@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/manual-tax-rate.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A merchant's `manual`-mode tax as a real Stripe Tax Rate (AGL-1953).
+ *
+ * ## Why this exists as its own module
+ *
+ * AGL-1751 built exactly this — mint a Tax Rate on the platform account, cache
+ * it under the host — inline in `checkout.ts`, for subscriptions. AGL-1953
+ * needed the same thing for the cart and draft-order paths, and a second copy
+ * of a money-shaped cache is how two paths quietly diverge. One implementation,
+ * three callers.
+ *
+ * ## Why a TAX RATE and not another line item
+ *
+ * Buy-now's one-time construction (AGL-1711) appends the tax as an ordinary
+ * `line_items[1]` product line Stripe is never told is tax. That works there
+ * because buy-now prices its discount INTO the unit amount, so nothing at
+ * session level can touch the tax line afterwards.
+ *
+ * **The cart cannot use it.** The cart applies its discounts, coupons and gift
+ * cards as real Stripe coupons at `discounts[0][coupon]`, and a session-level
+ * coupon is spread across every line — including a fake tax line. The tax would
+ * be discounted along with the goods, and the `metadata[taxCents]` snapshot
+ * would then over-state what was actually collected.
+ *
+ * A real tax rate is applied by Stripe AFTER the discount, which is the
+ * behaviour we want and which was MEASURED rather than assumed. Test mode, a
+ * $100.00 line carrying an 8.25% rate plus a $30.00 `amount_off` coupon:
+ *
+ *   amount_subtotal 10000, amount_discount 3000, **amount_tax 578**,
+ *   breakdown.taxes[0].taxable_amount **7000**
+ *
+ * 578 is 8.25% of the discounted 7000, not of the 10000 subtotal. Stripe
+ * discounts first and taxes the remainder, so the arithmetic stays right with
+ * no snapshot to keep in step — and `total_details.amount_tax` becomes a real
+ * field, so the order's own decomposition needs no metadata witness at all.
+ *
+ * ## This does NOT make the sale Stripe Tax
+ *
+ * `automatic_tax.enabled` stays `false` (confirmed on the same measured
+ * session), which is the discriminator `storefront-tax.ts` reads. A rate minted
+ * here is the merchant's own configured percentage against their own declared
+ * origin; Aglyn's registrations never enter into it and the money is not
+ * Aglyn's to remit. Reading tax-LINE presence instead of the flag would book
+ * this as Aglyn-collected, which is the AGL-1904 trap stated in that module.
+ */
+/**
+ * The rate id for (percentage, label) on this host, minting and caching one on
+ * first use. `null` means Stripe refused — the caller decides what that costs,
+ * and for every current caller it is a visible 502 rather than a silent
+ * untaxed sale.
+ *
+ * The rate is created on the PLATFORM account (no `Stripe-Account` header),
+ * matching the session calls, because that is where the session lives — a
+ * connected-account rate id would not resolve. Tax rates are immutable, so one
+ * object exists per (percentage, label): a merchant who edits their zone rate
+ * misses the cache and mints a fresh one, while the old object stays behind on
+ * everything already carrying it, exactly as it should.
+ */
+export declare function resolveManualTaxRateId(options: {
+    /** `hosts/{hostId}` — the cache lives under it. */
+    hostRef: any;
+    taxPct: number;
+    taxLabel: string;
+    /** Per-object idempotency header, derived by the caller (AGL-1714). */
+    headers?: Record<string, string>;
+}): Promise<string | null>;

package/src/lib/server/manual-tax-rate.js

@@ -0,0 +1,113 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A merchant's `manual`-mode tax as a real Stripe Tax Rate (AGL-1953).
+ *
+ * ## Why this exists as its own module
+ *
+ * AGL-1751 built exactly this — mint a Tax Rate on the platform account, cache
+ * it under the host — inline in `checkout.ts`, for subscriptions. AGL-1953
+ * needed the same thing for the cart and draft-order paths, and a second copy
+ * of a money-shaped cache is how two paths quietly diverge. One implementation,
+ * three callers.
+ *
+ * ## Why a TAX RATE and not another line item
+ *
+ * Buy-now's one-time construction (AGL-1711) appends the tax as an ordinary
+ * `line_items[1]` product line Stripe is never told is tax. That works there
+ * because buy-now prices its discount INTO the unit amount, so nothing at
+ * session level can touch the tax line afterwards.
+ *
+ * **The cart cannot use it.** The cart applies its discounts, coupons and gift
+ * cards as real Stripe coupons at `discounts[0][coupon]`, and a session-level
+ * coupon is spread across every line — including a fake tax line. The tax would
+ * be discounted along with the goods, and the `metadata[taxCents]` snapshot
+ * would then over-state what was actually collected.
+ *
+ * A real tax rate is applied by Stripe AFTER the discount, which is the
+ * behaviour we want and which was MEASURED rather than assumed. Test mode, a
+ * $100.00 line carrying an 8.25% rate plus a $30.00 `amount_off` coupon:
+ *
+ *   amount_subtotal 10000, amount_discount 3000, **amount_tax 578**,
+ *   breakdown.taxes[0].taxable_amount **7000**
+ *
+ * 578 is 8.25% of the discounted 7000, not of the 10000 subtotal. Stripe
+ * discounts first and taxes the remainder, so the arithmetic stays right with
+ * no snapshot to keep in step — and `total_details.amount_tax` becomes a real
+ * field, so the order's own decomposition needs no metadata witness at all.
+ *
+ * ## This does NOT make the sale Stripe Tax
+ *
+ * `automatic_tax.enabled` stays `false` (confirmed on the same measured
+ * session), which is the discriminator `storefront-tax.ts` reads. A rate minted
+ * here is the merchant's own configured percentage against their own declared
+ * origin; Aglyn's registrations never enter into it and the money is not
+ * Aglyn's to remit. Reading tax-LINE presence instead of the flag would book
+ * this as Aglyn-collected, which is the AGL-1904 trap stated in that module.
+ */ /**
+ * The rate id for (percentage, label) on this host, minting and caching one on
+ * first use. `null` means Stripe refused — the caller decides what that costs,
+ * and for every current caller it is a visible 502 rather than a silent
+ * untaxed sale.
+ *
+ * The rate is created on the PLATFORM account (no `Stripe-Account` header),
+ * matching the session calls, because that is where the session lives — a
+ * connected-account rate id would not resolve. Tax rates are immutable, so one
+ * object exists per (percentage, label): a merchant who edits their zone rate
+ * misses the cache and mints a fresh one, while the old object stays behind on
+ * everything already carrying it, exactly as it should.
+ */ export async function resolveManualTaxRateId(options) {
+    var _cached_get;
+    const { hostRef, taxPct, taxLabel, headers = {} } = options;
+    if (!(taxPct > 0)) return null;
+    // ≤4 decimal places, which is all Stripe accepts on a tax rate.
+    const percentage = Math.round(taxPct * 10000) / 10000;
+    const displayLabel = (taxLabel || `Tax (${percentage}%)`).slice(0, 50);
+    const cacheKey = `p${Math.round(percentage * 10000)}-${encodeURIComponent(displayLabel)}`;
+    const cacheRef = hostRef.collection('stripeTaxRates').doc(cacheKey);
+    const cached = await cacheRef.get();
+    const cachedId = String((_cached_get = cached.get('taxRateId')) != null ? _cached_get : '');
+    if (cachedId) return cachedId;
+    const response = await fetch('https://api.stripe.com/v1/tax_rates', {
+        method: 'POST',
+        headers: _extends({
+            Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
+            'Content-Type': 'application/x-www-form-urlencoded'
+        }, headers),
+        body: new URLSearchParams({
+            display_name: displayLabel,
+            percentage: String(percentage),
+            inclusive: 'false'
+        }).toString()
+    });
+    const taxRate = await response.json();
+    if (!response.ok || !taxRate.id) {
+        console.error('Stripe tax rate error', taxRate.error);
+        return null;
+    }
+    // Best-effort: the rate exists either way, and two concurrent misses racing
+    // this write just means one orphan rate on the dashboard.
+    await cacheRef.set({
+        taxRateId: String(taxRate.id),
+        pct: percentage,
+        label: displayLabel,
+        createdAtMs: Date.now()
+    }).catch(()=>undefined);
+    return String(taxRate.id);
+}
+
+//# sourceMappingURL=manual-tax-rate.js.map

package/src/lib/server/manual-tax-rate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/manual-tax-rate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A merchant's `manual`-mode tax as a real Stripe Tax Rate (AGL-1953).\n *\n * ## Why this exists as its own module\n *\n * AGL-1751 built exactly this — mint a Tax Rate on the platform account, cache\n * it under the host — inline in `checkout.ts`, for subscriptions. AGL-1953\n * needed the same thing for the cart and draft-order paths, and a second copy\n * of a money-shaped cache is how two paths quietly diverge. One implementation,\n * three callers.\n *\n * ## Why a TAX RATE and not another line item\n *\n * Buy-now's one-time construction (AGL-1711) appends the tax as an ordinary\n * `line_items[1]` product line Stripe is never told is tax. That works there\n * because buy-now prices its discount INTO the unit amount, so nothing at\n * session level can touch the tax line afterwards.\n *\n * **The cart cannot use it.** The cart applies its discounts, coupons and gift\n * cards as real Stripe coupons at `discounts[0][coupon]`, and a session-level\n * coupon is spread across every line — including a fake tax line. The tax would\n * be discounted along with the goods, and the `metadata[taxCents]` snapshot\n * would then over-state what was actually collected.\n *\n * A real tax rate is applied by Stripe AFTER the discount, which is the\n * behaviour we want and which was MEASURED rather than assumed. Test mode, a\n * $100.00 line carrying an 8.25% rate plus a $30.00 `amount_off` coupon:\n *\n *   amount_subtotal 10000, amount_discount 3000, **amount_tax 578**,\n *   breakdown.taxes[0].taxable_amount **7000**\n *\n * 578 is 8.25% of the discounted 7000, not of the 10000 subtotal. Stripe\n * discounts first and taxes the remainder, so the arithmetic stays right with\n * no snapshot to keep in step — and `total_details.amount_tax` becomes a real\n * field, so the order's own decomposition needs no metadata witness at all.\n *\n * ## This does NOT make the sale Stripe Tax\n *\n * `automatic_tax.enabled` stays `false` (confirmed on the same measured\n * session), which is the discriminator `storefront-tax.ts` reads. A rate minted\n * here is the merchant's own configured percentage against their own declared\n * origin; Aglyn's registrations never enter into it and the money is not\n * Aglyn's to remit. Reading tax-LINE presence instead of the flag would book\n * this as Aglyn-collected, which is the AGL-1904 trap stated in that module.\n */\n\n/**\n * The rate id for (percentage, label) on this host, minting and caching one on\n * first use. `null` means Stripe refused — the caller decides what that costs,\n * and for every current caller it is a visible 502 rather than a silent\n * untaxed sale.\n *\n * The rate is created on the PLATFORM account (no `Stripe-Account` header),\n * matching the session calls, because that is where the session lives — a\n * connected-account rate id would not resolve. Tax rates are immutable, so one\n * object exists per (percentage, label): a merchant who edits their zone rate\n * misses the cache and mints a fresh one, while the old object stays behind on\n * everything already carrying it, exactly as it should.\n */\nexport async function resolveManualTaxRateId(options: {\n  /** `hosts/{hostId}` — the cache lives under it. */\n  hostRef: any\n  taxPct: number\n  taxLabel: string\n  /** Per-object idempotency header, derived by the caller (AGL-1714). */\n  headers?: Record<string, string>\n}): Promise<string | null> {\n  const { hostRef, taxPct, taxLabel, headers = {} } = options\n  if (!(taxPct > 0)) return null\n  // ≤4 decimal places, which is all Stripe accepts on a tax rate.\n  const percentage = Math.round(taxPct * 10000) / 10000\n  const displayLabel = (taxLabel || `Tax (${percentage}%)`).slice(0, 50)\n  const cacheKey = `p${Math.round(percentage * 10000)}-${encodeURIComponent(\n    displayLabel,\n  )}`\n  const cacheRef = hostRef.collection('stripeTaxRates').doc(cacheKey)\n  const cached = await cacheRef.get()\n  const cachedId = String(cached.get('taxRateId') ?? '')\n  if (cachedId) return cachedId\n\n  const response = await fetch('https://api.stripe.com/v1/tax_rates', {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n      ...headers,\n    },\n    body: new URLSearchParams({\n      display_name: displayLabel,\n      percentage: String(percentage),\n      inclusive: 'false',\n    }).toString(),\n  })\n  const taxRate = (await response.json()) as { id?: string; error?: any }\n  if (!response.ok || !taxRate.id) {\n    console.error('Stripe tax rate error', taxRate.error)\n    return null\n  }\n  // Best-effort: the rate exists either way, and two concurrent misses racing\n  // this write just means one orphan rate on the dashboard.\n  await cacheRef\n    .set({\n      taxRateId: String(taxRate.id),\n      pct: percentage,\n      label: displayLabel,\n      createdAtMs: Date.now(),\n    })\n    .catch(() => undefined)\n  return String(taxRate.id)\n}\n"],"names":["resolveManualTaxRateId","options","cached","hostRef","taxPct","taxLabel","headers","percentage","Math","round","displayLabel","slice","cacheKey","encodeURIComponent","cacheRef","collection","doc","get","cachedId","String","response","fetch","method","Authorization","process","env","STRIPE_SECRET_KEY","body","URLSearchParams","display_name","inclusive","toString","taxRate","json","ok","id","console","error","set","taxRateId","pct","label","createdAtMs","Date","now","catch","undefined"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAED;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeA,uBAAuBC,OAO5C;QAWyBC;IAVxB,MAAM,EAAEC,OAAO,EAAEC,MAAM,EAAEC,QAAQ,EAAEC,UAAU,CAAC,CAAC,EAAE,GAAGL;IACpD,IAAI,CAAEG,CAAAA,SAAS,CAAA,GAAI,OAAO;IAC1B,gEAAgE;IAChE,MAAMG,aAAaC,KAAKC,KAAK,CAACL,SAAS,SAAS;IAChD,MAAMM,eAAe,AAACL,CAAAA,YAAY,CAAC,KAAK,EAAEE,WAAW,EAAE,CAAC,AAAD,EAAGI,KAAK,CAAC,GAAG;IACnE,MAAMC,WAAW,CAAC,CAAC,EAAEJ,KAAKC,KAAK,CAACF,aAAa,OAAO,CAAC,EAAEM,mBACrDH,eACC;IACH,MAAMI,WAAWX,QAAQY,UAAU,CAAC,kBAAkBC,GAAG,CAACJ;IAC1D,MAAMV,SAAS,MAAMY,SAASG,GAAG;IACjC,MAAMC,WAAWC,QAAOjB,cAAAA,OAAOe,GAAG,CAAC,wBAAXf,cAA2B;IACnD,IAAIgB,UAAU,OAAOA;IAErB,MAAME,WAAW,MAAMC,MAAM,uCAAuC;QAClEC,QAAQ;QACRhB,SAAS;YACPiB,eAAe,CAAC,OAAO,EAAEC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;YACxD,gBAAgB;WACbpB;QAELqB,MAAM,IAAIC,gBAAgB;YACxBC,cAAcnB;YACdH,YAAYY,OAAOZ;YACnBuB,WAAW;QACb,GAAGC,QAAQ;IACb;IACA,MAAMC,UAAW,MAAMZ,SAASa,IAAI;IACpC,IAAI,CAACb,SAASc,EAAE,IAAI,CAACF,QAAQG,EAAE,EAAE;QAC/BC,QAAQC,KAAK,CAAC,yBAAyBL,QAAQK,KAAK;QACpD,OAAO;IACT;IACA,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAMvB,SACHwB,GAAG,CAAC;QACHC,WAAWpB,OAAOa,QAAQG,EAAE;QAC5BK,KAAKjC;QACLkC,OAAO/B;QACPgC,aAAaC,KAAKC,GAAG;IACvB,GACCC,KAAK,CAAC,IAAMC;IACf,OAAO3B,OAAOa,QAAQG,EAAE;AAC1B"}

package/src/lib/server/member-feed.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Member feed (AGL-316): posts the signed-in member is entitled to —
+ * unscoped posts need any live subscription; product-scoped posts need
+ * that product's entitlement. Server-enforced; bodies never reach
+ * non-members.
+ */
+export declare const memberFeedHandler: PluginApiHandler;

package/src/lib/server/member-feed.js

@@ -0,0 +1,72 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { requireActiveMember } from "./membership.js";
+import { checkMemberEntitlement } from "./gate.js";
+/**
+ * Member feed (AGL-316): posts the signed-in member is entitled to —
+ * unscoped posts need any live subscription; product-scoped posts need
+ * that product's entitlement. Server-enforced; bodies never reach
+ * non-members.
+ */ export const memberFeedHandler = async (req, res)=>{
+    var _req_query_hostId;
+    const hostId = String((_req_query_hostId = req.query.hostId) != null ? _req_query_hostId : '');
+    if (!hostId) return res.status(400).json({
+        error: 'Missing hostId'
+    });
+    try {
+        var _auth_member_get;
+        // Suspension gate (AGL-550): a suspended member's cookie (AGL-546)
+        // no longer reads the feed — 403'd with the cookie cleared.
+        const auth = await requireActiveMember(req, res, hostId, 'Sign in first');
+        if (!auth) return;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const email = String((_auth_member_get = auth.member.get('email')) != null ? _auth_member_get : '');
+        if (!email) return res.status(401).json({
+            error: 'Sign in first'
+        });
+        const postsSnapshot = await hostRef.collection('memberPosts').limit(50).get();
+        const entitlementCache = new Map();
+        const posts = [];
+        for (const docSnapshot of postsSnapshot.docs){
+            var _docSnapshot_get, _docSnapshot_get1, _docSnapshot_get2, _docSnapshot_get3;
+            const scope = String((_docSnapshot_get = docSnapshot.get('productId')) != null ? _docSnapshot_get : '') || 'any';
+            if (!entitlementCache.has(scope)) {
+                entitlementCache.set(scope, await checkMemberEntitlement(hostId, email, scope));
+            }
+            if (!entitlementCache.get(scope)) continue;
+            posts.push({
+                id: docSnapshot.id,
+                title: String((_docSnapshot_get1 = docSnapshot.get('title')) != null ? _docSnapshot_get1 : ''),
+                body: String((_docSnapshot_get2 = docSnapshot.get('body')) != null ? _docSnapshot_get2 : ''),
+                createdAtMs: Number((_docSnapshot_get3 = docSnapshot.get('createdAtMs')) != null ? _docSnapshot_get3 : 0)
+            });
+        }
+        posts.sort((a, b)=>b.createdAtMs - a.createdAtMs);
+        res.setHeader('Cache-Control', 'private, no-store');
+        return res.status(200).json({
+            posts
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Feed unavailable'
+        });
+    }
+};
+
+//# sourceMappingURL=member-feed.js.map

package/src/lib/server/member-feed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/member-feed.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { requireActiveMember } from './membership'\nimport { checkMemberEntitlement } from './gate'\n\n/**\n * Member feed (AGL-316): posts the signed-in member is entitled to —\n * unscoped posts need any live subscription; product-scoped posts need\n * that product's entitlement. Server-enforced; bodies never reach\n * non-members.\n */\nexport const memberFeedHandler: PluginApiHandler = async (req, res) => {\n  const hostId = String(req.query.hostId ?? '')\n  if (!hostId) return res.status(400).json({ error: 'Missing hostId' })\n  try {\n    // Suspension gate (AGL-550): a suspended member's cookie (AGL-546)\n    // no longer reads the feed — 403'd with the cookie cleared.\n    const auth = await requireActiveMember(req, res, hostId, 'Sign in first')\n    if (!auth) return\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const email = String(auth.member.get('email') ?? '')\n    if (!email) return res.status(401).json({ error: 'Sign in first' })\n\n    const postsSnapshot = await hostRef\n      .collection('memberPosts')\n      .limit(50)\n      .get()\n    const entitlementCache = new Map<string, boolean>()\n    const posts: Array<{\n      id: string\n      title: string\n      body: string\n      createdAtMs: number\n    }> = []\n    for (const docSnapshot of postsSnapshot.docs) {\n      const scope = String(docSnapshot.get('productId') ?? '') || 'any'\n      if (!entitlementCache.has(scope)) {\n        entitlementCache.set(\n          scope,\n          await checkMemberEntitlement(hostId, email, scope),\n        )\n      }\n      if (!entitlementCache.get(scope)) continue\n      posts.push({\n        id: docSnapshot.id,\n        title: String(docSnapshot.get('title') ?? ''),\n        body: String(docSnapshot.get('body') ?? ''),\n        createdAtMs: Number(docSnapshot.get('createdAtMs') ?? 0),\n      })\n    }\n    posts.sort((a, b) => b.createdAtMs - a.createdAtMs)\n    res.setHeader('Cache-Control', 'private, no-store')\n    return res.status(200).json({ posts })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Feed unavailable' })\n  }\n}\n"],"names":["firebaseAdmin","requireActiveMember","checkMemberEntitlement","memberFeedHandler","req","res","hostId","String","query","status","json","error","auth","firestore","app","hostRef","collection","doc","email","member","get","postsSnapshot","limit","entitlementCache","Map","posts","docSnapshot","docs","scope","has","set","push","id","title","body","createdAtMs","Number","sort","a","b","setHeader","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,mBAAmB,QAAQ,kBAAc;AAClD,SAASC,sBAAsB,QAAQ,YAAQ;AAE/C;;;;;CAKC,GACD,OAAO,MAAMC,oBAAsC,OAAOC,KAAKC;QACvCD;IAAtB,MAAME,SAASC,QAAOH,oBAAAA,IAAII,KAAK,CAACF,MAAM,YAAhBF,oBAAoB;IAC1C,IAAI,CAACE,QAAQ,OAAOD,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAiB;IACnE,IAAI;YAOmBC;QANrB,mEAAmE;QACnE,4DAA4D;QAC5D,MAAMA,OAAO,MAAMX,oBAAoBG,KAAKC,KAAKC,QAAQ;QACzD,IAAI,CAACM,MAAM;QACX,MAAMC,YAAYb,cAAcc,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACX;QAClD,MAAMY,QAAQX,QAAOK,mBAAAA,KAAKO,MAAM,CAACC,GAAG,CAAC,oBAAhBR,mBAA4B;QACjD,IAAI,CAACM,OAAO,OAAOb,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;QAEjE,MAAMU,gBAAgB,MAAMN,QACzBC,UAAU,CAAC,eACXM,KAAK,CAAC,IACNF,GAAG;QACN,MAAMG,mBAAmB,IAAIC;QAC7B,MAAMC,QAKD,EAAE;QACP,KAAK,MAAMC,eAAeL,cAAcM,IAAI,CAAE;gBACvBD,kBAULA,mBACDA,mBACOA;YAZtB,MAAME,QAAQrB,QAAOmB,mBAAAA,YAAYN,GAAG,CAAC,wBAAhBM,mBAAgC,OAAO;YAC5D,IAAI,CAACH,iBAAiBM,GAAG,CAACD,QAAQ;gBAChCL,iBAAiBO,GAAG,CAClBF,OACA,MAAM1B,uBAAuBI,QAAQY,OAAOU;YAEhD;YACA,IAAI,CAACL,iBAAiBH,GAAG,CAACQ,QAAQ;YAClCH,MAAMM,IAAI,CAAC;gBACTC,IAAIN,YAAYM,EAAE;gBAClBC,OAAO1B,QAAOmB,oBAAAA,YAAYN,GAAG,CAAC,oBAAhBM,oBAA4B;gBAC1CQ,MAAM3B,QAAOmB,oBAAAA,YAAYN,GAAG,CAAC,mBAAhBM,oBAA2B;gBACxCS,aAAaC,QAAOV,oBAAAA,YAAYN,GAAG,CAAC,0BAAhBM,oBAAkC;YACxD;QACF;QACAD,MAAMY,IAAI,CAAC,CAACC,GAAGC,IAAMA,EAAEJ,WAAW,GAAGG,EAAEH,WAAW;QAClD9B,IAAImC,SAAS,CAAC,iBAAiB;QAC/B,OAAOnC,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEe;QAAM;IACtC,EAAE,OAAOd,OAAO;QACd8B,QAAQ9B,KAAK,CAACA;QACd,OAAON,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmB;IAC1D;AACF,EAAC"}

package/src/lib/server/member-name-search.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The search fields that travel with a site member's display name (AGL-2501).
+ *
+ * The console's Site users card is paged, so a name search that compares the
+ * rows already fetched answers "no such member" for everyone past the first
+ * page. Searching the whole collection needs a query, and a query over a raw
+ * `displayName` is case-sensitive — it would miss rather than fail, which is
+ * the worse of the two.
+ *
+ * `email` needs no twin: the register path already lower-cases it before
+ * storing, so the stored value IS its own normalized key.
+ *
+ * ⚠️ EVERY writer of `displayName` must call this. A member updated through a
+ * path that skips it keeps a stale key and becomes unfindable by their new
+ * name while still listing normally — the quiet half of a search bug.
+ */
+export declare function memberNameSearchFields(displayName: string): {
+    displayName: string;
+    displayNameLower: string;
+    displayNameTokens: string[];
+};

package/src/lib/server/member-name-search.js

@@ -0,0 +1,42 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { nameSearchKey, nameSearchTokens } from "@aglyn/aglyn/app-utils/name-search";
+/**
+ * The search fields that travel with a site member's display name (AGL-2501).
+ *
+ * The console's Site users card is paged, so a name search that compares the
+ * rows already fetched answers "no such member" for everyone past the first
+ * page. Searching the whole collection needs a query, and a query over a raw
+ * `displayName` is case-sensitive — it would miss rather than fail, which is
+ * the worse of the two.
+ *
+ * `email` needs no twin: the register path already lower-cases it before
+ * storing, so the stored value IS its own normalized key.
+ *
+ * ⚠️ EVERY writer of `displayName` must call this. A member updated through a
+ * path that skips it keeps a stale key and becomes unfindable by their new
+ * name while still listing normally — the quiet half of a search bug.
+ */ export function memberNameSearchFields(displayName) {
+    return {
+        displayName,
+        displayNameLower: nameSearchKey(displayName),
+        // Every prefix of every WORD, so a reader finds "Ada Lovelace" by typing
+        // "lovelace" and not only by typing "ada".
+        displayNameTokens: nameSearchTokens(displayName)
+    };
+}
+
+//# sourceMappingURL=member-name-search.js.map

package/src/lib/server/member-name-search.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/member-name-search.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  nameSearchKey,\n  nameSearchTokens,\n} from '@aglyn/aglyn/app-utils/name-search'\n\n/**\n * The search fields that travel with a site member's display name (AGL-2501).\n *\n * The console's Site users card is paged, so a name search that compares the\n * rows already fetched answers \"no such member\" for everyone past the first\n * page. Searching the whole collection needs a query, and a query over a raw\n * `displayName` is case-sensitive — it would miss rather than fail, which is\n * the worse of the two.\n *\n * `email` needs no twin: the register path already lower-cases it before\n * storing, so the stored value IS its own normalized key.\n *\n * ⚠️ EVERY writer of `displayName` must call this. A member updated through a\n * path that skips it keeps a stale key and becomes unfindable by their new\n * name while still listing normally — the quiet half of a search bug.\n */\nexport function memberNameSearchFields(displayName: string): {\n  displayName: string\n  displayNameLower: string\n  displayNameTokens: string[]\n} {\n  return {\n    displayName,\n    displayNameLower: nameSearchKey(displayName),\n    // Every prefix of every WORD, so a reader finds \"Ada Lovelace\" by typing\n    // \"lovelace\" and not only by typing \"ada\".\n    displayNameTokens: nameSearchTokens(displayName),\n  }\n}\n"],"names":["nameSearchKey","nameSearchTokens","memberNameSearchFields","displayName","displayNameLower","displayNameTokens"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,aAAa,EACbC,gBAAgB,QACX,qCAAoC;AAE3C;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,uBAAuBC,WAAmB;IAKxD,OAAO;QACLA;QACAC,kBAAkBJ,cAAcG;QAChC,yEAAyE;QACzE,2CAA2C;QAC3CE,mBAAmBJ,iBAAiBE;IACtC;AACF"}

package/src/lib/server/member-post.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Member post publish (AGL-316): manager-gated; writes the post and
+ * optionally emails the entitled subscribers (product-scoped or all
+ * live subscribers) through the env-gated Resend pipeline.
+ */
+export declare const memberPostHandler: PluginApiHandler;

package/src/lib/server/member-post.js

@@ -0,0 +1,166 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin, getOrgForHost, hostSendingIdentity, meterHostEmail } from "@aglyn/tenant-data-admin";
+import * as CommerceModel from "../model/index.js";
+import { isEmailConfigured, sendEmail } from "@aglyn/shared-util-email";
+import { EMAIL_TOPIC_NEWSLETTER, hostPublicOrigin, resolveBrandingProfile } from "@aglyn/aglyn/server";
+// Which member subscribers are live enough to email (AGL-316). The list itself
+// now lives in the model as `isTenantSubscriptionLive` (AGL-1849) — it was a
+// private copy here and a second private copy in `gate.ts`, which is the drift
+// AGL-1715 guards against on the org side.
+/**
+ * Member post publish (AGL-316): manager-gated; writes the post and
+ * optionally emails the entitled subscribers (product-scoped or all
+ * live subscribers) through the env-gated Resend pipeline.
+ */ export const memberPostHandler = async (req, res)=>{
+    var _req_headers_authorization, _req_body, _body_hostId, _body_title, _body_body, _body_productId;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const hostId = String((_body_hostId = body.hostId) != null ? _body_hostId : '');
+    const title = String((_body_title = body.title) != null ? _body_title : '').trim().slice(0, 160);
+    const postBody = String((_body_body = body.body) != null ? _body_body : '').trim().slice(0, 5000);
+    const productId = String((_body_productId = body.productId) != null ? _body_productId : '').trim();
+    const emailSubscribers = Boolean(body.emailSubscribers);
+    if (!hostId || !title) {
+        return res.status(400).json({
+            error: 'Missing hostId or title'
+        });
+    }
+    try {
+        var _hostSnapshot_get;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        // AN ALLOWLIST (AGL-2372), matching `gift-cards.ts` and the AGL-2262
+        // correction to the register. The old `!role || role === 'viewer'`
+        // denylist admitted every string that was not literally `viewer` — and
+        // since AGL-2334 that includes `author`, a real grantable role, on a route
+        // that publishes to paying subscribers and sends them mail on the
+        // merchant's brand. A denylist that widens whenever the role union grows
+        // is the defect; the set is the fix. Absent is refused, not permitted.
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin' && memberRole !== 'editor') {
+            return res.status(403).json({
+                error: 'Not permitted'
+            });
+        }
+        const postRef = await hostRef.collection('memberPosts').add(_extends({
+            title,
+            body: postBody
+        }, productId ? {
+            productId
+        } : {}, {
+            createdAtMs: Date.now(),
+            createdBy: decoded.uid
+        }));
+        let emailed = 0;
+        if (emailSubscribers && isEmailConfigured()) {
+            var _hostPublicOrigin;
+            var _this;
+            /*
+       * ORDERED (D1). This was `limit(500)` with no `orderBy`, and Firestore
+       * answers an unordered limit in DOCUMENT-ID order — so a site past the
+       * ceiling mailed whichever five hundred subscriptions happened to hash
+       * low, and the same five hundred every time. `__name__` is the order it
+       * was already getting; stating it makes the window a decision rather
+       * than an accident, and makes it the same window on every publish.
+       */ const subscriptions = await hostRef.collection('subscriptions').orderBy(firebaseAdmin.firestore.FieldPath.documentId()).limit(500).get();
+            const recipients = [
+                ...new Set(subscriptions.docs.filter((docSnapshot)=>CommerceModel.isTenantSubscriptionLive(docSnapshot.get('status')) && (!productId || docSnapshot.get('productId') === productId) && docSnapshot.get('customerEmail')).map((docSnapshot)=>String(docSnapshot.get('customerEmail'))))
+            ].slice(0, 200);
+            // White-label sender identity (White-Label Phase 3): the store's brand
+            // via the one shared resolver, from the owning org doc.
+            const branding = resolveBrandingProfile((_this = await getOrgForHost(hostId).catch(()=>null)) == null ? void 0 : _this.org);
+            // The site's own origin, for the unsubscribe link the gate mints. Read
+            // from the host document already in hand rather than assembled from an
+            // apex: a post is mailed and read later, and a wrong origin sends a
+            // subscriber's opt-out to a domain the merchant does not control.
+            const siteBase = (_hostPublicOrigin = hostPublicOrigin({
+                cname: hostSnapshot.get('cname'),
+                subdomain: hostSnapshot.get('subdomain')
+            })) != null ? _hostPublicOrigin : '';
+            /*
+       * ONE site, up to two hundred recipients — so the identity is resolved
+       * once and reused, not read per message. Hoisted rather than cached
+       * inside the helper for the reason its docblock gives: verification can
+       * change under a long-lived process, so how long a resolution may be
+       * trusted is the caller's declaration.
+       */ const identity = await hostSendingIdentity(hostId);
+            for (const to of recipients){
+                /*
+         * MARKETING. A member post is a merchant mailing their audience, so
+         * it carries the unsubscribe header pair and a visible link, it is
+         * checked against both suppression lists, and it counts against how
+         * much mail one person receives from this site.
+         *
+         * Priority stays transactional — this handler answers a click and has
+         * nowhere to put a message the hourly governor deferred, and the rule
+         * on `'bulk'` is that only a resumable sweep may use it.
+         */ const result = await sendEmail({
+                    to,
+                    subject: title,
+                    text: postBody || title,
+                    fromName: branding.fromName,
+                    sendingIdentity: identity,
+                    audience: 'tenant',
+                    context: 'member post',
+                    /*
+           * A post to a site's members is the "Newsletter" stream — regular
+           * news and stories from the site. Declared so a member who left
+           * that stream, while staying subscribed to everything else, is not
+           * mailed it; the gate asks the topic only for callers that name
+           * one.
+           */ marketing: {
+                        hostId,
+                        siteBase,
+                        topicId: EMAIL_TOPIC_NEWSLETTER
+                    }
+                });
+                // The cost meter counts messages that LEFT. A suppressed or capped
+                // recipient produced no message and therefore no cost, and counting
+                // one would bill a merchant for the control working.
+                if (result.sent) emailed += 1;
+            }
+            // Cost meter (AGL-1438), once for the batch rather than per recipient —
+            // same number, one write. Transactional: a member post is content the
+            // subscriber is paying for, not a discretionary campaign, so it counts
+            // toward cost and is never refused by the campaign cap.
+            await meterHostEmail(hostId, emailed);
+        }
+        return res.status(200).json({
+            postId: postRef.id,
+            emailed
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Publish failed'
+        });
+    }
+};
+
+//# sourceMappingURL=member-post.js.map

package/src/lib/server/member-post.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/member-post.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  meterHostEmail,\n} from '@aglyn/tenant-data-admin'\nimport * as CommerceModel from '../model'\nimport { isEmailConfigured, sendEmail } from '@aglyn/shared-util-email'\nimport {\n  EMAIL_TOPIC_NEWSLETTER,\n  hostPublicOrigin,\n  type PluginApiHandler,\n  resolveBrandingProfile,\n} from '@aglyn/aglyn/server'\n\n// Which member subscribers are live enough to email (AGL-316). The list itself\n// now lives in the model as `isTenantSubscriptionLive` (AGL-1849) — it was a\n// private copy here and a second private copy in `gate.ts`, which is the drift\n// AGL-1715 guards against on the org side.\n\n/**\n * Member post publish (AGL-316): manager-gated; writes the post and\n * optionally emails the entitled subscribers (product-scoped or all\n * live subscribers) through the env-gated Resend pipeline.\n */\nexport const memberPostHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const title = String(body.title ?? '').trim().slice(0, 160)\n  const postBody = String(body.body ?? '').trim().slice(0, 5000)\n  const productId = String(body.productId ?? '').trim()\n  const emailSubscribers = Boolean(body.emailSubscribers)\n  if (!hostId || !title) {\n    return res.status(400).json({ error: 'Missing hostId or title' })\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    // AN ALLOWLIST (AGL-2372), matching `gift-cards.ts` and the AGL-2262\n    // correction to the register. The old `!role || role === 'viewer'`\n    // denylist admitted every string that was not literally `viewer` — and\n    // since AGL-2334 that includes `author`, a real grantable role, on a route\n    // that publishes to paying subscribers and sends them mail on the\n    // merchant's brand. A denylist that widens whenever the role union grows\n    // is the defect; the set is the fix. Absent is refused, not permitted.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not permitted' })\n    }\n    const postRef = await hostRef.collection('memberPosts').add({\n      title,\n      body: postBody,\n      ...(productId ? { productId } : {}),\n      createdAtMs: Date.now(),\n      createdBy: decoded.uid,\n    })\n\n    let emailed = 0\n    if (emailSubscribers && isEmailConfigured()) {\n      /*\n       * ORDERED (D1). This was `limit(500)` with no `orderBy`, and Firestore\n       * answers an unordered limit in DOCUMENT-ID order — so a site past the\n       * ceiling mailed whichever five hundred subscriptions happened to hash\n       * low, and the same five hundred every time. `__name__` is the order it\n       * was already getting; stating it makes the window a decision rather\n       * than an accident, and makes it the same window on every publish.\n       */\n      const subscriptions = await hostRef\n        .collection('subscriptions')\n        .orderBy(firebaseAdmin.firestore.FieldPath.documentId())\n        .limit(500)\n        .get()\n      const recipients = [\n        ...new Set(\n          subscriptions.docs\n            .filter(\n              (docSnapshot) =>\n                CommerceModel.isTenantSubscriptionLive(\n                  docSnapshot.get('status'),\n                ) &&\n                (!productId ||\n                  docSnapshot.get('productId') === productId) &&\n                docSnapshot.get('customerEmail'),\n            )\n            .map((docSnapshot) => String(docSnapshot.get('customerEmail'))),\n        ),\n      ].slice(0, 200)\n      // White-label sender identity (White-Label Phase 3): the store's brand\n      // via the one shared resolver, from the owning org doc.\n      const branding = resolveBrandingProfile(\n        (await getOrgForHost(hostId).catch(() => null))?.org as never,\n      )\n      // The site's own origin, for the unsubscribe link the gate mints. Read\n      // from the host document already in hand rather than assembled from an\n      // apex: a post is mailed and read later, and a wrong origin sends a\n      // subscriber's opt-out to a domain the merchant does not control.\n      const siteBase =\n        hostPublicOrigin({\n          cname: hostSnapshot.get('cname'),\n          subdomain: hostSnapshot.get('subdomain'),\n        }) ?? ''\n      /*\n       * ONE site, up to two hundred recipients — so the identity is resolved\n       * once and reused, not read per message. Hoisted rather than cached\n       * inside the helper for the reason its docblock gives: verification can\n       * change under a long-lived process, so how long a resolution may be\n       * trusted is the caller's declaration.\n       */\n      const identity = await hostSendingIdentity(hostId)\n      for (const to of recipients) {\n        /*\n         * MARKETING. A member post is a merchant mailing their audience, so\n         * it carries the unsubscribe header pair and a visible link, it is\n         * checked against both suppression lists, and it counts against how\n         * much mail one person receives from this site.\n         *\n         * Priority stays transactional — this handler answers a click and has\n         * nowhere to put a message the hourly governor deferred, and the rule\n         * on `'bulk'` is that only a resumable sweep may use it.\n         */\n        const result = await sendEmail({\n          to,\n          subject: title,\n          text: postBody || title,\n          fromName: branding.fromName,\n          sendingIdentity: identity,\n          audience: 'tenant',\n          context: 'member post',\n          /*\n           * A post to a site's members is the \"Newsletter\" stream — regular\n           * news and stories from the site. Declared so a member who left\n           * that stream, while staying subscribed to everything else, is not\n           * mailed it; the gate asks the topic only for callers that name\n           * one.\n           */\n          marketing: {\n            hostId,\n            siteBase,\n            topicId: EMAIL_TOPIC_NEWSLETTER,\n          },\n        })\n        // The cost meter counts messages that LEFT. A suppressed or capped\n        // recipient produced no message and therefore no cost, and counting\n        // one would bill a merchant for the control working.\n        if (result.sent) emailed += 1\n      }\n      // Cost meter (AGL-1438), once for the batch rather than per recipient —\n      // same number, one write. Transactional: a member post is content the\n      // subscriber is paying for, not a discretionary campaign, so it counts\n      // toward cost and is never refused by the campaign cap.\n      await meterHostEmail(hostId, emailed)\n    }\n    return res.status(200).json({ postId: postRef.id, emailed })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Publish failed' })\n  }\n}\n"],"names":["firebaseAdmin","getOrgForHost","hostSendingIdentity","meterHostEmail","CommerceModel","isEmailConfigured","sendEmail","EMAIL_TOPIC_NEWSLETTER","hostPublicOrigin","resolveBrandingProfile","memberPostHandler","req","res","body","method","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","title","trim","postBody","productId","emailSubscribers","Boolean","hostSnapshot","decoded","app","auth","verifyIdToken","firestore","hostRef","collection","doc","get","memberRole","uid","postRef","add","createdAtMs","Date","now","createdBy","emailed","subscriptions","orderBy","FieldPath","documentId","limit","recipients","Set","docs","filter","docSnapshot","isTenantSubscriptionLive","map","branding","catch","org","siteBase","cname","subdomain","identity","to","result","subject","text","fromName","sendingIdentity","audience","context","marketing","topicId","sent","postId","id","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,aAAa,EACbC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,QACT,2BAA0B;AACjC,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,iBAAiB,EAAEC,SAAS,QAAQ,2BAA0B;AACvE,SACEC,sBAAsB,EACtBC,gBAAgB,EAEhBC,sBAAsB,QACjB,sBAAqB;AAE5B,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,2CAA2C;AAE3C;;;;CAIC,GACD,OAAO,MAAMC,oBAAsC,OAAOC,KAAKC;QAIhCD,4BAM4BA,WACnCE,cACDA,aACGA,YACCA;IAbzB,IAAIF,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,gBAAgBC,QAAOR,6BAAAA,IAAIS,OAAO,CAACF,aAAa,YAAzBP,6BAA6B;IAC1D,MAAMU,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMJ,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWa,KAAKC,KAAK,CAAChB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMiB,SAAST,QAAON,eAAAA,KAAKe,MAAM,YAAXf,eAAe;IACrC,MAAMgB,QAAQV,QAAON,cAAAA,KAAKgB,KAAK,YAAVhB,cAAc,IAAIiB,IAAI,GAAGP,KAAK,CAAC,GAAG;IACvD,MAAMQ,WAAWZ,QAAON,aAAAA,KAAKA,IAAI,YAATA,aAAa,IAAIiB,IAAI,GAAGP,KAAK,CAAC,GAAG;IACzD,MAAMS,YAAYb,QAAON,kBAAAA,KAAKmB,SAAS,YAAdnB,kBAAkB,IAAIiB,IAAI;IACnD,MAAMG,mBAAmBC,QAAQrB,KAAKoB,gBAAgB;IACtD,IAAI,CAACL,UAAU,CAACC,OAAO;QACrB,OAAOjB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;IACjE;IAEA,IAAI;YAYkBkB;QAXpB,MAAMC,UAAU,MAAMpC,cAAcqC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAAClB;QAC/D,MAAMmB,YAAYxC,cAAcqC,GAAG,GAAGG,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACf;QAClD,MAAMO,eAAe,MAAMM,QAAQG,GAAG;QACtC,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,kEAAkE;QAClE,yEAAyE;QACzE,uEAAuE;QACvE,MAAMC,aAAa,EAACV,oBAAAA,aAAaS,GAAG,CAAC,0BAAjBT,oBAAmC,CAAC,EAAE,CAACC,QAAQU,GAAG,CAAC;QACvE,IAAID,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAOjC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QACA,MAAM8B,UAAU,MAAMN,QAAQC,UAAU,CAAC,eAAeM,GAAG,CAAC;YAC1DnB;YACAhB,MAAMkB;WACFC,YAAY;YAAEA;QAAU,IAAI,CAAC;YACjCiB,aAAaC,KAAKC,GAAG;YACrBC,WAAWhB,QAAQU,GAAG;;QAGxB,IAAIO,UAAU;QACd,IAAIpB,oBAAoB5B,qBAAqB;gBAuCzCG;gBAPC;YA/BH;;;;;;;OAOC,GACD,MAAM8C,gBAAgB,MAAMb,QACzBC,UAAU,CAAC,iBACXa,OAAO,CAACvD,cAAcwC,SAAS,CAACgB,SAAS,CAACC,UAAU,IACpDC,KAAK,CAAC,KACNd,GAAG;YACN,MAAMe,aAAa;mBACd,IAAIC,IACLN,cAAcO,IAAI,CACfC,MAAM,CACL,CAACC,cACC3D,cAAc4D,wBAAwB,CACpCD,YAAYnB,GAAG,CAAC,cAEjB,CAAA,CAACZ,aACA+B,YAAYnB,GAAG,CAAC,iBAAiBZ,SAAQ,KAC3C+B,YAAYnB,GAAG,CAAC,kBAEnBqB,GAAG,CAAC,CAACF,cAAgB5C,OAAO4C,YAAYnB,GAAG,CAAC;aAElD,CAACrB,KAAK,CAAC,GAAG;YACX,uEAAuE;YACvE,wDAAwD;YACxD,MAAM2C,WAAWzD,wBACd,QAAA,MAAMR,cAAc2B,QAAQuC,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDC,GAAG;YAEtD,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,kEAAkE;YAClE,MAAMC,YACJ7D,oBAAAA,iBAAiB;gBACf8D,OAAOnC,aAAaS,GAAG,CAAC;gBACxB2B,WAAWpC,aAAaS,GAAG,CAAC;YAC9B,cAHApC,oBAGM;YACR;;;;;;OAMC,GACD,MAAMgE,WAAW,MAAMtE,oBAAoB0B;YAC3C,KAAK,MAAM6C,MAAMd,WAAY;gBAC3B;;;;;;;;;SASC,GACD,MAAMe,SAAS,MAAMpE,UAAU;oBAC7BmE;oBACAE,SAAS9C;oBACT+C,MAAM7C,YAAYF;oBAClBgD,UAAUX,SAASW,QAAQ;oBAC3BC,iBAAiBN;oBACjBO,UAAU;oBACVC,SAAS;oBACT;;;;;;WAMC,GACDC,WAAW;wBACTrD;wBACAyC;wBACAa,SAAS3E;oBACX;gBACF;gBACA,mEAAmE;gBACnE,oEAAoE;gBACpE,qDAAqD;gBACrD,IAAImE,OAAOS,IAAI,EAAE9B,WAAW;YAC9B;YACA,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wDAAwD;YACxD,MAAMlD,eAAeyB,QAAQyB;QAC/B;QACA,OAAOzC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEoE,QAAQrC,QAAQsC,EAAE;YAAEhC;QAAQ;IAC5D,EAAE,OAAOpC,OAAO;QACdqE,QAAQrE,KAAK,CAACA;QACd,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}