@aglyn/plugins-commerce 1.0.0-beta.285 → 1.0.0-beta.288

package/src/lib/server/cancel-order.js

@@ -14,7 +14,9 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import * as CommerceModel from "../model/index.js";
+ */ import { holdsCommerceSiteKey } from "./commerce-site-keys.js";
+import { commerceSitePermissionRefusal } from "../model/plugin-permissions.js";
+import * as CommerceModel from "../model/index.js";
 import { firebaseAdmin } from "@aglyn/tenant-data-admin";
 import { notifyOrderBuyer } from "./order-notifications.js";
 import { ORDER_CANCELLED_EVENT } from "../model/order-events.js";
@@ -116,7 +118,6 @@ import { capRestockLines, resolveTrackedRestockLines, saleReleaseCaps } from "./
         });
     }
     try {
-        var _hostSnapshot_get;
         const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
@@ -131,10 +132,11 @@ import { capRestockLines, resolveTrackedRestockLines, saleReleaseCaps } from "./
         // `editor` — narrowing to admin here would take the cancel button away
         // from editors who have always had it, and widening it past what the rules
         // allow would make this endpoint the way around them.
-        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
-        if (memberRole !== 'admin' && memberRole !== 'editor') {
+        // "Manage orders" (`commerce.orders`, AGL-4047), whose preset is the site's Admin
+        // and Editor this asked for, read as the rules would read it.
+        if (!holdsCommerceSiteKey(hostSnapshot, decoded.uid, 'commerce.orders')) {
             return res.status(403).json({
-                error: 'Not permitted'
+                error: commerceSitePermissionRefusal('commerce.orders')
             });
         }
         const orderRef = hostRef.collection('orders').doc(orderId);

package/src/lib/server/cancel-order.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/cancel-order.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { notifyOrderBuyer } from './order-notifications'\nimport { ORDER_CANCELLED_EVENT } from '../model/order-events'\nimport { raiseOrderEvent } from './order-events'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport {\n  capRestockLines,\n  resolveTrackedRestockLines,\n  saleReleaseCaps,\n} from './restock-flag'\n\n/**\n * Cancelling an order RELEASES its stock (AGL-1808) — the opposite of what the\n * reversal doors do, and for a structural reason rather than a preference.\n *\n * AGL-1797 refused to increment on a refund or a chargeback because the goods\n * may well be gone: a refund with no return, or a shopper who kept the item and\n * took the money, leaves stock that incrementing would INVENT. It flags and\n * lets the merchant answer. Cancellation carries no such question, and the\n * guarantee is `ORDER_TRANSITIONS`:\n *\n *     pending: ['paid', 'cancelled'],\n *     paid:    ['partially_fulfilled', 'fulfilled', 'cancelled', 'refunded'],\n *     partially_fulfilled | fulfilled | delivered: no 'cancelled'\n *\n * so a cancelled order was never fulfilled and nothing ever shipped. The units\n * are still on the shelf; the only wrong number is ours.\n *\n * THE GUARANTEE HAD TO BE ENFORCED BEFORE IT COULD BE RELIED ON, and that is\n * why this is a handler rather than a few lines in the console. The transition\n * table said the right thing but nothing consulted it on the way IN: the order\n * dialog cancelled with a client `updateDoc`, and `canTransitionOrder` only\n * decided whether to render the button. The Firestore rules impose no status\n * machine — an order update is allowed to any admin or editor — so a dialog\n * held open while the order shipped in another tab (or any other client) could\n * write `cancelled` straight onto a `fulfilled` order, and an automatic\n * increment behind that would restock goods already in the post. Re-asking the\n * transition INSIDE the transaction that writes the status is what turns the\n * comment into a guarantee, and it is what makes the release safe.\n *\n * `pending` RELEASES NOTHING, which is the other half the issue's premise\n * missed. Stock is decremented when the money lands, not when the order is\n * written: `draft-order.ts` and the POS card path both open a `pending` order\n * and decrement only in the webhook that pays it. Incrementing on a cancelled\n * `pending` order would invent inventory exactly the way AGL-1797 refused to —\n * so only a `paid` order, the one status reachable here whose sale provably\n * decremented, releases anything.\n *\n * ONE LEDGER, NOT A SECOND STOCK WRITER. The increment goes through\n * `adjustVariantInventory` and logs an `InventoryAdjustment` per line, the same\n * pair the sale paths and the products hub's \"Adjust stock\" write, with the new\n * `cancellation` reason and the `orderId`. An increment with no ledger row\n * would leave the hub's stock history unable to explain a count that moved on\n * its own — the mirror of AGL-1797's argument against writing a row for stock\n * that had NOT moved.\n *\n * ONLY WHAT THE SALE DECREMENTED comes back: `resolveTrackedRestockLines`, the\n * helper AGL-1797 already built, applies the sale path's own\n * `variant.inventory != null` test to the products as they stand now. A store\n * that tracks no stock gets a plain cancellation and no adjustment rows.\n *\n * IT FAILS THE CANCEL RATHER THAN LOSING THE RELEASE. `flagOrderRestock`\n * swallows its errors because the money had already moved and the flag was a\n * postscript; here the status flip and the stock write are one act, so they\n * share a transaction and a failure leaves the order uncancelled for the\n * merchant to retry. A cancelled order whose stock never came back is the\n * original bug.\n *\n * ONCE. The transaction's own read is the guard: a second cancel — a retried\n * request, two admins clicking together — finds `cancelled`, which\n * `canTransitionOrder` cannot leave, and returns without touching stock. Two\n * increments of the same units is the failure mode this shape exists to\n * prevent, and it is measured rather than asserted (`cancel-order.spec.ts`).\n *\n * REACHED FROM THE CONSOLE since AGL-1818: `order-detail-dialog`'s\n * `handleCancel` POSTs here with the console id token, and the client\n * `updateDoc` cancel it replaced is gone. (The wiring landed separately from\n * the route because the dialog belonged to a concurrent agent, AGL-1806,\n * when the route was written.)\n */\nexport const cancelOrderHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const orderId = String(body.orderId ?? '')\n  if (!hostId || !orderId) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n  // Firestore reserves `__…__` ids and `.doc()` throws SYNCHRONOUSLY on one,\n  // which would surface as a 500 on a caller's typo rather than the 400 it is.\n  if (/^__.*__$/.test(hostId) || /^__.*__$/.test(orderId)) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // The role the CLIENT write already had, not a stricter one. Order updates\n    // fall through the rules' host catch-all, which admits `admin` and\n    // `editor` — narrowing to admin here would take the cancel button away\n    // from editors who have always had it, and widening it past what the rules\n    // allow would make this endpoint the way around them.\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not permitted' })\n    }\n    const orderRef = hostRef.collection('orders').doc(orderId)\n\n    const outcome = await firestore.runTransaction(async (transaction) => {\n      const snapshot = await transaction.get(orderRef)\n      if (!snapshot.exists) {\n        return { status: 404, body: { error: 'Unknown order' } }\n      }\n      const order = CommerceModel.liftLegacyOrder(\n        (snapshot.data() ?? {}) as never,\n      )\n      // A redelivered click, or the second of two admins. Answered as success\n      // because it IS the state the caller asked for — reporting 409 here\n      // teaches an admin that the cancel failed and invites a third attempt —\n      // but nothing is written, so the units are released exactly once.\n      if (order.status === 'cancelled') {\n        return {\n          status: 200,\n          body: { ok: true, alreadyCancelled: true, released: 0, units: 0 },\n        }\n      }\n      if (!CommerceModel.canTransitionOrder(order.status, 'cancelled')) {\n        return {\n          status: 409,\n          body: { error: `Orders in \"${order.status}\" cannot cancel` },\n        }\n      }\n      // An OPEN register sale that has taken money (AGL-3607) is voided at\n      // the register, which hands each payment back first. Cancelling it here\n      // would mark it cancelled with a card charge, a gift card debit or a\n      // room charge still standing.\n      if (\n        order.status === 'pending' &&\n        CommerceModel.orderPayments(order).some(\n          (payment) => payment.status === 'succeeded' || payment.status === 'pending',\n        ) &&\n        Array.isArray(order.payments)\n      ) {\n        return {\n          status: 409,\n          body: {\n            error:\n              'This register sale has payments on it. Void it at the register, ' +\n              'which hands each payment back first.',\n          },\n        }\n      }\n\n      // A POS CARD order's decrement happens in the webhook that pays it —\n      // and before AGL-1825 it did not happen AT ALL: the paying branch's\n      // decrement was gated on `productId` metadata the register's session\n      // never carried. Releasing such an order restocks units that were never\n      // taken, turning the silent under-count into a silent over-count. The\n      // sale's own ledger is the discriminator: every decrement pairs with a\n      // `reason: 'sale'` row (AGL-1807 closed the last hole, and the AGL-1825\n      // decrement writes them from day one), so a paid card order with no\n      // sale row is one whose sale took nothing — and nothing is released.\n      //\n      // Scoped to card orders (the `pos-card-pending` timeline event) rather\n      // than applied to every order, because one historical path decremented\n      // WITHOUT rows — draft links paid before AGL-1807 — and asking the\n      // ledger to vouch for those would wrongly strand their stock. The\n      // residual is stated plainly: the sibling-shaped decrement/ledger pair\n      // is two swallowed sequential writes, so a card order whose ledger add\n      // alone failed will not release — a bounded under-count on that one\n      // order, visible as a sale missing from the hub's history, against the\n      // alternative of inflating stock on every pre-fix cancel.\n      //\n      // One equality filter, so the automatic single-field index answers it;\n      // the reason test runs here, over the handful of rows one order has.\n      //\n      // THE SAME READ NOW ALSO BOUNDS HOW MUCH COMES BACK (AGL-2149), so it is\n      // no longer scoped to card orders. `adjustVariantInventory` floors at\n      // zero, and that floor silently absorbs the overshoot on a BACKORDER\n      // product: stock 0, `canPurchase` admits the sale because the policy says\n      // to, three units sell, `Math.max(0, 0 + -3)` leaves the count at 0 —\n      // and a `+3` here would hand the merchant three units nobody has and a\n      // stock badge offering them. The sale rows carry `appliedDelta` for\n      // exactly this: `delta` stays the units sold (the merchant's history),\n      // `appliedDelta` says how many the count could actually give up.\n      //\n      // Only lines the ledger DESCRIBES are capped. A pair the ledger says\n      // nothing about restores as before, which is what keeps the pre-AGL-1807\n      // draft links — decremented with no row at all — from having their stock\n      // stranded, and what keeps a single swallowed ledger write from turning\n      // into a lost restock on an unrelated line of the same order.\n      let saleDecremented = true\n      // The cap rule itself lives beside the restock flag, which now bounds\n      // the question it ASKS by the same ledger this bounds the stock it\n      // RETURNS (AGL-2325). One implementation, so a prompt naming more units\n      // than a cancellation would put back is not expressible.\n      let releaseCap: ReadonlyMap<string, number> = new Map<string, number>()\n      if (order.status === 'paid') {\n        const orderAdjustments = await transaction.get(\n          hostRef\n            .collection('inventoryAdjustments')\n            .where('orderId', '==', orderId),\n        )\n        const saleRows = orderAdjustments.docs.filter(\n          (row) => row.get('reason') === 'sale',\n        )\n        if (\n          order.channel === 'pos' &&\n          (order.timeline ?? []).some(\n            (event) => event.event === 'pos-card-pending',\n          )\n        ) {\n          saleDecremented = saleRows.length > 0\n        }\n        releaseCap = saleReleaseCaps(saleRows)\n      }\n\n      // `paid` is the only status reachable here whose sale decremented; see\n      // the header. Reads happen before any write, as a transaction requires.\n      const { lines, products } =\n        order.status === 'paid' && saleDecremented\n          ? await resolveTrackedRestockLines(hostRef, order, (ref) =>\n              transaction.get(ref),\n            )\n          : {\n              lines: [],\n              products: new Map<string, CommerceModel.HostProduct>(),\n            }\n\n      const atMs = Date.now()\n      // Grouped by product, because two lines of one product (two variants, or\n      // the same variant twice) are two deltas against ONE document: writing\n      // them separately would compute both from the same read and land only\n      // the last, silently dropping units.\n      const byProduct = new Map<string, CommerceModel.OrderRestockLine[]>()\n      // Never more than the sale actually took off the shelf (AGL-2149).\n      for (const line of capRestockLines(lines, releaseCap)) {\n        byProduct.set(line.productId, [\n          ...(byProduct.get(line.productId) ?? []),\n          line,\n        ])\n      }\n      for (const [productId, productLines] of byProduct) {\n        const product = products.get(productId)\n        if (!product) continue\n        let variants = product.variants\n        for (const line of productLines) {\n          variants = CommerceModel.adjustVariantInventory(\n            { variants },\n            line.variantId,\n            line.quantity,\n            // The bucket the sale came out of, for a location-tracked store\n            // (AGL-286). Absent on every path that decremented the flat count,\n            // where `adjustVariantInventory` puts it back the same way.\n            order.locationId || undefined,\n          )\n        }\n        // `update()`, not `set(…, { merge: true })` as the sale paths use: the\n        // transaction has just read this product, so it exists, and a product\n        // deleted under us must not be conjured back as a stub holding nothing\n        // but a variants array.\n        transaction.update(hostRef.collection('products').doc(productId), {\n          variants,\n          // The total and the storefront's In stock verdict (AGL-3321).\n          ...CommerceModel.productStockFields({ ...product, variants }),\n          updatedAtMs: atMs,\n        })\n        for (const line of productLines) {\n          transaction.create(hostRef.collection('inventoryAdjustments').doc(), {\n            productId,\n            variantId: line.variantId,\n            delta: line.quantity,\n            reason: 'cancellation',\n            orderId,\n            ...(order.locationId ? { locationId: order.locationId } : {}),\n            atMs,\n          } satisfies CommerceModel.InventoryAdjustment)\n        }\n      }\n\n      // From the CAPPED lines, not the order's, so the timeline reports what\n      // was actually put back (AGL-2149).\n      const releasedLines = [...byProduct.values()].flat()\n      const units = releasedLines.reduce((sum, line) => sum + line.quantity, 0)\n      const patch: Record<string, unknown> = {\n        status: 'cancelled',\n        // What a shipping tool's feed asks to learn of the cancel (AGL-3613).\n        updatedAtMs: atMs,\n        timeline: CommerceModel.appendOrderEvent(\n          order,\n          'cancelled',\n          units > 0\n            ? `${units} ${units === 1 ? 'unit' : 'units'} returned to stock`\n            : undefined,\n          atMs,\n        ),\n      }\n      // An open restock question about THIS order's stock, raised by a partial\n      // refund before the cancellation (AGL-1797). The units it asked about are\n      // the ones just put back, so leaving it open would invite the merchant to\n      // restock them a second time from the order dialog — the double-count\n      // that flag exists to avoid. Answered with what actually happened.\n      if (units > 0 && order.restockCheck && !order.restockCheck.resolution) {\n        patch.restockCheck = {\n          ...order.restockCheck,\n          resolution: 'restocked',\n          resolvedAtMs: atMs,\n          resolvedBy: decoded.uid,\n        } satisfies CommerceModel.OrderRestockCheck\n      }\n      transaction.update(orderRef, patch)\n      return {\n        status: 200,\n        body: { ok: true, released: releasedLines.length, units },\n        // The live Stripe page this cancellation orphans, if any (AGL-2244).\n        // Read inside the transaction that flips the status so the expiry\n        // below cannot act on an order some other writer paid meanwhile.\n        expireSessionId:\n          order.status === 'pending' ? (order.checkoutSessionId ?? '') : '',\n      }\n    })\n    // EXPIRE THE PAYMENT LINK (AGL-2244). Cancelling a `pending` draft order or\n    // POS card sale left its Checkout Session live: the URL is on the\n    // customer's phone or in the email the merchant sent, and Stripe keeps it\n    // payable for 24 hours. Paying it captured real money on the merchant's\n    // account and the completing webhook then discarded the event — its\n    // `status !== 'pending'` guard cannot tell a redelivery from a cancelled\n    // order — so the sale existed in Stripe and nowhere in the product: no\n    // order, no stock move, no contact, no notification, not even a timeline\n    // line. The webhook now says so when it happens; this is the half that\n    // stops it happening.\n    //\n    // OUTSIDE the transaction, because it is a network call, and best-effort\n    // by design: the cancellation itself already landed and is what the\n    // merchant asked for. A failure here leaves the pre-existing behaviour\n    // (a payable link) plus the webhook's new record of it, which is strictly\n    // better than failing a cancel that has already released stock. Stripe\n    // answers 400 for a session that is already expired or already paid, and\n    // both are states this has nothing to add to.\n    const expireSessionId = (outcome as { expireSessionId?: string })\n      .expireSessionId\n    if (expireSessionId && process.env.STRIPE_SECRET_KEY) {\n      const expiry = await fetch(\n        `https://api.stripe.com/v1/checkout/sessions/${expireSessionId}/expire`,\n        {\n          method: 'POST',\n          headers: {\n            Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n            'Content-Type': 'application/x-www-form-urlencoded',\n          },\n        },\n      ).catch(() => null)\n      if (!expiry?.ok) {\n        console.error(\n          'Cancelled order: Stripe session not expired, the payment link may still be payable',\n          { hostId, orderId, sessionId: expireSessionId },\n        )\n      }\n    }\n    // The buyer is told (AGL-3610) — only by the request that cancelled it.\n    if (outcome.status === 200 && !(outcome.body as { alreadyCancelled?: boolean }).alreadyCancelled) {\n      await notifyOrderBuyer({ hostId, orderId }, 'cancelled')\n      await raiseOrderEvent(ORDER_CANCELLED_EVENT, { hostId, orderId, key: 'cancelled' })\n    }\n    return res.status(outcome.status).json(outcome.body)\n  } catch (error) {\n    // Nothing landed — the transaction is all-or-nothing — so the order is\n    // still open and the merchant can try again. Deliberately NOT the swallow\n    // `flagOrderRestock` uses: there the money had already moved and only a\n    // postscript was at risk; here a swallowed failure is a cancelled order\n    // whose stock never came back, which is the bug this closes.\n    console.error('cancelOrder failed', error)\n    return res.status(500).json({ error: 'Cancel failed' })\n  }\n}\n"],"names":["CommerceModel","firebaseAdmin","notifyOrderBuyer","ORDER_CANCELLED_EVENT","raiseOrderEvent","capRestockLines","resolveTrackedRestockLines","saleReleaseCaps","cancelOrderHandler","req","res","body","method","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","orderId","test","hostSnapshot","decoded","app","auth","verifyIdToken","firestore","hostRef","collection","doc","get","exists","memberRole","uid","orderRef","outcome","runTransaction","transaction","snapshot","order","liftLegacyOrder","data","ok","alreadyCancelled","released","units","canTransitionOrder","orderPayments","some","payment","Array","isArray","payments","saleDecremented","releaseCap","Map","orderAdjustments","where","saleRows","docs","filter","row","channel","timeline","event","lines","products","ref","atMs","Date","now","byProduct","line","set","productId","productLines","product","variants","adjustVariantInventory","variantId","quantity","locationId","update","productStockFields","updatedAtMs","create","delta","reason","releasedLines","values","flat","reduce","sum","patch","appendOrderEvent","restockCheck","resolution","resolvedAtMs","resolvedBy","expireSessionId","checkoutSessionId","process","env","STRIPE_SECRET_KEY","expiry","fetch","Authorization","catch","console","sessionId","key"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,mBAAmB,oBAAU;AACzC,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,gBAAgB,QAAQ,2BAAuB;AACxD,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,eAAe,QAAQ,oBAAgB;AAEhD,SACEC,eAAe,EACfC,0BAA0B,EAC1BC,eAAe,QACV,oBAAgB;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEC,GACD,OAAO,MAAMC,qBAAuC,OAAOC,KAAKC;QAIjCD,4BAM4BA,WACnCE,cACCA;IAXvB,IAAIF,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,gBAAgBC,QAAOR,6BAAAA,IAAIS,OAAO,CAACF,aAAa,YAAzBP,6BAA6B;IAC1D,MAAMU,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMJ,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWa,KAAKC,KAAK,CAAChB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMiB,SAAST,QAAON,eAAAA,KAAKe,MAAM,YAAXf,eAAe;IACrC,MAAMgB,UAAUV,QAAON,gBAAAA,KAAKgB,OAAO,YAAZhB,gBAAgB;IACvC,IAAI,CAACe,UAAU,CAACC,SAAS;QACvB,OAAOjB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B;IACnE;IACA,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,WAAWa,IAAI,CAACF,WAAW,WAAWE,IAAI,CAACD,UAAU;QACvD,OAAOjB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B;IACnE;IAEA,IAAI;YAakBc;QAZpB,MAAMC,UAAU,MAAM7B,cAAc8B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACd;QAC/D,MAAMe,YAAYjC,cAAc8B,GAAG,GAAGG,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACX;QAClD,MAAMG,eAAe,MAAMM,QAAQG,GAAG;QACtC,IAAI,CAACT,aAAaU,MAAM,EAAE;YACxB,OAAO7B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,2EAA2E;QAC3E,mEAAmE;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,sDAAsD;QACtD,MAAMyB,aAAa,EAACX,oBAAAA,aAAaS,GAAG,CAAC,0BAAjBT,oBAAmC,CAAC,EAAE,CAACC,QAAQW,GAAG,CAAC;QACvE,IAAID,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAO9B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QACA,MAAM2B,WAAWP,QAAQC,UAAU,CAAC,UAAUC,GAAG,CAACV;QAElD,MAAMgB,UAAU,MAAMT,UAAUU,cAAc,CAAC,OAAOC;gBAMjDC,gBA4M+BC;YAjNlC,MAAMD,WAAW,MAAMD,YAAYP,GAAG,CAACI;YACvC,IAAI,CAACI,SAASP,MAAM,EAAE;gBACpB,OAAO;oBAAE1B,QAAQ;oBAAKF,MAAM;wBAAEI,OAAO;oBAAgB;gBAAE;YACzD;YACA,MAAMgC,QAAQ/C,cAAcgD,eAAe,EACxCF,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,CAAC;YAEvB,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,kEAAkE;YAClE,IAAIC,MAAMlC,MAAM,KAAK,aAAa;gBAChC,OAAO;oBACLA,QAAQ;oBACRF,MAAM;wBAAEuC,IAAI;wBAAMC,kBAAkB;wBAAMC,UAAU;wBAAGC,OAAO;oBAAE;gBAClE;YACF;YACA,IAAI,CAACrD,cAAcsD,kBAAkB,CAACP,MAAMlC,MAAM,EAAE,cAAc;gBAChE,OAAO;oBACLA,QAAQ;oBACRF,MAAM;wBAAEI,OAAO,CAAC,WAAW,EAAEgC,MAAMlC,MAAM,CAAC,eAAe,CAAC;oBAAC;gBAC7D;YACF;YACA,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,8BAA8B;YAC9B,IACEkC,MAAMlC,MAAM,KAAK,aACjBb,cAAcuD,aAAa,CAACR,OAAOS,IAAI,CACrC,CAACC,UAAYA,QAAQ5C,MAAM,KAAK,eAAe4C,QAAQ5C,MAAM,KAAK,cAEpE6C,MAAMC,OAAO,CAACZ,MAAMa,QAAQ,GAC5B;gBACA,OAAO;oBACL/C,QAAQ;oBACRF,MAAM;wBACJI,OACE,qEACA;oBACJ;gBACF;YACF;YAEA,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,0DAA0D;YAC1D,EAAE;YACF,uEAAuE;YACvE,qEAAqE;YACrE,EAAE;YACF,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,qEAAqE;YACrE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,8DAA8D;YAC9D,IAAI8C,kBAAkB;YACtB,sEAAsE;YACtE,mEAAmE;YACnE,wEAAwE;YACxE,yDAAyD;YACzD,IAAIC,aAA0C,IAAIC;YAClD,IAAIhB,MAAMlC,MAAM,KAAK,QAAQ;oBAWxBkC;gBAVH,MAAMiB,mBAAmB,MAAMnB,YAAYP,GAAG,CAC5CH,QACGC,UAAU,CAAC,wBACX6B,KAAK,CAAC,WAAW,MAAMtC;gBAE5B,MAAMuC,WAAWF,iBAAiBG,IAAI,CAACC,MAAM,CAC3C,CAACC,MAAQA,IAAI/B,GAAG,CAAC,cAAc;gBAEjC,IACES,MAAMuB,OAAO,KAAK,SAClB,EAACvB,kBAAAA,MAAMwB,QAAQ,YAAdxB,kBAAkB,EAAE,EAAES,IAAI,CACzB,CAACgB,QAAUA,MAAMA,KAAK,KAAK,qBAE7B;oBACAX,kBAAkBK,SAAS5C,MAAM,GAAG;gBACtC;gBACAwC,aAAavD,gBAAgB2D;YAC/B;YAEA,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,EAAEO,KAAK,EAAEC,QAAQ,EAAE,GACvB3B,MAAMlC,MAAM,KAAK,UAAUgD,kBACvB,MAAMvD,2BAA2B6B,SAASY,OAAO,CAAC4B,MAChD9B,YAAYP,GAAG,CAACqC,QAElB;gBACEF,OAAO,EAAE;gBACTC,UAAU,IAAIX;YAChB;YAEN,MAAMa,OAAOC,KAAKC,GAAG;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,qCAAqC;YACrC,MAAMC,YAAY,IAAIhB;YACtB,mEAAmE;YACnE,KAAK,MAAMiB,QAAQ3E,gBAAgBoE,OAAOX,YAAa;oBAE/CiB;gBADNA,UAAUE,GAAG,CAACD,KAAKE,SAAS,EAAE;wBACxBH,iBAAAA,UAAUzC,GAAG,CAAC0C,KAAKE,SAAS,aAA5BH,iBAAiC,EAAE;oBACvCC;iBACD;YACH;YACA,KAAK,MAAM,CAACE,WAAWC,aAAa,IAAIJ,UAAW;gBACjD,MAAMK,UAAUV,SAASpC,GAAG,CAAC4C;gBAC7B,IAAI,CAACE,SAAS;gBACd,IAAIC,WAAWD,QAAQC,QAAQ;gBAC/B,KAAK,MAAML,QAAQG,aAAc;oBAC/BE,WAAWrF,cAAcsF,sBAAsB,CAC7C;wBAAED;oBAAS,GACXL,KAAKO,SAAS,EACdP,KAAKQ,QAAQ,EACb,gEAAgE;oBAChE,mEAAmE;oBACnE,4DAA4D;oBAC5DzC,MAAM0C,UAAU,IAAIlE;gBAExB;gBACA,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,wBAAwB;gBACxBsB,YAAY6C,MAAM,CAACvD,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAAC6C,YAAY;oBAChEG;mBAEGrF,cAAc2F,kBAAkB,CAAC,aAAKP;oBAASC;;oBAClDO,aAAahB;;gBAEf,KAAK,MAAMI,QAAQG,aAAc;oBAC/BtC,YAAYgD,MAAM,CAAC1D,QAAQC,UAAU,CAAC,wBAAwBC,GAAG,IAAI;wBACnE6C;wBACAK,WAAWP,KAAKO,SAAS;wBACzBO,OAAOd,KAAKQ,QAAQ;wBACpBO,QAAQ;wBACRpE;uBACIoB,MAAM0C,UAAU,GAAG;wBAAEA,YAAY1C,MAAM0C,UAAU;oBAAC,IAAI,CAAC;wBAC3Db;;gBAEJ;YACF;YAEA,uEAAuE;YACvE,oCAAoC;YACpC,MAAMoB,gBAAgB;mBAAIjB,UAAUkB,MAAM;aAAG,CAACC,IAAI;YAClD,MAAM7C,QAAQ2C,cAAcG,MAAM,CAAC,CAACC,KAAKpB,OAASoB,MAAMpB,KAAKQ,QAAQ,EAAE;YACvE,MAAMa,QAAiC;gBACrCxF,QAAQ;gBACR,sEAAsE;gBACtE+E,aAAahB;gBACbL,UAAUvE,cAAcsG,gBAAgB,CACtCvD,OACA,aACAM,QAAQ,IACJ,GAAGA,MAAM,CAAC,EAAEA,UAAU,IAAI,SAAS,QAAQ,kBAAkB,CAAC,GAC9D9B,WACJqD;YAEJ;YACA,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,mEAAmE;YACnE,IAAIvB,QAAQ,KAAKN,MAAMwD,YAAY,IAAI,CAACxD,MAAMwD,YAAY,CAACC,UAAU,EAAE;gBACrEH,MAAME,YAAY,GAAG,aAChBxD,MAAMwD,YAAY;oBACrBC,YAAY;oBACZC,cAAc7B;oBACd8B,YAAY5E,QAAQW,GAAG;;YAE3B;YACAI,YAAY6C,MAAM,CAAChD,UAAU2D;YAC7B,OAAO;gBACLxF,QAAQ;gBACRF,MAAM;oBAAEuC,IAAI;oBAAME,UAAU4C,cAAc1E,MAAM;oBAAE+B;gBAAM;gBACxD,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjEsD,iBACE5D,MAAMlC,MAAM,KAAK,aAAakC,2BAAAA,MAAM6D,iBAAiB,YAAvB7D,2BAA2B,KAAM;YACnE;QACF;QACA,4EAA4E;QAC5E,kEAAkE;QAClE,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,sBAAsB;QACtB,EAAE;QACF,yEAAyE;QACzE,oEAAoE;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM4D,kBAAkB,AAAChE,QACtBgE,eAAe;QAClB,IAAIA,mBAAmBE,QAAQC,GAAG,CAACC,iBAAiB,EAAE;YACpD,MAAMC,SAAS,MAAMC,MACnB,CAAC,4CAA4C,EAAEN,gBAAgB,OAAO,CAAC,EACvE;gBACE/F,QAAQ;gBACRM,SAAS;oBACPgG,eAAe,CAAC,OAAO,EAAEL,QAAQC,GAAG,CAACC,iBAAiB,EAAE;oBACxD,gBAAgB;gBAClB;YACF,GACAI,KAAK,CAAC,IAAM;YACd,IAAI,EAACH,0BAAAA,OAAQ9D,EAAE,GAAE;gBACfkE,QAAQrG,KAAK,CACX,sFACA;oBAAEW;oBAAQC;oBAAS0F,WAAWV;gBAAgB;YAElD;QACF;QACA,wEAAwE;QACxE,IAAIhE,QAAQ9B,MAAM,KAAK,OAAO,CAAC,AAAC8B,QAAQhC,IAAI,CAAoCwC,gBAAgB,EAAE;YAChG,MAAMjD,iBAAiB;gBAAEwB;gBAAQC;YAAQ,GAAG;YAC5C,MAAMvB,gBAAgBD,uBAAuB;gBAAEuB;gBAAQC;gBAAS2F,KAAK;YAAY;QACnF;QACA,OAAO5G,IAAIG,MAAM,CAAC8B,QAAQ9B,MAAM,EAAEC,IAAI,CAAC6B,QAAQhC,IAAI;IACrD,EAAE,OAAOI,OAAO;QACd,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,6DAA6D;QAC7DqG,QAAQrG,KAAK,CAAC,sBAAsBA;QACpC,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/cancel-order.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { holdsCommerceSiteKey } from './commerce-site-keys'\nimport { commerceSitePermissionRefusal } from '../model/plugin-permissions'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { notifyOrderBuyer } from './order-notifications'\nimport { ORDER_CANCELLED_EVENT } from '../model/order-events'\nimport { raiseOrderEvent } from './order-events'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport {\n  capRestockLines,\n  resolveTrackedRestockLines,\n  saleReleaseCaps,\n} from './restock-flag'\n\n/**\n * Cancelling an order RELEASES its stock (AGL-1808) — the opposite of what the\n * reversal doors do, and for a structural reason rather than a preference.\n *\n * AGL-1797 refused to increment on a refund or a chargeback because the goods\n * may well be gone: a refund with no return, or a shopper who kept the item and\n * took the money, leaves stock that incrementing would INVENT. It flags and\n * lets the merchant answer. Cancellation carries no such question, and the\n * guarantee is `ORDER_TRANSITIONS`:\n *\n *     pending: ['paid', 'cancelled'],\n *     paid:    ['partially_fulfilled', 'fulfilled', 'cancelled', 'refunded'],\n *     partially_fulfilled | fulfilled | delivered: no 'cancelled'\n *\n * so a cancelled order was never fulfilled and nothing ever shipped. The units\n * are still on the shelf; the only wrong number is ours.\n *\n * THE GUARANTEE HAD TO BE ENFORCED BEFORE IT COULD BE RELIED ON, and that is\n * why this is a handler rather than a few lines in the console. The transition\n * table said the right thing but nothing consulted it on the way IN: the order\n * dialog cancelled with a client `updateDoc`, and `canTransitionOrder` only\n * decided whether to render the button. The Firestore rules impose no status\n * machine — an order update is allowed to any admin or editor — so a dialog\n * held open while the order shipped in another tab (or any other client) could\n * write `cancelled` straight onto a `fulfilled` order, and an automatic\n * increment behind that would restock goods already in the post. Re-asking the\n * transition INSIDE the transaction that writes the status is what turns the\n * comment into a guarantee, and it is what makes the release safe.\n *\n * `pending` RELEASES NOTHING, which is the other half the issue's premise\n * missed. Stock is decremented when the money lands, not when the order is\n * written: `draft-order.ts` and the POS card path both open a `pending` order\n * and decrement only in the webhook that pays it. Incrementing on a cancelled\n * `pending` order would invent inventory exactly the way AGL-1797 refused to —\n * so only a `paid` order, the one status reachable here whose sale provably\n * decremented, releases anything.\n *\n * ONE LEDGER, NOT A SECOND STOCK WRITER. The increment goes through\n * `adjustVariantInventory` and logs an `InventoryAdjustment` per line, the same\n * pair the sale paths and the products hub's \"Adjust stock\" write, with the new\n * `cancellation` reason and the `orderId`. An increment with no ledger row\n * would leave the hub's stock history unable to explain a count that moved on\n * its own — the mirror of AGL-1797's argument against writing a row for stock\n * that had NOT moved.\n *\n * ONLY WHAT THE SALE DECREMENTED comes back: `resolveTrackedRestockLines`, the\n * helper AGL-1797 already built, applies the sale path's own\n * `variant.inventory != null` test to the products as they stand now. A store\n * that tracks no stock gets a plain cancellation and no adjustment rows.\n *\n * IT FAILS THE CANCEL RATHER THAN LOSING THE RELEASE. `flagOrderRestock`\n * swallows its errors because the money had already moved and the flag was a\n * postscript; here the status flip and the stock write are one act, so they\n * share a transaction and a failure leaves the order uncancelled for the\n * merchant to retry. A cancelled order whose stock never came back is the\n * original bug.\n *\n * ONCE. The transaction's own read is the guard: a second cancel — a retried\n * request, two admins clicking together — finds `cancelled`, which\n * `canTransitionOrder` cannot leave, and returns without touching stock. Two\n * increments of the same units is the failure mode this shape exists to\n * prevent, and it is measured rather than asserted (`cancel-order.spec.ts`).\n *\n * REACHED FROM THE CONSOLE since AGL-1818: `order-detail-dialog`'s\n * `handleCancel` POSTs here with the console id token, and the client\n * `updateDoc` cancel it replaced is gone. (The wiring landed separately from\n * the route because the dialog belonged to a concurrent agent, AGL-1806,\n * when the route was written.)\n */\nexport const cancelOrderHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const body =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '')\n  const orderId = String(body.orderId ?? '')\n  if (!hostId || !orderId) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n  // Firestore reserves `__…__` ids and `.doc()` throws SYNCHRONOUSLY on one,\n  // which would surface as a 500 on a caller's typo rather than the 400 it is.\n  if (/^__.*__$/.test(hostId) || /^__.*__$/.test(orderId)) {\n    return res.status(400).json({ error: 'Missing hostId or orderId' })\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // The role the CLIENT write already had, not a stricter one. Order updates\n    // fall through the rules' host catch-all, which admits `admin` and\n    // `editor` — narrowing to admin here would take the cancel button away\n    // from editors who have always had it, and widening it past what the rules\n    // allow would make this endpoint the way around them.\n    // \"Manage orders\" (`commerce.orders`, AGL-4047), whose preset is the site's Admin\n    // and Editor this asked for, read as the rules would read it.\n    if (!holdsCommerceSiteKey(hostSnapshot, decoded.uid, 'commerce.orders')) {\n      return res.status(403).json({ error: commerceSitePermissionRefusal('commerce.orders') })\n    }\n    const orderRef = hostRef.collection('orders').doc(orderId)\n\n    const outcome = await firestore.runTransaction(async (transaction) => {\n      const snapshot = await transaction.get(orderRef)\n      if (!snapshot.exists) {\n        return { status: 404, body: { error: 'Unknown order' } }\n      }\n      const order = CommerceModel.liftLegacyOrder(\n        (snapshot.data() ?? {}) as never,\n      )\n      // A redelivered click, or the second of two admins. Answered as success\n      // because it IS the state the caller asked for — reporting 409 here\n      // teaches an admin that the cancel failed and invites a third attempt —\n      // but nothing is written, so the units are released exactly once.\n      if (order.status === 'cancelled') {\n        return {\n          status: 200,\n          body: { ok: true, alreadyCancelled: true, released: 0, units: 0 },\n        }\n      }\n      if (!CommerceModel.canTransitionOrder(order.status, 'cancelled')) {\n        return {\n          status: 409,\n          body: { error: `Orders in \"${order.status}\" cannot cancel` },\n        }\n      }\n      // An OPEN register sale that has taken money (AGL-3607) is voided at\n      // the register, which hands each payment back first. Cancelling it here\n      // would mark it cancelled with a card charge, a gift card debit or a\n      // room charge still standing.\n      if (\n        order.status === 'pending' &&\n        CommerceModel.orderPayments(order).some(\n          (payment) => payment.status === 'succeeded' || payment.status === 'pending',\n        ) &&\n        Array.isArray(order.payments)\n      ) {\n        return {\n          status: 409,\n          body: {\n            error:\n              'This register sale has payments on it. Void it at the register, ' +\n              'which hands each payment back first.',\n          },\n        }\n      }\n\n      // A POS CARD order's decrement happens in the webhook that pays it —\n      // and before AGL-1825 it did not happen AT ALL: the paying branch's\n      // decrement was gated on `productId` metadata the register's session\n      // never carried. Releasing such an order restocks units that were never\n      // taken, turning the silent under-count into a silent over-count. The\n      // sale's own ledger is the discriminator: every decrement pairs with a\n      // `reason: 'sale'` row (AGL-1807 closed the last hole, and the AGL-1825\n      // decrement writes them from day one), so a paid card order with no\n      // sale row is one whose sale took nothing — and nothing is released.\n      //\n      // Scoped to card orders (the `pos-card-pending` timeline event) rather\n      // than applied to every order, because one historical path decremented\n      // WITHOUT rows — draft links paid before AGL-1807 — and asking the\n      // ledger to vouch for those would wrongly strand their stock. The\n      // residual is stated plainly: the sibling-shaped decrement/ledger pair\n      // is two swallowed sequential writes, so a card order whose ledger add\n      // alone failed will not release — a bounded under-count on that one\n      // order, visible as a sale missing from the hub's history, against the\n      // alternative of inflating stock on every pre-fix cancel.\n      //\n      // One equality filter, so the automatic single-field index answers it;\n      // the reason test runs here, over the handful of rows one order has.\n      //\n      // THE SAME READ NOW ALSO BOUNDS HOW MUCH COMES BACK (AGL-2149), so it is\n      // no longer scoped to card orders. `adjustVariantInventory` floors at\n      // zero, and that floor silently absorbs the overshoot on a BACKORDER\n      // product: stock 0, `canPurchase` admits the sale because the policy says\n      // to, three units sell, `Math.max(0, 0 + -3)` leaves the count at 0 —\n      // and a `+3` here would hand the merchant three units nobody has and a\n      // stock badge offering them. The sale rows carry `appliedDelta` for\n      // exactly this: `delta` stays the units sold (the merchant's history),\n      // `appliedDelta` says how many the count could actually give up.\n      //\n      // Only lines the ledger DESCRIBES are capped. A pair the ledger says\n      // nothing about restores as before, which is what keeps the pre-AGL-1807\n      // draft links — decremented with no row at all — from having their stock\n      // stranded, and what keeps a single swallowed ledger write from turning\n      // into a lost restock on an unrelated line of the same order.\n      let saleDecremented = true\n      // The cap rule itself lives beside the restock flag, which now bounds\n      // the question it ASKS by the same ledger this bounds the stock it\n      // RETURNS (AGL-2325). One implementation, so a prompt naming more units\n      // than a cancellation would put back is not expressible.\n      let releaseCap: ReadonlyMap<string, number> = new Map<string, number>()\n      if (order.status === 'paid') {\n        const orderAdjustments = await transaction.get(\n          hostRef\n            .collection('inventoryAdjustments')\n            .where('orderId', '==', orderId),\n        )\n        const saleRows = orderAdjustments.docs.filter(\n          (row) => row.get('reason') === 'sale',\n        )\n        if (\n          order.channel === 'pos' &&\n          (order.timeline ?? []).some(\n            (event) => event.event === 'pos-card-pending',\n          )\n        ) {\n          saleDecremented = saleRows.length > 0\n        }\n        releaseCap = saleReleaseCaps(saleRows)\n      }\n\n      // `paid` is the only status reachable here whose sale decremented; see\n      // the header. Reads happen before any write, as a transaction requires.\n      const { lines, products } =\n        order.status === 'paid' && saleDecremented\n          ? await resolveTrackedRestockLines(hostRef, order, (ref) =>\n              transaction.get(ref),\n            )\n          : {\n              lines: [],\n              products: new Map<string, CommerceModel.HostProduct>(),\n            }\n\n      const atMs = Date.now()\n      // Grouped by product, because two lines of one product (two variants, or\n      // the same variant twice) are two deltas against ONE document: writing\n      // them separately would compute both from the same read and land only\n      // the last, silently dropping units.\n      const byProduct = new Map<string, CommerceModel.OrderRestockLine[]>()\n      // Never more than the sale actually took off the shelf (AGL-2149).\n      for (const line of capRestockLines(lines, releaseCap)) {\n        byProduct.set(line.productId, [\n          ...(byProduct.get(line.productId) ?? []),\n          line,\n        ])\n      }\n      for (const [productId, productLines] of byProduct) {\n        const product = products.get(productId)\n        if (!product) continue\n        let variants = product.variants\n        for (const line of productLines) {\n          variants = CommerceModel.adjustVariantInventory(\n            { variants },\n            line.variantId,\n            line.quantity,\n            // The bucket the sale came out of, for a location-tracked store\n            // (AGL-286). Absent on every path that decremented the flat count,\n            // where `adjustVariantInventory` puts it back the same way.\n            order.locationId || undefined,\n          )\n        }\n        // `update()`, not `set(…, { merge: true })` as the sale paths use: the\n        // transaction has just read this product, so it exists, and a product\n        // deleted under us must not be conjured back as a stub holding nothing\n        // but a variants array.\n        transaction.update(hostRef.collection('products').doc(productId), {\n          variants,\n          // The total and the storefront's In stock verdict (AGL-3321).\n          ...CommerceModel.productStockFields({ ...product, variants }),\n          updatedAtMs: atMs,\n        })\n        for (const line of productLines) {\n          transaction.create(hostRef.collection('inventoryAdjustments').doc(), {\n            productId,\n            variantId: line.variantId,\n            delta: line.quantity,\n            reason: 'cancellation',\n            orderId,\n            ...(order.locationId ? { locationId: order.locationId } : {}),\n            atMs,\n          } satisfies CommerceModel.InventoryAdjustment)\n        }\n      }\n\n      // From the CAPPED lines, not the order's, so the timeline reports what\n      // was actually put back (AGL-2149).\n      const releasedLines = [...byProduct.values()].flat()\n      const units = releasedLines.reduce((sum, line) => sum + line.quantity, 0)\n      const patch: Record<string, unknown> = {\n        status: 'cancelled',\n        // What a shipping tool's feed asks to learn of the cancel (AGL-3613).\n        updatedAtMs: atMs,\n        timeline: CommerceModel.appendOrderEvent(\n          order,\n          'cancelled',\n          units > 0\n            ? `${units} ${units === 1 ? 'unit' : 'units'} returned to stock`\n            : undefined,\n          atMs,\n        ),\n      }\n      // An open restock question about THIS order's stock, raised by a partial\n      // refund before the cancellation (AGL-1797). The units it asked about are\n      // the ones just put back, so leaving it open would invite the merchant to\n      // restock them a second time from the order dialog — the double-count\n      // that flag exists to avoid. Answered with what actually happened.\n      if (units > 0 && order.restockCheck && !order.restockCheck.resolution) {\n        patch.restockCheck = {\n          ...order.restockCheck,\n          resolution: 'restocked',\n          resolvedAtMs: atMs,\n          resolvedBy: decoded.uid,\n        } satisfies CommerceModel.OrderRestockCheck\n      }\n      transaction.update(orderRef, patch)\n      return {\n        status: 200,\n        body: { ok: true, released: releasedLines.length, units },\n        // The live Stripe page this cancellation orphans, if any (AGL-2244).\n        // Read inside the transaction that flips the status so the expiry\n        // below cannot act on an order some other writer paid meanwhile.\n        expireSessionId:\n          order.status === 'pending' ? (order.checkoutSessionId ?? '') : '',\n      }\n    })\n    // EXPIRE THE PAYMENT LINK (AGL-2244). Cancelling a `pending` draft order or\n    // POS card sale left its Checkout Session live: the URL is on the\n    // customer's phone or in the email the merchant sent, and Stripe keeps it\n    // payable for 24 hours. Paying it captured real money on the merchant's\n    // account and the completing webhook then discarded the event — its\n    // `status !== 'pending'` guard cannot tell a redelivery from a cancelled\n    // order — so the sale existed in Stripe and nowhere in the product: no\n    // order, no stock move, no contact, no notification, not even a timeline\n    // line. The webhook now says so when it happens; this is the half that\n    // stops it happening.\n    //\n    // OUTSIDE the transaction, because it is a network call, and best-effort\n    // by design: the cancellation itself already landed and is what the\n    // merchant asked for. A failure here leaves the pre-existing behaviour\n    // (a payable link) plus the webhook's new record of it, which is strictly\n    // better than failing a cancel that has already released stock. Stripe\n    // answers 400 for a session that is already expired or already paid, and\n    // both are states this has nothing to add to.\n    const expireSessionId = (outcome as { expireSessionId?: string })\n      .expireSessionId\n    if (expireSessionId && process.env.STRIPE_SECRET_KEY) {\n      const expiry = await fetch(\n        `https://api.stripe.com/v1/checkout/sessions/${expireSessionId}/expire`,\n        {\n          method: 'POST',\n          headers: {\n            Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n            'Content-Type': 'application/x-www-form-urlencoded',\n          },\n        },\n      ).catch(() => null)\n      if (!expiry?.ok) {\n        console.error(\n          'Cancelled order: Stripe session not expired, the payment link may still be payable',\n          { hostId, orderId, sessionId: expireSessionId },\n        )\n      }\n    }\n    // The buyer is told (AGL-3610) — only by the request that cancelled it.\n    if (outcome.status === 200 && !(outcome.body as { alreadyCancelled?: boolean }).alreadyCancelled) {\n      await notifyOrderBuyer({ hostId, orderId }, 'cancelled')\n      await raiseOrderEvent(ORDER_CANCELLED_EVENT, { hostId, orderId, key: 'cancelled' })\n    }\n    return res.status(outcome.status).json(outcome.body)\n  } catch (error) {\n    // Nothing landed — the transaction is all-or-nothing — so the order is\n    // still open and the merchant can try again. Deliberately NOT the swallow\n    // `flagOrderRestock` uses: there the money had already moved and only a\n    // postscript was at risk; here a swallowed failure is a cancelled order\n    // whose stock never came back, which is the bug this closes.\n    console.error('cancelOrder failed', error)\n    return res.status(500).json({ error: 'Cancel failed' })\n  }\n}\n"],"names":["holdsCommerceSiteKey","commerceSitePermissionRefusal","CommerceModel","firebaseAdmin","notifyOrderBuyer","ORDER_CANCELLED_EVENT","raiseOrderEvent","capRestockLines","resolveTrackedRestockLines","saleReleaseCaps","cancelOrderHandler","req","res","body","method","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","orderId","test","decoded","app","auth","verifyIdToken","firestore","hostRef","collection","doc","hostSnapshot","get","exists","uid","orderRef","outcome","runTransaction","transaction","snapshot","order","liftLegacyOrder","data","ok","alreadyCancelled","released","units","canTransitionOrder","orderPayments","some","payment","Array","isArray","payments","saleDecremented","releaseCap","Map","orderAdjustments","where","saleRows","docs","filter","row","channel","timeline","event","lines","products","ref","atMs","Date","now","byProduct","line","set","productId","productLines","product","variants","adjustVariantInventory","variantId","quantity","locationId","update","productStockFields","updatedAtMs","create","delta","reason","releasedLines","values","flat","reduce","sum","patch","appendOrderEvent","restockCheck","resolution","resolvedAtMs","resolvedBy","expireSessionId","checkoutSessionId","process","env","STRIPE_SECRET_KEY","expiry","fetch","Authorization","catch","console","sessionId","key"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,oBAAoB,QAAQ,0BAAsB;AAC3D,SAASC,6BAA6B,QAAQ,iCAA6B;AAC3E,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,gBAAgB,QAAQ,2BAAuB;AACxD,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,eAAe,QAAQ,oBAAgB;AAEhD,SACEC,eAAe,EACfC,0BAA0B,EAC1BC,eAAe,QACV,oBAAgB;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEC,GACD,OAAO,MAAMC,qBAAuC,OAAOC,KAAKC;QAIjCD,4BAM4BA,WACnCE,cACCA;IAXvB,IAAIF,IAAIG,MAAM,KAAK,QAAQ;QACzB,OAAOF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,gBAAgBC,QAAOR,6BAAAA,IAAIS,OAAO,CAACF,aAAa,YAAzBP,6BAA6B;IAC1D,MAAMU,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMJ,OACJ,OAAOF,IAAIE,IAAI,KAAK,WAAWa,KAAKC,KAAK,CAAChB,IAAIE,IAAI,KAAKF,YAAAA,IAAIE,IAAI,YAARF,YAAY,CAAC;IACtE,MAAMiB,SAAST,QAAON,eAAAA,KAAKe,MAAM,YAAXf,eAAe;IACrC,MAAMgB,UAAUV,QAAON,gBAAAA,KAAKgB,OAAO,YAAZhB,gBAAgB;IACvC,IAAI,CAACe,UAAU,CAACC,SAAS;QACvB,OAAOjB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B;IACnE;IACA,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,WAAWa,IAAI,CAACF,WAAW,WAAWE,IAAI,CAACD,UAAU;QACvD,OAAOjB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B;IACnE;IAEA,IAAI;QACF,MAAMc,UAAU,MAAM5B,cAAc6B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACb;QAC/D,MAAMc,YAAYhC,cAAc6B,GAAG,GAAGG,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACV;QAClD,MAAMW,eAAe,MAAMH,QAAQI,GAAG;QACtC,IAAI,CAACD,aAAaE,MAAM,EAAE;YACxB,OAAO7B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,2EAA2E;QAC3E,mEAAmE;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,sDAAsD;QACtD,kFAAkF;QAClF,8DAA8D;QAC9D,IAAI,CAACjB,qBAAqBuC,cAAcR,QAAQW,GAAG,EAAE,oBAAoB;YACvE,OAAO9B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOhB,8BAA8B;YAAmB;QACxF;QACA,MAAM0C,WAAWP,QAAQC,UAAU,CAAC,UAAUC,GAAG,CAACT;QAElD,MAAMe,UAAU,MAAMT,UAAUU,cAAc,CAAC,OAAOC;gBAMjDC,gBA4M+BC;YAjNlC,MAAMD,WAAW,MAAMD,YAAYN,GAAG,CAACG;YACvC,IAAI,CAACI,SAASN,MAAM,EAAE;gBACpB,OAAO;oBAAE1B,QAAQ;oBAAKF,MAAM;wBAAEI,OAAO;oBAAgB;gBAAE;YACzD;YACA,MAAM+B,QAAQ9C,cAAc+C,eAAe,EACxCF,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,CAAC;YAEvB,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,kEAAkE;YAClE,IAAIC,MAAMjC,MAAM,KAAK,aAAa;gBAChC,OAAO;oBACLA,QAAQ;oBACRF,MAAM;wBAAEsC,IAAI;wBAAMC,kBAAkB;wBAAMC,UAAU;wBAAGC,OAAO;oBAAE;gBAClE;YACF;YACA,IAAI,CAACpD,cAAcqD,kBAAkB,CAACP,MAAMjC,MAAM,EAAE,cAAc;gBAChE,OAAO;oBACLA,QAAQ;oBACRF,MAAM;wBAAEI,OAAO,CAAC,WAAW,EAAE+B,MAAMjC,MAAM,CAAC,eAAe,CAAC;oBAAC;gBAC7D;YACF;YACA,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,8BAA8B;YAC9B,IACEiC,MAAMjC,MAAM,KAAK,aACjBb,cAAcsD,aAAa,CAACR,OAAOS,IAAI,CACrC,CAACC,UAAYA,QAAQ3C,MAAM,KAAK,eAAe2C,QAAQ3C,MAAM,KAAK,cAEpE4C,MAAMC,OAAO,CAACZ,MAAMa,QAAQ,GAC5B;gBACA,OAAO;oBACL9C,QAAQ;oBACRF,MAAM;wBACJI,OACE,qEACA;oBACJ;gBACF;YACF;YAEA,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,0DAA0D;YAC1D,EAAE;YACF,uEAAuE;YACvE,qEAAqE;YACrE,EAAE;YACF,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,qEAAqE;YACrE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,8DAA8D;YAC9D,IAAI6C,kBAAkB;YACtB,sEAAsE;YACtE,mEAAmE;YACnE,wEAAwE;YACxE,yDAAyD;YACzD,IAAIC,aAA0C,IAAIC;YAClD,IAAIhB,MAAMjC,MAAM,KAAK,QAAQ;oBAWxBiC;gBAVH,MAAMiB,mBAAmB,MAAMnB,YAAYN,GAAG,CAC5CJ,QACGC,UAAU,CAAC,wBACX6B,KAAK,CAAC,WAAW,MAAMrC;gBAE5B,MAAMsC,WAAWF,iBAAiBG,IAAI,CAACC,MAAM,CAC3C,CAACC,MAAQA,IAAI9B,GAAG,CAAC,cAAc;gBAEjC,IACEQ,MAAMuB,OAAO,KAAK,SAClB,EAACvB,kBAAAA,MAAMwB,QAAQ,YAAdxB,kBAAkB,EAAE,EAAES,IAAI,CACzB,CAACgB,QAAUA,MAAMA,KAAK,KAAK,qBAE7B;oBACAX,kBAAkBK,SAAS3C,MAAM,GAAG;gBACtC;gBACAuC,aAAatD,gBAAgB0D;YAC/B;YAEA,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,EAAEO,KAAK,EAAEC,QAAQ,EAAE,GACvB3B,MAAMjC,MAAM,KAAK,UAAU+C,kBACvB,MAAMtD,2BAA2B4B,SAASY,OAAO,CAAC4B,MAChD9B,YAAYN,GAAG,CAACoC,QAElB;gBACEF,OAAO,EAAE;gBACTC,UAAU,IAAIX;YAChB;YAEN,MAAMa,OAAOC,KAAKC,GAAG;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,qCAAqC;YACrC,MAAMC,YAAY,IAAIhB;YACtB,mEAAmE;YACnE,KAAK,MAAMiB,QAAQ1E,gBAAgBmE,OAAOX,YAAa;oBAE/CiB;gBADNA,UAAUE,GAAG,CAACD,KAAKE,SAAS,EAAE;wBACxBH,iBAAAA,UAAUxC,GAAG,CAACyC,KAAKE,SAAS,aAA5BH,iBAAiC,EAAE;oBACvCC;iBACD;YACH;YACA,KAAK,MAAM,CAACE,WAAWC,aAAa,IAAIJ,UAAW;gBACjD,MAAMK,UAAUV,SAASnC,GAAG,CAAC2C;gBAC7B,IAAI,CAACE,SAAS;gBACd,IAAIC,WAAWD,QAAQC,QAAQ;gBAC/B,KAAK,MAAML,QAAQG,aAAc;oBAC/BE,WAAWpF,cAAcqF,sBAAsB,CAC7C;wBAAED;oBAAS,GACXL,KAAKO,SAAS,EACdP,KAAKQ,QAAQ,EACb,gEAAgE;oBAChE,mEAAmE;oBACnE,4DAA4D;oBAC5DzC,MAAM0C,UAAU,IAAIjE;gBAExB;gBACA,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,wBAAwB;gBACxBqB,YAAY6C,MAAM,CAACvD,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAAC6C,YAAY;oBAChEG;mBAEGpF,cAAc0F,kBAAkB,CAAC,aAAKP;oBAASC;;oBAClDO,aAAahB;;gBAEf,KAAK,MAAMI,QAAQG,aAAc;oBAC/BtC,YAAYgD,MAAM,CAAC1D,QAAQC,UAAU,CAAC,wBAAwBC,GAAG,IAAI;wBACnE6C;wBACAK,WAAWP,KAAKO,SAAS;wBACzBO,OAAOd,KAAKQ,QAAQ;wBACpBO,QAAQ;wBACRnE;uBACImB,MAAM0C,UAAU,GAAG;wBAAEA,YAAY1C,MAAM0C,UAAU;oBAAC,IAAI,CAAC;wBAC3Db;;gBAEJ;YACF;YAEA,uEAAuE;YACvE,oCAAoC;YACpC,MAAMoB,gBAAgB;mBAAIjB,UAAUkB,MAAM;aAAG,CAACC,IAAI;YAClD,MAAM7C,QAAQ2C,cAAcG,MAAM,CAAC,CAACC,KAAKpB,OAASoB,MAAMpB,KAAKQ,QAAQ,EAAE;YACvE,MAAMa,QAAiC;gBACrCvF,QAAQ;gBACR,sEAAsE;gBACtE8E,aAAahB;gBACbL,UAAUtE,cAAcqG,gBAAgB,CACtCvD,OACA,aACAM,QAAQ,IACJ,GAAGA,MAAM,CAAC,EAAEA,UAAU,IAAI,SAAS,QAAQ,kBAAkB,CAAC,GAC9D7B,WACJoD;YAEJ;YACA,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,mEAAmE;YACnE,IAAIvB,QAAQ,KAAKN,MAAMwD,YAAY,IAAI,CAACxD,MAAMwD,YAAY,CAACC,UAAU,EAAE;gBACrEH,MAAME,YAAY,GAAG,aAChBxD,MAAMwD,YAAY;oBACrBC,YAAY;oBACZC,cAAc7B;oBACd8B,YAAY5E,QAAQW,GAAG;;YAE3B;YACAI,YAAY6C,MAAM,CAAChD,UAAU2D;YAC7B,OAAO;gBACLvF,QAAQ;gBACRF,MAAM;oBAAEsC,IAAI;oBAAME,UAAU4C,cAAczE,MAAM;oBAAE8B;gBAAM;gBACxD,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjEsD,iBACE5D,MAAMjC,MAAM,KAAK,aAAaiC,2BAAAA,MAAM6D,iBAAiB,YAAvB7D,2BAA2B,KAAM;YACnE;QACF;QACA,4EAA4E;QAC5E,kEAAkE;QAClE,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,sBAAsB;QACtB,EAAE;QACF,yEAAyE;QACzE,oEAAoE;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM4D,kBAAkB,AAAChE,QACtBgE,eAAe;QAClB,IAAIA,mBAAmBE,QAAQC,GAAG,CAACC,iBAAiB,EAAE;YACpD,MAAMC,SAAS,MAAMC,MACnB,CAAC,4CAA4C,EAAEN,gBAAgB,OAAO,CAAC,EACvE;gBACE9F,QAAQ;gBACRM,SAAS;oBACP+F,eAAe,CAAC,OAAO,EAAEL,QAAQC,GAAG,CAACC,iBAAiB,EAAE;oBACxD,gBAAgB;gBAClB;YACF,GACAI,KAAK,CAAC,IAAM;YACd,IAAI,EAACH,0BAAAA,OAAQ9D,EAAE,GAAE;gBACfkE,QAAQpG,KAAK,CACX,sFACA;oBAAEW;oBAAQC;oBAASyF,WAAWV;gBAAgB;YAElD;QACF;QACA,wEAAwE;QACxE,IAAIhE,QAAQ7B,MAAM,KAAK,OAAO,CAAC,AAAC6B,QAAQ/B,IAAI,CAAoCuC,gBAAgB,EAAE;YAChG,MAAMhD,iBAAiB;gBAAEwB;gBAAQC;YAAQ,GAAG;YAC5C,MAAMvB,gBAAgBD,uBAAuB;gBAAEuB;gBAAQC;gBAAS0F,KAAK;YAAY;QACnF;QACA,OAAO3G,IAAIG,MAAM,CAAC6B,QAAQ7B,MAAM,EAAEC,IAAI,CAAC4B,QAAQ/B,IAAI;IACrD,EAAE,OAAOI,OAAO;QACd,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,6DAA6D;QAC7DoG,QAAQpG,KAAK,CAAC,sBAAsBA;QACpC,OAAOL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC"}

package/src/lib/server/cart-checkout.js

@@ -26,6 +26,7 @@ import { merchantAccountIsReady } from "@aglyn/tenant-data-admin/server/payment-
 import { checkoutSessionCardAuthenticationParams } from "@aglyn/tenant-data-admin/server/stripe-card-authentication";
 import { CARRIER_POSTAL_CODE_MESSAGE, planCheckoutShippingWithCarriers } from "./carrier-shipping.js";
 import { readCartId } from "./cart-cookie.js";
+import { readStoreDay } from "./store-day.js";
 import { resolveManualTaxRateId } from "./manual-tax-rate.js";
 import { allocateCentsByWeight, engineLineTaxPercentages, taxEngineSessionMetadata } from "../model/commerce-tax-engine.js";
 import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
@@ -104,8 +105,8 @@ import { boundedCreditCents, checkoutCreditProviderForCode, encodeCheckoutCredit
         if (held) await held.release();
     };
     try {
-        var _cartSnapshot_data, _ref1, _ref2, _storeSettings_get, _storeSettings_get1, _req_headers_referer, _req_headers_host, _ref3, _ref4, _session_id;
-        var _ownerOrg_org, _ownerOrg_org1, _ownerOrg_org2, _engineTax_quote;
+        var _cartSnapshot_data, _ownerOrg_org, _ref1, _ref2, _storeSettings_get, _storeSettings_get1, _req_headers_referer, _req_headers_host, _ref3, _ref4, _session_id;
+        var _ownerOrg_org1, _ownerOrg_org2, _ownerOrg_org3, _engineTax_quote;
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
         const cartSnapshot = await hostRef.collection('carts').doc(cartId).get();
@@ -118,7 +119,7 @@ import { boundedCreditCents, checkoutCreditProviderForCode, encodeCheckoutCredit
             });
         }
         const ownerOrg = await getOrgForHost(hostId);
-        const ownerId = ownerOrg == null ? void 0 : (_ownerOrg_org = ownerOrg.org) == null ? void 0 : _ownerOrg_org.ownerUid;
+        const ownerId = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.ownerUid;
         if (!ownerId) {
             return res.status(409).json({
                 error: 'This site cannot sell yet'
@@ -188,15 +189,20 @@ import { boundedCreditCents, checkoutCreditProviderForCode, encodeCheckoutCredit
         const params = new URLSearchParams(_extends({
             mode: 'payment'
         }, checkoutSessionCardAuthenticationParams('payment')));
+        // The store's today, for the use days lines carry (AGL-4043): a pass
+        // for a day that has passed since it went in the cart is not sold.
+        const storeDay = cart.lines.some((line)=>line.useDayKey) ? await readStoreDay(hostRef, {
+            org: (_ownerOrg_org = ownerOrg.org) != null ? _ownerOrg_org : null
+        }) : null;
         cart.lines.forEach((line, index)=>{
-            var _product_type, _variant_id, _variant_sku, _variant_weightGrams, _product_type1, _product_type2, _variant_options, _variant_options1;
+            var _ref, _product_type, _variant_id, _variant_sku, _variant_weightGrams, _product_type1, _product_type2, _variant_options, _variant_options1;
             const product = productsById.get(line.productId);
             // Sold in person only (AGL-4060) is not for sale here, whatever the
             // cart was holding when the switch went off.
             if (!product || !CommerceModel.productListedOnline(product)) {
-                var _ref;
+                var _ref1;
                 throw Object.assign(new Error('unavailable'), {
-                    visible: `"${(_ref = product == null ? void 0 : product.name) != null ? _ref : 'A product'}" is no longer available`
+                    visible: `"${(_ref1 = product == null ? void 0 : product.name) != null ? _ref1 : 'A product'}" is no longer available`
                 });
             }
             const variant = line.variantId ? product.variants.find((item)=>item.id === line.variantId) : product.variants[0];
@@ -212,6 +218,12 @@ import { boundedCreditCents, checkoutCreditProviderForCode, encodeCheckoutCredit
                     visible: `"${product.name}" is not available`
                 });
             }
+            const useDayProblem = !line.useDayKey ? null : !CommerceModel.productAsksUseDate(product, variant.id) ? 'It has no day to choose.' : CommerceModel.checkInUseDayProblem(line.useDayKey, (_ref = storeDay == null ? void 0 : storeDay.todayKey) != null ? _ref : '');
+            if (useDayProblem) {
+                throw Object.assign(new Error('unavailable'), {
+                    visible: `"${product.name}": ${useDayProblem} Remove it and add it again with a new day.`
+                });
+            }
             // Gift cards are a Business+ entitlement, checked per sale (AGL-470).
             if (product.giftCard && !Aglyn.checkEntitlement(ownerOrg.org, 'giftCards')) {
                 throw Object.assign(new Error('unavailable'), {
@@ -511,7 +523,7 @@ import { boundedCreditCents, checkoutCreditProviderForCode, encodeCheckoutCredit
         const claimed = await claimAttempt(firestore, {
             kind: 'commerce-cart',
             scopeId: `${hostId}:${cartId}`,
-            orgId: String((_ref2 = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.id) != null ? _ref2 : ''),
+            orgId: String((_ref2 = ownerOrg == null ? void 0 : (_ownerOrg_org2 = ownerOrg.org) == null ? void 0 : _ownerOrg_org2.id) != null ? _ref2 : ''),
             key: idempotencyKey,
             busyMessage: 'This checkout is already being processed'
         });
@@ -1274,7 +1286,7 @@ import { boundedCreditCents, checkoutCreditProviderForCode, encodeCheckoutCredit
         // and is identical on both checkout paths. This swaps the redirect's URL
         // pair for `ui_mode` + `return_url` and stops. Off unless the flag is on for
         // this org AND a publishable key exists; see `resolveNativeCheckoutMode`.
-        const nativeMode = await resolveNativeCheckoutMode(String((_ref3 = ownerOrg == null ? void 0 : (_ownerOrg_org2 = ownerOrg.org) == null ? void 0 : _ownerOrg_org2.id) != null ? _ref3 : ''));
+        const nativeMode = await resolveNativeCheckoutMode(String((_ref3 = ownerOrg == null ? void 0 : (_ownerOrg_org3 = ownerOrg.org) == null ? void 0 : _ownerOrg_org3.id) != null ? _ref3 : ''));
         if (nativeMode.native) {
             applyNativeCheckoutParams(params, `${backUrl}${separator}order=success&session_id={CHECKOUT_SESSION_ID}`);
         }