@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/storefront-tax.js

@@ -0,0 +1,245 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * What a storefront sale's TAX decomposes to (AGL-1904) — the record that
+ * makes tax collected on a merchant's sale visible to Aglyn's own return.
+ *
+ * ## The observation this module exists to record
+ *
+ * Every storefront checkout — cart, buy-now, subscription — creates its
+ * Checkout Session on the PLATFORM account: platform secret key, no
+ * `Stripe-Account` header, no `on_behalf_of`, with
+ * `payment_intent_data[transfer_data][destination]` pointing at the merchant's
+ * connected account. `cart-checkout.ts` and `checkout.ts` then set
+ * `automatic_tax[enabled]` when the store's tax mode is `stripe`.
+ *
+ * That was long suspected to mean Stripe Tax computes the shopper's tax
+ * against AGLYN's registrations rather than the merchant's. It was MEASURED on
+ * 2026-08-18, in test mode, as a two-arm experiment on exactly that session
+ * shape (a $100 line, a Texas shopper address, `transfer_data[destination]`
+ * set):
+ *
+ *   - **Platform unregistered, destination connected account registered in
+ *     TX** → `amount_tax: 0`, one breakdown line with
+ *     `taxability_reason: "not_collecting"`, `taxable_amount: 0`.
+ *   - **Platform registered in TX, everything else byte-identical** →
+ *     `amount_tax: 825`, `taxability_reason: "standard_rated"`,
+ *     `taxable_amount: 10000`, rate 8.25% "Texas".
+ *
+ * Both sessions reported `automatic_tax.liability: { type: "self" }` — Stripe's
+ * own word for "the account this session was created on is the one liable".
+ * `transfer_data[destination]` had no effect on tax in either arm.
+ *
+ * So on a `mode: 'stripe'` store the tax charged to the shopper is computed on
+ * Aglyn's registration footprint, lands in Aglyn's platform balance, and is
+ * Aglyn's to remit. The live platform account has held an ACTIVE Texas state
+ * sales tax registration since 2026-08-17, so this is not hypothetical.
+ *
+ * **This module describes that mechanism and records the money.** Aglyn IS a
+ * marketplace facilitator for storefront sales, and the published Terms say so
+ * at §10.7 (AGL-1956). Facilitator status still attaches by operation of
+ * law rather than by our say-so, and §10.7 is deliberately narrow — Aglyn
+ * collects and remits **where applicable law gives it an obligation**, not
+ * universally — so this module still records the mechanism per sale and does
+ * not stamp a per-merchant or per-jurisdiction verdict on any row.
+ *
+ * ## The two store modes are DIFFERENT FACTS and must never be summed
+ *
+ * `taxMode` is the whole point of this record, and it is derived from
+ * `automatic_tax.enabled` — **never** from whether tax lines are present:
+ *
+ *   - **`stripe-automatic`** — Stripe Tax computed it, against whichever
+ *     account `automatic_tax.liability` names. When that is `platform`, the
+ *     money is held under Aglyn's registration.
+ *   - **`manual`** — the merchant's own configured rate
+ *     (`checkout.ts` / `pos-order.ts`), applied to the merchant's own declared
+ *     origin. Aglyn's registrations never enter into it and the amount is not
+ *     Aglyn's to remit.
+ *
+ * The trap that makes the `automatic_tax.enabled` discriminator load-bearing:
+ * a MANUAL-mode subscription renewal carries a real Stripe Tax Rate (AGL-1751
+ * attaches one so the tax recurs), so its invoice arrives with a populated
+ * `total_taxes[]` — indistinguishable from a Stripe Tax invoice if you look at
+ * the tax lines. Summing tax lines would silently book merchant-configured tax
+ * as Aglyn-collected. **Read the flag, not the lines.**
+ *
+ * ## The taxable base is kept, never inferred
+ *
+ * `taxable_amount` is what a return reports as "taxable sales". Deriving it as
+ * `amount ÷ rate` needs a live read to resolve the rate id and rounds wrong at
+ * the edges, so it is stored when Stripe states it and left `null` when it
+ * does not — and a row whose base cannot be read is COUNTED OUT LOUD by the
+ * return rather than treated as a zero-base sale.
+ *
+ * A Checkout Session's `total_details.breakdown` is not in the webhook payload
+ * and must be re-read with `expand[]=total_details.breakdown`; an invoice
+ * carries `total_taxes[]` inline. Both land in the same `taxLines` shape.
+ *
+ * Pure and total: unreadable input answers `null`, never throws — a recording
+ * failure must never 500 a webhook into redelivery.
+ */ import { storefrontTaxMode } from "../model/commerce-tax-decision.js";
+function asCents(value) {
+    const cents = Number(value != null ? value : 0);
+    return Number.isFinite(cents) ? Math.round(cents) : 0;
+}
+function asStringOrNull(value) {
+    return typeof value === 'string' && value ? value : null;
+}
+function asNumberOrNull(value) {
+    const parsed = Number(value != null ? value : NaN);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+/** Seconds-since-epoch to Date, or null for anything unreadable. */ function asDate(value) {
+    const seconds = Number(value != null ? value : NaN);
+    return Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * 1000) : null;
+}
+function address(source) {
+    if (!source || typeof source !== 'object') return null;
+    return {
+        country: asStringOrNull(source.country),
+        state: asStringOrNull(source.state),
+        city: asStringOrNull(source.city),
+        postalCode: asStringOrNull(source.postal_code)
+    };
+}
+/**
+ * The breakdown entries, from either shape.
+ *
+ * A Checkout Session expands them under `total_details.breakdown.taxes[]`
+ * with the rate object inline; an invoice carries `total_taxes[]` (rate under
+ * `tax_rate_details.tax_rate`) or the older `total_tax_amounts[]` (`tax_rate`,
+ * an id or an expanded object). All three map onto one stored line.
+ */ function taxLines(source) {
+    var _source_total_details_breakdown, _source_total_details;
+    const entries = Array.isArray(source == null ? void 0 : (_source_total_details = source.total_details) == null ? void 0 : (_source_total_details_breakdown = _source_total_details.breakdown) == null ? void 0 : _source_total_details_breakdown.taxes) ? source.total_details.breakdown.taxes : Array.isArray(source == null ? void 0 : source.total_taxes) ? source.total_taxes : Array.isArray(source == null ? void 0 : source.total_tax_amounts) ? source.total_tax_amounts : [];
+    return entries.map((entry)=>{
+        var _ref, _ref1, _ref2, _asStringOrNull, _asNumberOrNull;
+        var _entry_tax_rate_details;
+        const rate = (_ref = (_ref1 = entry == null ? void 0 : entry.rate) != null ? _ref1 : entry == null ? void 0 : (_entry_tax_rate_details = entry.tax_rate_details) == null ? void 0 : _entry_tax_rate_details.tax_rate) != null ? _ref : entry == null ? void 0 : entry.tax_rate;
+        const rateObject = rate && typeof rate === 'object' ? rate : null;
+        // Distinguish an absent `taxable_amount` from a genuine zero: a zero base
+        // is a real fact (`not_collecting`), an absent one means the base is
+        // UNKNOWN, and the return has to be able to tell those apart.
+        const taxableAmount = Number((_ref2 = entry == null ? void 0 : entry.taxable_amount) != null ? _ref2 : NaN);
+        return {
+            amountCents: asCents(entry == null ? void 0 : entry.amount),
+            taxabilityReason: asStringOrNull(entry == null ? void 0 : entry.taxability_reason),
+            taxRateId: (_asStringOrNull = asStringOrNull(rate)) != null ? _asStringOrNull : asStringOrNull(rateObject == null ? void 0 : rateObject.id),
+            taxableAmountCents: Number.isFinite(taxableAmount) ? Math.round(taxableAmount) : null,
+            jurisdiction: asStringOrNull(rateObject == null ? void 0 : rateObject.jurisdiction),
+            rateState: asStringOrNull(rateObject == null ? void 0 : rateObject.state),
+            percentage: (_asNumberOrNull = asNumberOrNull(rateObject == null ? void 0 : rateObject.effective_percentage)) != null ? _asNumberOrNull : asNumberOrNull(rateObject == null ? void 0 : rateObject.percentage)
+        };
+    });
+}
+/** Sum of the stored lines' amounts. */ function sumLines(lines) {
+    return lines.reduce((sum, line)=>sum + line.amountCents, 0);
+}
+/**
+ * Reads the tax off one paid session or invoice — the SINGLE derivation, and
+ * the reason it is its own exported function (AGL-2451).
+ *
+ * `storefrontTaxRow` builds the `storefrontTaxCollected` record from it, and
+ * the four order-writing doors in `billing-webhook.ts` stamp `HostOrder.taxMode`
+ * from it, so an order and the row filed for the same Stripe id cannot state
+ * different regimes. Re-deriving the mode beside a second reading of the same
+ * object is exactly how the two would drift.
+ *
+ * Pure and total: unreadable input answers `taxMode: 'none'`, never throws.
+ */ export function resolveStorefrontTax(object, manualTaxCents = 0) {
+    var _ref, _ref1;
+    var _source_automatic_tax, _source_total_details, _source_total_details1;
+    const source = object;
+    const automatic = (source == null ? void 0 : (_source_automatic_tax = source.automatic_tax) == null ? void 0 : _source_automatic_tax.enabled) === true;
+    const lines = automatic ? taxLines(source) : [];
+    const manualCents = Math.max(0, asCents(manualTaxCents));
+    // The flag, never the lines — see the module note. A manual-mode
+    // subscription renewal carries real Stripe tax rates in `total_taxes[]`,
+    // and booking those as Aglyn-collected would be the whole defect restated.
+    //
+    // Read on SESSIONS as well as invoices since AGL-1953: the cart and
+    // draft-order paths now carry their manual tax as a real Stripe Tax Rate on
+    // the line (the construction that survives a session-level coupon), so a
+    // manual session reports a genuine `total_details.amount_tax`. The scalar is
+    // the fallback because `total_details.breakdown` is expandable and absent
+    // unless the recorder re-read it. Buy-now's `line_items[1]` construction
+    // reports 0 in both shapes and still answers from `manualTaxCents` below.
+    const manualLineCents = !automatic ? sumLines(taxLines(source)) || asCents((_ref = source == null ? void 0 : (_source_total_details = source.total_details) == null ? void 0 : _source_total_details.amount_tax) != null ? _ref : source == null ? void 0 : source.tax) : 0;
+    const taxCents = automatic ? // invoice. Prefer the summed lines when they exist (a computed invoice
+    // can send a 0/null scalar beside a populated array — AGL-1811's
+    // measurement), and fall back to the scalar shapes otherwise.
+    lines.length > 0 ? sumLines(lines) : asCents((_ref1 = source == null ? void 0 : (_source_total_details1 = source.total_details) == null ? void 0 : _source_total_details1.amount_tax) != null ? _ref1 : source == null ? void 0 : source.tax) : Math.max(manualCents, manualLineCents);
+    return {
+        automatic,
+        lines,
+        taxCents,
+        taxMode: storefrontTaxMode({
+            automatic,
+            taxCents
+        })
+    };
+}
+/**
+ * Just the regime, for the order-writing doors (AGL-2451). Delegates, so this
+ * is the same answer the filed tax record gives for the same object.
+ */ export function storefrontTaxModeOf(object, manualTaxCents = 0) {
+    return resolveStorefrontTax(object, manualTaxCents).taxMode;
+}
+/**
+ * Decomposes a paid storefront session or invoice into the stored row, or
+ * `null` when there is no host to attribute it to.
+ *
+ * The caller decides WHICH objects reach this — the commerce webhook
+ * self-selects on `metadata.type`, exactly as every other section does.
+ */ export function storefrontTaxRow(object, context) {
+    var _ref, _ref1, _ref2, _asStringOrNull, _asStringOrNull1, _asStringOrNull2, _address, _asDate;
+    var _source_automatic_tax_liability, _source_automatic_tax, _source_payment_intent_data_transfer_data, _source_payment_intent_data, _source_transfer_data, _source_metadata, _source_subscription_details_metadata, _source_subscription_details, _source_parent_subscription_details_metadata, _source_parent_subscription_details, _source_parent, _source_customer_details, _source_status_transitions;
+    const source = object;
+    const hostId = String((_ref = context == null ? void 0 : context.hostId) != null ? _ref : '');
+    if (!hostId) return null;
+    const { automatic, lines, taxCents, taxMode } = resolveStorefrontTax(source, context == null ? void 0 : context.manualTaxCents);
+    const liabilityType = asStringOrNull(source == null ? void 0 : (_source_automatic_tax = source.automatic_tax) == null ? void 0 : (_source_automatic_tax_liability = _source_automatic_tax.liability) == null ? void 0 : _source_automatic_tax_liability.type);
+    const taxLiability = !automatic ? null : liabilityType === 'account' ? 'connected-account' : // older API versions, where the only account a session could be
+    // liable under is the one it was created on — the platform.
+    'platform';
+    const grossCents = asCents(context.kind === 'invoice' ? source == null ? void 0 : source.amount_paid : source == null ? void 0 : source.amount_total);
+    const transferDestination = (_ref1 = source == null ? void 0 : (_source_payment_intent_data = source.payment_intent_data) == null ? void 0 : (_source_payment_intent_data_transfer_data = _source_payment_intent_data.transfer_data) == null ? void 0 : _source_payment_intent_data_transfer_data.destination) != null ? _ref1 : source == null ? void 0 : (_source_transfer_data = source.transfer_data) == null ? void 0 : _source_transfer_data.destination;
+    return {
+        kind: context.kind,
+        hostId,
+        metadataType: (_ref2 = (_asStringOrNull = asStringOrNull(source == null ? void 0 : (_source_metadata = source.metadata) == null ? void 0 : _source_metadata.type)) != null ? _asStringOrNull : asStringOrNull(source == null ? void 0 : (_source_subscription_details = source.subscription_details) == null ? void 0 : (_source_subscription_details_metadata = _source_subscription_details.metadata) == null ? void 0 : _source_subscription_details_metadata.type)) != null ? _ref2 : asStringOrNull(source == null ? void 0 : (_source_parent = source.parent) == null ? void 0 : (_source_parent_subscription_details = _source_parent.subscription_details) == null ? void 0 : (_source_parent_subscription_details_metadata = _source_parent_subscription_details.metadata) == null ? void 0 : _source_parent_subscription_details_metadata.type),
+        taxMode,
+        taxLiability,
+        connectedAccountId: (_asStringOrNull1 = asStringOrNull(transferDestination)) != null ? _asStringOrNull1 : asStringOrNull(transferDestination == null ? void 0 : transferDestination.id),
+        grossCents,
+        taxCents,
+        netCents: grossCents - taxCents,
+        currency: (_asStringOrNull2 = asStringOrNull(source == null ? void 0 : source.currency)) != null ? _asStringOrNull2 : 'usd',
+        customerAddress: (_address = address(source == null ? void 0 : (_source_customer_details = source.customer_details) == null ? void 0 : _source_customer_details.address)) != null ? _address : address(source == null ? void 0 : source.customer_address),
+        // Stripe's OWN breakdown, whenever Stripe stated one — never an invented
+        // base. Buy-now's manual construction states none (Stripe was never told
+        // the line was tax) and answers `[]`, which is the honest answer. The
+        // cart, draft-order and subscription-renewal manual paths carry a real
+        // Tax Rate, so Stripe DOES state a `taxable_amount` for them, and keeping
+        // it gives `merchantManual` a real taxable-sales figure instead of a
+        // permanent zero (AGL-1953). It never reaches the Aglyn-liable bucket:
+        // the classification above is the flag, not these lines.
+        taxLines: automatic ? lines : taxLines(source),
+        paidAt: (_asDate = asDate(source == null ? void 0 : (_source_status_transitions = source.status_transitions) == null ? void 0 : _source_status_transitions.paid_at)) != null ? _asDate : asDate(source == null ? void 0 : source.created)
+    };
+}
+
+//# sourceMappingURL=storefront-tax.js.map

package/src/lib/server/storefront-tax.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/storefront-tax.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * What a storefront sale's TAX decomposes to (AGL-1904) — the record that\n * makes tax collected on a merchant's sale visible to Aglyn's own return.\n *\n * ## The observation this module exists to record\n *\n * Every storefront checkout — cart, buy-now, subscription — creates its\n * Checkout Session on the PLATFORM account: platform secret key, no\n * `Stripe-Account` header, no `on_behalf_of`, with\n * `payment_intent_data[transfer_data][destination]` pointing at the merchant's\n * connected account. `cart-checkout.ts` and `checkout.ts` then set\n * `automatic_tax[enabled]` when the store's tax mode is `stripe`.\n *\n * That was long suspected to mean Stripe Tax computes the shopper's tax\n * against AGLYN's registrations rather than the merchant's. It was MEASURED on\n * 2026-08-18, in test mode, as a two-arm experiment on exactly that session\n * shape (a $100 line, a Texas shopper address, `transfer_data[destination]`\n * set):\n *\n *   - **Platform unregistered, destination connected account registered in\n *     TX** → `amount_tax: 0`, one breakdown line with\n *     `taxability_reason: \"not_collecting\"`, `taxable_amount: 0`.\n *   - **Platform registered in TX, everything else byte-identical** →\n *     `amount_tax: 825`, `taxability_reason: \"standard_rated\"`,\n *     `taxable_amount: 10000`, rate 8.25% \"Texas\".\n *\n * Both sessions reported `automatic_tax.liability: { type: \"self\" }` — Stripe's\n * own word for \"the account this session was created on is the one liable\".\n * `transfer_data[destination]` had no effect on tax in either arm.\n *\n * So on a `mode: 'stripe'` store the tax charged to the shopper is computed on\n * Aglyn's registration footprint, lands in Aglyn's platform balance, and is\n * Aglyn's to remit. The live platform account has held an ACTIVE Texas state\n * sales tax registration since 2026-08-17, so this is not hypothetical.\n *\n * **This module describes that mechanism and records the money.** Aglyn IS a\n * marketplace facilitator for storefront sales, and the published Terms say so\n * at §10.7 (AGL-1956). Facilitator status still attaches by operation of\n * law rather than by our say-so, and §10.7 is deliberately narrow — Aglyn\n * collects and remits **where applicable law gives it an obligation**, not\n * universally — so this module still records the mechanism per sale and does\n * not stamp a per-merchant or per-jurisdiction verdict on any row.\n *\n * ## The two store modes are DIFFERENT FACTS and must never be summed\n *\n * `taxMode` is the whole point of this record, and it is derived from\n * `automatic_tax.enabled` — **never** from whether tax lines are present:\n *\n *   - **`stripe-automatic`** — Stripe Tax computed it, against whichever\n *     account `automatic_tax.liability` names. When that is `platform`, the\n *     money is held under Aglyn's registration.\n *   - **`manual`** — the merchant's own configured rate\n *     (`checkout.ts` / `pos-order.ts`), applied to the merchant's own declared\n *     origin. Aglyn's registrations never enter into it and the amount is not\n *     Aglyn's to remit.\n *\n * The trap that makes the `automatic_tax.enabled` discriminator load-bearing:\n * a MANUAL-mode subscription renewal carries a real Stripe Tax Rate (AGL-1751\n * attaches one so the tax recurs), so its invoice arrives with a populated\n * `total_taxes[]` — indistinguishable from a Stripe Tax invoice if you look at\n * the tax lines. Summing tax lines would silently book merchant-configured tax\n * as Aglyn-collected. **Read the flag, not the lines.**\n *\n * ## The taxable base is kept, never inferred\n *\n * `taxable_amount` is what a return reports as \"taxable sales\". Deriving it as\n * `amount ÷ rate` needs a live read to resolve the rate id and rounds wrong at\n * the edges, so it is stored when Stripe states it and left `null` when it\n * does not — and a row whose base cannot be read is COUNTED OUT LOUD by the\n * return rather than treated as a zero-base sale.\n *\n * A Checkout Session's `total_details.breakdown` is not in the webhook payload\n * and must be re-read with `expand[]=total_details.breakdown`; an invoice\n * carries `total_taxes[]` inline. Both land in the same `taxLines` shape.\n *\n * Pure and total: unreadable input answers `null`, never throws — a recording\n * failure must never 500 a webhook into redelivery.\n */\n\nimport {\n  storefrontTaxMode,\n  type StorefrontTaxMode,\n} from '../model/commerce-tax-decision'\n\n/**\n * Which machinery produced the tax on this sale. See the module note.\n *\n * The union and its derivation live in the MODEL since AGL-2451, because the\n * merchant's order document now carries the same fact (`HostOrder.taxMode`)\n * and two copies of a rule that must agree are one copy too many. Re-exported\n * here so this module stays the place the mechanism is documented.\n */\nexport type { StorefrontTaxMode }\n\n/**\n * Whose registrations Stripe Tax computed against, from\n * `automatic_tax.liability.type`: `self` (the account the object lives on,\n * i.e. Aglyn's platform) or `account` (a named connected account).\n * Null whenever `taxMode` is not `stripe-automatic`.\n */\nexport type StorefrontTaxLiability = 'platform' | 'connected-account'\n\n/** One entry of the stored tax breakdown. */\nexport interface StorefrontTaxLine {\n  amountCents: number\n  /** Stripe's stated reason, e.g. `standard_rated`, `not_collecting`. */\n  taxabilityReason: string | null\n  taxRateId: string | null\n  /** Stripe's `taxable_amount`; null when the shape did not carry it. */\n  taxableAmountCents: number | null\n  /** e.g. `Texas` — from the expanded rate, for the working papers. */\n  jurisdiction: string | null\n  /** The rate's own state code, which is not the shopper's address. */\n  rateState: string | null\n  percentage: number | null\n}\n\n/** The per-transaction record `storefrontTaxCollected/{stripeId}` stores. */\nexport interface StorefrontTaxRow {\n  /** `session` for one-time sales, `invoice` for subscription cycles. */\n  kind: 'session' | 'invoice'\n  hostId: string\n  /** The commerce path — `commerce-cart`, `commerce-order`, … */\n  metadataType: string | null\n  taxMode: StorefrontTaxMode\n  taxLiability: StorefrontTaxLiability | null\n  /** The merchant's connected account, when the object names one. */\n  connectedAccountId: string | null\n  /** What the shopper actually paid, tax included. */\n  grossCents: number\n  taxCents: number\n  /** Gross minus tax. NOT Aglyn's revenue — most of it is the merchant's. */\n  netCents: number\n  currency: string\n  /** The jurisdiction input — the shopper's address on the Stripe object. */\n  customerAddress: {\n    country: string | null\n    state: string | null\n    city: string | null\n    postalCode: string | null\n  } | null\n  taxLines: StorefrontTaxLine[]\n  paidAt: Date | null\n}\n\nfunction asCents(value: unknown): number {\n  const cents = Number(value ?? 0)\n  return Number.isFinite(cents) ? Math.round(cents) : 0\n}\n\nfunction asStringOrNull(value: unknown): string | null {\n  return typeof value === 'string' && value ? value : null\n}\n\nfunction asNumberOrNull(value: unknown): number | null {\n  const parsed = Number(value ?? NaN)\n  return Number.isFinite(parsed) ? parsed : null\n}\n\n/** Seconds-since-epoch to Date, or null for anything unreadable. */\nfunction asDate(value: unknown): Date | null {\n  const seconds = Number(value ?? NaN)\n  return Number.isFinite(seconds) && seconds > 0\n    ? new Date(seconds * 1000)\n    : null\n}\n\nfunction address(source: any): StorefrontTaxRow['customerAddress'] {\n  if (!source || typeof source !== 'object') return null\n  return {\n    country: asStringOrNull(source.country),\n    state: asStringOrNull(source.state),\n    city: asStringOrNull(source.city),\n    postalCode: asStringOrNull(source.postal_code),\n  }\n}\n\n/**\n * The breakdown entries, from either shape.\n *\n * A Checkout Session expands them under `total_details.breakdown.taxes[]`\n * with the rate object inline; an invoice carries `total_taxes[]` (rate under\n * `tax_rate_details.tax_rate`) or the older `total_tax_amounts[]` (`tax_rate`,\n * an id or an expanded object). All three map onto one stored line.\n */\nfunction taxLines(source: any): StorefrontTaxLine[] {\n  const entries: any[] = Array.isArray(source?.total_details?.breakdown?.taxes)\n    ? source.total_details.breakdown.taxes\n    : Array.isArray(source?.total_taxes)\n      ? source.total_taxes\n      : Array.isArray(source?.total_tax_amounts)\n        ? source.total_tax_amounts\n        : []\n  return entries.map((entry: any) => {\n    const rate = entry?.rate ?? entry?.tax_rate_details?.tax_rate ?? entry?.tax_rate\n    const rateObject = rate && typeof rate === 'object' ? rate : null\n    // Distinguish an absent `taxable_amount` from a genuine zero: a zero base\n    // is a real fact (`not_collecting`), an absent one means the base is\n    // UNKNOWN, and the return has to be able to tell those apart.\n    const taxableAmount = Number(entry?.taxable_amount ?? NaN)\n    return {\n      amountCents: asCents(entry?.amount),\n      taxabilityReason: asStringOrNull(entry?.taxability_reason),\n      taxRateId: asStringOrNull(rate) ?? asStringOrNull(rateObject?.id),\n      taxableAmountCents: Number.isFinite(taxableAmount)\n        ? Math.round(taxableAmount)\n        : null,\n      jurisdiction: asStringOrNull(rateObject?.jurisdiction),\n      rateState: asStringOrNull(rateObject?.state),\n      percentage:\n        asNumberOrNull(rateObject?.effective_percentage) ??\n        asNumberOrNull(rateObject?.percentage),\n    }\n  })\n}\n\n/** Sum of the stored lines' amounts. */\nfunction sumLines(lines: readonly StorefrontTaxLine[]): number {\n  return lines.reduce((sum, line) => sum + line.amountCents, 0)\n}\n\nexport interface StorefrontTaxContext {\n  kind: 'session' | 'invoice'\n  hostId: string\n  /**\n   * The manual-mode tax `checkout.ts` puts over as an ordinary line item.\n   * Stripe is never told it is tax, so no Stripe field carries it and the\n   * session's own `metadata[taxCents]` is the only witness (AGL-1711).\n   */\n  manualTaxCents?: number\n}\n\n/** What one Stripe object says about the tax it carried. */\nexport interface ResolvedStorefrontTax {\n  /** `automatic_tax.enabled` — the discriminator, never the tax lines. */\n  automatic: boolean\n  /** Stripe's own breakdown, present only on a `stripe-automatic` sale. */\n  lines: StorefrontTaxLine[]\n  taxCents: number\n  taxMode: StorefrontTaxMode\n}\n\n/**\n * Reads the tax off one paid session or invoice — the SINGLE derivation, and\n * the reason it is its own exported function (AGL-2451).\n *\n * `storefrontTaxRow` builds the `storefrontTaxCollected` record from it, and\n * the four order-writing doors in `billing-webhook.ts` stamp `HostOrder.taxMode`\n * from it, so an order and the row filed for the same Stripe id cannot state\n * different regimes. Re-deriving the mode beside a second reading of the same\n * object is exactly how the two would drift.\n *\n * Pure and total: unreadable input answers `taxMode: 'none'`, never throws.\n */\nexport function resolveStorefrontTax(\n  object: unknown,\n  manualTaxCents = 0,\n): ResolvedStorefrontTax {\n  const source = object as any\n  const automatic = source?.automatic_tax?.enabled === true\n  const lines = automatic ? taxLines(source) : []\n  const manualCents = Math.max(0, asCents(manualTaxCents))\n  // The flag, never the lines — see the module note. A manual-mode\n  // subscription renewal carries real Stripe tax rates in `total_taxes[]`,\n  // and booking those as Aglyn-collected would be the whole defect restated.\n  //\n  // Read on SESSIONS as well as invoices since AGL-1953: the cart and\n  // draft-order paths now carry their manual tax as a real Stripe Tax Rate on\n  // the line (the construction that survives a session-level coupon), so a\n  // manual session reports a genuine `total_details.amount_tax`. The scalar is\n  // the fallback because `total_details.breakdown` is expandable and absent\n  // unless the recorder re-read it. Buy-now's `line_items[1]` construction\n  // reports 0 in both shapes and still answers from `manualTaxCents` below.\n  const manualLineCents = !automatic\n    ? sumLines(taxLines(source)) ||\n      asCents(source?.total_details?.amount_tax ?? source?.tax)\n    : 0\n  const taxCents = automatic\n    ? // `total_details.amount_tax` on a session, `total_taxes[]` on an\n      // invoice. Prefer the summed lines when they exist (a computed invoice\n      // can send a 0/null scalar beside a populated array — AGL-1811's\n      // measurement), and fall back to the scalar shapes otherwise.\n      lines.length > 0\n      ? sumLines(lines)\n      : asCents(source?.total_details?.amount_tax ?? source?.tax)\n    : Math.max(manualCents, manualLineCents)\n  return {\n    automatic,\n    lines,\n    taxCents,\n    taxMode: storefrontTaxMode({ automatic, taxCents }),\n  }\n}\n\n/**\n * Just the regime, for the order-writing doors (AGL-2451). Delegates, so this\n * is the same answer the filed tax record gives for the same object.\n */\nexport function storefrontTaxModeOf(\n  object: unknown,\n  manualTaxCents = 0,\n): StorefrontTaxMode {\n  return resolveStorefrontTax(object, manualTaxCents).taxMode\n}\n\n/**\n * Decomposes a paid storefront session or invoice into the stored row, or\n * `null` when there is no host to attribute it to.\n *\n * The caller decides WHICH objects reach this — the commerce webhook\n * self-selects on `metadata.type`, exactly as every other section does.\n */\nexport function storefrontTaxRow(\n  object: unknown,\n  context: StorefrontTaxContext,\n): StorefrontTaxRow | null {\n  const source = object as any\n  const hostId = String(context?.hostId ?? '')\n  if (!hostId) return null\n\n  const { automatic, lines, taxCents, taxMode } = resolveStorefrontTax(\n    source,\n    context?.manualTaxCents,\n  )\n\n  const liabilityType = asStringOrNull(source?.automatic_tax?.liability?.type)\n  const taxLiability: StorefrontTaxLiability | null = !automatic\n    ? null\n    : liabilityType === 'account'\n      ? 'connected-account'\n      : // `self`, and also an absent liability: Stripe omits the field on\n        // older API versions, where the only account a session could be\n        // liable under is the one it was created on — the platform.\n        'platform'\n\n  const grossCents = asCents(\n    context.kind === 'invoice' ? source?.amount_paid : source?.amount_total,\n  )\n  const transferDestination =\n    source?.payment_intent_data?.transfer_data?.destination ??\n    source?.transfer_data?.destination\n  return {\n    kind: context.kind,\n    hostId,\n    metadataType:\n      asStringOrNull(source?.metadata?.type) ??\n      asStringOrNull(source?.subscription_details?.metadata?.type) ??\n      asStringOrNull(source?.parent?.subscription_details?.metadata?.type),\n    taxMode,\n    taxLiability,\n    connectedAccountId:\n      asStringOrNull(transferDestination) ??\n      asStringOrNull((transferDestination as any)?.id),\n    grossCents,\n    taxCents,\n    netCents: grossCents - taxCents,\n    currency: asStringOrNull(source?.currency) ?? 'usd',\n    customerAddress:\n      address(source?.customer_details?.address) ??\n      address(source?.customer_address),\n    // Stripe's OWN breakdown, whenever Stripe stated one — never an invented\n    // base. Buy-now's manual construction states none (Stripe was never told\n    // the line was tax) and answers `[]`, which is the honest answer. The\n    // cart, draft-order and subscription-renewal manual paths carry a real\n    // Tax Rate, so Stripe DOES state a `taxable_amount` for them, and keeping\n    // it gives `merchantManual` a real taxable-sales figure instead of a\n    // permanent zero (AGL-1953). It never reaches the Aglyn-liable bucket:\n    // the classification above is the flag, not these lines.\n    taxLines: automatic ? lines : taxLines(source),\n    paidAt:\n      asDate(source?.status_transitions?.paid_at) ?? asDate(source?.created),\n  }\n}\n"],"names":["storefrontTaxMode","asCents","value","cents","Number","isFinite","Math","round","asStringOrNull","asNumberOrNull","parsed","NaN","asDate","seconds","Date","address","source","country","state","city","postalCode","postal_code","taxLines","entries","Array","isArray","total_details","breakdown","taxes","total_taxes","total_tax_amounts","map","entry","rate","tax_rate_details","tax_rate","rateObject","taxableAmount","taxable_amount","amountCents","amount","taxabilityReason","taxability_reason","taxRateId","id","taxableAmountCents","jurisdiction","rateState","percentage","effective_percentage","sumLines","lines","reduce","sum","line","resolveStorefrontTax","object","manualTaxCents","automatic","automatic_tax","enabled","manualCents","max","manualLineCents","amount_tax","tax","taxCents","length","taxMode","storefrontTaxModeOf","storefrontTaxRow","context","hostId","String","liabilityType","liability","type","taxLiability","grossCents","kind","amount_paid","amount_total","transferDestination","payment_intent_data","transfer_data","destination","metadataType","metadata","subscription_details","parent","connectedAccountId","netCents","currency","customerAddress","customer_details","customer_address","paidAt","status_transitions","paid_at","created"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6EC,GAED,SACEA,iBAAiB,QAEZ,oCAAgC;AA+DvC,SAASC,QAAQC,KAAc;IAC7B,MAAMC,QAAQC,OAAOF,gBAAAA,QAAS;IAC9B,OAAOE,OAAOC,QAAQ,CAACF,SAASG,KAAKC,KAAK,CAACJ,SAAS;AACtD;AAEA,SAASK,eAAeN,KAAc;IACpC,OAAO,OAAOA,UAAU,YAAYA,QAAQA,QAAQ;AACtD;AAEA,SAASO,eAAeP,KAAc;IACpC,MAAMQ,SAASN,OAAOF,gBAAAA,QAASS;IAC/B,OAAOP,OAAOC,QAAQ,CAACK,UAAUA,SAAS;AAC5C;AAEA,kEAAkE,GAClE,SAASE,OAAOV,KAAc;IAC5B,MAAMW,UAAUT,OAAOF,gBAAAA,QAASS;IAChC,OAAOP,OAAOC,QAAQ,CAACQ,YAAYA,UAAU,IACzC,IAAIC,KAAKD,UAAU,QACnB;AACN;AAEA,SAASE,QAAQC,MAAW;IAC1B,IAAI,CAACA,UAAU,OAAOA,WAAW,UAAU,OAAO;IAClD,OAAO;QACLC,SAAST,eAAeQ,OAAOC,OAAO;QACtCC,OAAOV,eAAeQ,OAAOE,KAAK;QAClCC,MAAMX,eAAeQ,OAAOG,IAAI;QAChCC,YAAYZ,eAAeQ,OAAOK,WAAW;IAC/C;AACF;AAEA;;;;;;;CAOC,GACD,SAASC,SAASN,MAAW;QACUA,iCAAAA;IAArC,MAAMO,UAAiBC,MAAMC,OAAO,CAACT,2BAAAA,wBAAAA,OAAQU,aAAa,sBAArBV,kCAAAA,sBAAuBW,SAAS,qBAAhCX,gCAAkCY,KAAK,IACxEZ,OAAOU,aAAa,CAACC,SAAS,CAACC,KAAK,GACpCJ,MAAMC,OAAO,CAACT,0BAAAA,OAAQa,WAAW,IAC/Bb,OAAOa,WAAW,GAClBL,MAAMC,OAAO,CAACT,0BAAAA,OAAQc,iBAAiB,IACrCd,OAAOc,iBAAiB,GACxB,EAAE;IACV,OAAOP,QAAQQ,GAAG,CAAC,CAACC;YACLA,oBASAxB,iBAOTC;YAhBwBuB;QAA5B,MAAMC,QAAOD,gBAAAA,yBAAAA,MAAOC,IAAI,oBAAID,0BAAAA,0BAAAA,MAAOE,gBAAgB,qBAAvBF,wBAAyBG,QAAQ,YAAhDH,OAAoDA,yBAAAA,MAAOG,QAAQ;QAChF,MAAMC,aAAaH,QAAQ,OAAOA,SAAS,WAAWA,OAAO;QAC7D,0EAA0E;QAC1E,qEAAqE;QACrE,8DAA8D;QAC9D,MAAMI,gBAAgBjC,gBAAO4B,yBAAAA,MAAOM,cAAc,oBAAI3B;QACtD,OAAO;YACL4B,aAAatC,QAAQ+B,yBAAAA,MAAOQ,MAAM;YAClCC,kBAAkBjC,eAAewB,yBAAAA,MAAOU,iBAAiB;YACzDC,SAAS,GAAEnC,kBAAAA,eAAeyB,iBAAfzB,kBAAwBA,eAAe4B,8BAAAA,WAAYQ,EAAE;YAChEC,oBAAoBzC,OAAOC,QAAQ,CAACgC,iBAChC/B,KAAKC,KAAK,CAAC8B,iBACX;YACJS,cAActC,eAAe4B,8BAAAA,WAAYU,YAAY;YACrDC,WAAWvC,eAAe4B,8BAAAA,WAAYlB,KAAK;YAC3C8B,UAAU,GACRvC,kBAAAA,eAAe2B,8BAAAA,WAAYa,oBAAoB,aAA/CxC,kBACAA,eAAe2B,8BAAAA,WAAYY,UAAU;QACzC;IACF;AACF;AAEA,sCAAsC,GACtC,SAASE,SAASC,KAAmC;IACnD,OAAOA,MAAMC,MAAM,CAAC,CAACC,KAAKC,OAASD,MAAMC,KAAKf,WAAW,EAAE;AAC7D;AAuBA;;;;;;;;;;;CAWC,GACD,OAAO,SAASgB,qBACdC,MAAe,EACfC,iBAAiB,CAAC;;QAGAzC,uBAgBNA,uBASEA;IA1Bd,MAAMA,SAASwC;IACf,MAAME,YAAY1C,CAAAA,2BAAAA,wBAAAA,OAAQ2C,aAAa,qBAArB3C,sBAAuB4C,OAAO,MAAK;IACrD,MAAMT,QAAQO,YAAYpC,SAASN,UAAU,EAAE;IAC/C,MAAM6C,cAAcvD,KAAKwD,GAAG,CAAC,GAAG7D,QAAQwD;IACxC,iEAAiE;IACjE,yEAAyE;IACzE,2EAA2E;IAC3E,EAAE;IACF,oEAAoE;IACpE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAMM,kBAAkB,CAACL,YACrBR,SAAS5B,SAASN,YAClBf,gBAAQe,2BAAAA,wBAAAA,OAAQU,aAAa,qBAArBV,sBAAuBgD,UAAU,mBAAIhD,0BAAAA,OAAQiD,GAAG,IACxD;IACJ,MAAMC,WAAWR,YAEb,uEAAuE;IACvE,iEAAiE;IACjE,8DAA8D;IAC9DP,MAAMgB,MAAM,GAAG,IACbjB,SAASC,SACTlD,iBAAQe,2BAAAA,yBAAAA,OAAQU,aAAa,qBAArBV,uBAAuBgD,UAAU,oBAAIhD,0BAAAA,OAAQiD,GAAG,IAC1D3D,KAAKwD,GAAG,CAACD,aAAaE;IAC1B,OAAO;QACLL;QACAP;QACAe;QACAE,SAASpE,kBAAkB;YAAE0D;YAAWQ;QAAS;IACnD;AACF;AAEA;;;CAGC,GACD,OAAO,SAASG,oBACdb,MAAe,EACfC,iBAAiB,CAAC;IAElB,OAAOF,qBAAqBC,QAAQC,gBAAgBW,OAAO;AAC7D;AAEA;;;;;;CAMC,GACD,OAAO,SAASE,iBACdd,MAAe,EACfe,OAA6B;qBA+BzB/D,OAAAA,iBAMAA,kBAKQA,kBAERO,UAYAH;QA7CiCI,iCAAAA,uBAcnCA,2CAAAA,6BACAA,uBAKiBA,kBACAA,uCAAAA,8BACAA,8CAAAA,qCAAAA,gBAWPA,0BAYDA;IAtDX,MAAMA,SAASwC;IACf,MAAMgB,SAASC,eAAOF,2BAAAA,QAASC,MAAM,mBAAI;IACzC,IAAI,CAACA,QAAQ,OAAO;IAEpB,MAAM,EAAEd,SAAS,EAAEP,KAAK,EAAEe,QAAQ,EAAEE,OAAO,EAAE,GAAGb,qBAC9CvC,QACAuD,2BAAAA,QAASd,cAAc;IAGzB,MAAMiB,gBAAgBlE,eAAeQ,2BAAAA,wBAAAA,OAAQ2C,aAAa,sBAArB3C,kCAAAA,sBAAuB2D,SAAS,qBAAhC3D,gCAAkC4D,IAAI;IAC3E,MAAMC,eAA8C,CAACnB,YACjD,OACAgB,kBAAkB,YAChB,sBAEA,gEAAgE;IAChE,4DAA4D;IAC5D;IAEN,MAAMI,aAAa7E,QACjBsE,QAAQQ,IAAI,KAAK,YAAY/D,0BAAAA,OAAQgE,WAAW,GAAGhE,0BAAAA,OAAQiE,YAAY;IAEzE,MAAMC,+BACJlE,2BAAAA,8BAAAA,OAAQmE,mBAAmB,sBAA3BnE,4CAAAA,4BAA6BoE,aAAa,qBAA1CpE,0CAA4CqE,WAAW,oBACvDrE,2BAAAA,wBAAAA,OAAQoE,aAAa,qBAArBpE,sBAAuBqE,WAAW;IACpC,OAAO;QACLN,MAAMR,QAAQQ,IAAI;QAClBP;QACAc,YAAY,GACV9E,SAAAA,kBAAAA,eAAeQ,2BAAAA,mBAAAA,OAAQuE,QAAQ,qBAAhBvE,iBAAkB4D,IAAI,aAArCpE,kBACAA,eAAeQ,2BAAAA,+BAAAA,OAAQwE,oBAAoB,sBAA5BxE,wCAAAA,6BAA8BuE,QAAQ,qBAAtCvE,sCAAwC4D,IAAI,aAD3DpE,QAEAA,eAAeQ,2BAAAA,iBAAAA,OAAQyE,MAAM,sBAAdzE,sCAAAA,eAAgBwE,oBAAoB,sBAApCxE,+CAAAA,oCAAsCuE,QAAQ,qBAA9CvE,6CAAgD4D,IAAI;QACrER;QACAS;QACAa,kBAAkB,GAChBlF,mBAAAA,eAAe0E,gCAAf1E,mBACAA,eAAgB0E,uCAAD,AAACA,oBAA6BtC,EAAE;QACjDkC;QACAZ;QACAyB,UAAUb,aAAaZ;QACvB0B,QAAQ,GAAEpF,mBAAAA,eAAeQ,0BAAAA,OAAQ4E,QAAQ,aAA/BpF,mBAAoC;QAC9CqF,eAAe,GACb9E,WAAAA,QAAQC,2BAAAA,2BAAAA,OAAQ8E,gBAAgB,qBAAxB9E,yBAA0BD,OAAO,aAAzCA,WACAA,QAAQC,0BAAAA,OAAQ+E,gBAAgB;QAClC,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,yDAAyD;QACzDzE,UAAUoC,YAAYP,QAAQ7B,SAASN;QACvCgF,MAAM,GACJpF,UAAAA,OAAOI,2BAAAA,6BAAAA,OAAQiF,kBAAkB,qBAA1BjF,2BAA4BkF,OAAO,aAA1CtF,UAA+CA,OAAOI,0BAAAA,OAAQmF,OAAO;IACzE;AACF"}

package/src/lib/server/stream.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Gated video streaming (AGL-315). POST (member session) checks the
+ * entitlement and mints a short-TTL signed URL; GET with a valid signature
+ * redirects to a media URL that itself expires (AGL-2814). The mint step is
+ * the server-enforced gate, a shared stream link dies within 15 minutes, and
+ * the media URL behind it dies with the viewing session.
+ */
+export declare const streamHandler: PluginApiHandler;

package/src/lib/server/stream.js

@@ -0,0 +1,191 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { MEDIA_CDN_RENDITION_AUTO, MEDIA_CDN_RENDITION_PARAM } from "@aglyn/aglyn/server";
+import * as CommerceModel from "../model/index.js";
+import { firebaseAdmin, GATED_VIDEO_SESSION_TTL_MS } from "@aglyn/tenant-data-admin";
+import { createPaidMediaDeliveryIo, resolvePaidMediaDelivery } from "./paid-media-delivery.js";
+import { createHmac, timingSafeEqual } from "crypto";
+import { requireActiveMember } from "./membership.js";
+import { checkMemberEntitlement } from "./gate.js";
+import { tokenSigningSecret } from "./download.js";
+const TTL_MS = 15 * 60 * 1000;
+/**
+ * Signed with the dedicated, fail-closed `TOKEN_SIGNING_SECRET` (AGL-509).
+ * AGL-509 converted the download and supplier tokens but missed this call
+ * site (AGL-689): the old `STRIPE_SECRET_KEY ?? 'aglyn'` key left the whole
+ * payload — `stream:${hostId}:${productId}:${video}:${exp}`, all public
+ * identifiers — forgeable on any deploy without the Stripe key, and the
+ * short TTL bought nothing because the forger chooses `exp`.
+ */ function sign(hostId, productId, video, exp) {
+    return createHmac('sha256', tokenSigningSecret()).update(`stream:${hostId}:${productId}:${video}:${exp}`).digest('hex').slice(0, 32);
+}
+/**
+ * Constant-time signature compare (AGL-512, closed here by AGL-1881).
+ *
+ * The presented signature was compared with `!==`, which short-circuits on
+ * the first differing byte — the exact defect AGL-512 closed in `download.ts`
+ * and `supplier-update.ts` and missed here, one directory over. It matters
+ * more on this route than it reads: the signature is a truncated HMAC over
+ * values the caller already knows (`hostId`, `productId`, `video`, `exp`), so
+ * a byte-at-a-time oracle recovers a token for a video the caller was never
+ * entitled to, and the 15-minute TTL does not bound the attempt rate.
+ *
+ * Length is checked first because `timingSafeEqual` THROWS on a length
+ * mismatch rather than returning false, and the expected length here is a
+ * public constant (32 hex chars) — leaking it costs nothing.
+ */ function signatureMatches(presented, expected) {
+    const a = Buffer.from(String(presented != null ? presented : ''), 'utf8');
+    const b = Buffer.from(String(expected != null ? expected : ''), 'utf8');
+    if (a.length !== b.length) return false;
+    return timingSafeEqual(new Uint8Array(a), new Uint8Array(b));
+}
+/**
+ * Gated video streaming (AGL-315). POST (member session) checks the
+ * entitlement and mints a short-TTL signed URL; GET with a valid signature
+ * redirects to a media URL that itself expires (AGL-2814). The mint step is
+ * the server-enforced gate, a shared stream link dies within 15 minutes, and
+ * the media URL behind it dies with the viewing session.
+ */ export const streamHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2;
+    var _req_body, _req_body1, _req_body2;
+    const hostId = String((_ref = req.method === 'POST' ? (_req_body = req.body) == null ? void 0 : _req_body.hostId : req.query.hostId) != null ? _ref : '');
+    const productId = String((_ref1 = req.method === 'POST' ? (_req_body1 = req.body) == null ? void 0 : _req_body1.productId : req.query.productId) != null ? _ref1 : '');
+    const video = Math.max(0, Number((_ref2 = req.method === 'POST' ? (_req_body2 = req.body) == null ? void 0 : _req_body2.video : req.query.video) != null ? _ref2 : 0));
+    if (!hostId || !productId) {
+        return res.status(400).json({
+            error: 'Missing hostId or productId'
+        });
+    }
+    try {
+        var _req_query_exp, _req_query_sig, _productSnapshot_data;
+        var _product_gatedVideos, _req_headers;
+        if (req.method === 'POST') {
+            var _auth_member_get;
+            // Suspension gate (AGL-550): suspended members (AGL-546) cannot
+            // mint stream URLs — 403'd with the session cookie cleared.
+            const auth = await requireActiveMember(req, res, hostId, 'Sign in first');
+            if (!auth) return;
+            const email = String((_auth_member_get = auth.member.get('email')) != null ? _auth_member_get : '');
+            const entitled = email && await checkMemberEntitlement(hostId, email, productId);
+            if (!entitled) {
+                return res.status(403).json({
+                    error: 'Not entitled'
+                });
+            }
+            const exp = Date.now() + TTL_MS;
+            const url = `/api/commerce/stream?hostId=${encodeURIComponent(hostId)}` + `&productId=${encodeURIComponent(productId)}&video=${video}` + `&exp=${exp}&sig=${sign(hostId, productId, video, exp)}`;
+            res.setHeader('Cache-Control', 'private, no-store');
+            return res.status(200).json({
+                url,
+                expiresAtMs: exp
+            });
+        }
+        // GET: signature + expiry gate, then redirect to the media.
+        const exp = Number((_req_query_exp = req.query.exp) != null ? _req_query_exp : 0);
+        const sig = String((_req_query_sig = req.query.sig) != null ? _req_query_sig : '');
+        if (!exp || exp < Date.now() || !signatureMatches(sig, sign(hostId, productId, video, exp))) {
+            return res.status(403).send('Link expired — reload the page');
+        }
+        const app = firebaseAdmin.app();
+        const productSnapshot = await app.firestore().collection('hosts').doc(hostId).collection('products').doc(productId).get();
+        const product = CommerceModel.liftLegacyProduct((_productSnapshot_data = productSnapshot.data()) != null ? _productSnapshot_data : {});
+        const file = (_product_gatedVideos = product.gatedVideos) == null ? void 0 : _product_gatedVideos[video];
+        if (!(file == null ? void 0 : file.url)) return res.status(404).send('No video');
+        /**
+     * The redirect lands on a link that expires (AGL-2814).
+     *
+     * Everything above only guards the 302. What the 302 points at is what
+     * the buyer, and anyone who copies the `Location` out of the buyer's
+     * network panel, keeps. So `resolvePaidMediaDelivery` hands back one of
+     * three things and never a permanent URL:
+     *
+     * - a CDN URL signed for {@link GATED_VIDEO_SESSION_TTL_MS}, when the video
+     *   is a PRIVATE asset in this site's library or its org's. The CDN refuses
+     *   a private asset on every path without an unexpired signature.
+     * - a V4 signed Storage read with the same lifetime, for an object in those
+     *   libraries that no media document owns. A raw download URL's token lives
+     *   as long as the object, so it is never the redirect.
+     * - an author-typed hotlink, unchanged, because nothing of ours runs there.
+     *
+     * A video whose asset is still PUBLIC is refused rather than delivered:
+     * its URL already works for anyone, so redirecting a buyer to it is the
+     * leak. The 409 is what the gated player reports to the viewer, and the
+     * log line is what tells the operator which product needs its video made
+     * private.
+     *
+     * `?r=auto` rides inside the signed URL (AGL-2766). The signature covers
+     * `(scope, mediaId, exp)` and not the parameter, so it asks the CDN for the
+     * best delivery copy of the one asset the signature names and can reach no
+     * other. Nothing the caller sends reaches this `Location`: the GET half
+     * reads `hostId`, `productId`, `video`, `exp` and `sig`, and builds the
+     * target from the product document.
+     *
+     * With a delivery provider configured and its release flag on for the
+     * owning org, a video with a current copy there is redirected straight to
+     * the provider's short-lived URL instead (AGL-2824), for the same session
+     * and the same rendition the CDN would pick. `Accept` is the one request
+     * header that reaches that choice, and only to pick among the asset's own
+     * encodings.
+     */ const delivery = await resolvePaidMediaDelivery({
+            stored: file.url,
+            hostId,
+            ttlMs: GATED_VIDEO_SESSION_TTL_MS,
+            cdnParams: [
+                [
+                    MEDIA_CDN_RENDITION_PARAM,
+                    MEDIA_CDN_RENDITION_AUTO
+                ]
+            ],
+            delivery: {
+                accept: (_req_headers = req.headers) == null ? void 0 : _req_headers['accept']
+            },
+            io: createPaidMediaDeliveryIo({
+                firestore: app.firestore(),
+                bucket: app.storage().bucket(process.env['NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET'])
+            })
+        });
+        // Per-member and time-boxed, whichever way it goes: no cache may keep the
+        // redirect past the session it opens, nor a refusal past the fix.
+        res.setHeader('Cache-Control', 'private, no-store');
+        if (delivery.ok === false) {
+            console.error('[commerce/stream] gated video not delivered', JSON.stringify({
+                hostId,
+                productId,
+                video,
+                refusal: delivery.refusal
+            }));
+            return delivery.refusal === 'not-private' ? res.status(409).send('This video is not ready to play yet') : res.status(404).send('No video');
+        }
+        /*
+     * `Vary: Accept` only when this response chose the rendition (AGL-2824).
+     *
+     * A signed CDN URL is the same for every client: the `Location` is a
+     * function of the product document and the clock, not of the request's
+     * `Accept`, and the negotiation happens on the SECOND response, where
+     * `serveMediaCdn` declares `Vary` (AGL-2766). A delivery provider's URL is
+     * minted after the rendition is picked, so there the `Accept` shaped this
+     * `Location`, and saying so is correct even under `no-store`.
+     */ if (delivery.via === 'delivery') res.setHeader('Vary', 'Accept');
+        return res.redirect(302, delivery.location);
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Stream unavailable'
+        });
+    }
+};
+
+//# sourceMappingURL=stream.js.map

package/src/lib/server/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/stream.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  MEDIA_CDN_RENDITION_AUTO,\n  MEDIA_CDN_RENDITION_PARAM,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport {\n  firebaseAdmin,\n  GATED_VIDEO_SESSION_TTL_MS,\n} from '@aglyn/tenant-data-admin'\nimport {\n  createPaidMediaDeliveryIo,\n  resolvePaidMediaDelivery,\n} from './paid-media-delivery'\nimport { createHmac, timingSafeEqual } from 'crypto'\nimport { requireActiveMember } from './membership'\nimport { checkMemberEntitlement } from './gate'\nimport { tokenSigningSecret } from './download'\n\nconst TTL_MS = 15 * 60 * 1000\n\n/**\n * Signed with the dedicated, fail-closed `TOKEN_SIGNING_SECRET` (AGL-509).\n * AGL-509 converted the download and supplier tokens but missed this call\n * site (AGL-689): the old `STRIPE_SECRET_KEY ?? 'aglyn'` key left the whole\n * payload — `stream:${hostId}:${productId}:${video}:${exp}`, all public\n * identifiers — forgeable on any deploy without the Stripe key, and the\n * short TTL bought nothing because the forger chooses `exp`.\n */\nfunction sign(hostId: string, productId: string, video: number, exp: number) {\n  return createHmac('sha256', tokenSigningSecret())\n    .update(`stream:${hostId}:${productId}:${video}:${exp}`)\n    .digest('hex')\n    .slice(0, 32)\n}\n\n/**\n * Constant-time signature compare (AGL-512, closed here by AGL-1881).\n *\n * The presented signature was compared with `!==`, which short-circuits on\n * the first differing byte — the exact defect AGL-512 closed in `download.ts`\n * and `supplier-update.ts` and missed here, one directory over. It matters\n * more on this route than it reads: the signature is a truncated HMAC over\n * values the caller already knows (`hostId`, `productId`, `video`, `exp`), so\n * a byte-at-a-time oracle recovers a token for a video the caller was never\n * entitled to, and the 15-minute TTL does not bound the attempt rate.\n *\n * Length is checked first because `timingSafeEqual` THROWS on a length\n * mismatch rather than returning false, and the expected length here is a\n * public constant (32 hex chars) — leaking it costs nothing.\n */\nfunction signatureMatches(presented: string, expected: string): boolean {\n  const a = Buffer.from(String(presented ?? ''), 'utf8')\n  const b = Buffer.from(String(expected ?? ''), 'utf8')\n  if (a.length !== b.length) return false\n  return timingSafeEqual(new Uint8Array(a), new Uint8Array(b))\n}\n\n/**\n * Gated video streaming (AGL-315). POST (member session) checks the\n * entitlement and mints a short-TTL signed URL; GET with a valid signature\n * redirects to a media URL that itself expires (AGL-2814). The mint step is\n * the server-enforced gate, a shared stream link dies within 15 minutes, and\n * the media URL behind it dies with the viewing session.\n */\nexport const streamHandler: PluginApiHandler = async (req, res) => {\n  const hostId = String(\n    (req.method === 'POST' ? req.body?.hostId : req.query.hostId) ?? '',\n  )\n  const productId = String(\n    (req.method === 'POST' ? req.body?.productId : req.query.productId) ?? '',\n  )\n  const video = Math.max(\n    0,\n    Number(\n      (req.method === 'POST' ? req.body?.video : req.query.video) ?? 0,\n    ),\n  )\n  if (!hostId || !productId) {\n    return res.status(400).json({ error: 'Missing hostId or productId' })\n  }\n\n  try {\n    if (req.method === 'POST') {\n      // Suspension gate (AGL-550): suspended members (AGL-546) cannot\n      // mint stream URLs — 403'd with the session cookie cleared.\n      const auth = await requireActiveMember(req, res, hostId, 'Sign in first')\n      if (!auth) return\n      const email = String(auth.member.get('email') ?? '')\n      const entitled =\n        email && (await checkMemberEntitlement(hostId, email, productId))\n      if (!entitled) {\n        return res.status(403).json({ error: 'Not entitled' })\n      }\n      const exp = Date.now() + TTL_MS\n      const url =\n        `/api/commerce/stream?hostId=${encodeURIComponent(hostId)}` +\n        `&productId=${encodeURIComponent(productId)}&video=${video}` +\n        `&exp=${exp}&sig=${sign(hostId, productId, video, exp)}`\n      res.setHeader('Cache-Control', 'private, no-store')\n      return res.status(200).json({ url, expiresAtMs: exp })\n    }\n\n    // GET: signature + expiry gate, then redirect to the media.\n    const exp = Number(req.query.exp ?? 0)\n    const sig = String(req.query.sig ?? '')\n    if (\n      !exp ||\n      exp < Date.now() ||\n      !signatureMatches(sig, sign(hostId, productId, video, exp))\n    ) {\n      return res.status(403).send('Link expired — reload the page')\n    }\n    const app = firebaseAdmin.app()\n    const productSnapshot = await app\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('products')\n      .doc(productId)\n      .get()\n    const product = CommerceModel.liftLegacyProduct(\n      (productSnapshot.data() as any) ?? {},\n    )\n    const file = product.gatedVideos?.[video]\n    if (!file?.url) return res.status(404).send('No video')\n    /**\n     * The redirect lands on a link that expires (AGL-2814).\n     *\n     * Everything above only guards the 302. What the 302 points at is what\n     * the buyer, and anyone who copies the `Location` out of the buyer's\n     * network panel, keeps. So `resolvePaidMediaDelivery` hands back one of\n     * three things and never a permanent URL:\n     *\n     * - a CDN URL signed for {@link GATED_VIDEO_SESSION_TTL_MS}, when the video\n     *   is a PRIVATE asset in this site's library or its org's. The CDN refuses\n     *   a private asset on every path without an unexpired signature.\n     * - a V4 signed Storage read with the same lifetime, for an object in those\n     *   libraries that no media document owns. A raw download URL's token lives\n     *   as long as the object, so it is never the redirect.\n     * - an author-typed hotlink, unchanged, because nothing of ours runs there.\n     *\n     * A video whose asset is still PUBLIC is refused rather than delivered:\n     * its URL already works for anyone, so redirecting a buyer to it is the\n     * leak. The 409 is what the gated player reports to the viewer, and the\n     * log line is what tells the operator which product needs its video made\n     * private.\n     *\n     * `?r=auto` rides inside the signed URL (AGL-2766). The signature covers\n     * `(scope, mediaId, exp)` and not the parameter, so it asks the CDN for the\n     * best delivery copy of the one asset the signature names and can reach no\n     * other. Nothing the caller sends reaches this `Location`: the GET half\n     * reads `hostId`, `productId`, `video`, `exp` and `sig`, and builds the\n     * target from the product document.\n     *\n     * With a delivery provider configured and its release flag on for the\n     * owning org, a video with a current copy there is redirected straight to\n     * the provider's short-lived URL instead (AGL-2824), for the same session\n     * and the same rendition the CDN would pick. `Accept` is the one request\n     * header that reaches that choice, and only to pick among the asset's own\n     * encodings.\n     */\n    const delivery = await resolvePaidMediaDelivery({\n      stored: file.url,\n      hostId,\n      ttlMs: GATED_VIDEO_SESSION_TTL_MS,\n      cdnParams: [[MEDIA_CDN_RENDITION_PARAM, MEDIA_CDN_RENDITION_AUTO]],\n      delivery: { accept: req.headers?.['accept'] },\n      io: createPaidMediaDeliveryIo({\n        firestore: app.firestore(),\n        bucket: app\n          .storage()\n          .bucket(process.env['NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET']),\n      }),\n    })\n    // Per-member and time-boxed, whichever way it goes: no cache may keep the\n    // redirect past the session it opens, nor a refusal past the fix.\n    res.setHeader('Cache-Control', 'private, no-store')\n    if (delivery.ok === false) {\n      console.error(\n        '[commerce/stream] gated video not delivered',\n        JSON.stringify({ hostId, productId, video, refusal: delivery.refusal }),\n      )\n      return delivery.refusal === 'not-private'\n        ? res.status(409).send('This video is not ready to play yet')\n        : res.status(404).send('No video')\n    }\n    /*\n     * `Vary: Accept` only when this response chose the rendition (AGL-2824).\n     *\n     * A signed CDN URL is the same for every client: the `Location` is a\n     * function of the product document and the clock, not of the request's\n     * `Accept`, and the negotiation happens on the SECOND response, where\n     * `serveMediaCdn` declares `Vary` (AGL-2766). A delivery provider's URL is\n     * minted after the rendition is picked, so there the `Accept` shaped this\n     * `Location`, and saying so is correct even under `no-store`.\n     */\n    if (delivery.via === 'delivery') res.setHeader('Vary', 'Accept')\n    return res.redirect(302, delivery.location)\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Stream unavailable' })\n  }\n}\n"],"names":["MEDIA_CDN_RENDITION_AUTO","MEDIA_CDN_RENDITION_PARAM","CommerceModel","firebaseAdmin","GATED_VIDEO_SESSION_TTL_MS","createPaidMediaDeliveryIo","resolvePaidMediaDelivery","createHmac","timingSafeEqual","requireActiveMember","checkMemberEntitlement","tokenSigningSecret","TTL_MS","sign","hostId","productId","video","exp","update","digest","slice","signatureMatches","presented","expected","a","Buffer","from","String","b","length","Uint8Array","streamHandler","req","res","method","body","query","Math","max","Number","status","json","error","productSnapshot","product","auth","email","member","get","entitled","Date","now","url","encodeURIComponent","setHeader","expiresAtMs","sig","send","app","firestore","collection","doc","liftLegacyProduct","data","file","gatedVideos","delivery","stored","ttlMs","cdnParams","accept","headers","io","bucket","storage","process","env","ok","console","JSON","stringify","refusal","via","redirect","location"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,wBAAwB,EACxBC,yBAAyB,QAEpB,sBAAqB;AAC5B,YAAYC,mBAAmB,oBAAU;AACzC,SACEC,aAAa,EACbC,0BAA0B,QACrB,2BAA0B;AACjC,SACEC,yBAAyB,EACzBC,wBAAwB,QACnB,2BAAuB;AAC9B,SAASC,UAAU,EAAEC,eAAe,QAAQ,SAAQ;AACpD,SAASC,mBAAmB,QAAQ,kBAAc;AAClD,SAASC,sBAAsB,QAAQ,YAAQ;AAC/C,SAASC,kBAAkB,QAAQ,gBAAY;AAE/C,MAAMC,SAAS,KAAK,KAAK;AAEzB;;;;;;;CAOC,GACD,SAASC,KAAKC,MAAc,EAAEC,SAAiB,EAAEC,KAAa,EAAEC,GAAW;IACzE,OAAOV,WAAW,UAAUI,sBACzBO,MAAM,CAAC,CAAC,OAAO,EAAEJ,OAAO,CAAC,EAAEC,UAAU,CAAC,EAAEC,MAAM,CAAC,EAAEC,KAAK,EACtDE,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;AACd;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAASC,iBAAiBC,SAAiB,EAAEC,QAAgB;IAC3D,MAAMC,IAAIC,OAAOC,IAAI,CAACC,OAAOL,oBAAAA,YAAa,KAAK;IAC/C,MAAMM,IAAIH,OAAOC,IAAI,CAACC,OAAOJ,mBAAAA,WAAY,KAAK;IAC9C,IAAIC,EAAEK,MAAM,KAAKD,EAAEC,MAAM,EAAE,OAAO;IAClC,OAAOrB,gBAAgB,IAAIsB,WAAWN,IAAI,IAAIM,WAAWF;AAC3D;AAEA;;;;;;CAMC,GACD,OAAO,MAAMG,gBAAkC,OAAOC,KAAKC;QAEtDD,MAGAA,OAKEA;QARsBA,WAGAA,YAKEA;IAT7B,MAAMlB,SAASa,QACZK,OAAAA,IAAIE,MAAM,KAAK,UAASF,YAAAA,IAAIG,IAAI,qBAARH,UAAUlB,MAAM,GAAGkB,IAAII,KAAK,CAACtB,MAAM,YAA3DkB,OAAgE;IAEnE,MAAMjB,YAAYY,QACfK,QAAAA,IAAIE,MAAM,KAAK,UAASF,aAAAA,IAAIG,IAAI,qBAARH,WAAUjB,SAAS,GAAGiB,IAAII,KAAK,CAACrB,SAAS,YAAjEiB,QAAsE;IAEzE,MAAMhB,QAAQqB,KAAKC,GAAG,CACpB,GACAC,QACGP,QAAAA,IAAIE,MAAM,KAAK,UAASF,aAAAA,IAAIG,IAAI,qBAARH,WAAUhB,KAAK,GAAGgB,IAAII,KAAK,CAACpB,KAAK,YAAzDgB,QAA8D;IAGnE,IAAI,CAAClB,UAAU,CAACC,WAAW;QACzB,OAAOkB,IAAIO,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IAEA,IAAI;YAsBiBV,gBACAA,gBAiBhBW;YAEUC,sBA2CSZ;QApFtB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;gBAKJW;YAJrB,gEAAgE;YAChE,4DAA4D;YAC5D,MAAMA,OAAO,MAAMpC,oBAAoBuB,KAAKC,KAAKnB,QAAQ;YACzD,IAAI,CAAC+B,MAAM;YACX,MAAMC,QAAQnB,QAAOkB,mBAAAA,KAAKE,MAAM,CAACC,GAAG,CAAC,oBAAhBH,mBAA4B;YACjD,MAAMI,WACJH,SAAU,MAAMpC,uBAAuBI,QAAQgC,OAAO/B;YACxD,IAAI,CAACkC,UAAU;gBACb,OAAOhB,IAAIO,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAe;YACtD;YACA,MAAMzB,MAAMiC,KAAKC,GAAG,KAAKvC;YACzB,MAAMwC,MACJ,CAAC,4BAA4B,EAAEC,mBAAmBvC,SAAS,GAC3D,CAAC,WAAW,EAAEuC,mBAAmBtC,WAAW,OAAO,EAAEC,OAAO,GAC5D,CAAC,KAAK,EAAEC,IAAI,KAAK,EAAEJ,KAAKC,QAAQC,WAAWC,OAAOC,MAAM;YAC1DgB,IAAIqB,SAAS,CAAC,iBAAiB;YAC/B,OAAOrB,IAAIO,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEW;gBAAKG,aAAatC;YAAI;QACtD;QAEA,4DAA4D;QAC5D,MAAMA,MAAMsB,QAAOP,iBAAAA,IAAII,KAAK,CAACnB,GAAG,YAAbe,iBAAiB;QACpC,MAAMwB,MAAM7B,QAAOK,iBAAAA,IAAII,KAAK,CAACoB,GAAG,YAAbxB,iBAAiB;QACpC,IACE,CAACf,OACDA,MAAMiC,KAAKC,GAAG,MACd,CAAC9B,iBAAiBmC,KAAK3C,KAAKC,QAAQC,WAAWC,OAAOC,OACtD;YACA,OAAOgB,IAAIO,MAAM,CAAC,KAAKiB,IAAI,CAAC;QAC9B;QACA,MAAMC,MAAMvD,cAAcuD,GAAG;QAC7B,MAAMf,kBAAkB,MAAMe,IAC3BC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAC/C,QACJ8C,UAAU,CAAC,YACXC,GAAG,CAAC9C,WACJiC,GAAG;QACN,MAAMJ,UAAU1C,cAAc4D,iBAAiB,EAC5CnB,wBAAAA,gBAAgBoB,IAAI,cAApBpB,wBAAkC,CAAC;QAEtC,MAAMqB,QAAOpB,uBAAAA,QAAQqB,WAAW,qBAAnBrB,oBAAqB,CAAC5B,MAAM;QACzC,IAAI,EAACgD,wBAAAA,KAAMZ,GAAG,GAAE,OAAOnB,IAAIO,MAAM,CAAC,KAAKiB,IAAI,CAAC;QAC5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAmCC,GACD,MAAMS,WAAW,MAAM5D,yBAAyB;YAC9C6D,QAAQH,KAAKZ,GAAG;YAChBtC;YACAsD,OAAOhE;YACPiE,WAAW;gBAAC;oBAACpE;oBAA2BD;iBAAyB;aAAC;YAClEkE,UAAU;gBAAEI,MAAM,GAAEtC,eAAAA,IAAIuC,OAAO,qBAAXvC,YAAa,CAAC,SAAS;YAAC;YAC5CwC,IAAInE,0BAA0B;gBAC5BsD,WAAWD,IAAIC,SAAS;gBACxBc,QAAQf,IACLgB,OAAO,GACPD,MAAM,CAACE,QAAQC,GAAG,CAAC,sCAAsC;YAC9D;QACF;QACA,0EAA0E;QAC1E,kEAAkE;QAClE3C,IAAIqB,SAAS,CAAC,iBAAiB;QAC/B,IAAIY,SAASW,EAAE,KAAK,OAAO;YACzBC,QAAQpC,KAAK,CACX,+CACAqC,KAAKC,SAAS,CAAC;gBAAElE;gBAAQC;gBAAWC;gBAAOiE,SAASf,SAASe,OAAO;YAAC;YAEvE,OAAOf,SAASe,OAAO,KAAK,gBACxBhD,IAAIO,MAAM,CAAC,KAAKiB,IAAI,CAAC,yCACrBxB,IAAIO,MAAM,CAAC,KAAKiB,IAAI,CAAC;QAC3B;QACA;;;;;;;;;KASC,GACD,IAAIS,SAASgB,GAAG,KAAK,YAAYjD,IAAIqB,SAAS,CAAC,QAAQ;QACvD,OAAOrB,IAAIkD,QAAQ,CAAC,KAAKjB,SAASkB,QAAQ;IAC5C,EAAE,OAAO1C,OAAO;QACdoC,QAAQpC,KAAK,CAACA;QACd,OAAOT,IAAIO,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;AACF,EAAC"}

package/src/lib/server/subscription-portal.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Subscriber self-service (AGL-303): opens the Stripe Billing Portal for
+ * the signed-in member's storefront subscription (cancel, switch
+ * payment method). Member-gated; the portal customer is matched by the
+ * member's email through the recorded subscription doc.
+ */
+export declare const subscriptionPortalHandler: PluginApiHandler;