@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/membership-register.js

@@ -0,0 +1,241 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { memberNameSearchFields } from "./member-name-search.js";
+import { checkVisitorRecordCeiling, HOST_TOKENS, marketingConsentFieldsForHost, personKey, SITE_MEMBER_CEILING_CODE, SITE_MEMBER_UNAVAILABLE_MESSAGE, SITE_MEMBERS_MAX_PER_HOST } from "@aglyn/aglyn/server";
+import { addHostLead, firebaseAdmin, recordVisitorRecordCeilingTrip, resolveCampaignTouch } from "@aglyn/tenant-data-admin";
+import { captureHostContact, emitHostEvent } from "@aglyn/tenant-runtime";
+import { hashMemberPassword, mintMemberSession, setMemberCookie } from "./membership.js";
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * Site member sign-up (AGL-109): creates the member record (scrypt hash),
+ * doubles as a lead, and signs the visitor in via the session cookie.
+ */ export const membershipRegisterHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _ref3;
+    var _req_body, _req_body1, _req_body2, _req_body3, _req_body4;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const email = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.email) != null ? _ref1 : '').trim().toLowerCase();
+    const password = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.password) != null ? _ref2 : '');
+    const displayName = String((_ref3 = (_req_body3 = req.body) == null ? void 0 : _req_body3.displayName) != null ? _ref3 : '').trim().slice(0, 80);
+    // Explicit opt-in checkbox (AGL-2499) — never inferred from signing up.
+    const marketingConsent = ((_req_body4 = req.body) == null ? void 0 : _req_body4.marketingConsent) === true;
+    if (!hostId) return res.status(400).json({
+        error: 'Missing host'
+    });
+    if (!EMAIL_PATTERN.test(email)) {
+        return res.status(400).json({
+            error: 'Enter a valid email'
+        });
+    }
+    if (password.length < 8) {
+        return res.status(400).json({
+            error: 'Password must be at least 8 characters'
+        });
+    }
+    try {
+        var _personKey;
+        var _req_body5;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        // Member accounts are UNLIMITED on every plan (AGL-889) — no seat or
+        // quota check belongs here. Audience monetization happens downstream:
+        // contact bands meter the CRM projection (AGL-890) and paid
+        // memberships carry the plan's digital transaction fee (AGL-892).
+        //
+        // `SITE_MEMBERS_MAX_PER_HOST` below is NOT that check and does not make
+        // it one (AGL-1529). It is a flat PLATFORM ceiling — same number on every
+        // plan, no `OrgEntitlements` key, nothing on the price list — and it
+        // exists because this handler is reachable by an ANONYMOUS VISITOR, so
+        // without it the collection was bounded only by a per-(host, IP) rate
+        // limiter that fails soft and bounds the RATE rather than the TOTAL. An
+        // abuse control is not something we sell; "unlimited member accounts on
+        // every plan" stays literally true.
+        const membersRef = hostRef.collection('siteMembers');
+        const memberRef = membersRef.doc();
+        /*
+     * COUNT, DEDUPE AND CREATE IN ONE TRANSACTION (AGL-1529, the AGL-2231
+     * treatment).
+     *
+     * Read-then-decide-then-`set()` is the create-time quota that laundered
+     * everywhere else in this repo: N concurrent sign-ups each read the same
+     * pre-count, each find room, and each land — and nothing re-counts
+     * afterwards, so the extra accounts are permanent. The fix is WHEN the
+     * count is evaluated, not the counting rule.
+     * `Transaction.get(AggregateQuery)` serialises the count against a
+     * concurrent create into this collection: the loser retries, re-reads the
+     * higher count and is refused. The duplicate-email read moves inside for
+     * free, which also closes the smaller race it always had — two
+     * simultaneous sign-ups on one address both saw `empty` and both wrote.
+     *
+     * ALL READS BEFORE THE WRITE, which Firestore requires.
+     *
+     * The scrypt hash sits between the last read and the create ON PURPOSE.
+     * It is ~100 ms of CPU and it is the most expensive thing in the request,
+     * so a refused sign-up must never pay it — hashing before the transaction
+     * would hand a flood a CPU amplifier on exactly the path the ceiling
+     * exists to contain, and would also be a regression, since today a
+     * duplicate-email refusal does not hash either. It is a pure computation,
+     * not an effect, so it does not violate the "nothing happens in a
+     * transaction body" rule the sibling routes state.
+     *
+     * A refusal is returned as DATA and rendered outside: a body that can run
+     * several times must not be the place a response is built.
+     */ const refusal = await firestore.runTransaction(async (tx)=>{
+            const existing = await tx.get(membersRef.where('email', '==', email).limit(1));
+            if (!existing.empty) return {
+                duplicate: true,
+                ceiling: 0
+            };
+            const used = (await tx.get(membersRef.count())).data().count;
+            // Live documents only, so removing a member in the inbox frees the slot.
+            const verdict = checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST);
+            if (verdict.exceeded) return {
+                duplicate: false,
+                ceiling: verdict.ceiling
+            };
+            tx.create(memberRef, _extends({
+                email
+            }, displayName ? memberNameSearchFields(displayName) : {}, {
+                passwordScrypt: hashMemberPassword(password)
+            }, marketingConsent ? marketingConsentFieldsForHost(hostId, Date.now()) : {}, {
+                createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+            }));
+            return null;
+        });
+        if (refusal == null ? void 0 : refusal.duplicate) {
+            return res.status(409).json({
+                error: 'That email is already a member'
+            });
+        }
+        if (refusal) {
+            var _HOST_TOKENS_supportEmail;
+            // Visible to the HOST — the rule that a control nobody can see in
+            // the console did not ship. Durable counter + one notification.
+            await recordVisitorRecordCeilingTrip({
+                hostRef,
+                hostId,
+                kind: 'siteMembers',
+                ceiling: refusal.ceiling
+            });
+            // Opaque to the VISITOR, who is a stranger to this site and not our
+            // customer (AGL-1666's rules, restated in the message's own docblock).
+            // The one genuinely useful thing to hand them is a door that still
+            // opens, so the site's OWN published support address rides along when
+            // it has one — read through the host-token registry, whose description
+            // of this field is literally "where visitors should write for help".
+            // Nothing else off the host document may leave the console.
+            const contact = (_HOST_TOKENS_supportEmail = HOST_TOKENS['supportEmail']) == null ? void 0 : _HOST_TOKENS_supportEmail.resolve(hostSnapshot.data());
+            return res.status(429).json(_extends({
+                error: SITE_MEMBER_UNAVAILABLE_MESSAGE,
+                // Machine-readable, because the dispatcher's rate limiter answers 429
+                // too and the status therefore discriminates nothing.
+                code: SITE_MEMBER_CEILING_CODE
+            }, contact ? {
+                contact
+            } : {}));
+        }
+        // Sign-ups double as leads for the site owner (AGL-109), through the one
+        // writer that enforces `LEADS_MAX_PER_HOST` (AGL-1529). A refused lead
+        // never fails the sign-up: the visitor asked for an account, not for a
+        // lead record, and the trip is recorded for the owner either way.
+        /*
+     * THE CAMPAIGN TOUCH, RESOLVED ONCE FOR THE WHOLE SIGN-UP.
+     *
+     * A sign-up is the identify moment for a visitor who has been anonymous
+     * until now, and it writes two records that a campaign can be credited
+     * with — the lead and the contact. One resolve, one keyed read, and the
+     * two cannot end up naming different campaigns.
+     *
+     * The MEMBER record itself is not attributed. A member is an account the
+     * visitor holds and the lead is the site's record of the same act, so
+     * crediting both would count one sign-up twice under two names.
+     */ const signedUpAtMs = Date.now();
+        const campaignTouch = await resolveCampaignTouch({
+            hostId,
+            wire: (_req_body5 = req.body) == null ? void 0 : _req_body5.campaignTouch,
+            email,
+            atMs: signedUpAtMs
+        });
+        await addHostLead(_extends({
+            hostRef,
+            hostId,
+            lead: _extends({
+                email
+            }, displayName ? {
+                name: displayName
+            } : {}, {
+                source: 'signup'
+            }, marketingConsent ? {
+                marketingConsent: true
+            } : {})
+        }, campaignTouch ? {
+            touch: campaignTouch
+        } : {}));
+        // Contacts ingestion (AGL-197).
+        void captureHostContact(_extends({
+            hostId,
+            email,
+            name: displayName || undefined,
+            source: 'member',
+            // An account is a subscription to the site, not an enquiry (AGL-2612):
+            // the lead this sign-up also files is the sales record, and the stage
+            // on the contact says only that the person asked to be kept.
+            initialLifecycleStage: 'subscriber',
+            interaction: {
+                refId: memberRef.id,
+                summary: 'Joined as a member'
+            }
+        }, marketingConsent ? {
+            marketingConsent: true
+        } : {}, campaignTouch ? {
+            campaignTouch
+        } : {}));
+        // Event triggers (AGL-128/148): sign-ups double as leads here too. The
+        // lead's id is the person key `addHostLead` filed it under, so a webhook
+        // can read the row back over `/v1/leads/{leadId}` (AGL-2627); empty for
+        // an address that could not be keyed, as every optional payload key is.
+        await emitHostEvent(hostId, 'memberSignUp', {
+            email
+        });
+        await emitHostEvent(hostId, 'lead', {
+            email,
+            source: 'signup',
+            leadId: (_personKey = personKey(email)) != null ? _personKey : ''
+        });
+        setMemberCookie(res, hostId, mintMemberSession(hostId, memberRef.id));
+        return res.status(200).json({
+            ok: true
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Sign-up failed'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-register.js.map

package/src/lib/server/membership-register.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-register.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { memberNameSearchFields } from './member-name-search'\nimport {\n  checkVisitorRecordCeiling,\n  HOST_TOKENS,\n  marketingConsentFieldsForHost,\n  personKey,\n  SITE_MEMBER_CEILING_CODE,\n  SITE_MEMBER_UNAVAILABLE_MESSAGE,\n  SITE_MEMBERS_MAX_PER_HOST,\n} from '@aglyn/aglyn/server'\nimport {\n  addHostLead,\n  firebaseAdmin,\n  recordVisitorRecordCeilingTrip,\n  resolveCampaignTouch,\n} from '@aglyn/tenant-data-admin'\nimport { captureHostContact, emitHostEvent } from '@aglyn/tenant-runtime'\nimport {\n  hashMemberPassword,\n  mintMemberSession,\n  setMemberCookie,\n} from './membership'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Site member sign-up (AGL-109): creates the member record (scrypt hash),\n * doubles as a lead, and signs the visitor in via the session cookie.\n */\nexport const membershipRegisterHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  const displayName = String(req.body?.displayName ?? '')\n    .trim()\n    .slice(0, 80)\n  // Explicit opt-in checkbox (AGL-2499) — never inferred from signing up.\n  const marketingConsent = req.body?.marketingConsent === true\n  if (!hostId) return res.status(400).json({ error: 'Missing host' })\n  if (!EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Enter a valid email' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Member accounts are UNLIMITED on every plan (AGL-889) — no seat or\n    // quota check belongs here. Audience monetization happens downstream:\n    // contact bands meter the CRM projection (AGL-890) and paid\n    // memberships carry the plan's digital transaction fee (AGL-892).\n    //\n    // `SITE_MEMBERS_MAX_PER_HOST` below is NOT that check and does not make\n    // it one (AGL-1529). It is a flat PLATFORM ceiling — same number on every\n    // plan, no `OrgEntitlements` key, nothing on the price list — and it\n    // exists because this handler is reachable by an ANONYMOUS VISITOR, so\n    // without it the collection was bounded only by a per-(host, IP) rate\n    // limiter that fails soft and bounds the RATE rather than the TOTAL. An\n    // abuse control is not something we sell; \"unlimited member accounts on\n    // every plan\" stays literally true.\n    const membersRef = hostRef.collection('siteMembers')\n    const memberRef = membersRef.doc()\n    /*\n     * COUNT, DEDUPE AND CREATE IN ONE TRANSACTION (AGL-1529, the AGL-2231\n     * treatment).\n     *\n     * Read-then-decide-then-`set()` is the create-time quota that laundered\n     * everywhere else in this repo: N concurrent sign-ups each read the same\n     * pre-count, each find room, and each land — and nothing re-counts\n     * afterwards, so the extra accounts are permanent. The fix is WHEN the\n     * count is evaluated, not the counting rule.\n     * `Transaction.get(AggregateQuery)` serialises the count against a\n     * concurrent create into this collection: the loser retries, re-reads the\n     * higher count and is refused. The duplicate-email read moves inside for\n     * free, which also closes the smaller race it always had — two\n     * simultaneous sign-ups on one address both saw `empty` and both wrote.\n     *\n     * ALL READS BEFORE THE WRITE, which Firestore requires.\n     *\n     * The scrypt hash sits between the last read and the create ON PURPOSE.\n     * It is ~100 ms of CPU and it is the most expensive thing in the request,\n     * so a refused sign-up must never pay it — hashing before the transaction\n     * would hand a flood a CPU amplifier on exactly the path the ceiling\n     * exists to contain, and would also be a regression, since today a\n     * duplicate-email refusal does not hash either. It is a pure computation,\n     * not an effect, so it does not violate the \"nothing happens in a\n     * transaction body\" rule the sibling routes state.\n     *\n     * A refusal is returned as DATA and rendered outside: a body that can run\n     * several times must not be the place a response is built.\n     */\n    const refusal = await firestore.runTransaction(async (tx) => {\n      const existing = await tx.get(membersRef.where('email', '==', email).limit(1))\n      if (!existing.empty) return { duplicate: true, ceiling: 0 }\n      const used = (await tx.get(membersRef.count())).data().count\n      // Live documents only, so removing a member in the inbox frees the slot.\n      const verdict = checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n      if (verdict.exceeded) return { duplicate: false, ceiling: verdict.ceiling }\n      tx.create(memberRef, {\n        email,\n        ...(displayName ? memberNameSearchFields(displayName) : {}),\n        passwordScrypt: hashMemberPassword(password),\n        /*\n         * The checkbox is PERSISTED on the member, not only forwarded.\n         *\n         * It reached the lead and the contact from the two lines below and\n         * was dropped for this document, so `hosts/{hostId}/siteMembers` had\n         * no consent field of any kind and `audience: 'members'` had nothing\n         * for the send-time join to read — the audience could not be filtered\n         * even in principle (`docs/specs/email-overhaul.md` §1d/§3f). The\n         * other two documents are not a substitute: a member is deduped in\n         * this transaction while leads append every time, and contacts are\n         * ORG-scoped where a member is the site's own.\n         *\n         * Written only when ticked. Signing up is not opting in — that is why\n         * the checkbox exists and why it defaults unchecked — so the omitted\n         * case stores nothing and reads back as an unrecorded basis rather\n         * than as a refusal.\n         *\n         * Under this site's key even though `siteMembers` already lives\n         * beneath it, so that one reader answers for every silo — see\n         * `addHostLead`, which makes the same write for the same reason.\n         */\n        ...(marketingConsent\n          ? marketingConsentFieldsForHost(hostId, Date.now())\n          : {}),\n        createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      })\n      return null\n    })\n    if (refusal?.duplicate) {\n      return res.status(409).json({ error: 'That email is already a member' })\n    }\n    if (refusal) {\n      // Visible to the HOST — the rule that a control nobody can see in\n      // the console did not ship. Durable counter + one notification.\n      await recordVisitorRecordCeilingTrip({\n        hostRef,\n        hostId,\n        kind: 'siteMembers',\n        ceiling: refusal.ceiling,\n      })\n      // Opaque to the VISITOR, who is a stranger to this site and not our\n      // customer (AGL-1666's rules, restated in the message's own docblock).\n      // The one genuinely useful thing to hand them is a door that still\n      // opens, so the site's OWN published support address rides along when\n      // it has one — read through the host-token registry, whose description\n      // of this field is literally \"where visitors should write for help\".\n      // Nothing else off the host document may leave the console.\n      const contact = HOST_TOKENS['supportEmail']?.resolve(\n        hostSnapshot.data() as any,\n      )\n      return res.status(429).json({\n        error: SITE_MEMBER_UNAVAILABLE_MESSAGE,\n        // Machine-readable, because the dispatcher's rate limiter answers 429\n        // too and the status therefore discriminates nothing.\n        code: SITE_MEMBER_CEILING_CODE,\n        ...(contact ? { contact } : {}),\n      })\n    }\n    // Sign-ups double as leads for the site owner (AGL-109), through the one\n    // writer that enforces `LEADS_MAX_PER_HOST` (AGL-1529). A refused lead\n    // never fails the sign-up: the visitor asked for an account, not for a\n    // lead record, and the trip is recorded for the owner either way.\n    /*\n     * THE CAMPAIGN TOUCH, RESOLVED ONCE FOR THE WHOLE SIGN-UP.\n     *\n     * A sign-up is the identify moment for a visitor who has been anonymous\n     * until now, and it writes two records that a campaign can be credited\n     * with — the lead and the contact. One resolve, one keyed read, and the\n     * two cannot end up naming different campaigns.\n     *\n     * The MEMBER record itself is not attributed. A member is an account the\n     * visitor holds and the lead is the site's record of the same act, so\n     * crediting both would count one sign-up twice under two names.\n     */\n    const signedUpAtMs = Date.now()\n    const campaignTouch = await resolveCampaignTouch({\n      hostId,\n      wire: req.body?.campaignTouch,\n      email,\n      atMs: signedUpAtMs,\n    })\n    await addHostLead({\n      hostRef,\n      hostId,\n      lead: {\n        email,\n        // The name the person just typed (AGL-2303). `campaign-send` reads\n        // `leads.name` for merge tags and NOTHING wrote it, so every campaign\n        // to the leads audience addressed a blank — with the name sitting one\n        // line above, already stored on the member document.\n        ...(displayName ? { name: displayName } : {}),\n        source: 'signup',\n        ...(marketingConsent ? { marketingConsent: true } : {}),\n      },\n      ...(campaignTouch ? { touch: campaignTouch } : {}),\n    })\n    // Contacts ingestion (AGL-197).\n    void captureHostContact({\n      hostId,\n      email,\n      name: displayName || undefined,\n      source: 'member',\n      // An account is a subscription to the site, not an enquiry (AGL-2612):\n      // the lead this sign-up also files is the sales record, and the stage\n      // on the contact says only that the person asked to be kept.\n      initialLifecycleStage: 'subscriber',\n      interaction: { refId: memberRef.id, summary: 'Joined as a member' },\n      ...(marketingConsent ? { marketingConsent: true } : {}),\n      ...(campaignTouch ? { campaignTouch } : {}),\n    })\n    // Event triggers (AGL-128/148): sign-ups double as leads here too. The\n    // lead's id is the person key `addHostLead` filed it under, so a webhook\n    // can read the row back over `/v1/leads/{leadId}` (AGL-2627); empty for\n    // an address that could not be keyed, as every optional payload key is.\n    await emitHostEvent(hostId, 'memberSignUp', { email })\n    await emitHostEvent(hostId, 'lead', {\n      email,\n      source: 'signup',\n      leadId: personKey(email) ?? '',\n    })\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberRef.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-up failed' })\n  }\n}\n"],"names":["memberNameSearchFields","checkVisitorRecordCeiling","HOST_TOKENS","marketingConsentFieldsForHost","personKey","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","SITE_MEMBERS_MAX_PER_HOST","addHostLead","firebaseAdmin","recordVisitorRecordCeilingTrip","resolveCampaignTouch","captureHostContact","emitHostEvent","hashMemberPassword","mintMemberSession","setMemberCookie","EMAIL_PATTERN","membershipRegisterHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","displayName","slice","marketingConsent","test","length","firestore","app","hostRef","collection","doc","hostSnapshot","get","exists","membersRef","memberRef","refusal","runTransaction","tx","existing","where","limit","empty","duplicate","ceiling","used","count","data","verdict","exceeded","create","passwordScrypt","Date","now","createdAt","FieldValue","serverTimestamp","kind","contact","resolve","code","signedUpAtMs","campaignTouch","wire","atMs","lead","name","source","touch","undefined","initialLifecycleStage","interaction","refId","id","summary","leadId","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,sBAAsB,QAAQ,0BAAsB;AAC7D,SACEC,yBAAyB,EACzBC,WAAW,EACXC,6BAA6B,EAC7BC,SAAS,EACTC,wBAAwB,EACxBC,+BAA+B,EAC/BC,yBAAyB,QACpB,sBAAqB;AAC5B,SACEC,WAAW,EACXC,aAAa,EACbC,8BAA8B,EAC9BC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,kBAAkB,EAAEC,aAAa,QAAQ,wBAAuB;AACzE,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,eAAe,QACV,kBAAc;AAErB,MAAMC,gBAAgB;AAEtB;;;CAGC,GACD,OAAO,MAAMC,4BAA8C,OAAOC,KAAKC;;QAI/CD,WACDA,YAGGA,YACGA,YAIFA;IAZzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,MAAMC,cAAcN,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,WAAW,oBAAI,IACjDH,IAAI,GACJI,KAAK,CAAC,GAAG;IACZ,wEAAwE;IACxE,MAAMC,mBAAmBf,EAAAA,aAAAA,IAAIQ,IAAI,qBAARR,WAAUe,gBAAgB,MAAK;IACxD,IAAI,CAACT,QAAQ,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAe;IACjE,IAAI,CAACP,cAAckB,IAAI,CAACP,QAAQ;QAC9B,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;IACA,IAAIO,SAASK,MAAM,GAAG,GAAG;QACvB,OAAOhB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,IAAI;YAoLQpB;YAzCFe;QA1IR,MAAMkB,YAAY5B,cAAc6B,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMiB,eAAe,MAAMH,QAAQI,GAAG;QACtC,IAAI,CAACD,aAAaE,MAAM,EAAE;YACxB,OAAOxB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,qEAAqE;QACrE,sEAAsE;QACtE,4DAA4D;QAC5D,kEAAkE;QAClE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,oCAAoC;QACpC,MAAMqB,aAAaN,QAAQC,UAAU,CAAC;QACtC,MAAMM,YAAYD,WAAWJ,GAAG;QAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BC,GACD,MAAMM,UAAU,MAAMV,UAAUW,cAAc,CAAC,OAAOC;YACpD,MAAMC,WAAW,MAAMD,GAAGN,GAAG,CAACE,WAAWM,KAAK,CAAC,SAAS,MAAMvB,OAAOwB,KAAK,CAAC;YAC3E,IAAI,CAACF,SAASG,KAAK,EAAE,OAAO;gBAAEC,WAAW;gBAAMC,SAAS;YAAE;YAC1D,MAAMC,OAAO,AAAC,CAAA,MAAMP,GAAGN,GAAG,CAACE,WAAWY,KAAK,GAAE,EAAGC,IAAI,GAAGD,KAAK;YAC5D,yEAAyE;YACzE,MAAME,UAAU1D,0BAA0BuD,MAAMjD;YAChD,IAAIoD,QAAQC,QAAQ,EAAE,OAAO;gBAAEN,WAAW;gBAAOC,SAASI,QAAQJ,OAAO;YAAC;YAC1EN,GAAGY,MAAM,CAACf,WAAW;gBACnBlB;eACII,cAAchC,uBAAuBgC,eAAe,CAAC;gBACzD8B,gBAAgBhD,mBAAmBiB;eAsB/BG,mBACA/B,8BAA8BsB,QAAQsC,KAAKC,GAAG,MAC9C,CAAC;gBACLC,WAAWxD,cAAc4B,SAAS,CAAC6B,UAAU,CAACC,eAAe;;YAE/D,OAAO;QACT;QACA,IAAIpB,2BAAAA,QAASO,SAAS,EAAE;YACtB,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;QACA,IAAIuB,SAAS;gBAgBK7C;YAfhB,kEAAkE;YAClE,gEAAgE;YAChE,MAAMQ,+BAA+B;gBACnC6B;gBACAd;gBACA2C,MAAM;gBACNb,SAASR,QAAQQ,OAAO;YAC1B;YACA,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,4DAA4D;YAC5D,MAAMc,WAAUnE,4BAAAA,WAAW,CAAC,eAAe,qBAA3BA,0BAA6BoE,OAAO,CAClD5B,aAAagB,IAAI;YAEnB,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAOlB;gBACP,sEAAsE;gBACtE,sDAAsD;gBACtDiE,MAAMlE;eACFgE,UAAU;gBAAEA;YAAQ,IAAI,CAAC;QAEjC;QACA,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE;;;;;;;;;;;KAWC,GACD,MAAMG,eAAeT,KAAKC,GAAG;QAC7B,MAAMS,gBAAgB,MAAM9D,qBAAqB;YAC/Cc;YACAiD,IAAI,GAAEvD,aAAAA,IAAIQ,IAAI,qBAARR,WAAUsD,aAAa;YAC7B7C;YACA+C,MAAMH;QACR;QACA,MAAMhE,YAAY;YAChB+B;YACAd;YACAmD,MAAM;gBACJhD;eAKII,cAAc;gBAAE6C,MAAM7C;YAAY,IAAI,CAAC;gBAC3C8C,QAAQ;eACJ5C,mBAAmB;gBAAEA,kBAAkB;YAAK,IAAI,CAAC;WAEnDuC,gBAAgB;YAAEM,OAAON;QAAc,IAAI,CAAC;QAElD,gCAAgC;QAChC,KAAK7D,mBAAmB;YACtBa;YACAG;YACAiD,MAAM7C,eAAegD;YACrBF,QAAQ;YACR,uEAAuE;YACvE,sEAAsE;YACtE,6DAA6D;YAC7DG,uBAAuB;YACvBC,aAAa;gBAAEC,OAAOrC,UAAUsC,EAAE;gBAAEC,SAAS;YAAqB;WAC9DnD,mBAAmB;YAAEA,kBAAkB;QAAK,IAAI,CAAC,GACjDuC,gBAAgB;YAAEA;QAAc,IAAI,CAAC;QAE3C,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM5D,cAAcY,QAAQ,gBAAgB;YAAEG;QAAM;QACpD,MAAMf,cAAcY,QAAQ,QAAQ;YAClCG;YACAkD,QAAQ;YACRQ,MAAM,GAAElF,aAAAA,UAAUwB,kBAAVxB,aAAoB;QAC9B;QACAY,gBAAgBI,KAAKK,QAAQV,kBAAkBU,QAAQqB,UAAUsC,EAAE;QACnE,OAAOhE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEgE,IAAI;QAAK;IACzC,EAAE,OAAO/D,OAAO;QACdgE,QAAQhE,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}

package/src/lib/server/membership-reset.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Password reset completion (AGL-552): verifies the recover token
+ * (signature + expiry + binding to the member's CURRENT password hash —
+ * so a completed reset invalidates every outstanding token) and writes the
+ * new scrypt hash. No session is minted here; the client signs in through
+ * the normal login route with the new password. Token guessing is a
+ * non-issue (256-bit HMAC), so no extra damper beyond login's.
+ */
+export declare const membershipResetHandler: PluginApiHandler;

package/src/lib/server/membership-reset.js

@@ -0,0 +1,88 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { MEMBER_SUSPENDED_ERROR, hashMemberPassword, passwordResetTokenMemberId, verifyPasswordResetToken } from "./membership.js";
+/**
+ * Password reset completion (AGL-552): verifies the recover token
+ * (signature + expiry + binding to the member's CURRENT password hash —
+ * so a completed reset invalidates every outstanding token) and writes the
+ * new scrypt hash. No session is minted here; the client signs in through
+ * the normal login route with the new password. Token guessing is a
+ * non-issue (256-bit HMAC), so no extra damper beyond login's.
+ */ export const membershipResetHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2;
+    var _req_body, _req_body1, _req_body2;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const token = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.token) != null ? _ref1 : '');
+    const password = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.password) != null ? _ref2 : '');
+    if (!hostId || !token) {
+        return res.status(400).json({
+            error: 'Invalid request'
+        });
+    }
+    if (password.length < 8) {
+        return res.status(400).json({
+            error: 'Password must be at least 8 characters'
+        });
+    }
+    const invalid = ()=>res.status(400).json({
+            error: 'That reset link is invalid or has expired — request a new one.'
+        });
+    // Structural pre-check only (host + expiry); the signature binds to the
+    // member's current hash, which we have to load first.
+    const memberId = passwordResetTokenMemberId(hostId, token);
+    if (!memberId) return invalid();
+    try {
+        const firestore = firebaseAdmin.app().firestore();
+        const memberRef = firestore.collection('hosts').doc(hostId).collection('siteMembers').doc(memberId);
+        const memberDoc = await memberRef.get();
+        if (!memberDoc.exists) return invalid();
+        if (!verifyPasswordResetToken(hostId, token, memberDoc.get('passwordScrypt'))) {
+            return invalid();
+        }
+        // Suspension gate (AGL-546/550): a token minted before the
+        // suspension stays cryptographically valid for its hour, so reject
+        // here — recovery must not rehabilitate a suspended account. Checked
+        // AFTER the signature so only the mailed-link holder (who already
+        // knows the account exists) can observe the suspension.
+        if (memberDoc.get('suspended') === true) {
+            return res.status(403).json({
+                error: MEMBER_SUSPENDED_ERROR
+            });
+        }
+        await memberRef.set({
+            passwordScrypt: hashMemberPassword(password),
+            passwordResetAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+        }, {
+            merge: true
+        });
+        return res.status(200).json({
+            ok: true
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Reset failed'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-reset.js.map

package/src/lib/server/membership-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-reset.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  MEMBER_SUSPENDED_ERROR,\n  hashMemberPassword,\n  passwordResetTokenMemberId,\n  verifyPasswordResetToken,\n} from './membership'\n\n/**\n * Password reset completion (AGL-552): verifies the recover token\n * (signature + expiry + binding to the member's CURRENT password hash —\n * so a completed reset invalidates every outstanding token) and writes the\n * new scrypt hash. No session is minted here; the client signs in through\n * the normal login route with the new password. Token guessing is a\n * non-issue (256-bit HMAC), so no extra damper beyond login's.\n */\nexport const membershipResetHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const token = String(req.body?.token ?? '')\n  const password = String(req.body?.password ?? '')\n  if (!hostId || !token) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  const invalid = () =>\n    res.status(400).json({\n      error: 'That reset link is invalid or has expired — request a new one.',\n    })\n  // Structural pre-check only (host + expiry); the signature binds to the\n  // member's current hash, which we have to load first.\n  const memberId = passwordResetTokenMemberId(hostId, token)\n  if (!memberId) return invalid()\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const memberRef = firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('siteMembers')\n      .doc(memberId)\n    const memberDoc = await memberRef.get()\n    if (!memberDoc.exists) return invalid()\n    if (\n      !verifyPasswordResetToken(hostId, token, memberDoc.get('passwordScrypt'))\n    ) {\n      return invalid()\n    }\n    // Suspension gate (AGL-546/550): a token minted before the\n    // suspension stays cryptographically valid for its hour, so reject\n    // here — recovery must not rehabilitate a suspended account. Checked\n    // AFTER the signature so only the mailed-link holder (who already\n    // knows the account exists) can observe the suspension.\n    if (memberDoc.get('suspended') === true) {\n      return res.status(403).json({ error: MEMBER_SUSPENDED_ERROR })\n    }\n    await memberRef.set(\n      {\n        passwordScrypt: hashMemberPassword(password),\n        passwordResetAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Reset failed' })\n  }\n}\n"],"names":["firebaseAdmin","MEMBER_SUSPENDED_ERROR","hashMemberPassword","passwordResetTokenMemberId","verifyPasswordResetToken","membershipResetHandler","req","res","method","status","json","error","hostId","String","body","token","password","length","invalid","memberId","firestore","app","memberRef","collection","doc","memberDoc","get","exists","set","passwordScrypt","passwordResetAt","FieldValue","serverTimestamp","merge","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SACEC,sBAAsB,EACtBC,kBAAkB,EAClBC,0BAA0B,EAC1BC,wBAAwB,QACnB,kBAAc;AAErB;;;;;;;CAOC,GACD,OAAO,MAAMC,yBAA2C,OAAOC,KAAKC;;QAI5CD,WACDA,YACGA;IALxB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI;IACxC,MAAMC,WAAWH,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUU,QAAQ,oBAAI;IAC9C,IAAI,CAACJ,UAAU,CAACG,OAAO;QACrB,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,IAAIK,SAASC,MAAM,GAAG,GAAG;QACvB,OAAOV,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,MAAMO,UAAU,IACdX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YACnBC,OAAO;QACT;IACF,wEAAwE;IACxE,sDAAsD;IACtD,MAAMQ,WAAWhB,2BAA2BS,QAAQG;IACpD,IAAI,CAACI,UAAU,OAAOD;IACtB,IAAI;QACF,MAAME,YAAYpB,cAAcqB,GAAG,GAAGD,SAAS;QAC/C,MAAME,YAAYF,UACfG,UAAU,CAAC,SACXC,GAAG,CAACZ,QACJW,UAAU,CAAC,eACXC,GAAG,CAACL;QACP,MAAMM,YAAY,MAAMH,UAAUI,GAAG;QACrC,IAAI,CAACD,UAAUE,MAAM,EAAE,OAAOT;QAC9B,IACE,CAACd,yBAAyBQ,QAAQG,OAAOU,UAAUC,GAAG,CAAC,oBACvD;YACA,OAAOR;QACT;QACA,2DAA2D;QAC3D,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,wDAAwD;QACxD,IAAIO,UAAUC,GAAG,CAAC,iBAAiB,MAAM;YACvC,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOV;YAAuB;QAC9D;QACA,MAAMqB,UAAUM,GAAG,CACjB;YACEC,gBAAgB3B,mBAAmBc;YACnCc,iBAAiB9B,cAAcoB,SAAS,CAACW,UAAU,CAACC,eAAe;QACrE,GACA;YAAEC,OAAO;QAAK;QAEhB,OAAO1B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEwB,IAAI;QAAK;IACzC,EAAE,OAAOvB,OAAO;QACdwB,QAAQxB,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAe;IACtD;AACF,EAAC"}

package/src/lib/server/membership-wishlist.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Member wishlist (AGL-297): product ids on the siteMembers doc.
+ * Guests keep theirs in localStorage; the wishlist block merges the
+ * local list into the member's on first signed-in read.
+ */
+export declare const membershipWishlistHandler: PluginApiHandler;

package/src/lib/server/membership-wishlist.js

@@ -0,0 +1,89 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { requireActiveMember } from "./membership.js";
+/**
+ * Member wishlist (AGL-297): product ids on the siteMembers doc.
+ * Guests keep theirs in localStorage; the wishlist block merges the
+ * local list into the member's on first signed-in read.
+ */ export const membershipWishlistHandler = async (req, res)=>{
+    var _ref;
+    var _req_body;
+    const isPost = req.method === 'POST';
+    if (!isPost && req.method !== 'GET') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = isPost ? (_req_body = req.body) == null ? void 0 : _req_body.hostId : req.query.hostId) != null ? _ref : '');
+    if (!hostId) return res.status(400).json({
+        error: 'Missing hostId'
+    });
+    try {
+        var _auth_member_get;
+        // Suspension gate (AGL-550): loads the member doc too, so a
+        // suspended member's cookie (AGL-546) is 403'd and cleared here.
+        const auth = await requireActiveMember(req, res, hostId);
+        if (!auth) return;
+        const memberRef = firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection('siteMembers').doc(auth.memberId);
+        let wishlist = (_auth_member_get = auth.member.get('wishlist')) != null ? _auth_member_get : [];
+        if (isPost) {
+            var _ref1;
+            var _req_body1;
+            const action = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.action) != null ? _ref1 : 'add');
+            if (action === 'merge') {
+                var _req_body2;
+                const incoming = Array.isArray((_req_body2 = req.body) == null ? void 0 : _req_body2.productIds) ? req.body.productIds.map(String).slice(0, 100) : [];
+                wishlist = [
+                    ...new Set([
+                        ...wishlist,
+                        ...incoming
+                    ])
+                ].slice(0, 200);
+            } else {
+                var _ref2;
+                var _req_body3;
+                const productId = String((_ref2 = (_req_body3 = req.body) == null ? void 0 : _req_body3.productId) != null ? _ref2 : '');
+                if (!productId) {
+                    return res.status(400).json({
+                        error: 'Missing productId'
+                    });
+                }
+                wishlist = action === 'remove' ? wishlist.filter((id)=>id !== productId) : [
+                    ...new Set([
+                        ...wishlist,
+                        productId
+                    ])
+                ].slice(0, 200);
+            }
+            await memberRef.set({
+                wishlist
+            }, {
+                merge: true
+            });
+        }
+        return res.status(200).json({
+            productIds: wishlist
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Wishlist unavailable'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-wishlist.js.map

package/src/lib/server/membership-wishlist.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-wishlist.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { requireActiveMember } from './membership'\n\n/**\n * Member wishlist (AGL-297): product ids on the siteMembers doc.\n * Guests keep theirs in localStorage; the wishlist block merges the\n * local list into the member's on first signed-in read.\n */\nexport const membershipWishlistHandler: PluginApiHandler = async (req, res) => {\n  const isPost = req.method === 'POST'\n  if (!isPost && req.method !== 'GET') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(\n    (isPost ? req.body?.hostId : req.query.hostId) ?? '',\n  )\n  if (!hostId) return res.status(400).json({ error: 'Missing hostId' })\n\n  try {\n    // Suspension gate (AGL-550): loads the member doc too, so a\n    // suspended member's cookie (AGL-546) is 403'd and cleared here.\n    const auth = await requireActiveMember(req, res, hostId)\n    if (!auth) return\n    const memberRef = firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('siteMembers')\n      .doc(auth.memberId)\n    let wishlist: string[] = (auth.member.get('wishlist') ?? []) as string[]\n\n    if (isPost) {\n      const action = String(req.body?.action ?? 'add')\n      if (action === 'merge') {\n        const incoming = Array.isArray(req.body?.productIds)\n          ? (req.body.productIds as string[]).map(String).slice(0, 100)\n          : []\n        wishlist = [...new Set([...wishlist, ...incoming])].slice(0, 200)\n      } else {\n        const productId = String(req.body?.productId ?? '')\n        if (!productId) {\n          return res.status(400).json({ error: 'Missing productId' })\n        }\n        wishlist =\n          action === 'remove'\n            ? wishlist.filter((id) => id !== productId)\n            : [...new Set([...wishlist, productId])].slice(0, 200)\n      }\n      await memberRef.set({ wishlist }, { merge: true })\n    }\n    return res.status(200).json({ productIds: wishlist })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Wishlist unavailable' })\n  }\n}\n"],"names":["firebaseAdmin","requireActiveMember","membershipWishlistHandler","req","res","isPost","method","status","json","error","hostId","String","body","query","auth","memberRef","app","firestore","collection","doc","memberId","wishlist","member","get","action","incoming","Array","isArray","productIds","map","slice","Set","productId","filter","id","set","merge","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,mBAAmB,QAAQ,kBAAc;AAElD;;;;CAIC,GACD,OAAO,MAAMC,4BAA8C,OAAOC,KAAKC;QAMlEC;QAASF;IALZ,MAAME,SAASF,IAAIG,MAAM,KAAK;IAC9B,IAAI,CAACD,UAAUF,IAAIG,MAAM,KAAK,OAAO;QACnC,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,QACZN,OAAAA,UAASF,YAAAA,IAAIS,IAAI,qBAART,UAAUO,MAAM,GAAGP,IAAIU,KAAK,CAACH,MAAM,YAA5CL,OAAiD;IAEpD,IAAI,CAACK,QAAQ,OAAON,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAiB;IAEnE,IAAI;YAYwBK;QAX1B,4DAA4D;QAC5D,iEAAiE;QACjE,MAAMA,OAAO,MAAMb,oBAAoBE,KAAKC,KAAKM;QACjD,IAAI,CAACI,MAAM;QACX,MAAMC,YAAYf,cACfgB,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACT,QACJQ,UAAU,CAAC,eACXC,GAAG,CAACL,KAAKM,QAAQ;QACpB,IAAIC,YAAsBP,mBAAAA,KAAKQ,MAAM,CAACC,GAAG,CAAC,uBAAhBT,mBAA+B,EAAE;QAE3D,IAAIT,QAAQ;;gBACYF;YAAtB,MAAMqB,SAASb,iBAAOR,aAAAA,IAAIS,IAAI,qBAART,WAAUqB,MAAM,oBAAI;YAC1C,IAAIA,WAAW,SAAS;oBACSrB;gBAA/B,MAAMsB,WAAWC,MAAMC,OAAO,EAACxB,aAAAA,IAAIS,IAAI,qBAART,WAAUyB,UAAU,IAC/C,AAACzB,IAAIS,IAAI,CAACgB,UAAU,CAAcC,GAAG,CAAClB,QAAQmB,KAAK,CAAC,GAAG,OACvD,EAAE;gBACNT,WAAW;uBAAI,IAAIU,IAAI;2BAAIV;2BAAaI;qBAAS;iBAAE,CAACK,KAAK,CAAC,GAAG;YAC/D,OAAO;;oBACoB3B;gBAAzB,MAAM6B,YAAYrB,iBAAOR,aAAAA,IAAIS,IAAI,qBAART,WAAU6B,SAAS,oBAAI;gBAChD,IAAI,CAACA,WAAW;oBACd,OAAO5B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;wBAAEC,OAAO;oBAAoB;gBAC3D;gBACAY,WACEG,WAAW,WACPH,SAASY,MAAM,CAAC,CAACC,KAAOA,OAAOF,aAC/B;uBAAI,IAAID,IAAI;2BAAIV;wBAAUW;qBAAU;iBAAE,CAACF,KAAK,CAAC,GAAG;YACxD;YACA,MAAMf,UAAUoB,GAAG,CAAC;gBAAEd;YAAS,GAAG;gBAAEe,OAAO;YAAK;QAClD;QACA,OAAOhC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEoB,YAAYP;QAAS;IACrD,EAAE,OAAOZ,OAAO;QACd4B,QAAQ5B,KAAK,CAACA;QACd,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAuB;IAC9D;AACF,EAAC"}

package/src/lib/server/membership.d.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiRequest, PluginApiResponse } from '@aglyn/aglyn/server';
+export declare function hashMemberPassword(password: string): string;
+export declare function verifyMemberPassword(password: string, stored: string | undefined): boolean;
+export declare function mintMemberSession(hostId: string, memberId: string): string;
+/**
+ * Verified session contents. `issuedAtMs` is derived, not stored: the
+ * payload carries `now + TTL`, so subtracting the TTL recovers the mint
+ * time. That is what lets sessions be revoked in bulk (AGL-914) without
+ * changing the token format or invalidating cookies already in the wild.
+ */
+export interface MemberSessionToken {
+    memberId: string;
+    issuedAtMs: number;
+}
+/** Returns the session contents when the cookie verifies for this host. */
+export declare function parseMemberSession(hostId: string, token: string | undefined): MemberSessionToken | null;
+/** Returns the memberId when the cookie verifies for this host. */
+export declare function verifyMemberSession(hostId: string, token: string | undefined): string | null;
+/**
+ * Single-use, time-boxed password-reset token (AGL-552):
+ * `hostId.memberId.expiry.HMAC(payload + password-fingerprint)`. Same
+ * secret as sessions; the fingerprint binding is what makes it one-shot.
+ */
+export declare function mintPasswordResetToken(hostId: string, memberId: string, passwordScrypt: string | undefined): string;
+/**
+ * First step of reset verification: extract the memberId from a
+ * well-formed, unexpired token for THIS host. The signature is NOT checked
+ * here (it binds to the member's current password hash, which the caller
+ * has to load first) — never trust the result without a follow-up
+ * {@link verifyPasswordResetToken}.
+ */
+export declare function passwordResetTokenMemberId(hostId: string, token: string | undefined): string | null;
+/** Full reset-token check: host, expiry, and password-hash binding. */
+export declare function verifyPasswordResetToken(hostId: string, token: string | undefined, currentPasswordScrypt: string | undefined): boolean;
+export declare function memberCookieName(hostId: string): string;
+export declare function setMemberCookie(res: PluginApiResponse, hostId: string, token: string | null): void;
+export declare function readMemberSession(req: PluginApiRequest, hostId: string): string | null;
+/**
+ * Field name for the bulk session cut-off (AGL-914). Set to `Date.now()`
+ * whenever every existing session for a member must stop working — today
+ * only when an admin sets their password from the console, since a rewritten
+ * `passwordScrypt` does NOT invalidate sessions on its own (unlike a reset
+ * TOKEN, which binds to the hash by design).
+ */
+export declare const MEMBER_SESSIONS_VALID_FROM_FIELD = "sessionsValidFromMs";
+/** Suspension rejection body — matches the login flow's AGL-546 message. */
+export declare const MEMBER_SUSPENDED_ERROR = "This account has been suspended. Contact the site owner.";
+/** Resolved member-session state, see {@link readActiveMemberSession}. */
+export type MemberSessionCheck = {
+    status: 'anonymous';
+} | {
+    status: 'suspended';
+    memberId: string;
+} | {
+    status: 'active';
+    memberId: string;
+    member: FirebaseFirestore.DocumentSnapshot;
+};
+/**
+ * Session + member-doc resolution for cookie-authenticated endpoints
+ * (AGL-550). A verified cookie alone stopped being enough once console
+ * suspension (AGL-546) landed: the HMAC session outlives the member's
+ * standing, so every endpoint must also load the doc and check
+ * `suspended`. That is one doc read per request — acceptable, and most
+ * endpoints needed the member doc anyway. A deleted member doc reads as
+ * `anonymous` (same as no cookie).
+ */
+export declare function readActiveMemberSession(req: PluginApiRequest, hostId: string): Promise<MemberSessionCheck>;
+/**
+ * Guard for cookie-authenticated member endpoints (AGL-550): resolves
+ * the session AND the member doc, writing the rejection itself — 401
+ * (`signInError`) when there is no usable session, 403 with the session
+ * cookie cleared (mirroring membership-account's AGL-546 handling, so
+ * the site stops presenting a signed-in shell) when the member is
+ * suspended. Returns null after responding; handlers `if (!auth) return`.
+ */
+export declare function requireActiveMember(req: PluginApiRequest, res: PluginApiResponse, hostId: string, signInError?: string): Promise<{
+    memberId: string;
+    member: FirebaseFirestore.DocumentSnapshot;
+} | null>;