@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/membership-account.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+import * as CommerceModel from '../model';
+export interface AccountOrderView {
+    id: string;
+    number: string;
+    status: CommerceModel.OrderStatus;
+    totalCents: number;
+    createdAtMs: number;
+    itemsSummary: string;
+    tracking?: {
+        carrier?: string;
+        trackingNumber?: string;
+    };
+}
+/**
+ * Member account (AGL-294): profile + address book + order history for
+ * the signed-in site member (AGL-109 session cookie). Orders match by
+ * the member's email — guest purchases made with the same address show
+ * up too, which is what buyers expect.
+ */
+export declare const membershipAccountHandler: PluginApiHandler;

package/src/lib/server/membership-account.js

@@ -0,0 +1,148 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { memberNameSearchFields } from "./member-name-search.js";
+import * as CommerceModel from "../model/index.js";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { mintDownloadToken } from "./download.js";
+import { requireActiveMember } from "./membership.js";
+/**
+ * Member account (AGL-294): profile + address book + order history for
+ * the signed-in site member (AGL-109 session cookie). Orders match by
+ * the member's email — guest purchases made with the same address show
+ * up too, which is what buyers expect.
+ */ export const membershipAccountHandler = async (req, res)=>{
+    var _ref;
+    var _req_body;
+    const hostId = String((_ref = req.method === 'GET' ? req.query.hostId : (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    if (!hostId) return res.status(400).json({
+        error: 'Missing hostId'
+    });
+    try {
+        var _memberSnapshot_get, _memberSnapshot_get1, _memberSnapshot_get2;
+        // Suspension gate (AGL-546/550): the shared guard 401s stale
+        // sessions and 403s suspended members with the cookie cleared, so
+        // the site stops presenting a signed-in shell; the account block
+        // treats any non-OK response as signed-out, the graceful path here.
+        const auth = await requireActiveMember(req, res, hostId);
+        if (!auth) return;
+        const { memberId, member: memberSnapshot } = auth;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const memberRef = hostRef.collection('siteMembers').doc(memberId);
+        if (req.method === 'POST') {
+            var _ref1;
+            var _req_body1, _req_body2;
+            const displayName = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.displayName) != null ? _ref1 : '').slice(0, 80);
+            const addresses = Array.isArray((_req_body2 = req.body) == null ? void 0 : _req_body2.addresses) ? req.body.addresses.slice(0, 5).map((address)=>{
+                var _address_name, _address_line1, _address_line2, _address_city, _address_state, _address_postalCode, _address_country;
+                return {
+                    name: String((_address_name = address.name) != null ? _address_name : '').slice(0, 80),
+                    line1: String((_address_line1 = address.line1) != null ? _address_line1 : '').slice(0, 120),
+                    line2: String((_address_line2 = address.line2) != null ? _address_line2 : '').slice(0, 120),
+                    city: String((_address_city = address.city) != null ? _address_city : '').slice(0, 80),
+                    state: String((_address_state = address.state) != null ? _address_state : '').slice(0, 40),
+                    postalCode: String((_address_postalCode = address.postalCode) != null ? _address_postalCode : '').slice(0, 20),
+                    country: String((_address_country = address.country) != null ? _address_country : '').slice(0, 2).toUpperCase()
+                };
+            }) : undefined;
+            await memberRef.set(_extends({}, displayName ? memberNameSearchFields(displayName) : {}, addresses ? {
+                addresses
+            } : {}), {
+                merge: true
+            });
+        }
+        const email = String((_memberSnapshot_get = memberSnapshot.get('email')) != null ? _memberSnapshot_get : '');
+        const ordersSnapshot = await hostRef.collection('orders').where('customerEmail', '==', email).limit(25).get();
+        const orders = ordersSnapshot.docs.map((docSnapshot)=>{
+            var _order_fulfillments, _ref, _order_amountCents, _order_createdAtMs, _ref1, _order_lineItems;
+            var _order_totals, _docSnapshot_get;
+            const order = CommerceModel.liftLegacyOrder(docSnapshot.data());
+            const latestFulfillment = ((_order_fulfillments = order.fulfillments) != null ? _order_fulfillments : []).slice(-1)[0];
+            return _extends({
+                id: docSnapshot.id,
+                number: CommerceModel.formatOrderNumber(order, docSnapshot.id),
+                status: order.status,
+                totalCents: (_ref = (_order_totals = order.totals) == null ? void 0 : _order_totals.totalCents) != null ? _ref : Number((_order_amountCents = order.amountCents) != null ? _order_amountCents : 0),
+                createdAtMs: (_order_createdAtMs = order.createdAtMs) != null ? _order_createdAtMs : ((_ref1 = (_docSnapshot_get = docSnapshot.get('createdAt')) == null ? void 0 : _docSnapshot_get.seconds) != null ? _ref1 : 0) * 1000 || 0,
+                itemsSummary: ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).map((line)=>`${line.quantity}× ${line.name}`).join(', ').slice(0, 140)
+            }, (latestFulfillment == null ? void 0 : latestFulfillment.trackingNumber) ? {
+                tracking: {
+                    carrier: latestFulfillment.carrier,
+                    trackingNumber: latestFulfillment.trackingNumber
+                }
+            } : {});
+        }).sort((a, b)=>b.createdAtMs - a.createdAtMs);
+        // Digital downloads (AGL-302): tokened links for digital lines on
+        // paid orders; files resolve to the product's current list.
+        const downloads = [];
+        for (const docSnapshot of ordersSnapshot.docs){
+            var _docSnapshot_get, _order_lineItems;
+            const order = CommerceModel.liftLegacyOrder(docSnapshot.data());
+            if (!CommerceModel.orderEntitlesProduct(order, 'any')) continue;
+            const orderKeys = (_docSnapshot_get = docSnapshot.get('licenseKeys')) != null ? _docSnapshot_get : {};
+            for (const line of (_order_lineItems = order.lineItems) != null ? _order_lineItems : []){
+                var _orderKeys_line_productId;
+                if (line.productType !== 'digital') continue;
+                // PER LINE (AGL-2454). The status test above only ever moved on a FULL
+                // refund, so this page went on listing the download link AND the
+                // licence key for a line the merchant had refunded. The key string is
+                // the one thing here that cannot be taken back once mailed — which is
+                // exactly why it is retired from the pool rather than reissued — so
+                // removing it from the account page is the only withdrawal available.
+                if (!CommerceModel.orderEntitlesProduct(order, line.productId)) continue;
+                downloads.push(_extends({
+                    orderId: docSnapshot.id,
+                    productId: line.productId,
+                    productName: line.name
+                }, ((_orderKeys_line_productId = orderKeys[line.productId]) == null ? void 0 : _orderKeys_line_productId.length) ? {
+                    licenseKeys: orderKeys[line.productId]
+                } : {}, {
+                    url: `/api/commerce/download?hostId=${encodeURIComponent(hostId)}` + `&orderId=${encodeURIComponent(docSnapshot.id)}` + `&productId=${encodeURIComponent(line.productId)}` + `&token=${mintDownloadToken(hostId, docSnapshot.id)}`
+                }));
+            }
+        }
+        // Storefront subscriptions (AGL-303) with product names resolved.
+        const subscriptionsSnapshot = await hostRef.collection('subscriptions').where('customerEmail', '==', email).limit(10).get();
+        const subscriptions = await Promise.all(subscriptionsSnapshot.docs.map(async (docSnapshot)=>{
+            var _docSnapshot_get, _productSnapshot_get, _docSnapshot_get1, _docSnapshot_get2;
+            const productSnapshot = await hostRef.collection('products').doc(String((_docSnapshot_get = docSnapshot.get('productId')) != null ? _docSnapshot_get : '')).get();
+            return {
+                id: docSnapshot.id,
+                productName: String((_productSnapshot_get = productSnapshot.get('name')) != null ? _productSnapshot_get : 'Subscription'),
+                status: String((_docSnapshot_get1 = docSnapshot.get('status')) != null ? _docSnapshot_get1 : 'active'),
+                currentPeriodEndMs: (_docSnapshot_get2 = docSnapshot.get('currentPeriodEndMs')) != null ? _docSnapshot_get2 : null
+            };
+        }));
+        return res.status(200).json({
+            member: {
+                email,
+                displayName: (_memberSnapshot_get1 = memberSnapshot.get('displayName')) != null ? _memberSnapshot_get1 : '',
+                addresses: (_memberSnapshot_get2 = memberSnapshot.get('addresses')) != null ? _memberSnapshot_get2 : []
+            },
+            orders,
+            downloads,
+            subscriptions
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Account unavailable'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-account.js.map

package/src/lib/server/membership-account.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-account.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { memberNameSearchFields } from './member-name-search'\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { mintDownloadToken } from './download'\nimport { requireActiveMember } from './membership'\n\nexport interface AccountOrderView {\n  id: string\n  number: string\n  status: CommerceModel.OrderStatus\n  totalCents: number\n  createdAtMs: number\n  itemsSummary: string\n  tracking?: { carrier?: string; trackingNumber?: string }\n}\n\n/**\n * Member account (AGL-294): profile + address book + order history for\n * the signed-in site member (AGL-109 session cookie). Orders match by\n * the member's email — guest purchases made with the same address show\n * up too, which is what buyers expect.\n */\nexport const membershipAccountHandler: PluginApiHandler = async (req, res) => {\n  const hostId = String(\n    (req.method === 'GET' ? req.query.hostId : req.body?.hostId) ?? '',\n  )\n  if (!hostId) return res.status(400).json({ error: 'Missing hostId' })\n\n  try {\n    // Suspension gate (AGL-546/550): the shared guard 401s stale\n    // sessions and 403s suspended members with the cookie cleared, so\n    // the site stops presenting a signed-in shell; the account block\n    // treats any non-OK response as signed-out, the graceful path here.\n    const auth = await requireActiveMember(req, res, hostId)\n    if (!auth) return\n    const { memberId, member: memberSnapshot } = auth\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const memberRef = hostRef.collection('siteMembers').doc(memberId)\n\n    if (req.method === 'POST') {\n      const displayName = String(req.body?.displayName ?? '').slice(0, 80)\n      const addresses = Array.isArray(req.body?.addresses)\n        ? (req.body.addresses as CommerceModel.OrderAddress[]).slice(0, 5).map(\n            (address) => ({\n              name: String(address.name ?? '').slice(0, 80),\n              line1: String(address.line1 ?? '').slice(0, 120),\n              line2: String(address.line2 ?? '').slice(0, 120),\n              city: String(address.city ?? '').slice(0, 80),\n              state: String(address.state ?? '').slice(0, 40),\n              postalCode: String(address.postalCode ?? '').slice(0, 20),\n              country: String(address.country ?? '').slice(0, 2).toUpperCase(),\n            }),\n          )\n        : undefined\n      await memberRef.set(\n        {\n          ...(displayName ? memberNameSearchFields(displayName) : {}),\n          ...(addresses ? { addresses } : {}),\n        },\n        { merge: true },\n      )\n    }\n\n    const email = String(memberSnapshot.get('email') ?? '')\n    const ordersSnapshot = await hostRef\n      .collection('orders')\n      .where('customerEmail', '==', email)\n      .limit(25)\n      .get()\n    const orders: AccountOrderView[] = ordersSnapshot.docs\n      .map((docSnapshot) => {\n        const order = CommerceModel.liftLegacyOrder(docSnapshot.data() as any)\n        const latestFulfillment = (order.fulfillments ?? []).slice(-1)[0]\n        return {\n          id: docSnapshot.id,\n          number: CommerceModel.formatOrderNumber(order, docSnapshot.id),\n          status: order.status,\n          totalCents:\n            order.totals?.totalCents ?? Number(order.amountCents ?? 0),\n          createdAtMs:\n            order.createdAtMs ??\n            ((docSnapshot.get('createdAt')?.seconds ?? 0) * 1000 || 0),\n          itemsSummary: (order.lineItems ?? [])\n            .map((line) => `${line.quantity}× ${line.name}`)\n            .join(', ')\n            .slice(0, 140),\n          ...(latestFulfillment?.trackingNumber\n            ? {\n                tracking: {\n                  carrier: latestFulfillment.carrier,\n                  trackingNumber: latestFulfillment.trackingNumber,\n                },\n              }\n            : {}),\n        }\n      })\n      .sort((a, b) => b.createdAtMs - a.createdAtMs)\n\n    // Digital downloads (AGL-302): tokened links for digital lines on\n    // paid orders; files resolve to the product's current list.\n    const downloads: Array<{\n      orderId: string\n      productId: string\n      productName: string\n      url: string\n      licenseKeys?: string[]\n    }> = []\n    for (const docSnapshot of ordersSnapshot.docs) {\n      const order = CommerceModel.liftLegacyOrder(docSnapshot.data() as any)\n      if (!CommerceModel.orderEntitlesProduct(order, 'any')) continue\n      const orderKeys = (docSnapshot.get('licenseKeys') ?? {}) as Record<\n        string,\n        string[]\n      >\n      for (const line of order.lineItems ?? []) {\n        if (line.productType !== 'digital') continue\n        // PER LINE (AGL-2454). The status test above only ever moved on a FULL\n        // refund, so this page went on listing the download link AND the\n        // licence key for a line the merchant had refunded. The key string is\n        // the one thing here that cannot be taken back once mailed — which is\n        // exactly why it is retired from the pool rather than reissued — so\n        // removing it from the account page is the only withdrawal available.\n        if (!CommerceModel.orderEntitlesProduct(order, line.productId)) continue\n        downloads.push({\n          orderId: docSnapshot.id,\n          productId: line.productId,\n          productName: line.name,\n          ...(orderKeys[line.productId]?.length\n            ? { licenseKeys: orderKeys[line.productId] }\n            : {}),\n          url:\n            `/api/commerce/download?hostId=${encodeURIComponent(hostId)}` +\n            `&orderId=${encodeURIComponent(docSnapshot.id)}` +\n            `&productId=${encodeURIComponent(line.productId)}` +\n            `&token=${mintDownloadToken(hostId, docSnapshot.id)}`,\n        })\n      }\n    }\n\n    // Storefront subscriptions (AGL-303) with product names resolved.\n    const subscriptionsSnapshot = await hostRef\n      .collection('subscriptions')\n      .where('customerEmail', '==', email)\n      .limit(10)\n      .get()\n    const subscriptions = await Promise.all(\n      subscriptionsSnapshot.docs.map(async (docSnapshot) => {\n        const productSnapshot = await hostRef\n          .collection('products')\n          .doc(String(docSnapshot.get('productId') ?? ''))\n          .get()\n        return {\n          id: docSnapshot.id,\n          productName: String(productSnapshot.get('name') ?? 'Subscription'),\n          status: String(docSnapshot.get('status') ?? 'active'),\n          currentPeriodEndMs: docSnapshot.get('currentPeriodEndMs') ?? null,\n        }\n      }),\n    )\n\n    return res.status(200).json({\n      member: {\n        email,\n        displayName: memberSnapshot.get('displayName') ?? '',\n        addresses: memberSnapshot.get('addresses') ?? [],\n      },\n      orders,\n      downloads,\n      subscriptions,\n    })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Account unavailable' })\n  }\n}\n"],"names":["memberNameSearchFields","CommerceModel","firebaseAdmin","mintDownloadToken","requireActiveMember","membershipAccountHandler","req","res","hostId","String","method","query","body","status","json","error","memberSnapshot","auth","memberId","member","firestore","app","hostRef","collection","doc","memberRef","displayName","slice","addresses","Array","isArray","map","address","name","line1","line2","city","state","postalCode","country","toUpperCase","undefined","set","merge","email","get","ordersSnapshot","where","limit","orders","docs","docSnapshot","order","liftLegacyOrder","data","latestFulfillment","fulfillments","id","number","formatOrderNumber","totalCents","totals","Number","amountCents","createdAtMs","seconds","itemsSummary","lineItems","line","quantity","join","trackingNumber","tracking","carrier","sort","a","b","downloads","orderEntitlesProduct","orderKeys","productType","productId","push","orderId","productName","length","licenseKeys","url","encodeURIComponent","subscriptionsSnapshot","subscriptions","Promise","all","productSnapshot","currentPeriodEndMs","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,sBAAsB,QAAQ,0BAAsB;AAE7D,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,iBAAiB,QAAQ,gBAAY;AAC9C,SAASC,mBAAmB,QAAQ,kBAAc;AAYlD;;;;;CAKC,GACD,OAAO,MAAMC,2BAA6C,OAAOC,KAAKC;QAEjED;QAA0CA;IAD7C,MAAME,SAASC,QACZH,OAAAA,IAAII,MAAM,KAAK,QAAQJ,IAAIK,KAAK,CAACH,MAAM,IAAGF,YAAAA,IAAIM,IAAI,qBAARN,UAAUE,MAAM,YAA1DF,OAA+D;IAElE,IAAI,CAACE,QAAQ,OAAOD,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAiB;IAEnE,IAAI;YAoCmBC,qBAoGJA,sBACFA;QAxIf,6DAA6D;QAC7D,kEAAkE;QAClE,iEAAiE;QACjE,oEAAoE;QACpE,MAAMC,OAAO,MAAMb,oBAAoBE,KAAKC,KAAKC;QACjD,IAAI,CAACS,MAAM;QACX,MAAM,EAAEC,QAAQ,EAAEC,QAAQH,cAAc,EAAE,GAAGC;QAC7C,MAAMG,YAAYlB,cAAcmB,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMiB,YAAYH,QAAQC,UAAU,CAAC,eAAeC,GAAG,CAACN;QAExD,IAAIZ,IAAII,MAAM,KAAK,QAAQ;;gBACEJ,YACKA;YADhC,MAAMoB,cAAcjB,iBAAOH,aAAAA,IAAIM,IAAI,qBAARN,WAAUoB,WAAW,oBAAI,IAAIC,KAAK,CAAC,GAAG;YACjE,MAAMC,YAAYC,MAAMC,OAAO,EAACxB,aAAAA,IAAIM,IAAI,qBAARN,WAAUsB,SAAS,IAC/C,AAACtB,IAAIM,IAAI,CAACgB,SAAS,CAAkCD,KAAK,CAAC,GAAG,GAAGI,GAAG,CAClE,CAACC;oBACcA,eACCA,gBACAA,gBACDA,eACCA,gBACKA,qBACHA;uBAPJ;oBACZC,MAAMxB,QAAOuB,gBAAAA,QAAQC,IAAI,YAAZD,gBAAgB,IAAIL,KAAK,CAAC,GAAG;oBAC1CO,OAAOzB,QAAOuB,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiB,IAAIL,KAAK,CAAC,GAAG;oBAC5CQ,OAAO1B,QAAOuB,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiB,IAAIL,KAAK,CAAC,GAAG;oBAC5CS,MAAM3B,QAAOuB,gBAAAA,QAAQI,IAAI,YAAZJ,gBAAgB,IAAIL,KAAK,CAAC,GAAG;oBAC1CU,OAAO5B,QAAOuB,iBAAAA,QAAQK,KAAK,YAAbL,iBAAiB,IAAIL,KAAK,CAAC,GAAG;oBAC5CW,YAAY7B,QAAOuB,sBAAAA,QAAQM,UAAU,YAAlBN,sBAAsB,IAAIL,KAAK,CAAC,GAAG;oBACtDY,SAAS9B,QAAOuB,mBAAAA,QAAQO,OAAO,YAAfP,mBAAmB,IAAIL,KAAK,CAAC,GAAG,GAAGa,WAAW;gBAChE;iBAEFC;YACJ,MAAMhB,UAAUiB,GAAG,CACjB,aACMhB,cAAc1B,uBAAuB0B,eAAe,CAAC,GACrDE,YAAY;gBAAEA;YAAU,IAAI,CAAC,IAEnC;gBAAEe,OAAO;YAAK;QAElB;QAEA,MAAMC,QAAQnC,QAAOO,sBAAAA,eAAe6B,GAAG,CAAC,oBAAnB7B,sBAA+B;QACpD,MAAM8B,iBAAiB,MAAMxB,QAC1BC,UAAU,CAAC,UACXwB,KAAK,CAAC,iBAAiB,MAAMH,OAC7BI,KAAK,CAAC,IACNH,GAAG;QACN,MAAMI,SAA6BH,eAAeI,IAAI,CACnDnB,GAAG,CAAC,CAACoB;gBAEuBC,2BAMYA,oBAEnCA,2BAEaA;gBAJbA,eAGED;YAVN,MAAMC,QAAQnD,cAAcoD,eAAe,CAACF,YAAYG,IAAI;YAC5D,MAAMC,oBAAoB,EAACH,sBAAAA,MAAMI,YAAY,YAAlBJ,sBAAsB,EAAE,EAAEzB,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE;YACjE,OAAO;gBACL8B,IAAIN,YAAYM,EAAE;gBAClBC,QAAQzD,cAAc0D,iBAAiB,CAACP,OAAOD,YAAYM,EAAE;gBAC7D5C,QAAQuC,MAAMvC,MAAM;gBACpB+C,UAAU,WACRR,gBAAAA,MAAMS,MAAM,qBAAZT,cAAcQ,UAAU,mBAAIE,QAAOV,qBAAAA,MAAMW,WAAW,YAAjBX,qBAAqB;gBAC1DY,WAAW,GACTZ,qBAAAA,MAAMY,WAAW,YAAjBZ,qBACC,WAACD,mBAAAA,YAAYN,GAAG,CAAC,iCAAhBM,iBAA8Bc,OAAO,oBAAI,KAAK,QAAQ;gBAC1DC,cAAc,EAACd,mBAAAA,MAAMe,SAAS,YAAff,mBAAmB,EAAE,EACjCrB,GAAG,CAAC,CAACqC,OAAS,GAAGA,KAAKC,QAAQ,CAAC,EAAE,EAAED,KAAKnC,IAAI,EAAE,EAC9CqC,IAAI,CAAC,MACL3C,KAAK,CAAC,GAAG;eACR4B,CAAAA,qCAAAA,kBAAmBgB,cAAc,IACjC;gBACEC,UAAU;oBACRC,SAASlB,kBAAkBkB,OAAO;oBAClCF,gBAAgBhB,kBAAkBgB,cAAc;gBAClD;YACF,IACA,CAAC;QAET,GACCG,IAAI,CAAC,CAACC,GAAGC,IAAMA,EAAEZ,WAAW,GAAGW,EAAEX,WAAW;QAE/C,kEAAkE;QAClE,4DAA4D;QAC5D,MAAMa,YAMD,EAAE;QACP,KAAK,MAAM1B,eAAeL,eAAeI,IAAI,CAAE;gBAG1BC,kBAIAC;YANnB,MAAMA,QAAQnD,cAAcoD,eAAe,CAACF,YAAYG,IAAI;YAC5D,IAAI,CAACrD,cAAc6E,oBAAoB,CAAC1B,OAAO,QAAQ;YACvD,MAAM2B,aAAa5B,mBAAAA,YAAYN,GAAG,CAAC,0BAAhBM,mBAAkC,CAAC;YAItD,KAAK,MAAMiB,SAAQhB,mBAAAA,MAAMe,SAAS,YAAff,mBAAmB,EAAE,CAAE;oBAalC2B;gBAZN,IAAIX,KAAKY,WAAW,KAAK,WAAW;gBACpC,uEAAuE;gBACvE,iEAAiE;gBACjE,sEAAsE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,sEAAsE;gBACtE,IAAI,CAAC/E,cAAc6E,oBAAoB,CAAC1B,OAAOgB,KAAKa,SAAS,GAAG;gBAChEJ,UAAUK,IAAI,CAAC;oBACbC,SAAShC,YAAYM,EAAE;oBACvBwB,WAAWb,KAAKa,SAAS;oBACzBG,aAAahB,KAAKnC,IAAI;mBAClB8C,EAAAA,4BAAAA,SAAS,CAACX,KAAKa,SAAS,CAAC,qBAAzBF,0BAA2BM,MAAM,IACjC;oBAAEC,aAAaP,SAAS,CAACX,KAAKa,SAAS,CAAC;gBAAC,IACzC,CAAC;oBACLM,KACE,CAAC,8BAA8B,EAAEC,mBAAmBhF,SAAS,GAC7D,CAAC,SAAS,EAAEgF,mBAAmBrC,YAAYM,EAAE,GAAG,GAChD,CAAC,WAAW,EAAE+B,mBAAmBpB,KAAKa,SAAS,GAAG,GAClD,CAAC,OAAO,EAAE9E,kBAAkBK,QAAQ2C,YAAYM,EAAE,GAAG;;YAE3D;QACF;QAEA,kEAAkE;QAClE,MAAMgC,wBAAwB,MAAMnE,QACjCC,UAAU,CAAC,iBACXwB,KAAK,CAAC,iBAAiB,MAAMH,OAC7BI,KAAK,CAAC,IACNH,GAAG;QACN,MAAM6C,gBAAgB,MAAMC,QAAQC,GAAG,CACrCH,sBAAsBvC,IAAI,CAACnB,GAAG,CAAC,OAAOoB;gBAGtBA,kBAIQ0C,sBACL1C,mBACKA;YARtB,MAAM0C,kBAAkB,MAAMvE,QAC3BC,UAAU,CAAC,YACXC,GAAG,CAACf,QAAO0C,mBAAAA,YAAYN,GAAG,CAAC,wBAAhBM,mBAAgC,KAC3CN,GAAG;YACN,OAAO;gBACLY,IAAIN,YAAYM,EAAE;gBAClB2B,aAAa3E,QAAOoF,uBAAAA,gBAAgBhD,GAAG,CAAC,mBAApBgD,uBAA+B;gBACnDhF,QAAQJ,QAAO0C,oBAAAA,YAAYN,GAAG,CAAC,qBAAhBM,oBAA6B;gBAC5C2C,kBAAkB,GAAE3C,oBAAAA,YAAYN,GAAG,CAAC,iCAAhBM,oBAAyC;YAC/D;QACF;QAGF,OAAO5C,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BK,QAAQ;gBACNyB;gBACAlB,WAAW,GAAEV,uBAAAA,eAAe6B,GAAG,CAAC,0BAAnB7B,uBAAqC;gBAClDY,SAAS,GAAEZ,uBAAAA,eAAe6B,GAAG,CAAC,wBAAnB7B,uBAAmC,EAAE;YAClD;YACAiC;YACA4B;YACAa;QACF;IACF,EAAE,OAAO3E,OAAO;QACdgF,QAAQhF,KAAK,CAACA;QACd,OAAOR,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;AACF,EAAC"}

package/src/lib/server/membership-admin-password.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Console-side password help for a SITE MEMBER (AGL-914) — a visitor account
+ * on a published site, not an Aglyn console user.
+ *
+ * Sibling to `membership-recover`, and deliberately its opposite in tone.
+ * That endpoint is public, so it answers `{ok:true}` no matter what to avoid
+ * confirming whether an address has an account. This one is driven by a site
+ * admin looking straight at the member's record — they already know the
+ * account exists, so hiding failures would only leave them guessing whether
+ * their click did anything. Every outcome here is reported honestly.
+ *
+ * Auth is the console id-token check `hosts/members` uses (site admin via
+ * the `memberRoles` projection, or an org role carrying manageMembers) — NOT
+ * the visitor session cookie the rest of the membership endpoints take.
+ */
+export declare const membershipAdminPasswordHandler: PluginApiHandler;

package/src/lib/server/membership-admin-password.js

@@ -0,0 +1,202 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { resolveBrandingProfile, validateNewPassword } from "@aglyn/aglyn/server";
+import { hostPublicOrigin } from "@aglyn/aglyn/server";
+import { isEmailConfigured, sendEmail } from "@aglyn/shared-util-email";
+import { consumePasswordResetSend, firebaseAdmin, getOrgForHost, hostSendingIdentity, isImpersonationSession, meterHostEmail, passwordResetThrottleMessage } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { hashMemberPassword, MEMBER_SESSIONS_VALID_FROM_FIELD, mintPasswordResetToken } from "./membership.js";
+/**
+ * Console-side password help for a SITE MEMBER (AGL-914) — a visitor account
+ * on a published site, not an Aglyn console user.
+ *
+ * Sibling to `membership-recover`, and deliberately its opposite in tone.
+ * That endpoint is public, so it answers `{ok:true}` no matter what to avoid
+ * confirming whether an address has an account. This one is driven by a site
+ * admin looking straight at the member's record — they already know the
+ * account exists, so hiding failures would only leave them guessing whether
+ * their click did anything. Every outcome here is reported honestly.
+ *
+ * Auth is the console id-token check `hosts/members` uses (site admin via
+ * the `memberRoles` projection, or an org role carrying manageMembers) — NOT
+ * the visitor session cookie the rest of the membership endpoints take.
+ */ export const membershipAdminPasswordHandler = async (req, res)=>{
+    var _req_headers_authorization, _ref, _ref1, _ref2;
+    var _req_body, _req_body1, _req_body2;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers['authorization']) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const memberId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.memberId) != null ? _ref1 : '');
+    const action = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.action) != null ? _ref2 : '');
+    if (!hostId || !memberId) {
+        return res.status(400).json({
+            error: 'Missing hostId or memberId'
+        });
+    }
+    if (action !== 'sendPasswordReset' && action !== 'setPassword') {
+        return res.status(400).json({
+            error: 'Unknown action'
+        });
+    }
+    try {
+        var _ref3, _memberSnapshot_get, _hostPublicOrigin, _ref4, _hostSnapshot_get;
+        var _this, _req_body3;
+        const app = firebaseAdmin.app();
+        const decoded = await app.auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            // Same shape as emailUnverifiedResponse (AGL-479), written by hand
+            // because that helper returns a fetch `Response` and this is a
+            // (req, res) plugin handler.
+            return res.status(403).json({
+                error: 'Verify your email to continue',
+                reason: 'email-unverified'
+            });
+        }
+        const firestore = app.firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        const host = hostSnapshot.data();
+        const memberRole = ((_ref3 = host == null ? void 0 : host['memberRoles']) != null ? _ref3 : {})[decoded.uid];
+        const orgPermissions = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!host || memberRole !== 'admin' && !orgPermissions.permissions.manageMembers) {
+            return res.status(403).json({
+                error: 'Not a site admin'
+            });
+        }
+        const memberRef = hostRef.collection('siteMembers').doc(memberId);
+        const memberSnapshot = await memberRef.get();
+        if (!memberSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown member'
+            });
+        }
+        const email = String((_memberSnapshot_get = memberSnapshot.get('email')) != null ? _memberSnapshot_get : '');
+        if (!email) {
+            return res.status(400).json({
+                error: 'This member has no email address'
+            });
+        }
+        // `hostPublicOrigin`, not a hand-rolled apex (AGL-2195). This URL is
+        // minted server-side and mailed out, so a wrong apex is not a display
+        // bug — it is a live link on somebody else's domain.
+        const siteBase = (_hostPublicOrigin = hostPublicOrigin({
+            cname: hostSnapshot.get('cname'),
+            subdomain: hostSnapshot.get('subdomain')
+        })) != null ? _hostPublicOrigin : '';
+        const siteName = String((_ref4 = (_hostSnapshot_get = hostSnapshot.get('displayName')) != null ? _hostSnapshot_get : hostSnapshot.get('subdomain')) != null ? _ref4 : 'the site');
+        // White-label sender identity (White-Label Phase 3): the store's brand via
+        // the one shared resolver; the copy already uses the site name.
+        const branding = resolveBrandingProfile((_this = await getOrgForHost(hostId).catch(()=>null)) == null ? void 0 : _this.org);
+        if (action === 'sendPasswordReset') {
+            // Throttled per recipient and per actor (AGL-920). Same caps as the
+            // console surfaces — a site member's inbox is no less worth protecting
+            // than a console user's.
+            const throttle = await consumePasswordResetSend({
+                actorKey: decoded.uid,
+                recipientKey: email
+            });
+            if (!throttle.allowed) {
+                res.setHeader('Retry-After', String(throttle.retryAfterSeconds));
+                return res.status(429).json({
+                    error: passwordResetThrottleMessage(throttle)
+                });
+            }
+            if (!isEmailConfigured()) {
+                return res.status(502).json({
+                    error: 'Email is not configured, so no reset link could be sent'
+                });
+            }
+            // Same single-use, hash-bound token the self-serve flow mints
+            // (AGL-552) — completing the reset rewrites `passwordScrypt`, which
+            // retires the token without any server-side storage.
+            const token = mintPasswordResetToken(hostId, memberId, memberSnapshot.get('passwordScrypt'));
+            const resetUrl = `${siteBase}/recover?token=${encodeURIComponent(token)}`;
+            const result = await sendEmail({
+                to: email,
+                subject: `Reset your ${siteName} password`,
+                text: `An administrator of ${siteName} started a password reset for ` + 'your account. Set a new password here:\n\n' + `${resetUrl}\n\n` + 'The link works once and expires in 1 hour. Your current ' + 'password keeps working until you use it.',
+                fromName: branding.fromName,
+                sendingIdentity: await hostSendingIdentity(hostId),
+                audience: 'tenant',
+                context: 'membership admin recovery'
+            });
+            if (!result.sent) {
+                return res.status(502).json({
+                    error: 'The reset email could not be delivered'
+                });
+            }
+            // Cost meter (AGL-1438). Transactional: a reset a quota refused leaves
+            // the member locked out of a site they pay for.
+            await meterHostEmail(hostId);
+            return res.status(200).json({
+                ok: true
+            });
+        }
+        const validated = validateNewPassword((_req_body3 = req.body) == null ? void 0 : _req_body3.password);
+        if (validated.error) {
+            return res.status(400).json({
+                error: validated.error
+            });
+        }
+        // Rewriting the hash alone would NOT sign the member out: their session
+        // is an HMAC cookie that never encodes the password (unlike a reset
+        // token, which binds to it on purpose). The cut-off field is what
+        // actually revokes the old sessions — see readActiveMemberSession.
+        await memberRef.update({
+            passwordScrypt: hashMemberPassword(validated.password),
+            [MEMBER_SESSIONS_VALID_FROM_FIELD]: Date.now()
+        });
+        // Best-effort: the password has already changed, so a mail failure must
+        // not fail the request and send the admin round again. Report it so
+        // they know to reach the member another way.
+        let notified = false;
+        if (isEmailConfigured()) {
+            const result = await sendEmail({
+                to: email,
+                subject: `Your ${siteName} password was changed`,
+                text: `An administrator of ${siteName} set a new password on your ` + 'account. You have been signed out on every device and will need ' + `the new password to sign back in at ${siteBase}.\n\n` + 'If you did not expect this, contact the site owner.',
+                fromName: branding.fromName,
+                sendingIdentity: await hostSendingIdentity(hostId),
+                audience: 'tenant',
+                context: 'membership admin password change'
+            });
+            notified = result.sent;
+            // Cost meter (AGL-1438). Transactional: a security notice.
+            if (result.sent) await meterHostEmail(hostId);
+        }
+        return res.status(200).json({
+            ok: true,
+            notified
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Password operation failed'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-admin-password.js.map

package/src/lib/server/membership-admin-password.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-admin-password.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveBrandingProfile, validateNewPassword } from '@aglyn/aglyn/server'\nimport { hostPublicOrigin } from '@aglyn/aglyn/server'\nimport { isEmailConfigured, sendEmail } from '@aglyn/shared-util-email'\nimport {\n  consumePasswordResetSend,\n  firebaseAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  isImpersonationSession,\n  meterHostEmail,\n  passwordResetThrottleMessage,\n} from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport {\n  hashMemberPassword,\n  MEMBER_SESSIONS_VALID_FROM_FIELD,\n  mintPasswordResetToken,\n} from './membership'\n\n/**\n * Console-side password help for a SITE MEMBER (AGL-914) — a visitor account\n * on a published site, not an Aglyn console user.\n *\n * Sibling to `membership-recover`, and deliberately its opposite in tone.\n * That endpoint is public, so it answers `{ok:true}` no matter what to avoid\n * confirming whether an address has an account. This one is driven by a site\n * admin looking straight at the member's record — they already know the\n * account exists, so hiding failures would only leave them guessing whether\n * their click did anything. Every outcome here is reported honestly.\n *\n * Auth is the console id-token check `hosts/members` uses (site admin via\n * the `memberRoles` projection, or an org role carrying manageMembers) — NOT\n * the visitor session cookie the rest of the membership endpoints take.\n */\nexport const membershipAdminPasswordHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const authorization = String(req.headers['authorization'] ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : ''\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  const hostId = String(req.body?.hostId ?? '')\n  const memberId = String(req.body?.memberId ?? '')\n  const action = String(req.body?.action ?? '')\n  if (!hostId || !memberId) {\n    return res.status(400).json({ error: 'Missing hostId or memberId' })\n  }\n  if (action !== 'sendPasswordReset' && action !== 'setPassword') {\n    return res.status(400).json({ error: 'Unknown action' })\n  }\n\n  try {\n    const app = firebaseAdmin.app()\n    const decoded = await app.auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      // Same shape as emailUnverifiedResponse (AGL-479), written by hand\n      // because that helper returns a fetch `Response` and this is a\n      // (req, res) plugin handler.\n      return res.status(403).json({\n        error: 'Verify your email to continue',\n        reason: 'email-unverified',\n      })\n    }\n    const firestore = app.firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    const host = hostSnapshot.data()\n    const memberRole = (host?.['memberRoles'] ?? {})[decoded.uid]\n    const orgPermissions = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (\n      !host ||\n      (memberRole !== 'admin' && !orgPermissions.permissions.manageMembers)\n    ) {\n      return res.status(403).json({ error: 'Not a site admin' })\n    }\n\n    const memberRef = hostRef.collection('siteMembers').doc(memberId)\n    const memberSnapshot = await memberRef.get()\n    if (!memberSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown member' })\n    }\n    const email = String(memberSnapshot.get('email') ?? '')\n    if (!email) {\n      return res.status(400).json({ error: 'This member has no email address' })\n    }\n\n    // `hostPublicOrigin`, not a hand-rolled apex (AGL-2195). This URL is\n    // minted server-side and mailed out, so a wrong apex is not a display\n    // bug — it is a live link on somebody else's domain.\n    const siteBase =\n      hostPublicOrigin({\n        cname: hostSnapshot.get('cname'),\n        subdomain: hostSnapshot.get('subdomain'),\n      }) ?? ''\n    const siteName = String(\n      hostSnapshot.get('displayName') ?? hostSnapshot.get('subdomain') ?? 'the site',\n    )\n    // White-label sender identity (White-Label Phase 3): the store's brand via\n    // the one shared resolver; the copy already uses the site name.\n    const branding = resolveBrandingProfile(\n      (await getOrgForHost(hostId).catch(() => null))?.org as never,\n    )\n\n    if (action === 'sendPasswordReset') {\n      // Throttled per recipient and per actor (AGL-920). Same caps as the\n      // console surfaces — a site member's inbox is no less worth protecting\n      // than a console user's.\n      const throttle = await consumePasswordResetSend({\n        actorKey: decoded.uid,\n        recipientKey: email,\n      })\n      if (!throttle.allowed) {\n        res.setHeader('Retry-After', String(throttle.retryAfterSeconds))\n        return res\n          .status(429)\n          .json({ error: passwordResetThrottleMessage(throttle) })\n      }\n      if (!isEmailConfigured()) {\n        return res.status(502).json({\n          error: 'Email is not configured, so no reset link could be sent',\n        })\n      }\n      // Same single-use, hash-bound token the self-serve flow mints\n      // (AGL-552) — completing the reset rewrites `passwordScrypt`, which\n      // retires the token without any server-side storage.\n      const token = mintPasswordResetToken(\n        hostId,\n        memberId,\n        memberSnapshot.get('passwordScrypt'),\n      )\n      const resetUrl = `${siteBase}/recover?token=${encodeURIComponent(token)}`\n      const result = await sendEmail({\n        to: email,\n        subject: `Reset your ${siteName} password`,\n        text:\n          `An administrator of ${siteName} started a password reset for ` +\n          'your account. Set a new password here:\\n\\n' +\n          `${resetUrl}\\n\\n` +\n          'The link works once and expires in 1 hour. Your current ' +\n          'password keeps working until you use it.',\n        fromName: branding.fromName,\n        sendingIdentity: await hostSendingIdentity(hostId),\n        audience: 'tenant',\n        context: 'membership admin recovery',\n      })\n      if (!result.sent) {\n        return res.status(502).json({\n          error: 'The reset email could not be delivered',\n        })\n      }\n      // Cost meter (AGL-1438). Transactional: a reset a quota refused leaves\n      // the member locked out of a site they pay for.\n      await meterHostEmail(hostId)\n      return res.status(200).json({ ok: true })\n    }\n\n    const validated = validateNewPassword(req.body?.password)\n    if (validated.error) {\n      return res.status(400).json({ error: validated.error })\n    }\n    // Rewriting the hash alone would NOT sign the member out: their session\n    // is an HMAC cookie that never encodes the password (unlike a reset\n    // token, which binds to it on purpose). The cut-off field is what\n    // actually revokes the old sessions — see readActiveMemberSession.\n    await memberRef.update({\n      passwordScrypt: hashMemberPassword(validated.password),\n      [MEMBER_SESSIONS_VALID_FROM_FIELD]: Date.now(),\n    })\n    // Best-effort: the password has already changed, so a mail failure must\n    // not fail the request and send the admin round again. Report it so\n    // they know to reach the member another way.\n    let notified = false\n    if (isEmailConfigured()) {\n      const result = await sendEmail({\n        to: email,\n        subject: `Your ${siteName} password was changed`,\n        text:\n          `An administrator of ${siteName} set a new password on your ` +\n          'account. You have been signed out on every device and will need ' +\n          `the new password to sign back in at ${siteBase}.\\n\\n` +\n          'If you did not expect this, contact the site owner.',\n        fromName: branding.fromName,\n        sendingIdentity: await hostSendingIdentity(hostId),\n        audience: 'tenant',\n        context: 'membership admin password change',\n      })\n      notified = result.sent\n      // Cost meter (AGL-1438). Transactional: a security notice.\n      if (result.sent) await meterHostEmail(hostId)\n    }\n    return res.status(200).json({ ok: true, notified })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Password operation failed' })\n  }\n}\n"],"names":["resolveBrandingProfile","validateNewPassword","hostPublicOrigin","isEmailConfigured","sendEmail","consumePasswordResetSend","firebaseAdmin","getOrgForHost","hostSendingIdentity","isImpersonationSession","meterHostEmail","passwordResetThrottleMessage","resolveOrgPermissions","hashMemberPassword","MEMBER_SESSIONS_VALID_FROM_FIELD","mintPasswordResetToken","membershipAdminPasswordHandler","req","res","method","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","hostId","body","memberId","action","memberSnapshot","hostSnapshot","app","decoded","auth","verifyIdToken","email_verified","reason","firestore","hostRef","collection","doc","get","host","data","memberRole","uid","orgPermissions","permissions","manageMembers","memberRef","exists","email","siteBase","cname","subdomain","siteName","branding","catch","org","throttle","actorKey","recipientKey","allowed","setHeader","retryAfterSeconds","token","resetUrl","encodeURIComponent","result","to","subject","text","fromName","sendingIdentity","audience","context","sent","ok","validated","password","update","passwordScrypt","Date","now","notified","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,sBAAsB,EAAEC,mBAAmB,QAAQ,sBAAqB;AACjF,SAASC,gBAAgB,QAAQ,sBAAqB;AACtD,SAASC,iBAAiB,EAAEC,SAAS,QAAQ,2BAA0B;AACvE,SACEC,wBAAwB,EACxBC,aAAa,EACbC,aAAa,EACbC,mBAAmB,EACnBC,sBAAsB,EACtBC,cAAc,EACdC,4BAA4B,QACvB,2BAA0B;AACjC,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SACEC,kBAAkB,EAClBC,gCAAgC,EAChCC,sBAAsB,QACjB,kBAAc;AAErB;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,iCAAmD,OAC9DC,KACAC;QAK6BD;QAMPA,WACEA,YACFA;IAXtB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,gBAAgBC,QAAOP,6BAAAA,IAAIQ,OAAO,CAAC,gBAAgB,YAA5BR,6BAAgC;IAC7D,MAAMS,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpC;IACJ,IAAI,CAACH,SAAS,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,MAAMQ,SAASN,gBAAOP,YAAAA,IAAIc,IAAI,qBAARd,UAAUa,MAAM,mBAAI;IAC1C,MAAME,WAAWR,iBAAOP,aAAAA,IAAIc,IAAI,qBAARd,WAAUe,QAAQ,oBAAI;IAC9C,MAAMC,SAAST,iBAAOP,aAAAA,IAAIc,IAAI,qBAARd,WAAUgB,MAAM,oBAAI;IAC1C,IAAI,CAACH,UAAU,CAACE,UAAU;QACxB,OAAOd,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA6B;IACpE;IACA,IAAIW,WAAW,uBAAuBA,WAAW,eAAe;QAC9D,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;IAEA,IAAI;mBA8BmBY,qBASnBhC,mBAKAiC,OAAAA;YAKC,OAwDmClB;QAxGtC,MAAMmB,MAAM9B,cAAc8B,GAAG;QAC7B,MAAMC,UAAU,MAAMD,IAAIE,IAAI,GAAGC,aAAa,CAACb;QAC/C,IAAI,CAACW,QAAQG,cAAc,IAAI,CAAC/B,uBAAuB4B,UAAU;YAC/D,mEAAmE;YACnE,+DAA+D;YAC/D,6BAA6B;YAC7B,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;gBACPmB,QAAQ;YACV;QACF;QACA,MAAMC,YAAYN,IAAIM,SAAS;QAC/B,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACf;QAClD,MAAMK,eAAe,MAAMQ,QAAQG,GAAG;QACtC,MAAMC,OAAOZ,aAAaa,IAAI;QAC9B,MAAMC,aAAa,UAACF,wBAAAA,IAAM,CAAC,cAAc,oBAAI,CAAC,EAAE,CAACV,QAAQa,GAAG,CAAC;QAC7D,MAAMC,iBAAiB,MAAMvC,sBAAsByB,QAAQa,GAAG,EAAE;YAAEpB;QAAO;QACzE,IACE,CAACiB,QACAE,eAAe,WAAW,CAACE,eAAeC,WAAW,CAACC,aAAa,EACpE;YACA,OAAOnC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAmB;QAC1D;QAEA,MAAMgC,YAAYX,QAAQC,UAAU,CAAC,eAAeC,GAAG,CAACb;QACxD,MAAME,iBAAiB,MAAMoB,UAAUR,GAAG;QAC1C,IAAI,CAACZ,eAAeqB,MAAM,EAAE;YAC1B,OAAOrC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiB;QACxD;QACA,MAAMkC,QAAQhC,QAAOU,sBAAAA,eAAeY,GAAG,CAAC,oBAAnBZ,sBAA+B;QACpD,IAAI,CAACsB,OAAO;YACV,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAmC;QAC1E;QAEA,qEAAqE;QACrE,sEAAsE;QACtE,qDAAqD;QACrD,MAAMmC,YACJvD,oBAAAA,iBAAiB;YACfwD,OAAOvB,aAAaW,GAAG,CAAC;YACxBa,WAAWxB,aAAaW,GAAG,CAAC;QAC9B,cAHA5C,oBAGM;QACR,MAAM0D,WAAWpC,QACfW,SAAAA,oBAAAA,aAAaW,GAAG,CAAC,0BAAjBX,oBAAmCA,aAAaW,GAAG,CAAC,wBAApDX,QAAoE;QAEtE,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM0B,WAAW7D,wBACd,QAAA,MAAMO,cAAcuB,QAAQgC,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDC,GAAG;QAGtD,IAAI9B,WAAW,qBAAqB;YAClC,oEAAoE;YACpE,uEAAuE;YACvE,yBAAyB;YACzB,MAAM+B,WAAW,MAAM3D,yBAAyB;gBAC9C4D,UAAU5B,QAAQa,GAAG;gBACrBgB,cAAcV;YAChB;YACA,IAAI,CAACQ,SAASG,OAAO,EAAE;gBACrBjD,IAAIkD,SAAS,CAAC,eAAe5C,OAAOwC,SAASK,iBAAiB;gBAC9D,OAAOnD,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;oBAAEC,OAAOX,6BAA6BqD;gBAAU;YAC1D;YACA,IAAI,CAAC7D,qBAAqB;gBACxB,OAAOe,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OAAO;gBACT;YACF;YACA,8DAA8D;YAC9D,oEAAoE;YACpE,qDAAqD;YACrD,MAAMgD,QAAQvD,uBACZe,QACAE,UACAE,eAAeY,GAAG,CAAC;YAErB,MAAMyB,WAAW,GAAGd,SAAS,eAAe,EAAEe,mBAAmBF,QAAQ;YACzE,MAAMG,SAAS,MAAMrE,UAAU;gBAC7BsE,IAAIlB;gBACJmB,SAAS,CAAC,WAAW,EAAEf,SAAS,SAAS,CAAC;gBAC1CgB,MACE,CAAC,oBAAoB,EAAEhB,SAAS,8BAA8B,CAAC,GAC/D,+CACA,GAAGW,SAAS,IAAI,CAAC,GACjB,6DACA;gBACFM,UAAUhB,SAASgB,QAAQ;gBAC3BC,iBAAiB,MAAMtE,oBAAoBsB;gBAC3CiD,UAAU;gBACVC,SAAS;YACX;YACA,IAAI,CAACP,OAAOQ,IAAI,EAAE;gBAChB,OAAO/D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OAAO;gBACT;YACF;YACA,uEAAuE;YACvE,gDAAgD;YAChD,MAAMZ,eAAeoB;YACrB,OAAOZ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE6D,IAAI;YAAK;QACzC;QAEA,MAAMC,YAAYlF,qBAAoBgB,aAAAA,IAAIc,IAAI,qBAARd,WAAUmE,QAAQ;QACxD,IAAID,UAAU7D,KAAK,EAAE;YACnB,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO6D,UAAU7D,KAAK;YAAC;QACvD;QACA,wEAAwE;QACxE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,MAAMgC,UAAU+B,MAAM,CAAC;YACrBC,gBAAgBzE,mBAAmBsE,UAAUC,QAAQ;YACrD,CAACtE,iCAAiC,EAAEyE,KAAKC,GAAG;QAC9C;QACA,wEAAwE;QACxE,oEAAoE;QACpE,6CAA6C;QAC7C,IAAIC,WAAW;QACf,IAAItF,qBAAqB;YACvB,MAAMsE,SAAS,MAAMrE,UAAU;gBAC7BsE,IAAIlB;gBACJmB,SAAS,CAAC,KAAK,EAAEf,SAAS,qBAAqB,CAAC;gBAChDgB,MACE,CAAC,oBAAoB,EAAEhB,SAAS,4BAA4B,CAAC,GAC7D,qEACA,CAAC,oCAAoC,EAAEH,SAAS,KAAK,CAAC,GACtD;gBACFoB,UAAUhB,SAASgB,QAAQ;gBAC3BC,iBAAiB,MAAMtE,oBAAoBsB;gBAC3CiD,UAAU;gBACVC,SAAS;YACX;YACAS,WAAWhB,OAAOQ,IAAI;YACtB,2DAA2D;YAC3D,IAAIR,OAAOQ,IAAI,EAAE,MAAMvE,eAAeoB;QACxC;QACA,OAAOZ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE6D,IAAI;YAAMO;QAAS;IACnD,EAAE,OAAOnE,OAAO;QACdoE,QAAQpE,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B;IACnE;AACF,EAAC"}

package/src/lib/server/membership-content.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Members-only screen content (AGL-109/309): like the AGL-87 unlock API,
+ * the node tree never ships in static HTML — it is returned here only when
+ * the visitor's session cookie verifies for this host.
+ */
+export declare const membershipContentHandler: PluginApiHandler;

package/src/lib/server/membership-content.js

@@ -0,0 +1,105 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import composeScreenNodes from "@aglyn/tenant-runtime/compose-screen-nodes";
+import { enrichGatedScreenPage } from "@aglyn/tenant-runtime/enrich-gated-page";
+import getScreen from "@aglyn/tenant-runtime/get-screen";
+import { getHostDocAdmin } from "@aglyn/tenant-data-admin";
+import { hostHasContentGating } from "./gate.js";
+import { requireActiveMember } from "./membership.js";
+/**
+ * Members-only screen content (AGL-109/309): like the AGL-87 unlock API,
+ * the node tree never ships in static HTML — it is returned here only when
+ * the visitor's session cookie verifies for this host.
+ */ export const membershipContentHandler = async (req, res)=>{
+    var _ref, _ref1;
+    var _req_body, _req_body1;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const screenId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.screenId) != null ? _ref1 : '');
+    if (!hostId || !screenId) {
+        return res.status(400).json({
+            error: 'Invalid request'
+        });
+    }
+    try {
+        // Suspension gate (AGL-550): the cookie alone no longer unlocks the
+        // node tree — a suspended member (AGL-546) is 403'd, cookie cleared.
+        const auth = await requireActiveMember(req, res, hostId, 'Sign in required');
+        if (!auth) return;
+        // Org-level gate (AGL-481): members-only screens are a Business+
+        // feature. If the host's plan doesn't include content gating, the
+        // protected node tree is never served — fail closed. (These nodes
+        // never ship in static HTML, so this endpoint is the runtime gate.)
+        if (!await hostHasContentGating(hostId)) {
+            return res.status(403).json({
+                error: 'Members-only content is unavailable'
+            });
+        }
+        const screenRes = await getScreen({
+            hostId,
+            screenId
+        });
+        if (!screenRes.screen) {
+            return res.status(404).json({
+                error: 'Unknown screen'
+            });
+        }
+        // The site document (AGL-2883): the tree's host variables fill in from
+        // it, and the enricher slice below reads the same copy. A failed read
+        // composes with no site, which renders those variables as nothing — the
+        // member's content without its business name still beats no content.
+        const host = await getHostDocAdmin(hostId).catch((error)=>{
+            console.error(error);
+            return null;
+        });
+        const nodes = await composeScreenNodes({
+            hostId,
+            screenId,
+            screen: screenRes.screen,
+            host
+        });
+        if (!nodes) return res.status(404).json({
+            error: 'No published version'
+        });
+        // The page's behavior travels with its nodes (AGL-2510). The loader ships
+        // `nodes: null` for a members-only screen, so its enricher slice — the
+        // interactions the shared layout's nav opens on, above all — has nowhere
+        // else to arrive from, and the member saw a nav that did not open.
+        const enriched = await enrichGatedScreenPage(_extends({
+            hostId,
+            screenId,
+            screen: screenRes.screen,
+            nodes
+        }, host ? {
+            host
+        } : {}));
+        return res.status(200).json(_extends({
+            nodes
+        }, enriched));
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Content fetch failed'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-content.js.map

package/src/lib/server/membership-content.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-content.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport composeScreenNodes from '@aglyn/tenant-runtime/compose-screen-nodes'\nimport { enrichGatedScreenPage } from '@aglyn/tenant-runtime/enrich-gated-page'\nimport getScreen from '@aglyn/tenant-runtime/get-screen'\nimport { getHostDocAdmin } from '@aglyn/tenant-data-admin'\nimport { hostHasContentGating } from './gate'\nimport { requireActiveMember } from './membership'\n\n/**\n * Members-only screen content (AGL-109/309): like the AGL-87 unlock API,\n * the node tree never ships in static HTML — it is returned here only when\n * the visitor's session cookie verifies for this host.\n */\nexport const membershipContentHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const screenId = String(req.body?.screenId ?? '')\n  if (!hostId || !screenId) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  try {\n    // Suspension gate (AGL-550): the cookie alone no longer unlocks the\n    // node tree — a suspended member (AGL-546) is 403'd, cookie cleared.\n    const auth = await requireActiveMember(req, res, hostId, 'Sign in required')\n    if (!auth) return\n    // Org-level gate (AGL-481): members-only screens are a Business+\n    // feature. If the host's plan doesn't include content gating, the\n    // protected node tree is never served — fail closed. (These nodes\n    // never ship in static HTML, so this endpoint is the runtime gate.)\n    if (!(await hostHasContentGating(hostId))) {\n      return res.status(403).json({ error: 'Members-only content is unavailable' })\n    }\n    const screenRes = await getScreen({ hostId, screenId })\n    if (!screenRes.screen) {\n      return res.status(404).json({ error: 'Unknown screen' })\n    }\n    // The site document (AGL-2883): the tree's host variables fill in from\n    // it, and the enricher slice below reads the same copy. A failed read\n    // composes with no site, which renders those variables as nothing — the\n    // member's content without its business name still beats no content.\n    const host = await getHostDocAdmin(hostId).catch((error) => {\n      console.error(error)\n      return null\n    })\n    const nodes = await composeScreenNodes({\n      hostId,\n      screenId,\n      screen: screenRes.screen,\n      host,\n    })\n    if (!nodes) return res.status(404).json({ error: 'No published version' })\n    // The page's behavior travels with its nodes (AGL-2510). The loader ships\n    // `nodes: null` for a members-only screen, so its enricher slice — the\n    // interactions the shared layout's nav opens on, above all — has nowhere\n    // else to arrive from, and the member saw a nav that did not open.\n    const enriched = await enrichGatedScreenPage({\n      hostId,\n      screenId,\n      screen: screenRes.screen,\n      nodes,\n      ...(host ? { host } : {}),\n    })\n    return res.status(200).json({ nodes, ...enriched })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Content fetch failed' })\n  }\n}\n"],"names":["composeScreenNodes","enrichGatedScreenPage","getScreen","getHostDocAdmin","hostHasContentGating","requireActiveMember","membershipContentHandler","req","res","method","status","json","error","hostId","String","body","screenId","auth","screenRes","screen","host","catch","console","nodes","enriched"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,OAAOA,wBAAwB,6CAA4C;AAC3E,SAASC,qBAAqB,QAAQ,0CAAyC;AAC/E,OAAOC,eAAe,mCAAkC;AACxD,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,oBAAoB,QAAQ,YAAQ;AAC7C,SAASC,mBAAmB,QAAQ,kBAAc;AAElD;;;;CAIC,GACD,OAAO,MAAMC,2BAA6C,OAAOC,KAAKC;;QAI9CD,WACEA;IAJxB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,WAAWF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,QAAQ,oBAAI;IAC9C,IAAI,CAACH,UAAU,CAACG,UAAU;QACxB,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,IAAI;QACF,oEAAoE;QACpE,qEAAqE;QACrE,MAAMK,OAAO,MAAMZ,oBAAoBE,KAAKC,KAAKK,QAAQ;QACzD,IAAI,CAACI,MAAM;QACX,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,IAAI,CAAE,MAAMb,qBAAqBS,SAAU;YACzC,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAsC;QAC7E;QACA,MAAMM,YAAY,MAAMhB,UAAU;YAAEW;YAAQG;QAAS;QACrD,IAAI,CAACE,UAAUC,MAAM,EAAE;YACrB,OAAOX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiB;QACxD;QACA,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,qEAAqE;QACrE,MAAMQ,OAAO,MAAMjB,gBAAgBU,QAAQQ,KAAK,CAAC,CAACT;YAChDU,QAAQV,KAAK,CAACA;YACd,OAAO;QACT;QACA,MAAMW,QAAQ,MAAMvB,mBAAmB;YACrCa;YACAG;YACAG,QAAQD,UAAUC,MAAM;YACxBC;QACF;QACA,IAAI,CAACG,OAAO,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAuB;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,MAAMY,WAAW,MAAMvB,sBAAsB;YAC3CY;YACAG;YACAG,QAAQD,UAAUC,MAAM;YACxBI;WACIH,OAAO;YAAEA;QAAK,IAAI,CAAC;QAEzB,OAAOZ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEY;WAAUC;IAC1C,EAAE,OAAOZ,OAAO;QACdU,QAAQV,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAuB;IAC9D;AACF,EAAC"}