@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/reserve-stock.js

@@ -0,0 +1,146 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { notifyHostManagers } from "@aglyn/tenant-data-admin";
+import * as CommerceModel from "../model/index.js";
+/**
+ * Decrements one variant's stock inside a transaction and reports what the
+ * shelf could actually give up. Never throws: a stock write must not fail a
+ * webhook, because Stripe would redeliver and the order would be minted twice.
+ *
+ * ## THE LEDGER ROW RIDES INSIDE THE TRANSACTION (AGL-2161)
+ *
+ * The count and its `inventoryAdjustments` row used to be two separate writes
+ * at six call sites, the second one a bare
+ * `.add({…}).catch(() => undefined)`. Either could land without the other and
+ * nothing anywhere said so:
+ *
+ * - **row lost, count moved** — `cancel-order.ts:206-224` reads the rows for
+ *   an order to decide whether a POS card sale was ever decremented, and reads
+ *   `appliedDelta ?? delta` to cap the restock. No row means it refuses to
+ *   release that stock at all, so the units are stranded permanently.
+ * - **count lost, row written** — the reverse hands back units nobody has, the
+ *   failure `StockDecrementOutcome.failed` already exists to prevent.
+ *
+ * Both targets hang off the same `hostRef`, so nothing ever stopped them
+ * sharing one transaction; they simply did not. They do now, and the divergence
+ * is not made *loud*, it is made **impossible** — which is the stronger of the
+ * two options, and available here only because the helper already owned the
+ * transaction the count was written in.
+ *
+ * Consequences worth stating, because they change five call sites at once:
+ *
+ * - A ledger failure now ROLLS BACK the decrement instead of being swallowed.
+ *   That is the direction that keeps the two readings in agreement: the sale
+ *   is still paid, the shelf is untouched, and `reconcile-stock.ts` reports a
+ *   missing decrement — which is true, and was previously a false positive
+ *   whenever only the row was lost.
+ * - The row is still auto-id'd. A deterministic id keyed on the order would
+ *   make redelivery idempotent, but two lines of one product in one order are
+ *   two legitimate rows (`billing-webhook-low-stock.spec.ts`, "logs both sale
+ *   rows"), and a deterministic key would silently fold them into one and
+ *   under-cap the restock. Redelivery stays bounded upstream, where it was.
+ */ export async function decrementVariantStock(options) {
+    const { firestore, hostRef, hostId, productId, variantId, quantity, locationId, ledger } = options;
+    const requested = -Math.abs(Math.round(Number(quantity) || 0));
+    const nothing = {
+        applied: 0,
+        requested,
+        before: null,
+        after: null,
+        failed: false
+    };
+    if (requested === 0) return nothing;
+    let outcome;
+    try {
+        outcome = await firestore.runTransaction(async (transaction)=>{
+            const productRef = hostRef.collection('products').doc(productId);
+            const snapshot = await transaction.get(productRef);
+            if (!(snapshot == null ? void 0 : snapshot.exists)) return nothing;
+            const before = CommerceModel.liftLegacyProduct(snapshot.data());
+            const tracked = before.variants.some((variant)=>variant.id === variantId && variant.inventory != null);
+            if (!tracked) return nothing;
+            const variants = CommerceModel.adjustVariantInventory(before, variantId, requested, locationId);
+            // Computed from the SAME read the write is derived from, inside the same
+            // transaction — which is the whole point (AGL-2320).
+            const applied = CommerceModel.appliedVariantInventoryDelta(before, variantId, requested, locationId);
+            const after = _extends({}, before, {
+                variants
+            });
+            transaction.set(productRef, {
+                variants,
+                inventory: CommerceModel.productInventory(after)
+            }, {
+                merge: true
+            });
+            // Same transaction, so the count and the row commit together or neither
+            // does (AGL-2161). `applied` is the figure computed above from the read
+            // this write is derived from, so `appliedDelta` tells the truth under
+            // contention exactly as it does for the count.
+            if (ledger) {
+                transaction.set(hostRef.collection('inventoryAdjustments').doc(), _extends({
+                    productId,
+                    variantId,
+                    delta: requested
+                }, applied !== requested ? {
+                    appliedDelta: applied
+                } : {}, {
+                    reason: ledger.reason,
+                    orderId: ledger.orderId
+                }, locationId ? {
+                    locationId
+                } : {}, {
+                    atMs: Date.now()
+                }));
+            }
+            return {
+                applied,
+                requested,
+                before,
+                after,
+                failed: false
+            };
+        });
+    } catch (error) {
+        // Swallowed like the `.catch(() => undefined)` this replaces, but no longer
+        // silently: the caller skips its ledger row, and the count and the ledger
+        // stay in agreement about a decrement that did not happen.
+        console.error('Stock decrement failed', hostId, productId, variantId, error);
+        return _extends({}, nothing, {
+            failed: true
+        });
+    }
+    // The oversell is now LOUD (AGL-2320). `content.lowStock` is deliberately
+    // reused rather than a new notification type: the type union carries a label
+    // map, a category and a per-user mute, and "you are out of this" is the
+    // category a merchant who cares about stock is already subscribed to. A
+    // backorder product selling past zero
+    // is the merchant's own choice and already understood (AGL-2149), so only a
+    // deny-policy shortfall is reported — that is the one the merchant did not
+    // ask for and previously got no signal about at all.
+    const short = outcome.applied - outcome.requested;
+    if (short > 0 && outcome.before && outcome.before.oversellPolicy !== 'backorder') {
+        void notifyHostManagers(hostId, {
+            type: 'content.lowStock',
+            title: `Oversold — ${outcome.before.name}`,
+            body: `${Math.abs(outcome.requested)} sold, ${Math.abs(outcome.applied)} ` + `came off the shelf. ${short} unit${short === 1 ? '' : 's'} were not ` + 'in stock — the sale is paid and needs restocking or refunding.',
+            link: `/${hostId}/products`
+        });
+    }
+    return outcome;
+}
+
+//# sourceMappingURL=reserve-stock.js.map

package/src/lib/server/reserve-stock.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/reserve-stock.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { notifyHostManagers } from '@aglyn/tenant-data-admin'\nimport * as CommerceModel from '../model'\n\n/**\n * THE ATOMIC STOCK DECREMENT (AGL-2320).\n *\n * Every stock write in this plugin was a read → compute → `set(…, {merge:true})`\n * of the whole `variants` array, with the read often far upstream of the write:\n * the cart branch of `billing-webhook.ts` reads its products, then runs a\n * transaction, a `cartRef.delete()`, a checkout-doc read, licence-key\n * assignment and an email send before it decrements. Two sales landing in that\n * window both computed from the same `variants` and both wrote; the later won\n * and one decrement was LOST. The ledger showed two `sale` rows while the count\n * moved once, so the shelf was short by one and the storefront went on offering\n * the unit it had already sold — the loss compounds, because phantom stock is\n * what admits the next oversell.\n *\n * `inventory` lives INSIDE the `variants` array, not at a document field path,\n * so `FieldValue.increment` is not expressible against it. That is why this was\n * filed as blocked on a data-model change. It is not the only way to make a\n * decrement safe: a transaction is. `Transaction.get()` takes a lock on the\n * product document, so two concurrent decrements SERIALIZE — the loser re-runs\n * its callback against the winner's committed state and subtracts from the real\n * remainder. The read-modify-write stays, the schema is untouched, and no\n * migration is needed. The cost is one contended retry, not one extra read.\n *\n * WHAT THIS DOES NOT DO. It does not refuse a sale. Every storefront path\n * gates on `canPurchase` when the Stripe Checkout session is created and\n * decrements minutes later in the webhook, by which time the money has moved —\n * refusing there would take payment and withhold goods. Closing the last-unit\n * oversell needs a HOLD taken at session creation and released when the session\n * expires, which is a feature with a new failure mode (an abandoned cart\n * sitting on the last unit for the session's lifetime) and is deliberately not\n * being introduced days before launch. So the oversell is made LOUD instead of\n * silent: when the fresh read proves the shelf could not cover the sale, the\n * managers are told, with the number that was actually short.\n *\n * The floor in `adjustVariantInventory` stays — a shelf count does not go\n * negative, and every reader assumes it cannot (AGL-2149). What changes is that\n * `applied` is now computed from the state the write actually lands on, so the\n * ledger's `appliedDelta` tells the truth under concurrency. Before this, two\n * concurrent sales of one unit each computed `appliedDelta: -1` from the same\n * stale `inventory: 1`, and the ledger claimed two units left a shelf that only\n * ever held one.\n */\nexport interface StockDecrementOutcome {\n  /**\n   * What the count ACTUALLY moved by — zero or negative, and never more than\n   * the shelf held. The caller writes this as the ledger row's `appliedDelta`\n   * (AGL-2149) when it differs from `requested`.\n   */\n  applied: number\n  /** The units sold, negated. */\n  requested: number\n  /**\n   * The product as read INSIDE the transaction, and the same product with the\n   * committed variants. Both null when nothing was written — a missing product,\n   * an untracked variant, or a failed commit. Handed to\n   * `alertLowStockCrossing` as the pre/post pair, which is now the pair the\n   * write actually crossed rather than one computed from an upstream read.\n   */\n  before: CommerceModel.HostProduct | null\n  after: CommerceModel.HostProduct | null\n  /**\n   * The commit did not land. Distinct from `applied === 0`, which is a real\n   * outcome (a deny-policy product already at zero). A caller must not write a\n   * ledger row for a failed commit: a row whose count never moved is exactly\n   * what makes a later cancellation hand back units nobody has.\n   */\n  failed: boolean\n}\n\n/**\n * What the ledger row joins this movement to (AGL-2161).\n *\n * Passing this is what makes the count and the row ONE write. Omitting it\n * decrements without a row, which only `reserve-stock`'s own specs do — every\n * production caller passes it, and `stock-decrement-race.spec.ts` fails the\n * build if one stops.\n */\nexport interface StockLedgerJoin {\n  /** Why the count moved. Every sale path passes `sale`. */\n  reason: CommerceModel.InventoryAdjustmentReason\n  /**\n   * The document this movement is answerable to. `cancel-order.ts` queries\n   * `where('orderId','==',…)` to decide whether to restock at all, so a row\n   * that names the wrong id is as bad as a missing one.\n   */\n  orderId: string\n}\n\n/**\n * Decrements one variant's stock inside a transaction and reports what the\n * shelf could actually give up. Never throws: a stock write must not fail a\n * webhook, because Stripe would redeliver and the order would be minted twice.\n *\n * ## THE LEDGER ROW RIDES INSIDE THE TRANSACTION (AGL-2161)\n *\n * The count and its `inventoryAdjustments` row used to be two separate writes\n * at six call sites, the second one a bare\n * `.add({…}).catch(() => undefined)`. Either could land without the other and\n * nothing anywhere said so:\n *\n * - **row lost, count moved** — `cancel-order.ts:206-224` reads the rows for\n *   an order to decide whether a POS card sale was ever decremented, and reads\n *   `appliedDelta ?? delta` to cap the restock. No row means it refuses to\n *   release that stock at all, so the units are stranded permanently.\n * - **count lost, row written** — the reverse hands back units nobody has, the\n *   failure `StockDecrementOutcome.failed` already exists to prevent.\n *\n * Both targets hang off the same `hostRef`, so nothing ever stopped them\n * sharing one transaction; they simply did not. They do now, and the divergence\n * is not made *loud*, it is made **impossible** — which is the stronger of the\n * two options, and available here only because the helper already owned the\n * transaction the count was written in.\n *\n * Consequences worth stating, because they change five call sites at once:\n *\n * - A ledger failure now ROLLS BACK the decrement instead of being swallowed.\n *   That is the direction that keeps the two readings in agreement: the sale\n *   is still paid, the shelf is untouched, and `reconcile-stock.ts` reports a\n *   missing decrement — which is true, and was previously a false positive\n *   whenever only the row was lost.\n * - The row is still auto-id'd. A deterministic id keyed on the order would\n *   make redelivery idempotent, but two lines of one product in one order are\n *   two legitimate rows (`billing-webhook-low-stock.spec.ts`, \"logs both sale\n *   rows\"), and a deterministic key would silently fold them into one and\n *   under-cap the restock. Redelivery stays bounded upstream, where it was.\n */\nexport async function decrementVariantStock(options: {\n  firestore: any\n  hostRef: any\n  hostId: string\n  productId: string\n  variantId: string\n  /** Units sold; sign is ignored. */\n  quantity: number\n  locationId?: string\n  /**\n   * The ledger row to write in the SAME transaction as the count (AGL-2161).\n   * Omit only where no movement should be recorded.\n   */\n  ledger?: StockLedgerJoin\n}): Promise<StockDecrementOutcome> {\n  const {\n    firestore,\n    hostRef,\n    hostId,\n    productId,\n    variantId,\n    quantity,\n    locationId,\n    ledger,\n  } = options\n  const requested = -Math.abs(Math.round(Number(quantity) || 0))\n  const nothing: StockDecrementOutcome = {\n    applied: 0,\n    requested,\n    before: null,\n    after: null,\n    failed: false,\n  }\n  if (requested === 0) return nothing\n  let outcome: StockDecrementOutcome\n  try {\n    outcome = await firestore.runTransaction(async (transaction: any) => {\n      const productRef = hostRef.collection('products').doc(productId)\n      const snapshot = await transaction.get(productRef)\n      if (!snapshot?.exists) return nothing\n      const before = CommerceModel.liftLegacyProduct(snapshot.data() as any)\n      const tracked = before.variants.some(\n        (variant) => variant.id === variantId && variant.inventory != null,\n      )\n      if (!tracked) return nothing\n      const variants = CommerceModel.adjustVariantInventory(\n        before,\n        variantId,\n        requested,\n        locationId,\n      )\n      // Computed from the SAME read the write is derived from, inside the same\n      // transaction — which is the whole point (AGL-2320).\n      const applied = CommerceModel.appliedVariantInventoryDelta(\n        before,\n        variantId,\n        requested,\n        locationId,\n      )\n      const after = { ...before, variants }\n      transaction.set(\n        productRef,\n        {\n          variants,\n          inventory: CommerceModel.productInventory(after),\n        },\n        { merge: true },\n      )\n      // Same transaction, so the count and the row commit together or neither\n      // does (AGL-2161). `applied` is the figure computed above from the read\n      // this write is derived from, so `appliedDelta` tells the truth under\n      // contention exactly as it does for the count.\n      if (ledger) {\n        transaction.set(\n          hostRef.collection('inventoryAdjustments').doc(),\n          {\n            productId,\n            variantId,\n            delta: requested,\n            ...(applied !== requested ? { appliedDelta: applied } : {}),\n            reason: ledger.reason,\n            orderId: ledger.orderId,\n            ...(locationId ? { locationId } : {}),\n            atMs: Date.now(),\n          } satisfies CommerceModel.InventoryAdjustment,\n        )\n      }\n      return { applied, requested, before, after, failed: false }\n    })\n  } catch (error) {\n    // Swallowed like the `.catch(() => undefined)` this replaces, but no longer\n    // silently: the caller skips its ledger row, and the count and the ledger\n    // stay in agreement about a decrement that did not happen.\n    console.error('Stock decrement failed', hostId, productId, variantId, error)\n    return { ...nothing, failed: true }\n  }\n  // The oversell is now LOUD (AGL-2320). `content.lowStock` is deliberately\n  // reused rather than a new notification type: the type union carries a label\n  // map, a category and a per-user mute, and \"you are out of this\" is the\n  // category a merchant who cares about stock is already subscribed to. A\n  // backorder product selling past zero\n  // is the merchant's own choice and already understood (AGL-2149), so only a\n  // deny-policy shortfall is reported — that is the one the merchant did not\n  // ask for and previously got no signal about at all.\n  const short = outcome.applied - outcome.requested\n  if (\n    short > 0 &&\n    outcome.before &&\n    outcome.before.oversellPolicy !== 'backorder'\n  ) {\n    void notifyHostManagers(hostId, {\n      type: 'content.lowStock',\n      title: `Oversold — ${outcome.before.name}`,\n      body:\n        `${Math.abs(outcome.requested)} sold, ${Math.abs(outcome.applied)} ` +\n        `came off the shelf. ${short} unit${short === 1 ? '' : 's'} were not ` +\n        'in stock — the sale is paid and needs restocking or refunding.',\n      link: `/${hostId}/products`,\n    })\n  }\n  return outcome\n}\n"],"names":["notifyHostManagers","CommerceModel","decrementVariantStock","options","firestore","hostRef","hostId","productId","variantId","quantity","locationId","ledger","requested","Math","abs","round","Number","nothing","applied","before","after","failed","outcome","runTransaction","transaction","productRef","collection","doc","snapshot","get","exists","liftLegacyProduct","data","tracked","variants","some","variant","id","inventory","adjustVariantInventory","appliedVariantInventoryDelta","set","productInventory","merge","delta","appliedDelta","reason","orderId","atMs","Date","now","error","console","short","oversellPolicy","type","title","name","body","link"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kBAAkB,QAAQ,2BAA0B;AAC7D,YAAYC,mBAAmB,oBAAU;AA0FzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCC,GACD,OAAO,eAAeC,sBAAsBC,OAc3C;IACC,MAAM,EACJC,SAAS,EACTC,OAAO,EACPC,MAAM,EACNC,SAAS,EACTC,SAAS,EACTC,QAAQ,EACRC,UAAU,EACVC,MAAM,EACP,GAAGR;IACJ,MAAMS,YAAY,CAACC,KAAKC,GAAG,CAACD,KAAKE,KAAK,CAACC,OAAOP,aAAa;IAC3D,MAAMQ,UAAiC;QACrCC,SAAS;QACTN;QACAO,QAAQ;QACRC,OAAO;QACPC,QAAQ;IACV;IACA,IAAIT,cAAc,GAAG,OAAOK;IAC5B,IAAIK;IACJ,IAAI;QACFA,UAAU,MAAMlB,UAAUmB,cAAc,CAAC,OAAOC;YAC9C,MAAMC,aAAapB,QAAQqB,UAAU,CAAC,YAAYC,GAAG,CAACpB;YACtD,MAAMqB,WAAW,MAAMJ,YAAYK,GAAG,CAACJ;YACvC,IAAI,EAACG,4BAAAA,SAAUE,MAAM,GAAE,OAAOb;YAC9B,MAAME,SAASlB,cAAc8B,iBAAiB,CAACH,SAASI,IAAI;YAC5D,MAAMC,UAAUd,OAAOe,QAAQ,CAACC,IAAI,CAClC,CAACC,UAAYA,QAAQC,EAAE,KAAK7B,aAAa4B,QAAQE,SAAS,IAAI;YAEhE,IAAI,CAACL,SAAS,OAAOhB;YACrB,MAAMiB,WAAWjC,cAAcsC,sBAAsB,CACnDpB,QACAX,WACAI,WACAF;YAEF,yEAAyE;YACzE,qDAAqD;YACrD,MAAMQ,UAAUjB,cAAcuC,4BAA4B,CACxDrB,QACAX,WACAI,WACAF;YAEF,MAAMU,QAAQ,aAAKD;gBAAQe;;YAC3BV,YAAYiB,GAAG,CACbhB,YACA;gBACES;gBACAI,WAAWrC,cAAcyC,gBAAgB,CAACtB;YAC5C,GACA;gBAAEuB,OAAO;YAAK;YAEhB,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,+CAA+C;YAC/C,IAAIhC,QAAQ;gBACVa,YAAYiB,GAAG,CACbpC,QAAQqB,UAAU,CAAC,wBAAwBC,GAAG,IAC9C;oBACEpB;oBACAC;oBACAoC,OAAOhC;mBACHM,YAAYN,YAAY;oBAAEiC,cAAc3B;gBAAQ,IAAI,CAAC;oBACzD4B,QAAQnC,OAAOmC,MAAM;oBACrBC,SAASpC,OAAOoC,OAAO;mBACnBrC,aAAa;oBAAEA;gBAAW,IAAI,CAAC;oBACnCsC,MAAMC,KAAKC,GAAG;;YAGpB;YACA,OAAO;gBAAEhC;gBAASN;gBAAWO;gBAAQC;gBAAOC,QAAQ;YAAM;QAC5D;IACF,EAAE,OAAO8B,OAAO;QACd,4EAA4E;QAC5E,0EAA0E;QAC1E,2DAA2D;QAC3DC,QAAQD,KAAK,CAAC,0BAA0B7C,QAAQC,WAAWC,WAAW2C;QACtE,OAAO,aAAKlC;YAASI,QAAQ;;IAC/B;IACA,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,wEAAwE;IACxE,sCAAsC;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAMgC,QAAQ/B,QAAQJ,OAAO,GAAGI,QAAQV,SAAS;IACjD,IACEyC,QAAQ,KACR/B,QAAQH,MAAM,IACdG,QAAQH,MAAM,CAACmC,cAAc,KAAK,aAClC;QACA,KAAKtD,mBAAmBM,QAAQ;YAC9BiD,MAAM;YACNC,OAAO,CAAC,WAAW,EAAElC,QAAQH,MAAM,CAACsC,IAAI,EAAE;YAC1CC,MACE,GAAG7C,KAAKC,GAAG,CAACQ,QAAQV,SAAS,EAAE,OAAO,EAAEC,KAAKC,GAAG,CAACQ,QAAQJ,OAAO,EAAE,CAAC,CAAC,GACpE,CAAC,oBAAoB,EAAEmC,MAAM,KAAK,EAAEA,UAAU,IAAI,KAAK,IAAI,UAAU,CAAC,GACtE;YACFM,MAAM,CAAC,CAAC,EAAErD,OAAO,SAAS,CAAC;QAC7B;IACF;IACA,OAAOgB;AACT"}

package/src/lib/server/reserve.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Reserve a stay (AGL-310): server-side quote + availability check,
+ * pending reservation doc, then a Stripe session for the deposit (or
+ * full amount) on the merchant's account. Webhook completion confirms
+ * the reservation; abandoned pending holds expire after 30 minutes and
+ * stop blocking the calendar.
+ */
+export declare const reserveHandler: PluginApiHandler;

package/src/lib/server/reserve.js

@@ -0,0 +1,426 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import * as Aglyn from "@aglyn/aglyn/server";
+import * as CommerceModel from "../model/index.js";
+import { claimAttempt } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { connectLinkageIsReady } from "@aglyn/tenant-data-admin/server/stripe-account-mode";
+/**
+ * Reserve a stay (AGL-310): server-side quote + availability check,
+ * pending reservation doc, then a Stripe session for the deposit (or
+ * full amount) on the merchant's account. Webhook completion confirms
+ * the reservation; abandoned pending holds expire after 30 minutes and
+ * stop blocking the calendar.
+ */ export const reserveHandler = async (req, res)=>{
+    var _req_body, _body_hostId, _body_resourceId, _body_checkInDayMs, _body_checkOutDayMs, _body_guestName, _body_guestEmail, _ref, _req_headers_idempotencykey;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    if (!process.env.STRIPE_SECRET_KEY) {
+        return res.status(501).json({
+            error: 'Payments are not configured.'
+        });
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const hostId = String((_body_hostId = body.hostId) != null ? _body_hostId : '');
+    const resourceId = String((_body_resourceId = body.resourceId) != null ? _body_resourceId : '');
+    const checkInDayMs = CommerceModel.toDayMs(Number((_body_checkInDayMs = body.checkInDayMs) != null ? _body_checkInDayMs : 0));
+    const checkOutDayMs = CommerceModel.toDayMs(Number((_body_checkOutDayMs = body.checkOutDayMs) != null ? _body_checkOutDayMs : 0));
+    const guestName = String((_body_guestName = body.guestName) != null ? _body_guestName : '').trim().slice(0, 120);
+    const guestEmail = String((_body_guestEmail = body.guestEmail) != null ? _body_guestEmail : '').trim().toLowerCase().slice(0, 120);
+    // One reservation attempt, minted by the widget (AGL-1697). Node lowercases
+    // incoming headers, but read both spellings — the plugin API request type
+    // makes no promise about casing.
+    const idempotencyKey = String((_ref = (_req_headers_idempotencykey = req.headers['idempotency-key']) != null ? _req_headers_idempotencykey : req.headers['Idempotency-Key']) != null ? _ref : '').trim().slice(0, 200);
+    if (!hostId || !resourceId || !checkInDayMs || !checkOutDayMs) {
+        return res.status(400).json({
+            error: 'Missing reservation details'
+        });
+    }
+    let claim = null;
+    try {
+        var _ref1, _ref2, _req_headers_referer;
+        var _ownerOrg_org, _ownerOrg_org1, _storeSnapshot_data;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        // Owner + payment readiness, HOISTED above the claim (AGL-1697): both are
+        // deterministic refusals a merchant fixes out of band, and neither should
+        // burn the guest's attempt key.
+        const ownerOrg = await getOrgForHost(hostId);
+        // Plan gate, re-asked per request exactly as the storefront checkout
+        // asks it (AGL-1873, the AGL-481 pattern): a lapsed org's storefront
+        // must not keep taking reservation deposits — at the free plan's 0%
+        // transaction fee — through the one shopper-facing commerce door that
+        // skipped the entitlement. Deterministic and merchant-side, so it sits
+        // here above the claim with the readiness check.
+        if (!Aglyn.checkEntitlement(ownerOrg == null ? void 0 : ownerOrg.org, 'commerce')) {
+            return res.status(403).json({
+                error: 'Reservations are not enabled'
+            });
+        }
+        const ownerId = ownerOrg == null ? void 0 : (_ownerOrg_org = ownerOrg.org) == null ? void 0 : _ownerOrg_org.ownerUid;
+        const ownerProfile = ownerId ? await firestore.collection('profiles').doc(String(ownerId)).get() : null;
+        const accountId = ownerProfile == null ? void 0 : ownerProfile.get('stripeAccountId');
+        if (!connectLinkageIsReady({
+            accountId,
+            chargesEnabled: ownerProfile == null ? void 0 : ownerProfile.get('stripeChargesEnabled'),
+            accountLivemode: ownerProfile == null ? void 0 : ownerProfile.get('stripeAccountLivemode')
+        }, {
+            subject: `reserve host ${hostId}`
+        })) {
+            return res.status(409).json({
+                error: 'Payments are not set up yet'
+            });
+        }
+        // The claim sits ABOVE the availability read, and that placement is the
+        // fix for this handler's particular lie (AGL-1697): a retried attempt used
+        // to collide with its OWN 30-minute pending hold and be told "Those dates
+        // just sold out" — about dates the guest was holding — where the correct
+        // answer was the original session URL. Replaying here means the retry
+        // never reaches the availability check at all. Every refusal below the
+        // claim releases it, because each is deterministic and retryable.
+        const claimed = await claimAttempt(firestore, {
+            kind: 'commerce-reserve',
+            scopeId: hostId,
+            orgId: String((_ref1 = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.id) != null ? _ref1 : ''),
+            key: idempotencyKey,
+            busyMessage: 'This reservation is already being processed'
+        });
+        if ('replay' in claimed) {
+            return res.status(claimed.replay.status).json(claimed.replay.body);
+        }
+        claim = claimed.claim;
+        // ONLY STAYS THAT COULD STILL OVERLAP, NEAREST FIRST (AGL-2159).
+        //
+        // This was `.where('resourceId','==',resourceId).limit(500)` with no
+        // ordering, so Firestore returned 500 documents in `__name__` order — an
+        // arbitrary slice of the resource's ENTIRE booking history. Every stay the
+        // resource has ever had competed for those 500 slots on equal terms with
+        // the ones that matter, so a cottage that had taken 500 bookings began
+        // silently dropping LIVE reservations out of its own availability check
+        // and confirming a second guest into an occupied room. Nothing about that
+        // failure is visible: `isRangeAvailable` is handed a short list and
+        // answers, correctly, that the range is free.
+        //
+        // `checkOutDayMs > checkInDayMs` is the one inequality that removes the
+        // whole of the past — a stay that ended before the requested arrival
+        // cannot overlap it — and ordering by the same field puts the stays
+        // nearest the requested window at the front of the limit rather than
+        // whichever ones happen to sort early by id. Needs the composite index
+        // `reservations (resourceId ASC, checkOutDayMs ASC)`, added to
+        // `cloud/firebase-firestore.indexes.json` and pinned by
+        // `reserve-availability-indexes.spec.ts` — an equality plus an `orderBy`
+        // on a second field is exactly the shape that reads as free and is not
+        // (AGL-1793), and here a missing index throws rather than under-reporting.
+        //
+        // RESIDUAL, stated: the cap can still bite when a single resource holds
+        // more than 500 stays that all end between the requested arrival and the
+        // end of a genuinely overlapping one. That is a far narrower window than
+        // "500 bookings in this resource's lifetime", but it is not zero, and the
+        // sweep that would keep expired `pending` holds from filling those slots
+        // is a scheduled job this change does not add (see the commit).
+        const availabilityQuery = hostRef.collection('reservations').where('resourceId', '==', resourceId).where('checkOutDayMs', '>', checkInDayMs).orderBy('checkOutDayMs').limit(500);
+        const [resourceSnapshot, reservationsSnapshot, storeSnapshot] = await Promise.all([
+            hostRef.collection('resources').doc(resourceId).get(),
+            availabilityQuery.get(),
+            // The merchant's own lodging rate (AGL-1969). Read in the SAME round
+            // trip as the availability query rather than as a fourth sequential
+            // await — this path already runs three reads before it can answer, and
+            // a tax lookup is not a reason to make a guest wait for a fourth.
+            hostRef.collection('settings').doc('store').get()
+        ]);
+        const resource = resourceSnapshot.data();
+        if (!resource) {
+            await claim.release();
+            return res.status(404).json({
+                error: 'Unknown resource'
+            });
+        }
+        // Pending holds block for 30 minutes only, so abandoned checkouts
+        // release the dates. The lapse itself lives in
+        // `reservationHoldsDates`, which `isRangeAvailable` applies — this reads
+        // the fields that rule needs and leaves the rule to the model, so the
+        // storefront's date-picker cannot answer a different question from the
+        // door that takes the money.
+        //
+        // Extracted so the pre-read below and the re-read inside the booking
+        // transaction cannot drift apart (AGL-2450). Two copies of a filter that
+        // decides whether a room is free is exactly the shape where one of them
+        // quietly stops matching the other.
+        const readLive = (snapshot)=>snapshot.docs.map((docSnapshot)=>{
+                var _docSnapshot_get;
+                return {
+                    checkInDayMs: Number(docSnapshot.get('checkInDayMs')),
+                    checkOutDayMs: Number(docSnapshot.get('checkOutDayMs')),
+                    status: String(docSnapshot.get('status')),
+                    createdAtMs: Number((_docSnapshot_get = docSnapshot.get('createdAtMs')) != null ? _docSnapshot_get : 0)
+                };
+            });
+        const now = Date.now();
+        const live = readLive(reservationsSnapshot);
+        if (!CommerceModel.isRangeAvailable(resource, live, checkInDayMs, checkOutDayMs, now)) {
+            // A GENUINE sold-out (a keyed retry replayed before reaching here). The
+            // guest picks other dates or the blocking stay is cancelled; either way
+            // the key must survive the refusal.
+            await claim.release();
+            return res.status(409).json({
+                error: 'Those dates just sold out'
+            });
+        }
+        const quote = CommerceModel.computeReservationQuote(resource, checkInDayMs, checkOutDayMs);
+        if (quote.problem) {
+            await claim.release();
+            return res.status(400).json({
+                error: quote.problem
+            });
+        }
+        const chargeCents = quote.depositCents || quote.totalCents;
+        // NO DISCOUNT IS APPLIED HERE, AND THAT IS AN OPEN QUESTION RATHER THAN AN
+        // OVERSIGHT (AGL-305).
+        //
+        // `hosts/{hostId}/discounts` reaches the cart, buy-now, the draft-order
+        // payment link and the register. This door was deliberately left out,
+        // because unlike those four it does not take a payment for goods — it takes
+        // a DEPOSIT against a stay that is settled later, and "apply 10% off" has
+        // three different meanings against that shape:
+        //
+        //   1. Discount the STAY. `quote.totalCents` falls, the deposit falls with
+        //      it because it is a percentage of the subtotal, and the balance falls
+        //      too. This is the only reading that is actually a discount on the
+        //      booking — and it reprices a merchant's lodging inventory from a
+        //      storefront promo code, which is a larger claim than any of the four
+        //      goods doors makes.
+        //   2. Discount the DEPOSIT only. Strictly worse than doing nothing: the
+        //      balance is computed downstream as `totalCents - paidCents`, so every
+        //      cent taken off at booking is billed straight back at check-out. The
+        //      guest would be shown a discount and then charged for it, which is
+        //      the silent-reversal shape this codebase refuses elsewhere.
+        //   3. Discount the BALANCE. Nothing visible at booking; the guest finds
+        //      out at the register. A promotion nobody can see when they buy is not
+        //      a promotion.
+        //
+        // What makes this a product decision and not an implementation one is that
+        // the balance is not collected by any door this repo can teach. It is read
+        // off the console's reservations card as `totalCents - paidCents` and
+        // collected BY A HUMAN at the till, so option 1 is the only one that
+        // survives the hand-off — and it survives it by changing the stay's stored
+        // price, which is the merchant's revenue basis and what their analytics,
+        // their folio and their register all read.
+        //
+        // The tax makes it sharper still. `lodgingTax` below is an occupancy rate,
+        // not a sales rate, and its basis here is already a STATED LIMITATION — it
+        // is charged on what is collected (the deposit) rather than on the stay.
+        // Layering a discount on top asks whether occupancy tax is owed on the
+        // discounted room rate or the gross one, which differs by jurisdiction, is
+        // the merchant's own regime to answer, and is not a question this handler
+        // can decide from a promo code.
+        //
+        // So: refusing to guess. A shopper who types a code here is not told it
+        // worked — this path never reads one, so there is nothing to fall through
+        // silently, which is the failure mode that mattered. When the owner picks
+        // a reading, option 1 is the one the machinery already supports: reduce
+        // `quote.subtotalCents` before the deposit is derived from it, and the
+        // deposit, the balance, the fee and the tax all follow without further
+        // change.
+        // LODGING TAX: the MERCHANT'S OWN RATE, off unless they set one
+        // (AGL-1969, answering the decision AGL-1953 recorded here).
+        //
+        // What this path used to do, and why it was only ever a holding position:
+        // it computed no tax in either store mode, on two stated grounds. The
+        // first is still true and is the reason for the shape below — a stay is
+        // not goods. The AGL-285 zone editor configures a SALES rate, lodging is
+        // an occupancy/hotel regime with its own rates, its own registration and
+        // its own return, and reading `rates[]` for a night would be confidently
+        // wrong rather than merely absent. Stripe Tax has the mirror problem: it
+        // needs a lodging tax code this handler does not send, so
+        // `automatic_tax` here would compute a goods rate on a room. Neither of
+        // those changes, and neither is used.
+        //
+        // What DID change is that the merchant now has a field of their own to
+        // answer in (`tax.lodging`), so "Aglyn does not know the right number"
+        // stops being a reason to collect nothing. They type the rate, we compute
+        // it, charge it, record it and stamp the regime; the settings card states
+        // plainly that determining what is owed and to whom is theirs. Aglyn
+        // takes no tax position here — this is the manual LODGING rate, which
+        // never touches Aglyn's registrations.
+        //
+        // ⚠️ This comment used to say "Terms §10.3 ... untouched by this". §10.3
+        // CHANGED on 2026-08-24 (AGL-1956): Aglyn accepts marketplace-facilitator
+        // status and new §10.7 makes storefront sales tax Aglyn's where it has a
+        // collection obligation. Lodging tax is still the merchant's, so this
+        // handler is unaffected — but §10.3 is no longer the authority for that.
+        //
+        // DEFAULT OFF, and that is load-bearing: `resolveFlatTaxCents` answers
+        // zero for an absent, zero, negative or out-of-range rate, so no existing
+        // reservation's charge moves because this shipped.
+        //
+        // THE BASIS IS WHAT IS CHARGED, AND THAT IS A STATED LIMITATION RATHER
+        // THAN AN ANSWER. `chargeCents` is `depositCents || totalCents`, so on a
+        // deposit-taking resource the tax collected here is the rate on the
+        // DEPOSIT, not on the stay. Whether a given jurisdiction wants occupancy
+        // tax on the full stay at booking, on the deposit only, or on redemption
+        // at check-out is a tax question, it differs by jurisdiction, and this
+        // code deliberately does NOT decide it — the amount the platform actually
+        // moves is the only basis available to it, the settings card says so in
+        // the merchant's own view, and the residual is on AGL-1969.
+        const taxSettings = (_ref2 = (_storeSnapshot_data = storeSnapshot.data()) == null ? void 0 : _storeSnapshot_data.tax) != null ? _ref2 : {};
+        const lodgingTax = CommerceModel.resolveFlatTaxCents(taxSettings.lodging, chargeCents, 'Lodging tax');
+        // Platform take PLUS Stripe's card cost at cost (AGL-2152). This is a
+        // destination charge, so Stripe debits its percentage plus 30¢ from the
+        // PLATFORM's balance; with the old take-only figure every tier carrying a
+        // 0% service rate paid Aglyn nothing and cost it that fee on each
+        // reservation.
+        //
+        // THE TWO BASES ARE NOW DIFFERENT NUMBERS (AGL-1969), and the split is
+        // AGL-2317's rule: the platform take is computed on the ITEMS — the stay
+        // — while Stripe's cost is passed through on the WHOLE charge, because
+        // that is what Stripe actually debits. Taking a percentage of the lodging
+        // tax would be taking a cut of the state's money, which no storefront
+        // path does. The previous single-argument form is what made this a real
+        // risk: it read as "the fee base is the charge" and would have silently
+        // started taxing the tax the moment a tax line appeared.
+        const feeCents = Aglyn.resolveTransactionFeeCents(ownerOrg == null ? void 0 : ownerOrg.org, 'service', chargeCents, chargeCents + lodgingTax.taxCents);
+        // THE HOLD IS TAKEN IN A TRANSACTION (AGL-2450).
+        //
+        // The check above is a fast refusal on a stale read, and on its own that is
+        // all it ever was: the availability query ran, the quote and the fee were
+        // computed, and only then did the hold land — so two guests requesting the
+        // same dates both read a reservation set that lacked the other's booking,
+        // both passed, and both got a `pending` row and a real payment. Nothing
+        // downstream caught it. The webhook's transaction guards double-CONFIRMATION
+        // of one booking against Stripe redelivery; it never re-asks availability,
+        // so both holds confirmed cleanly into two guests in one room.
+        //
+        // `claimAttempt` does not help either, and it is worth being explicit about
+        // why: it is keyed on the guest's own `Idempotency-Key`, so it dedupes
+        // retries of ONE attempt. Two different guests carry two different keys and
+        // never contend.
+        //
+        // Re-asking inside the transaction that writes is the whole guard — the
+        // same shape as `decrementVariantStock` (AGL-2320), and easier to justify
+        // here: the conflicting write lands BEFORE Stripe is contacted, so this
+        // door can legitimately refuse rather than take the money and withhold the
+        // room.
+        const reservationRef = hostRef.collection('reservations').doc();
+        const booked = await firestore.runTransaction(async (transaction)=>{
+            const fresh = await transaction.get(availabilityQuery);
+            // Re-timed, not reusing `now`: a transaction that retries under
+            // contention may run appreciably later, and the 30-minute pending window
+            // has to be measured from when this attempt actually commits.
+            if (!CommerceModel.isRangeAvailable(resource, readLive(fresh), checkInDayMs, checkOutDayMs, Date.now())) {
+                return false;
+            }
+            // `create()`, not `set()`: the ref is freshly minted, so an id collision
+            // is a bug rather than an overwrite to absorb silently.
+            transaction.create(reservationRef, {
+                resourceId,
+                status: 'pending',
+                checkInDayMs,
+                checkOutDayMs,
+                guestName: guestName || null,
+                guestEmail: guestEmail || null,
+                nights: quote.nights,
+                totalCents: quote.totalCents,
+                depositCents: quote.depositCents,
+                paidCents: 0,
+                createdAtMs: now
+            });
+            return true;
+        });
+        if (!booked) {
+            // Lost the race for these dates. Same refusal as the pre-read's, and the
+            // key survives it for the same reason: the guest picks other dates or the
+            // blocking stay is cancelled.
+            await claim.release();
+            return res.status(409).json({
+                error: 'Those dates just sold out'
+            });
+        }
+        const referer = String((_req_headers_referer = req.headers.referer) != null ? _req_headers_referer : '');
+        const origin = `https://${req.headers.host}`;
+        const backUrl = referer.startsWith('http') ? referer : origin;
+        const separator = backUrl.includes('?') ? '&' : '?';
+        const params = new URLSearchParams(_extends({
+            mode: 'payment',
+            'line_items[0][quantity]': '1',
+            'line_items[0][price_data][currency]': 'usd',
+            'line_items[0][price_data][unit_amount]': String(chargeCents),
+            'line_items[0][price_data][product_data][name]': `${resource.name} — ${quote.nights} night${quote.nights === 1 ? '' : 's'}${quote.depositCents && quote.depositCents < quote.totalCents ? ' (deposit)' : ''}`.slice(0, 120)
+        }, lodgingTax.taxCents > 0 ? {
+            'line_items[1][quantity]': '1',
+            'line_items[1][price_data][currency]': 'usd',
+            'line_items[1][price_data][unit_amount]': String(lodgingTax.taxCents),
+            'line_items[1][price_data][product_data][name]': lodgingTax.label
+        } : {}, feeCents > 0 ? {
+            'payment_intent_data[application_fee_amount]': String(feeCents)
+        } : {}, {
+            'payment_intent_data[transfer_data][destination]': String(accountId)
+        }, guestEmail ? {
+            customer_email: guestEmail
+        } : {}, {
+            success_url: `${backUrl}${separator}reserved=1`,
+            cancel_url: `${backUrl}${separator}reserved=0`,
+            'metadata[type]': 'commerce-reservation',
+            'metadata[hostId]': hostId,
+            'metadata[reservationId]': reservationRef.id,
+            'metadata[feeCents]': String(feeCents)
+        }, lodgingTax.taxCents > 0 ? {
+            'metadata[taxCents]': String(lodgingTax.taxCents),
+            'metadata[taxPct]': String(lodgingTax.pct)
+        } : {}));
+        const response = await fetch('https://api.stripe.com/v1/checkout/sessions', {
+            method: 'POST',
+            headers: _extends({
+                Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
+                'Content-Type': 'application/x-www-form-urlencoded'
+            }, claim.stripeKey ? {
+                'Idempotency-Key': claim.stripeKey
+            } : {}),
+            body: params.toString()
+        });
+        const session = await response.json();
+        if (!response.ok || !session.url) {
+            console.error('Stripe reservation error', session.error);
+            await reservationRef.delete().catch(()=>undefined);
+            // The hold is rolled back, so the key must come back too — the guest
+            // presses the same button and the retry re-derives the same digest,
+            // which Stripe replays if the session did get created.
+            await claim.release();
+            return res.status(502).json({
+                error: 'Payment setup failed'
+            });
+        }
+        const payload = {
+            url: session.url
+        };
+        await claim.record(200, payload);
+        return res.status(200).json(payload);
+    } catch (error) {
+        console.error(error);
+        // Release on the way out so a transient failure does not strand the key
+        // (AGL-1691's rule): the hold may or may not have landed, and it expires
+        // in 30 minutes either way.
+        await (claim == null ? void 0 : claim.release());
+        return res.status(500).json({
+            error: 'Reservation failed'
+        });
+    }
+};
+
+//# sourceMappingURL=reserve.js.map