@aglyn/plugins-commerce 1.0.0-beta.229 → 1.0.0-beta.231

package/src/lib/server/api-v1/orders-and-products.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/plugins/commerce/src/lib/server/api-v1/orders-and-products.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { checkEntitlement, isHostPluginEnabled } from '@aglyn/aglyn/server'\nimport {\n  ApiErrors,\n  apiJson,\n  listResponse,\n} from '@aglyn/tenant-data-admin'\nimport {\n  type ApiV1Context,\n  paginate,\n  readJsonBody,\n  requireScope,\n  serialize,\n} from '@aglyn/tenant-data-admin/server/api-v1-kit'\nimport { BUNDLE_ID } from '../../constants/bundle-common'\nimport { type OrderFulfilmentTarget, recordOrderShipment } from '../fulfill-order'\n\n/**\n * A site's orders and products on the customer REST API,\n * `/v1/sites/{siteId}/orders/…` and `/v1/sites/{siteId}/products/…`\n * (AGL-1928, AGL-2461, AGL-3080). Registered from this plugin's console\n * server declarations; the console's `/v1` router owns the pipeline in\n * front — the key, the plan's API access, the request quota, the rate limit —\n * and refuses a site the key's organization does not own before it hands a\n * request here.\n */\n\n/**\n * Commerce resources need the `commerce` entitlement as well as the scope\n * (AGL-1928). `apiAccess` alone is the wrong gate here: it says the org may\n * call the API at all, not that it may still use the store. AGL-1873 closed\n * exactly this class on the write side — two money doors that asked the\n * plugin switch (`org.enabledPlugins`) instead of the plan, so a lapsed org\n * kept selling — and the same reasoning applies to a read. `enabledPlugins`\n * is the customer's own on/off switch and survives a downgrade; the plan does\n * not, and the published rule is that paid features stop at the door when the\n * plan no longer includes them.\n *\n * Answered as `plan_required` rather than `not_found`, deliberately. Hiding a\n * store that plainly exists behind a 404 sends an integrator hunting a wrong\n * site id; the honest answer names the plan.\n */\nfunction requireCommerce(ctx: ApiV1Context): Response | null {\n  return checkEntitlement(ctx.org, 'commerce')\n    ? null\n    : ApiErrors.planRequired({\n        message: 'Commerce is not included in this organization’s plan',\n        code: 'commerce',\n        headers: ctx.headers,\n      })\n}\n\nfunction hostRef(ctx: ApiV1Context, hostId: string) {\n  return ctx.firestore.collection('hosts').doc(hostId)\n}\n\n/**\n * Orders carry a legacy Commerce Starter shape (AGL-90) alongside the modern\n * one: `amountCents`/`feeCents` at the top level rather than a `totals` map.\n * The console lifts them through `CommerceModel.liftLegacyOrder` and reads\n * `lifted.totals?.totalCents ?? order.amountCents`. The API cannot publish two\n * shapes for one object, so the legacy fields are folded into `totals` here\n * and a client only ever sees the modern one. `channel` defaults to `online`\n * for the same reason the console's list does — an absent channel is a\n * pre-channel order, not an unknown one.\n */\nfunction orderView(doc: FirebaseFirestore.DocumentSnapshot) {\n  const data = doc.data() ?? {}\n  const totals = (data.totals ?? {}) as Record<string, unknown>\n  const legacyTotal = Number(data.amountCents ?? NaN)\n  const totalCents = Number.isFinite(Number(totals.totalCents))\n    ? Number(totals.totalCents)\n    : Number.isFinite(legacyTotal)\n      ? legacyTotal\n      : null\n  const legacyFee = Number(data.feeCents ?? NaN)\n  return {\n    id: doc.id,\n    object: 'order',\n    number: typeof data.number === 'number' ? data.number : null,\n    status: (data.status as string) ?? null,\n    channel: (data.channel as string) ?? 'online',\n    currency: 'usd',\n    customerEmail: data.customerEmail ?? null,\n    customerName: data.customerName ?? null,\n    lineItems: serialize(data.lineItems ?? []),\n    totals: {\n      itemsCents: Number(totals.itemsCents ?? 0),\n      shippingCents: Number(totals.shippingCents ?? 0),\n      taxCents: Number(totals.taxCents ?? 0),\n      discountCents: Number(totals.discountCents ?? 0),\n      totalCents,\n      // The Connect application fee. NOT subtracted from `totalCents` — it is\n      // Aglyn's cut of a total the shopper already paid in full, so a client\n      // that nets it out of revenue would understate what it collected.\n      feeCents: Number.isFinite(Number(totals.feeCents))\n        ? Number(totals.feeCents)\n        : Number.isFinite(legacyFee)\n          ? legacyFee\n          : 0,\n    },\n    // Money already handed back, for any reason. A chargeback lands here too,\n    // so `refundedCents > 0` does not by itself mean the merchant chose it.\n    refundedCents: Number(data.refundedCents ?? 0),\n    disputed: Boolean(data.dispute),\n    shippingAddress: serialize(data.shippingAddress) ?? null,\n    couponCode: data.couponCode ?? null,\n    // Shipment records — the half of fulfilment an integration can use\n    // without a write (AGL-2460). `status` says an order is `fulfilled`; it\n    // does not say which carrier took it or under what tracking number, so a\n    // 3PL or accounting reconcile could see THAT an order shipped and never\n    // WHICH shipment it was. The console's order dialog shows both, and an\n    // order that has been shipped twice (a split shipment) is indistinguish-\n    // able from one shipped once when only the status is published.\n    //\n    // `atMs` is a number of milliseconds, not a Firestore Timestamp, so\n    // `serialize` passes it through untouched. It is republished as `at` in\n    // ISO 8601 to match `created` and every other time this API emits: one\n    // object publishing two time formats is a bug an integrator finds late,\n    // in their own timezone conversion, and blames on their own code.\n    fulfillments: (Array.isArray(data.fulfillments) ? data.fulfillments : []).map(\n      (entry: Record<string, unknown>) => {\n        const atMs = Number((entry ?? {}).atMs)\n        return {\n          id: (entry ?? {}).id ?? null,\n          lineItemIds: Array.isArray((entry ?? {}).lineItemIds)\n            ? (entry as { lineItemIds: unknown[] }).lineItemIds\n            : [],\n          carrier: (entry ?? {}).carrier ?? null,\n          trackingNumber: (entry ?? {}).trackingNumber ?? null,\n          trackingUrl: (entry ?? {}).trackingUrl ?? null,\n          at: Number.isFinite(atMs) ? new Date(atMs).toISOString() : null,\n        }\n      },\n    ),\n    created: serialize(data.createdAt) ?? null,\n  }\n}\n\nexport async function handleOrders(\n  request: Request,\n  ctx: ApiV1Context,\n  segments: string[],\n  url: URL,\n): Promise<Response> {\n  const [, hostId, , orderId] = segments\n  // `orders:write` is checked BEFORE `orders:read`, matching `handleSites`\n  // and `handleScopedMedia` (AGL-900): a fulfilment key that only records\n  // shipments must not be told it lacks a read scope it was never meant to\n  // hold.\n  if (request.method === 'PATCH' && orderId) {\n    const deniedWrite = requireScope(ctx, 'orders:write')\n    if (deniedWrite) return deniedWrite\n    const unentitledWrite = requireCommerce(ctx)\n    if (unentitledWrite) return unentitledWrite\n    return updateOrder(request, ctx, hostId, orderId)\n  }\n  const denied = requireScope(ctx, 'orders:read')\n  if (denied) return denied\n  const unentitled = requireCommerce(ctx)\n  if (unentitled) return unentitled\n  if (request.method !== 'GET') {\n    return ApiErrors.methodNotAllowed({\n      headers: { ...ctx.headers, Allow: orderId ? 'GET, PATCH' : 'GET' },\n    })\n  }\n  const collection = hostRef(ctx, hostId).collection('orders')\n\n  if (orderId) {\n    const snap = await collection.doc(orderId).get()\n    if (!snap.exists) {\n      return ApiErrors.notFound({ message: 'No such order', headers: ctx.headers })\n    }\n    return apiJson(orderView(snap), { headers: ctx.headers })\n  }\n\n  let query: FirebaseFirestore.Query = collection\n  const status = url.searchParams.get('status')\n  if (status) query = query.where('status', '==', status)\n  const channel = url.searchParams.get('channel')\n  // `online` is the DEFAULT, not a stored value on older orders, so filtering\n  // for it in Firestore would silently drop every pre-channel order. Those are\n  // exactly the oldest orders an accounting backfill is reaching for, so this\n  // one value is filtered after the read instead. The page can therefore come\n  // back shorter than `limit` while `has_more` is still true — which the\n  // published pagination contract already tells clients to expect (check\n  // `has_more`, never a page's length).\n  if (channel && channel !== 'online') query = query.where('channel', '==', channel)\n  const { docs, nextCursor } = await paginate(query, url)\n  const data = docs\n    .map(orderView)\n    .filter((order) => (channel === 'online' ? order.channel === 'online' : true))\n  return listResponse(data, nextCursor, ctx.headers)\n}\n\n/**\n * Statuses this endpoint will move an order TO, and the two it names as\n * refused. Kept as data so the 400 can list them and the docs can be checked\n * against the same source the handler branches on.\n */\nconst ORDER_WRITE_TARGETS: OrderFulfilmentTarget[] = ['fulfilled', 'delivered']\n\n/**\n * Transitions that exist in the commerce model and are DELIBERATELY not\n * reachable here — refused by name with a 400 that says why, never silently\n * ignored. `cancelled` releases held stock under its own transaction and\n * `refunded` moves money under another; admitting either here would hand a\n * caller a door around exactly the specifics those two routes exist to\n * enforce, and an API key is the credential least able to answer the\n * questions they ask.\n */\nconst ORDER_WRITE_REFUSED: Record<string, string> = {\n  cancelled:\n    'Canceling an order releases held stock, so it is not part of this endpoint. Cancel it in the console.',\n  refunded:\n    'Refunding an order moves money, so it is not part of this endpoint. Refund it in the console.',\n}\n\n/**\n * `PATCH /v1/sites/{siteId}/orders/{orderId}` — record a shipment (AGL-2461).\n *\n * ## The write is the console's, shared\n *\n * The transition rule, the transaction that re-asks it under the write, the\n * fulfillment append and the timeline entry are `recordOrderShipment`'s,\n * the one implementation the console's `commerce/fulfill-order` route calls\n * too. A second copy of `ORDER_TRANSITIONS` here would be the bug rather\n * than the fix: two tables drift, and drift here means the API writing an\n * order status the console forbids — `paid → delivered` skipping\n * fulfilment, or a write onto a `refunded` order. That is the class\n * AGL-1818/AGL-1819 exist to close, and it is money-adjacent.\n *\n * ## What THIS function is responsible for: all of the authorization\n *\n * `recordOrderShipment` is pre-authorized by contract — it takes `hostId`\n * on trust — so every gate is here, and all four are load-bearing:\n *\n * 1. `orders:write` on the key (checked by the caller, above).\n * 2. The `commerce` PLAN entitlement (checked by the caller, above) — the\n *    plan, never the plugin switch, which is the AGL-1873 distinction.\n * 3. **Org owns the site** — the console's `handleSites` refuses an unowned\n *    `hostId` with a 404 before it hands any site resource to its plugin,\n *    which is what keeps this from being a cross-tenant write primitive\n *    addressable by anyone who can guess a host id. Deliberately NOT\n *    re-checked here: a second copy would be a gate no test can redden\n *    (removing either one alone leaves the other answering), and an unproven\n *    guard on a cross-tenant write is worse than the one guard a test\n *    actually holds. `api-v1-order-fulfilment.spec.ts`'s \"CANNOT move\n *    another org's order\" case is that test, and it fails when\n *    `handleSites`' `orgOwnsHost` is removed.\n * 4. **This plugin is switched on for this site.** The resource is\n *    registered for every organization the console serves, so its being here\n *    says nothing about one org's configuration; without this an org that\n *    switched commerce off for a site would still accept writes into it,\n *    which is the per-site enablement rule (AGL-1014) the plugin API\n *    dispatcher applies to every other commerce door.\n *\n * ## No `Idempotency-Key`\n *\n * None is needed and none is accepted: the write returns without writing when\n * the order is already in the target status, so a retry lands the same state\n * AND returns the same `200` with the same order body — the contract\n * `updateRecord`, `updateContact` and `updateFormSubmission` are held to.\n */\nasync function updateOrder(\n  request: Request,\n  ctx: ApiV1Context,\n  hostId: string,\n  orderId: string,\n): Promise<Response> {\n  const body = await readJsonBody(request)\n  const unknown = Object.keys(body).filter(\n    (key) => key !== 'status' && key !== 'carrier' && key !== 'trackingNumber',\n  )\n  if (unknown.length > 0) {\n    // Named, not dropped — the `updateFormSubmission` / `updateContact` rule.\n    // A silently ignored `trackingUrl` here reads as \"we recorded your\n    // shipment as you described it\" when half of it went nowhere, and the\n    // caller is a warehouse system that will never look again.\n    return ApiErrors.badRequest({\n      message:\n        'Only `status`, `carrier` and `trackingNumber` can be set on an order',\n      code: 'validation_failed',\n      fields: Object.fromEntries(\n        unknown.map((key) => [key, 'Not writable on an order']),\n      ),\n      headers: ctx.headers,\n    })\n  }\n\n  const status = String(body.status ?? '')\n  const refusal = ORDER_WRITE_REFUSED[status]\n  if (refusal) {\n    return ApiErrors.badRequest({\n      message: refusal,\n      code: 'validation_failed',\n      fields: { status: refusal },\n      headers: ctx.headers,\n    })\n  }\n  if (!(ORDER_WRITE_TARGETS as string[]).includes(status)) {\n    return ApiErrors.badRequest({\n      message: 'Order failed validation',\n      code: 'validation_failed',\n      fields: {\n        status: `Must be one of: ${ORDER_WRITE_TARGETS.join(', ')}`,\n      },\n      headers: ctx.headers,\n    })\n  }\n  // Bounded exactly as the console route bounds them, so one field cannot be\n  // used to stuff an order document through a door the console keeps narrow.\n  const carrier = String(body.carrier ?? '').slice(0, 40)\n  const trackingNumber = String(body.trackingNumber ?? '').slice(0, 60)\n\n  // Gate 4: this plugin, on for this site.\n  const hostSnap = await hostRef(ctx, hostId).get()\n  if (!isHostPluginEnabled(ctx.org, hostSnap.data(), BUNDLE_ID)) {\n    return ApiErrors.notFound({\n      message: 'No such site',\n      headers: ctx.headers,\n    })\n  }\n\n  const outcome = await recordOrderShipment({\n    hostId,\n    orderId,\n    to: status as OrderFulfilmentTarget,\n    carrier,\n    trackingNumber,\n  })\n  if (outcome.outcome === 'no_such_order') {\n    return ApiErrors.notFound({\n      message: 'No such order',\n      headers: ctx.headers,\n    })\n  }\n  if (outcome.outcome === 'blocked') {\n    // A NEW 409 code (`order_transition`), because an integrator has to be\n    // able to tell \"the order moved on without me\" apart from every other\n    // conflict this API can raise — it is the one a fulfilment poller will\n    // actually hit, and the one it must not retry forever.\n    return ApiErrors.conflict({\n      message: `Orders in \"${outcome.from}\" cannot be marked ${status}`,\n      code: 'order_transition',\n      headers: ctx.headers,\n    })\n  }\n  // The order object, on both `recorded` and `already` — a retry lands the\n  // same state and reads the same 200. Re-read after the write so the body\n  // shows the shipment that was just recorded rather than the one before it.\n  return apiJson(orderView(await hostRef(ctx, hostId).collection('orders').doc(orderId).get()), {\n    headers: ctx.headers,\n  })\n}\n\n/**\n * Price and stock live on VARIANTS, never on the product — a product-level\n * `inventory` exists only as a denormalized sum the console rewrites on every\n * decrement, and a product-level `priceUsd` is the legacy single-variant\n * shape. Publishing either as the product's price would be wrong the moment a\n * product has two variants, so the variant array is the contract and the\n * product carries only the roll-up, clearly named.\n *\n * `inventory: null` on a variant means UNTRACKED and `0` means SOLD OUT.\n * Collapsing them (the `?? 0` an integrator writes on the first day) turns\n * every untracked product into an out-of-stock one, so the distinction is\n * carried through verbatim rather than defaulted.\n */\nfunction variantView(variant: Record<string, unknown>) {\n  const inventory = variant.inventory\n  return {\n    id: variant.id ?? null,\n    sku: variant.sku ?? null,\n    barcode: variant.barcode ?? null,\n    options: variant.options ?? {},\n    priceUsd: typeof variant.priceUsd === 'number' ? variant.priceUsd : null,\n    compareAtPriceUsd:\n      typeof variant.compareAtPriceUsd === 'number'\n        ? variant.compareAtPriceUsd\n        : null,\n    weightGrams:\n      typeof variant.weightGrams === 'number' ? variant.weightGrams : null,\n    inventory: typeof inventory === 'number' ? inventory : null,\n    inventoryTracked: typeof inventory === 'number',\n  }\n}\n\nfunction productView(doc: FirebaseFirestore.DocumentSnapshot) {\n  const data = doc.data() ?? {}\n  const variants = Array.isArray(data.variants)\n    ? (data.variants as Array<Record<string, unknown>>)\n    : []\n  const tracked = variants.filter((v) => typeof v.inventory === 'number')\n  return {\n    id: doc.id,\n    object: 'product',\n    name: data.name ?? null,\n    slug: data.slug ?? null,\n    description: data.description ?? null,\n    type: data.type ?? null,\n    status: data.status ?? null,\n    tags: data.tags ?? [],\n    categoryIds: data.categoryIds ?? [],\n    mediaUrls: data.mediaUrls ?? [],\n    options: data.options ?? [],\n    variants: variants.map(variantView),\n    // The sum across TRACKED variants only, and `null` when none of them is\n    // tracked — so an untracked catalogue reads as \"we don't count this\"\n    // rather than as a store with nothing left to sell.\n    inventory: tracked.length\n      ? tracked.reduce((sum, v) => sum + Number(v.inventory ?? 0), 0)\n      : null,\n    subscription: serialize(data.subscription) ?? null,\n    created: data.createdAtMs ? new Date(Number(data.createdAtMs)).toISOString() : null,\n    updated: data.updatedAtMs ? new Date(Number(data.updatedAtMs)).toISOString() : null,\n  }\n}\n\nexport async function handleProducts(\n  request: Request,\n  ctx: ApiV1Context,\n  segments: string[],\n  url: URL,\n): Promise<Response> {\n  const [, hostId, , productId] = segments\n  const denied = requireScope(ctx, 'products:read')\n  if (denied) return denied\n  const unentitled = requireCommerce(ctx)\n  if (unentitled) return unentitled\n  if (request.method !== 'GET') {\n    return ApiErrors.methodNotAllowed({ headers: ctx.headers })\n  }\n  const collection = hostRef(ctx, hostId).collection('products')\n\n  if (productId) {\n    const snap = await collection.doc(productId).get()\n    // A soft-deleted product is gone as far as a customer is concerned. The\n    // console filters `deletedAt` client-side; the API must not hand back a\n    // product the merchant deleted just because the document survives.\n    if (!snap.exists || snap.get('deletedAt')) {\n      return ApiErrors.notFound({ message: 'No such product', headers: ctx.headers })\n    }\n    return apiJson(productView(snap), { headers: ctx.headers })\n  }\n\n  let query: FirebaseFirestore.Query = collection\n  const status = url.searchParams.get('status')\n  if (status) query = query.where('status', '==', status)\n  const { docs, nextCursor } = await paginate(query, url)\n  const data = docs.filter((doc) => !doc.get('deletedAt')).map(productView)\n  return listResponse(data, nextCursor, ctx.headers)\n}\n\n"],"names":["checkEntitlement","isHostPluginEnabled","ApiErrors","apiJson","listResponse","paginate","readJsonBody","requireScope","serialize","BUNDLE_ID","recordOrderShipment","requireCommerce","ctx","org","planRequired","message","code","headers","hostRef","hostId","firestore","collection","doc","orderView","data","totals","legacyTotal","Number","amountCents","NaN","totalCents","isFinite","legacyFee","feeCents","id","object","number","status","channel","currency","customerEmail","customerName","lineItems","itemsCents","shippingCents","taxCents","discountCents","refundedCents","disputed","Boolean","dispute","shippingAddress","couponCode","fulfillments","Array","isArray","map","entry","atMs","lineItemIds","carrier","trackingNumber","trackingUrl","at","Date","toISOString","created","createdAt","handleOrders","request","segments","url","orderId","method","deniedWrite","unentitledWrite","updateOrder","denied","unentitled","methodNotAllowed","Allow","snap","get","exists","notFound","query","searchParams","where","docs","nextCursor","filter","order","ORDER_WRITE_TARGETS","ORDER_WRITE_REFUSED","cancelled","refunded","body","unknown","Object","keys","key","length","badRequest","fields","fromEntries","String","refusal","includes","join","slice","hostSnap","outcome","to","conflict","from","variantView","variant","inventory","sku","barcode","options","priceUsd","compareAtPriceUsd","weightGrams","inventoryTracked","productView","variants","tracked","v","name","slug","description","type","tags","categoryIds","mediaUrls","reduce","sum","subscription","createdAtMs","updated","updatedAtMs","handleProducts","productId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,EAAEC,mBAAmB,QAAQ,sBAAqB;AAC3E,SACEC,SAAS,EACTC,OAAO,EACPC,YAAY,QACP,2BAA0B;AACjC,SAEEC,QAAQ,EACRC,YAAY,EACZC,YAAY,EACZC,SAAS,QACJ,6CAA4C;AACnD,SAASC,SAAS,QAAQ,mCAA+B;AACzD,SAAqCC,mBAAmB,QAAQ,sBAAkB;AAElF;;;;;;;;CAQC,GAED;;;;;;;;;;;;;;CAcC,GACD,SAASC,gBAAgBC,GAAiB;IACxC,OAAOZ,iBAAiBY,IAAIC,GAAG,EAAE,cAC7B,OACAX,UAAUY,YAAY,CAAC;QACrBC,SAAS;QACTC,MAAM;QACNC,SAASL,IAAIK,OAAO;IACtB;AACN;AAEA,SAASC,QAAQN,GAAiB,EAAEO,MAAc;IAChD,OAAOP,IAAIQ,SAAS,CAACC,UAAU,CAAC,SAASC,GAAG,CAACH;AAC/C;AAEA;;;;;;;;;CASC,GACD,SAASI,UAAUD,GAAuC;QAC3CA,WACGE,cACWA,mBAMFA,gBAKdA,cACCA,eAEKA,qBACDA,oBACOA,iBAEAC,oBACGA,uBACLA,kBACKA,uBAaFD,qBAELhB,YACLgB,kBA6BHhB;IApEX,MAAMgB,QAAOF,YAAAA,IAAIE,IAAI,cAARF,YAAc,CAAC;IAC5B,MAAMG,UAAUD,eAAAA,KAAKC,MAAM,YAAXD,eAAe,CAAC;IAChC,MAAME,cAAcC,QAAOH,oBAAAA,KAAKI,WAAW,YAAhBJ,oBAAoBK;IAC/C,MAAMC,aAAaH,OAAOI,QAAQ,CAACJ,OAAOF,OAAOK,UAAU,KACvDH,OAAOF,OAAOK,UAAU,IACxBH,OAAOI,QAAQ,CAACL,eACdA,cACA;IACN,MAAMM,YAAYL,QAAOH,iBAAAA,KAAKS,QAAQ,YAAbT,iBAAiBK;IAC1C,OAAO;QACLK,IAAIZ,IAAIY,EAAE;QACVC,QAAQ;QACRC,QAAQ,OAAOZ,KAAKY,MAAM,KAAK,WAAWZ,KAAKY,MAAM,GAAG;QACxDC,MAAM,GAAGb,eAAAA,KAAKa,MAAM,YAAXb,eAA0B;QACnCc,OAAO,GAAGd,gBAAAA,KAAKc,OAAO,YAAZd,gBAA2B;QACrCe,UAAU;QACVC,aAAa,GAAEhB,sBAAAA,KAAKgB,aAAa,YAAlBhB,sBAAsB;QACrCiB,YAAY,GAAEjB,qBAAAA,KAAKiB,YAAY,YAAjBjB,qBAAqB;QACnCkB,WAAWlC,WAAUgB,kBAAAA,KAAKkB,SAAS,YAAdlB,kBAAkB,EAAE;QACzCC,QAAQ;YACNkB,YAAYhB,QAAOF,qBAAAA,OAAOkB,UAAU,YAAjBlB,qBAAqB;YACxCmB,eAAejB,QAAOF,wBAAAA,OAAOmB,aAAa,YAApBnB,wBAAwB;YAC9CoB,UAAUlB,QAAOF,mBAAAA,OAAOoB,QAAQ,YAAfpB,mBAAmB;YACpCqB,eAAenB,QAAOF,wBAAAA,OAAOqB,aAAa,YAApBrB,wBAAwB;YAC9CK;YACA,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClEG,UAAUN,OAAOI,QAAQ,CAACJ,OAAOF,OAAOQ,QAAQ,KAC5CN,OAAOF,OAAOQ,QAAQ,IACtBN,OAAOI,QAAQ,CAACC,aACdA,YACA;QACR;QACA,0EAA0E;QAC1E,wEAAwE;QACxEe,eAAepB,QAAOH,sBAAAA,KAAKuB,aAAa,YAAlBvB,sBAAsB;QAC5CwB,UAAUC,QAAQzB,KAAK0B,OAAO;QAC9BC,eAAe,GAAE3C,aAAAA,UAAUgB,KAAK2B,eAAe,aAA9B3C,aAAmC;QACpD4C,UAAU,GAAE5B,mBAAAA,KAAK4B,UAAU,YAAf5B,mBAAmB;QAC/B,mEAAmE;QACnE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,gEAAgE;QAChE,EAAE;QACF,oEAAoE;QACpE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,kEAAkE;QAClE6B,cAAc,AAACC,CAAAA,MAAMC,OAAO,CAAC/B,KAAK6B,YAAY,IAAI7B,KAAK6B,YAAY,GAAG,EAAE,AAAD,EAAGG,GAAG,CAC3E,CAACC;gBAGO,KAIK,UACO,iBACH;YARf,MAAMC,OAAO/B,OAAO,CAAC8B,gBAAAA,QAAS,CAAC,GAAGC,IAAI;YACtC,OAAO;gBACLxB,EAAE,GAAE,MAAA,CAACuB,gBAAAA,QAAS,CAAC,GAAGvB,EAAE,YAAhB,MAAoB;gBACxByB,aAAaL,MAAMC,OAAO,CAAC,CAACE,gBAAAA,QAAS,CAAC,GAAGE,WAAW,IAChD,AAACF,MAAqCE,WAAW,GACjD,EAAE;gBACNC,OAAO,GAAE,WAAA,CAACH,gBAAAA,QAAS,CAAC,GAAGG,OAAO,YAArB,WAAyB;gBAClCC,cAAc,GAAE,kBAAA,CAACJ,gBAAAA,QAAS,CAAC,GAAGI,cAAc,YAA5B,kBAAgC;gBAChDC,WAAW,GAAE,eAAA,CAACL,gBAAAA,QAAS,CAAC,GAAGK,WAAW,YAAzB,eAA6B;gBAC1CC,IAAIpC,OAAOI,QAAQ,CAAC2B,QAAQ,IAAIM,KAAKN,MAAMO,WAAW,KAAK;YAC7D;QACF;QAEFC,OAAO,GAAE1D,cAAAA,UAAUgB,KAAK2C,SAAS,aAAxB3D,cAA6B;IACxC;AACF;AAEA,OAAO,eAAe4D,aACpBC,OAAgB,EAChBzD,GAAiB,EACjB0D,QAAkB,EAClBC,GAAQ;IAER,MAAM,GAAGpD,UAAUqD,QAAQ,GAAGF;IAC9B,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,QAAQ;IACR,IAAID,QAAQI,MAAM,KAAK,WAAWD,SAAS;QACzC,MAAME,cAAcnE,aAAaK,KAAK;QACtC,IAAI8D,aAAa,OAAOA;QACxB,MAAMC,kBAAkBhE,gBAAgBC;QACxC,IAAI+D,iBAAiB,OAAOA;QAC5B,OAAOC,YAAYP,SAASzD,KAAKO,QAAQqD;IAC3C;IACA,MAAMK,SAAStE,aAAaK,KAAK;IACjC,IAAIiE,QAAQ,OAAOA;IACnB,MAAMC,aAAanE,gBAAgBC;IACnC,IAAIkE,YAAY,OAAOA;IACvB,IAAIT,QAAQI,MAAM,KAAK,OAAO;QAC5B,OAAOvE,UAAU6E,gBAAgB,CAAC;YAChC9D,SAAS,aAAKL,IAAIK,OAAO;gBAAE+D,OAAOR,UAAU,eAAe;;QAC7D;IACF;IACA,MAAMnD,aAAaH,QAAQN,KAAKO,QAAQE,UAAU,CAAC;IAEnD,IAAImD,SAAS;QACX,MAAMS,OAAO,MAAM5D,WAAWC,GAAG,CAACkD,SAASU,GAAG;QAC9C,IAAI,CAACD,KAAKE,MAAM,EAAE;YAChB,OAAOjF,UAAUkF,QAAQ,CAAC;gBAAErE,SAAS;gBAAiBE,SAASL,IAAIK,OAAO;YAAC;QAC7E;QACA,OAAOd,QAAQoB,UAAU0D,OAAO;YAAEhE,SAASL,IAAIK,OAAO;QAAC;IACzD;IAEA,IAAIoE,QAAiChE;IACrC,MAAMgB,SAASkC,IAAIe,YAAY,CAACJ,GAAG,CAAC;IACpC,IAAI7C,QAAQgD,QAAQA,MAAME,KAAK,CAAC,UAAU,MAAMlD;IAChD,MAAMC,UAAUiC,IAAIe,YAAY,CAACJ,GAAG,CAAC;IACrC,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,sCAAsC;IACtC,IAAI5C,WAAWA,YAAY,UAAU+C,QAAQA,MAAME,KAAK,CAAC,WAAW,MAAMjD;IAC1E,MAAM,EAAEkD,IAAI,EAAEC,UAAU,EAAE,GAAG,MAAMpF,SAASgF,OAAOd;IACnD,MAAM/C,OAAOgE,KACVhC,GAAG,CAACjC,WACJmE,MAAM,CAAC,CAACC,QAAWrD,YAAY,WAAWqD,MAAMrD,OAAO,KAAK,WAAW;IAC1E,OAAOlC,aAAaoB,MAAMiE,YAAY7E,IAAIK,OAAO;AACnD;AAEA;;;;CAIC,GACD,MAAM2E,sBAA+C;IAAC;IAAa;CAAY;AAE/E;;;;;;;;CAQC,GACD,MAAMC,sBAA8C;IAClDC,WACE;IACFC,UACE;AACJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CC,GACD,eAAenB,YACbP,OAAgB,EAChBzD,GAAiB,EACjBO,MAAc,EACdqD,OAAe;QAsBOwB,cAsBCA,eACOA;IA3C9B,MAAMA,OAAO,MAAM1F,aAAa+D;IAChC,MAAM4B,UAAUC,OAAOC,IAAI,CAACH,MAAMN,MAAM,CACtC,CAACU,MAAQA,QAAQ,YAAYA,QAAQ,aAAaA,QAAQ;IAE5D,IAAIH,QAAQI,MAAM,GAAG,GAAG;QACtB,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,2DAA2D;QAC3D,OAAOnG,UAAUoG,UAAU,CAAC;YAC1BvF,SACE;YACFC,MAAM;YACNuF,QAAQL,OAAOM,WAAW,CACxBP,QAAQzC,GAAG,CAAC,CAAC4C,MAAQ;oBAACA;oBAAK;iBAA2B;YAExDnF,SAASL,IAAIK,OAAO;QACtB;IACF;IAEA,MAAMoB,SAASoE,QAAOT,eAAAA,KAAK3D,MAAM,YAAX2D,eAAe;IACrC,MAAMU,UAAUb,mBAAmB,CAACxD,OAAO;IAC3C,IAAIqE,SAAS;QACX,OAAOxG,UAAUoG,UAAU,CAAC;YAC1BvF,SAAS2F;YACT1F,MAAM;YACNuF,QAAQ;gBAAElE,QAAQqE;YAAQ;YAC1BzF,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,IAAI,CAAC,AAAC2E,oBAAiCe,QAAQ,CAACtE,SAAS;QACvD,OAAOnC,UAAUoG,UAAU,CAAC;YAC1BvF,SAAS;YACTC,MAAM;YACNuF,QAAQ;gBACNlE,QAAQ,CAAC,gBAAgB,EAAEuD,oBAAoBgB,IAAI,CAAC,OAAO;YAC7D;YACA3F,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM2C,UAAU6C,QAAOT,gBAAAA,KAAKpC,OAAO,YAAZoC,gBAAgB,IAAIa,KAAK,CAAC,GAAG;IACpD,MAAMhD,iBAAiB4C,QAAOT,uBAAAA,KAAKnC,cAAc,YAAnBmC,uBAAuB,IAAIa,KAAK,CAAC,GAAG;IAElE,yCAAyC;IACzC,MAAMC,WAAW,MAAM5F,QAAQN,KAAKO,QAAQ+D,GAAG;IAC/C,IAAI,CAACjF,oBAAoBW,IAAIC,GAAG,EAAEiG,SAAStF,IAAI,IAAIf,YAAY;QAC7D,OAAOP,UAAUkF,QAAQ,CAAC;YACxBrE,SAAS;YACTE,SAASL,IAAIK,OAAO;QACtB;IACF;IAEA,MAAM8F,UAAU,MAAMrG,oBAAoB;QACxCS;QACAqD;QACAwC,IAAI3E;QACJuB;QACAC;IACF;IACA,IAAIkD,QAAQA,OAAO,KAAK,iBAAiB;QACvC,OAAO7G,UAAUkF,QAAQ,CAAC;YACxBrE,SAAS;YACTE,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,IAAI8F,QAAQA,OAAO,KAAK,WAAW;QACjC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,uDAAuD;QACvD,OAAO7G,UAAU+G,QAAQ,CAAC;YACxBlG,SAAS,CAAC,WAAW,EAAEgG,QAAQG,IAAI,CAAC,mBAAmB,EAAE7E,QAAQ;YACjErB,MAAM;YACNC,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,OAAOd,QAAQoB,UAAU,MAAML,QAAQN,KAAKO,QAAQE,UAAU,CAAC,UAAUC,GAAG,CAACkD,SAASU,GAAG,KAAK;QAC5FjE,SAASL,IAAIK,OAAO;IACtB;AACF;AAEA;;;;;;;;;;;;CAYC,GACD,SAASkG,YAAYC,OAAgC;QAG7CA,aACCA,cACIA,kBACAA;IALX,MAAMC,YAAYD,QAAQC,SAAS;IACnC,OAAO;QACLnF,EAAE,GAAEkF,cAAAA,QAAQlF,EAAE,YAAVkF,cAAc;QAClBE,GAAG,GAAEF,eAAAA,QAAQE,GAAG,YAAXF,eAAe;QACpBG,OAAO,GAAEH,mBAAAA,QAAQG,OAAO,YAAfH,mBAAmB;QAC5BI,OAAO,GAAEJ,mBAAAA,QAAQI,OAAO,YAAfJ,mBAAmB,CAAC;QAC7BK,UAAU,OAAOL,QAAQK,QAAQ,KAAK,WAAWL,QAAQK,QAAQ,GAAG;QACpEC,mBACE,OAAON,QAAQM,iBAAiB,KAAK,WACjCN,QAAQM,iBAAiB,GACzB;QACNC,aACE,OAAOP,QAAQO,WAAW,KAAK,WAAWP,QAAQO,WAAW,GAAG;QAClEN,WAAW,OAAOA,cAAc,WAAWA,YAAY;QACvDO,kBAAkB,OAAOP,cAAc;IACzC;AACF;AAEA,SAASQ,YAAYvG,GAAuC;QAC7CA,WAQLE,YACAA,YACOA,mBACPA,YACEA,cACFA,YACOA,mBACFA,iBACFA,eAQKhB;IAxBhB,MAAMgB,QAAOF,YAAAA,IAAIE,IAAI,cAARF,YAAc,CAAC;IAC5B,MAAMwG,WAAWxE,MAAMC,OAAO,CAAC/B,KAAKsG,QAAQ,IACvCtG,KAAKsG,QAAQ,GACd,EAAE;IACN,MAAMC,UAAUD,SAASpC,MAAM,CAAC,CAACsC,IAAM,OAAOA,EAAEX,SAAS,KAAK;IAC9D,OAAO;QACLnF,IAAIZ,IAAIY,EAAE;QACVC,QAAQ;QACR8F,IAAI,GAAEzG,aAAAA,KAAKyG,IAAI,YAATzG,aAAa;QACnB0G,IAAI,GAAE1G,aAAAA,KAAK0G,IAAI,YAAT1G,aAAa;QACnB2G,WAAW,GAAE3G,oBAAAA,KAAK2G,WAAW,YAAhB3G,oBAAoB;QACjC4G,IAAI,GAAE5G,aAAAA,KAAK4G,IAAI,YAAT5G,aAAa;QACnBa,MAAM,GAAEb,eAAAA,KAAKa,MAAM,YAAXb,eAAe;QACvB6G,IAAI,GAAE7G,aAAAA,KAAK6G,IAAI,YAAT7G,aAAa,EAAE;QACrB8G,WAAW,GAAE9G,oBAAAA,KAAK8G,WAAW,YAAhB9G,oBAAoB,EAAE;QACnC+G,SAAS,GAAE/G,kBAAAA,KAAK+G,SAAS,YAAd/G,kBAAkB,EAAE;QAC/BgG,OAAO,GAAEhG,gBAAAA,KAAKgG,OAAO,YAAZhG,gBAAgB,EAAE;QAC3BsG,UAAUA,SAAStE,GAAG,CAAC2D;QACvB,wEAAwE;QACxE,qEAAqE;QACrE,oDAAoD;QACpDE,WAAWU,QAAQ1B,MAAM,GACrB0B,QAAQS,MAAM,CAAC,CAACC,KAAKT;gBAAmBA;mBAAbS,MAAM9G,QAAOqG,eAAAA,EAAEX,SAAS,YAAXW,eAAe;WAAI,KAC3D;QACJU,YAAY,GAAElI,aAAAA,UAAUgB,KAAKkH,YAAY,aAA3BlI,aAAgC;QAC9C0D,SAAS1C,KAAKmH,WAAW,GAAG,IAAI3E,KAAKrC,OAAOH,KAAKmH,WAAW,GAAG1E,WAAW,KAAK;QAC/E2E,SAASpH,KAAKqH,WAAW,GAAG,IAAI7E,KAAKrC,OAAOH,KAAKqH,WAAW,GAAG5E,WAAW,KAAK;IACjF;AACF;AAEA,OAAO,eAAe6E,eACpBzE,OAAgB,EAChBzD,GAAiB,EACjB0D,QAAkB,EAClBC,GAAQ;IAER,MAAM,GAAGpD,UAAU4H,UAAU,GAAGzE;IAChC,MAAMO,SAAStE,aAAaK,KAAK;IACjC,IAAIiE,QAAQ,OAAOA;IACnB,MAAMC,aAAanE,gBAAgBC;IACnC,IAAIkE,YAAY,OAAOA;IACvB,IAAIT,QAAQI,MAAM,KAAK,OAAO;QAC5B,OAAOvE,UAAU6E,gBAAgB,CAAC;YAAE9D,SAASL,IAAIK,OAAO;QAAC;IAC3D;IACA,MAAMI,aAAaH,QAAQN,KAAKO,QAAQE,UAAU,CAAC;IAEnD,IAAI0H,WAAW;QACb,MAAM9D,OAAO,MAAM5D,WAAWC,GAAG,CAACyH,WAAW7D,GAAG;QAChD,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAACD,KAAKE,MAAM,IAAIF,KAAKC,GAAG,CAAC,cAAc;YACzC,OAAOhF,UAAUkF,QAAQ,CAAC;gBAAErE,SAAS;gBAAmBE,SAASL,IAAIK,OAAO;YAAC;QAC/E;QACA,OAAOd,QAAQ0H,YAAY5C,OAAO;YAAEhE,SAASL,IAAIK,OAAO;QAAC;IAC3D;IAEA,IAAIoE,QAAiChE;IACrC,MAAMgB,SAASkC,IAAIe,YAAY,CAACJ,GAAG,CAAC;IACpC,IAAI7C,QAAQgD,QAAQA,MAAME,KAAK,CAAC,UAAU,MAAMlD;IAChD,MAAM,EAAEmD,IAAI,EAAEC,UAAU,EAAE,GAAG,MAAMpF,SAASgF,OAAOd;IACnD,MAAM/C,OAAOgE,KAAKE,MAAM,CAAC,CAACpE,MAAQ,CAACA,IAAI4D,GAAG,CAAC,cAAc1B,GAAG,CAACqE;IAC7D,OAAOzH,aAAaoB,MAAMiE,YAAY7E,IAAIK,OAAO;AACnD"}
+{"version":3,"sources":["../../../../../../../../libs/plugins/commerce/src/lib/server/api-v1/orders-and-products.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { checkEntitlement, isHostPluginEnabled } from '@aglyn/aglyn/server'\nimport {\n  ApiErrors,\n  apiJson,\n  listResponse,\n} from '@aglyn/tenant-data-admin'\nimport {\n  type ApiV1Context,\n  paginate,\n  readJsonBody,\n  requireScope,\n  serialize,\n} from '@aglyn/tenant-data-admin/server/api-v1-kit'\nimport { BUNDLE_ID } from '../../constants/bundle-common'\nimport { type OrderFulfilmentTarget, recordOrderShipment } from '../fulfill-order'\nimport { orderViewFromData } from './order-view'\n\n/**\n * A site's orders and products on the customer REST API,\n * `/v1/sites/{siteId}/orders/…` and `/v1/sites/{siteId}/products/…`\n * (AGL-1928, AGL-2461, AGL-3080). Registered from this plugin's console\n * server declarations; the console's `/v1` router owns the pipeline in\n * front — the key, the plan's API access, the request quota, the rate limit —\n * and refuses a site the key's organization does not own before it hands a\n * request here.\n */\n\n/**\n * Commerce resources need the `commerce` entitlement as well as the scope\n * (AGL-1928). `apiAccess` alone is the wrong gate here: it says the org may\n * call the API at all, not that it may still use the store. AGL-1873 closed\n * exactly this class on the write side — two money doors that asked the\n * plugin switch (`org.enabledPlugins`) instead of the plan, so a lapsed org\n * kept selling — and the same reasoning applies to a read. `enabledPlugins`\n * is the customer's own on/off switch and survives a downgrade; the plan does\n * not, and the published rule is that paid features stop at the door when the\n * plan no longer includes them.\n *\n * Answered as `plan_required` rather than `not_found`, deliberately. Hiding a\n * store that plainly exists behind a 404 sends an integrator hunting a wrong\n * site id; the honest answer names the plan.\n */\nfunction requireCommerce(ctx: ApiV1Context): Response | null {\n  return checkEntitlement(ctx.org, 'commerce')\n    ? null\n    : ApiErrors.planRequired({\n        message: 'Commerce is not included in this organization’s plan',\n        code: 'commerce',\n        headers: ctx.headers,\n      })\n}\n\nfunction hostRef(ctx: ApiV1Context, hostId: string) {\n  return ctx.firestore.collection('hosts').doc(hostId)\n}\n\n/**\n * Orders carry a legacy Commerce Starter shape (AGL-90) alongside the modern\n * one: `amountCents`/`feeCents` at the top level rather than a `totals` map.\n * The console lifts them through `CommerceModel.liftLegacyOrder` and reads\n * `lifted.totals?.totalCents ?? order.amountCents`. The API cannot publish two\n * shapes for one object, so the legacy fields are folded into `totals` here\n * and a client only ever sees the modern one. `channel` defaults to `online`\n * for the same reason the console's list does — an absent channel is a\n * pre-channel order, not an unknown one.\n */\nfunction orderView(doc: FirebaseFirestore.DocumentSnapshot) {\n  return orderViewFromData(doc.id, doc.data() ?? {})\n}\n\nexport async function handleOrders(\n  request: Request,\n  ctx: ApiV1Context,\n  segments: string[],\n  url: URL,\n): Promise<Response> {\n  const [, hostId, , orderId] = segments\n  // `orders:write` is checked BEFORE `orders:read`, matching `handleSites`\n  // and `handleScopedMedia` (AGL-900): a fulfilment key that only records\n  // shipments must not be told it lacks a read scope it was never meant to\n  // hold.\n  if (request.method === 'PATCH' && orderId) {\n    const deniedWrite = requireScope(ctx, 'orders:write')\n    if (deniedWrite) return deniedWrite\n    const unentitledWrite = requireCommerce(ctx)\n    if (unentitledWrite) return unentitledWrite\n    return updateOrder(request, ctx, hostId, orderId)\n  }\n  const denied = requireScope(ctx, 'orders:read')\n  if (denied) return denied\n  const unentitled = requireCommerce(ctx)\n  if (unentitled) return unentitled\n  if (request.method !== 'GET') {\n    return ApiErrors.methodNotAllowed({\n      headers: { ...ctx.headers, Allow: orderId ? 'GET, PATCH' : 'GET' },\n    })\n  }\n  const collection = hostRef(ctx, hostId).collection('orders')\n\n  if (orderId) {\n    const snap = await collection.doc(orderId).get()\n    if (!snap.exists) {\n      return ApiErrors.notFound({ message: 'No such order', headers: ctx.headers })\n    }\n    return apiJson(orderView(snap), { headers: ctx.headers })\n  }\n\n  let query: FirebaseFirestore.Query = collection\n  const status = url.searchParams.get('status')\n  if (status) query = query.where('status', '==', status)\n  const channel = url.searchParams.get('channel')\n  // `online` is the DEFAULT, not a stored value on older orders, so filtering\n  // for it in Firestore would silently drop every pre-channel order. Those are\n  // exactly the oldest orders an accounting backfill is reaching for, so this\n  // one value is filtered after the read instead. The page can therefore come\n  // back shorter than `limit` while `has_more` is still true — which the\n  // published pagination contract already tells clients to expect (check\n  // `has_more`, never a page's length).\n  if (channel && channel !== 'online') query = query.where('channel', '==', channel)\n  const { docs, nextCursor } = await paginate(query, url)\n  const data = docs\n    .map(orderView)\n    .filter((order) => (channel === 'online' ? order.channel === 'online' : true))\n  return listResponse(data, nextCursor, ctx.headers)\n}\n\n/**\n * Statuses this endpoint will move an order TO, and the two it names as\n * refused. Kept as data so the 400 can list them and the docs can be checked\n * against the same source the handler branches on.\n */\nconst ORDER_WRITE_TARGETS: OrderFulfilmentTarget[] = ['fulfilled', 'delivered']\n\n/** The keys a PATCH may carry (AGL-3611 added the last three). */\nconst ORDER_WRITABLE_KEYS = ['status', 'carrier', 'trackingNumber', 'trackingUrl', 'lineItems', 'notify']\n\n/**\n * Transitions that exist in the commerce model and are DELIBERATELY not\n * reachable here — refused by name with a 400 that says why, never silently\n * ignored. `cancelled` releases held stock under its own transaction and\n * `refunded` moves money under another; admitting either here would hand a\n * caller a door around exactly the specifics those two routes exist to\n * enforce, and an API key is the credential least able to answer the\n * questions they ask.\n */\nconst ORDER_WRITE_REFUSED: Record<string, string> = {\n  cancelled:\n    'Canceling an order releases held stock, so it is not part of this endpoint. Cancel it in the console.',\n  refunded:\n    'Refunding an order moves money, so it is not part of this endpoint. Refund it in the console.',\n}\n\n/**\n * `PATCH /v1/sites/{siteId}/orders/{orderId}` — record a shipment (AGL-2461).\n *\n * ## The write is the console's, shared\n *\n * The transition rule, the transaction that re-asks it under the write, the\n * fulfillment append and the timeline entry are `recordOrderShipment`'s,\n * the one implementation the console's `commerce/fulfill-order` route calls\n * too. A second copy of `ORDER_TRANSITIONS` here would be the bug rather\n * than the fix: two tables drift, and drift here means the API writing an\n * order status the console forbids — `paid → delivered` skipping\n * fulfilment, or a write onto a `refunded` order. That is the class\n * AGL-1818/AGL-1819 exist to close, and it is money-adjacent.\n *\n * ## What THIS function is responsible for: all of the authorization\n *\n * `recordOrderShipment` is pre-authorized by contract — it takes `hostId`\n * on trust — so every gate is here, and all four are load-bearing:\n *\n * 1. `orders:write` on the key (checked by the caller, above).\n * 2. The `commerce` PLAN entitlement (checked by the caller, above) — the\n *    plan, never the plugin switch, which is the AGL-1873 distinction.\n * 3. **Org owns the site** — the console's `handleSites` refuses an unowned\n *    `hostId` with a 404 before it hands any site resource to its plugin,\n *    which is what keeps this from being a cross-tenant write primitive\n *    addressable by anyone who can guess a host id. Deliberately NOT\n *    re-checked here: a second copy would be a gate no test can redden\n *    (removing either one alone leaves the other answering), and an unproven\n *    guard on a cross-tenant write is worse than the one guard a test\n *    actually holds. `api-v1-order-fulfilment.spec.ts`'s \"CANNOT move\n *    another org's order\" case is that test, and it fails when\n *    `handleSites`' `orgOwnsHost` is removed.\n * 4. **This plugin is switched on for this site.** The resource is\n *    registered for every organization the console serves, so its being here\n *    says nothing about one org's configuration; without this an org that\n *    switched commerce off for a site would still accept writes into it,\n *    which is the per-site enablement rule (AGL-1014) the plugin API\n *    dispatcher applies to every other commerce door.\n *\n * ## No `Idempotency-Key`\n *\n * None is needed and none is accepted: the write returns without writing when\n * the order is already in the target status, so a retry lands the same state\n * AND returns the same `200` with the same order body — the contract\n * `updateRecord`, `updateContact` and `updateFormSubmission` are held to.\n */\nasync function updateOrder(\n  request: Request,\n  ctx: ApiV1Context,\n  hostId: string,\n  orderId: string,\n): Promise<Response> {\n  const body = await readJsonBody(request)\n  const unknown = Object.keys(body).filter((key) => !ORDER_WRITABLE_KEYS.includes(key))\n  if (unknown.length > 0) {\n    // Named, not dropped — the `updateFormSubmission` / `updateContact` rule.\n    // A silently ignored `trackingUrl` here reads as \"we recorded your\n    // shipment as you described it\" when half of it went nowhere, and the\n    // caller is a warehouse system that will never look again.\n    return ApiErrors.badRequest({\n      message:\n        'Only `status`, `carrier`, `trackingNumber`, `trackingUrl`, `lineItems` and `notify` can be set on an order',\n      code: 'validation_failed',\n      fields: Object.fromEntries(\n        unknown.map((key) => [key, 'Not writable on an order']),\n      ),\n      headers: ctx.headers,\n    })\n  }\n\n  const status = String(body.status ?? '')\n  const refusal = ORDER_WRITE_REFUSED[status]\n  if (refusal) {\n    return ApiErrors.badRequest({\n      message: refusal,\n      code: 'validation_failed',\n      fields: { status: refusal },\n      headers: ctx.headers,\n    })\n  }\n  if (!(ORDER_WRITE_TARGETS as string[]).includes(status)) {\n    return ApiErrors.badRequest({\n      message: 'Order failed validation',\n      code: 'validation_failed',\n      fields: {\n        status: `Must be one of: ${ORDER_WRITE_TARGETS.join(', ')}`,\n      },\n      headers: ctx.headers,\n    })\n  }\n  // Bounded exactly as the console route bounds them, so one field cannot be\n  // used to stuff an order document through a door the console keeps narrow.\n  const carrier = String(body.carrier ?? '').slice(0, 40)\n  const trackingNumber = String(body.trackingNumber ?? '').slice(0, 60)\n  // Partial shipments (AGL-3611): `lineItems: [{ lineItemId, quantity }]`.\n  // Absent keeps the old meaning, everything still to ship.\n  let lineItems: Array<{ lineItemId: number; quantity: number }> | undefined\n  if (body.lineItems !== undefined) {\n    if (status !== 'fulfilled' || !Array.isArray(body.lineItems) || body.lineItems.length === 0) {\n      return ApiErrors.badRequest({\n        message: 'Order failed validation',\n        code: 'validation_failed',\n        fields: {\n          lineItems:\n            status !== 'fulfilled'\n              ? 'Only a `fulfilled` update names line items'\n              : 'Must be a non-empty array of { lineItemId, quantity }',\n        },\n        headers: ctx.headers,\n      })\n    }\n    lineItems = (body.lineItems as unknown[]).slice(0, 500).map((entry) => ({\n      lineItemId: Number((entry as Record<string, unknown>)?.lineItemId),\n      quantity: Number((entry as Record<string, unknown>)?.quantity),\n    }))\n  }\n  const idempotencyKey = request.headers.get('idempotency-key') ?? undefined\n\n  // Gate 4: this plugin, on for this site.\n  const hostSnap = await hostRef(ctx, hostId).get()\n  if (!isHostPluginEnabled(ctx.org, hostSnap.data(), BUNDLE_ID)) {\n    return ApiErrors.notFound({\n      message: 'No such site',\n      headers: ctx.headers,\n    })\n  }\n\n  const outcome = await recordOrderShipment({\n    hostId,\n    orderId,\n    to: status as OrderFulfilmentTarget,\n    carrier,\n    trackingNumber,\n    ...(lineItems ? { lineItems } : {}),\n    ...(typeof body.trackingUrl === 'string' ? { trackingUrl: body.trackingUrl } : {}),\n    ...(body.notify === false ? { notify: false } : {}),\n    ...(idempotencyKey ? { idempotencyKey } : {}),\n  })\n  if (outcome.outcome === 'invalid_lines') {\n    return outcome.problem.problem === 'over_fulfilled'\n      ? ApiErrors.conflict({\n          message: outcome.message,\n          code: 'over_fulfilled',\n          headers: ctx.headers,\n        })\n      : ApiErrors.badRequest({\n          message: 'Order failed validation',\n          code: 'validation_failed',\n          fields: { lineItems: outcome.message },\n          headers: ctx.headers,\n        })\n  }\n  if (outcome.outcome === 'no_such_order') {\n    return ApiErrors.notFound({\n      message: 'No such order',\n      headers: ctx.headers,\n    })\n  }\n  if (outcome.outcome === 'blocked') {\n    // A NEW 409 code (`order_transition`), because an integrator has to be\n    // able to tell \"the order moved on without me\" apart from every other\n    // conflict this API can raise — it is the one a fulfilment poller will\n    // actually hit, and the one it must not retry forever.\n    return ApiErrors.conflict({\n      message: `Orders in \"${outcome.from}\" cannot be marked ${status}`,\n      code: 'order_transition',\n      headers: ctx.headers,\n    })\n  }\n  // The order object, on both `recorded` and `already` — a retry lands the\n  // same state and reads the same 200. Re-read after the write so the body\n  // shows the shipment that was just recorded rather than the one before it.\n  return apiJson(orderView(await hostRef(ctx, hostId).collection('orders').doc(orderId).get()), {\n    headers: ctx.headers,\n  })\n}\n\n/**\n * Price and stock live on VARIANTS, never on the product — a product-level\n * `inventory` exists only as a denormalized sum the console rewrites on every\n * decrement, and a product-level `priceUsd` is the legacy single-variant\n * shape. Publishing either as the product's price would be wrong the moment a\n * product has two variants, so the variant array is the contract and the\n * product carries only the roll-up, clearly named.\n *\n * `inventory: null` on a variant means UNTRACKED and `0` means SOLD OUT.\n * Collapsing them (the `?? 0` an integrator writes on the first day) turns\n * every untracked product into an out-of-stock one, so the distinction is\n * carried through verbatim rather than defaulted.\n */\nfunction variantView(variant: Record<string, unknown>) {\n  const inventory = variant.inventory\n  return {\n    id: variant.id ?? null,\n    sku: variant.sku ?? null,\n    barcode: variant.barcode ?? null,\n    options: variant.options ?? {},\n    priceUsd: typeof variant.priceUsd === 'number' ? variant.priceUsd : null,\n    compareAtPriceUsd:\n      typeof variant.compareAtPriceUsd === 'number'\n        ? variant.compareAtPriceUsd\n        : null,\n    weightGrams:\n      typeof variant.weightGrams === 'number' ? variant.weightGrams : null,\n    inventory: typeof inventory === 'number' ? inventory : null,\n    inventoryTracked: typeof inventory === 'number',\n  }\n}\n\nfunction productView(doc: FirebaseFirestore.DocumentSnapshot) {\n  const data = doc.data() ?? {}\n  const variants = Array.isArray(data.variants)\n    ? (data.variants as Array<Record<string, unknown>>)\n    : []\n  const tracked = variants.filter((v) => typeof v.inventory === 'number')\n  return {\n    id: doc.id,\n    object: 'product',\n    name: data.name ?? null,\n    slug: data.slug ?? null,\n    description: data.description ?? null,\n    type: data.type ?? null,\n    status: data.status ?? null,\n    tags: data.tags ?? [],\n    categoryIds: data.categoryIds ?? [],\n    mediaUrls: data.mediaUrls ?? [],\n    options: data.options ?? [],\n    variants: variants.map(variantView),\n    // The sum across TRACKED variants only, and `null` when none of them is\n    // tracked — so an untracked catalogue reads as \"we don't count this\"\n    // rather than as a store with nothing left to sell.\n    inventory: tracked.length\n      ? tracked.reduce((sum, v) => sum + Number(v.inventory ?? 0), 0)\n      : null,\n    subscription: serialize(data.subscription) ?? null,\n    created: data.createdAtMs ? new Date(Number(data.createdAtMs)).toISOString() : null,\n    updated: data.updatedAtMs ? new Date(Number(data.updatedAtMs)).toISOString() : null,\n  }\n}\n\nexport async function handleProducts(\n  request: Request,\n  ctx: ApiV1Context,\n  segments: string[],\n  url: URL,\n): Promise<Response> {\n  const [, hostId, , productId] = segments\n  const denied = requireScope(ctx, 'products:read')\n  if (denied) return denied\n  const unentitled = requireCommerce(ctx)\n  if (unentitled) return unentitled\n  if (request.method !== 'GET') {\n    return ApiErrors.methodNotAllowed({ headers: ctx.headers })\n  }\n  const collection = hostRef(ctx, hostId).collection('products')\n\n  if (productId) {\n    const snap = await collection.doc(productId).get()\n    // A soft-deleted product is gone as far as a customer is concerned. The\n    // console filters `deletedAt` client-side; the API must not hand back a\n    // product the merchant deleted just because the document survives.\n    if (!snap.exists || snap.get('deletedAt')) {\n      return ApiErrors.notFound({ message: 'No such product', headers: ctx.headers })\n    }\n    return apiJson(productView(snap), { headers: ctx.headers })\n  }\n\n  let query: FirebaseFirestore.Query = collection\n  const status = url.searchParams.get('status')\n  if (status) query = query.where('status', '==', status)\n  const { docs, nextCursor } = await paginate(query, url)\n  const data = docs.filter((doc) => !doc.get('deletedAt')).map(productView)\n  return listResponse(data, nextCursor, ctx.headers)\n}\n\n"],"names":["checkEntitlement","isHostPluginEnabled","ApiErrors","apiJson","listResponse","paginate","readJsonBody","requireScope","serialize","BUNDLE_ID","recordOrderShipment","orderViewFromData","requireCommerce","ctx","org","planRequired","message","code","headers","hostRef","hostId","firestore","collection","doc","orderView","id","data","handleOrders","request","segments","url","orderId","method","deniedWrite","unentitledWrite","updateOrder","denied","unentitled","methodNotAllowed","Allow","snap","get","exists","notFound","query","status","searchParams","where","channel","docs","nextCursor","map","filter","order","ORDER_WRITE_TARGETS","ORDER_WRITABLE_KEYS","ORDER_WRITE_REFUSED","cancelled","refunded","body","unknown","Object","keys","key","includes","length","badRequest","fields","fromEntries","String","refusal","join","carrier","slice","trackingNumber","lineItems","undefined","Array","isArray","entry","lineItemId","Number","quantity","idempotencyKey","hostSnap","outcome","to","trackingUrl","notify","problem","conflict","from","variantView","variant","inventory","sku","barcode","options","priceUsd","compareAtPriceUsd","weightGrams","inventoryTracked","productView","variants","tracked","v","object","name","slug","description","type","tags","categoryIds","mediaUrls","reduce","sum","subscription","created","createdAtMs","Date","toISOString","updated","updatedAtMs","handleProducts","productId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,EAAEC,mBAAmB,QAAQ,sBAAqB;AAC3E,SACEC,SAAS,EACTC,OAAO,EACPC,YAAY,QACP,2BAA0B;AACjC,SAEEC,QAAQ,EACRC,YAAY,EACZC,YAAY,EACZC,SAAS,QACJ,6CAA4C;AACnD,SAASC,SAAS,QAAQ,mCAA+B;AACzD,SAAqCC,mBAAmB,QAAQ,sBAAkB;AAClF,SAASC,iBAAiB,QAAQ,kBAAc;AAEhD;;;;;;;;CAQC,GAED;;;;;;;;;;;;;;CAcC,GACD,SAASC,gBAAgBC,GAAiB;IACxC,OAAOb,iBAAiBa,IAAIC,GAAG,EAAE,cAC7B,OACAZ,UAAUa,YAAY,CAAC;QACrBC,SAAS;QACTC,MAAM;QACNC,SAASL,IAAIK,OAAO;IACtB;AACN;AAEA,SAASC,QAAQN,GAAiB,EAAEO,MAAc;IAChD,OAAOP,IAAIQ,SAAS,CAACC,UAAU,CAAC,SAASC,GAAG,CAACH;AAC/C;AAEA;;;;;;;;;CASC,GACD,SAASI,UAAUD,GAAuC;QACvBA;IAAjC,OAAOZ,kBAAkBY,IAAIE,EAAE,GAAEF,YAAAA,IAAIG,IAAI,cAARH,YAAc,CAAC;AAClD;AAEA,OAAO,eAAeI,aACpBC,OAAgB,EAChBf,GAAiB,EACjBgB,QAAkB,EAClBC,GAAQ;IAER,MAAM,GAAGV,UAAUW,QAAQ,GAAGF;IAC9B,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,QAAQ;IACR,IAAID,QAAQI,MAAM,KAAK,WAAWD,SAAS;QACzC,MAAME,cAAc1B,aAAaM,KAAK;QACtC,IAAIoB,aAAa,OAAOA;QACxB,MAAMC,kBAAkBtB,gBAAgBC;QACxC,IAAIqB,iBAAiB,OAAOA;QAC5B,OAAOC,YAAYP,SAASf,KAAKO,QAAQW;IAC3C;IACA,MAAMK,SAAS7B,aAAaM,KAAK;IACjC,IAAIuB,QAAQ,OAAOA;IACnB,MAAMC,aAAazB,gBAAgBC;IACnC,IAAIwB,YAAY,OAAOA;IACvB,IAAIT,QAAQI,MAAM,KAAK,OAAO;QAC5B,OAAO9B,UAAUoC,gBAAgB,CAAC;YAChCpB,SAAS,aAAKL,IAAIK,OAAO;gBAAEqB,OAAOR,UAAU,eAAe;;QAC7D;IACF;IACA,MAAMT,aAAaH,QAAQN,KAAKO,QAAQE,UAAU,CAAC;IAEnD,IAAIS,SAAS;QACX,MAAMS,OAAO,MAAMlB,WAAWC,GAAG,CAACQ,SAASU,GAAG;QAC9C,IAAI,CAACD,KAAKE,MAAM,EAAE;YAChB,OAAOxC,UAAUyC,QAAQ,CAAC;gBAAE3B,SAAS;gBAAiBE,SAASL,IAAIK,OAAO;YAAC;QAC7E;QACA,OAAOf,QAAQqB,UAAUgB,OAAO;YAAEtB,SAASL,IAAIK,OAAO;QAAC;IACzD;IAEA,IAAI0B,QAAiCtB;IACrC,MAAMuB,SAASf,IAAIgB,YAAY,CAACL,GAAG,CAAC;IACpC,IAAII,QAAQD,QAAQA,MAAMG,KAAK,CAAC,UAAU,MAAMF;IAChD,MAAMG,UAAUlB,IAAIgB,YAAY,CAACL,GAAG,CAAC;IACrC,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,sCAAsC;IACtC,IAAIO,WAAWA,YAAY,UAAUJ,QAAQA,MAAMG,KAAK,CAAC,WAAW,MAAMC;IAC1E,MAAM,EAAEC,IAAI,EAAEC,UAAU,EAAE,GAAG,MAAM7C,SAASuC,OAAOd;IACnD,MAAMJ,OAAOuB,KACVE,GAAG,CAAC3B,WACJ4B,MAAM,CAAC,CAACC,QAAWL,YAAY,WAAWK,MAAML,OAAO,KAAK,WAAW;IAC1E,OAAO5C,aAAasB,MAAMwB,YAAYrC,IAAIK,OAAO;AACnD;AAEA;;;;CAIC,GACD,MAAMoC,sBAA+C;IAAC;IAAa;CAAY;AAE/E,gEAAgE,GAChE,MAAMC,sBAAsB;IAAC;IAAU;IAAW;IAAkB;IAAe;IAAa;CAAS;AAEzG;;;;;;;;CAQC,GACD,MAAMC,sBAA8C;IAClDC,WACE;IACFC,UACE;AACJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CC,GACD,eAAevB,YACbP,OAAgB,EAChBf,GAAiB,EACjBO,MAAc,EACdW,OAAe;QAoBO4B,cAsBCA,eACOA,sBAuBP/B;IAhEvB,MAAM+B,OAAO,MAAMrD,aAAasB;IAChC,MAAMgC,UAAUC,OAAOC,IAAI,CAACH,MAAMP,MAAM,CAAC,CAACW,MAAQ,CAACR,oBAAoBS,QAAQ,CAACD;IAChF,IAAIH,QAAQK,MAAM,GAAG,GAAG;QACtB,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,2DAA2D;QAC3D,OAAO/D,UAAUgE,UAAU,CAAC;YAC1BlD,SACE;YACFC,MAAM;YACNkD,QAAQN,OAAOO,WAAW,CACxBR,QAAQT,GAAG,CAAC,CAACY,MAAQ;oBAACA;oBAAK;iBAA2B;YAExD7C,SAASL,IAAIK,OAAO;QACtB;IACF;IAEA,MAAM2B,SAASwB,QAAOV,eAAAA,KAAKd,MAAM,YAAXc,eAAe;IACrC,MAAMW,UAAUd,mBAAmB,CAACX,OAAO;IAC3C,IAAIyB,SAAS;QACX,OAAOpE,UAAUgE,UAAU,CAAC;YAC1BlD,SAASsD;YACTrD,MAAM;YACNkD,QAAQ;gBAAEtB,QAAQyB;YAAQ;YAC1BpD,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,IAAI,CAAC,AAACoC,oBAAiCU,QAAQ,CAACnB,SAAS;QACvD,OAAO3C,UAAUgE,UAAU,CAAC;YAC1BlD,SAAS;YACTC,MAAM;YACNkD,QAAQ;gBACNtB,QAAQ,CAAC,gBAAgB,EAAES,oBAAoBiB,IAAI,CAAC,OAAO;YAC7D;YACArD,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAMsD,UAAUH,QAAOV,gBAAAA,KAAKa,OAAO,YAAZb,gBAAgB,IAAIc,KAAK,CAAC,GAAG;IACpD,MAAMC,iBAAiBL,QAAOV,uBAAAA,KAAKe,cAAc,YAAnBf,uBAAuB,IAAIc,KAAK,CAAC,GAAG;IAClE,yEAAyE;IACzE,0DAA0D;IAC1D,IAAIE;IACJ,IAAIhB,KAAKgB,SAAS,KAAKC,WAAW;QAChC,IAAI/B,WAAW,eAAe,CAACgC,MAAMC,OAAO,CAACnB,KAAKgB,SAAS,KAAKhB,KAAKgB,SAAS,CAACV,MAAM,KAAK,GAAG;YAC3F,OAAO/D,UAAUgE,UAAU,CAAC;gBAC1BlD,SAAS;gBACTC,MAAM;gBACNkD,QAAQ;oBACNQ,WACE9B,WAAW,cACP,+CACA;gBACR;gBACA3B,SAASL,IAAIK,OAAO;YACtB;QACF;QACAyD,YAAY,AAAChB,KAAKgB,SAAS,CAAeF,KAAK,CAAC,GAAG,KAAKtB,GAAG,CAAC,CAAC4B,QAAW,CAAA;gBACtEC,YAAYC,OAAQF,yBAAD,AAACA,MAAmCC,UAAU;gBACjEE,UAAUD,OAAQF,yBAAD,AAACA,MAAmCG,QAAQ;YAC/D,CAAA;IACF;IACA,MAAMC,kBAAiBvD,uBAAAA,QAAQV,OAAO,CAACuB,GAAG,CAAC,8BAApBb,uBAA0CgD;IAEjE,yCAAyC;IACzC,MAAMQ,WAAW,MAAMjE,QAAQN,KAAKO,QAAQqB,GAAG;IAC/C,IAAI,CAACxC,oBAAoBY,IAAIC,GAAG,EAAEsE,SAAS1D,IAAI,IAAIjB,YAAY;QAC7D,OAAOP,UAAUyC,QAAQ,CAAC;YACxB3B,SAAS;YACTE,SAASL,IAAIK,OAAO;QACtB;IACF;IAEA,MAAMmE,UAAU,MAAM3E,oBAAoB;QACxCU;QACAW;QACAuD,IAAIzC;QACJ2B;QACAE;OACIC,YAAY;QAAEA;IAAU,IAAI,CAAC,GAC7B,OAAOhB,KAAK4B,WAAW,KAAK,WAAW;QAAEA,aAAa5B,KAAK4B,WAAW;IAAC,IAAI,CAAC,GAC5E5B,KAAK6B,MAAM,KAAK,QAAQ;QAAEA,QAAQ;IAAM,IAAI,CAAC,GAC7CL,iBAAiB;QAAEA;IAAe,IAAI,CAAC;IAE7C,IAAIE,QAAQA,OAAO,KAAK,iBAAiB;QACvC,OAAOA,QAAQI,OAAO,CAACA,OAAO,KAAK,mBAC/BvF,UAAUwF,QAAQ,CAAC;YACjB1E,SAASqE,QAAQrE,OAAO;YACxBC,MAAM;YACNC,SAASL,IAAIK,OAAO;QACtB,KACAhB,UAAUgE,UAAU,CAAC;YACnBlD,SAAS;YACTC,MAAM;YACNkD,QAAQ;gBAAEQ,WAAWU,QAAQrE,OAAO;YAAC;YACrCE,SAASL,IAAIK,OAAO;QACtB;IACN;IACA,IAAImE,QAAQA,OAAO,KAAK,iBAAiB;QACvC,OAAOnF,UAAUyC,QAAQ,CAAC;YACxB3B,SAAS;YACTE,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,IAAImE,QAAQA,OAAO,KAAK,WAAW;QACjC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,uDAAuD;QACvD,OAAOnF,UAAUwF,QAAQ,CAAC;YACxB1E,SAAS,CAAC,WAAW,EAAEqE,QAAQM,IAAI,CAAC,mBAAmB,EAAE9C,QAAQ;YACjE5B,MAAM;YACNC,SAASL,IAAIK,OAAO;QACtB;IACF;IACA,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,OAAOf,QAAQqB,UAAU,MAAML,QAAQN,KAAKO,QAAQE,UAAU,CAAC,UAAUC,GAAG,CAACQ,SAASU,GAAG,KAAK;QAC5FvB,SAASL,IAAIK,OAAO;IACtB;AACF;AAEA;;;;;;;;;;;;CAYC,GACD,SAAS0E,YAAYC,OAAgC;QAG7CA,aACCA,cACIA,kBACAA;IALX,MAAMC,YAAYD,QAAQC,SAAS;IACnC,OAAO;QACLrE,EAAE,GAAEoE,cAAAA,QAAQpE,EAAE,YAAVoE,cAAc;QAClBE,GAAG,GAAEF,eAAAA,QAAQE,GAAG,YAAXF,eAAe;QACpBG,OAAO,GAAEH,mBAAAA,QAAQG,OAAO,YAAfH,mBAAmB;QAC5BI,OAAO,GAAEJ,mBAAAA,QAAQI,OAAO,YAAfJ,mBAAmB,CAAC;QAC7BK,UAAU,OAAOL,QAAQK,QAAQ,KAAK,WAAWL,QAAQK,QAAQ,GAAG;QACpEC,mBACE,OAAON,QAAQM,iBAAiB,KAAK,WACjCN,QAAQM,iBAAiB,GACzB;QACNC,aACE,OAAOP,QAAQO,WAAW,KAAK,WAAWP,QAAQO,WAAW,GAAG;QAClEN,WAAW,OAAOA,cAAc,WAAWA,YAAY;QACvDO,kBAAkB,OAAOP,cAAc;IACzC;AACF;AAEA,SAASQ,YAAY/E,GAAuC;QAC7CA,WAQLG,YACAA,YACOA,mBACPA,YACEA,cACFA,YACOA,mBACFA,iBACFA,eAQKlB;IAxBhB,MAAMkB,QAAOH,YAAAA,IAAIG,IAAI,cAARH,YAAc,CAAC;IAC5B,MAAMgF,WAAW1B,MAAMC,OAAO,CAACpD,KAAK6E,QAAQ,IACvC7E,KAAK6E,QAAQ,GACd,EAAE;IACN,MAAMC,UAAUD,SAASnD,MAAM,CAAC,CAACqD,IAAM,OAAOA,EAAEX,SAAS,KAAK;IAC9D,OAAO;QACLrE,IAAIF,IAAIE,EAAE;QACViF,QAAQ;QACRC,IAAI,GAAEjF,aAAAA,KAAKiF,IAAI,YAATjF,aAAa;QACnBkF,IAAI,GAAElF,aAAAA,KAAKkF,IAAI,YAATlF,aAAa;QACnBmF,WAAW,GAAEnF,oBAAAA,KAAKmF,WAAW,YAAhBnF,oBAAoB;QACjCoF,IAAI,GAAEpF,aAAAA,KAAKoF,IAAI,YAATpF,aAAa;QACnBmB,MAAM,GAAEnB,eAAAA,KAAKmB,MAAM,YAAXnB,eAAe;QACvBqF,IAAI,GAAErF,aAAAA,KAAKqF,IAAI,YAATrF,aAAa,EAAE;QACrBsF,WAAW,GAAEtF,oBAAAA,KAAKsF,WAAW,YAAhBtF,oBAAoB,EAAE;QACnCuF,SAAS,GAAEvF,kBAAAA,KAAKuF,SAAS,YAAdvF,kBAAkB,EAAE;QAC/BuE,OAAO,GAAEvE,gBAAAA,KAAKuE,OAAO,YAAZvE,gBAAgB,EAAE;QAC3B6E,UAAUA,SAASpD,GAAG,CAACyC;QACvB,wEAAwE;QACxE,qEAAqE;QACrE,oDAAoD;QACpDE,WAAWU,QAAQvC,MAAM,GACrBuC,QAAQU,MAAM,CAAC,CAACC,KAAKV;gBAAmBA;mBAAbU,MAAMlC,QAAOwB,eAAAA,EAAEX,SAAS,YAAXW,eAAe;WAAI,KAC3D;QACJW,YAAY,GAAE5G,aAAAA,UAAUkB,KAAK0F,YAAY,aAA3B5G,aAAgC;QAC9C6G,SAAS3F,KAAK4F,WAAW,GAAG,IAAIC,KAAKtC,OAAOvD,KAAK4F,WAAW,GAAGE,WAAW,KAAK;QAC/EC,SAAS/F,KAAKgG,WAAW,GAAG,IAAIH,KAAKtC,OAAOvD,KAAKgG,WAAW,GAAGF,WAAW,KAAK;IACjF;AACF;AAEA,OAAO,eAAeG,eACpB/F,OAAgB,EAChBf,GAAiB,EACjBgB,QAAkB,EAClBC,GAAQ;IAER,MAAM,GAAGV,UAAUwG,UAAU,GAAG/F;IAChC,MAAMO,SAAS7B,aAAaM,KAAK;IACjC,IAAIuB,QAAQ,OAAOA;IACnB,MAAMC,aAAazB,gBAAgBC;IACnC,IAAIwB,YAAY,OAAOA;IACvB,IAAIT,QAAQI,MAAM,KAAK,OAAO;QAC5B,OAAO9B,UAAUoC,gBAAgB,CAAC;YAAEpB,SAASL,IAAIK,OAAO;QAAC;IAC3D;IACA,MAAMI,aAAaH,QAAQN,KAAKO,QAAQE,UAAU,CAAC;IAEnD,IAAIsG,WAAW;QACb,MAAMpF,OAAO,MAAMlB,WAAWC,GAAG,CAACqG,WAAWnF,GAAG;QAChD,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAACD,KAAKE,MAAM,IAAIF,KAAKC,GAAG,CAAC,cAAc;YACzC,OAAOvC,UAAUyC,QAAQ,CAAC;gBAAE3B,SAAS;gBAAmBE,SAASL,IAAIK,OAAO;YAAC;QAC/E;QACA,OAAOf,QAAQmG,YAAY9D,OAAO;YAAEtB,SAASL,IAAIK,OAAO;QAAC;IAC3D;IAEA,IAAI0B,QAAiCtB;IACrC,MAAMuB,SAASf,IAAIgB,YAAY,CAACL,GAAG,CAAC;IACpC,IAAII,QAAQD,QAAQA,MAAMG,KAAK,CAAC,UAAU,MAAMF;IAChD,MAAM,EAAEI,IAAI,EAAEC,UAAU,EAAE,GAAG,MAAM7C,SAASuC,OAAOd;IACnD,MAAMJ,OAAOuB,KAAKG,MAAM,CAAC,CAAC7B,MAAQ,CAACA,IAAIkB,GAAG,CAAC,cAAcU,GAAG,CAACmD;IAC7D,OAAOlG,aAAasB,MAAMwB,YAAYrC,IAAIK,OAAO;AACnD"}

package/src/lib/server/billing-webhook.js

@@ -39,8 +39,15 @@ import { releaseStockHold } from "./stock-hold.js";
 import { releasePromotionHold, settlePromotionSlot } from "./promotion-hold.js";
 import { flagOrderRestock } from "./restock-flag.js";
 import { storefrontTaxModeOf } from "./storefront-tax.js";
+import { taxEngineStampFromMetadata } from "../model/commerce-tax-engine.js";
 import { recordStorefrontTax } from "./storefront-tax-record.js";
 import { enqueueSupplierDelivery } from "./supplier-outbox.js";
+import { notifyOrderBuyer, onlineReceiptExtras } from "./order-notifications.js";
+import { ORDER_PAID_EVENT, ORDER_REFUNDED_EVENT } from "../model/order-events.js";
+import { checkoutExtrasCents, decodeCheckoutExtrasMetadata } from "@aglyn/aglyn/plugin-manager/plugin-checkout-extras";
+import { raiseOrderEvent } from "./order-events.js";
+import { handlePosStripeEvent } from "./pos-terminal.js";
+import { notifyPosSaleCompleted } from "./pos-sale.js";
 /**
  * Assigns unassigned license keys for a digital product (AGL-308):
  * stamps order/email on the key docs, returns the key strings, and
@@ -262,9 +269,18 @@ async function findOrderForDispute(paymentIntentId) {
         kind: 'unresolved',
         reason: 'missing-index'
     };
-    if (matches.empty) return {
-        kind: 'not-ours'
-    };
+    if (matches.empty) {
+        // A register sale paid with SEVERAL cards keeps every charge in
+        // `paymentIntentIds` and none in `paymentIntentId` (AGL-3607).
+        const split = await firebaseAdmin.app().firestore().collectionGroup('orders').where('paymentIntentIds', 'array-contains', paymentIntentId).limit(2).get().catch(()=>null);
+        if ((split == null ? void 0 : split.docs.length) === 1) return {
+            kind: 'order',
+            snapshot: split.docs[0]
+        };
+        return {
+            kind: 'not-ours'
+        };
+    }
     if (matches.docs.length > 1) {
         console.error('Dispute matched more than one order; reversing none', paymentIntentId);
         return {
@@ -556,7 +572,8 @@ async function findOrderForDispute(paymentIntentId) {
         }), snapshot.id), reversedCents > 0 ? {
             refundedCents: reversedTotal
         } : {}, closedTheOrder ? {
-            status: 'refunded'
+            status: 'refunded',
+            updatedAtMs: Date.now()
         } : {}, {
             dispute: settled,
             timeline: CommerceModel.appendOrderEvent(order, 'dispute', lost ? `${amount} charged back (dispute lost)` + (closedTheOrder ? ' (full)' : '') : `Dispute ${outcome.replace(/_/g, ' ')} — no money reversed`, closedAtMs)
@@ -1704,6 +1721,18 @@ async function findOrderForDispute(paymentIntentId) {
     })) {
         return;
     }
+    // THE REGISTER'S CARD PAYMENTS (AGL-3607): Terminal reader actions, register
+    // PaymentIntents and register QR pages. Each names one payment on an open
+    // sale and is settled by re-reading Stripe in `pos-terminal.ts`; every other
+    // event falls through untouched.
+    const posPayment = await handlePosStripeEvent({
+        type,
+        object
+    });
+    if (posPayment) return {
+        claimed: true,
+        hostId: posPayment.hostId
+    };
     // A DEAD SESSION GIVES ITS RESERVATIONS BACK (AGL-2453).
     //
     // Stripe expires a Checkout Session 24 hours after creation, and emits this
@@ -2402,6 +2431,12 @@ async function findOrderForDispute(paymentIntentId) {
                 }
                 return true;
             });
+            // Other plugins and the merchant's webhooks hear of the sale (AGL-3611); keyed, so a redelivery raises it once.
+            await raiseOrderEvent(ORDER_PAID_EVENT, {
+                hostId: invoiceHostId,
+                orderId: invoiceId,
+                key: 'paid'
+            });
             // THE SALES TAX COMES BACK TO THE PLATFORM (AGL-1956), and like the
             // stop below it runs BEFORE the `recorded` short-circuit: a cycle
             // already on the ledger is exactly the cycle whose reversal may still
@@ -2850,6 +2885,9 @@ async function findOrderForDispute(paymentIntentId) {
             // transaction for the notices below (AGL-3432). The document id is
             // the Stripe session id, which appears nowhere in the console.
             let cartOrderNumber;
+            // The optional lines the buyer took (AGL-3635), read back off the
+            // session they were charged on; never re-quoted here.
+            const cartExtras = decodeCheckoutExtrasMetadata(object == null ? void 0 : object.metadata);
             const created = await firestore.runTransaction(async (transaction)=>{
                 var _counter_get, _ref, _ref1, _ref2, _ref3, _ref4, _shipping_address_line1, _shipping_address_line2, _shipping_address_city, _shipping_address_state, _shipping_address_postal_code, _shipping_address_country, _ref5;
                 var _object_metadata, _object_customer_details, _object_customer_details1;
@@ -2869,7 +2907,8 @@ async function findOrderForDispute(paymentIntentId) {
                 // to be dropped here, storing `shippingCents: 0` on every online
                 // order while the shopper's shipping sat inside `amount_total`.
                 const totals = CommerceModel.computeCheckoutSessionTotals(lineItems, object, {
-                    feeCents: Number(feeCents != null ? feeCents : 0)
+                    feeCents: Number(feeCents != null ? feeCents : 0),
+                    extrasCents: checkoutExtrasCents(cartExtras)
                 });
                 // With the fields the orders list queries by (AGL-3321).
                 transaction.set(orderRef, CommerceModel.withOrderListFields(orderRef.id, _extends({
@@ -2877,7 +2916,10 @@ async function findOrderForDispute(paymentIntentId) {
                     status: 'paid',
                     channel: 'online',
                     lineItems,
-                    totals,
+                    totals
+                }, cartExtras.length ? {
+                    extras: cartExtras
+                } : {}, {
                     // WHICH TAX THIS SALE CARRIED (AGL-2451). `totals.taxCents` above
                     // says how much; this says who computed it, which is the fact that
                     // decides whose registration the money is held under. The same
@@ -2885,7 +2927,8 @@ async function findOrderForDispute(paymentIntentId) {
                     // the order and the filed row cannot disagree. A manual cart's tax
                     // rides a real Stripe Tax Rate since AGL-1953 and therefore has a
                     // populated breakdown — the flag is what tells the two apart.
-                    taxMode: storefrontTaxModeOf(object, Number((_ref = object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.taxCents) != null ? _ref : 0)),
+                    taxMode: storefrontTaxModeOf(object, Number((_ref = object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.taxCents) != null ? _ref : 0))
+                }, taxEngineStampFromMetadata(object == null ? void 0 : object.metadata), {
                     timeline: [
                         {
                             atMs: Date.now(),
@@ -3004,13 +3047,22 @@ async function findOrderForDispute(paymentIntentId) {
                     merge: true
                 }).catch(()=>undefined);
             }
+            // Other plugins and the merchant's webhooks hear of the sale (AGL-3611); keyed, so a redelivery raises it once.
+            await raiseOrderEvent(ORDER_PAID_EVENT, {
+                hostId: String(hostId),
+                orderId: orderRef.id,
+                key: 'paid'
+            });
             // Branded receipt (AGL-296): env-gated like every outbound email.
             const buyerEmailForReceipt = object == null ? void 0 : (_object_customer_details7 = object.customer_details) == null ? void 0 : _object_customer_details7.email;
-            if (isEmailConfigured() && buyerEmailForReceipt) {
+            // The store's receipt switch and the status link (AGL-3610).
+            const receiptExtras = await onlineReceiptExtras(String(hostId), String(object.id));
+            if (isEmailConfigured() && buyerEmailForReceipt && receiptExtras.enabled) {
                 var _ref47, _ref48, _ref49, _ref50;
                 const receiptSettings = await hostRef.collection('settings').doc('store').get().catch(()=>null);
                 const receiptFooter = String((_ref47 = receiptSettings == null ? void 0 : receiptSettings.get('receiptFooter')) != null ? _ref47 : '');
-                const linesText = lineItems.map((line)=>`${line.quantity}× ${line.name}${line.variantLabel ? ` (${line.variantLabel})` : ''} — $${(line.unitAmountCents * line.quantity / 100).toFixed(2)}`).join('\n');
+                const linesText = lineItems.map((line)=>`${line.quantity}× ${line.name}${line.variantLabel ? ` (${line.variantLabel})` : ''} — $${(line.unitAmountCents * line.quantity / 100).toFixed(2)}`).concat(// Optional lines the buyer took (AGL-3635), as charged.
+                cartExtras.map((extra)=>`${extra.label} — $${(extra.amountCents / 100).toFixed(2)}`)).join('\n');
                 // The keys assigned above the gate (AGL-2149); the receipt only
                 // reports them.
                 const licenseText = Object.entries(licenseKeysByProduct).flatMap(([keyProductId, keys])=>{
@@ -3034,7 +3086,7 @@ async function findOrderForDispute(paymentIntentId) {
                 const fallbackText = `Thanks for your purchase!\n\n${linesText}\n\n` + (licenseText ? `${licenseText}\n\n` : '') + (downloadLines ? `${downloadLines}\n\n` : '') + `Total: ${orderTotal}\n` + `Order reference: ${object.id}` + (receiptFooter ? `\n\n${receiptFooter}` : '');
                 // Site-owner-designed template when published (AGL-771). The
                 // license keys and download links ride in {{order.summary}}.
-                const designed = await renderHostEmailWithTokens(firebaseAdmin.app().firestore(), String(hostId), 'order-receipt', {
+                const designed = await renderHostEmailWithTokens(firebaseAdmin.app().firestore(), String(hostId), 'order-receipt', _extends({
                     'order.summary': orderSummary,
                     'order.total': orderTotal,
                     'order.ref': String(object.id),
@@ -3042,7 +3094,7 @@ async function findOrderForDispute(paymentIntentId) {
                     // built-in copy always renders (AGL-3370), so a footer that is
                     // only in the fallback text above never reaches a buyer.
                     'store.receiptFooter': receiptFooter
-                });
+                }, receiptExtras.tokens));
                 await sendEmail(_extends({
                     to: buyerEmailForReceipt,
                     subject: (_ref50 = designed == null ? void 0 : designed.subject) != null ? _ref50 : `Receipt for your order`,
@@ -3484,7 +3536,9 @@ async function findOrderForDispute(paymentIntentId) {
                     taxMode: storefrontTaxModeOf(object, Number((_ref2 = object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.taxCents) != null ? _ref2 : 0)),
                     paymentIntentId: String((_ref3 = object == null ? void 0 : object.payment_intent) != null ? _ref3 : '') || null,
                     customerEmail: (_ref4 = (_ref5 = object == null ? void 0 : (_object_customer_details1 = object.customer_details) == null ? void 0 : _object_customer_details1.email) != null ? _ref5 : lifted.customerEmail) != null ? _ref4 : null,
-                    timeline: CommerceModel.appendOrderEvent(lifted, 'paid')
+                    timeline: CommerceModel.appendOrderEvent(lifted, 'paid'),
+                    // A paid draft is new to a shipping tool's feed (AGL-3613).
+                    updatedAtMs: Date.now()
                 }, shippingCents > 0 || stripeTaxCents > 0 ? {
                     totals: _extends({}, (_lifted_totals = lifted.totals) != null ? _lifted_totals : {}, shippingCents > 0 ? {
                         shippingCents
@@ -3527,6 +3581,16 @@ async function findOrderForDispute(paymentIntentId) {
                 var _ref61, _ref62, _ref63, _ref64, _ref65, _ref66;
                 var _object_metadata28, _object_customer_details15, _order_totals, _object_customer_details16;
                 const order = paidOrder;
+                // A legacy register QR sale is a register sale completing (AGL-3607).
+                if (order.channel === 'pos') {
+                    await notifyPosSaleCompleted({
+                        hostId: String(hostId),
+                        orderId: String(orderId),
+                        order: _extends({}, order, {
+                            status: 'paid'
+                        })
+                    });
+                }
                 // Discounts engine redemptions (AGL-305), for this branch's BOTH
                 // tenants: a console draft order and a POS card sale, which carry the
                 // same `commerce-draft` metadata type. The cart branch has settled
@@ -3597,6 +3661,18 @@ async function findOrderForDispute(paymentIntentId) {
                         }
                     }));
                 }
+                // The receipt a payment link or a POS card sale never sent (AGL-3610).
+                await notifyOrderBuyer({
+                    hostId: String(hostId),
+                    orderId: String(orderId)
+                }, 'receipt', {
+                    email: draftEmail
+                });
+                await raiseOrderEvent(ORDER_PAID_EVENT, {
+                    hostId: String(hostId),
+                    orderId: String(orderId),
+                    key: 'paid'
+                });
                 if (productId) {
                     var _productSnapshot_data, _ref71, _ref72;
                     var _object_metadata30, _lifted_variants_, _order_lineItems_, _order_lineItems;
@@ -3791,7 +3867,8 @@ async function findOrderForDispute(paymentIntentId) {
                     // tax (AGL-1711), so the session reports `amount_tax: 0` and
                     // `metadata[taxCents]` — the key `checkout.ts` writes — is the only
                     // witness. Same resolver as the filed tax row, same witness.
-                    taxMode: storefrontTaxModeOf(object, Number((_ref = object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.taxCents) != null ? _ref : 0)),
+                    taxMode: storefrontTaxModeOf(object, Number((_ref = object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.taxCents) != null ? _ref : 0))
+                }, taxEngineStampFromMetadata(object == null ? void 0 : object.metadata), {
                     timeline: [
                         {
                             atMs: Date.now(),
@@ -4050,6 +4127,12 @@ async function findOrderForDispute(paymentIntentId) {
                     detail: `Coupon ${couponCode} was applied to this order but no longer ` + 'exists, so the redemption is uncounted against its limit.'
                 });
             }
+            // Other plugins and the merchant's webhooks hear of the sale (AGL-3611); keyed, so a redelivery raises it once.
+            await raiseOrderEvent(ORDER_PAID_EVENT, {
+                hostId: String(hostId),
+                orderId: orderRef.id,
+                key: 'paid'
+            });
             // Receipt + seller notification (AGL-96): env-gated like every
             // other outbound email; failures never fail the webhook.
             if (isEmailConfigured()) {
@@ -4059,7 +4142,9 @@ async function findOrderForDispute(paymentIntentId) {
                 const amount = (Number((_ref85 = object == null ? void 0 : object.amount_total) != null ? _ref85 : 0) / 100).toFixed(2);
                 const buyerEmail = object == null ? void 0 : (_object_customer_details21 = object.customer_details) == null ? void 0 : _object_customer_details21.email;
                 const orderTotal = `$${amount}`;
-                if (buyerEmail) {
+                // The store's receipt switch and the status link (AGL-3610).
+                const receiptExtras = await onlineReceiptExtras(String(hostId), String(object.id));
+                if (buyerEmail && receiptExtras.enabled) {
                     var _ref86, _ref87;
                     // The store's own Receipt footer, as the cart receipt carries it
                     // (AGL-3432).
@@ -4069,12 +4154,12 @@ async function findOrderForDispute(paymentIntentId) {
                     const receiptLine = `${soldQuantity}× ${productName}`;
                     const fallbackText = `Thanks for your purchase!\n\n${receiptLine} — $${amount}` + `\nOrder reference: ${object.id}` + (receiptFooter ? `\n\n${receiptFooter}` : '');
                     // Site-owner-designed template when published (AGL-771).
-                    const designed = await renderHostEmailWithTokens(firebaseAdmin.app().firestore(), String(hostId), 'order-receipt', {
+                    const designed = await renderHostEmailWithTokens(firebaseAdmin.app().firestore(), String(hostId), 'order-receipt', _extends({
                         'order.summary': receiptLine,
                         'order.total': orderTotal,
                         'order.ref': String(object.id),
                         'store.receiptFooter': receiptFooter
-                    });
+                    }, receiptExtras.tokens));
                     await sendEmail(_extends({
                         to: String(buyerEmail),
                         subject: (_ref87 = designed == null ? void 0 : designed.subject) != null ? _ref87 : `Receipt: ${productName}`,
@@ -4164,6 +4249,28 @@ async function findOrderForDispute(paymentIntentId) {
         const snapshot = lookup.snapshot;
         const hostId = String((_ref90 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref90 : '');
         const external = await recordExternalRefund(snapshot.ref, object);
+        if (external && hostId) {
+            var _ref91, _ref92, _ref93;
+            var _object_refunds;
+            // A Stripe Dashboard refund is a refund to every subscriber too
+            // (AGL-3645): accounting books it and the merchant's webhooks hear it,
+            // as they do a console refund. Keyed by the charge's refunded total,
+            // which the record above only ever advances once per amount.
+            const latestRefund = ((_ref91 = object == null ? void 0 : (_object_refunds = object.refunds) == null ? void 0 : _object_refunds.data) != null ? _ref91 : [])[0];
+            await raiseOrderEvent(ORDER_REFUNDED_EVENT, {
+                hostId,
+                orderId: snapshot.id,
+                key: `external-refund:${String((_ref92 = object == null ? void 0 : object.id) != null ? _ref92 : paymentIntentId)}:${Number((_ref93 = object == null ? void 0 : object.amount_refunded) != null ? _ref93 : 0)}`,
+                extra: {
+                    refund: {
+                        id: (latestRefund == null ? void 0 : latestRefund.id) ? String(latestRefund.id) : null,
+                        amountCents: external.newCents,
+                        lineItemIds: [],
+                        full: external.fullyRefunded
+                    }
+                }
+            });
+        }
         if (external && hostId && snapshot.ref.parent.parent) {
             const outcome = await applyExternalRefundToGiftCards({
                 firestore: firebaseAdmin.app().firestore(),
@@ -4203,16 +4310,16 @@ async function findOrderForDispute(paymentIntentId) {
     // merchant; both report the site so the seller's fraud ledger can name it.
     const risk = paymentRiskEventFrom(type, object);
     if (risk && risk.signal.kind !== 'dispute') {
-        var _ref91, _snapshot_data1, _ref92, _ref93;
+        var _ref94, _snapshot_data1, _ref95, _ref96;
         var _snapshot_ref_parent_parent1, _order_totals2;
         const lookup = risk.paymentIntentId ? await findOrderForDispute(risk.paymentIntentId) : {
             kind: 'not-ours'
         };
         if (lookup.kind !== 'order') return;
         const snapshot = lookup.snapshot;
-        const hostId = String((_ref91 = (_snapshot_ref_parent_parent1 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent1.id) != null ? _ref91 : '');
+        const hostId = String((_ref94 = (_snapshot_ref_parent_parent1 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent1.id) != null ? _ref94 : '');
         const order = CommerceModel.liftLegacyOrder((_snapshot_data1 = snapshot.data()) != null ? _snapshot_data1 : {});
-        const orderCents = Number((_ref92 = (_ref93 = (_order_totals2 = order.totals) == null ? void 0 : _order_totals2.totalCents) != null ? _ref93 : order.amountCents) != null ? _ref92 : 0);
+        const orderCents = Number((_ref95 = (_ref96 = (_order_totals2 = order.totals) == null ? void 0 : _order_totals2.totalCents) != null ? _ref96 : order.amountCents) != null ? _ref95 : 0);
         await recordPaymentRiskOnRecord({
             ref: snapshot.ref,
             signal: risk.signal,
@@ -4275,7 +4382,7 @@ async function findOrderForDispute(paymentIntentId) {
     // finds). AGL-1554 will add its own `closed` branch for the marketplace
     // side; the two coexist because each self-selects by finding its own record.
     if (type === 'charge.dispute.created' || type === 'charge.dispute.closed') {
-        var _dispute_payment_intent, _ref94;
+        var _dispute_payment_intent, _ref97;
         var _snapshot_ref_parent_parent2;
         const dispute = object != null ? object : {};
         const paymentIntentId = String((_dispute_payment_intent = dispute.payment_intent) != null ? _dispute_payment_intent : '');
@@ -4301,9 +4408,9 @@ async function findOrderForDispute(paymentIntentId) {
         const claimed = lookup.kind === 'order' || lookup.kind === 'unresolved';
         const snapshot = lookup.kind === 'order' ? lookup.snapshot : null;
         if (snapshot) {
-            var _ref95;
+            var _ref98;
             var _snapshot_ref_parent_parent3;
-            const hostId = String((_ref95 = (_snapshot_ref_parent_parent3 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent3.id) != null ? _ref95 : '');
+            const hostId = String((_ref98 = (_snapshot_ref_parent_parent3 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent3.id) != null ? _ref98 : '');
             if (type === 'charge.dispute.created') {
                 var _snapshot_data2;
                 // A chargeback's gift cards are frozen while it is open (AGL-3363).
@@ -4321,7 +4428,7 @@ async function findOrderForDispute(paymentIntentId) {
                 }, notifyRiskEvent);
                 const { opened, record } = await recordDisputeOpened(snapshot, dispute);
                 if (opened && hostId) {
-                    var _snapshot_data3, _record_evidenceDueByMs, _ref96;
+                    var _snapshot_data3, _record_evidenceDueByMs, _ref99;
                     // Time-critical — Stripe's evidence window is days, not weeks — so
                     // this is awaited rather than fired off with `void`: the handler is
                     // serverless and work left running past the response is work the
@@ -4340,16 +4447,16 @@ async function findOrderForDispute(paymentIntentId) {
                         },
                         amount: `$${(record.amountCents / 100).toFixed(2)}`,
                         evidenceDueByMs: (_record_evidenceDueByMs = record.evidenceDueByMs) != null ? _record_evidenceDueByMs : null,
-                        dedupeKey: `sale:${String((_ref96 = dispute == null ? void 0 : dispute.id) != null ? _ref96 : snapshot.id)}`,
+                        dedupeKey: `sale:${String((_ref99 = dispute == null ? void 0 : dispute.id) != null ? _ref99 : snapshot.id)}`,
                         staffEvidence: record.reason ? `Reason: ${record.reason.replace(/_/g, ' ')}.` : null
                     });
                 }
             } else {
-                var _ref97, _snapshot_data4, _ref98;
+                var _ref100, _snapshot_data4, _ref101;
                 // Lost: the money went back, so the cards it bought are voided. Won
                 // (or closed on a warning): the dispute's freeze lifts; a freeze a
                 // fraud warning or review put on stays for the merchant (AGL-3363).
-                await applyOrderGiftCardRisk(snapshot, String((_ref97 = dispute == null ? void 0 : dispute.status) != null ? _ref97 : '') === 'lost' ? {
+                await applyOrderGiftCardRisk(snapshot, String((_ref100 = dispute == null ? void 0 : dispute.status) != null ? _ref100 : '') === 'lost' ? {
                     kind: 'void',
                     reason: 'dispute-lost'
                 } : {
@@ -4420,7 +4527,7 @@ async function findOrderForDispute(paymentIntentId) {
                 // transiently-failed reversal gets its retry — and gated inside on
                 // the order's own `reversedTransferCents` marker, so it runs at most
                 // once per dispute however many times Stripe delivers.
-                if (String((_ref98 = dispute == null ? void 0 : dispute.status) != null ? _ref98 : '') === 'lost') {
+                if (String((_ref101 = dispute == null ? void 0 : dispute.status) != null ? _ref101 : '') === 'lost') {
                     const pulledBackCents = await reverseSellerShare(snapshot.ref, dispute);
                     // The merchant-experience half of the AGL-1794 decision, and not an
                     // optional extra: the reversal takes money out of the connected
@@ -4450,7 +4557,7 @@ async function findOrderForDispute(paymentIntentId) {
         return _extends({
             claimed
         }, snapshot ? {
-            hostId: String((_ref94 = (_snapshot_ref_parent_parent2 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent2.id) != null ? _ref94 : '')
+            hostId: String((_ref97 = (_snapshot_ref_parent_parent2 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent2.id) != null ? _ref97 : '')
         } : {});
     }
 };