@aglyn/plugins-commerce 1.0.0-beta.151 → 1.0.0-beta.153

package/src/lib/server/membership-register.js

@@ -15,8 +15,8 @@
  * limitations under the License.
  */ import { _ as _extends } from "@swc/helpers/_/_extends";
 import { memberNameSearchFields } from "./member-name-search.js";
-import { checkVisitorRecordCeiling, HOST_TOKENS, marketingConsentFieldsForHost, personKey, SITE_MEMBER_CEILING_CODE, SITE_MEMBER_UNAVAILABLE_MESSAGE, SITE_MEMBERS_MAX_PER_HOST } from "@aglyn/aglyn/server";
-import { addHostLead, firebaseAdmin, recordVisitorRecordCeilingTrip, resolveCampaignTouch } from "@aglyn/tenant-data-admin";
+import { checkVisitorRecordCeiling, HOST_TOKENS, marketingConsentFieldsForHost, SITE_MEMBER_CEILING_CODE, SITE_MEMBER_UNAVAILABLE_MESSAGE, SITE_MEMBERS_MAX_PER_HOST } from "@aglyn/aglyn/server";
+import { firebaseAdmin, recordVisitorRecordCeilingTrip, resolveCampaignTouch } from "@aglyn/tenant-data-admin";
 import { emitHostEvent } from "@aglyn/tenant-runtime";
 import recordCapturedContact from "@aglyn/aglyn/plugin-manager/record-captured-contact";
 import { hashMemberPassword, mintMemberSession, setMemberCookie } from "./membership.js";
@@ -52,7 +52,6 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
         });
     }
     try {
-        var _personKey;
         var _req_body5;
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
@@ -181,26 +180,17 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
             email,
             atMs: signedUpAtMs
         });
-        await addHostLead(_extends({
-            hostRef,
-            hostId,
-            lead: _extends({
-                email
-            }, displayName ? {
-                name: displayName
-            } : {}, {
-                source: 'signup'
-            }, marketingConsent ? {
-                marketingConsent: true
-            } : {})
-        }, campaignTouch ? {
-            touch: campaignTouch
-        } : {}));
         /*
      * Contacts ingestion (AGL-197), reported to whichever plugin keeps people
      * rather than written by this one (AGL-3080). Commerce knows it just met
      * somebody; what a person record is belongs to the plugin that models it,
      * and a workspace that keeps none is a quiet, correct answer here.
+     */ /*
+     * A member account is a RELATIONSHIP (AGL-3232): the person is a
+     * contact from this moment, and an open lead the site held for the
+     * address is closed as converted onto that contact by the record
+     * system — a sign-up files no lead of its own any more, the way a
+     * portal user is a contact and not a lead in Salesforce.
      */ void recordCapturedContact(_extends({
             /*
        * Not resolved here. The record system keys a person on the SITE they
@@ -218,10 +208,10 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
                 refId: memberRef.id,
                 summary: 'Joined as a member'
             },
+            surface: 'relationship',
             // An account is a subscription to the site, not an enquiry (AGL-2612):
-            // the lead this sign-up also files is the sales record, and the stage
-            // on the contact says only that the person asked to be kept. A floor,
-            // so a customer who opens an account stays a customer.
+            // the stage on the contact says only that the person asked to be
+            // kept. A floor, so a customer who opens an account stays a customer.
             lifecycleFloor: 'subscriber'
         }, marketingConsent ? {
             marketingConsent: true
@@ -230,18 +220,11 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
                 campaignTouch
             }
         } : {}));
-        // Event triggers (AGL-128/148): sign-ups double as leads here too. The
-        // lead's id is the person key `addHostLead` filed it under, so a webhook
-        // can read the row back over `/v1/leads/{leadId}` (AGL-2627); empty for
-        // an address that could not be keyed, as every optional payload key is.
+        // Event trigger (AGL-128/148). A sign-up is no longer a lead (AGL-3232),
+        // so the `lead` event is the lead surfaces' to emit.
         await emitHostEvent(hostId, 'memberSignUp', {
             email
         });
-        await emitHostEvent(hostId, 'lead', {
-            email,
-            source: 'signup',
-            leadId: (_personKey = personKey(email)) != null ? _personKey : ''
-        });
         setMemberCookie(res, hostId, mintMemberSession(hostId, memberRef.id));
         return res.status(200).json({
             ok: true

package/src/lib/server/membership-register.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-register.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { memberNameSearchFields } from './member-name-search'\nimport {\n  checkVisitorRecordCeiling,\n  HOST_TOKENS,\n  marketingConsentFieldsForHost,\n  personKey,\n  SITE_MEMBER_CEILING_CODE,\n  SITE_MEMBER_UNAVAILABLE_MESSAGE,\n  SITE_MEMBERS_MAX_PER_HOST,\n} from '@aglyn/aglyn/server'\nimport {\n  addHostLead,\n  firebaseAdmin,\n  recordVisitorRecordCeilingTrip,\n  resolveCampaignTouch,\n} from '@aglyn/tenant-data-admin'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport recordCapturedContact from '@aglyn/aglyn/plugin-manager/record-captured-contact'\nimport {\n  hashMemberPassword,\n  mintMemberSession,\n  setMemberCookie,\n} from './membership'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Site member sign-up (AGL-109): creates the member record (scrypt hash),\n * doubles as a lead, and signs the visitor in via the session cookie.\n */\nexport const membershipRegisterHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  const displayName = String(req.body?.displayName ?? '')\n    .trim()\n    .slice(0, 80)\n  // Explicit opt-in checkbox (AGL-2499) — never inferred from signing up.\n  const marketingConsent = req.body?.marketingConsent === true\n  if (!hostId) return res.status(400).json({ error: 'Missing host' })\n  if (!EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Enter a valid email' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Member accounts are UNLIMITED on every plan (AGL-889) — no seat or\n    // quota check belongs here. Audience monetization happens downstream:\n    // contact bands meter the CRM projection (AGL-890) and paid\n    // memberships carry the plan's digital transaction fee (AGL-892).\n    //\n    // `SITE_MEMBERS_MAX_PER_HOST` below is NOT that check and does not make\n    // it one (AGL-1529). It is a flat PLATFORM ceiling — same number on every\n    // plan, no `OrgEntitlements` key, nothing on the price list — and it\n    // exists because this handler is reachable by an ANONYMOUS VISITOR, so\n    // without it the collection was bounded only by a per-(host, IP) rate\n    // limiter that fails soft and bounds the RATE rather than the TOTAL. An\n    // abuse control is not something we sell; \"unlimited member accounts on\n    // every plan\" stays literally true.\n    const membersRef = hostRef.collection('siteMembers')\n    const memberRef = membersRef.doc()\n    /*\n     * COUNT, DEDUPE AND CREATE IN ONE TRANSACTION (AGL-1529, the AGL-2231\n     * treatment).\n     *\n     * Read-then-decide-then-`set()` is the create-time quota that laundered\n     * everywhere else in this repo: N concurrent sign-ups each read the same\n     * pre-count, each find room, and each land — and nothing re-counts\n     * afterwards, so the extra accounts are permanent. The fix is WHEN the\n     * count is evaluated, not the counting rule.\n     * `Transaction.get(AggregateQuery)` serialises the count against a\n     * concurrent create into this collection: the loser retries, re-reads the\n     * higher count and is refused. The duplicate-email read moves inside for\n     * free, which also closes the smaller race it always had — two\n     * simultaneous sign-ups on one address both saw `empty` and both wrote.\n     *\n     * ALL READS BEFORE THE WRITE, which Firestore requires.\n     *\n     * The scrypt hash sits between the last read and the create ON PURPOSE.\n     * It is ~100 ms of CPU and it is the most expensive thing in the request,\n     * so a refused sign-up must never pay it — hashing before the transaction\n     * would hand a flood a CPU amplifier on exactly the path the ceiling\n     * exists to contain, and would also be a regression, since today a\n     * duplicate-email refusal does not hash either. It is a pure computation,\n     * not an effect, so it does not violate the \"nothing happens in a\n     * transaction body\" rule the sibling routes state.\n     *\n     * A refusal is returned as DATA and rendered outside: a body that can run\n     * several times must not be the place a response is built.\n     */\n    const refusal = await firestore.runTransaction(async (tx) => {\n      const existing = await tx.get(membersRef.where('email', '==', email).limit(1))\n      if (!existing.empty) return { duplicate: true, ceiling: 0 }\n      const used = (await tx.get(membersRef.count())).data().count\n      // Live documents only, so removing a member in the inbox frees the slot.\n      const verdict = checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n      if (verdict.exceeded) return { duplicate: false, ceiling: verdict.ceiling }\n      tx.create(memberRef, {\n        email,\n        ...(displayName ? memberNameSearchFields(displayName) : {}),\n        passwordScrypt: hashMemberPassword(password),\n        /*\n         * The checkbox is PERSISTED on the member, not only forwarded.\n         *\n         * It reached the lead and the contact from the two lines below and\n         * was dropped for this document, so `hosts/{hostId}/siteMembers` had\n         * no consent field of any kind and `audience: 'members'` had nothing\n         * for the send-time join to read — the audience could not be filtered\n         * even in principle (`docs/specs/email-overhaul.md` §1d/§3f). The\n         * other two documents are not a substitute: a member is deduped in\n         * this transaction while leads append every time, and contacts are\n         * ORG-scoped where a member is the site's own.\n         *\n         * Written only when ticked. Signing up is not opting in — that is why\n         * the checkbox exists and why it defaults unchecked — so the omitted\n         * case stores nothing and reads back as an unrecorded basis rather\n         * than as a refusal.\n         *\n         * Under this site's key even though `siteMembers` already lives\n         * beneath it, so that one reader answers for every silo — see\n         * `addHostLead`, which makes the same write for the same reason.\n         */\n        ...(marketingConsent\n          ? marketingConsentFieldsForHost(hostId, Date.now())\n          : {}),\n        createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      })\n      return null\n    })\n    if (refusal?.duplicate) {\n      return res.status(409).json({ error: 'That email is already a member' })\n    }\n    if (refusal) {\n      // Visible to the HOST — the rule that a control nobody can see in\n      // the console did not ship. Durable counter + one notification.\n      await recordVisitorRecordCeilingTrip({\n        hostRef,\n        hostId,\n        kind: 'siteMembers',\n        ceiling: refusal.ceiling,\n      })\n      // Opaque to the VISITOR, who is a stranger to this site and not our\n      // customer (AGL-1666's rules, restated in the message's own docblock).\n      // The one genuinely useful thing to hand them is a door that still\n      // opens, so the site's OWN published support address rides along when\n      // it has one — read through the host-token registry, whose description\n      // of this field is literally \"where visitors should write for help\".\n      // Nothing else off the host document may leave the console.\n      const contact = HOST_TOKENS['supportEmail']?.resolve(\n        hostSnapshot.data() as any,\n      )\n      return res.status(429).json({\n        error: SITE_MEMBER_UNAVAILABLE_MESSAGE,\n        // Machine-readable, because the dispatcher's rate limiter answers 429\n        // too and the status therefore discriminates nothing.\n        code: SITE_MEMBER_CEILING_CODE,\n        ...(contact ? { contact } : {}),\n      })\n    }\n    // Sign-ups double as leads for the site owner (AGL-109), through the one\n    // writer that enforces `LEADS_MAX_PER_HOST` (AGL-1529). A refused lead\n    // never fails the sign-up: the visitor asked for an account, not for a\n    // lead record, and the trip is recorded for the owner either way.\n    /*\n     * THE CAMPAIGN TOUCH, RESOLVED ONCE FOR THE WHOLE SIGN-UP.\n     *\n     * A sign-up is the identify moment for a visitor who has been anonymous\n     * until now, and it writes two records that a campaign can be credited\n     * with — the lead and the contact. One resolve, one keyed read, and the\n     * two cannot end up naming different campaigns.\n     *\n     * The MEMBER record itself is not attributed. A member is an account the\n     * visitor holds and the lead is the site's record of the same act, so\n     * crediting both would count one sign-up twice under two names.\n     */\n    const signedUpAtMs = Date.now()\n    const campaignTouch = await resolveCampaignTouch({\n      hostId,\n      wire: req.body?.campaignTouch,\n      email,\n      atMs: signedUpAtMs,\n    })\n    await addHostLead({\n      hostRef,\n      hostId,\n      lead: {\n        email,\n        // The name the person just typed (AGL-2303). `campaign-send` reads\n        // `leads.name` for merge tags and NOTHING wrote it, so every campaign\n        // to the leads audience addressed a blank — with the name sitting one\n        // line above, already stored on the member document.\n        ...(displayName ? { name: displayName } : {}),\n        source: 'signup',\n        ...(marketingConsent ? { marketingConsent: true } : {}),\n      },\n      ...(campaignTouch ? { touch: campaignTouch } : {}),\n    })\n    /*\n     * Contacts ingestion (AGL-197), reported to whichever plugin keeps people\n     * rather than written by this one (AGL-3080). Commerce knows it just met\n     * somebody; what a person record is belongs to the plugin that models it,\n     * and a workspace that keeps none is a quiet, correct answer here.\n     */\n    void recordCapturedContact({\n      /*\n       * Not resolved here. The record system keys a person on the SITE they\n       * were met on, so this costs the capture nothing — and resolving it\n       * would put a Firestore read in front of the writer, which is the one\n       * thing `recordCapturedContact` asks a door not to do.\n       */\n      orgId: '',\n      hostId,\n      identity: { email, name: displayName || undefined },\n      interaction: {\n        source: 'member',\n        refId: memberRef.id,\n        summary: 'Joined as a member',\n      },\n      // An account is a subscription to the site, not an enquiry (AGL-2612):\n      // the lead this sign-up also files is the sales record, and the stage\n      // on the contact says only that the person asked to be kept. A floor,\n      // so a customer who opens an account stays a customer.\n      lifecycleFloor: 'subscriber',\n      ...(marketingConsent ? { marketingConsent: true } : {}),\n      // Where the visitor ARRIVED from — a fact about this visit and not\n      // about the person, which is what `detail` carries.\n      ...(campaignTouch ? { detail: { campaignTouch } } : {}),\n    })\n    // Event triggers (AGL-128/148): sign-ups double as leads here too. The\n    // lead's id is the person key `addHostLead` filed it under, so a webhook\n    // can read the row back over `/v1/leads/{leadId}` (AGL-2627); empty for\n    // an address that could not be keyed, as every optional payload key is.\n    await emitHostEvent(hostId, 'memberSignUp', { email })\n    await emitHostEvent(hostId, 'lead', {\n      email,\n      source: 'signup',\n      leadId: personKey(email) ?? '',\n    })\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberRef.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-up failed' })\n  }\n}\n"],"names":["memberNameSearchFields","checkVisitorRecordCeiling","HOST_TOKENS","marketingConsentFieldsForHost","personKey","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","SITE_MEMBERS_MAX_PER_HOST","addHostLead","firebaseAdmin","recordVisitorRecordCeilingTrip","resolveCampaignTouch","emitHostEvent","recordCapturedContact","hashMemberPassword","mintMemberSession","setMemberCookie","EMAIL_PATTERN","membershipRegisterHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","displayName","slice","marketingConsent","test","length","firestore","app","hostRef","collection","doc","hostSnapshot","get","exists","membersRef","memberRef","refusal","runTransaction","tx","existing","where","limit","empty","duplicate","ceiling","used","count","data","verdict","exceeded","create","passwordScrypt","Date","now","createdAt","FieldValue","serverTimestamp","kind","contact","resolve","code","signedUpAtMs","campaignTouch","wire","atMs","lead","name","source","touch","orgId","identity","undefined","interaction","refId","id","summary","lifecycleFloor","detail","leadId","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,sBAAsB,QAAQ,0BAAsB;AAC7D,SACEC,yBAAyB,EACzBC,WAAW,EACXC,6BAA6B,EAC7BC,SAAS,EACTC,wBAAwB,EACxBC,+BAA+B,EAC/BC,yBAAyB,QACpB,sBAAqB;AAC5B,SACEC,WAAW,EACXC,aAAa,EACbC,8BAA8B,EAC9BC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,aAAa,QAAQ,wBAAuB;AACrD,OAAOC,2BAA2B,sDAAqD;AACvF,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,eAAe,QACV,kBAAc;AAErB,MAAMC,gBAAgB;AAEtB;;;CAGC,GACD,OAAO,MAAMC,4BAA8C,OAAOC,KAAKC;;QAI/CD,WACDA,YAGGA,YACGA,YAIFA;IAZzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,MAAMC,cAAcN,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,WAAW,oBAAI,IACjDH,IAAI,GACJI,KAAK,CAAC,GAAG;IACZ,wEAAwE;IACxE,MAAMC,mBAAmBf,EAAAA,aAAAA,IAAIQ,IAAI,qBAARR,WAAUe,gBAAgB,MAAK;IACxD,IAAI,CAACT,QAAQ,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAe;IACjE,IAAI,CAACP,cAAckB,IAAI,CAACP,QAAQ;QAC9B,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;IACA,IAAIO,SAASK,MAAM,GAAG,GAAG;QACvB,OAAOhB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,IAAI;YAqMQpB;YA1DFe;QA1IR,MAAMkB,YAAY5B,cAAc6B,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMiB,eAAe,MAAMH,QAAQI,GAAG;QACtC,IAAI,CAACD,aAAaE,MAAM,EAAE;YACxB,OAAOxB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,qEAAqE;QACrE,sEAAsE;QACtE,4DAA4D;QAC5D,kEAAkE;QAClE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,oCAAoC;QACpC,MAAMqB,aAAaN,QAAQC,UAAU,CAAC;QACtC,MAAMM,YAAYD,WAAWJ,GAAG;QAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BC,GACD,MAAMM,UAAU,MAAMV,UAAUW,cAAc,CAAC,OAAOC;YACpD,MAAMC,WAAW,MAAMD,GAAGN,GAAG,CAACE,WAAWM,KAAK,CAAC,SAAS,MAAMvB,OAAOwB,KAAK,CAAC;YAC3E,IAAI,CAACF,SAASG,KAAK,EAAE,OAAO;gBAAEC,WAAW;gBAAMC,SAAS;YAAE;YAC1D,MAAMC,OAAO,AAAC,CAAA,MAAMP,GAAGN,GAAG,CAACE,WAAWY,KAAK,GAAE,EAAGC,IAAI,GAAGD,KAAK;YAC5D,yEAAyE;YACzE,MAAME,UAAU1D,0BAA0BuD,MAAMjD;YAChD,IAAIoD,QAAQC,QAAQ,EAAE,OAAO;gBAAEN,WAAW;gBAAOC,SAASI,QAAQJ,OAAO;YAAC;YAC1EN,GAAGY,MAAM,CAACf,WAAW;gBACnBlB;eACII,cAAchC,uBAAuBgC,eAAe,CAAC;gBACzD8B,gBAAgBhD,mBAAmBiB;eAsB/BG,mBACA/B,8BAA8BsB,QAAQsC,KAAKC,GAAG,MAC9C,CAAC;gBACLC,WAAWxD,cAAc4B,SAAS,CAAC6B,UAAU,CAACC,eAAe;;YAE/D,OAAO;QACT;QACA,IAAIpB,2BAAAA,QAASO,SAAS,EAAE;YACtB,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;QACA,IAAIuB,SAAS;gBAgBK7C;YAfhB,kEAAkE;YAClE,gEAAgE;YAChE,MAAMQ,+BAA+B;gBACnC6B;gBACAd;gBACA2C,MAAM;gBACNb,SAASR,QAAQQ,OAAO;YAC1B;YACA,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,4DAA4D;YAC5D,MAAMc,WAAUnE,4BAAAA,WAAW,CAAC,eAAe,qBAA3BA,0BAA6BoE,OAAO,CAClD5B,aAAagB,IAAI;YAEnB,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAOlB;gBACP,sEAAsE;gBACtE,sDAAsD;gBACtDiE,MAAMlE;eACFgE,UAAU;gBAAEA;YAAQ,IAAI,CAAC;QAEjC;QACA,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE;;;;;;;;;;;KAWC,GACD,MAAMG,eAAeT,KAAKC,GAAG;QAC7B,MAAMS,gBAAgB,MAAM9D,qBAAqB;YAC/Cc;YACAiD,IAAI,GAAEvD,aAAAA,IAAIQ,IAAI,qBAARR,WAAUsD,aAAa;YAC7B7C;YACA+C,MAAMH;QACR;QACA,MAAMhE,YAAY;YAChB+B;YACAd;YACAmD,MAAM;gBACJhD;eAKII,cAAc;gBAAE6C,MAAM7C;YAAY,IAAI,CAAC;gBAC3C8C,QAAQ;eACJ5C,mBAAmB;gBAAEA,kBAAkB;YAAK,IAAI,CAAC;WAEnDuC,gBAAgB;YAAEM,OAAON;QAAc,IAAI,CAAC;QAElD;;;;;KAKC,GACD,KAAK5D,sBAAsB;YACzB;;;;;OAKC,GACDmE,OAAO;YACPvD;YACAwD,UAAU;gBAAErD;gBAAOiD,MAAM7C,eAAekD;YAAU;YAClDC,aAAa;gBACXL,QAAQ;gBACRM,OAAOtC,UAAUuC,EAAE;gBACnBC,SAAS;YACX;YACA,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,uDAAuD;YACvDC,gBAAgB;WACZrD,mBAAmB;YAAEA,kBAAkB;QAAK,IAAI,CAAC,GAGjDuC,gBAAgB;YAAEe,QAAQ;gBAAEf;YAAc;QAAE,IAAI,CAAC;QAEvD,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM7D,cAAca,QAAQ,gBAAgB;YAAEG;QAAM;QACpD,MAAMhB,cAAca,QAAQ,QAAQ;YAClCG;YACAkD,QAAQ;YACRW,MAAM,GAAErF,aAAAA,UAAUwB,kBAAVxB,aAAoB;QAC9B;QACAY,gBAAgBI,KAAKK,QAAQV,kBAAkBU,QAAQqB,UAAUuC,EAAE;QACnE,OAAOjE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEmE,IAAI;QAAK;IACzC,EAAE,OAAOlE,OAAO;QACdmE,QAAQnE,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-register.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { memberNameSearchFields } from './member-name-search'\nimport {\n  checkVisitorRecordCeiling,\n  HOST_TOKENS,\n  marketingConsentFieldsForHost,\n  SITE_MEMBER_CEILING_CODE,\n  SITE_MEMBER_UNAVAILABLE_MESSAGE,\n  SITE_MEMBERS_MAX_PER_HOST,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  recordVisitorRecordCeilingTrip,\n  resolveCampaignTouch,\n} from '@aglyn/tenant-data-admin'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport recordCapturedContact from '@aglyn/aglyn/plugin-manager/record-captured-contact'\nimport {\n  hashMemberPassword,\n  mintMemberSession,\n  setMemberCookie,\n} from './membership'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Site member sign-up (AGL-109): creates the member record (scrypt hash),\n * doubles as a lead, and signs the visitor in via the session cookie.\n */\nexport const membershipRegisterHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  const displayName = String(req.body?.displayName ?? '')\n    .trim()\n    .slice(0, 80)\n  // Explicit opt-in checkbox (AGL-2499) — never inferred from signing up.\n  const marketingConsent = req.body?.marketingConsent === true\n  if (!hostId) return res.status(400).json({ error: 'Missing host' })\n  if (!EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Enter a valid email' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Member accounts are UNLIMITED on every plan (AGL-889) — no seat or\n    // quota check belongs here. Audience monetization happens downstream:\n    // contact bands meter the CRM projection (AGL-890) and paid\n    // memberships carry the plan's digital transaction fee (AGL-892).\n    //\n    // `SITE_MEMBERS_MAX_PER_HOST` below is NOT that check and does not make\n    // it one (AGL-1529). It is a flat PLATFORM ceiling — same number on every\n    // plan, no `OrgEntitlements` key, nothing on the price list — and it\n    // exists because this handler is reachable by an ANONYMOUS VISITOR, so\n    // without it the collection was bounded only by a per-(host, IP) rate\n    // limiter that fails soft and bounds the RATE rather than the TOTAL. An\n    // abuse control is not something we sell; \"unlimited member accounts on\n    // every plan\" stays literally true.\n    const membersRef = hostRef.collection('siteMembers')\n    const memberRef = membersRef.doc()\n    /*\n     * COUNT, DEDUPE AND CREATE IN ONE TRANSACTION (AGL-1529, the AGL-2231\n     * treatment).\n     *\n     * Read-then-decide-then-`set()` is the create-time quota that laundered\n     * everywhere else in this repo: N concurrent sign-ups each read the same\n     * pre-count, each find room, and each land — and nothing re-counts\n     * afterwards, so the extra accounts are permanent. The fix is WHEN the\n     * count is evaluated, not the counting rule.\n     * `Transaction.get(AggregateQuery)` serialises the count against a\n     * concurrent create into this collection: the loser retries, re-reads the\n     * higher count and is refused. The duplicate-email read moves inside for\n     * free, which also closes the smaller race it always had — two\n     * simultaneous sign-ups on one address both saw `empty` and both wrote.\n     *\n     * ALL READS BEFORE THE WRITE, which Firestore requires.\n     *\n     * The scrypt hash sits between the last read and the create ON PURPOSE.\n     * It is ~100 ms of CPU and it is the most expensive thing in the request,\n     * so a refused sign-up must never pay it — hashing before the transaction\n     * would hand a flood a CPU amplifier on exactly the path the ceiling\n     * exists to contain, and would also be a regression, since today a\n     * duplicate-email refusal does not hash either. It is a pure computation,\n     * not an effect, so it does not violate the \"nothing happens in a\n     * transaction body\" rule the sibling routes state.\n     *\n     * A refusal is returned as DATA and rendered outside: a body that can run\n     * several times must not be the place a response is built.\n     */\n    const refusal = await firestore.runTransaction(async (tx) => {\n      const existing = await tx.get(membersRef.where('email', '==', email).limit(1))\n      if (!existing.empty) return { duplicate: true, ceiling: 0 }\n      const used = (await tx.get(membersRef.count())).data().count\n      // Live documents only, so removing a member in the inbox frees the slot.\n      const verdict = checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n      if (verdict.exceeded) return { duplicate: false, ceiling: verdict.ceiling }\n      tx.create(memberRef, {\n        email,\n        ...(displayName ? memberNameSearchFields(displayName) : {}),\n        passwordScrypt: hashMemberPassword(password),\n        /*\n         * The checkbox is PERSISTED on the member, not only forwarded.\n         *\n         * It reached the lead and the contact from the two lines below and\n         * was dropped for this document, so `hosts/{hostId}/siteMembers` had\n         * no consent field of any kind and `audience: 'members'` had nothing\n         * for the send-time join to read — the audience could not be filtered\n         * even in principle (`docs/specs/email-overhaul.md` §1d/§3f). The\n         * other two documents are not a substitute: a member is deduped in\n         * this transaction while leads append every time, and contacts are\n         * ORG-scoped where a member is the site's own.\n         *\n         * Written only when ticked. Signing up is not opting in — that is why\n         * the checkbox exists and why it defaults unchecked — so the omitted\n         * case stores nothing and reads back as an unrecorded basis rather\n         * than as a refusal.\n         *\n         * Under this site's key even though `siteMembers` already lives\n         * beneath it, so that one reader answers for every silo — see\n         * `addHostLead`, which makes the same write for the same reason.\n         */\n        ...(marketingConsent\n          ? marketingConsentFieldsForHost(hostId, Date.now())\n          : {}),\n        createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      })\n      return null\n    })\n    if (refusal?.duplicate) {\n      return res.status(409).json({ error: 'That email is already a member' })\n    }\n    if (refusal) {\n      // Visible to the HOST — the rule that a control nobody can see in\n      // the console did not ship. Durable counter + one notification.\n      await recordVisitorRecordCeilingTrip({\n        hostRef,\n        hostId,\n        kind: 'siteMembers',\n        ceiling: refusal.ceiling,\n      })\n      // Opaque to the VISITOR, who is a stranger to this site and not our\n      // customer (AGL-1666's rules, restated in the message's own docblock).\n      // The one genuinely useful thing to hand them is a door that still\n      // opens, so the site's OWN published support address rides along when\n      // it has one — read through the host-token registry, whose description\n      // of this field is literally \"where visitors should write for help\".\n      // Nothing else off the host document may leave the console.\n      const contact = HOST_TOKENS['supportEmail']?.resolve(\n        hostSnapshot.data() as any,\n      )\n      return res.status(429).json({\n        error: SITE_MEMBER_UNAVAILABLE_MESSAGE,\n        // Machine-readable, because the dispatcher's rate limiter answers 429\n        // too and the status therefore discriminates nothing.\n        code: SITE_MEMBER_CEILING_CODE,\n        ...(contact ? { contact } : {}),\n      })\n    }\n    // Sign-ups double as leads for the site owner (AGL-109), through the one\n    // writer that enforces `LEADS_MAX_PER_HOST` (AGL-1529). A refused lead\n    // never fails the sign-up: the visitor asked for an account, not for a\n    // lead record, and the trip is recorded for the owner either way.\n    /*\n     * THE CAMPAIGN TOUCH, RESOLVED ONCE FOR THE WHOLE SIGN-UP.\n     *\n     * A sign-up is the identify moment for a visitor who has been anonymous\n     * until now, and it writes two records that a campaign can be credited\n     * with — the lead and the contact. One resolve, one keyed read, and the\n     * two cannot end up naming different campaigns.\n     *\n     * The MEMBER record itself is not attributed. A member is an account the\n     * visitor holds and the lead is the site's record of the same act, so\n     * crediting both would count one sign-up twice under two names.\n     */\n    const signedUpAtMs = Date.now()\n    const campaignTouch = await resolveCampaignTouch({\n      hostId,\n      wire: req.body?.campaignTouch,\n      email,\n      atMs: signedUpAtMs,\n    })\n    /*\n     * Contacts ingestion (AGL-197), reported to whichever plugin keeps people\n     * rather than written by this one (AGL-3080). Commerce knows it just met\n     * somebody; what a person record is belongs to the plugin that models it,\n     * and a workspace that keeps none is a quiet, correct answer here.\n     */\n    /*\n     * A member account is a RELATIONSHIP (AGL-3232): the person is a\n     * contact from this moment, and an open lead the site held for the\n     * address is closed as converted onto that contact by the record\n     * system — a sign-up files no lead of its own any more, the way a\n     * portal user is a contact and not a lead in Salesforce.\n     */\n    void recordCapturedContact({\n      /*\n       * Not resolved here. The record system keys a person on the SITE they\n       * were met on, so this costs the capture nothing — and resolving it\n       * would put a Firestore read in front of the writer, which is the one\n       * thing `recordCapturedContact` asks a door not to do.\n       */\n      orgId: '',\n      hostId,\n      identity: { email, name: displayName || undefined },\n      interaction: {\n        source: 'member',\n        refId: memberRef.id,\n        summary: 'Joined as a member',\n      },\n      surface: 'relationship',\n      // An account is a subscription to the site, not an enquiry (AGL-2612):\n      // the stage on the contact says only that the person asked to be\n      // kept. A floor, so a customer who opens an account stays a customer.\n      lifecycleFloor: 'subscriber',\n      ...(marketingConsent ? { marketingConsent: true } : {}),\n      // Where the visitor ARRIVED from — a fact about this visit and not\n      // about the person, which is what `detail` carries.\n      ...(campaignTouch ? { detail: { campaignTouch } } : {}),\n    })\n    // Event trigger (AGL-128/148). A sign-up is no longer a lead (AGL-3232),\n    // so the `lead` event is the lead surfaces' to emit.\n    await emitHostEvent(hostId, 'memberSignUp', { email })\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberRef.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-up failed' })\n  }\n}\n"],"names":["memberNameSearchFields","checkVisitorRecordCeiling","HOST_TOKENS","marketingConsentFieldsForHost","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","SITE_MEMBERS_MAX_PER_HOST","firebaseAdmin","recordVisitorRecordCeilingTrip","resolveCampaignTouch","emitHostEvent","recordCapturedContact","hashMemberPassword","mintMemberSession","setMemberCookie","EMAIL_PATTERN","membershipRegisterHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","displayName","slice","marketingConsent","test","length","firestore","app","hostRef","collection","doc","hostSnapshot","get","exists","membersRef","memberRef","refusal","runTransaction","tx","existing","where","limit","empty","duplicate","ceiling","used","count","data","verdict","exceeded","create","passwordScrypt","Date","now","createdAt","FieldValue","serverTimestamp","kind","contact","resolve","code","signedUpAtMs","campaignTouch","wire","atMs","orgId","identity","name","undefined","interaction","source","refId","id","summary","surface","lifecycleFloor","detail","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,sBAAsB,QAAQ,0BAAsB;AAC7D,SACEC,yBAAyB,EACzBC,WAAW,EACXC,6BAA6B,EAC7BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,yBAAyB,QACpB,sBAAqB;AAC5B,SACEC,aAAa,EACbC,8BAA8B,EAC9BC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,aAAa,QAAQ,wBAAuB;AACrD,OAAOC,2BAA2B,sDAAqD;AACvF,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,eAAe,QACV,kBAAc;AAErB,MAAMC,gBAAgB;AAEtB;;;CAGC,GACD,OAAO,MAAMC,4BAA8C,OAAOC,KAAKC;;QAI/CD,WACDA,YAGGA,YACGA,YAIFA;IAZzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,MAAMC,cAAcN,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,WAAW,oBAAI,IACjDH,IAAI,GACJI,KAAK,CAAC,GAAG;IACZ,wEAAwE;IACxE,MAAMC,mBAAmBf,EAAAA,aAAAA,IAAIQ,IAAI,qBAARR,WAAUe,gBAAgB,MAAK;IACxD,IAAI,CAACT,QAAQ,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAe;IACjE,IAAI,CAACP,cAAckB,IAAI,CAACP,QAAQ;QAC9B,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;IACA,IAAIO,SAASK,MAAM,GAAG,GAAG;QACvB,OAAOhB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,IAAI;YA2IML;QA1IR,MAAMkB,YAAY5B,cAAc6B,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMiB,eAAe,MAAMH,QAAQI,GAAG;QACtC,IAAI,CAACD,aAAaE,MAAM,EAAE;YACxB,OAAOxB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,qEAAqE;QACrE,sEAAsE;QACtE,4DAA4D;QAC5D,kEAAkE;QAClE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,oCAAoC;QACpC,MAAMqB,aAAaN,QAAQC,UAAU,CAAC;QACtC,MAAMM,YAAYD,WAAWJ,GAAG;QAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BC,GACD,MAAMM,UAAU,MAAMV,UAAUW,cAAc,CAAC,OAAOC;YACpD,MAAMC,WAAW,MAAMD,GAAGN,GAAG,CAACE,WAAWM,KAAK,CAAC,SAAS,MAAMvB,OAAOwB,KAAK,CAAC;YAC3E,IAAI,CAACF,SAASG,KAAK,EAAE,OAAO;gBAAEC,WAAW;gBAAMC,SAAS;YAAE;YAC1D,MAAMC,OAAO,AAAC,CAAA,MAAMP,GAAGN,GAAG,CAACE,WAAWY,KAAK,GAAE,EAAGC,IAAI,GAAGD,KAAK;YAC5D,yEAAyE;YACzE,MAAME,UAAUxD,0BAA0BqD,MAAMhD;YAChD,IAAImD,QAAQC,QAAQ,EAAE,OAAO;gBAAEN,WAAW;gBAAOC,SAASI,QAAQJ,OAAO;YAAC;YAC1EN,GAAGY,MAAM,CAACf,WAAW;gBACnBlB;eACII,cAAc9B,uBAAuB8B,eAAe,CAAC;gBACzD8B,gBAAgBhD,mBAAmBiB;eAsB/BG,mBACA7B,8BAA8BoB,QAAQsC,KAAKC,GAAG,MAC9C,CAAC;gBACLC,WAAWxD,cAAc4B,SAAS,CAAC6B,UAAU,CAACC,eAAe;;YAE/D,OAAO;QACT;QACA,IAAIpB,2BAAAA,QAASO,SAAS,EAAE;YACtB,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;QACA,IAAIuB,SAAS;gBAgBK3C;YAfhB,kEAAkE;YAClE,gEAAgE;YAChE,MAAMM,+BAA+B;gBACnC6B;gBACAd;gBACA2C,MAAM;gBACNb,SAASR,QAAQQ,OAAO;YAC1B;YACA,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,4DAA4D;YAC5D,MAAMc,WAAUjE,4BAAAA,WAAW,CAAC,eAAe,qBAA3BA,0BAA6BkE,OAAO,CAClD5B,aAAagB,IAAI;YAEnB,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAOjB;gBACP,sEAAsE;gBACtE,sDAAsD;gBACtDgE,MAAMjE;eACF+D,UAAU;gBAAEA;YAAQ,IAAI,CAAC;QAEjC;QACA,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE;;;;;;;;;;;KAWC,GACD,MAAMG,eAAeT,KAAKC,GAAG;QAC7B,MAAMS,gBAAgB,MAAM9D,qBAAqB;YAC/Cc;YACAiD,IAAI,GAAEvD,aAAAA,IAAIQ,IAAI,qBAARR,WAAUsD,aAAa;YAC7B7C;YACA+C,MAAMH;QACR;QACA;;;;;KAKC,GACD;;;;;;KAMC,GACD,KAAK3D,sBAAsB;YACzB;;;;;OAKC,GACD+D,OAAO;YACPnD;YACAoD,UAAU;gBAAEjD;gBAAOkD,MAAM9C,eAAe+C;YAAU;YAClDC,aAAa;gBACXC,QAAQ;gBACRC,OAAOpC,UAAUqC,EAAE;gBACnBC,SAAS;YACX;YACAC,SAAS;YACT,uEAAuE;YACvE,iEAAiE;YACjE,sEAAsE;YACtEC,gBAAgB;WACZpD,mBAAmB;YAAEA,kBAAkB;QAAK,IAAI,CAAC,GAGjDuC,gBAAgB;YAAEc,QAAQ;gBAAEd;YAAc;QAAE,IAAI,CAAC;QAEvD,yEAAyE;QACzE,qDAAqD;QACrD,MAAM7D,cAAca,QAAQ,gBAAgB;YAAEG;QAAM;QACpDZ,gBAAgBI,KAAKK,QAAQV,kBAAkBU,QAAQqB,UAAUqC,EAAE;QACnE,OAAO/D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEiE,IAAI;QAAK;IACzC,EAAE,OAAOhE,OAAO;QACdiE,QAAQjE,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}

package/src/lib/server/newsletter.js

@@ -275,6 +275,10 @@ import { NO_CLIENT_ADDRESS_BUCKET, readClientIp } from "@aglyn/aglyn/app-utils/r
                 refId: `newsletter-${now}`,
                 summary: 'Subscribed to the newsletter'
             },
+            // A TOUCH (AGL-3232): the opt-in lands on the lead the site is
+            // working for this address when it holds one, and on the contact
+            // otherwise — the consent stays with the one record the person is.
+            surface: 'touch',
             // The stage the name is for (AGL-2612): somebody who asked to hear
             // from the site and nothing more yet. A floor, so a customer who
             // subscribes stays a customer.

package/src/lib/server/newsletter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/newsletter.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { hostPublicOrigin } from '@aglyn/aglyn/app-utils/host-naming'\nimport {\n  mergeEmailTopics,\n  normalizeEmailTopic,\n  topicRequiresDoubleOptIn,\n  EMAIL_TOPICS_COLLECTION,\n  type EmailTopic,\n} from '@aglyn/aglyn/app-utils/email-topics'\nimport {\n  enrollListMember,\n  firebaseAdmin,\n  hostSendingIdentity,\n  meterHostEmail,\n  consentGroupForSite,\n  orgDataCollectionForHost,\n  recordPendingTopicConfirmation,\n  resolveCampaignTouch,\n  resolveOrgIdForHost,\n  siteRequiresDoubleOptIn,\n} from '@aglyn/tenant-data-admin'\nimport recordCapturedContact from '@aglyn/aglyn/plugin-manager/record-captured-contact'\nimport { buildConfirmUrl } from '@aglyn/tenant-data-admin/server/email-unsubscribe-link'\nimport { sendEmail } from '@aglyn/shared-util-email'\nimport { isDocumentId } from '@aglyn/tenant-data-admin/server/document-id'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * The stream a newsletter signup joins.\n *\n * The built-in id, not the campaign default: somebody typing their address\n * into a footer box is asking for the newsletter, and attributing it to\n * \"Promotions and offers\" would confirm them for a stream they did not name.\n */\nconst NEWSLETTER_TOPIC_ID = 'newsletter'\n\n/**\n * Enrolls one address into an org list's members (AGL-2499).\n *\n * The document id comes from `enrollListMember`, which is the only writer of\n * that collection — the workflow `enrollList` step reaches it too, and when\n * the two derived their own ids the same person subscribing by both routes\n * became two members of one list.\n *\n * Best-effort and silent on any problem: list enrollment rides along with\n * the newsletter signup, which must still succeed (and still upsert the\n * contact) even when the list id is stale, was mistyped into the besigner\n * prop, or belongs to an org this host cannot resolve.\n */\nasync function enrollInList(options: {\n  hostId: string\n  listId: string\n  email: string\n  name?: string\n  /** The opt-in the signup itself carries — see the call site. */\n  marketingConsent?: boolean\n}): Promise<void> {\n  if (!isDocumentId(options.listId)) return\n  try {\n    const contactsRef = await orgDataCollectionForHost(options.hostId, 'contacts')\n    const listRef = contactsRef.parent?.collection('lists').doc(options.listId)\n    if (!listRef) return\n    const listSnapshot = await listRef.get()\n    // A stale/mistyped id must not silently CREATE a list — campaign-send's\n    // `list` audience would then read a list nobody set up.\n    if (!listSnapshot.exists) return\n    await enrollListMember({\n      listRef,\n      group: await consentGroupForSite(options.hostId),\n      email: options.email,\n      ...(options.name ? { name: options.name } : {}),\n      source: 'newsletter',\n      ...(options.marketingConsent ? { marketingConsent: true } : {}),\n    })\n  } catch (error) {\n    console.error('list enrollment failed', error)\n  }\n}\n\n/**\n * DOUBLE OPT-IN, when this site asks for one\n * (`docs/specs/email-competitive-gaps.md` P8).\n *\n * A footer signup is where a confirmation belongs — ActiveCampaign's shape,\n * where forms are the thing that default to it — and it is the only capture\n * path in the product where the person is present, expecting a reply, and has\n * just typed the address themselves.\n *\n * ## The confirmation message is TRANSACTIONAL\n *\n * It carries no marketing context, so it passes no frequency cap and adds no\n * unsubscribe header: somebody who just asked to subscribe is owed the answer\n * to what they asked, and gating it behind a marketing ceiling would drop\n * exactly the message that lets them out of the quarantine. The suppression\n * lists are not consulted here either — `recordPendingTopicConfirmation`\n * refuses an address that left this stream before any message is composed,\n * which is the check that matters: a signup form must not become a way to\n * mail somebody who unsubscribed by asking them again.\n *\n * A hard-bounced address is deliberately NOT refused here, and the asymmetry\n * with the opt-out above is the point. An opt-out is a stated intention; a\n * bounce is a measurement of a mailbox at a moment, and refusing to send at\n * submission time would settle it on evidence that cannot be older than the\n * question being asked. The confirmation goes out, and if it is delivered and\n * clicked, `confirmTopicSubscription` lifts the platform bounce — the round\n * trip is what proves the record stale. A complaint or an unsubscribe is\n * never lifted by that path.\n *\n * ## Best-effort, like the enrollment beside it\n *\n * A failure to send leaves the address pending and unmailable, which is the\n * safe direction: they signed up, nothing reaches them, and signing up again\n * re-sends. The signup itself still succeeds — the contact is captured with\n * its consent record either way, and losing the capture because a confirmation\n * bounced would be a worse trade for everybody.\n *\n * @returns whether the address was put in the quarantine, so the caller can\n *          decide whether to enroll them on a list yet.\n */\nasync function requestConfirmation(options: {\n  hostId: string\n  email: string\n  topics: EmailTopic[]\n  /** The host document the setting was read from — see {@link loadHostGate}. */\n  host: { cname?: unknown; subdomain?: unknown }\n}): Promise<boolean> {\n  const topic = options.topics.find(\n    (candidate) => candidate.id === NEWSLETTER_TOPIC_ID,\n  )\n  const { result } = await recordPendingTopicConfirmation(\n    options.hostId,\n    options.email,\n    NEWSLETTER_TOPIC_ID,\n  )\n  if (result !== 'pending') return false\n  try {\n    const siteBase =\n      hostPublicOrigin({\n        cname: String(options.host.cname ?? ''),\n        subdomain: String(options.host.subdomain ?? ''),\n      }) ?? ''\n    const url = buildConfirmUrl({\n      siteBase,\n      hostId: options.hostId,\n      email: options.email,\n      topicId: NEWSLETTER_TOPIC_ID,\n    })\n    // No origin or no signing secret means no link, and a confirmation\n    // message with nothing to click is worse than none: the person believes\n    // they have subscribed and nothing ever arrives. Said out loud rather\n    // than shipped quietly, exactly as the unsubscribe seam does.\n    if (!url) {\n      console.warn(\n        '[newsletter] confirmation not sent — no public origin or no ' +\n          'EMAIL_UNSUBSCRIBE_SECRET',\n      )\n      return true\n    }\n    const stream = topic?.name ?? 'our newsletter'\n    const result = await sendEmail({\n      to: options.email,\n      subject: `Confirm your subscription`,\n      text:\n        `Please confirm that you want to receive ${stream} at this ` +\n        `address:\\n\\n${url}\\n\\nThe link works for three days. If you did ` +\n        'not sign up, ignore this message — nothing will be sent.',\n      sendingIdentity: await hostSendingIdentity(options.hostId),\n      audience: 'tenant',\n      context: 'newsletter confirmation',\n    })\n    /*\n     * Counted against the site, as TRANSACTIONAL.\n     *\n     * It is a message this site sent, so it costs what a message costs and\n     * the meter has to see it. `'transactional'` is the honest class: the\n     * person just typed their address into a form and is waiting for the\n     * answer, which is why the message carries no marketing context and no\n     * unsubscribe header either. Only a delivery is counted, so a send that\n     * never left is not billed as one.\n     */\n    if (result.sent) await meterHostEmail(options.hostId)\n  } catch (error) {\n    console.error('confirmation send failed', error)\n  }\n  return true\n}\n\n/**\n * The site's topic catalog, for the one question the signup asks of it.\n *\n * Fails soft to the built-ins, like the preference page's read: a site whose\n * org cannot be resolved still gets the four defaults, so the decision is\n * made against a catalog rather than against nothing.\n */\nasync function loadTopics(hostId: string): Promise<EmailTopic[]> {\n  try {\n    const orgId = await resolveOrgIdForHost(hostId)\n    if (!orgId) return mergeEmailTopics(null)\n    const snapshot = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('orgs')\n      .doc(orgId)\n      .collection(EMAIL_TOPICS_COLLECTION)\n      .get()\n    return mergeEmailTopics(\n      (snapshot?.docs ?? [])\n        .map((doc: any) => normalizeEmailTopic(doc.id, doc.data()))\n        .filter((topic: EmailTopic | null): topic is EmailTopic => !!topic),\n    )\n  } catch (error) {\n    console.error('[newsletter] topic catalog read failed', error)\n    return mergeEmailTopics(null)\n  }\n}\n\n/**\n * Everything the confirmation decision needs, in one round trip.\n *\n * Three reads — the host document, the org lookup and the topic catalog — and\n * the first is issued IN PARALLEL with the other two rather than after them,\n * because none of the three depends on another's answer. A signup is a person\n * waiting for a form to come back, and serialized reads on that path are\n * latency the person feels for a decision that is usually \"no\".\n *\n * The host document is returned rather than discarded: the confirmation link\n * needs the site's public origin, which is on that same document, and reading\n * it twice would be a read per signup to recover something already in hand.\n *\n * Fails soft on the site flag, which `siteRequiresDoubleOptIn` already does —\n * a default a failed read could switch ON would quarantine every new signup\n * on a site whose owner never asked for confirmations.\n */\nasync function loadHostGate(hostId: string): Promise<{\n  topics: EmailTopic[]\n  siteDefault: boolean\n  host: { cname?: unknown; subdomain?: unknown }\n}> {\n  const [topics, siteDefault, snapshot] = await Promise.all([\n    loadTopics(hostId),\n    siteRequiresDoubleOptIn(hostId),\n    firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .get()\n      .catch(() => null),\n  ])\n  return {\n    topics,\n    siteDefault,\n    host: {\n      cname: snapshot?.get('cname'),\n      subdomain: snapshot?.get('subdomain'),\n    },\n  }\n}\n\n// Best-effort per-instance flood damper.\nconst attemptsByIp = new Map<string, number[]>()\nimport {\n  NO_CLIENT_ADDRESS_BUCKET,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\n\n/**\n * Newsletter opt-in (AGL-301): footer signups and checkout opt-ins land\n * in the contacts CRM with an explicit consent timestamp, feeding the\n * email-campaign audiences.\n */\nexport const newsletterHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const email = String(body.email ?? '')\n    .trim()\n    .toLowerCase()\n  const listId = String(body.listId ?? '').trim()\n  if (!hostId || !EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Enter a valid email' })\n  }\n  // Keeps counting under the no-address bucket rather than being skipped: an\n  // unauthenticated signup endpoint that stops counting is an open write into\n  // the contacts CRM.\n  const ip =\n    readClientIp(req.headers, { remoteAddress: req.socket?.remoteAddress }) ??\n    NO_CLIENT_ADDRESS_BUCKET\n  const now = Date.now()\n  const attempts = (attemptsByIp.get(ip) ?? []).filter(\n    (at) => now - at < 60_000,\n  )\n  attempts.push(now)\n  attemptsByIp.set(ip, attempts)\n  if (attempts.length > 10) {\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    // A newsletter signup is an identify moment: the visitor was anonymous\n    // while they browsed and this request is the first thing that names them.\n    // Both channels are asked once, here, and the later touch is credited.\n    const campaignTouch = await resolveCampaignTouch({\n      hostId,\n      wire: body.campaignTouch,\n      email,\n      atMs: now,\n    })\n    /*\n     * Reported to whichever plugin keeps people, not written by this one\n     * (AGL-3080). A newsletter signup is commerce meeting somebody; what a\n     * person record is, and whether this workspace keeps any, belongs to the\n     * plugin that models them.\n     *\n     * Still awaited, because the confirmation below is deliberately after it.\n     */\n    await recordCapturedContact({\n      /*\n       * Not resolved here. The record system keys a person on the SITE they\n       * were met on, so this costs the capture nothing — and resolving it\n       * would put a Firestore read in front of the writer, which is the one\n       * thing `recordCapturedContact` asks a door not to do.\n       */\n      orgId: '',\n      hostId,\n      identity: { email },\n      interaction: {\n        source: 'newsletter',\n        refId: `newsletter-${now}`,\n        summary: 'Subscribed to the newsletter',\n      },\n      // The stage the name is for (AGL-2612): somebody who asked to hear\n      // from the site and nothing more yet. A floor, so a customer who\n      // subscribes stays a customer.\n      lifecycleFloor: 'subscriber',\n      marketingConsent: true,\n      // Where the visitor ARRIVED from — a fact about this visit and not\n      // about the person, which is what `detail` carries.\n      ...(campaignTouch ? { detail: { campaignTouch } } : {}),\n    })\n    /*\n     * The confirmation, when this site asks for one.\n     *\n     * AFTER the contact upsert and never instead of it. The person typed\n     * their address and ticked a box, and that consent record is a fact\n     * whether or not they go on to click a link — withholding the capture\n     * until they do would lose the record of what they actually did. What the\n     * confirmation gates is the SEND, on the person's own topic entry, which\n     * is where `filterTopicSendable` reads it.\n     */\n    const { topics, siteDefault, host } = await loadHostGate(hostId)\n    const confirming =\n      topicRequiresDoubleOptIn(\n        topics.find((topic) => topic.id === NEWSLETTER_TOPIC_ID),\n        siteDefault,\n      ) && (await requestConfirmation({ hostId, email, topics, host }))\n    if (listId) {\n      /*\n       * The same basis the contact upsert records, on the membership too.\n       *\n       * A list membership had no consent field at all, so `audience: 'list'`\n       * gave the send-time join nothing to read even for the one audience\n       * whose members literally asked for a newsletter\n       * (`docs/specs/email-overhaul.md` §1d). This is a DECLARED opt-in and\n       * not an inference from an act: the request this handler serves is\n       * \"subscribe me\", which is the checkbox.\n       */\n      await enrollInList({ hostId, listId, email, marketingConsent: true })\n    }\n    /*\n     * The caller is told which of the two things happened, so the signup form\n     * can say \"check your email\" rather than \"you're subscribed\".\n     *\n     * A form that reported success identically either way would be the site\n     * telling somebody they are on the list while the send path refuses them,\n     * and the only way they could find out is by noticing that nothing\n     * arrives.\n     */\n    return res.status(200).json({ ok: true, confirmationRequired: confirming })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Signup failed' })\n  }\n}\n"],"names":["hostPublicOrigin","mergeEmailTopics","normalizeEmailTopic","topicRequiresDoubleOptIn","EMAIL_TOPICS_COLLECTION","enrollListMember","firebaseAdmin","hostSendingIdentity","meterHostEmail","consentGroupForSite","orgDataCollectionForHost","recordPendingTopicConfirmation","resolveCampaignTouch","resolveOrgIdForHost","siteRequiresDoubleOptIn","recordCapturedContact","buildConfirmUrl","sendEmail","isDocumentId","EMAIL_PATTERN","NEWSLETTER_TOPIC_ID","enrollInList","options","listId","contactsRef","hostId","listRef","parent","collection","doc","listSnapshot","get","exists","group","email","name","source","marketingConsent","error","console","requestConfirmation","topic","topics","find","candidate","id","result","siteBase","cname","String","host","subdomain","url","topicId","warn","stream","to","subject","text","sendingIdentity","audience","context","sent","loadTopics","orgId","snapshot","app","firestore","docs","map","data","filter","loadHostGate","siteDefault","Promise","all","catch","attemptsByIp","Map","NO_CLIENT_ADDRESS_BUCKET","readClientIp","newsletterHandler","req","res","body","method","status","json","JSON","parse","trim","toLowerCase","test","ip","headers","remoteAddress","socket","now","Date","attempts","at","push","set","length","campaignTouch","wire","atMs","identity","interaction","refId","summary","lifecycleFloor","detail","confirming","ok","confirmationRequired"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,gBAAgB,QAAQ,qCAAoC;AACrE,SACEC,gBAAgB,EAChBC,mBAAmB,EACnBC,wBAAwB,EACxBC,uBAAuB,QAElB,sCAAqC;AAC5C,SACEC,gBAAgB,EAChBC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,mBAAmB,EACnBC,wBAAwB,EACxBC,8BAA8B,EAC9BC,oBAAoB,EACpBC,mBAAmB,EACnBC,uBAAuB,QAClB,2BAA0B;AACjC,OAAOC,2BAA2B,sDAAqD;AACvF,SAASC,eAAe,QAAQ,yDAAwD;AACxF,SAASC,SAAS,QAAQ,2BAA0B;AACpD,SAASC,YAAY,QAAQ,8CAA6C;AAE1E,MAAMC,gBAAgB;AAEtB;;;;;;CAMC,GACD,MAAMC,sBAAsB;AAE5B;;;;;;;;;;;;CAYC,GACD,eAAeC,aAAaC,OAO3B;IACC,IAAI,CAACJ,aAAaI,QAAQC,MAAM,GAAG;IACnC,IAAI;YAEcC;QADhB,MAAMA,cAAc,MAAMd,yBAAyBY,QAAQG,MAAM,EAAE;QACnE,MAAMC,WAAUF,sBAAAA,YAAYG,MAAM,qBAAlBH,oBAAoBI,UAAU,CAAC,SAASC,GAAG,CAACP,QAAQC,MAAM;QAC1E,IAAI,CAACG,SAAS;QACd,MAAMI,eAAe,MAAMJ,QAAQK,GAAG;QACtC,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,CAACD,aAAaE,MAAM,EAAE;QAC1B,MAAM3B,iBAAiB;YACrBqB;YACAO,OAAO,MAAMxB,oBAAoBa,QAAQG,MAAM;YAC/CS,OAAOZ,QAAQY,KAAK;WAChBZ,QAAQa,IAAI,GAAG;YAAEA,MAAMb,QAAQa,IAAI;QAAC,IAAI,CAAC;YAC7CC,QAAQ;WACJd,QAAQe,gBAAgB,GAAG;YAAEA,kBAAkB;QAAK,IAAI,CAAC;IAEjE,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,0BAA0BA;IAC1C;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GACD,eAAeE,oBAAoBlB,OAMlC;IACC,MAAMmB,QAAQnB,QAAQoB,MAAM,CAACC,IAAI,CAC/B,CAACC,YAAcA,UAAUC,EAAE,KAAKzB;IAElC,MAAM,EAAE0B,MAAM,EAAE,GAAG,MAAMnC,+BACvBW,QAAQG,MAAM,EACdH,QAAQY,KAAK,EACbd;IAEF,IAAI0B,WAAW,WAAW,OAAO;IACjC,IAAI;YAEA9C,mBACgBsB,qBACIA;QAHtB,MAAMyB,YACJ/C,oBAAAA,iBAAiB;YACfgD,OAAOC,QAAO3B,sBAAAA,QAAQ4B,IAAI,CAACF,KAAK,YAAlB1B,sBAAsB;YACpC6B,WAAWF,QAAO3B,0BAAAA,QAAQ4B,IAAI,CAACC,SAAS,YAAtB7B,0BAA0B;QAC9C,cAHAtB,oBAGM;QACR,MAAMoD,MAAMpC,gBAAgB;YAC1B+B;YACAtB,QAAQH,QAAQG,MAAM;YACtBS,OAAOZ,QAAQY,KAAK;YACpBmB,SAASjC;QACX;QACA,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,CAACgC,KAAK;YACRb,QAAQe,IAAI,CACV,iEACE;YAEJ,OAAO;QACT;QACA,MAAMC,iBAASd,yBAAAA,MAAON,IAAI,mBAAI;QAC9B,MAAMW,SAAS,MAAM7B,UAAU;YAC7BuC,IAAIlC,QAAQY,KAAK;YACjBuB,SAAS,CAAC,yBAAyB,CAAC;YACpCC,MACE,CAAC,wCAAwC,EAAEH,OAAO,SAAS,CAAC,GAC5D,CAAC,YAAY,EAAEH,IAAI,8CAA8C,CAAC,GAClE;YACFO,iBAAiB,MAAMpD,oBAAoBe,QAAQG,MAAM;YACzDmC,UAAU;YACVC,SAAS;QACX;QACA;;;;;;;;;KASC,GACD,IAAIf,OAAOgB,IAAI,EAAE,MAAMtD,eAAec,QAAQG,MAAM;IACtD,EAAE,OAAOa,OAAO;QACdC,QAAQD,KAAK,CAAC,4BAA4BA;IAC5C;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,eAAeyB,WAAWtC,MAAc;IACtC,IAAI;;QACF,MAAMuC,QAAQ,MAAMnD,oBAAoBY;QACxC,IAAI,CAACuC,OAAO,OAAO/D,iBAAiB;QACpC,MAAMgE,WAAW,MAAM3D,cACpB4D,GAAG,GACHC,SAAS,GACTvC,UAAU,CAAC,QACXC,GAAG,CAACmC,OACJpC,UAAU,CAACxB,yBACX2B,GAAG;QACN,OAAO9B,iBACL,SAACgE,4BAAAA,SAAUG,IAAI,mBAAI,EAAE,EAClBC,GAAG,CAAC,CAACxC,MAAa3B,oBAAoB2B,IAAIgB,EAAE,EAAEhB,IAAIyC,IAAI,KACtDC,MAAM,CAAC,CAAC9B,QAAkD,CAAC,CAACA;IAEnE,EAAE,OAAOH,OAAO;QACdC,QAAQD,KAAK,CAAC,0CAA0CA;QACxD,OAAOrC,iBAAiB;IAC1B;AACF;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,eAAeuE,aAAa/C,MAAc;IAKxC,MAAM,CAACiB,QAAQ+B,aAAaR,SAAS,GAAG,MAAMS,QAAQC,GAAG,CAAC;QACxDZ,WAAWtC;QACXX,wBAAwBW;QACxBnB,cACG4D,GAAG,GACHC,SAAS,GACTvC,UAAU,CAAC,SACXC,GAAG,CAACJ,QACJM,GAAG,GACH6C,KAAK,CAAC,IAAM;KAChB;IACD,OAAO;QACLlC;QACA+B;QACAvB,MAAM;YACJF,KAAK,EAAEiB,4BAAAA,SAAUlC,GAAG,CAAC;YACrBoB,SAAS,EAAEc,4BAAAA,SAAUlC,GAAG,CAAC;QAC3B;IACF;AACF;AAEA,yCAAyC;AACzC,MAAM8C,eAAe,IAAIC;AACzB,SACEC,wBAAwB,EACxBC,YAAY,QACP,oCAAmC;AAE1C;;;;CAIC,GACD,OAAO,MAAMC,oBAAsC,OAAOC,KAAKC;QAKJD,WACnCE,cACDA,aAGCA,cAQpBJ,eAGgBH;QAH2BK;IAjB7C,IAAIA,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAqB;IAC5D;IACA,MAAM8C,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWI,KAAKC,KAAK,CAACP,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMzD,SAASwB,QAAOmC,eAAAA,KAAK3D,MAAM,YAAX2D,eAAe;IACrC,MAAMlD,QAAQe,QAAOmC,cAAAA,KAAKlD,KAAK,YAAVkD,cAAc,IAChCM,IAAI,GACJC,WAAW;IACd,MAAMpE,SAAS0B,QAAOmC,eAAAA,KAAK7D,MAAM,YAAX6D,eAAe,IAAIM,IAAI;IAC7C,IAAI,CAACjE,UAAU,CAACN,cAAcyE,IAAI,CAAC1D,QAAQ;QACzC,OAAOiD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAsB;IAC7D;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,oBAAoB;IACpB,MAAMuD,MACJb,gBAAAA,aAAaE,IAAIY,OAAO,EAAE;QAAEC,aAAa,GAAEb,cAAAA,IAAIc,MAAM,qBAAVd,YAAYa,aAAa;IAAC,cAArEf,gBACAD;IACF,MAAMkB,MAAMC,KAAKD,GAAG;IACpB,MAAME,WAAW,EAACtB,oBAAAA,aAAa9C,GAAG,CAAC8D,eAAjBhB,oBAAwB,EAAE,EAAEN,MAAM,CAClD,CAAC6B,KAAOH,MAAMG,KAAK;IAErBD,SAASE,IAAI,CAACJ;IACdpB,aAAayB,GAAG,CAACT,IAAIM;IACrB,IAAIA,SAASI,MAAM,GAAG,IAAI;QACxB,OAAOpB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAoB;IAC3D;IACA,IAAI;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAMkE,gBAAgB,MAAM5F,qBAAqB;YAC/Ca;YACAgF,MAAMrB,KAAKoB,aAAa;YACxBtE;YACAwE,MAAMT;QACR;QACA;;;;;;;KAOC,GACD,MAAMlF,sBAAsB;YAC1B;;;;;OAKC,GACDiD,OAAO;YACPvC;YACAkF,UAAU;gBAAEzE;YAAM;YAClB0E,aAAa;gBACXxE,QAAQ;gBACRyE,OAAO,CAAC,WAAW,EAAEZ,KAAK;gBAC1Ba,SAAS;YACX;YACA,mEAAmE;YACnE,iEAAiE;YACjE,+BAA+B;YAC/BC,gBAAgB;YAChB1E,kBAAkB;WAGdmE,gBAAgB;YAAEQ,QAAQ;gBAAER;YAAc;QAAE,IAAI,CAAC;QAEvD;;;;;;;;;KASC,GACD,MAAM,EAAE9D,MAAM,EAAE+B,WAAW,EAAEvB,IAAI,EAAE,GAAG,MAAMsB,aAAa/C;QACzD,MAAMwF,aACJ9G,yBACEuC,OAAOC,IAAI,CAAC,CAACF,QAAUA,MAAMI,EAAE,KAAKzB,sBACpCqD,gBACI,MAAMjC,oBAAoB;YAAEf;YAAQS;YAAOQ;YAAQQ;QAAK;QAChE,IAAI3B,QAAQ;YACV;;;;;;;;;OASC,GACD,MAAMF,aAAa;gBAAEI;gBAAQF;gBAAQW;gBAAOG,kBAAkB;YAAK;QACrE;QACA;;;;;;;;KAQC,GACD,OAAO8C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE2B,IAAI;YAAMC,sBAAsBF;QAAW;IAC3E,EAAE,OAAO3E,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,OAAO6C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAgB;IACvD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/newsletter.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { hostPublicOrigin } from '@aglyn/aglyn/app-utils/host-naming'\nimport {\n  mergeEmailTopics,\n  normalizeEmailTopic,\n  topicRequiresDoubleOptIn,\n  EMAIL_TOPICS_COLLECTION,\n  type EmailTopic,\n} from '@aglyn/aglyn/app-utils/email-topics'\nimport {\n  enrollListMember,\n  firebaseAdmin,\n  hostSendingIdentity,\n  meterHostEmail,\n  consentGroupForSite,\n  orgDataCollectionForHost,\n  recordPendingTopicConfirmation,\n  resolveCampaignTouch,\n  resolveOrgIdForHost,\n  siteRequiresDoubleOptIn,\n} from '@aglyn/tenant-data-admin'\nimport recordCapturedContact from '@aglyn/aglyn/plugin-manager/record-captured-contact'\nimport { buildConfirmUrl } from '@aglyn/tenant-data-admin/server/email-unsubscribe-link'\nimport { sendEmail } from '@aglyn/shared-util-email'\nimport { isDocumentId } from '@aglyn/tenant-data-admin/server/document-id'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * The stream a newsletter signup joins.\n *\n * The built-in id, not the campaign default: somebody typing their address\n * into a footer box is asking for the newsletter, and attributing it to\n * \"Promotions and offers\" would confirm them for a stream they did not name.\n */\nconst NEWSLETTER_TOPIC_ID = 'newsletter'\n\n/**\n * Enrolls one address into an org list's members (AGL-2499).\n *\n * The document id comes from `enrollListMember`, which is the only writer of\n * that collection — the workflow `enrollList` step reaches it too, and when\n * the two derived their own ids the same person subscribing by both routes\n * became two members of one list.\n *\n * Best-effort and silent on any problem: list enrollment rides along with\n * the newsletter signup, which must still succeed (and still upsert the\n * contact) even when the list id is stale, was mistyped into the besigner\n * prop, or belongs to an org this host cannot resolve.\n */\nasync function enrollInList(options: {\n  hostId: string\n  listId: string\n  email: string\n  name?: string\n  /** The opt-in the signup itself carries — see the call site. */\n  marketingConsent?: boolean\n}): Promise<void> {\n  if (!isDocumentId(options.listId)) return\n  try {\n    const contactsRef = await orgDataCollectionForHost(options.hostId, 'contacts')\n    const listRef = contactsRef.parent?.collection('lists').doc(options.listId)\n    if (!listRef) return\n    const listSnapshot = await listRef.get()\n    // A stale/mistyped id must not silently CREATE a list — campaign-send's\n    // `list` audience would then read a list nobody set up.\n    if (!listSnapshot.exists) return\n    await enrollListMember({\n      listRef,\n      group: await consentGroupForSite(options.hostId),\n      email: options.email,\n      ...(options.name ? { name: options.name } : {}),\n      source: 'newsletter',\n      ...(options.marketingConsent ? { marketingConsent: true } : {}),\n    })\n  } catch (error) {\n    console.error('list enrollment failed', error)\n  }\n}\n\n/**\n * DOUBLE OPT-IN, when this site asks for one\n * (`docs/specs/email-competitive-gaps.md` P8).\n *\n * A footer signup is where a confirmation belongs — ActiveCampaign's shape,\n * where forms are the thing that default to it — and it is the only capture\n * path in the product where the person is present, expecting a reply, and has\n * just typed the address themselves.\n *\n * ## The confirmation message is TRANSACTIONAL\n *\n * It carries no marketing context, so it passes no frequency cap and adds no\n * unsubscribe header: somebody who just asked to subscribe is owed the answer\n * to what they asked, and gating it behind a marketing ceiling would drop\n * exactly the message that lets them out of the quarantine. The suppression\n * lists are not consulted here either — `recordPendingTopicConfirmation`\n * refuses an address that left this stream before any message is composed,\n * which is the check that matters: a signup form must not become a way to\n * mail somebody who unsubscribed by asking them again.\n *\n * A hard-bounced address is deliberately NOT refused here, and the asymmetry\n * with the opt-out above is the point. An opt-out is a stated intention; a\n * bounce is a measurement of a mailbox at a moment, and refusing to send at\n * submission time would settle it on evidence that cannot be older than the\n * question being asked. The confirmation goes out, and if it is delivered and\n * clicked, `confirmTopicSubscription` lifts the platform bounce — the round\n * trip is what proves the record stale. A complaint or an unsubscribe is\n * never lifted by that path.\n *\n * ## Best-effort, like the enrollment beside it\n *\n * A failure to send leaves the address pending and unmailable, which is the\n * safe direction: they signed up, nothing reaches them, and signing up again\n * re-sends. The signup itself still succeeds — the contact is captured with\n * its consent record either way, and losing the capture because a confirmation\n * bounced would be a worse trade for everybody.\n *\n * @returns whether the address was put in the quarantine, so the caller can\n *          decide whether to enroll them on a list yet.\n */\nasync function requestConfirmation(options: {\n  hostId: string\n  email: string\n  topics: EmailTopic[]\n  /** The host document the setting was read from — see {@link loadHostGate}. */\n  host: { cname?: unknown; subdomain?: unknown }\n}): Promise<boolean> {\n  const topic = options.topics.find(\n    (candidate) => candidate.id === NEWSLETTER_TOPIC_ID,\n  )\n  const { result } = await recordPendingTopicConfirmation(\n    options.hostId,\n    options.email,\n    NEWSLETTER_TOPIC_ID,\n  )\n  if (result !== 'pending') return false\n  try {\n    const siteBase =\n      hostPublicOrigin({\n        cname: String(options.host.cname ?? ''),\n        subdomain: String(options.host.subdomain ?? ''),\n      }) ?? ''\n    const url = buildConfirmUrl({\n      siteBase,\n      hostId: options.hostId,\n      email: options.email,\n      topicId: NEWSLETTER_TOPIC_ID,\n    })\n    // No origin or no signing secret means no link, and a confirmation\n    // message with nothing to click is worse than none: the person believes\n    // they have subscribed and nothing ever arrives. Said out loud rather\n    // than shipped quietly, exactly as the unsubscribe seam does.\n    if (!url) {\n      console.warn(\n        '[newsletter] confirmation not sent — no public origin or no ' +\n          'EMAIL_UNSUBSCRIBE_SECRET',\n      )\n      return true\n    }\n    const stream = topic?.name ?? 'our newsletter'\n    const result = await sendEmail({\n      to: options.email,\n      subject: `Confirm your subscription`,\n      text:\n        `Please confirm that you want to receive ${stream} at this ` +\n        `address:\\n\\n${url}\\n\\nThe link works for three days. If you did ` +\n        'not sign up, ignore this message — nothing will be sent.',\n      sendingIdentity: await hostSendingIdentity(options.hostId),\n      audience: 'tenant',\n      context: 'newsletter confirmation',\n    })\n    /*\n     * Counted against the site, as TRANSACTIONAL.\n     *\n     * It is a message this site sent, so it costs what a message costs and\n     * the meter has to see it. `'transactional'` is the honest class: the\n     * person just typed their address into a form and is waiting for the\n     * answer, which is why the message carries no marketing context and no\n     * unsubscribe header either. Only a delivery is counted, so a send that\n     * never left is not billed as one.\n     */\n    if (result.sent) await meterHostEmail(options.hostId)\n  } catch (error) {\n    console.error('confirmation send failed', error)\n  }\n  return true\n}\n\n/**\n * The site's topic catalog, for the one question the signup asks of it.\n *\n * Fails soft to the built-ins, like the preference page's read: a site whose\n * org cannot be resolved still gets the four defaults, so the decision is\n * made against a catalog rather than against nothing.\n */\nasync function loadTopics(hostId: string): Promise<EmailTopic[]> {\n  try {\n    const orgId = await resolveOrgIdForHost(hostId)\n    if (!orgId) return mergeEmailTopics(null)\n    const snapshot = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('orgs')\n      .doc(orgId)\n      .collection(EMAIL_TOPICS_COLLECTION)\n      .get()\n    return mergeEmailTopics(\n      (snapshot?.docs ?? [])\n        .map((doc: any) => normalizeEmailTopic(doc.id, doc.data()))\n        .filter((topic: EmailTopic | null): topic is EmailTopic => !!topic),\n    )\n  } catch (error) {\n    console.error('[newsletter] topic catalog read failed', error)\n    return mergeEmailTopics(null)\n  }\n}\n\n/**\n * Everything the confirmation decision needs, in one round trip.\n *\n * Three reads — the host document, the org lookup and the topic catalog — and\n * the first is issued IN PARALLEL with the other two rather than after them,\n * because none of the three depends on another's answer. A signup is a person\n * waiting for a form to come back, and serialized reads on that path are\n * latency the person feels for a decision that is usually \"no\".\n *\n * The host document is returned rather than discarded: the confirmation link\n * needs the site's public origin, which is on that same document, and reading\n * it twice would be a read per signup to recover something already in hand.\n *\n * Fails soft on the site flag, which `siteRequiresDoubleOptIn` already does —\n * a default a failed read could switch ON would quarantine every new signup\n * on a site whose owner never asked for confirmations.\n */\nasync function loadHostGate(hostId: string): Promise<{\n  topics: EmailTopic[]\n  siteDefault: boolean\n  host: { cname?: unknown; subdomain?: unknown }\n}> {\n  const [topics, siteDefault, snapshot] = await Promise.all([\n    loadTopics(hostId),\n    siteRequiresDoubleOptIn(hostId),\n    firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .get()\n      .catch(() => null),\n  ])\n  return {\n    topics,\n    siteDefault,\n    host: {\n      cname: snapshot?.get('cname'),\n      subdomain: snapshot?.get('subdomain'),\n    },\n  }\n}\n\n// Best-effort per-instance flood damper.\nconst attemptsByIp = new Map<string, number[]>()\nimport {\n  NO_CLIENT_ADDRESS_BUCKET,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\n\n/**\n * Newsletter opt-in (AGL-301): footer signups and checkout opt-ins land\n * in the contacts CRM with an explicit consent timestamp, feeding the\n * email-campaign audiences.\n */\nexport const newsletterHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const email = String(body.email ?? '')\n    .trim()\n    .toLowerCase()\n  const listId = String(body.listId ?? '').trim()\n  if (!hostId || !EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Enter a valid email' })\n  }\n  // Keeps counting under the no-address bucket rather than being skipped: an\n  // unauthenticated signup endpoint that stops counting is an open write into\n  // the contacts CRM.\n  const ip =\n    readClientIp(req.headers, { remoteAddress: req.socket?.remoteAddress }) ??\n    NO_CLIENT_ADDRESS_BUCKET\n  const now = Date.now()\n  const attempts = (attemptsByIp.get(ip) ?? []).filter(\n    (at) => now - at < 60_000,\n  )\n  attempts.push(now)\n  attemptsByIp.set(ip, attempts)\n  if (attempts.length > 10) {\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    // A newsletter signup is an identify moment: the visitor was anonymous\n    // while they browsed and this request is the first thing that names them.\n    // Both channels are asked once, here, and the later touch is credited.\n    const campaignTouch = await resolveCampaignTouch({\n      hostId,\n      wire: body.campaignTouch,\n      email,\n      atMs: now,\n    })\n    /*\n     * Reported to whichever plugin keeps people, not written by this one\n     * (AGL-3080). A newsletter signup is commerce meeting somebody; what a\n     * person record is, and whether this workspace keeps any, belongs to the\n     * plugin that models them.\n     *\n     * Still awaited, because the confirmation below is deliberately after it.\n     */\n    await recordCapturedContact({\n      /*\n       * Not resolved here. The record system keys a person on the SITE they\n       * were met on, so this costs the capture nothing — and resolving it\n       * would put a Firestore read in front of the writer, which is the one\n       * thing `recordCapturedContact` asks a door not to do.\n       */\n      orgId: '',\n      hostId,\n      identity: { email },\n      interaction: {\n        source: 'newsletter',\n        refId: `newsletter-${now}`,\n        summary: 'Subscribed to the newsletter',\n      },\n      // A TOUCH (AGL-3232): the opt-in lands on the lead the site is\n      // working for this address when it holds one, and on the contact\n      // otherwise — the consent stays with the one record the person is.\n      surface: 'touch',\n      // The stage the name is for (AGL-2612): somebody who asked to hear\n      // from the site and nothing more yet. A floor, so a customer who\n      // subscribes stays a customer.\n      lifecycleFloor: 'subscriber',\n      marketingConsent: true,\n      // Where the visitor ARRIVED from — a fact about this visit and not\n      // about the person, which is what `detail` carries.\n      ...(campaignTouch ? { detail: { campaignTouch } } : {}),\n    })\n    /*\n     * The confirmation, when this site asks for one.\n     *\n     * AFTER the contact upsert and never instead of it. The person typed\n     * their address and ticked a box, and that consent record is a fact\n     * whether or not they go on to click a link — withholding the capture\n     * until they do would lose the record of what they actually did. What the\n     * confirmation gates is the SEND, on the person's own topic entry, which\n     * is where `filterTopicSendable` reads it.\n     */\n    const { topics, siteDefault, host } = await loadHostGate(hostId)\n    const confirming =\n      topicRequiresDoubleOptIn(\n        topics.find((topic) => topic.id === NEWSLETTER_TOPIC_ID),\n        siteDefault,\n      ) && (await requestConfirmation({ hostId, email, topics, host }))\n    if (listId) {\n      /*\n       * The same basis the contact upsert records, on the membership too.\n       *\n       * A list membership had no consent field at all, so `audience: 'list'`\n       * gave the send-time join nothing to read even for the one audience\n       * whose members literally asked for a newsletter\n       * (`docs/specs/email-overhaul.md` §1d). This is a DECLARED opt-in and\n       * not an inference from an act: the request this handler serves is\n       * \"subscribe me\", which is the checkbox.\n       */\n      await enrollInList({ hostId, listId, email, marketingConsent: true })\n    }\n    /*\n     * The caller is told which of the two things happened, so the signup form\n     * can say \"check your email\" rather than \"you're subscribed\".\n     *\n     * A form that reported success identically either way would be the site\n     * telling somebody they are on the list while the send path refuses them,\n     * and the only way they could find out is by noticing that nothing\n     * arrives.\n     */\n    return res.status(200).json({ ok: true, confirmationRequired: confirming })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Signup failed' })\n  }\n}\n"],"names":["hostPublicOrigin","mergeEmailTopics","normalizeEmailTopic","topicRequiresDoubleOptIn","EMAIL_TOPICS_COLLECTION","enrollListMember","firebaseAdmin","hostSendingIdentity","meterHostEmail","consentGroupForSite","orgDataCollectionForHost","recordPendingTopicConfirmation","resolveCampaignTouch","resolveOrgIdForHost","siteRequiresDoubleOptIn","recordCapturedContact","buildConfirmUrl","sendEmail","isDocumentId","EMAIL_PATTERN","NEWSLETTER_TOPIC_ID","enrollInList","options","listId","contactsRef","hostId","listRef","parent","collection","doc","listSnapshot","get","exists","group","email","name","source","marketingConsent","error","console","requestConfirmation","topic","topics","find","candidate","id","result","siteBase","cname","String","host","subdomain","url","topicId","warn","stream","to","subject","text","sendingIdentity","audience","context","sent","loadTopics","orgId","snapshot","app","firestore","docs","map","data","filter","loadHostGate","siteDefault","Promise","all","catch","attemptsByIp","Map","NO_CLIENT_ADDRESS_BUCKET","readClientIp","newsletterHandler","req","res","body","method","status","json","JSON","parse","trim","toLowerCase","test","ip","headers","remoteAddress","socket","now","Date","attempts","at","push","set","length","campaignTouch","wire","atMs","identity","interaction","refId","summary","surface","lifecycleFloor","detail","confirming","ok","confirmationRequired"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,gBAAgB,QAAQ,qCAAoC;AACrE,SACEC,gBAAgB,EAChBC,mBAAmB,EACnBC,wBAAwB,EACxBC,uBAAuB,QAElB,sCAAqC;AAC5C,SACEC,gBAAgB,EAChBC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,mBAAmB,EACnBC,wBAAwB,EACxBC,8BAA8B,EAC9BC,oBAAoB,EACpBC,mBAAmB,EACnBC,uBAAuB,QAClB,2BAA0B;AACjC,OAAOC,2BAA2B,sDAAqD;AACvF,SAASC,eAAe,QAAQ,yDAAwD;AACxF,SAASC,SAAS,QAAQ,2BAA0B;AACpD,SAASC,YAAY,QAAQ,8CAA6C;AAE1E,MAAMC,gBAAgB;AAEtB;;;;;;CAMC,GACD,MAAMC,sBAAsB;AAE5B;;;;;;;;;;;;CAYC,GACD,eAAeC,aAAaC,OAO3B;IACC,IAAI,CAACJ,aAAaI,QAAQC,MAAM,GAAG;IACnC,IAAI;YAEcC;QADhB,MAAMA,cAAc,MAAMd,yBAAyBY,QAAQG,MAAM,EAAE;QACnE,MAAMC,WAAUF,sBAAAA,YAAYG,MAAM,qBAAlBH,oBAAoBI,UAAU,CAAC,SAASC,GAAG,CAACP,QAAQC,MAAM;QAC1E,IAAI,CAACG,SAAS;QACd,MAAMI,eAAe,MAAMJ,QAAQK,GAAG;QACtC,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,CAACD,aAAaE,MAAM,EAAE;QAC1B,MAAM3B,iBAAiB;YACrBqB;YACAO,OAAO,MAAMxB,oBAAoBa,QAAQG,MAAM;YAC/CS,OAAOZ,QAAQY,KAAK;WAChBZ,QAAQa,IAAI,GAAG;YAAEA,MAAMb,QAAQa,IAAI;QAAC,IAAI,CAAC;YAC7CC,QAAQ;WACJd,QAAQe,gBAAgB,GAAG;YAAEA,kBAAkB;QAAK,IAAI,CAAC;IAEjE,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,0BAA0BA;IAC1C;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GACD,eAAeE,oBAAoBlB,OAMlC;IACC,MAAMmB,QAAQnB,QAAQoB,MAAM,CAACC,IAAI,CAC/B,CAACC,YAAcA,UAAUC,EAAE,KAAKzB;IAElC,MAAM,EAAE0B,MAAM,EAAE,GAAG,MAAMnC,+BACvBW,QAAQG,MAAM,EACdH,QAAQY,KAAK,EACbd;IAEF,IAAI0B,WAAW,WAAW,OAAO;IACjC,IAAI;YAEA9C,mBACgBsB,qBACIA;QAHtB,MAAMyB,YACJ/C,oBAAAA,iBAAiB;YACfgD,OAAOC,QAAO3B,sBAAAA,QAAQ4B,IAAI,CAACF,KAAK,YAAlB1B,sBAAsB;YACpC6B,WAAWF,QAAO3B,0BAAAA,QAAQ4B,IAAI,CAACC,SAAS,YAAtB7B,0BAA0B;QAC9C,cAHAtB,oBAGM;QACR,MAAMoD,MAAMpC,gBAAgB;YAC1B+B;YACAtB,QAAQH,QAAQG,MAAM;YACtBS,OAAOZ,QAAQY,KAAK;YACpBmB,SAASjC;QACX;QACA,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,CAACgC,KAAK;YACRb,QAAQe,IAAI,CACV,iEACE;YAEJ,OAAO;QACT;QACA,MAAMC,iBAASd,yBAAAA,MAAON,IAAI,mBAAI;QAC9B,MAAMW,SAAS,MAAM7B,UAAU;YAC7BuC,IAAIlC,QAAQY,KAAK;YACjBuB,SAAS,CAAC,yBAAyB,CAAC;YACpCC,MACE,CAAC,wCAAwC,EAAEH,OAAO,SAAS,CAAC,GAC5D,CAAC,YAAY,EAAEH,IAAI,8CAA8C,CAAC,GAClE;YACFO,iBAAiB,MAAMpD,oBAAoBe,QAAQG,MAAM;YACzDmC,UAAU;YACVC,SAAS;QACX;QACA;;;;;;;;;KASC,GACD,IAAIf,OAAOgB,IAAI,EAAE,MAAMtD,eAAec,QAAQG,MAAM;IACtD,EAAE,OAAOa,OAAO;QACdC,QAAQD,KAAK,CAAC,4BAA4BA;IAC5C;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,eAAeyB,WAAWtC,MAAc;IACtC,IAAI;;QACF,MAAMuC,QAAQ,MAAMnD,oBAAoBY;QACxC,IAAI,CAACuC,OAAO,OAAO/D,iBAAiB;QACpC,MAAMgE,WAAW,MAAM3D,cACpB4D,GAAG,GACHC,SAAS,GACTvC,UAAU,CAAC,QACXC,GAAG,CAACmC,OACJpC,UAAU,CAACxB,yBACX2B,GAAG;QACN,OAAO9B,iBACL,SAACgE,4BAAAA,SAAUG,IAAI,mBAAI,EAAE,EAClBC,GAAG,CAAC,CAACxC,MAAa3B,oBAAoB2B,IAAIgB,EAAE,EAAEhB,IAAIyC,IAAI,KACtDC,MAAM,CAAC,CAAC9B,QAAkD,CAAC,CAACA;IAEnE,EAAE,OAAOH,OAAO;QACdC,QAAQD,KAAK,CAAC,0CAA0CA;QACxD,OAAOrC,iBAAiB;IAC1B;AACF;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,eAAeuE,aAAa/C,MAAc;IAKxC,MAAM,CAACiB,QAAQ+B,aAAaR,SAAS,GAAG,MAAMS,QAAQC,GAAG,CAAC;QACxDZ,WAAWtC;QACXX,wBAAwBW;QACxBnB,cACG4D,GAAG,GACHC,SAAS,GACTvC,UAAU,CAAC,SACXC,GAAG,CAACJ,QACJM,GAAG,GACH6C,KAAK,CAAC,IAAM;KAChB;IACD,OAAO;QACLlC;QACA+B;QACAvB,MAAM;YACJF,KAAK,EAAEiB,4BAAAA,SAAUlC,GAAG,CAAC;YACrBoB,SAAS,EAAEc,4BAAAA,SAAUlC,GAAG,CAAC;QAC3B;IACF;AACF;AAEA,yCAAyC;AACzC,MAAM8C,eAAe,IAAIC;AACzB,SACEC,wBAAwB,EACxBC,YAAY,QACP,oCAAmC;AAE1C;;;;CAIC,GACD,OAAO,MAAMC,oBAAsC,OAAOC,KAAKC;QAKJD,WACnCE,cACDA,aAGCA,cAQpBJ,eAGgBH;QAH2BK;IAjB7C,IAAIA,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAqB;IAC5D;IACA,MAAM8C,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWI,KAAKC,KAAK,CAACP,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMzD,SAASwB,QAAOmC,eAAAA,KAAK3D,MAAM,YAAX2D,eAAe;IACrC,MAAMlD,QAAQe,QAAOmC,cAAAA,KAAKlD,KAAK,YAAVkD,cAAc,IAChCM,IAAI,GACJC,WAAW;IACd,MAAMpE,SAAS0B,QAAOmC,eAAAA,KAAK7D,MAAM,YAAX6D,eAAe,IAAIM,IAAI;IAC7C,IAAI,CAACjE,UAAU,CAACN,cAAcyE,IAAI,CAAC1D,QAAQ;QACzC,OAAOiD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAsB;IAC7D;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,oBAAoB;IACpB,MAAMuD,MACJb,gBAAAA,aAAaE,IAAIY,OAAO,EAAE;QAAEC,aAAa,GAAEb,cAAAA,IAAIc,MAAM,qBAAVd,YAAYa,aAAa;IAAC,cAArEf,gBACAD;IACF,MAAMkB,MAAMC,KAAKD,GAAG;IACpB,MAAME,WAAW,EAACtB,oBAAAA,aAAa9C,GAAG,CAAC8D,eAAjBhB,oBAAwB,EAAE,EAAEN,MAAM,CAClD,CAAC6B,KAAOH,MAAMG,KAAK;IAErBD,SAASE,IAAI,CAACJ;IACdpB,aAAayB,GAAG,CAACT,IAAIM;IACrB,IAAIA,SAASI,MAAM,GAAG,IAAI;QACxB,OAAOpB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAoB;IAC3D;IACA,IAAI;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAMkE,gBAAgB,MAAM5F,qBAAqB;YAC/Ca;YACAgF,MAAMrB,KAAKoB,aAAa;YACxBtE;YACAwE,MAAMT;QACR;QACA;;;;;;;KAOC,GACD,MAAMlF,sBAAsB;YAC1B;;;;;OAKC,GACDiD,OAAO;YACPvC;YACAkF,UAAU;gBAAEzE;YAAM;YAClB0E,aAAa;gBACXxE,QAAQ;gBACRyE,OAAO,CAAC,WAAW,EAAEZ,KAAK;gBAC1Ba,SAAS;YACX;YACA,+DAA+D;YAC/D,iEAAiE;YACjE,mEAAmE;YACnEC,SAAS;YACT,mEAAmE;YACnE,iEAAiE;YACjE,+BAA+B;YAC/BC,gBAAgB;YAChB3E,kBAAkB;WAGdmE,gBAAgB;YAAES,QAAQ;gBAAET;YAAc;QAAE,IAAI,CAAC;QAEvD;;;;;;;;;KASC,GACD,MAAM,EAAE9D,MAAM,EAAE+B,WAAW,EAAEvB,IAAI,EAAE,GAAG,MAAMsB,aAAa/C;QACzD,MAAMyF,aACJ/G,yBACEuC,OAAOC,IAAI,CAAC,CAACF,QAAUA,MAAMI,EAAE,KAAKzB,sBACpCqD,gBACI,MAAMjC,oBAAoB;YAAEf;YAAQS;YAAOQ;YAAQQ;QAAK;QAChE,IAAI3B,QAAQ;YACV;;;;;;;;;OASC,GACD,MAAMF,aAAa;gBAAEI;gBAAQF;gBAAQW;gBAAOG,kBAAkB;YAAK;QACrE;QACA;;;;;;;;KAQC,GACD,OAAO8C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE4B,IAAI;YAAMC,sBAAsBF;QAAW;IAC3E,EAAE,OAAO5E,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,OAAO6C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEjD,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/server/refund.js

@@ -76,7 +76,7 @@ import { reverseEmailAttributedRevenue } from "@aglyn/tenant-data-admin/server/e
         }
         return retired;
     } catch (error) {
-        console.error('Licence key retirement failed', orderId, error);
+        console.error('License key retirement failed', orderId, error);
         return 0;
     }
 }

package/src/lib/server/refund.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/refund.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { createHash } from 'crypto'\nimport { recordContactRefund } from './contact-refund'\nimport { flagOrderRestock } from './restock-flag'\n// Leaf import, not the barrel, for the reason `contact-refund.ts` states about\n// `updateExisting`: the specs in this library mock `@aglyn/tenant-data-admin`\n// wholesale, and a permissive stub would turn a reversal that never happened\n// green.\nimport { reverseEmailAttributedRevenue } from '@aglyn/tenant-data-admin/server/email-revenue-attribution'\n\n/**\n * A claim on one refund attempt (AGL-1696), the same primitive the POS sale\n * path uses (AGL-1691, `cab8aa36e`).\n */\ninterface RefundClaim {\n  /** Stripe idempotency key for this attempt, or null when no key was sent. */\n  stripeKey: string | null\n  record: (status: number, body: unknown) => Promise<void>\n  release: () => Promise<void>\n}\n\n/**\n * Retires the licence keys a refund withdrew (AGL-2454).\n *\n * Reads the order back so the decision is made from what actually SETTLED\n * rather than from what this request asked for — a concurrent partial may have\n * closed a line between the two — and retires only the keys of products the\n * order no longer entitles at all. `refundedProductIds` is deliberately strict\n * about that: a buyer who returned one of two copies still holds the product,\n * so nothing is retired for them.\n *\n * `revokedAtMs` with `assignedAtMs` left standing is the retired state. Keeping\n * `assignedAtMs` matters: `assignLicenseKeys` claims from\n * `where('assignedAtMs','==',null)`, so clearing it would put the key straight\n * back in front of the next buyer — the reissue this must not do.\n *\n * Swallows everything. The refund has already moved money.\n */\nasync function retireLicenseKeys(\n  hostRef: FirebaseFirestore.DocumentReference,\n  orderRef: FirebaseFirestore.DocumentReference,\n  orderId: string,\n): Promise<number> {\n  try {\n    const fresh = CommerceModel.liftLegacyOrder(\n      ((await orderRef.get()).data() ?? {}) as any,\n    )\n    const withdrawn = new Set(CommerceModel.refundedProductIds(fresh))\n    if (withdrawn.size === 0) return 0\n    const assigned = await hostRef\n      .collection('licenseKeys')\n      .where('orderId', '==', orderId)\n      .limit(500)\n      .get()\n    let retired = 0\n    for (const keySnapshot of assigned.docs) {\n      if (!withdrawn.has(String(keySnapshot.get('productId') ?? ''))) continue\n      // Already retired by an earlier partial, or by the merchant's own Revoke\n      // button. Skipped so a second refund does not restamp the timestamp and\n      // make the retirement look newer than it is.\n      if (keySnapshot.get('revokedAtMs') != null) continue\n      await keySnapshot.ref\n        .set({ revokedAtMs: Date.now(), revokedOrderId: orderId }, { merge: true })\n        .catch(() => undefined)\n      retired++\n    }\n    if (retired > 0) {\n      await orderRef\n        .update({\n          timeline: firebaseAdmin.firestore.FieldValue.arrayUnion({\n            atMs: Date.now(),\n            event: 'license-retired',\n            detail:\n              `${retired} license key${retired === 1 ? '' : 's'} retired. ` +\n              'The buyer already holds the key string, so it is not returned ' +\n              'to the pool — reissuing it would give two people one secret.',\n          }),\n        })\n        .catch(() => undefined)\n    }\n    return retired\n  } catch (error) {\n    console.error('Licence key retirement failed', orderId, error)\n    return 0\n  }\n}\n\n/**\n * Order refunds (AGL-287): full or partial via Stripe, site-admin only\n * (it moves money). Destination charges reverse the transfer and the\n * platform fee proportionally. Full refunds transition the order to\n * `refunded`; partial refunds accumulate `refundedCents` and stay in\n * the current status.\n *\n * Two SEPARATE controls guard the money (AGL-1696), and conflating them is\n * how the original went wrong:\n *\n *  - The idempotency key stops a DUPLICATE refund — one attempt sent twice\n *    because the response was lost, the admin double-clicked, or a client\n *    retried. It is minted per attempt by the console and deliberately not\n *    derived from the order or the amount: two $10 refunds on a $50 order are\n *    two real refunds, exactly as a cashier ringing the same coffee twice is a\n *    real second sale.\n *  - The cap stops an OVER-refund — several partials summing past what was\n *    captured, including two admins refunding at once, where the two attempts\n *    are genuinely distinct and no key can help. That needs the counter read\n *    and written inside one transaction.\n *\n * The original had a cap that looked like both and was neither: it read\n * `refundedCents` and wrote it back only AFTER the Stripe call, outside any\n * transaction. A guard that reads state the guarded operation writes too late\n * is not a guard — measured, two concurrent refunds each sent a full $50 to\n * Stripe with no idempotency header on either.\n */\nexport const refundHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return res.status(501).json({ error: 'Payments are not configured.' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const orderId = String(body.orderId ?? '')\n  const amountCents = body.amountCents == null ? null : Number(body.amountCents)\n  /**\n   * Lines the admin is refunding BY NAME (AGL-2454), and therefore the lines\n   * whose digital entitlements come back. Optional: an amount-only refund is\n   * still a legal refund and still revokes nothing per-line — see the guard\n   * below for why that is a decision rather than an oversight.\n   */\n  const requestedLineIds: number[] = Array.isArray(body.lineItemIds)\n    ? [\n        ...new Set(\n          (body.lineItemIds as unknown[])\n            .map((value) => Math.round(Number(value)))\n            .filter((value) => Number.isFinite(value) && value >= 0),\n        ),\n      ].sort((a, b) => a - b)\n    : []\n  // One refund attempt, minted by the console. Node lowercases incoming\n  // headers, but read both spellings — the plugin API request type makes no\n  // promise about casing.\n  const idempotencyKey = String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n  if (!hostId || !orderId) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n\n  let claim: RefundClaim | null = null\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // TWO CHECKS, and they answer different questions (AGL-2372).\n    //\n    // The first is the HOST-level fact the Firestore rules also enforce, and\n    // it stays: `memberRoles` is the projection the rules read, so dropping it\n    // here would let this route and the database disagree.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin') {\n      return res.status(403).json({ error: 'Refunds require a site admin' })\n    }\n    // The second is WHOSE admin, and it is the one this gate was missing.\n    //\n    // `memberRoles` is a per-host projection of `hostAccess`, and\n    // `/api/hosts/members` will grant a SITE COLLABORATOR `admin` on one site\n    // (`hostAccess: { [hostId]: 'admin' }`, `allHosts: false`). That writes the\n    // literal string `'admin'` into `memberRoles[uid]` — byte-identical to an\n    // org owner's. So the check above cannot tell a contractor invited to run\n    // one microsite from the person who owns the business, and refunding is\n    // money leaving that business.\n    //\n    // `orgWide` is the discriminator, and it needs no new role: it is\n    // `isOrgWideMember` (AGL-1026) — owner/admin of the org, an explicit\n    // `allHosts` member, or the legacy pre-`allHosts` shape — and it is false\n    // for every scoped collaborator. Same pairing `pos-order.ts` uses.\n    //\n    // BOTH halves are required. `hostRole` is re-tested rather than assumed\n    // from `memberRole`: an org-wide member can still be scoped down to\n    // `editor` on this host, and `resolveOrgPermissions` is the resolver that\n    // knows it. It fails CLOSED on a lookup error when a host is named\n    // (AGL-506), and `denied()` returns `orgWide: false` / `hostRole: null`,\n    // so an absent membership refuses rather than folding to permitted.\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.orgWide || membership.hostRole !== 'admin') {\n      return res\n        .status(403)\n        .json({ error: 'Refunds require an admin of the whole workspace' })\n    }\n    const orderRef = hostRef.collection('orders').doc(orderId)\n    const orderSnapshot = await orderRef.get()\n    if (!orderSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown order' })\n    }\n    const order = CommerceModel.liftLegacyOrder(orderSnapshot.data() as any)\n\n    // Replay a settled attempt before anything else can reject it. This read\n    // is only a short-circuit, never the dedupe primitive — the atomic\n    // `create()` below is. It has to run ahead of the status guard because a\n    // retried FULL refund would otherwise be answered \"orders in refunded\n    // cannot refund\", which is the right money outcome reported as a failure,\n    // and an admin who reads it as a failure refunds again by hand.\n    const claimRef = idempotencyKey\n      ? firestore\n          .collection('apiIdempotency')\n          .doc(\n            createHash('sha256')\n              // Scoped by the order, so a client that reused one key across\n              // two orders cannot dedupe two legitimately distinct refunds.\n              // NOT by the amount: that would swallow a real second partial.\n              .update(`refund:${hostId}:${orderId}:${idempotencyKey}`)\n              .digest('hex'),\n          )\n      : null\n    if (claimRef) {\n      const prior = await claimRef.get()\n      const priorResponse = prior.get('response')\n      if (priorResponse) {\n        return res\n          .status(Number(prior.get('responseStatus') ?? 200))\n          .json(priorResponse)\n      }\n    }\n\n    if (!CommerceModel.canTransitionOrder(order.status, 'refunded')) {\n      return res\n        .status(409)\n        .json({ error: `Orders in \"${order.status}\" cannot refund` })\n    }\n    // A refund does not withdraw a dispute (AGL-1809). While a chargeback is\n    // formally open the bank has already pulled the disputed funds, Stripe's\n    // refund API refuses the charge (`charge_disputed`), and a refund that did\n    // go through would pay the shopper twice — the merchant loses the refund\n    // AND the dispute plus its fee. Refused HERE, before the claim and the\n    // reservation, so a refusal burns no idempotency key and strands nothing:\n    // no state has been written yet (AGL-1754's contract). An open INQUIRY\n    // (`warning_*`) deliberately passes — no funds have moved and Stripe names\n    // a full refund as the way to resolve one before it escalates — and the\n    // status guard above already turns away a LOST dispute, which parked the\n    // order in `refunded`. This reads the pre-transaction snapshot; a dispute\n    // webhook racing this exact request is caught by the `charge_disputed`\n    // mapping on the Stripe response below.\n    if (CommerceModel.orderDisputeBlocksRefund(order)) {\n      return res.status(409).json({\n        error:\n          'A chargeback is open on this order, so it was not refunded. ' +\n          'Refunding would not withdraw the dispute — the bank has already ' +\n          'taken the disputed amount, and a refund on top of it would pay ' +\n          'the shopper twice. Respond to the dispute or accept it in the ' +\n          'Stripe dashboard; refund any remainder once it settles.',\n      })\n    }\n    // WHAT THE NAMED LINES ARE WORTH, AND WHY THE AMOUNT MAY NOT BE LESS\n    // (AGL-2454).\n    //\n    // A refund carries an amount, not lines — that is the blocker this issue\n    // names, and `restock-flag.ts:48-55` already records it for stock. It\n    // cannot be solved by inference: deciding for the merchant which lines a\n    // bare figure covers would be a guess about their goods. It CAN be solved\n    // by asking, which is what naming lines does, and the amount is then\n    // derived from them rather than typed beside them.\n    //\n    // An explicit `amountCents` may still be LARGER (the admin is refunding the\n    // line plus its share of tax or shipping, which this items-only sum does\n    // not include). It may not be SMALLER: revoking a line the refund did not\n    // actually cover is the silent over-revocation this issue forbids in the\n    // same breath as silent under-revocation.\n    const orderLines = order.lineItems ?? []\n    const invalidLine = requestedLineIds.find(\n      (index) => index >= orderLines.length,\n    )\n    if (invalidLine != null) {\n      return res\n        .status(400)\n        .json({ error: `Line ${invalidLine} is not on this order` })\n    }\n    // NET OF THE ORDER'S DISCOUNT, not the list price.\n    //\n    // This was the bare `unitAmountCents x quantity`, which is what the line\n    // was LISTED at rather than what the buyer paid for it. On a discounted\n    // order the two differ, and both directions of the error land on the\n    // merchant: a $10 coupon over two $50 lines means each line cost $45, so\n    // refunding one at $50 gave back $5 that was never taken, and the order\n    // then held less than its remaining line was worth — so the second line\n    // refund hit the cap below and was refused outright, leaving the merchant\n    // unable to finish a refund they had already half-issued.\n    //\n    // `orderLineRefundCents` apportions the discount across every line by list\n    // value and returns the named lines' share, so refunding all of them sums\n    // to exactly what was charged and no cent is stranded or invented.\n    const namedLinesCents = CommerceModel.orderLineRefundCents(\n      order,\n      requestedLineIds,\n    )\n    if (\n      requestedLineIds.length > 0 &&\n      amountCents != null &&\n      Math.round(amountCents) < namedLinesCents\n    ) {\n      return res.status(400).json({\n        error:\n          'That amount is less than the lines you selected are worth. ' +\n          'Refund the full value of those lines, or refund an amount ' +\n          'without selecting lines.',\n      })\n    }\n    const paymentIntentId =\n      order.paymentIntentId ??\n      // Legacy rows stored the checkout session as the doc id; resolve\n      // the payment intent from Stripe.\n      (await (async () => {\n        const response = await fetch(\n          `https://api.stripe.com/v1/checkout/sessions/${orderId}`,\n          {\n            headers: {\n              Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n            },\n          },\n        )\n        const session = await response.json()\n        return response.ok ? session?.payment_intent : null\n      })())\n    if (!paymentIntentId) {\n      return res.status(409).json({ error: 'No payment to refund' })\n    }\n\n    // Point of no return: everything past here moves money. The claim is\n    // `create()` — Firestore rejects a create on an existing document, and\n    // that rejection IS the dedupe primitive. A read-then-write would race\n    // exactly the double-submit it exists to stop. Storage reuses the REST\n    // API's shape and its `orgId` field (AGL-618) rather than inventing a\n    // second replay store, so `eraseOrgIdempotencyKeys` (AGL-1448) already\n    // sweeps these on org erasure with no change there.\n    if (claimRef) {\n      const ownerOrg = await getOrgForHost(hostId)\n      try {\n        await claimRef.create({\n          orgId: String(ownerOrg?.org?.id ?? '') || null,\n          hostId,\n          orderId,\n          kind: 'commerce-refund',\n          status: 'pending',\n          createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n          createdAtMs: Date.now(),\n          // The second writer into `apiIdempotency` (AGL-1978). The shared\n          // `claimAttempt` stamps this too; this local copy has to as well,\n          // or refund claims are the one shape the TTL policy silently never\n          // reaches — a policy that governs most of a collection reads, from\n          // the outside, exactly like one that governs all of it.\n          expiresAt: Aglyn.apiIdempotencyExpiry(),\n        })\n      } catch {\n        const prior = await claimRef.get()\n        const priorResponse = prior.get('response')\n        if (priorResponse) {\n          return res\n            .status(Number(prior.get('responseStatus') ?? 200))\n            .json(priorResponse)\n        }\n        // In flight, or stranded by a process that died mid-refund. Fail\n        // CLOSED: the alternative is sending the money a second time.\n        return res\n          .status(409)\n          .json({ error: 'This refund is already being processed' })\n      }\n      claim = {\n        // The same digest goes to Stripe. That is the half that costs real\n        // money: it covers the window where our claim is written but the\n        // response never arrives, and makes Stripe replay its own refund\n        // instead of moving the funds again.\n        stripeKey: claimRef.id,\n        record: async (status, payload) => {\n          await claimRef\n            .set(\n              {\n                status: 'done',\n                responseStatus: status,\n                response: payload,\n                settledAtMs: Date.now(),\n              },\n              { merge: true },\n            )\n            .catch(() => undefined)\n        },\n        release: async () => {\n          await claimRef.delete().catch(() => undefined)\n        },\n      }\n    }\n\n    // RESERVE. The cap is read and written in one transaction, so two\n    // concurrent refunds cannot both see the same `refundedCents` — which is\n    // the whole failure the old ordering had, since it wrote the counter only\n    // after Stripe had already been asked to move the money. Reserving BEFORE\n    // the call rather than after also fails in the safe direction: a lost\n    // response leaves the amount counted, so the retry refunds less, never\n    // more.\n    let refundCents = 0\n    let totalCents = 0\n    await firestore.runTransaction(async (transaction) => {\n      const fresh = CommerceModel.liftLegacyOrder(\n        ((await transaction.get(orderRef)).data() ?? {}) as any,\n      )\n      totalCents = fresh.totals?.totalCents ?? Number(fresh.amountCents ?? 0)\n      const alreadyRefunded = Number(fresh.refundedCents ?? 0)\n      const remaining = totalCents - alreadyRefunded\n      // Named lines with no amount refund exactly what those lines are worth;\n      // named lines WITH an amount use the amount (already guarded above as\n      // no smaller than the lines). Neither is the whole order, which is what\n      // `amountCents == null` alone still means.\n      const asked =\n        amountCents != null\n          ? Math.round(amountCents)\n          : requestedLineIds.length > 0\n            ? namedLinesCents\n            : remaining\n      refundCents = Math.min(asked, remaining)\n      if (!(refundCents > 0)) {\n        refundCents = 0\n        return\n      }\n      transaction.set(\n        orderRef,\n        { refundedCents: alreadyRefunded + refundCents },\n        { merge: true },\n      )\n    })\n    if (!(refundCents > 0)) {\n      // Nothing moved, so the attempt key is released rather than burned.\n      await claim?.release()\n      return res.status(400).json({ error: 'Nothing left to refund' })\n    }\n    // The cap bit into the named lines (AGL-2454): earlier partials have left\n    // less on this order than the selected lines are worth. REFUSED rather\n    // than refunded-and-revoked, because revoking a line for less than its\n    // value is precisely the silent over-revocation this issue forbids. The\n    // reservation is given back — the same compensation a Stripe refusal does\n    // below, and for the same reason: nothing has left the account yet.\n    if (requestedLineIds.length > 0 && refundCents < namedLinesCents) {\n      await firestore\n        .runTransaction(async (transaction) => {\n          const current = Number(\n            (await transaction.get(orderRef)).get('refundedCents') ?? 0,\n          )\n          transaction.set(\n            orderRef,\n            { refundedCents: Math.max(0, current - refundCents) },\n            { merge: true },\n          )\n        })\n        .catch(() => undefined)\n      await claim?.release()\n      return res.status(409).json({\n        error:\n          `Only $${(refundCents / 100).toFixed(2)} is left to refund on this ` +\n          `order, and the lines you selected are worth $${(\n            namedLinesCents / 100\n          ).toFixed(2)}. Refund an amount without selecting lines instead.`,\n      })\n    }\n\n    const params = new URLSearchParams({\n      payment_intent: String(paymentIntentId),\n      amount: String(refundCents),\n      reverse_transfer: 'true',\n      refund_application_fee: 'true',\n    })\n    const response = await fetch('https://api.stripe.com/v1/refunds', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n        'Content-Type': 'application/x-www-form-urlencoded',\n        ...(claim?.stripeKey\n          ? { 'Idempotency-Key': claim.stripeKey }\n          : {}),\n      },\n      body: params.toString(),\n    })\n    const refund = await response.json()\n    if (!response.ok) {\n      console.error('Stripe refund error', refund?.error)\n      // Stripe said no, so we KNOW no money moved: give the reservation back\n      // and let the same attempt be tried again.\n      await firestore\n        .runTransaction(async (transaction) => {\n          const current = Number(\n            (await transaction.get(orderRef)).get('refundedCents') ?? 0,\n          )\n          transaction.set(\n            orderRef,\n            { refundedCents: Math.max(0, current - refundCents) },\n            { merge: true },\n          )\n        })\n        .catch(() => undefined)\n      await claim?.release()\n      // Stripe refusing BECAUSE OF A DISPUTE is the guard above arriving by\n      // the other door — our order document simply didn't know yet (webhook\n      // lag, or an order from before disputes were subscribed at all). Same\n      // answer, same accuracy: a 409 naming the dispute, not a 502 reading\n      // \"The charge you're attempting to refund has been charged back\", which\n      // an admin has no reason to connect to the Refund button they pressed.\n      const stripeCode = String(refund?.error?.code ?? '')\n      if (\n        stripeCode === 'charge_disputed' ||\n        stripeCode === 'refund_disputed_payment'\n      ) {\n        return res.status(409).json({\n          error:\n            'Stripe refused this refund because the charge is disputed. ' +\n            'Respond to the dispute or accept it in the Stripe dashboard; ' +\n            'refund any remainder once it settles.',\n        })\n      }\n      return res\n        .status(502)\n        .json({ error: refund?.error?.message ?? 'Refund failed' })\n    }\n\n    // SETTLE. Re-read inside the transaction: a concurrent partial may have\n    // reserved against the same order, and the timeline must be appended to\n    // whatever is there now rather than to the snapshot read at the top.\n    let refundedCents = 0\n    let fullyRefunded = false\n    let closedTheOrder = false\n    await firestore.runTransaction(async (transaction) => {\n      const fresh = CommerceModel.liftLegacyOrder(\n        ((await transaction.get(orderRef)).data() ?? {}) as any,\n      )\n      refundedCents = Number(fresh.refundedCents ?? 0)\n      fullyRefunded = refundedCents >= totalCents\n      // Whether THIS settle moved the order into `refunded`, which is not the\n      // same question as whether the order is now fully refunded (AGL-1754).\n      // Two partials that between them close an order can both reserve before\n      // either settles, so both re-read the completed total and both compute\n      // `fullyRefunded`. Writing `status: 'refunded'` twice is harmless;\n      // incrementing a count twice is not. Reading the status inside the same\n      // transaction that writes it makes the flip observable exactly once.\n      closedTheOrder = fullyRefunded && fresh.status !== 'refunded'\n      transaction.set(\n        orderRef,\n        {\n          ...(fullyRefunded ? { status: 'refunded' } : {}),\n          // The entitlement withdrawal, recorded WITH the money (AGL-2454).\n          // `arrayUnion` rather than a written-back array: two admins refunding\n          // different lines at once must not erase each other's, and this\n          // transaction re-reads the order but a written array would still lose\n          // a concurrent settle that committed between the two.\n          ...(requestedLineIds.length > 0\n            ? {\n                refundedLineItemIds:\n                  firebaseAdmin.firestore.FieldValue.arrayUnion(\n                    ...requestedLineIds,\n                  ),\n              }\n            : {}),\n          timeline: CommerceModel.appendOrderEvent(\n            fresh,\n            'refund',\n            `$${(refundCents / 100).toFixed(2)} refunded` +\n              (fullyRefunded\n                ? ' (full)'\n                : requestedLineIds.length > 0\n                  ? ` — ${requestedLineIds.length} line${\n                      requestedLineIds.length === 1 ? '' : 's'\n                    } withdrawn`\n                  : ' — refunded by amount, no lines withdrawn'),\n          ),\n        },\n        { merge: true },\n      )\n    })\n    const payload = { refundedCents, fullyRefunded }\n    await claim?.record(200, payload)\n    // LICENCE KEYS ARE RETIRED, NEVER RETURNED TO THE POOL (AGL-2454).\n    //\n    // `assignLicenseKeys` stamps `assignedAtMs`, `orderId` and `email` onto a\n    // pool document and nothing anywhere ever set them back — so a refunded\n    // order consumed the merchant's key forever, and a merchant who sold one\n    // key out of a hundred and refunded it had ninety-nine, permanently.\n    //\n    // Returning it to the pool is NOT the fix, and this is the decision the\n    // issue asked for: the key string was mailed in the receipt and cannot be\n    // invalidated by anything we own, so re-issuing it to the next paying\n    // customer would hand two people one working secret. That is worse than\n    // losing the key. A third state — retired: neither assigned to a live order\n    // nor available — is the honest record, and `revokedAtMs` already IS that\n    // state: the console's key dialog has written exactly this pair since it\n    // shipped, so this reuses the merchant's own vocabulary rather than\n    // inventing a second one.\n    //\n    // Best-effort and after the response is recorded, matching the contact and\n    // restock ledgers below: the money has moved and nothing here may fail a\n    // refund that already left the merchant's account.\n    await retireLicenseKeys(hostRef, orderRef, orderId)\n    // The customer's side of the ledger (AGL-1754). Everything above records\n    // the money on the ORDER; without this the buyer's `ltvCents` still counts\n    // a sale they returned, and only ever rises.\n    //\n    // Placed AFTER the attempt is recorded so a slow contacts write cannot\n    // strand the claim: a retry that arrives while this is in flight replays\n    // the recorded 200 instead of being turned away with \"already being\n    // processed\". Awaited rather than fired off with `void` — the handler is\n    // serverless, and work left running past the response is work the\n    // container may be frozen before it finishes. `recordContactRefund`\n    // swallows its own failures, so awaiting adds no way for this to fail a\n    // refund that has already left the merchant's account.\n    //\n    // Amount is THIS attempt's `refundCents`, already capped against what was\n    // left, so several partials sum to at most the order total — the same\n    // number the order's own `refundedCents` follows. The retried and racing\n    // cases need no key of their own: a keyed retry never reaches here (it\n    // replays at the claim), and a keyless one is a genuinely new refund that\n    // moved more money and should be counted.\n    await recordContactRefund({\n      hostId,\n      orderId,\n      email: order.customerEmail,\n      amountCents: refundCents,\n      closedTheOrder,\n    })\n    /*\n     * The campaign's side of the same ledger.\n     *\n     * If a campaign was credited with this order, that credit is now partly\n     * or wholly wrong — a campaign cannot go on being paid for a sale the\n     * merchant reversed, and revenue attribution that only ever rises is the\n     * flattering half of a measurement. Recorded beside the gross rather than\n     * subtracted from it, for the reason `recordContactRefund` above records\n     * `refundedCents` beside `ltvCents`.\n     *\n     * Keyed by the ORDER and not by the buyer, so it needs no email and works\n     * for a guest checkout: the attribution record holds which campaign and\n     * which currency, and this reads them back. Same placement, same\n     * swallow-all contract and same awaited call as the two ledgers around\n     * it — nothing here may fail a refund that has already left the\n     * merchant's account.\n     */\n    await reverseEmailAttributedRevenue({\n      hostId,\n      orderId,\n      amountCents: refundCents,\n      closedTheOrder,\n    })\n    // The shelf's side of the ledger (AGL-1797). The sale decremented variant\n    // inventory and nothing put it back, so a fully refunded order read one\n    // unit light forever. This FLAGS rather than releases — a refund with no\n    // return leaves the goods gone, and inventing stock the merchant does not\n    // have is worse than under-counting it — and the merchant answers from the\n    // stock adjustment they already have. Same placement and same swallow-all\n    // contract as the contact write above, for the same reason: the money has\n    // moved and the order records it, so nothing here may fail the refund.\n    await flagOrderRestock({ hostId, orderId, kind: 'refund', closedTheOrder })\n    return res.status(200).json(payload)\n  } catch (error) {\n    console.error(error)\n    // Deliberately NOT released, which is where this diverges from the POS\n    // sale path (AGL-1691). If the refund call threw we do not know whether\n    // Stripe moved the money, and the two failure directions are not\n    // symmetric: a stranded key costs a support ticket, a released one costs a\n    // second refund. The retry gets a 409 and a human reconciles.\n    return res.status(500).json({ error: 'Refund failed' })\n  }\n}\n"],"names":["Aglyn","CommerceModel","firebaseAdmin","getOrgForHost","resolveOrgPermissions","createHash","recordContactRefund","flagOrderRestock","reverseEmailAttributedRevenue","retireLicenseKeys","hostRef","orderRef","orderId","fresh","liftLegacyOrder","get","data","withdrawn","Set","refundedProductIds","size","assigned","collection","where","limit","retired","keySnapshot","docs","has","String","ref","set","revokedAtMs","Date","now","revokedOrderId","merge","catch","undefined","update","timeline","firestore","FieldValue","arrayUnion","atMs","event","detail","error","console","refundHandler","req","res","body","method","status","json","process","env","STRIPE_SECRET_KEY","authorization","headers","idToken","startsWith","slice","length","JSON","parse","hostId","amountCents","Number","requestedLineIds","Array","isArray","lineItemIds","map","value","Math","round","filter","isFinite","sort","a","b","idempotencyKey","trim","claim","hostSnapshot","order","decoded","app","auth","verifyIdToken","doc","exists","memberRole","uid","membership","orgWide","hostRole","orderSnapshot","claimRef","digest","prior","priorResponse","canTransitionOrder","orderDisputeBlocksRefund","orderLines","lineItems","invalidLine","find","index","namedLinesCents","orderLineRefundCents","paymentIntentId","response","fetch","Authorization","session","ok","payment_intent","ownerOrg","create","orgId","org","id","kind","createdAt","serverTimestamp","createdAtMs","expiresAt","apiIdempotencyExpiry","stripeKey","record","payload","responseStatus","settledAtMs","release","delete","refundCents","totalCents","runTransaction","transaction","totals","alreadyRefunded","refundedCents","remaining","asked","min","current","max","toFixed","params","URLSearchParams","amount","reverse_transfer","refund_application_fee","toString","refund","stripeCode","code","message","fullyRefunded","closedTheOrder","refundedLineItemIds","appendOrderEvent","email","customerEmail"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAC5C,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AAEvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SAASC,gBAAgB,QAAQ,oBAAgB;AACjD,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,SAAS;AACT,SAASC,6BAA6B,QAAQ,4DAA2D;AAazG;;;;;;;;;;;;;;;;CAgBC,GACD,eAAeC,kBACbC,OAA4C,EAC5CC,QAA6C,EAC7CC,OAAe;IAEf,IAAI;YAEC;QADH,MAAMC,QAAQZ,cAAca,eAAe,EACxC,QAAA,AAAC,CAAA,MAAMH,SAASI,GAAG,EAAC,EAAGC,IAAI,cAA3B,QAAiC,CAAC;QAErC,MAAMC,YAAY,IAAIC,IAAIjB,cAAckB,kBAAkB,CAACN;QAC3D,IAAII,UAAUG,IAAI,KAAK,GAAG,OAAO;QACjC,MAAMC,WAAW,MAAMX,QACpBY,UAAU,CAAC,eACXC,KAAK,CAAC,WAAW,MAAMX,SACvBY,KAAK,CAAC,KACNT,GAAG;QACN,IAAIU,UAAU;QACd,KAAK,MAAMC,eAAeL,SAASM,IAAI,CAAE;gBACbD;YAA1B,IAAI,CAACT,UAAUW,GAAG,CAACC,QAAOH,mBAAAA,YAAYX,GAAG,CAAC,wBAAhBW,mBAAgC,MAAM;YAChE,yEAAyE;YACzE,wEAAwE;YACxE,6CAA6C;YAC7C,IAAIA,YAAYX,GAAG,CAAC,kBAAkB,MAAM;YAC5C,MAAMW,YAAYI,GAAG,CAClBC,GAAG,CAAC;gBAAEC,aAAaC,KAAKC,GAAG;gBAAIC,gBAAgBvB;YAAQ,GAAG;gBAAEwB,OAAO;YAAK,GACxEC,KAAK,CAAC,IAAMC;YACfb;QACF;QACA,IAAIA,UAAU,GAAG;YACf,MAAMd,SACH4B,MAAM,CAAC;gBACNC,UAAUtC,cAAcuC,SAAS,CAACC,UAAU,CAACC,UAAU,CAAC;oBACtDC,MAAMX,KAAKC,GAAG;oBACdW,OAAO;oBACPC,QACE,GAAGrB,QAAQ,YAAY,EAAEA,YAAY,IAAI,KAAK,IAAI,UAAU,CAAC,GAC7D,mEACA;gBACJ;YACF,GACCY,KAAK,CAAC,IAAMC;QACjB;QACA,OAAOb;IACT,EAAE,OAAOsB,OAAO;QACdC,QAAQD,KAAK,CAAC,iCAAiCnC,SAASmC;QACxD,OAAO;IACT;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAME,gBAAkC,OAAOC,KAAKC;QAO5BD,4BAM4BA,WACnCE,cACCA,eAqBrBF,MAAAA;IAnCF,IAAIA,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAAqB;IAC5D;IACA,IAAI,CAACS,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOP,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAA+B;IACtE;IACA,MAAMY,gBAAgB9B,QAAOqB,6BAAAA,IAAIU,OAAO,CAACD,aAAa,YAAzBT,6BAA6B;IAC1D,MAAMW,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpC1B;IACJ,IAAI,CAACuB,SAAS,OAAOV,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAER,OAAO;IAAkB;IACrE,MAAMK,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWa,KAAKC,KAAK,CAAChB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMiB,SAAStC,QAAOuB,eAAAA,KAAKe,MAAM,YAAXf,eAAe;IACrC,MAAMxC,UAAUiB,QAAOuB,gBAAAA,KAAKxC,OAAO,YAAZwC,gBAAgB;IACvC,MAAMgB,cAAchB,KAAKgB,WAAW,IAAI,OAAO,OAAOC,OAAOjB,KAAKgB,WAAW;IAC7E;;;;;GAKC,GACD,MAAME,mBAA6BC,MAAMC,OAAO,CAACpB,KAAKqB,WAAW,IAC7D;WACK,IAAIvD,IACL,AAACkC,KAAKqB,WAAW,CACdC,GAAG,CAAC,CAACC,QAAUC,KAAKC,KAAK,CAACR,OAAOM,SACjCG,MAAM,CAAC,CAACH,QAAUN,OAAOU,QAAQ,CAACJ,UAAUA,SAAS;KAE3D,CAACK,IAAI,CAAC,CAACC,GAAGC,IAAMD,IAAIC,KACrB,EAAE;IACN,sEAAsE;IACtE,0EAA0E;IAC1E,wBAAwB;IACxB,MAAMC,iBAAiBtD,QACrBqB,QAAAA,8BAAAA,IAAIU,OAAO,CAAC,kBAAkB,YAA9BV,8BAAkCA,IAAIU,OAAO,CAAC,kBAAkB,YAAhEV,OAAoE,IAEnEkC,IAAI,GACJrB,KAAK,CAAC,GAAG;IACZ,IAAI,CAACI,UAAU,CAACvD,SAAS;QACvB,OAAOuC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAA4B;IACnE;IAEA,IAAIsC,QAA4B;IAChC,IAAI;YAakBC,mBA6GDC,kBAwCjBA;QAjKF,MAAMC,UAAU,MAAMtF,cAAcuF,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAAC9B;QAC/D,MAAMpB,YAAYvC,cAAcuF,GAAG,GAAGhD,SAAS;QAC/C,MAAM/B,UAAU+B,UAAUnB,UAAU,CAAC,SAASsE,GAAG,CAACzB;QAClD,MAAMmB,eAAe,MAAM5E,QAAQK,GAAG;QACtC,IAAI,CAACuE,aAAaO,MAAM,EAAE;YACxB,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAe;QACtD;QACA,8DAA8D;QAC9D,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM+C,aAAa,EAACR,oBAAAA,aAAavE,GAAG,CAAC,0BAAjBuE,oBAAmC,CAAC,EAAE,CAACE,QAAQO,GAAG,CAAC;QACvE,IAAID,eAAe,SAAS;YAC1B,OAAO3C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAA+B;QACtE;QACA,sEAAsE;QACtE,EAAE;QACF,8DAA8D;QAC9D,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,+BAA+B;QAC/B,EAAE;QACF,kEAAkE;QAClE,qEAAqE;QACrE,0EAA0E;QAC1E,mEAAmE;QACnE,EAAE;QACF,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,oEAAoE;QACpE,MAAMiD,aAAa,MAAM5F,sBAAsBoF,QAAQO,GAAG,EAAE;YAAE5B;QAAO;QACrE,IAAI,CAAC6B,WAAWC,OAAO,IAAID,WAAWE,QAAQ,KAAK,SAAS;YAC1D,OAAO/C,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,OAAO;YAAkD;QACrE;QACA,MAAMpC,WAAWD,QAAQY,UAAU,CAAC,UAAUsE,GAAG,CAAChF;QAClD,MAAMuF,gBAAgB,MAAMxF,SAASI,GAAG;QACxC,IAAI,CAACoF,cAAcN,MAAM,EAAE;YACzB,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAgB;QACvD;QACA,MAAMwC,QAAQtF,cAAca,eAAe,CAACqF,cAAcnF,IAAI;QAE9D,yEAAyE;QACzE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,gEAAgE;QAChE,MAAMoF,WAAWjB,iBACb1C,UACGnB,UAAU,CAAC,kBACXsE,GAAG,CACFvF,WAAW,SACT,8DAA8D;QAC9D,8DAA8D;QAC9D,+DAA+D;SAC9DkC,MAAM,CAAC,CAAC,OAAO,EAAE4B,OAAO,CAAC,EAAEvD,QAAQ,CAAC,EAAEuE,gBAAgB,EACtDkB,MAAM,CAAC,UAEd;QACJ,IAAID,UAAU;YACZ,MAAME,QAAQ,MAAMF,SAASrF,GAAG;YAChC,MAAMwF,gBAAgBD,MAAMvF,GAAG,CAAC;YAChC,IAAIwF,eAAe;oBAEAD;gBADjB,OAAOnD,IACJG,MAAM,CAACe,QAAOiC,aAAAA,MAAMvF,GAAG,CAAC,6BAAVuF,aAA+B,MAC7C/C,IAAI,CAACgD;YACV;QACF;QAEA,IAAI,CAACtG,cAAcuG,kBAAkB,CAACjB,MAAMjC,MAAM,EAAE,aAAa;YAC/D,OAAOH,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,OAAO,CAAC,WAAW,EAAEwC,MAAMjC,MAAM,CAAC,eAAe,CAAC;YAAC;QAC/D;QACA,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,wCAAwC;QACxC,IAAIrD,cAAcwG,wBAAwB,CAAClB,QAAQ;YACjD,OAAOpC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BR,OACE,iEACA,qEACA,oEACA,mEACA;YACJ;QACF;QACA,qEAAqE;QACrE,cAAc;QACd,EAAE;QACF,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,mDAAmD;QACnD,EAAE;QACF,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,0CAA0C;QAC1C,MAAM2D,cAAanB,mBAAAA,MAAMoB,SAAS,YAAfpB,mBAAmB,EAAE;QACxC,MAAMqB,cAActC,iBAAiBuC,IAAI,CACvC,CAACC,QAAUA,SAASJ,WAAW1C,MAAM;QAEvC,IAAI4C,eAAe,MAAM;YACvB,OAAOzD,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,OAAO,CAAC,KAAK,EAAE6D,YAAY,qBAAqB,CAAC;YAAC;QAC9D;QACA,mDAAmD;QACnD,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,mEAAmE;QACnE,MAAMG,kBAAkB9G,cAAc+G,oBAAoB,CACxDzB,OACAjB;QAEF,IACEA,iBAAiBN,MAAM,GAAG,KAC1BI,eAAe,QACfQ,KAAKC,KAAK,CAACT,eAAe2C,iBAC1B;YACA,OAAO5D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BR,OACE,gEACA,+DACA;YACJ;QACF;QACA,MAAMkE,mBACJ1B,yBAAAA,MAAM0B,eAAe,YAArB1B,yBACA,iEAAiE;QACjE,kCAAkC;QACjC,MAAM,AAAC,CAAA;YACN,MAAM2B,WAAW,MAAMC,MACrB,CAAC,4CAA4C,EAAEvG,SAAS,EACxD;gBACEgD,SAAS;oBACPwD,eAAe,CAAC,OAAO,EAAE5D,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBAC1D;YACF;YAEF,MAAM2D,UAAU,MAAMH,SAAS3D,IAAI;YACnC,OAAO2D,SAASI,EAAE,GAAGD,2BAAAA,QAASE,cAAc,GAAG;QACjD,CAAA;QACF,IAAI,CAACN,iBAAiB;YACpB,OAAO9D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAuB;QAC9D;QAEA,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,oDAAoD;QACpD,IAAIqD,UAAU;YACZ,MAAMoB,WAAW,MAAMrH,cAAcgE;YACrC,IAAI;;oBAEcqD;gBADhB,MAAMpB,SAASqB,MAAM,CAAC;oBACpBC,OAAO7F,gBAAO2F,6BAAAA,gBAAAA,SAAUG,GAAG,qBAAbH,cAAeI,EAAE,oBAAI,OAAO;oBAC1CzD;oBACAvD;oBACAiH,MAAM;oBACNvE,QAAQ;oBACRwE,WAAW5H,cAAcuC,SAAS,CAACC,UAAU,CAACqF,eAAe;oBAC7DC,aAAa/F,KAAKC,GAAG;oBACrB,iEAAiE;oBACjE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,wDAAwD;oBACxD+F,WAAWjI,MAAMkI,oBAAoB;gBACvC;YACF,EAAE,eAAM;gBACN,MAAM5B,QAAQ,MAAMF,SAASrF,GAAG;gBAChC,MAAMwF,gBAAgBD,MAAMvF,GAAG,CAAC;gBAChC,IAAIwF,eAAe;wBAEAD;oBADjB,OAAOnD,IACJG,MAAM,CAACe,QAAOiC,cAAAA,MAAMvF,GAAG,CAAC,6BAAVuF,cAA+B,MAC7C/C,IAAI,CAACgD;gBACV;gBACA,iEAAiE;gBACjE,8DAA8D;gBAC9D,OAAOpD,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;oBAAER,OAAO;gBAAyC;YAC5D;YACAsC,QAAQ;gBACN,mEAAmE;gBACnE,iEAAiE;gBACjE,iEAAiE;gBACjE,qCAAqC;gBACrC8C,WAAW/B,SAASwB,EAAE;gBACtBQ,QAAQ,OAAO9E,QAAQ+E;oBACrB,MAAMjC,SACHrE,GAAG,CACF;wBACEuB,QAAQ;wBACRgF,gBAAgBhF;wBAChB4D,UAAUmB;wBACVE,aAAatG,KAAKC,GAAG;oBACvB,GACA;wBAAEE,OAAO;oBAAK,GAEfC,KAAK,CAAC,IAAMC;gBACjB;gBACAkG,SAAS;oBACP,MAAMpC,SAASqC,MAAM,GAAGpG,KAAK,CAAC,IAAMC;gBACtC;YACF;QACF;QAEA,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,QAAQ;QACR,IAAIoG,cAAc;QAClB,IAAIC,aAAa;QACjB,MAAMlG,UAAUmG,cAAc,CAAC,OAAOC;gBAEjC,aAE6ChI,oBACjBA;gBADlBA;YAHb,MAAMA,QAAQZ,cAAca,eAAe,EACxC,QAAA,AAAC,CAAA,MAAM+H,YAAY9H,GAAG,CAACJ,SAAQ,EAAGK,IAAI,cAAtC,QAA4C,CAAC;YAEhD2H,sBAAa9H,gBAAAA,MAAMiI,MAAM,qBAAZjI,cAAc8H,UAAU,mBAAItE,QAAOxD,qBAAAA,MAAMuD,WAAW,YAAjBvD,qBAAqB;YACrE,MAAMkI,kBAAkB1E,QAAOxD,uBAAAA,MAAMmI,aAAa,YAAnBnI,uBAAuB;YACtD,MAAMoI,YAAYN,aAAaI;YAC/B,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,2CAA2C;YAC3C,MAAMG,QACJ9E,eAAe,OACXQ,KAAKC,KAAK,CAACT,eACXE,iBAAiBN,MAAM,GAAG,IACxB+C,kBACAkC;YACRP,cAAc9D,KAAKuE,GAAG,CAACD,OAAOD;YAC9B,IAAI,CAAEP,CAAAA,cAAc,CAAA,GAAI;gBACtBA,cAAc;gBACd;YACF;YACAG,YAAY9G,GAAG,CACbpB,UACA;gBAAEqI,eAAeD,kBAAkBL;YAAY,GAC/C;gBAAEtG,OAAO;YAAK;QAElB;QACA,IAAI,CAAEsG,CAAAA,cAAc,CAAA,GAAI;YACtB,oEAAoE;YACpE,OAAMrD,yBAAAA,MAAOmD,OAAO;YACpB,OAAOrF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAyB;QAChE;QACA,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,IAAIuB,iBAAiBN,MAAM,GAAG,KAAK0E,cAAc3B,iBAAiB;YAChE,MAAMtE,UACHmG,cAAc,CAAC,OAAOC;oBAEnB;gBADF,MAAMO,UAAU/E,QACd,OAAA,AAAC,CAAA,MAAMwE,YAAY9H,GAAG,CAACJ,SAAQ,EAAGI,GAAG,CAAC,4BAAtC,OAA0D;gBAE5D8H,YAAY9G,GAAG,CACbpB,UACA;oBAAEqI,eAAepE,KAAKyE,GAAG,CAAC,GAAGD,UAAUV;gBAAa,GACpD;oBAAEtG,OAAO;gBAAK;YAElB,GACCC,KAAK,CAAC,IAAMC;YACf,OAAM+C,yBAAAA,MAAOmD,OAAO;YACpB,OAAOrF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BR,OACE,CAAC,MAAM,EAAE,AAAC2F,CAAAA,cAAc,GAAE,EAAGY,OAAO,CAAC,GAAG,2BAA2B,CAAC,GACpE,CAAC,6CAA6C,EAAE,AAC9CvC,CAAAA,kBAAkB,GAAE,EACpBuC,OAAO,CAAC,GAAG,mDAAmD,CAAC;YACrE;QACF;QAEA,MAAMC,SAAS,IAAIC,gBAAgB;YACjCjC,gBAAgB1F,OAAOoF;YACvBwC,QAAQ5H,OAAO6G;YACfgB,kBAAkB;YAClBC,wBAAwB;QAC1B;QACA,MAAMzC,WAAW,MAAMC,MAAM,qCAAqC;YAChE9D,QAAQ;YACRO,SAAS;gBACPwD,eAAe,CAAC,OAAO,EAAE5D,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBACxD,gBAAgB;eACZ2B,CAAAA,yBAAAA,MAAO8C,SAAS,IAChB;gBAAE,mBAAmB9C,MAAM8C,SAAS;YAAC,IACrC,CAAC;YAEP/E,MAAMmG,OAAOK,QAAQ;QACvB;QACA,MAAMC,SAAS,MAAM3C,SAAS3D,IAAI;QAClC,IAAI,CAAC2D,SAASI,EAAE,EAAE;;gBAuBUuC,eAcTA;YApCjB7G,QAAQD,KAAK,CAAC,uBAAuB8G,0BAAAA,OAAQ9G,KAAK;YAClD,uEAAuE;YACvE,2CAA2C;YAC3C,MAAMN,UACHmG,cAAc,CAAC,OAAOC;oBAEnB;gBADF,MAAMO,UAAU/E,QACd,OAAA,AAAC,CAAA,MAAMwE,YAAY9H,GAAG,CAACJ,SAAQ,EAAGI,GAAG,CAAC,4BAAtC,OAA0D;gBAE5D8H,YAAY9G,GAAG,CACbpB,UACA;oBAAEqI,eAAepE,KAAKyE,GAAG,CAAC,GAAGD,UAAUV;gBAAa,GACpD;oBAAEtG,OAAO;gBAAK;YAElB,GACCC,KAAK,CAAC,IAAMC;YACf,OAAM+C,yBAAAA,MAAOmD,OAAO;YACpB,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,MAAMsB,aAAajI,gBAAOgI,2BAAAA,gBAAAA,OAAQ9G,KAAK,qBAAb8G,cAAeE,IAAI,oBAAI;YACjD,IACED,eAAe,qBACfA,eAAe,2BACf;gBACA,OAAO3G,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BR,OACE,gEACA,kEACA;gBACJ;YACF;YACA,OAAOI,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,KAAK,WAAE8G,2BAAAA,iBAAAA,OAAQ9G,KAAK,qBAAb8G,eAAeG,OAAO,oBAAI;YAAgB;QAC7D;QAEA,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,IAAIhB,gBAAgB;QACpB,IAAIiB,gBAAgB;QACpB,IAAIC,iBAAiB;QACrB,MAAMzH,UAAUmG,cAAc,CAAC,OAAOC;gBAEjC,OAEoBhI;YAHvB,MAAMA,QAAQZ,cAAca,eAAe,EACxC,QAAA,AAAC,CAAA,MAAM+H,YAAY9H,GAAG,CAACJ,SAAQ,EAAGK,IAAI,cAAtC,QAA4C,CAAC;YAEhDgI,gBAAgB3E,QAAOxD,uBAAAA,MAAMmI,aAAa,YAAnBnI,uBAAuB;YAC9CoJ,gBAAgBjB,iBAAiBL;YACjC,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,qEAAqE;YACrEuB,iBAAiBD,iBAAiBpJ,MAAMyC,MAAM,KAAK;YACnDuF,YAAY9G,GAAG,CACbpB,UACA,aACMsJ,gBAAgB;gBAAE3G,QAAQ;YAAW,IAAI,CAAC,GAM1CgB,iBAAiBN,MAAM,GAAG,IAC1B;gBACEmG,qBACEjK,cAAcuC,SAAS,CAACC,UAAU,CAACC,UAAU,IACxC2B;YAET,IACA,CAAC;gBACL9B,UAAUvC,cAAcmK,gBAAgB,CACtCvJ,OACA,UACA,CAAC,CAAC,EAAE,AAAC6H,CAAAA,cAAc,GAAE,EAAGY,OAAO,CAAC,GAAG,SAAS,CAAC,GAC1CW,CAAAA,gBACG,YACA3F,iBAAiBN,MAAM,GAAG,IACxB,CAAC,GAAG,EAAEM,iBAAiBN,MAAM,CAAC,KAAK,EACjCM,iBAAiBN,MAAM,KAAK,IAAI,KAAK,IACtC,UAAU,CAAC,GACZ,2CAA0C;gBAGtD;gBAAE5B,OAAO;YAAK;QAElB;QACA,MAAMiG,UAAU;YAAEW;YAAeiB;QAAc;QAC/C,OAAM5E,yBAAAA,MAAO+C,MAAM,CAAC,KAAKC;QACzB,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,0BAA0B;QAC1B,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,mDAAmD;QACnD,MAAM5H,kBAAkBC,SAASC,UAAUC;QAC3C,yEAAyE;QACzE,2EAA2E;QAC3E,6CAA6C;QAC7C,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,wEAAwE;QACxE,uDAAuD;QACvD,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAMN,oBAAoB;YACxB6D;YACAvD;YACAyJ,OAAO9E,MAAM+E,aAAa;YAC1BlG,aAAasE;YACbwB;QACF;QACA;;;;;;;;;;;;;;;;KAgBC,GACD,MAAM1J,8BAA8B;YAClC2D;YACAvD;YACAwD,aAAasE;YACbwB;QACF;QACA,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM3J,iBAAiB;YAAE4D;YAAQvD;YAASiH,MAAM;YAAUqC;QAAe;QACzE,OAAO/G,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC8E;IAC9B,EAAE,OAAOtF,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,uEAAuE;QACvE,wEAAwE;QACxE,iEAAiE;QACjE,2EAA2E;QAC3E,8DAA8D;QAC9D,OAAOI,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAAgB;IACvD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/refund.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { createHash } from 'crypto'\nimport { recordContactRefund } from './contact-refund'\nimport { flagOrderRestock } from './restock-flag'\n// Leaf import, not the barrel, for the reason `contact-refund.ts` states about\n// `updateExisting`: the specs in this library mock `@aglyn/tenant-data-admin`\n// wholesale, and a permissive stub would turn a reversal that never happened\n// green.\nimport { reverseEmailAttributedRevenue } from '@aglyn/tenant-data-admin/server/email-revenue-attribution'\n\n/**\n * A claim on one refund attempt (AGL-1696), the same primitive the POS sale\n * path uses (AGL-1691, `cab8aa36e`).\n */\ninterface RefundClaim {\n  /** Stripe idempotency key for this attempt, or null when no key was sent. */\n  stripeKey: string | null\n  record: (status: number, body: unknown) => Promise<void>\n  release: () => Promise<void>\n}\n\n/**\n * Retires the licence keys a refund withdrew (AGL-2454).\n *\n * Reads the order back so the decision is made from what actually SETTLED\n * rather than from what this request asked for — a concurrent partial may have\n * closed a line between the two — and retires only the keys of products the\n * order no longer entitles at all. `refundedProductIds` is deliberately strict\n * about that: a buyer who returned one of two copies still holds the product,\n * so nothing is retired for them.\n *\n * `revokedAtMs` with `assignedAtMs` left standing is the retired state. Keeping\n * `assignedAtMs` matters: `assignLicenseKeys` claims from\n * `where('assignedAtMs','==',null)`, so clearing it would put the key straight\n * back in front of the next buyer — the reissue this must not do.\n *\n * Swallows everything. The refund has already moved money.\n */\nasync function retireLicenseKeys(\n  hostRef: FirebaseFirestore.DocumentReference,\n  orderRef: FirebaseFirestore.DocumentReference,\n  orderId: string,\n): Promise<number> {\n  try {\n    const fresh = CommerceModel.liftLegacyOrder(\n      ((await orderRef.get()).data() ?? {}) as any,\n    )\n    const withdrawn = new Set(CommerceModel.refundedProductIds(fresh))\n    if (withdrawn.size === 0) return 0\n    const assigned = await hostRef\n      .collection('licenseKeys')\n      .where('orderId', '==', orderId)\n      .limit(500)\n      .get()\n    let retired = 0\n    for (const keySnapshot of assigned.docs) {\n      if (!withdrawn.has(String(keySnapshot.get('productId') ?? ''))) continue\n      // Already retired by an earlier partial, or by the merchant's own Revoke\n      // button. Skipped so a second refund does not restamp the timestamp and\n      // make the retirement look newer than it is.\n      if (keySnapshot.get('revokedAtMs') != null) continue\n      await keySnapshot.ref\n        .set({ revokedAtMs: Date.now(), revokedOrderId: orderId }, { merge: true })\n        .catch(() => undefined)\n      retired++\n    }\n    if (retired > 0) {\n      await orderRef\n        .update({\n          timeline: firebaseAdmin.firestore.FieldValue.arrayUnion({\n            atMs: Date.now(),\n            event: 'license-retired',\n            detail:\n              `${retired} license key${retired === 1 ? '' : 's'} retired. ` +\n              'The buyer already holds the key string, so it is not returned ' +\n              'to the pool — reissuing it would give two people one secret.',\n          }),\n        })\n        .catch(() => undefined)\n    }\n    return retired\n  } catch (error) {\n    console.error('License key retirement failed', orderId, error)\n    return 0\n  }\n}\n\n/**\n * Order refunds (AGL-287): full or partial via Stripe, site-admin only\n * (it moves money). Destination charges reverse the transfer and the\n * platform fee proportionally. Full refunds transition the order to\n * `refunded`; partial refunds accumulate `refundedCents` and stay in\n * the current status.\n *\n * Two SEPARATE controls guard the money (AGL-1696), and conflating them is\n * how the original went wrong:\n *\n *  - The idempotency key stops a DUPLICATE refund — one attempt sent twice\n *    because the response was lost, the admin double-clicked, or a client\n *    retried. It is minted per attempt by the console and deliberately not\n *    derived from the order or the amount: two $10 refunds on a $50 order are\n *    two real refunds, exactly as a cashier ringing the same coffee twice is a\n *    real second sale.\n *  - The cap stops an OVER-refund — several partials summing past what was\n *    captured, including two admins refunding at once, where the two attempts\n *    are genuinely distinct and no key can help. That needs the counter read\n *    and written inside one transaction.\n *\n * The original had a cap that looked like both and was neither: it read\n * `refundedCents` and wrote it back only AFTER the Stripe call, outside any\n * transaction. A guard that reads state the guarded operation writes too late\n * is not a guard — measured, two concurrent refunds each sent a full $50 to\n * Stripe with no idempotency header on either.\n */\nexport const refundHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return res.status(501).json({ error: 'Payments are not configured.' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const orderId = String(body.orderId ?? '')\n  const amountCents = body.amountCents == null ? null : Number(body.amountCents)\n  /**\n   * Lines the admin is refunding BY NAME (AGL-2454), and therefore the lines\n   * whose digital entitlements come back. Optional: an amount-only refund is\n   * still a legal refund and still revokes nothing per-line — see the guard\n   * below for why that is a decision rather than an oversight.\n   */\n  const requestedLineIds: number[] = Array.isArray(body.lineItemIds)\n    ? [\n        ...new Set(\n          (body.lineItemIds as unknown[])\n            .map((value) => Math.round(Number(value)))\n            .filter((value) => Number.isFinite(value) && value >= 0),\n        ),\n      ].sort((a, b) => a - b)\n    : []\n  // One refund attempt, minted by the console. Node lowercases incoming\n  // headers, but read both spellings — the plugin API request type makes no\n  // promise about casing.\n  const idempotencyKey = String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n  if (!hostId || !orderId) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n\n  let claim: RefundClaim | null = null\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // TWO CHECKS, and they answer different questions (AGL-2372).\n    //\n    // The first is the HOST-level fact the Firestore rules also enforce, and\n    // it stays: `memberRoles` is the projection the rules read, so dropping it\n    // here would let this route and the database disagree.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin') {\n      return res.status(403).json({ error: 'Refunds require a site admin' })\n    }\n    // The second is WHOSE admin, and it is the one this gate was missing.\n    //\n    // `memberRoles` is a per-host projection of `hostAccess`, and\n    // `/api/hosts/members` will grant a SITE COLLABORATOR `admin` on one site\n    // (`hostAccess: { [hostId]: 'admin' }`, `allHosts: false`). That writes the\n    // literal string `'admin'` into `memberRoles[uid]` — byte-identical to an\n    // org owner's. So the check above cannot tell a contractor invited to run\n    // one microsite from the person who owns the business, and refunding is\n    // money leaving that business.\n    //\n    // `orgWide` is the discriminator, and it needs no new role: it is\n    // `isOrgWideMember` (AGL-1026) — owner/admin of the org, an explicit\n    // `allHosts` member, or the legacy pre-`allHosts` shape — and it is false\n    // for every scoped collaborator. Same pairing `pos-order.ts` uses.\n    //\n    // BOTH halves are required. `hostRole` is re-tested rather than assumed\n    // from `memberRole`: an org-wide member can still be scoped down to\n    // `editor` on this host, and `resolveOrgPermissions` is the resolver that\n    // knows it. It fails CLOSED on a lookup error when a host is named\n    // (AGL-506), and `denied()` returns `orgWide: false` / `hostRole: null`,\n    // so an absent membership refuses rather than folding to permitted.\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.orgWide || membership.hostRole !== 'admin') {\n      return res\n        .status(403)\n        .json({ error: 'Refunds require an admin of the whole workspace' })\n    }\n    const orderRef = hostRef.collection('orders').doc(orderId)\n    const orderSnapshot = await orderRef.get()\n    if (!orderSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown order' })\n    }\n    const order = CommerceModel.liftLegacyOrder(orderSnapshot.data() as any)\n\n    // Replay a settled attempt before anything else can reject it. This read\n    // is only a short-circuit, never the dedupe primitive — the atomic\n    // `create()` below is. It has to run ahead of the status guard because a\n    // retried FULL refund would otherwise be answered \"orders in refunded\n    // cannot refund\", which is the right money outcome reported as a failure,\n    // and an admin who reads it as a failure refunds again by hand.\n    const claimRef = idempotencyKey\n      ? firestore\n          .collection('apiIdempotency')\n          .doc(\n            createHash('sha256')\n              // Scoped by the order, so a client that reused one key across\n              // two orders cannot dedupe two legitimately distinct refunds.\n              // NOT by the amount: that would swallow a real second partial.\n              .update(`refund:${hostId}:${orderId}:${idempotencyKey}`)\n              .digest('hex'),\n          )\n      : null\n    if (claimRef) {\n      const prior = await claimRef.get()\n      const priorResponse = prior.get('response')\n      if (priorResponse) {\n        return res\n          .status(Number(prior.get('responseStatus') ?? 200))\n          .json(priorResponse)\n      }\n    }\n\n    if (!CommerceModel.canTransitionOrder(order.status, 'refunded')) {\n      return res\n        .status(409)\n        .json({ error: `Orders in \"${order.status}\" cannot refund` })\n    }\n    // A refund does not withdraw a dispute (AGL-1809). While a chargeback is\n    // formally open the bank has already pulled the disputed funds, Stripe's\n    // refund API refuses the charge (`charge_disputed`), and a refund that did\n    // go through would pay the shopper twice — the merchant loses the refund\n    // AND the dispute plus its fee. Refused HERE, before the claim and the\n    // reservation, so a refusal burns no idempotency key and strands nothing:\n    // no state has been written yet (AGL-1754's contract). An open INQUIRY\n    // (`warning_*`) deliberately passes — no funds have moved and Stripe names\n    // a full refund as the way to resolve one before it escalates — and the\n    // status guard above already turns away a LOST dispute, which parked the\n    // order in `refunded`. This reads the pre-transaction snapshot; a dispute\n    // webhook racing this exact request is caught by the `charge_disputed`\n    // mapping on the Stripe response below.\n    if (CommerceModel.orderDisputeBlocksRefund(order)) {\n      return res.status(409).json({\n        error:\n          'A chargeback is open on this order, so it was not refunded. ' +\n          'Refunding would not withdraw the dispute — the bank has already ' +\n          'taken the disputed amount, and a refund on top of it would pay ' +\n          'the shopper twice. Respond to the dispute or accept it in the ' +\n          'Stripe dashboard; refund any remainder once it settles.',\n      })\n    }\n    // WHAT THE NAMED LINES ARE WORTH, AND WHY THE AMOUNT MAY NOT BE LESS\n    // (AGL-2454).\n    //\n    // A refund carries an amount, not lines — that is the blocker this issue\n    // names, and `restock-flag.ts:48-55` already records it for stock. It\n    // cannot be solved by inference: deciding for the merchant which lines a\n    // bare figure covers would be a guess about their goods. It CAN be solved\n    // by asking, which is what naming lines does, and the amount is then\n    // derived from them rather than typed beside them.\n    //\n    // An explicit `amountCents` may still be LARGER (the admin is refunding the\n    // line plus its share of tax or shipping, which this items-only sum does\n    // not include). It may not be SMALLER: revoking a line the refund did not\n    // actually cover is the silent over-revocation this issue forbids in the\n    // same breath as silent under-revocation.\n    const orderLines = order.lineItems ?? []\n    const invalidLine = requestedLineIds.find(\n      (index) => index >= orderLines.length,\n    )\n    if (invalidLine != null) {\n      return res\n        .status(400)\n        .json({ error: `Line ${invalidLine} is not on this order` })\n    }\n    // NET OF THE ORDER'S DISCOUNT, not the list price.\n    //\n    // This was the bare `unitAmountCents x quantity`, which is what the line\n    // was LISTED at rather than what the buyer paid for it. On a discounted\n    // order the two differ, and both directions of the error land on the\n    // merchant: a $10 coupon over two $50 lines means each line cost $45, so\n    // refunding one at $50 gave back $5 that was never taken, and the order\n    // then held less than its remaining line was worth — so the second line\n    // refund hit the cap below and was refused outright, leaving the merchant\n    // unable to finish a refund they had already half-issued.\n    //\n    // `orderLineRefundCents` apportions the discount across every line by list\n    // value and returns the named lines' share, so refunding all of them sums\n    // to exactly what was charged and no cent is stranded or invented.\n    const namedLinesCents = CommerceModel.orderLineRefundCents(\n      order,\n      requestedLineIds,\n    )\n    if (\n      requestedLineIds.length > 0 &&\n      amountCents != null &&\n      Math.round(amountCents) < namedLinesCents\n    ) {\n      return res.status(400).json({\n        error:\n          'That amount is less than the lines you selected are worth. ' +\n          'Refund the full value of those lines, or refund an amount ' +\n          'without selecting lines.',\n      })\n    }\n    const paymentIntentId =\n      order.paymentIntentId ??\n      // Legacy rows stored the checkout session as the doc id; resolve\n      // the payment intent from Stripe.\n      (await (async () => {\n        const response = await fetch(\n          `https://api.stripe.com/v1/checkout/sessions/${orderId}`,\n          {\n            headers: {\n              Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n            },\n          },\n        )\n        const session = await response.json()\n        return response.ok ? session?.payment_intent : null\n      })())\n    if (!paymentIntentId) {\n      return res.status(409).json({ error: 'No payment to refund' })\n    }\n\n    // Point of no return: everything past here moves money. The claim is\n    // `create()` — Firestore rejects a create on an existing document, and\n    // that rejection IS the dedupe primitive. A read-then-write would race\n    // exactly the double-submit it exists to stop. Storage reuses the REST\n    // API's shape and its `orgId` field (AGL-618) rather than inventing a\n    // second replay store, so `eraseOrgIdempotencyKeys` (AGL-1448) already\n    // sweeps these on org erasure with no change there.\n    if (claimRef) {\n      const ownerOrg = await getOrgForHost(hostId)\n      try {\n        await claimRef.create({\n          orgId: String(ownerOrg?.org?.id ?? '') || null,\n          hostId,\n          orderId,\n          kind: 'commerce-refund',\n          status: 'pending',\n          createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n          createdAtMs: Date.now(),\n          // The second writer into `apiIdempotency` (AGL-1978). The shared\n          // `claimAttempt` stamps this too; this local copy has to as well,\n          // or refund claims are the one shape the TTL policy silently never\n          // reaches — a policy that governs most of a collection reads, from\n          // the outside, exactly like one that governs all of it.\n          expiresAt: Aglyn.apiIdempotencyExpiry(),\n        })\n      } catch {\n        const prior = await claimRef.get()\n        const priorResponse = prior.get('response')\n        if (priorResponse) {\n          return res\n            .status(Number(prior.get('responseStatus') ?? 200))\n            .json(priorResponse)\n        }\n        // In flight, or stranded by a process that died mid-refund. Fail\n        // CLOSED: the alternative is sending the money a second time.\n        return res\n          .status(409)\n          .json({ error: 'This refund is already being processed' })\n      }\n      claim = {\n        // The same digest goes to Stripe. That is the half that costs real\n        // money: it covers the window where our claim is written but the\n        // response never arrives, and makes Stripe replay its own refund\n        // instead of moving the funds again.\n        stripeKey: claimRef.id,\n        record: async (status, payload) => {\n          await claimRef\n            .set(\n              {\n                status: 'done',\n                responseStatus: status,\n                response: payload,\n                settledAtMs: Date.now(),\n              },\n              { merge: true },\n            )\n            .catch(() => undefined)\n        },\n        release: async () => {\n          await claimRef.delete().catch(() => undefined)\n        },\n      }\n    }\n\n    // RESERVE. The cap is read and written in one transaction, so two\n    // concurrent refunds cannot both see the same `refundedCents` — which is\n    // the whole failure the old ordering had, since it wrote the counter only\n    // after Stripe had already been asked to move the money. Reserving BEFORE\n    // the call rather than after also fails in the safe direction: a lost\n    // response leaves the amount counted, so the retry refunds less, never\n    // more.\n    let refundCents = 0\n    let totalCents = 0\n    await firestore.runTransaction(async (transaction) => {\n      const fresh = CommerceModel.liftLegacyOrder(\n        ((await transaction.get(orderRef)).data() ?? {}) as any,\n      )\n      totalCents = fresh.totals?.totalCents ?? Number(fresh.amountCents ?? 0)\n      const alreadyRefunded = Number(fresh.refundedCents ?? 0)\n      const remaining = totalCents - alreadyRefunded\n      // Named lines with no amount refund exactly what those lines are worth;\n      // named lines WITH an amount use the amount (already guarded above as\n      // no smaller than the lines). Neither is the whole order, which is what\n      // `amountCents == null` alone still means.\n      const asked =\n        amountCents != null\n          ? Math.round(amountCents)\n          : requestedLineIds.length > 0\n            ? namedLinesCents\n            : remaining\n      refundCents = Math.min(asked, remaining)\n      if (!(refundCents > 0)) {\n        refundCents = 0\n        return\n      }\n      transaction.set(\n        orderRef,\n        { refundedCents: alreadyRefunded + refundCents },\n        { merge: true },\n      )\n    })\n    if (!(refundCents > 0)) {\n      // Nothing moved, so the attempt key is released rather than burned.\n      await claim?.release()\n      return res.status(400).json({ error: 'Nothing left to refund' })\n    }\n    // The cap bit into the named lines (AGL-2454): earlier partials have left\n    // less on this order than the selected lines are worth. REFUSED rather\n    // than refunded-and-revoked, because revoking a line for less than its\n    // value is precisely the silent over-revocation this issue forbids. The\n    // reservation is given back — the same compensation a Stripe refusal does\n    // below, and for the same reason: nothing has left the account yet.\n    if (requestedLineIds.length > 0 && refundCents < namedLinesCents) {\n      await firestore\n        .runTransaction(async (transaction) => {\n          const current = Number(\n            (await transaction.get(orderRef)).get('refundedCents') ?? 0,\n          )\n          transaction.set(\n            orderRef,\n            { refundedCents: Math.max(0, current - refundCents) },\n            { merge: true },\n          )\n        })\n        .catch(() => undefined)\n      await claim?.release()\n      return res.status(409).json({\n        error:\n          `Only $${(refundCents / 100).toFixed(2)} is left to refund on this ` +\n          `order, and the lines you selected are worth $${(\n            namedLinesCents / 100\n          ).toFixed(2)}. Refund an amount without selecting lines instead.`,\n      })\n    }\n\n    const params = new URLSearchParams({\n      payment_intent: String(paymentIntentId),\n      amount: String(refundCents),\n      reverse_transfer: 'true',\n      refund_application_fee: 'true',\n    })\n    const response = await fetch('https://api.stripe.com/v1/refunds', {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n        'Content-Type': 'application/x-www-form-urlencoded',\n        ...(claim?.stripeKey\n          ? { 'Idempotency-Key': claim.stripeKey }\n          : {}),\n      },\n      body: params.toString(),\n    })\n    const refund = await response.json()\n    if (!response.ok) {\n      console.error('Stripe refund error', refund?.error)\n      // Stripe said no, so we KNOW no money moved: give the reservation back\n      // and let the same attempt be tried again.\n      await firestore\n        .runTransaction(async (transaction) => {\n          const current = Number(\n            (await transaction.get(orderRef)).get('refundedCents') ?? 0,\n          )\n          transaction.set(\n            orderRef,\n            { refundedCents: Math.max(0, current - refundCents) },\n            { merge: true },\n          )\n        })\n        .catch(() => undefined)\n      await claim?.release()\n      // Stripe refusing BECAUSE OF A DISPUTE is the guard above arriving by\n      // the other door — our order document simply didn't know yet (webhook\n      // lag, or an order from before disputes were subscribed at all). Same\n      // answer, same accuracy: a 409 naming the dispute, not a 502 reading\n      // \"The charge you're attempting to refund has been charged back\", which\n      // an admin has no reason to connect to the Refund button they pressed.\n      const stripeCode = String(refund?.error?.code ?? '')\n      if (\n        stripeCode === 'charge_disputed' ||\n        stripeCode === 'refund_disputed_payment'\n      ) {\n        return res.status(409).json({\n          error:\n            'Stripe refused this refund because the charge is disputed. ' +\n            'Respond to the dispute or accept it in the Stripe dashboard; ' +\n            'refund any remainder once it settles.',\n        })\n      }\n      return res\n        .status(502)\n        .json({ error: refund?.error?.message ?? 'Refund failed' })\n    }\n\n    // SETTLE. Re-read inside the transaction: a concurrent partial may have\n    // reserved against the same order, and the timeline must be appended to\n    // whatever is there now rather than to the snapshot read at the top.\n    let refundedCents = 0\n    let fullyRefunded = false\n    let closedTheOrder = false\n    await firestore.runTransaction(async (transaction) => {\n      const fresh = CommerceModel.liftLegacyOrder(\n        ((await transaction.get(orderRef)).data() ?? {}) as any,\n      )\n      refundedCents = Number(fresh.refundedCents ?? 0)\n      fullyRefunded = refundedCents >= totalCents\n      // Whether THIS settle moved the order into `refunded`, which is not the\n      // same question as whether the order is now fully refunded (AGL-1754).\n      // Two partials that between them close an order can both reserve before\n      // either settles, so both re-read the completed total and both compute\n      // `fullyRefunded`. Writing `status: 'refunded'` twice is harmless;\n      // incrementing a count twice is not. Reading the status inside the same\n      // transaction that writes it makes the flip observable exactly once.\n      closedTheOrder = fullyRefunded && fresh.status !== 'refunded'\n      transaction.set(\n        orderRef,\n        {\n          ...(fullyRefunded ? { status: 'refunded' } : {}),\n          // The entitlement withdrawal, recorded WITH the money (AGL-2454).\n          // `arrayUnion` rather than a written-back array: two admins refunding\n          // different lines at once must not erase each other's, and this\n          // transaction re-reads the order but a written array would still lose\n          // a concurrent settle that committed between the two.\n          ...(requestedLineIds.length > 0\n            ? {\n                refundedLineItemIds:\n                  firebaseAdmin.firestore.FieldValue.arrayUnion(\n                    ...requestedLineIds,\n                  ),\n              }\n            : {}),\n          timeline: CommerceModel.appendOrderEvent(\n            fresh,\n            'refund',\n            `$${(refundCents / 100).toFixed(2)} refunded` +\n              (fullyRefunded\n                ? ' (full)'\n                : requestedLineIds.length > 0\n                  ? ` — ${requestedLineIds.length} line${\n                      requestedLineIds.length === 1 ? '' : 's'\n                    } withdrawn`\n                  : ' — refunded by amount, no lines withdrawn'),\n          ),\n        },\n        { merge: true },\n      )\n    })\n    const payload = { refundedCents, fullyRefunded }\n    await claim?.record(200, payload)\n    // LICENCE KEYS ARE RETIRED, NEVER RETURNED TO THE POOL (AGL-2454).\n    //\n    // `assignLicenseKeys` stamps `assignedAtMs`, `orderId` and `email` onto a\n    // pool document and nothing anywhere ever set them back — so a refunded\n    // order consumed the merchant's key forever, and a merchant who sold one\n    // key out of a hundred and refunded it had ninety-nine, permanently.\n    //\n    // Returning it to the pool is NOT the fix, and this is the decision the\n    // issue asked for: the key string was mailed in the receipt and cannot be\n    // invalidated by anything we own, so re-issuing it to the next paying\n    // customer would hand two people one working secret. That is worse than\n    // losing the key. A third state — retired: neither assigned to a live order\n    // nor available — is the honest record, and `revokedAtMs` already IS that\n    // state: the console's key dialog has written exactly this pair since it\n    // shipped, so this reuses the merchant's own vocabulary rather than\n    // inventing a second one.\n    //\n    // Best-effort and after the response is recorded, matching the contact and\n    // restock ledgers below: the money has moved and nothing here may fail a\n    // refund that already left the merchant's account.\n    await retireLicenseKeys(hostRef, orderRef, orderId)\n    // The customer's side of the ledger (AGL-1754). Everything above records\n    // the money on the ORDER; without this the buyer's `ltvCents` still counts\n    // a sale they returned, and only ever rises.\n    //\n    // Placed AFTER the attempt is recorded so a slow contacts write cannot\n    // strand the claim: a retry that arrives while this is in flight replays\n    // the recorded 200 instead of being turned away with \"already being\n    // processed\". Awaited rather than fired off with `void` — the handler is\n    // serverless, and work left running past the response is work the\n    // container may be frozen before it finishes. `recordContactRefund`\n    // swallows its own failures, so awaiting adds no way for this to fail a\n    // refund that has already left the merchant's account.\n    //\n    // Amount is THIS attempt's `refundCents`, already capped against what was\n    // left, so several partials sum to at most the order total — the same\n    // number the order's own `refundedCents` follows. The retried and racing\n    // cases need no key of their own: a keyed retry never reaches here (it\n    // replays at the claim), and a keyless one is a genuinely new refund that\n    // moved more money and should be counted.\n    await recordContactRefund({\n      hostId,\n      orderId,\n      email: order.customerEmail,\n      amountCents: refundCents,\n      closedTheOrder,\n    })\n    /*\n     * The campaign's side of the same ledger.\n     *\n     * If a campaign was credited with this order, that credit is now partly\n     * or wholly wrong — a campaign cannot go on being paid for a sale the\n     * merchant reversed, and revenue attribution that only ever rises is the\n     * flattering half of a measurement. Recorded beside the gross rather than\n     * subtracted from it, for the reason `recordContactRefund` above records\n     * `refundedCents` beside `ltvCents`.\n     *\n     * Keyed by the ORDER and not by the buyer, so it needs no email and works\n     * for a guest checkout: the attribution record holds which campaign and\n     * which currency, and this reads them back. Same placement, same\n     * swallow-all contract and same awaited call as the two ledgers around\n     * it — nothing here may fail a refund that has already left the\n     * merchant's account.\n     */\n    await reverseEmailAttributedRevenue({\n      hostId,\n      orderId,\n      amountCents: refundCents,\n      closedTheOrder,\n    })\n    // The shelf's side of the ledger (AGL-1797). The sale decremented variant\n    // inventory and nothing put it back, so a fully refunded order read one\n    // unit light forever. This FLAGS rather than releases — a refund with no\n    // return leaves the goods gone, and inventing stock the merchant does not\n    // have is worse than under-counting it — and the merchant answers from the\n    // stock adjustment they already have. Same placement and same swallow-all\n    // contract as the contact write above, for the same reason: the money has\n    // moved and the order records it, so nothing here may fail the refund.\n    await flagOrderRestock({ hostId, orderId, kind: 'refund', closedTheOrder })\n    return res.status(200).json(payload)\n  } catch (error) {\n    console.error(error)\n    // Deliberately NOT released, which is where this diverges from the POS\n    // sale path (AGL-1691). If the refund call threw we do not know whether\n    // Stripe moved the money, and the two failure directions are not\n    // symmetric: a stranded key costs a support ticket, a released one costs a\n    // second refund. The retry gets a 409 and a human reconciles.\n    return res.status(500).json({ error: 'Refund failed' })\n  }\n}\n"],"names":["Aglyn","CommerceModel","firebaseAdmin","getOrgForHost","resolveOrgPermissions","createHash","recordContactRefund","flagOrderRestock","reverseEmailAttributedRevenue","retireLicenseKeys","hostRef","orderRef","orderId","fresh","liftLegacyOrder","get","data","withdrawn","Set","refundedProductIds","size","assigned","collection","where","limit","retired","keySnapshot","docs","has","String","ref","set","revokedAtMs","Date","now","revokedOrderId","merge","catch","undefined","update","timeline","firestore","FieldValue","arrayUnion","atMs","event","detail","error","console","refundHandler","req","res","body","method","status","json","process","env","STRIPE_SECRET_KEY","authorization","headers","idToken","startsWith","slice","length","JSON","parse","hostId","amountCents","Number","requestedLineIds","Array","isArray","lineItemIds","map","value","Math","round","filter","isFinite","sort","a","b","idempotencyKey","trim","claim","hostSnapshot","order","decoded","app","auth","verifyIdToken","doc","exists","memberRole","uid","membership","orgWide","hostRole","orderSnapshot","claimRef","digest","prior","priorResponse","canTransitionOrder","orderDisputeBlocksRefund","orderLines","lineItems","invalidLine","find","index","namedLinesCents","orderLineRefundCents","paymentIntentId","response","fetch","Authorization","session","ok","payment_intent","ownerOrg","create","orgId","org","id","kind","createdAt","serverTimestamp","createdAtMs","expiresAt","apiIdempotencyExpiry","stripeKey","record","payload","responseStatus","settledAtMs","release","delete","refundCents","totalCents","runTransaction","transaction","totals","alreadyRefunded","refundedCents","remaining","asked","min","current","max","toFixed","params","URLSearchParams","amount","reverse_transfer","refund_application_fee","toString","refund","stripeCode","code","message","fullyRefunded","closedTheOrder","refundedLineItemIds","appendOrderEvent","email","customerEmail"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAC5C,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AAEvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SAASC,gBAAgB,QAAQ,oBAAgB;AACjD,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,SAAS;AACT,SAASC,6BAA6B,QAAQ,4DAA2D;AAazG;;;;;;;;;;;;;;;;CAgBC,GACD,eAAeC,kBACbC,OAA4C,EAC5CC,QAA6C,EAC7CC,OAAe;IAEf,IAAI;YAEC;QADH,MAAMC,QAAQZ,cAAca,eAAe,EACxC,QAAA,AAAC,CAAA,MAAMH,SAASI,GAAG,EAAC,EAAGC,IAAI,cAA3B,QAAiC,CAAC;QAErC,MAAMC,YAAY,IAAIC,IAAIjB,cAAckB,kBAAkB,CAACN;QAC3D,IAAII,UAAUG,IAAI,KAAK,GAAG,OAAO;QACjC,MAAMC,WAAW,MAAMX,QACpBY,UAAU,CAAC,eACXC,KAAK,CAAC,WAAW,MAAMX,SACvBY,KAAK,CAAC,KACNT,GAAG;QACN,IAAIU,UAAU;QACd,KAAK,MAAMC,eAAeL,SAASM,IAAI,CAAE;gBACbD;YAA1B,IAAI,CAACT,UAAUW,GAAG,CAACC,QAAOH,mBAAAA,YAAYX,GAAG,CAAC,wBAAhBW,mBAAgC,MAAM;YAChE,yEAAyE;YACzE,wEAAwE;YACxE,6CAA6C;YAC7C,IAAIA,YAAYX,GAAG,CAAC,kBAAkB,MAAM;YAC5C,MAAMW,YAAYI,GAAG,CAClBC,GAAG,CAAC;gBAAEC,aAAaC,KAAKC,GAAG;gBAAIC,gBAAgBvB;YAAQ,GAAG;gBAAEwB,OAAO;YAAK,GACxEC,KAAK,CAAC,IAAMC;YACfb;QACF;QACA,IAAIA,UAAU,GAAG;YACf,MAAMd,SACH4B,MAAM,CAAC;gBACNC,UAAUtC,cAAcuC,SAAS,CAACC,UAAU,CAACC,UAAU,CAAC;oBACtDC,MAAMX,KAAKC,GAAG;oBACdW,OAAO;oBACPC,QACE,GAAGrB,QAAQ,YAAY,EAAEA,YAAY,IAAI,KAAK,IAAI,UAAU,CAAC,GAC7D,mEACA;gBACJ;YACF,GACCY,KAAK,CAAC,IAAMC;QACjB;QACA,OAAOb;IACT,EAAE,OAAOsB,OAAO;QACdC,QAAQD,KAAK,CAAC,iCAAiCnC,SAASmC;QACxD,OAAO;IACT;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAME,gBAAkC,OAAOC,KAAKC;QAO5BD,4BAM4BA,WACnCE,cACCA,eAqBrBF,MAAAA;IAnCF,IAAIA,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAAqB;IAC5D;IACA,IAAI,CAACS,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOP,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAA+B;IACtE;IACA,MAAMY,gBAAgB9B,QAAOqB,6BAAAA,IAAIU,OAAO,CAACD,aAAa,YAAzBT,6BAA6B;IAC1D,MAAMW,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpC1B;IACJ,IAAI,CAACuB,SAAS,OAAOV,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAER,OAAO;IAAkB;IACrE,MAAMK,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWa,KAAKC,KAAK,CAAChB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMiB,SAAStC,QAAOuB,eAAAA,KAAKe,MAAM,YAAXf,eAAe;IACrC,MAAMxC,UAAUiB,QAAOuB,gBAAAA,KAAKxC,OAAO,YAAZwC,gBAAgB;IACvC,MAAMgB,cAAchB,KAAKgB,WAAW,IAAI,OAAO,OAAOC,OAAOjB,KAAKgB,WAAW;IAC7E;;;;;GAKC,GACD,MAAME,mBAA6BC,MAAMC,OAAO,CAACpB,KAAKqB,WAAW,IAC7D;WACK,IAAIvD,IACL,AAACkC,KAAKqB,WAAW,CACdC,GAAG,CAAC,CAACC,QAAUC,KAAKC,KAAK,CAACR,OAAOM,SACjCG,MAAM,CAAC,CAACH,QAAUN,OAAOU,QAAQ,CAACJ,UAAUA,SAAS;KAE3D,CAACK,IAAI,CAAC,CAACC,GAAGC,IAAMD,IAAIC,KACrB,EAAE;IACN,sEAAsE;IACtE,0EAA0E;IAC1E,wBAAwB;IACxB,MAAMC,iBAAiBtD,QACrBqB,QAAAA,8BAAAA,IAAIU,OAAO,CAAC,kBAAkB,YAA9BV,8BAAkCA,IAAIU,OAAO,CAAC,kBAAkB,YAAhEV,OAAoE,IAEnEkC,IAAI,GACJrB,KAAK,CAAC,GAAG;IACZ,IAAI,CAACI,UAAU,CAACvD,SAAS;QACvB,OAAOuC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAA4B;IACnE;IAEA,IAAIsC,QAA4B;IAChC,IAAI;YAakBC,mBA6GDC,kBAwCjBA;QAjKF,MAAMC,UAAU,MAAMtF,cAAcuF,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAAC9B;QAC/D,MAAMpB,YAAYvC,cAAcuF,GAAG,GAAGhD,SAAS;QAC/C,MAAM/B,UAAU+B,UAAUnB,UAAU,CAAC,SAASsE,GAAG,CAACzB;QAClD,MAAMmB,eAAe,MAAM5E,QAAQK,GAAG;QACtC,IAAI,CAACuE,aAAaO,MAAM,EAAE;YACxB,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAe;QACtD;QACA,8DAA8D;QAC9D,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM+C,aAAa,EAACR,oBAAAA,aAAavE,GAAG,CAAC,0BAAjBuE,oBAAmC,CAAC,EAAE,CAACE,QAAQO,GAAG,CAAC;QACvE,IAAID,eAAe,SAAS;YAC1B,OAAO3C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAA+B;QACtE;QACA,sEAAsE;QACtE,EAAE;QACF,8DAA8D;QAC9D,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,+BAA+B;QAC/B,EAAE;QACF,kEAAkE;QAClE,qEAAqE;QACrE,0EAA0E;QAC1E,mEAAmE;QACnE,EAAE;QACF,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,oEAAoE;QACpE,MAAMiD,aAAa,MAAM5F,sBAAsBoF,QAAQO,GAAG,EAAE;YAAE5B;QAAO;QACrE,IAAI,CAAC6B,WAAWC,OAAO,IAAID,WAAWE,QAAQ,KAAK,SAAS;YAC1D,OAAO/C,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,OAAO;YAAkD;QACrE;QACA,MAAMpC,WAAWD,QAAQY,UAAU,CAAC,UAAUsE,GAAG,CAAChF;QAClD,MAAMuF,gBAAgB,MAAMxF,SAASI,GAAG;QACxC,IAAI,CAACoF,cAAcN,MAAM,EAAE;YACzB,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAgB;QACvD;QACA,MAAMwC,QAAQtF,cAAca,eAAe,CAACqF,cAAcnF,IAAI;QAE9D,yEAAyE;QACzE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,gEAAgE;QAChE,MAAMoF,WAAWjB,iBACb1C,UACGnB,UAAU,CAAC,kBACXsE,GAAG,CACFvF,WAAW,SACT,8DAA8D;QAC9D,8DAA8D;QAC9D,+DAA+D;SAC9DkC,MAAM,CAAC,CAAC,OAAO,EAAE4B,OAAO,CAAC,EAAEvD,QAAQ,CAAC,EAAEuE,gBAAgB,EACtDkB,MAAM,CAAC,UAEd;QACJ,IAAID,UAAU;YACZ,MAAME,QAAQ,MAAMF,SAASrF,GAAG;YAChC,MAAMwF,gBAAgBD,MAAMvF,GAAG,CAAC;YAChC,IAAIwF,eAAe;oBAEAD;gBADjB,OAAOnD,IACJG,MAAM,CAACe,QAAOiC,aAAAA,MAAMvF,GAAG,CAAC,6BAAVuF,aAA+B,MAC7C/C,IAAI,CAACgD;YACV;QACF;QAEA,IAAI,CAACtG,cAAcuG,kBAAkB,CAACjB,MAAMjC,MAAM,EAAE,aAAa;YAC/D,OAAOH,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,OAAO,CAAC,WAAW,EAAEwC,MAAMjC,MAAM,CAAC,eAAe,CAAC;YAAC;QAC/D;QACA,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,wCAAwC;QACxC,IAAIrD,cAAcwG,wBAAwB,CAAClB,QAAQ;YACjD,OAAOpC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BR,OACE,iEACA,qEACA,oEACA,mEACA;YACJ;QACF;QACA,qEAAqE;QACrE,cAAc;QACd,EAAE;QACF,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,mDAAmD;QACnD,EAAE;QACF,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,0CAA0C;QAC1C,MAAM2D,cAAanB,mBAAAA,MAAMoB,SAAS,YAAfpB,mBAAmB,EAAE;QACxC,MAAMqB,cAActC,iBAAiBuC,IAAI,CACvC,CAACC,QAAUA,SAASJ,WAAW1C,MAAM;QAEvC,IAAI4C,eAAe,MAAM;YACvB,OAAOzD,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,OAAO,CAAC,KAAK,EAAE6D,YAAY,qBAAqB,CAAC;YAAC;QAC9D;QACA,mDAAmD;QACnD,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,mEAAmE;QACnE,MAAMG,kBAAkB9G,cAAc+G,oBAAoB,CACxDzB,OACAjB;QAEF,IACEA,iBAAiBN,MAAM,GAAG,KAC1BI,eAAe,QACfQ,KAAKC,KAAK,CAACT,eAAe2C,iBAC1B;YACA,OAAO5D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BR,OACE,gEACA,+DACA;YACJ;QACF;QACA,MAAMkE,mBACJ1B,yBAAAA,MAAM0B,eAAe,YAArB1B,yBACA,iEAAiE;QACjE,kCAAkC;QACjC,MAAM,AAAC,CAAA;YACN,MAAM2B,WAAW,MAAMC,MACrB,CAAC,4CAA4C,EAAEvG,SAAS,EACxD;gBACEgD,SAAS;oBACPwD,eAAe,CAAC,OAAO,EAAE5D,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBAC1D;YACF;YAEF,MAAM2D,UAAU,MAAMH,SAAS3D,IAAI;YACnC,OAAO2D,SAASI,EAAE,GAAGD,2BAAAA,QAASE,cAAc,GAAG;QACjD,CAAA;QACF,IAAI,CAACN,iBAAiB;YACpB,OAAO9D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAuB;QAC9D;QAEA,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,oDAAoD;QACpD,IAAIqD,UAAU;YACZ,MAAMoB,WAAW,MAAMrH,cAAcgE;YACrC,IAAI;;oBAEcqD;gBADhB,MAAMpB,SAASqB,MAAM,CAAC;oBACpBC,OAAO7F,gBAAO2F,6BAAAA,gBAAAA,SAAUG,GAAG,qBAAbH,cAAeI,EAAE,oBAAI,OAAO;oBAC1CzD;oBACAvD;oBACAiH,MAAM;oBACNvE,QAAQ;oBACRwE,WAAW5H,cAAcuC,SAAS,CAACC,UAAU,CAACqF,eAAe;oBAC7DC,aAAa/F,KAAKC,GAAG;oBACrB,iEAAiE;oBACjE,kEAAkE;oBAClE,mEAAmE;oBACnE,mEAAmE;oBACnE,wDAAwD;oBACxD+F,WAAWjI,MAAMkI,oBAAoB;gBACvC;YACF,EAAE,eAAM;gBACN,MAAM5B,QAAQ,MAAMF,SAASrF,GAAG;gBAChC,MAAMwF,gBAAgBD,MAAMvF,GAAG,CAAC;gBAChC,IAAIwF,eAAe;wBAEAD;oBADjB,OAAOnD,IACJG,MAAM,CAACe,QAAOiC,cAAAA,MAAMvF,GAAG,CAAC,6BAAVuF,cAA+B,MAC7C/C,IAAI,CAACgD;gBACV;gBACA,iEAAiE;gBACjE,8DAA8D;gBAC9D,OAAOpD,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;oBAAER,OAAO;gBAAyC;YAC5D;YACAsC,QAAQ;gBACN,mEAAmE;gBACnE,iEAAiE;gBACjE,iEAAiE;gBACjE,qCAAqC;gBACrC8C,WAAW/B,SAASwB,EAAE;gBACtBQ,QAAQ,OAAO9E,QAAQ+E;oBACrB,MAAMjC,SACHrE,GAAG,CACF;wBACEuB,QAAQ;wBACRgF,gBAAgBhF;wBAChB4D,UAAUmB;wBACVE,aAAatG,KAAKC,GAAG;oBACvB,GACA;wBAAEE,OAAO;oBAAK,GAEfC,KAAK,CAAC,IAAMC;gBACjB;gBACAkG,SAAS;oBACP,MAAMpC,SAASqC,MAAM,GAAGpG,KAAK,CAAC,IAAMC;gBACtC;YACF;QACF;QAEA,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,QAAQ;QACR,IAAIoG,cAAc;QAClB,IAAIC,aAAa;QACjB,MAAMlG,UAAUmG,cAAc,CAAC,OAAOC;gBAEjC,aAE6ChI,oBACjBA;gBADlBA;YAHb,MAAMA,QAAQZ,cAAca,eAAe,EACxC,QAAA,AAAC,CAAA,MAAM+H,YAAY9H,GAAG,CAACJ,SAAQ,EAAGK,IAAI,cAAtC,QAA4C,CAAC;YAEhD2H,sBAAa9H,gBAAAA,MAAMiI,MAAM,qBAAZjI,cAAc8H,UAAU,mBAAItE,QAAOxD,qBAAAA,MAAMuD,WAAW,YAAjBvD,qBAAqB;YACrE,MAAMkI,kBAAkB1E,QAAOxD,uBAAAA,MAAMmI,aAAa,YAAnBnI,uBAAuB;YACtD,MAAMoI,YAAYN,aAAaI;YAC/B,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,2CAA2C;YAC3C,MAAMG,QACJ9E,eAAe,OACXQ,KAAKC,KAAK,CAACT,eACXE,iBAAiBN,MAAM,GAAG,IACxB+C,kBACAkC;YACRP,cAAc9D,KAAKuE,GAAG,CAACD,OAAOD;YAC9B,IAAI,CAAEP,CAAAA,cAAc,CAAA,GAAI;gBACtBA,cAAc;gBACd;YACF;YACAG,YAAY9G,GAAG,CACbpB,UACA;gBAAEqI,eAAeD,kBAAkBL;YAAY,GAC/C;gBAAEtG,OAAO;YAAK;QAElB;QACA,IAAI,CAAEsG,CAAAA,cAAc,CAAA,GAAI;YACtB,oEAAoE;YACpE,OAAMrD,yBAAAA,MAAOmD,OAAO;YACpB,OAAOrF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAER,OAAO;YAAyB;QAChE;QACA,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,IAAIuB,iBAAiBN,MAAM,GAAG,KAAK0E,cAAc3B,iBAAiB;YAChE,MAAMtE,UACHmG,cAAc,CAAC,OAAOC;oBAEnB;gBADF,MAAMO,UAAU/E,QACd,OAAA,AAAC,CAAA,MAAMwE,YAAY9H,GAAG,CAACJ,SAAQ,EAAGI,GAAG,CAAC,4BAAtC,OAA0D;gBAE5D8H,YAAY9G,GAAG,CACbpB,UACA;oBAAEqI,eAAepE,KAAKyE,GAAG,CAAC,GAAGD,UAAUV;gBAAa,GACpD;oBAAEtG,OAAO;gBAAK;YAElB,GACCC,KAAK,CAAC,IAAMC;YACf,OAAM+C,yBAAAA,MAAOmD,OAAO;YACpB,OAAOrF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BR,OACE,CAAC,MAAM,EAAE,AAAC2F,CAAAA,cAAc,GAAE,EAAGY,OAAO,CAAC,GAAG,2BAA2B,CAAC,GACpE,CAAC,6CAA6C,EAAE,AAC9CvC,CAAAA,kBAAkB,GAAE,EACpBuC,OAAO,CAAC,GAAG,mDAAmD,CAAC;YACrE;QACF;QAEA,MAAMC,SAAS,IAAIC,gBAAgB;YACjCjC,gBAAgB1F,OAAOoF;YACvBwC,QAAQ5H,OAAO6G;YACfgB,kBAAkB;YAClBC,wBAAwB;QAC1B;QACA,MAAMzC,WAAW,MAAMC,MAAM,qCAAqC;YAChE9D,QAAQ;YACRO,SAAS;gBACPwD,eAAe,CAAC,OAAO,EAAE5D,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBACxD,gBAAgB;eACZ2B,CAAAA,yBAAAA,MAAO8C,SAAS,IAChB;gBAAE,mBAAmB9C,MAAM8C,SAAS;YAAC,IACrC,CAAC;YAEP/E,MAAMmG,OAAOK,QAAQ;QACvB;QACA,MAAMC,SAAS,MAAM3C,SAAS3D,IAAI;QAClC,IAAI,CAAC2D,SAASI,EAAE,EAAE;;gBAuBUuC,eAcTA;YApCjB7G,QAAQD,KAAK,CAAC,uBAAuB8G,0BAAAA,OAAQ9G,KAAK;YAClD,uEAAuE;YACvE,2CAA2C;YAC3C,MAAMN,UACHmG,cAAc,CAAC,OAAOC;oBAEnB;gBADF,MAAMO,UAAU/E,QACd,OAAA,AAAC,CAAA,MAAMwE,YAAY9H,GAAG,CAACJ,SAAQ,EAAGI,GAAG,CAAC,4BAAtC,OAA0D;gBAE5D8H,YAAY9G,GAAG,CACbpB,UACA;oBAAEqI,eAAepE,KAAKyE,GAAG,CAAC,GAAGD,UAAUV;gBAAa,GACpD;oBAAEtG,OAAO;gBAAK;YAElB,GACCC,KAAK,CAAC,IAAMC;YACf,OAAM+C,yBAAAA,MAAOmD,OAAO;YACpB,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,MAAMsB,aAAajI,gBAAOgI,2BAAAA,gBAAAA,OAAQ9G,KAAK,qBAAb8G,cAAeE,IAAI,oBAAI;YACjD,IACED,eAAe,qBACfA,eAAe,2BACf;gBACA,OAAO3G,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BR,OACE,gEACA,kEACA;gBACJ;YACF;YACA,OAAOI,IACJG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAER,KAAK,WAAE8G,2BAAAA,iBAAAA,OAAQ9G,KAAK,qBAAb8G,eAAeG,OAAO,oBAAI;YAAgB;QAC7D;QAEA,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,IAAIhB,gBAAgB;QACpB,IAAIiB,gBAAgB;QACpB,IAAIC,iBAAiB;QACrB,MAAMzH,UAAUmG,cAAc,CAAC,OAAOC;gBAEjC,OAEoBhI;YAHvB,MAAMA,QAAQZ,cAAca,eAAe,EACxC,QAAA,AAAC,CAAA,MAAM+H,YAAY9H,GAAG,CAACJ,SAAQ,EAAGK,IAAI,cAAtC,QAA4C,CAAC;YAEhDgI,gBAAgB3E,QAAOxD,uBAAAA,MAAMmI,aAAa,YAAnBnI,uBAAuB;YAC9CoJ,gBAAgBjB,iBAAiBL;YACjC,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,qEAAqE;YACrEuB,iBAAiBD,iBAAiBpJ,MAAMyC,MAAM,KAAK;YACnDuF,YAAY9G,GAAG,CACbpB,UACA,aACMsJ,gBAAgB;gBAAE3G,QAAQ;YAAW,IAAI,CAAC,GAM1CgB,iBAAiBN,MAAM,GAAG,IAC1B;gBACEmG,qBACEjK,cAAcuC,SAAS,CAACC,UAAU,CAACC,UAAU,IACxC2B;YAET,IACA,CAAC;gBACL9B,UAAUvC,cAAcmK,gBAAgB,CACtCvJ,OACA,UACA,CAAC,CAAC,EAAE,AAAC6H,CAAAA,cAAc,GAAE,EAAGY,OAAO,CAAC,GAAG,SAAS,CAAC,GAC1CW,CAAAA,gBACG,YACA3F,iBAAiBN,MAAM,GAAG,IACxB,CAAC,GAAG,EAAEM,iBAAiBN,MAAM,CAAC,KAAK,EACjCM,iBAAiBN,MAAM,KAAK,IAAI,KAAK,IACtC,UAAU,CAAC,GACZ,2CAA0C;gBAGtD;gBAAE5B,OAAO;YAAK;QAElB;QACA,MAAMiG,UAAU;YAAEW;YAAeiB;QAAc;QAC/C,OAAM5E,yBAAAA,MAAO+C,MAAM,CAAC,KAAKC;QACzB,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,0BAA0B;QAC1B,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,mDAAmD;QACnD,MAAM5H,kBAAkBC,SAASC,UAAUC;QAC3C,yEAAyE;QACzE,2EAA2E;QAC3E,6CAA6C;QAC7C,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,wEAAwE;QACxE,uDAAuD;QACvD,EAAE;QACF,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAMN,oBAAoB;YACxB6D;YACAvD;YACAyJ,OAAO9E,MAAM+E,aAAa;YAC1BlG,aAAasE;YACbwB;QACF;QACA;;;;;;;;;;;;;;;;KAgBC,GACD,MAAM1J,8BAA8B;YAClC2D;YACAvD;YACAwD,aAAasE;YACbwB;QACF;QACA,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM3J,iBAAiB;YAAE4D;YAAQvD;YAASiH,MAAM;YAAUqC;QAAe;QACzE,OAAO/G,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC8E;IAC9B,EAAE,OAAOtF,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,uEAAuE;QACvE,wEAAwE;QACxE,iEAAiE;QACjE,2EAA2E;QAC3E,8DAA8D;QAC9D,OAAOI,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAER,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/testing/stand-in-record-system.js

@@ -38,6 +38,7 @@ import { resetPluginServicesForTests } from "@aglyn/aglyn/plugin-manager/plugin-
             captured.push(request);
             return {
                 ok: true,
+                record: 'contact',
                 contactId: `contact-${captured.length}`,
                 created: true
             };

package/src/lib/testing/stand-in-record-system.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/testing/stand-in-record-system.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginContactCaptureWriter } from '@aglyn/aglyn/plugin-manager/plugin-contact-capture'\nimport type { PluginContactCaptureRequest } from '@aglyn/aglyn/plugin-manager/plugin-contact-capture'\nimport { resetPluginServicesForTests } from '@aglyn/aglyn/plugin-manager/plugin-services'\n\n/**\n * A plugin that keeps people, standing in for the one that does (AGL-3080).\n *\n * Commerce reports the people it meets — a newsletter signup, a membership registration and an order — through the contact-capture\n * contract and imports no record system, so its specs stand a writer up the\n * way the loader would. One plugin may not import another, which is why this\n * is here rather than borrowed from the CRM.\n *\n * What these specs certify is that the door REPORTS the right capture: the\n * address, the door's own word for itself, the stage floor and the consent.\n * That the real record system turns that into the same contact it always\n * wrote is held where both plugins can be reached — the CRM's own adapter\n * specs and the forms-door specs in `apps/tenant`.\n *\n * Returns the list the writer fills, in the order the doors reported them.\n */\nexport function standInRecordSystem(): PluginContactCaptureRequest[] {\n  resetPluginServicesForTests()\n  const captured: PluginContactCaptureRequest[] = []\n  registerPluginContactCaptureWriter(\n    {\n      capture: async (request) => {\n        captured.push(request)\n        return { ok: true, contactId: `contact-${captured.length}`, created: true }\n      },\n    },\n    { pluginId: 'record-system' },\n  )\n  return captured\n}\n"],"names":["registerPluginContactCaptureWriter","resetPluginServicesForTests","standInRecordSystem","captured","capture","request","push","ok","contactId","length","created","pluginId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kCAAkC,QAAQ,qDAAoD;AAEvG,SAASC,2BAA2B,QAAQ,8CAA6C;AAEzF;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC;IACdD;IACA,MAAME,WAA0C,EAAE;IAClDH,mCACE;QACEI,SAAS,OAAOC;YACdF,SAASG,IAAI,CAACD;YACd,OAAO;gBAAEE,IAAI;gBAAMC,WAAW,CAAC,QAAQ,EAAEL,SAASM,MAAM,EAAE;gBAAEC,SAAS;YAAK;QAC5E;IACF,GACA;QAAEC,UAAU;IAAgB;IAE9B,OAAOR;AACT"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/testing/stand-in-record-system.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginContactCaptureWriter } from '@aglyn/aglyn/plugin-manager/plugin-contact-capture'\nimport type { PluginContactCaptureRequest } from '@aglyn/aglyn/plugin-manager/plugin-contact-capture'\nimport { resetPluginServicesForTests } from '@aglyn/aglyn/plugin-manager/plugin-services'\n\n/**\n * A plugin that keeps people, standing in for the one that does (AGL-3080).\n *\n * Commerce reports the people it meets — a newsletter signup, a membership registration and an order — through the contact-capture\n * contract and imports no record system, so its specs stand a writer up the\n * way the loader would. One plugin may not import another, which is why this\n * is here rather than borrowed from the CRM.\n *\n * What these specs certify is that the door REPORTS the right capture: the\n * address, the door's own word for itself, the stage floor and the consent.\n * That the real record system turns that into the same contact it always\n * wrote is held where both plugins can be reached — the CRM's own adapter\n * specs and the forms-door specs in `apps/tenant`.\n *\n * Returns the list the writer fills, in the order the doors reported them.\n */\nexport function standInRecordSystem(): PluginContactCaptureRequest[] {\n  resetPluginServicesForTests()\n  const captured: PluginContactCaptureRequest[] = []\n  registerPluginContactCaptureWriter(\n    {\n      capture: async (request) => {\n        captured.push(request)\n        return { ok: true, record: 'contact', contactId: `contact-${captured.length}`, created: true }\n      },\n    },\n    { pluginId: 'record-system' },\n  )\n  return captured\n}\n"],"names":["registerPluginContactCaptureWriter","resetPluginServicesForTests","standInRecordSystem","captured","capture","request","push","ok","record","contactId","length","created","pluginId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kCAAkC,QAAQ,qDAAoD;AAEvG,SAASC,2BAA2B,QAAQ,8CAA6C;AAEzF;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC;IACdD;IACA,MAAME,WAA0C,EAAE;IAClDH,mCACE;QACEI,SAAS,OAAOC;YACdF,SAASG,IAAI,CAACD;YACd,OAAO;gBAAEE,IAAI;gBAAMC,QAAQ;gBAAWC,WAAW,CAAC,QAAQ,EAAEN,SAASO,MAAM,EAAE;gBAAEC,SAAS;YAAK;QAC/F;IACF,GACA;QAAEC,UAAU;IAAgB;IAE9B,OAAOT;AACT"}