@aglyn/plugins-commerce 1.0.0-beta.230 → 1.0.0-beta.232

package/src/lib/server/order-webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/order-webhooks.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createResourceUid } from '@aglyn/aglyn/app-utils/create-resource-uid'\nimport { PLATFORM_BRAND_NAME } from '@aglyn/aglyn/app-utils/platform-brand'\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport type { PluginDomainEventEnvelope } from '@aglyn/aglyn/plugin-manager/plugin-domain-events'\nimport {\n  describeConfiguredUrlRefusal,\n  configuredUrlRefusal,\n  fetchConfiguredPublicUrl,\n  firebaseAdmin,\n  notifyHostManagers,\n} from '@aglyn/tenant-data-admin'\nimport { PLUGIN_EVENT_MAX_ATTEMPTS } from '@aglyn/tenant-data-admin/server/plugin-event-outbox'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport {\n  createSecretBoxKey,\n  openSecret,\n  parseSecretBoxKeyring,\n  sealSecret,\n  SECRET_BOX_KEY_BYTES,\n  type SecretBoxKey,\n  type SecretBoxKeyring,\n} from '@aglyn/shared-util-tools/secret-box'\nimport { createHmac, hkdfSync, randomBytes } from 'node:crypto'\nimport { COMMERCE_EVENT_DECLARATIONS } from '../model/order-events'\nimport * as Webhooks from '../model/order-webhooks'\n\n/**\n * Merchant order webhooks (AGL-3611): the console's door and the delivery\n * behind it. The model (`model/order-webhooks.ts`) says what is stored where.\n *\n * DELIVERY RIDES THE PLUGIN EVENT OUTBOX. Commerce subscribes to its own\n * order and return events under the name `webhooks`; the subscriber posts the\n * event to every endpoint that takes it and records each attempt in the\n * delivery log. An endpoint that already took an event is not posted it\n * again, so when one of three endpoints fails, the subscriber throws, the\n * outbox retries it with its backoff (30s, 2m, 10m, 30m, 1h, 6h, 12h), and\n * only the failing endpoint is called again. On the last attempt the delivery\n * is marked failed and the site's managers are told.\n *\n * EVERY CALL GOES THROUGH `fetchConfiguredPublicUrl`: https on the default\n * port, a public address pinned at connect time, no redirect followed. A\n * merchant's endpoint is a stranger's server to us.\n *\n * THE SECRET IS SEALED with the shared secret box, under the keyring\n * `readCommerceSecretKeyring` answers, bound to its endpoint by the seal's\n * context. The plaintext leaves the server once, in the answer to the request\n * that made or rolled it.\n */\n\nexport const COMMERCE_SECRET_KEY_ENV = 'COMMERCE_SECRET_KEY'\n\nconst SECRETS = 'orderWebhookSecrets'\n\n/** Delivery rows live this long, then Firestore's TTL removes them. */\nexport const ORDER_WEBHOOK_LOG_RETENTION_MS = 30 * 86_400_000\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/** The id of the key derived from `TOKEN_SIGNING_SECRET`. */\nexport const DERIVED_COMMERCE_KEY_ID = 'tss1'\n\n/**\n * A secret-box key derived from `TOKEN_SIGNING_SECRET` with HKDF, under its\n * own label, so the commerce tokens and the sealed secrets never share key\n * material. `null` when that secret is unset.\n */\nfunction derivedCommerceKey(): SecretBoxKey | null {\n  const base = String(process.env['TOKEN_SIGNING_SECRET'] ?? '')\n  if (!base) return null\n  const material = new Uint8Array(hkdfSync('sha256', base, 'aglyn-commerce', 'secret-box:v1', SECRET_BOX_KEY_BYTES))\n  return createSecretBoxKey(material, DERIVED_COMMERCE_KEY_ID)\n}\n\n/**\n * The keyring commerce seals its stored secrets with. `COMMERCE_SECRET_KEY`\n * (a secret-box keyring) when it is set, its first key sealing; otherwise the\n * key derived from `TOKEN_SIGNING_SECRET`, which every deployment that sells\n * already has. The derived key stays in the ring after a dedicated key is\n * configured, so what it sealed still opens. `null` when neither is usable.\n * Never throws.\n */\nexport function readCommerceSecretKeyring(): SecretBoxKeyring | null {\n  let derived: SecretBoxKey | null = null\n  try {\n    derived = derivedCommerceKey()\n  } catch {\n    derived = null\n  }\n  const raw = String(process.env[COMMERCE_SECRET_KEY_ENV] ?? '').trim()\n  if (raw) {\n    try {\n      const ring = parseSecretBoxKeyring(raw)\n      const keys = derived && !ring.keys.some((key) => key.id === derived!.id) ? [...ring.keys, derived] : ring.keys\n      return { current: ring.current, keys }\n    } catch {\n      // An unusable dedicated key falls back to the derived one rather than\n      // sealing nothing.\n    }\n  }\n  return derived ? { current: derived, keys: [derived] } : null\n}\n\n/** Whether this deployment can sign webhooks at all. */\nexport function orderWebhooksConfigured(): boolean {\n  return readCommerceSecretKeyring() !== null\n}\n\nconst sealContext = (hostId: string, endpointId: string) => `hosts/${hostId}/${SECRETS}/${endpointId}#secret`\n\n/** A fresh signing secret: `whsec_` and 32 random bytes. */\nexport function mintOrderWebhookSecret(): string {\n  return `whsec_${randomBytes(32).toString('base64url')}`\n}\n\n/** The HMAC-SHA256 of `{t}.{body}` under the secret, as hex. */\nexport function signOrderWebhook(secret: string, timestampSeconds: number, body: string): string {\n  return createHmac('sha256', secret).update(Webhooks.orderWebhookSignedPayload(timestampSeconds, body)).digest('hex')\n}\n\nconst hostRefFor = (firestore: Firestore, hostId: string) => firestore.collection('hosts').doc(hostId)\n\nasync function readSecret(\n  firestore: Firestore,\n  hostId: string,\n  endpointId: string,\n  keyring: SecretBoxKeyring,\n): Promise<string> {\n  const hostRef = hostRefFor(firestore, hostId)\n  const snapshot = await hostRef.collection('orderWebhookSecrets').doc(endpointId).get()\n  const sealed = String(snapshot.get('sealedSecret') ?? '')\n  if (!sealed) throw new Error('This endpoint has no signing secret')\n  return openSecret(sealed, keyring, { context: sealContext(hostId, endpointId) }).plaintext\n}\n\nfunction sealedSecretRecord(\n  hostId: string,\n  endpointId: string,\n  secret: string,\n  keyring: SecretBoxKeyring,\n  now: number,\n): Webhooks.OrderWebhookSecretRecord {\n  return {\n    sealedSecret: sealSecret(secret, keyring.current, { context: sealContext(hostId, endpointId) }),\n    secretKeyId: keyring.current.id,\n    updatedAtMs: now,\n  }\n}\n\n/** What one POST came to. */\nexport interface OrderWebhookPostResult {\n  attempt: Webhooks.OrderWebhookAttempt\n  delivered: boolean\n}\n\n/**\n * Posts one body to one endpoint, signed. Never throws: a refusal, a timeout\n * or a reset is an attempt that failed, with the reason in words.\n */\nexport async function postOrderWebhook(input: {\n  url: string\n  secret: string\n  event: string\n  eventId: string\n  body: string\n  now?: () => number\n  fetchImpl?: typeof fetchConfiguredPublicUrl\n}): Promise<OrderWebhookPostResult> {\n  const clock = input.now ?? Date.now\n  const startedAt = clock()\n  const timestamp = Math.floor(startedAt / 1000)\n  const signature = Webhooks.formatOrderWebhookSignature(timestamp, signOrderWebhook(input.secret, timestamp, input.body))\n  let httpStatus: number | null = null\n  let error: string | undefined\n  try {\n    const result = await (input.fetchImpl ?? fetchConfiguredPublicUrl)(input.url, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        'user-agent': 'Aglyn-Webhooks/1.0',\n        [Webhooks.ORDER_WEBHOOK_SIGNATURE_HEADER]: signature,\n        [Webhooks.ORDER_WEBHOOK_EVENT_HEADER]: input.event,\n        [Webhooks.ORDER_WEBHOOK_EVENT_ID_HEADER]: input.eventId,\n      },\n      body: input.body,\n      signal: AbortSignal.timeout(Webhooks.ORDER_WEBHOOK_TIMEOUT_MS),\n    })\n    if ('refusal' in result) {\n      error = `Not sent: ${describeConfiguredUrlRefusal(result.refusal)}`\n    } else {\n      httpStatus = result.status\n      if (!Webhooks.orderWebhookAccepted(httpStatus)) {\n        error =\n          httpStatus >= 300 && httpStatus < 400\n            ? `The endpoint answered ${httpStatus}, a redirect; redirects are not followed`\n            : `The endpoint answered ${httpStatus}`\n      }\n    }\n  } catch (caught) {\n    const name = (caught as Error)?.name\n    error =\n      name === 'TimeoutError' || name === 'AbortError'\n        ? `No answer within ${Webhooks.ORDER_WEBHOOK_TIMEOUT_MS / 1000} seconds`\n        : `The connection failed: ${String((caught as Error)?.message ?? caught).slice(0, 200)}`\n  }\n  const attempt: Webhooks.OrderWebhookAttempt = {\n    atMs: startedAt,\n    httpStatus,\n    ...(error ? { error } : {}),\n    durationMs: Math.max(0, clock() - startedAt),\n  }\n  return { attempt, delivered: !error }\n}\n\nfunction expiresAt(now: number) {\n  return firebaseAdmin.firestore.Timestamp.fromMillis(now + ORDER_WEBHOOK_LOG_RETENTION_MS)\n}\n\n/** Records an attempt on the delivery row and on the endpoint's summary. */\nasync function recordAttempt(\n  firestore: Firestore,\n  hostId: string,\n  endpointId: string,\n  delivery: {\n    id: string\n    eventId: string\n    event: string\n    orderId: string | null\n    body: string\n    test?: boolean\n    prior: Webhooks.OrderWebhookDelivery | null\n  },\n  result: OrderWebhookPostResult,\n  status: Webhooks.OrderWebhookDeliveryStatus,\n  now: number,\n): Promise<void> {\n  const hostRef = hostRefFor(firestore, hostId)\n  const row: Webhooks.OrderWebhookDelivery & { expiresAt: unknown } = {\n    endpointId,\n    eventId: delivery.eventId,\n    event: delivery.event,\n    orderId: delivery.orderId,\n    status,\n    attempts: Webhooks.appendOrderWebhookAttempt(delivery.prior?.attempts, result.attempt),\n    body: delivery.body.slice(0, Webhooks.ORDER_WEBHOOK_BODY_MAX),\n    ...(delivery.test ? { test: true } : {}),\n    createdAtMs: delivery.prior?.createdAtMs ?? now,\n    updatedAtMs: now,\n    expiresAt: expiresAt(now),\n  }\n  await hostRef.collection('orderWebhookDeliveries').doc(delivery.id).set(row)\n  await hostRef\n    .collection('orderWebhooks')\n    .doc(endpointId)\n    .update({\n      lastDeliveryAtMs: now,\n      lastDeliveryStatus: status,\n      consecutiveFailures: result.delivered ? 0 : firebaseAdmin.firestore.FieldValue.increment(1),\n    })\n    .catch(() => undefined)\n}\n\n/**\n * The subscriber: posts one event to every endpoint of the site that takes\n * it and has not taken it already. Throws when any endpoint still owes it, so\n * the outbox retries; on the outbox's last attempt it records the failure and\n * tells the site's managers instead.\n */\nexport async function deliverOrderEventToWebhooks(\n  envelope: PluginDomainEventEnvelope,\n  deps: { fetchImpl?: typeof fetchConfiguredPublicUrl; now?: () => number } = {},\n): Promise<{ delivered: number; failed: number }> {\n  const firestore = firebaseAdmin.app().firestore()\n  const hostRef = hostRefFor(firestore, envelope.hostId)\n  const endpoints = await hostRef.collection('orderWebhooks').where('enabled', '==', true).get()\n  const taking = endpoints.docs.filter((doc) =>\n    Webhooks.orderWebhookTakes(doc.data() as Webhooks.OrderWebhookEndpoint, envelope.event, envelope.occurredAtMs),\n  )\n  if (taking.length === 0) return { delivered: 0, failed: 0 }\n  const keyring = readCommerceSecretKeyring()\n  const clock = deps.now ?? Date.now\n  const final = envelope.attempt >= PLUGIN_EVENT_MAX_ATTEMPTS\n  const body = Webhooks.orderWebhookBody({\n    eventId: envelope.id,\n    event: envelope.event,\n    occurredAtMs: envelope.occurredAtMs,\n    hostId: envelope.hostId,\n    payload: envelope.payload,\n  })\n  const orderId = String(((envelope.payload ?? {}) as { order?: { id?: unknown } }).order?.id ?? '') || null\n  const outcomes = await Promise.all(\n    taking.map(async (doc) => {\n      const endpoint = doc.data() as Webhooks.OrderWebhookEndpoint\n      const deliveryId = Webhooks.orderWebhookDeliveryId(envelope.id, doc.id)\n      const priorSnapshot = await hostRef.collection('orderWebhookDeliveries').doc(deliveryId).get()\n      const prior = priorSnapshot.exists ? (priorSnapshot.data() as Webhooks.OrderWebhookDelivery) : null\n      // Taken already, on an earlier pass or by a resend from the console.\n      if (prior?.status === 'delivered') return 'delivered' as const\n      const settled = await attemptEndpoint({\n        firestore,\n        hostId: envelope.hostId,\n        endpointId: doc.id,\n        url: endpoint.url,\n        keyring,\n        event: envelope.event,\n        eventId: envelope.id,\n        body,\n        clock,\n        fetchImpl: deps.fetchImpl,\n      })\n      const status: Webhooks.OrderWebhookDeliveryStatus = settled.delivered ? 'delivered' : final ? 'failed' : 'retrying'\n      await recordAttempt(\n        firestore,\n        envelope.hostId,\n        doc.id,\n        { id: deliveryId, eventId: envelope.id, event: envelope.event, orderId, body, prior },\n        settled,\n        status,\n        clock(),\n      )\n      if (status === 'failed') {\n        await notifyHostManagers(envelope.hostId, {\n          type: 'content.order',\n          title: 'An order webhook could not be delivered',\n          body:\n            `${envelope.event} never reached ${safeHost(endpoint.url)} on {site} after ` +\n            `${envelope.attempt} attempts (${settled.attempt.error ?? 'no answer'}). ` +\n            'Resend it from the delivery log once the endpoint is fixed.',\n          link: `/${envelope.hostId}/products/settings`,\n        }).catch(() => undefined)\n      }\n      return status\n    }),\n  )\n  const delivered = outcomes.filter((status) => status === 'delivered').length\n  const failed = outcomes.length - delivered\n  if (failed > 0 && !final) {\n    throw new Error(`${failed} of ${outcomes.length} order webhook endpoints did not take ${envelope.event}`)\n  }\n  return { delivered, failed }\n}\n\n/** One signed attempt at one endpoint; a missing key or secret is a failed attempt. */\nasync function attemptEndpoint(input: {\n  firestore: Firestore\n  hostId: string\n  endpointId: string\n  url: string\n  keyring: SecretBoxKeyring | null\n  event: string\n  eventId: string\n  body: string\n  clock: () => number\n  fetchImpl?: typeof fetchConfiguredPublicUrl\n}): Promise<OrderWebhookPostResult> {\n  const failed = (error: string): OrderWebhookPostResult => ({\n    delivered: false,\n    attempt: { atMs: input.clock(), httpStatus: null, error, durationMs: 0 },\n  })\n  if (!input.keyring) return failed('Webhook signing is not configured')\n  let secret: string\n  try {\n    secret = await readSecret(input.firestore, input.hostId, input.endpointId, input.keyring)\n  } catch (error) {\n    return failed(`The signing secret could not be read: ${String((error as Error)?.message ?? error).slice(0, 120)}`)\n  }\n  return postOrderWebhook({\n    url: input.url,\n    secret,\n    event: input.event,\n    eventId: input.eventId,\n    body: input.body,\n    fetchImpl: input.fetchImpl,\n    now: input.clock,\n  })\n}\n\nfunction safeHost(url: string): string {\n  try {\n    return new URL(url).hostname\n  } catch {\n    return 'the endpoint'\n  }\n}\n\n// ---------------------------------------------------------------------------\n// The console's door\n// ---------------------------------------------------------------------------\n\nconst ACTIONS = ['status', 'create', 'update', 'roll-secret', 'delete', 'test', 'resend'] as const\ntype Action = (typeof ACTIONS)[number]\n\nconst isId = (value: string) => Boolean(value) && value.length <= 1500 && !/^__.*__$/.test(value) && !value.includes('/')\n\nfunction cleanUrl(raw: unknown): { url: string } | { error: string } {\n  const url = String(raw ?? '').trim()\n  if (!url) return { error: 'Enter the endpoint’s address' }\n  if (url.length > 2048) return { error: 'That address is too long' }\n  const refusal = configuredUrlRefusal(url)\n  if (refusal) return { error: `This endpoint cannot be used: ${describeConfiguredUrlRefusal(refusal)}` }\n  return { url }\n}\n\nconst cleanDescription = (raw: unknown) => String(raw ?? '').trim().slice(0, 120)\n\n/**\n * `POST /api/commerce/order-webhooks` with `{ hostId, action, … }`. Endpoints\n * post the order book to an outside server, so only an admin of the whole\n * workspace manages them — the bar a refund sets.\n *\n *  - `status` → `{ configured, events: [{ event, label, description }] }`\n *  - `create` `{ url, events, description? }` → `{ id, secret }` (shown once)\n *  - `update` `{ endpointId, url?, events?, enabled?, description? }`\n *  - `roll-secret` `{ endpointId }` → `{ secret }`\n *  - `delete` `{ endpointId }`; the delivery log stays until it expires\n *  - `test` `{ endpointId }` → posts a `webhook.test` event now\n *  - `resend` `{ deliveryId }` → posts a logged delivery again now\n */\nexport const orderWebhooksHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  let body: Record<string, any>\n  try {\n    body = (typeof req.body === 'string' ? JSON.parse(req.body) : req.body) ?? {}\n  } catch {\n    return res.status(400).json({ error: 'Invalid JSON' })\n  }\n  const hostId = String(body.hostId ?? '')\n  const action = String(body.action ?? '') as Action\n  if (!isId(hostId)) return res.status(400).json({ error: 'Missing hostId' })\n  if (!ACTIONS.includes(action)) return res.status(400).json({ error: 'Unknown action' })\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = hostRefFor(firestore, hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) return res.status(404).json({ error: 'Unknown site' })\n    if ((hostSnapshot.get('memberRoles') ?? {})[decoded.uid] !== 'admin') {\n      return res.status(403).json({ error: 'Webhooks are managed by a site admin' })\n    }\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.orgWide || membership.hostRole !== 'admin') {\n      return res.status(403).json({ error: 'Webhooks are managed by an admin of the whole workspace' })\n    }\n    const keyring = readCommerceSecretKeyring()\n    if (action === 'status') {\n      return res.status(200).json({\n        configured: Boolean(keyring),\n        maxEndpoints: Webhooks.ORDER_WEBHOOK_MAX_ENDPOINTS,\n        events: COMMERCE_EVENT_DECLARATIONS.map((entry) => ({\n          event: entry.event.id,\n          label: entry.label,\n          description: entry.description,\n        })),\n      })\n    }\n    if (!keyring) {\n      return res.status(503).json({ error: 'Order webhooks are not configured on this deployment' })\n    }\n    const now = Date.now()\n    const endpoints = hostRef.collection('orderWebhooks')\n\n    if (action === 'create') {\n      const url = cleanUrl(body.url)\n      if ('error' in url) return res.status(400).json({ error: url.error })\n      const events = Webhooks.normalizeOrderWebhookEvents(body.events)\n      if (events.length === 0) return res.status(400).json({ error: 'Choose at least one event' })\n      const secret = mintOrderWebhookSecret()\n      const ref = endpoints.doc(createResourceUid())\n      const created = await firestore.runTransaction(async (transaction) => {\n        const existing = await transaction.get(endpoints.limit(Webhooks.ORDER_WEBHOOK_MAX_ENDPOINTS))\n        if (existing.size >= Webhooks.ORDER_WEBHOOK_MAX_ENDPOINTS) return false\n        const endpoint: Webhooks.OrderWebhookEndpoint = {\n          url: url.url,\n          events,\n          enabled: true,\n          ...(cleanDescription(body.description) ? { description: cleanDescription(body.description) } : {}),\n          secretHint: secret.slice(-4),\n          consecutiveFailures: 0,\n          createdAtMs: now,\n          updatedAtMs: now,\n          createdBy: decoded.uid,\n        }\n        transaction.create(ref, endpoint)\n        transaction.create(hostRef.collection('orderWebhookSecrets').doc(ref.id), sealedSecretRecord(hostId, ref.id, secret, keyring, now))\n        return true\n      })\n      if (!created) {\n        return res.status(409).json({ error: `A store can keep ${Webhooks.ORDER_WEBHOOK_MAX_ENDPOINTS} webhook endpoints` })\n      }\n      return res.status(200).json({ ok: true, id: ref.id, secret })\n    }\n\n    if (action === 'resend') {\n      const deliveryId = String(body.deliveryId ?? '')\n      if (!isId(deliveryId)) return res.status(400).json({ error: 'Missing deliveryId' })\n      const deliveryRef = hostRef.collection('orderWebhookDeliveries').doc(deliveryId)\n      const deliverySnapshot = await deliveryRef.get()\n      if (!deliverySnapshot.exists) return res.status(404).json({ error: 'Unknown delivery' })\n      const delivery = deliverySnapshot.data() as Webhooks.OrderWebhookDelivery\n      const endpointSnapshot = await endpoints.doc(delivery.endpointId).get()\n      if (!endpointSnapshot.exists) return res.status(404).json({ error: 'That endpoint was deleted' })\n      if (delivery.body.length >= Webhooks.ORDER_WEBHOOK_BODY_MAX) {\n        return res.status(409).json({ error: 'This delivery was too large to keep, so it cannot be resent' })\n      }\n      const endpoint = endpointSnapshot.data() as Webhooks.OrderWebhookEndpoint\n      const secret = await readSecret(firestore, hostId, delivery.endpointId, keyring)\n      const result = await postOrderWebhook({ url: endpoint.url, secret, event: delivery.event, eventId: delivery.eventId, body: delivery.body })\n      const status: Webhooks.OrderWebhookDeliveryStatus = result.delivered\n        ? 'delivered'\n        : delivery.status === 'delivered'\n          ? 'delivered'\n          : delivery.status\n      await recordAttempt(\n        firestore,\n        hostId,\n        delivery.endpointId,\n        { id: deliveryId, eventId: delivery.eventId, event: delivery.event, orderId: delivery.orderId, body: delivery.body, test: delivery.test, prior: delivery },\n        result,\n        status,\n        Date.now(),\n      )\n      return res.status(200).json({ ok: true, delivered: result.delivered, attempt: result.attempt })\n    }\n\n    const endpointId = String(body.endpointId ?? '')\n    if (!isId(endpointId)) return res.status(400).json({ error: 'Missing endpointId' })\n    const endpointRef = endpoints.doc(endpointId)\n    const endpointSnapshot = await endpointRef.get()\n    if (!endpointSnapshot.exists) return res.status(404).json({ error: 'Unknown endpoint' })\n    const endpoint = endpointSnapshot.data() as Webhooks.OrderWebhookEndpoint\n\n    if (action === 'update') {\n      const patch: Partial<Webhooks.OrderWebhookEndpoint> = { updatedAtMs: now }\n      if (body.url !== undefined) {\n        const url = cleanUrl(body.url)\n        if ('error' in url) return res.status(400).json({ error: url.error })\n        patch.url = url.url\n      }\n      if (body.events !== undefined) {\n        const events = Webhooks.normalizeOrderWebhookEvents(body.events)\n        if (events.length === 0) return res.status(400).json({ error: 'Choose at least one event' })\n        patch.events = events\n      }\n      if (body.enabled !== undefined) {\n        patch.enabled = Boolean(body.enabled)\n        if (patch.enabled) patch.consecutiveFailures = 0\n      }\n      if (body.description !== undefined) patch.description = cleanDescription(body.description)\n      await endpointRef.update(patch)\n      return res.status(200).json({ ok: true })\n    }\n\n    if (action === 'roll-secret') {\n      const secret = mintOrderWebhookSecret()\n      const batch = firestore.batch()\n      batch.set(hostRef.collection('orderWebhookSecrets').doc(endpointId), sealedSecretRecord(hostId, endpointId, secret, keyring, now))\n      batch.update(endpointRef, { secretHint: secret.slice(-4), updatedAtMs: now })\n      await batch.commit()\n      return res.status(200).json({ ok: true, secret })\n    }\n\n    if (action === 'delete') {\n      const batch = firestore.batch()\n      batch.delete(endpointRef)\n      batch.delete(hostRef.collection('orderWebhookSecrets').doc(endpointId))\n      await batch.commit()\n      return res.status(200).json({ ok: true })\n    }\n\n    // test\n    const eventId = `test_${randomBytes(9).toString('base64url')}`\n    const testBody = Webhooks.orderWebhookBody({\n      eventId,\n      event: Webhooks.ORDER_WEBHOOK_TEST_EVENT,\n      occurredAtMs: now,\n      hostId,\n      payload: { message: `A test event from ${PLATFORM_BRAND_NAME}. Answer with any 2xx status.` },\n    })\n    const secret = await readSecret(firestore, hostId, endpointId, keyring)\n    const result = await postOrderWebhook({ url: endpoint.url, secret, event: Webhooks.ORDER_WEBHOOK_TEST_EVENT, eventId, body: testBody })\n    await recordAttempt(\n      firestore,\n      hostId,\n      endpointId,\n      { id: Webhooks.orderWebhookDeliveryId(eventId, endpointId), eventId, event: Webhooks.ORDER_WEBHOOK_TEST_EVENT, orderId: null, body: testBody, test: true, prior: null },\n      result,\n      result.delivered ? 'delivered' : 'failed',\n      Date.now(),\n    )\n    return res.status(200).json({ ok: true, delivered: result.delivered, attempt: result.attempt })\n  } catch (error) {\n    console.error('order webhooks action failed', action, error)\n    return res.status(500).json({ error: 'The webhook could not be updated. Please try again.' })\n  }\n}\n"],"names":["createResourceUid","PLATFORM_BRAND_NAME","describeConfiguredUrlRefusal","configuredUrlRefusal","fetchConfiguredPublicUrl","firebaseAdmin","notifyHostManagers","PLUGIN_EVENT_MAX_ATTEMPTS","resolveOrgPermissions","createSecretBoxKey","openSecret","parseSecretBoxKeyring","sealSecret","SECRET_BOX_KEY_BYTES","createHmac","hkdfSync","randomBytes","COMMERCE_EVENT_DECLARATIONS","Webhooks","COMMERCE_SECRET_KEY_ENV","SECRETS","ORDER_WEBHOOK_LOG_RETENTION_MS","DERIVED_COMMERCE_KEY_ID","derivedCommerceKey","process","base","String","env","material","Uint8Array","readCommerceSecretKeyring","derived","raw","trim","ring","keys","some","key","id","current","orderWebhooksConfigured","sealContext","hostId","endpointId","mintOrderWebhookSecret","toString","signOrderWebhook","secret","timestampSeconds","body","update","orderWebhookSignedPayload","digest","hostRefFor","firestore","collection","doc","readSecret","keyring","snapshot","hostRef","get","sealed","Error","context","plaintext","sealedSecretRecord","now","sealedSecret","secretKeyId","updatedAtMs","postOrderWebhook","input","clock","Date","startedAt","timestamp","Math","floor","signature","formatOrderWebhookSignature","httpStatus","error","result","fetchImpl","url","method","headers","ORDER_WEBHOOK_SIGNATURE_HEADER","ORDER_WEBHOOK_EVENT_HEADER","event","ORDER_WEBHOOK_EVENT_ID_HEADER","eventId","signal","AbortSignal","timeout","ORDER_WEBHOOK_TIMEOUT_MS","refusal","status","orderWebhookAccepted","caught","name","message","slice","attempt","atMs","durationMs","max","delivered","expiresAt","Timestamp","fromMillis","recordAttempt","delivery","row","orderId","attempts","appendOrderWebhookAttempt","prior","ORDER_WEBHOOK_BODY_MAX","test","createdAtMs","set","lastDeliveryAtMs","lastDeliveryStatus","consecutiveFailures","FieldValue","increment","catch","undefined","deliverOrderEventToWebhooks","envelope","deps","app","endpoints","where","taking","docs","filter","orderWebhookTakes","data","occurredAtMs","length","failed","final","orderWebhookBody","payload","order","outcomes","Promise","all","map","endpoint","deliveryId","orderWebhookDeliveryId","priorSnapshot","exists","settled","attemptEndpoint","type","title","safeHost","link","URL","hostname","ACTIONS","isId","value","Boolean","includes","cleanUrl","cleanDescription","orderWebhooksHandler","req","res","json","authorization","idToken","startsWith","JSON","parse","action","hostSnapshot","decoded","auth","verifyIdToken","uid","membership","orgWide","hostRole","configured","maxEndpoints","ORDER_WEBHOOK_MAX_ENDPOINTS","events","entry","label","description","normalizeOrderWebhookEvents","ref","created","runTransaction","transaction","existing","limit","size","enabled","secretHint","createdBy","create","ok","deliveryRef","deliverySnapshot","endpointSnapshot","endpointRef","patch","batch","commit","delete","testBody","ORDER_WEBHOOK_TEST_EVENT","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,iBAAiB,QAAQ,6CAA4C;AAC9E,SAASC,mBAAmB,QAAQ,wCAAuC;AAG3E,SACEC,4BAA4B,EAC5BC,oBAAoB,EACpBC,wBAAwB,EACxBC,aAAa,EACbC,kBAAkB,QACb,2BAA0B;AACjC,SAASC,yBAAyB,QAAQ,sDAAqD;AAC/F,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SACEC,kBAAkB,EAClBC,UAAU,EACVC,qBAAqB,EACrBC,UAAU,EACVC,oBAAoB,QAGf,sCAAqC;AAC5C,SAASC,UAAU,EAAEC,QAAQ,EAAEC,WAAW,QAAQ,cAAa;AAC/D,SAASC,2BAA2B,QAAQ,2BAAuB;AACnE,YAAYC,cAAc,6BAAyB;AAEnD;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED,OAAO,MAAMC,0BAA0B,sBAAqB;AAE5D,MAAMC,UAAU;AAEhB,qEAAqE,GACrE,OAAO,MAAMC,iCAAiC,KAAK,SAAU;AAI7D,2DAA2D,GAC3D,OAAO,MAAMC,0BAA0B,OAAM;AAE7C;;;;CAIC,GACD,SAASC;QACaC;IAApB,MAAMC,OAAOC,QAAOF,oCAAAA,QAAQG,GAAG,CAAC,uBAAuB,YAAnCH,oCAAuC;IAC3D,IAAI,CAACC,MAAM,OAAO;IAClB,MAAMG,WAAW,IAAIC,WAAWd,SAAS,UAAUU,MAAM,kBAAkB,iBAAiBZ;IAC5F,OAAOJ,mBAAmBmB,UAAUN;AACtC;AAEA;;;;;;;CAOC,GACD,OAAO,SAASQ;QAOKN;IANnB,IAAIO,UAA+B;IACnC,IAAI;QACFA,UAAUR;IACZ,EAAE,eAAM;QACNQ,UAAU;IACZ;IACA,MAAMC,MAAMN,QAAOF,uCAAAA,QAAQG,GAAG,CAACR,wBAAwB,YAApCK,uCAAwC,IAAIS,IAAI;IACnE,IAAID,KAAK;QACP,IAAI;YACF,MAAME,OAAOvB,sBAAsBqB;YACnC,MAAMG,OAAOJ,WAAW,CAACG,KAAKC,IAAI,CAACC,IAAI,CAAC,CAACC,MAAQA,IAAIC,EAAE,KAAKP,QAASO,EAAE,IAAI;mBAAIJ,KAAKC,IAAI;gBAAEJ;aAAQ,GAAGG,KAAKC,IAAI;YAC9G,OAAO;gBAAEI,SAASL,KAAKK,OAAO;gBAAEJ;YAAK;QACvC,EAAE,eAAM;QACN,sEAAsE;QACtE,mBAAmB;QACrB;IACF;IACA,OAAOJ,UAAU;QAAEQ,SAASR;QAASI,MAAM;YAACJ;SAAQ;IAAC,IAAI;AAC3D;AAEA,sDAAsD,GACtD,OAAO,SAASS;IACd,OAAOV,gCAAgC;AACzC;AAEA,MAAMW,cAAc,CAACC,QAAgBC,aAAuB,CAAC,MAAM,EAAED,OAAO,CAAC,EAAEtB,QAAQ,CAAC,EAAEuB,WAAW,OAAO,CAAC;AAE7G,0DAA0D,GAC1D,OAAO,SAASC;IACd,OAAO,CAAC,MAAM,EAAE5B,YAAY,IAAI6B,QAAQ,CAAC,cAAc;AACzD;AAEA,8DAA8D,GAC9D,OAAO,SAASC,iBAAiBC,MAAc,EAAEC,gBAAwB,EAAEC,IAAY;IACrF,OAAOnC,WAAW,UAAUiC,QAAQG,MAAM,CAAChC,SAASiC,yBAAyB,CAACH,kBAAkBC,OAAOG,MAAM,CAAC;AAChH;AAEA,MAAMC,aAAa,CAACC,WAAsBZ,SAAmBY,UAAUC,UAAU,CAAC,SAASC,GAAG,CAACd;AAE/F,eAAee,WACbH,SAAoB,EACpBZ,MAAc,EACdC,UAAkB,EAClBe,OAAyB;QAIHC;IAFtB,MAAMC,UAAUP,WAAWC,WAAWZ;IACtC,MAAMiB,WAAW,MAAMC,QAAQL,UAAU,CAAC,uBAAuBC,GAAG,CAACb,YAAYkB,GAAG;IACpF,MAAMC,SAASpC,QAAOiC,gBAAAA,SAASE,GAAG,CAAC,2BAAbF,gBAAgC;IACtD,IAAI,CAACG,QAAQ,MAAM,IAAIC,MAAM;IAC7B,OAAOrD,WAAWoD,QAAQJ,SAAS;QAAEM,SAASvB,YAAYC,QAAQC;IAAY,GAAGsB,SAAS;AAC5F;AAEA,SAASC,mBACPxB,MAAc,EACdC,UAAkB,EAClBI,MAAc,EACdW,OAAyB,EACzBS,GAAW;IAEX,OAAO;QACLC,cAAcxD,WAAWmC,QAAQW,QAAQnB,OAAO,EAAE;YAAEyB,SAASvB,YAAYC,QAAQC;QAAY;QAC7F0B,aAAaX,QAAQnB,OAAO,CAACD,EAAE;QAC/BgC,aAAaH;IACf;AACF;AAQA;;;CAGC,GACD,OAAO,eAAeI,iBAAiBC,KAQtC;QACeA;IAAd,MAAMC,SAAQD,aAAAA,MAAML,GAAG,YAATK,aAAaE,KAAKP,GAAG;IACnC,MAAMQ,YAAYF;IAClB,MAAMG,YAAYC,KAAKC,KAAK,CAACH,YAAY;IACzC,MAAMI,YAAY7D,SAAS8D,2BAA2B,CAACJ,WAAW9B,iBAAiB0B,MAAMzB,MAAM,EAAE6B,WAAWJ,MAAMvB,IAAI;IACtH,IAAIgC,aAA4B;IAChC,IAAIC;IACJ,IAAI;YACoBV;QAAtB,MAAMW,SAAS,MAAM,EAACX,mBAAAA,MAAMY,SAAS,YAAfZ,mBAAmBpE,0BAA0BoE,MAAMa,GAAG,EAAE;YAC5EC,QAAQ;YACRC,SAAS;gBACP,gBAAgB;gBAChB,cAAc;gBACd,CAACrE,SAASsE,8BAA8B,CAAC,EAAET;gBAC3C,CAAC7D,SAASuE,0BAA0B,CAAC,EAAEjB,MAAMkB,KAAK;gBAClD,CAACxE,SAASyE,6BAA6B,CAAC,EAAEnB,MAAMoB,OAAO;YACzD;YACA3C,MAAMuB,MAAMvB,IAAI;YAChB4C,QAAQC,YAAYC,OAAO,CAAC7E,SAAS8E,wBAAwB;QAC/D;QACA,IAAI,aAAab,QAAQ;YACvBD,QAAQ,CAAC,UAAU,EAAEhF,6BAA6BiF,OAAOc,OAAO,GAAG;QACrE,OAAO;YACLhB,aAAaE,OAAOe,MAAM;YAC1B,IAAI,CAAChF,SAASiF,oBAAoB,CAAClB,aAAa;gBAC9CC,QACED,cAAc,OAAOA,aAAa,MAC9B,CAAC,sBAAsB,EAAEA,WAAW,wCAAwC,CAAC,GAC7E,CAAC,sBAAsB,EAAEA,YAAY;YAC7C;QACF;IACF,EAAE,OAAOmB,QAAQ;;QACf,MAAMC,OAAQD,0BAAD,AAACA,OAAkBC,IAAI;QACpCnB,QACEmB,SAAS,kBAAkBA,SAAS,eAChC,CAAC,iBAAiB,EAAEnF,SAAS8E,wBAAwB,GAAG,KAAK,QAAQ,CAAC,GACtE,CAAC,uBAAuB,EAAEtE,eAAQ0E,0BAAD,AAACA,OAAkBE,OAAO,mBAAIF,QAAQG,KAAK,CAAC,GAAG,MAAM;IAC9F;IACA,MAAMC,UAAwC;QAC5CC,MAAM9B;QACNM;OACIC,QAAQ;QAAEA;IAAM,IAAI,CAAC;QACzBwB,YAAY7B,KAAK8B,GAAG,CAAC,GAAGlC,UAAUE;;IAEpC,OAAO;QAAE6B;QAASI,WAAW,CAAC1B;IAAM;AACtC;AAEA,SAAS2B,UAAU1C,GAAW;IAC5B,OAAO9D,cAAciD,SAAS,CAACwD,SAAS,CAACC,UAAU,CAAC5C,MAAM9C;AAC5D;AAEA,0EAA0E,GAC1E,eAAe2F,cACb1D,SAAoB,EACpBZ,MAAc,EACdC,UAAkB,EAClBsE,QAQC,EACD9B,MAA8B,EAC9Be,MAA2C,EAC3C/B,GAAW;;QASoC8C,iBAGhCA;IAVf,MAAMrD,UAAUP,WAAWC,WAAWZ;IACtC,MAAMwE,MAA8D;QAClEvE;QACAiD,SAASqB,SAASrB,OAAO;QACzBF,OAAOuB,SAASvB,KAAK;QACrByB,SAASF,SAASE,OAAO;QACzBjB;QACAkB,UAAUlG,SAASmG,yBAAyB,EAACJ,kBAAAA,SAASK,KAAK,qBAAdL,gBAAgBG,QAAQ,EAAEjC,OAAOqB,OAAO;QACrFvD,MAAMgE,SAAShE,IAAI,CAACsD,KAAK,CAAC,GAAGrF,SAASqG,sBAAsB;OACxDN,SAASO,IAAI,GAAG;QAAEA,MAAM;IAAK,IAAI,CAAC;QACtCC,WAAW,WAAER,mBAAAA,SAASK,KAAK,qBAAdL,iBAAgBQ,WAAW,mBAAItD;QAC5CG,aAAaH;QACb0C,WAAWA,UAAU1C;;IAEvB,MAAMP,QAAQL,UAAU,CAAC,0BAA0BC,GAAG,CAACyD,SAAS3E,EAAE,EAAEoF,GAAG,CAACR;IACxE,MAAMtD,QACHL,UAAU,CAAC,iBACXC,GAAG,CAACb,YACJO,MAAM,CAAC;QACNyE,kBAAkBxD;QAClByD,oBAAoB1B;QACpB2B,qBAAqB1C,OAAOyB,SAAS,GAAG,IAAIvG,cAAciD,SAAS,CAACwE,UAAU,CAACC,SAAS,CAAC;IAC3F,GACCC,KAAK,CAAC,IAAMC;AACjB;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,4BACpBC,QAAmC,EACnCC,OAA4E,CAAC,CAAC;QAUhEA,iBASWD;QAAF;IAjBvB,MAAM7E,YAAYjD,cAAcgI,GAAG,GAAG/E,SAAS;IAC/C,MAAMM,UAAUP,WAAWC,WAAW6E,SAASzF,MAAM;IACrD,MAAM4F,YAAY,MAAM1E,QAAQL,UAAU,CAAC,iBAAiBgF,KAAK,CAAC,WAAW,MAAM,MAAM1E,GAAG;IAC5F,MAAM2E,SAASF,UAAUG,IAAI,CAACC,MAAM,CAAC,CAAClF,MACpCtC,SAASyH,iBAAiB,CAACnF,IAAIoF,IAAI,IAAqCT,SAASzC,KAAK,EAAEyC,SAASU,YAAY;IAE/G,IAAIL,OAAOM,MAAM,KAAK,GAAG,OAAO;QAAElC,WAAW;QAAGmC,QAAQ;IAAE;IAC1D,MAAMrF,UAAU5B;IAChB,MAAM2C,SAAQ2D,YAAAA,KAAKjE,GAAG,YAARiE,YAAY1D,KAAKP,GAAG;IAClC,MAAM6E,QAAQb,SAAS3B,OAAO,IAAIjG;IAClC,MAAM0C,OAAO/B,SAAS+H,gBAAgB,CAAC;QACrCrD,SAASuC,SAAS7F,EAAE;QACpBoD,OAAOyC,SAASzC,KAAK;QACrBmD,cAAcV,SAASU,YAAY;QACnCnG,QAAQyF,SAASzF,MAAM;QACvBwG,SAASf,SAASe,OAAO;IAC3B;IACA,MAAM/B,UAAUzF,gBAAO,SAAA,EAAEyG,oBAAAA,SAASe,OAAO,YAAhBf,oBAAoB,CAAC,GAAoCgB,KAAK,qBAAhE,OAAkE7G,EAAE,mBAAI,OAAO;IACtG,MAAM8G,WAAW,MAAMC,QAAQC,GAAG,CAChCd,OAAOe,GAAG,CAAC,OAAO/F;QAChB,MAAMgG,WAAWhG,IAAIoF,IAAI;QACzB,MAAMa,aAAavI,SAASwI,sBAAsB,CAACvB,SAAS7F,EAAE,EAAEkB,IAAIlB,EAAE;QACtE,MAAMqH,gBAAgB,MAAM/F,QAAQL,UAAU,CAAC,0BAA0BC,GAAG,CAACiG,YAAY5F,GAAG;QAC5F,MAAMyD,QAAQqC,cAAcC,MAAM,GAAID,cAAcf,IAAI,KAAuC;QAC/F,qEAAqE;QACrE,IAAItB,CAAAA,yBAAAA,MAAOpB,MAAM,MAAK,aAAa,OAAO;QAC1C,MAAM2D,UAAU,MAAMC,gBAAgB;YACpCxG;YACAZ,QAAQyF,SAASzF,MAAM;YACvBC,YAAYa,IAAIlB,EAAE;YAClB+C,KAAKmE,SAASnE,GAAG;YACjB3B;YACAgC,OAAOyC,SAASzC,KAAK;YACrBE,SAASuC,SAAS7F,EAAE;YACpBW;YACAwB;YACAW,WAAWgD,KAAKhD,SAAS;QAC3B;QACA,MAAMc,SAA8C2D,QAAQjD,SAAS,GAAG,cAAcoC,QAAQ,WAAW;QACzG,MAAMhC,cACJ1D,WACA6E,SAASzF,MAAM,EACfc,IAAIlB,EAAE,EACN;YAAEA,IAAImH;YAAY7D,SAASuC,SAAS7F,EAAE;YAAEoD,OAAOyC,SAASzC,KAAK;YAAEyB;YAASlE;YAAMqE;QAAM,GACpFuC,SACA3D,QACAzB;QAEF,IAAIyB,WAAW,UAAU;gBAMc2D;YALrC,MAAMvJ,mBAAmB6H,SAASzF,MAAM,EAAE;gBACxCqH,MAAM;gBACNC,OAAO;gBACP/G,MACE,GAAGkF,SAASzC,KAAK,CAAC,eAAe,EAAEuE,SAAST,SAASnE,GAAG,EAAE,iBAAiB,CAAC,GAC5E,GAAG8C,SAAS3B,OAAO,CAAC,WAAW,GAAEqD,yBAAAA,QAAQrD,OAAO,CAACtB,KAAK,YAArB2E,yBAAyB,YAAY,GAAG,CAAC,GAC1E;gBACFK,MAAM,CAAC,CAAC,EAAE/B,SAASzF,MAAM,CAAC,kBAAkB,CAAC;YAC/C,GAAGsF,KAAK,CAAC,IAAMC;QACjB;QACA,OAAO/B;IACT;IAEF,MAAMU,YAAYwC,SAASV,MAAM,CAAC,CAACxC,SAAWA,WAAW,aAAa4C,MAAM;IAC5E,MAAMC,SAASK,SAASN,MAAM,GAAGlC;IACjC,IAAImC,SAAS,KAAK,CAACC,OAAO;QACxB,MAAM,IAAIjF,MAAM,GAAGgF,OAAO,IAAI,EAAEK,SAASN,MAAM,CAAC,sCAAsC,EAAEX,SAASzC,KAAK,EAAE;IAC1G;IACA,OAAO;QAAEkB;QAAWmC;IAAO;AAC7B;AAEA,qFAAqF,GACrF,eAAee,gBAAgBtF,KAW9B;IACC,MAAMuE,SAAS,CAAC7D,QAA2C,CAAA;YACzD0B,WAAW;YACXJ,SAAS;gBAAEC,MAAMjC,MAAMC,KAAK;gBAAIQ,YAAY;gBAAMC;gBAAOwB,YAAY;YAAE;QACzE,CAAA;IACA,IAAI,CAAClC,MAAMd,OAAO,EAAE,OAAOqF,OAAO;IAClC,IAAIhG;IACJ,IAAI;QACFA,SAAS,MAAMU,WAAWe,MAAMlB,SAAS,EAAEkB,MAAM9B,MAAM,EAAE8B,MAAM7B,UAAU,EAAE6B,MAAMd,OAAO;IAC1F,EAAE,OAAOwB,OAAO;;QACd,OAAO6D,OAAO,CAAC,sCAAsC,EAAErH,eAAQwD,yBAAD,AAACA,MAAiBoB,OAAO,mBAAIpB,OAAOqB,KAAK,CAAC,GAAG,MAAM;IACnH;IACA,OAAOhC,iBAAiB;QACtBc,KAAKb,MAAMa,GAAG;QACdtC;QACA2C,OAAOlB,MAAMkB,KAAK;QAClBE,SAASpB,MAAMoB,OAAO;QACtB3C,MAAMuB,MAAMvB,IAAI;QAChBmC,WAAWZ,MAAMY,SAAS;QAC1BjB,KAAKK,MAAMC,KAAK;IAClB;AACF;AAEA,SAASwF,SAAS5E,GAAW;IAC3B,IAAI;QACF,OAAO,IAAI8E,IAAI9E,KAAK+E,QAAQ;IAC9B,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAMC,UAAU;IAAC;IAAU;IAAU;IAAU;IAAe;IAAU;IAAQ;CAAS;AAGzF,MAAMC,OAAO,CAACC,QAAkBC,QAAQD,UAAUA,MAAMzB,MAAM,IAAI,QAAQ,CAAC,WAAWtB,IAAI,CAAC+C,UAAU,CAACA,MAAME,QAAQ,CAAC;AAErH,SAASC,SAAS1I,GAAY;IAC5B,MAAMqD,MAAM3D,OAAOM,cAAAA,MAAO,IAAIC,IAAI;IAClC,IAAI,CAACoD,KAAK,OAAO;QAAEH,OAAO;IAA+B;IACzD,IAAIG,IAAIyD,MAAM,GAAG,MAAM,OAAO;QAAE5D,OAAO;IAA2B;IAClE,MAAMe,UAAU9F,qBAAqBkF;IACrC,IAAIY,SAAS,OAAO;QAAEf,OAAO,CAAC,8BAA8B,EAAEhF,6BAA6B+F,UAAU;IAAC;IACtG,OAAO;QAAEZ;IAAI;AACf;AAEA,MAAMsF,mBAAmB,CAAC3I,MAAiBN,OAAOM,cAAAA,MAAO,IAAIC,IAAI,GAAGsE,KAAK,CAAC,GAAG;AAE7E;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMqE,uBAAyC,OAAOC,KAAKC;QAEnCD,4BASP5H,cACAA;IAXtB,IAAI4H,IAAIvF,MAAM,KAAK,QAAQ,OAAOwF,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;QAAE7F,OAAO;IAAqB;IACrF,MAAM8F,gBAAgBtJ,QAAOmJ,6BAAAA,IAAItF,OAAO,CAACyF,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMI,UAAUD,cAAcE,UAAU,CAAC,aAAaF,cAAczE,KAAK,CAAC,UAAUuC,MAAM,IAAIb;IAC9F,IAAI,CAACgD,SAAS,OAAOH,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;QAAE7F,OAAO;IAAkB;IACrE,IAAIjC;IACJ,IAAI;YACM;QAARA,QAAQ,OAAA,OAAO4H,IAAI5H,IAAI,KAAK,WAAWkI,KAAKC,KAAK,CAACP,IAAI5H,IAAI,IAAI4H,IAAI5H,IAAI,YAA9D,OAAmE,CAAC;IAC9E,EAAE,eAAM;QACN,OAAO6H,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;YAAE7F,OAAO;QAAe;IACtD;IACA,MAAMxC,SAAShB,QAAOuB,eAAAA,KAAKP,MAAM,YAAXO,eAAe;IACrC,MAAMoI,SAAS3J,QAAOuB,eAAAA,KAAKoI,MAAM,YAAXpI,eAAe;IACrC,IAAI,CAACqH,KAAK5H,SAAS,OAAOoI,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;QAAE7F,OAAO;IAAiB;IACzE,IAAI,CAACmF,QAAQI,QAAQ,CAACY,SAAS,OAAOP,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;QAAE7F,OAAO;IAAiB;IACrF,IAAI;YAMGoG,mBAwFqBrI;QA7F1B,MAAMsI,UAAU,MAAMlL,cAAcgI,GAAG,GAAGmD,IAAI,GAAGC,aAAa,CAACR;QAC/D,MAAM3H,YAAYjD,cAAcgI,GAAG,GAAG/E,SAAS;QAC/C,MAAMM,UAAUP,WAAWC,WAAWZ;QACtC,MAAM4I,eAAe,MAAM1H,QAAQC,GAAG;QACtC,IAAI,CAACyH,aAAa1B,MAAM,EAAE,OAAOkB,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;YAAE7F,OAAO;QAAe;QAC9E,IAAI,EAACoG,oBAAAA,aAAazH,GAAG,CAAC,0BAAjByH,oBAAmC,CAAC,EAAE,CAACC,QAAQG,GAAG,CAAC,KAAK,SAAS;YACpE,OAAOZ,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAO;YAAuC;QAC9E;QACA,MAAMyG,aAAa,MAAMnL,sBAAsB+K,QAAQG,GAAG,EAAE;YAAEhJ;QAAO;QACrE,IAAI,CAACiJ,WAAWC,OAAO,IAAID,WAAWE,QAAQ,KAAK,SAAS;YAC1D,OAAOf,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAO;YAA0D;QACjG;QACA,MAAMxB,UAAU5B;QAChB,IAAIuJ,WAAW,UAAU;YACvB,OAAOP,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAC1Be,YAAYtB,QAAQ9G;gBACpBqI,cAAc7K,SAAS8K,2BAA2B;gBAClDC,QAAQhL,4BAA4BsI,GAAG,CAAC,CAAC2C,QAAW,CAAA;wBAClDxG,OAAOwG,MAAMxG,KAAK,CAACpD,EAAE;wBACrB6J,OAAOD,MAAMC,KAAK;wBAClBC,aAAaF,MAAME,WAAW;oBAChC,CAAA;YACF;QACF;QACA,IAAI,CAAC1I,SAAS;YACZ,OAAOoH,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAO;YAAuD;QAC9F;QACA,MAAMf,MAAMO,KAAKP,GAAG;QACpB,MAAMmE,YAAY1E,QAAQL,UAAU,CAAC;QAErC,IAAI8H,WAAW,UAAU;YACvB,MAAMhG,MAAMqF,SAASzH,KAAKoC,GAAG;YAC7B,IAAI,WAAWA,KAAK,OAAOyF,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAOG,IAAIH,KAAK;YAAC;YACnE,MAAM+G,SAAS/K,SAASmL,2BAA2B,CAACpJ,KAAKgJ,MAAM;YAC/D,IAAIA,OAAOnD,MAAM,KAAK,GAAG,OAAOgC,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAO;YAA4B;YAC1F,MAAMnC,SAASH;YACf,MAAM0J,MAAMhE,UAAU9E,GAAG,CAACxD;YAC1B,MAAMuM,UAAU,MAAMjJ,UAAUkJ,cAAc,CAAC,OAAOC;gBACpD,MAAMC,WAAW,MAAMD,YAAY5I,GAAG,CAACyE,UAAUqE,KAAK,CAACzL,SAAS8K,2BAA2B;gBAC3F,IAAIU,SAASE,IAAI,IAAI1L,SAAS8K,2BAA2B,EAAE,OAAO;gBAClE,MAAMxC,WAA0C;oBAC9CnE,KAAKA,IAAIA,GAAG;oBACZ4G;oBACAY,SAAS;mBACLlC,iBAAiB1H,KAAKmJ,WAAW,IAAI;oBAAEA,aAAazB,iBAAiB1H,KAAKmJ,WAAW;gBAAE,IAAI,CAAC;oBAChGU,YAAY/J,OAAOwD,KAAK,CAAC,CAAC;oBAC1BsB,qBAAqB;oBACrBJ,aAAatD;oBACbG,aAAaH;oBACb4I,WAAWxB,QAAQG,GAAG;;gBAExBe,YAAYO,MAAM,CAACV,KAAK9C;gBACxBiD,YAAYO,MAAM,CAACpJ,QAAQL,UAAU,CAAC,uBAAuBC,GAAG,CAAC8I,IAAIhK,EAAE,GAAG4B,mBAAmBxB,QAAQ4J,IAAIhK,EAAE,EAAES,QAAQW,SAASS;gBAC9H,OAAO;YACT;YACA,IAAI,CAACoI,SAAS;gBACZ,OAAOzB,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;oBAAE7F,OAAO,CAAC,iBAAiB,EAAEhE,SAAS8K,2BAA2B,CAAC,kBAAkB,CAAC;gBAAC;YACpH;YACA,OAAOlB,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAEkC,IAAI;gBAAM3K,IAAIgK,IAAIhK,EAAE;gBAAES;YAAO;QAC7D;QAEA,IAAIsI,WAAW,UAAU;gBACGpI;YAA1B,MAAMwG,aAAa/H,QAAOuB,mBAAAA,KAAKwG,UAAU,YAAfxG,mBAAmB;YAC7C,IAAI,CAACqH,KAAKb,aAAa,OAAOqB,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAO;YAAqB;YACjF,MAAMgI,cAActJ,QAAQL,UAAU,CAAC,0BAA0BC,GAAG,CAACiG;YACrE,MAAM0D,mBAAmB,MAAMD,YAAYrJ,GAAG;YAC9C,IAAI,CAACsJ,iBAAiBvD,MAAM,EAAE,OAAOkB,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAO;YAAmB;YACtF,MAAM+B,WAAWkG,iBAAiBvE,IAAI;YACtC,MAAMwE,mBAAmB,MAAM9E,UAAU9E,GAAG,CAACyD,SAAStE,UAAU,EAAEkB,GAAG;YACrE,IAAI,CAACuJ,iBAAiBxD,MAAM,EAAE,OAAOkB,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAE7F,OAAO;YAA4B;YAC/F,IAAI+B,SAAShE,IAAI,CAAC6F,MAAM,IAAI5H,SAASqG,sBAAsB,EAAE;gBAC3D,OAAOuD,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;oBAAE7F,OAAO;gBAA8D;YACrG;YACA,MAAMsE,WAAW4D,iBAAiBxE,IAAI;YACtC,MAAM7F,SAAS,MAAMU,WAAWH,WAAWZ,QAAQuE,SAAStE,UAAU,EAAEe;YACxE,MAAMyB,SAAS,MAAMZ,iBAAiB;gBAAEc,KAAKmE,SAASnE,GAAG;gBAAEtC;gBAAQ2C,OAAOuB,SAASvB,KAAK;gBAAEE,SAASqB,SAASrB,OAAO;gBAAE3C,MAAMgE,SAAShE,IAAI;YAAC;YACzI,MAAMiD,SAA8Cf,OAAOyB,SAAS,GAChE,cACAK,SAASf,MAAM,KAAK,cAClB,cACAe,SAASf,MAAM;YACrB,MAAMc,cACJ1D,WACAZ,QACAuE,SAAStE,UAAU,EACnB;gBAAEL,IAAImH;gBAAY7D,SAASqB,SAASrB,OAAO;gBAAEF,OAAOuB,SAASvB,KAAK;gBAAEyB,SAASF,SAASE,OAAO;gBAAElE,MAAMgE,SAAShE,IAAI;gBAAEuE,MAAMP,SAASO,IAAI;gBAAEF,OAAOL;YAAS,GACzJ9B,QACAe,QACAxB,KAAKP,GAAG;YAEV,OAAO2G,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAEkC,IAAI;gBAAMrG,WAAWzB,OAAOyB,SAAS;gBAAEJ,SAASrB,OAAOqB,OAAO;YAAC;QAC/F;QAEA,MAAM7D,aAAajB,QAAOuB,mBAAAA,KAAKN,UAAU,YAAfM,mBAAmB;QAC7C,IAAI,CAACqH,KAAK3H,aAAa,OAAOmI,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;YAAE7F,OAAO;QAAqB;QACjF,MAAMmI,cAAc/E,UAAU9E,GAAG,CAACb;QAClC,MAAMyK,mBAAmB,MAAMC,YAAYxJ,GAAG;QAC9C,IAAI,CAACuJ,iBAAiBxD,MAAM,EAAE,OAAOkB,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;YAAE7F,OAAO;QAAmB;QACtF,MAAMsE,WAAW4D,iBAAiBxE,IAAI;QAEtC,IAAIyC,WAAW,UAAU;YACvB,MAAMiC,QAAgD;gBAAEhJ,aAAaH;YAAI;YACzE,IAAIlB,KAAKoC,GAAG,KAAK4C,WAAW;gBAC1B,MAAM5C,MAAMqF,SAASzH,KAAKoC,GAAG;gBAC7B,IAAI,WAAWA,KAAK,OAAOyF,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;oBAAE7F,OAAOG,IAAIH,KAAK;gBAAC;gBACnEoI,MAAMjI,GAAG,GAAGA,IAAIA,GAAG;YACrB;YACA,IAAIpC,KAAKgJ,MAAM,KAAKhE,WAAW;gBAC7B,MAAMgE,SAAS/K,SAASmL,2BAA2B,CAACpJ,KAAKgJ,MAAM;gBAC/D,IAAIA,OAAOnD,MAAM,KAAK,GAAG,OAAOgC,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;oBAAE7F,OAAO;gBAA4B;gBAC1FoI,MAAMrB,MAAM,GAAGA;YACjB;YACA,IAAIhJ,KAAK4J,OAAO,KAAK5E,WAAW;gBAC9BqF,MAAMT,OAAO,GAAGrC,QAAQvH,KAAK4J,OAAO;gBACpC,IAAIS,MAAMT,OAAO,EAAES,MAAMzF,mBAAmB,GAAG;YACjD;YACA,IAAI5E,KAAKmJ,WAAW,KAAKnE,WAAWqF,MAAMlB,WAAW,GAAGzB,iBAAiB1H,KAAKmJ,WAAW;YACzF,MAAMiB,YAAYnK,MAAM,CAACoK;YACzB,OAAOxC,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAEkC,IAAI;YAAK;QACzC;QAEA,IAAI5B,WAAW,eAAe;YAC5B,MAAMtI,SAASH;YACf,MAAM2K,QAAQjK,UAAUiK,KAAK;YAC7BA,MAAM7F,GAAG,CAAC9D,QAAQL,UAAU,CAAC,uBAAuBC,GAAG,CAACb,aAAauB,mBAAmBxB,QAAQC,YAAYI,QAAQW,SAASS;YAC7HoJ,MAAMrK,MAAM,CAACmK,aAAa;gBAAEP,YAAY/J,OAAOwD,KAAK,CAAC,CAAC;gBAAIjC,aAAaH;YAAI;YAC3E,MAAMoJ,MAAMC,MAAM;YAClB,OAAO1C,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAEkC,IAAI;gBAAMlK;YAAO;QACjD;QAEA,IAAIsI,WAAW,UAAU;YACvB,MAAMkC,QAAQjK,UAAUiK,KAAK;YAC7BA,MAAME,MAAM,CAACJ;YACbE,MAAME,MAAM,CAAC7J,QAAQL,UAAU,CAAC,uBAAuBC,GAAG,CAACb;YAC3D,MAAM4K,MAAMC,MAAM;YAClB,OAAO1C,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;gBAAEkC,IAAI;YAAK;QACzC;QAEA,OAAO;QACP,MAAMrH,UAAU,CAAC,KAAK,EAAE5E,YAAY,GAAG6B,QAAQ,CAAC,cAAc;QAC9D,MAAM6K,WAAWxM,SAAS+H,gBAAgB,CAAC;YACzCrD;YACAF,OAAOxE,SAASyM,wBAAwB;YACxC9E,cAAc1E;YACdzB;YACAwG,SAAS;gBAAE5C,SAAS,CAAC,kBAAkB,EAAErG,oBAAoB,6BAA6B,CAAC;YAAC;QAC9F;QACA,MAAM8C,SAAS,MAAMU,WAAWH,WAAWZ,QAAQC,YAAYe;QAC/D,MAAMyB,SAAS,MAAMZ,iBAAiB;YAAEc,KAAKmE,SAASnE,GAAG;YAAEtC;YAAQ2C,OAAOxE,SAASyM,wBAAwB;YAAE/H;YAAS3C,MAAMyK;QAAS;QACrI,MAAM1G,cACJ1D,WACAZ,QACAC,YACA;YAAEL,IAAIpB,SAASwI,sBAAsB,CAAC9D,SAASjD;YAAaiD;YAASF,OAAOxE,SAASyM,wBAAwB;YAAExG,SAAS;YAAMlE,MAAMyK;YAAUlG,MAAM;YAAMF,OAAO;QAAK,GACtKnC,QACAA,OAAOyB,SAAS,GAAG,cAAc,UACjClC,KAAKP,GAAG;QAEV,OAAO2G,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;YAAEkC,IAAI;YAAMrG,WAAWzB,OAAOyB,SAAS;YAAEJ,SAASrB,OAAOqB,OAAO;QAAC;IAC/F,EAAE,OAAOtB,OAAO;QACd0I,QAAQ1I,KAAK,CAAC,gCAAgCmG,QAAQnG;QACtD,OAAO4F,IAAI5E,MAAM,CAAC,KAAK6E,IAAI,CAAC;YAAE7F,OAAO;QAAsD;IAC7F;AACF,EAAC"}

package/src/lib/server/orders-shipping-prepare.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import * as Aglyn from '@aglyn/aglyn/server';
+/** The most open orders one `prepare` stamps; a store with more is stamped over several calls. */
+export declare const PREPARE_MAX_ORDERS = 2000;
+/**
+ * Stamps the site's open orders that predate the stamp. Answers how many it
+ * stamped. `updatedAtMs` is the order's creation, not now: stamping is not
+ * a change ShipStation needs to hear about.
+ */
+export declare function prepareOpenOrders(hostId: string): Promise<number>;
+export declare const ordersShippingPrepareHandler: Aglyn.PluginApiHandler;

package/src/lib/server/orders-shipping-prepare.js

@@ -0,0 +1,121 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import * as CommerceModel from "../model/index.js";
+/*
+ * `commerce/orders-shipping-prepare` (AGL-3613): POST `{ hostId }` stamps the
+ * site's open orders written before AGL-3613 with what the shipping export
+ * and a shipping tool's feed ask (`requiresShipping`, `updatedAtMs`), so the
+ * indexed query finds them. The console calls it before an export for
+ * shipping. Bounded to OPEN orders — the ones a shipping tool still has to
+ * see — and a no-op for an order already stamped. The site's admins and
+ * editors, the order book's roles.
+ */ /** Statuses a shipping tool still has to see an order in. */ const OPEN_STATUSES = [
+    'pending',
+    'paid',
+    'partially_fulfilled'
+];
+/** The most open orders one `prepare` stamps; a store with more is stamped over several calls. */ export const PREPARE_MAX_ORDERS = 2000;
+/**
+ * Stamps the site's open orders that predate the stamp. Answers how many it
+ * stamped. `updatedAtMs` is the order's creation, not now: stamping is not
+ * a change ShipStation needs to hear about.
+ */ export async function prepareOpenOrders(hostId) {
+    const firestore = firebaseAdmin.app().firestore();
+    const orders = firestore.collection('hosts').doc(hostId).collection('orders');
+    const snapshot = await orders.where('status', 'in', [
+        ...OPEN_STATUSES
+    ]).limit(PREPARE_MAX_ORDERS).get();
+    let stamped = 0;
+    let batch = firestore.batch();
+    let inBatch = 0;
+    for (const doc of snapshot.docs){
+        var _doc_data;
+        const data = (_doc_data = doc.data()) != null ? _doc_data : {};
+        if (typeof data.requiresShipping === 'boolean' && typeof data.updatedAtMs === 'number') continue;
+        const createdAtMs = Number(data.createdAtMs);
+        batch.update(doc.ref, _extends({}, typeof data.requiresShipping === 'boolean' ? {} : {
+            requiresShipping: CommerceModel.orderRequiresShipping(data)
+        }, typeof data.updatedAtMs === 'number' ? {} : {
+            updatedAtMs: Number.isFinite(createdAtMs) && createdAtMs > 0 ? createdAtMs : Date.now()
+        }));
+        stamped += 1;
+        inBatch += 1;
+        if (inBatch === 400) {
+            await batch.commit();
+            batch = firestore.batch();
+            inBatch = 0;
+        }
+    }
+    if (inBatch) await batch.commit();
+    return stamped;
+}
+export const ordersShippingPrepareHandler = async (req, res)=>{
+    var _req_headers_authorization, _body_hostId;
+    if (req.method !== 'POST') return res.status(405).json({
+        error: 'Method not allowed'
+    });
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    let body;
+    try {
+        var _req_body;
+        body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    } catch (unused) {
+        return res.status(400).json({
+            error: 'The request could not be read'
+        });
+    }
+    const hostId = String((_body_hostId = body['hostId']) != null ? _body_hostId : '');
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(hostId)) return res.status(400).json({
+        error: 'Missing hostId'
+    });
+    try {
+        var _hostSnapshot_get;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const hostSnapshot = await firebaseAdmin.app().firestore().collection('hosts').doc(hostId).get();
+        if (!hostSnapshot.exists) return res.status(404).json({
+            error: 'Unknown site'
+        });
+        const role = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (role !== 'admin' && role !== 'editor') return res.status(403).json({
+            error: 'Not permitted'
+        });
+        const owner = await getOrgForHost(hostId);
+        if (!Aglyn.checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) {
+            return res.status(403).json({
+                error: 'Selling is not enabled'
+            });
+        }
+        const stamped = await prepareOpenOrders(hostId);
+        return res.status(200).json({
+            ok: true,
+            stamped
+        });
+    } catch (error) {
+        console.error('orders-shipping-prepare failed', hostId, error);
+        return res.status(500).json({
+            error: 'That did not work. Try again.'
+        });
+    }
+};
+
+//# sourceMappingURL=orders-shipping-prepare.js.map

package/src/lib/server/orders-shipping-prepare.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/orders-shipping-prepare.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport * as CommerceModel from '../model'\n\n/*\n * `commerce/orders-shipping-prepare` (AGL-3613): POST `{ hostId }` stamps the\n * site's open orders written before AGL-3613 with what the shipping export\n * and a shipping tool's feed ask (`requiresShipping`, `updatedAtMs`), so the\n * indexed query finds them. The console calls it before an export for\n * shipping. Bounded to OPEN orders — the ones a shipping tool still has to\n * see — and a no-op for an order already stamped. The site's admins and\n * editors, the order book's roles.\n */\n\n/** Statuses a shipping tool still has to see an order in. */\nconst OPEN_STATUSES: readonly CommerceModel.OrderStatus[] = ['pending', 'paid', 'partially_fulfilled']\n\n/** The most open orders one `prepare` stamps; a store with more is stamped over several calls. */\nexport const PREPARE_MAX_ORDERS = 2000\n\n/**\n * Stamps the site's open orders that predate the stamp. Answers how many it\n * stamped. `updatedAtMs` is the order's creation, not now: stamping is not\n * a change ShipStation needs to hear about.\n */\nexport async function prepareOpenOrders(hostId: string): Promise<number> {\n  const firestore = firebaseAdmin.app().firestore()\n  const orders = firestore.collection('hosts').doc(hostId).collection('orders')\n  const snapshot = await orders.where('status', 'in', [...OPEN_STATUSES]).limit(PREPARE_MAX_ORDERS).get()\n  let stamped = 0\n  let batch = firestore.batch()\n  let inBatch = 0\n  for (const doc of snapshot.docs) {\n    const data = (doc.data() ?? {}) as Partial<CommerceModel.HostOrder> & { requiresShipping?: unknown; updatedAtMs?: unknown; createdAtMs?: unknown }\n    if (typeof data.requiresShipping === 'boolean' && typeof data.updatedAtMs === 'number') continue\n    const createdAtMs = Number(data.createdAtMs)\n    batch.update(doc.ref, {\n      ...(typeof data.requiresShipping === 'boolean' ? {} : { requiresShipping: CommerceModel.orderRequiresShipping(data) }),\n      ...(typeof data.updatedAtMs === 'number'\n        ? {}\n        : { updatedAtMs: Number.isFinite(createdAtMs) && createdAtMs > 0 ? createdAtMs : Date.now() }),\n    })\n    stamped += 1\n    inBatch += 1\n    if (inBatch === 400) {\n      await batch.commit()\n      batch = firestore.batch()\n      inBatch = 0\n    }\n  }\n  if (inBatch) await batch.commit()\n  return stamped\n}\n\nexport const ordersShippingPrepareHandler: Aglyn.PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  let body: Record<string, unknown>\n  try {\n    body = typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  } catch {\n    return res.status(400).json({ error: 'The request could not be read' })\n  }\n  const hostId = String(body['hostId'] ?? '')\n  if (!/^[A-Za-z0-9_-]{1,128}$/.test(hostId)) return res.status(400).json({ error: 'Missing hostId' })\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const hostSnapshot = await firebaseAdmin.app().firestore().collection('hosts').doc(hostId).get()\n    if (!hostSnapshot.exists) return res.status(404).json({ error: 'Unknown site' })\n    const role = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (role !== 'admin' && role !== 'editor') return res.status(403).json({ error: 'Not permitted' })\n    const owner = await getOrgForHost(hostId)\n    if (!Aglyn.checkEntitlement(owner?.org as never, 'commerce')) {\n      return res.status(403).json({ error: 'Selling is not enabled' })\n    }\n    const stamped = await prepareOpenOrders(hostId)\n    return res.status(200).json({ ok: true, stamped })\n  } catch (error) {\n    console.error('orders-shipping-prepare failed', hostId, error)\n    return res.status(500).json({ error: 'That did not work. Try again.' })\n  }\n}\n"],"names":["Aglyn","firebaseAdmin","getOrgForHost","CommerceModel","OPEN_STATUSES","PREPARE_MAX_ORDERS","prepareOpenOrders","hostId","firestore","app","orders","collection","doc","snapshot","where","limit","get","stamped","batch","inBatch","docs","data","requiresShipping","updatedAtMs","createdAtMs","Number","update","ref","orderRequiresShipping","isFinite","Date","now","commit","ordersShippingPrepareHandler","req","res","body","method","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","test","hostSnapshot","decoded","auth","verifyIdToken","exists","role","uid","owner","checkEntitlement","org","ok","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAC5C,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,YAAYC,mBAAmB,oBAAU;AAEzC;;;;;;;;CAQC,GAED,2DAA2D,GAC3D,MAAMC,gBAAsD;IAAC;IAAW;IAAQ;CAAsB;AAEtG,gGAAgG,GAChG,OAAO,MAAMC,qBAAqB,KAAI;AAEtC;;;;CAIC,GACD,OAAO,eAAeC,kBAAkBC,MAAc;IACpD,MAAMC,YAAYP,cAAcQ,GAAG,GAAGD,SAAS;IAC/C,MAAME,SAASF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACL,QAAQI,UAAU,CAAC;IACpE,MAAME,WAAW,MAAMH,OAAOI,KAAK,CAAC,UAAU,MAAM;WAAIV;KAAc,EAAEW,KAAK,CAACV,oBAAoBW,GAAG;IACrG,IAAIC,UAAU;IACd,IAAIC,QAAQV,UAAUU,KAAK;IAC3B,IAAIC,UAAU;IACd,KAAK,MAAMP,OAAOC,SAASO,IAAI,CAAE;YACjBR;QAAd,MAAMS,QAAQT,YAAAA,IAAIS,IAAI,cAART,YAAc,CAAC;QAC7B,IAAI,OAAOS,KAAKC,gBAAgB,KAAK,aAAa,OAAOD,KAAKE,WAAW,KAAK,UAAU;QACxF,MAAMC,cAAcC,OAAOJ,KAAKG,WAAW;QAC3CN,MAAMQ,MAAM,CAACd,IAAIe,GAAG,EAAE,aAChB,OAAON,KAAKC,gBAAgB,KAAK,YAAY,CAAC,IAAI;YAAEA,kBAAkBnB,cAAcyB,qBAAqB,CAACP;QAAM,GAChH,OAAOA,KAAKE,WAAW,KAAK,WAC5B,CAAC,IACD;YAAEA,aAAaE,OAAOI,QAAQ,CAACL,gBAAgBA,cAAc,IAAIA,cAAcM,KAAKC,GAAG;QAAG;QAEhGd,WAAW;QACXE,WAAW;QACX,IAAIA,YAAY,KAAK;YACnB,MAAMD,MAAMc,MAAM;YAClBd,QAAQV,UAAUU,KAAK;YACvBC,UAAU;QACZ;IACF;IACA,IAAIA,SAAS,MAAMD,MAAMc,MAAM;IAC/B,OAAOf;AACT;AAEA,OAAO,MAAMgB,+BAAuD,OAAOC,KAAKC;QAEjDD,4BASPE;IAVtB,IAAIF,IAAIG,MAAM,KAAK,QAAQ,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAqB;IACrF,MAAMC,gBAAgBC,QAAOR,6BAAAA,IAAIS,OAAO,CAACF,aAAa,YAAzBP,6BAA6B;IAC1D,MAAMU,UAAUH,cAAcI,UAAU,CAAC,aAAaJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IAAIC;IAC9F,IAAI,CAACJ,SAAS,OAAOT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,IAAIJ;IACJ,IAAI;YAC4DF;QAA9DE,OAAO,OAAOF,IAAIE,IAAI,KAAK,WAAWa,KAAKC,KAAK,CAAChB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IAC7E,EAAE,eAAM;QACN,OAAOC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgC;IACvE;IACA,MAAMjC,SAASmC,QAAON,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;IACxC,IAAI,CAAC,yBAAyBe,IAAI,CAAC5C,SAAS,OAAO4B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAiB;IAClG,IAAI;YAIYY;QAHd,MAAMC,UAAU,MAAMpD,cAAcQ,GAAG,GAAG6C,IAAI,GAAGC,aAAa,CAACX;QAC/D,MAAMQ,eAAe,MAAMnD,cAAcQ,GAAG,GAAGD,SAAS,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACL,QAAQS,GAAG;QAC9F,IAAI,CAACoC,aAAaI,MAAM,EAAE,OAAOrB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAe;QAC9E,MAAMiB,OAAO,EAACL,oBAAAA,aAAapC,GAAG,CAAC,0BAAjBoC,oBAAmC,CAAC,EAAE,CAACC,QAAQK,GAAG,CAAC;QACjE,IAAID,SAAS,WAAWA,SAAS,UAAU,OAAOtB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;QAChG,MAAMmB,QAAQ,MAAMzD,cAAcK;QAClC,IAAI,CAACP,MAAM4D,gBAAgB,CAACD,yBAAAA,MAAOE,GAAG,EAAW,aAAa;YAC5D,OAAO1B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QACA,MAAMvB,UAAU,MAAMX,kBAAkBC;QACxC,OAAO4B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEuB,IAAI;YAAM7C;QAAQ;IAClD,EAAE,OAAOuB,OAAO;QACduB,QAAQvB,KAAK,CAAC,kCAAkCjC,QAAQiC;QACxD,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgC;IACvE;AACF,EAAC"}

package/src/lib/server/payment-method-domains.d.ts

@@ -0,0 +1,209 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type SiteReturnHost } from '@aglyn/aglyn/app-utils/site-return-url';
+/**
+ * Stripe payment method domains for storefronts (AGL-3629).
+ *
+ * The in-page checkout mounts Stripe's Payment Element on the merchant's own
+ * domain, and Stripe shows Apple Pay there only on a REGISTERED domain (Google
+ * Pay, Link, Amazon Pay and Klarna's express button use the same registration).
+ * Nothing registered one, so a shopper on `shop.example.com` with a card in
+ * Apple Wallet never saw the button.
+ *
+ * ## Which account the domain is registered on
+ *
+ * Stripe's rule: "The domain where the charge is being run needs to be
+ * registered for the user running the charge." Storefront charges are
+ * DESTINATION charges created by the platform with no `Stripe-Account` header
+ * and no `on_behalf_of`, so the platform runs them and the platform's key
+ * registers the domain, with no `Stripe-Account` header. A direct-charge flow
+ * would register on the connected account instead; there is none today, and
+ * `registerOnPlatform` is named for that reason.
+ *
+ * ## When
+ *
+ *  - On connect: core raises `host.domain.attached`, and commerce registers
+ *    the custom domain and its `www.` twin.
+ *  - On first checkout: the session handlers call `ensureCheckoutDomain` for
+ *    the page the shopper is on, which covers every `{site}.aglyn.app`
+ *    subdomain without registering thousands of sites that never sell.
+ *  - Daily: `reconcileCustomDomains` registers any connected custom domain the
+ *    first two missed (domains connected before AGL-3629 included) — the
+ *    backfill is a job rather than a one-off script, so it also repairs a
+ *    missed event later.
+ *  - On release: `host.domain.released` DISABLES the domain. Stripe has no
+ *    delete; a disabled domain stops showing the methods and can be enabled
+ *    again if the name comes back.
+ *
+ * ## The cache
+ *
+ * `paymentMethodDomains/{mode}~{domain}` records what Stripe last said, so a
+ * checkout costs one document read rather than a Stripe round trip. The mode is
+ * in the id because a test key and a live key register in different worlds and
+ * a domain registered in one is not registered in the other. Server-only: the
+ * rules deny every client.
+ */
+export declare const PAYMENT_METHOD_DOMAINS_COLLECTION = "paymentMethodDomains";
+/** How long a recorded registration is trusted before Stripe is asked again. */
+export declare const PAYMENT_METHOD_DOMAIN_RECHECK_MS: number;
+/** The most a checkout waits on Stripe before selling without the domain. */
+export declare const CHECKOUT_DOMAIN_BUDGET_MS = 2500;
+export type StripeMode = 'live' | 'test';
+/** Stripe's per-method verdict on a domain. */
+export interface PaymentMethodDomainStatus {
+    applePay: string | null;
+    googlePay: string | null;
+    link: string | null;
+    amazonPay: string | null;
+    klarna: string | null;
+}
+export interface PaymentMethodDomainRecord {
+    domain: string;
+    mode: StripeMode;
+    stripeId: string | null;
+    enabled: boolean;
+    status: PaymentMethodDomainStatus;
+    hostId: string | null;
+    checkedAtMs: number;
+    lastError: string | null;
+}
+interface StripeDomainObject {
+    id: string;
+    domain_name: string;
+    enabled: boolean;
+    apple_pay?: {
+        status?: string;
+    };
+    google_pay?: {
+        status?: string;
+    };
+    link?: {
+        status?: string;
+    };
+    amazon_pay?: {
+        status?: string;
+    };
+    klarna?: {
+        status?: string;
+    };
+}
+/** Which Stripe world the platform key is in, from its prefix. */
+export declare function stripeModeOfKey(key: string | undefined): StripeMode | null;
+/**
+ * A hostname Stripe can register: lowercased, no trailing dot, at least two
+ * labels, and never a local or IP host — a checkout opened on `localhost`
+ * must not try to register it.
+ */
+export declare function registrableDomain(input: unknown): string | null;
+/** The cache document id for a domain in a mode. */
+export declare function paymentMethodDomainDocId(mode: StripeMode, domain: string): string;
+/**
+ * The domains a site's custom domain needs: the domain and its `www.` twin,
+ * since the platform answers on both (`siteOwnHosts`).
+ */
+export declare function customDomainNames(cname: unknown): string[];
+/**
+ * Register (or re-enable) one domain on the platform account. Idempotent end
+ * to end: an existing registration is found first and reused, a disabled one
+ * is enabled rather than duplicated, and the create carries an idempotency key
+ * so two checkouts racing on a fresh subdomain open one registration.
+ */
+export declare function registerOnPlatform(domain: string, signal?: AbortSignal): Promise<StripeDomainObject>;
+export interface EnsureDomainResult {
+    domain: string;
+    outcome: 'registered' | 'cached' | 'skipped' | 'failed';
+    record?: PaymentMethodDomainRecord;
+    error?: string;
+}
+/**
+ * Make sure one domain is registered and enabled, reading the cache first.
+ *
+ * Never throws: every caller is on its way to something more important (a
+ * sale, a domain connect), and a domain Stripe would not take today is
+ * recorded with its error and retried by the daily reconcile.
+ */
+export declare function ensurePaymentMethodDomain(rawDomain: string, options?: {
+    hostId?: string | null;
+    signal?: AbortSignal;
+    force?: boolean;
+}): Promise<EnsureDomainResult>;
+/**
+ * Disable a domain the platform no longer serves for a site. Stripe has no
+ * delete for a payment method domain; disabling stops every method on it, and
+ * `ensurePaymentMethodDomain` re-enables the same registration if the name is
+ * connected again.
+ */
+export declare function disablePaymentMethodDomain(rawDomain: string): Promise<{
+    domain: string;
+    outcome: 'disabled' | 'absent' | 'skipped' | 'failed';
+    error?: string;
+}>;
+/**
+ * Is a name still served for some OTHER site? A custom domain's `www.` twin
+ * can be another site's own `cname`, and an aglyn subdomain released by a
+ * deleted site can already belong to a new one. Disabling either would take
+ * Apple Pay away from a store that did nothing.
+ */
+export declare function domainStillClaimed(domain: string, exceptHostId: string): Promise<boolean>;
+/**
+ * The checkout's hook: register the domain the shopper is paying on, within a
+ * budget, before the client secret goes back to the browser. Only a name the
+ * SITE answers on is ever registered — the return URL has already been judged
+ * against `siteOwnHosts` by `siteReturnUrl`, and it is judged again here so a
+ * forged `Host` can never make the platform register a stranger's domain.
+ */
+export declare function ensureCheckoutDomain(input: {
+    pageUrl: string;
+    site: SiteReturnHost | null | undefined;
+    hostId: string;
+    budgetMs?: number;
+}): Promise<EnsureDomainResult | null>;
+/** One page of the daily reconcile. */
+export declare const RECONCILE_PAGE_SIZE = 200;
+/**
+ * The backfill and the safety net in one pass: every site with a connected
+ * custom domain gets its domain and `www.` twin registered. A cached, enabled
+ * registration costs one read and no Stripe call, so the steady state is cheap;
+ * a domain connected before AGL-3629, or whose connect event was lost, is
+ * registered on the first pass after it.
+ *
+ * Paged by `cname` with a cursor so it reads every site once and stops; the
+ * `cname > ''` range uses Firestore's automatic single-field index.
+ */
+export declare function reconcileCustomDomains(gate: {
+    isLocked(hostId: string): Promise<boolean>;
+}, options?: {
+    maxPages?: number;
+}): Promise<{
+    hosts: number;
+    registered: number;
+    failed: number;
+    skippedLocked: number;
+}>;
+/** Core's `host.domain.attached`: register the custom domain and its twin. */
+export declare function onHostDomainAttached(payload: {
+    hostId: string;
+    domain: string;
+}): Promise<void>;
+/** Core's `host.domain.released`: disable what no other site still serves. */
+export declare function onHostDomainReleased(payload: {
+    hostId: string;
+    domain: string;
+}): Promise<void>;
+/** The registrations a settings card shows for one site. */
+export declare function readSiteDomainRecords(site: SiteReturnHost | null | undefined): Promise<PaymentMethodDomainRecord[]>;
+export {};