@aglyn/plugins-commerce 1.0.0-beta.230 → 1.0.0-beta.232

package/src/lib/server/returns.js

@@ -0,0 +1,938 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn/server";
+import { createResourceUid } from "@aglyn/aglyn/app-utils/create-resource-uid";
+import { findUserByUidAcrossPools, firebaseAdmin, getOrgForHost, hostSendingIdentity, meterHostEmail, notifyHostManagers, renderHostEmailWithTokens } from "@aglyn/tenant-data-admin";
+import { isEmailConfigured, sendEmail } from "@aglyn/shared-util-email";
+import * as CommerceModel from "../model/index.js";
+import { RETURN_APPROVED_EVENT, RETURN_DECLINED_EVENT, RETURN_RECEIVED_EVENT, RETURN_REFUNDED_EVENT, RETURN_REQUESTED_EVENT } from "../model/order-events.js";
+import { raiseOrderEvent, stageOrderEvent } from "./order-events.js";
+import { orderStatusUrl, verifyOrderStatusToken } from "./order-status-token.js";
+import { readActiveMemberSession } from "./membership.js";
+import { resolveTrackedRestockLines } from "./restock-flag.js";
+import { refundHandler } from "./refund.js";
+const hostRefFor = (firestore, hostId)=>firestore.collection('hosts').doc(hostId);
+const isId = (value)=>Boolean(value) && value.length <= 200 && !/^__.*__$/.test(value) && !value.includes('/');
+/** The store's settings document and what the return emails need from the host. */ async function readStore(firestore, hostId) {
+    var _ref, _ref1, _settings_currency;
+    const hostRef = hostRefFor(firestore, hostId);
+    const [host, store] = await Promise.all([
+        hostRef.get().catch(()=>null),
+        hostRef.collection('settings').doc('store').get().catch(()=>null)
+    ]);
+    const settings = (_ref = store == null ? void 0 : store.data()) != null ? _ref : {};
+    return {
+        host: (_ref1 = host == null ? void 0 : host.data()) != null ? _ref1 : {},
+        returnSettings: CommerceModel.readReturnSettings(settings['returns']),
+        currency: String((_settings_currency = settings['currency']) != null ? _settings_currency : 'USD').toUpperCase()
+    };
+}
+function money(cents, currency) {
+    try {
+        return new Intl.NumberFormat('en-US', {
+            style: 'currency',
+            currency
+        }).format(cents / 100);
+    } catch (unused) {
+        return `$${(cents / 100).toFixed(2)}`;
+    }
+}
+/** The return as an event carries it. */ function returnEventView(id, entry) {
+    var _entry_refundCents;
+    return {
+        id,
+        status: entry.status,
+        lines: entry.lines.map((line)=>_extends({}, line)),
+        refundCents: (_entry_refundCents = entry.refundCents) != null ? _entry_refundCents : null,
+        restock: entry.restock ? entry.restock.lines.map((line)=>_extends({}, line)) : null
+    };
+}
+/** "1× House Blend — Arrived damaged", one per line. */ function returnItemsText(order, entry) {
+    return entry.lines.map((line)=>{
+        var _ref, _CommerceModel_RETURN_REASON_LABELS_line_reason;
+        var _order_lineItems_line_lineItemId, _order_lineItems;
+        return `${line.quantity}× ${(_ref = (_order_lineItems = order.lineItems) == null ? void 0 : (_order_lineItems_line_lineItemId = _order_lineItems[line.lineItemId]) == null ? void 0 : _order_lineItems_line_lineItemId.name) != null ? _ref : `line ${line.lineItemId}`} — ${(_CommerceModel_RETURN_REASON_LABELS_line_reason = CommerceModel.RETURN_REASON_LABELS[line.reason]) != null ? _CommerceModel_RETURN_REASON_LABELS_line_reason : line.reason}`;
+    }).join('\n');
+}
+/**
+ * Opens a return. A buyer's starts `requested`; a merchant's starts
+ * `approved`, since the merchant asking is the approval.
+ */ export async function openReturn(request) {
+    var _request_now, _request_note;
+    const firestore = firebaseAdmin.app().firestore();
+    const hostRef = hostRefFor(firestore, request.hostId);
+    const orderRef = hostRef.collection('orders').doc(request.orderId);
+    const { returnSettings } = await readStore(firestore, request.hostId);
+    const now = (_request_now = request.now) != null ? _request_now : Date.now();
+    const note = String((_request_note = request.note) != null ? _request_note : '').trim().slice(0, CommerceModel.RETURN_NOTE_MAX);
+    return firestore.runTransaction(async (transaction)=>{
+        var _orderSnapshot_data, _order_customerEmail, _order_customerName;
+        const orderSnapshot = await transaction.get(orderRef);
+        if (!orderSnapshot.exists) return {
+            outcome: 'no_such_order'
+        };
+        const existing = await transaction.get(hostRef.collection('returns').where('orderId', '==', request.orderId));
+        const order = CommerceModel.liftLegacyOrder((_orderSnapshot_data = orderSnapshot.data()) != null ? _orderSnapshot_data : {});
+        const verdict = CommerceModel.validateReturnRequest({
+            order,
+            existing: existing.docs.map((entry)=>entry.data()),
+            settings: returnSettings,
+            lines: request.lines,
+            by: request.by,
+            now
+        });
+        if (!('lines' in verdict)) {
+            return {
+                outcome: 'refused',
+                message: CommerceModel.describeReturnRequestProblem(verdict)
+            };
+        }
+        const status = request.by === 'merchant' ? 'approved' : 'requested';
+        const entry = _extends({
+            orderId: request.orderId,
+            orderNumber: CommerceModel.returnOrderNumber(order, request.orderId),
+            customerEmail: (_order_customerEmail = order.customerEmail) != null ? _order_customerEmail : null,
+            customerName: (_order_customerName = order.customerName) != null ? _order_customerName : null,
+            lines: verdict.lines.map((line)=>{
+                var _ref;
+                var _order_lineItems_line_lineItemId, _order_lineItems;
+                return _extends({}, line, {
+                    name: String((_ref = (_order_lineItems = order.lineItems) == null ? void 0 : (_order_lineItems_line_lineItemId = _order_lineItems[line.lineItemId]) == null ? void 0 : _order_lineItems_line_lineItemId.name) != null ? _ref : '').slice(0, 200)
+                });
+            }),
+            status,
+            requestedBy: request.by
+        }, note ? request.by === 'buyer' ? {
+            customerNote: note
+        } : {
+            merchantNote: note
+        } : {}, {
+            timeline: [
+                {
+                    atMs: now,
+                    event: status,
+                    detail: `${request.by === 'buyer' ? 'Requested by the buyer' : 'Opened by the store'}: ${CommerceModel.describeReturnLines(order, verdict.lines)}`
+                }
+            ],
+            createdAtMs: now,
+            updatedAtMs: now
+        });
+        const returnRef = hostRef.collection('returns').doc(createResourceUid());
+        transaction.create(returnRef, entry);
+        const orderPatch = {
+            timeline: CommerceModel.appendOrderEvent(order, 'return-requested', CommerceModel.describeReturnLines(order, verdict.lines), now)
+        };
+        transaction.update(orderRef, orderPatch);
+        stageOrderEvent(transaction, RETURN_REQUESTED_EVENT, {
+            hostId: request.hostId,
+            orderId: request.orderId,
+            key: `return:${returnRef.id}`,
+            order: _extends({}, orderSnapshot.data(), orderPatch),
+            extra: {
+                return: returnEventView(returnRef.id, entry)
+            }
+        });
+        // The store opening a return is its approval.
+        if (status === 'approved') {
+            stageOrderEvent(transaction, RETURN_APPROVED_EVENT, {
+                hostId: request.hostId,
+                orderId: request.orderId,
+                key: `return-approved:${returnRef.id}`,
+                order: _extends({}, orderSnapshot.data(), orderPatch),
+                extra: {
+                    return: returnEventView(returnRef.id, entry)
+                }
+            });
+        }
+        return {
+            outcome: 'created',
+            returnId: returnRef.id,
+            entry,
+            order
+        };
+    });
+}
+const ACTION_TARGET = {
+    approve: 'approved',
+    decline: 'declined',
+    close: 'closed'
+};
+/**
+ * Approve, decline, close, a note, or a return label — the writes that move
+ * no stock and no money. The transition is re-asked under the write.
+ */ export async function changeReturn(request) {
+    var _request_now;
+    const firestore = firebaseAdmin.app().firestore();
+    const hostRef = hostRefFor(firestore, request.hostId);
+    const returnRef = hostRef.collection('returns').doc(request.returnId);
+    const now = (_request_now = request.now) != null ? _request_now : Date.now();
+    const note = request.merchantNote === undefined ? undefined : String(request.merchantNote).trim().slice(0, CommerceModel.RETURN_NOTE_MAX);
+    return firestore.runTransaction(async (transaction)=>{
+        var _orderSnapshot_data;
+        const snapshot = await transaction.get(returnRef);
+        if (!snapshot.exists) return {
+            outcome: 'no_such_return'
+        };
+        const entry = snapshot.data();
+        const orderSnapshot = await transaction.get(hostRef.collection('orders').doc(entry.orderId));
+        const order = orderSnapshot.exists ? CommerceModel.liftLegacyOrder((_orderSnapshot_data = orderSnapshot.data()) != null ? _orderSnapshot_data : {}) : null;
+        const target = ACTION_TARGET[request.action];
+        let patch;
+        if (target) {
+            if (entry.status === target) return {
+                outcome: 'already',
+                entry
+            };
+            if (!CommerceModel.canTransitionReturn(entry.status, target)) {
+                return {
+                    outcome: 'refused',
+                    message: `A return that is ${CommerceModel.RETURN_STATUS_LABELS[entry.status].toLowerCase()} cannot be ${CommerceModel.RETURN_STATUS_LABELS[target].toLowerCase()}`
+                };
+            }
+            patch = _extends({
+                status: target
+            }, note !== undefined && note ? {
+                merchantNote: note
+            } : {}, {
+                timeline: CommerceModel.appendReturnEvent(entry, target, note || undefined, now)
+            });
+        } else if (request.action === 'attach-label') {
+            var _label_carrier, _label_trackingNumber, _ref;
+            const label = request.label;
+            if (!(label == null ? void 0 : label.labelUrl) || !/^https:\/\//i.test(label.labelUrl)) {
+                return {
+                    outcome: 'refused',
+                    message: 'A return label needs an https link'
+                };
+            }
+            if (!CommerceModel.returnIsOpen(entry) || entry.status === 'refunded') {
+                return {
+                    outcome: 'refused',
+                    message: 'This return is finished; a label can no longer be attached'
+                };
+            }
+            const carrier = String((_label_carrier = label.carrier) != null ? _label_carrier : '').trim().slice(0, 40);
+            const trackingNumber = String((_label_trackingNumber = label.trackingNumber) != null ? _label_trackingNumber : '').trim().slice(0, 60);
+            const trackingUrl = (_ref = label.trackingUrl && /^https:\/\//i.test(label.trackingUrl) ? label.trackingUrl : null) != null ? _ref : CommerceModel.trackingUrlFor(carrier, trackingNumber);
+            patch = {
+                returnLabel: _extends({
+                    carrier,
+                    trackingNumber,
+                    labelUrl: String(label.labelUrl).slice(0, 2048)
+                }, trackingUrl ? {
+                    trackingUrl
+                } : {}, {
+                    attachedAtMs: now
+                }),
+                timeline: CommerceModel.appendReturnEvent(entry, 'label', `${carrier} ${trackingNumber}`.trim() || 'Return label attached', now)
+            };
+        } else {
+            patch = {
+                merchantNote: note != null ? note : '',
+                timeline: CommerceModel.appendReturnEvent(entry, 'note', note || 'Note cleared', now)
+            };
+        }
+        transaction.update(returnRef, _extends({}, patch, {
+            updatedAtMs: now
+        }));
+        const changed = _extends({}, entry, patch, {
+            updatedAtMs: now
+        });
+        const event = target === 'approved' ? RETURN_APPROVED_EVENT : target === 'declined' ? RETURN_DECLINED_EVENT : null;
+        if (event && orderSnapshot.exists) {
+            var _orderSnapshot_data1;
+            stageOrderEvent(transaction, event, {
+                hostId: request.hostId,
+                orderId: entry.orderId,
+                key: `return-${target}:${request.returnId}`,
+                order: (_orderSnapshot_data1 = orderSnapshot.data()) != null ? _orderSnapshot_data1 : {},
+                extra: {
+                    return: returnEventView(request.returnId, changed)
+                }
+            });
+        }
+        return {
+            outcome: 'changed',
+            entry: changed,
+            order
+        };
+    });
+}
+/**
+ * The parcel arrived: the return is `received`, and the units the merchant
+ * chose go back on the shelf, at the location they chose. A unit the sale
+ * never took off a tracked count (an untracked variant, a deleted product)
+ * has nothing to go back to and is left out, as a cancellation leaves it.
+ */ export async function receiveReturn(request) {
+    var _request_now, _request_locationId;
+    const firestore = firebaseAdmin.app().firestore();
+    const hostRef = hostRefFor(firestore, request.hostId);
+    const returnRef = hostRef.collection('returns').doc(request.returnId);
+    const now = (_request_now = request.now) != null ? _request_now : Date.now();
+    const locationId = String((_request_locationId = request.locationId) != null ? _request_locationId : '').trim().slice(0, 100);
+    return firestore.runTransaction(async (transaction)=>{
+        var _orderSnapshot_data;
+        const snapshot = await transaction.get(returnRef);
+        if (!snapshot.exists) return {
+            outcome: 'no_such_return'
+        };
+        const entry = snapshot.data();
+        if (entry.status === 'received' || entry.restock) return {
+            outcome: 'already',
+            entry
+        };
+        if (!CommerceModel.canTransitionReturn(entry.status, 'received')) {
+            return {
+                outcome: 'refused',
+                message: `A return that is ${CommerceModel.RETURN_STATUS_LABELS[entry.status].toLowerCase()} cannot be received`
+            };
+        }
+        // What may go back: at most what the return covers, per line.
+        const covered = new Map(entry.lines.map((line)=>[
+                line.lineItemId,
+                line.quantity
+            ]));
+        const wanted = new Map();
+        for (const line of request.restock){
+            var _wanted_get, _covered_get;
+            const lineItemId = Number(line == null ? void 0 : line.lineItemId);
+            const quantity = Number(line == null ? void 0 : line.quantity);
+            if (!covered.has(lineItemId)) {
+                return {
+                    outcome: 'refused',
+                    message: `Line ${lineItemId} is not part of this return`
+                };
+            }
+            if (!Number.isInteger(quantity) || quantity < 0) {
+                return {
+                    outcome: 'refused',
+                    message: 'Restock quantities must be whole numbers'
+                };
+            }
+            const total = ((_wanted_get = wanted.get(lineItemId)) != null ? _wanted_get : 0) + quantity;
+            if (total > ((_covered_get = covered.get(lineItemId)) != null ? _covered_get : 0)) {
+                return {
+                    outcome: 'refused',
+                    message: `Only ${covered.get(lineItemId)} of line ${lineItemId} came back`
+                };
+            }
+            if (quantity > 0) wanted.set(lineItemId, total);
+        }
+        if (locationId && wanted.size > 0) {
+            const location = await transaction.get(hostRef.collection('locations').doc(locationId));
+            if (!location.exists) return {
+                outcome: 'refused',
+                message: 'That stock location no longer exists'
+            };
+        }
+        const orderRef = hostRef.collection('orders').doc(entry.orderId);
+        const orderSnapshot = await transaction.get(orderRef);
+        const order = orderSnapshot.exists ? CommerceModel.liftLegacyOrder((_orderSnapshot_data = orderSnapshot.data()) != null ? _orderSnapshot_data : {}) : null;
+        // Every read before any write, as a transaction requires.
+        const tracked = order && wanted.size > 0 ? await resolveTrackedRestockLines(hostRef, order, (ref)=>transaction.get(ref)) : {
+            lines: [],
+            products: new Map()
+        };
+        const byProduct = new Map();
+        for (const line of tracked.lines){
+            var _wanted_get1, _line_lineIndex, _byProduct_get;
+            const quantity = Math.min(line.quantity, (_wanted_get1 = wanted.get((_line_lineIndex = line.lineIndex) != null ? _line_lineIndex : -1)) != null ? _wanted_get1 : 0);
+            if (quantity <= 0) continue;
+            byProduct.set(line.productId, [
+                ...(_byProduct_get = byProduct.get(line.productId)) != null ? _byProduct_get : [],
+                {
+                    variantId: line.variantId,
+                    quantity
+                }
+            ]);
+        }
+        let units = 0;
+        for (const [productId, lines] of byProduct){
+            const product = tracked.products.get(productId);
+            if (!product) continue;
+            let variants = product.variants;
+            for (const line of lines){
+                variants = CommerceModel.adjustVariantInventory({
+                    variants
+                }, line.variantId, line.quantity, locationId || undefined);
+            }
+            transaction.update(hostRef.collection('products').doc(productId), _extends({
+                variants
+            }, CommerceModel.productStockFields(_extends({}, product, {
+                variants
+            })), {
+                updatedAtMs: now
+            }));
+            for (const line of lines){
+                units += line.quantity;
+                transaction.create(hostRef.collection('inventoryAdjustments').doc(createResourceUid()), _extends({
+                    productId,
+                    variantId: line.variantId,
+                    delta: line.quantity,
+                    reason: 'restock',
+                    orderId: entry.orderId
+                }, locationId ? {
+                    locationId
+                } : {}, {
+                    atMs: now
+                }));
+            }
+        }
+        const restock = _extends({
+            lines: [
+                ...wanted.entries()
+            ].map(([lineItemId, quantity])=>({
+                    lineItemId,
+                    quantity
+                }))
+        }, locationId ? {
+            locationId
+        } : {}, {
+            atMs: now
+        });
+        const patch = {
+            status: 'received',
+            restock,
+            timeline: CommerceModel.appendReturnEvent(entry, 'received', units > 0 ? `${units} ${units === 1 ? 'unit' : 'units'} back in stock` : 'Nothing restocked', now),
+            updatedAtMs: now
+        };
+        transaction.update(returnRef, patch);
+        const received = _extends({}, entry, patch);
+        if (order) {
+            const orderPatch = {
+                timeline: CommerceModel.appendOrderEvent(order, 'return-received', units > 0 ? `${units} restocked` : undefined, now)
+            };
+            transaction.update(orderRef, orderPatch);
+            stageOrderEvent(transaction, RETURN_RECEIVED_EVENT, {
+                hostId: request.hostId,
+                orderId: entry.orderId,
+                key: `return-received:${request.returnId}`,
+                order: _extends({}, orderSnapshot.data(), orderPatch),
+                extra: {
+                    return: returnEventView(request.returnId, received)
+                }
+            });
+        }
+        return {
+            outcome: 'changed',
+            entry: received,
+            order,
+            units
+        };
+    });
+}
+/**
+ * Records a refund that went through the order's refund route against the
+ * return, and answers the order's restock question with what the return
+ * already did, so the merchant is not asked to restock the same units again.
+ */ export async function markReturnRefunded(request) {
+    var _request_now;
+    const firestore = firebaseAdmin.app().firestore();
+    const hostRef = hostRefFor(firestore, request.hostId);
+    const returnRef = hostRef.collection('returns').doc(request.returnId);
+    const now = (_request_now = request.now) != null ? _request_now : Date.now();
+    return firestore.runTransaction(async (transaction)=>{
+        var _orderSnapshot_data;
+        const snapshot = await transaction.get(returnRef);
+        if (!snapshot.exists) return {
+            outcome: 'no_such_return'
+        };
+        const entry = snapshot.data();
+        if (entry.status === 'refunded' || entry.refundedAtMs) return {
+            outcome: 'already',
+            entry
+        };
+        const orderRef = hostRef.collection('orders').doc(entry.orderId);
+        const orderSnapshot = await transaction.get(orderRef);
+        const order = orderSnapshot.exists ? CommerceModel.liftLegacyOrder((_orderSnapshot_data = orderSnapshot.data()) != null ? _orderSnapshot_data : {}) : null;
+        const patch = {
+            status: 'refunded',
+            refundedAtMs: now,
+            refundCents: Math.max(0, Math.round(request.refundCents)),
+            timeline: CommerceModel.appendReturnEvent(entry, 'refunded', undefined, now),
+            updatedAtMs: now
+        };
+        transaction.update(returnRef, patch);
+        const check = order == null ? void 0 : order.restockCheck;
+        if (order && check && !check.resolution && entry.restock) {
+            const restocked = entry.restock.lines.some((line)=>line.quantity > 0);
+            transaction.update(orderRef, {
+                restockCheck: _extends({}, check, {
+                    resolution: restocked ? 'restocked' : 'dismissed',
+                    resolvedAtMs: now
+                }, request.uid ? {
+                    resolvedBy: request.uid
+                } : {}),
+                timeline: CommerceModel.appendOrderEvent(order, 'restock-check', restocked ? 'answered by the return — restocked' : 'answered by the return — no restock', now)
+            });
+        }
+        return {
+            outcome: 'changed',
+            entry: _extends({}, entry, patch),
+            order
+        };
+    });
+}
+/** Calls the order's own refund route in-process, with the caller's credentials. */ async function callRefundRoute(req, body, idempotencyKey) {
+    var _req_headers_authorization;
+    let status = 200;
+    let payload = {};
+    const res = {
+        status (code) {
+            status = code;
+            return res;
+        },
+        json (value) {
+            payload = value != null ? value : {};
+            return res;
+        },
+        send (value) {
+            payload = {
+                error: String(value != null ? value : '')
+            };
+            return res;
+        },
+        setHeader () {
+            return res;
+        },
+        end () {
+            return res;
+        }
+    };
+    await refundHandler(_extends({}, req, {
+        method: 'POST',
+        headers: {
+            authorization: String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : ''),
+            'idempotency-key': idempotencyKey
+        },
+        body
+    }), res);
+    return {
+        status,
+        body: payload
+    };
+}
+async function sendReturnEmail(hostId, key, to, tokens, fallback) {
+    if (!to || !isEmailConfigured()) return;
+    try {
+        var _ref;
+        const firestore = firebaseAdmin.app().firestore();
+        const designed = await renderHostEmailWithTokens(firestore, hostId, key, tokens);
+        const org = await getOrgForHost(hostId).catch(()=>null);
+        await sendEmail(_extends({
+            to,
+            subject: (_ref = designed == null ? void 0 : designed.subject) != null ? _ref : fallback.subject,
+            text: (designed == null ? void 0 : designed.text) || fallback.text
+        }, (designed == null ? void 0 : designed.html) ? {
+            html: designed.html
+        } : {}, {
+            fromName: Aglyn.resolveBrandingProfile(org == null ? void 0 : org.org).fromName,
+            sendingIdentity: await hostSendingIdentity(hostId),
+            audience: 'tenant',
+            context: key,
+            // Owed to the recipient by their own order (AGL-3356).
+            owedFor: 'order'
+        }));
+        await meterHostEmail(hostId);
+    } catch (error) {
+        // A return that is recorded is not undone because its email failed.
+        console.error(`[returns] ${key} not sent`, hostId, error);
+    }
+}
+/** Tells the store a buyer asked, in the console and by email to the owner. */ async function tellStoreOfRequest(hostId, returnId, entry, order) {
+    var _entry_customerEmail, _entry_customerEmail1, _entry_customerNote, _entry_customerEmail2;
+    var _org, _this, _this1;
+    const items = returnItemsText(order, entry);
+    await notifyHostManagers(hostId, {
+        type: 'content.order',
+        title: `Return requested for order ${entry.orderNumber}`,
+        body: `${(_entry_customerEmail = entry.customerEmail) != null ? _entry_customerEmail : 'A buyer'} wants to return ${CommerceModel.describeReturnLines(order, entry.lines)} from order ${entry.orderNumber} on {site}.`,
+        link: `/${hostId}/products/returns?return=${encodeURIComponent(returnId)}`
+    }, {
+        skipOwnerEmail: true
+    }).catch(()=>undefined);
+    const ownerUid = (_this = await getOrgForHost(hostId).catch(()=>null)) == null ? void 0 : (_org = _this.org) == null ? void 0 : _org.ownerUid;
+    const owner = ownerUid ? (_this1 = await findUserByUidAcrossPools(ownerUid).catch(()=>null)) == null ? void 0 : _this1.record : null;
+    if (!(owner == null ? void 0 : owner.email)) return;
+    await sendReturnEmail(hostId, 'return-requested', owner.email, {
+        'order.number': entry.orderNumber,
+        'return.items': items,
+        'buyer.email': String((_entry_customerEmail1 = entry.customerEmail) != null ? _entry_customerEmail1 : ''),
+        'return.customerNote': String((_entry_customerNote = entry.customerNote) != null ? _entry_customerNote : '')
+    }, {
+        subject: `Return requested for order ${entry.orderNumber}`,
+        text: `${(_entry_customerEmail2 = entry.customerEmail) != null ? _entry_customerEmail2 : 'A buyer'} wants to return items from order ${entry.orderNumber}.\n\n${items}` + (entry.customerNote ? `\n\n"${entry.customerNote}"` : '') + `\n\nApprove or decline it under Products → Returns.`
+    });
+}
+/** Tells the buyer what happened to their return. */ async function tellBuyer(hostId, key, entry, order) {
+    var _ref, _entry_customerEmail, _orderStatusUrl, _entry_refundCents, _entry_merchantNote;
+    const to = String((_ref = (_entry_customerEmail = entry.customerEmail) != null ? _entry_customerEmail : order == null ? void 0 : order.customerEmail) != null ? _ref : '').trim();
+    if (!to || !order) return;
+    const firestore = firebaseAdmin.app().firestore();
+    const store = await readStore(firestore, hostId);
+    const statusUrl = (_orderStatusUrl = orderStatusUrl(store.host, hostId, entry.orderId)) != null ? _orderStatusUrl : '';
+    const items = returnItemsText(order, entry);
+    const label = entry.returnLabel ? `Print your return label: ${entry.returnLabel.labelUrl}` + (entry.returnLabel.trackingNumber ? ` (${[
+        entry.returnLabel.carrier,
+        entry.returnLabel.trackingNumber
+    ].filter(Boolean).join(' ')})` : '') : '';
+    const refundTotal = money((_entry_refundCents = entry.refundCents) != null ? _entry_refundCents : 0, store.currency);
+    const tokens = {
+        'order.number': entry.orderNumber,
+        'return.items': items,
+        'return.note': String((_entry_merchantNote = entry.merchantNote) != null ? _entry_merchantNote : ''),
+        'return.label': label,
+        'return.refundTotal': refundTotal,
+        'order.statusUrl': statusUrl
+    };
+    const fallback = key === 'return-approved' ? {
+        subject: `Your return for order ${entry.orderNumber} is approved`,
+        text: `Your return is approved:\n\n${items}` + (entry.merchantNote ? `\n\n${entry.merchantNote}` : '') + (label ? `\n\n${label}` : '')
+    } : key === 'return-declined' ? {
+        subject: `About your return for order ${entry.orderNumber}`,
+        text: `We could not accept the return of:\n\n${items}` + (entry.merchantNote ? `\n\n${entry.merchantNote}` : '')
+    } : {
+        subject: `Your refund for order ${entry.orderNumber}`,
+        text: `We received your return and refunded ${refundTotal}.\n\n${items}`
+    };
+    if (statusUrl) fallback.text += `\n\nView your order: ${statusUrl}`;
+    await sendReturnEmail(hostId, key, to, tokens, fallback);
+}
+// ---------------------------------------------------------------------------
+// The buyer's door (tenant)
+// ---------------------------------------------------------------------------
+/**
+ * Whether this request may act for the buyer of this order: the signed-in
+ * site member whose email the order carries, or the holder of the order's
+ * signed status link. Neither reveals whether the order exists to anyone
+ * else — both refusals read the same.
+ */ async function buyerMayActFor(req, hostId, orderId, token, order) {
+    var _session_member_get, _order_customerEmail;
+    if (token && verifyOrderStatusToken(hostId, orderId, token)) return true;
+    const session = await readActiveMemberSession(req, hostId);
+    if (session.status !== 'active') return false;
+    const memberEmail = String((_session_member_get = session.member.get('email')) != null ? _session_member_get : '').trim().toLowerCase();
+    return Boolean(memberEmail) && memberEmail === String((_order_customerEmail = order.customerEmail) != null ? _order_customerEmail : '').trim().toLowerCase();
+}
+/**
+ * `GET /api/commerce/return-request?hostId&orderId&t` — what the buyer may
+ * send back and until when, and the returns already open.
+ * `POST` with `{ hostId, orderId, t?, lines: [{ lineItemId, quantity, reason }], note? }`
+ * opens a return.
+ */ export const returnRequestHandler = async (req, res)=>{
+    var _ref, _input_hostId, _ref1, _input_orderId, _ref2, _input_t;
+    if (req.method !== 'GET' && req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const input = (_ref = req.method === 'GET' ? req.query : typeof req.body === 'string' ? JSON.parse(req.body) : req.body) != null ? _ref : {};
+    const hostId = String((_input_hostId = input.hostId) != null ? _input_hostId : '');
+    const orderId = String((_ref1 = (_input_orderId = input.orderId) != null ? _input_orderId : input.o) != null ? _ref1 : '');
+    const token = String((_ref2 = (_input_t = input.t) != null ? _input_t : input.token) != null ? _ref2 : '').slice(0, 100);
+    if (!isId(hostId) || !isId(orderId)) return res.status(400).json({
+        error: 'Missing hostId or orderId'
+    });
+    try {
+        var _orderSnapshot_data, _input_note;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = hostRefFor(firestore, hostId);
+        const orderSnapshot = await hostRef.collection('orders').doc(orderId).get();
+        const order = orderSnapshot.exists ? CommerceModel.liftLegacyOrder((_orderSnapshot_data = orderSnapshot.data()) != null ? _orderSnapshot_data : {}) : null;
+        if (!order || !await buyerMayActFor(req, hostId, orderId, token, order)) {
+            return res.status(404).json({
+                error: 'We could not find that order'
+            });
+        }
+        if (req.method === 'GET') {
+            const [{ returnSettings }, existing] = await Promise.all([
+                readStore(firestore, hostId),
+                hostRef.collection('returns').where('orderId', '==', orderId).get()
+            ]);
+            const returns = existing.docs.map((entry)=>_extends({
+                    id: entry.id
+                }, entry.data()));
+            const endsAt = CommerceModel.returnWindowEndsAtMs(order, returnSettings);
+            return res.status(200).json({
+                enabled: returnSettings.enabled,
+                windowEndsAtMs: endsAt,
+                windowOpen: endsAt === null || Date.now() <= endsAt,
+                lines: CommerceModel.returnableLines(order, returns, returnSettings),
+                reasons: CommerceModel.RETURN_REASONS.map((reason)=>({
+                        value: reason,
+                        label: CommerceModel.RETURN_REASON_LABELS[reason]
+                    })),
+                returns: returns.map((entry)=>_extends({
+                        id: entry.id,
+                        status: entry.status,
+                        lines: entry.lines,
+                        createdAtMs: entry.createdAtMs
+                    }, entry.returnLabel ? {
+                        returnLabel: {
+                            labelUrl: entry.returnLabel.labelUrl,
+                            carrier: entry.returnLabel.carrier,
+                            trackingNumber: entry.returnLabel.trackingNumber
+                        }
+                    } : {}, entry.status === 'declined' && entry.merchantNote ? {
+                        merchantNote: entry.merchantNote
+                    } : {}))
+            });
+        }
+        const outcome = await openReturn({
+            hostId,
+            orderId,
+            lines: Array.isArray(input.lines) ? input.lines.slice(0, 100) : [],
+            note: String((_input_note = input.note) != null ? _input_note : ''),
+            by: 'buyer'
+        });
+        if (outcome.outcome === 'no_such_order') return res.status(404).json({
+            error: 'We could not find that order'
+        });
+        if (outcome.outcome === 'refused') return res.status(409).json({
+            error: outcome.message
+        });
+        await tellStoreOfRequest(hostId, outcome.returnId, outcome.entry, outcome.order);
+        return res.status(200).json({
+            ok: true,
+            returnId: outcome.returnId,
+            status: outcome.entry.status
+        });
+    } catch (error) {
+        console.error('return request failed', error);
+        return res.status(500).json({
+            error: 'Your return could not be requested. Please try again.'
+        });
+    }
+};
+// ---------------------------------------------------------------------------
+// The merchant's door (console)
+// ---------------------------------------------------------------------------
+const MERCHANT_ACTIONS = [
+    'create',
+    'approve',
+    'decline',
+    'close',
+    'note',
+    'attach-label',
+    'receive',
+    'refund'
+];
+/**
+ * `POST /api/commerce/returns` with `{ hostId, action, … }`. Admins and
+ * editors run the return; the refund goes through the order's refund route,
+ * which asks for an admin of the whole workspace on its own.
+ */ export const returnsHandler = async (req, res)=>{
+    var _req_headers_authorization, _ref, _body_hostId, _body_action, _body_returnId;
+    if (req.method !== 'POST') return res.status(405).json({
+        error: 'Method not allowed'
+    });
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    const body = (_ref = typeof req.body === 'string' ? JSON.parse(req.body) : req.body) != null ? _ref : {};
+    const hostId = String((_body_hostId = body.hostId) != null ? _body_hostId : '');
+    const action = String((_body_action = body.action) != null ? _body_action : '');
+    const returnId = String((_body_returnId = body.returnId) != null ? _body_returnId : '');
+    if (!isId(hostId)) return res.status(400).json({
+        error: 'Missing hostId'
+    });
+    if (!MERCHANT_ACTIONS.includes(action)) return res.status(400).json({
+        error: 'Unknown action'
+    });
+    if (action !== 'create' && !isId(returnId)) return res.status(400).json({
+        error: 'Missing returnId'
+    });
+    try {
+        var _hostSnapshot_get;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const firestore = firebaseAdmin.app().firestore();
+        const hostSnapshot = await hostRefFor(firestore, hostId).get();
+        if (!hostSnapshot.exists) return res.status(404).json({
+            error: 'Unknown site'
+        });
+        const role = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (role !== 'admin' && role !== 'editor') return res.status(403).json({
+            error: 'Not permitted'
+        });
+        if (action === 'create') {
+            var _body_orderId, _body_note;
+            const orderId = String((_body_orderId = body.orderId) != null ? _body_orderId : '');
+            if (!isId(orderId)) return res.status(400).json({
+                error: 'Missing orderId'
+            });
+            const outcome = await openReturn({
+                hostId,
+                orderId,
+                lines: Array.isArray(body.lines) ? body.lines.slice(0, 100) : [],
+                note: String((_body_note = body.note) != null ? _body_note : ''),
+                by: 'merchant'
+            });
+            if (outcome.outcome === 'no_such_order') return res.status(404).json({
+                error: 'Unknown order'
+            });
+            if (outcome.outcome === 'refused') return res.status(409).json({
+                error: outcome.message
+            });
+            if (body.notify !== false) await tellBuyer(hostId, 'return-approved', outcome.entry, outcome.order);
+            return res.status(200).json({
+                ok: true,
+                returnId: outcome.returnId,
+                status: outcome.entry.status
+            });
+        }
+        if (action === 'receive') {
+            var _outcome_units;
+            const outcome = await receiveReturn({
+                hostId,
+                returnId,
+                restock: Array.isArray(body.restock) ? body.restock.slice(0, 100) : [],
+                locationId: body.locationId ? String(body.locationId) : undefined
+            });
+            if (outcome.outcome === 'no_such_return') return res.status(404).json({
+                error: 'Unknown return'
+            });
+            if (outcome.outcome === 'refused') return res.status(409).json({
+                error: outcome.message
+            });
+            return res.status(200).json(_extends({
+                ok: true
+            }, outcome.outcome === 'already' ? {
+                already: true
+            } : {
+                units: (_outcome_units = outcome.units) != null ? _outcome_units : 0
+            }, {
+                status: outcome.entry.status
+            }));
+        }
+        if (action === 'refund') {
+            var _orderSnapshot_data;
+            const returnSnapshot = await hostRefFor(firestore, hostId).collection('returns').doc(returnId).get();
+            if (!returnSnapshot.exists) return res.status(404).json({
+                error: 'Unknown return'
+            });
+            const entry = returnSnapshot.data();
+            if (entry.status === 'refunded' || entry.refundedAtMs) {
+                return res.status(200).json({
+                    ok: true,
+                    already: true,
+                    status: entry.status
+                });
+            }
+            if (!CommerceModel.canTransitionReturn(entry.status, 'refunded')) {
+                return res.status(409).json({
+                    error: `A return that is ${CommerceModel.RETURN_STATUS_LABELS[entry.status].toLowerCase()} cannot be refunded`
+                });
+            }
+            const orderSnapshot = await hostRefFor(firestore, hostId).collection('orders').doc(entry.orderId).get();
+            if (!orderSnapshot.exists) return res.status(404).json({
+                error: 'The order for this return is gone'
+            });
+            const order = CommerceModel.liftLegacyOrder((_orderSnapshot_data = orderSnapshot.data()) != null ? _orderSnapshot_data : {});
+            const suggested = CommerceModel.returnRefundCents(order, entry.lines);
+            const amountCents = body.amountCents == null ? suggested : Math.round(Number(body.amountCents));
+            if (!Number.isFinite(amountCents) || amountCents <= 0) {
+                return res.status(400).json({
+                    error: 'The refund amount must be above zero'
+                });
+            }
+            const wholeLines = CommerceModel.returnWholeLineIds(order, entry.lines).filter((index)=>!CommerceModel.orderLineRefunded(order, index));
+            const namedWorth = CommerceModel.orderLineRefundCents(order, wholeLines);
+            // Lines are named only when the amount covers them in full, which is
+            // what the refund route requires before it withdraws a line's
+            // entitlements; a smaller amount refunds by amount alone.
+            const refund = await callRefundRoute(req, _extends({
+                hostId,
+                orderId: entry.orderId,
+                amountCents
+            }, wholeLines.length > 0 && amountCents >= namedWorth ? {
+                lineItemIds: wholeLines
+            } : {}), // One refund per return: asking again replays rather than pays twice.
+            `return:${hostId}:${returnId}`);
+            if (refund.status !== 200) {
+                var _ref1;
+                var _refund_body;
+                return res.status(refund.status).json({
+                    error: (_ref1 = (_refund_body = refund.body) == null ? void 0 : _refund_body.error) != null ? _ref1 : 'Refund failed'
+                });
+            }
+            const marked = await markReturnRefunded({
+                hostId,
+                returnId,
+                refundCents: amountCents,
+                uid: decoded.uid
+            });
+            if (marked.outcome === 'changed') {
+                await raiseOrderEvent(RETURN_REFUNDED_EVENT, {
+                    hostId,
+                    orderId: entry.orderId,
+                    key: `return-refunded:${returnId}`,
+                    extra: {
+                        return: returnEventView(returnId, marked.entry)
+                    }
+                });
+                await tellBuyer(hostId, 'return-refunded', marked.entry, marked.order);
+            }
+            return res.status(200).json({
+                ok: true,
+                refundCents: amountCents,
+                status: 'refunded'
+            });
+        }
+        const outcome = await changeReturn(_extends({
+            hostId,
+            returnId,
+            action: action
+        }, body.merchantNote !== undefined ? {
+            merchantNote: String(body.merchantNote)
+        } : {}, action === 'attach-label' ? {
+            label: body.label
+        } : {}));
+        if (outcome.outcome === 'no_such_return') return res.status(404).json({
+            error: 'Unknown return'
+        });
+        if (outcome.outcome === 'refused') return res.status(409).json({
+            error: outcome.message
+        });
+        if (outcome.outcome === 'changed' && body.notify !== false) {
+            if (action === 'approve') await tellBuyer(hostId, 'return-approved', outcome.entry, outcome.order);
+            if (action === 'decline') await tellBuyer(hostId, 'return-declined', outcome.entry, outcome.order);
+            // A label attached after the approval reaches the buyer the same way,
+            // in the approval email, which carries it.
+            if (action === 'attach-label' && outcome.entry.status === 'approved') {
+                await tellBuyer(hostId, 'return-approved', outcome.entry, outcome.order);
+            }
+        }
+        return res.status(200).json(_extends({
+            ok: true
+        }, outcome.outcome === 'already' ? {
+            already: true
+        } : {}, {
+            status: outcome.entry.status
+        }));
+    } catch (error) {
+        console.error('returns action failed', action, error);
+        // Every write here is a transaction or keyed (the refund), so asking
+        // again lands once.
+        return res.status(500).json({
+            error: 'The return could not be updated. Retrying is safe.'
+        });
+    }
+};
+
+//# sourceMappingURL=returns.js.map