taxCents > 0) {
+            var _ref4;
+            recurringTaxRateId = (_ref4 = await resolveManualTaxRateId({
+                hostRef,
+                taxPct,
+                taxLabel,
+                headers: stripeKeyHeader('tax-rate')
+            })) != null ? _ref4 : '';
+            if (!recurringTaxRateId) {
+                // Nothing was sold — hand the key back so the same button works
+                // once Stripe does (AGL-1697).
+                await releaseCouponSlot();
+                await releaseStock();
+                await claim.release();
+                return res.status(502).json({
+                    error: 'Checkout failed'
+                });
+            }
+        }
+        // Shipping (AGL-1720), from the same settings document tax was just read
+        // from. Buy-now declared neither `shipping_address_collection` nor
+        // `shipping_options`, so a merchant who configured zones and rates in the
+        // console collected them on cart orders (AGL-1707) and nothing at all on
+        // buy-now — same merchant, same product, two totals depending on which
+        // button the shopper pressed.
+        //
+        // CONDITIONAL, unlike the cart's, on two things the cart cannot know:
+        //
+        //   - PHYSICAL PRODUCTS ONLY. This is the PDP path for one product, and it
+        //     sells digital downloads and services too. Asking a shopper buying a
+        //     PDF for a shipping address, then charging them to ship it, would be
+        //     a worse bug than the one being fixed. A missing `type` reads as
+        //     physical, exactly as the fee ladder above already reads it —
+        //     `liftLegacyProduct` only defaults the field on docs it synthesizes
+        //     variants for, so a part-migrated doc can reach here without one, and
+        //     the two reads must not disagree about what that doc is.
+        //   - ONE-TIME SALES ONLY. Originally because the webhook's
+        //     `commerce-subscription` branch never touched `total_details`, so
+        //     shipping charged there would have been real money recorded NOWHERE.
+        //     Both halves of that are now closed: AGL-1732 decomposed the initial
+        //     charge onto the subscription document, `amount_shipping` included,
+        //     and AGL-1743 records every renewal invoice — `shipping_cost` read
+        //     the same way — so a recurring shipping charge would now land.
+        //
+        //     What remains is the PRODUCT question, and only it: a rate editor
+        //     written for one-time orders never asks the merchant whether a rate
+        //     should be re-charged every cycle, and Stripe bills a subscription's
+        //     one-time line items on the FIRST invoice only, so a shipping rate
+        //     added as a session line item would be charged once and then silently
+        //     stop. Answering that is AGL-1720's revisit, not wiring.
+        //
+        // Weight is per unit TIMES the quantity bought. `weightGrams` alone would
+        // quote the lightest tier on a multi-unit order — the same under-collection
+        // this issue is about, and adjacent to the hardcoded `quantity: 1` that
+        // AGL-1711 just removed from this function.
+        //
+        // The subtotal fed to the resolver is the PRE-discount list total, matching
+        // the cart's, so "free over $50" means what the shopper saw it mean.
+        //
+        // WHICH DESTINATIONS the session may serve is decided with the rates and
+        // not after them (AGL-1721): a session that declared every zone's rates
+        // while accepting an address in any country let a shopper pick a domestic
+        // rate for an international parcel, and Stripe re-checks nothing — a
+        // `shipping_rate_data` carries no country. `planCheckoutShipping` pairs
+        // the two lists, and refuses rather than guessing.
+        const shippingSettings = storeSettings.get('shipping');
+        const shipsPhysically = ((_lifted_type = lifted.type) != null ? _lifted_type : 'physical') === 'physical' && !isSubscription;
+        const shippingPlan = shipsPhysically ? CommerceModel.planCheckoutShipping(shippingSettings, {
+            subtotalCents: listUnitAmountCents * quantity,
+            totalGrams: Math.max(0, Number((_variant_weightGrams = variant.weightGrams) != null ? _variant_weightGrams : 0)) * quantity
+        }, body.shippingCountry) : {
+            countries: CommerceModel.CHECKOUT_SHIPPING_COUNTRIES,
+            options: []
+        };
+        if (shippingPlan.refusal === 'destination-required') {
+            // A deterministic ask the shopper answers and retries under the same
+            // key — released, not burned (AGL-1697). The tax rate possibly minted
+            // above replays from its cache (or its derived key) on the retry.
+            await releaseCouponSlot();
+            await releaseStock();
+            await claim.release();
+            return res.status(400).json({
+                error: 'Choose where you’re shipping to.',
+                needsShippingCountry: true,
+                shippingCountries: [
+                    ...CommerceModel.CHECKOUT_SHIPPING_COUNTRIES
+                ]
+            });
+        }
+        if (shippingPlan.refusal === 'destination-unserved') {
+            var _CommerceModel_CHECKOUT_SHIPPING_COUNTRY_NAMES_declared;
+            const declared = CommerceModel.normalizeCheckoutShippingCountry(body.shippingCountry);
+            await releaseCouponSlot();
+            await releaseStock();
+            await claim.release();
+            return res.status(409).json({
+                error: `This store does not ship to ${(_CommerceModel_CHECKOUT_SHIPPING_COUNTRY_NAMES_declared = CommerceModel.CHECKOUT_SHIPPING_COUNTRY_NAMES[declared]) != null ? _CommerceModel_CHECKOUT_SHIPPING_COUNTRY_NAMES_declared : 'that country'}.`,
+                needsShippingCountry: true,
+                shippingCountries: [
+                    ...CommerceModel.CHECKOUT_SHIPPING_COUNTRIES
+                ]
+            });
+        }
+        // The merchant priced shipping and no rate of theirs reaches this cart
+        // (AGL-2232). Released like every other deterministic refusal on this
+        // path — the shopper can change the basket and retry under the same key.
+        if (shippingPlan.refusal === 'cart-unpriceable') {
+            await releaseCouponSlot();
+            await releaseStock();
+            await claim.release();
+            return res.status(409).json({
+                error: CommerceModel.CART_UNPRICEABLE_SHIPPING_MESSAGE
+            });
+        }
+        // THE PLATFORM FEE (AGL-2152). Formerly `feePct` of the goods and nothing
+        // else, which on a DESTINATION charge meant Aglyn paid Stripe 2.9% + 30¢
+        // out of its own balance and — on every tier carrying
+        // `transactionFeePhysicalPct: 0` — collected nothing back. The advertised
+        // platform take is unchanged; the card cost is now passed through at cost
+        // so the net per order is the take rather than the take minus Stripe's fee.
+        //
+        // The charge base is everything Stripe will run the card for: the goods
+        // after the coupon, the manual tax line, and the DEAREST shipping option on
+        // the session. The dearest, not the cheapest, because the shopper picks
+        // after the session is created and `application_fee_amount` is a fixed
+        // number Stripe will not let us revise — under-reaching would put the
+        // difference back on Aglyn. A store on Stripe Tax is the one residual: its
+        // tax is computed by Stripe after this point and cannot be seen from here.
+        const shippingCeilingCents = shippingPlan.options.reduce((most, option)=>{
+            var _option_amountCents;
+            return Math.max(most, Math.max(0, Number((_option_amountCents = option.amountCents) != null ? _option_amountCents : 0)));
+        }, 0);
+        // A SUBSCRIPTION carries the same pass-through AS A PERCENT (AGL-2655).
+        // Stripe offers a Subscription no `application_fee_amount`, only
+        // `application_fee_percent`, which cannot carry a fixed 30¢ as cents — so
+        // the 30¢ is folded into the rate: `(rate × amount + fixed) ÷ amount`,
+        // rounded UP to the two decimals the parameter allows, on top of the
+        // plan's own percent. `resolveSubscriptionFeePercent` owns that
+        // arithmetic and its rounding. Sized on the recurring goods alone: Stripe
+        // applies the percent to the whole invoice, and the paid-invoice
+        // correction (`chargeSubscriptionFeeOnItemsOnly`, AGL-2317) scales it
+        // back to the items, so the goods are the base the recovery has to come
+        // out at cost on.
+        //
+        // This branch never reaches `payment_intent_data[application_fee_amount]`
+        // (the emission below is gated on `!isSubscription`); the percent goes
+        // out on `subscription_data` further down, and `feeCents` here is what
+        // that percent takes of the opening cycle's goods — the figure
+        // `metadata[feeCents]` records as what Aglyn keeps.
+        const subscriptionFeePercent = isSubscription ? Aglyn.resolveSubscriptionFeePercent(ownerOrg.org, (_lifted_type1 = lifted.type) != null ? _lifted_type1 : 'physical', amountCents) : 0;
+        const feeCents = isSubscription ? subscriptionFeePercent > 0 ? Math.max(1, Math.round(amountCents * subscriptionFeePercent / 100)) : 0 : Aglyn.resolveTransactionFeeCents(ownerOrg.org, (_lifted_type2 = lifted.type) != null ? _lifted_type2 : 'physical', amountCents, amountCents + taxCents + shippingCeilingCents);
+        // The unit price Stripe actually charges — the coupon is priced INTO it
+        // rather than sent as a Stripe discount, which is why `amount_discount` is
+        // 0 on every buy-now session and the discount has to ride the metadata
+        // (AGL-1711). Hoisted so the Stripe param and the metadata cannot drift.
+        // THE SESSION CHARGES `amountCents`, EXACTLY (AGL-2159).
+        //
+        // A Stripe line is `quantity` units at ONE integer `unit_amount`, so it can
+        // only express totals divisible by `quantity` — and a percentage coupon
+        // does not respect that. This used to be
+        // `Math.round(amountCents / quantity)` multiplied back by `quantity`, which
+        // missed `amountCents` by up to `quantity / 2` cents in either direction:
+        // the shopper was charged something the storefront never quoted, and the
+        // fee and the manual tax were computed on a base nothing collected.
+        // Rounding UP was worse still — `discountCents` below is
+        // `list - charged` under a `Math.max(0, …)`, so a charge that met or passed
+        // the list price clamped it to ZERO and the order recorded no discount on a
+        // sale the shopper had applied a coupon to. On a 99-unit order of a 50¢
+        // item with 1% off that is not a cent of drift: the shopper paid the full
+        // $49.50 and the promotion vanished from the merchant's own record.
+        //
+        // So when the total does not divide evenly, the line becomes ONE unit at
+        // the exact total, with the count moved into the display name. The
+        // shopper's real quantity was never carried by this field anyway —
+        // `metadata[quantity]` is what `computeBuyNowOrder` builds the order's line
+        // item from, and it is untouched — so nothing downstream can tell the
+        // difference except that the arithmetic now closes.
+        //
+        // The even case (every sale with no coupon, and most with one) keeps the
+        // per-unit shape byte for byte, so the ordinary Stripe checkout page is
+        // unchanged.
+        const evenUnitAmountCents = Math.floor(amountCents / quantity);
+        const remainderCents = amountCents - evenUnitAmountCents * quantity;
+        const chargedQuantity = remainderCents === 0 ? quantity : 1;
+        const chargedUnitAmountCents = remainderCents === 0 ? evenUnitAmountCents : amountCents;
+        const chargedLineName = `${String((_product_name = product.name) != null ? _product_name : 'Product')}${remainderCents === 0 ? '' : ` × ${quantity}`}`.slice(0, 120);
+        // What was ACTUALLY discounted, now that the charge and `amountCents` are
+        // the same number. `Math.max(0, …)` stays as a guard against a future floor
+        // lifting the charge above list; it no longer erases a real discount,
+        // because there is no longer a rounding that can push the charge past it.
+        const discountCents = Math.max(0, listUnitAmountCents * quantity - amountCents);
+        // Subscriptions (AGL-303): recurring prices bill on the platform with
+        // a destination transfer + percent fee; the webhook records the sub.
+        // `isSubscription` resolved above (AGL-545).
+        const params = new URLSearchParams(_extends({
+            mode: isSubscription ? 'subscription' : 'payment',
+            'line_items[0][quantity]': String(chargedQuantity),
+            'line_items[0][price_data][currency]': 'usd',
+            'line_items[0][price_data][unit_amount]': String(chargedUnitAmountCents),
+            'line_items[0][price_data][product_data][name]': chargedLineName
+        }, isSubscription ? _extends({
+            'line_items[0][price_data][recurring][interval]': lifted.subscription.interval
+        }, lifted.subscription.trialDays ? {
+            'subscription_data[trial_period_days]': String(lifted.subscription.trialDays)
+        } : {}, {
+            'subscription_data[transfer_data][destination]': String(accountId)
+        }, subscriptionFeePercent > 0 ? {
+            'subscription_data[application_fee_percent]': String(subscriptionFeePercent)
+        } : {}, {
+            'subscription_data[metadata][type]': 'commerce-subscription',
+            'subscription_data[metadata][hostId]': hostId,
+            'subscription_data[metadata][productId]': productId
+        }, recurringTaxRateId ? {
+            'subscription_data[metadata][taxRateId]': recurringTaxRateId,
+            'subscription_data[metadata][taxPct]': String(taxPct)
+        } : {}) : {}, taxCents > 0 && !isSubscription ? {
+            'line_items[1][quantity]': '1',
+            'line_items[1][price_data][currency]': 'usd',
+            'line_items[1][price_data][unit_amount]': String(taxCents),
+            'line_items[1][price_data][product_data][name]': taxLabel.slice(0, 120)
+        } : {}, recurringTaxRateId ? {
+            'line_items[0][tax_rates][0]': recurringTaxRateId
+        } : {}, useStripeTax ? {
+            'automatic_tax[enabled]': 'true'
+        } : {}, !isSubscription ? CommerceModel.destinationChargeParams({
+            accountId: String(accountId),
+            feeCents,
+            taxOwner: useStripeTax ? 'platform' : 'merchant',
+            merchantGoodsCents: amountCents,
+            shippingFloorCents: CommerceModel.shippingFloorCents(shippingPlan.options)
+        }) : {}, {
+            // Substituted by Stripe on redirect — see the note in `cart-checkout.ts`
+            // (AGL-1641). The single-product path returns the shopper to the product
+            // page, so the `purchase` is reported by the PDP rather than the cart.
+            success_url: `${backUrl}${separator}order=success&session_id={CHECKOUT_SESSION_ID}`,
+            cancel_url: `${backUrl}${separator}order=canceled`,
+            'metadata[type]': isSubscription ? 'commerce-subscription' : 'commerce-order',
+            'metadata[hostId]': hostId,
+            'metadata[productId]': productId
+        }, variantId ? {
+            'metadata[variantId]': variantId
+        } : {}, {
+            'metadata[quantity]': String(quantity),
+            'metadata[feeCents]': String(feeCents)
+        }, useStripeTax && !isSubscription ? {
+            'metadata[transferCents]': String(CommerceModel.platformLiableTransferCents({
+                feeCents,
+                merchantGoodsCents: amountCents,
+                shippingFloorCents: CommerceModel.shippingFloorCents(shippingPlan.options)
+            })),
+            'metadata[transferShippingCents]': String(CommerceModel.shippingFloorCents(shippingPlan.options))
+        } : {}, recurringTaxRateId ? {
+            'metadata[taxRateId]': recurringTaxRateId,
+            'metadata[taxPct]': String(taxPct)
+        } : {}, {
+            // The order's decomposition, snapshotted as we compute it (AGL-1711).
+            // Two of these three are invisible to Stripe's own `total_details` BY
+            // OUR OWN CONSTRUCTION — the manual tax goes over as an ordinary
+            // `line_items[1]` product line, and the coupon is priced into
+            // `line_items[0]`'s unit amount — so the webhook cannot recover them
+            // from the session. Frozen here rather than re-derived from the product
+            // doc at webhook time, which a price edit in between would falsify.
+            //
+            // EXCEPT the tax on a subscription (AGL-1751): there it is a real tax
+            // rate, `amount_tax` carries it, and this snapshot must say 0 —
+            // `computeBuyNowOrder` SUMS the metadata figure with Stripe's, on the
+            // documented ground that the two are mutually exclusive, so carrying
+            // both would double-count the tax on the recorded sale.
+            'metadata[unitAmountCents]': String(listUnitAmountCents),
+            'metadata[taxCents]': String(isSubscription ? 0 : taxCents),
+            'metadata[discountCents]': String(discountCents)
+        }, appliedCoupon ? {
+            'metadata[couponCode]': appliedCoupon
+        } : {}, appliedDiscountId ? {
+            'metadata[discountId]': appliedDiscountId
+        } : {}, couponHoldKey ? {
+            'metadata[couponHoldKey]': couponHoldKey
+        } : {}, heldStockKey ? {
+            'metadata[stockHoldKey]': heldStockKey
+        } : {}, {
+            // A HALF-HOUR SESSION, AND IT IS THE HOLD'S WHOLE SAFETY ARGUMENT
+            // (AGL-2356). Stripe's default is 24 hours, and a hold must outlive any
+            // session that can still be paid — so the default would mean one
+            // abandoned cart standing on a merchant's last unit for a day, which is
+            // exactly the unbounded, invisible UNDER-sell this issue was held back
+            // for. Shortening the SESSION is what bounds it; 30 minutes is Stripe's
+            // own minimum and the same figure the bookings plugin gives a held room.
+            // Sent on subscription sessions too, deliberately: a shopper who has been
+            // sitting on a payment page for half an hour is starting again either
+            // way, and one rule is one thing to reason about.
+            expires_at: String(Math.floor((Date.now() + CommerceModel.CHECKOUT_SESSION_TTL_MS) / 1000))
+        }));
+        // Both keys or neither (AGL-1720). Stripe will not apply a shipping rate
+        // without an address to ship to, and a merchant who configured nothing
+        // resolves to no options and so gets neither key — a session byte-identical
+        // to the one this handler built before shipping existed on it. Buy-now has
+        // never collected an address, so declaring one unconditionally would put a
+        // shipping form in front of every shopper on a store that charges none.
+        if (shippingPlan.options.length > 0) {
+            CommerceModel.appendShippingAddressCollectionParams(params, shippingPlan.countries);
+            CommerceModel.appendCheckoutShippingParams(params, // Free shipping is a zeroed rate, never a coupon — see the cart's note
+            // for why a session coupon cannot reach `shipping_options` at all.
+            (resolvedDiscount == null ? void 0 : resolvedDiscount.freeShipping) === true ? shippingPlan.options.map((option)=>_extends({}, option, {
+                    amountCents: 0
+                })) : shippingPlan.options);
+        }
+        // The Payment Element (AGL-1944), and the LAST thing done to the params on
+        // purpose. Everything above — price, coupon, tax, shipping, the Connect
+        // destination, the fee, every metadata key the webhook reads — is computed
+        // identically for both checkout paths, and this rewrite touches none of it:
+        // it swaps the redirect's URL pair for `ui_mode` + `return_url` and stops.
+        // A native session that priced differently from the hosted one would be the
+        // under-collection AGL-1944 warns about, and the only defence that actually
+        // holds is that there is nowhere for the two to diverge.
+        //
+        // Off unless the flag is on for this org AND a publishable key exists, so
+        // the default remains the redirect — see `resolveNativeCheckoutMode`.
+        const nativeMode = await resolveNativeCheckoutMode(String((_ref2 = ownerOrg == null ? void 0 : (_ownerOrg_org2 = ownerOrg.org) == null ? void 0 : _ownerOrg_org2.id) != null ? _ref2 : ''));
+        if (nativeMode.native) {
+            applyNativeCheckoutParams(params, `${backUrl}${separator}order=success&session_id={CHECKOUT_SESSION_ID}`);
+        }
+        const response = await fetch('https://api.stripe.com/v1/checkout/sessions', {
+            method: 'POST',
+            headers: _extends({
+                Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
+                'Content-Type': 'application/x-www-form-urlencoded'
+            }, stripeKeyHeader('session'), nativeCheckoutStripeHeaders(nativeMode)),
+            body: params.toString()
+        });
+        const session = await response.json();
+        // `!session.url` was the liveness check, and a `ui_mode` session HAS no
+        // url — so the check moves with the mode rather than staying behind and
+        // reading every successful native session as a Stripe failure (AGL-1944).
+        const payload = response.ok ? readCheckoutSessionPayload(session, nativeMode) : null;
+        if (!payload) {
+            console.error('Stripe checkout error', session.error);
+            // Nothing was sold — hand the key back so one flaky moment does not
+            // lock this product out for the shopper.
+            await releaseCouponSlot();
+            await releaseStock();
+            await claim.release();
+            return res.status(502).json({
+                error: 'Checkout failed'
+            });
+        }
+        // THE SESSION NOW EXISTS, SO THE SLOT BELONGS TO IT (AGL-2453). Past this
+        // line the hold must survive: the shopper can still pay, and the webhook
+        // settles against the reservation. A catch that released it here would
+        // leave a paid order whose redemption is never counted — the same
+        // over-redemption this fix closes, arriving through the release path.
+        couponSlot = null;
+        // And so do the units (AGL-2356), for the stronger version of the same
+        // reason: releasing here would hand the last unit to the next shopper while
+        // this one still holds a payable session, which is the oversell itself.
+        stockHold = null;
+        await claim.record(200, payload);
+        return res.status(200).json(payload);
+    } catch (error) {
+        console.error(error);
+        // Release on the way out so a transient failure does not strand the key
+        // (AGL-1691's rule).
+        await releaseCouponSlot();
+        await releaseStock();
+        await (claim == null ? void 0 : claim.release());
+        return res.status(500).json({
+            error: 'Checkout failed'
+        });
+    }
+};
+
+//# sourceMappingURL=checkout.js.map