@aglyn/plugins-commerce 1.0.0-beta.230 → 1.0.0-beta.231

package/src/lib/server/checkout-extras.js

@@ -0,0 +1,157 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { hasPluginCheckoutExtras, quotePluginCheckoutExtras } from "@aglyn/aglyn/plugin-manager/plugin-checkout-extras";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { isDocumentId } from "@aglyn/tenant-data-admin/server/document-id";
+import * as CommerceModel from "../model/index.js";
+import { readCartId } from "./cart-cookie.js";
+/**
+ * Optional lines another plugin offers at the cart (AGL-3635) — package
+ * protection is the first — through core's checkout-extras seam. Commerce
+ * names no insurer: it asks the seam, shows each offer as a box, and charges
+ * the ones the buyer ticked as ordinary lines on the session.
+ *
+ * Asked only for a basket that ships: an extra is about a parcel, and a cart
+ * of downloads has none.
+ */ /** How long the cart and checkout wait for an offer before selling without it. */ export const CHECKOUT_EXTRAS_TIMEOUT_MS = 2500;
+/** Every offer for a basket, or none. Never throws. */ export async function quoteCartExtras(input) {
+    var _ref, _ref1;
+    var _input_destination, _input_destination1;
+    if (!hasPluginCheckoutExtras()) return [];
+    const lines = input.lines.filter((line)=>line.quantity > 0 && line.unitCents >= 0);
+    if (!lines.some((line)=>line.physical)) return [];
+    const itemsCents = lines.reduce((sum, line)=>sum + line.unitCents * line.quantity, 0);
+    if (itemsCents <= 0) return [];
+    const country = String((_ref = (_input_destination = input.destination) == null ? void 0 : _input_destination.country) != null ? _ref : '').trim().toUpperCase().slice(0, 2);
+    const postalCode = String((_ref1 = (_input_destination1 = input.destination) == null ? void 0 : _input_destination1.postalCode) != null ? _ref1 : '').trim().slice(0, 12);
+    return quotePluginCheckoutExtras(_extends({
+        hostId: input.hostId,
+        // Every storefront session is charged in dollars today (`cart-checkout.ts`).
+        currency: 'usd',
+        itemsCents,
+        lines: lines.map((line)=>_extends({
+                itemId: line.productId,
+                name: line.name
+            }, line.sku ? {
+                sku: line.sku
+            } : {}, {
+                quantity: line.quantity,
+                unitCents: line.unitCents,
+                ships: line.physical
+            }))
+    }, country || postalCode ? {
+        destination: _extends({}, country ? {
+            country
+        } : {}, postalCode ? {
+            postalCode
+        } : {})
+    } : {}), {
+        timeoutMs: CHECKOUT_EXTRAS_TIMEOUT_MS
+    });
+}
+export function cartExtraView(extra) {
+    return _extends({
+        id: extra.id,
+        label: extra.label
+    }, extra.description ? {
+        description: extra.description
+    } : {}, {
+        amountCents: extra.amountCents,
+        defaultSelected: extra.defaultSelected
+    }, extra.termsUrl ? {
+        termsUrl: extra.termsUrl
+    } : {});
+}
+/**
+ * `GET /api/commerce/cart-extras?hostId=…` — the offers for the visitor's own
+ * cart (cookie). Asked by the cart when it is SHOWN, never by the badge on
+ * every page. A store with no offering plugin answers `[]` without reading a
+ * document. `private, no-store`: the answer is this basket's.
+ */ export const cartExtrasHandler = async (req, res)=>{
+    var _req_query_hostId;
+    res.setHeader('Cache-Control', 'private, no-store');
+    if (req.method !== 'GET') return res.status(405).json({
+        error: 'Method not allowed'
+    });
+    const hostId = String((_req_query_hostId = req.query.hostId) != null ? _req_query_hostId : '');
+    if (!isDocumentId(hostId)) return res.status(400).json({
+        error: 'Missing or invalid hostId'
+    });
+    if (!hasPluginCheckoutExtras()) return res.status(200).json({
+        extras: []
+    });
+    const cartId = readCartId(req.cookies, hostId);
+    if (!cartId) return res.status(200).json({
+        extras: []
+    });
+    try {
+        var _data, _cart_lines, _req_query_country, _req_query_postalCode;
+        const hostRef = firebaseAdmin.app().firestore().collection('hosts').doc(hostId);
+        const cart = (_data = (await hostRef.collection('carts').doc(cartId).get()).data()) != null ? _data : {
+            lines: []
+        };
+        const lines = await resolveCartExtrasLines(hostRef, (_cart_lines = cart.lines) != null ? _cart_lines : []);
+        const extras = await quoteCartExtras({
+            hostId,
+            lines,
+            destination: {
+                country: String((_req_query_country = req.query.country) != null ? _req_query_country : ''),
+                postalCode: String((_req_query_postalCode = req.query.postalCode) != null ? _req_query_postalCode : '')
+            }
+        });
+        return res.status(200).json({
+            extras: extras.map(cartExtraView)
+        });
+    } catch (error) {
+        console.error('cart extras failed', error);
+        // An offer is never worth a broken cart.
+        return res.status(200).json({
+            extras: []
+        });
+    }
+};
+/** The cart's purchasable lines, priced from the product documents. */ async function resolveCartExtrasLines(hostRef, cartLines) {
+    const ids = [
+        ...new Set(cartLines.map((line)=>line.productId))
+    ].filter((id)=>isDocumentId(id));
+    const snapshots = await Promise.all(ids.map((id)=>hostRef.collection('products').doc(id).get()));
+    const products = new Map(snapshots.map((snapshot)=>[
+            snapshot.id,
+            snapshot.exists ? CommerceModel.liftLegacyProduct(snapshot.data()) : null
+        ]));
+    const lines = [];
+    for (const line of cartLines){
+        var _product_type;
+        const product = products.get(line.productId);
+        if (!product || product.deletedAt || product.status !== 'active') continue;
+        const variant = line.variantId ? product.variants.find((item)=>item.id === line.variantId) : product.variants[0];
+        if (!variant || !CommerceModel.variantHasPrice(variant)) continue;
+        lines.push(_extends({
+            productId: line.productId,
+            name: product.name
+        }, variant.sku ? {
+            sku: variant.sku
+        } : {}, {
+            quantity: Math.max(0, Math.round(Number(line.quantity) || 0)),
+            unitCents: Math.round(Number(variant.priceUsd) * 100),
+            physical: ((_product_type = product.type) != null ? _product_type : 'physical') === 'physical'
+        }));
+    }
+    return lines;
+}
+
+//# sourceMappingURL=checkout-extras.js.map

package/src/lib/server/checkout-extras.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/checkout-extras.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport {\n  hasPluginCheckoutExtras,\n  quotePluginCheckoutExtras,\n  type QuotedPluginCheckoutExtra,\n} from '@aglyn/aglyn/plugin-manager/plugin-checkout-extras'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { isDocumentId } from '@aglyn/tenant-data-admin/server/document-id'\nimport * as CommerceModel from '../model'\nimport { readCartId } from './cart-cookie'\n\n/**\n * Optional lines another plugin offers at the cart (AGL-3635) — package\n * protection is the first — through core's checkout-extras seam. Commerce\n * names no insurer: it asks the seam, shows each offer as a box, and charges\n * the ones the buyer ticked as ordinary lines on the session.\n *\n * Asked only for a basket that ships: an extra is about a parcel, and a cart\n * of downloads has none.\n */\n\n/** How long the cart and checkout wait for an offer before selling without it. */\nexport const CHECKOUT_EXTRAS_TIMEOUT_MS = 2_500\n\n/** One cart line, priced, as the extras quote reads it. */\nexport interface CheckoutExtrasLine {\n  productId: string\n  name: string\n  sku?: string\n  quantity: number\n  unitCents: number\n  physical: boolean\n}\n\n/** Every offer for a basket, or none. Never throws. */\nexport async function quoteCartExtras(input: {\n  hostId: string\n  lines: CheckoutExtrasLine[]\n  destination?: { country?: string; postalCode?: string }\n}): Promise<QuotedPluginCheckoutExtra[]> {\n  if (!hasPluginCheckoutExtras()) return []\n  const lines = input.lines.filter((line) => line.quantity > 0 && line.unitCents >= 0)\n  if (!lines.some((line) => line.physical)) return []\n  const itemsCents = lines.reduce((sum, line) => sum + line.unitCents * line.quantity, 0)\n  if (itemsCents <= 0) return []\n  const country = String(input.destination?.country ?? '').trim().toUpperCase().slice(0, 2)\n  const postalCode = String(input.destination?.postalCode ?? '').trim().slice(0, 12)\n  return quotePluginCheckoutExtras(\n    {\n      hostId: input.hostId,\n      // Every storefront session is charged in dollars today (`cart-checkout.ts`).\n      currency: 'usd',\n      itemsCents,\n      lines: lines.map((line) => ({\n        itemId: line.productId,\n        name: line.name,\n        ...(line.sku ? { sku: line.sku } : {}),\n        quantity: line.quantity,\n        unitCents: line.unitCents,\n        ships: line.physical,\n      })),\n      ...(country || postalCode\n        ? { destination: { ...(country ? { country } : {}), ...(postalCode ? { postalCode } : {}) } }\n        : {}),\n    },\n    { timeoutMs: CHECKOUT_EXTRAS_TIMEOUT_MS },\n  )\n}\n\n/** What the cart shows of an offer: never the quote id. */\nexport interface CartExtraView {\n  id: string\n  label: string\n  description?: string\n  amountCents: number\n  defaultSelected: boolean\n  termsUrl?: string\n}\n\nexport function cartExtraView(extra: QuotedPluginCheckoutExtra): CartExtraView {\n  return {\n    id: extra.id,\n    label: extra.label,\n    ...(extra.description ? { description: extra.description } : {}),\n    amountCents: extra.amountCents,\n    defaultSelected: extra.defaultSelected,\n    ...(extra.termsUrl ? { termsUrl: extra.termsUrl } : {}),\n  }\n}\n\n/**\n * `GET /api/commerce/cart-extras?hostId=…` — the offers for the visitor's own\n * cart (cookie). Asked by the cart when it is SHOWN, never by the badge on\n * every page. A store with no offering plugin answers `[]` without reading a\n * document. `private, no-store`: the answer is this basket's.\n */\nexport const cartExtrasHandler: PluginApiHandler = async (req, res) => {\n  res.setHeader('Cache-Control', 'private, no-store')\n  if (req.method !== 'GET') return res.status(405).json({ error: 'Method not allowed' })\n  const hostId = String(req.query.hostId ?? '')\n  if (!isDocumentId(hostId)) return res.status(400).json({ error: 'Missing or invalid hostId' })\n  if (!hasPluginCheckoutExtras()) return res.status(200).json({ extras: [] })\n  const cartId = readCartId(req.cookies, hostId)\n  if (!cartId) return res.status(200).json({ extras: [] })\n  try {\n    const hostRef = firebaseAdmin.app().firestore().collection('hosts').doc(hostId)\n    const cart = ((await hostRef.collection('carts').doc(cartId).get()).data() as CommerceModel.HostCart | undefined) ?? {\n      lines: [],\n    }\n    const lines = await resolveCartExtrasLines(hostRef, cart.lines ?? [])\n    const extras = await quoteCartExtras({\n      hostId,\n      lines,\n      destination: {\n        country: String(req.query.country ?? ''),\n        postalCode: String(req.query.postalCode ?? ''),\n      },\n    })\n    return res.status(200).json({ extras: extras.map(cartExtraView) })\n  } catch (error) {\n    console.error('cart extras failed', error)\n    // An offer is never worth a broken cart.\n    return res.status(200).json({ extras: [] })\n  }\n}\n\n/** The cart's purchasable lines, priced from the product documents. */\nasync function resolveCartExtrasLines(\n  hostRef: FirebaseFirestore.DocumentReference,\n  cartLines: CommerceModel.CartLine[],\n): Promise<CheckoutExtrasLine[]> {\n  const ids = [...new Set(cartLines.map((line) => line.productId))].filter((id) => isDocumentId(id))\n  const snapshots = await Promise.all(ids.map((id) => hostRef.collection('products').doc(id).get()))\n  const products = new Map(\n    snapshots.map((snapshot) => [\n      snapshot.id,\n      snapshot.exists ? CommerceModel.liftLegacyProduct(snapshot.data() as never) : null,\n    ]),\n  )\n  const lines: CheckoutExtrasLine[] = []\n  for (const line of cartLines) {\n    const product = products.get(line.productId)\n    if (!product || product.deletedAt || product.status !== 'active') continue\n    const variant = line.variantId\n      ? product.variants.find((item) => item.id === line.variantId)\n      : product.variants[0]\n    if (!variant || !CommerceModel.variantHasPrice(variant)) continue\n    lines.push({\n      productId: line.productId,\n      name: product.name,\n      ...(variant.sku ? { sku: variant.sku } : {}),\n      quantity: Math.max(0, Math.round(Number(line.quantity) || 0)),\n      unitCents: Math.round(Number(variant.priceUsd) * 100),\n      physical: (product.type ?? 'physical') === 'physical',\n    })\n  }\n  return lines\n}\n"],"names":["hasPluginCheckoutExtras","quotePluginCheckoutExtras","firebaseAdmin","isDocumentId","CommerceModel","readCartId","CHECKOUT_EXTRAS_TIMEOUT_MS","quoteCartExtras","input","lines","filter","line","quantity","unitCents","some","physical","itemsCents","reduce","sum","country","String","destination","trim","toUpperCase","slice","postalCode","hostId","currency","map","itemId","productId","name","sku","ships","timeoutMs","cartExtraView","extra","id","label","description","amountCents","defaultSelected","termsUrl","cartExtrasHandler","req","res","setHeader","method","status","json","error","query","extras","cartId","cookies","cart","hostRef","app","firestore","collection","doc","get","data","resolveCartExtrasLines","console","cartLines","ids","Set","snapshots","Promise","all","products","Map","snapshot","exists","liftLegacyProduct","product","deletedAt","variant","variantId","variants","find","item","variantHasPrice","push","Math","max","round","Number","priceUsd","type"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,uBAAuB,EACvBC,yBAAyB,QAEpB,qDAAoD;AAC3D,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,YAAY,QAAQ,8CAA6C;AAC1E,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,UAAU,QAAQ,mBAAe;AAE1C;;;;;;;;CAQC,GAED,gFAAgF,GAChF,OAAO,MAAMC,6BAA6B,KAAK;AAY/C,qDAAqD,GACrD,OAAO,eAAeC,gBAAgBC,KAIrC;;QAMwBA,oBACGA;IAN1B,IAAI,CAACR,2BAA2B,OAAO,EAAE;IACzC,MAAMS,QAAQD,MAAMC,KAAK,CAACC,MAAM,CAAC,CAACC,OAASA,KAAKC,QAAQ,GAAG,KAAKD,KAAKE,SAAS,IAAI;IAClF,IAAI,CAACJ,MAAMK,IAAI,CAAC,CAACH,OAASA,KAAKI,QAAQ,GAAG,OAAO,EAAE;IACnD,MAAMC,aAAaP,MAAMQ,MAAM,CAAC,CAACC,KAAKP,OAASO,MAAMP,KAAKE,SAAS,GAAGF,KAAKC,QAAQ,EAAE;IACrF,IAAII,cAAc,GAAG,OAAO,EAAE;IAC9B,MAAMG,UAAUC,gBAAOZ,qBAAAA,MAAMa,WAAW,qBAAjBb,mBAAmBW,OAAO,mBAAI,IAAIG,IAAI,GAAGC,WAAW,GAAGC,KAAK,CAAC,GAAG;IACvF,MAAMC,aAAaL,iBAAOZ,sBAAAA,MAAMa,WAAW,qBAAjBb,oBAAmBiB,UAAU,oBAAI,IAAIH,IAAI,GAAGE,KAAK,CAAC,GAAG;IAC/E,OAAOvB,0BACL;QACEyB,QAAQlB,MAAMkB,MAAM;QACpB,6EAA6E;QAC7EC,UAAU;QACVX;QACAP,OAAOA,MAAMmB,GAAG,CAAC,CAACjB,OAAU;gBAC1BkB,QAAQlB,KAAKmB,SAAS;gBACtBC,MAAMpB,KAAKoB,IAAI;eACXpB,KAAKqB,GAAG,GAAG;gBAAEA,KAAKrB,KAAKqB,GAAG;YAAC,IAAI,CAAC;gBACpCpB,UAAUD,KAAKC,QAAQ;gBACvBC,WAAWF,KAAKE,SAAS;gBACzBoB,OAAOtB,KAAKI,QAAQ;;OAElBI,WAAWM,aACX;QAAEJ,aAAa,aAAMF,UAAU;YAAEA;QAAQ,IAAI,CAAC,GAAQM,aAAa;YAAEA;QAAW,IAAI,CAAC;IAAK,IAC1F,CAAC,IAEP;QAAES,WAAW5B;IAA2B;AAE5C;AAYA,OAAO,SAAS6B,cAAcC,KAAgC;IAC5D,OAAO;QACLC,IAAID,MAAMC,EAAE;QACZC,OAAOF,MAAME,KAAK;OACdF,MAAMG,WAAW,GAAG;QAAEA,aAAaH,MAAMG,WAAW;IAAC,IAAI,CAAC;QAC9DC,aAAaJ,MAAMI,WAAW;QAC9BC,iBAAiBL,MAAMK,eAAe;OAClCL,MAAMM,QAAQ,GAAG;QAAEA,UAAUN,MAAMM,QAAQ;IAAC,IAAI,CAAC;AAEzD;AAEA;;;;;CAKC,GACD,OAAO,MAAMC,oBAAsC,OAAOC,KAAKC;QAGvCD;IAFtBC,IAAIC,SAAS,CAAC,iBAAiB;IAC/B,IAAIF,IAAIG,MAAM,KAAK,OAAO,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAqB;IACpF,MAAMxB,SAASN,QAAOwB,oBAAAA,IAAIO,KAAK,CAACzB,MAAM,YAAhBkB,oBAAoB;IAC1C,IAAI,CAACzC,aAAauB,SAAS,OAAOmB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAA4B;IAC5F,IAAI,CAAClD,2BAA2B,OAAO6C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEG,QAAQ,EAAE;IAAC;IACzE,MAAMC,SAAShD,WAAWuC,IAAIU,OAAO,EAAE5B;IACvC,IAAI,CAAC2B,QAAQ,OAAOR,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEG,QAAQ,EAAE;IAAC;IACtD,IAAI;YAEY,OAGsCG,aAKhCX,oBACGA;QAVvB,MAAMY,UAAUtD,cAAcuD,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAAClC;QACxE,MAAM6B,QAAQ,QAAA,AAAC,CAAA,MAAMC,QAAQG,UAAU,CAAC,SAASC,GAAG,CAACP,QAAQQ,GAAG,EAAC,EAAGC,IAAI,cAA1D,QAAuG;YACnHrD,OAAO,EAAE;QACX;QACA,MAAMA,QAAQ,MAAMsD,uBAAuBP,UAASD,cAAAA,KAAK9C,KAAK,YAAV8C,cAAc,EAAE;QACpE,MAAMH,SAAS,MAAM7C,gBAAgB;YACnCmB;YACAjB;YACAY,aAAa;gBACXF,SAASC,QAAOwB,qBAAAA,IAAIO,KAAK,CAAChC,OAAO,YAAjByB,qBAAqB;gBACrCnB,YAAYL,QAAOwB,wBAAAA,IAAIO,KAAK,CAAC1B,UAAU,YAApBmB,wBAAwB;YAC7C;QACF;QACA,OAAOC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEG,QAAQA,OAAOxB,GAAG,CAACO;QAAe;IAClE,EAAE,OAAOe,OAAO;QACdc,QAAQd,KAAK,CAAC,sBAAsBA;QACpC,yCAAyC;QACzC,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEG,QAAQ,EAAE;QAAC;IAC3C;AACF,EAAC;AAED,qEAAqE,GACrE,eAAeW,uBACbP,OAA4C,EAC5CS,SAAmC;IAEnC,MAAMC,MAAM;WAAI,IAAIC,IAAIF,UAAUrC,GAAG,CAAC,CAACjB,OAASA,KAAKmB,SAAS;KAAG,CAACpB,MAAM,CAAC,CAAC2B,KAAOlC,aAAakC;IAC9F,MAAM+B,YAAY,MAAMC,QAAQC,GAAG,CAACJ,IAAItC,GAAG,CAAC,CAACS,KAAOmB,QAAQG,UAAU,CAAC,YAAYC,GAAG,CAACvB,IAAIwB,GAAG;IAC9F,MAAMU,WAAW,IAAIC,IACnBJ,UAAUxC,GAAG,CAAC,CAAC6C,WAAa;YAC1BA,SAASpC,EAAE;YACXoC,SAASC,MAAM,GAAGtE,cAAcuE,iBAAiB,CAACF,SAASX,IAAI,MAAe;SAC/E;IAEH,MAAMrD,QAA8B,EAAE;IACtC,KAAK,MAAME,QAAQsD,UAAW;YAafW;QAZb,MAAMA,UAAUL,SAASV,GAAG,CAAClD,KAAKmB,SAAS;QAC3C,IAAI,CAAC8C,WAAWA,QAAQC,SAAS,IAAID,QAAQ5B,MAAM,KAAK,UAAU;QAClE,MAAM8B,UAAUnE,KAAKoE,SAAS,GAC1BH,QAAQI,QAAQ,CAACC,IAAI,CAAC,CAACC,OAASA,KAAK7C,EAAE,KAAK1B,KAAKoE,SAAS,IAC1DH,QAAQI,QAAQ,CAAC,EAAE;QACvB,IAAI,CAACF,WAAW,CAAC1E,cAAc+E,eAAe,CAACL,UAAU;QACzDrE,MAAM2E,IAAI,CAAC;YACTtD,WAAWnB,KAAKmB,SAAS;YACzBC,MAAM6C,QAAQ7C,IAAI;WACd+C,QAAQ9C,GAAG,GAAG;YAAEA,KAAK8C,QAAQ9C,GAAG;QAAC,IAAI,CAAC;YAC1CpB,UAAUyE,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAO7E,KAAKC,QAAQ,KAAK;YAC1DC,WAAWwE,KAAKE,KAAK,CAACC,OAAOV,QAAQW,QAAQ,IAAI;YACjD1E,UAAU,EAAC6D,gBAAAA,QAAQc,IAAI,YAAZd,gBAAgB,gBAAgB;;IAE/C;IACA,OAAOnE;AACT"}

package/src/lib/server/{feed.d.ts → checkout-status.d.ts}

@@ -15,10 +15,5 @@
  * limitations under the License.
  */
 import type { PluginApiHandler } from '@aglyn/aglyn/server';
-/**
- * Google Merchant Center product feed (AGL-299): RSS 2.0 with the g:
- * namespace over active products — one item per product (default
- * variant pricing; per-variant feeds can come later). Submit
- * `https://{site}/api/commerce/feed?hostId={id}` in Merchant Center.
- */
-export declare const feedHandler: PluginApiHandler;
+export type CheckoutReturnStatus = 'open' | 'complete' | 'expired';
+export declare const checkoutStatusHandler: PluginApiHandler;

package/src/lib/server/checkout-status.js

@@ -0,0 +1,111 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * What became of a storefront Checkout Session, for the page Stripe returned
+ * the shopper to (AGL-3606).
+ *
+ * ## Why the return page has to ask
+ *
+ * The in-page checkout sends every successful confirm to `return_url` — the
+ * same `?order=success&session_id=…` the hosted redirect lands on. But a
+ * redirect-based payment method (a bank redirect, a wallet that leaves the
+ * page) comes back to that SAME url when the shopper abandons or fails the
+ * bank step, with the session still open and nothing charged. The url alone
+ * cannot tell the two apart, so a shopper whose bank step failed was shown a
+ * store that said nothing at all, and had no reason to try again.
+ *
+ * ## What it answers, and what it never does
+ *
+ * Only the session's `status` and `payment_status`, and only for a session
+ * this host created (`metadata[hostId]`, which both checkout routes set). No
+ * email, no address, no amount, and no client secret: the session id rides a
+ * url that lands in browser history and referrers, and must not become a key
+ * to the shopper's details or to paying for their basket.
+ *
+ * It does not fulfil, and its answer fulfils nothing: the order is still
+ * `checkout.session.completed` in `billing-webhook.ts`, and nothing here
+ * writes anywhere.
+ */ const SESSION_ID = /^cs_(test|live)_[A-Za-z0-9]{8,255}$/;
+export const checkoutStatusHandler = async (req, res)=>{
+    var _req_query_hostId, _req_query_sessionId, _process_env_STRIPE_SECRET_KEY;
+    if (req.method && req.method !== 'GET') {
+        res.setHeader('Allow', 'GET');
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_req_query_hostId = req.query.hostId) != null ? _req_query_hostId : '').trim();
+    const sessionId = String((_req_query_sessionId = req.query.sessionId) != null ? _req_query_sessionId : '').trim();
+    if (!hostId || !sessionId) {
+        return res.status(400).json({
+            error: 'Missing hostId or sessionId'
+        });
+    }
+    // Shape-checked before it is interpolated into a Stripe URL path.
+    if (!SESSION_ID.test(sessionId)) {
+        return res.status(400).json({
+            error: 'Invalid sessionId'
+        });
+    }
+    const secretKey = String((_process_env_STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY) != null ? _process_env_STRIPE_SECRET_KEY : '').trim();
+    if (!secretKey) {
+        return res.status(501).json({
+            error: 'Payments are not configured'
+        });
+    }
+    res.setHeader('Cache-Control', 'no-store');
+    try {
+        var _ref, _session_status, _session_payment_status;
+        var _session_metadata;
+        const response = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}`, {
+            headers: {
+                Authorization: `Bearer ${secretKey}`
+            }
+        });
+        if (!response.ok) {
+            // A test-mode id under a live key (or the reverse) is a 404 at Stripe,
+            // and so is an id that never existed. Both are "not ours".
+            return res.status(404).json({
+                error: 'Not found'
+            });
+        }
+        const session = await response.json();
+        // The same 404 as a missing session, so this route cannot be used to
+        // learn that a session exists on ANOTHER merchant's storefront.
+        if (String((_ref = session == null ? void 0 : (_session_metadata = session.metadata) == null ? void 0 : _session_metadata.hostId) != null ? _ref : '') !== hostId) {
+            return res.status(404).json({
+                error: 'Not found'
+            });
+        }
+        const status = String((_session_status = session.status) != null ? _session_status : '');
+        if (status !== 'open' && status !== 'complete' && status !== 'expired') {
+            return res.status(404).json({
+                error: 'Not found'
+            });
+        }
+        return res.status(200).json({
+            status: status,
+            paymentStatus: String((_session_payment_status = session.payment_status) != null ? _session_payment_status : '')
+        });
+    } catch (error) {
+        console.error('checkout-status lookup failed', error);
+        return res.status(502).json({
+            error: 'Lookup failed'
+        });
+    }
+};
+
+//# sourceMappingURL=checkout-status.js.map

package/src/lib/server/checkout-status.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/checkout-status.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\n\n/**\n * What became of a storefront Checkout Session, for the page Stripe returned\n * the shopper to (AGL-3606).\n *\n * ## Why the return page has to ask\n *\n * The in-page checkout sends every successful confirm to `return_url` — the\n * same `?order=success&session_id=…` the hosted redirect lands on. But a\n * redirect-based payment method (a bank redirect, a wallet that leaves the\n * page) comes back to that SAME url when the shopper abandons or fails the\n * bank step, with the session still open and nothing charged. The url alone\n * cannot tell the two apart, so a shopper whose bank step failed was shown a\n * store that said nothing at all, and had no reason to try again.\n *\n * ## What it answers, and what it never does\n *\n * Only the session's `status` and `payment_status`, and only for a session\n * this host created (`metadata[hostId]`, which both checkout routes set). No\n * email, no address, no amount, and no client secret: the session id rides a\n * url that lands in browser history and referrers, and must not become a key\n * to the shopper's details or to paying for their basket.\n *\n * It does not fulfil, and its answer fulfils nothing: the order is still\n * `checkout.session.completed` in `billing-webhook.ts`, and nothing here\n * writes anywhere.\n */\n\nconst SESSION_ID = /^cs_(test|live)_[A-Za-z0-9]{8,255}$/\n\nexport type CheckoutReturnStatus = 'open' | 'complete' | 'expired'\n\nexport const checkoutStatusHandler: PluginApiHandler = async (req, res) => {\n  if (req.method && req.method !== 'GET') {\n    res.setHeader('Allow', 'GET')\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.query.hostId ?? '').trim()\n  const sessionId = String(req.query.sessionId ?? '').trim()\n  if (!hostId || !sessionId) {\n    return res.status(400).json({ error: 'Missing hostId or sessionId' })\n  }\n  // Shape-checked before it is interpolated into a Stripe URL path.\n  if (!SESSION_ID.test(sessionId)) {\n    return res.status(400).json({ error: 'Invalid sessionId' })\n  }\n  const secretKey = String(process.env.STRIPE_SECRET_KEY ?? '').trim()\n  if (!secretKey) {\n    return res.status(501).json({ error: 'Payments are not configured' })\n  }\n  res.setHeader('Cache-Control', 'no-store')\n  try {\n    const response = await fetch(\n      `https://api.stripe.com/v1/checkout/sessions/${sessionId}`,\n      { headers: { Authorization: `Bearer ${secretKey}` } },\n    )\n    if (!response.ok) {\n      // A test-mode id under a live key (or the reverse) is a 404 at Stripe,\n      // and so is an id that never existed. Both are \"not ours\".\n      return res.status(404).json({ error: 'Not found' })\n    }\n    const session = (await response.json()) as {\n      status?: string\n      payment_status?: string\n      metadata?: Record<string, string>\n    }\n    // The same 404 as a missing session, so this route cannot be used to\n    // learn that a session exists on ANOTHER merchant's storefront.\n    if (String(session?.metadata?.hostId ?? '') !== hostId) {\n      return res.status(404).json({ error: 'Not found' })\n    }\n    const status = String(session.status ?? '')\n    if (status !== 'open' && status !== 'complete' && status !== 'expired') {\n      return res.status(404).json({ error: 'Not found' })\n    }\n    return res.status(200).json({\n      status: status as CheckoutReturnStatus,\n      paymentStatus: String(session.payment_status ?? ''),\n    })\n  } catch (error) {\n    console.error('checkout-status lookup failed', error)\n    return res.status(502).json({ error: 'Lookup failed' })\n  }\n}\n"],"names":["SESSION_ID","checkoutStatusHandler","req","res","process","method","setHeader","status","json","error","hostId","String","query","trim","sessionId","test","secretKey","env","STRIPE_SECRET_KEY","session","response","fetch","headers","Authorization","ok","metadata","paymentStatus","payment_status","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAID;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GAED,MAAMA,aAAa;AAInB,OAAO,MAAMC,wBAA0C,OAAOC,KAAKC;QAK3CD,mBACGA,sBAQAE;IAbzB,IAAIF,IAAIG,MAAM,IAAIH,IAAIG,MAAM,KAAK,OAAO;QACtCF,IAAIG,SAAS,CAAC,SAAS;QACvB,OAAOH,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,QAAOT,oBAAAA,IAAIU,KAAK,CAACF,MAAM,YAAhBR,oBAAoB,IAAIW,IAAI;IAClD,MAAMC,YAAYH,QAAOT,uBAAAA,IAAIU,KAAK,CAACE,SAAS,YAAnBZ,uBAAuB,IAAIW,IAAI;IACxD,IAAI,CAACH,UAAU,CAACI,WAAW;QACzB,OAAOX,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACA,kEAAkE;IAClE,IAAI,CAACT,WAAWe,IAAI,CAACD,YAAY;QAC/B,OAAOX,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IACA,MAAMO,YAAYL,QAAOP,iCAAAA,QAAQa,GAAG,CAACC,iBAAiB,YAA7Bd,iCAAiC,IAAIS,IAAI;IAClE,IAAI,CAACG,WAAW;QACd,OAAOb,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACAN,IAAIG,SAAS,CAAC,iBAAiB;IAC/B,IAAI;kBAoBoBa,iBAMEA;YATbA;QAhBX,MAAMC,WAAW,MAAMC,MACrB,CAAC,4CAA4C,EAAEP,WAAW,EAC1D;YAAEQ,SAAS;gBAAEC,eAAe,CAAC,OAAO,EAAEP,WAAW;YAAC;QAAE;QAEtD,IAAI,CAACI,SAASI,EAAE,EAAE;YAChB,uEAAuE;YACvE,2DAA2D;YAC3D,OAAOrB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAY;QACnD;QACA,MAAMU,UAAW,MAAMC,SAASZ,IAAI;QAKpC,qEAAqE;QACrE,gEAAgE;QAChE,IAAIG,eAAOQ,4BAAAA,oBAAAA,QAASM,QAAQ,qBAAjBN,kBAAmBT,MAAM,mBAAI,QAAQA,QAAQ;YACtD,OAAOP,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAY;QACnD;QACA,MAAMF,SAASI,QAAOQ,kBAAAA,QAAQZ,MAAM,YAAdY,kBAAkB;QACxC,IAAIZ,WAAW,UAAUA,WAAW,cAAcA,WAAW,WAAW;YACtE,OAAOJ,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAY;QACnD;QACA,OAAON,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BD,QAAQA;YACRmB,eAAef,QAAOQ,0BAAAA,QAAQQ,cAAc,YAAtBR,0BAA0B;QAClD;IACF,EAAE,OAAOV,OAAO;QACdmB,QAAQnB,KAAK,CAAC,iCAAiCA;QAC/C,OAAON,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/server/checkout.js

@@ -21,11 +21,15 @@ import { claimAttempt, deriveStripeObjectKey } from "@aglyn/aglyn/server";
 import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
 import { merchantAccountIsReady } from "@aglyn/tenant-data-admin/server/payment-provider";
 import { checkoutSessionCardAuthenticationParams } from "@aglyn/tenant-data-admin/server/stripe-card-authentication";
+import { CARRIER_POSTAL_CODE_MESSAGE, planCheckoutShippingWithCarriers } from "./carrier-shipping.js";
 import { readActiveMemberSession } from "./membership.js";
 import { resolveManualTaxRateId } from "./manual-tax-rate.js";
+import { taxEngineSessionMetadata } from "../model/commerce-tax-engine.js";
+import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
 import { holdPromotionSlot, promotionHoldKey } from "./promotion-hold.js";
 import { holdStock, stockHoldKey } from "./stock-hold.js";
 import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSessionPayload, resolveNativeCheckoutMode } from "./native-checkout.js";
+import { ensureCheckoutDomain } from "./payment-method-domains.js";
 /**
  * Commerce Starter checkout (AGL-90): a site visitor buys a product. The
  * price ALWAYS comes from the host's product doc (never the request), the
@@ -102,7 +106,7 @@ import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSes
         if (held) await held.release();
     };
     try {
-        var _variant_priceUsd, _req_headers_referer, _req_headers_host, _storeSettings_get, _ref1, _lifted_type, _variant_weightGrams, _lifted_type1, _lifted_type2, _product_name, _ref2;
+        var _variant_priceUsd, _req_headers_referer, _req_headers_host, _storeSettings_get, _lifted_name, _ref1, _lifted_type, _variant_weightGrams, _lifted_type1, _lifted_type2, _product_name, _ref2;
         var _ownerOrg_org, _ownerOrg_org1, _ownerOrg_org2;
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
@@ -419,6 +423,36 @@ import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSes
                 taxPct = rate.pct;
             }
         }
+        // The merchant's own tax service, where they connected one (AGL-3631),
+        // for a one-time sale. Taxed at the store's address, like the rate above:
+        // the shopper's address arrives inside Stripe Checkout, after this
+        // session exists. A subscription keeps the store's recurring rate — a
+        // quote taken today does not price next month's renewal. When the service
+        // does not answer, the rate above stands and the order says so.
+        const engineTax = taxSettings.mode === 'manual' && !lifted.taxExempt && !isSubscription ? await quoteSaleTaxWithEngine({
+            hostId,
+            settings: taxSettings,
+            channel: 'online',
+            lines: [
+                _extends({
+                    id: '0',
+                    productId
+                }, variantId ? {
+                    variantId
+                } : {}, {
+                    description: String((_lifted_name = lifted.name) != null ? _lifted_name : ''),
+                    quantity,
+                    amountCents
+                })
+            ]
+        }) : {
+            quote: null,
+            stamp: null
+        };
+        if (engineTax.quote) {
+            taxCents = engineTax.quote.taxCents;
+            taxLabel = 'Sales tax';
+        }
         // Recurring manual tax (AGL-1751). The manual tax cannot ride the
         // `line_items[1]` product line on a SUBSCRIPTION session: a non-recurring
         // price in `mode: subscription` is a one-time item, and Stripe bills
@@ -628,13 +662,38 @@ import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSes
         // the two lists, and refuses rather than guessing.
         const shippingSettings = storeSettings.get('shipping');
         const shipsPhysically = ((_lifted_type = lifted.type) != null ? _lifted_type : 'physical') === 'physical' && !isSubscription;
-        const shippingPlan = shipsPhysically ? CommerceModel.planCheckoutShipping(shippingSettings, {
-            subtotalCents: listUnitAmountCents * quantity,
-            totalGrams: Math.max(0, Number((_variant_weightGrams = variant.weightGrams) != null ? _variant_weightGrams : 0)) * quantity
-        }, body.shippingCountry) : {
+        // Live carrier rates (AGL-3612) are quoted here, before the session,
+        // for the destination the shopper declared; see `carrier-shipping.ts`.
+        const shippingPlan = shipsPhysically ? await planCheckoutShippingWithCarriers({
+            hostId,
+            settings: shippingSettings,
+            cart: _extends({
+                subtotalCents: listUnitAmountCents * quantity,
+                totalGrams: Math.max(0, Number((_variant_weightGrams = variant.weightGrams) != null ? _variant_weightGrams : 0)) * quantity
+            }, quantity === 1 ? {
+                parcel: CommerceModel.productParcelDimensions(lifted)
+            } : {}),
+            destination: {
+                country: body.shippingCountry,
+                postalCode: body.shippingPostalCode
+            }
+        }) : {
             countries: CommerceModel.CHECKOUT_SHIPPING_COUNTRIES,
             options: []
         };
+        if (shippingPlan.needsPostalCode) {
+            await releaseCouponSlot();
+            await releaseStock();
+            await claim.release();
+            return res.status(400).json({
+                error: CARRIER_POSTAL_CODE_MESSAGE,
+                needsShippingCountry: true,
+                needsShippingPostalCode: true,
+                shippingCountries: [
+                    ...CommerceModel.CHECKOUT_SHIPPING_COUNTRIES
+                ]
+            });
+        }
         if (shippingPlan.refusal === 'destination-required') {
             // A deterministic ask the shopper answers and retries under the same
             // key — released, not burned (AGL-1697). The tax rate possibly minted
@@ -806,7 +865,9 @@ import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSes
         } : {}, {
             'metadata[quantity]': String(quantity),
             'metadata[feeCents]': String(feeCents)
-        }, useStripeTax && !isSubscription ? {
+        }, shippingPlan.quotedPostalCode ? {
+            'metadata[shippingQuotePostalCode]': shippingPlan.quotedPostalCode
+        } : {}, useStripeTax && !isSubscription ? {
             'metadata[transferCents]': String(CommerceModel.platformLiableTransferCents({
                 feeCents,
                 merchantGoodsCents: amountCents,
@@ -831,7 +892,8 @@ import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSes
             // documented ground that the two are mutually exclusive, so carrying
             // both would double-count the tax on the recorded sale.
             'metadata[unitAmountCents]': String(listUnitAmountCents),
-            'metadata[taxCents]': String(isSubscription ? 0 : taxCents),
+            'metadata[taxCents]': String(isSubscription ? 0 : taxCents)
+        }, taxEngineSessionMetadata(engineTax.stamp), {
             'metadata[discountCents]': String(discountCents)
         }, appliedCoupon ? {
             'metadata[couponCode]': appliedCoupon
@@ -868,6 +930,12 @@ import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSes
                     amountCents: 0
                 })) : shippingPlan.options);
         }
+        // The payment methods the merchant switched off (AGL-3629). Exclusions
+        // only: what stays on is whatever the platform's configuration offers for
+        // this order, so a store on the defaults sends what it always sent, bar
+        // the crypto opt-in. Works on the hosted page as well as the in-page one.
+        const paymentMethodControls = CommerceModel.resolveStorefrontPaymentMethodControls(CommerceModel.normalizeStorefrontPaymentMethodSettings(storeSettings.get('paymentMethods')));
+        CommerceModel.appendStorefrontPaymentMethodParams(params, paymentMethodControls);
         // The Payment Element (AGL-1944), and the LAST thing done to the params on
         // purpose. Everything above — price, coupon, tax, shipping, the Connect
         // destination, the fee, every metadata key the webhook reads — is computed
@@ -883,19 +951,28 @@ import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSes
         if (nativeMode.native) {
             applyNativeCheckoutParams(params, `${backUrl}${separator}order=success&session_id={CHECKOUT_SESSION_ID}`);
         }
+        // Apple Pay shows on a registered domain only (AGL-3629). Started beside
+        // the session create rather than before it, inside a fixed budget, and
+        // never throws: a sale does not wait on, or fail for, a registration.
+        const domainRegistration = nativeMode.native ? ensureCheckoutDomain({
+            pageUrl: backUrl,
+            site: hostSnapshot.data == null ? void 0 : hostSnapshot.data.call(hostSnapshot),
+            hostId
+        }).catch(()=>null) : Promise.resolve(null);
         const response = await fetch('https://api.stripe.com/v1/checkout/sessions', {
             method: 'POST',
             headers: _extends({
                 Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
                 'Content-Type': 'application/x-www-form-urlencoded'
-            }, stripeKeyHeader('session'), nativeCheckoutStripeHeaders(nativeMode)),
+            }, stripeKeyHeader(engineTax.stamp ? `session-tax-${taxCents}-${engineTax.stamp.status}` : 'session'), nativeCheckoutStripeHeaders(nativeMode)),
             body: params.toString()
         });
         const session = await response.json();
         // `!session.url` was the liveness check, and a `ui_mode` session HAS no
         // url — so the check moves with the mode rather than staying behind and
         // reading every successful native session as a Stripe failure (AGL-1944).
-        const payload = response.ok ? readCheckoutSessionPayload(session, nativeMode) : null;
+        await domainRegistration;
+        const payload = response.ok ? readCheckoutSessionPayload(session, nativeMode, paymentMethodControls.wallets) : null;
         if (!payload) {
             console.error('Stripe checkout error', session.error);
             // Nothing was sold — hand the key back so one flaky moment does not