@aglyn/plugins-commerce 1.0.0-beta.230 → 1.0.0-beta.231

package/src/lib/server.js

@@ -43,10 +43,10 @@ import { commerceSitePageEnricher } from "./server/site-page-enricher.js";
 import { commerceSitePageResolver } from "./server/site-page-resolver.js";
 import { cartCheckoutHandler } from "./server/cart-checkout.js";
 import { cartHandler } from "./server/cart.js";
+import { cartExtrasHandler } from "./server/checkout-extras.js";
 import { catalogHandler } from "./server/catalog.js";
 import { checkoutHandler } from "./server/checkout.js";
 import { downloadHandler } from "./server/download.js";
-import { feedHandler } from "./server/feed.js";
 import { newsletterHandler } from "./server/newsletter.js";
 import { notifyRestockHandler } from "./server/notify-restock.js";
 import { productHandler } from "./server/product.js";
@@ -70,17 +70,30 @@ import { subscriptionPortalHandler } from "./server/subscription-portal.js";
 import { reviewsHandler } from "./server/reviews.js";
 import { connectHandler } from "./server/connect.js";
 import { cancelOrderHandler } from "./server/cancel-order.js";
+import { carrierRatesAvailabilityHandler } from "./server/carrier-rates-availability.js";
 import { collectionMembershipHandler } from "./server/collection-membership.js";
 import { draftOrderHandler } from "./server/draft-order.js";
 import { fulfillOrderHandler } from "./server/fulfill-order.js";
+import { orderReceiptSendHandler } from "./server/order-receipt-send.js";
+import { orderStatusHandler, registerOrderStatusActions } from "./server/order-status.js";
+import { returnRequestStatusAction } from "./server/return-status-action.js";
 import { giftCardsHandler } from "./server/gift-cards.js";
 import { memberPostHandler } from "./server/member-post.js";
 import { orderAnalyticsHandler } from "./server/order-analytics.js";
+import { checkoutStatusHandler } from "./server/checkout-status.js";
 import { posOrderHandler } from "./server/pos-order.js";
+import { printersHandler } from "./server/printers.js";
+import { posPaymentHandler } from "./server/pos-payment.js";
+import { posReadersHandler } from "./server/pos-readers.js";
+import { posTerminalConnectionTokenHandler } from "./server/pos-terminal-connection-token.js";
+import { posDisplayHandler } from "./server/pos-display.js";
+import { registerPosOpsRoutes } from "./server/pos-ops-routes.js";
 import { processAbandonedHandler, scanAbandonedCheckouts } from "./server/process-abandoned.js";
 import { processRestockHandler, scanRestockAlerts } from "./server/process-restock.js";
 import { scanStockDecrements } from "./server/reconcile-stock.js";
 import { refundHandler } from "./server/refund.js";
+import { orderWebhooksHandler } from "./server/order-webhooks.js";
+import { returnRequestHandler, returnsHandler } from "./server/returns.js";
 import { scanSupplierDeliveries } from "./server/supplier-outbox.js";
 import { supplierUpdateHandler } from "./server/supplier-update.js";
 /**
@@ -204,6 +217,32 @@ registerPluginJob({
         }
     }
 });
+/**
+ * Stripe payment method domains for every connected custom domain (AGL-3629).
+ *
+ * The backfill for domains connected before registration existed, and the
+ * repair for a connect whose event was lost, in one daily pass. A domain
+ * already registered costs a document read and no Stripe call, so the beat is
+ * cheap; a day's delay costs only the Apple Pay button on a domain connected
+ * while Stripe was unreachable, and the first in-page checkout there registers
+ * it anyway.
+ */ registerPluginJob({
+    pluginId: BUNDLE_ID,
+    name: 'payment-method-domains',
+    intervalMinutes: 24 * 60,
+    description: 'Register connected custom domains with Stripe so Apple Pay, Google Pay ' + 'and Link show on them (AGL-3629).',
+    lockdown: {
+        scope: 'per-host'
+    },
+    handler: async (gate)=>{
+        if (!process.env.STRIPE_SECRET_KEY) return;
+        const { reconcileCustomDomains } = await import("./server/payment-method-domains.js");
+        const result = await reconcileCustomDomains(gate);
+        if (result.registered || result.failed) {
+            console.info(`commerce: payment method domains — ${result.registered} registered, ` + `${result.failed} failed across ${result.hosts} sites`);
+        }
+    }
+});
 /**
  * A visitor's payment door: it opens a Stripe Checkout Session for whoever
  * calls it, so the dispatcher holds it to the card-testing counters
@@ -229,14 +268,30 @@ registerPluginJob({
     registerSitePageEnricher(commerceSitePageEnricher);
     registerPluginApiRoute('commerce/cart-checkout', cartCheckoutHandler, CARD_PAYMENT_DOOR);
     registerPluginApiRoute('commerce/cart', cartHandler);
+    // Optional lines another plugin offers at the cart (AGL-3635).
+    registerPluginApiRoute('commerce/cart-extras', cartExtrasHandler);
     registerPluginApiRoute('commerce/catalog', catalogHandler);
     registerPluginApiRoute('commerce/checkout', checkoutHandler, CARD_PAYMENT_DOOR);
     registerPluginApiRoute('commerce/download', downloadHandler);
-    registerPluginApiRoute('commerce/feed', feedHandler);
+    // The pre-channels Google feed address (AGL-299), now written by the
+    // catalog's feed publisher (AGL-3637); the module loads with a fetch.
+    registerPluginApiRoute('commerce/feed', {
+        web: async (request)=>(await import("./server/legacy-feed.js")).legacyFeedRoute(request)
+    });
     registerPluginApiRoute('commerce/newsletter', newsletterHandler);
     registerPluginApiRoute('commerce/notify-restock', notifyRestockHandler);
     // GA-safe order projection for the storefront `purchase` (AGL-1641).
     registerPluginApiRoute('commerce/order-analytics', orderAnalyticsHandler);
+    // The guest order-status page's data (AGL-3610), behind the signed link in
+    // every buyer email — a recipient link, so it outlives the site's gates.
+    registerPluginApiRoute('commerce/order-status', orderStatusHandler, {
+        recipientLink: true
+    });
+    // …and its "Request a return" button (AGL-3611), on an order that can
+    // still send something back.
+    registerOrderStatusActions(returnRequestStatusAction);
+    // What became of a session the shopper was returned from (AGL-3606).
+    registerPluginApiRoute('commerce/checkout-status', checkoutStatusHandler);
     registerPluginApiRoute('commerce/product', productHandler);
     registerPluginApiRoute('commerce/related', relatedHandler);
     registerPluginApiRoute('commerce/reservation-availability', reservationAvailabilityHandler);
@@ -246,6 +301,9 @@ registerPluginJob({
     registerPluginApiRoute('commerce/stream', streamHandler);
     registerPluginApiRoute('commerce/subscription-portal', subscriptionPortalHandler);
     registerPluginApiRoute('commerce/reviews', reviewsHandler);
+    // A buyer's return request (AGL-3611), from their account or the signed
+    // order-status link.
+    registerPluginApiRoute('commerce/return-request', returnRequestHandler);
     registerPluginApiRoute('membership/account', membershipAccountHandler);
     registerPluginApiRoute('membership/content', membershipContentHandler);
     registerPluginApiRoute('membership/login', membershipLoginHandler);
@@ -267,6 +325,11 @@ registerPluginJob({
  * jobs", which is how they stayed dark for months: it asserted the wiring
  * instead of having it.
  */ export function registerCommerceConsoleApi() {
+    // The register's gate (`managePos`) is resolved on THIS surface: every POS
+    // route below runs in the console, and a key no surface registered here is
+    // absent from the resolved map, which reads as refused — the site's own
+    // owner was answered 403 at the register.
+    registerPluginPermissions(COMMERCE_PERMISSIONS);
     // What a product looks like to a surface that is not this plugin's — a
     // campaign email that features one asks here rather than importing the model.
     registerProductCardReader();
@@ -306,6 +369,8 @@ registerPluginJob({
     // the release depends on the transition rule, and a client write could not
     // re-ask it under the same lock that flips the status.
     registerPluginApiRoute('commerce/cancel-order', cancelOrderHandler);
+    // Whether live carrier rates can be offered on this site (AGL-3612).
+    registerPluginApiRoute('commerce/shipping/carrier-rates', carrierRatesAvailabilityHandler);
     registerPluginApiRoute('commerce/connect', connectHandler);
     registerPluginApiRoute('commerce/draft-order', draftOrderHandler);
     // Fulfil + mark-delivered with the transition re-asked under the write
@@ -314,6 +379,10 @@ registerPluginJob({
     // `PATCH /v1/sites/{id}/orders/{id}` records a shipment through the same
     // transaction (`server/api-v1/orders-and-products.ts`).
     registerPluginApiRoute('commerce/fulfill-order', fulfillOrderHandler);
+    // "Resend receipt" from the order dialog (AGL-3610): by email, or by text
+    // when the platform's SMS provider is configured. Rate-limited per member
+    // and per order.
+    registerPluginApiRoute('commerce/order-receipt-send', orderReceiptSendHandler);
     // Issue / void store credit (AGL-2226). Server-side because the host
     // catch-all in the Firestore rules would otherwise let a client write
     // its own `balanceCents`, which checkout applies as amount-off.
@@ -323,6 +392,12 @@ registerPluginJob({
     registerPluginApiRoute('commerce/tax-summary', {
         web: taxSummaryHandler
     });
+    // The payment methods card (AGL-3629): toggles, the platform's offer, the
+    // payout account's capabilities and the site's wallet domains. Loaded with
+    // the first request, so a console that never opens Settings never imports it.
+    registerPluginApiRoute('commerce/payment-methods', {
+        web: async (request)=>(await import("./server/payment-methods.js")).paymentMethodsHandler(request)
+    });
     // A smart collection's rules changed or it was deleted: re-stamp which
     // products it holds (AGL-3321), the membership the storefront queries.
     registerPluginApiRoute('commerce/collection-membership', collectionMembershipHandler);
@@ -334,10 +409,71 @@ registerPluginJob({
     registerPluginApiRoute('membership/admin-remove', membershipAdminRemoveHandler);
     registerPluginApiRoute('commerce/member-post', memberPostHandler);
     registerPluginApiRoute('commerce/pos-order', posOrderHandler);
+    // A register's cloud receipt printers and the jobs a manager sends them
+    // (AGL-3619), and the two doors the printers themselves poll. The doors are
+    // MACHINE routes: a printer is no member and names no site cookie, so it
+    // authenticates with the per-printer secret in its URL and its own device id,
+    // and the route asks the plan before it hands over a job. Loaded with the
+    // first poll, so a console that has no printers never imports them.
+    registerPluginApiRoute('commerce/printers', printersHandler);
+    registerPluginApiRoute('commerce/cloudprnt/:hostId/:printerId/:secret', {
+        web: async (request, context)=>(await import("./server/printer-poll.js")).cloudPrntRoute(request, context)
+    }, {
+        machine: true
+    });
+    registerPluginApiRoute('commerce/epson-sdp/:hostId/:printerId/:secret', {
+        web: async (request, context)=>(await import("./server/printer-poll.js")).epsonServerDirectPrintRoute(request, context)
+    }, {
+        machine: true
+    });
+    // The register's tenders against an open sale, its Stripe Terminal card
+    // readers, and the paired customer display (AGL-3607, AGL-3608). The
+    // display's `pair`/`poll`/`respond` take a display token and no console
+    // session; every other action is gated like a sale.
+    registerPluginApiRoute('commerce/pos-payment', posPaymentHandler);
+    registerPluginApiRoute('commerce/pos-readers', posReadersHandler);
+    registerPluginApiRoute('commerce/pos-display', posDisplayHandler);
+    // Shifts, staff PINs, the customer lookup and returns (AGL-3609).
+    registerPosOpsRoutes();
+    // The native Aglyn POS app's Stripe Terminal SDK: a connection token scoped
+    // to the site's Location, and the Location itself (AGL-3618). Gated like a
+    // sale.
+    registerPluginApiRoute('commerce/pos-terminal-connection-token', posTerminalConnectionTokenHandler);
     registerPluginApiRoute('commerce/process-abandoned', processAbandonedHandler);
     registerPluginApiRoute('commerce/process-restock', processRestockHandler);
     registerPluginApiRoute('commerce/refund', refundHandler);
+    // Returns (AGL-3611): approve, decline, receive with restock, refund
+    // through the route above, a label from a shipping plugin.
+    registerPluginApiRoute('commerce/returns', returnsHandler);
+    // The merchant's outbound order webhooks (AGL-3611): endpoints, secrets,
+    // a test ping and a resend from the delivery log.
+    registerPluginApiRoute('commerce/order-webhooks', orderWebhooksHandler);
     registerPluginApiRoute('commerce/supplier-update', supplierUpdateHandler);
+    // Stamps the open orders that predate the shipping fields, before an
+    // export for shipping (AGL-3613).
+    registerPluginApiRoute('commerce/orders-shipping-prepare', async (req, res)=>(await import("./server/orders-shipping-prepare.js")).ordersShippingPrepareHandler(req, res));
+    // ShipStation's Custom Store endpoint (AGL-3613): ShipStation's servers
+    // pull the order feed and post shipments back with the site's own Basic
+    // credentials, so it is a MACHINE's route and asks the site's commerce,
+    // plan, release and lockdown gates itself once the credentials prove the
+    // site. Loaded on its first call, never with the console API surface.
+    registerPluginApiRoute('commerce/shipstation/:hostId', {
+        web: async (request, context)=>(await import("./server/shipstation.js")).shipStationRoute(request, context)
+    }, {
+        machine: true
+    });
+    // ShippingEasy's shipment callback (AGL-3633): ShippingEasy's servers post
+    // each label bought for an order this store sent them, signed with the
+    // merchant's own API secret, so it is a MACHINE's route like ShipStation's
+    // above and asks the same gates once the signature proves the site.
+    registerPluginApiRoute('commerce/shippingeasy/:hostId', {
+        web: async (request, context)=>(await import("./server/shippingeasy.js")).shippingEasyRoute(request, context)
+    }, {
+        machine: true
+    });
+    // The ShipStation and ShippingEasy cards' connect, show, new password,
+    // send open orders and disconnect.
+    registerPluginApiRoute('commerce/shipping-connectors', async (req, res)=>(await import("./server/shipping-connectors.js")).shippingConnectorsHandler(req, res));
     // The store's sales as figure tables (AGL-2915), for the AI plugin's
     // insights to read by id rather than by reading orders. The console runs
     // insight jobs, so the console surface registers them.

package/src/lib/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/commerce/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n\n/**\n * Server half of the commerce plugin (AGL-396): the site-facing storefront\n * API handlers, registered with the plugin API registry and served by the\n * tenant dispatcher at their unchanged `/api/commerce/*` URLs. This module\n * pulls in firebase-admin + Stripe, so it is NOT re-exported from the client\n * barrel — apps import `@aglyn/plugins-commerce/server` only from their\n * (server-only) API dispatcher registration.\n */\n\nimport {\n  registerBillingWebhookHandler,\n  registerPluginApiRoute,\n  registerPluginJob,\n  registerSitePageEnricher,\n  registerSitePageResolver,\n  registerPluginPermissions,\n  registerPluginConfigSchema,\n} from '@aglyn/aglyn/server'\nimport { isEmailConfigured } from '@aglyn/shared-util-email'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { registerCommerceMediaPublishGuard } from './server/media-publish-guard'\nimport { registerCommerceRecurringCharges } from './server/recurring-charges'\nimport { registerProductCardReader } from './server/product-card'\nimport { registerProductAiCapability } from './server/product-ai-capability'\nimport { registerProductDraftWriter } from './server/product-drafts'\nimport { registerCommerceTaxProfile } from './server/tax-profile'\nimport { registerTaxReturnSource } from '@aglyn/aglyn/plugin-manager/plugin-tax-return-sources'\nimport { commerceTaxReturnSource } from './server/tax-return-source'\nimport { taxSummaryHandler } from './server/tax-summary'\nimport { registerRevenueSource } from '@aglyn/aglyn/plugin-manager/plugin-revenue-sources'\nimport { commerceRevenueSource } from './server/revenue-source'\nimport { commerceBillingWebhookHandler } from './server/billing-webhook'\nimport { registerOrderFigureReaders } from './server/order-figures'\nimport { COMMERCE_PERMISSIONS } from './model/plugin-permissions'\nimport { COMMERCE_CONFIG_SCHEMA } from './plugin-config'\nimport { commerceSitePageEnricher } from './server/site-page-enricher'\nimport { commerceSitePageResolver } from './server/site-page-resolver'\nimport { cartCheckoutHandler } from './server/cart-checkout'\nimport { cartHandler } from './server/cart'\nimport { catalogHandler } from './server/catalog'\nimport { checkoutHandler } from './server/checkout'\nimport { downloadHandler } from './server/download'\nimport { feedHandler } from './server/feed'\nimport { newsletterHandler } from './server/newsletter'\nimport { notifyRestockHandler } from './server/notify-restock'\nimport { productHandler } from './server/product'\nimport { relatedHandler } from './server/related'\nimport { reservationAvailabilityHandler } from './server/reservation-availability'\nimport { gateHandler } from './server/gate'\nimport { memberFeedHandler } from './server/member-feed'\nimport { membershipAccountHandler } from './server/membership-account'\nimport { membershipAdminPasswordHandler } from './server/membership-admin-password'\nimport { membershipAdminRemoveHandler } from './server/membership-admin-remove'\nimport { membershipContentHandler } from './server/membership-content'\nimport { membershipLoginHandler } from './server/membership-login'\nimport { membershipLogoutHandler } from './server/membership-logout'\nimport { membershipRecoverHandler } from './server/membership-recover'\nimport { membershipRegisterHandler } from './server/membership-register'\nimport { membershipResetHandler } from './server/membership-reset'\nimport { membershipWishlistHandler } from './server/membership-wishlist'\nimport { reserveHandler } from './server/reserve'\nimport { streamHandler } from './server/stream'\nimport { subscriptionPortalHandler } from './server/subscription-portal'\nimport { reviewsHandler } from './server/reviews'\nimport { connectHandler } from './server/connect'\nimport { cancelOrderHandler } from './server/cancel-order'\nimport { collectionMembershipHandler } from './server/collection-membership'\nimport { draftOrderHandler } from './server/draft-order'\nimport { fulfillOrderHandler } from './server/fulfill-order'\nimport { giftCardsHandler } from './server/gift-cards'\nimport { memberPostHandler } from './server/member-post'\nimport { orderAnalyticsHandler } from './server/order-analytics'\nimport { posOrderHandler } from './server/pos-order'\nimport {\n  processAbandonedHandler,\n  scanAbandonedCheckouts,\n} from './server/process-abandoned'\nimport { processRestockHandler, scanRestockAlerts } from './server/process-restock'\nimport { scanStockDecrements } from './server/reconcile-stock'\nimport { refundHandler } from './server/refund'\nimport { scanSupplierDeliveries } from './server/supplier-outbox'\nimport { supplierUpdateHandler } from './server/supplier-update'\n\n/**\n * The two commerce beats (AGL-2227).\n *\n * `commerce/process-abandoned` and `commerce/process-restock` have existed\n * since AGL-323/326 as `x-cron-secret` HTTP doors, and `registerCommerceConsoleApi`\n * below has called them \"the scheduler-driven jobs\" in a comment that whole\n * time. **Nothing scheduled them.** Not `scheduled-crons.yml` (its table names\n * 11 paths; neither of these), not `vercel.json` (no `crons` key at all), not\n * `registerPluginJob` — the only two registrations in the repo were scheduled\n * publishing and the bookings hold-expiry.\n *\n * The cost was a Pro-tier entitlement (`abandonedCart`) that had never sent an\n * email, and a storefront \"notify me when it's back\" form writing into a queue\n * with no drain. AGL-1793 had already added the collection-group indexes these\n * two scans need, which is the clearest evidence they were always meant to run.\n *\n * Module scope, like the bookings job beside it: the runner route reaches jobs\n * through `ensureAll(['tenantApi'])`, and a registration inside a `register*`\n * function would depend on which entry point happened to be loaded.\n *\n * 15 minutes, not 1: `process-abandoned` will not remind a checkout younger\n * than an hour and `process-restock` only mails alerts whose product already\n * has stock, so a tighter beat buys nothing and costs two collection-group\n * scans a minute. Both are bounded (200 docs) and idempotent — each pass\n * stamps what it sent — so an overlapping or repeated beat cannot double-send.\n */\nconst RECOVERY_JOB_INTERVAL_MINUTES = 15\n\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'abandoned-checkout-recovery',\n  intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,\n  description:\n    'Email one recovery reminder per stalled checkout (abandonedCart plans).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    // Quietly, not as an error: email is optional per deployment, and a beat\n    // that logs every minute on a self-host without Resend buries everything\n    // else in the log.\n    if (!isEmailConfigured()) return\n    const { sent } = await scanAbandonedCheckouts(gate)\n    if (sent) console.info(`commerce: sent ${sent} abandoned-cart reminders`)\n  },\n})\n\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'back-in-stock-alerts',\n  intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,\n  description: 'Email shoppers whose requested product is in stock again.',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    if (!isEmailConfigured()) return\n    const { sent } = await scanRestockAlerts(gate)\n    if (sent) console.info(`commerce: sent ${sent} back-in-stock alerts`)\n  },\n})\n\n/**\n * The missing-decrement detector (AGL-2358).\n *\n * HOURLY, not on the 15-minute recovery beat: it is a detector for a rare\n * process death, not a queue drain, and nothing it finds gets less true for\n * waiting an hour. The cost of the beat is what sets the interval — one\n * collection-group read of the platform's most recent orders, plus two\n * queries per host that has any — and an hour keeps that off the same tick as\n * the two scans above.\n *\n * NOT gated on `isEmailConfigured()`, unlike its two neighbours. Those send\n * mail; this writes a console notification and a log line, both of which work\n * on a self-host with no mail provider at all — and a stock count that is\n * silently wrong is exactly what a self-hoster least wants suppressed by a\n * setting about email.\n */\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'stock-decrement-reconciliation',\n  intervalMinutes: 60,\n  description:\n    'Report paid orders whose stock decrement never landed (AGL-2358).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    const scan = await scanStockDecrements(gate)\n    if (scan.missingLines || scan.truncatedHosts) {\n      console.warn(\n        `commerce: ${scan.missingLines} order lines across ${scan.hosts} ` +\n          `sites have no sale ledger row (${scan.reportedOrders} newly ` +\n          `reported, ${scan.truncatedHosts} sites' ledger window truncated)`,\n      )\n    }\n  },\n})\n\n/**\n * The dropship supplier outbox drain (AGL-2473).\n *\n * EVERY MINUTE, unlike the three above, and the interval is the point rather\n * than an oversight. This is the only one of the four that a BUYER is waiting\n * on: the row it drains is a paid order that has not been routed to whoever\n * ships it, and every minute it sits is a minute the parcel is not moving. The\n * first backoff step is also 60s, so a supplier that blipped is retried on the\n * next tick.\n *\n * The cost that set fifteen minutes for the recovery pair does not apply. Those\n * are collection-GROUP scans across every site on the platform; this is one\n * ordinary equality query against a top-level collection that is EMPTY in the\n * ordinary case — an empty result bills a single read, so the whole beat is\n * ~1,440 reads a day whether or not anyone is dropshipping.\n *\n * Not gated on `isEmailConfigured()`. The supplier notification is an HTTP POST\n * to the merchant's own supplier, and a self-host with no mail provider still\n * has dropship orders to route.\n */\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'supplier-webhook-delivery',\n  intervalMinutes: 1,\n  description:\n    'Deliver queued dropship supplier notifications, with backoff and a ' +\n    'dead letter that tells the merchant (AGL-2473).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    const scan = await scanSupplierDeliveries(gate)\n    if (scan.deadLettered) {\n      console.warn(\n        `commerce: ${scan.deadLettered} dropship orders could not be routed ` +\n          `to their supplier and have been reported on the order`,\n      )\n    }\n  },\n})\n\n/**\n * A visitor's payment door: it opens a Stripe Checkout Session for whoever\n * calls it, so the dispatcher holds it to the card-testing counters\n * (AGL-3363). Declared here, beside the registration, so the door cannot\n * exist without it.\n */\nconst CARD_PAYMENT_DOOR = { cardPayment: true } as const\n\n/** Registers the commerce plugin's storefront API routes. */\nexport function registerCommerceApi(): void {\n  registerProductCardReader()\n  // The merchant's tax rule, for every plugin that prices a charge here.\n  registerCommerceTaxProfile()\n  registerPluginPermissions(COMMERCE_PERMISSIONS)\n  // Merchant-settable register discount ceiling (AGL-2161). Registered on\n  // BOTH surfaces, like the permissions above: the POS route reads it\n  // server-side, and the settings card renders it from the same schema.\n  registerPluginConfigSchema(COMMERCE_CONFIG_SCHEMA)\n  // PDP/PLP template pages (AGL-418): /products/* + /collections/*.\n  registerSitePageResolver(commerceSitePageResolver)\n  // Seeds product grids on ordinary screens (AGL-659) — the resolver above\n  // only covers /products/* and /collections/*, so /products itself, and any\n  // designed page with a grid on it, needed this to render server-side.\n  registerSitePageEnricher(commerceSitePageEnricher)\n  registerPluginApiRoute('commerce/cart-checkout', cartCheckoutHandler, CARD_PAYMENT_DOOR)\n  registerPluginApiRoute('commerce/cart', cartHandler)\n  registerPluginApiRoute('commerce/catalog', catalogHandler)\n  registerPluginApiRoute('commerce/checkout', checkoutHandler, CARD_PAYMENT_DOOR)\n  registerPluginApiRoute('commerce/download', downloadHandler)\n  registerPluginApiRoute('commerce/feed', feedHandler)\n  registerPluginApiRoute('commerce/newsletter', newsletterHandler)\n  registerPluginApiRoute('commerce/notify-restock', notifyRestockHandler)\n  // GA-safe order projection for the storefront `purchase` (AGL-1641).\n  registerPluginApiRoute('commerce/order-analytics', orderAnalyticsHandler)\n  registerPluginApiRoute('commerce/product', productHandler)\n  registerPluginApiRoute('commerce/related', relatedHandler)\n  registerPluginApiRoute('commerce/reservation-availability', reservationAvailabilityHandler)\n  registerPluginApiRoute('commerce/reserve', reserveHandler, CARD_PAYMENT_DOOR)\n  registerPluginApiRoute('commerce/gate', gateHandler)\n  registerPluginApiRoute('commerce/member-feed', memberFeedHandler)\n  registerPluginApiRoute('commerce/stream', streamHandler)\n  registerPluginApiRoute('commerce/subscription-portal', subscriptionPortalHandler)\n  registerPluginApiRoute('commerce/reviews', reviewsHandler)\n  registerPluginApiRoute('membership/account', membershipAccountHandler)\n  registerPluginApiRoute('membership/content', membershipContentHandler)\n  registerPluginApiRoute('membership/login', membershipLoginHandler)\n  registerPluginApiRoute('membership/logout', membershipLogoutHandler)\n  // Password recovery pair (AGL-552): request + complete.\n  registerPluginApiRoute('membership/recover', membershipRecoverHandler)\n  registerPluginApiRoute('membership/register', membershipRegisterHandler)\n  registerPluginApiRoute('membership/reset', membershipResetHandler)\n  registerPluginApiRoute('membership/wishlist', membershipWishlistHandler)\n}\n\n/**\n * Registers the commerce plugin's console-side API routes (AGL-396):\n * merchant/staff operations (Connect onboarding, refunds, draft & POS\n * orders, member posts), the supplier tracking callback, and the HTTP doors\n * for the abandoned-cart / restock passes.\n *\n * Those last two are NOT what schedules them — the `registerPluginJob` calls\n * above are (AGL-2227). This comment used to call them \"the scheduler-driven\n * jobs\", which is how they stayed dark for months: it asserted the wiring\n * instead of having it.\n */\nexport function registerCommerceConsoleApi(): void {\n  // What a product looks like to a surface that is not this plugin's — a\n  // campaign email that features one asks here rather than importing the model.\n  registerProductCardReader()\n  // …and a draft product another plugin asks for by name (AGL-3616): an AI\n  // build setting a store up from a brief, unpriced unless the brief priced it.\n  // The console runs AI jobs (AGL-3026).\n  registerProductDraftWriter()\n  // …and the operation an AI build plans for it, which that writer executes.\n  registerProductAiCapability()\n  // …and why a file somebody is SELLING may not be made public (AGL-3080).\n  // The media library asks before it hands an asset its permanent CDN URL\n  // back; what a product is, and which of its fields hold paid media, is\n  // this plugin's to know.\n  registerCommerceMediaPublishGuard()\n  // …and which memberships a site sells, for a security lockdown to pause\n  // (AGL-3364). The lockdown route runs on this surface.\n  registerCommerceRecurringCharges()\n  // …and the tax rule, for the webhook that confirms what they charged.\n  registerCommerceTaxProfile()\n  // …and its sales on the operator's own sales tax return (AGL-3080): the\n  // tax a storefront checkout collected under the platform's registrations.\n  // The staff return awaits this surface before it asks, and refuses to be\n  // filed without this source — commerce declares `taxReturnSource`.\n  registerTaxReturnSource(commerceTaxReturnSource, { pluginId: BUNDLE_ID })\n  // …and the take its orders earn the operator, on the staff revenue report\n  // (AGL-3080) — commerce declares `revenueSource`, so the report names this\n  // source as unread rather than counting it as zero if it is missing.\n  registerRevenueSource(commerceRevenueSource, { pluginId: BUNDLE_ID })\n  // Stripe webhook sections (AGL-418): orders/carts/drafts/reservations/\n  // subscriptions ride the platform webhook via the hook registry.\n  registerBillingWebhookHandler(commerceBillingWebhookHandler)\n  // Cancel + stock release in one transaction (AGL-1808). Server-side because\n  // the release depends on the transition rule, and a client write could not\n  // re-ask it under the same lock that flips the status.\n  registerPluginApiRoute('commerce/cancel-order', cancelOrderHandler)\n  registerPluginApiRoute('commerce/connect', connectHandler)\n  registerPluginApiRoute('commerce/draft-order', draftOrderHandler)\n  // Fulfil + mark-delivered with the transition re-asked under the write\n  // (AGL-1819) — the same stale-dialog hole cancel-order closes, minus the\n  // stock release those two transitions never had. The customer REST API's\n  // `PATCH /v1/sites/{id}/orders/{id}` records a shipment through the same\n  // transaction (`server/api-v1/orders-and-products.ts`).\n  registerPluginApiRoute('commerce/fulfill-order', fulfillOrderHandler)\n  // Issue / void store credit (AGL-2226). Server-side because the host\n  // catch-all in the Firestore rules would otherwise let a client write\n  // its own `balanceCents`, which checkout applies as amount-off.\n  registerPluginApiRoute('commerce/gift-cards', giftCardsHandler)\n  // The merchant's own storefront sales tax, by who owes it (AGL-2440): the\n  // same rows and classifier the operator's return reads, fenced to one site.\n  registerPluginApiRoute('commerce/tax-summary', { web: taxSummaryHandler })\n  // A smart collection's rules changed or it was deleted: re-stamp which\n  // products it holds (AGL-3321), the membership the storefront queries.\n  registerPluginApiRoute('commerce/collection-membership', collectionMembershipHandler)\n  // A site member's password help (AGL-914) and removal (AGL-3308), from the\n  // Users page drawer and the Inbox. Console-auth, not the visitor cookie the\n  // storefront's `membership/*` routes take, so they are served where the\n  // console posts: the console's own dispatcher loads this surface only.\n  registerPluginApiRoute(\n    'membership/admin-password',\n    membershipAdminPasswordHandler,\n  )\n  registerPluginApiRoute('membership/admin-remove', membershipAdminRemoveHandler)\n  registerPluginApiRoute('commerce/member-post', memberPostHandler)\n  registerPluginApiRoute('commerce/pos-order', posOrderHandler)\n  registerPluginApiRoute('commerce/process-abandoned', processAbandonedHandler)\n  registerPluginApiRoute('commerce/process-restock', processRestockHandler)\n  registerPluginApiRoute('commerce/refund', refundHandler)\n  registerPluginApiRoute('commerce/supplier-update', supplierUpdateHandler)\n  // The store's sales as figure tables (AGL-2915), for the AI plugin's\n  // insights to read by id rather than by reading orders. The console runs\n  // insight jobs, so the console surface registers them.\n  registerOrderFigureReaders(() => firebaseAdmin.app().firestore())\n}\n\n// Shared with the (still app-side) membership/account route.\nexport { mintDownloadToken } from './server/download'\n\n// Site-member session primitives, shared with the (still app-side)\n// membership/* routes until those migrate too (AGL-396).\nexport * from './server/membership'\n\n// Type-only (AGL-3080): the plugin's entitlement keys, declared by module\n// augmentation, for every program that loads this entry point.\nexport type { commercePlanEntitlements } from './plan-entitlements'\n"],"names":["registerBillingWebhookHandler","registerPluginApiRoute","registerPluginJob","registerSitePageEnricher","registerSitePageResolver","registerPluginPermissions","registerPluginConfigSchema","isEmailConfigured","firebaseAdmin","BUNDLE_ID","registerCommerceMediaPublishGuard","registerCommerceRecurringCharges","registerProductCardReader","registerProductAiCapability","registerProductDraftWriter","registerCommerceTaxProfile","registerTaxReturnSource","commerceTaxReturnSource","taxSummaryHandler","registerRevenueSource","commerceRevenueSource","commerceBillingWebhookHandler","registerOrderFigureReaders","COMMERCE_PERMISSIONS","COMMERCE_CONFIG_SCHEMA","commerceSitePageEnricher","commerceSitePageResolver","cartCheckoutHandler","cartHandler","catalogHandler","checkoutHandler","downloadHandler","feedHandler","newsletterHandler","notifyRestockHandler","productHandler","relatedHandler","reservationAvailabilityHandler","gateHandler","memberFeedHandler","membershipAccountHandler","membershipAdminPasswordHandler","membershipAdminRemoveHandler","membershipContentHandler","membershipLoginHandler","membershipLogoutHandler","membershipRecoverHandler","membershipRegisterHandler","membershipResetHandler","membershipWishlistHandler","reserveHandler","streamHandler","subscriptionPortalHandler","reviewsHandler","connectHandler","cancelOrderHandler","collectionMembershipHandler","draftOrderHandler","fulfillOrderHandler","giftCardsHandler","memberPostHandler","orderAnalyticsHandler","posOrderHandler","processAbandonedHandler","scanAbandonedCheckouts","processRestockHandler","scanRestockAlerts","scanStockDecrements","refundHandler","scanSupplierDeliveries","supplierUpdateHandler","RECOVERY_JOB_INTERVAL_MINUTES","pluginId","name","intervalMinutes","description","lockdown","scope","handler","gate","sent","console","info","scan","missingLines","truncatedHosts","warn","hosts","reportedOrders","deadLettered","CARD_PAYMENT_DOOR","cardPayment","registerCommerceApi","registerCommerceConsoleApi","web","app","firestore","mintDownloadToken"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD;;;;;;;CAOC,GAED,SACEA,6BAA6B,EAC7BC,sBAAsB,EACtBC,iBAAiB,EACjBC,wBAAwB,EACxBC,wBAAwB,EACxBC,yBAAyB,EACzBC,0BAA0B,QACrB,sBAAqB;AAC5B,SAASC,iBAAiB,QAAQ,2BAA0B;AAC5D,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,iCAAiC,QAAQ,kCAA8B;AAChF,SAASC,gCAAgC,QAAQ,gCAA4B;AAC7E,SAASC,yBAAyB,QAAQ,2BAAuB;AACjE,SAASC,2BAA2B,QAAQ,oCAAgC;AAC5E,SAASC,0BAA0B,QAAQ,6BAAyB;AACpE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SAASC,uBAAuB,QAAQ,wDAAuD;AAC/F,SAASC,uBAAuB,QAAQ,gCAA4B;AACpE,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,qBAAqB,QAAQ,qDAAoD;AAC1F,SAASC,qBAAqB,QAAQ,6BAAyB;AAC/D,SAASC,6BAA6B,QAAQ,8BAA0B;AACxE,SAASC,0BAA0B,QAAQ,4BAAwB;AACnE,SAASC,oBAAoB,QAAQ,gCAA4B;AACjE,SAASC,sBAAsB,QAAQ,qBAAiB;AACxD,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,8BAA8B,QAAQ,uCAAmC;AAClF,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,8BAA8B,QAAQ,wCAAoC;AACnF,SAASC,4BAA4B,QAAQ,sCAAkC;AAC/E,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,uBAAuB,QAAQ,gCAA4B;AACpE,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,2BAA2B,QAAQ,oCAAgC;AAC5E,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,gBAAgB,QAAQ,yBAAqB;AACtD,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,qBAAqB,QAAQ,8BAA0B;AAChE,SAASC,eAAe,QAAQ,wBAAoB;AACpD,SACEC,uBAAuB,EACvBC,sBAAsB,QACjB,gCAA4B;AACnC,SAASC,qBAAqB,EAAEC,iBAAiB,QAAQ,8BAA0B;AACnF,SAASC,mBAAmB,QAAQ,8BAA0B;AAC9D,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,sBAAsB,QAAQ,8BAA0B;AACjE,SAASC,qBAAqB,QAAQ,8BAA0B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,MAAMC,gCAAgC;AAEtCrE,kBAAkB;IAChBsE,UAAU/D;IACVgE,MAAM;IACNC,iBAAiBH;IACjBI,aACE;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,yEAAyE;QACzE,yEAAyE;QACzE,mBAAmB;QACnB,IAAI,CAACxE,qBAAqB;QAC1B,MAAM,EAAEyE,IAAI,EAAE,GAAG,MAAMhB,uBAAuBe;QAC9C,IAAIC,MAAMC,QAAQC,IAAI,CAAC,CAAC,eAAe,EAAEF,KAAK,yBAAyB,CAAC;IAC1E;AACF;AAEA9E,kBAAkB;IAChBsE,UAAU/D;IACVgE,MAAM;IACNC,iBAAiBH;IACjBI,aAAa;IACbC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,IAAI,CAACxE,qBAAqB;QAC1B,MAAM,EAAEyE,IAAI,EAAE,GAAG,MAAMd,kBAAkBa;QACzC,IAAIC,MAAMC,QAAQC,IAAI,CAAC,CAAC,eAAe,EAAEF,KAAK,qBAAqB,CAAC;IACtE;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD9E,kBAAkB;IAChBsE,UAAU/D;IACVgE,MAAM;IACNC,iBAAiB;IACjBC,aACE;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,MAAMI,OAAO,MAAMhB,oBAAoBY;QACvC,IAAII,KAAKC,YAAY,IAAID,KAAKE,cAAc,EAAE;YAC5CJ,QAAQK,IAAI,CACV,CAAC,UAAU,EAAEH,KAAKC,YAAY,CAAC,oBAAoB,EAAED,KAAKI,KAAK,CAAC,CAAC,CAAC,GAChE,CAAC,+BAA+B,EAAEJ,KAAKK,cAAc,CAAC,OAAO,CAAC,GAC9D,CAAC,UAAU,EAAEL,KAAKE,cAAc,CAAC,gCAAgC,CAAC;QAExE;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACDnF,kBAAkB;IAChBsE,UAAU/D;IACVgE,MAAM;IACNC,iBAAiB;IACjBC,aACE,wEACA;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,MAAMI,OAAO,MAAMd,uBAAuBU;QAC1C,IAAII,KAAKM,YAAY,EAAE;YACrBR,QAAQK,IAAI,CACV,CAAC,UAAU,EAAEH,KAAKM,YAAY,CAAC,qCAAqC,CAAC,GACnE,CAAC,qDAAqD,CAAC;QAE7D;IACF;AACF;AAEA;;;;;CAKC,GACD,MAAMC,oBAAoB;IAAEC,aAAa;AAAK;AAE9C,2DAA2D,GAC3D,OAAO,SAASC;IACdhF;IACA,uEAAuE;IACvEG;IACAV,0BAA0BkB;IAC1B,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtEjB,2BAA2BkB;IAC3B,kEAAkE;IAClEpB,yBAAyBsB;IACzB,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtEvB,yBAAyBsB;IACzBxB,uBAAuB,0BAA0B0B,qBAAqB+D;IACtEzF,uBAAuB,iBAAiB2B;IACxC3B,uBAAuB,oBAAoB4B;IAC3C5B,uBAAuB,qBAAqB6B,iBAAiB4D;IAC7DzF,uBAAuB,qBAAqB8B;IAC5C9B,uBAAuB,iBAAiB+B;IACxC/B,uBAAuB,uBAAuBgC;IAC9ChC,uBAAuB,2BAA2BiC;IAClD,qEAAqE;IACrEjC,uBAAuB,4BAA4B4D;IACnD5D,uBAAuB,oBAAoBkC;IAC3ClC,uBAAuB,oBAAoBmC;IAC3CnC,uBAAuB,qCAAqCoC;IAC5DpC,uBAAuB,oBAAoBiD,gBAAgBwC;IAC3DzF,uBAAuB,iBAAiBqC;IACxCrC,uBAAuB,wBAAwBsC;IAC/CtC,uBAAuB,mBAAmBkD;IAC1ClD,uBAAuB,gCAAgCmD;IACvDnD,uBAAuB,oBAAoBoD;IAC3CpD,uBAAuB,sBAAsBuC;IAC7CvC,uBAAuB,sBAAsB0C;IAC7C1C,uBAAuB,oBAAoB2C;IAC3C3C,uBAAuB,qBAAqB4C;IAC5C,wDAAwD;IACxD5C,uBAAuB,sBAAsB6C;IAC7C7C,uBAAuB,uBAAuB8C;IAC9C9C,uBAAuB,oBAAoB+C;IAC3C/C,uBAAuB,uBAAuBgD;AAChD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAAS4C;IACd,uEAAuE;IACvE,8EAA8E;IAC9EjF;IACA,yEAAyE;IACzE,8EAA8E;IAC9E,uCAAuC;IACvCE;IACA,2EAA2E;IAC3ED;IACA,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,yBAAyB;IACzBH;IACA,wEAAwE;IACxE,uDAAuD;IACvDC;IACA,sEAAsE;IACtEI;IACA,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnEC,wBAAwBC,yBAAyB;QAAEuD,UAAU/D;IAAU;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrEU,sBAAsBC,uBAAuB;QAAEoD,UAAU/D;IAAU;IACnE,uEAAuE;IACvE,iEAAiE;IACjET,8BAA8BqB;IAC9B,4EAA4E;IAC5E,2EAA2E;IAC3E,uDAAuD;IACvDpB,uBAAuB,yBAAyBsD;IAChDtD,uBAAuB,oBAAoBqD;IAC3CrD,uBAAuB,wBAAwBwD;IAC/C,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wDAAwD;IACxDxD,uBAAuB,0BAA0ByD;IACjD,qEAAqE;IACrE,sEAAsE;IACtE,gEAAgE;IAChEzD,uBAAuB,uBAAuB0D;IAC9C,0EAA0E;IAC1E,4EAA4E;IAC5E1D,uBAAuB,wBAAwB;QAAE6F,KAAK5E;IAAkB;IACxE,uEAAuE;IACvE,uEAAuE;IACvEjB,uBAAuB,kCAAkCuD;IACzD,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvEvD,uBACE,6BACAwC;IAEFxC,uBAAuB,2BAA2ByC;IAClDzC,uBAAuB,wBAAwB2D;IAC/C3D,uBAAuB,sBAAsB6D;IAC7C7D,uBAAuB,8BAA8B8D;IACrD9D,uBAAuB,4BAA4BgE;IACnDhE,uBAAuB,mBAAmBmE;IAC1CnE,uBAAuB,4BAA4BqE;IACnD,qEAAqE;IACrE,yEAAyE;IACzE,uDAAuD;IACvDhD,2BAA2B,IAAMd,cAAcuF,GAAG,GAAGC,SAAS;AAChE;AAEA,6DAA6D;AAC7D,SAASC,iBAAiB,QAAQ,uBAAmB;AAErD,mEAAmE;AACnE,yDAAyD;AACzD,cAAc,yBAAqB"}
+{"version":3,"sources":["../../../../../../libs/plugins/commerce/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n\n/**\n * Server half of the commerce plugin (AGL-396): the site-facing storefront\n * API handlers, registered with the plugin API registry and served by the\n * tenant dispatcher at their unchanged `/api/commerce/*` URLs. This module\n * pulls in firebase-admin + Stripe, so it is NOT re-exported from the client\n * barrel — apps import `@aglyn/plugins-commerce/server` only from their\n * (server-only) API dispatcher registration.\n */\n\nimport {\n  registerBillingWebhookHandler,\n  registerPluginApiRoute,\n  registerPluginJob,\n  registerSitePageEnricher,\n  registerSitePageResolver,\n  registerPluginPermissions,\n  registerPluginConfigSchema,\n} from '@aglyn/aglyn/server'\nimport { isEmailConfigured } from '@aglyn/shared-util-email'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { registerCommerceMediaPublishGuard } from './server/media-publish-guard'\nimport { registerCommerceRecurringCharges } from './server/recurring-charges'\nimport { registerProductCardReader } from './server/product-card'\nimport { registerProductAiCapability } from './server/product-ai-capability'\nimport { registerProductDraftWriter } from './server/product-drafts'\nimport { registerCommerceTaxProfile } from './server/tax-profile'\nimport { registerTaxReturnSource } from '@aglyn/aglyn/plugin-manager/plugin-tax-return-sources'\nimport { commerceTaxReturnSource } from './server/tax-return-source'\nimport { taxSummaryHandler } from './server/tax-summary'\nimport { registerRevenueSource } from '@aglyn/aglyn/plugin-manager/plugin-revenue-sources'\nimport { commerceRevenueSource } from './server/revenue-source'\nimport { commerceBillingWebhookHandler } from './server/billing-webhook'\nimport { registerOrderFigureReaders } from './server/order-figures'\nimport { COMMERCE_PERMISSIONS } from './model/plugin-permissions'\nimport { COMMERCE_CONFIG_SCHEMA } from './plugin-config'\nimport { commerceSitePageEnricher } from './server/site-page-enricher'\nimport { commerceSitePageResolver } from './server/site-page-resolver'\nimport { cartCheckoutHandler } from './server/cart-checkout'\nimport { cartHandler } from './server/cart'\nimport { cartExtrasHandler } from './server/checkout-extras'\nimport { catalogHandler } from './server/catalog'\nimport { checkoutHandler } from './server/checkout'\nimport { downloadHandler } from './server/download'\nimport { newsletterHandler } from './server/newsletter'\nimport { notifyRestockHandler } from './server/notify-restock'\nimport { productHandler } from './server/product'\nimport { relatedHandler } from './server/related'\nimport { reservationAvailabilityHandler } from './server/reservation-availability'\nimport { gateHandler } from './server/gate'\nimport { memberFeedHandler } from './server/member-feed'\nimport { membershipAccountHandler } from './server/membership-account'\nimport { membershipAdminPasswordHandler } from './server/membership-admin-password'\nimport { membershipAdminRemoveHandler } from './server/membership-admin-remove'\nimport { membershipContentHandler } from './server/membership-content'\nimport { membershipLoginHandler } from './server/membership-login'\nimport { membershipLogoutHandler } from './server/membership-logout'\nimport { membershipRecoverHandler } from './server/membership-recover'\nimport { membershipRegisterHandler } from './server/membership-register'\nimport { membershipResetHandler } from './server/membership-reset'\nimport { membershipWishlistHandler } from './server/membership-wishlist'\nimport { reserveHandler } from './server/reserve'\nimport { streamHandler } from './server/stream'\nimport { subscriptionPortalHandler } from './server/subscription-portal'\nimport { reviewsHandler } from './server/reviews'\nimport { connectHandler } from './server/connect'\nimport { cancelOrderHandler } from './server/cancel-order'\nimport { carrierRatesAvailabilityHandler } from './server/carrier-rates-availability'\nimport { collectionMembershipHandler } from './server/collection-membership'\nimport { draftOrderHandler } from './server/draft-order'\nimport { fulfillOrderHandler } from './server/fulfill-order'\nimport { orderReceiptSendHandler } from './server/order-receipt-send'\nimport { orderStatusHandler, registerOrderStatusActions } from './server/order-status'\nimport { returnRequestStatusAction } from './server/return-status-action'\nimport { giftCardsHandler } from './server/gift-cards'\nimport { memberPostHandler } from './server/member-post'\nimport { orderAnalyticsHandler } from './server/order-analytics'\nimport { checkoutStatusHandler } from './server/checkout-status'\nimport { posOrderHandler } from './server/pos-order'\nimport { printersHandler } from './server/printers'\nimport { posPaymentHandler } from './server/pos-payment'\nimport { posReadersHandler } from './server/pos-readers'\nimport { posTerminalConnectionTokenHandler } from './server/pos-terminal-connection-token'\nimport { posDisplayHandler } from './server/pos-display'\nimport { registerPosOpsRoutes } from './server/pos-ops-routes'\nimport {\n  processAbandonedHandler,\n  scanAbandonedCheckouts,\n} from './server/process-abandoned'\nimport { processRestockHandler, scanRestockAlerts } from './server/process-restock'\nimport { scanStockDecrements } from './server/reconcile-stock'\nimport { refundHandler } from './server/refund'\nimport { orderWebhooksHandler } from './server/order-webhooks'\nimport { returnRequestHandler, returnsHandler } from './server/returns'\nimport { scanSupplierDeliveries } from './server/supplier-outbox'\nimport { supplierUpdateHandler } from './server/supplier-update'\n\n/**\n * The two commerce beats (AGL-2227).\n *\n * `commerce/process-abandoned` and `commerce/process-restock` have existed\n * since AGL-323/326 as `x-cron-secret` HTTP doors, and `registerCommerceConsoleApi`\n * below has called them \"the scheduler-driven jobs\" in a comment that whole\n * time. **Nothing scheduled them.** Not `scheduled-crons.yml` (its table names\n * 11 paths; neither of these), not `vercel.json` (no `crons` key at all), not\n * `registerPluginJob` — the only two registrations in the repo were scheduled\n * publishing and the bookings hold-expiry.\n *\n * The cost was a Pro-tier entitlement (`abandonedCart`) that had never sent an\n * email, and a storefront \"notify me when it's back\" form writing into a queue\n * with no drain. AGL-1793 had already added the collection-group indexes these\n * two scans need, which is the clearest evidence they were always meant to run.\n *\n * Module scope, like the bookings job beside it: the runner route reaches jobs\n * through `ensureAll(['tenantApi'])`, and a registration inside a `register*`\n * function would depend on which entry point happened to be loaded.\n *\n * 15 minutes, not 1: `process-abandoned` will not remind a checkout younger\n * than an hour and `process-restock` only mails alerts whose product already\n * has stock, so a tighter beat buys nothing and costs two collection-group\n * scans a minute. Both are bounded (200 docs) and idempotent — each pass\n * stamps what it sent — so an overlapping or repeated beat cannot double-send.\n */\nconst RECOVERY_JOB_INTERVAL_MINUTES = 15\n\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'abandoned-checkout-recovery',\n  intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,\n  description:\n    'Email one recovery reminder per stalled checkout (abandonedCart plans).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    // Quietly, not as an error: email is optional per deployment, and a beat\n    // that logs every minute on a self-host without Resend buries everything\n    // else in the log.\n    if (!isEmailConfigured()) return\n    const { sent } = await scanAbandonedCheckouts(gate)\n    if (sent) console.info(`commerce: sent ${sent} abandoned-cart reminders`)\n  },\n})\n\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'back-in-stock-alerts',\n  intervalMinutes: RECOVERY_JOB_INTERVAL_MINUTES,\n  description: 'Email shoppers whose requested product is in stock again.',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    if (!isEmailConfigured()) return\n    const { sent } = await scanRestockAlerts(gate)\n    if (sent) console.info(`commerce: sent ${sent} back-in-stock alerts`)\n  },\n})\n\n/**\n * The missing-decrement detector (AGL-2358).\n *\n * HOURLY, not on the 15-minute recovery beat: it is a detector for a rare\n * process death, not a queue drain, and nothing it finds gets less true for\n * waiting an hour. The cost of the beat is what sets the interval — one\n * collection-group read of the platform's most recent orders, plus two\n * queries per host that has any — and an hour keeps that off the same tick as\n * the two scans above.\n *\n * NOT gated on `isEmailConfigured()`, unlike its two neighbours. Those send\n * mail; this writes a console notification and a log line, both of which work\n * on a self-host with no mail provider at all — and a stock count that is\n * silently wrong is exactly what a self-hoster least wants suppressed by a\n * setting about email.\n */\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'stock-decrement-reconciliation',\n  intervalMinutes: 60,\n  description:\n    'Report paid orders whose stock decrement never landed (AGL-2358).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    const scan = await scanStockDecrements(gate)\n    if (scan.missingLines || scan.truncatedHosts) {\n      console.warn(\n        `commerce: ${scan.missingLines} order lines across ${scan.hosts} ` +\n          `sites have no sale ledger row (${scan.reportedOrders} newly ` +\n          `reported, ${scan.truncatedHosts} sites' ledger window truncated)`,\n      )\n    }\n  },\n})\n\n/**\n * The dropship supplier outbox drain (AGL-2473).\n *\n * EVERY MINUTE, unlike the three above, and the interval is the point rather\n * than an oversight. This is the only one of the four that a BUYER is waiting\n * on: the row it drains is a paid order that has not been routed to whoever\n * ships it, and every minute it sits is a minute the parcel is not moving. The\n * first backoff step is also 60s, so a supplier that blipped is retried on the\n * next tick.\n *\n * The cost that set fifteen minutes for the recovery pair does not apply. Those\n * are collection-GROUP scans across every site on the platform; this is one\n * ordinary equality query against a top-level collection that is EMPTY in the\n * ordinary case — an empty result bills a single read, so the whole beat is\n * ~1,440 reads a day whether or not anyone is dropshipping.\n *\n * Not gated on `isEmailConfigured()`. The supplier notification is an HTTP POST\n * to the merchant's own supplier, and a self-host with no mail provider still\n * has dropship orders to route.\n */\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'supplier-webhook-delivery',\n  intervalMinutes: 1,\n  description:\n    'Deliver queued dropship supplier notifications, with backoff and a ' +\n    'dead letter that tells the merchant (AGL-2473).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    const scan = await scanSupplierDeliveries(gate)\n    if (scan.deadLettered) {\n      console.warn(\n        `commerce: ${scan.deadLettered} dropship orders could not be routed ` +\n          `to their supplier and have been reported on the order`,\n      )\n    }\n  },\n})\n\n/**\n * Stripe payment method domains for every connected custom domain (AGL-3629).\n *\n * The backfill for domains connected before registration existed, and the\n * repair for a connect whose event was lost, in one daily pass. A domain\n * already registered costs a document read and no Stripe call, so the beat is\n * cheap; a day's delay costs only the Apple Pay button on a domain connected\n * while Stripe was unreachable, and the first in-page checkout there registers\n * it anyway.\n */\nregisterPluginJob({\n  pluginId: BUNDLE_ID,\n  name: 'payment-method-domains',\n  intervalMinutes: 24 * 60,\n  description:\n    'Register connected custom domains with Stripe so Apple Pay, Google Pay ' +\n    'and Link show on them (AGL-3629).',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    if (!process.env.STRIPE_SECRET_KEY) return\n    const { reconcileCustomDomains } = await import('./server/payment-method-domains')\n    const result = await reconcileCustomDomains(gate)\n    if (result.registered || result.failed) {\n      console.info(\n        `commerce: payment method domains — ${result.registered} registered, ` +\n          `${result.failed} failed across ${result.hosts} sites`,\n      )\n    }\n  },\n})\n\n/**\n * A visitor's payment door: it opens a Stripe Checkout Session for whoever\n * calls it, so the dispatcher holds it to the card-testing counters\n * (AGL-3363). Declared here, beside the registration, so the door cannot\n * exist without it.\n */\nconst CARD_PAYMENT_DOOR = { cardPayment: true } as const\n\n/** Registers the commerce plugin's storefront API routes. */\nexport function registerCommerceApi(): void {\n  registerProductCardReader()\n  // The merchant's tax rule, for every plugin that prices a charge here.\n  registerCommerceTaxProfile()\n  registerPluginPermissions(COMMERCE_PERMISSIONS)\n  // Merchant-settable register discount ceiling (AGL-2161). Registered on\n  // BOTH surfaces, like the permissions above: the POS route reads it\n  // server-side, and the settings card renders it from the same schema.\n  registerPluginConfigSchema(COMMERCE_CONFIG_SCHEMA)\n  // PDP/PLP template pages (AGL-418): /products/* + /collections/*.\n  registerSitePageResolver(commerceSitePageResolver)\n  // Seeds product grids on ordinary screens (AGL-659) — the resolver above\n  // only covers /products/* and /collections/*, so /products itself, and any\n  // designed page with a grid on it, needed this to render server-side.\n  registerSitePageEnricher(commerceSitePageEnricher)\n  registerPluginApiRoute('commerce/cart-checkout', cartCheckoutHandler, CARD_PAYMENT_DOOR)\n  registerPluginApiRoute('commerce/cart', cartHandler)\n  // Optional lines another plugin offers at the cart (AGL-3635).\n  registerPluginApiRoute('commerce/cart-extras', cartExtrasHandler)\n  registerPluginApiRoute('commerce/catalog', catalogHandler)\n  registerPluginApiRoute('commerce/checkout', checkoutHandler, CARD_PAYMENT_DOOR)\n  registerPluginApiRoute('commerce/download', downloadHandler)\n  // The pre-channels Google feed address (AGL-299), now written by the\n  // catalog's feed publisher (AGL-3637); the module loads with a fetch.\n  registerPluginApiRoute('commerce/feed', {\n    web: async (request) => (await import('./server/legacy-feed')).legacyFeedRoute(request),\n  })\n  registerPluginApiRoute('commerce/newsletter', newsletterHandler)\n  registerPluginApiRoute('commerce/notify-restock', notifyRestockHandler)\n  // GA-safe order projection for the storefront `purchase` (AGL-1641).\n  registerPluginApiRoute('commerce/order-analytics', orderAnalyticsHandler)\n  // The guest order-status page's data (AGL-3610), behind the signed link in\n  // every buyer email — a recipient link, so it outlives the site's gates.\n  registerPluginApiRoute('commerce/order-status', orderStatusHandler, { recipientLink: true })\n  // …and its \"Request a return\" button (AGL-3611), on an order that can\n  // still send something back.\n  registerOrderStatusActions(returnRequestStatusAction)\n  // What became of a session the shopper was returned from (AGL-3606).\n  registerPluginApiRoute('commerce/checkout-status', checkoutStatusHandler)\n  registerPluginApiRoute('commerce/product', productHandler)\n  registerPluginApiRoute('commerce/related', relatedHandler)\n  registerPluginApiRoute('commerce/reservation-availability', reservationAvailabilityHandler)\n  registerPluginApiRoute('commerce/reserve', reserveHandler, CARD_PAYMENT_DOOR)\n  registerPluginApiRoute('commerce/gate', gateHandler)\n  registerPluginApiRoute('commerce/member-feed', memberFeedHandler)\n  registerPluginApiRoute('commerce/stream', streamHandler)\n  registerPluginApiRoute('commerce/subscription-portal', subscriptionPortalHandler)\n  registerPluginApiRoute('commerce/reviews', reviewsHandler)\n  // A buyer's return request (AGL-3611), from their account or the signed\n  // order-status link.\n  registerPluginApiRoute('commerce/return-request', returnRequestHandler)\n  registerPluginApiRoute('membership/account', membershipAccountHandler)\n  registerPluginApiRoute('membership/content', membershipContentHandler)\n  registerPluginApiRoute('membership/login', membershipLoginHandler)\n  registerPluginApiRoute('membership/logout', membershipLogoutHandler)\n  // Password recovery pair (AGL-552): request + complete.\n  registerPluginApiRoute('membership/recover', membershipRecoverHandler)\n  registerPluginApiRoute('membership/register', membershipRegisterHandler)\n  registerPluginApiRoute('membership/reset', membershipResetHandler)\n  registerPluginApiRoute('membership/wishlist', membershipWishlistHandler)\n}\n\n/**\n * Registers the commerce plugin's console-side API routes (AGL-396):\n * merchant/staff operations (Connect onboarding, refunds, draft & POS\n * orders, member posts), the supplier tracking callback, and the HTTP doors\n * for the abandoned-cart / restock passes.\n *\n * Those last two are NOT what schedules them — the `registerPluginJob` calls\n * above are (AGL-2227). This comment used to call them \"the scheduler-driven\n * jobs\", which is how they stayed dark for months: it asserted the wiring\n * instead of having it.\n */\nexport function registerCommerceConsoleApi(): void {\n  // The register's gate (`managePos`) is resolved on THIS surface: every POS\n  // route below runs in the console, and a key no surface registered here is\n  // absent from the resolved map, which reads as refused — the site's own\n  // owner was answered 403 at the register.\n  registerPluginPermissions(COMMERCE_PERMISSIONS)\n  // What a product looks like to a surface that is not this plugin's — a\n  // campaign email that features one asks here rather than importing the model.\n  registerProductCardReader()\n  // …and a draft product another plugin asks for by name (AGL-3616): an AI\n  // build setting a store up from a brief, unpriced unless the brief priced it.\n  // The console runs AI jobs (AGL-3026).\n  registerProductDraftWriter()\n  // …and the operation an AI build plans for it, which that writer executes.\n  registerProductAiCapability()\n  // …and why a file somebody is SELLING may not be made public (AGL-3080).\n  // The media library asks before it hands an asset its permanent CDN URL\n  // back; what a product is, and which of its fields hold paid media, is\n  // this plugin's to know.\n  registerCommerceMediaPublishGuard()\n  // …and which memberships a site sells, for a security lockdown to pause\n  // (AGL-3364). The lockdown route runs on this surface.\n  registerCommerceRecurringCharges()\n  // …and the tax rule, for the webhook that confirms what they charged.\n  registerCommerceTaxProfile()\n  // …and its sales on the operator's own sales tax return (AGL-3080): the\n  // tax a storefront checkout collected under the platform's registrations.\n  // The staff return awaits this surface before it asks, and refuses to be\n  // filed without this source — commerce declares `taxReturnSource`.\n  registerTaxReturnSource(commerceTaxReturnSource, { pluginId: BUNDLE_ID })\n  // …and the take its orders earn the operator, on the staff revenue report\n  // (AGL-3080) — commerce declares `revenueSource`, so the report names this\n  // source as unread rather than counting it as zero if it is missing.\n  registerRevenueSource(commerceRevenueSource, { pluginId: BUNDLE_ID })\n  // Stripe webhook sections (AGL-418): orders/carts/drafts/reservations/\n  // subscriptions ride the platform webhook via the hook registry.\n  registerBillingWebhookHandler(commerceBillingWebhookHandler)\n  // Cancel + stock release in one transaction (AGL-1808). Server-side because\n  // the release depends on the transition rule, and a client write could not\n  // re-ask it under the same lock that flips the status.\n  registerPluginApiRoute('commerce/cancel-order', cancelOrderHandler)\n  // Whether live carrier rates can be offered on this site (AGL-3612).\n  registerPluginApiRoute('commerce/shipping/carrier-rates', carrierRatesAvailabilityHandler)\n  registerPluginApiRoute('commerce/connect', connectHandler)\n  registerPluginApiRoute('commerce/draft-order', draftOrderHandler)\n  // Fulfil + mark-delivered with the transition re-asked under the write\n  // (AGL-1819) — the same stale-dialog hole cancel-order closes, minus the\n  // stock release those two transitions never had. The customer REST API's\n  // `PATCH /v1/sites/{id}/orders/{id}` records a shipment through the same\n  // transaction (`server/api-v1/orders-and-products.ts`).\n  registerPluginApiRoute('commerce/fulfill-order', fulfillOrderHandler)\n  // \"Resend receipt\" from the order dialog (AGL-3610): by email, or by text\n  // when the platform's SMS provider is configured. Rate-limited per member\n  // and per order.\n  registerPluginApiRoute('commerce/order-receipt-send', orderReceiptSendHandler)\n  // Issue / void store credit (AGL-2226). Server-side because the host\n  // catch-all in the Firestore rules would otherwise let a client write\n  // its own `balanceCents`, which checkout applies as amount-off.\n  registerPluginApiRoute('commerce/gift-cards', giftCardsHandler)\n  // The merchant's own storefront sales tax, by who owes it (AGL-2440): the\n  // same rows and classifier the operator's return reads, fenced to one site.\n  registerPluginApiRoute('commerce/tax-summary', { web: taxSummaryHandler })\n  // The payment methods card (AGL-3629): toggles, the platform's offer, the\n  // payout account's capabilities and the site's wallet domains. Loaded with\n  // the first request, so a console that never opens Settings never imports it.\n  registerPluginApiRoute('commerce/payment-methods', {\n    web: async (request) =>\n      (await import('./server/payment-methods')).paymentMethodsHandler(request),\n  })\n  // A smart collection's rules changed or it was deleted: re-stamp which\n  // products it holds (AGL-3321), the membership the storefront queries.\n  registerPluginApiRoute('commerce/collection-membership', collectionMembershipHandler)\n  // A site member's password help (AGL-914) and removal (AGL-3308), from the\n  // Users page drawer and the Inbox. Console-auth, not the visitor cookie the\n  // storefront's `membership/*` routes take, so they are served where the\n  // console posts: the console's own dispatcher loads this surface only.\n  registerPluginApiRoute(\n    'membership/admin-password',\n    membershipAdminPasswordHandler,\n  )\n  registerPluginApiRoute('membership/admin-remove', membershipAdminRemoveHandler)\n  registerPluginApiRoute('commerce/member-post', memberPostHandler)\n  registerPluginApiRoute('commerce/pos-order', posOrderHandler)\n  // A register's cloud receipt printers and the jobs a manager sends them\n  // (AGL-3619), and the two doors the printers themselves poll. The doors are\n  // MACHINE routes: a printer is no member and names no site cookie, so it\n  // authenticates with the per-printer secret in its URL and its own device id,\n  // and the route asks the plan before it hands over a job. Loaded with the\n  // first poll, so a console that has no printers never imports them.\n  registerPluginApiRoute('commerce/printers', printersHandler)\n  registerPluginApiRoute(\n    'commerce/cloudprnt/:hostId/:printerId/:secret',\n    {\n      web: async (request, context) =>\n        (await import('./server/printer-poll')).cloudPrntRoute(request, context),\n    },\n    { machine: true },\n  )\n  registerPluginApiRoute(\n    'commerce/epson-sdp/:hostId/:printerId/:secret',\n    {\n      web: async (request, context) =>\n        (await import('./server/printer-poll')).epsonServerDirectPrintRoute(request, context),\n    },\n    { machine: true },\n  )\n  // The register's tenders against an open sale, its Stripe Terminal card\n  // readers, and the paired customer display (AGL-3607, AGL-3608). The\n  // display's `pair`/`poll`/`respond` take a display token and no console\n  // session; every other action is gated like a sale.\n  registerPluginApiRoute('commerce/pos-payment', posPaymentHandler)\n  registerPluginApiRoute('commerce/pos-readers', posReadersHandler)\n  registerPluginApiRoute('commerce/pos-display', posDisplayHandler)\n  // Shifts, staff PINs, the customer lookup and returns (AGL-3609).\n  registerPosOpsRoutes()\n  // The native Aglyn POS app's Stripe Terminal SDK: a connection token scoped\n  // to the site's Location, and the Location itself (AGL-3618). Gated like a\n  // sale.\n  registerPluginApiRoute('commerce/pos-terminal-connection-token', posTerminalConnectionTokenHandler)\n  registerPluginApiRoute('commerce/process-abandoned', processAbandonedHandler)\n  registerPluginApiRoute('commerce/process-restock', processRestockHandler)\n  registerPluginApiRoute('commerce/refund', refundHandler)\n  // Returns (AGL-3611): approve, decline, receive with restock, refund\n  // through the route above, a label from a shipping plugin.\n  registerPluginApiRoute('commerce/returns', returnsHandler)\n  // The merchant's outbound order webhooks (AGL-3611): endpoints, secrets,\n  // a test ping and a resend from the delivery log.\n  registerPluginApiRoute('commerce/order-webhooks', orderWebhooksHandler)\n  registerPluginApiRoute('commerce/supplier-update', supplierUpdateHandler)\n  // Stamps the open orders that predate the shipping fields, before an\n  // export for shipping (AGL-3613).\n  registerPluginApiRoute('commerce/orders-shipping-prepare', async (req, res) =>\n    (await import('./server/orders-shipping-prepare')).ordersShippingPrepareHandler(req, res),\n  )\n  // ShipStation's Custom Store endpoint (AGL-3613): ShipStation's servers\n  // pull the order feed and post shipments back with the site's own Basic\n  // credentials, so it is a MACHINE's route and asks the site's commerce,\n  // plan, release and lockdown gates itself once the credentials prove the\n  // site. Loaded on its first call, never with the console API surface.\n  registerPluginApiRoute(\n    'commerce/shipstation/:hostId',\n    {\n      web: async (request, context) =>\n        (await import('./server/shipstation')).shipStationRoute(request, context),\n    },\n    { machine: true },\n  )\n  // ShippingEasy's shipment callback (AGL-3633): ShippingEasy's servers post\n  // each label bought for an order this store sent them, signed with the\n  // merchant's own API secret, so it is a MACHINE's route like ShipStation's\n  // above and asks the same gates once the signature proves the site.\n  registerPluginApiRoute(\n    'commerce/shippingeasy/:hostId',\n    {\n      web: async (request, context) =>\n        (await import('./server/shippingeasy')).shippingEasyRoute(request, context),\n    },\n    { machine: true },\n  )\n  // The ShipStation and ShippingEasy cards' connect, show, new password,\n  // send open orders and disconnect.\n  registerPluginApiRoute('commerce/shipping-connectors', async (req, res) =>\n    (await import('./server/shipping-connectors')).shippingConnectorsHandler(req, res),\n  )\n  // The store's sales as figure tables (AGL-2915), for the AI plugin's\n  // insights to read by id rather than by reading orders. The console runs\n  // insight jobs, so the console surface registers them.\n  registerOrderFigureReaders(() => firebaseAdmin.app().firestore())\n}\n\n// Shared with the (still app-side) membership/account route.\nexport { mintDownloadToken } from './server/download'\n\n// Site-member session primitives, shared with the (still app-side)\n// membership/* routes until those migrate too (AGL-396).\nexport * from './server/membership'\n\n// Type-only (AGL-3080): the plugin's entitlement keys, declared by module\n// augmentation, for every program that loads this entry point.\nexport type { commercePlanEntitlements } from './plan-entitlements'\n"],"names":["registerBillingWebhookHandler","registerPluginApiRoute","registerPluginJob","registerSitePageEnricher","registerSitePageResolver","registerPluginPermissions","registerPluginConfigSchema","isEmailConfigured","firebaseAdmin","BUNDLE_ID","registerCommerceMediaPublishGuard","registerCommerceRecurringCharges","registerProductCardReader","registerProductAiCapability","registerProductDraftWriter","registerCommerceTaxProfile","registerTaxReturnSource","commerceTaxReturnSource","taxSummaryHandler","registerRevenueSource","commerceRevenueSource","commerceBillingWebhookHandler","registerOrderFigureReaders","COMMERCE_PERMISSIONS","COMMERCE_CONFIG_SCHEMA","commerceSitePageEnricher","commerceSitePageResolver","cartCheckoutHandler","cartHandler","cartExtrasHandler","catalogHandler","checkoutHandler","downloadHandler","newsletterHandler","notifyRestockHandler","productHandler","relatedHandler","reservationAvailabilityHandler","gateHandler","memberFeedHandler","membershipAccountHandler","membershipAdminPasswordHandler","membershipAdminRemoveHandler","membershipContentHandler","membershipLoginHandler","membershipLogoutHandler","membershipRecoverHandler","membershipRegisterHandler","membershipResetHandler","membershipWishlistHandler","reserveHandler","streamHandler","subscriptionPortalHandler","reviewsHandler","connectHandler","cancelOrderHandler","carrierRatesAvailabilityHandler","collectionMembershipHandler","draftOrderHandler","fulfillOrderHandler","orderReceiptSendHandler","orderStatusHandler","registerOrderStatusActions","returnRequestStatusAction","giftCardsHandler","memberPostHandler","orderAnalyticsHandler","checkoutStatusHandler","posOrderHandler","printersHandler","posPaymentHandler","posReadersHandler","posTerminalConnectionTokenHandler","posDisplayHandler","registerPosOpsRoutes","processAbandonedHandler","scanAbandonedCheckouts","processRestockHandler","scanRestockAlerts","scanStockDecrements","refundHandler","orderWebhooksHandler","returnRequestHandler","returnsHandler","scanSupplierDeliveries","supplierUpdateHandler","RECOVERY_JOB_INTERVAL_MINUTES","pluginId","name","intervalMinutes","description","lockdown","scope","handler","gate","sent","console","info","scan","missingLines","truncatedHosts","warn","hosts","reportedOrders","deadLettered","process","env","STRIPE_SECRET_KEY","reconcileCustomDomains","result","registered","failed","CARD_PAYMENT_DOOR","cardPayment","registerCommerceApi","web","request","legacyFeedRoute","recipientLink","registerCommerceConsoleApi","paymentMethodsHandler","context","cloudPrntRoute","machine","epsonServerDirectPrintRoute","req","res","ordersShippingPrepareHandler","shipStationRoute","shippingEasyRoute","shippingConnectorsHandler","app","firestore","mintDownloadToken"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD;;;;;;;CAOC,GAED,SACEA,6BAA6B,EAC7BC,sBAAsB,EACtBC,iBAAiB,EACjBC,wBAAwB,EACxBC,wBAAwB,EACxBC,yBAAyB,EACzBC,0BAA0B,QACrB,sBAAqB;AAC5B,SAASC,iBAAiB,QAAQ,2BAA0B;AAC5D,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,iCAAiC,QAAQ,kCAA8B;AAChF,SAASC,gCAAgC,QAAQ,gCAA4B;AAC7E,SAASC,yBAAyB,QAAQ,2BAAuB;AACjE,SAASC,2BAA2B,QAAQ,oCAAgC;AAC5E,SAASC,0BAA0B,QAAQ,6BAAyB;AACpE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SAASC,uBAAuB,QAAQ,wDAAuD;AAC/F,SAASC,uBAAuB,QAAQ,gCAA4B;AACpE,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,qBAAqB,QAAQ,qDAAoD;AAC1F,SAASC,qBAAqB,QAAQ,6BAAyB;AAC/D,SAASC,6BAA6B,QAAQ,8BAA0B;AACxE,SAASC,0BAA0B,QAAQ,4BAAwB;AACnE,SAASC,oBAAoB,QAAQ,gCAA4B;AACjE,SAASC,sBAAsB,QAAQ,qBAAiB;AACxD,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,iBAAiB,QAAQ,8BAA0B;AAC5D,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,8BAA8B,QAAQ,uCAAmC;AAClF,SAASC,WAAW,QAAQ,mBAAe;AAC3C,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,8BAA8B,QAAQ,wCAAoC;AACnF,SAASC,4BAA4B,QAAQ,sCAAkC;AAC/E,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,uBAAuB,QAAQ,gCAA4B;AACpE,SAASC,wBAAwB,QAAQ,iCAA6B;AACtE,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,yBAAyB,QAAQ,kCAA8B;AACxE,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,+BAA+B,QAAQ,yCAAqC;AACrF,SAASC,2BAA2B,QAAQ,oCAAgC;AAC5E,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,uBAAuB,QAAQ,iCAA6B;AACrE,SAASC,kBAAkB,EAAEC,0BAA0B,QAAQ,2BAAuB;AACtF,SAASC,yBAAyB,QAAQ,mCAA+B;AACzE,SAASC,gBAAgB,QAAQ,yBAAqB;AACtD,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,qBAAqB,QAAQ,8BAA0B;AAChE,SAASC,qBAAqB,QAAQ,8BAA0B;AAChE,SAASC,eAAe,QAAQ,wBAAoB;AACpD,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,iCAAiC,QAAQ,4CAAwC;AAC1F,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SACEC,uBAAuB,EACvBC,sBAAsB,QACjB,gCAA4B;AACnC,SAASC,qBAAqB,EAAEC,iBAAiB,QAAQ,8BAA0B;AACnF,SAASC,mBAAmB,QAAQ,8BAA0B;AAC9D,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,oBAAoB,EAAEC,cAAc,QAAQ,sBAAkB;AACvE,SAASC,sBAAsB,QAAQ,8BAA0B;AACjE,SAASC,qBAAqB,QAAQ,8BAA0B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,MAAMC,gCAAgC;AAEtCpF,kBAAkB;IAChBqF,UAAU9E;IACV+E,MAAM;IACNC,iBAAiBH;IACjBI,aACE;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,yEAAyE;QACzE,yEAAyE;QACzE,mBAAmB;QACnB,IAAI,CAACvF,qBAAqB;QAC1B,MAAM,EAAEwF,IAAI,EAAE,GAAG,MAAMnB,uBAAuBkB;QAC9C,IAAIC,MAAMC,QAAQC,IAAI,CAAC,CAAC,eAAe,EAAEF,KAAK,yBAAyB,CAAC;IAC1E;AACF;AAEA7F,kBAAkB;IAChBqF,UAAU9E;IACV+E,MAAM;IACNC,iBAAiBH;IACjBI,aAAa;IACbC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,IAAI,CAACvF,qBAAqB;QAC1B,MAAM,EAAEwF,IAAI,EAAE,GAAG,MAAMjB,kBAAkBgB;QACzC,IAAIC,MAAMC,QAAQC,IAAI,CAAC,CAAC,eAAe,EAAEF,KAAK,qBAAqB,CAAC;IACtE;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD7F,kBAAkB;IAChBqF,UAAU9E;IACV+E,MAAM;IACNC,iBAAiB;IACjBC,aACE;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,MAAMI,OAAO,MAAMnB,oBAAoBe;QACvC,IAAII,KAAKC,YAAY,IAAID,KAAKE,cAAc,EAAE;YAC5CJ,QAAQK,IAAI,CACV,CAAC,UAAU,EAAEH,KAAKC,YAAY,CAAC,oBAAoB,EAAED,KAAKI,KAAK,CAAC,CAAC,CAAC,GAChE,CAAC,+BAA+B,EAAEJ,KAAKK,cAAc,CAAC,OAAO,CAAC,GAC9D,CAAC,UAAU,EAAEL,KAAKE,cAAc,CAAC,gCAAgC,CAAC;QAExE;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACDlG,kBAAkB;IAChBqF,UAAU9E;IACV+E,MAAM;IACNC,iBAAiB;IACjBC,aACE,wEACA;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,MAAMI,OAAO,MAAMd,uBAAuBU;QAC1C,IAAII,KAAKM,YAAY,EAAE;YACrBR,QAAQK,IAAI,CACV,CAAC,UAAU,EAAEH,KAAKM,YAAY,CAAC,qCAAqC,CAAC,GACnE,CAAC,qDAAqD,CAAC;QAE7D;IACF;AACF;AAEA;;;;;;;;;CASC,GACDtG,kBAAkB;IAChBqF,UAAU9E;IACV+E,MAAM;IACNC,iBAAiB,KAAK;IACtBC,aACE,4EACA;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,IAAI,CAACW,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QACpC,MAAM,EAAEC,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC;QAChD,MAAMC,SAAS,MAAMD,uBAAuBd;QAC5C,IAAIe,OAAOC,UAAU,IAAID,OAAOE,MAAM,EAAE;YACtCf,QAAQC,IAAI,CACV,CAAC,mCAAmC,EAAEY,OAAOC,UAAU,CAAC,aAAa,CAAC,GACpE,GAAGD,OAAOE,MAAM,CAAC,eAAe,EAAEF,OAAOP,KAAK,CAAC,MAAM,CAAC;QAE5D;IACF;AACF;AAEA;;;;;CAKC,GACD,MAAMU,oBAAoB;IAAEC,aAAa;AAAK;AAE9C,2DAA2D,GAC3D,OAAO,SAASC;IACdtG;IACA,uEAAuE;IACvEG;IACAV,0BAA0BkB;IAC1B,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtEjB,2BAA2BkB;IAC3B,kEAAkE;IAClEpB,yBAAyBsB;IACzB,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtEvB,yBAAyBsB;IACzBxB,uBAAuB,0BAA0B0B,qBAAqBqF;IACtE/G,uBAAuB,iBAAiB2B;IACxC,+DAA+D;IAC/D3B,uBAAuB,wBAAwB4B;IAC/C5B,uBAAuB,oBAAoB6B;IAC3C7B,uBAAuB,qBAAqB8B,iBAAiBiF;IAC7D/G,uBAAuB,qBAAqB+B;IAC5C,qEAAqE;IACrE,sEAAsE;IACtE/B,uBAAuB,iBAAiB;QACtCkH,KAAK,OAAOC,UAAY,AAAC,CAAA,MAAM,MAAM,CAAC,0BAAsB,EAAGC,eAAe,CAACD;IACjF;IACAnH,uBAAuB,uBAAuBgC;IAC9ChC,uBAAuB,2BAA2BiC;IAClD,qEAAqE;IACrEjC,uBAAuB,4BAA4BiE;IACnD,2EAA2E;IAC3E,yEAAyE;IACzEjE,uBAAuB,yBAAyB4D,oBAAoB;QAAEyD,eAAe;IAAK;IAC1F,sEAAsE;IACtE,6BAA6B;IAC7BxD,2BAA2BC;IAC3B,qEAAqE;IACrE9D,uBAAuB,4BAA4BkE;IACnDlE,uBAAuB,oBAAoBkC;IAC3ClC,uBAAuB,oBAAoBmC;IAC3CnC,uBAAuB,qCAAqCoC;IAC5DpC,uBAAuB,oBAAoBiD,gBAAgB8D;IAC3D/G,uBAAuB,iBAAiBqC;IACxCrC,uBAAuB,wBAAwBsC;IAC/CtC,uBAAuB,mBAAmBkD;IAC1ClD,uBAAuB,gCAAgCmD;IACvDnD,uBAAuB,oBAAoBoD;IAC3C,wEAAwE;IACxE,qBAAqB;IACrBpD,uBAAuB,2BAA2BiF;IAClDjF,uBAAuB,sBAAsBuC;IAC7CvC,uBAAuB,sBAAsB0C;IAC7C1C,uBAAuB,oBAAoB2C;IAC3C3C,uBAAuB,qBAAqB4C;IAC5C,wDAAwD;IACxD5C,uBAAuB,sBAAsB6C;IAC7C7C,uBAAuB,uBAAuB8C;IAC9C9C,uBAAuB,oBAAoB+C;IAC3C/C,uBAAuB,uBAAuBgD;AAChD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASsE;IACd,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1ClH,0BAA0BkB;IAC1B,uEAAuE;IACvE,8EAA8E;IAC9EX;IACA,yEAAyE;IACzE,8EAA8E;IAC9E,uCAAuC;IACvCE;IACA,2EAA2E;IAC3ED;IACA,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,yBAAyB;IACzBH;IACA,wEAAwE;IACxE,uDAAuD;IACvDC;IACA,sEAAsE;IACtEI;IACA,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnEC,wBAAwBC,yBAAyB;QAAEsE,UAAU9E;IAAU;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrEU,sBAAsBC,uBAAuB;QAAEmE,UAAU9E;IAAU;IACnE,uEAAuE;IACvE,iEAAiE;IACjET,8BAA8BqB;IAC9B,4EAA4E;IAC5E,2EAA2E;IAC3E,uDAAuD;IACvDpB,uBAAuB,yBAAyBsD;IAChD,qEAAqE;IACrEtD,uBAAuB,mCAAmCuD;IAC1DvD,uBAAuB,oBAAoBqD;IAC3CrD,uBAAuB,wBAAwByD;IAC/C,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wDAAwD;IACxDzD,uBAAuB,0BAA0B0D;IACjD,0EAA0E;IAC1E,0EAA0E;IAC1E,iBAAiB;IACjB1D,uBAAuB,+BAA+B2D;IACtD,qEAAqE;IACrE,sEAAsE;IACtE,gEAAgE;IAChE3D,uBAAuB,uBAAuB+D;IAC9C,0EAA0E;IAC1E,4EAA4E;IAC5E/D,uBAAuB,wBAAwB;QAAEkH,KAAKjG;IAAkB;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9EjB,uBAAuB,4BAA4B;QACjDkH,KAAK,OAAOC,UACV,AAAC,CAAA,MAAM,MAAM,CAAC,8BAA0B,EAAGI,qBAAqB,CAACJ;IACrE;IACA,uEAAuE;IACvE,uEAAuE;IACvEnH,uBAAuB,kCAAkCwD;IACzD,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvExD,uBACE,6BACAwC;IAEFxC,uBAAuB,2BAA2ByC;IAClDzC,uBAAuB,wBAAwBgE;IAC/ChE,uBAAuB,sBAAsBmE;IAC7C,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,0EAA0E;IAC1E,oEAAoE;IACpEnE,uBAAuB,qBAAqBoE;IAC5CpE,uBACE,iDACA;QACEkH,KAAK,OAAOC,SAASK,UACnB,AAAC,CAAA,MAAM,MAAM,CAAC,2BAAuB,EAAGC,cAAc,CAACN,SAASK;IACpE,GACA;QAAEE,SAAS;IAAK;IAElB1H,uBACE,iDACA;QACEkH,KAAK,OAAOC,SAASK,UACnB,AAAC,CAAA,MAAM,MAAM,CAAC,2BAAuB,EAAGG,2BAA2B,CAACR,SAASK;IACjF,GACA;QAAEE,SAAS;IAAK;IAElB,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,oDAAoD;IACpD1H,uBAAuB,wBAAwBqE;IAC/CrE,uBAAuB,wBAAwBsE;IAC/CtE,uBAAuB,wBAAwBwE;IAC/C,kEAAkE;IAClEC;IACA,4EAA4E;IAC5E,2EAA2E;IAC3E,QAAQ;IACRzE,uBAAuB,0CAA0CuE;IACjEvE,uBAAuB,8BAA8B0E;IACrD1E,uBAAuB,4BAA4B4E;IACnD5E,uBAAuB,mBAAmB+E;IAC1C,qEAAqE;IACrE,2DAA2D;IAC3D/E,uBAAuB,oBAAoBkF;IAC3C,yEAAyE;IACzE,kDAAkD;IAClDlF,uBAAuB,2BAA2BgF;IAClDhF,uBAAuB,4BAA4BoF;IACnD,qEAAqE;IACrE,kCAAkC;IAClCpF,uBAAuB,oCAAoC,OAAO4H,KAAKC,MACrE,AAAC,CAAA,MAAM,MAAM,CAAC,sCAAkC,EAAGC,4BAA4B,CAACF,KAAKC;IAEvF,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE7H,uBACE,gCACA;QACEkH,KAAK,OAAOC,SAASK,UACnB,AAAC,CAAA,MAAM,MAAM,CAAC,0BAAsB,EAAGO,gBAAgB,CAACZ,SAASK;IACrE,GACA;QAAEE,SAAS;IAAK;IAElB,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,oEAAoE;IACpE1H,uBACE,iCACA;QACEkH,KAAK,OAAOC,SAASK,UACnB,AAAC,CAAA,MAAM,MAAM,CAAC,2BAAuB,EAAGQ,iBAAiB,CAACb,SAASK;IACvE,GACA;QAAEE,SAAS;IAAK;IAElB,uEAAuE;IACvE,mCAAmC;IACnC1H,uBAAuB,gCAAgC,OAAO4H,KAAKC,MACjE,AAAC,CAAA,MAAM,MAAM,CAAC,kCAA8B,EAAGI,yBAAyB,CAACL,KAAKC;IAEhF,qEAAqE;IACrE,yEAAyE;IACzE,uDAAuD;IACvDxG,2BAA2B,IAAMd,cAAc2H,GAAG,GAAGC,SAAS;AAChE;AAEA,6DAA6D;AAC7D,SAASC,iBAAiB,QAAQ,uBAAmB;AAErD,mEAAmE;AACnE,yDAAyD;AACzD,cAAc,yBAAqB"}

package/src/lib/site.js

@@ -24,11 +24,13 @@ import * as MemberRecovery from "./components/member-recovery.js";
 import * as MemberSignin from "./components/member-signin.js";
 import * as MemberSignup from "./components/member-signup.js";
 import * as NewsletterSignup from "./components/newsletter-signup.js";
+import * as OrderStatus from "./components/order-status.js";
 import * as ProductDetail from "./components/product-detail.js";
 import * as ReservationWidget from "./components/reservation-widget.js";
 import * as ProductGrid from "./components/product-grid.js";
 import * as ProductReviews from "./components/product-reviews.js";
 import * as RelatedProducts from "./components/related-products.js";
+import * as ReturnRequest from "./components/return-request.js";
 import * as Wishlist from "./components/wishlist.js";
 import { BUNDLE_ID } from "./constants/bundle-common.js";
 /**
@@ -113,6 +115,16 @@ import { BUNDLE_ID } from "./constants/bundle-common.js";
         component: RelatedProducts.default,
         schema: RelatedProducts.schema,
         presets: RelatedProducts.presets
+    },
+    {
+        component: OrderStatus.default,
+        schema: OrderStatus.schema,
+        presets: OrderStatus.presets
+    },
+    {
+        component: ReturnRequest.default,
+        schema: ReturnRequest.schema,
+        presets: ReturnRequest.presets
     }
 ];
 export function registerCommercePlugin() {

package/src/lib/site.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/commerce/src/lib/site.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiStorefrontOutline } from '@aglyn/shared-data-mdi'\nimport * as Account from './components/account'\nimport * as Cart from './components/cart'\nimport * as Gate from './components/gate'\nimport * as GatedVideo from './components/gated-video'\nimport * as MemberFeed from './components/member-feed'\nimport * as MemberRecovery from './components/member-recovery'\nimport * as MemberSignin from './components/member-signin'\nimport * as MemberSignup from './components/member-signup'\nimport * as NewsletterSignup from './components/newsletter-signup'\nimport * as ProductDetail from './components/product-detail'\nimport * as ReservationWidget from './components/reservation-widget'\nimport * as ProductGrid from './components/product-grid'\nimport * as ProductReviews from './components/product-reviews'\nimport * as RelatedProducts from './components/related-products'\nimport * as Wishlist from './components/wishlist'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/**\n * Commerce UI feature plugin (AGL-290): the storefront component set,\n * built on the feature-plugin pattern (AGL-277) — depends on the mui\n * bundle for primitives/theming and registers alongside it in the\n * besigner and the tenant renderer. Components join `COMMERCE_BUNDLE`\n * as they land (PLP AGL-291, PDP AGL-292, cart AGL-293, …); ids are\n * persisted in screen docs and never renamed.\n */\nexport const COMMERCE_BUNDLE: Aglyn.FeatureBundleEntry[] = [\n  {\n    component: ProductGrid.default,\n    schema: ProductGrid.schema,\n    presets: ProductGrid.presets,\n  },\n  {\n    component: ProductDetail.default,\n    schema: ProductDetail.schema,\n    presets: ProductDetail.presets,\n  },\n  {\n    component: Cart.default,\n    schema: Cart.schema,\n    presets: Cart.presets,\n  },\n  {\n    component: Account.default,\n    schema: Account.schema,\n    presets: Account.presets,\n  },\n  {\n    component: Wishlist.default,\n    schema: Wishlist.schema,\n    presets: Wishlist.presets,\n  },\n  {\n    component: NewsletterSignup.default,\n    schema: NewsletterSignup.schema,\n    presets: NewsletterSignup.presets,\n  },\n  {\n    component: Gate.default,\n    schema: Gate.schema,\n    presets: Gate.presets,\n  },\n  {\n    component: GatedVideo.default,\n    schema: GatedVideo.schema,\n    presets: GatedVideo.presets,\n  },\n  {\n    component: MemberFeed.default,\n    schema: MemberFeed.schema,\n    presets: MemberFeed.presets,\n  },\n  {\n    component: MemberRecovery.default,\n    schema: MemberRecovery.schema,\n    presets: MemberRecovery.presets,\n  },\n  {\n    component: MemberSignin.default,\n    schema: MemberSignin.schema,\n    presets: MemberSignin.presets,\n  },\n  {\n    component: MemberSignup.default,\n    schema: MemberSignup.schema,\n    presets: MemberSignup.presets,\n  },\n  {\n    component: ReservationWidget.default,\n    schema: ReservationWidget.schema,\n    presets: ReservationWidget.presets,\n  },\n  {\n    component: ProductReviews.default,\n    schema: ProductReviews.schema,\n    presets: ProductReviews.presets,\n  },\n  {\n    component: RelatedProducts.default,\n    schema: RelatedProducts.schema,\n    presets: RelatedProducts.presets,\n  },\n]\n\nexport function registerCommercePlugin(): void {\n  // The canvas half only. The console registers the console half through its\n  // own `console` surface, and a published page must never load console code\n  // (AGL-3116): this runs on every page that places one of these elements.\n  if (Aglyn.plugins.getDependency(BUNDLE_ID)) return\n  Aglyn.plugins.addDependency(\n    Aglyn.defineUiFeatureBundle(\n      {\n        bundleId: BUNDLE_ID,\n        displayName: 'Commerce',\n        description: 'Storefront blocks: product grids, detail, cart',\n        icon: { path: mdiStorefrontOutline.path },\n        components: COMMERCE_BUNDLE,\n      },\n      Aglyn.components,\n    ),\n  )\n}\n"],"names":["Aglyn","mdiStorefrontOutline","Account","Cart","Gate","GatedVideo","MemberFeed","MemberRecovery","MemberSignin","MemberSignup","NewsletterSignup","ProductDetail","ReservationWidget","ProductGrid","ProductReviews","RelatedProducts","Wishlist","BUNDLE_ID","COMMERCE_BUNDLE","component","default","schema","presets","registerCommercePlugin","plugins","getDependency","addDependency","defineUiFeatureBundle","bundleId","displayName","description","icon","path","components"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,oBAAoB,QAAQ,yBAAwB;AAC7D,YAAYC,aAAa,0BAAsB;AAC/C,YAAYC,UAAU,uBAAmB;AACzC,YAAYC,UAAU,uBAAmB;AACzC,YAAYC,gBAAgB,8BAA0B;AACtD,YAAYC,gBAAgB,8BAA0B;AACtD,YAAYC,oBAAoB,kCAA8B;AAC9D,YAAYC,kBAAkB,gCAA4B;AAC1D,YAAYC,kBAAkB,gCAA4B;AAC1D,YAAYC,sBAAsB,oCAAgC;AAClE,YAAYC,mBAAmB,iCAA6B;AAC5D,YAAYC,uBAAuB,qCAAiC;AACpE,YAAYC,iBAAiB,+BAA2B;AACxD,YAAYC,oBAAoB,kCAA8B;AAC9D,YAAYC,qBAAqB,mCAA+B;AAChE,YAAYC,cAAc,2BAAuB;AACjD,SAASC,SAAS,QAAQ,+BAA2B;AAErD;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAA8C;IACzD;QACEC,WAAWN,YAAYO,OAAO;QAC9BC,QAAQR,YAAYQ,MAAM;QAC1BC,SAAST,YAAYS,OAAO;IAC9B;IACA;QACEH,WAAWR,cAAcS,OAAO;QAChCC,QAAQV,cAAcU,MAAM;QAC5BC,SAASX,cAAcW,OAAO;IAChC;IACA;QACEH,WAAWhB,KAAKiB,OAAO;QACvBC,QAAQlB,KAAKkB,MAAM;QACnBC,SAASnB,KAAKmB,OAAO;IACvB;IACA;QACEH,WAAWjB,QAAQkB,OAAO;QAC1BC,QAAQnB,QAAQmB,MAAM;QACtBC,SAASpB,QAAQoB,OAAO;IAC1B;IACA;QACEH,WAAWH,SAASI,OAAO;QAC3BC,QAAQL,SAASK,MAAM;QACvBC,SAASN,SAASM,OAAO;IAC3B;IACA;QACEH,WAAWT,iBAAiBU,OAAO;QACnCC,QAAQX,iBAAiBW,MAAM;QAC/BC,SAASZ,iBAAiBY,OAAO;IACnC;IACA;QACEH,WAAWf,KAAKgB,OAAO;QACvBC,QAAQjB,KAAKiB,MAAM;QACnBC,SAASlB,KAAKkB,OAAO;IACvB;IACA;QACEH,WAAWd,WAAWe,OAAO;QAC7BC,QAAQhB,WAAWgB,MAAM;QACzBC,SAASjB,WAAWiB,OAAO;IAC7B;IACA;QACEH,WAAWb,WAAWc,OAAO;QAC7BC,QAAQf,WAAWe,MAAM;QACzBC,SAAShB,WAAWgB,OAAO;IAC7B;IACA;QACEH,WAAWZ,eAAea,OAAO;QACjCC,QAAQd,eAAec,MAAM;QAC7BC,SAASf,eAAee,OAAO;IACjC;IACA;QACEH,WAAWX,aAAaY,OAAO;QAC/BC,QAAQb,aAAaa,MAAM;QAC3BC,SAASd,aAAac,OAAO;IAC/B;IACA;QACEH,WAAWV,aAAaW,OAAO;QAC/BC,QAAQZ,aAAaY,MAAM;QAC3BC,SAASb,aAAaa,OAAO;IAC/B;IACA;QACEH,WAAWP,kBAAkBQ,OAAO;QACpCC,QAAQT,kBAAkBS,MAAM;QAChCC,SAASV,kBAAkBU,OAAO;IACpC;IACA;QACEH,WAAWL,eAAeM,OAAO;QACjCC,QAAQP,eAAeO,MAAM;QAC7BC,SAASR,eAAeQ,OAAO;IACjC;IACA;QACEH,WAAWJ,gBAAgBK,OAAO;QAClCC,QAAQN,gBAAgBM,MAAM;QAC9BC,SAASP,gBAAgBO,OAAO;IAClC;CACD,CAAA;AAED,OAAO,SAASC;IACd,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAIvB,MAAMwB,OAAO,CAACC,aAAa,CAACR,YAAY;IAC5CjB,MAAMwB,OAAO,CAACE,aAAa,CACzB1B,MAAM2B,qBAAqB,CACzB;QACEC,UAAUX;QACVY,aAAa;QACbC,aAAa;QACbC,MAAM;YAAEC,MAAM/B,qBAAqB+B,IAAI;QAAC;QACxCC,YAAYf;IACd,GACAlB,MAAMiC,UAAU;AAGtB"}
+{"version":3,"sources":["../../../../../../libs/plugins/commerce/src/lib/site.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiStorefrontOutline } from '@aglyn/shared-data-mdi'\nimport * as Account from './components/account'\nimport * as Cart from './components/cart'\nimport * as Gate from './components/gate'\nimport * as GatedVideo from './components/gated-video'\nimport * as MemberFeed from './components/member-feed'\nimport * as MemberRecovery from './components/member-recovery'\nimport * as MemberSignin from './components/member-signin'\nimport * as MemberSignup from './components/member-signup'\nimport * as NewsletterSignup from './components/newsletter-signup'\nimport * as OrderStatus from './components/order-status'\nimport * as ProductDetail from './components/product-detail'\nimport * as ReservationWidget from './components/reservation-widget'\nimport * as ProductGrid from './components/product-grid'\nimport * as ProductReviews from './components/product-reviews'\nimport * as RelatedProducts from './components/related-products'\nimport * as ReturnRequest from './components/return-request'\nimport * as Wishlist from './components/wishlist'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/**\n * Commerce UI feature plugin (AGL-290): the storefront component set,\n * built on the feature-plugin pattern (AGL-277) — depends on the mui\n * bundle for primitives/theming and registers alongside it in the\n * besigner and the tenant renderer. Components join `COMMERCE_BUNDLE`\n * as they land (PLP AGL-291, PDP AGL-292, cart AGL-293, …); ids are\n * persisted in screen docs and never renamed.\n */\nexport const COMMERCE_BUNDLE: Aglyn.FeatureBundleEntry[] = [\n  {\n    component: ProductGrid.default,\n    schema: ProductGrid.schema,\n    presets: ProductGrid.presets,\n  },\n  {\n    component: ProductDetail.default,\n    schema: ProductDetail.schema,\n    presets: ProductDetail.presets,\n  },\n  {\n    component: Cart.default,\n    schema: Cart.schema,\n    presets: Cart.presets,\n  },\n  {\n    component: Account.default,\n    schema: Account.schema,\n    presets: Account.presets,\n  },\n  {\n    component: Wishlist.default,\n    schema: Wishlist.schema,\n    presets: Wishlist.presets,\n  },\n  {\n    component: NewsletterSignup.default,\n    schema: NewsletterSignup.schema,\n    presets: NewsletterSignup.presets,\n  },\n  {\n    component: Gate.default,\n    schema: Gate.schema,\n    presets: Gate.presets,\n  },\n  {\n    component: GatedVideo.default,\n    schema: GatedVideo.schema,\n    presets: GatedVideo.presets,\n  },\n  {\n    component: MemberFeed.default,\n    schema: MemberFeed.schema,\n    presets: MemberFeed.presets,\n  },\n  {\n    component: MemberRecovery.default,\n    schema: MemberRecovery.schema,\n    presets: MemberRecovery.presets,\n  },\n  {\n    component: MemberSignin.default,\n    schema: MemberSignin.schema,\n    presets: MemberSignin.presets,\n  },\n  {\n    component: MemberSignup.default,\n    schema: MemberSignup.schema,\n    presets: MemberSignup.presets,\n  },\n  {\n    component: ReservationWidget.default,\n    schema: ReservationWidget.schema,\n    presets: ReservationWidget.presets,\n  },\n  {\n    component: ProductReviews.default,\n    schema: ProductReviews.schema,\n    presets: ProductReviews.presets,\n  },\n  {\n    component: RelatedProducts.default,\n    schema: RelatedProducts.schema,\n    presets: RelatedProducts.presets,\n  },\n  {\n    component: OrderStatus.default,\n    schema: OrderStatus.schema,\n    presets: OrderStatus.presets,\n  },\n  {\n    component: ReturnRequest.default,\n    schema: ReturnRequest.schema,\n    presets: ReturnRequest.presets,\n  },\n]\n\nexport function registerCommercePlugin(): void {\n  // The canvas half only. The console registers the console half through its\n  // own `console` surface, and a published page must never load console code\n  // (AGL-3116): this runs on every page that places one of these elements.\n  if (Aglyn.plugins.getDependency(BUNDLE_ID)) return\n  Aglyn.plugins.addDependency(\n    Aglyn.defineUiFeatureBundle(\n      {\n        bundleId: BUNDLE_ID,\n        displayName: 'Commerce',\n        description: 'Storefront blocks: product grids, detail, cart',\n        icon: { path: mdiStorefrontOutline.path },\n        components: COMMERCE_BUNDLE,\n      },\n      Aglyn.components,\n    ),\n  )\n}\n"],"names":["Aglyn","mdiStorefrontOutline","Account","Cart","Gate","GatedVideo","MemberFeed","MemberRecovery","MemberSignin","MemberSignup","NewsletterSignup","OrderStatus","ProductDetail","ReservationWidget","ProductGrid","ProductReviews","RelatedProducts","ReturnRequest","Wishlist","BUNDLE_ID","COMMERCE_BUNDLE","component","default","schema","presets","registerCommercePlugin","plugins","getDependency","addDependency","defineUiFeatureBundle","bundleId","displayName","description","icon","path","components"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,oBAAoB,QAAQ,yBAAwB;AAC7D,YAAYC,aAAa,0BAAsB;AAC/C,YAAYC,UAAU,uBAAmB;AACzC,YAAYC,UAAU,uBAAmB;AACzC,YAAYC,gBAAgB,8BAA0B;AACtD,YAAYC,gBAAgB,8BAA0B;AACtD,YAAYC,oBAAoB,kCAA8B;AAC9D,YAAYC,kBAAkB,gCAA4B;AAC1D,YAAYC,kBAAkB,gCAA4B;AAC1D,YAAYC,sBAAsB,oCAAgC;AAClE,YAAYC,iBAAiB,+BAA2B;AACxD,YAAYC,mBAAmB,iCAA6B;AAC5D,YAAYC,uBAAuB,qCAAiC;AACpE,YAAYC,iBAAiB,+BAA2B;AACxD,YAAYC,oBAAoB,kCAA8B;AAC9D,YAAYC,qBAAqB,mCAA+B;AAChE,YAAYC,mBAAmB,iCAA6B;AAC5D,YAAYC,cAAc,2BAAuB;AACjD,SAASC,SAAS,QAAQ,+BAA2B;AAErD;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAA8C;IACzD;QACEC,WAAWP,YAAYQ,OAAO;QAC9BC,QAAQT,YAAYS,MAAM;QAC1BC,SAASV,YAAYU,OAAO;IAC9B;IACA;QACEH,WAAWT,cAAcU,OAAO;QAChCC,QAAQX,cAAcW,MAAM;QAC5BC,SAASZ,cAAcY,OAAO;IAChC;IACA;QACEH,WAAWlB,KAAKmB,OAAO;QACvBC,QAAQpB,KAAKoB,MAAM;QACnBC,SAASrB,KAAKqB,OAAO;IACvB;IACA;QACEH,WAAWnB,QAAQoB,OAAO;QAC1BC,QAAQrB,QAAQqB,MAAM;QACtBC,SAAStB,QAAQsB,OAAO;IAC1B;IACA;QACEH,WAAWH,SAASI,OAAO;QAC3BC,QAAQL,SAASK,MAAM;QACvBC,SAASN,SAASM,OAAO;IAC3B;IACA;QACEH,WAAWX,iBAAiBY,OAAO;QACnCC,QAAQb,iBAAiBa,MAAM;QAC/BC,SAASd,iBAAiBc,OAAO;IACnC;IACA;QACEH,WAAWjB,KAAKkB,OAAO;QACvBC,QAAQnB,KAAKmB,MAAM;QACnBC,SAASpB,KAAKoB,OAAO;IACvB;IACA;QACEH,WAAWhB,WAAWiB,OAAO;QAC7BC,QAAQlB,WAAWkB,MAAM;QACzBC,SAASnB,WAAWmB,OAAO;IAC7B;IACA;QACEH,WAAWf,WAAWgB,OAAO;QAC7BC,QAAQjB,WAAWiB,MAAM;QACzBC,SAASlB,WAAWkB,OAAO;IAC7B;IACA;QACEH,WAAWd,eAAee,OAAO;QACjCC,QAAQhB,eAAegB,MAAM;QAC7BC,SAASjB,eAAeiB,OAAO;IACjC;IACA;QACEH,WAAWb,aAAac,OAAO;QAC/BC,QAAQf,aAAae,MAAM;QAC3BC,SAAShB,aAAagB,OAAO;IAC/B;IACA;QACEH,WAAWZ,aAAaa,OAAO;QAC/BC,QAAQd,aAAac,MAAM;QAC3BC,SAASf,aAAae,OAAO;IAC/B;IACA;QACEH,WAAWR,kBAAkBS,OAAO;QACpCC,QAAQV,kBAAkBU,MAAM;QAChCC,SAASX,kBAAkBW,OAAO;IACpC;IACA;QACEH,WAAWN,eAAeO,OAAO;QACjCC,QAAQR,eAAeQ,MAAM;QAC7BC,SAAST,eAAeS,OAAO;IACjC;IACA;QACEH,WAAWL,gBAAgBM,OAAO;QAClCC,QAAQP,gBAAgBO,MAAM;QAC9BC,SAASR,gBAAgBQ,OAAO;IAClC;IACA;QACEH,WAAWV,YAAYW,OAAO;QAC9BC,QAAQZ,YAAYY,MAAM;QAC1BC,SAASb,YAAYa,OAAO;IAC9B;IACA;QACEH,WAAWJ,cAAcK,OAAO;QAChCC,QAAQN,cAAcM,MAAM;QAC5BC,SAASP,cAAcO,OAAO;IAChC;CACD,CAAA;AAED,OAAO,SAASC;IACd,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAIzB,MAAM0B,OAAO,CAACC,aAAa,CAACR,YAAY;IAC5CnB,MAAM0B,OAAO,CAACE,aAAa,CACzB5B,MAAM6B,qBAAqB,CACzB;QACEC,UAAUX;QACVY,aAAa;QACbC,aAAa;QACbC,MAAM;YAAEC,MAAMjC,qBAAqBiC,IAAI;QAAC;QACxCC,YAAYf;IACd,GACApB,MAAMmC,UAAU;AAGtB"}

package/src/lib/subprocessors.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginSubprocessorsAnswer } from '@aglyn/aglyn/plugin-manager/plugin-subprocessors';
+/**
+ * Hosts commerce's code names that are no recipient of anything (AGL-3610):
+ * the carriers' public tracking pages, which `model/tracking-url.ts` turns a
+ * tracking number into a link to. No server here requests them — the link is
+ * printed in a buyer email and on the order status page, and only the buyer's
+ * own browser opens it, when they click. The Epson ePOS-Print namespace is
+ * the same: an identifier inside the XML a receipt printer is handed.
+ */
+export declare function commerceSubprocessors(): PluginSubprocessorsAnswer;

package/src/lib/subprocessors.js

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { SHIPPINGEASY_DEFAULT_BASE_URL } from "./model/shippingeasy.js";
+import { TRACKING_CARRIERS } from "./model/tracking-url.js";
+import { EPOS_PRINT_NAMESPACE } from "./printing/render-epson.js";
+/**
+ * Hosts commerce's code names that are no recipient of anything (AGL-3610):
+ * the carriers' public tracking pages, which `model/tracking-url.ts` turns a
+ * tracking number into a link to. No server here requests them — the link is
+ * printed in a buyer email and on the order status page, and only the buyer's
+ * own browser opens it, when they click. The Epson ePOS-Print namespace is
+ * the same: an identifier inside the XML a receipt printer is handed.
+ */ export function commerceSubprocessors() {
+    const hosts = TRACKING_CARRIERS.map((carrier)=>({
+            host: new URL(carrier.url('TRACKING')).host,
+            disposition: 'no-request',
+            reason: `${carrier.label}'s public tracking page. Commerce builds a link to it from a ` + 'shipment’s carrier and tracking number (`libs/plugins/commerce/src/lib/model/tracking-url.ts`) ' + 'and prints it in the buyer’s shipping email and order status page; no platform server ever requests it.',
+            dataReceived: 'Nothing from the platform. When the buyer clicks the link, their own browser sends the carrier the tracking number in the URL; no customer record, email or order detail goes with it.'
+        }));
+    hosts.push({
+        host: new URL(EPOS_PRINT_NAMESPACE).host,
+        disposition: 'no-request',
+        reason: 'The ePOS-Print XML namespace (`libs/plugins/commerce/src/lib/printing/render-epson.ts`) on the print job an Epson receipt printer receives when it polls. A namespace is an identifier that happens to look like a URL; neither the platform nor the printer requests it.',
+        dataReceived: 'Nothing. No request is made.'
+    });
+    hosts.push({
+        host: new URL(SHIPPINGEASY_DEFAULT_BASE_URL).host,
+        disposition: 'not-a-subprocessor',
+        reason: 'ShippingEasy’s order API (`libs/plugins/commerce/src/lib/server/shippingeasy.ts`, AGL-3633). A site admin ' + 'connects their OWN ShippingEasy account with its API key, secret and store key, and commerce sends that ' + 'site’s paid orders into it and cancels canceled ones there. The customer chose and contracts with ' + 'ShippingEasy; the platform sends nothing to it for a site that has not connected it.',
+        dataReceived: 'For a connected site only: each shippable order’s number, date, totals, ship-to and billing name, ' + 'address, email and phone, and its items (name, SKU, quantity, price, weight, options), signed with the ' + 'merchant’s own API key. Nothing from any other site or account.'
+    });
+    return {
+        hosts
+    };
+}
+
+//# sourceMappingURL=subprocessors.js.map

package/src/lib/subprocessors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/commerce/src/lib/subprocessors.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  PluginEgressHostDeclaration,\n  PluginSubprocessorsAnswer,\n} from '@aglyn/aglyn/plugin-manager/plugin-subprocessors'\nimport { SHIPPINGEASY_DEFAULT_BASE_URL } from './model/shippingeasy'\nimport { TRACKING_CARRIERS } from './model/tracking-url'\nimport { EPOS_PRINT_NAMESPACE } from './printing/render-epson'\n\n/**\n * Hosts commerce's code names that are no recipient of anything (AGL-3610):\n * the carriers' public tracking pages, which `model/tracking-url.ts` turns a\n * tracking number into a link to. No server here requests them — the link is\n * printed in a buyer email and on the order status page, and only the buyer's\n * own browser opens it, when they click. The Epson ePOS-Print namespace is\n * the same: an identifier inside the XML a receipt printer is handed.\n */\nexport function commerceSubprocessors(): PluginSubprocessorsAnswer {\n  const hosts: PluginEgressHostDeclaration[] = TRACKING_CARRIERS.map(\n    (carrier) => ({\n      host: new URL(carrier.url('TRACKING')).host,\n      disposition: 'no-request',\n      reason:\n        `${carrier.label}'s public tracking page. Commerce builds a link to it from a ` +\n        'shipment’s carrier and tracking number (`libs/plugins/commerce/src/lib/model/tracking-url.ts`) ' +\n        'and prints it in the buyer’s shipping email and order status page; no platform server ever requests it.',\n      dataReceived:\n        'Nothing from the platform. When the buyer clicks the link, their own browser sends the carrier the tracking number in the URL; no customer record, email or order detail goes with it.',\n    }),\n  )\n  hosts.push({\n    host: new URL(EPOS_PRINT_NAMESPACE).host,\n    disposition: 'no-request',\n    reason:\n      'The ePOS-Print XML namespace (`libs/plugins/commerce/src/lib/printing/render-epson.ts`) on the print job an Epson receipt printer receives when it polls. A namespace is an identifier that happens to look like a URL; neither the platform nor the printer requests it.',\n    dataReceived: 'Nothing. No request is made.',\n  })\n  hosts.push({\n    host: new URL(SHIPPINGEASY_DEFAULT_BASE_URL).host,\n    disposition: 'not-a-subprocessor',\n    reason:\n      'ShippingEasy’s order API (`libs/plugins/commerce/src/lib/server/shippingeasy.ts`, AGL-3633). A site admin ' +\n      'connects their OWN ShippingEasy account with its API key, secret and store key, and commerce sends that ' +\n      'site’s paid orders into it and cancels canceled ones there. The customer chose and contracts with ' +\n      'ShippingEasy; the platform sends nothing to it for a site that has not connected it.',\n    dataReceived:\n      'For a connected site only: each shippable order’s number, date, totals, ship-to and billing name, ' +\n      'address, email and phone, and its items (name, SKU, quantity, price, weight, options), signed with the ' +\n      'merchant’s own API key. Nothing from any other site or account.',\n  })\n  return { hosts }\n}\n"],"names":["SHIPPINGEASY_DEFAULT_BASE_URL","TRACKING_CARRIERS","EPOS_PRINT_NAMESPACE","commerceSubprocessors","hosts","map","carrier","host","URL","url","disposition","reason","label","dataReceived","push"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAMD,SAASA,6BAA6B,QAAQ,0BAAsB;AACpE,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,oBAAoB,QAAQ,6BAAyB;AAE9D;;;;;;;CAOC,GACD,OAAO,SAASC;IACd,MAAMC,QAAuCH,kBAAkBI,GAAG,CAChE,CAACC,UAAa,CAAA;YACZC,MAAM,IAAIC,IAAIF,QAAQG,GAAG,CAAC,aAAaF,IAAI;YAC3CG,aAAa;YACbC,QACE,GAAGL,QAAQM,KAAK,CAAC,6DAA6D,CAAC,GAC/E,oGACA;YACFC,cACE;QACJ,CAAA;IAEFT,MAAMU,IAAI,CAAC;QACTP,MAAM,IAAIC,IAAIN,sBAAsBK,IAAI;QACxCG,aAAa;QACbC,QACE;QACFE,cAAc;IAChB;IACAT,MAAMU,IAAI,CAAC;QACTP,MAAM,IAAIC,IAAIR,+BAA+BO,IAAI;QACjDG,aAAa;QACbC,QACE,+GACA,6GACA,uGACA;QACFE,cACE,uGACA,4GACA;IACJ;IACA,OAAO;QAAET;IAAM;AACjB"}