@aglyn/plugins-commerce 1.0.0-beta.284 → 1.0.0-beta.287

package/src/lib/server/pos-readers.js

@@ -17,6 +17,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
 import { authorizePosStaff, posRequestBody } from "./pos-auth.js";
 import { revokePosDisplays } from "./pos-display.js";
+import { parsePosHardwareInPersonConfig } from "../model/pos-hardware.js";
+import { parsePosCellularConfig, posCellularView } from "../model/pos-cellular.js";
 import { posStripe, posStripeErrorMessage, posStripeTestMode, posTerminalAvailable } from "./pos-stripe.js";
 import { ensurePosTerminalLocation, ownedTerminalReader, refreshPosReaderStatus } from "./pos-terminal.js";
 /**
@@ -34,12 +36,14 @@ import { ensurePosTerminalLocation, ownedTerminalReader, refreshPosReaderStatus
     });
     const body = posRequestBody(req);
     const hostId = String((_body_hostId = body['hostId']) != null ? _body_hostId : '');
-    const gate = await authorizePosStaff(req, hostId);
+    const action = String((_body_action = body['action']) != null ? _body_action : '');
+    // Listing the readers is the register's; adding, renaming and removing one
+    // is setting it up (AGL-4047).
+    const gate = await authorizePosStaff(req, hostId, action === 'list' ? undefined : 'posDevices');
     if ('error' in gate) return res.status(gate.status).json({
         error: gate.error
     });
     const staff = gate.staff;
-    const action = String((_body_action = body['action']) != null ? _body_action : '');
     try {
         switch(action){
             case 'list':
@@ -52,6 +56,13 @@ import { ensurePosTerminalLocation, ownedTerminalReader, refreshPosReaderStatus
                 return await removeReader(staff, body, res);
             case 'remove-register':
                 return await removeRegister(staff, body, res);
+            case 'cellular':
+                {
+                    // 4G for the store's S710s (AGL-4038): set up like the readers, so
+                    // "Registers and devices" on the store.
+                    const answer = await (await import("./pos-cellular.js")).setPosStoreCellular(staff, body);
+                    return res.status(answer.status).json(answer.body);
+                }
             default:
                 return res.status(400).json({
                     error: 'Unknown action'
@@ -64,6 +75,22 @@ import { ensurePosTerminalLocation, ownedTerminalReader, refreshPosReaderStatus
         });
     }
 };
+/**
+ * The 4G row for the card (AGL-4038), or nothing: with why this viewer may
+ * not turn it on, since it is charged to the workspace ("Manage billing"),
+ * asked only where the row shows.
+ */ async function cellularFor(staff, terminal, readers) {
+    const config = parsePosCellularConfig(process.env);
+    if (!posCellularView(config, terminal, readers)) return {};
+    const { mayTurnOnPosCellular, POS_CELLULAR_BILLING_REFUSAL } = await import("./pos-cellular.js");
+    const turnOnBlocked = await mayTurnOnPosCellular(staff.uid, staff.hostId) ? null : POS_CELLULAR_BILLING_REFUSAL;
+    const cellular = posCellularView(config, terminal, readers, {
+        turnOnBlocked
+    });
+    return cellular ? {
+        cellular
+    } : {};
+}
 function readersRef(hostId) {
     return firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection('terminalReaders');
 }
@@ -80,10 +107,11 @@ async function listReaders(staff, refresh) {
         }));
     }
     const config = await firebaseAdmin.app().firestore().collection('hosts').doc(staff.hostId).collection('terminal').doc('config').get();
-    return {
+    return _extends({
         available,
         testMode: posStripeTestMode(),
-        locationReady: Boolean(config.get('stripeLocationId')),
+        locationReady: Boolean(config.get('stripeLocationId'))
+    }, available ? await cellularFor(staff, config.data(), readers) : {}, {
         readers: readers.map((reader)=>{
             var _reader_registerId, _reader_deviceType, _reader_serialNumber, _reader_status;
             return {
@@ -96,38 +124,75 @@ async function listReaders(staff, refresh) {
                 livemode: reader.livemode
             };
         })
-    };
+    });
 }
 async function registerExists(hostId, registerId) {
     if (!/^[A-Za-z0-9_-]{1,128}$/.test(registerId)) return false;
     return (await firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection('registers').doc(registerId).get()).exists;
 }
 async function registerReader(staff, body, res) {
-    var _body_registrationCode, _body_label, _body_registerId, _ref, _host_get, _address_line1, _address_city, _address_postalCode, _address_country, _created_body_status;
-    var _created_body;
-    if (!posTerminalAvailable()) {
-        return res.status(409).json({
-            error: 'Card readers are not available yet.'
-        });
-    }
-    const registrationCode = String((_body_registrationCode = body['registrationCode']) != null ? _body_registrationCode : '').trim();
-    if (!/^[A-Za-z0-9-]{3,64}$/.test(registrationCode)) {
-        return res.status(400).json({
-            error: 'Enter the code the reader shows on its screen.'
-        });
-    }
-    const label = String((_body_label = body['label']) != null ? _body_label : '').trim().slice(0, 60) || 'Card reader';
+    var _body_registerId;
     const registerId = String((_body_registerId = body['registerId']) != null ? _body_registerId : '');
     if (registerId && !await registerExists(staff.hostId, registerId)) {
         return res.status(404).json({
             error: 'Unknown register'
         });
     }
-    const host = await firebaseAdmin.app().firestore().collection('hosts').doc(staff.hostId).get();
-    const address = body['address'];
-    const location = await ensurePosTerminalLocation(_extends({
+    const registered = await registerPosTerminalReader(_extends({
         hostId: staff.hostId,
         orgId: staff.orgId,
+        uid: staff.uid,
+        registrationCode: body['registrationCode'],
+        label: body['label']
+    }, registerId ? {
+        registerId
+    } : {}, body['address'] ? {
+        address: body['address']
+    } : {}));
+    if ('error' in registered) return res.status(registered.status).json({
+        error: registered.error
+    });
+    return res.status(200).json({
+        reader: _extends({
+            id: registered.id
+        }, registered.reader)
+    });
+}
+/**
+ * Registers a reader to a store by the code it shows: the store's Stripe
+ * Terminal Location (made from `address` when the store has none), the
+ * reader at Stripe, and `hosts/{hostId}/terminalReaders/{id}`. The POS
+ * devices card's Add card reader, and the platform's own register setting a
+ * reader up for the store of the person who just bought it (AGL-4038).
+ *
+ * A reader whose serial number was taken when it was sold in person is
+ * found on its hardware order, which moves on to Set up (AGL-4038,
+ * `pos-hardware-readers.ts`); that never fails the registration.
+ */ export async function registerPosTerminalReader(input) {
+    var _input_registrationCode, _input_label, _input_registerId, _ref, _host_get, _address_line1, _address_city, _address_postalCode, _address_country, _created_body_status;
+    var _created_body;
+    if (!posTerminalAvailable()) {
+        return {
+            ok: false,
+            status: 409,
+            error: 'Card readers are not available yet.'
+        };
+    }
+    const registrationCode = String((_input_registrationCode = input.registrationCode) != null ? _input_registrationCode : '').trim();
+    if (!/^[A-Za-z0-9-]{3,64}$/.test(registrationCode)) {
+        return {
+            ok: false,
+            status: 400,
+            error: 'Enter the code the reader shows on its screen.'
+        };
+    }
+    const label = String((_input_label = input.label) != null ? _input_label : '').trim().slice(0, 60) || 'Card reader';
+    const registerId = (_input_registerId = input.registerId) != null ? _input_registerId : '';
+    const host = await firebaseAdmin.app().firestore().collection('hosts').doc(input.hostId).get();
+    const address = input.address;
+    const location = await ensurePosTerminalLocation(_extends({
+        hostId: input.hostId,
+        orgId: input.orgId,
         displayName: String((_ref = (_host_get = host.get('name')) != null ? _host_get : host.get('title')) != null ? _ref : 'Store')
     }, address ? {
         address: _extends({
@@ -143,9 +208,11 @@ async function registerReader(staff, body, res) {
             country: String((_address_country = address.country) != null ? _address_country : '').toUpperCase().slice(0, 2)
         })
     } : {}));
-    if ('error' in location) return res.status(location.status).json({
+    if ('error' in location) return {
+        ok: false,
+        status: location.status,
         error: location.error
-    });
+    };
     // Not keyed: a registration code is single-use at Stripe, which is the
     // dedupe — a second press with the same code is refused there, and no
     // other store can ever register a reader this one already holds.
@@ -154,16 +221,18 @@ async function registerReader(staff, body, res) {
             registration_code: registrationCode,
             label,
             location: location.locationId,
-            'metadata[orgId]': staff.orgId,
-            'metadata[hostId]': staff.hostId
+            'metadata[orgId]': input.orgId,
+            'metadata[hostId]': input.hostId
         }, registerId ? {
             'metadata[registerId]': registerId
         } : {})
     });
     if (!created.ok || !((_created_body = created.body) == null ? void 0 : _created_body.id)) {
-        return res.status(400).json({
+        return {
+            ok: false,
+            status: 400,
             error: posStripeErrorMessage(created.body, 'That code did not register a reader. Check the code on the reader and try again.')
-        });
+        };
     }
     const reader = _extends({
         label
@@ -179,14 +248,29 @@ async function registerReader(staff, body, res) {
         status: String((_created_body_status = created.body.status) != null ? _created_body_status : 'offline'),
         livemode: Boolean(created.body.livemode),
         createdAtMs: Date.now(),
-        createdBy: staff.uid
-    });
-    await readersRef(staff.hostId).doc(String(created.body.id)).set(reader);
-    return res.status(200).json({
-        reader: _extends({
-            id: String(created.body.id)
-        }, reader)
+        createdBy: input.uid
     });
+    const id = String(created.body.id);
+    await readersRef(input.hostId).doc(id).set(reader);
+    await syncCellular(input.hostId, input.orgId);
+    if (reader.serialNumber && parsePosHardwareInPersonConfig(process.env)) {
+        try {
+            await (await import("./pos-hardware-readers.js")).matchRegisteredPosHardwareReader({
+                hostId: input.hostId,
+                orgId: input.orgId,
+                uid: input.uid,
+                readerId: id,
+                serialNumber: reader.serialNumber
+            });
+        } catch (error) {
+            console.error('[pos-readers] the hardware order was not matched', id, error);
+        }
+    }
+    return {
+        ok: true,
+        id,
+        reader
+    };
 }
 async function updateReader(staff, body, res) {
     var _body_registerId;
@@ -240,10 +324,25 @@ async function removeReader(staff, body, res) {
         });
     }
     await readersRef(staff.hostId).doc(reader.id).delete();
+    await syncCellular(staff.hostId, staff.orgId);
     return res.status(200).json({
         ok: true
     });
 }
+/**
+ * A reader added to or removed from a store with 4G (AGL-4038) starts or
+ * stops counting toward its monthly charge. Never fails the reader's own
+ * change; the next turn-on, turn-off or reader change heals a miss.
+ */ async function syncCellular(hostId, orgId) {
+    try {
+        await (await import("./pos-cellular.js")).syncPosCellularReaders({
+            hostId,
+            orgId
+        });
+    } catch (error) {
+        console.error('[pos-readers] the 4G record was not updated', hostId, error);
+    }
+}
 /**
  * Removes a register on the server (AGL-3617). The settings card deleted it
  * with a client `deleteDoc`, which the Firestore rules refuse for everyone but

package/src/lib/server/pos-readers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-readers.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { authorizePosStaff, posRequestBody, type PosStaff } from './pos-auth'\nimport { revokePosDisplays } from './pos-display'\nimport { posStripe, posStripeErrorMessage, posStripeTestMode, posTerminalAvailable } from './pos-stripe'\nimport {\n  ensurePosTerminalLocation,\n  ownedTerminalReader,\n  refreshPosReaderStatus,\n  type PosTerminalAddress,\n  type PosTerminalReader,\n} from './pos-terminal'\n\n/**\n * `POST /api/commerce/pos-readers` (AGL-3607): the site's Stripe Terminal\n * card readers, from the \"Card readers\" settings card, and the server-side\n * removal of a register.\n *\n * Every action names a reader by id, and every one reads that reader under\n * the CALLER's site first (`ownedTerminalReader`): a reader id copied from\n * another store is \"not on this site\", whatever Stripe would say about it.\n */\nexport const posReadersHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n  const body = posRequestBody(req)\n  const hostId = String(body['hostId'] ?? '')\n  const gate = await authorizePosStaff(req, hostId)\n  if ('error' in gate) return res.status(gate.status).json({ error: gate.error })\n  const staff = gate.staff\n  const action = String(body['action'] ?? '')\n  try {\n    switch (action) {\n      case 'list':\n        return res.status(200).json(await listReaders(staff, body['refresh'] === true))\n      case 'register':\n        return await registerReader(staff, body, res)\n      case 'update':\n        return await updateReader(staff, body, res)\n      case 'remove':\n        return await removeReader(staff, body, res)\n      case 'remove-register':\n        return await removeRegister(staff, body, res)\n      default:\n        return res.status(400).json({ error: 'Unknown action' })\n    }\n  } catch (error) {\n    console.error('[pos-readers]', action, error)\n    return res.status(500).json({ error: 'Card readers could not be updated' })\n  }\n}\n\nfunction readersRef(hostId: string) {\n  return firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection('terminalReaders')\n}\n\nasync function listReaders(staff: PosStaff, refresh: boolean) {\n  const available = posTerminalAvailable()\n  const snapshot = await readersRef(staff.hostId).limit(50).get()\n  const readers = snapshot.docs.map((doc: any) => ({\n    id: doc.id as string,\n    ...(doc.data() as PosTerminalReader),\n  }))\n  if (available && refresh) {\n    await Promise.all(\n      readers.map(async (reader: PosTerminalReader & { id: string }) => {\n        const fresh = await refreshPosReaderStatus(staff.hostId, reader.id).catch(() => null)\n        if (fresh) reader.status = fresh.status\n      }),\n    )\n  }\n  const config = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(staff.hostId)\n    .collection('terminal')\n    .doc('config')\n    .get()\n  return {\n    available,\n    testMode: posStripeTestMode(),\n    locationReady: Boolean(config.get('stripeLocationId')),\n    readers: readers.map((reader: PosTerminalReader & { id: string }) => ({\n      id: reader.id,\n      label: reader.label,\n      registerId: reader.registerId ?? null,\n      deviceType: reader.deviceType ?? null,\n      serialNumber: reader.serialNumber ?? null,\n      status: reader.status ?? 'offline',\n      livemode: reader.livemode,\n    })),\n  }\n}\n\nasync function registerExists(hostId: string, registerId: string): Promise<boolean> {\n  if (!/^[A-Za-z0-9_-]{1,128}$/.test(registerId)) return false\n  return (\n    await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('registers')\n      .doc(registerId)\n      .get()\n  ).exists\n}\n\nasync function registerReader(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  if (!posTerminalAvailable()) {\n    return res.status(409).json({ error: 'Card readers are not available yet.' })\n  }\n  const registrationCode = String(body['registrationCode'] ?? '').trim()\n  if (!/^[A-Za-z0-9-]{3,64}$/.test(registrationCode)) {\n    return res.status(400).json({ error: 'Enter the code the reader shows on its screen.' })\n  }\n  const label = String(body['label'] ?? '').trim().slice(0, 60) || 'Card reader'\n  const registerId = String(body['registerId'] ?? '')\n  if (registerId && !(await registerExists(staff.hostId, registerId))) {\n    return res.status(404).json({ error: 'Unknown register' })\n  }\n  const host = await firebaseAdmin.app().firestore().collection('hosts').doc(staff.hostId).get()\n  const address = body['address'] as PosTerminalAddress | undefined\n  const location = await ensurePosTerminalLocation({\n    hostId: staff.hostId,\n    orgId: staff.orgId,\n    displayName: String(host.get('name') ?? host.get('title') ?? 'Store'),\n    ...(address\n      ? {\n          address: {\n            line1: String(address.line1 ?? '').slice(0, 200),\n            ...(address.line2 ? { line2: String(address.line2).slice(0, 200) } : {}),\n            city: String(address.city ?? '').slice(0, 100),\n            ...(address.state ? { state: String(address.state).slice(0, 100) } : {}),\n            postalCode: String(address.postalCode ?? '').slice(0, 20),\n            country: String(address.country ?? '').toUpperCase().slice(0, 2),\n          },\n        }\n      : {}),\n  })\n  if ('error' in location) return res.status(location.status).json({ error: location.error })\n  // Not keyed: a registration code is single-use at Stripe, which is the\n  // dedupe — a second press with the same code is refused there, and no\n  // other store can ever register a reader this one already holds.\n  const created = await posStripe('POST', 'terminal/readers', {\n    params: {\n      registration_code: registrationCode,\n      label,\n      location: location.locationId,\n      'metadata[orgId]': staff.orgId,\n      'metadata[hostId]': staff.hostId,\n      ...(registerId ? { 'metadata[registerId]': registerId } : {}),\n    },\n  })\n  if (!created.ok || !created.body?.id) {\n    return res.status(400).json({\n      error: posStripeErrorMessage(\n        created.body,\n        'That code did not register a reader. Check the code on the reader and try again.',\n      ),\n    })\n  }\n  const reader: PosTerminalReader = {\n    label,\n    ...(registerId ? { registerId } : {}),\n    stripeLocationId: location.locationId,\n    ...(created.body.device_type ? { deviceType: String(created.body.device_type) } : {}),\n    ...(created.body.serial_number ? { serialNumber: String(created.body.serial_number) } : {}),\n    status: String(created.body.status ?? 'offline'),\n    livemode: Boolean(created.body.livemode),\n    createdAtMs: Date.now(),\n    createdBy: staff.uid,\n  }\n  await readersRef(staff.hostId).doc(String(created.body.id)).set(reader)\n  return res.status(200).json({ reader: { id: String(created.body.id), ...reader } })\n}\n\nasync function updateReader(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  const reader = await ownedTerminalReader(staff.hostId, body['readerId'])\n  if (!reader) return res.status(404).json({ error: 'That card reader is not on this site.' })\n  const patch: Record<string, unknown> = {}\n  if (typeof body['label'] === 'string') {\n    patch['label'] = body['label'].trim().slice(0, 60) || reader.label\n  }\n  if ('registerId' in body) {\n    const registerId = String(body['registerId'] ?? '')\n    if (registerId && !(await registerExists(staff.hostId, registerId))) {\n      return res.status(404).json({ error: 'Unknown register' })\n    }\n    patch['registerId'] = registerId || firebaseAdmin.firestore.FieldValue.delete()\n  }\n  const updated = await posStripe('POST', `terminal/readers/${reader.id}`, {\n    params: {\n      ...(patch['label'] ? { label: String(patch['label']) } : {}),\n      ...('registerId' in body ? { 'metadata[registerId]': String(body['registerId'] ?? '') } : {}),\n    },\n  })\n  if (!updated.ok) {\n    return res.status(502).json({ error: posStripeErrorMessage(updated.body, 'The reader could not be updated.') })\n  }\n  await readersRef(staff.hostId).doc(reader.id).set(patch, { merge: true })\n  return res.status(200).json({ ok: true })\n}\n\nasync function removeReader(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  const reader = await ownedTerminalReader(staff.hostId, body['readerId'])\n  if (!reader) return res.status(404).json({ error: 'That card reader is not on this site.' })\n  const removed = await posStripe('DELETE', `terminal/readers/${reader.id}`)\n  // Already gone at Stripe is the outcome asked for; anything else is not.\n  if (!removed.ok && removed.status !== 404) {\n    return res.status(502).json({ error: posStripeErrorMessage(removed.body, 'The reader could not be removed.') })\n  }\n  await readersRef(staff.hostId).doc(reader.id).delete()\n  return res.status(200).json({ ok: true })\n}\n\n/**\n * Removes a register on the server (AGL-3617). The settings card deleted it\n * with a client `deleteDoc`, which the Firestore rules refuse for everyone but\n * staff (`registers` is server-owned since AGL-1775), so a merchant's Remove\n * button failed with a permission error. Removing it here also signs out its\n * customer displays and unbinds its readers.\n */\nasync function removeRegister(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  const registerId = String(body['registerId'] ?? '')\n  if (!(await registerExists(staff.hostId, registerId))) {\n    return res.status(404).json({ error: 'Unknown register' })\n  }\n  const firestore = firebaseAdmin.app().firestore()\n  const registerRef = firestore\n    .collection('hosts')\n    .doc(staff.hostId)\n    .collection('registers')\n    .doc(registerId)\n  await revokePosDisplays(staff.hostId, registerId)\n  await registerRef.delete()\n  const bound = await readersRef(staff.hostId).where('registerId', '==', registerId).limit(50).get()\n  await Promise.all(\n    bound.docs.map((doc: any) =>\n      doc.ref.set({ registerId: firebaseAdmin.firestore.FieldValue.delete() }, { merge: true }),\n    ),\n  )\n  return res.status(200).json({ ok: true })\n}\n"],"names":["firebaseAdmin","authorizePosStaff","posRequestBody","revokePosDisplays","posStripe","posStripeErrorMessage","posStripeTestMode","posTerminalAvailable","ensurePosTerminalLocation","ownedTerminalReader","refreshPosReaderStatus","posReadersHandler","req","res","body","method","status","json","error","hostId","String","gate","staff","action","listReaders","registerReader","updateReader","removeReader","removeRegister","console","readersRef","app","firestore","collection","doc","refresh","available","snapshot","limit","get","readers","docs","map","id","data","Promise","all","reader","fresh","catch","config","testMode","locationReady","Boolean","label","registerId","deviceType","serialNumber","livemode","registerExists","test","exists","host","address","created","registrationCode","trim","slice","location","orgId","displayName","line1","line2","city","state","postalCode","country","toUpperCase","params","registration_code","locationId","ok","stripeLocationId","device_type","serial_number","createdAtMs","Date","now","createdBy","uid","set","patch","FieldValue","delete","updated","merge","removed","registerRef","bound","where","ref"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AAExD,SAASC,iBAAiB,EAAEC,cAAc,QAAuB,gBAAY;AAC7E,SAASC,iBAAiB,QAAQ,mBAAe;AACjD,SAASC,SAAS,EAAEC,qBAAqB,EAAEC,iBAAiB,EAAEC,oBAAoB,QAAQ,kBAAc;AACxG,SACEC,yBAAyB,EACzBC,mBAAmB,EACnBC,sBAAsB,QAGjB,oBAAgB;AAEvB;;;;;;;;CAQC,GACD,OAAO,MAAMC,oBAAsC,OAAOC,KAAKC;QAGvCC,cAIAA;IANtB,IAAIF,IAAIG,MAAM,KAAK,QAAQ,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAqB;IACrF,MAAMJ,OAAOZ,eAAeU;IAC5B,MAAMO,SAASC,QAAON,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;IACxC,MAAMO,OAAO,MAAMpB,kBAAkBW,KAAKO;IAC1C,IAAI,WAAWE,MAAM,OAAOR,IAAIG,MAAM,CAACK,KAAKL,MAAM,EAAEC,IAAI,CAAC;QAAEC,OAAOG,KAAKH,KAAK;IAAC;IAC7E,MAAMI,QAAQD,KAAKC,KAAK;IACxB,MAAMC,SAASH,QAAON,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;IACxC,IAAI;QACF,OAAQS;YACN,KAAK;gBACH,OAAOV,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC,MAAMO,YAAYF,OAAOR,IAAI,CAAC,UAAU,KAAK;YAC3E,KAAK;gBACH,OAAO,MAAMW,eAAeH,OAAOR,MAAMD;YAC3C,KAAK;gBACH,OAAO,MAAMa,aAAaJ,OAAOR,MAAMD;YACzC,KAAK;gBACH,OAAO,MAAMc,aAAaL,OAAOR,MAAMD;YACzC,KAAK;gBACH,OAAO,MAAMe,eAAeN,OAAOR,MAAMD;YAC3C;gBACE,OAAOA,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAiB;QAC1D;IACF,EAAE,OAAOA,OAAO;QACdW,QAAQX,KAAK,CAAC,iBAAiBK,QAAQL;QACvC,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;AACF,EAAC;AAED,SAASY,WAAWX,MAAc;IAChC,OAAOnB,cAAc+B,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAACf,QAAQc,UAAU,CAAC;AACpF;AAEA,eAAeT,YAAYF,KAAe,EAAEa,OAAgB;IAC1D,MAAMC,YAAY7B;IAClB,MAAM8B,WAAW,MAAMP,WAAWR,MAAMH,MAAM,EAAEmB,KAAK,CAAC,IAAIC,GAAG;IAC7D,MAAMC,UAAUH,SAASI,IAAI,CAACC,GAAG,CAAC,CAACR,MAAc;YAC/CS,IAAIT,IAAIS,EAAE;WACNT,IAAIU,IAAI;IAEd,IAAIR,aAAaD,SAAS;QACxB,MAAMU,QAAQC,GAAG,CACfN,QAAQE,GAAG,CAAC,OAAOK;YACjB,MAAMC,QAAQ,MAAMtC,uBAAuBY,MAAMH,MAAM,EAAE4B,OAAOJ,EAAE,EAAEM,KAAK,CAAC,IAAM;YAChF,IAAID,OAAOD,OAAO/B,MAAM,GAAGgC,MAAMhC,MAAM;QACzC;IAEJ;IACA,MAAMkC,SAAS,MAAMlD,cAClB+B,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACZ,MAAMH,MAAM,EAChBc,UAAU,CAAC,YACXC,GAAG,CAAC,UACJK,GAAG;IACN,OAAO;QACLH;QACAe,UAAU7C;QACV8C,eAAeC,QAAQH,OAAOX,GAAG,CAAC;QAClCC,SAASA,QAAQE,GAAG,CAAC,CAACK;gBAGRA,oBACAA,oBACEA,sBACNA;mBAN4D;gBACpEJ,IAAII,OAAOJ,EAAE;gBACbW,OAAOP,OAAOO,KAAK;gBACnBC,UAAU,GAAER,qBAAAA,OAAOQ,UAAU,YAAjBR,qBAAqB;gBACjCS,UAAU,GAAET,qBAAAA,OAAOS,UAAU,YAAjBT,qBAAqB;gBACjCU,YAAY,GAAEV,uBAAAA,OAAOU,YAAY,YAAnBV,uBAAuB;gBACrC/B,MAAM,GAAE+B,iBAAAA,OAAO/B,MAAM,YAAb+B,iBAAiB;gBACzBW,UAAUX,OAAOW,QAAQ;YAC3B;;IACF;AACF;AAEA,eAAeC,eAAexC,MAAc,EAAEoC,UAAkB;IAC9D,IAAI,CAAC,yBAAyBK,IAAI,CAACL,aAAa,OAAO;IACvD,OAAO,AACL,CAAA,MAAMvD,cACH+B,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACf,QACJc,UAAU,CAAC,aACXC,GAAG,CAACqB,YACJhB,GAAG,EAAC,EACPsB,MAAM;AACV;AAEA,eAAepC,eACbH,KAAe,EACfR,IAAyB,EACzBD,GAAoC;QAKJC,wBAIXA,aACKA,kBASJgD,MAAAA,WAIEC,gBAEDA,eAEMA,qBACHA,kBAiCTC;QAdGA;IA7CpB,IAAI,CAACzD,wBAAwB;QAC3B,OAAOM,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsC;IAC7E;IACA,MAAM+C,mBAAmB7C,QAAON,yBAAAA,IAAI,CAAC,mBAAmB,YAAxBA,yBAA4B,IAAIoD,IAAI;IACpE,IAAI,CAAC,uBAAuBN,IAAI,CAACK,mBAAmB;QAClD,OAAOpD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiD;IACxF;IACA,MAAMoC,QAAQlC,QAAON,cAAAA,IAAI,CAAC,QAAQ,YAAbA,cAAiB,IAAIoD,IAAI,GAAGC,KAAK,CAAC,GAAG,OAAO;IACjE,MAAMZ,aAAanC,QAAON,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB;IAChD,IAAIyC,cAAc,CAAE,MAAMI,eAAerC,MAAMH,MAAM,EAAEoC,aAAc;QACnE,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmB;IAC1D;IACA,MAAM4C,OAAO,MAAM9D,cAAc+B,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAACZ,MAAMH,MAAM,EAAEoB,GAAG;IAC5F,MAAMwB,UAAUjD,IAAI,CAAC,UAAU;IAC/B,MAAMsD,WAAW,MAAM5D,0BAA0B;QAC/CW,QAAQG,MAAMH,MAAM;QACpBkD,OAAO/C,MAAM+C,KAAK;QAClBC,aAAalD,QAAO0C,QAAAA,YAAAA,KAAKvB,GAAG,CAAC,mBAATuB,YAAoBA,KAAKvB,GAAG,CAAC,oBAA7BuB,OAAyC;OACzDC,UACA;QACEA,SAAS;YACPQ,OAAOnD,QAAO2C,iBAAAA,QAAQQ,KAAK,YAAbR,iBAAiB,IAAII,KAAK,CAAC,GAAG;WACxCJ,QAAQS,KAAK,GAAG;YAAEA,OAAOpD,OAAO2C,QAAQS,KAAK,EAAEL,KAAK,CAAC,GAAG;QAAK,IAAI,CAAC;YACtEM,MAAMrD,QAAO2C,gBAAAA,QAAQU,IAAI,YAAZV,gBAAgB,IAAII,KAAK,CAAC,GAAG;WACtCJ,QAAQW,KAAK,GAAG;YAAEA,OAAOtD,OAAO2C,QAAQW,KAAK,EAAEP,KAAK,CAAC,GAAG;QAAK,IAAI,CAAC;YACtEQ,YAAYvD,QAAO2C,sBAAAA,QAAQY,UAAU,YAAlBZ,sBAAsB,IAAII,KAAK,CAAC,GAAG;YACtDS,SAASxD,QAAO2C,mBAAAA,QAAQa,OAAO,YAAfb,mBAAmB,IAAIc,WAAW,GAAGV,KAAK,CAAC,GAAG;;IAElE,IACA,CAAC;IAEP,IAAI,WAAWC,UAAU,OAAOvD,IAAIG,MAAM,CAACoD,SAASpD,MAAM,EAAEC,IAAI,CAAC;QAAEC,OAAOkD,SAASlD,KAAK;IAAC;IACzF,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,MAAM8C,UAAU,MAAM5D,UAAU,QAAQ,oBAAoB;QAC1D0E,QAAQ;YACNC,mBAAmBd;YACnBX;YACAc,UAAUA,SAASY,UAAU;YAC7B,mBAAmB1D,MAAM+C,KAAK;YAC9B,oBAAoB/C,MAAMH,MAAM;WAC5BoC,aAAa;YAAE,wBAAwBA;QAAW,IAAI,CAAC;IAE/D;IACA,IAAI,CAACS,QAAQiB,EAAE,IAAI,GAACjB,gBAAAA,QAAQlD,IAAI,qBAAZkD,cAAcrB,EAAE,GAAE;QACpC,OAAO9B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BC,OAAOb,sBACL2D,QAAQlD,IAAI,EACZ;QAEJ;IACF;IACA,MAAMiC,SAA4B;QAChCO;OACIC,aAAa;QAAEA;IAAW,IAAI,CAAC;QACnC2B,kBAAkBd,SAASY,UAAU;OACjChB,QAAQlD,IAAI,CAACqE,WAAW,GAAG;QAAE3B,YAAYpC,OAAO4C,QAAQlD,IAAI,CAACqE,WAAW;IAAE,IAAI,CAAC,GAC/EnB,QAAQlD,IAAI,CAACsE,aAAa,GAAG;QAAE3B,cAAcrC,OAAO4C,QAAQlD,IAAI,CAACsE,aAAa;IAAE,IAAI,CAAC;QACzFpE,QAAQI,QAAO4C,uBAAAA,QAAQlD,IAAI,CAACE,MAAM,YAAnBgD,uBAAuB;QACtCN,UAAUL,QAAQW,QAAQlD,IAAI,CAAC4C,QAAQ;QACvC2B,aAAaC,KAAKC,GAAG;QACrBC,WAAWlE,MAAMmE,GAAG;;IAEtB,MAAM3D,WAAWR,MAAMH,MAAM,EAAEe,GAAG,CAACd,OAAO4C,QAAQlD,IAAI,CAAC6B,EAAE,GAAG+C,GAAG,CAAC3C;IAChE,OAAOlC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAE8B,QAAQ;YAAEJ,IAAIvB,OAAO4C,QAAQlD,IAAI,CAAC6B,EAAE;WAAMI;IAAS;AACnF;AAEA,eAAerB,aACbJ,KAAe,EACfR,IAAyB,EACzBD,GAAoC;QAkB4BC;IAhBhE,MAAMiC,SAAS,MAAMtC,oBAAoBa,MAAMH,MAAM,EAAEL,IAAI,CAAC,WAAW;IACvE,IAAI,CAACiC,QAAQ,OAAOlC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAwC;IAC1F,MAAMyE,QAAiC,CAAC;IACxC,IAAI,OAAO7E,IAAI,CAAC,QAAQ,KAAK,UAAU;QACrC6E,KAAK,CAAC,QAAQ,GAAG7E,IAAI,CAAC,QAAQ,CAACoD,IAAI,GAAGC,KAAK,CAAC,GAAG,OAAOpB,OAAOO,KAAK;IACpE;IACA,IAAI,gBAAgBxC,MAAM;YACEA;QAA1B,MAAMyC,aAAanC,QAAON,oBAAAA,IAAI,CAAC,aAAa,YAAlBA,oBAAsB;QAChD,IAAIyC,cAAc,CAAE,MAAMI,eAAerC,MAAMH,MAAM,EAAEoC,aAAc;YACnE,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAmB;QAC1D;QACAyE,KAAK,CAAC,aAAa,GAAGpC,cAAcvD,cAAcgC,SAAS,CAAC4D,UAAU,CAACC,MAAM;IAC/E;IACA,MAAMC,UAAU,MAAM1F,UAAU,QAAQ,CAAC,iBAAiB,EAAE2C,OAAOJ,EAAE,EAAE,EAAE;QACvEmC,QAAQ,aACFa,KAAK,CAAC,QAAQ,GAAG;YAAErC,OAAOlC,OAAOuE,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,GACtD,gBAAgB7E,OAAO;YAAE,wBAAwBM,QAAON,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB;QAAI,IAAI,CAAC;IAE/F;IACA,IAAI,CAACgF,QAAQb,EAAE,EAAE;QACf,OAAOpE,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOb,sBAAsByF,QAAQhF,IAAI,EAAE;QAAoC;IAC/G;IACA,MAAMgB,WAAWR,MAAMH,MAAM,EAAEe,GAAG,CAACa,OAAOJ,EAAE,EAAE+C,GAAG,CAACC,OAAO;QAAEI,OAAO;IAAK;IACvE,OAAOlF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEgE,IAAI;IAAK;AACzC;AAEA,eAAetD,aACbL,KAAe,EACfR,IAAyB,EACzBD,GAAoC;IAEpC,MAAMkC,SAAS,MAAMtC,oBAAoBa,MAAMH,MAAM,EAAEL,IAAI,CAAC,WAAW;IACvE,IAAI,CAACiC,QAAQ,OAAOlC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAwC;IAC1F,MAAM8E,UAAU,MAAM5F,UAAU,UAAU,CAAC,iBAAiB,EAAE2C,OAAOJ,EAAE,EAAE;IACzE,yEAAyE;IACzE,IAAI,CAACqD,QAAQf,EAAE,IAAIe,QAAQhF,MAAM,KAAK,KAAK;QACzC,OAAOH,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOb,sBAAsB2F,QAAQlF,IAAI,EAAE;QAAoC;IAC/G;IACA,MAAMgB,WAAWR,MAAMH,MAAM,EAAEe,GAAG,CAACa,OAAOJ,EAAE,EAAEkD,MAAM;IACpD,OAAOhF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEgE,IAAI;IAAK;AACzC;AAEA;;;;;;CAMC,GACD,eAAerD,eACbN,KAAe,EACfR,IAAyB,EACzBD,GAAoC;QAEVC;IAA1B,MAAMyC,aAAanC,QAAON,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB;IAChD,IAAI,CAAE,MAAM6C,eAAerC,MAAMH,MAAM,EAAEoC,aAAc;QACrD,OAAO1C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmB;IAC1D;IACA,MAAMc,YAAYhC,cAAc+B,GAAG,GAAGC,SAAS;IAC/C,MAAMiE,cAAcjE,UACjBC,UAAU,CAAC,SACXC,GAAG,CAACZ,MAAMH,MAAM,EAChBc,UAAU,CAAC,aACXC,GAAG,CAACqB;IACP,MAAMpD,kBAAkBmB,MAAMH,MAAM,EAAEoC;IACtC,MAAM0C,YAAYJ,MAAM;IACxB,MAAMK,QAAQ,MAAMpE,WAAWR,MAAMH,MAAM,EAAEgF,KAAK,CAAC,cAAc,MAAM5C,YAAYjB,KAAK,CAAC,IAAIC,GAAG;IAChG,MAAMM,QAAQC,GAAG,CACfoD,MAAMzD,IAAI,CAACC,GAAG,CAAC,CAACR,MACdA,IAAIkE,GAAG,CAACV,GAAG,CAAC;YAAEnC,YAAYvD,cAAcgC,SAAS,CAAC4D,UAAU,CAACC,MAAM;QAAG,GAAG;YAAEE,OAAO;QAAK;IAG3F,OAAOlF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEgE,IAAI;IAAK;AACzC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-readers.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { authorizePosStaff, posRequestBody, type PosStaff } from './pos-auth'\nimport { revokePosDisplays } from './pos-display'\nimport { parsePosHardwareInPersonConfig } from '../model/pos-hardware'\nimport { parsePosCellularConfig, posCellularView, type PosCellularView } from '../model/pos-cellular'\nimport { posStripe, posStripeErrorMessage, posStripeTestMode, posTerminalAvailable } from './pos-stripe'\nimport {\n  ensurePosTerminalLocation,\n  ownedTerminalReader,\n  refreshPosReaderStatus,\n  type PosTerminalAddress,\n  type PosTerminalReader,\n} from './pos-terminal'\n\n/**\n * `POST /api/commerce/pos-readers` (AGL-3607): the site's Stripe Terminal\n * card readers, from the \"Card readers\" settings card, and the server-side\n * removal of a register.\n *\n * Every action names a reader by id, and every one reads that reader under\n * the CALLER's site first (`ownedTerminalReader`): a reader id copied from\n * another store is \"not on this site\", whatever Stripe would say about it.\n */\nexport const posReadersHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n  const body = posRequestBody(req)\n  const hostId = String(body['hostId'] ?? '')\n  const action = String(body['action'] ?? '')\n  // Listing the readers is the register's; adding, renaming and removing one\n  // is setting it up (AGL-4047).\n  const gate = await authorizePosStaff(req, hostId, action === 'list' ? undefined : 'posDevices')\n  if ('error' in gate) return res.status(gate.status).json({ error: gate.error })\n  const staff = gate.staff\n  try {\n    switch (action) {\n      case 'list':\n        return res.status(200).json(await listReaders(staff, body['refresh'] === true))\n      case 'register':\n        return await registerReader(staff, body, res)\n      case 'update':\n        return await updateReader(staff, body, res)\n      case 'remove':\n        return await removeReader(staff, body, res)\n      case 'remove-register':\n        return await removeRegister(staff, body, res)\n      case 'cellular': {\n        // 4G for the store's S710s (AGL-4038): set up like the readers, so\n        // \"Registers and devices\" on the store.\n        const answer = await (await import('./pos-cellular')).setPosStoreCellular(staff, body)\n        return res.status(answer.status).json(answer.body)\n      }\n      default:\n        return res.status(400).json({ error: 'Unknown action' })\n    }\n  } catch (error) {\n    console.error('[pos-readers]', action, error)\n    return res.status(500).json({ error: 'Card readers could not be updated' })\n  }\n}\n\n/**\n * The 4G row for the card (AGL-4038), or nothing: with why this viewer may\n * not turn it on, since it is charged to the workspace (\"Manage billing\"),\n * asked only where the row shows.\n */\nasync function cellularFor(\n  staff: PosStaff,\n  terminal: Record<string, unknown> | undefined,\n  readers: ReadonlyArray<{ deviceType?: unknown }>,\n): Promise<{ cellular?: PosCellularView }> {\n  const config = parsePosCellularConfig(process.env)\n  if (!posCellularView(config, terminal, readers)) return {}\n  const { mayTurnOnPosCellular, POS_CELLULAR_BILLING_REFUSAL } = await import('./pos-cellular')\n  const turnOnBlocked = (await mayTurnOnPosCellular(staff.uid, staff.hostId)) ? null : POS_CELLULAR_BILLING_REFUSAL\n  const cellular = posCellularView(config, terminal, readers, { turnOnBlocked })\n  return cellular ? { cellular } : {}\n}\n\nfunction readersRef(hostId: string) {\n  return firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection('terminalReaders')\n}\n\nasync function listReaders(staff: PosStaff, refresh: boolean) {\n  const available = posTerminalAvailable()\n  const snapshot = await readersRef(staff.hostId).limit(50).get()\n  const readers = snapshot.docs.map((doc: any) => ({\n    id: doc.id as string,\n    ...(doc.data() as PosTerminalReader),\n  }))\n  if (available && refresh) {\n    await Promise.all(\n      readers.map(async (reader: PosTerminalReader & { id: string }) => {\n        const fresh = await refreshPosReaderStatus(staff.hostId, reader.id).catch(() => null)\n        if (fresh) reader.status = fresh.status\n      }),\n    )\n  }\n  const config = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(staff.hostId)\n    .collection('terminal')\n    .doc('config')\n    .get()\n  return {\n    available,\n    testMode: posStripeTestMode(),\n    locationReady: Boolean(config.get('stripeLocationId')),\n    // 4G for the store's S710s (AGL-4038), only where it is offered and the\n    // store has one; absent otherwise, so the card shows nothing of it.\n    ...(available ? await cellularFor(staff, config.data(), readers) : {}),\n    readers: readers.map((reader: PosTerminalReader & { id: string }) => ({\n      id: reader.id,\n      label: reader.label,\n      registerId: reader.registerId ?? null,\n      deviceType: reader.deviceType ?? null,\n      serialNumber: reader.serialNumber ?? null,\n      status: reader.status ?? 'offline',\n      livemode: reader.livemode,\n    })),\n  }\n}\n\nasync function registerExists(hostId: string, registerId: string): Promise<boolean> {\n  if (!/^[A-Za-z0-9_-]{1,128}$/.test(registerId)) return false\n  return (\n    await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('registers')\n      .doc(registerId)\n      .get()\n  ).exists\n}\n\nasync function registerReader(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  const registerId = String(body['registerId'] ?? '')\n  if (registerId && !(await registerExists(staff.hostId, registerId))) {\n    return res.status(404).json({ error: 'Unknown register' })\n  }\n  const registered = await registerPosTerminalReader({\n    hostId: staff.hostId,\n    orgId: staff.orgId,\n    uid: staff.uid,\n    registrationCode: body['registrationCode'],\n    label: body['label'],\n    ...(registerId ? { registerId } : {}),\n    ...(body['address'] ? { address: body['address'] as PosTerminalAddress } : {}),\n  })\n  if ('error' in registered) return res.status(registered.status).json({ error: registered.error })\n  return res.status(200).json({ reader: { id: registered.id, ...registered.reader } })\n}\n\n/**\n * Registers a reader to a store by the code it shows: the store's Stripe\n * Terminal Location (made from `address` when the store has none), the\n * reader at Stripe, and `hosts/{hostId}/terminalReaders/{id}`. The POS\n * devices card's Add card reader, and the platform's own register setting a\n * reader up for the store of the person who just bought it (AGL-4038).\n *\n * A reader whose serial number was taken when it was sold in person is\n * found on its hardware order, which moves on to Set up (AGL-4038,\n * `pos-hardware-readers.ts`); that never fails the registration.\n */\nexport async function registerPosTerminalReader(input: {\n  hostId: string\n  orgId: string\n  uid: string\n  registrationCode: unknown\n  label?: unknown\n  registerId?: string\n  address?: PosTerminalAddress\n}): Promise<\n  { ok: true; id: string; reader: PosTerminalReader } | { ok: false; status: number; error: string }\n> {\n  if (!posTerminalAvailable()) {\n    return { ok: false, status: 409, error: 'Card readers are not available yet.' }\n  }\n  const registrationCode = String(input.registrationCode ?? '').trim()\n  if (!/^[A-Za-z0-9-]{3,64}$/.test(registrationCode)) {\n    return { ok: false, status: 400, error: 'Enter the code the reader shows on its screen.' }\n  }\n  const label = String(input.label ?? '').trim().slice(0, 60) || 'Card reader'\n  const registerId = input.registerId ?? ''\n  const host = await firebaseAdmin.app().firestore().collection('hosts').doc(input.hostId).get()\n  const address = input.address\n  const location = await ensurePosTerminalLocation({\n    hostId: input.hostId,\n    orgId: input.orgId,\n    displayName: String(host.get('name') ?? host.get('title') ?? 'Store'),\n    ...(address\n      ? {\n          address: {\n            line1: String(address.line1 ?? '').slice(0, 200),\n            ...(address.line2 ? { line2: String(address.line2).slice(0, 200) } : {}),\n            city: String(address.city ?? '').slice(0, 100),\n            ...(address.state ? { state: String(address.state).slice(0, 100) } : {}),\n            postalCode: String(address.postalCode ?? '').slice(0, 20),\n            country: String(address.country ?? '').toUpperCase().slice(0, 2),\n          },\n        }\n      : {}),\n  })\n  if ('error' in location) return { ok: false, status: location.status, error: location.error }\n  // Not keyed: a registration code is single-use at Stripe, which is the\n  // dedupe — a second press with the same code is refused there, and no\n  // other store can ever register a reader this one already holds.\n  const created = await posStripe('POST', 'terminal/readers', {\n    params: {\n      registration_code: registrationCode,\n      label,\n      location: location.locationId,\n      'metadata[orgId]': input.orgId,\n      'metadata[hostId]': input.hostId,\n      ...(registerId ? { 'metadata[registerId]': registerId } : {}),\n    },\n  })\n  if (!created.ok || !created.body?.id) {\n    return {\n      ok: false,\n      status: 400,\n      error: posStripeErrorMessage(\n        created.body,\n        'That code did not register a reader. Check the code on the reader and try again.',\n      ),\n    }\n  }\n  const reader: PosTerminalReader = {\n    label,\n    ...(registerId ? { registerId } : {}),\n    stripeLocationId: location.locationId,\n    ...(created.body.device_type ? { deviceType: String(created.body.device_type) } : {}),\n    ...(created.body.serial_number ? { serialNumber: String(created.body.serial_number) } : {}),\n    status: String(created.body.status ?? 'offline'),\n    livemode: Boolean(created.body.livemode),\n    createdAtMs: Date.now(),\n    createdBy: input.uid,\n  }\n  const id = String(created.body.id)\n  await readersRef(input.hostId).doc(id).set(reader)\n  await syncCellular(input.hostId, input.orgId)\n  if (reader.serialNumber && parsePosHardwareInPersonConfig(process.env)) {\n    try {\n      await (await import('./pos-hardware-readers')).matchRegisteredPosHardwareReader({\n        hostId: input.hostId,\n        orgId: input.orgId,\n        uid: input.uid,\n        readerId: id,\n        serialNumber: reader.serialNumber,\n      })\n    } catch (error) {\n      console.error('[pos-readers] the hardware order was not matched', id, error)\n    }\n  }\n  return { ok: true, id, reader }\n}\n\nasync function updateReader(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  const reader = await ownedTerminalReader(staff.hostId, body['readerId'])\n  if (!reader) return res.status(404).json({ error: 'That card reader is not on this site.' })\n  const patch: Record<string, unknown> = {}\n  if (typeof body['label'] === 'string') {\n    patch['label'] = body['label'].trim().slice(0, 60) || reader.label\n  }\n  if ('registerId' in body) {\n    const registerId = String(body['registerId'] ?? '')\n    if (registerId && !(await registerExists(staff.hostId, registerId))) {\n      return res.status(404).json({ error: 'Unknown register' })\n    }\n    patch['registerId'] = registerId || firebaseAdmin.firestore.FieldValue.delete()\n  }\n  const updated = await posStripe('POST', `terminal/readers/${reader.id}`, {\n    params: {\n      ...(patch['label'] ? { label: String(patch['label']) } : {}),\n      ...('registerId' in body ? { 'metadata[registerId]': String(body['registerId'] ?? '') } : {}),\n    },\n  })\n  if (!updated.ok) {\n    return res.status(502).json({ error: posStripeErrorMessage(updated.body, 'The reader could not be updated.') })\n  }\n  await readersRef(staff.hostId).doc(reader.id).set(patch, { merge: true })\n  return res.status(200).json({ ok: true })\n}\n\nasync function removeReader(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  const reader = await ownedTerminalReader(staff.hostId, body['readerId'])\n  if (!reader) return res.status(404).json({ error: 'That card reader is not on this site.' })\n  const removed = await posStripe('DELETE', `terminal/readers/${reader.id}`)\n  // Already gone at Stripe is the outcome asked for; anything else is not.\n  if (!removed.ok && removed.status !== 404) {\n    return res.status(502).json({ error: posStripeErrorMessage(removed.body, 'The reader could not be removed.') })\n  }\n  await readersRef(staff.hostId).doc(reader.id).delete()\n  await syncCellular(staff.hostId, staff.orgId)\n  return res.status(200).json({ ok: true })\n}\n\n/**\n * A reader added to or removed from a store with 4G (AGL-4038) starts or\n * stops counting toward its monthly charge. Never fails the reader's own\n * change; the next turn-on, turn-off or reader change heals a miss.\n */\nasync function syncCellular(hostId: string, orgId: string): Promise<void> {\n  try {\n    await (await import('./pos-cellular')).syncPosCellularReaders({ hostId, orgId })\n  } catch (error) {\n    console.error('[pos-readers] the 4G record was not updated', hostId, error)\n  }\n}\n\n/**\n * Removes a register on the server (AGL-3617). The settings card deleted it\n * with a client `deleteDoc`, which the Firestore rules refuse for everyone but\n * staff (`registers` is server-owned since AGL-1775), so a merchant's Remove\n * button failed with a permission error. Removing it here also signs out its\n * customer displays and unbinds its readers.\n */\nasync function removeRegister(\n  staff: PosStaff,\n  body: Record<string, any>,\n  res: Parameters<PluginApiHandler>[1],\n) {\n  const registerId = String(body['registerId'] ?? '')\n  if (!(await registerExists(staff.hostId, registerId))) {\n    return res.status(404).json({ error: 'Unknown register' })\n  }\n  const firestore = firebaseAdmin.app().firestore()\n  const registerRef = firestore\n    .collection('hosts')\n    .doc(staff.hostId)\n    .collection('registers')\n    .doc(registerId)\n  await revokePosDisplays(staff.hostId, registerId)\n  await registerRef.delete()\n  const bound = await readersRef(staff.hostId).where('registerId', '==', registerId).limit(50).get()\n  await Promise.all(\n    bound.docs.map((doc: any) =>\n      doc.ref.set({ registerId: firebaseAdmin.firestore.FieldValue.delete() }, { merge: true }),\n    ),\n  )\n  return res.status(200).json({ ok: true })\n}\n"],"names":["firebaseAdmin","authorizePosStaff","posRequestBody","revokePosDisplays","parsePosHardwareInPersonConfig","parsePosCellularConfig","posCellularView","posStripe","posStripeErrorMessage","posStripeTestMode","posTerminalAvailable","ensurePosTerminalLocation","ownedTerminalReader","refreshPosReaderStatus","posReadersHandler","req","res","body","method","status","json","error","hostId","String","action","gate","undefined","staff","listReaders","registerReader","updateReader","removeReader","removeRegister","answer","setPosStoreCellular","console","cellularFor","terminal","readers","config","process","env","mayTurnOnPosCellular","POS_CELLULAR_BILLING_REFUSAL","turnOnBlocked","uid","cellular","readersRef","app","firestore","collection","doc","refresh","available","snapshot","limit","get","docs","map","id","data","Promise","all","reader","fresh","catch","testMode","locationReady","Boolean","label","registerId","deviceType","serialNumber","livemode","registerExists","test","exists","registered","registerPosTerminalReader","orgId","registrationCode","address","input","host","created","ok","trim","slice","location","displayName","line1","line2","city","state","postalCode","country","toUpperCase","params","registration_code","locationId","stripeLocationId","device_type","serial_number","createdAtMs","Date","now","createdBy","set","syncCellular","matchRegisteredPosHardwareReader","readerId","patch","FieldValue","delete","updated","merge","removed","syncPosCellularReaders","registerRef","bound","where","ref"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AAExD,SAASC,iBAAiB,EAAEC,cAAc,QAAuB,gBAAY;AAC7E,SAASC,iBAAiB,QAAQ,mBAAe;AACjD,SAASC,8BAA8B,QAAQ,2BAAuB;AACtE,SAASC,sBAAsB,EAAEC,eAAe,QAA8B,2BAAuB;AACrG,SAASC,SAAS,EAAEC,qBAAqB,EAAEC,iBAAiB,EAAEC,oBAAoB,QAAQ,kBAAc;AACxG,SACEC,yBAAyB,EACzBC,mBAAmB,EACnBC,sBAAsB,QAGjB,oBAAgB;AAEvB;;;;;;;;CAQC,GACD,OAAO,MAAMC,oBAAsC,OAAOC,KAAKC;QAGvCC,cACAA;IAHtB,IAAIF,IAAIG,MAAM,KAAK,QAAQ,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAqB;IACrF,MAAMJ,OAAOf,eAAea;IAC5B,MAAMO,SAASC,QAAON,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;IACxC,MAAMO,SAASD,QAAON,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;IACxC,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAMQ,OAAO,MAAMxB,kBAAkBc,KAAKO,QAAQE,WAAW,SAASE,YAAY;IAClF,IAAI,WAAWD,MAAM,OAAOT,IAAIG,MAAM,CAACM,KAAKN,MAAM,EAAEC,IAAI,CAAC;QAAEC,OAAOI,KAAKJ,KAAK;IAAC;IAC7E,MAAMM,QAAQF,KAAKE,KAAK;IACxB,IAAI;QACF,OAAQH;YACN,KAAK;gBACH,OAAOR,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC,MAAMQ,YAAYD,OAAOV,IAAI,CAAC,UAAU,KAAK;YAC3E,KAAK;gBACH,OAAO,MAAMY,eAAeF,OAAOV,MAAMD;YAC3C,KAAK;gBACH,OAAO,MAAMc,aAAaH,OAAOV,MAAMD;YACzC,KAAK;gBACH,OAAO,MAAMe,aAAaJ,OAAOV,MAAMD;YACzC,KAAK;gBACH,OAAO,MAAMgB,eAAeL,OAAOV,MAAMD;YAC3C,KAAK;gBAAY;oBACf,mEAAmE;oBACnE,wCAAwC;oBACxC,MAAMiB,SAAS,MAAM,AAAC,CAAA,MAAM,MAAM,CAAC,oBAAgB,EAAGC,mBAAmB,CAACP,OAAOV;oBACjF,OAAOD,IAAIG,MAAM,CAACc,OAAOd,MAAM,EAAEC,IAAI,CAACa,OAAOhB,IAAI;gBACnD;YACA;gBACE,OAAOD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAiB;QAC1D;IACF,EAAE,OAAOA,OAAO;QACdc,QAAQd,KAAK,CAAC,iBAAiBG,QAAQH;QACvC,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;AACF,EAAC;AAED;;;;CAIC,GACD,eAAee,YACbT,KAAe,EACfU,QAA6C,EAC7CC,OAAgD;IAEhD,MAAMC,SAASlC,uBAAuBmC,QAAQC,GAAG;IACjD,IAAI,CAACnC,gBAAgBiC,QAAQF,UAAUC,UAAU,OAAO,CAAC;IACzD,MAAM,EAAEI,oBAAoB,EAAEC,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC;IAC5E,MAAMC,gBAAgB,AAAC,MAAMF,qBAAqBf,MAAMkB,GAAG,EAAElB,MAAML,MAAM,IAAK,OAAOqB;IACrF,MAAMG,WAAWxC,gBAAgBiC,QAAQF,UAAUC,SAAS;QAAEM;IAAc;IAC5E,OAAOE,WAAW;QAAEA;IAAS,IAAI,CAAC;AACpC;AAEA,SAASC,WAAWzB,MAAc;IAChC,OAAOtB,cAAcgD,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAAC7B,QAAQ4B,UAAU,CAAC;AACpF;AAEA,eAAetB,YAAYD,KAAe,EAAEyB,OAAgB;IAC1D,MAAMC,YAAY3C;IAClB,MAAM4C,WAAW,MAAMP,WAAWpB,MAAML,MAAM,EAAEiC,KAAK,CAAC,IAAIC,GAAG;IAC7D,MAAMlB,UAAUgB,SAASG,IAAI,CAACC,GAAG,CAAC,CAACP,MAAc;YAC/CQ,IAAIR,IAAIQ,EAAE;WACNR,IAAIS,IAAI;IAEd,IAAIP,aAAaD,SAAS;QACxB,MAAMS,QAAQC,GAAG,CACfxB,QAAQoB,GAAG,CAAC,OAAOK;YACjB,MAAMC,QAAQ,MAAMnD,uBAAuBc,MAAML,MAAM,EAAEyC,OAAOJ,EAAE,EAAEM,KAAK,CAAC,IAAM;YAChF,IAAID,OAAOD,OAAO5C,MAAM,GAAG6C,MAAM7C,MAAM;QACzC;IAEJ;IACA,MAAMoB,SAAS,MAAMvC,cAClBgD,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACxB,MAAML,MAAM,EAChB4B,UAAU,CAAC,YACXC,GAAG,CAAC,UACJK,GAAG;IACN,OAAO;QACLH;QACAa,UAAUzD;QACV0D,eAAeC,QAAQ7B,OAAOiB,GAAG,CAAC;OAG9BH,YAAY,MAAMjB,YAAYT,OAAOY,OAAOqB,IAAI,IAAItB,WAAW,CAAC;QACpEA,SAASA,QAAQoB,GAAG,CAAC,CAACK;gBAGRA,oBACAA,oBACEA,sBACNA;mBAN4D;gBACpEJ,IAAII,OAAOJ,EAAE;gBACbU,OAAON,OAAOM,KAAK;gBACnBC,UAAU,GAAEP,qBAAAA,OAAOO,UAAU,YAAjBP,qBAAqB;gBACjCQ,UAAU,GAAER,qBAAAA,OAAOQ,UAAU,YAAjBR,qBAAqB;gBACjCS,YAAY,GAAET,uBAAAA,OAAOS,YAAY,YAAnBT,uBAAuB;gBACrC5C,MAAM,GAAE4C,iBAAAA,OAAO5C,MAAM,YAAb4C,iBAAiB;gBACzBU,UAAUV,OAAOU,QAAQ;YAC3B;;;AAEJ;AAEA,eAAeC,eAAepD,MAAc,EAAEgD,UAAkB;IAC9D,IAAI,CAAC,yBAAyBK,IAAI,CAACL,aAAa,OAAO;IACvD,OAAO,AACL,CAAA,MAAMtE,cACHgD,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAC7B,QACJ4B,UAAU,CAAC,aACXC,GAAG,CAACmB,YACJd,GAAG,EAAC,EACPoB,MAAM;AACV;AAEA,eAAe/C,eACbF,KAAe,EACfV,IAAyB,EACzBD,GAAoC;QAEVC;IAA1B,MAAMqD,aAAa/C,QAAON,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB;IAChD,IAAIqD,cAAc,CAAE,MAAMI,eAAe/C,MAAML,MAAM,EAAEgD,aAAc;QACnE,OAAOtD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmB;IAC1D;IACA,MAAMwD,aAAa,MAAMC,0BAA0B;QACjDxD,QAAQK,MAAML,MAAM;QACpByD,OAAOpD,MAAMoD,KAAK;QAClBlC,KAAKlB,MAAMkB,GAAG;QACdmC,kBAAkB/D,IAAI,CAAC,mBAAmB;QAC1CoD,OAAOpD,IAAI,CAAC,QAAQ;OAChBqD,aAAa;QAAEA;IAAW,IAAI,CAAC,GAC/BrD,IAAI,CAAC,UAAU,GAAG;QAAEgE,SAAShE,IAAI,CAAC,UAAU;IAAuB,IAAI,CAAC;IAE9E,IAAI,WAAW4D,YAAY,OAAO7D,IAAIG,MAAM,CAAC0D,WAAW1D,MAAM,EAAEC,IAAI,CAAC;QAAEC,OAAOwD,WAAWxD,KAAK;IAAC;IAC/F,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAE2C,QAAQ;YAAEJ,IAAIkB,WAAWlB,EAAE;WAAKkB,WAAWd,MAAM;IAAG;AACpF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAee,0BAA0BI,KAQ/C;QAMiCA,yBAIXA,cACFA,mBAMGC,MAAAA,WAIEF,gBAEDA,eAEMA,qBACHA,kBAmCTG;QAhBGA;IA1CpB,IAAI,CAAC1E,wBAAwB;QAC3B,OAAO;YAAE2E,IAAI;YAAOlE,QAAQ;YAAKE,OAAO;QAAsC;IAChF;IACA,MAAM2D,mBAAmBzD,QAAO2D,0BAAAA,MAAMF,gBAAgB,YAAtBE,0BAA0B,IAAII,IAAI;IAClE,IAAI,CAAC,uBAAuBX,IAAI,CAACK,mBAAmB;QAClD,OAAO;YAAEK,IAAI;YAAOlE,QAAQ;YAAKE,OAAO;QAAiD;IAC3F;IACA,MAAMgD,QAAQ9C,QAAO2D,eAAAA,MAAMb,KAAK,YAAXa,eAAe,IAAII,IAAI,GAAGC,KAAK,CAAC,GAAG,OAAO;IAC/D,MAAMjB,cAAaY,oBAAAA,MAAMZ,UAAU,YAAhBY,oBAAoB;IACvC,MAAMC,OAAO,MAAMnF,cAAcgD,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAAC+B,MAAM5D,MAAM,EAAEkC,GAAG;IAC5F,MAAMyB,UAAUC,MAAMD,OAAO;IAC7B,MAAMO,WAAW,MAAM7E,0BAA0B;QAC/CW,QAAQ4D,MAAM5D,MAAM;QACpByD,OAAOG,MAAMH,KAAK;QAClBU,aAAalE,QAAO4D,QAAAA,YAAAA,KAAK3B,GAAG,CAAC,mBAAT2B,YAAoBA,KAAK3B,GAAG,CAAC,oBAA7B2B,OAAyC;OACzDF,UACA;QACEA,SAAS;YACPS,OAAOnE,QAAO0D,iBAAAA,QAAQS,KAAK,YAAbT,iBAAiB,IAAIM,KAAK,CAAC,GAAG;WACxCN,QAAQU,KAAK,GAAG;YAAEA,OAAOpE,OAAO0D,QAAQU,KAAK,EAAEJ,KAAK,CAAC,GAAG;QAAK,IAAI,CAAC;YACtEK,MAAMrE,QAAO0D,gBAAAA,QAAQW,IAAI,YAAZX,gBAAgB,IAAIM,KAAK,CAAC,GAAG;WACtCN,QAAQY,KAAK,GAAG;YAAEA,OAAOtE,OAAO0D,QAAQY,KAAK,EAAEN,KAAK,CAAC,GAAG;QAAK,IAAI,CAAC;YACtEO,YAAYvE,QAAO0D,sBAAAA,QAAQa,UAAU,YAAlBb,sBAAsB,IAAIM,KAAK,CAAC,GAAG;YACtDQ,SAASxE,QAAO0D,mBAAAA,QAAQc,OAAO,YAAfd,mBAAmB,IAAIe,WAAW,GAAGT,KAAK,CAAC,GAAG;;IAElE,IACA,CAAC;IAEP,IAAI,WAAWC,UAAU,OAAO;QAAEH,IAAI;QAAOlE,QAAQqE,SAASrE,MAAM;QAAEE,OAAOmE,SAASnE,KAAK;IAAC;IAC5F,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,MAAM+D,UAAU,MAAM7E,UAAU,QAAQ,oBAAoB;QAC1D0F,QAAQ;YACNC,mBAAmBlB;YACnBX;YACAmB,UAAUA,SAASW,UAAU;YAC7B,mBAAmBjB,MAAMH,KAAK;YAC9B,oBAAoBG,MAAM5D,MAAM;WAC5BgD,aAAa;YAAE,wBAAwBA;QAAW,IAAI,CAAC;IAE/D;IACA,IAAI,CAACc,QAAQC,EAAE,IAAI,GAACD,gBAAAA,QAAQnE,IAAI,qBAAZmE,cAAczB,EAAE,GAAE;QACpC,OAAO;YACL0B,IAAI;YACJlE,QAAQ;YACRE,OAAOb,sBACL4E,QAAQnE,IAAI,EACZ;QAEJ;IACF;IACA,MAAM8C,SAA4B;QAChCM;OACIC,aAAa;QAAEA;IAAW,IAAI,CAAC;QACnC8B,kBAAkBZ,SAASW,UAAU;OACjCf,QAAQnE,IAAI,CAACoF,WAAW,GAAG;QAAE9B,YAAYhD,OAAO6D,QAAQnE,IAAI,CAACoF,WAAW;IAAE,IAAI,CAAC,GAC/EjB,QAAQnE,IAAI,CAACqF,aAAa,GAAG;QAAE9B,cAAcjD,OAAO6D,QAAQnE,IAAI,CAACqF,aAAa;IAAE,IAAI,CAAC;QACzFnF,QAAQI,QAAO6D,uBAAAA,QAAQnE,IAAI,CAACE,MAAM,YAAnBiE,uBAAuB;QACtCX,UAAUL,QAAQgB,QAAQnE,IAAI,CAACwD,QAAQ;QACvC8B,aAAaC,KAAKC,GAAG;QACrBC,WAAWxB,MAAMrC,GAAG;;IAEtB,MAAMc,KAAKpC,OAAO6D,QAAQnE,IAAI,CAAC0C,EAAE;IACjC,MAAMZ,WAAWmC,MAAM5D,MAAM,EAAE6B,GAAG,CAACQ,IAAIgD,GAAG,CAAC5C;IAC3C,MAAM6C,aAAa1B,MAAM5D,MAAM,EAAE4D,MAAMH,KAAK;IAC5C,IAAIhB,OAAOS,YAAY,IAAIpE,+BAA+BoC,QAAQC,GAAG,GAAG;QACtE,IAAI;YACF,MAAM,AAAC,CAAA,MAAM,MAAM,CAAC,4BAAwB,EAAGoE,gCAAgC,CAAC;gBAC9EvF,QAAQ4D,MAAM5D,MAAM;gBACpByD,OAAOG,MAAMH,KAAK;gBAClBlC,KAAKqC,MAAMrC,GAAG;gBACdiE,UAAUnD;gBACVa,cAAcT,OAAOS,YAAY;YACnC;QACF,EAAE,OAAOnD,OAAO;YACdc,QAAQd,KAAK,CAAC,oDAAoDsC,IAAItC;QACxE;IACF;IACA,OAAO;QAAEgE,IAAI;QAAM1B;QAAII;IAAO;AAChC;AAEA,eAAejC,aACbH,KAAe,EACfV,IAAyB,EACzBD,GAAoC;QAkB4BC;IAhBhE,MAAM8C,SAAS,MAAMnD,oBAAoBe,MAAML,MAAM,EAAEL,IAAI,CAAC,WAAW;IACvE,IAAI,CAAC8C,QAAQ,OAAO/C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAwC;IAC1F,MAAM0F,QAAiC,CAAC;IACxC,IAAI,OAAO9F,IAAI,CAAC,QAAQ,KAAK,UAAU;QACrC8F,KAAK,CAAC,QAAQ,GAAG9F,IAAI,CAAC,QAAQ,CAACqE,IAAI,GAAGC,KAAK,CAAC,GAAG,OAAOxB,OAAOM,KAAK;IACpE;IACA,IAAI,gBAAgBpD,MAAM;YACEA;QAA1B,MAAMqD,aAAa/C,QAAON,oBAAAA,IAAI,CAAC,aAAa,YAAlBA,oBAAsB;QAChD,IAAIqD,cAAc,CAAE,MAAMI,eAAe/C,MAAML,MAAM,EAAEgD,aAAc;YACnE,OAAOtD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAmB;QAC1D;QACA0F,KAAK,CAAC,aAAa,GAAGzC,cAActE,cAAciD,SAAS,CAAC+D,UAAU,CAACC,MAAM;IAC/E;IACA,MAAMC,UAAU,MAAM3G,UAAU,QAAQ,CAAC,iBAAiB,EAAEwD,OAAOJ,EAAE,EAAE,EAAE;QACvEsC,QAAQ,aACFc,KAAK,CAAC,QAAQ,GAAG;YAAE1C,OAAO9C,OAAOwF,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,GACtD,gBAAgB9F,OAAO;YAAE,wBAAwBM,QAAON,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB;QAAI,IAAI,CAAC;IAE/F;IACA,IAAI,CAACiG,QAAQ7B,EAAE,EAAE;QACf,OAAOrE,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOb,sBAAsB0G,QAAQjG,IAAI,EAAE;QAAoC;IAC/G;IACA,MAAM8B,WAAWpB,MAAML,MAAM,EAAE6B,GAAG,CAACY,OAAOJ,EAAE,EAAEgD,GAAG,CAACI,OAAO;QAAEI,OAAO;IAAK;IACvE,OAAOnG,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEiE,IAAI;IAAK;AACzC;AAEA,eAAetD,aACbJ,KAAe,EACfV,IAAyB,EACzBD,GAAoC;IAEpC,MAAM+C,SAAS,MAAMnD,oBAAoBe,MAAML,MAAM,EAAEL,IAAI,CAAC,WAAW;IACvE,IAAI,CAAC8C,QAAQ,OAAO/C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAwC;IAC1F,MAAM+F,UAAU,MAAM7G,UAAU,UAAU,CAAC,iBAAiB,EAAEwD,OAAOJ,EAAE,EAAE;IACzE,yEAAyE;IACzE,IAAI,CAACyD,QAAQ/B,EAAE,IAAI+B,QAAQjG,MAAM,KAAK,KAAK;QACzC,OAAOH,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOb,sBAAsB4G,QAAQnG,IAAI,EAAE;QAAoC;IAC/G;IACA,MAAM8B,WAAWpB,MAAML,MAAM,EAAE6B,GAAG,CAACY,OAAOJ,EAAE,EAAEsD,MAAM;IACpD,MAAML,aAAajF,MAAML,MAAM,EAAEK,MAAMoD,KAAK;IAC5C,OAAO/D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEiE,IAAI;IAAK;AACzC;AAEA;;;;CAIC,GACD,eAAeuB,aAAatF,MAAc,EAAEyD,KAAa;IACvD,IAAI;QACF,MAAM,AAAC,CAAA,MAAM,MAAM,CAAC,oBAAgB,EAAGsC,sBAAsB,CAAC;YAAE/F;YAAQyD;QAAM;IAChF,EAAE,OAAO1D,OAAO;QACdc,QAAQd,KAAK,CAAC,+CAA+CC,QAAQD;IACvE;AACF;AAEA;;;;;;CAMC,GACD,eAAeW,eACbL,KAAe,EACfV,IAAyB,EACzBD,GAAoC;QAEVC;IAA1B,MAAMqD,aAAa/C,QAAON,mBAAAA,IAAI,CAAC,aAAa,YAAlBA,mBAAsB;IAChD,IAAI,CAAE,MAAMyD,eAAe/C,MAAML,MAAM,EAAEgD,aAAc;QACrD,OAAOtD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmB;IAC1D;IACA,MAAM4B,YAAYjD,cAAcgD,GAAG,GAAGC,SAAS;IAC/C,MAAMqE,cAAcrE,UACjBC,UAAU,CAAC,SACXC,GAAG,CAACxB,MAAML,MAAM,EAChB4B,UAAU,CAAC,aACXC,GAAG,CAACmB;IACP,MAAMnE,kBAAkBwB,MAAML,MAAM,EAAEgD;IACtC,MAAMgD,YAAYL,MAAM;IACxB,MAAMM,QAAQ,MAAMxE,WAAWpB,MAAML,MAAM,EAAEkG,KAAK,CAAC,cAAc,MAAMlD,YAAYf,KAAK,CAAC,IAAIC,GAAG;IAChG,MAAMK,QAAQC,GAAG,CACfyD,MAAM9D,IAAI,CAACC,GAAG,CAAC,CAACP,MACdA,IAAIsE,GAAG,CAACd,GAAG,CAAC;YAAErC,YAAYtE,cAAciD,SAAS,CAAC+D,UAAU,CAACC,MAAM;QAAG,GAAG;YAAEE,OAAO;QAAK;IAG3F,OAAOnG,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEiE,IAAI;IAAK;AACzC"}

package/src/lib/server/pos-return.d.ts

@@ -34,6 +34,16 @@ export interface PosReturnSideEffects {
     lineIndexes: number[];
     /** The lines this return finished taking back in full. */
     fullLineIndexes: number[];
+    /**
+     * Each line taken back, with its units and its share of the refund, for
+     * whatever follows a line in particular — a card reader sold in person,
+     * whose hardware order is told (AGL-4038).
+     */
+    lines?: Array<{
+        index: number;
+        quantity: number;
+        refundCents: number;
+    }>;
 }
 export interface PosReturnDeps extends PosOpsDeps {
     /** What every refund tells the rest of the workspace, after the money moved. Never throws. */

package/src/lib/server/pos-return.js

@@ -29,10 +29,12 @@ import { notifyOrderBuyer } from "./order-notifications.js";
 import { decidePosRefundAuthority } from "./pos-refund-authority.js";
 import { authorizePosOps, defaultPosOpsDeps, posOpsBody, posOpsCleanId, posOpsIdempotencyKey, readPosRegister, isPosManager, resolvePosCashier } from "./pos-ops-gate.js";
 import { createStripeRefund } from "./stripe-refund.js";
+import { parsePosHardwareInPersonConfig } from "../model/pos-hardware.js";
 export function defaultPosReturnDeps() {
     const base = defaultPosOpsDeps();
     return _extends({}, base, {
         afterRefund: async (input)=>{
+            var _input_lines, _parsePosHardwareInPersonConfig;
             const settle = async (label, work)=>{
                 try {
                     await work();
@@ -102,6 +104,22 @@ export function defaultPosReturnDeps() {
                     }
                 });
             });
+            // A card reader the platform's own store sold in person (AGL-4038):
+            // its hardware order and retained sale record take the return too.
+            // Answered from the environment for every other store.
+            if (((_input_lines = input.lines) == null ? void 0 : _input_lines.length) && ((_parsePosHardwareInPersonConfig = parsePosHardwareInPersonConfig(process.env)) == null ? void 0 : _parsePosHardwareInPersonConfig.sellerHostId) === input.hostId) {
+                await settle('hardware return', async ()=>{
+                    var _input_lines;
+                    return (await import("./pos-hardware-returns.js")).recordRegisterHardwareReturn({
+                        config: parsePosHardwareInPersonConfig(process.env),
+                        hostId: input.hostId,
+                        registerOrderId: input.orderId,
+                        returnId: input.returnId,
+                        refundCents: input.refundCents,
+                        lines: (_input_lines = input.lines) != null ? _input_lines : []
+                    });
+                });
+            }
             await settle('buyer notice', ()=>notifyOrderBuyer({
                     hostId: input.hostId,
                     orderId: input.orderId
@@ -222,7 +240,9 @@ export async function handlePosReturn(deps, req) {
         }
     };
     const body = posOpsBody(req);
-    const gate = await authorizePosOps(deps, req, body['hostId']);
+    // Finding a sale to take back and refunding it are both the refund key's
+    // (AGL-4047).
+    const gate = await authorizePosOps(deps, req, body['hostId'], 'posRefund');
     if ('error' in gate) return {
         status: gate.status,
         body: {
@@ -726,6 +746,11 @@ export async function handlePosReturn(deps, req) {
             ],
             lineIndexes: picks.map((pick)=>pick.index),
             fullLineIndexes: reserved.completedLines,
+            lines: lines.map((line)=>({
+                    index: line.index,
+                    quantity: line.quantity,
+                    refundCents: line.refundCents
+                })),
             returnId,
             storeReturn: storeReturn,
             refundIds: results.flatMap((result)=>result.refundId ? [