@aglyn/plugins-commerce 1.0.0-beta.232 → 1.0.0-beta.234

package/src/lib/server/pos-kiosk.js

@@ -0,0 +1,972 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { createHmac, timingSafeEqual } from "crypto";
+import * as Aglyn from "@aglyn/aglyn/server";
+import { resolveMediaSrc } from "@aglyn/aglyn/app-utils/media-ref";
+import { pluginSmsAvailable } from "@aglyn/aglyn/plugin-manager/plugin-sms-messaging";
+import { consumeRateLimit, firebaseAdmin, getLockdownVerdict, getOrgForHost, getPluginConfig } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import * as CommerceModel from "../model/index.js";
+import { posRegisterSettings } from "../plugin-config.js";
+import { posKioskSettings } from "../pos-kiosk-config.js";
+import { verifyMemberPassword } from "./membership.js";
+import { authorizePosStaff, posIdempotencyKey, posQueryBody, posRequestBody } from "./pos-auth.js";
+import { displayBranding, displayToken, posDisplayCurrency, resolveDisplayToken } from "./pos-display.js";
+import { withPosKioskPrincipal } from "./pos-kiosk-principal.js";
+import { posOrderHandler } from "./pos-order.js";
+import { recordReceiptChoice, voidPosSale } from "./pos-payment.js";
+import { posPaymentId, posSaleSummary, readPosSale } from "./pos-sale.js";
+import { posStripeTestMode, posTerminalAvailable } from "./pos-stripe.js";
+import { cancelPosCardPayment, createCardPresentIntent, createPosTerminalConnectionToken, refreshPosCardPayment, simulatePosReaderTap, startCardPresentPayment } from "./pos-terminal.js";
+const DEVICE_READS = new Set([
+    'context',
+    'catalog',
+    'sale'
+]);
+const STAFF_READS = new Set([
+    'queue'
+]);
+/** The prefix of a token row's id a kiosk's orders are stamped with. */ export function posKioskDeviceId(device) {
+    var _ref;
+    var _device_ref;
+    return String((_ref = (_device_ref = device.ref) == null ? void 0 : _device_ref.id) != null ? _ref : '').slice(0, 16);
+}
+function refuse(status, error) {
+    return {
+        status,
+        body: {
+            error
+        }
+    };
+}
+/** The kiosk's gate, asked again on every call. */ async function authorizeKiosk(req, body, write) {
+    var _host_get, _ref, _ref1, _ref2, _register_data;
+    var _membership_permissions, _owner_org;
+    const device = await resolveDisplayToken(displayToken(req, body));
+    if (!device) return refuse(401, 'This kiosk is not paired.');
+    if (device.mode !== 'kiosk') return refuse(403, 'This device is a customer display, not a kiosk.');
+    const firestore = firebaseAdmin.app().firestore();
+    const hostRef = firestore.collection('hosts').doc(device.hostId);
+    const [host, register] = await Promise.all([
+        hostRef.get(),
+        hostRef.collection('registers').doc(device.registerId).get()
+    ]);
+    if (!host.exists || !register.exists) return refuse(401, 'This kiosk is not paired.');
+    const role = ((_host_get = host.get('memberRoles')) != null ? _host_get : {})[device.createdBy];
+    const membership = device.createdBy ? await resolveOrgPermissions(device.createdBy, {
+        hostId: device.hostId
+    }) : null;
+    if (role !== 'admin' && role !== 'editor' || !(membership == null ? void 0 : (_membership_permissions = membership.permissions) == null ? void 0 : _membership_permissions.managePos)) {
+        return refuse(403, 'This kiosk needs a staff member to pair it again.');
+    }
+    const owner = await getOrgForHost(device.hostId);
+    if (!Aglyn.checkEntitlement(owner == null ? void 0 : owner.org, 'pos')) {
+        return refuse(403, 'This kiosk is not available. Please order at the counter.');
+    }
+    const locked = await getLockdownVerdict({
+        uid: device.createdBy,
+        org: owner == null ? void 0 : owner.org,
+        host: host.data(),
+        intent: write ? 'write' : 'read'
+    });
+    if (locked) return {
+        status: 423,
+        body: {
+            error: 'This kiosk is paused. Please order at the counter.',
+            locked: true
+        }
+    };
+    const orgId = String((_ref = (_ref1 = owner == null ? void 0 : (_owner_org = owner.org) == null ? void 0 : _owner_org.id) != null ? _ref1 : owner == null ? void 0 : owner.orgId) != null ? _ref : '');
+    const config = await getPluginConfig(orgId || undefined, 'commerce', {
+        hostId: device.hostId
+    }).catch(()=>({}));
+    return {
+        device,
+        deviceId: posKioskDeviceId(device),
+        hostId: device.hostId,
+        registerId: device.registerId,
+        hostRef,
+        uid: device.createdBy,
+        orgId,
+        org: (_ref2 = owner == null ? void 0 : owner.org) != null ? _ref2 : null,
+        register: (_register_data = register.data()) != null ? _register_data : {},
+        settings: posRegisterSettings(config),
+        kiosk: posKioskSettings(config)
+    };
+}
+/** One durable budget per kiosk and action; refused requests do nothing. */ async function withinBudget(gate, action, limit) {
+    const rate = await consumeRateLimit(`pos-kiosk:${action}:${gate.deviceId}`, {
+        limit,
+        windowMs: 10 * 60 * 1000
+    });
+    return rate.allowed;
+}
+/** The register's card readers, when Terminal is switched on. */ async function registerReaders(gate) {
+    if (!posTerminalAvailable()) return [];
+    const snapshot = await gate.hostRef.collection('terminalReaders').where('registerId', '==', gate.registerId).limit(10).get();
+    return snapshot.docs.map((doc)=>{
+        var _doc_get, _doc_get1;
+        return {
+            id: String(doc.id),
+            label: String((_doc_get = doc.get('label')) != null ? _doc_get : 'Card reader'),
+            status: String((_doc_get1 = doc.get('status')) != null ? _doc_get1 : 'offline')
+        };
+    });
+}
+/** The reader this kiosk sends cards to: the one chosen in its settings, else the register's only one. */ async function kioskReaderId(gate) {
+    var _gate_device_data_kioskReaderId;
+    const readers = await registerReaders(gate);
+    const chosen = String((_gate_device_data_kioskReaderId = gate.device.data['kioskReaderId']) != null ? _gate_device_data_kioskReaderId : '');
+    if (chosen && readers.some((reader)=>reader.id === chosen)) return chosen;
+    return readers.length === 1 ? readers[0].id : null;
+}
+/** The receipt choices this kiosk can honor. */ async function receiptChannels(gate) {
+    const channels = [
+        'email'
+    ];
+    if (pluginSmsAvailable()) channels.push('sms');
+    // Printed on the register's own receipt printer, so offered only when it has one.
+    const printers = await gate.hostRef.collection('printers').where('registerId', '==', gate.registerId).limit(1).get().catch(()=>null);
+    if (printers && !printers.empty) channels.push('print');
+    channels.push('none');
+    return channels;
+}
+async function context(gate) {
+    const [branding, currency, reader, receipts] = await Promise.all([
+        displayBranding(gate.hostId),
+        posDisplayCurrency(gate.hostId),
+        kioskReaderId(gate),
+        receiptChannels(gate)
+    ]);
+    const value = {
+        branding: _extends({}, branding, {
+            message: gate.kiosk.welcome || 'Order here'
+        }),
+        currency,
+        tipping: {
+            enabled: gate.settings.tippingEnabled,
+            percentages: gate.settings.tipPercentages
+        },
+        payments: {
+            reader: Boolean(reader),
+            cardPresent: posTerminalAvailable(),
+            payAtCounter: gate.kiosk.payAtCounter
+        },
+        receipts,
+        offerMarketing: gate.settings.displayMarketingOptIn,
+        idleSeconds: gate.kiosk.idleSeconds,
+        testMode: posStripeTestMode()
+    };
+    return {
+        status: 200,
+        body: value
+    };
+}
+/**
+ * Whether a product may be sold at a kiosk at all: what the register sells,
+ * less what a customer cannot be handed at a counter — a subscription-only
+ * product, a gift card whose code needs issuing, and a digital download.
+ */ export function posKioskSellable(product) {
+    var _product_variants;
+    if (product.status !== 'active') return false;
+    if (product.subscription && !product.subscriptionOptional) return false;
+    if (product.giftCard) return false;
+    if (product.type === 'digital') return false;
+    return ((_product_variants = product.variants) != null ? _product_variants : []).some((variant)=>CommerceModel.variantHasPrice(variant));
+}
+/** A product as the kiosk may show it: names, prices and choices, nothing else. */ export function posKioskProduct(id, product, hostId) {
+    var _product_description, _product_name, _product_categoryIds, _product_options, _product_variants;
+    var _product_mediaUrls;
+    const image = resolveMediaSrc((_product_mediaUrls = product.mediaUrls) == null ? void 0 : _product_mediaUrls[0], {
+        hostId
+    });
+    const description = String((_product_description = product.description) != null ? _product_description : '').trim().slice(0, 280);
+    return _extends({
+        id,
+        name: String((_product_name = product.name) != null ? _product_name : '').slice(0, 120)
+    }, description ? {
+        description
+    } : {}, image ? {
+        imageUrl: image
+    } : {}, {
+        categoryIds: ((_product_categoryIds = product.categoryIds) != null ? _product_categoryIds : []).slice(0, 20),
+        options: ((_product_options = product.options) != null ? _product_options : []).map((option)=>({
+                name: option.name,
+                values: [
+                    ...option.values
+                ]
+            })),
+        variants: ((_product_variants = product.variants) != null ? _product_variants : []).filter((variant)=>CommerceModel.variantHasPrice(variant)).map((variant)=>{
+            var _variant_options;
+            return {
+                id: variant.id,
+                options: _extends({}, (_variant_options = variant.options) != null ? _variant_options : {}),
+                priceCents: Math.round(Number(variant.priceUsd) * 100),
+                soldOut: Boolean(CommerceModel.stockShortfall(product, variant.id, 1))
+            };
+        }),
+        modifierGroups: CommerceModel.productModifierGroups(product)
+    });
+}
+async function catalog(gate, body) {
+    var _body_categoryId;
+    const categoryId = String((_body_categoryId = body['categoryId']) != null ? _body_categoryId : '');
+    if (categoryId && !/^[A-Za-z0-9_-]{1,128}$/.test(categoryId)) return refuse(400, 'Unknown category');
+    // The register grid's query (AGL-3321): live, active, by name — and a
+    // category is a clause on the query, never a filter over what was read.
+    let query = gate.hostRef.collection('products').where('deletedAt', '==', null).where('status', '==', 'active');
+    if (categoryId) query = query.where('categoryIds', 'array-contains', categoryId);
+    const [products, categories, currency] = await Promise.all([
+        query.orderBy('nameLower').limit(CommerceModel.POS_KIOSK_CATALOG_LIMIT).get(),
+        gate.hostRef.collection('productCategories').limit(30).get(),
+        posDisplayCurrency(gate.hostId)
+    ]);
+    const value = {
+        products: products.docs.map((doc)=>({
+                id: String(doc.id),
+                product: CommerceModel.liftLegacyProduct(doc.data())
+            })).filter(({ product })=>posKioskSellable(product)).map(({ id, product })=>posKioskProduct(id, product, gate.hostId)),
+        categories: categories.docs.map((doc)=>{
+            var _doc_get;
+            return {
+                id: String(doc.id),
+                name: String((_doc_get = doc.get('name')) != null ? _doc_get : 'Category').slice(0, 60)
+            };
+        }),
+        currency
+    };
+    return {
+        status: 200,
+        body: value
+    };
+}
+/** An order as its kiosk reads it back; null for any order this kiosk did not open. */ export function posKioskSaleView(order, deviceId) {
+    var _order_number, _order_lineItems, _ref, _ref1, _ref2;
+    var _order_totals, _order_totals1, _order_totals2;
+    if (!order || order.posSource !== 'kiosk' || order.kioskDeviceId !== deviceId) return null;
+    const summary = posSaleSummary(order);
+    const status = order.status === 'paid' ? 'paid' : order.status === 'pending' ? order.kioskQueueRegisterId ? 'queued' : 'open' : 'voided';
+    const card = [
+        ...summary.payments
+    ].reverse().find((payment)=>CommerceModel.isCardPaymentMethod(payment.method));
+    return {
+        orderId: order.$id,
+        number: Number((_order_number = order.number) != null ? _order_number : 0),
+        status,
+        lines: ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).map((line)=>_extends({
+                name: line.name
+            }, line.variantLabel ? {
+                variantLabel: line.variantLabel
+            } : {}, {
+                quantity: line.quantity,
+                amountCents: line.unitAmountCents * line.quantity
+            })),
+        itemsCents: Number((_ref = (_order_totals = order.totals) == null ? void 0 : _order_totals.itemsCents) != null ? _ref : 0),
+        discountCents: Number((_ref1 = (_order_totals1 = order.totals) == null ? void 0 : _order_totals1.discountCents) != null ? _ref1 : 0),
+        taxCents: Number((_ref2 = (_order_totals2 = order.totals) == null ? void 0 : _order_totals2.taxCents) != null ? _ref2 : 0),
+        totalCents: summary.totalCents,
+        tipCents: summary.tipCents,
+        paidCents: summary.paidCents,
+        dueCents: summary.dueCents,
+        payment: card ? _extends({
+            id: card.id,
+            status: card.status
+        }, card.failureMessage ? {
+            failureMessage: card.failureMessage
+        } : {}) : null
+    };
+}
+/** This kiosk's order, or a refusal that says nothing about anyone else's. */ async function readOwnSale(gate, rawOrderId) {
+    const orderId = String(rawOrderId != null ? rawOrderId : '');
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(orderId)) return refuse(404, 'Unknown order');
+    const order = await readPosSale(gate.hostId, orderId);
+    const view = posKioskSaleView(order, gate.deviceId);
+    if (!order || !view) return refuse(404, 'Unknown order');
+    return {
+        order,
+        view
+    };
+}
+/** The response the in-process sale route wrote. */ function recorder() {
+    const result = {
+        status: 500,
+        body: {}
+    };
+    const res = {
+        status (code) {
+            result.status = code;
+            return res;
+        },
+        json (value) {
+            result.body = value != null ? value : {};
+        },
+        send () {},
+        setHeader () {},
+        redirect () {},
+        end () {}
+    };
+    return {
+        res,
+        result
+    };
+}
+async function checkout(gate, req, body) {
+    const attemptKey = posIdempotencyKey(req);
+    if (!attemptKey) return refuse(400, 'Missing Idempotency-Key');
+    const cart = CommerceModel.sanitizePosKioskLines(body['lines']);
+    if ('error' in cart) return refuse(400, cart.error);
+    if (!await withinBudget(gate, 'checkout', 40)) {
+        return refuse(429, 'Too many orders from this kiosk. Please order at the counter.');
+    }
+    // What a customer may buy here, read from the product documents before
+    // anything is priced: the sale route warns a cashier about stock and sells
+    // anyway (the goods are in their hand); a kiosk refuses what is sold out.
+    const ids = [
+        ...new Set(cart.lines.map((line)=>line.productId))
+    ];
+    const snapshots = await Promise.all(ids.map((id)=>gate.hostRef.collection('products').doc(id).get()));
+    const products = new Map(snapshots.map((snapshot)=>[
+            String(snapshot.id),
+            snapshot.exists ? CommerceModel.liftLegacyProduct(snapshot.data()) : null
+        ]));
+    for (const line of cart.lines){
+        const product = products.get(line.productId);
+        if (!product || product.deletedAt || !posKioskSellable(product)) {
+            return refuse(409, 'An item in your cart is no longer available. Remove it and try again.');
+        }
+        const variant = line.variantId ? product.variants.find((candidate)=>candidate.id === line.variantId) : product.variants[0];
+        if (!variant || !CommerceModel.variantHasPrice(variant)) {
+            return refuse(409, `${product.name} is no longer available. Remove it and try again.`);
+        }
+        const wanted = cart.lines.filter((other)=>{
+            var _other_variantId, _line_variantId;
+            return other.productId === line.productId && ((_other_variantId = other.variantId) != null ? _other_variantId : '') === ((_line_variantId = line.variantId) != null ? _line_variantId : '');
+        }).reduce((sum, other)=>sum + other.quantity, 0);
+        if (CommerceModel.stockShortfall(product, variant.id, wanted)) {
+            return refuse(409, `${product.name} is sold out. Remove it and try again.`);
+        }
+    }
+    const { res, result } = recorder();
+    const priced = withPosKioskPrincipal({
+        method: 'POST',
+        headers: {
+            'idempotency-key': `kiosk:${gate.deviceId}:${attemptKey}`
+        },
+        query: {},
+        cookies: {},
+        socket: req.socket,
+        body: _extends({
+            hostId: gate.hostId,
+            registerId: gate.registerId,
+            payment: 'open',
+            lines: cart.lines
+        }, typeof gate.register['locationId'] === 'string' && gate.register['locationId'] ? {
+            locationId: gate.register['locationId']
+        } : {})
+    }, {
+        uid: gate.uid,
+        registerId: gate.registerId,
+        deviceId: gate.deviceId
+    });
+    await posOrderHandler(priced, res);
+    if (result.status !== 200 || !result.body['orderId']) {
+        // A refusal about a product names it, and the customer can fix it. One
+        // about the store — a shift, the tax setup, the plan — is the staff's to
+        // fix, and the customer is sent to the counter.
+        console.warn('[pos-kiosk] sale refused', gate.hostId, result.status, result.body['error']);
+        if (result.status === 400 && result.body['error']) return refuse(400, String(result.body['error']));
+        return refuse(result.status === 429 ? 429 : 409, 'This kiosk cannot take orders right now. Please order at the counter.');
+    }
+    const own = await readOwnSale(gate, result.body['orderId']);
+    if ('status' in own) return own;
+    if (own.view.totalCents <= 0) {
+        // Nothing to take a card for, and nothing a kiosk should hand out free.
+        await voidPosSale(kioskStaff(gate), own.order.$id).catch(()=>undefined);
+        return refuse(409, 'Please ask at the counter for this order.');
+    }
+    return {
+        status: 200,
+        body: {
+            sale: own.view
+        }
+    };
+}
+/** The kiosk, as the register's payment helpers expect the person at the till. */ function kioskStaff(gate) {
+    return {
+        uid: gate.uid,
+        hostId: gate.hostId,
+        orgId: gate.orgId,
+        org: gate.org
+    };
+}
+async function pay(gate, req, body) {
+    var _body_method, _pressed_tipCents;
+    const attemptKey = posIdempotencyKey(req);
+    if (!attemptKey) return refuse(400, 'Missing Idempotency-Key');
+    const method = String((_body_method = body['method']) != null ? _body_method : '');
+    if (method !== 'reader' && method !== 'tap') return refuse(400, 'Choose how to pay.');
+    if (!posTerminalAvailable()) return refuse(409, 'Card payments are not available on this kiosk.');
+    if (!await withinBudget(gate, 'pay', 60)) return refuse(429, 'Too many tries. Please pay at the counter.');
+    const own = await readOwnSale(gate, body['orderId']);
+    if ('status' in own) return own;
+    if (own.view.status !== 'open') return refuse(409, 'This order is no longer waiting for payment.');
+    const paymentId = posPaymentId(own.order.$id, `kiosk:${attemptKey}`);
+    // A retried press finds the payment its first press reserved, for the
+    // amount and tip that press chose: the reservation is already out of the
+    // balance, so the balance alone would read as nothing left to pay.
+    const pressed = CommerceModel.orderPayments(own.order).find((payment)=>payment.id === paymentId);
+    const amountCents = pressed ? pressed.amountCents : posSaleSummary(own.order).tenderableCents;
+    if (!(amountCents > 0)) return refuse(409, 'Nothing is left to pay on this order.');
+    const tipCents = pressed ? Number((_pressed_tipCents = pressed.tipCents) != null ? _pressed_tipCents : 0) : CommerceModel.posKioskTipCents(body['tipChoice'], {
+        baseCents: amountCents,
+        enabled: gate.settings.tippingEnabled,
+        percentages: gate.settings.tipPercentages,
+        percent: body['tipPercent'],
+        cents: body['tipCents']
+    });
+    if (tipCents === null) return refuse(400, 'Choose one of the tips shown, or no tip.');
+    const start = {
+        hostId: gate.hostId,
+        orderId: own.order.$id,
+        paymentId,
+        amountCents,
+        tipCents,
+        cashierId: gate.uid,
+        org: gate.org
+    };
+    let outcome;
+    if (method === 'reader') {
+        const readerId = await kioskReaderId(gate);
+        if (!readerId) return refuse(409, 'No card reader is set up for this kiosk. Please pay at the counter.');
+        // The kiosk asked for the tip on its own screen: the reader must not ask again.
+        outcome = await startCardPresentPayment(_extends({}, start, {
+            readerId,
+            settings: _extends({}, gate.settings, {
+                tippingEnabled: false
+            })
+        }));
+    } else {
+        // Tap to Pay: collected by the native POS app's Stripe Terminal SDK
+        // against this server-made intent (AGL-3618), settled like any reader.
+        outcome = await createCardPresentIntent(start);
+    }
+    if ('error' in outcome) return refuse(outcome.status, outcome.error);
+    const view = posKioskSaleView(outcome.order, gate.deviceId);
+    return {
+        status: 200,
+        body: _extends({
+            sale: view
+        }, outcome.payment ? {
+            paymentId: outcome.payment.id
+        } : {}, outcome.clientSecret ? {
+            clientSecret: outcome.clientSecret
+        } : {}, outcome.paymentIntentId ? {
+            paymentIntentId: outcome.paymentIntentId
+        } : {})
+    };
+}
+/** A card payment on this kiosk's own order: refreshed, canceled or (test mode) tapped. */ async function cardStep(gate, body, step) {
+    var _body_paymentId;
+    var _own_order_payments;
+    if (!await withinBudget(gate, 'card', 900)) return refuse(429, 'Too many tries. Wait a moment.');
+    const own = await readOwnSale(gate, body['orderId']);
+    if ('status' in own) return own;
+    const paymentId = String((_body_paymentId = body['paymentId']) != null ? _body_paymentId : '');
+    if (!((_own_order_payments = own.order.payments) == null ? void 0 : _own_order_payments.some((payment)=>payment.id === paymentId))) return refuse(404, 'Unknown payment');
+    const ref = {
+        hostId: gate.hostId,
+        orderId: own.order.$id,
+        paymentId
+    };
+    let outcome;
+    if (step === 'payment-status') outcome = await refreshPosCardPayment(ref);
+    else if (step === 'cancel-payment') outcome = await cancelPosCardPayment(ref);
+    else {
+        var _body_cardNumber;
+        if (!posStripeTestMode()) return refuse(404, 'Unknown action');
+        outcome = await simulatePosReaderTap(_extends({}, ref, {
+            cardNumber: String((_body_cardNumber = body['cardNumber']) != null ? _body_cardNumber : '')
+        }));
+    }
+    if ('error' in outcome) return refuse(outcome.status, outcome.error);
+    return {
+        status: 200,
+        body: {
+            sale: posKioskSaleView(outcome.order, gate.deviceId)
+        }
+    };
+}
+/** "Pay at counter": the order joins the register's queue with its number. */ async function sendToCounter(gate, body) {
+    if (!gate.kiosk.payAtCounter) return refuse(409, 'Please pay here with a card.');
+    if (!await withinBudget(gate, 'counter', 40)) return refuse(429, 'Too many orders from this kiosk.');
+    const own = await readOwnSale(gate, body['orderId']);
+    if ('status' in own) return own;
+    if (own.view.status === 'queued') return {
+        status: 200,
+        body: {
+            sale: own.view
+        }
+    };
+    const ref = gate.hostRef.collection('orders').doc(own.order.$id);
+    const firestore = firebaseAdmin.app().firestore();
+    // In a transaction: a card that settled between the customer's two taps
+    // leaves a paid order, which never joins a queue.
+    const queued = await firestore.runTransaction(async (transaction)=>{
+        const fresh = await transaction.get(ref);
+        if (!fresh.exists || fresh.get('status') !== 'pending') return false;
+        const payments = CommerceModel.orderPayments(fresh.data());
+        if (payments.some((payment)=>payment.status === 'pending' || payment.status === 'succeeded')) {
+            return false;
+        }
+        transaction.set(ref, {
+            kioskQueueRegisterId: gate.registerId,
+            kioskQueuedAtMs: Date.now(),
+            timeline: CommerceModel.appendOrderEvent(_extends({}, fresh.data()), 'pos-kiosk-pay-at-counter', 'Sent to the counter from the self-service kiosk')
+        }, {
+            merge: true
+        });
+        return true;
+    });
+    if (!queued) return refuse(409, 'This order is already being paid. Check the screen.');
+    const after = await readOwnSale(gate, own.order.$id);
+    if ('status' in after) return after;
+    return {
+        status: 200,
+        body: {
+            sale: after.view
+        }
+    };
+}
+async function receipt(gate, body) {
+    var _body_channel;
+    if (!await withinBudget(gate, 'receipt', 40)) return refuse(429, 'Too many tries.');
+    const own = await readOwnSale(gate, body['orderId']);
+    if ('status' in own) return own;
+    if (own.view.status !== 'paid') return refuse(409, 'Your receipt is ready once your order is paid.');
+    const channel = String((_body_channel = body['channel']) != null ? _body_channel : '');
+    if (!(await receiptChannels(gate)).includes(channel)) return refuse(400, 'Choose a receipt shown on the screen.');
+    const outcome = await recordReceiptChoice(kioskStaff(gate), own.order.$id, {
+        channel,
+        to: body['to'],
+        marketingOptIn: gate.settings.displayMarketingOptIn && body['marketingOptIn'] === true
+    });
+    if ('error' in outcome) return refuse(outcome.status, outcome.error);
+    // The address is on the order now; nothing of it comes back to the screen.
+    return {
+        status: 200,
+        body: {
+            ok: true
+        }
+    };
+}
+/**
+ * The idle reset and "Start over": an order this kiosk opened and nobody
+ * paid is voided, so it holds no promotion slot and no stock. A queued or
+ * paid order is left exactly as it is.
+ */ async function abandon(gate, body) {
+    const own = await readOwnSale(gate, body['orderId']);
+    if ('status' in own) return own;
+    if (own.view.status !== 'open') return {
+        status: 200,
+        body: {
+            sale: own.view
+        }
+    };
+    // Money that already moved is the counter's to settle, never a screen's
+    // to refund on its own.
+    if (CommerceModel.orderPayments(own.order).some((payment)=>payment.status === 'succeeded')) {
+        return {
+            status: 200,
+            body: {
+                sale: own.view
+            }
+        };
+    }
+    const outcome = await voidPosSale(kioskStaff(gate), own.order.$id);
+    if ('error' in outcome) return refuse(outcome.status, outcome.error);
+    return {
+        status: 200,
+        body: {
+            sale: posKioskSaleView(outcome.order, gate.deviceId)
+        }
+    };
+}
+/*==========================================
+ * STAFF UNLOCK.
+ *
+ * The register's staff PINs (AGL-3609), checked on the server: a PIN at a
+ * kiosk unlocks its settings — choosing the card reader, leaving kiosk mode
+ * — for a few minutes. A kiosk faces the public, so it shows no roster of
+ * names; the PIN alone is checked against every member of the site who may
+ * work the register. The attempt is claimed on the device's own token row
+ * BEFORE any PIN is checked, so a burst of guesses gets
+ * POS_KIOSK_UNLOCK_MAX_ATTEMPTS in the lockout window and no more, and a
+ * member whose own PIN is locked at the register cannot unlock a kiosk
+ * either.
+ *=========================================*/ function unlockSecret() {
+    const secret = process.env['TOKEN_SIGNING_SECRET'];
+    if (!secret) throw new Error('TOKEN_SIGNING_SECRET is not configured');
+    return secret;
+}
+function signUnlock(payload) {
+    return createHmac('sha256', unlockSecret()).update(`pos-kiosk-unlock:${payload}`).digest('hex');
+}
+/** A short-lived, signed "staff unlocked THIS kiosk". */ export function mintPosKioskUnlock(deviceId, memberUid, nowMs) {
+    const expiresAtMs = nowMs + CommerceModel.POS_KIOSK_UNLOCK_TTL_MS;
+    const payload = Buffer.from(JSON.stringify({
+        v: 1,
+        d: deviceId,
+        u: memberUid,
+        e: expiresAtMs
+    })).toString('base64url');
+    return {
+        unlock: `${payload}.${signUnlock(payload)}`,
+        expiresAtMs
+    };
+}
+/** The member a valid unlock names for this kiosk, or null. */ export function readPosKioskUnlock(token, deviceId, nowMs) {
+    const value = typeof token === 'string' ? token.trim() : '';
+    const dot = value.lastIndexOf('.');
+    if (dot <= 0 || value.length > 1000) return null;
+    const payload = value.slice(0, dot);
+    let expected;
+    try {
+        expected = signUnlock(payload);
+    } catch (unused) {
+        return null;
+    }
+    const a = Buffer.from(value.slice(dot + 1));
+    const b = Buffer.from(expected);
+    if (a.length !== b.length || !timingSafeEqual(new Uint8Array(a), new Uint8Array(b))) return null;
+    try {
+        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if ((claims == null ? void 0 : claims.v) !== 1 || claims.d !== deviceId || typeof claims.u !== 'string' || !(Number(claims.e) > nowMs)) {
+            return null;
+        }
+        return claims.u;
+    } catch (unused) {
+        return null;
+    }
+}
+/** Whether a member may still unlock: their role and `managePos` today. */ async function mayUnlock(gate, memberUid) {
+    var _host_get;
+    var _membership_permissions;
+    const host = await gate.hostRef.get();
+    const role = ((_host_get = host.get('memberRoles')) != null ? _host_get : {})[memberUid];
+    if (role !== 'admin' && role !== 'editor') return false;
+    const membership = await resolveOrgPermissions(memberUid, {
+        hostId: gate.hostId
+    });
+    return (membership == null ? void 0 : (_membership_permissions = membership.permissions) == null ? void 0 : _membership_permissions.managePos) === true;
+}
+async function unlock(gate, req, body) {
+    var _body_pin, _ref, _host_get;
+    var _req_socket;
+    const pin = String((_body_pin = body['pin']) != null ? _body_pin : '');
+    if (!/^\d{4,6}$/.test(pin)) return refuse(400, 'Enter your staff PIN.');
+    const address = String((_ref = (_req_socket = req.socket) == null ? void 0 : _req_socket.remoteAddress) != null ? _ref : '') || 'no-address';
+    const rate = await consumeRateLimit(`pos-kiosk-unlock:${address}`, {
+        limit: 20,
+        windowMs: 15 * 60 * 1000
+    });
+    if (!rate.allowed) return refuse(429, 'Too many tries. Wait a few minutes and try again.');
+    try {
+        unlockSecret();
+    } catch (unused) {
+        return refuse(501, 'Staff PINs are not configured on this server.');
+    }
+    const firestore = firebaseAdmin.app().firestore();
+    const now = Date.now();
+    const claim = await firestore.runTransaction(async (transaction)=>{
+        var _snapshot_get, _snapshot_get1;
+        const snapshot = await transaction.get(gate.device.ref);
+        if (!snapshot.exists) return {
+            kind: 'gone'
+        };
+        const lockedUntilMs = Number((_snapshot_get = snapshot.get('kioskUnlockLockedUntilMs')) != null ? _snapshot_get : 0);
+        if (lockedUntilMs > now) return {
+            kind: 'locked',
+            lockedUntilMs
+        };
+        const failed = lockedUntilMs ? 0 : Number((_snapshot_get1 = snapshot.get('kioskUnlockFailures')) != null ? _snapshot_get1 : 0);
+        if (failed >= CommerceModel.POS_KIOSK_UNLOCK_MAX_ATTEMPTS) {
+            const until = now + CommerceModel.POS_KIOSK_UNLOCK_LOCKOUT_MS;
+            transaction.update(gate.device.ref, {
+                kioskUnlockLockedUntilMs: until,
+                kioskUnlockFailures: 0
+            });
+            return {
+                kind: 'locked',
+                lockedUntilMs: until
+            };
+        }
+        transaction.update(gate.device.ref, {
+            kioskUnlockFailures: failed + 1,
+            kioskUnlockLockedUntilMs: null
+        });
+        return {
+            kind: 'claimed',
+            attempt: failed + 1
+        };
+    });
+    if (claim.kind === 'gone') return refuse(401, 'This kiosk is not paired.');
+    if (claim.kind === 'locked') {
+        return {
+            status: 423,
+            body: {
+                error: 'Too many wrong PINs. Try again later.',
+                lockedUntilMs: claim.lockedUntilMs
+            }
+        };
+    }
+    const host = await gate.hostRef.get();
+    const roles = (_host_get = host.get('memberRoles')) != null ? _host_get : {};
+    const pins = await gate.hostRef.collection('posStaffPins').limit(50).get();
+    let matched = '';
+    for (const doc of pins.docs){
+        var _doc_get, _doc_get1;
+        const uid = String(doc.id);
+        if (roles[uid] !== 'admin' && roles[uid] !== 'editor') continue;
+        if (Number((_doc_get = doc.get('lockedUntilMs')) != null ? _doc_get : 0) > now) continue;
+        const hash = String((_doc_get1 = doc.get('pinScrypt')) != null ? _doc_get1 : '');
+        if (hash && verifyMemberPassword(pin, hash)) {
+            matched = uid;
+            break;
+        }
+    }
+    if (!matched || !await mayUnlock(gate, matched)) {
+        const left = CommerceModel.POS_KIOSK_UNLOCK_MAX_ATTEMPTS - claim.attempt;
+        if (left <= 0) {
+            await gate.device.ref.update({
+                kioskUnlockLockedUntilMs: now + CommerceModel.POS_KIOSK_UNLOCK_LOCKOUT_MS,
+                kioskUnlockFailures: 0
+            });
+            return {
+                status: 423,
+                body: {
+                    error: 'Too many wrong PINs. Try again later.'
+                }
+            };
+        }
+        return {
+            status: 401,
+            body: {
+                error: `That PIN is not right. ${left} ${left === 1 ? 'try' : 'tries'} left.`
+            }
+        };
+    }
+    await gate.device.ref.update({
+        kioskUnlockFailures: 0,
+        kioskUnlockLockedUntilMs: null
+    });
+    const minted = mintPosKioskUnlock(gate.deviceId, matched, now);
+    return {
+        status: 200,
+        body: minted
+    };
+}
+async function staffSettings(gate, body, action) {
+    var _gate_device_data_label;
+    const memberUid = readPosKioskUnlock(body['unlock'], gate.deviceId, Date.now());
+    if (!memberUid || !await mayUnlock(gate, memberUid)) return refuse(401, 'Enter your staff PIN again.');
+    if (action === 'exit') {
+        // Leaving kiosk mode unpairs the device: a new code from the register
+        // is the only way back.
+        await gate.device.ref.delete();
+        return {
+            status: 200,
+            body: {
+                ok: true
+            }
+        };
+    }
+    const readers = await registerReaders(gate);
+    let data = gate.device.data;
+    if (action === 'set-reader') {
+        var _body_readerId;
+        const readerId = String((_body_readerId = body['readerId']) != null ? _body_readerId : '');
+        if (readerId && !readers.some((reader)=>reader.id === readerId)) {
+            return refuse(404, 'That card reader is not on this register.');
+        }
+        await gate.device.ref.set({
+            kioskReaderId: readerId || null
+        }, {
+            merge: true
+        });
+        data = _extends({}, data, {
+            kioskReaderId: readerId || null
+        });
+    }
+    const chosen = await kioskReaderId(_extends({}, gate, {
+        device: _extends({}, gate.device, {
+            data
+        })
+    }));
+    return {
+        status: 200,
+        body: {
+            readers,
+            readerId: chosen,
+            label: String((_gate_device_data_label = gate.device.data['label']) != null ? _gate_device_data_label : 'Self-service kiosk')
+        }
+    };
+}
+/** A Terminal SDK connection token for the native app's Tap to Pay, scoped to the site's Location. */ async function connectionToken(gate) {
+    if (!posTerminalAvailable()) return refuse(409, 'Card payments are not available on this kiosk.');
+    if (!await withinBudget(gate, 'connection-token', 60)) return refuse(429, 'Too many tries.');
+    const token = await createPosTerminalConnectionToken(gate.hostId);
+    if (!token) return refuse(409, 'Set up a card reader location for this site first.');
+    return {
+        status: 200,
+        body: token
+    };
+}
+async function staffAction(req, body, action) {
+    var _body_hostId, _body_registerId, _body_orderId, _order_number, _order_lineItems;
+    const hostId = String((_body_hostId = body['hostId']) != null ? _body_hostId : '');
+    const gate = await authorizePosStaff(req, hostId);
+    if ('error' in gate) return refuse(gate.status, gate.error);
+    const registerId = String((_body_registerId = body['registerId']) != null ? _body_registerId : '');
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(registerId)) return refuse(400, 'Missing registerId');
+    const hostRef = firebaseAdmin.app().firestore().collection('hosts').doc(hostId);
+    if (!(await hostRef.collection('registers').doc(registerId).get()).exists) {
+        return refuse(404, 'Unknown register');
+    }
+    if (action === 'queue') {
+        // `kioskQueueRegisterId ==, status ==, kioskQueuedAtMs ASC`, declared in
+        // the index file: the oldest order first, as a counter serves them.
+        const snapshot = await hostRef.collection('orders').where('kioskQueueRegisterId', '==', registerId).where('status', '==', 'pending').orderBy('kioskQueuedAtMs', 'asc').limit(25).get();
+        const entries = snapshot.docs.map((doc)=>{
+            var _order_number, _order_kioskQueuedAtMs, _ref, _order_lineItems;
+            var _order_totals;
+            const order = CommerceModel.liftLegacyOrder(doc.data());
+            return {
+                orderId: String(doc.id),
+                number: Number((_order_number = order.number) != null ? _order_number : 0),
+                queuedAtMs: Number((_order_kioskQueuedAtMs = order.kioskQueuedAtMs) != null ? _order_kioskQueuedAtMs : 0),
+                totalCents: Number((_ref = (_order_totals = order.totals) == null ? void 0 : _order_totals.totalCents) != null ? _ref : 0),
+                itemCount: ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).reduce((sum, line)=>sum + line.quantity, 0)
+            };
+        });
+        return {
+            status: 200,
+            body: {
+                entries,
+                currency: await posDisplayCurrency(hostId)
+            }
+        };
+    }
+    // `take`: the queued order, as the register loads it into its tender panel.
+    const orderId = String((_body_orderId = body['orderId']) != null ? _body_orderId : '');
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(orderId)) return refuse(400, 'Missing orderId');
+    const order = await readPosSale(hostId, orderId);
+    if (!order || order.kioskQueueRegisterId !== registerId) return refuse(404, 'Unknown order');
+    if (order.status !== 'pending') return refuse(409, 'This order is no longer waiting for payment.');
+    return {
+        status: 200,
+        body: {
+            sale: posSaleSummary(order),
+            number: Number((_order_number = order.number) != null ? _order_number : 0),
+            lines: ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).map((line)=>{
+                var _line_modifiers;
+                return _extends({
+                    productId: line.productId
+                }, line.variantId ? {
+                    variantId: line.variantId
+                } : {}, {
+                    name: line.name
+                }, line.variantLabel ? {
+                    variantLabel: line.variantLabel
+                } : {}, {
+                    unitAmountCents: line.unitAmountCents,
+                    quantity: line.quantity
+                }, ((_line_modifiers = line.modifiers) == null ? void 0 : _line_modifiers.length) ? {
+                    modifiers: line.modifiers.map((modifier)=>({
+                            groupId: modifier.groupId,
+                            optionId: modifier.optionId
+                        }))
+                } : {});
+            })
+        }
+    };
+}
+export async function handlePosKiosk(req) {
+    var _body_action;
+    const body = req.method === 'GET' ? posQueryBody(req) : posRequestBody(req);
+    const action = String((_body_action = body['action']) != null ? _body_action : '');
+    const read = DEVICE_READS.has(action) || STAFF_READS.has(action);
+    if (!(req.method === 'POST' || req.method === 'GET' && read)) {
+        return refuse(405, 'Method not allowed');
+    }
+    if (action === 'queue' || action === 'take') return await staffAction(req, body, action);
+    const gate = await authorizeKiosk(req, body, !read);
+    if ('status' in gate) return gate;
+    switch(action){
+        case 'context':
+            return await context(gate);
+        case 'catalog':
+            return await catalog(gate, body);
+        case 'sale':
+            {
+                const own = await readOwnSale(gate, body['orderId']);
+                return 'status' in own ? own : {
+                    status: 200,
+                    body: {
+                        sale: own.view
+                    }
+                };
+            }
+        case 'checkout':
+            return await checkout(gate, req, body);
+        case 'pay':
+            return await pay(gate, req, body);
+        case 'payment-status':
+        case 'cancel-payment':
+        case 'simulate':
+            return await cardStep(gate, body, action);
+        case 'counter':
+            return await sendToCounter(gate, body);
+        case 'receipt':
+            return await receipt(gate, body);
+        case 'abandon':
+            return await abandon(gate, body);
+        case 'connection-token':
+            return await connectionToken(gate);
+        case 'unlock':
+            return await unlock(gate, req, body);
+        case 'settings':
+        case 'set-reader':
+        case 'exit':
+            return await staffSettings(gate, body, action);
+        default:
+            return refuse(400, 'Unknown action');
+    }
+}
+/** `GET|POST /api/commerce/pos-kiosk`. */ export const posKioskHandler = async (req, res)=>{
+    res.setHeader('Cache-Control', 'no-store');
+    try {
+        const outcome = await handlePosKiosk(req);
+        return res.status(outcome.status).json(outcome.body);
+    } catch (error) {
+        console.error('[pos-kiosk]', error);
+        return res.status(500).json({
+            error: 'Something went wrong. Please order at the counter.'
+        });
+    }
+};
+
+//# sourceMappingURL=pos-kiosk.js.map