@aglyn/plugins-commerce 1.0.0-beta.230 → 1.0.0-beta.232

package/src/lib/server/payment-method-domains.js

@@ -0,0 +1,444 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { siteOwnHosts } from "@aglyn/aglyn/app-utils/site-return-url";
+import { TENANT_APEX } from "@aglyn/aglyn/app-utils/tenant-apex";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+/**
+ * Stripe payment method domains for storefronts (AGL-3629).
+ *
+ * The in-page checkout mounts Stripe's Payment Element on the merchant's own
+ * domain, and Stripe shows Apple Pay there only on a REGISTERED domain (Google
+ * Pay, Link, Amazon Pay and Klarna's express button use the same registration).
+ * Nothing registered one, so a shopper on `shop.example.com` with a card in
+ * Apple Wallet never saw the button.
+ *
+ * ## Which account the domain is registered on
+ *
+ * Stripe's rule: "The domain where the charge is being run needs to be
+ * registered for the user running the charge." Storefront charges are
+ * DESTINATION charges created by the platform with no `Stripe-Account` header
+ * and no `on_behalf_of`, so the platform runs them and the platform's key
+ * registers the domain, with no `Stripe-Account` header. A direct-charge flow
+ * would register on the connected account instead; there is none today, and
+ * `registerOnPlatform` is named for that reason.
+ *
+ * ## When
+ *
+ *  - On connect: core raises `host.domain.attached`, and commerce registers
+ *    the custom domain and its `www.` twin.
+ *  - On first checkout: the session handlers call `ensureCheckoutDomain` for
+ *    the page the shopper is on, which covers every `{site}.aglyn.app`
+ *    subdomain without registering thousands of sites that never sell.
+ *  - Daily: `reconcileCustomDomains` registers any connected custom domain the
+ *    first two missed (domains connected before AGL-3629 included) — the
+ *    backfill is a job rather than a one-off script, so it also repairs a
+ *    missed event later.
+ *  - On release: `host.domain.released` DISABLES the domain. Stripe has no
+ *    delete; a disabled domain stops showing the methods and can be enabled
+ *    again if the name comes back.
+ *
+ * ## The cache
+ *
+ * `paymentMethodDomains/{mode}~{domain}` records what Stripe last said, so a
+ * checkout costs one document read rather than a Stripe round trip. The mode is
+ * in the id because a test key and a live key register in different worlds and
+ * a domain registered in one is not registered in the other. Server-only: the
+ * rules deny every client.
+ */ export const PAYMENT_METHOD_DOMAINS_COLLECTION = 'paymentMethodDomains';
+/** How long a recorded registration is trusted before Stripe is asked again. */ export const PAYMENT_METHOD_DOMAIN_RECHECK_MS = 7 * 24 * 60 * 60 * 1000;
+/** The most a checkout waits on Stripe before selling without the domain. */ export const CHECKOUT_DOMAIN_BUDGET_MS = 2500;
+/** Which Stripe world the platform key is in, from its prefix. */ export function stripeModeOfKey(key) {
+    const value = String(key != null ? key : '');
+    if (/^(sk|rk)_live_/.test(value)) return 'live';
+    if (/^(sk|rk)_test_/.test(value)) return 'test';
+    return null;
+}
+/**
+ * A hostname Stripe can register: lowercased, no trailing dot, at least two
+ * labels, and never a local or IP host — a checkout opened on `localhost`
+ * must not try to register it.
+ */ export function registrableDomain(input) {
+    const value = String(input != null ? input : '').trim().toLowerCase().replace(/\.+$/, '');
+    if (!value || value.length > 253) return null;
+    if (value === 'localhost' || value.endsWith('.localhost')) return null;
+    if (/^[0-9.]+$/.test(value) || value.includes(':')) return null;
+    if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(value)) return null;
+    return value;
+}
+/** The cache document id for a domain in a mode. */ export function paymentMethodDomainDocId(mode, domain) {
+    return `${mode}~${domain}`;
+}
+/**
+ * The domains a site's custom domain needs: the domain and its `www.` twin,
+ * since the platform answers on both (`siteOwnHosts`).
+ */ export function customDomainNames(cname) {
+    const domain = registrableDomain(cname);
+    if (!domain) return [];
+    const twin = domain.startsWith('www.') ? domain.slice(4) : `www.${domain}`;
+    return [
+        domain,
+        ...registrableDomain(twin) ? [
+            twin
+        ] : []
+    ];
+}
+function statusOf(object) {
+    var _ref, _ref1, _ref2, _ref3, _ref4;
+    var _object_apple_pay, _object_google_pay, _object_link, _object_amazon_pay, _object_klarna;
+    return {
+        applePay: (_ref = (_object_apple_pay = object.apple_pay) == null ? void 0 : _object_apple_pay.status) != null ? _ref : null,
+        googlePay: (_ref1 = (_object_google_pay = object.google_pay) == null ? void 0 : _object_google_pay.status) != null ? _ref1 : null,
+        link: (_ref2 = (_object_link = object.link) == null ? void 0 : _object_link.status) != null ? _ref2 : null,
+        amazonPay: (_ref3 = (_object_amazon_pay = object.amazon_pay) == null ? void 0 : _object_amazon_pay.status) != null ? _ref3 : null,
+        klarna: (_ref4 = (_object_klarna = object.klarna) == null ? void 0 : _object_klarna.status) != null ? _ref4 : null
+    };
+}
+async function stripeRequest(method, path, params, options = {}) {
+    const query = method === 'GET' && params ? `?${new URLSearchParams(params)}` : '';
+    const response = await fetch(`https://api.stripe.com/v1/${path}${query}`, _extends({
+        method,
+        headers: _extends({
+            Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`
+        }, method === 'POST' && {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        }, options.idempotencyKey && {
+            'Idempotency-Key': options.idempotencyKey
+        })
+    }, method === 'POST' && params && {
+        body: new URLSearchParams(params).toString()
+    }, options.signal && {
+        signal: options.signal
+    }));
+    const payload = await response.json().catch(()=>({}));
+    if (!response.ok) {
+        var _ref;
+        var _payload_error;
+        throw new Error((_ref = payload == null ? void 0 : (_payload_error = payload.error) == null ? void 0 : _payload_error.message) != null ? _ref : `Stripe ${path} failed (${response.status})`);
+    }
+    return payload;
+}
+async function findOnStripe(domain, signal) {
+    var _ref;
+    var _list_data;
+    const list = await stripeRequest('GET', 'payment_method_domains', {
+        domain_name: domain,
+        limit: '1'
+    }, {
+        signal
+    });
+    return (_ref = (_list_data = list.data) == null ? void 0 : _list_data.find((entry)=>entry.domain_name === domain)) != null ? _ref : null;
+}
+/**
+ * Register (or re-enable) one domain on the platform account. Idempotent end
+ * to end: an existing registration is found first and reused, a disabled one
+ * is enabled rather than duplicated, and the create carries an idempotency key
+ * so two checkouts racing on a fresh subdomain open one registration.
+ */ export async function registerOnPlatform(domain, signal) {
+    const existing = await findOnStripe(domain, signal);
+    if (existing) {
+        if (existing.enabled) return existing;
+        return stripeRequest('POST', `payment_method_domains/${encodeURIComponent(existing.id)}`, {
+            enabled: 'true'
+        }, {
+            signal
+        });
+    }
+    try {
+        return await stripeRequest('POST', 'payment_method_domains', {
+            domain_name: domain,
+            enabled: 'true'
+        }, {
+            idempotencyKey: `aglyn-pmd-register:${domain}`,
+            signal
+        });
+    } catch (error) {
+        // Lost a race to a create that landed between the lookup and this call:
+        // the registration exists, which is what was wanted.
+        const raced = await findOnStripe(domain, signal).catch(()=>null);
+        if (raced) return raced;
+        throw error;
+    }
+}
+function docRef(mode, domain) {
+    return firebaseAdmin.app().firestore().collection(PAYMENT_METHOD_DOMAINS_COLLECTION).doc(paymentMethodDomainDocId(mode, domain));
+}
+async function record(mode, domain, patch) {
+    await docRef(mode, domain).set(_extends({
+        domain,
+        mode,
+        checkedAtMs: Date.now()
+    }, patch), {
+        merge: true
+    });
+}
+/**
+ * Make sure one domain is registered and enabled, reading the cache first.
+ *
+ * Never throws: every caller is on its way to something more important (a
+ * sale, a domain connect), and a domain Stripe would not take today is
+ * recorded with its error and retried by the daily reconcile.
+ */ export async function ensurePaymentMethodDomain(rawDomain, options = {}) {
+    const domain = registrableDomain(rawDomain);
+    const mode = stripeModeOfKey(process.env.STRIPE_SECRET_KEY);
+    if (!domain || !mode) {
+        return {
+            domain: String(rawDomain != null ? rawDomain : ''),
+            outcome: 'skipped'
+        };
+    }
+    try {
+        var _options_hostId;
+        if (!options.force) {
+            var _data_checkedAtMs;
+            const cached = await docRef(mode, domain).get();
+            const data = cached.data == null ? void 0 : cached.data.call(cached);
+            if (cached.exists && (data == null ? void 0 : data.enabled) === true && data.stripeId && Date.now() - Number((_data_checkedAtMs = data.checkedAtMs) != null ? _data_checkedAtMs : 0) < PAYMENT_METHOD_DOMAIN_RECHECK_MS) {
+                return {
+                    domain,
+                    outcome: 'cached',
+                    record: data
+                };
+            }
+        }
+        const object = await registerOnPlatform(domain, options.signal);
+        const next = {
+            domain,
+            mode,
+            stripeId: object.id,
+            enabled: object.enabled !== false,
+            status: statusOf(object),
+            hostId: (_options_hostId = options.hostId) != null ? _options_hostId : null,
+            checkedAtMs: Date.now(),
+            lastError: null
+        };
+        await record(mode, domain, next);
+        return {
+            domain,
+            outcome: 'registered',
+            record: next
+        };
+    } catch (error) {
+        var _options_hostId1;
+        const message = error instanceof Error ? error.message : String(error);
+        await record(mode, domain, {
+            enabled: false,
+            hostId: (_options_hostId1 = options.hostId) != null ? _options_hostId1 : null,
+            lastError: message.slice(0, 500)
+        }).catch(()=>undefined);
+        return {
+            domain,
+            outcome: 'failed',
+            error: message
+        };
+    }
+}
+/**
+ * Disable a domain the platform no longer serves for a site. Stripe has no
+ * delete for a payment method domain; disabling stops every method on it, and
+ * `ensurePaymentMethodDomain` re-enables the same registration if the name is
+ * connected again.
+ */ export async function disablePaymentMethodDomain(rawDomain) {
+    const domain = registrableDomain(rawDomain);
+    const mode = stripeModeOfKey(process.env.STRIPE_SECRET_KEY);
+    if (!domain || !mode) return {
+        domain: String(rawDomain != null ? rawDomain : ''),
+        outcome: 'skipped'
+    };
+    try {
+        const existing = await findOnStripe(domain);
+        if (!existing) {
+            await record(mode, domain, {
+                enabled: false,
+                stripeId: null,
+                lastError: null
+            });
+            return {
+                domain,
+                outcome: 'absent'
+            };
+        }
+        const object = existing.enabled ? await stripeRequest('POST', `payment_method_domains/${encodeURIComponent(existing.id)}`, {
+            enabled: 'false'
+        }) : existing;
+        await record(mode, domain, {
+            stripeId: object.id,
+            enabled: false,
+            status: statusOf(object),
+            lastError: null
+        });
+        return {
+            domain,
+            outcome: 'disabled'
+        };
+    } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            domain,
+            outcome: 'failed',
+            error: message
+        };
+    }
+}
+/**
+ * Is a name still served for some OTHER site? A custom domain's `www.` twin
+ * can be another site's own `cname`, and an aglyn subdomain released by a
+ * deleted site can already belong to a new one. Disabling either would take
+ * Apple Pay away from a store that did nothing.
+ */ export async function domainStillClaimed(domain, exceptHostId) {
+    const firestore = firebaseAdmin.app().firestore();
+    const hosts = firestore.collection('hosts');
+    const names = customDomainNames(domain);
+    const byCname = await hosts.where('cname', 'in', names.length ? names : [
+        domain
+    ]).limit(3).get();
+    if (byCname.docs.some((doc)=>doc.id !== exceptHostId)) return true;
+    const suffix = `.${TENANT_APEX}`;
+    if (domain.endsWith(suffix)) {
+        const subdomain = domain.slice(0, -suffix.length);
+        const bySubdomain = await hosts.where('subdomain', '==', subdomain).limit(3).get();
+        if (bySubdomain.docs.some((doc)=>doc.id !== exceptHostId)) return true;
+    }
+    return false;
+}
+/**
+ * The checkout's hook: register the domain the shopper is paying on, within a
+ * budget, before the client secret goes back to the browser. Only a name the
+ * SITE answers on is ever registered — the return URL has already been judged
+ * against `siteOwnHosts` by `siteReturnUrl`, and it is judged again here so a
+ * forged `Host` can never make the platform register a stranger's domain.
+ */ export async function ensureCheckoutDomain(input) {
+    var _input_budgetMs;
+    let hostname;
+    try {
+        hostname = new URL(input.pageUrl).hostname.toLowerCase();
+    } catch (unused) {
+        return null;
+    }
+    if (!siteOwnHosts(input.site).includes(hostname)) return null;
+    if (!registrableDomain(hostname)) return null;
+    const controller = new AbortController();
+    const budget = (_input_budgetMs = input.budgetMs) != null ? _input_budgetMs : CHECKOUT_DOMAIN_BUDGET_MS;
+    const timer = setTimeout(()=>controller.abort(), budget);
+    try {
+        return await ensurePaymentMethodDomain(hostname, {
+            hostId: input.hostId,
+            signal: controller.signal
+        });
+    } finally{
+        clearTimeout(timer);
+    }
+}
+/** One page of the daily reconcile. */ export const RECONCILE_PAGE_SIZE = 200;
+/**
+ * The backfill and the safety net in one pass: every site with a connected
+ * custom domain gets its domain and `www.` twin registered. A cached, enabled
+ * registration costs one read and no Stripe call, so the steady state is cheap;
+ * a domain connected before AGL-3629, or whose connect event was lost, is
+ * registered on the first pass after it.
+ *
+ * Paged by `cname` with a cursor so it reads every site once and stops; the
+ * `cname > ''` range uses Firestore's automatic single-field index.
+ */ export async function reconcileCustomDomains(gate, options = {}) {
+    var _options_maxPages;
+    const result = {
+        hosts: 0,
+        registered: 0,
+        failed: 0,
+        skippedLocked: 0
+    };
+    if (!stripeModeOfKey(process.env.STRIPE_SECRET_KEY)) return result;
+    const firestore = firebaseAdmin.app().firestore();
+    let cursor = null;
+    const maxPages = (_options_maxPages = options.maxPages) != null ? _options_maxPages : 50;
+    for(let page = 0; page < maxPages; page += 1){
+        var _ref;
+        var _snapshot_docs_;
+        let query = firestore.collection('hosts').where('cname', '>', '').orderBy('cname').limit(RECONCILE_PAGE_SIZE);
+        if (cursor) query = query.startAfter(cursor);
+        const snapshot = await query.get();
+        if (snapshot.empty) break;
+        for (const hostDoc of snapshot.docs){
+            result.hosts += 1;
+            // Skipped, not dropped: a locked site is left as it is and picked up on
+            // the first pass after the lift.
+            if (await gate.isLocked(hostDoc.id)) {
+                result.skippedLocked += 1;
+                continue;
+            }
+            for (const domain of customDomainNames(hostDoc.get('cname'))){
+                const outcome = await ensurePaymentMethodDomain(domain, {
+                    hostId: hostDoc.id
+                });
+                if (outcome.outcome === 'registered') result.registered += 1;
+                if (outcome.outcome === 'failed') result.failed += 1;
+            }
+        }
+        cursor = String((_ref = (_snapshot_docs_ = snapshot.docs[snapshot.docs.length - 1]) == null ? void 0 : _snapshot_docs_.get('cname')) != null ? _ref : '');
+        if (snapshot.size < RECONCILE_PAGE_SIZE || !cursor) break;
+    }
+    return result;
+}
+/** Core's `host.domain.attached`: register the custom domain and its twin. */ export async function onHostDomainAttached(payload) {
+    for (const domain of customDomainNames(payload.domain)){
+        const outcome = await ensurePaymentMethodDomain(domain, {
+            hostId: payload.hostId,
+            force: true
+        });
+        if (outcome.outcome === 'failed') {
+            console.warn(`[commerce] payment method domain ${domain} not registered: ${outcome.error}`);
+        }
+    }
+}
+/** Core's `host.domain.released`: disable what no other site still serves. */ export async function onHostDomainReleased(payload) {
+    const names = payload.domain.endsWith(`.${TENANT_APEX}`) ? [
+        registrableDomain(payload.domain)
+    ].filter((name)=>Boolean(name)) : customDomainNames(payload.domain);
+    for (const domain of names){
+        if (await domainStillClaimed(domain, payload.hostId)) continue;
+        const outcome = await disablePaymentMethodDomain(domain);
+        if (outcome.outcome === 'failed') {
+            console.warn(`[commerce] payment method domain ${domain} not disabled: ${outcome.error}`);
+        }
+    }
+}
+/** The registrations a settings card shows for one site. */ export async function readSiteDomainRecords(site) {
+    const mode = stripeModeOfKey(process.env.STRIPE_SECRET_KEY);
+    if (!mode) return [];
+    const names = siteOwnHosts(site).filter((name)=>registrableDomain(name));
+    const snapshots = await Promise.all(names.map((name)=>docRef(mode, name).get()));
+    return snapshots.map((snapshot, index)=>{
+        const data = snapshot.exists ? snapshot.data == null ? void 0 : snapshot.data.call(snapshot) : null;
+        return data != null ? data : {
+            domain: names[index],
+            mode,
+            stripeId: null,
+            enabled: false,
+            status: {
+                applePay: null,
+                googlePay: null,
+                link: null,
+                amazonPay: null,
+                klarna: null
+            },
+            hostId: null,
+            checkedAtMs: 0,
+            lastError: null
+        };
+    });
+}
+
+//# sourceMappingURL=payment-method-domains.js.map

package/src/lib/server/payment-method-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/payment-method-domains.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { type SiteReturnHost, siteOwnHosts } from '@aglyn/aglyn/app-utils/site-return-url'\nimport { TENANT_APEX } from '@aglyn/aglyn/app-utils/tenant-apex'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\n\n/**\n * Stripe payment method domains for storefronts (AGL-3629).\n *\n * The in-page checkout mounts Stripe's Payment Element on the merchant's own\n * domain, and Stripe shows Apple Pay there only on a REGISTERED domain (Google\n * Pay, Link, Amazon Pay and Klarna's express button use the same registration).\n * Nothing registered one, so a shopper on `shop.example.com` with a card in\n * Apple Wallet never saw the button.\n *\n * ## Which account the domain is registered on\n *\n * Stripe's rule: \"The domain where the charge is being run needs to be\n * registered for the user running the charge.\" Storefront charges are\n * DESTINATION charges created by the platform with no `Stripe-Account` header\n * and no `on_behalf_of`, so the platform runs them and the platform's key\n * registers the domain, with no `Stripe-Account` header. A direct-charge flow\n * would register on the connected account instead; there is none today, and\n * `registerOnPlatform` is named for that reason.\n *\n * ## When\n *\n *  - On connect: core raises `host.domain.attached`, and commerce registers\n *    the custom domain and its `www.` twin.\n *  - On first checkout: the session handlers call `ensureCheckoutDomain` for\n *    the page the shopper is on, which covers every `{site}.aglyn.app`\n *    subdomain without registering thousands of sites that never sell.\n *  - Daily: `reconcileCustomDomains` registers any connected custom domain the\n *    first two missed (domains connected before AGL-3629 included) — the\n *    backfill is a job rather than a one-off script, so it also repairs a\n *    missed event later.\n *  - On release: `host.domain.released` DISABLES the domain. Stripe has no\n *    delete; a disabled domain stops showing the methods and can be enabled\n *    again if the name comes back.\n *\n * ## The cache\n *\n * `paymentMethodDomains/{mode}~{domain}` records what Stripe last said, so a\n * checkout costs one document read rather than a Stripe round trip. The mode is\n * in the id because a test key and a live key register in different worlds and\n * a domain registered in one is not registered in the other. Server-only: the\n * rules deny every client.\n */\n\nexport const PAYMENT_METHOD_DOMAINS_COLLECTION = 'paymentMethodDomains'\n\n/** How long a recorded registration is trusted before Stripe is asked again. */\nexport const PAYMENT_METHOD_DOMAIN_RECHECK_MS = 7 * 24 * 60 * 60 * 1000\n\n/** The most a checkout waits on Stripe before selling without the domain. */\nexport const CHECKOUT_DOMAIN_BUDGET_MS = 2500\n\nexport type StripeMode = 'live' | 'test'\n\n/** Stripe's per-method verdict on a domain. */\nexport interface PaymentMethodDomainStatus {\n  applePay: string | null\n  googlePay: string | null\n  link: string | null\n  amazonPay: string | null\n  klarna: string | null\n}\n\nexport interface PaymentMethodDomainRecord {\n  domain: string\n  mode: StripeMode\n  stripeId: string | null\n  enabled: boolean\n  status: PaymentMethodDomainStatus\n  hostId: string | null\n  checkedAtMs: number\n  lastError: string | null\n}\n\ninterface StripeDomainObject {\n  id: string\n  domain_name: string\n  enabled: boolean\n  apple_pay?: { status?: string }\n  google_pay?: { status?: string }\n  link?: { status?: string }\n  amazon_pay?: { status?: string }\n  klarna?: { status?: string }\n}\n\n/** Which Stripe world the platform key is in, from its prefix. */\nexport function stripeModeOfKey(key: string | undefined): StripeMode | null {\n  const value = String(key ?? '')\n  if (/^(sk|rk)_live_/.test(value)) return 'live'\n  if (/^(sk|rk)_test_/.test(value)) return 'test'\n  return null\n}\n\n/**\n * A hostname Stripe can register: lowercased, no trailing dot, at least two\n * labels, and never a local or IP host — a checkout opened on `localhost`\n * must not try to register it.\n */\nexport function registrableDomain(input: unknown): string | null {\n  const value = String(input ?? '')\n    .trim()\n    .toLowerCase()\n    .replace(/\\.+$/, '')\n  if (!value || value.length > 253) return null\n  if (value === 'localhost' || value.endsWith('.localhost')) return null\n  if (/^[0-9.]+$/.test(value) || value.includes(':')) return null\n  if (!/^[a-z0-9-]+(\\.[a-z0-9-]+)+$/.test(value)) return null\n  return value\n}\n\n/** The cache document id for a domain in a mode. */\nexport function paymentMethodDomainDocId(mode: StripeMode, domain: string): string {\n  return `${mode}~${domain}`\n}\n\n/**\n * The domains a site's custom domain needs: the domain and its `www.` twin,\n * since the platform answers on both (`siteOwnHosts`).\n */\nexport function customDomainNames(cname: unknown): string[] {\n  const domain = registrableDomain(cname)\n  if (!domain) return []\n  const twin = domain.startsWith('www.') ? domain.slice(4) : `www.${domain}`\n  return [domain, ...(registrableDomain(twin) ? [twin] : [])]\n}\n\nfunction statusOf(object: StripeDomainObject): PaymentMethodDomainStatus {\n  return {\n    applePay: object.apple_pay?.status ?? null,\n    googlePay: object.google_pay?.status ?? null,\n    link: object.link?.status ?? null,\n    amazonPay: object.amazon_pay?.status ?? null,\n    klarna: object.klarna?.status ?? null,\n  }\n}\n\nasync function stripeRequest<T>(\n  method: 'GET' | 'POST',\n  path: string,\n  params?: Record<string, string>,\n  options: { idempotencyKey?: string; signal?: AbortSignal } = {},\n): Promise<T> {\n  const query = method === 'GET' && params ? `?${new URLSearchParams(params)}` : ''\n  const response = await fetch(`https://api.stripe.com/v1/${path}${query}`, {\n    method,\n    headers: {\n      Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n      ...(method === 'POST' && {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      }),\n      // The platform's own key and NO `Stripe-Account`: destination charges\n      // are run by the platform, so the platform holds the registration.\n      ...(options.idempotencyKey && { 'Idempotency-Key': options.idempotencyKey }),\n    },\n    ...(method === 'POST' && params && { body: new URLSearchParams(params).toString() }),\n    ...(options.signal && { signal: options.signal }),\n  })\n  const payload = (await response.json().catch(() => ({}))) as T & {\n    error?: { message?: string }\n  }\n  if (!response.ok) {\n    throw new Error(payload?.error?.message ?? `Stripe ${path} failed (${response.status})`)\n  }\n  return payload\n}\n\nasync function findOnStripe(\n  domain: string,\n  signal?: AbortSignal,\n): Promise<StripeDomainObject | null> {\n  const list = await stripeRequest<{ data?: StripeDomainObject[] }>(\n    'GET',\n    'payment_method_domains',\n    { domain_name: domain, limit: '1' },\n    { signal },\n  )\n  return list.data?.find((entry) => entry.domain_name === domain) ?? null\n}\n\n/**\n * Register (or re-enable) one domain on the platform account. Idempotent end\n * to end: an existing registration is found first and reused, a disabled one\n * is enabled rather than duplicated, and the create carries an idempotency key\n * so two checkouts racing on a fresh subdomain open one registration.\n */\nexport async function registerOnPlatform(\n  domain: string,\n  signal?: AbortSignal,\n): Promise<StripeDomainObject> {\n  const existing = await findOnStripe(domain, signal)\n  if (existing) {\n    if (existing.enabled) return existing\n    return stripeRequest<StripeDomainObject>(\n      'POST',\n      `payment_method_domains/${encodeURIComponent(existing.id)}`,\n      { enabled: 'true' },\n      { signal },\n    )\n  }\n  try {\n    return await stripeRequest<StripeDomainObject>(\n      'POST',\n      'payment_method_domains',\n      { domain_name: domain, enabled: 'true' },\n      { idempotencyKey: `aglyn-pmd-register:${domain}`, signal },\n    )\n  } catch (error) {\n    // Lost a race to a create that landed between the lookup and this call:\n    // the registration exists, which is what was wanted.\n    const raced = await findOnStripe(domain, signal).catch(() => null)\n    if (raced) return raced\n    throw error\n  }\n}\n\nfunction docRef(mode: StripeMode, domain: string) {\n  return firebaseAdmin\n    .app()\n    .firestore()\n    .collection(PAYMENT_METHOD_DOMAINS_COLLECTION)\n    .doc(paymentMethodDomainDocId(mode, domain))\n}\n\nasync function record(\n  mode: StripeMode,\n  domain: string,\n  patch: Partial<PaymentMethodDomainRecord>,\n): Promise<void> {\n  await docRef(mode, domain).set(\n    { domain, mode, checkedAtMs: Date.now(), ...patch },\n    { merge: true },\n  )\n}\n\nexport interface EnsureDomainResult {\n  domain: string\n  outcome: 'registered' | 'cached' | 'skipped' | 'failed'\n  record?: PaymentMethodDomainRecord\n  error?: string\n}\n\n/**\n * Make sure one domain is registered and enabled, reading the cache first.\n *\n * Never throws: every caller is on its way to something more important (a\n * sale, a domain connect), and a domain Stripe would not take today is\n * recorded with its error and retried by the daily reconcile.\n */\nexport async function ensurePaymentMethodDomain(\n  rawDomain: string,\n  options: { hostId?: string | null; signal?: AbortSignal; force?: boolean } = {},\n): Promise<EnsureDomainResult> {\n  const domain = registrableDomain(rawDomain)\n  const mode = stripeModeOfKey(process.env.STRIPE_SECRET_KEY)\n  if (!domain || !mode) {\n    return { domain: String(rawDomain ?? ''), outcome: 'skipped' }\n  }\n  try {\n    if (!options.force) {\n      const cached = await docRef(mode, domain).get()\n      const data = cached.data?.() as PaymentMethodDomainRecord | undefined\n      if (\n        cached.exists &&\n        data?.enabled === true &&\n        data.stripeId &&\n        Date.now() - Number(data.checkedAtMs ?? 0) < PAYMENT_METHOD_DOMAIN_RECHECK_MS\n      ) {\n        return { domain, outcome: 'cached', record: data }\n      }\n    }\n    const object = await registerOnPlatform(domain, options.signal)\n    const next: PaymentMethodDomainRecord = {\n      domain,\n      mode,\n      stripeId: object.id,\n      enabled: object.enabled !== false,\n      status: statusOf(object),\n      hostId: options.hostId ?? null,\n      checkedAtMs: Date.now(),\n      lastError: null,\n    }\n    await record(mode, domain, next)\n    return { domain, outcome: 'registered', record: next }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    await record(mode, domain, {\n      enabled: false,\n      hostId: options.hostId ?? null,\n      lastError: message.slice(0, 500),\n    }).catch(() => undefined)\n    return { domain, outcome: 'failed', error: message }\n  }\n}\n\n/**\n * Disable a domain the platform no longer serves for a site. Stripe has no\n * delete for a payment method domain; disabling stops every method on it, and\n * `ensurePaymentMethodDomain` re-enables the same registration if the name is\n * connected again.\n */\nexport async function disablePaymentMethodDomain(\n  rawDomain: string,\n): Promise<{ domain: string; outcome: 'disabled' | 'absent' | 'skipped' | 'failed'; error?: string }> {\n  const domain = registrableDomain(rawDomain)\n  const mode = stripeModeOfKey(process.env.STRIPE_SECRET_KEY)\n  if (!domain || !mode) return { domain: String(rawDomain ?? ''), outcome: 'skipped' }\n  try {\n    const existing = await findOnStripe(domain)\n    if (!existing) {\n      await record(mode, domain, { enabled: false, stripeId: null, lastError: null })\n      return { domain, outcome: 'absent' }\n    }\n    const object = existing.enabled\n      ? await stripeRequest<StripeDomainObject>(\n          'POST',\n          `payment_method_domains/${encodeURIComponent(existing.id)}`,\n          { enabled: 'false' },\n        )\n      : existing\n    await record(mode, domain, {\n      stripeId: object.id,\n      enabled: false,\n      status: statusOf(object),\n      lastError: null,\n    })\n    return { domain, outcome: 'disabled' }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    return { domain, outcome: 'failed', error: message }\n  }\n}\n\n/**\n * Is a name still served for some OTHER site? A custom domain's `www.` twin\n * can be another site's own `cname`, and an aglyn subdomain released by a\n * deleted site can already belong to a new one. Disabling either would take\n * Apple Pay away from a store that did nothing.\n */\nexport async function domainStillClaimed(domain: string, exceptHostId: string): Promise<boolean> {\n  const firestore = firebaseAdmin.app().firestore()\n  const hosts = firestore.collection('hosts')\n  const names = customDomainNames(domain)\n  const byCname = await hosts\n    .where('cname', 'in', names.length ? names : [domain])\n    .limit(3)\n    .get()\n  if (byCname.docs.some((doc) => doc.id !== exceptHostId)) return true\n  const suffix = `.${TENANT_APEX}`\n  if (domain.endsWith(suffix)) {\n    const subdomain = domain.slice(0, -suffix.length)\n    const bySubdomain = await hosts.where('subdomain', '==', subdomain).limit(3).get()\n    if (bySubdomain.docs.some((doc) => doc.id !== exceptHostId)) return true\n  }\n  return false\n}\n\n/**\n * The checkout's hook: register the domain the shopper is paying on, within a\n * budget, before the client secret goes back to the browser. Only a name the\n * SITE answers on is ever registered — the return URL has already been judged\n * against `siteOwnHosts` by `siteReturnUrl`, and it is judged again here so a\n * forged `Host` can never make the platform register a stranger's domain.\n */\nexport async function ensureCheckoutDomain(input: {\n  pageUrl: string\n  site: SiteReturnHost | null | undefined\n  hostId: string\n  budgetMs?: number\n}): Promise<EnsureDomainResult | null> {\n  let hostname: string\n  try {\n    hostname = new URL(input.pageUrl).hostname.toLowerCase()\n  } catch {\n    return null\n  }\n  if (!siteOwnHosts(input.site).includes(hostname)) return null\n  if (!registrableDomain(hostname)) return null\n  const controller = new AbortController()\n  const budget = input.budgetMs ?? CHECKOUT_DOMAIN_BUDGET_MS\n  const timer = setTimeout(() => controller.abort(), budget)\n  try {\n    return await ensurePaymentMethodDomain(hostname, {\n      hostId: input.hostId,\n      signal: controller.signal,\n    })\n  } finally {\n    clearTimeout(timer)\n  }\n}\n\n/** One page of the daily reconcile. */\nexport const RECONCILE_PAGE_SIZE = 200\n\n/**\n * The backfill and the safety net in one pass: every site with a connected\n * custom domain gets its domain and `www.` twin registered. A cached, enabled\n * registration costs one read and no Stripe call, so the steady state is cheap;\n * a domain connected before AGL-3629, or whose connect event was lost, is\n * registered on the first pass after it.\n *\n * Paged by `cname` with a cursor so it reads every site once and stops; the\n * `cname > ''` range uses Firestore's automatic single-field index.\n */\nexport async function reconcileCustomDomains(\n  gate: { isLocked(hostId: string): Promise<boolean> },\n  options: { maxPages?: number } = {},\n): Promise<{ hosts: number; registered: number; failed: number; skippedLocked: number }> {\n  const result = { hosts: 0, registered: 0, failed: 0, skippedLocked: 0 }\n  if (!stripeModeOfKey(process.env.STRIPE_SECRET_KEY)) return result\n  const firestore = firebaseAdmin.app().firestore()\n  let cursor: string | null = null\n  const maxPages = options.maxPages ?? 50\n  for (let page = 0; page < maxPages; page += 1) {\n    let query = firestore\n      .collection('hosts')\n      .where('cname', '>', '')\n      .orderBy('cname')\n      .limit(RECONCILE_PAGE_SIZE)\n    if (cursor) query = query.startAfter(cursor)\n    const snapshot = await query.get()\n    if (snapshot.empty) break\n    for (const hostDoc of snapshot.docs) {\n      result.hosts += 1\n      // Skipped, not dropped: a locked site is left as it is and picked up on\n      // the first pass after the lift.\n      if (await gate.isLocked(hostDoc.id)) {\n        result.skippedLocked += 1\n        continue\n      }\n      for (const domain of customDomainNames(hostDoc.get('cname'))) {\n        const outcome = await ensurePaymentMethodDomain(domain, { hostId: hostDoc.id })\n        if (outcome.outcome === 'registered') result.registered += 1\n        if (outcome.outcome === 'failed') result.failed += 1\n      }\n    }\n    cursor = String(snapshot.docs[snapshot.docs.length - 1]?.get('cname') ?? '')\n    if (snapshot.size < RECONCILE_PAGE_SIZE || !cursor) break\n  }\n  return result\n}\n\n/** Core's `host.domain.attached`: register the custom domain and its twin. */\nexport async function onHostDomainAttached(payload: {\n  hostId: string\n  domain: string\n}): Promise<void> {\n  for (const domain of customDomainNames(payload.domain)) {\n    const outcome = await ensurePaymentMethodDomain(domain, {\n      hostId: payload.hostId,\n      force: true,\n    })\n    if (outcome.outcome === 'failed') {\n      console.warn(`[commerce] payment method domain ${domain} not registered: ${outcome.error}`)\n    }\n  }\n}\n\n/** Core's `host.domain.released`: disable what no other site still serves. */\nexport async function onHostDomainReleased(payload: {\n  hostId: string\n  domain: string\n}): Promise<void> {\n  const names = payload.domain.endsWith(`.${TENANT_APEX}`)\n    ? [registrableDomain(payload.domain)].filter((name): name is string => Boolean(name))\n    : customDomainNames(payload.domain)\n  for (const domain of names) {\n    if (await domainStillClaimed(domain, payload.hostId)) continue\n    const outcome = await disablePaymentMethodDomain(domain)\n    if (outcome.outcome === 'failed') {\n      console.warn(`[commerce] payment method domain ${domain} not disabled: ${outcome.error}`)\n    }\n  }\n}\n\n/** The registrations a settings card shows for one site. */\nexport async function readSiteDomainRecords(\n  site: SiteReturnHost | null | undefined,\n): Promise<PaymentMethodDomainRecord[]> {\n  const mode = stripeModeOfKey(process.env.STRIPE_SECRET_KEY)\n  if (!mode) return []\n  const names = siteOwnHosts(site).filter((name) => registrableDomain(name))\n  const snapshots = await Promise.all(names.map((name) => docRef(mode, name).get()))\n  return snapshots.map((snapshot, index) => {\n    const data = (snapshot.exists ? snapshot.data?.() : null) as PaymentMethodDomainRecord | null\n    return (\n      data ?? {\n        domain: names[index],\n        mode,\n        stripeId: null,\n        enabled: false,\n        status: { applePay: null, googlePay: null, link: null, amazonPay: null, klarna: null },\n        hostId: null,\n        checkedAtMs: 0,\n        lastError: null,\n      }\n    )\n  })\n}\n"],"names":["siteOwnHosts","TENANT_APEX","firebaseAdmin","PAYMENT_METHOD_DOMAINS_COLLECTION","PAYMENT_METHOD_DOMAIN_RECHECK_MS","CHECKOUT_DOMAIN_BUDGET_MS","stripeModeOfKey","key","value","String","test","registrableDomain","input","trim","toLowerCase","replace","length","endsWith","includes","paymentMethodDomainDocId","mode","domain","customDomainNames","cname","twin","startsWith","slice","statusOf","object","applePay","apple_pay","status","googlePay","google_pay","link","amazonPay","amazon_pay","klarna","stripeRequest","method","path","params","options","query","URLSearchParams","response","fetch","headers","Authorization","process","env","STRIPE_SECRET_KEY","idempotencyKey","body","toString","signal","payload","json","catch","ok","Error","error","message","findOnStripe","list","domain_name","limit","data","find","entry","registerOnPlatform","existing","enabled","encodeURIComponent","id","raced","docRef","app","firestore","collection","doc","record","patch","set","checkedAtMs","Date","now","merge","ensurePaymentMethodDomain","rawDomain","outcome","force","cached","get","exists","stripeId","Number","next","hostId","lastError","undefined","disablePaymentMethodDomain","domainStillClaimed","exceptHostId","hosts","names","byCname","where","docs","some","suffix","subdomain","bySubdomain","ensureCheckoutDomain","hostname","URL","pageUrl","site","controller","AbortController","budget","budgetMs","timer","setTimeout","abort","clearTimeout","RECONCILE_PAGE_SIZE","reconcileCustomDomains","gate","result","registered","failed","skippedLocked","cursor","maxPages","page","snapshot","orderBy","startAfter","empty","hostDoc","isLocked","size","onHostDomainAttached","console","warn","onHostDomainReleased","filter","name","Boolean","readSiteDomainRecords","snapshots","Promise","all","map","index"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAA8BA,YAAY,QAAQ,yCAAwC;AAC1F,SAASC,WAAW,QAAQ,qCAAoC;AAChE,SAASC,aAAa,QAAQ,2BAA0B;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GAED,OAAO,MAAMC,oCAAoC,uBAAsB;AAEvE,8EAA8E,GAC9E,OAAO,MAAMC,mCAAmC,IAAI,KAAK,KAAK,KAAK,KAAI;AAEvE,2EAA2E,GAC3E,OAAO,MAAMC,4BAA4B,KAAI;AAmC7C,gEAAgE,GAChE,OAAO,SAASC,gBAAgBC,GAAuB;IACrD,MAAMC,QAAQC,OAAOF,cAAAA,MAAO;IAC5B,IAAI,iBAAiBG,IAAI,CAACF,QAAQ,OAAO;IACzC,IAAI,iBAAiBE,IAAI,CAACF,QAAQ,OAAO;IACzC,OAAO;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASG,kBAAkBC,KAAc;IAC9C,MAAMJ,QAAQC,OAAOG,gBAAAA,QAAS,IAC3BC,IAAI,GACJC,WAAW,GACXC,OAAO,CAAC,QAAQ;IACnB,IAAI,CAACP,SAASA,MAAMQ,MAAM,GAAG,KAAK,OAAO;IACzC,IAAIR,UAAU,eAAeA,MAAMS,QAAQ,CAAC,eAAe,OAAO;IAClE,IAAI,YAAYP,IAAI,CAACF,UAAUA,MAAMU,QAAQ,CAAC,MAAM,OAAO;IAC3D,IAAI,CAAC,8BAA8BR,IAAI,CAACF,QAAQ,OAAO;IACvD,OAAOA;AACT;AAEA,kDAAkD,GAClD,OAAO,SAASW,yBAAyBC,IAAgB,EAAEC,MAAc;IACvE,OAAO,GAAGD,KAAK,CAAC,EAAEC,QAAQ;AAC5B;AAEA;;;CAGC,GACD,OAAO,SAASC,kBAAkBC,KAAc;IAC9C,MAAMF,SAASV,kBAAkBY;IACjC,IAAI,CAACF,QAAQ,OAAO,EAAE;IACtB,MAAMG,OAAOH,OAAOI,UAAU,CAAC,UAAUJ,OAAOK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAEL,QAAQ;IAC1E,OAAO;QAACA;WAAYV,kBAAkBa,QAAQ;YAACA;SAAK,GAAG,EAAE;KAAE;AAC7D;AAEA,SAASG,SAASC,MAA0B;;QAE9BA,mBACCA,oBACLA,cACKA,oBACHA;IALV,OAAO;QACLC,QAAQ,WAAED,oBAAAA,OAAOE,SAAS,qBAAhBF,kBAAkBG,MAAM,mBAAI;QACtCC,SAAS,YAAEJ,qBAAAA,OAAOK,UAAU,qBAAjBL,mBAAmBG,MAAM,oBAAI;QACxCG,IAAI,YAAEN,eAAAA,OAAOM,IAAI,qBAAXN,aAAaG,MAAM,oBAAI;QAC7BI,SAAS,YAAEP,qBAAAA,OAAOQ,UAAU,qBAAjBR,mBAAmBG,MAAM,oBAAI;QACxCM,MAAM,YAAET,iBAAAA,OAAOS,MAAM,qBAAbT,eAAeG,MAAM,oBAAI;IACnC;AACF;AAEA,eAAeO,cACbC,MAAsB,EACtBC,IAAY,EACZC,MAA+B,EAC/BC,UAA6D,CAAC,CAAC;IAE/D,MAAMC,QAAQJ,WAAW,SAASE,SAAS,CAAC,CAAC,EAAE,IAAIG,gBAAgBH,SAAS,GAAG;IAC/E,MAAMI,WAAW,MAAMC,MAAM,CAAC,0BAA0B,EAAEN,OAAOG,OAAO,EAAE;QACxEJ;QACAQ,SAAS;YACPC,eAAe,CAAC,OAAO,EAAEC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;WACpDZ,WAAW,UAAU;YACvB,gBAAgB;QAClB,GAGIG,QAAQU,cAAc,IAAI;YAAE,mBAAmBV,QAAQU,cAAc;QAAC;OAExEb,WAAW,UAAUE,UAAU;QAAEY,MAAM,IAAIT,gBAAgBH,QAAQa,QAAQ;IAAG,GAC9EZ,QAAQa,MAAM,IAAI;QAAEA,QAAQb,QAAQa,MAAM;IAAC;IAEjD,MAAMC,UAAW,MAAMX,SAASY,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;IAGrD,IAAI,CAACb,SAASc,EAAE,EAAE;;YACAH;QAAhB,MAAM,IAAII,cAAMJ,4BAAAA,iBAAAA,QAASK,KAAK,qBAAdL,eAAgBM,OAAO,mBAAI,CAAC,OAAO,EAAEtB,KAAK,SAAS,EAAEK,SAASd,MAAM,CAAC,CAAC,CAAC;IACzF;IACA,OAAOyB;AACT;AAEA,eAAeO,aACb1C,MAAc,EACdkC,MAAoB;;QAQbS;IANP,MAAMA,OAAO,MAAM1B,cACjB,OACA,0BACA;QAAE2B,aAAa5C;QAAQ6C,OAAO;IAAI,GAClC;QAAEX;IAAO;IAEX,gBAAOS,aAAAA,KAAKG,IAAI,qBAATH,WAAWI,IAAI,CAAC,CAACC,QAAUA,MAAMJ,WAAW,KAAK5C,0BAAW;AACrE;AAEA;;;;;CAKC,GACD,OAAO,eAAeiD,mBACpBjD,MAAc,EACdkC,MAAoB;IAEpB,MAAMgB,WAAW,MAAMR,aAAa1C,QAAQkC;IAC5C,IAAIgB,UAAU;QACZ,IAAIA,SAASC,OAAO,EAAE,OAAOD;QAC7B,OAAOjC,cACL,QACA,CAAC,uBAAuB,EAAEmC,mBAAmBF,SAASG,EAAE,GAAG,EAC3D;YAAEF,SAAS;QAAO,GAClB;YAAEjB;QAAO;IAEb;IACA,IAAI;QACF,OAAO,MAAMjB,cACX,QACA,0BACA;YAAE2B,aAAa5C;YAAQmD,SAAS;QAAO,GACvC;YAAEpB,gBAAgB,CAAC,mBAAmB,EAAE/B,QAAQ;YAAEkC;QAAO;IAE7D,EAAE,OAAOM,OAAO;QACd,wEAAwE;QACxE,qDAAqD;QACrD,MAAMc,QAAQ,MAAMZ,aAAa1C,QAAQkC,QAAQG,KAAK,CAAC,IAAM;QAC7D,IAAIiB,OAAO,OAAOA;QAClB,MAAMd;IACR;AACF;AAEA,SAASe,OAAOxD,IAAgB,EAAEC,MAAc;IAC9C,OAAOnB,cACJ2E,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC5E,mCACX6E,GAAG,CAAC7D,yBAAyBC,MAAMC;AACxC;AAEA,eAAe4D,OACb7D,IAAgB,EAChBC,MAAc,EACd6D,KAAyC;IAEzC,MAAMN,OAAOxD,MAAMC,QAAQ8D,GAAG,CAC5B;QAAE9D;QAAQD;QAAMgE,aAAaC,KAAKC,GAAG;OAAOJ,QAC5C;QAAEK,OAAO;IAAK;AAElB;AASA;;;;;;CAMC,GACD,OAAO,eAAeC,0BACpBC,SAAiB,EACjB/C,UAA6E,CAAC,CAAC;IAE/E,MAAMrB,SAASV,kBAAkB8E;IACjC,MAAMrE,OAAOd,gBAAgB2C,QAAQC,GAAG,CAACC,iBAAiB;IAC1D,IAAI,CAAC9B,UAAU,CAACD,MAAM;QACpB,OAAO;YAAEC,QAAQZ,OAAOgF,oBAAAA,YAAa;YAAKC,SAAS;QAAU;IAC/D;IACA,IAAI;YAoBQhD;QAnBV,IAAI,CAACA,QAAQiD,KAAK,EAAE;gBAOIxB;YANtB,MAAMyB,SAAS,MAAMhB,OAAOxD,MAAMC,QAAQwE,GAAG;YAC7C,MAAM1B,OAAOyB,OAAOzB,IAAI,oBAAXyB,OAAOzB,IAAI,MAAXyB;YACb,IACEA,OAAOE,MAAM,IACb3B,CAAAA,wBAAAA,KAAMK,OAAO,MAAK,QAClBL,KAAK4B,QAAQ,IACbV,KAAKC,GAAG,KAAKU,QAAO7B,oBAAAA,KAAKiB,WAAW,YAAhBjB,oBAAoB,KAAK/D,kCAC7C;gBACA,OAAO;oBAAEiB;oBAAQqE,SAAS;oBAAUT,QAAQd;gBAAK;YACnD;QACF;QACA,MAAMvC,SAAS,MAAM0C,mBAAmBjD,QAAQqB,QAAQa,MAAM;QAC9D,MAAM0C,OAAkC;YACtC5E;YACAD;YACA2E,UAAUnE,OAAO8C,EAAE;YACnBF,SAAS5C,OAAO4C,OAAO,KAAK;YAC5BzC,QAAQJ,SAASC;YACjBsE,MAAM,GAAExD,kBAAAA,QAAQwD,MAAM,YAAdxD,kBAAkB;YAC1B0C,aAAaC,KAAKC,GAAG;YACrBa,WAAW;QACb;QACA,MAAMlB,OAAO7D,MAAMC,QAAQ4E;QAC3B,OAAO;YAAE5E;YAAQqE,SAAS;YAAcT,QAAQgB;QAAK;IACvD,EAAE,OAAOpC,OAAO;YAIJnB;QAHV,MAAMoB,UAAUD,iBAAiBD,QAAQC,MAAMC,OAAO,GAAGrD,OAAOoD;QAChE,MAAMoB,OAAO7D,MAAMC,QAAQ;YACzBmD,SAAS;YACT0B,MAAM,GAAExD,mBAAAA,QAAQwD,MAAM,YAAdxD,mBAAkB;YAC1ByD,WAAWrC,QAAQpC,KAAK,CAAC,GAAG;QAC9B,GAAGgC,KAAK,CAAC,IAAM0C;QACf,OAAO;YAAE/E;YAAQqE,SAAS;YAAU7B,OAAOC;QAAQ;IACrD;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeuC,2BACpBZ,SAAiB;IAEjB,MAAMpE,SAASV,kBAAkB8E;IACjC,MAAMrE,OAAOd,gBAAgB2C,QAAQC,GAAG,CAACC,iBAAiB;IAC1D,IAAI,CAAC9B,UAAU,CAACD,MAAM,OAAO;QAAEC,QAAQZ,OAAOgF,oBAAAA,YAAa;QAAKC,SAAS;IAAU;IACnF,IAAI;QACF,MAAMnB,WAAW,MAAMR,aAAa1C;QACpC,IAAI,CAACkD,UAAU;YACb,MAAMU,OAAO7D,MAAMC,QAAQ;gBAAEmD,SAAS;gBAAOuB,UAAU;gBAAMI,WAAW;YAAK;YAC7E,OAAO;gBAAE9E;gBAAQqE,SAAS;YAAS;QACrC;QACA,MAAM9D,SAAS2C,SAASC,OAAO,GAC3B,MAAMlC,cACJ,QACA,CAAC,uBAAuB,EAAEmC,mBAAmBF,SAASG,EAAE,GAAG,EAC3D;YAAEF,SAAS;QAAQ,KAErBD;QACJ,MAAMU,OAAO7D,MAAMC,QAAQ;YACzB0E,UAAUnE,OAAO8C,EAAE;YACnBF,SAAS;YACTzC,QAAQJ,SAASC;YACjBuE,WAAW;QACb;QACA,OAAO;YAAE9E;YAAQqE,SAAS;QAAW;IACvC,EAAE,OAAO7B,OAAO;QACd,MAAMC,UAAUD,iBAAiBD,QAAQC,MAAMC,OAAO,GAAGrD,OAAOoD;QAChE,OAAO;YAAExC;YAAQqE,SAAS;YAAU7B,OAAOC;QAAQ;IACrD;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAewC,mBAAmBjF,MAAc,EAAEkF,YAAoB;IAC3E,MAAMzB,YAAY5E,cAAc2E,GAAG,GAAGC,SAAS;IAC/C,MAAM0B,QAAQ1B,UAAUC,UAAU,CAAC;IACnC,MAAM0B,QAAQnF,kBAAkBD;IAChC,MAAMqF,UAAU,MAAMF,MACnBG,KAAK,CAAC,SAAS,MAAMF,MAAMzF,MAAM,GAAGyF,QAAQ;QAACpF;KAAO,EACpD6C,KAAK,CAAC,GACN2B,GAAG;IACN,IAAIa,QAAQE,IAAI,CAACC,IAAI,CAAC,CAAC7B,MAAQA,IAAIN,EAAE,KAAK6B,eAAe,OAAO;IAChE,MAAMO,SAAS,CAAC,CAAC,EAAE7G,aAAa;IAChC,IAAIoB,OAAOJ,QAAQ,CAAC6F,SAAS;QAC3B,MAAMC,YAAY1F,OAAOK,KAAK,CAAC,GAAG,CAACoF,OAAO9F,MAAM;QAChD,MAAMgG,cAAc,MAAMR,MAAMG,KAAK,CAAC,aAAa,MAAMI,WAAW7C,KAAK,CAAC,GAAG2B,GAAG;QAChF,IAAImB,YAAYJ,IAAI,CAACC,IAAI,CAAC,CAAC7B,MAAQA,IAAIN,EAAE,KAAK6B,eAAe,OAAO;IACtE;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,OAAO,eAAeU,qBAAqBrG,KAK1C;QAUgBA;IATf,IAAIsG;IACJ,IAAI;QACFA,WAAW,IAAIC,IAAIvG,MAAMwG,OAAO,EAAEF,QAAQ,CAACpG,WAAW;IACxD,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAI,CAACd,aAAaY,MAAMyG,IAAI,EAAEnG,QAAQ,CAACgG,WAAW,OAAO;IACzD,IAAI,CAACvG,kBAAkBuG,WAAW,OAAO;IACzC,MAAMI,aAAa,IAAIC;IACvB,MAAMC,UAAS5G,kBAAAA,MAAM6G,QAAQ,YAAd7G,kBAAkBP;IACjC,MAAMqH,QAAQC,WAAW,IAAML,WAAWM,KAAK,IAAIJ;IACnD,IAAI;QACF,OAAO,MAAMhC,0BAA0B0B,UAAU;YAC/ChB,QAAQtF,MAAMsF,MAAM;YACpB3C,QAAQ+D,WAAW/D,MAAM;QAC3B;IACF,SAAU;QACRsE,aAAaH;IACf;AACF;AAEA,qCAAqC,GACrC,OAAO,MAAMI,sBAAsB,IAAG;AAEtC;;;;;;;;;CASC,GACD,OAAO,eAAeC,uBACpBC,IAAoD,EACpDtF,UAAiC,CAAC,CAAC;QAMlBA;IAJjB,MAAMuF,SAAS;QAAEzB,OAAO;QAAG0B,YAAY;QAAGC,QAAQ;QAAGC,eAAe;IAAE;IACtE,IAAI,CAAC9H,gBAAgB2C,QAAQC,GAAG,CAACC,iBAAiB,GAAG,OAAO8E;IAC5D,MAAMnD,YAAY5E,cAAc2E,GAAG,GAAGC,SAAS;IAC/C,IAAIuD,SAAwB;IAC5B,MAAMC,YAAW5F,oBAAAA,QAAQ4F,QAAQ,YAAhB5F,oBAAoB;IACrC,IAAK,IAAI6F,OAAO,GAAGA,OAAOD,UAAUC,QAAQ,EAAG;;YAuB7BC;QAtBhB,IAAI7F,QAAQmC,UACTC,UAAU,CAAC,SACX4B,KAAK,CAAC,SAAS,KAAK,IACpB8B,OAAO,CAAC,SACRvE,KAAK,CAAC4D;QACT,IAAIO,QAAQ1F,QAAQA,MAAM+F,UAAU,CAACL;QACrC,MAAMG,WAAW,MAAM7F,MAAMkD,GAAG;QAChC,IAAI2C,SAASG,KAAK,EAAE;QACpB,KAAK,MAAMC,WAAWJ,SAAS5B,IAAI,CAAE;YACnCqB,OAAOzB,KAAK,IAAI;YAChB,wEAAwE;YACxE,iCAAiC;YACjC,IAAI,MAAMwB,KAAKa,QAAQ,CAACD,QAAQlE,EAAE,GAAG;gBACnCuD,OAAOG,aAAa,IAAI;gBACxB;YACF;YACA,KAAK,MAAM/G,UAAUC,kBAAkBsH,QAAQ/C,GAAG,CAAC,UAAW;gBAC5D,MAAMH,UAAU,MAAMF,0BAA0BnE,QAAQ;oBAAE6E,QAAQ0C,QAAQlE,EAAE;gBAAC;gBAC7E,IAAIgB,QAAQA,OAAO,KAAK,cAAcuC,OAAOC,UAAU,IAAI;gBAC3D,IAAIxC,QAAQA,OAAO,KAAK,UAAUuC,OAAOE,MAAM,IAAI;YACrD;QACF;QACAE,SAAS5H,gBAAO+H,kBAAAA,SAAS5B,IAAI,CAAC4B,SAAS5B,IAAI,CAAC5F,MAAM,GAAG,EAAE,qBAAvCwH,gBAAyC3C,GAAG,CAAC,2BAAY;QACzE,IAAI2C,SAASM,IAAI,GAAGhB,uBAAuB,CAACO,QAAQ;IACtD;IACA,OAAOJ;AACT;AAEA,4EAA4E,GAC5E,OAAO,eAAec,qBAAqBvF,OAG1C;IACC,KAAK,MAAMnC,UAAUC,kBAAkBkC,QAAQnC,MAAM,EAAG;QACtD,MAAMqE,UAAU,MAAMF,0BAA0BnE,QAAQ;YACtD6E,QAAQ1C,QAAQ0C,MAAM;YACtBP,OAAO;QACT;QACA,IAAID,QAAQA,OAAO,KAAK,UAAU;YAChCsD,QAAQC,IAAI,CAAC,CAAC,iCAAiC,EAAE5H,OAAO,iBAAiB,EAAEqE,QAAQ7B,KAAK,EAAE;QAC5F;IACF;AACF;AAEA,4EAA4E,GAC5E,OAAO,eAAeqF,qBAAqB1F,OAG1C;IACC,MAAMiD,QAAQjD,QAAQnC,MAAM,CAACJ,QAAQ,CAAC,CAAC,CAAC,EAAEhB,aAAa,IACnD;QAACU,kBAAkB6C,QAAQnC,MAAM;KAAE,CAAC8H,MAAM,CAAC,CAACC,OAAyBC,QAAQD,SAC7E9H,kBAAkBkC,QAAQnC,MAAM;IACpC,KAAK,MAAMA,UAAUoF,MAAO;QAC1B,IAAI,MAAMH,mBAAmBjF,QAAQmC,QAAQ0C,MAAM,GAAG;QACtD,MAAMR,UAAU,MAAMW,2BAA2BhF;QACjD,IAAIqE,QAAQA,OAAO,KAAK,UAAU;YAChCsD,QAAQC,IAAI,CAAC,CAAC,iCAAiC,EAAE5H,OAAO,eAAe,EAAEqE,QAAQ7B,KAAK,EAAE;QAC1F;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,eAAeyF,sBACpBjC,IAAuC;IAEvC,MAAMjG,OAAOd,gBAAgB2C,QAAQC,GAAG,CAACC,iBAAiB;IAC1D,IAAI,CAAC/B,MAAM,OAAO,EAAE;IACpB,MAAMqF,QAAQzG,aAAaqH,MAAM8B,MAAM,CAAC,CAACC,OAASzI,kBAAkByI;IACpE,MAAMG,YAAY,MAAMC,QAAQC,GAAG,CAAChD,MAAMiD,GAAG,CAAC,CAACN,OAASxE,OAAOxD,MAAMgI,MAAMvD,GAAG;IAC9E,OAAO0D,UAAUG,GAAG,CAAC,CAAClB,UAAUmB;QAC9B,MAAMxF,OAAQqE,SAAS1C,MAAM,GAAG0C,SAASrE,IAAI,oBAAbqE,SAASrE,IAAI,MAAbqE,YAAoB;QACpD,OACErE,eAAAA,OAAQ;YACN9C,QAAQoF,KAAK,CAACkD,MAAM;YACpBvI;YACA2E,UAAU;YACVvB,SAAS;YACTzC,QAAQ;gBAAEF,UAAU;gBAAMG,WAAW;gBAAME,MAAM;gBAAMC,WAAW;gBAAME,QAAQ;YAAK;YACrF6D,QAAQ;YACRd,aAAa;YACbe,WAAW;QACb;IAEJ;AACF"}

package/src/lib/server/payment-methods.d.ts

@@ -0,0 +1,77 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type StorefrontPaymentMethodId, type StorefrontPaymentMethodSettings } from '../model/commerce-payment-methods';
+import { type PaymentMethodDomainRecord } from './payment-method-domains';
+/**
+ * The merchant's payment methods card (AGL-3629):
+ * `GET|POST /api/commerce/payment-methods?hostId=…`, served by the console.
+ *
+ * GET answers, per method, three facts the card needs and no client can read:
+ *
+ *  - whether the PLATFORM offers it (its default payment method configuration
+ *    — storefront charges are destination charges with the platform as
+ *    merchant of record, so that configuration is the ceiling). A method the
+ *    platform has not turned on, or that Stripe has not made available to it,
+ *    is reported `unavailable` and the card does not show it at all;
+ *  - the connected account's capability for it, which Stripe asks platforms to
+ *    request before an account accepts BNPL, Cash App, Amazon Pay or crypto;
+ *  - the site's domain registrations, which Apple Pay depends on.
+ *
+ * POST saves the toggles to `hosts/{hostId}/settings/store.paymentMethods` and
+ * requests the capability of each method turned on, in one account update with
+ * an idempotency key. Server-side, because the toggle and the capability are
+ * one decision: a toggle saved by the browser with no capability behind it
+ * would read as on and never appear.
+ */
+export type PlatformAvailability = 'on' | 'unavailable' | null;
+export type CapabilityStatus = 'active' | 'pending' | 'inactive' | 'unrequested' | null;
+export interface PaymentMethodRow {
+    id: StorefrontPaymentMethodId;
+    on: boolean;
+    platform: PlatformAvailability;
+    capability: CapabilityStatus;
+}
+export interface PaymentMethodsAnswer {
+    methods: PaymentMethodRow[];
+    domains: PaymentMethodDomainRecord[];
+    accountConnected: boolean;
+    /** The caller may save toggles: a site admin. */
+    canEdit: boolean;
+    /** The caller may open Stripe to finish a method: the organization owner. */
+    canFinish: boolean;
+    warnings: string[];
+}
+/** Test seam: forget the cached platform configuration. */
+export declare function resetPlatformPaymentMethodCacheForTests(): void;
+/**
+ * Which methods the platform's own default configuration offers. The list
+ * also returns configurations OTHER Connect applications made for this
+ * account (`application` set); those do not govern our sessions and are
+ * skipped. `null` per method when Stripe could not be asked — the card then
+ * shows the toggle without a verdict rather than hiding a method that may work.
+ */
+export declare function platformPaymentMethodAvailability(): Promise<Record<string, PlatformAvailability>>;
+/** The capabilities a save asks Stripe for: on, offered, not yet requested. */
+export declare function capabilitiesToRequest(settings: StorefrontPaymentMethodSettings, platform: Record<string, PlatformAvailability>, capabilities: Record<string, string> | undefined): string[];
+export declare function buildPaymentMethodRows(settings: StorefrontPaymentMethodSettings, platform: Record<string, PlatformAvailability>, capabilities: Record<string, string> | undefined): PaymentMethodRow[];
+/**
+ * Where Stripe sends the owner back: the console page they pressed the button
+ * on, judged against the request's own origin so a forged `Referer` cannot
+ * turn the link into a redirect to somewhere else.
+ */
+export declare function consoleReturnUrl(headers: Partial<Record<string, string>>): string;
+export declare function paymentMethodsHandler(request: Request): Promise<Response>;