@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/supplier-outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/supplier-outbox.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { type PluginJobHostGate } from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  notifyHostManagers,\n} from '@aglyn/tenant-data-admin'\nimport { isDocumentId } from '@aglyn/tenant-data-admin/server/document-id'\nimport { createHmac } from 'crypto'\n\n/**\n * The durable outbox for the dropship supplier notification (AGL-2473).\n *\n * ## What was wrong\n *\n * `billing-webhook.ts` routed a paid dropship order inside\n * `void (async () => { … })()`, and the last thing that block did was\n * `await fetch(supplier.webhookUrl, …)` — an endpoint the MERCHANT typed into\n * a console field, on a host Aglyn neither runs nor monitors. Vercel freezes\n * the container the instant the response is written, so a supplier that is\n * slow, rate-limiting, or simply down is a supplier that is never told. The\n * order is paid, the buyer is thanked, the merchant sees \"Sent to supplier X\"\n * on the timeline, and NOTHING ANYWHERE records that the POST is still owed —\n * so no later pass can find it and no report can list it. It surfaces when the\n * customer asks where their parcel is.\n *\n * ## Why not just `await` it\n *\n * AGL-2161 fixed the other four fire-and-forget sites in that file and\n * deliberately left this one, because awaiting it is worse rather than better:\n * a supplier taking 30s pushes the handler past Stripe's delivery window,\n * Stripe redelivers, and the redelivery re-enters a fan-out whose only\n * idempotency is one `created` flag upstream. A silently dropped notification\n * would have been traded for a DUPLICATED order. `refund.ts` awaits its own\n * sibling and says so in a comment — correctly, because that sibling only\n * touches our own Firestore.\n *\n * So the line this module draws is not \"fast vs slow\" but **ours vs theirs**.\n * Everything the routing block does to Aglyn's own storage — the callback\n * token, the timeline entry, the supplier email through our own provider — is\n * now AWAITED on the response path, exactly like `refund.ts`. The one call to a\n * stranger's server becomes a row here, and the response no longer waits on it.\n *\n * ## The mechanism\n *\n * A Firestore-backed outbox drained by the plugin-job beat that already runs\n * the two commerce recovery passes (`server.ts`). No new infrastructure: the\n * beat is a Cloud Scheduler function POSTing the tenant runner route, and it\n * has carried bounded scans since AGL-2227.\n *\n *  * **Idempotent enqueue.** The id is `{hostId}__{orderId}__{supplierId}` and\n *    the write is `create()`, which REFUSES an existing document, so a\n *    redelivery cannot reset a retry part-way through its backoff. The AGL-498\n *    existence guard upstream already returns before this fan-out, but\n *    `reconcile-stock.ts` documents at length why one flag over a dozen effects\n *    is not something to lean on.\n *  * **Backoff.** 1m, 5m, 15m, 1h, 6h — about seven and a half hours of cover,\n *    which is a supplier's overnight deploy but not their week off.\n *  * **Dead letter.** After {@link SUPPLIER_DELIVERY_MAX_ATTEMPTS} the row is\n *    left as `failed`, the ORDER's own timeline is stamped, and host managers\n *    get a notification. The merchant reading the order they were paid for can\n *    see that it never reached the supplier — the thing the old code could not\n *    tell anyone, because it wrote nothing down.\n *\n * ## Two placement decisions, both deliberate\n *\n * **TOP-LEVEL, not `hosts/{hostId}/supplierDeliveries`.** The host catch-all in\n * the rules file is PERMISSIVE by default — a subcollection nobody names in its\n * three exclusion lists is one every site editor can write from the browser —\n * and the row carries the exact JSON body we sign and POST, so an editor-\n * writable row is an editor-chosen payload delivered under the supplier's own\n * shared secret. A top-level collection matches no rule in\n * `cloud/firebase-firestore.rules` at all and is therefore denied to every\n * client by default, the same footing as `platform/pluginJobs`. It also keeps\n * the drain on an ordinary collection query: a collection-GROUP `where` would\n * need a `COLLECTION_GROUP_ASC` fieldOverride, and AGL-1793 is the record of\n * both commerce crons being silently dead in production for want of exactly\n * that. Neither a rules deploy nor an index deploy is owed for this change.\n *\n * **A delivered row is DELETED, not stamped `delivered`.** The body holds the\n * buyer's email and name, and a top-level document is outside the\n * `hosts/{hostId}` recursive delete an erasure request runs. Retaining the\n * happy path would accumulate third-party PII in a place erasure does not\n * reach, to record something the order's own `routed` timeline entry already\n * says. Dead-lettered rows survive, because those are the ones a human has to\n * act on and the merchant has been told about them.\n */\n\n/** Top-level collection. Matches no rule, so no client may read or write it. */\nexport const SUPPLIER_DELIVERY_COLLECTION = 'supplierDeliveries'\n\n/** Attempts before a delivery is dead-lettered. */\nexport const SUPPLIER_DELIVERY_MAX_ATTEMPTS = 6\n\n/**\n * Delay before the next retry, indexed by attempts ALREADY made.\n *\n * The first entry is 60s and the job beat is also 60s, so a supplier that\n * blipped is retried on the next tick rather than a quarter of an hour later —\n * the difference between a parcel that ships today and one that does not.\n */\nexport const SUPPLIER_DELIVERY_BACKOFF_MS: readonly number[] = [\n  60_000,\n  300_000,\n  900_000,\n  3_600_000,\n  21_600_000,\n]\n\n/**\n * Per-attempt timeout. Nothing user-facing waits on this — it exists so one\n * hung supplier cannot hold the shared job beat open for the whole scan.\n */\nexport const SUPPLIER_DELIVERY_TIMEOUT_MS = 10_000\n\n/** Rows examined per drain. Bounded like every other scan on the beat. */\nexport const SUPPLIER_DELIVERY_SCAN_LIMIT = 100\n\nexport type SupplierDeliveryStatus = 'pending' | 'failed'\n\nexport interface SupplierDeliveryRecord {\n  status: SupplierDeliveryStatus\n  hostId: string\n  orderId: string\n  supplierId: string\n  supplierName: string\n  /** The endpoint as configured when the order was routed, for the record. */\n  url: string\n  /** The exact JSON the supplier is sent; signed at delivery time. */\n  body: string\n  attempts: number\n  nextAttemptAtMs: number\n  createdAtMs: number\n  lastError?: string\n  lastStatus?: number\n  failedAtMs?: number\n}\n\nexport interface SupplierDeliveryScanResult {\n  scanned: number\n  delivered: number\n  retried: number\n  deadLettered: number\n  /** Retired without delivery because the merchant removed the endpoint. */\n  cancelled: number\n  /** Left pending, with the retry budget intact, because the site is locked. */\n  skippedLocked: number\n}\n\n/** gRPC `Status.ALREADY_EXISTS` — what `create()` on a live path carries. */\nconst GRPC_ALREADY_EXISTS = 6\n\n/**\n * The delay owed after `attempts` failures, clamped to the last step.\n *\n * Clamped rather than extrapolated: the tail entry is already six hours, and a\n * dead letter is what comes after it, not a longer and longer silence.\n */\nexport function supplierDeliveryBackoffMs(attempts: number): number {\n  const last = SUPPLIER_DELIVERY_BACKOFF_MS.length - 1\n  return SUPPLIER_DELIVERY_BACKOFF_MS[\n    Math.max(0, Math.min(attempts - 1, last))\n  ]\n}\n\n/**\n * The outbox document id for one host/order/supplier triple.\n *\n * Deterministic, so `create()` is the idempotency. `__` rather than `:` or `/`:\n * a slash would make `.doc()` build a PATH instead of an id (AGL-1771), and the\n * separator has to survive a Stripe session id, which already contains `_`.\n * Firestore reserves ids fully matching `__.*__`; this never is, because all\n * three parts are non-empty and the id neither starts nor ends with `__`.\n */\nexport function supplierDeliveryId(\n  hostId: string,\n  orderId: string,\n  supplierId: string,\n): string {\n  return `${hostId}__${orderId}__${supplierId}`\n}\n\n/**\n * Records that a supplier POST is owed. One Firestore write, awaited.\n *\n * Returns `'queued'`, `'exists'` when a row for this triple is already in\n * flight, or `'skipped'`. NEVER THROWS: the caller is a paid order's fulfilment\n * path, and a queue that cannot be written must not take the receipt down with\n * it. The refusal is logged, which is strictly more than the old code managed\n * on the same failure.\n */\nexport async function enqueueSupplierDelivery(options: {\n  firestore: FirebaseFirestore.Firestore\n  hostId: string\n  orderId: string\n  supplierId: string\n  supplierName: string\n  url: string\n  body: string\n  now?: number\n}): Promise<'queued' | 'exists' | 'skipped'> {\n  const { firestore, hostId, orderId, supplierId, supplierName, url, body } =\n    options\n  const now = options.now ?? Date.now()\n  const id = supplierDeliveryId(hostId, orderId, supplierId)\n  if (!isDocumentId(id)) {\n    console.error('Supplier delivery not queued: unusable id', id)\n    return 'skipped'\n  }\n  const record: SupplierDeliveryRecord = {\n    status: 'pending',\n    hostId,\n    orderId,\n    supplierId,\n    supplierName,\n    url,\n    body,\n    attempts: 0,\n    // Due immediately: the next beat picks it up, at most a minute out.\n    nextAttemptAtMs: now,\n    createdAtMs: now,\n  }\n  try {\n    await firestore\n      .collection(SUPPLIER_DELIVERY_COLLECTION)\n      .doc(id)\n      .create(record as unknown as FirebaseFirestore.DocumentData)\n    return 'queued'\n  } catch (error) {\n    if ((error as { code?: number })?.code === GRPC_ALREADY_EXISTS) {\n      return 'exists'\n    }\n    console.error('Supplier delivery not queued', hostId, orderId, error)\n    return 'skipped'\n  }\n}\n\n/**\n * Stamps a routing failure on the order the merchant actually reads.\n *\n * `update()`, not a merge-set, for `recordRedemptionOrphan`'s reason: the order\n * exists — the delivery was queued from its own fulfilment — and a merge would\n * mint an order stub on the one path where it does not.\n */\nasync function stampOrderRoutingFailure(\n  firestore: FirebaseFirestore.Firestore,\n  hostId: string,\n  orderId: string,\n  detail: string,\n): Promise<void> {\n  if (!isDocumentId(hostId) || !isDocumentId(orderId)) return\n  await firestore\n    .collection('hosts')\n    .doc(hostId)\n    .collection('orders')\n    .doc(orderId)\n    .update({\n      timeline: firebaseAdmin.firestore.FieldValue.arrayUnion({\n        atMs: Date.now(),\n        event: 'routing-failed',\n        detail,\n      }),\n    })\n    .catch(() => undefined)\n}\n\ntype DeliveryOutcome = 'delivered' | 'retried' | 'dead-lettered' | 'cancelled'\n\n/**\n * One delivery attempt.\n *\n * Never throws: the drain is a shared beat, and one merchant's supplier must\n * not abort every other merchant's queue — the `process-restock.ts` lesson,\n * where a single poisoned row killed back-in-stock email platform-wide.\n */\nasync function attemptSupplierDelivery(\n  firestore: FirebaseFirestore.Firestore,\n  snapshot: FirebaseFirestore.QueryDocumentSnapshot,\n  now: number,\n): Promise<DeliveryOutcome> {\n  const data = snapshot.data() as SupplierDeliveryRecord\n  const hostId = String(data.hostId ?? '')\n  const attempts = Number(data.attempts ?? 0) + 1\n\n  const retire = async (): Promise<'cancelled'> => {\n    await snapshot.ref.delete().catch(() => undefined)\n    return 'cancelled'\n  }\n  if (!isDocumentId(hostId) || !isDocumentId(String(data.supplierId ?? ''))) {\n    return retire()\n  }\n\n  // The endpoint and the secret are read FRESH rather than frozen into the row:\n  // a merchant correcting a typo'd URL corrects what is already queued, and the\n  // supplier's shared secret is never copied into a second document.\n  const supplierSnapshot = await firestore\n    .collection('hosts')\n    .doc(hostId)\n    .collection('suppliers')\n    .doc(String(data.supplierId))\n    .get()\n    .catch(() => null)\n  // A read that FAILED is not a supplier that is gone. Retrying beats retiring\n  // a real delivery on a transient Firestore error — the `reconcile-stock.ts`\n  // rule that a failed read is not an absent marker.\n  if (!supplierSnapshot) {\n    return recordFailure(\n      firestore,\n      snapshot,\n      data,\n      attempts,\n      now,\n      'could not read the supplier record',\n      undefined,\n    )\n  }\n  const url = String(supplierSnapshot.get('webhookUrl') ?? '')\n  if (!url) {\n    // Deliberately NOT a dead letter: the merchant removed the endpoint (or the\n    // supplier), which is a decision rather than an outage. Alarming them about\n    // a delivery they cancelled is how an alert stops being read.\n    return retire()\n  }\n  const secret = String(supplierSnapshot.get('webhookSecret') ?? '')\n  const body = String(data.body ?? '')\n\n  let status: number\n  try {\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        // NO EMPTY-KEY HMAC (AGL-2455). A signature computed under `''` is one\n        // any party can compute, and a supplier who also left their secret\n        // unset would verify it and believe the delivery was authenticated. An\n        // absent header fails their check closed; a forgeable one passes it.\n        ...(secret\n          ? {\n              'x-aglyn-signature': createHmac('sha256', secret)\n                .update(body)\n                .digest('hex'),\n            }\n          : {}),\n      },\n      body,\n      signal: AbortSignal.timeout(SUPPLIER_DELIVERY_TIMEOUT_MS),\n    })\n    status = Number(response?.status ?? 0)\n    if (!response?.ok) {\n      return recordFailure(\n        firestore,\n        snapshot,\n        data,\n        attempts,\n        now,\n        `supplier answered HTTP ${status}`,\n        status,\n      )\n    }\n  } catch (error) {\n    return recordFailure(\n      firestore,\n      snapshot,\n      data,\n      attempts,\n      now,\n      String((error as Error)?.message ?? error),\n      undefined,\n    )\n  }\n\n  // Delivered rows are DELETED rather than stamped — see the module note: the\n  // body holds the buyer's email and name, and a top-level document is outside\n  // the recursive delete an erasure request runs over `hosts/{hostId}`.\n  await snapshot.ref.delete().catch(() => undefined)\n  return 'delivered'\n}\n\n/** Books one failure: another retry, or the dead letter and its two alarms. */\nasync function recordFailure(\n  firestore: FirebaseFirestore.Firestore,\n  snapshot: FirebaseFirestore.QueryDocumentSnapshot,\n  data: SupplierDeliveryRecord,\n  attempts: number,\n  now: number,\n  reason: string,\n  status: number | undefined,\n): Promise<'retried' | 'dead-lettered'> {\n  const exhausted = attempts >= SUPPLIER_DELIVERY_MAX_ATTEMPTS\n  await snapshot.ref\n    .update({\n      status: exhausted ? 'failed' : 'pending',\n      attempts,\n      lastError: reason,\n      ...(status ? { lastStatus: status } : {}),\n      ...(exhausted\n        ? { failedAtMs: now }\n        : { nextAttemptAtMs: now + supplierDeliveryBackoffMs(attempts) }),\n    })\n    .catch(() => undefined)\n  if (!exhausted) return 'retried'\n\n  const hostId = String(data.hostId ?? '')\n  const orderId = String(data.orderId ?? '')\n  const supplierName = String(data.supplierName ?? '') || 'the supplier'\n  await stampOrderRoutingFailure(\n    firestore,\n    hostId,\n    orderId,\n    `Could not reach ${supplierName} after ${attempts} attempts ` +\n      `(${reason}). This order was never routed.`,\n  )\n  // The bell as well as the timeline: nobody opens an order they have no\n  // reason to suspect.\n  await notifyHostManagers(hostId, {\n    type: 'content.order',\n    title: `Order not routed to ${supplierName}`,\n    body: `Order ${orderId} could not be sent after ${attempts} attempts.`,\n    link: `/${hostId}/products`,\n  }).catch(() => undefined)\n  return 'dead-lettered'\n}\n\n/**\n * Drains the supplier outbox. Bounded, and safe to run twice.\n *\n * `nextAttemptAtMs` is filtered IN MEMORY rather than added to the query, which\n * would need a composite index for one field's worth of selectivity. The cost\n * is that a row still inside its backoff occupies one of the\n * {@link SUPPLIER_DELIVERY_SCAN_LIMIT} slots; with at most\n * {@link SUPPLIER_DELIVERY_MAX_ATTEMPTS} attempts per row the queue always\n * drains rather than growing a permanent head.\n */\nexport async function scanSupplierDeliveries(\n  /** The lockdown gate, injected by the caller (AGL-2495). Not optional. */\n  gate: PluginJobHostGate,\n  now: number = Date.now(),\n): Promise<SupplierDeliveryScanResult> {\n  const firestore = firebaseAdmin.app().firestore()\n  const pending = await firestore\n    .collection(SUPPLIER_DELIVERY_COLLECTION)\n    .where('status', '==', 'pending')\n    .limit(SUPPLIER_DELIVERY_SCAN_LIMIT)\n    .get()\n  const result: SupplierDeliveryScanResult = {\n    scanned: pending.size,\n    delivered: 0,\n    retried: 0,\n    deadLettered: 0,\n    cancelled: 0,\n    skippedLocked: 0,\n  }\n  for (const snapshot of pending.docs) {\n    const data = snapshot.data() as SupplierDeliveryRecord\n    // LOCKDOWN (AGL-2495). The row is a TOP-LEVEL document carrying its own\n    // `hostId` rather than living under `hosts/{hostId}`, so the host is read\n    // from the record instead of the parent chain — the one job of the six\n    // whose subject is not in its path.\n    //\n    // An outbound POST to the merchant's supplier is this platform acting in\n    // a suspended merchant's name against a third party, which is precisely\n    // what a takedown is for. The attempt also mutates the row (`attempts`,\n    // `nextAttemptAtMs`, or the dead-letter) and can notify the host's\n    // managers.\n    //\n    // SKIPPED, NOT DROPPED, and the strongest case of the six: the row stays\n    // `pending` with its `attempts` count untouched, so a long lock cannot\n    // burn a paid order's retry budget and dead-letter it for being locked.\n    // The queue drains from where it stood the minute the lock lifts.\n    if (await gate.isLocked(String(data?.hostId ?? ''))) {\n      result.skippedLocked += 1\n      continue\n    }\n    if (Number(data?.nextAttemptAtMs ?? 0) > now) continue\n    const outcome = await attemptSupplierDelivery(\n      firestore,\n      snapshot,\n      now,\n    ).catch((error) => {\n      console.error(\n        'Supplier delivery attempt failed',\n        snapshot.ref.path,\n        error,\n      )\n      return null\n    })\n    if (outcome === 'delivered') result.delivered += 1\n    else if (outcome === 'retried') result.retried += 1\n    else if (outcome === 'dead-lettered') result.deadLettered += 1\n    else if (outcome === 'cancelled') result.cancelled += 1\n  }\n  return result\n}\n"],"names":["firebaseAdmin","notifyHostManagers","isDocumentId","createHmac","SUPPLIER_DELIVERY_COLLECTION","SUPPLIER_DELIVERY_MAX_ATTEMPTS","SUPPLIER_DELIVERY_BACKOFF_MS","SUPPLIER_DELIVERY_TIMEOUT_MS","SUPPLIER_DELIVERY_SCAN_LIMIT","GRPC_ALREADY_EXISTS","supplierDeliveryBackoffMs","attempts","last","length","Math","max","min","supplierDeliveryId","hostId","orderId","supplierId","enqueueSupplierDelivery","options","firestore","supplierName","url","body","now","Date","id","console","error","record","status","nextAttemptAtMs","createdAtMs","collection","doc","create","code","stampOrderRoutingFailure","detail","update","timeline","FieldValue","arrayUnion","atMs","event","catch","undefined","attemptSupplierDelivery","snapshot","data","supplierSnapshot","String","Number","retire","ref","delete","get","recordFailure","secret","response","fetch","method","headers","digest","signal","AbortSignal","timeout","ok","message","reason","exhausted","lastError","lastStatus","failedAtMs","type","title","link","scanSupplierDeliveries","gate","app","pending","where","limit","result","scanned","size","delivered","retried","deadLettered","cancelled","skippedLocked","docs","isLocked","outcome","path"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,aAAa,EACbC,kBAAkB,QACb,2BAA0B;AACjC,SAASC,YAAY,QAAQ,8CAA6C;AAC1E,SAASC,UAAU,QAAQ,SAAQ;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4EC,GAED,8EAA8E,GAC9E,OAAO,MAAMC,+BAA+B,qBAAoB;AAEhE,iDAAiD,GACjD,OAAO,MAAMC,iCAAiC,EAAC;AAE/C;;;;;;CAMC,GACD,OAAO,MAAMC,+BAAkD;IAC7D;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,MAAM;AAElD,wEAAwE,GACxE,OAAO,MAAMC,+BAA+B,IAAG;AAiC/C,2EAA2E,GAC3E,MAAMC,sBAAsB;AAE5B;;;;;CAKC,GACD,OAAO,SAASC,0BAA0BC,QAAgB;IACxD,MAAMC,OAAON,6BAA6BO,MAAM,GAAG;IACnD,OAAOP,4BAA4B,CACjCQ,KAAKC,GAAG,CAAC,GAAGD,KAAKE,GAAG,CAACL,WAAW,GAAGC,OACpC;AACH;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASK,mBACdC,MAAc,EACdC,OAAe,EACfC,UAAkB;IAElB,OAAO,GAAGF,OAAO,EAAE,EAAEC,QAAQ,EAAE,EAAEC,YAAY;AAC/C;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,wBAAwBC,OAS7C;QAGaA;IAFZ,MAAM,EAAEC,SAAS,EAAEL,MAAM,EAAEC,OAAO,EAAEC,UAAU,EAAEI,YAAY,EAAEC,GAAG,EAAEC,IAAI,EAAE,GACvEJ;IACF,MAAMK,OAAML,eAAAA,QAAQK,GAAG,YAAXL,eAAeM,KAAKD,GAAG;IACnC,MAAME,KAAKZ,mBAAmBC,QAAQC,SAASC;IAC/C,IAAI,CAAClB,aAAa2B,KAAK;QACrBC,QAAQC,KAAK,CAAC,6CAA6CF;QAC3D,OAAO;IACT;IACA,MAAMG,SAAiC;QACrCC,QAAQ;QACRf;QACAC;QACAC;QACAI;QACAC;QACAC;QACAf,UAAU;QACV,oEAAoE;QACpEuB,iBAAiBP;QACjBQ,aAAaR;IACf;IACA,IAAI;QACF,MAAMJ,UACHa,UAAU,CAAChC,8BACXiC,GAAG,CAACR,IACJS,MAAM,CAACN;QACV,OAAO;IACT,EAAE,OAAOD,OAAO;QACd,IAAI,CAACA,yBAAD,AAACA,MAA6BQ,IAAI,MAAK9B,qBAAqB;YAC9D,OAAO;QACT;QACAqB,QAAQC,KAAK,CAAC,gCAAgCb,QAAQC,SAASY;QAC/D,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,eAAeS,yBACbjB,SAAsC,EACtCL,MAAc,EACdC,OAAe,EACfsB,MAAc;IAEd,IAAI,CAACvC,aAAagB,WAAW,CAAChB,aAAaiB,UAAU;IACrD,MAAMI,UACHa,UAAU,CAAC,SACXC,GAAG,CAACnB,QACJkB,UAAU,CAAC,UACXC,GAAG,CAAClB,SACJuB,MAAM,CAAC;QACNC,UAAU3C,cAAcuB,SAAS,CAACqB,UAAU,CAACC,UAAU,CAAC;YACtDC,MAAMlB,KAAKD,GAAG;YACdoB,OAAO;YACPN;QACF;IACF,GACCO,KAAK,CAAC,IAAMC;AACjB;AAIA;;;;;;CAMC,GACD,eAAeC,wBACb3B,SAAsC,EACtC4B,QAAiD,EACjDxB,GAAW;QAGWyB,cACEA,gBAM0BA,kBA4B/BC,uBAOGA,wBACFD;IA5CpB,MAAMA,OAAOD,SAASC,IAAI;IAC1B,MAAMlC,SAASoC,QAAOF,eAAAA,KAAKlC,MAAM,YAAXkC,eAAe;IACrC,MAAMzC,WAAW4C,QAAOH,iBAAAA,KAAKzC,QAAQ,YAAbyC,iBAAiB,KAAK;IAE9C,MAAMI,SAAS;QACb,MAAML,SAASM,GAAG,CAACC,MAAM,GAAGV,KAAK,CAAC,IAAMC;QACxC,OAAO;IACT;IACA,IAAI,CAAC/C,aAAagB,WAAW,CAAChB,aAAaoD,QAAOF,mBAAAA,KAAKhC,UAAU,YAAfgC,mBAAmB,MAAM;QACzE,OAAOI;IACT;IAEA,8EAA8E;IAC9E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAMH,mBAAmB,MAAM9B,UAC5Ba,UAAU,CAAC,SACXC,GAAG,CAACnB,QACJkB,UAAU,CAAC,aACXC,GAAG,CAACiB,OAAOF,KAAKhC,UAAU,GAC1BuC,GAAG,GACHX,KAAK,CAAC,IAAM;IACf,6EAA6E;IAC7E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,CAACK,kBAAkB;QACrB,OAAOO,cACLrC,WACA4B,UACAC,MACAzC,UACAgB,KACA,sCACAsB;IAEJ;IACA,MAAMxB,MAAM6B,QAAOD,wBAAAA,iBAAiBM,GAAG,CAAC,yBAArBN,wBAAsC;IACzD,IAAI,CAAC5B,KAAK;QACR,4EAA4E;QAC5E,4EAA4E;QAC5E,8DAA8D;QAC9D,OAAO+B;IACT;IACA,MAAMK,SAASP,QAAOD,yBAAAA,iBAAiBM,GAAG,CAAC,4BAArBN,yBAAyC;IAC/D,MAAM3B,OAAO4B,QAAOF,aAAAA,KAAK1B,IAAI,YAAT0B,aAAa;IAEjC,IAAInB;IACJ,IAAI;;QACF,MAAM6B,WAAW,MAAMC,MAAMtC,KAAK;YAChCuC,QAAQ;YACRC,SAAS;gBACP,gBAAgB;eAKZJ,SACA;gBACE,qBAAqB1D,WAAW,UAAU0D,QACvCnB,MAAM,CAAChB,MACPwC,MAAM,CAAC;YACZ,IACA,CAAC;YAEPxC;YACAyC,QAAQC,YAAYC,OAAO,CAAC9D;QAC9B;QACA0B,SAASsB,eAAOO,4BAAAA,SAAU7B,MAAM,mBAAI;QACpC,IAAI,EAAC6B,4BAAAA,SAAUQ,EAAE,GAAE;YACjB,OAAOV,cACLrC,WACA4B,UACAC,MACAzC,UACAgB,KACA,CAAC,uBAAuB,EAAEM,QAAQ,EAClCA;QAEJ;IACF,EAAE,OAAOF,OAAO;;QACd,OAAO6B,cACLrC,WACA4B,UACAC,MACAzC,UACAgB,KACA2B,gBAAQvB,yBAAD,AAACA,MAAiBwC,OAAO,oBAAIxC,QACpCkB;IAEJ;IAEA,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAME,SAASM,GAAG,CAACC,MAAM,GAAGV,KAAK,CAAC,IAAMC;IACxC,OAAO;AACT;AAEA,6EAA6E,GAC7E,eAAeW,cACbrC,SAAsC,EACtC4B,QAAiD,EACjDC,IAA4B,EAC5BzC,QAAgB,EAChBgB,GAAW,EACX6C,MAAc,EACdvC,MAA0B;QAgBJmB,cACCA,eACKA;IAhB5B,MAAMqB,YAAY9D,YAAYN;IAC9B,MAAM8C,SAASM,GAAG,CACff,MAAM,CAAC;QACNT,QAAQwC,YAAY,WAAW;QAC/B9D;QACA+D,WAAWF;OACPvC,SAAS;QAAE0C,YAAY1C;IAAO,IAAI,CAAC,GACnCwC,YACA;QAAEG,YAAYjD;IAAI,IAClB;QAAEO,iBAAiBP,MAAMjB,0BAA0BC;IAAU,IAElEqC,KAAK,CAAC,IAAMC;IACf,IAAI,CAACwB,WAAW,OAAO;IAEvB,MAAMvD,SAASoC,QAAOF,eAAAA,KAAKlC,MAAM,YAAXkC,eAAe;IACrC,MAAMjC,UAAUmC,QAAOF,gBAAAA,KAAKjC,OAAO,YAAZiC,gBAAgB;IACvC,MAAM5B,eAAe8B,QAAOF,qBAAAA,KAAK5B,YAAY,YAAjB4B,qBAAqB,OAAO;IACxD,MAAMZ,yBACJjB,WACAL,QACAC,SACA,CAAC,gBAAgB,EAAEK,aAAa,OAAO,EAAEb,SAAS,UAAU,CAAC,GAC3D,CAAC,CAAC,EAAE6D,OAAO,+BAA+B,CAAC;IAE/C,uEAAuE;IACvE,qBAAqB;IACrB,MAAMvE,mBAAmBiB,QAAQ;QAC/B2D,MAAM;QACNC,OAAO,CAAC,oBAAoB,EAAEtD,cAAc;QAC5CE,MAAM,CAAC,MAAM,EAAEP,QAAQ,yBAAyB,EAAER,SAAS,UAAU,CAAC;QACtEoE,MAAM,CAAC,CAAC,EAAE7D,OAAO,SAAS,CAAC;IAC7B,GAAG8B,KAAK,CAAC,IAAMC;IACf,OAAO;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAe+B,uBACpB,wEAAwE,GACxEC,IAAuB,EACvBtD,MAAcC,KAAKD,GAAG,EAAE;IAExB,MAAMJ,YAAYvB,cAAckF,GAAG,GAAG3D,SAAS;IAC/C,MAAM4D,UAAU,MAAM5D,UACnBa,UAAU,CAAChC,8BACXgF,KAAK,CAAC,UAAU,MAAM,WACtBC,KAAK,CAAC7E,8BACNmD,GAAG;IACN,MAAM2B,SAAqC;QACzCC,SAASJ,QAAQK,IAAI;QACrBC,WAAW;QACXC,SAAS;QACTC,cAAc;QACdC,WAAW;QACXC,eAAe;IACjB;IACA,KAAK,MAAM1C,YAAYgC,QAAQW,IAAI,CAAE;;QACnC,MAAM1C,OAAOD,SAASC,IAAI;QAC1B,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,oCAAoC;QACpC,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACnE,YAAY;QACZ,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,MAAM6B,KAAKc,QAAQ,CAACzC,eAAOF,wBAAAA,KAAMlC,MAAM,mBAAI,MAAM;YACnDoE,OAAOO,aAAa,IAAI;YACxB;QACF;QACA,IAAItC,gBAAOH,wBAAAA,KAAMlB,eAAe,oBAAI,KAAKP,KAAK;QAC9C,MAAMqE,UAAU,MAAM9C,wBACpB3B,WACA4B,UACAxB,KACAqB,KAAK,CAAC,CAACjB;YACPD,QAAQC,KAAK,CACX,oCACAoB,SAASM,GAAG,CAACwC,IAAI,EACjBlE;YAEF,OAAO;QACT;QACA,IAAIiE,YAAY,aAAaV,OAAOG,SAAS,IAAI;aAC5C,IAAIO,YAAY,WAAWV,OAAOI,OAAO,IAAI;aAC7C,IAAIM,YAAY,iBAAiBV,OAAOK,YAAY,IAAI;aACxD,IAAIK,YAAY,aAAaV,OAAOM,SAAS,IAAI;IACxD;IACA,OAAON;AACT"}

package/src/lib/server/supplier-update.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Supplier tracking callback (AGL-289): the routed order carried a
+ * per-order token; posting (or GET-ing, for email links) tracking with
+ * it fulfills the order. Token-gated — suppliers have no Aglyn account.
+ */
+export declare const supplierUpdateHandler: PluginApiHandler;

package/src/lib/server/supplier-update.js

@@ -0,0 +1,289 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import * as CommerceModel from "../model/index.js";
+import { firebaseAdmin, notifyHostManagers } from "@aglyn/tenant-data-admin";
+import { escapeHtml } from "../utils/escape-html.js";
+import { createHmac, timingSafeEqual } from "crypto";
+import { tokenSigningSecret } from "./download.js";
+/**
+ * Constant-time compare for the per-order supplier token (AGL-2268).
+ *
+ * `!==` on a secret leaks its prefix through response timing, and this token is
+ * a bearer credential for a route with no account behind it — the only thing
+ * standing between the open internet and marking a merchant's order shipped.
+ * `download.ts` has compared its own token this way since it shipped; this is
+ * the sibling that did not.
+ *
+ * Length is compared first and OUTSIDE the constant-time call, because
+ * `timingSafeEqual` throws on a length mismatch. That leaks the token's LENGTH
+ * and nothing else, which is the same concession `download.ts` makes.
+ */ function tokenMatches(stored, presented) {
+    const expected = typeof stored === 'string' ? stored : '';
+    if (!expected || !presented) return false;
+    const a = Buffer.from(presented);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length) return false;
+    return timingSafeEqual(new Uint8Array(a), new Uint8Array(b));
+}
+/**
+ * WHICH supplier is posting (AGL-2455), and the observation that makes the
+ * issue's "structural blocker" not structural after all.
+ *
+ * The order document holds ONE `supplierToken` field, so the issue's reading
+ * was that scoping lines per supplier would strand every other supplier's lines
+ * permanently: only the last token written could authenticate, and the others
+ * would have no valid credential at all. That reading is right about the stored
+ * field and wrong about the token.
+ *
+ * The token is not a random secret that has to be stored to be known. It is
+ * `HMAC(hostId:orderId:supplierId)` under `TOKEN_SIGNING_SECRET`
+ * (`billing-webhook.ts`), a pure function of three identifiers the order
+ * already carries — `supplierId` is stamped onto every line at purchase time.
+ * So the expected token for EVERY supplier on the order can be re-derived here
+ * and compared, which both identifies the poster and lets every supplier
+ * authenticate. No schema change, no migration, no map.
+ *
+ * Every candidate is compared even after a match, so the work done is a
+ * function of the order's supplier count and not of which supplier posted.
+ *
+ * Returns `null` when nothing matches; the stored-scalar fallback is the
+ * caller's, because only it knows whether that fallback is ambiguous.
+ */ function resolvePostingSupplier(hostId, orderId, order, presented) {
+    let secret;
+    try {
+        secret = tokenSigningSecret();
+    } catch (unused) {
+        // Unset secret: no token could have been MINTED either, so there is nothing
+        // to derive. Fall through to the stored scalar rather than throwing a 500
+        // at a supplier who cannot do anything about it.
+        return null;
+    }
+    let matched = null;
+    for (const supplierId of CommerceModel.orderSupplierIds(order)){
+        const expected = createHmac('sha256', secret).update(`${hostId}:${orderId}:${supplierId}`).digest('hex').slice(0, 32);
+        if (tokenMatches(expected, presented)) matched = supplierId;
+    }
+    return matched;
+}
+/**
+ * Supplier tracking callback (AGL-289): the routed order carried a
+ * per-order token; posting (or GET-ing, for email links) tracking with
+ * it fulfills the order. Token-gated — suppliers have no Aglyn account.
+ */ export const supplierUpdateHandler = async (req, res)=>{
+    var _req_body, _source_hostId, _source_orderId, _source_token, _source_trackingNumber, _source_carrier;
+    const source = req.method === 'POST' ? _extends({}, req.query, typeof req.body === 'string' ? JSON.parse(req.body || '{}') : (_req_body = req.body) != null ? _req_body : {}) : req.query;
+    const hostId = String((_source_hostId = source.hostId) != null ? _source_hostId : '');
+    const orderId = String((_source_orderId = source.orderId) != null ? _source_orderId : '');
+    const token = String((_source_token = source.token) != null ? _source_token : '');
+    const trackingNumber = String((_source_trackingNumber = source.trackingNumber) != null ? _source_trackingNumber : '').slice(0, 60);
+    const carrier = String((_source_carrier = source.carrier) != null ? _source_carrier : '').slice(0, 40);
+    if (!hostId || !orderId || !token) {
+        return res.status(400).json({
+            error: 'Missing hostId, orderId, or token'
+        });
+    }
+    // Firestore reserves `__…__` ids and `.doc()` throws SYNCHRONOUSLY on one,
+    // which fell into the catch below and answered 500 to what is a 400
+    // (AGL-2455). `fulfill-order.ts` has had this guard since it shipped; this is
+    // the sibling route that did not.
+    if (/^__.*__$/.test(hostId) || /^__.*__$/.test(orderId)) {
+        return res.status(400).json({
+            error: 'Missing hostId, orderId, or token'
+        });
+    }
+    try {
+        var _outcome_remaining;
+        const firestore = firebaseAdmin.app().firestore();
+        const orderRef = firestore.collection('hosts').doc(hostId).collection('orders').doc(orderId);
+        // A GET NEVER MOVES THE ORDER (AGL-2268). The supplier email carries this
+        // URL, and a GET that fulfils means every link scanner, spam filter,
+        // preview generator and browser prefetch on the path between us and the
+        // supplier's inbox marks the order shipped — before anything shipped, and
+        // with no tracking number on it. The link still works and the email is
+        // unchanged: a GET renders a one-button page that POSTs the same
+        // parameters, so the supplier's experience is one extra click and the
+        // machines that open mail for a living take no action at all.
+        if (req.method === 'GET') {
+            res.setHeader('Content-Type', 'text/html');
+            const field = (name, value)=>`<input type="hidden" name="${name}" value="${escapeHtml(value)}">`;
+            return res.status(200).send('<h3>Confirm this shipment</h3>' + '<p>Press the button to record it against the order.</p>' + '<form method="POST">' + field('hostId', hostId) + field('orderId', orderId) + field('token', token) + field('carrier', carrier) + field('trackingNumber', trackingNumber) + '<button type="submit">Mark as shipped</button>' + '</form>');
+        }
+        // THE READ, THE TRANSITION CHECK AND THE WRITE ARE ONE ACT (AGL-2268).
+        // They used to be a plain `get()`, a check, and a `set(…, {merge:true})`,
+        // which is the exact stale-read hole AGL-1808/1818/1819 closed on the
+        // console's own fulfil, cancel and refund routes — reopened here, on the
+        // one door with no account behind it. A supplier POST racing a refund read
+        // `paid`, the refund landed, and the POST then wrote `fulfilled` over
+        // `refunded`. `ORDER_TRANSITIONS` says `refunded: []`, and the cost is not
+        // cosmetic: `gate.ts`, `download.ts`, `membership-account.ts` and
+        // `reviews.ts` all withdraw a shopper's entitlement by matching that
+        // literal, so the refunded buyer got their downloads back.
+        const outcome = await firebaseAdmin.app().firestore().runTransaction(async (transaction)=>{
+            var _order_lineItems, _order_fulfillments, _order_lineItems1, _order_lineItems2;
+            const orderSnapshot = await transaction.get(orderRef);
+            if (!orderSnapshot.exists) {
+                return {
+                    status: 404,
+                    body: {
+                        error: 'Unknown order'
+                    }
+                };
+            }
+            const order = CommerceModel.liftLegacyOrder(orderSnapshot.data());
+            // ONE SUPPLIER SHIPS ONE SUPPLIER'S LINES (AGL-2455).
+            //
+            // `lineItemIds` used to be every index on the order and the status was
+            // written as the literal `'fulfilled'`, so the first supplier to post
+            // marked the whole order shipped — lines they had never seen included —
+            // and the second supplier's POST met a 409. The buyer was told
+            // everything shipped with one carrier and one tracking number.
+            const suppliers = CommerceModel.orderSupplierIds(order);
+            const postingSupplier = resolvePostingSupplier(hostId, orderId, order, token);
+            let myLines;
+            if (postingSupplier) {
+                myLines = CommerceModel.supplierLineItemIds(order, postingSupplier);
+            } else if (tokenMatches(orderSnapshot.get('supplierToken'), token)) {
+                var _order_lineItems3;
+                // The STORED scalar matched but no supplier on the order derives to
+                // it — an order whose lines carry no `supplierId`, which is every
+                // order routed before that field was stamped.
+                //
+                // With at most one supplier there is only one door, so claiming every
+                // line is the same answer this route has always given and is right.
+                // With TWO OR MORE, the scalar cannot say whose token it is, and
+                // guessing would either close lines a supplier never shipped (the
+                // defect) or strand them (the naive fix). REFUSED LOUDLY instead:
+                // the merchant fulfils from the console, where they can see the
+                // lines, and the message says so rather than leaving them to work it
+                // out from an order that silently went quiet.
+                if (suppliers.length > 1) {
+                    return {
+                        status: 409,
+                        body: {
+                            error: 'This order has more than one supplier and the link cannot ' + 'say which of them you are. Nothing was changed. Please ask ' + 'the merchant to record this shipment from their console.'
+                        }
+                    };
+                }
+                myLines = ((_order_lineItems3 = order.lineItems) != null ? _order_lineItems3 : []).map((_line, index)=>index);
+            } else {
+                return {
+                    status: 403,
+                    body: {
+                        error: 'Invalid token'
+                    }
+                };
+            }
+            if (myLines.length === 0) {
+                return {
+                    status: 409,
+                    body: {
+                        error: 'No lines on this order are yours'
+                    }
+                };
+            }
+            const coveredBefore = CommerceModel.coveredLineItemIds(order);
+            if (myLines.every((index)=>coveredBefore.has(index))) {
+                // Every line of theirs is already shipped: a redelivered POST, or the
+                // supplier pressing the emailed button twice. Refused rather than
+                // appending a second copy of the same fulfillment — the same rule
+                // `fulfill-order.ts` applies to a retried click.
+                return {
+                    status: 409,
+                    body: {
+                        error: suppliers.length > 1 ? 'Your lines on this order are already marked shipped' : `Order is already ${order.status}`
+                    }
+                };
+            }
+            const coveredAfter = new Set([
+                ...coveredBefore,
+                ...myLines
+            ]);
+            // COMPUTED, not written as a literal. `partially_fulfilled` has been in
+            // `ORDER_TRANSITIONS` since orders shipped and nothing ever wrote it.
+            const nextStatus = CommerceModel.statusAfterFulfilling(order, coveredAfter);
+            // Re-asked inside the transaction that writes, as AGL-2268 established:
+            // a supplier POST racing a refund must not write over `refunded`. Only
+            // when the status actually MOVES — a second supplier posting onto an
+            // already `partially_fulfilled` order changes nothing about the status
+            // and must not be refused by a table that has no self-edge.
+            if (nextStatus !== order.status && !CommerceModel.canTransitionOrder(order.status, nextStatus)) {
+                return {
+                    status: 409,
+                    body: {
+                        error: `Order is already ${order.status}`
+                    }
+                };
+            }
+            const fulfillment = _extends({
+                id: `supplier-${Date.now().toString(36)}`,
+                lineItemIds: myLines
+            }, carrier ? {
+                carrier
+            } : {}, trackingNumber ? {
+                trackingNumber
+            } : {}, {
+                atMs: Date.now()
+            });
+            const remaining = ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).filter((_line, index)=>!coveredAfter.has(index)).length;
+            transaction.set(orderRef, {
+                status: nextStatus,
+                fulfillments: [
+                    ...(_order_fulfillments = order.fulfillments) != null ? _order_fulfillments : [],
+                    fulfillment
+                ],
+                timeline: CommerceModel.appendOrderEvent(order, nextStatus, `Supplier shipped ${myLines.length} of ${((_order_lineItems1 = order.lineItems) != null ? _order_lineItems1 : []).length} line${((_order_lineItems2 = order.lineItems) != null ? _order_lineItems2 : []).length === 1 ? '' : 's'}` + (trackingNumber ? ` — ${carrier || 'tracking'} ${trackingNumber}` : '') + (remaining > 0 ? `. ${remaining} line${remaining === 1 ? '' : 's'} still to ship.` : ''))
+            }, {
+                merge: true
+            });
+            return {
+                status: 200,
+                body: {
+                    ok: true,
+                    lineItemIds: myLines,
+                    orderStatus: nextStatus
+                },
+                order,
+                nextStatus,
+                remaining
+            };
+        });
+        if (outcome.status !== 200) {
+            return res.status(outcome.status).json(outcome.body);
+        }
+        // The merchant is told what is STILL OUTSTANDING (AGL-2455). "Supplier
+        // shipped #1042" on an order where one of three suppliers has posted reads
+        // as done, which is the same misreport the status literal made — the
+        // merchant would stop watching an order that is two thirds unshipped.
+        const outstanding = Number((_outcome_remaining = outcome.remaining) != null ? _outcome_remaining : 0);
+        void notifyHostManagers(hostId, _extends({
+            type: 'content.order',
+            title: `Supplier shipped ${CommerceModel.formatOrderNumber(outcome.order, orderId)}${outstanding > 0 ? ` — ${outstanding} line${outstanding === 1 ? '' : 's'} still to ship` : ''}`
+        }, trackingNumber ? {
+            body: `${carrier} ${trackingNumber}`
+        } : {}, {
+            link: `/${hostId}/products`
+        }));
+        return res.status(200).json(outcome.body);
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Update failed'
+        });
+    }
+};
+
+//# sourceMappingURL=supplier-update.js.map

package/src/lib/server/supplier-update.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/supplier-update.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin, notifyHostManagers } from '@aglyn/tenant-data-admin'\nimport { escapeHtml } from '../utils/escape-html'\nimport { createHmac, timingSafeEqual } from 'crypto'\nimport { tokenSigningSecret } from './download'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\n\n/**\n * Constant-time compare for the per-order supplier token (AGL-2268).\n *\n * `!==` on a secret leaks its prefix through response timing, and this token is\n * a bearer credential for a route with no account behind it — the only thing\n * standing between the open internet and marking a merchant's order shipped.\n * `download.ts` has compared its own token this way since it shipped; this is\n * the sibling that did not.\n *\n * Length is compared first and OUTSIDE the constant-time call, because\n * `timingSafeEqual` throws on a length mismatch. That leaks the token's LENGTH\n * and nothing else, which is the same concession `download.ts` makes.\n */\nfunction tokenMatches(stored: unknown, presented: string): boolean {\n  const expected = typeof stored === 'string' ? stored : ''\n  if (!expected || !presented) return false\n  const a = Buffer.from(presented)\n  const b = Buffer.from(expected)\n  if (a.length !== b.length) return false\n  return timingSafeEqual(new Uint8Array(a), new Uint8Array(b))\n}\n\n/**\n * WHICH supplier is posting (AGL-2455), and the observation that makes the\n * issue's \"structural blocker\" not structural after all.\n *\n * The order document holds ONE `supplierToken` field, so the issue's reading\n * was that scoping lines per supplier would strand every other supplier's lines\n * permanently: only the last token written could authenticate, and the others\n * would have no valid credential at all. That reading is right about the stored\n * field and wrong about the token.\n *\n * The token is not a random secret that has to be stored to be known. It is\n * `HMAC(hostId:orderId:supplierId)` under `TOKEN_SIGNING_SECRET`\n * (`billing-webhook.ts`), a pure function of three identifiers the order\n * already carries — `supplierId` is stamped onto every line at purchase time.\n * So the expected token for EVERY supplier on the order can be re-derived here\n * and compared, which both identifies the poster and lets every supplier\n * authenticate. No schema change, no migration, no map.\n *\n * Every candidate is compared even after a match, so the work done is a\n * function of the order's supplier count and not of which supplier posted.\n *\n * Returns `null` when nothing matches; the stored-scalar fallback is the\n * caller's, because only it knows whether that fallback is ambiguous.\n */\nfunction resolvePostingSupplier(\n  hostId: string,\n  orderId: string,\n  order: CommerceModel.HostOrder,\n  presented: string,\n): string | null {\n  let secret: string\n  try {\n    secret = tokenSigningSecret()\n  } catch {\n    // Unset secret: no token could have been MINTED either, so there is nothing\n    // to derive. Fall through to the stored scalar rather than throwing a 500\n    // at a supplier who cannot do anything about it.\n    return null\n  }\n  let matched: string | null = null\n  for (const supplierId of CommerceModel.orderSupplierIds(order)) {\n    const expected = createHmac('sha256', secret)\n      .update(`${hostId}:${orderId}:${supplierId}`)\n      .digest('hex')\n      .slice(0, 32)\n    if (tokenMatches(expected, presented)) matched = supplierId\n  }\n  return matched\n}\n\n\n/**\n * Supplier tracking callback (AGL-289): the routed order carried a\n * per-order token; posting (or GET-ing, for email links) tracking with\n * it fulfills the order. Token-gated — suppliers have no Aglyn account.\n */\nexport const supplierUpdateHandler: PluginApiHandler = async (req, res) => {\n  const source = req.method === 'POST' ? { ...req.query, ...(typeof req.body === 'string' ? JSON.parse(req.body || '{}') : (req.body ?? {})) } : req.query\n  const hostId = String(source.hostId ?? '')\n  const orderId = String(source.orderId ?? '')\n  const token = String(source.token ?? '')\n  const trackingNumber = String(source.trackingNumber ?? '').slice(0, 60)\n  const carrier = String(source.carrier ?? '').slice(0, 40)\n  if (!hostId || !orderId || !token) {\n    return res.status(400).json({ error: 'Missing hostId, orderId, or token' })\n  }\n  // Firestore reserves `__…__` ids and `.doc()` throws SYNCHRONOUSLY on one,\n  // which fell into the catch below and answered 500 to what is a 400\n  // (AGL-2455). `fulfill-order.ts` has had this guard since it shipped; this is\n  // the sibling route that did not.\n  if (/^__.*__$/.test(hostId) || /^__.*__$/.test(orderId)) {\n    return res.status(400).json({ error: 'Missing hostId, orderId, or token' })\n  }\n\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const orderRef = firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('orders')\n      .doc(orderId)\n    // A GET NEVER MOVES THE ORDER (AGL-2268). The supplier email carries this\n    // URL, and a GET that fulfils means every link scanner, spam filter,\n    // preview generator and browser prefetch on the path between us and the\n    // supplier's inbox marks the order shipped — before anything shipped, and\n    // with no tracking number on it. The link still works and the email is\n    // unchanged: a GET renders a one-button page that POSTs the same\n    // parameters, so the supplier's experience is one extra click and the\n    // machines that open mail for a living take no action at all.\n    if (req.method === 'GET') {\n      res.setHeader('Content-Type', 'text/html')\n      const field = (name: string, value: string) =>\n        `<input type=\"hidden\" name=\"${name}\" value=\"${escapeHtml(value)}\">`\n      return res.status(200).send(\n        '<h3>Confirm this shipment</h3>' +\n          '<p>Press the button to record it against the order.</p>' +\n          '<form method=\"POST\">' +\n          field('hostId', hostId) +\n          field('orderId', orderId) +\n          field('token', token) +\n          field('carrier', carrier) +\n          field('trackingNumber', trackingNumber) +\n          '<button type=\"submit\">Mark as shipped</button>' +\n          '</form>',\n      )\n    }\n\n    // THE READ, THE TRANSITION CHECK AND THE WRITE ARE ONE ACT (AGL-2268).\n    // They used to be a plain `get()`, a check, and a `set(…, {merge:true})`,\n    // which is the exact stale-read hole AGL-1808/1818/1819 closed on the\n    // console's own fulfil, cancel and refund routes — reopened here, on the\n    // one door with no account behind it. A supplier POST racing a refund read\n    // `paid`, the refund landed, and the POST then wrote `fulfilled` over\n    // `refunded`. `ORDER_TRANSITIONS` says `refunded: []`, and the cost is not\n    // cosmetic: `gate.ts`, `download.ts`, `membership-account.ts` and\n    // `reviews.ts` all withdraw a shopper's entitlement by matching that\n    // literal, so the refunded buyer got their downloads back.\n    const outcome = await firebaseAdmin\n      .app()\n      .firestore()\n      .runTransaction(async (transaction) => {\n        const orderSnapshot = await transaction.get(orderRef)\n        if (!orderSnapshot.exists) {\n          return { status: 404, body: { error: 'Unknown order' } as any }\n        }\n        const order = CommerceModel.liftLegacyOrder(orderSnapshot.data() as any)\n        // ONE SUPPLIER SHIPS ONE SUPPLIER'S LINES (AGL-2455).\n        //\n        // `lineItemIds` used to be every index on the order and the status was\n        // written as the literal `'fulfilled'`, so the first supplier to post\n        // marked the whole order shipped — lines they had never seen included —\n        // and the second supplier's POST met a 409. The buyer was told\n        // everything shipped with one carrier and one tracking number.\n        const suppliers = CommerceModel.orderSupplierIds(order)\n        const postingSupplier = resolvePostingSupplier(\n          hostId,\n          orderId,\n          order,\n          token,\n        )\n        let myLines: number[]\n        if (postingSupplier) {\n          myLines = CommerceModel.supplierLineItemIds(order, postingSupplier)\n        } else if (tokenMatches(orderSnapshot.get('supplierToken'), token)) {\n          // The STORED scalar matched but no supplier on the order derives to\n          // it — an order whose lines carry no `supplierId`, which is every\n          // order routed before that field was stamped.\n          //\n          // With at most one supplier there is only one door, so claiming every\n          // line is the same answer this route has always given and is right.\n          // With TWO OR MORE, the scalar cannot say whose token it is, and\n          // guessing would either close lines a supplier never shipped (the\n          // defect) or strand them (the naive fix). REFUSED LOUDLY instead:\n          // the merchant fulfils from the console, where they can see the\n          // lines, and the message says so rather than leaving them to work it\n          // out from an order that silently went quiet.\n          if (suppliers.length > 1) {\n            return {\n              status: 409,\n              body: {\n                error:\n                  'This order has more than one supplier and the link cannot ' +\n                  'say which of them you are. Nothing was changed. Please ask ' +\n                  'the merchant to record this shipment from their console.',\n              } as any,\n            }\n          }\n          myLines = (order.lineItems ?? []).map((_line, index) => index)\n        } else {\n          return { status: 403, body: { error: 'Invalid token' } as any }\n        }\n        if (myLines.length === 0) {\n          return {\n            status: 409,\n            body: { error: 'No lines on this order are yours' } as any,\n          }\n        }\n        const coveredBefore = CommerceModel.coveredLineItemIds(order)\n        if (myLines.every((index) => coveredBefore.has(index))) {\n          // Every line of theirs is already shipped: a redelivered POST, or the\n          // supplier pressing the emailed button twice. Refused rather than\n          // appending a second copy of the same fulfillment — the same rule\n          // `fulfill-order.ts` applies to a retried click.\n          return {\n            status: 409,\n            body: {\n              error:\n                suppliers.length > 1\n                  ? 'Your lines on this order are already marked shipped'\n                  : `Order is already ${order.status}`,\n            } as any,\n          }\n        }\n        const coveredAfter = new Set([...coveredBefore, ...myLines])\n        // COMPUTED, not written as a literal. `partially_fulfilled` has been in\n        // `ORDER_TRANSITIONS` since orders shipped and nothing ever wrote it.\n        const nextStatus = CommerceModel.statusAfterFulfilling(\n          order,\n          coveredAfter,\n        )\n        // Re-asked inside the transaction that writes, as AGL-2268 established:\n        // a supplier POST racing a refund must not write over `refunded`. Only\n        // when the status actually MOVES — a second supplier posting onto an\n        // already `partially_fulfilled` order changes nothing about the status\n        // and must not be refused by a table that has no self-edge.\n        if (\n          nextStatus !== order.status &&\n          !CommerceModel.canTransitionOrder(order.status, nextStatus)\n        ) {\n          return {\n            status: 409,\n            body: { error: `Order is already ${order.status}` } as any,\n          }\n        }\n        const fulfillment: CommerceModel.OrderFulfillment = {\n          id: `supplier-${Date.now().toString(36)}`,\n          lineItemIds: myLines,\n          ...(carrier ? { carrier } : {}),\n          ...(trackingNumber ? { trackingNumber } : {}),\n          atMs: Date.now(),\n        }\n        const remaining = (order.lineItems ?? []).filter(\n          (_line, index) => !coveredAfter.has(index),\n        ).length\n        transaction.set(\n          orderRef,\n          {\n            status: nextStatus,\n            fulfillments: [...(order.fulfillments ?? []), fulfillment],\n            timeline: CommerceModel.appendOrderEvent(\n              order,\n              nextStatus,\n              `Supplier shipped ${myLines.length} of ${\n                (order.lineItems ?? []).length\n              } line${(order.lineItems ?? []).length === 1 ? '' : 's'}` +\n                (trackingNumber\n                  ? ` — ${carrier || 'tracking'} ${trackingNumber}`\n                  : '') +\n                (remaining > 0\n                  ? `. ${remaining} line${remaining === 1 ? '' : 's'} still to ship.`\n                  : ''),\n            ),\n          },\n          { merge: true },\n        )\n        return {\n          status: 200,\n          body: { ok: true, lineItemIds: myLines, orderStatus: nextStatus } as any,\n          order,\n          nextStatus,\n          remaining,\n        }\n      })\n    if (outcome.status !== 200) {\n      return res.status(outcome.status).json(outcome.body)\n    }\n    // The merchant is told what is STILL OUTSTANDING (AGL-2455). \"Supplier\n    // shipped #1042\" on an order where one of three suppliers has posted reads\n    // as done, which is the same misreport the status literal made — the\n    // merchant would stop watching an order that is two thirds unshipped.\n    const outstanding = Number((outcome as any).remaining ?? 0)\n    void notifyHostManagers(hostId, {\n      type: 'content.order',\n      title: `Supplier shipped ${CommerceModel.formatOrderNumber(\n        outcome.order as CommerceModel.HostOrder,\n        orderId,\n      )}${outstanding > 0 ? ` — ${outstanding} line${outstanding === 1 ? '' : 's'} still to ship` : ''}`,\n      ...(trackingNumber ? { body: `${carrier} ${trackingNumber}` } : {}),\n      link: `/${hostId}/products`,\n    })\n    return res.status(200).json(outcome.body)\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Update failed' })\n  }\n}\n"],"names":["CommerceModel","firebaseAdmin","notifyHostManagers","escapeHtml","createHmac","timingSafeEqual","tokenSigningSecret","tokenMatches","stored","presented","expected","a","Buffer","from","b","length","Uint8Array","resolvePostingSupplier","hostId","orderId","order","secret","matched","supplierId","orderSupplierIds","update","digest","slice","supplierUpdateHandler","req","res","source","method","query","body","JSON","parse","String","token","trackingNumber","carrier","status","json","error","test","firestore","app","orderRef","collection","doc","setHeader","field","name","value","send","outcome","runTransaction","transaction","orderSnapshot","get","exists","liftLegacyOrder","data","suppliers","postingSupplier","myLines","supplierLineItemIds","lineItems","map","_line","index","coveredBefore","coveredLineItemIds","every","has","coveredAfter","Set","nextStatus","statusAfterFulfilling","canTransitionOrder","fulfillment","id","Date","now","toString","lineItemIds","atMs","remaining","filter","set","fulfillments","timeline","appendOrderEvent","merge","ok","orderStatus","outstanding","Number","type","title","formatOrderNumber","link","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,YAAYA,mBAAmB,oBAAU;AACzC,SAASC,aAAa,EAAEC,kBAAkB,QAAQ,2BAA0B;AAC5E,SAASC,UAAU,QAAQ,0BAAsB;AACjD,SAASC,UAAU,EAAEC,eAAe,QAAQ,SAAQ;AACpD,SAASC,kBAAkB,QAAQ,gBAAY;AAG/C;;;;;;;;;;;;CAYC,GACD,SAASC,aAAaC,MAAe,EAAEC,SAAiB;IACtD,MAAMC,WAAW,OAAOF,WAAW,WAAWA,SAAS;IACvD,IAAI,CAACE,YAAY,CAACD,WAAW,OAAO;IACpC,MAAME,IAAIC,OAAOC,IAAI,CAACJ;IACtB,MAAMK,IAAIF,OAAOC,IAAI,CAACH;IACtB,IAAIC,EAAEI,MAAM,KAAKD,EAAEC,MAAM,EAAE,OAAO;IAClC,OAAOV,gBAAgB,IAAIW,WAAWL,IAAI,IAAIK,WAAWF;AAC3D;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,SAASG,uBACPC,MAAc,EACdC,OAAe,EACfC,KAA8B,EAC9BX,SAAiB;IAEjB,IAAIY;IACJ,IAAI;QACFA,SAASf;IACX,EAAE,eAAM;QACN,4EAA4E;QAC5E,0EAA0E;QAC1E,iDAAiD;QACjD,OAAO;IACT;IACA,IAAIgB,UAAyB;IAC7B,KAAK,MAAMC,cAAcvB,cAAcwB,gBAAgB,CAACJ,OAAQ;QAC9D,MAAMV,WAAWN,WAAW,UAAUiB,QACnCI,MAAM,CAAC,GAAGP,OAAO,CAAC,EAAEC,QAAQ,CAAC,EAAEI,YAAY,EAC3CG,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;QACZ,IAAIpB,aAAaG,UAAUD,YAAYa,UAAUC;IACnD;IACA,OAAOD;AACT;AAGA;;;;CAIC,GACD,OAAO,MAAMM,wBAA0C,OAAOC,KAAKC;QACyDD,WACpGE,gBACCA,iBACFA,eACSA,wBACPA;IALvB,MAAMA,SAASF,IAAIG,MAAM,KAAK,SAAS,aAAKH,IAAII,KAAK,EAAM,OAAOJ,IAAIK,IAAI,KAAK,WAAWC,KAAKC,KAAK,CAACP,IAAIK,IAAI,IAAI,SAASL,YAAAA,IAAIK,IAAI,YAARL,YAAY,CAAC,KAAQA,IAAII,KAAK;IACxJ,MAAMf,SAASmB,QAAON,iBAAAA,OAAOb,MAAM,YAAba,iBAAiB;IACvC,MAAMZ,UAAUkB,QAAON,kBAAAA,OAAOZ,OAAO,YAAdY,kBAAkB;IACzC,MAAMO,QAAQD,QAAON,gBAAAA,OAAOO,KAAK,YAAZP,gBAAgB;IACrC,MAAMQ,iBAAiBF,QAAON,yBAAAA,OAAOQ,cAAc,YAArBR,yBAAyB,IAAIJ,KAAK,CAAC,GAAG;IACpE,MAAMa,UAAUH,QAAON,kBAAAA,OAAOS,OAAO,YAAdT,kBAAkB,IAAIJ,KAAK,CAAC,GAAG;IACtD,IAAI,CAACT,UAAU,CAACC,WAAW,CAACmB,OAAO;QACjC,OAAOR,IAAIW,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;IACA,2EAA2E;IAC3E,oEAAoE;IACpE,8EAA8E;IAC9E,kCAAkC;IAClC,IAAI,WAAWC,IAAI,CAAC1B,WAAW,WAAW0B,IAAI,CAACzB,UAAU;QACvD,OAAOW,IAAIW,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;IAEA,IAAI;YA0LyB;QAzL3B,MAAME,YAAY5C,cAAc6C,GAAG,GAAGD,SAAS;QAC/C,MAAME,WAAWF,UACdG,UAAU,CAAC,SACXC,GAAG,CAAC/B,QACJ8B,UAAU,CAAC,UACXC,GAAG,CAAC9B;QACP,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,iEAAiE;QACjE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAIU,IAAIG,MAAM,KAAK,OAAO;YACxBF,IAAIoB,SAAS,CAAC,gBAAgB;YAC9B,MAAMC,QAAQ,CAACC,MAAcC,QAC3B,CAAC,2BAA2B,EAAED,KAAK,SAAS,EAAEjD,WAAWkD,OAAO,EAAE,CAAC;YACrE,OAAOvB,IAAIW,MAAM,CAAC,KAAKa,IAAI,CACzB,mCACE,4DACA,yBACAH,MAAM,UAAUjC,UAChBiC,MAAM,WAAWhC,WACjBgC,MAAM,SAASb,SACfa,MAAM,WAAWX,WACjBW,MAAM,kBAAkBZ,kBACxB,mDACA;QAEN;QAEA,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,MAAMgB,UAAU,MAAMtD,cACnB6C,GAAG,GACHD,SAAS,GACTW,cAAc,CAAC,OAAOC;gBAqGFrC,kBAOIA,qBAKdA,mBACMA;YAjHf,MAAMsC,gBAAgB,MAAMD,YAAYE,GAAG,CAACZ;YAC5C,IAAI,CAACW,cAAcE,MAAM,EAAE;gBACzB,OAAO;oBAAEnB,QAAQ;oBAAKP,MAAM;wBAAES,OAAO;oBAAgB;gBAAS;YAChE;YACA,MAAMvB,QAAQpB,cAAc6D,eAAe,CAACH,cAAcI,IAAI;YAC9D,sDAAsD;YACtD,EAAE;YACF,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,+DAA+D;YAC/D,+DAA+D;YAC/D,MAAMC,YAAY/D,cAAcwB,gBAAgB,CAACJ;YACjD,MAAM4C,kBAAkB/C,uBACtBC,QACAC,SACAC,OACAkB;YAEF,IAAI2B;YACJ,IAAID,iBAAiB;gBACnBC,UAAUjE,cAAckE,mBAAmB,CAAC9C,OAAO4C;YACrD,OAAO,IAAIzD,aAAamD,cAAcC,GAAG,CAAC,kBAAkBrB,QAAQ;oBAwBvDlB;gBAvBX,oEAAoE;gBACpE,kEAAkE;gBAClE,8CAA8C;gBAC9C,EAAE;gBACF,sEAAsE;gBACtE,oEAAoE;gBACpE,iEAAiE;gBACjE,kEAAkE;gBAClE,kEAAkE;gBAClE,gEAAgE;gBAChE,qEAAqE;gBACrE,8CAA8C;gBAC9C,IAAI2C,UAAUhD,MAAM,GAAG,GAAG;oBACxB,OAAO;wBACL0B,QAAQ;wBACRP,MAAM;4BACJS,OACE,+DACA,gEACA;wBACJ;oBACF;gBACF;gBACAsB,UAAU,EAAC7C,oBAAAA,MAAM+C,SAAS,YAAf/C,oBAAmB,EAAE,EAAEgD,GAAG,CAAC,CAACC,OAAOC,QAAUA;YAC1D,OAAO;gBACL,OAAO;oBAAE7B,QAAQ;oBAAKP,MAAM;wBAAES,OAAO;oBAAgB;gBAAS;YAChE;YACA,IAAIsB,QAAQlD,MAAM,KAAK,GAAG;gBACxB,OAAO;oBACL0B,QAAQ;oBACRP,MAAM;wBAAES,OAAO;oBAAmC;gBACpD;YACF;YACA,MAAM4B,gBAAgBvE,cAAcwE,kBAAkB,CAACpD;YACvD,IAAI6C,QAAQQ,KAAK,CAAC,CAACH,QAAUC,cAAcG,GAAG,CAACJ,SAAS;gBACtD,sEAAsE;gBACtE,kEAAkE;gBAClE,kEAAkE;gBAClE,iDAAiD;gBACjD,OAAO;oBACL7B,QAAQ;oBACRP,MAAM;wBACJS,OACEoB,UAAUhD,MAAM,GAAG,IACf,wDACA,CAAC,iBAAiB,EAAEK,MAAMqB,MAAM,EAAE;oBAC1C;gBACF;YACF;YACA,MAAMkC,eAAe,IAAIC,IAAI;mBAAIL;mBAAkBN;aAAQ;YAC3D,wEAAwE;YACxE,sEAAsE;YACtE,MAAMY,aAAa7E,cAAc8E,qBAAqB,CACpD1D,OACAuD;YAEF,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,4DAA4D;YAC5D,IACEE,eAAezD,MAAMqB,MAAM,IAC3B,CAACzC,cAAc+E,kBAAkB,CAAC3D,MAAMqB,MAAM,EAAEoC,aAChD;gBACA,OAAO;oBACLpC,QAAQ;oBACRP,MAAM;wBAAES,OAAO,CAAC,iBAAiB,EAAEvB,MAAMqB,MAAM,EAAE;oBAAC;gBACpD;YACF;YACA,MAAMuC,cAA8C;gBAClDC,IAAI,CAAC,SAAS,EAAEC,KAAKC,GAAG,GAAGC,QAAQ,CAAC,KAAK;gBACzCC,aAAapB;eACTzB,UAAU;gBAAEA;YAAQ,IAAI,CAAC,GACzBD,iBAAiB;gBAAEA;YAAe,IAAI,CAAC;gBAC3C+C,MAAMJ,KAAKC,GAAG;;YAEhB,MAAMI,YAAY,EAACnE,mBAAAA,MAAM+C,SAAS,YAAf/C,mBAAmB,EAAE,EAAEoE,MAAM,CAC9C,CAACnB,OAAOC,QAAU,CAACK,aAAaD,GAAG,CAACJ,QACpCvD,MAAM;YACR0C,YAAYgC,GAAG,CACb1C,UACA;gBACEN,QAAQoC;gBACRa,cAAc;wBAAKtE,sBAAAA,MAAMsE,YAAY,YAAlBtE,sBAAsB,EAAE;oBAAG4D;iBAAY;gBAC1DW,UAAU3F,cAAc4F,gBAAgB,CACtCxE,OACAyD,YACA,CAAC,iBAAiB,EAAEZ,QAAQlD,MAAM,CAAC,IAAI,EACrC,EAACK,oBAAAA,MAAM+C,SAAS,YAAf/C,oBAAmB,EAAE,EAAEL,MAAM,CAC/B,KAAK,EAAE,EAACK,oBAAAA,MAAM+C,SAAS,YAAf/C,oBAAmB,EAAE,EAAEL,MAAM,KAAK,IAAI,KAAK,KAAK,GACtDwB,CAAAA,iBACG,CAAC,GAAG,EAAEC,WAAW,WAAW,CAAC,EAAED,gBAAgB,GAC/C,EAAC,IACJgD,CAAAA,YAAY,IACT,CAAC,EAAE,EAAEA,UAAU,KAAK,EAAEA,cAAc,IAAI,KAAK,IAAI,eAAe,CAAC,GACjE,EAAC;YAEX,GACA;gBAAEM,OAAO;YAAK;YAEhB,OAAO;gBACLpD,QAAQ;gBACRP,MAAM;oBAAE4D,IAAI;oBAAMT,aAAapB;oBAAS8B,aAAalB;gBAAW;gBAChEzD;gBACAyD;gBACAU;YACF;QACF;QACF,IAAIhC,QAAQd,MAAM,KAAK,KAAK;YAC1B,OAAOX,IAAIW,MAAM,CAACc,QAAQd,MAAM,EAAEC,IAAI,CAACa,QAAQrB,IAAI;QACrD;QACA,uEAAuE;QACvE,2EAA2E;QAC3E,qEAAqE;QACrE,sEAAsE;QACtE,MAAM8D,cAAcC,QAAO,qBAAA,AAAC1C,QAAgBgC,SAAS,YAA1B,qBAA8B;QACzD,KAAKrF,mBAAmBgB,QAAQ;YAC9BgF,MAAM;YACNC,OAAO,CAAC,iBAAiB,EAAEnG,cAAcoG,iBAAiB,CACxD7C,QAAQnC,KAAK,EACbD,WACE6E,cAAc,IAAI,CAAC,GAAG,EAAEA,YAAY,KAAK,EAAEA,gBAAgB,IAAI,KAAK,IAAI,cAAc,CAAC,GAAG,IAAI;WAC9FzD,iBAAiB;YAAEL,MAAM,GAAGM,QAAQ,CAAC,EAAED,gBAAgB;QAAC,IAAI,CAAC;YACjE8D,MAAM,CAAC,CAAC,EAAEnF,OAAO,SAAS,CAAC;;QAE7B,OAAOY,IAAIW,MAAM,CAAC,KAAKC,IAAI,CAACa,QAAQrB,IAAI;IAC1C,EAAE,OAAOS,OAAO;QACd2D,QAAQ3D,KAAK,CAACA;QACd,OAAOb,IAAIW,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/server/tax-profile.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The merchant's tax rule, published for every plugin that charges.
+ *
+ * A merchant sets tax once, in the store settings this plugin keeps. A plugin
+ * that sells something else — an appointment — prices its own charge, and used
+ * to import `resolveFlatTaxCents` and `storefrontTaxModeOf` from here to do it.
+ * It asks the tax-profile contract now, and gets these same two functions: one
+ * rounding rule, one reading of a settled payment, wherever money is taken.
+ *
+ * Registered from BOTH server registrars, because a booking is priced in the
+ * tenant app and confirmed by the console's billing webhook.
+ */
+export declare function registerCommerceTaxProfile(): void;

package/src/lib/server/tax-profile.js

@@ -0,0 +1,40 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginTaxProfile } from "@aglyn/aglyn/plugin-manager/plugin-tax-profile";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+import { resolveFlatTaxCents } from "../model/index.js";
+import { storefrontTaxModeOf } from "./storefront-tax.js";
+/**
+ * The merchant's tax rule, published for every plugin that charges.
+ *
+ * A merchant sets tax once, in the store settings this plugin keeps. A plugin
+ * that sells something else — an appointment — prices its own charge, and used
+ * to import `resolveFlatTaxCents` and `storefrontTaxModeOf` from here to do it.
+ * It asks the tax-profile contract now, and gets these same two functions: one
+ * rounding rule, one reading of a settled payment, wherever money is taken.
+ *
+ * Registered from BOTH server registrars, because a booking is priced in the
+ * tenant app and confirmed by the console's billing webhook.
+ */ export function registerCommerceTaxProfile() {
+    registerPluginTaxProfile({
+        flatTax: (rate, chargeCents, fallbackLabel)=>resolveFlatTaxCents(rate, chargeCents, fallbackLabel),
+        taxModeOf: (settledPayment, manualTaxCents)=>storefrontTaxModeOf(settledPayment, manualTaxCents)
+    }, {
+        pluginId: BUNDLE_ID
+    });
+}
+
+//# sourceMappingURL=tax-profile.js.map

package/src/lib/server/tax-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/tax-profile.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginTaxProfile } from '@aglyn/aglyn/plugin-manager/plugin-tax-profile'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport { type FlatTaxRate, resolveFlatTaxCents } from '../model'\nimport { storefrontTaxModeOf } from './storefront-tax'\n\n/**\n * The merchant's tax rule, published for every plugin that charges.\n *\n * A merchant sets tax once, in the store settings this plugin keeps. A plugin\n * that sells something else — an appointment — prices its own charge, and used\n * to import `resolveFlatTaxCents` and `storefrontTaxModeOf` from here to do it.\n * It asks the tax-profile contract now, and gets these same two functions: one\n * rounding rule, one reading of a settled payment, wherever money is taken.\n *\n * Registered from BOTH server registrars, because a booking is priced in the\n * tenant app and confirmed by the console's billing webhook.\n */\nexport function registerCommerceTaxProfile(): void {\n  registerPluginTaxProfile(\n    {\n      flatTax: (rate, chargeCents, fallbackLabel) =>\n        resolveFlatTaxCents(\n          rate as FlatTaxRate | undefined | null,\n          chargeCents,\n          fallbackLabel,\n        ),\n      taxModeOf: (settledPayment, manualTaxCents) =>\n        storefrontTaxModeOf(settledPayment, manualTaxCents),\n    },\n    { pluginId: BUNDLE_ID },\n  )\n}\n"],"names":["registerPluginTaxProfile","BUNDLE_ID","resolveFlatTaxCents","storefrontTaxModeOf","registerCommerceTaxProfile","flatTax","rate","chargeCents","fallbackLabel","taxModeOf","settledPayment","manualTaxCents","pluginId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,wBAAwB,QAAQ,iDAAgD;AACzF,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SAA2BC,mBAAmB,QAAQ,oBAAU;AAChE,SAASC,mBAAmB,QAAQ,sBAAkB;AAEtD;;;;;;;;;;;CAWC,GACD,OAAO,SAASC;IACdJ,yBACE;QACEK,SAAS,CAACC,MAAMC,aAAaC,gBAC3BN,oBACEI,MACAC,aACAC;QAEJC,WAAW,CAACC,gBAAgBC,iBAC1BR,oBAAoBO,gBAAgBC;IACxC,GACA;QAAEC,UAAUX;IAAU;AAE1B"}

package/src/lib/server.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Registers the commerce plugin's storefront API routes. */
+export declare function registerCommerceApi(): void;
+/**
+ * Registers the commerce plugin's console-side API routes (AGL-396):
+ * merchant/staff operations (Connect onboarding, refunds, draft & POS
+ * orders, member posts), the supplier tracking callback, and the HTTP doors
+ * for the abandoned-cart / restock passes.
+ *
+ * Those last two are NOT what schedules them — the `registerPluginJob` calls
+ * above are (AGL-2227). This comment used to call them "the scheduler-driven
+ * jobs", which is how they stayed dark for months: it asserted the wiring
+ * instead of having it.
+ */
+export declare function registerCommerceConsoleApi(): void;
+export { mintDownloadToken } from './server/download';
+export * from './server/membership';