@aglyn/plugins-commerce 1.0.0-beta.229 → 1.0.0-beta.231

package/src/lib/utils/use-storefront-purchase-event.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/utils/use-storefront-purchase-event.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { trackEvent } from '@aglyn/aglyn/app-utils/analytics-events'\nimport { useEffect } from 'react'\nimport { buildStorefrontPurchaseParams } from '../model/purchase-analytics'\n\n/** How long to wait out the `checkout.session.completed` webhook. */\nconst MAX_ATTEMPTS = 8\nconst RETRY_MS = 1_500\n/** How long to wait for the consent-gated gtag script to exist. */\nconst GTAG_ATTEMPTS = 20\nconst GTAG_MS = 250\n\n/**\n * Once per browser session per order, across both mount points. `sessionStorage`\n * survives the reload; the in-memory set covers a page carrying BOTH a Cart and\n * a ProductDetail, which would otherwise race before either had written.\n */\nconst reported = new Set<string>()\nconst STORAGE_PREFIX = 'aglyn:purchase-reported:'\n\nfunction alreadyReported(sessionId: string): boolean {\n  if (reported.has(sessionId)) return true\n  try {\n    return window.sessionStorage.getItem(STORAGE_PREFIX + sessionId) === '1'\n  } catch {\n    // Private mode / storage disabled. GA4's own de-duplication on\n    // `transaction_id` is the real guarantee; this is only the cheap half.\n    return false\n  }\n}\n\nfunction markReported(sessionId: string): void {\n  reported.add(sessionId)\n  try {\n    window.sessionStorage.setItem(STORAGE_PREFIX + sessionId, '1')\n  } catch {\n    /* see above */\n  }\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => setTimeout(resolve, ms))\n\n/**\n * Report a completed storefront order to the MERCHANT's GA4 property\n * (AGL-1641).\n *\n * ## Why this exists at all\n *\n * The commerce plugin instrumented `view_item`, `add_to_cart` and\n * `begin_checkout` and then stopped. GA4's built-in ecommerce reports and the\n * shopping-behaviour funnel are all terminated by `purchase`, so without it a\n * merchant's property did not merely lack one number — it rendered an\n * authoritative-looking 0% conversion rate and zero revenue. The console's own\n * commerce analytics card meanwhile promised merchants that `purchase` already\n * mirrored into their Google Analytics.\n *\n * ## Client-side, deliberately — the opposite of the call made for OUR revenue\n *\n * Aglyn's own `purchase` is sent server-side over the Measurement Protocol,\n * because a lost hit there is lost revenue reporting on our books. This one is\n * client-side, and the reasoning inverts with the consequence: server-side\n * would require collecting, encrypting and supporting a per-host Measurement\n * Protocol API secret we have nowhere to store, to buy accuracy against\n * closed tabs and ad blockers that every storefront on the internet already\n * accepts. For a merchant's product analytics that is the industry norm; for\n * our revenue it would not have been.\n *\n * ## Where it fires\n *\n * On the page Stripe returns the shopper to, which is the page they left —\n * there is no order-confirmation surface on a tenant storefront. That is the\n * Cart for a cart checkout and the ProductDetail for a single-product buy,\n * which is exactly why both call this hook.\n *\n * ## The two waits\n *\n * The order is written by the webhook, which can land AFTER the shopper is\n * back, so the lookup retries. And `window.gtag` only exists once the visitor\n * has granted analytics consent and the consent-gated script has loaded\n * post-hydration, so the send waits for it — otherwise the event would be\n * built correctly and dropped on the floor. Both waits are bounded; an\n * ungranted visitor simply times out, which is the consent gate working.\n */\nexport function useStorefrontPurchaseEvent(\n  hostId: string,\n  /** `Aglyn.useSiteFetch()`. A GET, so preview mode passes it straight through. */\n  siteFetch: typeof fetch = fetch,\n): void {\n  useEffect(() => {\n    if (typeof window === 'undefined' || !hostId) return\n\n    const params = new URLSearchParams(window.location.search)\n    if (params.get('order') !== 'success') return\n    const sessionId = params.get('session_id') ?? ''\n    if (!sessionId || alreadyReported(sessionId)) return\n\n    let active = true\n    // Claimed up front so a sibling mount in the same document cannot start a\n    // second poll for the same order. Persisted only once the hit is sent.\n    reported.add(sessionId)\n\n    void (async () => {\n      let source: Parameters<typeof buildStorefrontPurchaseParams>[0] | null =\n        null\n      for (let attempt = 0; attempt < MAX_ATTEMPTS && active; attempt += 1) {\n        try {\n          const response = await siteFetch(\n            `/api/commerce/order-analytics?hostId=${encodeURIComponent(\n              hostId,\n            )}&sessionId=${encodeURIComponent(sessionId)}`,\n          )\n          if (response.ok) {\n            source = await response.json()\n            break\n          }\n          // 404 means the webhook has not written the order yet; anything\n          // else is terminal and retrying it would only add load.\n          if (response.status !== 404) return\n        } catch {\n          // Network blip — treated like the race and retried.\n        }\n        await sleep(RETRY_MS)\n      }\n      if (!active || !source) return\n\n      const purchase = buildStorefrontPurchaseParams(source)\n      if (!purchase) return\n\n      // `trackEvent` no-ops when `window.gtag` is absent and never queues, so\n      // waiting for the tag IS the delivery mechanism here.\n      for (let attempt = 0; attempt < GTAG_ATTEMPTS && active; attempt += 1) {\n        if (typeof (window as any).gtag === 'function') {\n          trackEvent('purchase', purchase)\n          markReported(sessionId)\n          return\n        }\n        await sleep(GTAG_MS)\n      }\n    })()\n\n    return () => {\n      active = false\n    }\n    // `siteFetch` is deliberately out of the dep list: it is a `useCallback`\n    // that changes identity on a preview toggle, and re-running this effect\n    // would restart a poll that has already claimed its session id.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [hostId])\n}\n"],"names":["trackEvent","useEffect","buildStorefrontPurchaseParams","MAX_ATTEMPTS","RETRY_MS","GTAG_ATTEMPTS","GTAG_MS","reported","Set","STORAGE_PREFIX","alreadyReported","sessionId","has","window","sessionStorage","getItem","markReported","add","setItem","sleep","ms","Promise","resolve","setTimeout","useStorefrontPurchaseEvent","hostId","siteFetch","fetch","params","URLSearchParams","location","search","get","active","source","attempt","response","encodeURIComponent","ok","json","status","purchase","gtag"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,0CAAyC;AACpE,SAASC,SAAS,QAAQ,QAAO;AACjC,SAASC,6BAA6B,QAAQ,iCAA6B;AAE3E,mEAAmE,GACnE,MAAMC,eAAe;AACrB,MAAMC,WAAW;AACjB,iEAAiE,GACjE,MAAMC,gBAAgB;AACtB,MAAMC,UAAU;AAEhB;;;;CAIC,GACD,MAAMC,WAAW,IAAIC;AACrB,MAAMC,iBAAiB;AAEvB,SAASC,gBAAgBC,SAAiB;IACxC,IAAIJ,SAASK,GAAG,CAACD,YAAY,OAAO;IACpC,IAAI;QACF,OAAOE,OAAOC,cAAc,CAACC,OAAO,CAACN,iBAAiBE,eAAe;IACvE,EAAE,eAAM;QACN,+DAA+D;QAC/D,uEAAuE;QACvE,OAAO;IACT;AACF;AAEA,SAASK,aAAaL,SAAiB;IACrCJ,SAASU,GAAG,CAACN;IACb,IAAI;QACFE,OAAOC,cAAc,CAACI,OAAO,CAACT,iBAAiBE,WAAW;IAC5D,EAAE,eAAM;IACN,aAAa,GACf;AACF;AAEA,MAAMQ,QAAQ,CAACC,KACb,IAAIC,QAAc,CAACC,UAAYC,WAAWD,SAASF;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,SAASI,2BACdC,MAAc,EACd,+EAA+E,GAC/EC,YAA0BC,KAAK;IAE/B1B,UAAU;YAKU2B;QAJlB,IAAI,OAAOf,WAAW,eAAe,CAACY,QAAQ;QAE9C,MAAMG,SAAS,IAAIC,gBAAgBhB,OAAOiB,QAAQ,CAACC,MAAM;QACzD,IAAIH,OAAOI,GAAG,CAAC,aAAa,WAAW;QACvC,MAAMrB,aAAYiB,cAAAA,OAAOI,GAAG,CAAC,yBAAXJ,cAA4B;QAC9C,IAAI,CAACjB,aAAaD,gBAAgBC,YAAY;QAE9C,IAAIsB,SAAS;QACb,0EAA0E;QAC1E,uEAAuE;QACvE1B,SAASU,GAAG,CAACN;QAEb,KAAK,AAAC,CAAA;YACJ,IAAIuB,SACF;YACF,IAAK,IAAIC,UAAU,GAAGA,UAAUhC,gBAAgB8B,QAAQE,WAAW,EAAG;gBACpE,IAAI;oBACF,MAAMC,WAAW,MAAMV,UACrB,CAAC,qCAAqC,EAAEW,mBACtCZ,QACA,WAAW,EAAEY,mBAAmB1B,YAAY;oBAEhD,IAAIyB,SAASE,EAAE,EAAE;wBACfJ,SAAS,MAAME,SAASG,IAAI;wBAC5B;oBACF;oBACA,gEAAgE;oBAChE,wDAAwD;oBACxD,IAAIH,SAASI,MAAM,KAAK,KAAK;gBAC/B,EAAE,eAAM;gBACN,oDAAoD;gBACtD;gBACA,MAAMrB,MAAMf;YACd;YACA,IAAI,CAAC6B,UAAU,CAACC,QAAQ;YAExB,MAAMO,WAAWvC,8BAA8BgC;YAC/C,IAAI,CAACO,UAAU;YAEf,wEAAwE;YACxE,sDAAsD;YACtD,IAAK,IAAIN,UAAU,GAAGA,UAAU9B,iBAAiB4B,QAAQE,WAAW,EAAG;gBACrE,IAAI,OAAO,AAACtB,OAAe6B,IAAI,KAAK,YAAY;oBAC9C1C,WAAW,YAAYyC;oBACvBzB,aAAaL;oBACb;gBACF;gBACA,MAAMQ,MAAMb;YACd;QACF,CAAA;QAEA,OAAO;YACL2B,SAAS;QACX;IACA,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,uDAAuD;IACzD,GAAG;QAACR;KAAO;AACb"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/utils/use-storefront-purchase-event.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { trackEvent } from '@aglyn/aglyn/app-utils/analytics-events'\nimport { recordSiteJourneyStep } from '@aglyn/aglyn/app-utils/site-journey'\nimport { useEffect } from 'react'\nimport { buildStorefrontPurchaseParams } from '../model/purchase-analytics'\n\n/** How long to wait out the `checkout.session.completed` webhook. */\nconst MAX_ATTEMPTS = 8\nconst RETRY_MS = 1_500\n/** How long to wait for the consent-gated gtag script to exist. */\nconst GTAG_ATTEMPTS = 20\nconst GTAG_MS = 250\n\n/**\n * Once per browser session per order, across both mount points. `sessionStorage`\n * survives the reload; the in-memory set covers a page carrying BOTH a Cart and\n * a ProductDetail, which would otherwise race before either had written.\n */\nconst reported = new Set<string>()\nconst STORAGE_PREFIX = 'aglyn:purchase-reported:'\n\nfunction alreadyReported(sessionId: string): boolean {\n  if (reported.has(sessionId)) return true\n  try {\n    return window.sessionStorage.getItem(STORAGE_PREFIX + sessionId) === '1'\n  } catch {\n    // Private mode / storage disabled. GA4's own de-duplication on\n    // `transaction_id` is the real guarantee; this is only the cheap half.\n    return false\n  }\n}\n\nfunction markReported(sessionId: string): void {\n  reported.add(sessionId)\n  try {\n    window.sessionStorage.setItem(STORAGE_PREFIX + sessionId, '1')\n  } catch {\n    /* see above */\n  }\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => setTimeout(resolve, ms))\n\n/**\n * Report a completed storefront order to the MERCHANT's GA4 property\n * (AGL-1641).\n *\n * ## Why this exists at all\n *\n * The commerce plugin instrumented `view_item`, `add_to_cart` and\n * `begin_checkout` and then stopped. GA4's built-in ecommerce reports and the\n * shopping-behaviour funnel are all terminated by `purchase`, so without it a\n * merchant's property did not merely lack one number — it rendered an\n * authoritative-looking 0% conversion rate and zero revenue. The console's own\n * commerce analytics card meanwhile promised merchants that `purchase` already\n * mirrored into their Google Analytics.\n *\n * ## Client-side, deliberately — the opposite of the call made for OUR revenue\n *\n * Aglyn's own `purchase` is sent server-side over the Measurement Protocol,\n * because a lost hit there is lost revenue reporting on our books. This one is\n * client-side, and the reasoning inverts with the consequence: server-side\n * would require collecting, encrypting and supporting a per-host Measurement\n * Protocol API secret we have nowhere to store, to buy accuracy against\n * closed tabs and ad blockers that every storefront on the internet already\n * accepts. For a merchant's product analytics that is the industry norm; for\n * our revenue it would not have been.\n *\n * ## Where it fires\n *\n * On the page Stripe returns the shopper to, which is the page they left —\n * there is no order-confirmation surface on a tenant storefront. That is the\n * Cart for a cart checkout and the ProductDetail for a single-product buy,\n * which is exactly why both call this hook.\n *\n * ## The two waits\n *\n * The order is written by the webhook, which can land AFTER the shopper is\n * back, so the lookup retries. And `window.gtag` only exists once the visitor\n * has granted analytics consent and the consent-gated script has loaded\n * post-hydration, so the send waits for it — otherwise the event would be\n * built correctly and dropped on the floor. Both waits are bounded; an\n * ungranted visitor simply times out, which is the consent gate working.\n */\nexport function useStorefrontPurchaseEvent(\n  hostId: string,\n  /** `Aglyn.useSiteFetch()`. A GET, so preview mode passes it straight through. */\n  siteFetch: typeof fetch = fetch,\n): void {\n  useEffect(() => {\n    if (typeof window === 'undefined' || !hostId) return\n\n    const params = new URLSearchParams(window.location.search)\n    if (params.get('order') !== 'success') return\n    const sessionId = params.get('session_id') ?? ''\n    if (!sessionId || alreadyReported(sessionId)) return\n\n    let active = true\n    // Claimed up front so a sibling mount in the same document cannot start a\n    // second poll for the same order. Persisted only once the hit is sent.\n    reported.add(sessionId)\n\n    void (async () => {\n      let source: Parameters<typeof buildStorefrontPurchaseParams>[0] | null =\n        null\n      for (let attempt = 0; attempt < MAX_ATTEMPTS && active; attempt += 1) {\n        try {\n          const response = await siteFetch(\n            `/api/commerce/order-analytics?hostId=${encodeURIComponent(\n              hostId,\n            )}&sessionId=${encodeURIComponent(sessionId)}`,\n          )\n          if (response.ok) {\n            source = await response.json()\n            break\n          }\n          // 404 means the webhook has not written the order yet; anything\n          // else is terminal and retrying it would only add load.\n          if (response.status !== 404) return\n        } catch {\n          // Network blip — treated like the race and retried.\n        }\n        await sleep(RETRY_MS)\n      }\n      if (!active || !source) return\n\n      const purchase = buildStorefrontPurchaseParams(source)\n      if (!purchase) return\n      // A funnel step (AGL-3605), recorded before the wait for the tag: the\n      // journey has its own consent gate and does not need GA on the page.\n      recordSiteJourneyStep('order')\n\n      // `trackEvent` no-ops when `window.gtag` is absent and never queues, so\n      // waiting for the tag IS the delivery mechanism here.\n      for (let attempt = 0; attempt < GTAG_ATTEMPTS && active; attempt += 1) {\n        if (typeof (window as any).gtag === 'function') {\n          trackEvent('purchase', purchase)\n          markReported(sessionId)\n          return\n        }\n        await sleep(GTAG_MS)\n      }\n    })()\n\n    return () => {\n      active = false\n    }\n    // `siteFetch` is deliberately out of the dep list: it is a `useCallback`\n    // that changes identity on a preview toggle, and re-running this effect\n    // would restart a poll that has already claimed its session id.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [hostId])\n}\n"],"names":["trackEvent","recordSiteJourneyStep","useEffect","buildStorefrontPurchaseParams","MAX_ATTEMPTS","RETRY_MS","GTAG_ATTEMPTS","GTAG_MS","reported","Set","STORAGE_PREFIX","alreadyReported","sessionId","has","window","sessionStorage","getItem","markReported","add","setItem","sleep","ms","Promise","resolve","setTimeout","useStorefrontPurchaseEvent","hostId","siteFetch","fetch","params","URLSearchParams","location","search","get","active","source","attempt","response","encodeURIComponent","ok","json","status","purchase","gtag"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,0CAAyC;AACpE,SAASC,qBAAqB,QAAQ,sCAAqC;AAC3E,SAASC,SAAS,QAAQ,QAAO;AACjC,SAASC,6BAA6B,QAAQ,iCAA6B;AAE3E,mEAAmE,GACnE,MAAMC,eAAe;AACrB,MAAMC,WAAW;AACjB,iEAAiE,GACjE,MAAMC,gBAAgB;AACtB,MAAMC,UAAU;AAEhB;;;;CAIC,GACD,MAAMC,WAAW,IAAIC;AACrB,MAAMC,iBAAiB;AAEvB,SAASC,gBAAgBC,SAAiB;IACxC,IAAIJ,SAASK,GAAG,CAACD,YAAY,OAAO;IACpC,IAAI;QACF,OAAOE,OAAOC,cAAc,CAACC,OAAO,CAACN,iBAAiBE,eAAe;IACvE,EAAE,eAAM;QACN,+DAA+D;QAC/D,uEAAuE;QACvE,OAAO;IACT;AACF;AAEA,SAASK,aAAaL,SAAiB;IACrCJ,SAASU,GAAG,CAACN;IACb,IAAI;QACFE,OAAOC,cAAc,CAACI,OAAO,CAACT,iBAAiBE,WAAW;IAC5D,EAAE,eAAM;IACN,aAAa,GACf;AACF;AAEA,MAAMQ,QAAQ,CAACC,KACb,IAAIC,QAAc,CAACC,UAAYC,WAAWD,SAASF;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,SAASI,2BACdC,MAAc,EACd,+EAA+E,GAC/EC,YAA0BC,KAAK;IAE/B1B,UAAU;YAKU2B;QAJlB,IAAI,OAAOf,WAAW,eAAe,CAACY,QAAQ;QAE9C,MAAMG,SAAS,IAAIC,gBAAgBhB,OAAOiB,QAAQ,CAACC,MAAM;QACzD,IAAIH,OAAOI,GAAG,CAAC,aAAa,WAAW;QACvC,MAAMrB,aAAYiB,cAAAA,OAAOI,GAAG,CAAC,yBAAXJ,cAA4B;QAC9C,IAAI,CAACjB,aAAaD,gBAAgBC,YAAY;QAE9C,IAAIsB,SAAS;QACb,0EAA0E;QAC1E,uEAAuE;QACvE1B,SAASU,GAAG,CAACN;QAEb,KAAK,AAAC,CAAA;YACJ,IAAIuB,SACF;YACF,IAAK,IAAIC,UAAU,GAAGA,UAAUhC,gBAAgB8B,QAAQE,WAAW,EAAG;gBACpE,IAAI;oBACF,MAAMC,WAAW,MAAMV,UACrB,CAAC,qCAAqC,EAAEW,mBACtCZ,QACA,WAAW,EAAEY,mBAAmB1B,YAAY;oBAEhD,IAAIyB,SAASE,EAAE,EAAE;wBACfJ,SAAS,MAAME,SAASG,IAAI;wBAC5B;oBACF;oBACA,gEAAgE;oBAChE,wDAAwD;oBACxD,IAAIH,SAASI,MAAM,KAAK,KAAK;gBAC/B,EAAE,eAAM;gBACN,oDAAoD;gBACtD;gBACA,MAAMrB,MAAMf;YACd;YACA,IAAI,CAAC6B,UAAU,CAACC,QAAQ;YAExB,MAAMO,WAAWvC,8BAA8BgC;YAC/C,IAAI,CAACO,UAAU;YACf,sEAAsE;YACtE,qEAAqE;YACrEzC,sBAAsB;YAEtB,wEAAwE;YACxE,sDAAsD;YACtD,IAAK,IAAImC,UAAU,GAAGA,UAAU9B,iBAAiB4B,QAAQE,WAAW,EAAG;gBACrE,IAAI,OAAO,AAACtB,OAAe6B,IAAI,KAAK,YAAY;oBAC9C3C,WAAW,YAAY0C;oBACvBzB,aAAaL;oBACb;gBACF;gBACA,MAAMQ,MAAMb;YACd;QACF,CAAA;QAEA,OAAO;YACL2B,SAAS;QACX;IACA,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,uDAAuD;IACzD,GAAG;QAACR;KAAO;AACb"}

package/src/lib/server/feed.js

@@ -1,69 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ import { _ as _extends } from "@swc/helpers/_/_extends";
-import * as CommerceModel from "../model/index.js";
-import { firebaseAdmin } from "@aglyn/tenant-data-admin";
-import { readSiteReturnHost, siteReturnOrigin } from "@aglyn/aglyn/app-utils/site-return-url";
-function escapeXml(text) {
-    return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
-}
-/**
- * Google Merchant Center product feed (AGL-299): RSS 2.0 with the g:
- * namespace over active products — one item per product (default
- * variant pricing; per-variant feeds can come later). Submit
- * `https://{site}/api/commerce/feed?hostId={id}` in Merchant Center.
- */ export const feedHandler = async (req, res)=>{
-    var _req_query_hostId;
-    const hostId = String((_req_query_hostId = req.query.hostId) != null ? _req_query_hostId : '');
-    if (!hostId) return res.status(400).send('Missing hostId');
-    try {
-        var _req_headers_host;
-        const firestore = firebaseAdmin.app().firestore();
-        const hostRef = firestore.collection('hosts').doc(hostId);
-        const productsSnapshot = await hostRef.collection('products').limit(500).get();
-        const requestHost = String((_req_headers_host = req.headers['host']) != null ? _req_headers_host : '');
-        // The site's own origin, never the Host a request arrived on (AGL-3363):
-        // any site's domain answers `?hostId=` for any other, so a feed read
-        // through a stranger's site linked every product there.
-        const base = siteReturnOrigin({
-            candidates: [
-                `https://${requestHost}`
-            ],
-            site: await readSiteReturnHost(hostRef),
-            requestHost
-        });
-        const items = productsSnapshot.docs.map((docSnapshot)=>_extends({}, CommerceModel.liftLegacyProduct(docSnapshot.data()), {
-                $id: docSnapshot.id
-            })).filter((product)=>!product.deletedAt && product.status === 'active').map((product)=>{
-            var _ref, _product_description;
-            var _product_mediaUrls;
-            const [minPrice] = CommerceModel.productPriceRange(product);
-            const inventory = CommerceModel.productInventory(product);
-            const availability = inventory != null && inventory <= 0 && product.oversellPolicy !== 'backorder' ? 'out_of_stock' : 'in_stock';
-            const image = (_ref = (_product_mediaUrls = product.mediaUrls) == null ? void 0 : _product_mediaUrls[0]) != null ? _ref : product.imageUrl;
-            return '    <item>\n' + `      <g:id>${escapeXml(product.$id)}</g:id>\n` + `      <g:title>${escapeXml(product.name)}</g:title>\n` + `      <g:description>${escapeXml((_product_description = product.description) != null ? _product_description : product.name)}</g:description>\n` + `      <g:link>${escapeXml(`${base}/products/${product.slug}`)}</g:link>\n` + (image ? `      <g:image_link>${escapeXml(image)}</g:image_link>\n` : '') + `      <g:price>${minPrice.toFixed(2)} USD</g:price>\n` + `      <g:availability>${availability}</g:availability>\n` + `      <g:condition>new</g:condition>\n` + '    </item>';
-        });
-        const xml = '<?xml version="1.0" encoding="UTF-8"?>\n' + '<rss version="2.0" xmlns:g="http://base.google.com/ns/1.0">\n' + '  <channel>\n' + `    <title>${escapeXml(base.replace(/^https?:\/\//, ''))} products</title>\n` + `    <link>${escapeXml(base)}</link>\n` + '    <description>Product feed</description>\n' + items.join('\n') + '\n  </channel>\n</rss>\n';
-        res.setHeader('Content-Type', 'application/xml');
-        res.setHeader('Cache-Control', 's-maxage=3600, stale-while-revalidate');
-        return res.status(200).send(xml);
-    } catch (error) {
-        console.error(error);
-        return res.status(500).send('Feed unavailable');
-    }
-};
-
-//# sourceMappingURL=feed.js.map

package/src/lib/server/feed.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/feed.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { readSiteReturnHost, siteReturnOrigin } from '@aglyn/aglyn/app-utils/site-return-url'\n\nfunction escapeXml(text: string): string {\n  return text\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n}\n\n/**\n * Google Merchant Center product feed (AGL-299): RSS 2.0 with the g:\n * namespace over active products — one item per product (default\n * variant pricing; per-variant feeds can come later). Submit\n * `https://{site}/api/commerce/feed?hostId={id}` in Merchant Center.\n */\nexport const feedHandler: PluginApiHandler = async (req, res) => {\n  const hostId = String(req.query.hostId ?? '')\n  if (!hostId) return res.status(400).send('Missing hostId')\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const productsSnapshot = await hostRef\n      .collection('products')\n      .limit(500)\n      .get()\n    const requestHost = String(req.headers['host'] ?? '')\n    // The site's own origin, never the Host a request arrived on (AGL-3363):\n    // any site's domain answers `?hostId=` for any other, so a feed read\n    // through a stranger's site linked every product there.\n    const base = siteReturnOrigin({\n      candidates: [`https://${requestHost}`],\n      site: await readSiteReturnHost(hostRef),\n      requestHost,\n    })\n    const items = productsSnapshot.docs\n      .map((docSnapshot) => ({\n        ...CommerceModel.liftLegacyProduct(docSnapshot.data() as any),\n        $id: docSnapshot.id,\n      }))\n      .filter(\n        (product) => !product.deletedAt && product.status === 'active',\n      )\n      .map((product) => {\n        const [minPrice] = CommerceModel.productPriceRange(product)\n        const inventory = CommerceModel.productInventory(product)\n        const availability =\n          inventory != null &&\n          inventory <= 0 &&\n          product.oversellPolicy !== 'backorder'\n            ? 'out_of_stock'\n            : 'in_stock'\n        const image = product.mediaUrls?.[0] ?? product.imageUrl\n        return (\n          '    <item>\\n' +\n          `      <g:id>${escapeXml(product.$id)}</g:id>\\n` +\n          `      <g:title>${escapeXml(product.name)}</g:title>\\n` +\n          `      <g:description>${escapeXml(product.description ?? product.name)}</g:description>\\n` +\n          `      <g:link>${escapeXml(`${base}/products/${product.slug}`)}</g:link>\\n` +\n          (image\n            ? `      <g:image_link>${escapeXml(image)}</g:image_link>\\n`\n            : '') +\n          `      <g:price>${minPrice.toFixed(2)} USD</g:price>\\n` +\n          `      <g:availability>${availability}</g:availability>\\n` +\n          `      <g:condition>new</g:condition>\\n` +\n          '    </item>'\n        )\n      })\n    const xml =\n      '<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n' +\n      '<rss version=\"2.0\" xmlns:g=\"http://base.google.com/ns/1.0\">\\n' +\n      '  <channel>\\n' +\n      `    <title>${escapeXml(base.replace(/^https?:\\/\\//, ''))} products</title>\\n` +\n      `    <link>${escapeXml(base)}</link>\\n` +\n      '    <description>Product feed</description>\\n' +\n      items.join('\\n') +\n      '\\n  </channel>\\n</rss>\\n'\n    res.setHeader('Content-Type', 'application/xml')\n    res.setHeader('Cache-Control', 's-maxage=3600, stale-while-revalidate')\n    return res.status(200).send(xml)\n  } catch (error) {\n    console.error(error)\n    return res.status(500).send('Feed unavailable')\n  }\n}\n"],"names":["CommerceModel","firebaseAdmin","readSiteReturnHost","siteReturnOrigin","escapeXml","text","replace","feedHandler","req","res","hostId","String","query","status","send","firestore","app","hostRef","collection","doc","productsSnapshot","limit","get","requestHost","headers","base","candidates","site","items","docs","map","docSnapshot","liftLegacyProduct","data","$id","id","filter","product","deletedAt","minPrice","productPriceRange","inventory","productInventory","availability","oversellPolicy","image","mediaUrls","imageUrl","name","description","slug","toFixed","xml","join","setHeader","error","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAID,YAAYA,mBAAmB,oBAAU;AACzC,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,kBAAkB,EAAEC,gBAAgB,QAAQ,yCAAwC;AAE7F,SAASC,UAAUC,IAAY;IAC7B,OAAOA,KACJC,OAAO,CAAC,MAAM,SACdA,OAAO,CAAC,MAAM,QACdA,OAAO,CAAC,MAAM,QACdA,OAAO,CAAC,MAAM;AACnB;AAEA;;;;;CAKC,GACD,OAAO,MAAMC,cAAgC,OAAOC,KAAKC;QACjCD;IAAtB,MAAME,SAASC,QAAOH,oBAAAA,IAAII,KAAK,CAACF,MAAM,YAAhBF,oBAAoB;IAC1C,IAAI,CAACE,QAAQ,OAAOD,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;IACzC,IAAI;YAOyBN;QAN3B,MAAMO,YAAYd,cAAce,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACT;QAClD,MAAMU,mBAAmB,MAAMH,QAC5BC,UAAU,CAAC,YACXG,KAAK,CAAC,KACNC,GAAG;QACN,MAAMC,cAAcZ,QAAOH,oBAAAA,IAAIgB,OAAO,CAAC,OAAO,YAAnBhB,oBAAuB;QAClD,yEAAyE;QACzE,qEAAqE;QACrE,wDAAwD;QACxD,MAAMiB,OAAOtB,iBAAiB;YAC5BuB,YAAY;gBAAC,CAAC,QAAQ,EAAEH,aAAa;aAAC;YACtCI,MAAM,MAAMzB,mBAAmBe;YAC/BM;QACF;QACA,MAAMK,QAAQR,iBAAiBS,IAAI,CAChCC,GAAG,CAAC,CAACC,cAAiB,aAClB/B,cAAcgC,iBAAiB,CAACD,YAAYE,IAAI;gBACnDC,KAAKH,YAAYI,EAAE;gBAEpBC,MAAM,CACL,CAACC,UAAY,CAACA,QAAQC,SAAS,IAAID,QAAQxB,MAAM,KAAK,UAEvDiB,GAAG,CAAC,CAACO;sBAcgCA;gBALtBA;YARd,MAAM,CAACE,SAAS,GAAGvC,cAAcwC,iBAAiB,CAACH;YACnD,MAAMI,YAAYzC,cAAc0C,gBAAgB,CAACL;YACjD,MAAMM,eACJF,aAAa,QACbA,aAAa,KACbJ,QAAQO,cAAc,KAAK,cACvB,iBACA;YACN,MAAMC,iBAAQR,qBAAAA,QAAQS,SAAS,qBAAjBT,kBAAmB,CAAC,EAAE,mBAAIA,QAAQU,QAAQ;YACxD,OACE,iBACA,CAAC,YAAY,EAAE3C,UAAUiC,QAAQH,GAAG,EAAE,SAAS,CAAC,GAChD,CAAC,eAAe,EAAE9B,UAAUiC,QAAQW,IAAI,EAAE,YAAY,CAAC,GACvD,CAAC,qBAAqB,EAAE5C,WAAUiC,uBAAAA,QAAQY,WAAW,YAAnBZ,uBAAuBA,QAAQW,IAAI,EAAE,kBAAkB,CAAC,GAC1F,CAAC,cAAc,EAAE5C,UAAU,GAAGqB,KAAK,UAAU,EAAEY,QAAQa,IAAI,EAAE,EAAE,WAAW,CAAC,GAC1EL,CAAAA,QACG,CAAC,oBAAoB,EAAEzC,UAAUyC,OAAO,iBAAiB,CAAC,GAC1D,EAAC,IACL,CAAC,eAAe,EAAEN,SAASY,OAAO,CAAC,GAAG,gBAAgB,CAAC,GACvD,CAAC,sBAAsB,EAAER,aAAa,mBAAmB,CAAC,GAC1D,CAAC,sCAAsC,CAAC,GACxC;QAEJ;QACF,MAAMS,MACJ,6CACA,kEACA,kBACA,CAAC,WAAW,EAAEhD,UAAUqB,KAAKnB,OAAO,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,GAC9E,CAAC,UAAU,EAAEF,UAAUqB,MAAM,SAAS,CAAC,GACvC,kDACAG,MAAMyB,IAAI,CAAC,QACX;QACF5C,IAAI6C,SAAS,CAAC,gBAAgB;QAC9B7C,IAAI6C,SAAS,CAAC,iBAAiB;QAC/B,OAAO7C,IAAII,MAAM,CAAC,KAAKC,IAAI,CAACsC;IAC9B,EAAE,OAAOG,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,OAAO9C,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;IAC9B;AACF,EAAC"}