@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/membership.js

@@ -0,0 +1,222 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { createHash, createHmac, randomBytes, scryptSync, timingSafeEqual } from "crypto";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+/**
+ * Site membership primitives (AGL-109): visitor accounts per host with
+ * scrypt-hashed passwords and an HMAC-signed httpOnly session cookie.
+ * Per-site Firebase Auth is a future infra decision (AGL-45 class); this
+ * keeps member content out of static HTML the same way AGL-87 does.
+ */ const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+// A per-boot fallback keeps dev working; production must set the env so
+// sessions survive deploys and instances agree.
+//
+// `||`, NOT `??`, and on a self-host install that is the whole difference
+// (AGL-2014). `.env.selfhost.example` ships `MEMBER_SESSION_SECRET=` blank and
+// compose `env_file` sets a blank line as the EMPTY STRING rather than leaving
+// it unset — so `??` did not fire, `SESSION_SECRET` was `''`, and `createHmac`
+// signs happily with an empty key. Every storefront member session cookie on a
+// template-following deployment was therefore signed with a key any reader of
+// this repository already has, i.e. forgeable. `||` restores the per-boot
+// random the comment above describes and the env template already promises
+// ("without it, sessions don't survive a restart and disagree across
+// instances") — unforgeable, and visibly degraded rather than silently open.
+//
+// Nothing caught it because `tools/scripts/selfhost-ci-env.mjs` FILLS this
+// variable before the image build, so the one job that builds these images
+// tests a configuration no operator following the template has.
+const SESSION_SECRET = process.env.MEMBER_SESSION_SECRET || randomBytes(32).toString('hex');
+export function hashMemberPassword(password) {
+    const salt = randomBytes(16).toString('hex');
+    const hash = scryptSync(password, salt, 64).toString('hex');
+    return `${salt}:${hash}`;
+}
+export function verifyMemberPassword(password, stored) {
+    const [salt, hash] = String(stored != null ? stored : '').split(':');
+    if (!salt || !hash) return false;
+    const candidate = scryptSync(password, salt, 64);
+    const expected = Buffer.from(hash, 'hex');
+    return candidate.length === expected.length && timingSafeEqual(new Uint8Array(candidate), new Uint8Array(expected));
+}
+function sign(payload) {
+    return createHmac('sha256', SESSION_SECRET).update(payload).digest('hex');
+}
+export function mintMemberSession(hostId, memberId) {
+    const payload = `${hostId}.${memberId}.${Date.now() + SESSION_TTL_MS}`;
+    return `${payload}.${sign(payload)}`;
+}
+/** Returns the session contents when the cookie verifies for this host. */ export function parseMemberSession(hostId, token) {
+    const parts = String(token != null ? token : '').split('.');
+    if (parts.length !== 4) return null;
+    const [tokenHost, memberId, expires, signature] = parts;
+    if (tokenHost !== hostId) return null;
+    if (Number(expires) < Date.now()) return null;
+    const payload = `${tokenHost}.${memberId}.${expires}`;
+    const expected = sign(payload);
+    const a = Buffer.from(signature);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length) return null;
+    if (!timingSafeEqual(new Uint8Array(a), new Uint8Array(b))) return null;
+    return {
+        memberId,
+        issuedAtMs: Number(expires) - SESSION_TTL_MS
+    };
+}
+/** Returns the memberId when the cookie verifies for this host. */ export function verifyMemberSession(hostId, token) {
+    var _ref;
+    var _parseMemberSession;
+    return (_ref = (_parseMemberSession = parseMemberSession(hostId, token)) == null ? void 0 : _parseMemberSession.memberId) != null ? _ref : null;
+}
+/** Password-reset links live for one hour (AGL-552). */ const RESET_TOKEN_TTL_MS = 60 * 60 * 1000;
+/**
+ * Fingerprint of the member's CURRENT scrypt hash, folded into the reset
+ * token signature (AGL-552): completing a reset rewrites `passwordScrypt`,
+ * so every token minted before it stops verifying — single-use without any
+ * server-side token storage.
+ */ function passwordFingerprint(passwordScrypt) {
+    return createHash('sha256').update(String(passwordScrypt != null ? passwordScrypt : '')).digest('hex');
+}
+/**
+ * Single-use, time-boxed password-reset token (AGL-552):
+ * `hostId.memberId.expiry.HMAC(payload + password-fingerprint)`. Same
+ * secret as sessions; the fingerprint binding is what makes it one-shot.
+ */ export function mintPasswordResetToken(hostId, memberId, passwordScrypt) {
+    const payload = `${hostId}.${memberId}.${Date.now() + RESET_TOKEN_TTL_MS}`;
+    return `${payload}.${sign(`${payload}.${passwordFingerprint(passwordScrypt)}`)}`;
+}
+/**
+ * First step of reset verification: extract the memberId from a
+ * well-formed, unexpired token for THIS host. The signature is NOT checked
+ * here (it binds to the member's current password hash, which the caller
+ * has to load first) — never trust the result without a follow-up
+ * {@link verifyPasswordResetToken}.
+ */ export function passwordResetTokenMemberId(hostId, token) {
+    const parts = String(token != null ? token : '').split('.');
+    if (parts.length !== 4) return null;
+    const [tokenHost, memberId, expires] = parts;
+    if (tokenHost !== hostId) return null;
+    if (!memberId) return null;
+    if (Number(expires) < Date.now()) return null;
+    return memberId;
+}
+/** Full reset-token check: host, expiry, and password-hash binding. */ export function verifyPasswordResetToken(hostId, token, currentPasswordScrypt) {
+    const parts = String(token != null ? token : '').split('.');
+    if (parts.length !== 4) return false;
+    const [tokenHost, memberId, expires, signature] = parts;
+    if (tokenHost !== hostId || !memberId) return false;
+    if (Number(expires) < Date.now()) return false;
+    const payload = `${tokenHost}.${memberId}.${expires}`;
+    const expected = sign(`${payload}.${passwordFingerprint(currentPasswordScrypt)}`);
+    const a = Buffer.from(signature);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length) return false;
+    return timingSafeEqual(new Uint8Array(a), new Uint8Array(b));
+}
+export function memberCookieName(hostId) {
+    return `aglyn_member_${hostId.replace(/[^A-Za-z0-9_-]/g, '')}`;
+}
+export function setMemberCookie(res, hostId, token) {
+    const name = memberCookieName(hostId);
+    // Secure in production (AGL-500): the member session is an HMAC-signed
+    // credential, so it must never travel over plaintext HTTP on a tenant
+    // custom domain. Omit only in local dev (http://localhost), matching the
+    // console __session cookie.
+    const secure = process.env.NODE_ENV === 'production' ? '; Secure' : '';
+    const base = `${name}=${token != null ? token : ''}; Path=/; HttpOnly; SameSite=Lax${secure}`;
+    res.setHeader('Set-Cookie', token ? `${base}; Max-Age=${30 * 24 * 60 * 60}` : `${base}; Max-Age=0`);
+}
+export function readMemberSession(req, hostId) {
+    var _req_cookies;
+    const raw = (_req_cookies = req.cookies) == null ? void 0 : _req_cookies[memberCookieName(hostId)];
+    return verifyMemberSession(hostId, raw);
+}
+/**
+ * Field name for the bulk session cut-off (AGL-914). Set to `Date.now()`
+ * whenever every existing session for a member must stop working — today
+ * only when an admin sets their password from the console, since a rewritten
+ * `passwordScrypt` does NOT invalidate sessions on its own (unlike a reset
+ * TOKEN, which binds to the hash by design).
+ */ export const MEMBER_SESSIONS_VALID_FROM_FIELD = 'sessionsValidFromMs';
+/** Suspension rejection body — matches the login flow's AGL-546 message. */ export const MEMBER_SUSPENDED_ERROR = 'This account has been suspended. Contact the site owner.';
+/**
+ * Session + member-doc resolution for cookie-authenticated endpoints
+ * (AGL-550). A verified cookie alone stopped being enough once console
+ * suspension (AGL-546) landed: the HMAC session outlives the member's
+ * standing, so every endpoint must also load the doc and check
+ * `suspended`. That is one doc read per request — acceptable, and most
+ * endpoints needed the member doc anyway. A deleted member doc reads as
+ * `anonymous` (same as no cookie).
+ */ export async function readActiveMemberSession(req, hostId) {
+    var _member_get;
+    var _req_cookies;
+    const session = parseMemberSession(hostId, (_req_cookies = req.cookies) == null ? void 0 : _req_cookies[memberCookieName(hostId)]);
+    if (!session) return {
+        status: 'anonymous'
+    };
+    const { memberId, issuedAtMs } = session;
+    const member = await firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection('siteMembers').doc(memberId).get();
+    if (!member.exists) return {
+        status: 'anonymous'
+    };
+    // Revoked in bulk (AGL-914): a session minted before the cut-off is dead
+    // even though its signature is still good. Reads as `anonymous` rather
+    // than `suspended` — the account is fine, this browser just holds a stale
+    // cookie, and signing in again is the correct next step.
+    const validFrom = Number((_member_get = member.get(MEMBER_SESSIONS_VALID_FROM_FIELD)) != null ? _member_get : 0);
+    if (validFrom && issuedAtMs < validFrom) return {
+        status: 'anonymous'
+    };
+    if (member.get('suspended') === true) {
+        return {
+            status: 'suspended',
+            memberId
+        };
+    }
+    return {
+        status: 'active',
+        memberId,
+        member
+    };
+}
+/**
+ * Guard for cookie-authenticated member endpoints (AGL-550): resolves
+ * the session AND the member doc, writing the rejection itself — 401
+ * (`signInError`) when there is no usable session, 403 with the session
+ * cookie cleared (mirroring membership-account's AGL-546 handling, so
+ * the site stops presenting a signed-in shell) when the member is
+ * suspended. Returns null after responding; handlers `if (!auth) return`.
+ */ export async function requireActiveMember(req, res, hostId, signInError = 'Not signed in') {
+    const session = await readActiveMemberSession(req, hostId);
+    if (session.status === 'suspended') {
+        setMemberCookie(res, hostId, null);
+        res.status(403).json({
+            error: MEMBER_SUSPENDED_ERROR
+        });
+        return null;
+    }
+    if (session.status !== 'active') {
+        res.status(401).json({
+            error: signInError
+        });
+        return null;
+    }
+    return {
+        memberId: session.memberId,
+        member: session.member
+    };
+}
+
+//# sourceMappingURL=membership.js.map

package/src/lib/server/membership.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createHash,\n  createHmac,\n  randomBytes,\n  scryptSync,\n  timingSafeEqual,\n} from 'crypto'\nimport type { PluginApiRequest, PluginApiResponse } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\n\n/**\n * Site membership primitives (AGL-109): visitor accounts per host with\n * scrypt-hashed passwords and an HMAC-signed httpOnly session cookie.\n * Per-site Firebase Auth is a future infra decision (AGL-45 class); this\n * keeps member content out of static HTML the same way AGL-87 does.\n */\n\nconst SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000\n\n// A per-boot fallback keeps dev working; production must set the env so\n// sessions survive deploys and instances agree.\n//\n// `||`, NOT `??`, and on a self-host install that is the whole difference\n// (AGL-2014). `.env.selfhost.example` ships `MEMBER_SESSION_SECRET=` blank and\n// compose `env_file` sets a blank line as the EMPTY STRING rather than leaving\n// it unset — so `??` did not fire, `SESSION_SECRET` was `''`, and `createHmac`\n// signs happily with an empty key. Every storefront member session cookie on a\n// template-following deployment was therefore signed with a key any reader of\n// this repository already has, i.e. forgeable. `||` restores the per-boot\n// random the comment above describes and the env template already promises\n// (\"without it, sessions don't survive a restart and disagree across\n// instances\") — unforgeable, and visibly degraded rather than silently open.\n//\n// Nothing caught it because `tools/scripts/selfhost-ci-env.mjs` FILLS this\n// variable before the image build, so the one job that builds these images\n// tests a configuration no operator following the template has.\nconst SESSION_SECRET =\n  process.env.MEMBER_SESSION_SECRET || randomBytes(32).toString('hex')\n\nexport function hashMemberPassword(password: string): string {\n  const salt = randomBytes(16).toString('hex')\n  const hash = scryptSync(password, salt, 64).toString('hex')\n  return `${salt}:${hash}`\n}\n\nexport function verifyMemberPassword(\n  password: string,\n  stored: string | undefined,\n): boolean {\n  const [salt, hash] = String(stored ?? '').split(':')\n  if (!salt || !hash) return false\n  const candidate = scryptSync(password, salt, 64)\n  const expected = Buffer.from(hash, 'hex')\n  return (\n    candidate.length === expected.length &&\n    timingSafeEqual(new Uint8Array(candidate), new Uint8Array(expected))\n  )\n}\n\nfunction sign(payload: string): string {\n  return createHmac('sha256', SESSION_SECRET).update(payload).digest('hex')\n}\n\nexport function mintMemberSession(hostId: string, memberId: string): string {\n  const payload = `${hostId}.${memberId}.${Date.now() + SESSION_TTL_MS}`\n  return `${payload}.${sign(payload)}`\n}\n\n/**\n * Verified session contents. `issuedAtMs` is derived, not stored: the\n * payload carries `now + TTL`, so subtracting the TTL recovers the mint\n * time. That is what lets sessions be revoked in bulk (AGL-914) without\n * changing the token format or invalidating cookies already in the wild.\n */\nexport interface MemberSessionToken {\n  memberId: string\n  issuedAtMs: number\n}\n\n/** Returns the session contents when the cookie verifies for this host. */\nexport function parseMemberSession(\n  hostId: string,\n  token: string | undefined,\n): MemberSessionToken | null {\n  const parts = String(token ?? '').split('.')\n  if (parts.length !== 4) return null\n  const [tokenHost, memberId, expires, signature] = parts\n  if (tokenHost !== hostId) return null\n  if (Number(expires) < Date.now()) return null\n  const payload = `${tokenHost}.${memberId}.${expires}`\n  const expected = sign(payload)\n  const a = Buffer.from(signature)\n  const b = Buffer.from(expected)\n  if (a.length !== b.length) return null\n  if (!timingSafeEqual(new Uint8Array(a), new Uint8Array(b))) return null\n  return { memberId, issuedAtMs: Number(expires) - SESSION_TTL_MS }\n}\n\n/** Returns the memberId when the cookie verifies for this host. */\nexport function verifyMemberSession(\n  hostId: string,\n  token: string | undefined,\n): string | null {\n  return parseMemberSession(hostId, token)?.memberId ?? null\n}\n\n/** Password-reset links live for one hour (AGL-552). */\nconst RESET_TOKEN_TTL_MS = 60 * 60 * 1000\n\n/**\n * Fingerprint of the member's CURRENT scrypt hash, folded into the reset\n * token signature (AGL-552): completing a reset rewrites `passwordScrypt`,\n * so every token minted before it stops verifying — single-use without any\n * server-side token storage.\n */\nfunction passwordFingerprint(passwordScrypt: string | undefined): string {\n  return createHash('sha256')\n    .update(String(passwordScrypt ?? ''))\n    .digest('hex')\n}\n\n/**\n * Single-use, time-boxed password-reset token (AGL-552):\n * `hostId.memberId.expiry.HMAC(payload + password-fingerprint)`. Same\n * secret as sessions; the fingerprint binding is what makes it one-shot.\n */\nexport function mintPasswordResetToken(\n  hostId: string,\n  memberId: string,\n  passwordScrypt: string | undefined,\n): string {\n  const payload = `${hostId}.${memberId}.${Date.now() + RESET_TOKEN_TTL_MS}`\n  return `${payload}.${sign(\n    `${payload}.${passwordFingerprint(passwordScrypt)}`,\n  )}`\n}\n\n/**\n * First step of reset verification: extract the memberId from a\n * well-formed, unexpired token for THIS host. The signature is NOT checked\n * here (it binds to the member's current password hash, which the caller\n * has to load first) — never trust the result without a follow-up\n * {@link verifyPasswordResetToken}.\n */\nexport function passwordResetTokenMemberId(\n  hostId: string,\n  token: string | undefined,\n): string | null {\n  const parts = String(token ?? '').split('.')\n  if (parts.length !== 4) return null\n  const [tokenHost, memberId, expires] = parts\n  if (tokenHost !== hostId) return null\n  if (!memberId) return null\n  if (Number(expires) < Date.now()) return null\n  return memberId\n}\n\n/** Full reset-token check: host, expiry, and password-hash binding. */\nexport function verifyPasswordResetToken(\n  hostId: string,\n  token: string | undefined,\n  currentPasswordScrypt: string | undefined,\n): boolean {\n  const parts = String(token ?? '').split('.')\n  if (parts.length !== 4) return false\n  const [tokenHost, memberId, expires, signature] = parts\n  if (tokenHost !== hostId || !memberId) return false\n  if (Number(expires) < Date.now()) return false\n  const payload = `${tokenHost}.${memberId}.${expires}`\n  const expected = sign(\n    `${payload}.${passwordFingerprint(currentPasswordScrypt)}`,\n  )\n  const a = Buffer.from(signature)\n  const b = Buffer.from(expected)\n  if (a.length !== b.length) return false\n  return timingSafeEqual(new Uint8Array(a), new Uint8Array(b))\n}\n\nexport function memberCookieName(hostId: string): string {\n  return `aglyn_member_${hostId.replace(/[^A-Za-z0-9_-]/g, '')}`\n}\n\nexport function setMemberCookie(\n  res: PluginApiResponse,\n  hostId: string,\n  token: string | null,\n): void {\n  const name = memberCookieName(hostId)\n  // Secure in production (AGL-500): the member session is an HMAC-signed\n  // credential, so it must never travel over plaintext HTTP on a tenant\n  // custom domain. Omit only in local dev (http://localhost), matching the\n  // console __session cookie.\n  const secure = process.env.NODE_ENV === 'production' ? '; Secure' : ''\n  const base = `${name}=${token ?? ''}; Path=/; HttpOnly; SameSite=Lax${secure}`\n  res.setHeader(\n    'Set-Cookie',\n    token ? `${base}; Max-Age=${30 * 24 * 60 * 60}` : `${base}; Max-Age=0`,\n  )\n}\n\nexport function readMemberSession(\n  req: PluginApiRequest,\n  hostId: string,\n): string | null {\n  const raw = req.cookies?.[memberCookieName(hostId)]\n  return verifyMemberSession(hostId, raw)\n}\n\n/**\n * Field name for the bulk session cut-off (AGL-914). Set to `Date.now()`\n * whenever every existing session for a member must stop working — today\n * only when an admin sets their password from the console, since a rewritten\n * `passwordScrypt` does NOT invalidate sessions on its own (unlike a reset\n * TOKEN, which binds to the hash by design).\n */\nexport const MEMBER_SESSIONS_VALID_FROM_FIELD = 'sessionsValidFromMs'\n\n/** Suspension rejection body — matches the login flow's AGL-546 message. */\nexport const MEMBER_SUSPENDED_ERROR =\n  'This account has been suspended. Contact the site owner.'\n\n/** Resolved member-session state, see {@link readActiveMemberSession}. */\nexport type MemberSessionCheck =\n  | { status: 'anonymous' }\n  | { status: 'suspended'; memberId: string }\n  | {\n      status: 'active'\n      memberId: string\n      member: FirebaseFirestore.DocumentSnapshot\n    }\n\n/**\n * Session + member-doc resolution for cookie-authenticated endpoints\n * (AGL-550). A verified cookie alone stopped being enough once console\n * suspension (AGL-546) landed: the HMAC session outlives the member's\n * standing, so every endpoint must also load the doc and check\n * `suspended`. That is one doc read per request — acceptable, and most\n * endpoints needed the member doc anyway. A deleted member doc reads as\n * `anonymous` (same as no cookie).\n */\nexport async function readActiveMemberSession(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<MemberSessionCheck> {\n  const session = parseMemberSession(\n    hostId,\n    req.cookies?.[memberCookieName(hostId)],\n  )\n  if (!session) return { status: 'anonymous' }\n  const { memberId, issuedAtMs } = session\n  const member = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection('siteMembers')\n    .doc(memberId)\n    .get()\n  if (!member.exists) return { status: 'anonymous' }\n  // Revoked in bulk (AGL-914): a session minted before the cut-off is dead\n  // even though its signature is still good. Reads as `anonymous` rather\n  // than `suspended` — the account is fine, this browser just holds a stale\n  // cookie, and signing in again is the correct next step.\n  const validFrom = Number(member.get(MEMBER_SESSIONS_VALID_FROM_FIELD) ?? 0)\n  if (validFrom && issuedAtMs < validFrom) return { status: 'anonymous' }\n  if (member.get('suspended') === true) {\n    return { status: 'suspended', memberId }\n  }\n  return { status: 'active', memberId, member }\n}\n\n/**\n * Guard for cookie-authenticated member endpoints (AGL-550): resolves\n * the session AND the member doc, writing the rejection itself — 401\n * (`signInError`) when there is no usable session, 403 with the session\n * cookie cleared (mirroring membership-account's AGL-546 handling, so\n * the site stops presenting a signed-in shell) when the member is\n * suspended. Returns null after responding; handlers `if (!auth) return`.\n */\nexport async function requireActiveMember(\n  req: PluginApiRequest,\n  res: PluginApiResponse,\n  hostId: string,\n  signInError = 'Not signed in',\n): Promise<{\n  memberId: string\n  member: FirebaseFirestore.DocumentSnapshot\n} | null> {\n  const session = await readActiveMemberSession(req, hostId)\n  if (session.status === 'suspended') {\n    setMemberCookie(res, hostId, null)\n    res.status(403).json({ error: MEMBER_SUSPENDED_ERROR })\n    return null\n  }\n  if (session.status !== 'active') {\n    res.status(401).json({ error: signInError })\n    return null\n  }\n  return { memberId: session.memberId, member: session.member }\n}\n"],"names":["createHash","createHmac","randomBytes","scryptSync","timingSafeEqual","firebaseAdmin","SESSION_TTL_MS","SESSION_SECRET","process","env","MEMBER_SESSION_SECRET","toString","hashMemberPassword","password","salt","hash","verifyMemberPassword","stored","String","split","candidate","expected","Buffer","from","length","Uint8Array","sign","payload","update","digest","mintMemberSession","hostId","memberId","Date","now","parseMemberSession","token","parts","tokenHost","expires","signature","Number","a","b","issuedAtMs","verifyMemberSession","RESET_TOKEN_TTL_MS","passwordFingerprint","passwordScrypt","mintPasswordResetToken","passwordResetTokenMemberId","verifyPasswordResetToken","currentPasswordScrypt","memberCookieName","replace","setMemberCookie","res","name","secure","NODE_ENV","base","setHeader","readMemberSession","req","raw","cookies","MEMBER_SESSIONS_VALID_FROM_FIELD","MEMBER_SUSPENDED_ERROR","readActiveMemberSession","member","session","status","app","firestore","collection","doc","get","exists","validFrom","requireActiveMember","signInError","json","error"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,UAAU,EACVC,UAAU,EACVC,WAAW,EACXC,UAAU,EACVC,eAAe,QACV,SAAQ;AAEf,SAASC,aAAa,QAAQ,2BAA0B;AAExD;;;;;CAKC,GAED,MAAMC,iBAAiB,KAAK,KAAK,KAAK,KAAK;AAE3C,wEAAwE;AACxE,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,qEAAqE;AACrE,6EAA6E;AAC7E,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,gEAAgE;AAChE,MAAMC,iBACJC,QAAQC,GAAG,CAACC,qBAAqB,IAAIR,YAAY,IAAIS,QAAQ,CAAC;AAEhE,OAAO,SAASC,mBAAmBC,QAAgB;IACjD,MAAMC,OAAOZ,YAAY,IAAIS,QAAQ,CAAC;IACtC,MAAMI,OAAOZ,WAAWU,UAAUC,MAAM,IAAIH,QAAQ,CAAC;IACrD,OAAO,GAAGG,KAAK,CAAC,EAAEC,MAAM;AAC1B;AAEA,OAAO,SAASC,qBACdH,QAAgB,EAChBI,MAA0B;IAE1B,MAAM,CAACH,MAAMC,KAAK,GAAGG,OAAOD,iBAAAA,SAAU,IAAIE,KAAK,CAAC;IAChD,IAAI,CAACL,QAAQ,CAACC,MAAM,OAAO;IAC3B,MAAMK,YAAYjB,WAAWU,UAAUC,MAAM;IAC7C,MAAMO,WAAWC,OAAOC,IAAI,CAACR,MAAM;IACnC,OACEK,UAAUI,MAAM,KAAKH,SAASG,MAAM,IACpCpB,gBAAgB,IAAIqB,WAAWL,YAAY,IAAIK,WAAWJ;AAE9D;AAEA,SAASK,KAAKC,OAAe;IAC3B,OAAO1B,WAAW,UAAUM,gBAAgBqB,MAAM,CAACD,SAASE,MAAM,CAAC;AACrE;AAEA,OAAO,SAASC,kBAAkBC,MAAc,EAAEC,QAAgB;IAChE,MAAML,UAAU,GAAGI,OAAO,CAAC,EAAEC,SAAS,CAAC,EAAEC,KAAKC,GAAG,KAAK5B,gBAAgB;IACtE,OAAO,GAAGqB,QAAQ,CAAC,EAAED,KAAKC,UAAU;AACtC;AAaA,yEAAyE,GACzE,OAAO,SAASQ,mBACdJ,MAAc,EACdK,KAAyB;IAEzB,MAAMC,QAAQnB,OAAOkB,gBAAAA,QAAS,IAAIjB,KAAK,CAAC;IACxC,IAAIkB,MAAMb,MAAM,KAAK,GAAG,OAAO;IAC/B,MAAM,CAACc,WAAWN,UAAUO,SAASC,UAAU,GAAGH;IAClD,IAAIC,cAAcP,QAAQ,OAAO;IACjC,IAAIU,OAAOF,WAAWN,KAAKC,GAAG,IAAI,OAAO;IACzC,MAAMP,UAAU,GAAGW,UAAU,CAAC,EAAEN,SAAS,CAAC,EAAEO,SAAS;IACrD,MAAMlB,WAAWK,KAAKC;IACtB,MAAMe,IAAIpB,OAAOC,IAAI,CAACiB;IACtB,MAAMG,IAAIrB,OAAOC,IAAI,CAACF;IACtB,IAAIqB,EAAElB,MAAM,KAAKmB,EAAEnB,MAAM,EAAE,OAAO;IAClC,IAAI,CAACpB,gBAAgB,IAAIqB,WAAWiB,IAAI,IAAIjB,WAAWkB,KAAK,OAAO;IACnE,OAAO;QAAEX;QAAUY,YAAYH,OAAOF,WAAWjC;IAAe;AAClE;AAEA,iEAAiE,GACjE,OAAO,SAASuC,oBACdd,MAAc,EACdK,KAAyB;;QAElBD;IAAP,gBAAOA,sBAAAA,mBAAmBJ,QAAQK,2BAA3BD,oBAAmCH,QAAQ,mBAAI;AACxD;AAEA,sDAAsD,GACtD,MAAMc,qBAAqB,KAAK,KAAK;AAErC;;;;;CAKC,GACD,SAASC,oBAAoBC,cAAkC;IAC7D,OAAOhD,WAAW,UACf4B,MAAM,CAACV,OAAO8B,yBAAAA,iBAAkB,KAChCnB,MAAM,CAAC;AACZ;AAEA;;;;CAIC,GACD,OAAO,SAASoB,uBACdlB,MAAc,EACdC,QAAgB,EAChBgB,cAAkC;IAElC,MAAMrB,UAAU,GAAGI,OAAO,CAAC,EAAEC,SAAS,CAAC,EAAEC,KAAKC,GAAG,KAAKY,oBAAoB;IAC1E,OAAO,GAAGnB,QAAQ,CAAC,EAAED,KACnB,GAAGC,QAAQ,CAAC,EAAEoB,oBAAoBC,iBAAiB,GAClD;AACL;AAEA;;;;;;CAMC,GACD,OAAO,SAASE,2BACdnB,MAAc,EACdK,KAAyB;IAEzB,MAAMC,QAAQnB,OAAOkB,gBAAAA,QAAS,IAAIjB,KAAK,CAAC;IACxC,IAAIkB,MAAMb,MAAM,KAAK,GAAG,OAAO;IAC/B,MAAM,CAACc,WAAWN,UAAUO,QAAQ,GAAGF;IACvC,IAAIC,cAAcP,QAAQ,OAAO;IACjC,IAAI,CAACC,UAAU,OAAO;IACtB,IAAIS,OAAOF,WAAWN,KAAKC,GAAG,IAAI,OAAO;IACzC,OAAOF;AACT;AAEA,qEAAqE,GACrE,OAAO,SAASmB,yBACdpB,MAAc,EACdK,KAAyB,EACzBgB,qBAAyC;IAEzC,MAAMf,QAAQnB,OAAOkB,gBAAAA,QAAS,IAAIjB,KAAK,CAAC;IACxC,IAAIkB,MAAMb,MAAM,KAAK,GAAG,OAAO;IAC/B,MAAM,CAACc,WAAWN,UAAUO,SAASC,UAAU,GAAGH;IAClD,IAAIC,cAAcP,UAAU,CAACC,UAAU,OAAO;IAC9C,IAAIS,OAAOF,WAAWN,KAAKC,GAAG,IAAI,OAAO;IACzC,MAAMP,UAAU,GAAGW,UAAU,CAAC,EAAEN,SAAS,CAAC,EAAEO,SAAS;IACrD,MAAMlB,WAAWK,KACf,GAAGC,QAAQ,CAAC,EAAEoB,oBAAoBK,wBAAwB;IAE5D,MAAMV,IAAIpB,OAAOC,IAAI,CAACiB;IACtB,MAAMG,IAAIrB,OAAOC,IAAI,CAACF;IACtB,IAAIqB,EAAElB,MAAM,KAAKmB,EAAEnB,MAAM,EAAE,OAAO;IAClC,OAAOpB,gBAAgB,IAAIqB,WAAWiB,IAAI,IAAIjB,WAAWkB;AAC3D;AAEA,OAAO,SAASU,iBAAiBtB,MAAc;IAC7C,OAAO,CAAC,aAAa,EAAEA,OAAOuB,OAAO,CAAC,mBAAmB,KAAK;AAChE;AAEA,OAAO,SAASC,gBACdC,GAAsB,EACtBzB,MAAc,EACdK,KAAoB;IAEpB,MAAMqB,OAAOJ,iBAAiBtB;IAC9B,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM2B,SAASlD,QAAQC,GAAG,CAACkD,QAAQ,KAAK,eAAe,aAAa;IACpE,MAAMC,OAAO,GAAGH,KAAK,CAAC,EAAErB,gBAAAA,QAAS,GAAG,gCAAgC,EAAEsB,QAAQ;IAC9EF,IAAIK,SAAS,CACX,cACAzB,QAAQ,GAAGwB,KAAK,UAAU,EAAE,KAAK,KAAK,KAAK,IAAI,GAAG,GAAGA,KAAK,WAAW,CAAC;AAE1E;AAEA,OAAO,SAASE,kBACdC,GAAqB,EACrBhC,MAAc;QAEFgC;IAAZ,MAAMC,OAAMD,eAAAA,IAAIE,OAAO,qBAAXF,YAAa,CAACV,iBAAiBtB,QAAQ;IACnD,OAAOc,oBAAoBd,QAAQiC;AACrC;AAEA;;;;;;CAMC,GACD,OAAO,MAAME,mCAAmC,sBAAqB;AAErE,0EAA0E,GAC1E,OAAO,MAAMC,yBACX,2DAA0D;AAY5D;;;;;;;;CAQC,GACD,OAAO,eAAeC,wBACpBL,GAAqB,EACrBhC,MAAc;QAqBWsC;QAjBvBN;IAFF,MAAMO,UAAUnC,mBACdJ,SACAgC,eAAAA,IAAIE,OAAO,qBAAXF,YAAa,CAACV,iBAAiBtB,QAAQ;IAEzC,IAAI,CAACuC,SAAS,OAAO;QAAEC,QAAQ;IAAY;IAC3C,MAAM,EAAEvC,QAAQ,EAAEY,UAAU,EAAE,GAAG0B;IACjC,MAAMD,SAAS,MAAMhE,cAClBmE,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAC5C,QACJ2C,UAAU,CAAC,eACXC,GAAG,CAAC3C,UACJ4C,GAAG;IACN,IAAI,CAACP,OAAOQ,MAAM,EAAE,OAAO;QAAEN,QAAQ;IAAY;IACjD,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,yDAAyD;IACzD,MAAMO,YAAYrC,QAAO4B,cAAAA,OAAOO,GAAG,CAACV,6CAAXG,cAAgD;IACzE,IAAIS,aAAalC,aAAakC,WAAW,OAAO;QAAEP,QAAQ;IAAY;IACtE,IAAIF,OAAOO,GAAG,CAAC,iBAAiB,MAAM;QACpC,OAAO;YAAEL,QAAQ;YAAavC;QAAS;IACzC;IACA,OAAO;QAAEuC,QAAQ;QAAUvC;QAAUqC;IAAO;AAC9C;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeU,oBACpBhB,GAAqB,EACrBP,GAAsB,EACtBzB,MAAc,EACdiD,cAAc,eAAe;IAK7B,MAAMV,UAAU,MAAMF,wBAAwBL,KAAKhC;IACnD,IAAIuC,QAAQC,MAAM,KAAK,aAAa;QAClChB,gBAAgBC,KAAKzB,QAAQ;QAC7ByB,IAAIe,MAAM,CAAC,KAAKU,IAAI,CAAC;YAAEC,OAAOf;QAAuB;QACrD,OAAO;IACT;IACA,IAAIG,QAAQC,MAAM,KAAK,UAAU;QAC/Bf,IAAIe,MAAM,CAAC,KAAKU,IAAI,CAAC;YAAEC,OAAOF;QAAY;QAC1C,OAAO;IACT;IACA,OAAO;QAAEhD,UAAUsC,QAAQtC,QAAQ;QAAEqC,QAAQC,QAAQD,MAAM;IAAC;AAC9D"}

package/src/lib/server/native-checkout.d.ts

@@ -0,0 +1,170 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The storefront Payment Element (AGL-1944), the half of native payments
+ * AGL-1132 said mattered more: a shopper on a merchant's own domain pays
+ * without being bounced to `checkout.stripe.com` and back.
+ *
+ * ## Why a Checkout Session and not a bare PaymentIntent
+ *
+ * AGL-1132 recommended "PaymentIntent + `<PaymentElement/>`" for this surface,
+ * and AGL-1944 asked for that to be a conscious re-decision rather than an
+ * inherited one. It is: the Payment Element ships, the bare PaymentIntent does
+ * not, and the difference is worth stating because it is the whole safety
+ * argument.
+ *
+ * A PaymentIntent-backed flow would have to own totals, tax, shipping and the
+ * platform fee itself — which means a SECOND place that computes what a shopper
+ * owes. Two paths that price a cart independently is how a storefront starts
+ * under-collecting tax without anyone noticing: nothing fails, the number is
+ * just quietly wrong on one of them. It also emits `payment_intent.succeeded`
+ * rather than `checkout.session.completed`, so every fulfilment branch in
+ * `billing-webhook.ts` — orders, inventory, coupons, gift cards, licence keys,
+ * subscriptions — would need a parallel implementation reading a different
+ * object shape.
+ *
+ * `ui_mode: 'custom'` is the Payment Element backed by a Checkout Session. The
+ * shopper sees `<PaymentElement/>` inside the merchant's own layout — no Stripe
+ * chrome, which is the thing AGL-1944 objected to about embedded Checkout — and
+ * the server keeps the session builder it already has. So:
+ *
+ *   - tax, shipping, inventory, coupons, the Connect destination and the fee
+ *     ladder are the SAME code, not a parallel implementation. Parity is by
+ *     construction rather than by test;
+ *   - `checkout.session.completed` still fires, so `billing-webhook.ts` needs
+ *     no change at all and stays the only thing that fulfils an order.
+ *
+ * ## The API version, and why it is pinned per-request
+ *
+ * Measured against live Stripe in test mode: `ui_mode: 'custom'` is refused at
+ * the platform account's default API version with
+ *
+ *     Invalid Stripe API version: 2020-08-27. In order to use `ui_mode:
+ *     custom`, you must upgrade to Stripe API version 2025-03-31.basil.
+ *
+ * Upgrading the ACCOUNT default would re-version every Stripe call in this
+ * repo at once — a change whose blast radius nobody could review in one pass.
+ * A `Stripe-Version` header pins one request instead, and the pin is contained
+ * in a way worth being explicit about: webhook deliveries are versioned per
+ * ENDPOINT, not per request, so the events `billing-webhook.ts` parses keep
+ * arriving in exactly the shape it already reads. The only thing read off the
+ * pinned response is `client_secret` and `id`, neither of which the version
+ * affects.
+ *
+ * Same probe, same params (line items, a manual tax line,
+ * `shipping_address_collection`, a `fixed_amount` shipping option, Connect
+ * `transfer_data[destination]` and `application_fee_amount`), hosted vs custom:
+ * `amount_total` **6212 in both**. That is the tax-and-shipping parity claim,
+ * measured rather than assumed.
+ *
+ * ## What this module deliberately does NOT do
+ *
+ * It does not fulfil anything, and it hands the browser nothing it could use to
+ * claim an order was paid. The client gets a `clientSecret` — which is an
+ * instruction to Stripe, not an assertion about money — and the same
+ * `session_id` the redirect flow already put in the return URL. Fulfilment
+ * remains `checkout.session.completed` in `billing-webhook.ts`, exactly as with
+ * the redirect. An in-page flow makes trusting the browser tempting; the
+ * browser is the one participant that can lie about having paid.
+ */
+/**
+ * The API version `ui_mode: 'custom'` needs, pinned on the session-create
+ * request only. Stated once so the header and the doc comment cannot drift.
+ */
+export declare const NATIVE_CHECKOUT_STRIPE_VERSION = "2025-03-31.basil";
+/** The flag both halves of native checkout share (AGL-1132, AGL-1944). */
+export declare const NATIVE_CHECKOUT_FLAG: "release_native_checkout";
+export interface NativeCheckoutMode {
+    /** True only when the flag is on for this org AND a publishable key exists. */
+    native: boolean;
+    /** Empty unless `native` — the client needs it to boot Stripe.js. */
+    publishableKey: string;
+}
+/**
+ * Two conditions, not one — the same pairing the console's route settled on.
+ *
+ * A `ui_mode` session returns a `client_secret` and NO `url`, so a browser that
+ * cannot mount Stripe.js has nothing to navigate to. If the flag alone decided
+ * this, flipping it in an environment without
+ * `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` would replace a working redirect with a
+ * dead Buy button on every storefront at once. Requiring the key here means the
+ * worst case of a premature flag flip is the redirect we already ship.
+ *
+ * That is not hypothetical for the storefront. Measured on 2026-08-18 through
+ * the Vercel REST API (`vercel env ls` cannot see team-shared vars):
+ * `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` exists as a project-level var on
+ * `aglyn-console` and is set NOWHERE on `aglyn-tenant`, which is the project
+ * that serves storefronts. So today this resolves to `native: false` in
+ * production however the flag is set, and the shopper keeps the redirect.
+ *
+ * The org — never the host — is the rollout bucket, per AGL-1656: a hostId and
+ * an orgId hash to different buckets, so bucketing on the host could land a
+ * merchant's storefront and their console on opposite sides of the same
+ * percentage.
+ */
+export declare function resolveNativeCheckoutMode(orgId: string | null | undefined): Promise<NativeCheckoutMode>;
+/**
+ * Rewrite a built session param set for the Payment Element, in place.
+ *
+ * DELETES `success_url` and `cancel_url` rather than leaving them alongside
+ * `return_url`: Stripe rejects the pair outright on a `ui_mode` session, and a
+ * 400 here would surface to the shopper as "Checkout failed" on a store that
+ * was working an hour ago. Everything else in the param set — line items, the
+ * tax line, `automatic_tax`, shipping options, the Connect destination, the
+ * application fee, every `metadata[…]` key the webhook reads — is left exactly
+ * as the caller built it. That is the point: this function must be incapable of
+ * changing what the shopper is charged.
+ *
+ * `returnUrl` is the caller's OWN `success_url` string, `{CHECKOUT_SESSION_ID}`
+ * placeholder and all. Stripe substitutes it on a `ui_mode: 'custom'` return
+ * exactly as it does on a hosted redirect (measured), so the storefront's
+ * post-purchase reporting — which reads `session_id` off the query to name the
+ * order it just completed (AGL-1641) — keeps working unchanged.
+ */
+export declare function applyNativeCheckoutParams(params: URLSearchParams, returnUrl: string): void;
+/**
+ * The `Stripe-Version` pin, as headers to spread into the session-create fetch.
+ * Empty for the hosted path so its request is byte-identical to today's.
+ */
+export declare function nativeCheckoutStripeHeaders(mode: NativeCheckoutMode): Record<string, string>;
+export interface NativeCheckoutPayload {
+    /** Stripe's own instruction to the browser. Not a claim that money moved. */
+    clientSecret: string;
+    publishableKey: string;
+    /** The order document id, and the `session_id` the return URL carries. */
+    sessionId: string;
+}
+export interface HostedCheckoutPayload {
+    url: string;
+}
+/**
+ * Read the created session into the payload the storefront gets back.
+ *
+ * Returns `null` when the session is unusable, which BOTH callers already treat
+ * as "nothing was sold" — release the idempotency claim and answer 502. The
+ * null case is the whole reason this is a function rather than a ternary: the
+ * hosted path's liveness check was `!session.url`, and a `ui_mode` session
+ * never has one. Left unchanged, switching a store to native mode would have
+ * made every successful session look like a Stripe failure — a 502 to the
+ * shopper, a released claim, and a real Checkout Session left open on the
+ * account. So the check has to move with the mode, and it does.
+ */
+export declare function readCheckoutSessionPayload(session: {
+    url?: string;
+    id?: string;
+    client_secret?: string;
+}, mode: NativeCheckoutMode): NativeCheckoutPayload | HostedCheckoutPayload | null;

package/src/lib/server/native-checkout.js

@@ -0,0 +1,193 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { isServerReleaseFlagOnForOrg } from "@aglyn/tenant-data-admin";
+/**
+ * The storefront Payment Element (AGL-1944), the half of native payments
+ * AGL-1132 said mattered more: a shopper on a merchant's own domain pays
+ * without being bounced to `checkout.stripe.com` and back.
+ *
+ * ## Why a Checkout Session and not a bare PaymentIntent
+ *
+ * AGL-1132 recommended "PaymentIntent + `<PaymentElement/>`" for this surface,
+ * and AGL-1944 asked for that to be a conscious re-decision rather than an
+ * inherited one. It is: the Payment Element ships, the bare PaymentIntent does
+ * not, and the difference is worth stating because it is the whole safety
+ * argument.
+ *
+ * A PaymentIntent-backed flow would have to own totals, tax, shipping and the
+ * platform fee itself — which means a SECOND place that computes what a shopper
+ * owes. Two paths that price a cart independently is how a storefront starts
+ * under-collecting tax without anyone noticing: nothing fails, the number is
+ * just quietly wrong on one of them. It also emits `payment_intent.succeeded`
+ * rather than `checkout.session.completed`, so every fulfilment branch in
+ * `billing-webhook.ts` — orders, inventory, coupons, gift cards, licence keys,
+ * subscriptions — would need a parallel implementation reading a different
+ * object shape.
+ *
+ * `ui_mode: 'custom'` is the Payment Element backed by a Checkout Session. The
+ * shopper sees `<PaymentElement/>` inside the merchant's own layout — no Stripe
+ * chrome, which is the thing AGL-1944 objected to about embedded Checkout — and
+ * the server keeps the session builder it already has. So:
+ *
+ *   - tax, shipping, inventory, coupons, the Connect destination and the fee
+ *     ladder are the SAME code, not a parallel implementation. Parity is by
+ *     construction rather than by test;
+ *   - `checkout.session.completed` still fires, so `billing-webhook.ts` needs
+ *     no change at all and stays the only thing that fulfils an order.
+ *
+ * ## The API version, and why it is pinned per-request
+ *
+ * Measured against live Stripe in test mode: `ui_mode: 'custom'` is refused at
+ * the platform account's default API version with
+ *
+ *     Invalid Stripe API version: 2020-08-27. In order to use `ui_mode:
+ *     custom`, you must upgrade to Stripe API version 2025-03-31.basil.
+ *
+ * Upgrading the ACCOUNT default would re-version every Stripe call in this
+ * repo at once — a change whose blast radius nobody could review in one pass.
+ * A `Stripe-Version` header pins one request instead, and the pin is contained
+ * in a way worth being explicit about: webhook deliveries are versioned per
+ * ENDPOINT, not per request, so the events `billing-webhook.ts` parses keep
+ * arriving in exactly the shape it already reads. The only thing read off the
+ * pinned response is `client_secret` and `id`, neither of which the version
+ * affects.
+ *
+ * Same probe, same params (line items, a manual tax line,
+ * `shipping_address_collection`, a `fixed_amount` shipping option, Connect
+ * `transfer_data[destination]` and `application_fee_amount`), hosted vs custom:
+ * `amount_total` **6212 in both**. That is the tax-and-shipping parity claim,
+ * measured rather than assumed.
+ *
+ * ## What this module deliberately does NOT do
+ *
+ * It does not fulfil anything, and it hands the browser nothing it could use to
+ * claim an order was paid. The client gets a `clientSecret` — which is an
+ * instruction to Stripe, not an assertion about money — and the same
+ * `session_id` the redirect flow already put in the return URL. Fulfilment
+ * remains `checkout.session.completed` in `billing-webhook.ts`, exactly as with
+ * the redirect. An in-page flow makes trusting the browser tempting; the
+ * browser is the one participant that can lie about having paid.
+ */ /**
+ * The API version `ui_mode: 'custom'` needs, pinned on the session-create
+ * request only. Stated once so the header and the doc comment cannot drift.
+ */ export const NATIVE_CHECKOUT_STRIPE_VERSION = '2025-03-31.basil';
+/** The flag both halves of native checkout share (AGL-1132, AGL-1944). */ export const NATIVE_CHECKOUT_FLAG = 'release_native_checkout';
+/**
+ * Two conditions, not one — the same pairing the console's route settled on.
+ *
+ * A `ui_mode` session returns a `client_secret` and NO `url`, so a browser that
+ * cannot mount Stripe.js has nothing to navigate to. If the flag alone decided
+ * this, flipping it in an environment without
+ * `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` would replace a working redirect with a
+ * dead Buy button on every storefront at once. Requiring the key here means the
+ * worst case of a premature flag flip is the redirect we already ship.
+ *
+ * That is not hypothetical for the storefront. Measured on 2026-08-18 through
+ * the Vercel REST API (`vercel env ls` cannot see team-shared vars):
+ * `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` exists as a project-level var on
+ * `aglyn-console` and is set NOWHERE on `aglyn-tenant`, which is the project
+ * that serves storefronts. So today this resolves to `native: false` in
+ * production however the flag is set, and the shopper keeps the redirect.
+ *
+ * The org — never the host — is the rollout bucket, per AGL-1656: a hostId and
+ * an orgId hash to different buckets, so bucketing on the host could land a
+ * merchant's storefront and their console on opposite sides of the same
+ * percentage.
+ */ export async function resolveNativeCheckoutMode(orgId) {
+    var _process_env_NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY;
+    const publishableKey = String((_process_env_NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY = process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY) != null ? _process_env_NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY : '').trim();
+    if (!publishableKey) return {
+        native: false,
+        publishableKey: ''
+    };
+    // A flag lookup that throws must not take a sale down with it, and the catch
+    // is a `try` rather than `.catch()` deliberately: Remote Config being
+    // unreachable rejects, but the resolver being absent entirely — an
+    // environment where the module never loaded — throws SYNCHRONOUSLY, before
+    // there is a promise to attach a handler to. Only the block form covers both.
+    // Either way the answer is the same and it is the safe one: the redirect.
+    let on;
+    try {
+        on = await isServerReleaseFlagOnForOrg(NATIVE_CHECKOUT_FLAG, orgId != null ? orgId : null);
+    } catch (unused) {
+        return {
+            native: false,
+            publishableKey: ''
+        };
+    }
+    return on ? {
+        native: true,
+        publishableKey
+    } : {
+        native: false,
+        publishableKey: ''
+    };
+}
+/**
+ * Rewrite a built session param set for the Payment Element, in place.
+ *
+ * DELETES `success_url` and `cancel_url` rather than leaving them alongside
+ * `return_url`: Stripe rejects the pair outright on a `ui_mode` session, and a
+ * 400 here would surface to the shopper as "Checkout failed" on a store that
+ * was working an hour ago. Everything else in the param set — line items, the
+ * tax line, `automatic_tax`, shipping options, the Connect destination, the
+ * application fee, every `metadata[…]` key the webhook reads — is left exactly
+ * as the caller built it. That is the point: this function must be incapable of
+ * changing what the shopper is charged.
+ *
+ * `returnUrl` is the caller's OWN `success_url` string, `{CHECKOUT_SESSION_ID}`
+ * placeholder and all. Stripe substitutes it on a `ui_mode: 'custom'` return
+ * exactly as it does on a hosted redirect (measured), so the storefront's
+ * post-purchase reporting — which reads `session_id` off the query to name the
+ * order it just completed (AGL-1641) — keeps working unchanged.
+ */ export function applyNativeCheckoutParams(params, returnUrl) {
+    params.delete('success_url');
+    params.delete('cancel_url');
+    params.set('ui_mode', 'custom');
+    params.set('return_url', returnUrl);
+}
+/**
+ * The `Stripe-Version` pin, as headers to spread into the session-create fetch.
+ * Empty for the hosted path so its request is byte-identical to today's.
+ */ export function nativeCheckoutStripeHeaders(mode) {
+    return mode.native ? {
+        'Stripe-Version': NATIVE_CHECKOUT_STRIPE_VERSION
+    } : {};
+}
+/**
+ * Read the created session into the payload the storefront gets back.
+ *
+ * Returns `null` when the session is unusable, which BOTH callers already treat
+ * as "nothing was sold" — release the idempotency claim and answer 502. The
+ * null case is the whole reason this is a function rather than a ternary: the
+ * hosted path's liveness check was `!session.url`, and a `ui_mode` session
+ * never has one. Left unchanged, switching a store to native mode would have
+ * made every successful session look like a Stripe failure — a 502 to the
+ * shopper, a released claim, and a real Checkout Session left open on the
+ * account. So the check has to move with the mode, and it does.
+ */ export function readCheckoutSessionPayload(session, mode) {
+    if (!mode.native) return (session == null ? void 0 : session.url) ? {
+        url: session.url
+    } : null;
+    if (!(session == null ? void 0 : session.client_secret) || !(session == null ? void 0 : session.id)) return null;
+    return {
+        clientSecret: String(session.client_secret),
+        publishableKey: mode.publishableKey,
+        sessionId: String(session.id)
+    };
+}
+
+//# sourceMappingURL=native-checkout.js.map