@aglyn/plugins-commerce 1.0.0-beta.230 → 1.0.0-beta.231

package/src/lib/server/pos-ops-gate.d.ts

@@ -0,0 +1,161 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiRequest } from '@aglyn/aglyn/server';
+import type { PrintReport } from '../model/commerce-printers';
+import { type PosOpsSettings } from '../pos-ops-config';
+export interface PosOpsMembership {
+    orgWide: boolean;
+    hostRole: string | null;
+    permissions: {
+        managePos?: boolean;
+    };
+}
+export interface PosOpsDeps {
+    firestore(): FirebaseFirestore.Firestore;
+    verifyIdToken(token: string): Promise<{
+        uid: string;
+    }>;
+    membership(uid: string, hostId: string): Promise<PosOpsMembership>;
+    orgForHost(hostId: string): Promise<{
+        orgId: string;
+        org: Record<string, any> | null;
+    } | null>;
+    pluginConfig(orgId: string, hostId: string): Promise<Record<string, unknown>>;
+    /** The plan includes the register. */
+    posEntitled(org: Record<string, any> | null): boolean;
+    /** The HMAC secret staff assertions are signed with; throws when unset. */
+    signingSecret(): string;
+    /** A member's name as a receipt or a report prints it. */
+    memberName(uid: string): Promise<string>;
+    now(): number;
+    /** Stripe's REST API; `global.fetch` in production. */
+    fetch: typeof fetch;
+    /** The register's cloud printers (AGL-3619): drawer kicks and shift reports. */
+    printer: PosOpsPrinter;
+}
+/** What the register's routes ask of the printer queue. Never throws. */
+export interface PosOpsPrinter {
+    kickDrawer(input: {
+        hostId: string;
+        registerId: string;
+        reason: 'paid_in' | 'paid_out' | 'drop' | 'cash_refund';
+        causeId: string;
+        createdBy?: string;
+    }): Promise<{
+        jobIds: string[];
+    }>;
+    printReport(input: {
+        hostId: string;
+        registerId: string;
+        shiftId: string;
+        report: PrintReport;
+        createdBy?: string;
+        attemptKey: string;
+    }): Promise<{
+        jobIds: string[];
+    }>;
+}
+export declare function defaultPosOpsDeps(): PosOpsDeps;
+/** A JSON body, whether the dispatcher parsed it or not. */
+export declare function posOpsBody(req: PluginApiRequest): Record<string, any>;
+/** The request's idempotency key, either header spelling, bounded. */
+export declare function posOpsIdempotencyKey(req: PluginApiRequest): string;
+/** Who is at the register, once the gate admitted them. */
+export interface PosOpsStaff {
+    uid: string;
+    hostId: string;
+    orgId: string;
+    org: Record<string, any> | null;
+    membership: PosOpsMembership;
+    /** An admin of the whole workspace: the one role with no refund limit. */
+    isManager: boolean;
+    settings: PosOpsSettings;
+    hostRef: FirebaseFirestore.DocumentReference;
+}
+export type PosOpsGate = {
+    ok: true;
+    staff: PosOpsStaff;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+/** A site id the dispatcher's own sentinels and path tricks cannot pass for. */
+declare function cleanId(value: unknown): string;
+export { cleanId as posOpsCleanId };
+/** Whether a member may work this site's register, by role and permission. */
+export declare function mayWorkRegister(memberRole: unknown, membership: PosOpsMembership): boolean;
+/**
+ * The one role whose say-so a refund above the cashier limit needs: an admin
+ * of the whole workspace who is also this site's admin — the role
+ * `refund.ts` has always required to refund at all.
+ */
+export declare function isPosManager(memberRole: unknown, membership: PosOpsMembership): boolean;
+export declare function authorizePosOps(deps: PosOpsDeps, req: PluginApiRequest, rawHostId: unknown): Promise<PosOpsGate>;
+/** A register on this site, or a refusal: a register id from another site is unknown here. */
+export declare function readPosRegister(staff: PosOpsStaff, rawRegisterId: unknown): Promise<{
+    ok: true;
+    ref: FirebaseFirestore.DocumentReference;
+    data: Record<string, any>;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+}>;
+export type PosAssertionPurpose = 'cashier' | 'manager';
+export declare function mintPosAssertion(deps: PosOpsDeps, input: {
+    hostId: string;
+    registerId: string;
+    memberUid: string;
+    purpose: PosAssertionPurpose;
+}): {
+    token: string;
+    expiresAtMs: number;
+};
+/**
+ * The member an assertion names, or `null` — for a forged, expired, wrong-site,
+ * wrong-register or wrong-purpose one alike. It does NOT re-check the member:
+ * {@link resolvePosStaffAssertion} does that.
+ */
+export declare function readPosAssertion(deps: PosOpsDeps, token: unknown, expected: {
+    hostId: string;
+    registerId: string;
+    purpose: PosAssertionPurpose;
+}): {
+    memberUid: string;
+    expiresAtMs: number;
+} | null;
+/**
+ * The member an assertion puts at the register, re-checked NOW against the
+ * site's roles and the organization's permissions — or `null` when the
+ * assertion is bad or the member may no longer do what it was minted for.
+ */
+export declare function resolvePosStaffAssertion(deps: PosOpsDeps, hostRef: FirebaseFirestore.DocumentReference, token: unknown, expected: {
+    hostId: string;
+    registerId: string;
+    purpose: PosAssertionPurpose;
+}): Promise<string | null>;
+/**
+ * Who rang this: the member a valid cashier assertion names, or the member
+ * signed in on the device when there is none or it no longer holds. The
+ * signed-in member already passed the gate, so the fallback never admits
+ * anybody new; it only decides whose name the sale carries.
+ */
+export declare function resolvePosCashier(deps: PosOpsDeps, staff: Pick<PosOpsStaff, 'uid' | 'hostId' | 'hostRef'>, registerId: string, token: unknown): Promise<{
+    cashierId: string;
+    via: 'pin' | 'session';
+}>;

package/src/lib/server/pos-ops-gate.js

@@ -0,0 +1,295 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost, getPluginConfig } from "@aglyn/tenant-data-admin";
+import { findUserByUidAcrossPools } from "@aglyn/tenant-data-admin/server/auth-pools";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { createHmac, timingSafeEqual } from "crypto";
+import { POS_CASHIER_ASSERTION_TTL_MS, POS_MANAGER_ASSERTION_TTL_MS } from "../model/commerce-pos-ops.js";
+import { posOpsSettings } from "../pos-ops-config.js";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+export function defaultPosOpsDeps() {
+    return {
+        firestore: ()=>firebaseAdmin.app().firestore(),
+        verifyIdToken: async (token)=>{
+            const decoded = await firebaseAdmin.app().auth().verifyIdToken(token);
+            return {
+                uid: decoded.uid
+            };
+        },
+        membership: async (uid, hostId)=>{
+            var _resolved_hostRole;
+            var _resolved_permissions;
+            const resolved = await resolveOrgPermissions(uid, {
+                hostId
+            });
+            return {
+                orgWide: resolved.orgWide === true,
+                hostRole: (_resolved_hostRole = resolved.hostRole) != null ? _resolved_hostRole : null,
+                permissions: {
+                    managePos: ((_resolved_permissions = resolved.permissions) == null ? void 0 : _resolved_permissions.managePos) === true
+                }
+            };
+        },
+        orgForHost: async (hostId)=>{
+            var _ref, _ref1, _found_org;
+            var _found_org1;
+            const found = await getOrgForHost(hostId);
+            if (!found) return null;
+            return {
+                orgId: String((_ref = (_ref1 = (_found_org1 = found.org) == null ? void 0 : _found_org1.id) != null ? _ref1 : found.orgId) != null ? _ref : ''),
+                org: (_found_org = found.org) != null ? _found_org : null
+            };
+        },
+        pluginConfig: async (orgId, hostId)=>{
+            var _ref;
+            return (_ref = await getPluginConfig(orgId, 'commerce', {
+                hostId
+            })) != null ? _ref : {};
+        },
+        posEntitled: (org)=>Aglyn.checkEntitlement(org, 'pos'),
+        signingSecret: ()=>{
+            const secret = process.env.TOKEN_SIGNING_SECRET;
+            if (!secret) throw new Error('TOKEN_SIGNING_SECRET is not configured');
+            return secret;
+        },
+        memberName: async (uid)=>{
+            // Every pool: a member who signs in through SSO lives in a GCIP tenant
+            // pool, not the project one (AGL-1122).
+            try {
+                var _this;
+                const user = (_this = await findUserByUidAcrossPools(uid)) == null ? void 0 : _this.record;
+                return (user == null ? void 0 : user.displayName) || (user == null ? void 0 : user.email) || 'Staff member';
+            } catch (unused) {
+                return 'Staff member';
+            }
+        },
+        now: ()=>Date.now(),
+        fetch: (input, init)=>fetch(input, init),
+        // Loaded on use: the printing module reaches the whole sale pipeline,
+        // which a shift count or a PIN check never needs.
+        printer: {
+            kickDrawer: async (input)=>(await import("./pos-print.js")).kickPosDrawer(input),
+            printReport: async (input)=>(await import("./pos-print.js")).printPosShiftReport(input)
+        }
+    };
+}
+/** A JSON body, whether the dispatcher parsed it or not. */ export function posOpsBody(req) {
+    if (typeof req.body === 'string') {
+        try {
+            const parsed = JSON.parse(req.body);
+            return parsed && typeof parsed === 'object' ? parsed : {};
+        } catch (unused) {
+            return {};
+        }
+    }
+    return req.body && typeof req.body === 'object' ? req.body : {};
+}
+/** The request's idempotency key, either header spelling, bounded. */ export function posOpsIdempotencyKey(req) {
+    var _ref, _req_headers_idempotencykey;
+    return String((_ref = (_req_headers_idempotencykey = req.headers['idempotency-key']) != null ? _req_headers_idempotencykey : req.headers['Idempotency-Key']) != null ? _ref : '').trim().slice(0, 200);
+}
+/** A site id the dispatcher's own sentinels and path tricks cannot pass for. */ function cleanId(value) {
+    const id = String(value != null ? value : '').trim();
+    return /^[A-Za-z0-9_-]{1,128}$/.test(id) && !/^__.*__$/.test(id) ? id : '';
+}
+export { cleanId as posOpsCleanId };
+/** Whether a member may work this site's register, by role and permission. */ export function mayWorkRegister(memberRole, membership) {
+    return (memberRole === 'admin' || memberRole === 'editor') && membership.permissions.managePos === true;
+}
+/**
+ * The one role whose say-so a refund above the cashier limit needs: an admin
+ * of the whole workspace who is also this site's admin — the role
+ * `refund.ts` has always required to refund at all.
+ */ export function isPosManager(memberRole, membership) {
+    return memberRole === 'admin' && membership.orgWide && membership.hostRole === 'admin';
+}
+export async function authorizePosOps(deps, req, rawHostId) {
+    var _req_headers_authorization, _hostSnapshot_get, _ref, _ref1, _ref2;
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
+    if (!idToken) return {
+        ok: false,
+        status: 401,
+        error: 'Unauthenticated'
+    };
+    const hostId = cleanId(rawHostId);
+    if (!hostId) return {
+        ok: false,
+        status: 400,
+        error: 'Missing hostId'
+    };
+    let uid;
+    try {
+        uid = (await deps.verifyIdToken(idToken)).uid;
+    } catch (error) {
+        if (!isRefusedIdToken(error)) throw error;
+        return {
+            ok: false,
+            status: 401,
+            error: 'Unauthenticated'
+        };
+    }
+    const hostRef = deps.firestore().collection('hosts').doc(hostId);
+    const hostSnapshot = await hostRef.get();
+    if (!hostSnapshot.exists) return {
+        ok: false,
+        status: 404,
+        error: 'Unknown site'
+    };
+    const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[uid];
+    const membership = await deps.membership(uid, hostId);
+    if (!mayWorkRegister(memberRole, membership)) {
+        return {
+            ok: false,
+            status: 403,
+            error: 'Not permitted'
+        };
+    }
+    const owner = await deps.orgForHost(hostId);
+    if (!deps.posEntitled((_ref = owner == null ? void 0 : owner.org) != null ? _ref : null)) {
+        return {
+            ok: false,
+            status: 403,
+            error: 'POS requires the Pro plan or above'
+        };
+    }
+    const settings = posOpsSettings((owner == null ? void 0 : owner.orgId) ? await deps.pluginConfig(owner.orgId, hostId).catch(()=>({})) : {});
+    return {
+        ok: true,
+        staff: {
+            uid,
+            hostId,
+            orgId: (_ref1 = owner == null ? void 0 : owner.orgId) != null ? _ref1 : '',
+            org: (_ref2 = owner == null ? void 0 : owner.org) != null ? _ref2 : null,
+            membership,
+            isManager: isPosManager(memberRole, membership),
+            settings,
+            hostRef
+        }
+    };
+}
+/** A register on this site, or a refusal: a register id from another site is unknown here. */ export async function readPosRegister(staff, rawRegisterId) {
+    var _snapshot_data;
+    const registerId = cleanId(rawRegisterId);
+    if (!registerId) return {
+        ok: false,
+        status: 400,
+        error: 'Missing registerId'
+    };
+    const ref = staff.hostRef.collection('registers').doc(registerId);
+    const snapshot = await ref.get();
+    if (!snapshot.exists) return {
+        ok: false,
+        status: 404,
+        error: 'Unknown register'
+    };
+    return {
+        ok: true,
+        ref,
+        data: (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {}
+    };
+}
+function signClaims(deps, payload) {
+    return createHmac('sha256', deps.signingSecret()).update(`pos-assertion:${payload}`).digest('hex');
+}
+export function mintPosAssertion(deps, input) {
+    const expiresAtMs = deps.now() + (input.purpose === 'manager' ? POS_MANAGER_ASSERTION_TTL_MS : POS_CASHIER_ASSERTION_TTL_MS);
+    const claims = {
+        v: 1,
+        h: input.hostId,
+        r: input.registerId,
+        u: input.memberUid,
+        p: input.purpose,
+        e: expiresAtMs
+    };
+    const payload = Buffer.from(JSON.stringify(claims)).toString('base64url');
+    return {
+        token: `${payload}.${signClaims(deps, payload)}`,
+        expiresAtMs
+    };
+}
+/**
+ * The member an assertion names, or `null` — for a forged, expired, wrong-site,
+ * wrong-register or wrong-purpose one alike. It does NOT re-check the member:
+ * {@link resolvePosStaffAssertion} does that.
+ */ export function readPosAssertion(deps, token, expected) {
+    const value = typeof token === 'string' ? token.trim() : '';
+    const dot = value.lastIndexOf('.');
+    if (dot <= 0 || value.length > 2000) return null;
+    const payload = value.slice(0, dot);
+    const signature = value.slice(dot + 1);
+    let expected64;
+    try {
+        expected64 = signClaims(deps, payload);
+    } catch (unused) {
+        return null;
+    }
+    const a = Buffer.from(signature);
+    const b = Buffer.from(expected64);
+    if (a.length !== b.length || !timingSafeEqual(new Uint8Array(a), new Uint8Array(b))) return null;
+    let claims;
+    try {
+        claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    } catch (unused) {
+        return null;
+    }
+    if ((claims == null ? void 0 : claims.v) !== 1 || claims.h !== expected.hostId || claims.r !== expected.registerId || claims.p !== expected.purpose || typeof claims.u !== 'string' || !claims.u || !(Number(claims.e) > deps.now())) {
+        return null;
+    }
+    return {
+        memberUid: claims.u,
+        expiresAtMs: Number(claims.e)
+    };
+}
+/**
+ * The member an assertion puts at the register, re-checked NOW against the
+ * site's roles and the organization's permissions — or `null` when the
+ * assertion is bad or the member may no longer do what it was minted for.
+ */ export async function resolvePosStaffAssertion(deps, hostRef, token, expected) {
+    var _host_get;
+    const read = readPosAssertion(deps, token, expected);
+    if (!read) return null;
+    const host = await hostRef.get();
+    const memberRole = ((_host_get = host.get('memberRoles')) != null ? _host_get : {})[read.memberUid];
+    const membership = await deps.membership(read.memberUid, expected.hostId);
+    const allowed = expected.purpose === 'manager' ? isPosManager(memberRole, membership) : mayWorkRegister(memberRole, membership);
+    return allowed ? read.memberUid : null;
+}
+/**
+ * Who rang this: the member a valid cashier assertion names, or the member
+ * signed in on the device when there is none or it no longer holds. The
+ * signed-in member already passed the gate, so the fallback never admits
+ * anybody new; it only decides whose name the sale carries.
+ */ export async function resolvePosCashier(deps, staff, registerId, token) {
+    if (token) {
+        const memberUid = await resolvePosStaffAssertion(deps, staff.hostRef, token, {
+            hostId: staff.hostId,
+            registerId,
+            purpose: 'cashier'
+        });
+        if (memberUid) return {
+            cashierId: memberUid,
+            via: 'pin'
+        };
+    }
+    return {
+        cashierId: staff.uid,
+        via: 'session'
+    };
+}
+
+//# sourceMappingURL=pos-ops-gate.js.map

package/src/lib/server/pos-ops-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-ops-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport type { PluginApiRequest } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost, getPluginConfig } from '@aglyn/tenant-data-admin'\nimport { findUserByUidAcrossPools } from '@aglyn/tenant-data-admin/server/auth-pools'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { createHmac, timingSafeEqual } from 'crypto'\nimport {\n  POS_CASHIER_ASSERTION_TTL_MS,\n  POS_MANAGER_ASSERTION_TTL_MS,\n} from '../model/commerce-pos-ops'\nimport type { PrintReport } from '../model/commerce-printers'\nimport { posOpsSettings, type PosOpsSettings } from '../pos-ops-config'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\n\n/*==========================================\n * WHO MAY RUN THE REGISTER (AGL-3609), for the shift, PIN, customer and\n * return routes.\n *\n * The same two facts the sale route checks: the member's role ON THIS SITE\n * is `admin` or `editor` (the allowlist the Firestore rules enforce), and the\n * organization has not revoked `managePos` from them. Plus the plan's `pos`\n * entitlement, re-read every time because a downgrade happens between taps.\n *\n * Every Firebase and Stripe touch goes through {@link PosOpsDeps}, so the\n * routes' specs run each money path against an in-memory store and a counted\n * fetch without mocking a module.\n *=========================================*/\n\nexport interface PosOpsMembership {\n  orgWide: boolean\n  hostRole: string | null\n  permissions: { managePos?: boolean }\n}\n\nexport interface PosOpsDeps {\n  firestore(): FirebaseFirestore.Firestore\n  verifyIdToken(token: string): Promise<{ uid: string }>\n  membership(uid: string, hostId: string): Promise<PosOpsMembership>\n  orgForHost(hostId: string): Promise<{ orgId: string; org: Record<string, any> | null } | null>\n  pluginConfig(orgId: string, hostId: string): Promise<Record<string, unknown>>\n  /** The plan includes the register. */\n  posEntitled(org: Record<string, any> | null): boolean\n  /** The HMAC secret staff assertions are signed with; throws when unset. */\n  signingSecret(): string\n  /** A member's name as a receipt or a report prints it. */\n  memberName(uid: string): Promise<string>\n  now(): number\n  /** Stripe's REST API; `global.fetch` in production. */\n  fetch: typeof fetch\n  /** The register's cloud printers (AGL-3619): drawer kicks and shift reports. */\n  printer: PosOpsPrinter\n}\n\n/** What the register's routes ask of the printer queue. Never throws. */\nexport interface PosOpsPrinter {\n  kickDrawer(input: {\n    hostId: string\n    registerId: string\n    reason: 'paid_in' | 'paid_out' | 'drop' | 'cash_refund'\n    causeId: string\n    createdBy?: string\n  }): Promise<{ jobIds: string[] }>\n  printReport(input: {\n    hostId: string\n    registerId: string\n    shiftId: string\n    report: PrintReport\n    createdBy?: string\n    attemptKey: string\n  }): Promise<{ jobIds: string[] }>\n}\n\nexport function defaultPosOpsDeps(): PosOpsDeps {\n  return {\n    firestore: () => firebaseAdmin.app().firestore(),\n    verifyIdToken: async (token) => {\n      const decoded = await firebaseAdmin.app().auth().verifyIdToken(token)\n      return { uid: decoded.uid }\n    },\n    membership: async (uid, hostId) => {\n      const resolved = await resolveOrgPermissions(uid, { hostId })\n      return {\n        orgWide: resolved.orgWide === true,\n        hostRole: resolved.hostRole ?? null,\n        permissions: { managePos: resolved.permissions?.managePos === true },\n      }\n    },\n    orgForHost: async (hostId) => {\n      const found = await getOrgForHost(hostId)\n      if (!found) return null\n      return {\n        orgId: String(found.org?.id ?? found.orgId ?? ''),\n        org: (found.org as Record<string, any>) ?? null,\n      }\n    },\n    pluginConfig: async (orgId, hostId) =>\n      ((await getPluginConfig(orgId, 'commerce', { hostId })) ?? {}) as Record<string, unknown>,\n    posEntitled: (org) => Aglyn.checkEntitlement(org as any, 'pos'),\n    signingSecret: () => {\n      const secret = process.env.TOKEN_SIGNING_SECRET\n      if (!secret) throw new Error('TOKEN_SIGNING_SECRET is not configured')\n      return secret\n    },\n    memberName: async (uid) => {\n      // Every pool: a member who signs in through SSO lives in a GCIP tenant\n      // pool, not the project one (AGL-1122).\n      try {\n        const user = (await findUserByUidAcrossPools(uid))?.record\n        return user?.displayName || user?.email || 'Staff member'\n      } catch {\n        return 'Staff member'\n      }\n    },\n    now: () => Date.now(),\n    fetch: (input, init) => fetch(input, init),\n    // Loaded on use: the printing module reaches the whole sale pipeline,\n    // which a shift count or a PIN check never needs.\n    printer: {\n      kickDrawer: async (input) => (await import('./pos-print')).kickPosDrawer(input),\n      printReport: async (input) => (await import('./pos-print')).printPosShiftReport(input),\n    },\n  }\n}\n\n/** A JSON body, whether the dispatcher parsed it or not. */\nexport function posOpsBody(req: PluginApiRequest): Record<string, any> {\n  if (typeof req.body === 'string') {\n    try {\n      const parsed = JSON.parse(req.body)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return req.body && typeof req.body === 'object' ? (req.body as Record<string, any>) : {}\n}\n\n/** The request's idempotency key, either header spelling, bounded. */\nexport function posOpsIdempotencyKey(req: PluginApiRequest): string {\n  return String(req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '')\n    .trim()\n    .slice(0, 200)\n}\n\n/** Who is at the register, once the gate admitted them. */\nexport interface PosOpsStaff {\n  uid: string\n  hostId: string\n  orgId: string\n  org: Record<string, any> | null\n  membership: PosOpsMembership\n  /** An admin of the whole workspace: the one role with no refund limit. */\n  isManager: boolean\n  settings: PosOpsSettings\n  hostRef: FirebaseFirestore.DocumentReference\n}\n\nexport type PosOpsGate =\n  | { ok: true; staff: PosOpsStaff }\n  | { ok: false; status: number; error: string }\n\n/** A site id the dispatcher's own sentinels and path tricks cannot pass for. */\nfunction cleanId(value: unknown): string {\n  const id = String(value ?? '').trim()\n  return /^[A-Za-z0-9_-]{1,128}$/.test(id) && !/^__.*__$/.test(id) ? id : ''\n}\n\nexport { cleanId as posOpsCleanId }\n\n/** Whether a member may work this site's register, by role and permission. */\nexport function mayWorkRegister(memberRole: unknown, membership: PosOpsMembership): boolean {\n  return (memberRole === 'admin' || memberRole === 'editor') && membership.permissions.managePos === true\n}\n\n/**\n * The one role whose say-so a refund above the cashier limit needs: an admin\n * of the whole workspace who is also this site's admin — the role\n * `refund.ts` has always required to refund at all.\n */\nexport function isPosManager(memberRole: unknown, membership: PosOpsMembership): boolean {\n  return memberRole === 'admin' && membership.orgWide && membership.hostRole === 'admin'\n}\n\nexport async function authorizePosOps(\n  deps: PosOpsDeps,\n  req: PluginApiRequest,\n  rawHostId: unknown,\n): Promise<PosOpsGate> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : ''\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  const hostId = cleanId(rawHostId)\n  if (!hostId) return { ok: false, status: 400, error: 'Missing hostId' }\n  let uid: string\n  try {\n    uid = (await deps.verifyIdToken(idToken)).uid\n  } catch (error) {\n    if (!isRefusedIdToken(error)) throw error\n    return { ok: false, status: 401, error: 'Unauthenticated' }\n  }\n  const hostRef = deps.firestore().collection('hosts').doc(hostId)\n  const hostSnapshot = await hostRef.get()\n  if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  const membership = await deps.membership(uid, hostId)\n  if (!mayWorkRegister(memberRole, membership)) {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  const owner = await deps.orgForHost(hostId)\n  if (!deps.posEntitled(owner?.org ?? null)) {\n    return { ok: false, status: 403, error: 'POS requires the Pro plan or above' }\n  }\n  const settings = posOpsSettings(\n    owner?.orgId ? await deps.pluginConfig(owner.orgId, hostId).catch(() => ({})) : {},\n  )\n  return {\n    ok: true,\n    staff: {\n      uid,\n      hostId,\n      orgId: owner?.orgId ?? '',\n      org: owner?.org ?? null,\n      membership,\n      isManager: isPosManager(memberRole, membership),\n      settings,\n      hostRef,\n    },\n  }\n}\n\n/** A register on this site, or a refusal: a register id from another site is unknown here. */\nexport async function readPosRegister(\n  staff: PosOpsStaff,\n  rawRegisterId: unknown,\n): Promise<\n  | { ok: true; ref: FirebaseFirestore.DocumentReference; data: Record<string, any> }\n  | { ok: false; status: number; error: string }\n> {\n  const registerId = cleanId(rawRegisterId)\n  if (!registerId) return { ok: false, status: 400, error: 'Missing registerId' }\n  const ref = staff.hostRef.collection('registers').doc(registerId)\n  const snapshot = await ref.get()\n  if (!snapshot.exists) return { ok: false, status: 404, error: 'Unknown register' }\n  return { ok: true, ref, data: (snapshot.data() ?? {}) as Record<string, any> }\n}\n\n/*==========================================\n * STAFF ASSERTIONS: what a PIN buys.\n *\n * A PIN never signs anybody in. It mints a short-lived, signed statement\n * that one member of THIS site is at THIS register — `{hostId, registerId,\n * memberUid, purpose, expiry}` under an HMAC — and the routes that take one\n * re-check that member's role and `managePos` on every use, so a PIN never\n * carries more than its member holds right now, and a revoked member's\n * assertion stops working on the next tap rather than at expiry.\n *=========================================*/\n\nexport type PosAssertionPurpose = 'cashier' | 'manager'\n\ninterface AssertionClaims {\n  v: 1\n  h: string\n  r: string\n  u: string\n  p: PosAssertionPurpose\n  e: number\n}\n\nfunction signClaims(deps: PosOpsDeps, payload: string): string {\n  return createHmac('sha256', deps.signingSecret()).update(`pos-assertion:${payload}`).digest('hex')\n}\n\nexport function mintPosAssertion(\n  deps: PosOpsDeps,\n  input: { hostId: string; registerId: string; memberUid: string; purpose: PosAssertionPurpose },\n): { token: string; expiresAtMs: number } {\n  const expiresAtMs =\n    deps.now() +\n    (input.purpose === 'manager' ? POS_MANAGER_ASSERTION_TTL_MS : POS_CASHIER_ASSERTION_TTL_MS)\n  const claims: AssertionClaims = {\n    v: 1,\n    h: input.hostId,\n    r: input.registerId,\n    u: input.memberUid,\n    p: input.purpose,\n    e: expiresAtMs,\n  }\n  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url')\n  return { token: `${payload}.${signClaims(deps, payload)}`, expiresAtMs }\n}\n\n/**\n * The member an assertion names, or `null` — for a forged, expired, wrong-site,\n * wrong-register or wrong-purpose one alike. It does NOT re-check the member:\n * {@link resolvePosStaffAssertion} does that.\n */\nexport function readPosAssertion(\n  deps: PosOpsDeps,\n  token: unknown,\n  expected: { hostId: string; registerId: string; purpose: PosAssertionPurpose },\n): { memberUid: string; expiresAtMs: number } | null {\n  const value = typeof token === 'string' ? token.trim() : ''\n  const dot = value.lastIndexOf('.')\n  if (dot <= 0 || value.length > 2000) return null\n  const payload = value.slice(0, dot)\n  const signature = value.slice(dot + 1)\n  let expected64: string\n  try {\n    expected64 = signClaims(deps, payload)\n  } catch {\n    return null\n  }\n  const a = Buffer.from(signature)\n  const b = Buffer.from(expected64)\n  if (a.length !== b.length || !timingSafeEqual(new Uint8Array(a), new Uint8Array(b))) return null\n  let claims: AssertionClaims\n  try {\n    claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'))\n  } catch {\n    return null\n  }\n  if (\n    claims?.v !== 1 ||\n    claims.h !== expected.hostId ||\n    claims.r !== expected.registerId ||\n    claims.p !== expected.purpose ||\n    typeof claims.u !== 'string' ||\n    !claims.u ||\n    !(Number(claims.e) > deps.now())\n  ) {\n    return null\n  }\n  return { memberUid: claims.u, expiresAtMs: Number(claims.e) }\n}\n\n/**\n * The member an assertion puts at the register, re-checked NOW against the\n * site's roles and the organization's permissions — or `null` when the\n * assertion is bad or the member may no longer do what it was minted for.\n */\nexport async function resolvePosStaffAssertion(\n  deps: PosOpsDeps,\n  hostRef: FirebaseFirestore.DocumentReference,\n  token: unknown,\n  expected: { hostId: string; registerId: string; purpose: PosAssertionPurpose },\n): Promise<string | null> {\n  const read = readPosAssertion(deps, token, expected)\n  if (!read) return null\n  const host = await hostRef.get()\n  const memberRole = (host.get('memberRoles') ?? {})[read.memberUid]\n  const membership = await deps.membership(read.memberUid, expected.hostId)\n  const allowed =\n    expected.purpose === 'manager'\n      ? isPosManager(memberRole, membership)\n      : mayWorkRegister(memberRole, membership)\n  return allowed ? read.memberUid : null\n}\n\n/**\n * Who rang this: the member a valid cashier assertion names, or the member\n * signed in on the device when there is none or it no longer holds. The\n * signed-in member already passed the gate, so the fallback never admits\n * anybody new; it only decides whose name the sale carries.\n */\nexport async function resolvePosCashier(\n  deps: PosOpsDeps,\n  staff: Pick<PosOpsStaff, 'uid' | 'hostId' | 'hostRef'>,\n  registerId: string,\n  token: unknown,\n): Promise<{ cashierId: string; via: 'pin' | 'session' }> {\n  if (token) {\n    const memberUid = await resolvePosStaffAssertion(deps, staff.hostRef, token, {\n      hostId: staff.hostId,\n      registerId,\n      purpose: 'cashier',\n    })\n    if (memberUid) return { cashierId: memberUid, via: 'pin' }\n  }\n  return { cashierId: staff.uid, via: 'session' }\n}\n"],"names":["Aglyn","firebaseAdmin","getOrgForHost","getPluginConfig","findUserByUidAcrossPools","resolveOrgPermissions","createHmac","timingSafeEqual","POS_CASHIER_ASSERTION_TTL_MS","POS_MANAGER_ASSERTION_TTL_MS","posOpsSettings","isRefusedIdToken","defaultPosOpsDeps","firestore","app","verifyIdToken","token","decoded","auth","uid","membership","hostId","resolved","orgWide","hostRole","permissions","managePos","orgForHost","found","orgId","String","org","id","pluginConfig","posEntitled","checkEntitlement","signingSecret","secret","process","env","TOKEN_SIGNING_SECRET","Error","memberName","user","record","displayName","email","now","Date","fetch","input","init","printer","kickDrawer","kickPosDrawer","printReport","printPosShiftReport","posOpsBody","req","body","parsed","JSON","parse","posOpsIdempotencyKey","headers","trim","slice","cleanId","value","test","posOpsCleanId","mayWorkRegister","memberRole","isPosManager","authorizePosOps","deps","rawHostId","hostSnapshot","authorization","idToken","startsWith","length","ok","status","error","hostRef","collection","doc","get","exists","owner","settings","catch","staff","isManager","readPosRegister","rawRegisterId","snapshot","registerId","ref","data","signClaims","payload","update","digest","mintPosAssertion","expiresAtMs","purpose","claims","v","h","r","u","memberUid","p","e","Buffer","from","stringify","toString","readPosAssertion","expected","dot","lastIndexOf","signature","expected64","a","b","Uint8Array","Number","resolvePosStaffAssertion","host","read","allowed","resolvePosCashier","cashierId","via"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAE5C,SAASC,aAAa,EAAEC,aAAa,EAAEC,eAAe,QAAQ,2BAA0B;AACxF,SAASC,wBAAwB,QAAQ,6CAA4C;AACrF,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,UAAU,EAAEC,eAAe,QAAQ,SAAQ;AACpD,SACEC,4BAA4B,EAC5BC,4BAA4B,QACvB,+BAA2B;AAElC,SAASC,cAAc,QAA6B,uBAAmB;AACvE,SAASC,gBAAgB,QAAQ,mDAAkD;AA4DnF,OAAO,SAASC;IACd,OAAO;QACLC,WAAW,IAAMZ,cAAca,GAAG,GAAGD,SAAS;QAC9CE,eAAe,OAAOC;YACpB,MAAMC,UAAU,MAAMhB,cAAca,GAAG,GAAGI,IAAI,GAAGH,aAAa,CAACC;YAC/D,OAAO;gBAAEG,KAAKF,QAAQE,GAAG;YAAC;QAC5B;QACAC,YAAY,OAAOD,KAAKE;gBAIVC;gBACgBA;YAJ5B,MAAMA,WAAW,MAAMjB,sBAAsBc,KAAK;gBAAEE;YAAO;YAC3D,OAAO;gBACLE,SAASD,SAASC,OAAO,KAAK;gBAC9BC,QAAQ,GAAEF,qBAAAA,SAASE,QAAQ,YAAjBF,qBAAqB;gBAC/BG,aAAa;oBAAEC,WAAWJ,EAAAA,wBAAAA,SAASG,WAAW,qBAApBH,sBAAsBI,SAAS,MAAK;gBAAK;YACrE;QACF;QACAC,YAAY,OAAON;gBAIDO,aACRA;gBADQA;YAHhB,MAAMA,QAAQ,MAAM1B,cAAcmB;YAClC,IAAI,CAACO,OAAO,OAAO;YACnB,OAAO;gBACLC,OAAOC,QAAOF,iBAAAA,cAAAA,MAAMG,GAAG,qBAATH,YAAWI,EAAE,oBAAIJ,MAAMC,KAAK,YAA5BD,OAAgC;gBAC9CG,GAAG,GAAGH,aAAAA,MAAMG,GAAG,YAATH,aAAqC;YAC7C;QACF;QACAK,cAAc,OAAOJ,OAAOR;gBACxB;oBAAA,OAAA,MAAMlB,gBAAgB0B,OAAO,YAAY;gBAAER;YAAO,cAAlD,OAAyD,CAAC;;QAC9Da,aAAa,CAACH,MAAQ/B,MAAMmC,gBAAgB,CAACJ,KAAY;QACzDK,eAAe;YACb,MAAMC,SAASC,QAAQC,GAAG,CAACC,oBAAoB;YAC/C,IAAI,CAACH,QAAQ,MAAM,IAAII,MAAM;YAC7B,OAAOJ;QACT;QACAK,YAAY,OAAOvB;YACjB,uEAAuE;YACvE,wCAAwC;YACxC,IAAI;oBACY;gBAAd,MAAMwB,QAAQ,QAAA,MAAMvC,yBAAyBe,yBAAhC,AAAC,MAAsCyB,MAAM;gBAC1D,OAAOD,CAAAA,wBAAAA,KAAME,WAAW,MAAIF,wBAAAA,KAAMG,KAAK,KAAI;YAC7C,EAAE,eAAM;gBACN,OAAO;YACT;QACF;QACAC,KAAK,IAAMC,KAAKD,GAAG;QACnBE,OAAO,CAACC,OAAOC,OAASF,MAAMC,OAAOC;QACrC,sEAAsE;QACtE,kDAAkD;QAClDC,SAAS;YACPC,YAAY,OAAOH,QAAU,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGI,aAAa,CAACJ;YACzEK,aAAa,OAAOL,QAAU,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGM,mBAAmB,CAACN;QAClF;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASO,WAAWC,GAAqB;IAC9C,IAAI,OAAOA,IAAIC,IAAI,KAAK,UAAU;QAChC,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACJ,IAAIC,IAAI;YAClC,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOF,IAAIC,IAAI,IAAI,OAAOD,IAAIC,IAAI,KAAK,WAAYD,IAAIC,IAAI,GAA2B,CAAC;AACzF;AAEA,oEAAoE,GACpE,OAAO,SAASI,qBAAqBL,GAAqB;QAC1CA,MAAAA;IAAd,OAAO5B,QAAO4B,QAAAA,8BAAAA,IAAIM,OAAO,CAAC,kBAAkB,YAA9BN,8BAAkCA,IAAIM,OAAO,CAAC,kBAAkB,YAAhEN,OAAoE,IAC/EO,IAAI,GACJC,KAAK,CAAC,GAAG;AACd;AAmBA,8EAA8E,GAC9E,SAASC,QAAQC,KAAc;IAC7B,MAAMpC,KAAKF,OAAOsC,gBAAAA,QAAS,IAAIH,IAAI;IACnC,OAAO,yBAAyBI,IAAI,CAACrC,OAAO,CAAC,WAAWqC,IAAI,CAACrC,MAAMA,KAAK;AAC1E;AAEA,SAASmC,WAAWG,aAAa,GAAE;AAEnC,4EAA4E,GAC5E,OAAO,SAASC,gBAAgBC,UAAmB,EAAEpD,UAA4B;IAC/E,OAAO,AAACoD,CAAAA,eAAe,WAAWA,eAAe,QAAO,KAAMpD,WAAWK,WAAW,CAACC,SAAS,KAAK;AACrG;AAEA;;;;CAIC,GACD,OAAO,SAAS+C,aAAaD,UAAmB,EAAEpD,UAA4B;IAC5E,OAAOoD,eAAe,WAAWpD,WAAWG,OAAO,IAAIH,WAAWI,QAAQ,KAAK;AACjF;AAEA,OAAO,eAAekD,gBACpBC,IAAgB,EAChBjB,GAAqB,EACrBkB,SAAkB;QAEWlB,4BAeTmB;IAfpB,MAAMC,gBAAgBhD,QAAO4B,6BAAAA,IAAIM,OAAO,CAACc,aAAa,YAAzBpB,6BAA6B;IAC1D,MAAMqB,UAAUD,cAAcE,UAAU,CAAC,aAAaF,cAAcZ,KAAK,CAAC,UAAUe,MAAM,IAAI;IAC9F,IAAI,CAACF,SAAS,OAAO;QAAEG,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,MAAM/D,SAAS8C,QAAQS;IACvB,IAAI,CAACvD,QAAQ,OAAO;QAAE6D,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAiB;IACtE,IAAIjE;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAMwD,KAAK5D,aAAa,CAACgE,QAAO,EAAG5D,GAAG;IAC/C,EAAE,OAAOiE,OAAO;QACd,IAAI,CAACzE,iBAAiByE,QAAQ,MAAMA;QACpC,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;IAC5D;IACA,MAAMC,UAAUV,KAAK9D,SAAS,GAAGyE,UAAU,CAAC,SAASC,GAAG,CAAClE;IACzD,MAAMwD,eAAe,MAAMQ,QAAQG,GAAG;IACtC,IAAI,CAACX,aAAaY,MAAM,EAAE,OAAO;QAAEP,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACjF,MAAMZ,aAAa,EAACK,oBAAAA,aAAaW,GAAG,CAAC,0BAAjBX,oBAAmC,CAAC,EAAE,CAAC1D,IAAI;IAC/D,MAAMC,aAAa,MAAMuD,KAAKvD,UAAU,CAACD,KAAKE;IAC9C,IAAI,CAACkD,gBAAgBC,YAAYpD,aAAa;QAC5C,OAAO;YAAE8D,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,MAAMM,QAAQ,MAAMf,KAAKhD,UAAU,CAACN;IACpC,IAAI,CAACsD,KAAKzC,WAAW,SAACwD,yBAAAA,MAAO3D,GAAG,mBAAI,OAAO;QACzC,OAAO;YAAEmD,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAqC;IAC/E;IACA,MAAMO,WAAWjF,eACfgF,CAAAA,yBAAAA,MAAO7D,KAAK,IAAG,MAAM8C,KAAK1C,YAAY,CAACyD,MAAM7D,KAAK,EAAER,QAAQuE,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA,KAAM,CAAC;IAEnF,OAAO;QACLV,IAAI;QACJW,OAAO;YACL1E;YACAE;YACAQ,KAAK,WAAE6D,yBAAAA,MAAO7D,KAAK,oBAAI;YACvBE,GAAG,WAAE2D,yBAAAA,MAAO3D,GAAG,oBAAI;YACnBX;YACA0E,WAAWrB,aAAaD,YAAYpD;YACpCuE;YACAN;QACF;IACF;AACF;AAEA,4FAA4F,GAC5F,OAAO,eAAeU,gBACpBF,KAAkB,EAClBG,aAAsB;QAUSC;IAL/B,MAAMC,aAAa/B,QAAQ6B;IAC3B,IAAI,CAACE,YAAY,OAAO;QAAEhB,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAqB;IAC9E,MAAMe,MAAMN,MAAMR,OAAO,CAACC,UAAU,CAAC,aAAaC,GAAG,CAACW;IACtD,MAAMD,WAAW,MAAME,IAAIX,GAAG;IAC9B,IAAI,CAACS,SAASR,MAAM,EAAE,OAAO;QAAEP,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAmB;IACjF,OAAO;QAAEF,IAAI;QAAMiB;QAAKC,IAAI,GAAGH,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,CAAC;IAA0B;AAC/E;AAwBA,SAASI,WAAW1B,IAAgB,EAAE2B,OAAe;IACnD,OAAOhG,WAAW,UAAUqE,KAAKvC,aAAa,IAAImE,MAAM,CAAC,CAAC,cAAc,EAAED,SAAS,EAAEE,MAAM,CAAC;AAC9F;AAEA,OAAO,SAASC,iBACd9B,IAAgB,EAChBzB,KAA8F;IAE9F,MAAMwD,cACJ/B,KAAK5B,GAAG,KACPG,CAAAA,MAAMyD,OAAO,KAAK,YAAYlG,+BAA+BD,4BAA2B;IAC3F,MAAMoG,SAA0B;QAC9BC,GAAG;QACHC,GAAG5D,MAAM7B,MAAM;QACf0F,GAAG7D,MAAMgD,UAAU;QACnBc,GAAG9D,MAAM+D,SAAS;QAClBC,GAAGhE,MAAMyD,OAAO;QAChBQ,GAAGT;IACL;IACA,MAAMJ,UAAUc,OAAOC,IAAI,CAACxD,KAAKyD,SAAS,CAACV,SAASW,QAAQ,CAAC;IAC7D,OAAO;QAAEvG,OAAO,GAAGsF,QAAQ,CAAC,EAAED,WAAW1B,MAAM2B,UAAU;QAAEI;IAAY;AACzE;AAEA;;;;CAIC,GACD,OAAO,SAASc,iBACd7C,IAAgB,EAChB3D,KAAc,EACdyG,QAA8E;IAE9E,MAAMrD,QAAQ,OAAOpD,UAAU,WAAWA,MAAMiD,IAAI,KAAK;IACzD,MAAMyD,MAAMtD,MAAMuD,WAAW,CAAC;IAC9B,IAAID,OAAO,KAAKtD,MAAMa,MAAM,GAAG,MAAM,OAAO;IAC5C,MAAMqB,UAAUlC,MAAMF,KAAK,CAAC,GAAGwD;IAC/B,MAAME,YAAYxD,MAAMF,KAAK,CAACwD,MAAM;IACpC,IAAIG;IACJ,IAAI;QACFA,aAAaxB,WAAW1B,MAAM2B;IAChC,EAAE,eAAM;QACN,OAAO;IACT;IACA,MAAMwB,IAAIV,OAAOC,IAAI,CAACO;IACtB,MAAMG,IAAIX,OAAOC,IAAI,CAACQ;IACtB,IAAIC,EAAE7C,MAAM,KAAK8C,EAAE9C,MAAM,IAAI,CAAC1E,gBAAgB,IAAIyH,WAAWF,IAAI,IAAIE,WAAWD,KAAK,OAAO;IAC5F,IAAInB;IACJ,IAAI;QACFA,SAAS/C,KAAKC,KAAK,CAACsD,OAAOC,IAAI,CAACf,SAAS,aAAaiB,QAAQ,CAAC;IACjE,EAAE,eAAM;QACN,OAAO;IACT;IACA,IACEX,CAAAA,0BAAAA,OAAQC,CAAC,MAAK,KACdD,OAAOE,CAAC,KAAKW,SAASpG,MAAM,IAC5BuF,OAAOG,CAAC,KAAKU,SAASvB,UAAU,IAChCU,OAAOM,CAAC,KAAKO,SAASd,OAAO,IAC7B,OAAOC,OAAOI,CAAC,KAAK,YACpB,CAACJ,OAAOI,CAAC,IACT,CAAEiB,CAAAA,OAAOrB,OAAOO,CAAC,IAAIxC,KAAK5B,GAAG,EAAC,GAC9B;QACA,OAAO;IACT;IACA,OAAO;QAAEkE,WAAWL,OAAOI,CAAC;QAAEN,aAAauB,OAAOrB,OAAOO,CAAC;IAAE;AAC9D;AAEA;;;;CAIC,GACD,OAAO,eAAee,yBACpBvD,IAAgB,EAChBU,OAA4C,EAC5CrE,KAAc,EACdyG,QAA8E;QAK1DU;IAHpB,MAAMC,OAAOZ,iBAAiB7C,MAAM3D,OAAOyG;IAC3C,IAAI,CAACW,MAAM,OAAO;IAClB,MAAMD,OAAO,MAAM9C,QAAQG,GAAG;IAC9B,MAAMhB,aAAa,EAAC2D,YAAAA,KAAK3C,GAAG,CAAC,0BAAT2C,YAA2B,CAAC,EAAE,CAACC,KAAKnB,SAAS,CAAC;IAClE,MAAM7F,aAAa,MAAMuD,KAAKvD,UAAU,CAACgH,KAAKnB,SAAS,EAAEQ,SAASpG,MAAM;IACxE,MAAMgH,UACJZ,SAASd,OAAO,KAAK,YACjBlC,aAAaD,YAAYpD,cACzBmD,gBAAgBC,YAAYpD;IAClC,OAAOiH,UAAUD,KAAKnB,SAAS,GAAG;AACpC;AAEA;;;;;CAKC,GACD,OAAO,eAAeqB,kBACpB3D,IAAgB,EAChBkB,KAAsD,EACtDK,UAAkB,EAClBlF,KAAc;IAEd,IAAIA,OAAO;QACT,MAAMiG,YAAY,MAAMiB,yBAAyBvD,MAAMkB,MAAMR,OAAO,EAAErE,OAAO;YAC3EK,QAAQwE,MAAMxE,MAAM;YACpB6E;YACAS,SAAS;QACX;QACA,IAAIM,WAAW,OAAO;YAAEsB,WAAWtB;YAAWuB,KAAK;QAAM;IAC3D;IACA,OAAO;QAAED,WAAW1C,MAAM1E,GAAG;QAAEqH,KAAK;IAAU;AAChD"}

package/src/lib/server/pos-ops-routes.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The register's operations routes (AGL-3609): shifts and the drawer, staff
+ * PINs, the customer lookup and returns, plus the sale printing. Console-auth,
+ * so they register on the console surface with the sale route itself.
+ */
+export declare function registerPosOpsRoutes(): void;

package/src/lib/server/pos-ops-routes.js

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginApiRoute } from "@aglyn/aglyn/server";
+import { posCustomerHandler } from "./pos-customer.js";
+import { registerPosSalePrinting } from "./pos-print.js";
+import { posReturnHandler } from "./pos-return.js";
+import { posShiftHandler } from "./pos-shift.js";
+import { posStaffPinHandler } from "./pos-staff-pin.js";
+/**
+ * The register's operations routes (AGL-3609): shifts and the drawer, staff
+ * PINs, the customer lookup and returns, plus the sale printing. Console-auth,
+ * so they register on the console surface with the sale route itself.
+ */ export function registerPosOpsRoutes() {
+    registerPluginApiRoute('commerce/pos-shift', posShiftHandler);
+    registerPluginApiRoute('commerce/pos-staff-pin', posStaffPinHandler);
+    registerPluginApiRoute('commerce/pos-customer', posCustomerHandler);
+    registerPluginApiRoute('commerce/pos-return', posReturnHandler);
+    // A completed sale's receipt and drawer kick on the register's cloud
+    // printers (AGL-3619), through the sale-completed seam every path fires.
+    registerPosSalePrinting();
+}
+
+//# sourceMappingURL=pos-ops-routes.js.map

package/src/lib/server/pos-ops-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-ops-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { posCustomerHandler } from './pos-customer'\nimport { registerPosSalePrinting } from './pos-print'\nimport { posReturnHandler } from './pos-return'\nimport { posShiftHandler } from './pos-shift'\nimport { posStaffPinHandler } from './pos-staff-pin'\n\n/**\n * The register's operations routes (AGL-3609): shifts and the drawer, staff\n * PINs, the customer lookup and returns, plus the sale printing. Console-auth,\n * so they register on the console surface with the sale route itself.\n */\nexport function registerPosOpsRoutes(): void {\n  registerPluginApiRoute('commerce/pos-shift', posShiftHandler)\n  registerPluginApiRoute('commerce/pos-staff-pin', posStaffPinHandler)\n  registerPluginApiRoute('commerce/pos-customer', posCustomerHandler)\n  registerPluginApiRoute('commerce/pos-return', posReturnHandler)\n  // A completed sale's receipt and drawer kick on the register's cloud\n  // printers (AGL-3619), through the sale-completed seam every path fires.\n  registerPosSalePrinting()\n}\n"],"names":["registerPluginApiRoute","posCustomerHandler","registerPosSalePrinting","posReturnHandler","posShiftHandler","posStaffPinHandler","registerPosOpsRoutes"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,kBAAkB,QAAQ,oBAAgB;AACnD,SAASC,uBAAuB,QAAQ,iBAAa;AACrD,SAASC,gBAAgB,QAAQ,kBAAc;AAC/C,SAASC,eAAe,QAAQ,iBAAa;AAC7C,SAASC,kBAAkB,QAAQ,qBAAiB;AAEpD;;;;CAIC,GACD,OAAO,SAASC;IACdN,uBAAuB,sBAAsBI;IAC7CJ,uBAAuB,0BAA0BK;IACjDL,uBAAuB,yBAAyBC;IAChDD,uBAAuB,uBAAuBG;IAC9C,qEAAqE;IACrE,yEAAyE;IACzED;AACF"}

package/src/lib/server/pos-order.d.ts

@@ -34,21 +34,4 @@ import { type PluginApiHandler } from '@aglyn/aglyn/server';
  * and sales can post to an open reservation folio instead (AGL-317).
  */
 export declare const posOrderHandler: PluginApiHandler;
-/**
- * The billing month a non-card POS fee accrues into (AGL-2111): `YYYY-MM` in
- * **UTC**, byte-identical to the key `apps/console/utils/billing-month.ts`
- * mints and to the twelve other month counters on the platform
- * (`orgs/{id}/apiUsage/*`, `orgs/{id}/assistUsage/*`, the per-host counters).
- *
- * It has to be UTC and it has to be this exact expression: `report-usage`
- * sweeps `previousMonth()` in UTC and reads the accrual document by that key,
- * so a local-time month would strand every sale rung in the offset window on a
- * document no sweep ever looks at — which is uncollected revenue that leaves
- * no trace. `offline-pos-fee-month-key.spec.ts` pins the two against each
- * other rather than trusting the comment.
- *
- * Local rather than imported because `apps/console` is an app: a plugin
- * library cannot import from it, and the repo's other eleven copies of this
- * one-liner are the established shape.
- */
-export declare function offlineFeeMonthKey(now?: Date): string;
+export { offlineFeeMonthKey } from './pos-fee-month';