@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server.js

@@ -0,0 +1,311 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Server half of the commerce plugin (AGL-396): the site-facing storefront
+ * API handlers, registered with the plugin API registry and served by the
+ * tenant dispatcher at their unchanged `/api/commerce/*` URLs. This module
+ * pulls in firebase-admin + Stripe, so it is NOT re-exported from the client
+ * barrel — apps import `@aglyn/plugins-commerce/server` only from their
+ * (server-only) API dispatcher registration.
+ */ import { registerBillingWebhookHandler, registerOrderFulfilmentService, registerPluginApiRoute, registerPluginJob, registerSitePageEnricher, registerSitePageResolver, registerPluginPermissions, registerPluginConfigSchema } from "@aglyn/aglyn/server";
+import { isEmailConfigured } from "@aglyn/shared-util-email";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { BUNDLE_ID } from "./constants/bundle-common.js";
+import { registerProductCardReader } from "./server/product-card.js";
+import { registerCommerceTaxProfile } from "./server/tax-profile.js";
+import { commerceBillingWebhookHandler } from "./server/billing-webhook.js";
+import { registerOrderFigureReaders } from "./server/order-figures.js";
+import { COMMERCE_PERMISSIONS } from "./model/plugin-permissions.js";
+import { COMMERCE_CONFIG_SCHEMA } from "./plugin-config.js";
+import { commerceSitePageEnricher } from "./server/site-page-enricher.js";
+import { commerceSitePageResolver } from "./server/site-page-resolver.js";
+import { cartCheckoutHandler } from "./server/cart-checkout.js";
+import { cartHandler } from "./server/cart.js";
+import { catalogHandler } from "./server/catalog.js";
+import { checkoutHandler } from "./server/checkout.js";
+import { downloadHandler } from "./server/download.js";
+import { feedHandler } from "./server/feed.js";
+import { newsletterHandler } from "./server/newsletter.js";
+import { notifyRestockHandler } from "./server/notify-restock.js";
+import { productHandler } from "./server/product.js";
+import { relatedHandler } from "./server/related.js";
+import { reservationAvailabilityHandler } from "./server/reservation-availability.js";
+import { gateHandler } from "./server/gate.js";
+import { memberFeedHandler } from "./server/member-feed.js";
+import { membershipAccountHandler } from "./server/membership-account.js";
+import { membershipAdminPasswordHandler } from "./server/membership-admin-password.js";
+import { membershipContentHandler } from "./server/membership-content.js";
+import { membershipLoginHandler } from "./server/membership-login.js";
+import { membershipLogoutHandler } from "./server/membership-logout.js";
+import { membershipRecoverHandler } from "./server/membership-recover.js";
+import { membershipRegisterHandler } from "./server/membership-register.js";
+import { membershipResetHandler } from "./server/membership-reset.js";
+import { membershipWishlistHandler } from "./server/membership-wishlist.js";
+import { reserveHandler } from "./server/reserve.js";
+import { streamHandler } from "./server/stream.js";
+import { subscriptionPortalHandler } from "./server/subscription-portal.js";
+import { reviewsHandler } from "./server/reviews.js";
+import { connectHandler } from "./server/connect.js";
+import { cancelOrderHandler } from "./server/cancel-order.js";
+import { draftOrderHandler } from "./server/draft-order.js";
+import { fulfillOrderHandler, recordOrderShipment } from "./server/fulfill-order.js";
+import { giftCardsHandler } from "./server/gift-cards.js";
+import { memberPostHandler } from "./server/member-post.js";
+import { orderAnalyticsHandler } from "./server/order-analytics.js";
+import { posOrderHandler } from "./server/pos-order.js";
+import { processAbandonedHandler, scanAbandonedCheckouts } from "./server/process-abandoned.js";
+import { processRestockHandler, scanRestockAlerts } from "./server/process-restock.js";
+import { scanStockDecrements } from "./server/reconcile-stock.js";
+import { refundHandler } from "./server/refund.js";
+import { scanSupplierDeliveries } from "./server/supplier-outbox.js";
+import { supplierUpdateHandler } from "./server/supplier-update.js";
+/**
+ * The two commerce beats (AGL-2227).
+ *
+ * `commerce/process-abandoned` and `commerce/process-restock` have existed
+ * since AGL-323/326 as `x-cron-secret` HTTP doors, and `registerCommerceConsoleApi`
+ * below has called them "the scheduler-driven jobs" in a comment that whole
+ * time. **Nothing scheduled them.** Not `scheduled-crons.yml` (its table names
+ * 11 paths; neither of these), not `vercel.json` (no `crons` key at all), not
+ * `registerPluginJob` — the only two registrations in the repo were scheduled
+ * publishing and the bookings hold-expiry.
+ *
+ * The cost was a Pro-tier entitlement (`abandonedCart`) that had never sent an
+ * email, and a storefront "notify me when it's back" form writing into a queue
+ * with no drain. AGL-1793 had already added the collection-group indexes these
+ * two scans need, which is the clearest evidence they were always meant to run.
+ *
+ * Module scope, like the bookings job beside it: the runner route reaches jobs
+ * through `ensureAll(['tenantApi'])`, and a registration inside a `register*`
+ * function would depend on which entry point happened to be loaded.
+ *
+ * 15 minutes, not 1: `process-abandoned` will not remind a checkout younger
+ * than an hour and `process-restock` only mails alerts whose product already
+ * has stock, so a tighter beat buys nothing and costs two collection-group
+ * scans a minute. Both are bounded (200 docs) and idempotent — each pass
+ * stamps what it sent — so an overlapping or repeated beat cannot double-send.
+ */ const RECOVERY_JOB_INTERVAL_MINUTES = 15;
+registerPluginJob({
+    pluginId: BUNDLE_ID,
+    name: 'abandoned-checkout-recovery',
+    intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,
+    description: 'Email one recovery reminder per stalled checkout (abandonedCart plans).',
+    lockdown: {
+        scope: 'per-host'
+    },
+    handler: async (gate)=>{
+        // Quietly, not as an error: email is optional per deployment, and a beat
+        // that logs every minute on a self-host without Resend buries everything
+        // else in the log.
+        if (!isEmailConfigured()) return;
+        const { sent } = await scanAbandonedCheckouts(gate);
+        if (sent) console.info(`commerce: sent ${sent} abandoned-cart reminders`);
+    }
+});
+registerPluginJob({
+    pluginId: BUNDLE_ID,
+    name: 'back-in-stock-alerts',
+    intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,
+    description: 'Email shoppers whose requested product is in stock again.',
+    lockdown: {
+        scope: 'per-host'
+    },
+    handler: async (gate)=>{
+        if (!isEmailConfigured()) return;
+        const { sent } = await scanRestockAlerts(gate);
+        if (sent) console.info(`commerce: sent ${sent} back-in-stock alerts`);
+    }
+});
+/**
+ * The missing-decrement detector (AGL-2358).
+ *
+ * HOURLY, not on the 15-minute recovery beat: it is a detector for a rare
+ * process death, not a queue drain, and nothing it finds gets less true for
+ * waiting an hour. The cost of the beat is what sets the interval — one
+ * collection-group read of the platform's most recent orders, plus two
+ * queries per host that has any — and an hour keeps that off the same tick as
+ * the two scans above.
+ *
+ * NOT gated on `isEmailConfigured()`, unlike its two neighbours. Those send
+ * mail; this writes a console notification and a log line, both of which work
+ * on a self-host with no mail provider at all — and a stock count that is
+ * silently wrong is exactly what a self-hoster least wants suppressed by a
+ * setting about email.
+ */ registerPluginJob({
+    pluginId: BUNDLE_ID,
+    name: 'stock-decrement-reconciliation',
+    intervalMinutes: 60,
+    description: 'Report paid orders whose stock decrement never landed (AGL-2358).',
+    lockdown: {
+        scope: 'per-host'
+    },
+    handler: async (gate)=>{
+        const scan = await scanStockDecrements(gate);
+        if (scan.missingLines || scan.truncatedHosts) {
+            console.warn(`commerce: ${scan.missingLines} order lines across ${scan.hosts} ` + `sites have no sale ledger row (${scan.reportedOrders} newly ` + `reported, ${scan.truncatedHosts} sites' ledger window truncated)`);
+        }
+    }
+});
+/**
+ * The dropship supplier outbox drain (AGL-2473).
+ *
+ * EVERY MINUTE, unlike the three above, and the interval is the point rather
+ * than an oversight. This is the only one of the four that a BUYER is waiting
+ * on: the row it drains is a paid order that has not been routed to whoever
+ * ships it, and every minute it sits is a minute the parcel is not moving. The
+ * first backoff step is also 60s, so a supplier that blipped is retried on the
+ * next tick.
+ *
+ * The cost that set fifteen minutes for the recovery pair does not apply. Those
+ * are collection-GROUP scans across every site on the platform; this is one
+ * ordinary equality query against a top-level collection that is EMPTY in the
+ * ordinary case — an empty result bills a single read, so the whole beat is
+ * ~1,440 reads a day whether or not anyone is dropshipping.
+ *
+ * Not gated on `isEmailConfigured()`. The supplier notification is an HTTP POST
+ * to the merchant's own supplier, and a self-host with no mail provider still
+ * has dropship orders to route.
+ */ registerPluginJob({
+    pluginId: BUNDLE_ID,
+    name: 'supplier-webhook-delivery',
+    intervalMinutes: 1,
+    description: 'Deliver queued dropship supplier notifications, with backoff and a ' + 'dead letter that tells the merchant (AGL-2473).',
+    lockdown: {
+        scope: 'per-host'
+    },
+    handler: async (gate)=>{
+        const scan = await scanSupplierDeliveries(gate);
+        if (scan.deadLettered) {
+            console.warn(`commerce: ${scan.deadLettered} dropship orders could not be routed ` + `to their supplier and have been reported on the order`);
+        }
+    }
+});
+/** Registers the commerce plugin's storefront API routes. */ export function registerCommerceApi() {
+    registerProductCardReader();
+    // The merchant's tax rule, for every plugin that prices a charge here.
+    registerCommerceTaxProfile();
+    registerPluginPermissions(COMMERCE_PERMISSIONS);
+    // Merchant-settable register discount ceiling (AGL-2161). Registered on
+    // BOTH surfaces, like the permissions above: the POS route reads it
+    // server-side, and the settings card renders it from the same schema.
+    registerPluginConfigSchema(COMMERCE_CONFIG_SCHEMA);
+    // PDP/PLP template pages (AGL-418): /products/* + /collections/*.
+    registerSitePageResolver(commerceSitePageResolver);
+    // Seeds product grids on ordinary screens (AGL-659) — the resolver above
+    // only covers /products/* and /collections/*, so /products itself, and any
+    // designed page with a grid on it, needed this to render server-side.
+    registerSitePageEnricher(commerceSitePageEnricher);
+    registerPluginApiRoute('commerce/cart-checkout', cartCheckoutHandler);
+    registerPluginApiRoute('commerce/cart', cartHandler);
+    registerPluginApiRoute('commerce/catalog', catalogHandler);
+    registerPluginApiRoute('commerce/checkout', checkoutHandler);
+    registerPluginApiRoute('commerce/download', downloadHandler);
+    registerPluginApiRoute('commerce/feed', feedHandler);
+    registerPluginApiRoute('commerce/newsletter', newsletterHandler);
+    registerPluginApiRoute('commerce/notify-restock', notifyRestockHandler);
+    // GA-safe order projection for the storefront `purchase` (AGL-1641).
+    registerPluginApiRoute('commerce/order-analytics', orderAnalyticsHandler);
+    registerPluginApiRoute('commerce/product', productHandler);
+    registerPluginApiRoute('commerce/related', relatedHandler);
+    registerPluginApiRoute('commerce/reservation-availability', reservationAvailabilityHandler);
+    registerPluginApiRoute('commerce/reserve', reserveHandler);
+    registerPluginApiRoute('commerce/gate', gateHandler);
+    registerPluginApiRoute('commerce/member-feed', memberFeedHandler);
+    registerPluginApiRoute('commerce/stream', streamHandler);
+    registerPluginApiRoute('commerce/subscription-portal', subscriptionPortalHandler);
+    registerPluginApiRoute('commerce/reviews', reviewsHandler);
+    registerPluginApiRoute('membership/account', membershipAccountHandler);
+    // Console-driven password help for a member (AGL-914). Console-auth, not
+    // the visitor cookie the neighbouring routes take.
+    registerPluginApiRoute('membership/admin-password', membershipAdminPasswordHandler);
+    registerPluginApiRoute('membership/content', membershipContentHandler);
+    registerPluginApiRoute('membership/login', membershipLoginHandler);
+    registerPluginApiRoute('membership/logout', membershipLogoutHandler);
+    // Password recovery pair (AGL-552): request + complete.
+    registerPluginApiRoute('membership/recover', membershipRecoverHandler);
+    registerPluginApiRoute('membership/register', membershipRegisterHandler);
+    registerPluginApiRoute('membership/reset', membershipResetHandler);
+    registerPluginApiRoute('membership/wishlist', membershipWishlistHandler);
+}
+/**
+ * Registers the commerce plugin's console-side API routes (AGL-396):
+ * merchant/staff operations (Connect onboarding, refunds, draft & POS
+ * orders, member posts), the supplier tracking callback, and the HTTP doors
+ * for the abandoned-cart / restock passes.
+ *
+ * Those last two are NOT what schedules them — the `registerPluginJob` calls
+ * above are (AGL-2227). This comment used to call them "the scheduler-driven
+ * jobs", which is how they stayed dark for months: it asserted the wiring
+ * instead of having it.
+ */ export function registerCommerceConsoleApi() {
+    // What a product looks like to a surface that is not this plugin's — a
+    // campaign email that features one asks here rather than importing the model.
+    registerProductCardReader();
+    // …and the tax rule, for the webhook that confirms what they charged.
+    registerCommerceTaxProfile();
+    // Stripe webhook sections (AGL-418): orders/carts/drafts/reservations/
+    // subscriptions ride the platform webhook via the hook registry.
+    registerBillingWebhookHandler(commerceBillingWebhookHandler);
+    // Cancel + stock release in one transaction (AGL-1808). Server-side because
+    // the release depends on the transition rule, and a client write could not
+    // re-ask it under the same lock that flips the status.
+    registerPluginApiRoute('commerce/cancel-order', cancelOrderHandler);
+    registerPluginApiRoute('commerce/connect', connectHandler);
+    registerPluginApiRoute('commerce/draft-order', draftOrderHandler);
+    // Fulfil + mark-delivered with the transition re-asked under the write
+    // (AGL-1819) — the same stale-dialog hole cancel-order closes, minus the
+    // stock release those two transitions never had.
+    registerPluginApiRoute('commerce/fulfill-order', fulfillOrderHandler);
+    // The same transaction, offered to the HOST APP as a capability (AGL-2461)
+    // so `/v1` can record a shipment without importing this library — which
+    // `eslint.config.mjs`'s `scope:app` boundary forbids, and which is why the
+    // public REST API could take an order and never ship it.
+    //
+    // Registered HERE, in the consoleApi surface, beside the route it shares an
+    // implementation with: `/v1` reaches it through the console's server plugin
+    // loader, the same `ensureAll(['consoleApi'])` batch the plugin API
+    // dispatcher runs. A registration at module scope would instead depend on
+    // which entry point a process happened to import.
+    //
+    // NOTHING ABOUT AUTHORIZATION CROSSES THIS LINE. The capability is a
+    // pre-authorized domain operation and `/v1` does its own gating (key scope,
+    // plan entitlement, org-owns-host, plugin-enabled-for-site) before it calls.
+    registerOrderFulfilmentService({
+        pluginId: BUNDLE_ID,
+        recordShipment: recordOrderShipment
+    });
+    // Issue / void store credit (AGL-2226). Server-side because the host
+    // catch-all in the Firestore rules would otherwise let a client write
+    // its own `balanceCents`, which checkout applies as amount-off.
+    registerPluginApiRoute('commerce/gift-cards', giftCardsHandler);
+    registerPluginApiRoute('commerce/member-post', memberPostHandler);
+    registerPluginApiRoute('commerce/pos-order', posOrderHandler);
+    registerPluginApiRoute('commerce/process-abandoned', processAbandonedHandler);
+    registerPluginApiRoute('commerce/process-restock', processRestockHandler);
+    registerPluginApiRoute('commerce/refund', refundHandler);
+    registerPluginApiRoute('commerce/supplier-update', supplierUpdateHandler);
+    // The store's sales as figure tables (AGL-2915), for the AI plugin's
+    // insights to read by id rather than by reading orders. The console runs
+    // insight jobs, so the console surface registers them.
+    registerOrderFigureReaders(()=>firebaseAdmin.app().firestore());
+}
+// Shared with the (still app-side) membership/account route.
+export { mintDownloadToken } from "./server/download.js";
+// Site-member session primitives, shared with the (still app-side)
+// membership/* routes until those migrate too (AGL-396).
+export * from "./server/membership.js";
+
+//# sourceMappingURL=server.js.map

package/src/lib/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/commerce/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n\n/**\n * Server half of the commerce plugin (AGL-396): the site-facing storefront\n * API handlers, registered with the plugin API registry and served by the\n * tenant dispatcher at their unchanged `/api/commerce/*` URLs. This module\n * pulls in firebase-admin + Stripe, so it is NOT re-exported from the client\n * barrel — apps import `@aglyn/plugins-commerce/server` only from their\n * (server-only) API dispatcher registration.\n */\n\nimport {\n  registerBillingWebhookHandler,\n  registerOrderFulfilmentService,\n  registerPluginApiRoute,\n  registerPluginJob,\n  registerSitePageEnricher,\n  registerSitePageResolver,\n  registerPluginPermissions,\n  registerPluginConfigSchema,\n} from '@aglyn/aglyn/server'\nimport { isEmailConfigured } from '@aglyn/shared-util-email'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { registerProductCardReader } from './server/product-card'\nimport { registerCommerceTaxProfile } from './server/tax-profile'\nimport { commerceBillingWebhookHandler } from './server/billing-webhook'\nimport { registerOrderFigureReaders } from './server/order-figures'\nimport { COMMERCE_PERMISSIONS } from './model/plugin-permissions'\nimport { COMMERCE_CONFIG_SCHEMA } from './plugin-config'\nimport { commerceSitePageEnricher } from './server/site-page-enricher'\nimport { commerceSitePageResolver } from './server/site-page-resolver'\nimport { cartCheckoutHandler } from './server/cart-checkout'\nimport { cartHandler } from './server/cart'\nimport { catalogHandler } from './server/catalog'\nimport { checkoutHandler } from './server/checkout'\nimport { downloadHandler } from './server/download'\nimport { feedHandler } from './server/feed'\nimport { newsletterHandler } from './server/newsletter'\nimport { notifyRestockHandler } from './server/notify-restock'\nimport { productHandler } from './server/product'\nimport { relatedHandler } from './server/related'\nimport { reservationAvailabilityHandler } from './server/reservation-availability'\nimport { gateHandler } from './server/gate'\nimport { memberFeedHandler } from './server/member-feed'\nimport { membershipAccountHandler } from './server/membership-account'\nimport { membershipAdminPasswordHandler } from './server/membership-admin-password'\nimport { membershipContentHandler } from './server/membership-content'\nimport { membershipLoginHandler } from './server/membership-login'\nimport { membershipLogoutHandler } from './server/membership-logout'\nimport { membershipRecoverHandler } from './server/membership-recover'\nimport { membershipRegisterHandler } from './server/membership-register'\nimport { membershipResetHandler } from './server/membership-reset'\nimport { membershipWishlistHandler } from './server/membership-wishlist'\nimport { reserveHandler } from './server/reserve'\nimport { streamHandler } from './server/stream'\nimport { subscriptionPortalHandler } from './server/subscription-portal'\nimport { reviewsHandler } from './server/reviews'\nimport { connectHandler } from './server/connect'\nimport { cancelOrderHandler } from './server/cancel-order'\nimport { draftOrderHandler } from './server/draft-order'\nimport {\n  fulfillOrderHandler,\n  recordOrderShipment,\n} from './server/fulfill-order'\nimport { giftCardsHandler } from './server/gift-cards'\nimport { memberPostHandler } from './server/member-post'\nimport { orderAnalyticsHandler } from './server/order-analytics'\nimport { posOrderHandler } from './server/pos-order'\nimport {\n  processAbandonedHandler,\n  scanAbandonedCheckouts,\n} from './server/process-abandoned'\nimport { processRestockHandler, scanRestockAlerts } from './server/process-restock'\nimport { scanStockDecrements } from './server/reconcile-stock'\nimport { refundHandler } from './server/refund'\nimport { scanSupplierDeliveries } from './server/supplier-outbox'\nimport { supplierUpdateHandler } from './server/supplier-update'\n\n/**\n * The two commerce beats (AGL-2227).\n *\n * `commerce/process-abandoned` and `commerce/process-restock` have existed\n * since AGL-323/326 as `x-cron-secret` HTTP doors, and `registerCommerceConsoleApi`\n * below has called them \"the scheduler-driven jobs\" in a comment that whole\n * time. **Nothing scheduled them.** Not `scheduled-crons.yml` (its table names\n * 11 paths; neither of these), not `vercel.json` (no `crons` key at all), not\n * `registerPluginJob` — the only two registrations in the repo were scheduled\n * publishing and the bookings hold-expiry.\n *\n * The cost was a Pro-tier entitlement (`abandonedCart`) that had never sent an\n * email, and a storefront \"notify me when it's back\" form writing into a queue\n * with no drain. AGL-1793 had already added the collection-group indexes these\n * two scans need, which is the clearest evidence they were always meant to run.\n *\n * Module scope, like the bookings job beside it: the runner route reaches jobs\n * through `ensureAll(['tenantApi'])`, and a registration inside a `register*`\n * function would depend on which entry point happened to be loaded.\n *\n * 15 minutes, not 1: `process-abandoned` will not remind a checkout younger\n * than an hour and `process-restock` only mails alerts whose product already\n * has stock, so a tighter beat buys nothing and costs two collection-group\n * scans a minute. Both are bounded (200 docs) and idempotent — each pass\n * stamps what it sent — so an overlapping or repeated beat cannot double-send.\n */\nconst RECOVERY_JOB_INTERVAL_MINUTES = 15\n\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'abandoned-checkout-recovery',\n  intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,\n  description:\n    'Email one recovery reminder per stalled checkout (abandonedCart plans).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    // Quietly, not as an error: email is optional per deployment, and a beat\n    // that logs every minute on a self-host without Resend buries everything\n    // else in the log.\n    if (!isEmailConfigured()) return\n    const { sent } = await scanAbandonedCheckouts(gate)\n    if (sent) console.info(`commerce: sent ${sent} abandoned-cart reminders`)\n  },\n})\n\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'back-in-stock-alerts',\n  intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,\n  description: 'Email shoppers whose requested product is in stock again.',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    if (!isEmailConfigured()) return\n    const { sent } = await scanRestockAlerts(gate)\n    if (sent) console.info(`commerce: sent ${sent} back-in-stock alerts`)\n  },\n})\n\n/**\n * The missing-decrement detector (AGL-2358).\n *\n * HOURLY, not on the 15-minute recovery beat: it is a detector for a rare\n * process death, not a queue drain, and nothing it finds gets less true for\n * waiting an hour. The cost of the beat is what sets the interval — one\n * collection-group read of the platform's most recent orders, plus two\n * queries per host that has any — and an hour keeps that off the same tick as\n * the two scans above.\n *\n * NOT gated on `isEmailConfigured()`, unlike its two neighbours. Those send\n * mail; this writes a console notification and a log line, both of which work\n * on a self-host with no mail provider at all — and a stock count that is\n * silently wrong is exactly what a self-hoster least wants suppressed by a\n * setting about email.\n */\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'stock-decrement-reconciliation',\n  intervalMinutes: 60,\n  description:\n    'Report paid orders whose stock decrement never landed (AGL-2358).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    const scan = await scanStockDecrements(gate)\n    if (scan.missingLines || scan.truncatedHosts) {\n      console.warn(\n        `commerce: ${scan.missingLines} order lines across ${scan.hosts} ` +\n          `sites have no sale ledger row (${scan.reportedOrders} newly ` +\n          `reported, ${scan.truncatedHosts} sites' ledger window truncated)`,\n      )\n    }\n  },\n})\n\n/**\n * The dropship supplier outbox drain (AGL-2473).\n *\n * EVERY MINUTE, unlike the three above, and the interval is the point rather\n * than an oversight. This is the only one of the four that a BUYER is waiting\n * on: the row it drains is a paid order that has not been routed to whoever\n * ships it, and every minute it sits is a minute the parcel is not moving. The\n * first backoff step is also 60s, so a supplier that blipped is retried on the\n * next tick.\n *\n * The cost that set fifteen minutes for the recovery pair does not apply. Those\n * are collection-GROUP scans across every site on the platform; this is one\n * ordinary equality query against a top-level collection that is EMPTY in the\n * ordinary case — an empty result bills a single read, so the whole beat is\n * ~1,440 reads a day whether or not anyone is dropshipping.\n *\n * Not gated on `isEmailConfigured()`. The supplier notification is an HTTP POST\n * to the merchant's own supplier, and a self-host with no mail provider still\n * has dropship orders to route.\n */\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'supplier-webhook-delivery',\n  intervalMinutes: 1,\n  description:\n    'Deliver queued dropship supplier notifications, with backoff and a ' +\n    'dead letter that tells the merchant (AGL-2473).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    const scan = await scanSupplierDeliveries(gate)\n    if (scan.deadLettered) {\n      console.warn(\n        `commerce: ${scan.deadLettered} dropship orders could not be routed ` +\n          `to their supplier and have been reported on the order`,\n      )\n    }\n  },\n})\n\n/** Registers the commerce plugin's storefront API routes. */\nexport function registerCommerceApi(): void {\n  registerProductCardReader()\n  // The merchant's tax rule, for every plugin that prices a charge here.\n  registerCommerceTaxProfile()\n  registerPluginPermissions(COMMERCE_PERMISSIONS)\n  // Merchant-settable register discount ceiling (AGL-2161). Registered on\n  // BOTH surfaces, like the permissions above: the POS route reads it\n  // server-side, and the settings card renders it from the same schema.\n  registerPluginConfigSchema(COMMERCE_CONFIG_SCHEMA)\n  // PDP/PLP template pages (AGL-418): /products/* + /collections/*.\n  registerSitePageResolver(commerceSitePageResolver)\n  // Seeds product grids on ordinary screens (AGL-659) — the resolver above\n  // only covers /products/* and /collections/*, so /products itself, and any\n  // designed page with a grid on it, needed this to render server-side.\n  registerSitePageEnricher(commerceSitePageEnricher)\n  registerPluginApiRoute('commerce/cart-checkout', cartCheckoutHandler)\n  registerPluginApiRoute('commerce/cart', cartHandler)\n  registerPluginApiRoute('commerce/catalog', catalogHandler)\n  registerPluginApiRoute('commerce/checkout', checkoutHandler)\n  registerPluginApiRoute('commerce/download', downloadHandler)\n  registerPluginApiRoute('commerce/feed', feedHandler)\n  registerPluginApiRoute('commerce/newsletter', newsletterHandler)\n  registerPluginApiRoute('commerce/notify-restock', notifyRestockHandler)\n  // GA-safe order projection for the storefront `purchase` (AGL-1641).\n  registerPluginApiRoute('commerce/order-analytics', orderAnalyticsHandler)\n  registerPluginApiRoute('commerce/product', productHandler)\n  registerPluginApiRoute('commerce/related', relatedHandler)\n  registerPluginApiRoute('commerce/reservation-availability', reservationAvailabilityHandler)\n  registerPluginApiRoute('commerce/reserve', reserveHandler)\n  registerPluginApiRoute('commerce/gate', gateHandler)\n  registerPluginApiRoute('commerce/member-feed', memberFeedHandler)\n  registerPluginApiRoute('commerce/stream', streamHandler)\n  registerPluginApiRoute('commerce/subscription-portal', subscriptionPortalHandler)\n  registerPluginApiRoute('commerce/reviews', reviewsHandler)\n  registerPluginApiRoute('membership/account', membershipAccountHandler)\n  // Console-driven password help for a member (AGL-914). Console-auth, not\n  // the visitor cookie the neighbouring routes take.\n  registerPluginApiRoute(\n    'membership/admin-password',\n    membershipAdminPasswordHandler,\n  )\n  registerPluginApiRoute('membership/content', membershipContentHandler)\n  registerPluginApiRoute('membership/login', membershipLoginHandler)\n  registerPluginApiRoute('membership/logout', membershipLogoutHandler)\n  // Password recovery pair (AGL-552): request + complete.\n  registerPluginApiRoute('membership/recover', membershipRecoverHandler)\n  registerPluginApiRoute('membership/register', membershipRegisterHandler)\n  registerPluginApiRoute('membership/reset', membershipResetHandler)\n  registerPluginApiRoute('membership/wishlist', membershipWishlistHandler)\n}\n\n/**\n * Registers the commerce plugin's console-side API routes (AGL-396):\n * merchant/staff operations (Connect onboarding, refunds, draft & POS\n * orders, member posts), the supplier tracking callback, and the HTTP doors\n * for the abandoned-cart / restock passes.\n *\n * Those last two are NOT what schedules them — the `registerPluginJob` calls\n * above are (AGL-2227). This comment used to call them \"the scheduler-driven\n * jobs\", which is how they stayed dark for months: it asserted the wiring\n * instead of having it.\n */\nexport function registerCommerceConsoleApi(): void {\n  // What a product looks like to a surface that is not this plugin's — a\n  // campaign email that features one asks here rather than importing the model.\n  registerProductCardReader()\n  // …and the tax rule, for the webhook that confirms what they charged.\n  registerCommerceTaxProfile()\n  // Stripe webhook sections (AGL-418): orders/carts/drafts/reservations/\n  // subscriptions ride the platform webhook via the hook registry.\n  registerBillingWebhookHandler(commerceBillingWebhookHandler)\n  // Cancel + stock release in one transaction (AGL-1808). Server-side because\n  // the release depends on the transition rule, and a client write could not\n  // re-ask it under the same lock that flips the status.\n  registerPluginApiRoute('commerce/cancel-order', cancelOrderHandler)\n  registerPluginApiRoute('commerce/connect', connectHandler)\n  registerPluginApiRoute('commerce/draft-order', draftOrderHandler)\n  // Fulfil + mark-delivered with the transition re-asked under the write\n  // (AGL-1819) — the same stale-dialog hole cancel-order closes, minus the\n  // stock release those two transitions never had.\n  registerPluginApiRoute('commerce/fulfill-order', fulfillOrderHandler)\n  // The same transaction, offered to the HOST APP as a capability (AGL-2461)\n  // so `/v1` can record a shipment without importing this library — which\n  // `eslint.config.mjs`'s `scope:app` boundary forbids, and which is why the\n  // public REST API could take an order and never ship it.\n  //\n  // Registered HERE, in the consoleApi surface, beside the route it shares an\n  // implementation with: `/v1` reaches it through the console's server plugin\n  // loader, the same `ensureAll(['consoleApi'])` batch the plugin API\n  // dispatcher runs. A registration at module scope would instead depend on\n  // which entry point a process happened to import.\n  //\n  // NOTHING ABOUT AUTHORIZATION CROSSES THIS LINE. The capability is a\n  // pre-authorized domain operation and `/v1` does its own gating (key scope,\n  // plan entitlement, org-owns-host, plugin-enabled-for-site) before it calls.\n  registerOrderFulfilmentService({\n    pluginId: BUNDLE_ID,\n    recordShipment: recordOrderShipment,\n  })\n  // Issue / void store credit (AGL-2226). Server-side because the host\n  // catch-all in the Firestore rules would otherwise let a client write\n  // its own `balanceCents`, which checkout applies as amount-off.\n  registerPluginApiRoute('commerce/gift-cards', giftCardsHandler)\n  registerPluginApiRoute('commerce/member-post', memberPostHandler)\n  registerPluginApiRoute('commerce/pos-order', posOrderHandler)\n  registerPluginApiRoute('commerce/process-abandoned', processAbandonedHandler)\n  registerPluginApiRoute('commerce/process-restock', processRestockHandler)\n  registerPluginApiRoute('commerce/refund', refundHandler)\n  registerPluginApiRoute('commerce/supplier-update', supplierUpdateHandler)\n  // The store's sales as figure tables (AGL-2915), for the AI plugin's\n  // insights to read by id rather than by reading orders. The console runs\n  // insight jobs, so the console surface registers them.\n  registerOrderFigureReaders(() => firebaseAdmin.app().firestore())\n}\n\n// Shared with the (still app-side) membership/account route.\nexport { mintDownloadToken } from './server/download'\n\n// Site-member session primitives, shared with the (still app-side)\n// membership/* routes until those migrate too (AGL-396).\nexport * from './server/membership'\n"],"names":["registerBillingWebhookHandler","registerOrderFulfilmentService","registerPluginApiRoute","registerPluginJob","registerSitePageEnricher","registerSitePageResolver","registerPluginPermissions","registerPluginConfigSchema","isEmailConfigured","firebaseAdmin","BUNDLE_ID","registerProductCardReader","registerCommerceTaxProfile","commerceBillingWebhookHandler","registerOrderFigureReaders","COMMERCE_PERMISSIONS","COMMERCE_CONFIG_SCHEMA","commerceSitePageEnricher","commerceSitePageResolver","cartCheckoutHandler","cartHandler","catalogHandler","checkoutHandler","downloadHandler","feedHandler","newsletterHandler","notifyRestockHandler","productHandler","relatedHandler","reservationAvailabilityHandler","gateHandler","memberFeedHandler","membershipAccountHandler","membershipAdminPasswordHandler","membershipContentHandler","membershipLoginHandler","membershipLogoutHandler","membershipRecoverHandler","membershipRegisterHandler","membershipResetHandler","membershipWishlistHandler","reserveHandler","streamHandler","subscriptionPortalHandler","reviewsHandler","connectHandler","cancelOrderHandler","draftOrderHandler","fulfillOrderHandler","recordOrderShipment","giftCardsHandler","memberPostHandler","orderAnalyticsHandler","posOrderHandler","processAbandonedHandler","scanAbandonedCheckouts","processRestockHandler","scanRestockAlerts","scanStockDecrements","refundHandler","scanSupplierDeliveries","supplierUpdateHandler","RECOVERY_JOB_INTERVAL_MINUTES","pluginId","name","intervalMinutes","description","lockdown","scope","handler","gate","sent","console","info","scan","missingLines","truncatedHosts","warn","hosts","reportedOrders","deadLettered","registerCommerceApi","registerCommerceConsoleApi","recordShipment","app","firestore","mintDownloadToken"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD;;;;;;;CAOC,GAED,SACEA,6BAA6B,EAC7BC,8BAA8B,EAC9BC,sBAAsB,EACtBC,iBAAiB,EACjBC,wBAAwB,EACxBC,wBAAwB,EACxBC,yBAAyB,EACzBC,0BAA0B,QACrB,sBAAqB;AAC5B,SAASC,iBAAiB,QAAQ,2BAA0B;AAC5D,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,yBAAyB,QAAQ,2BAAuB;AACjE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SAASC,6BAA6B,QAAQ,8BAA0B;AACxE,SAASC,0BAA0B,QAAQ,4BAAwB;AACnE,SAASC,oBAAoB,QAAQ,gCAA4B;AACjE,SAASC,sBAAsB,QAAQ,qBAAiB;AACxD,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,8BAA8B,QAAQ,uCAAmC;AAClF,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,8BAA8B,QAAQ,wCAAoC;AACnF,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,uBAAuB,QAAQ,gCAA4B;AACpE,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SACEC,mBAAmB,EACnBC,mBAAmB,QACd,4BAAwB;AAC/B,SAASC,gBAAgB,QAAQ,yBAAqB;AACtD,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,qBAAqB,QAAQ,8BAA0B;AAChE,SAASC,eAAe,QAAQ,wBAAoB;AACpD,SACEC,uBAAuB,EACvBC,sBAAsB,QACjB,gCAA4B;AACnC,SAASC,qBAAqB,EAAEC,iBAAiB,QAAQ,8BAA0B;AACnF,SAASC,mBAAmB,QAAQ,8BAA0B;AAC9D,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,sBAAsB,QAAQ,8BAA0B;AACjE,SAASC,qBAAqB,QAAQ,8BAA0B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,MAAMC,gCAAgC;AAEtC3D,kBAAkB;IAChB4D,UAAUrD;IACVsD,MAAM;IACNC,iBAAiBH;IACjBI,aACE;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,yEAAyE;QACzE,yEAAyE;QACzE,mBAAmB;QACnB,IAAI,CAAC9D,qBAAqB;QAC1B,MAAM,EAAE+D,IAAI,EAAE,GAAG,MAAMhB,uBAAuBe;QAC9C,IAAIC,MAAMC,QAAQC,IAAI,CAAC,CAAC,eAAe,EAAEF,KAAK,yBAAyB,CAAC;IAC1E;AACF;AAEApE,kBAAkB;IAChB4D,UAAUrD;IACVsD,MAAM;IACNC,iBAAiBH;IACjBI,aAAa;IACbC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,IAAI,CAAC9D,qBAAqB;QAC1B,MAAM,EAAE+D,IAAI,EAAE,GAAG,MAAMd,kBAAkBa;QACzC,IAAIC,MAAMC,QAAQC,IAAI,CAAC,CAAC,eAAe,EAAEF,KAAK,qBAAqB,CAAC;IACtE;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACDpE,kBAAkB;IAChB4D,UAAUrD;IACVsD,MAAM;IACNC,iBAAiB;IACjBC,aACE;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,MAAMI,OAAO,MAAMhB,oBAAoBY;QACvC,IAAII,KAAKC,YAAY,IAAID,KAAKE,cAAc,EAAE;YAC5CJ,QAAQK,IAAI,CACV,CAAC,UAAU,EAAEH,KAAKC,YAAY,CAAC,oBAAoB,EAAED,KAAKI,KAAK,CAAC,CAAC,CAAC,GAChE,CAAC,+BAA+B,EAAEJ,KAAKK,cAAc,CAAC,OAAO,CAAC,GAC9D,CAAC,UAAU,EAAEL,KAAKE,cAAc,CAAC,gCAAgC,CAAC;QAExE;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACDzE,kBAAkB;IAChB4D,UAAUrD;IACVsD,MAAM;IACNC,iBAAiB;IACjBC,aACE,wEACA;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,MAAMI,OAAO,MAAMd,uBAAuBU;QAC1C,IAAII,KAAKM,YAAY,EAAE;YACrBR,QAAQK,IAAI,CACV,CAAC,UAAU,EAAEH,KAAKM,YAAY,CAAC,qCAAqC,CAAC,GACnE,CAAC,qDAAqD,CAAC;QAE7D;IACF;AACF;AAEA,2DAA2D,GAC3D,OAAO,SAASC;IACdtE;IACA,uEAAuE;IACvEC;IACAN,0BAA0BS;IAC1B,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtER,2BAA2BS;IAC3B,kEAAkE;IAClEX,yBAAyBa;IACzB,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtEd,yBAAyBa;IACzBf,uBAAuB,0BAA0BiB;IACjDjB,uBAAuB,iBAAiBkB;IACxClB,uBAAuB,oBAAoBmB;IAC3CnB,uBAAuB,qBAAqBoB;IAC5CpB,uBAAuB,qBAAqBqB;IAC5CrB,uBAAuB,iBAAiBsB;IACxCtB,uBAAuB,uBAAuBuB;IAC9CvB,uBAAuB,2BAA2BwB;IAClD,qEAAqE;IACrExB,uBAAuB,4BAA4BkD;IACnDlD,uBAAuB,oBAAoByB;IAC3CzB,uBAAuB,oBAAoB0B;IAC3C1B,uBAAuB,qCAAqC2B;IAC5D3B,uBAAuB,oBAAoBuC;IAC3CvC,uBAAuB,iBAAiB4B;IACxC5B,uBAAuB,wBAAwB6B;IAC/C7B,uBAAuB,mBAAmBwC;IAC1CxC,uBAAuB,gCAAgCyC;IACvDzC,uBAAuB,oBAAoB0C;IAC3C1C,uBAAuB,sBAAsB8B;IAC7C,yEAAyE;IACzE,mDAAmD;IACnD9B,uBACE,6BACA+B;IAEF/B,uBAAuB,sBAAsBgC;IAC7ChC,uBAAuB,oBAAoBiC;IAC3CjC,uBAAuB,qBAAqBkC;IAC5C,wDAAwD;IACxDlC,uBAAuB,sBAAsBmC;IAC7CnC,uBAAuB,uBAAuBoC;IAC9CpC,uBAAuB,oBAAoBqC;IAC3CrC,uBAAuB,uBAAuBsC;AAChD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAAS0C;IACd,uEAAuE;IACvE,8EAA8E;IAC9EvE;IACA,sEAAsE;IACtEC;IACA,uEAAuE;IACvE,iEAAiE;IACjEZ,8BAA8Ba;IAC9B,4EAA4E;IAC5E,2EAA2E;IAC3E,uDAAuD;IACvDX,uBAAuB,yBAAyB4C;IAChD5C,uBAAuB,oBAAoB2C;IAC3C3C,uBAAuB,wBAAwB6C;IAC/C,uEAAuE;IACvE,yEAAyE;IACzE,iDAAiD;IACjD7C,uBAAuB,0BAA0B8C;IACjD,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,yDAAyD;IACzD,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE,0EAA0E;IAC1E,kDAAkD;IAClD,EAAE;IACF,qEAAqE;IACrE,4EAA4E;IAC5E,6EAA6E;IAC7E/C,+BAA+B;QAC7B8D,UAAUrD;QACVyE,gBAAgBlC;IAClB;IACA,qEAAqE;IACrE,sEAAsE;IACtE,gEAAgE;IAChE/C,uBAAuB,uBAAuBgD;IAC9ChD,uBAAuB,wBAAwBiD;IAC/CjD,uBAAuB,sBAAsBmD;IAC7CnD,uBAAuB,8BAA8BoD;IACrDpD,uBAAuB,4BAA4BsD;IACnDtD,uBAAuB,mBAAmByD;IAC1CzD,uBAAuB,4BAA4B2D;IACnD,qEAAqE;IACrE,yEAAyE;IACzE,uDAAuD;IACvD/C,2BAA2B,IAAML,cAAc2E,GAAG,GAAGC,SAAS;AAChE;AAEA,6DAA6D;AAC7D,SAASC,iBAAiB,QAAQ,uBAAmB;AAErD,mEAAmE;AACnE,yDAAyD;AACzD,cAAc,yBAAqB"}

package/src/lib/site.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import * as Aglyn from '@aglyn/aglyn';
+/**
+ * Commerce UI feature plugin (AGL-290): the storefront component set,
+ * built on the feature-plugin pattern (AGL-277) — depends on the mui
+ * bundle for primitives/theming and registers alongside it in the
+ * besigner and the tenant renderer. Components join `COMMERCE_BUNDLE`
+ * as they land (PLP AGL-291, PDP AGL-292, cart AGL-293, …); ids are
+ * persisted in screen docs and never renamed.
+ */
+export declare const COMMERCE_BUNDLE: Aglyn.FeatureBundleEntry[];
+export declare function registerCommercePlugin(): void;

package/src/lib/site.js

@@ -0,0 +1,134 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn";
+import { mdiStorefrontOutline } from "@aglyn/shared-data-mdi";
+import * as Account from "./components/account.js";
+import * as Cart from "./components/cart.js";
+import * as Gate from "./components/gate.js";
+import * as GatedVideo from "./components/gated-video.js";
+import * as MemberFeed from "./components/member-feed.js";
+import * as MemberRecovery from "./components/member-recovery.js";
+import * as MemberSignin from "./components/member-signin.js";
+import * as MemberSignup from "./components/member-signup.js";
+import * as NewsletterSignup from "./components/newsletter-signup.js";
+import * as ProductDetail from "./components/product-detail.js";
+import * as ReservationWidget from "./components/reservation-widget.js";
+import * as ProductGrid from "./components/product-grid.js";
+import * as ProductReviews from "./components/product-reviews.js";
+import * as RelatedProducts from "./components/related-products.js";
+import * as Wishlist from "./components/wishlist.js";
+import { BUNDLE_ID } from "./constants/bundle-common.js";
+/**
+ * Commerce UI feature plugin (AGL-290): the storefront component set,
+ * built on the feature-plugin pattern (AGL-277) — depends on the mui
+ * bundle for primitives/theming and registers alongside it in the
+ * besigner and the tenant renderer. Components join `COMMERCE_BUNDLE`
+ * as they land (PLP AGL-291, PDP AGL-292, cart AGL-293, …); ids are
+ * persisted in screen docs and never renamed.
+ */ export const COMMERCE_BUNDLE = [
+    {
+        component: ProductGrid.default,
+        schema: ProductGrid.schema,
+        presets: ProductGrid.presets
+    },
+    {
+        component: ProductDetail.default,
+        schema: ProductDetail.schema,
+        presets: ProductDetail.presets
+    },
+    {
+        component: Cart.default,
+        schema: Cart.schema,
+        presets: Cart.presets
+    },
+    {
+        component: Account.default,
+        schema: Account.schema,
+        presets: Account.presets
+    },
+    {
+        component: Wishlist.default,
+        schema: Wishlist.schema,
+        presets: Wishlist.presets
+    },
+    {
+        component: NewsletterSignup.default,
+        schema: NewsletterSignup.schema,
+        presets: NewsletterSignup.presets
+    },
+    {
+        component: Gate.default,
+        schema: Gate.schema,
+        presets: Gate.presets
+    },
+    {
+        component: GatedVideo.default,
+        schema: GatedVideo.schema,
+        presets: GatedVideo.presets
+    },
+    {
+        component: MemberFeed.default,
+        schema: MemberFeed.schema,
+        presets: MemberFeed.presets
+    },
+    {
+        component: MemberRecovery.default,
+        schema: MemberRecovery.schema,
+        presets: MemberRecovery.presets
+    },
+    {
+        component: MemberSignin.default,
+        schema: MemberSignin.schema,
+        presets: MemberSignin.presets
+    },
+    {
+        component: MemberSignup.default,
+        schema: MemberSignup.schema,
+        presets: MemberSignup.presets
+    },
+    {
+        component: ReservationWidget.default,
+        schema: ReservationWidget.schema,
+        presets: ReservationWidget.presets
+    },
+    {
+        component: ProductReviews.default,
+        schema: ProductReviews.schema,
+        presets: ProductReviews.presets
+    },
+    {
+        component: RelatedProducts.default,
+        schema: RelatedProducts.schema,
+        presets: RelatedProducts.presets
+    }
+];
+export function registerCommercePlugin() {
+    // The canvas half only. The console registers the console half through its
+    // own `console` surface, and a published page must never load console code
+    // (AGL-3116): this runs on every page that places one of these elements.
+    if (Aglyn.plugins.getDependency(BUNDLE_ID)) return;
+    Aglyn.plugins.addDependency(Aglyn.defineUiFeatureBundle({
+        bundleId: BUNDLE_ID,
+        displayName: 'Commerce',
+        description: 'Storefront blocks: product grids, detail, cart',
+        icon: {
+            path: mdiStorefrontOutline.path
+        },
+        components: COMMERCE_BUNDLE
+    }, Aglyn.components));
+}
+
+//# sourceMappingURL=site.js.map

package/src/lib/site.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/commerce/src/lib/site.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiStorefrontOutline } from '@aglyn/shared-data-mdi'\nimport * as Account from './components/account'\nimport * as Cart from './components/cart'\nimport * as Gate from './components/gate'\nimport * as GatedVideo from './components/gated-video'\nimport * as MemberFeed from './components/member-feed'\nimport * as MemberRecovery from './components/member-recovery'\nimport * as MemberSignin from './components/member-signin'\nimport * as MemberSignup from './components/member-signup'\nimport * as NewsletterSignup from './components/newsletter-signup'\nimport * as ProductDetail from './components/product-detail'\nimport * as ReservationWidget from './components/reservation-widget'\nimport * as ProductGrid from './components/product-grid'\nimport * as ProductReviews from './components/product-reviews'\nimport * as RelatedProducts from './components/related-products'\nimport * as Wishlist from './components/wishlist'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/**\n * Commerce UI feature plugin (AGL-290): the storefront component set,\n * built on the feature-plugin pattern (AGL-277) — depends on the mui\n * bundle for primitives/theming and registers alongside it in the\n * besigner and the tenant renderer. Components join `COMMERCE_BUNDLE`\n * as they land (PLP AGL-291, PDP AGL-292, cart AGL-293, …); ids are\n * persisted in screen docs and never renamed.\n */\nexport const COMMERCE_BUNDLE: Aglyn.FeatureBundleEntry[] = [\n  {\n    component: ProductGrid.default,\n    schema: ProductGrid.schema,\n    presets: ProductGrid.presets,\n  },\n  {\n    component: ProductDetail.default,\n    schema: ProductDetail.schema,\n    presets: ProductDetail.presets,\n  },\n  {\n    component: Cart.default,\n    schema: Cart.schema,\n    presets: Cart.presets,\n  },\n  {\n    component: Account.default,\n    schema: Account.schema,\n    presets: Account.presets,\n  },\n  {\n    component: Wishlist.default,\n    schema: Wishlist.schema,\n    presets: Wishlist.presets,\n  },\n  {\n    component: NewsletterSignup.default,\n    schema: NewsletterSignup.schema,\n    presets: NewsletterSignup.presets,\n  },\n  {\n    component: Gate.default,\n    schema: Gate.schema,\n    presets: Gate.presets,\n  },\n  {\n    component: GatedVideo.default,\n    schema: GatedVideo.schema,\n    presets: GatedVideo.presets,\n  },\n  {\n    component: MemberFeed.default,\n    schema: MemberFeed.schema,\n    presets: MemberFeed.presets,\n  },\n  {\n    component: MemberRecovery.default,\n    schema: MemberRecovery.schema,\n    presets: MemberRecovery.presets,\n  },\n  {\n    component: MemberSignin.default,\n    schema: MemberSignin.schema,\n    presets: MemberSignin.presets,\n  },\n  {\n    component: MemberSignup.default,\n    schema: MemberSignup.schema,\n    presets: MemberSignup.presets,\n  },\n  {\n    component: ReservationWidget.default,\n    schema: ReservationWidget.schema,\n    presets: ReservationWidget.presets,\n  },\n  {\n    component: ProductReviews.default,\n    schema: ProductReviews.schema,\n    presets: ProductReviews.presets,\n  },\n  {\n    component: RelatedProducts.default,\n    schema: RelatedProducts.schema,\n    presets: RelatedProducts.presets,\n  },\n]\n\nexport function registerCommercePlugin(): void {\n  // The canvas half only. The console registers the console half through its\n  // own `console` surface, and a published page must never load console code\n  // (AGL-3116): this runs on every page that places one of these elements.\n  if (Aglyn.plugins.getDependency(BUNDLE_ID)) return\n  Aglyn.plugins.addDependency(\n    Aglyn.defineUiFeatureBundle(\n      {\n        bundleId: BUNDLE_ID,\n        displayName: 'Commerce',\n        description: 'Storefront blocks: product grids, detail, cart',\n        icon: { path: mdiStorefrontOutline.path },\n        components: COMMERCE_BUNDLE,\n      },\n      Aglyn.components,\n    ),\n  )\n}\n"],"names":["Aglyn","mdiStorefrontOutline","Account","Cart","Gate","GatedVideo","MemberFeed","MemberRecovery","MemberSignin","MemberSignup","NewsletterSignup","ProductDetail","ReservationWidget","ProductGrid","ProductReviews","RelatedProducts","Wishlist","BUNDLE_ID","COMMERCE_BUNDLE","component","default","schema","presets","registerCommercePlugin","plugins","getDependency","addDependency","defineUiFeatureBundle","bundleId","displayName","description","icon","path","components"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,oBAAoB,QAAQ,yBAAwB;AAC7D,YAAYC,aAAa,0BAAsB;AAC/C,YAAYC,UAAU,uBAAmB;AACzC,YAAYC,UAAU,uBAAmB;AACzC,YAAYC,gBAAgB,8BAA0B;AACtD,YAAYC,gBAAgB,8BAA0B;AACtD,YAAYC,oBAAoB,kCAA8B;AAC9D,YAAYC,kBAAkB,gCAA4B;AAC1D,YAAYC,kBAAkB,gCAA4B;AAC1D,YAAYC,sBAAsB,oCAAgC;AAClE,YAAYC,mBAAmB,iCAA6B;AAC5D,YAAYC,uBAAuB,qCAAiC;AACpE,YAAYC,iBAAiB,+BAA2B;AACxD,YAAYC,oBAAoB,kCAA8B;AAC9D,YAAYC,qBAAqB,mCAA+B;AAChE,YAAYC,cAAc,2BAAuB;AACjD,SAASC,SAAS,QAAQ,+BAA2B;AAErD;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAA8C;IACzD;QACEC,WAAWN,YAAYO,OAAO;QAC9BC,QAAQR,YAAYQ,MAAM;QAC1BC,SAAST,YAAYS,OAAO;IAC9B;IACA;QACEH,WAAWR,cAAcS,OAAO;QAChCC,QAAQV,cAAcU,MAAM;QAC5BC,SAASX,cAAcW,OAAO;IAChC;IACA;QACEH,WAAWhB,KAAKiB,OAAO;QACvBC,QAAQlB,KAAKkB,MAAM;QACnBC,SAASnB,KAAKmB,OAAO;IACvB;IACA;QACEH,WAAWjB,QAAQkB,OAAO;QAC1BC,QAAQnB,QAAQmB,MAAM;QACtBC,SAASpB,QAAQoB,OAAO;IAC1B;IACA;QACEH,WAAWH,SAASI,OAAO;QAC3BC,QAAQL,SAASK,MAAM;QACvBC,SAASN,SAASM,OAAO;IAC3B;IACA;QACEH,WAAWT,iBAAiBU,OAAO;QACnCC,QAAQX,iBAAiBW,MAAM;QAC/BC,SAASZ,iBAAiBY,OAAO;IACnC;IACA;QACEH,WAAWf,KAAKgB,OAAO;QACvBC,QAAQjB,KAAKiB,MAAM;QACnBC,SAASlB,KAAKkB,OAAO;IACvB;IACA;QACEH,WAAWd,WAAWe,OAAO;QAC7BC,QAAQhB,WAAWgB,MAAM;QACzBC,SAASjB,WAAWiB,OAAO;IAC7B;IACA;QACEH,WAAWb,WAAWc,OAAO;QAC7BC,QAAQf,WAAWe,MAAM;QACzBC,SAAShB,WAAWgB,OAAO;IAC7B;IACA;QACEH,WAAWZ,eAAea,OAAO;QACjCC,QAAQd,eAAec,MAAM;QAC7BC,SAASf,eAAee,OAAO;IACjC;IACA;QACEH,WAAWX,aAAaY,OAAO;QAC/BC,QAAQb,aAAaa,MAAM;QAC3BC,SAASd,aAAac,OAAO;IAC/B;IACA;QACEH,WAAWV,aAAaW,OAAO;QAC/BC,QAAQZ,aAAaY,MAAM;QAC3BC,SAASb,aAAaa,OAAO;IAC/B;IACA;QACEH,WAAWP,kBAAkBQ,OAAO;QACpCC,QAAQT,kBAAkBS,MAAM;QAChCC,SAASV,kBAAkBU,OAAO;IACpC;IACA;QACEH,WAAWL,eAAeM,OAAO;QACjCC,QAAQP,eAAeO,MAAM;QAC7BC,SAASR,eAAeQ,OAAO;IACjC;IACA;QACEH,WAAWJ,gBAAgBK,OAAO;QAClCC,QAAQN,gBAAgBM,MAAM;QAC9BC,SAASP,gBAAgBO,OAAO;IAClC;CACD,CAAA;AAED,OAAO,SAASC;IACd,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAIvB,MAAMwB,OAAO,CAACC,aAAa,CAACR,YAAY;IAC5CjB,MAAMwB,OAAO,CAACE,aAAa,CACzB1B,MAAM2B,qBAAqB,CACzB;QACEC,UAAUX;QACVY,aAAa;QACbC,aAAa;QACbC,MAAM;YAAEC,MAAM/B,qBAAqB+B,IAAI;QAAC;QACxCC,YAAYf;IACd,GACAlB,MAAMiC,UAAU;AAGtB"}

package/src/lib/utils/escape-html.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * HTML-escape a text value for interpolation into markup this plugin builds by
+ * hand (AGL-2283).
+ *
+ * Commerce has three such places and React guards none of them, because none
+ * of them is React: the packing slip and the POS receipt are written into a
+ * `window.open('')` popup with `document.write`, and the supplier confirmation
+ * page is a string a server route sends. All three interpolated values
+ * straight in.
+ *
+ * The packing slip is the one that matters. `order.shippingAddress` is copied
+ * verbatim from Stripe's `shipping_details` — a SHOPPER types it — and the
+ * popup is an `about:blank` document that inherits the CONSOLE's origin, so a
+ * name of `<img src=x onerror=…>` runs script against the merchant's own
+ * authenticated session. The receipt and the slip's line names are merchant-
+ * authored and lower severity, but they are the same construction and are
+ * escaped the same way rather than reasoned about one at a time.
+ *
+ * The escaping itself is `@aglyn/shared-util-tools/escape-html`, which this
+ * module's implementation became when the same function turned up in four
+ * other places (AGL-2706) — two of them missing `'`. What stays here is the
+ * paragraph above, which is about commerce's call sites and belongs with
+ * them.
+ */
+export { escapeHtml } from '@aglyn/shared-util-tools/escape-html';

package/src/lib/utils/escape-html.js

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * HTML-escape a text value for interpolation into markup this plugin builds by
+ * hand (AGL-2283).
+ *
+ * Commerce has three such places and React guards none of them, because none
+ * of them is React: the packing slip and the POS receipt are written into a
+ * `window.open('')` popup with `document.write`, and the supplier confirmation
+ * page is a string a server route sends. All three interpolated values
+ * straight in.
+ *
+ * The packing slip is the one that matters. `order.shippingAddress` is copied
+ * verbatim from Stripe's `shipping_details` — a SHOPPER types it — and the
+ * popup is an `about:blank` document that inherits the CONSOLE's origin, so a
+ * name of `<img src=x onerror=…>` runs script against the merchant's own
+ * authenticated session. The receipt and the slip's line names are merchant-
+ * authored and lower severity, but they are the same construction and are
+ * escaped the same way rather than reasoned about one at a time.
+ *
+ * The escaping itself is `@aglyn/shared-util-tools/escape-html`, which this
+ * module's implementation became when the same function turned up in four
+ * other places (AGL-2706) — two of them missing `'`. What stays here is the
+ * paragraph above, which is about commerce's call sites and belongs with
+ * them.
+ */ export { escapeHtml } from "@aglyn/shared-util-tools/escape-html";
+
+//# sourceMappingURL=escape-html.js.map

package/src/lib/utils/escape-html.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/utils/escape-html.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * HTML-escape a text value for interpolation into markup this plugin builds by\n * hand (AGL-2283).\n *\n * Commerce has three such places and React guards none of them, because none\n * of them is React: the packing slip and the POS receipt are written into a\n * `window.open('')` popup with `document.write`, and the supplier confirmation\n * page is a string a server route sends. All three interpolated values\n * straight in.\n *\n * The packing slip is the one that matters. `order.shippingAddress` is copied\n * verbatim from Stripe's `shipping_details` — a SHOPPER types it — and the\n * popup is an `about:blank` document that inherits the CONSOLE's origin, so a\n * name of `<img src=x onerror=…>` runs script against the merchant's own\n * authenticated session. The receipt and the slip's line names are merchant-\n * authored and lower severity, but they are the same construction and are\n * escaped the same way rather than reasoned about one at a time.\n *\n * The escaping itself is `@aglyn/shared-util-tools/escape-html`, which this\n * module's implementation became when the same function turned up in four\n * other places (AGL-2706) — two of them missing `'`. What stays here is the\n * paragraph above, which is about commerce's call sites and belongs with\n * them.\n */\nexport { escapeHtml } from '@aglyn/shared-util-tools/escape-html'\n"],"names":["escapeHtml"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,SAASA,UAAU,QAAQ,uCAAsC"}