@aglyn/plugins-commerce 1.0.0-beta.285 → 1.0.0-beta.288

package/src/lib/server/pos-ops-gate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-ops-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport type { PluginApiRequest } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost, getPluginConfig } from '@aglyn/tenant-data-admin'\nimport { findUserByUidAcrossPools } from '@aglyn/tenant-data-admin/server/auth-pools'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { createHmac, timingSafeEqual } from 'crypto'\nimport {\n  POS_CASHIER_ASSERTION_TTL_MS,\n  POS_MANAGER_ASSERTION_TTL_MS,\n} from '../model/commerce-pos-ops'\nimport type { PrintReport } from '../model/commerce-printers'\nimport { posOpsSettings, type PosOpsSettings } from '../pos-ops-config'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\n\n/*==========================================\n * WHO MAY RUN THE REGISTER (AGL-3609), for the shift, PIN, customer and\n * return routes.\n *\n * The same two facts the sale route checks: the member's role ON THIS SITE\n * is `admin` or `editor` (the allowlist the Firestore rules enforce), and the\n * organization has not revoked `managePos` from them. Plus the plan's `pos`\n * entitlement, re-read every time because a downgrade happens between taps.\n *\n * Every Firebase and Stripe touch goes through {@link PosOpsDeps}, so the\n * routes' specs run each money path against an in-memory store and a counted\n * fetch without mocking a module.\n *=========================================*/\n\nexport interface PosOpsMembership {\n  orgWide: boolean\n  hostRole: string | null\n  permissions: { managePos?: boolean }\n}\n\nexport interface PosOpsDeps {\n  firestore(): FirebaseFirestore.Firestore\n  verifyIdToken(token: string): Promise<{ uid: string }>\n  membership(uid: string, hostId: string): Promise<PosOpsMembership>\n  orgForHost(hostId: string): Promise<{ orgId: string; org: Record<string, any> | null } | null>\n  pluginConfig(orgId: string, hostId: string): Promise<Record<string, unknown>>\n  /** The plan includes the register. */\n  posEntitled(org: Record<string, any> | null): boolean\n  /** The HMAC secret staff assertions are signed with; throws when unset. */\n  signingSecret(): string\n  /** A member's name as a receipt or a report prints it. */\n  memberName(uid: string): Promise<string>\n  now(): number\n  /** Stripe's REST API; `global.fetch` in production. */\n  fetch: typeof fetch\n  /** The register's cloud printers (AGL-3619): drawer kicks and shift reports. */\n  printer: PosOpsPrinter\n}\n\n/** What the register's routes ask of the printer queue. Never throws. */\nexport interface PosOpsPrinter {\n  kickDrawer(input: {\n    hostId: string\n    registerId: string\n    reason: 'paid_in' | 'paid_out' | 'drop' | 'cash_refund'\n    causeId: string\n    createdBy?: string\n  }): Promise<{ jobIds: string[] }>\n  printReport(input: {\n    hostId: string\n    registerId: string\n    shiftId: string\n    report: PrintReport\n    createdBy?: string\n    attemptKey: string\n  }): Promise<{ jobIds: string[] }>\n}\n\nexport function defaultPosOpsDeps(): PosOpsDeps {\n  return {\n    firestore: () => firebaseAdmin.app().firestore(),\n    verifyIdToken: async (token) => {\n      const decoded = await firebaseAdmin.app().auth().verifyIdToken(token)\n      return { uid: decoded.uid }\n    },\n    membership: async (uid, hostId) => {\n      const resolved = await resolveOrgPermissions(uid, { hostId })\n      return {\n        orgWide: resolved.orgWide === true,\n        hostRole: resolved.hostRole ?? null,\n        permissions: { managePos: resolved.permissions?.managePos === true },\n      }\n    },\n    orgForHost: async (hostId) => {\n      const found = await getOrgForHost(hostId)\n      if (!found) return null\n      return {\n        orgId: String(found.org?.id ?? found.orgId ?? ''),\n        org: (found.org as Record<string, any>) ?? null,\n      }\n    },\n    pluginConfig: async (orgId, hostId) =>\n      ((await getPluginConfig(orgId, 'commerce', { hostId })) ?? {}) as Record<string, unknown>,\n    posEntitled: (org) => Aglyn.checkEntitlement(org as any, 'pos'),\n    signingSecret: () => {\n      const secret = process.env.TOKEN_SIGNING_SECRET\n      if (!secret) throw new Error('TOKEN_SIGNING_SECRET is not configured')\n      return secret\n    },\n    memberName: async (uid) => {\n      // Every pool: a member who signs in through SSO lives in a GCIP tenant\n      // pool, not the project one (AGL-1122).\n      try {\n        const user = (await findUserByUidAcrossPools(uid))?.record\n        return user?.displayName || user?.email || 'Staff member'\n      } catch {\n        return 'Staff member'\n      }\n    },\n    now: () => Date.now(),\n    fetch: (input, init) => fetch(input, init),\n    // Loaded on use: the printing module reaches the whole sale pipeline,\n    // which a shift count or a PIN check never needs.\n    printer: {\n      kickDrawer: async (input) => (await import('./pos-print')).kickPosDrawer(input),\n      printReport: async (input) => (await import('./pos-print')).printPosShiftReport(input),\n    },\n  }\n}\n\n/** A JSON body, whether the dispatcher parsed it or not. */\nexport function posOpsBody(req: PluginApiRequest): Record<string, any> {\n  if (typeof req.body === 'string') {\n    try {\n      const parsed = JSON.parse(req.body)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return req.body && typeof req.body === 'object' ? (req.body as Record<string, any>) : {}\n}\n\n/** The request's idempotency key, either header spelling, bounded. */\nexport function posOpsIdempotencyKey(req: PluginApiRequest): string {\n  return String(req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '')\n    .trim()\n    .slice(0, 200)\n}\n\n/** Who is at the register, once the gate admitted them. */\nexport interface PosOpsStaff {\n  uid: string\n  hostId: string\n  orgId: string\n  org: Record<string, any> | null\n  membership: PosOpsMembership\n  /** An admin of the whole workspace: the one role with no refund limit. */\n  isManager: boolean\n  settings: PosOpsSettings\n  hostRef: FirebaseFirestore.DocumentReference\n}\n\nexport type PosOpsGate =\n  | { ok: true; staff: PosOpsStaff }\n  | { ok: false; status: number; error: string }\n\n/** A site id the dispatcher's own sentinels and path tricks cannot pass for. */\nfunction cleanId(value: unknown): string {\n  const id = String(value ?? '').trim()\n  return /^[A-Za-z0-9_-]{1,128}$/.test(id) && !/^__.*__$/.test(id) ? id : ''\n}\n\nexport { cleanId as posOpsCleanId }\n\n/** Whether a member may work this site's register, by role and permission. */\nexport function mayWorkRegister(memberRole: unknown, membership: PosOpsMembership): boolean {\n  return (memberRole === 'admin' || memberRole === 'editor') && membership.permissions.managePos === true\n}\n\n/**\n * The one role whose say-so a refund above the cashier limit needs: an admin\n * of the whole workspace who is also this site's admin — the role\n * `refund.ts` has always required to refund at all.\n */\nexport function isPosManager(memberRole: unknown, membership: PosOpsMembership): boolean {\n  return memberRole === 'admin' && membership.orgWide && membership.hostRole === 'admin'\n}\n\nexport async function authorizePosOps(\n  deps: PosOpsDeps,\n  req: PluginApiRequest,\n  rawHostId: unknown,\n): Promise<PosOpsGate> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : ''\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  const hostId = cleanId(rawHostId)\n  if (!hostId) return { ok: false, status: 400, error: 'Missing hostId' }\n  let uid: string\n  try {\n    uid = (await deps.verifyIdToken(idToken)).uid\n  } catch (error) {\n    if (!isRefusedIdToken(error)) throw error\n    return { ok: false, status: 401, error: 'Unauthenticated' }\n  }\n  const hostRef = deps.firestore().collection('hosts').doc(hostId)\n  const hostSnapshot = await hostRef.get()\n  if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  const membership = await deps.membership(uid, hostId)\n  if (!mayWorkRegister(memberRole, membership)) {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  const owner = await deps.orgForHost(hostId)\n  if (!deps.posEntitled(owner?.org ?? null)) {\n    return { ok: false, status: 403, error: 'POS requires the Pro plan or above' }\n  }\n  const settings = posOpsSettings(\n    owner?.orgId ? await deps.pluginConfig(owner.orgId, hostId).catch(() => ({})) : {},\n  )\n  return {\n    ok: true,\n    staff: {\n      uid,\n      hostId,\n      orgId: owner?.orgId ?? '',\n      org: owner?.org ?? null,\n      membership,\n      isManager: isPosManager(memberRole, membership),\n      settings,\n      hostRef,\n    },\n  }\n}\n\n/** A register on this site, or a refusal: a register id from another site is unknown here. */\nexport async function readPosRegister(\n  staff: PosOpsStaff,\n  rawRegisterId: unknown,\n): Promise<\n  | { ok: true; ref: FirebaseFirestore.DocumentReference; data: Record<string, any> }\n  | { ok: false; status: number; error: string }\n> {\n  const registerId = cleanId(rawRegisterId)\n  if (!registerId) return { ok: false, status: 400, error: 'Missing registerId' }\n  const ref = staff.hostRef.collection('registers').doc(registerId)\n  const snapshot = await ref.get()\n  if (!snapshot.exists) return { ok: false, status: 404, error: 'Unknown register' }\n  return { ok: true, ref, data: (snapshot.data() ?? {}) as Record<string, any> }\n}\n\n/*==========================================\n * STAFF ASSERTIONS: what a PIN buys.\n *\n * A PIN never signs anybody in. It mints a short-lived, signed statement\n * that one member of THIS site is at THIS register — `{hostId, registerId,\n * memberUid, purpose, expiry}` under an HMAC — and the routes that take one\n * re-check that member's role and `managePos` on every use, so a PIN never\n * carries more than its member holds right now, and a revoked member's\n * assertion stops working on the next tap rather than at expiry.\n *=========================================*/\n\nexport type PosAssertionPurpose = 'cashier' | 'manager'\n\ninterface AssertionClaims {\n  v: 1\n  h: string\n  r: string\n  u: string\n  p: PosAssertionPurpose\n  e: number\n}\n\nfunction signClaims(deps: PosOpsDeps, payload: string): string {\n  return createHmac('sha256', deps.signingSecret()).update(`pos-assertion:${payload}`).digest('hex')\n}\n\nexport function mintPosAssertion(\n  deps: PosOpsDeps,\n  input: { hostId: string; registerId: string; memberUid: string; purpose: PosAssertionPurpose },\n): { token: string; expiresAtMs: number } {\n  const expiresAtMs =\n    deps.now() +\n    (input.purpose === 'manager' ? POS_MANAGER_ASSERTION_TTL_MS : POS_CASHIER_ASSERTION_TTL_MS)\n  const claims: AssertionClaims = {\n    v: 1,\n    h: input.hostId,\n    r: input.registerId,\n    u: input.memberUid,\n    p: input.purpose,\n    e: expiresAtMs,\n  }\n  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url')\n  return { token: `${payload}.${signClaims(deps, payload)}`, expiresAtMs }\n}\n\n/**\n * The member an assertion names, or `null` — for a forged, expired, wrong-site,\n * wrong-register or wrong-purpose one alike. It does NOT re-check the member:\n * {@link resolvePosStaffAssertion} does that.\n */\nexport function readPosAssertion(\n  deps: PosOpsDeps,\n  token: unknown,\n  expected: { hostId: string; registerId: string; purpose: PosAssertionPurpose },\n): { memberUid: string; expiresAtMs: number } | null {\n  const value = typeof token === 'string' ? token.trim() : ''\n  const dot = value.lastIndexOf('.')\n  if (dot <= 0 || value.length > 2000) return null\n  const payload = value.slice(0, dot)\n  const signature = value.slice(dot + 1)\n  let expected64: string\n  try {\n    expected64 = signClaims(deps, payload)\n  } catch {\n    return null\n  }\n  const a = Buffer.from(signature)\n  const b = Buffer.from(expected64)\n  if (a.length !== b.length || !timingSafeEqual(new Uint8Array(a), new Uint8Array(b))) return null\n  let claims: AssertionClaims\n  try {\n    claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'))\n  } catch {\n    return null\n  }\n  if (\n    claims?.v !== 1 ||\n    claims.h !== expected.hostId ||\n    claims.r !== expected.registerId ||\n    claims.p !== expected.purpose ||\n    typeof claims.u !== 'string' ||\n    !claims.u ||\n    !(Number(claims.e) > deps.now())\n  ) {\n    return null\n  }\n  return { memberUid: claims.u, expiresAtMs: Number(claims.e) }\n}\n\n/**\n * The member an assertion puts at the register, re-checked NOW against the\n * site's roles and the organization's permissions — or `null` when the\n * assertion is bad or the member may no longer do what it was minted for.\n */\nexport async function resolvePosStaffAssertion(\n  deps: PosOpsDeps,\n  hostRef: FirebaseFirestore.DocumentReference,\n  token: unknown,\n  expected: { hostId: string; registerId: string; purpose: PosAssertionPurpose },\n): Promise<string | null> {\n  const read = readPosAssertion(deps, token, expected)\n  if (!read) return null\n  const host = await hostRef.get()\n  const memberRole = (host.get('memberRoles') ?? {})[read.memberUid]\n  const membership = await deps.membership(read.memberUid, expected.hostId)\n  const allowed =\n    expected.purpose === 'manager'\n      ? isPosManager(memberRole, membership)\n      : mayWorkRegister(memberRole, membership)\n  return allowed ? read.memberUid : null\n}\n\n/**\n * Who rang this: the member a valid cashier assertion names, or the member\n * signed in on the device when there is none or it no longer holds. The\n * signed-in member already passed the gate, so the fallback never admits\n * anybody new; it only decides whose name the sale carries.\n */\nexport async function resolvePosCashier(\n  deps: PosOpsDeps,\n  staff: Pick<PosOpsStaff, 'uid' | 'hostId' | 'hostRef'>,\n  registerId: string,\n  token: unknown,\n): Promise<{ cashierId: string; via: 'pin' | 'session' }> {\n  if (token) {\n    const memberUid = await resolvePosStaffAssertion(deps, staff.hostRef, token, {\n      hostId: staff.hostId,\n      registerId,\n      purpose: 'cashier',\n    })\n    if (memberUid) return { cashierId: memberUid, via: 'pin' }\n  }\n  return { cashierId: staff.uid, via: 'session' }\n}\n"],"names":["Aglyn","firebaseAdmin","getOrgForHost","getPluginConfig","findUserByUidAcrossPools","resolveOrgPermissions","createHmac","timingSafeEqual","POS_CASHIER_ASSERTION_TTL_MS","POS_MANAGER_ASSERTION_TTL_MS","posOpsSettings","isRefusedIdToken","defaultPosOpsDeps","firestore","app","verifyIdToken","token","decoded","auth","uid","membership","hostId","resolved","orgWide","hostRole","permissions","managePos","orgForHost","found","orgId","String","org","id","pluginConfig","posEntitled","checkEntitlement","signingSecret","secret","process","env","TOKEN_SIGNING_SECRET","Error","memberName","user","record","displayName","email","now","Date","fetch","input","init","printer","kickDrawer","kickPosDrawer","printReport","printPosShiftReport","posOpsBody","req","body","parsed","JSON","parse","posOpsIdempotencyKey","headers","trim","slice","cleanId","value","test","posOpsCleanId","mayWorkRegister","memberRole","isPosManager","authorizePosOps","deps","rawHostId","hostSnapshot","authorization","idToken","startsWith","length","ok","status","error","hostRef","collection","doc","get","exists","owner","settings","catch","staff","isManager","readPosRegister","rawRegisterId","snapshot","registerId","ref","data","signClaims","payload","update","digest","mintPosAssertion","expiresAtMs","purpose","claims","v","h","r","u","memberUid","p","e","Buffer","from","stringify","toString","readPosAssertion","expected","dot","lastIndexOf","signature","expected64","a","b","Uint8Array","Number","resolvePosStaffAssertion","host","read","allowed","resolvePosCashier","cashierId","via"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAE5C,SAASC,aAAa,EAAEC,aAAa,EAAEC,eAAe,QAAQ,2BAA0B;AACxF,SAASC,wBAAwB,QAAQ,6CAA4C;AACrF,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,UAAU,EAAEC,eAAe,QAAQ,SAAQ;AACpD,SACEC,4BAA4B,EAC5BC,4BAA4B,QACvB,+BAA2B;AAElC,SAASC,cAAc,QAA6B,uBAAmB;AACvE,SAASC,gBAAgB,QAAQ,mDAAkD;AA4DnF,OAAO,SAASC;IACd,OAAO;QACLC,WAAW,IAAMZ,cAAca,GAAG,GAAGD,SAAS;QAC9CE,eAAe,OAAOC;YACpB,MAAMC,UAAU,MAAMhB,cAAca,GAAG,GAAGI,IAAI,GAAGH,aAAa,CAACC;YAC/D,OAAO;gBAAEG,KAAKF,QAAQE,GAAG;YAAC;QAC5B;QACAC,YAAY,OAAOD,KAAKE;gBAIVC;gBACgBA;YAJ5B,MAAMA,WAAW,MAAMjB,sBAAsBc,KAAK;gBAAEE;YAAO;YAC3D,OAAO;gBACLE,SAASD,SAASC,OAAO,KAAK;gBAC9BC,QAAQ,GAAEF,qBAAAA,SAASE,QAAQ,YAAjBF,qBAAqB;gBAC/BG,aAAa;oBAAEC,WAAWJ,EAAAA,wBAAAA,SAASG,WAAW,qBAApBH,sBAAsBI,SAAS,MAAK;gBAAK;YACrE;QACF;QACAC,YAAY,OAAON;gBAIDO,aACRA;gBADQA;YAHhB,MAAMA,QAAQ,MAAM1B,cAAcmB;YAClC,IAAI,CAACO,OAAO,OAAO;YACnB,OAAO;gBACLC,OAAOC,QAAOF,iBAAAA,cAAAA,MAAMG,GAAG,qBAATH,YAAWI,EAAE,oBAAIJ,MAAMC,KAAK,YAA5BD,OAAgC;gBAC9CG,GAAG,GAAGH,aAAAA,MAAMG,GAAG,YAATH,aAAqC;YAC7C;QACF;QACAK,cAAc,OAAOJ,OAAOR;gBACxB;oBAAA,OAAA,MAAMlB,gBAAgB0B,OAAO,YAAY;gBAAER;YAAO,cAAlD,OAAyD,CAAC;;QAC9Da,aAAa,CAACH,MAAQ/B,MAAMmC,gBAAgB,CAACJ,KAAY;QACzDK,eAAe;YACb,MAAMC,SAASC,QAAQC,GAAG,CAACC,oBAAoB;YAC/C,IAAI,CAACH,QAAQ,MAAM,IAAII,MAAM;YAC7B,OAAOJ;QACT;QACAK,YAAY,OAAOvB;YACjB,uEAAuE;YACvE,wCAAwC;YACxC,IAAI;oBACY;gBAAd,MAAMwB,QAAQ,QAAA,MAAMvC,yBAAyBe,yBAAhC,AAAC,MAAsCyB,MAAM;gBAC1D,OAAOD,CAAAA,wBAAAA,KAAME,WAAW,MAAIF,wBAAAA,KAAMG,KAAK,KAAI;YAC7C,EAAE,eAAM;gBACN,OAAO;YACT;QACF;QACAC,KAAK,IAAMC,KAAKD,GAAG;QACnBE,OAAO,CAACC,OAAOC,OAASF,MAAMC,OAAOC;QACrC,sEAAsE;QACtE,kDAAkD;QAClDC,SAAS;YACPC,YAAY,OAAOH,QAAU,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGI,aAAa,CAACJ;YACzEK,aAAa,OAAOL,QAAU,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGM,mBAAmB,CAACN;QAClF;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASO,WAAWC,GAAqB;IAC9C,IAAI,OAAOA,IAAIC,IAAI,KAAK,UAAU;QAChC,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACJ,IAAIC,IAAI;YAClC,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOF,IAAIC,IAAI,IAAI,OAAOD,IAAIC,IAAI,KAAK,WAAYD,IAAIC,IAAI,GAA2B,CAAC;AACzF;AAEA,oEAAoE,GACpE,OAAO,SAASI,qBAAqBL,GAAqB;QAC1CA,MAAAA;IAAd,OAAO5B,QAAO4B,QAAAA,8BAAAA,IAAIM,OAAO,CAAC,kBAAkB,YAA9BN,8BAAkCA,IAAIM,OAAO,CAAC,kBAAkB,YAAhEN,OAAoE,IAC/EO,IAAI,GACJC,KAAK,CAAC,GAAG;AACd;AAmBA,8EAA8E,GAC9E,SAASC,QAAQC,KAAc;IAC7B,MAAMpC,KAAKF,OAAOsC,gBAAAA,QAAS,IAAIH,IAAI;IACnC,OAAO,yBAAyBI,IAAI,CAACrC,OAAO,CAAC,WAAWqC,IAAI,CAACrC,MAAMA,KAAK;AAC1E;AAEA,SAASmC,WAAWG,aAAa,GAAE;AAEnC,4EAA4E,GAC5E,OAAO,SAASC,gBAAgBC,UAAmB,EAAEpD,UAA4B;IAC/E,OAAO,AAACoD,CAAAA,eAAe,WAAWA,eAAe,QAAO,KAAMpD,WAAWK,WAAW,CAACC,SAAS,KAAK;AACrG;AAEA;;;;CAIC,GACD,OAAO,SAAS+C,aAAaD,UAAmB,EAAEpD,UAA4B;IAC5E,OAAOoD,eAAe,WAAWpD,WAAWG,OAAO,IAAIH,WAAWI,QAAQ,KAAK;AACjF;AAEA,OAAO,eAAekD,gBACpBC,IAAgB,EAChBjB,GAAqB,EACrBkB,SAAkB;QAEWlB,4BAeTmB;IAfpB,MAAMC,gBAAgBhD,QAAO4B,6BAAAA,IAAIM,OAAO,CAACc,aAAa,YAAzBpB,6BAA6B;IAC1D,MAAMqB,UAAUD,cAAcE,UAAU,CAAC,aAAaF,cAAcZ,KAAK,CAAC,UAAUe,MAAM,IAAI;IAC9F,IAAI,CAACF,SAAS,OAAO;QAAEG,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,MAAM/D,SAAS8C,QAAQS;IACvB,IAAI,CAACvD,QAAQ,OAAO;QAAE6D,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAiB;IACtE,IAAIjE;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAMwD,KAAK5D,aAAa,CAACgE,QAAO,EAAG5D,GAAG;IAC/C,EAAE,OAAOiE,OAAO;QACd,IAAI,CAACzE,iBAAiByE,QAAQ,MAAMA;QACpC,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;IAC5D;IACA,MAAMC,UAAUV,KAAK9D,SAAS,GAAGyE,UAAU,CAAC,SAASC,GAAG,CAAClE;IACzD,MAAMwD,eAAe,MAAMQ,QAAQG,GAAG;IACtC,IAAI,CAACX,aAAaY,MAAM,EAAE,OAAO;QAAEP,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACjF,MAAMZ,aAAa,EAACK,oBAAAA,aAAaW,GAAG,CAAC,0BAAjBX,oBAAmC,CAAC,EAAE,CAAC1D,IAAI;IAC/D,MAAMC,aAAa,MAAMuD,KAAKvD,UAAU,CAACD,KAAKE;IAC9C,IAAI,CAACkD,gBAAgBC,YAAYpD,aAAa;QAC5C,OAAO;YAAE8D,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,MAAMM,QAAQ,MAAMf,KAAKhD,UAAU,CAACN;IACpC,IAAI,CAACsD,KAAKzC,WAAW,SAACwD,yBAAAA,MAAO3D,GAAG,mBAAI,OAAO;QACzC,OAAO;YAAEmD,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAqC;IAC/E;IACA,MAAMO,WAAWjF,eACfgF,CAAAA,yBAAAA,MAAO7D,KAAK,IAAG,MAAM8C,KAAK1C,YAAY,CAACyD,MAAM7D,KAAK,EAAER,QAAQuE,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA,KAAM,CAAC;IAEnF,OAAO;QACLV,IAAI;QACJW,OAAO;YACL1E;YACAE;YACAQ,KAAK,WAAE6D,yBAAAA,MAAO7D,KAAK,oBAAI;YACvBE,GAAG,WAAE2D,yBAAAA,MAAO3D,GAAG,oBAAI;YACnBX;YACA0E,WAAWrB,aAAaD,YAAYpD;YACpCuE;YACAN;QACF;IACF;AACF;AAEA,4FAA4F,GAC5F,OAAO,eAAeU,gBACpBF,KAAkB,EAClBG,aAAsB;QAUSC;IAL/B,MAAMC,aAAa/B,QAAQ6B;IAC3B,IAAI,CAACE,YAAY,OAAO;QAAEhB,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAqB;IAC9E,MAAMe,MAAMN,MAAMR,OAAO,CAACC,UAAU,CAAC,aAAaC,GAAG,CAACW;IACtD,MAAMD,WAAW,MAAME,IAAIX,GAAG;IAC9B,IAAI,CAACS,SAASR,MAAM,EAAE,OAAO;QAAEP,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAmB;IACjF,OAAO;QAAEF,IAAI;QAAMiB;QAAKC,IAAI,GAAGH,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,CAAC;IAA0B;AAC/E;AAwBA,SAASI,WAAW1B,IAAgB,EAAE2B,OAAe;IACnD,OAAOhG,WAAW,UAAUqE,KAAKvC,aAAa,IAAImE,MAAM,CAAC,CAAC,cAAc,EAAED,SAAS,EAAEE,MAAM,CAAC;AAC9F;AAEA,OAAO,SAASC,iBACd9B,IAAgB,EAChBzB,KAA8F;IAE9F,MAAMwD,cACJ/B,KAAK5B,GAAG,KACPG,CAAAA,MAAMyD,OAAO,KAAK,YAAYlG,+BAA+BD,4BAA2B;IAC3F,MAAMoG,SAA0B;QAC9BC,GAAG;QACHC,GAAG5D,MAAM7B,MAAM;QACf0F,GAAG7D,MAAMgD,UAAU;QACnBc,GAAG9D,MAAM+D,SAAS;QAClBC,GAAGhE,MAAMyD,OAAO;QAChBQ,GAAGT;IACL;IACA,MAAMJ,UAAUc,OAAOC,IAAI,CAACxD,KAAKyD,SAAS,CAACV,SAASW,QAAQ,CAAC;IAC7D,OAAO;QAAEvG,OAAO,GAAGsF,QAAQ,CAAC,EAAED,WAAW1B,MAAM2B,UAAU;QAAEI;IAAY;AACzE;AAEA;;;;CAIC,GACD,OAAO,SAASc,iBACd7C,IAAgB,EAChB3D,KAAc,EACdyG,QAA8E;IAE9E,MAAMrD,QAAQ,OAAOpD,UAAU,WAAWA,MAAMiD,IAAI,KAAK;IACzD,MAAMyD,MAAMtD,MAAMuD,WAAW,CAAC;IAC9B,IAAID,OAAO,KAAKtD,MAAMa,MAAM,GAAG,MAAM,OAAO;IAC5C,MAAMqB,UAAUlC,MAAMF,KAAK,CAAC,GAAGwD;IAC/B,MAAME,YAAYxD,MAAMF,KAAK,CAACwD,MAAM;IACpC,IAAIG;IACJ,IAAI;QACFA,aAAaxB,WAAW1B,MAAM2B;IAChC,EAAE,eAAM;QACN,OAAO;IACT;IACA,MAAMwB,IAAIV,OAAOC,IAAI,CAACO;IACtB,MAAMG,IAAIX,OAAOC,IAAI,CAACQ;IACtB,IAAIC,EAAE7C,MAAM,KAAK8C,EAAE9C,MAAM,IAAI,CAAC1E,gBAAgB,IAAIyH,WAAWF,IAAI,IAAIE,WAAWD,KAAK,OAAO;IAC5F,IAAInB;IACJ,IAAI;QACFA,SAAS/C,KAAKC,KAAK,CAACsD,OAAOC,IAAI,CAACf,SAAS,aAAaiB,QAAQ,CAAC;IACjE,EAAE,eAAM;QACN,OAAO;IACT;IACA,IACEX,CAAAA,0BAAAA,OAAQC,CAAC,MAAK,KACdD,OAAOE,CAAC,KAAKW,SAASpG,MAAM,IAC5BuF,OAAOG,CAAC,KAAKU,SAASvB,UAAU,IAChCU,OAAOM,CAAC,KAAKO,SAASd,OAAO,IAC7B,OAAOC,OAAOI,CAAC,KAAK,YACpB,CAACJ,OAAOI,CAAC,IACT,CAAEiB,CAAAA,OAAOrB,OAAOO,CAAC,IAAIxC,KAAK5B,GAAG,EAAC,GAC9B;QACA,OAAO;IACT;IACA,OAAO;QAAEkE,WAAWL,OAAOI,CAAC;QAAEN,aAAauB,OAAOrB,OAAOO,CAAC;IAAE;AAC9D;AAEA;;;;CAIC,GACD,OAAO,eAAee,yBACpBvD,IAAgB,EAChBU,OAA4C,EAC5CrE,KAAc,EACdyG,QAA8E;QAK1DU;IAHpB,MAAMC,OAAOZ,iBAAiB7C,MAAM3D,OAAOyG;IAC3C,IAAI,CAACW,MAAM,OAAO;IAClB,MAAMD,OAAO,MAAM9C,QAAQG,GAAG;IAC9B,MAAMhB,aAAa,EAAC2D,YAAAA,KAAK3C,GAAG,CAAC,0BAAT2C,YAA2B,CAAC,EAAE,CAACC,KAAKnB,SAAS,CAAC;IAClE,MAAM7F,aAAa,MAAMuD,KAAKvD,UAAU,CAACgH,KAAKnB,SAAS,EAAEQ,SAASpG,MAAM;IACxE,MAAMgH,UACJZ,SAASd,OAAO,KAAK,YACjBlC,aAAaD,YAAYpD,cACzBmD,gBAAgBC,YAAYpD;IAClC,OAAOiH,UAAUD,KAAKnB,SAAS,GAAG;AACpC;AAEA;;;;;CAKC,GACD,OAAO,eAAeqB,kBACpB3D,IAAgB,EAChBkB,KAAsD,EACtDK,UAAkB,EAClBlF,KAAc;IAEd,IAAIA,OAAO;QACT,MAAMiG,YAAY,MAAMiB,yBAAyBvD,MAAMkB,MAAMR,OAAO,EAAErE,OAAO;YAC3EK,QAAQwE,MAAMxE,MAAM;YACpB6E;YACAS,SAAS;QACX;QACA,IAAIM,WAAW,OAAO;YAAEsB,WAAWtB;YAAWuB,KAAK;QAAM;IAC3D;IACA,OAAO;QAAED,WAAW1C,MAAM1E,GAAG;QAAEqH,KAAK;IAAU;AAChD"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-ops-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport type { PluginApiRequest } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost, getPluginConfig } from '@aglyn/tenant-data-admin'\nimport { findUserByUidAcrossPools } from '@aglyn/tenant-data-admin/server/auth-pools'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { createHmac, timingSafeEqual } from 'crypto'\nimport {\n  POS_CASHIER_ASSERTION_TTL_MS,\n  POS_MANAGER_ASSERTION_TTL_MS,\n} from '../model/commerce-pos-ops'\nimport type { PrintReport } from '../model/commerce-printers'\nimport {\n  holdsPosPermission,\n  posPermissionRefusal,\n  type PosPermission,\n} from '../model/plugin-permissions'\nimport { posOpsSettings, type PosOpsSettings } from '../pos-ops-config'\nimport { holdsCommerceWorkspaceSiteKey } from './commerce-site-keys'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\n\n/*==========================================\n * WHO MAY RUN THE REGISTER (AGL-3609), for the shift, PIN, customer and\n * return routes.\n *\n * The fact the sale route checks: `managePos`, as resolved for THIS site —\n * the member's org role, custom role and overrides for an org-wide member,\n * and the role they hold here and their overrides for a site collaborator.\n * Plus the plan's `pos` entitlement, re-read every time because a downgrade\n * happens between taps.\n *\n * THE KEYS DECIDE, NOT THE SITE ROLE (AGL-4047). This also asked for `admin`\n * or `editor` in the site's `memberRoles`, exactly the set `managePos` is on\n * for by default, so nobody who had the register loses it; a site viewer the\n * workspace grants the register now works it.\n *\n * Every Firebase and Stripe touch goes through {@link PosOpsDeps}, so the\n * routes' specs run each money path against an in-memory store and a counted\n * fetch without mocking a module.\n *=========================================*/\n\nexport interface PosOpsMembership {\n  orgWide: boolean\n  hostRole: string | null\n  /** `managePos`, and the register's finer keys (AGL-4047) as resolved. */\n  permissions: { managePos?: boolean } & Partial<Record<PosPermission, boolean>>\n}\n\n/** The register's finer keys a membership carries (AGL-4047). */\nconst POS_PERMISSION_KEYS: readonly PosPermission[] = [\n  'posSell',\n  'posRefund',\n  'posDiscount',\n  'posCashDrawer',\n  'posDevices',\n  'posBuyHardware',\n]\n\nexport interface PosOpsDeps {\n  firestore(): FirebaseFirestore.Firestore\n  verifyIdToken(token: string): Promise<{ uid: string }>\n  membership(uid: string, hostId: string): Promise<PosOpsMembership>\n  orgForHost(hostId: string): Promise<{ orgId: string; org: Record<string, any> | null } | null>\n  pluginConfig(orgId: string, hostId: string): Promise<Record<string, unknown>>\n  /** The plan includes the register. */\n  posEntitled(org: Record<string, any> | null): boolean\n  /** The HMAC secret staff assertions are signed with; throws when unset. */\n  signingSecret(): string\n  /** A member's name as a receipt or a report prints it. */\n  memberName(uid: string): Promise<string>\n  now(): number\n  /** Stripe's REST API; `global.fetch` in production. */\n  fetch: typeof fetch\n  /** The register's cloud printers (AGL-3619): drawer kicks and shift reports. */\n  printer: PosOpsPrinter\n}\n\n/** What the register's routes ask of the printer queue. Never throws. */\nexport interface PosOpsPrinter {\n  kickDrawer(input: {\n    hostId: string\n    registerId: string\n    reason: 'paid_in' | 'paid_out' | 'drop' | 'cash_refund'\n    causeId: string\n    createdBy?: string\n  }): Promise<{ jobIds: string[] }>\n  printReport(input: {\n    hostId: string\n    registerId: string\n    shiftId: string\n    report: PrintReport\n    createdBy?: string\n    attemptKey: string\n  }): Promise<{ jobIds: string[] }>\n}\n\nexport function defaultPosOpsDeps(): PosOpsDeps {\n  return {\n    firestore: () => firebaseAdmin.app().firestore(),\n    verifyIdToken: async (token) => {\n      const decoded = await firebaseAdmin.app().auth().verifyIdToken(token)\n      return { uid: decoded.uid }\n    },\n    membership: async (uid, hostId) => {\n      const resolved = await resolveOrgPermissions(uid, { hostId })\n      return {\n        orgWide: resolved.orgWide === true,\n        hostRole: resolved.hostRole ?? null,\n        permissions: {\n          managePos: resolved.permissions?.managePos === true,\n          // Each finer key as resolved; absent when the map carries none,\n          // which `holdsPosPermission` reads as following `managePos`.\n          ...Object.fromEntries(\n            POS_PERMISSION_KEYS.filter(\n              (key) => typeof resolved.permissions?.[key] === 'boolean',\n            ).map((key) => [key, resolved.permissions[key] === true]),\n          ),\n        },\n      }\n    },\n    orgForHost: async (hostId) => {\n      const found = await getOrgForHost(hostId)\n      if (!found) return null\n      return {\n        orgId: String(found.org?.id ?? found.orgId ?? ''),\n        org: (found.org as Record<string, any>) ?? null,\n      }\n    },\n    pluginConfig: async (orgId, hostId) =>\n      ((await getPluginConfig(orgId, 'commerce', { hostId })) ?? {}) as Record<string, unknown>,\n    posEntitled: (org) => Aglyn.checkEntitlement(org as any, 'pos'),\n    signingSecret: () => {\n      const secret = process.env.TOKEN_SIGNING_SECRET\n      if (!secret) throw new Error('TOKEN_SIGNING_SECRET is not configured')\n      return secret\n    },\n    memberName: async (uid) => {\n      // Every pool: a member who signs in through SSO lives in a GCIP tenant\n      // pool, not the project one (AGL-1122).\n      try {\n        const user = (await findUserByUidAcrossPools(uid))?.record\n        return user?.displayName || user?.email || 'Staff member'\n      } catch {\n        return 'Staff member'\n      }\n    },\n    now: () => Date.now(),\n    fetch: (input, init) => fetch(input, init),\n    // Loaded on use: the printing module reaches the whole sale pipeline,\n    // which a shift count or a PIN check never needs.\n    printer: {\n      kickDrawer: async (input) => (await import('./pos-print')).kickPosDrawer(input),\n      printReport: async (input) => (await import('./pos-print')).printPosShiftReport(input),\n    },\n  }\n}\n\n/** A JSON body, whether the dispatcher parsed it or not. */\nexport function posOpsBody(req: PluginApiRequest): Record<string, any> {\n  if (typeof req.body === 'string') {\n    try {\n      const parsed = JSON.parse(req.body)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return req.body && typeof req.body === 'object' ? (req.body as Record<string, any>) : {}\n}\n\n/** The request's idempotency key, either header spelling, bounded. */\nexport function posOpsIdempotencyKey(req: PluginApiRequest): string {\n  return String(req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '')\n    .trim()\n    .slice(0, 200)\n}\n\n/** Who is at the register, once the gate admitted them. */\nexport interface PosOpsStaff {\n  uid: string\n  hostId: string\n  orgId: string\n  org: Record<string, any> | null\n  membership: PosOpsMembership\n  /**\n   * \"Approve refunds over the register's limit\" (`commerce.posApprovals`,\n   * AGL-4047): no refund limit, a manager's approval, other members' PINs.\n   */\n  isManager: boolean\n  settings: PosOpsSettings\n  hostRef: FirebaseFirestore.DocumentReference\n}\n\nexport type PosOpsGate =\n  | { ok: true; staff: PosOpsStaff }\n  | { ok: false; status: number; error: string }\n\n/** A site id the dispatcher's own sentinels and path tricks cannot pass for. */\nfunction cleanId(value: unknown): string {\n  const id = String(value ?? '').trim()\n  return /^[A-Za-z0-9_-]{1,128}$/.test(id) && !/^__.*__$/.test(id) ? id : ''\n}\n\nexport { cleanId as posOpsCleanId }\n\n/**\n * Whether a member may work this site's register: `managePos`, as resolved\n * for the site (AGL-4047). A finer action also needs its own key:\n * `holdsPosPermission`.\n */\nexport function mayWorkRegister(membership: PosOpsMembership): boolean {\n  return membership.permissions.managePos === true\n}\n\n/**\n * Whose say-so a refund above the cashier limit needs, and who sets other\n * members' PINs: \"Approve refunds over the register's limit\"\n * (`commerce.posApprovals`, AGL-4047). Its preset is the gate this asked\n * before: an admin of the whole workspace who is also this site's admin,\n * which someone added to just this site as its admin never was. `hostDoc` is\n * the site's document (its stamp and `memberRoles`).\n */\nexport function isPosManager(\n  hostDoc: { get(field: string): unknown } | null | undefined,\n  uid: string,\n  membership: PosOpsMembership,\n): boolean {\n  return holdsCommerceWorkspaceSiteKey(hostDoc, uid, 'commerce.posApprovals', membership)\n}\n\n/**\n * The register's gate for one route. `permission` names the finer register\n * key the action needs (AGL-4047) on top of working the register at all; a\n * member without it is answered 403 naming it.\n */\nexport async function authorizePosOps(\n  deps: PosOpsDeps,\n  req: PluginApiRequest,\n  rawHostId: unknown,\n  permission?: PosPermission,\n): Promise<PosOpsGate> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : ''\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  const hostId = cleanId(rawHostId)\n  if (!hostId) return { ok: false, status: 400, error: 'Missing hostId' }\n  let uid: string\n  try {\n    uid = (await deps.verifyIdToken(idToken)).uid\n  } catch (error) {\n    if (!isRefusedIdToken(error)) throw error\n    return { ok: false, status: 401, error: 'Unauthenticated' }\n  }\n  const hostRef = deps.firestore().collection('hosts').doc(hostId)\n  const hostSnapshot = await hostRef.get()\n  if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n  const membership = await deps.membership(uid, hostId)\n  if (!mayWorkRegister(membership)) {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  if (permission && !holdsPosPermission(membership.permissions, permission)) {\n    return { ok: false, status: 403, error: posPermissionRefusal(permission) }\n  }\n  const owner = await deps.orgForHost(hostId)\n  if (!deps.posEntitled(owner?.org ?? null)) {\n    return { ok: false, status: 403, error: 'POS requires the Pro plan or above' }\n  }\n  const settings = posOpsSettings(\n    owner?.orgId ? await deps.pluginConfig(owner.orgId, hostId).catch(() => ({})) : {},\n  )\n  return {\n    ok: true,\n    staff: {\n      uid,\n      hostId,\n      orgId: owner?.orgId ?? '',\n      org: owner?.org ?? null,\n      membership,\n      isManager: isPosManager(hostSnapshot, uid, membership),\n      settings,\n      hostRef,\n    },\n  }\n}\n\n/** A register on this site, or a refusal: a register id from another site is unknown here. */\nexport async function readPosRegister(\n  staff: PosOpsStaff,\n  rawRegisterId: unknown,\n): Promise<\n  | { ok: true; ref: FirebaseFirestore.DocumentReference; data: Record<string, any> }\n  | { ok: false; status: number; error: string }\n> {\n  const registerId = cleanId(rawRegisterId)\n  if (!registerId) return { ok: false, status: 400, error: 'Missing registerId' }\n  const ref = staff.hostRef.collection('registers').doc(registerId)\n  const snapshot = await ref.get()\n  if (!snapshot.exists) return { ok: false, status: 404, error: 'Unknown register' }\n  return { ok: true, ref, data: (snapshot.data() ?? {}) as Record<string, any> }\n}\n\n/*==========================================\n * STAFF ASSERTIONS: what a PIN buys.\n *\n * A PIN never signs anybody in. It mints a short-lived, signed statement\n * that one member of THIS site is at THIS register — `{hostId, registerId,\n * memberUid, purpose, expiry}` under an HMAC — and the routes that take one\n * re-check that member's permissions on every use, so a PIN never\n * carries more than its member holds right now, and a revoked member's\n * assertion stops working on the next tap rather than at expiry.\n *=========================================*/\n\nexport type PosAssertionPurpose = 'cashier' | 'manager'\n\ninterface AssertionClaims {\n  v: 1\n  h: string\n  r: string\n  u: string\n  p: PosAssertionPurpose\n  e: number\n}\n\nfunction signClaims(deps: PosOpsDeps, payload: string): string {\n  return createHmac('sha256', deps.signingSecret()).update(`pos-assertion:${payload}`).digest('hex')\n}\n\nexport function mintPosAssertion(\n  deps: PosOpsDeps,\n  input: { hostId: string; registerId: string; memberUid: string; purpose: PosAssertionPurpose },\n): { token: string; expiresAtMs: number } {\n  const expiresAtMs =\n    deps.now() +\n    (input.purpose === 'manager' ? POS_MANAGER_ASSERTION_TTL_MS : POS_CASHIER_ASSERTION_TTL_MS)\n  const claims: AssertionClaims = {\n    v: 1,\n    h: input.hostId,\n    r: input.registerId,\n    u: input.memberUid,\n    p: input.purpose,\n    e: expiresAtMs,\n  }\n  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url')\n  return { token: `${payload}.${signClaims(deps, payload)}`, expiresAtMs }\n}\n\n/**\n * The member an assertion names, or `null` — for a forged, expired, wrong-site,\n * wrong-register or wrong-purpose one alike. It does NOT re-check the member:\n * {@link resolvePosStaffAssertion} does that.\n */\nexport function readPosAssertion(\n  deps: PosOpsDeps,\n  token: unknown,\n  expected: { hostId: string; registerId: string; purpose: PosAssertionPurpose },\n): { memberUid: string; expiresAtMs: number } | null {\n  const value = typeof token === 'string' ? token.trim() : ''\n  const dot = value.lastIndexOf('.')\n  if (dot <= 0 || value.length > 2000) return null\n  const payload = value.slice(0, dot)\n  const signature = value.slice(dot + 1)\n  let expected64: string\n  try {\n    expected64 = signClaims(deps, payload)\n  } catch {\n    return null\n  }\n  const a = Buffer.from(signature)\n  const b = Buffer.from(expected64)\n  if (a.length !== b.length || !timingSafeEqual(new Uint8Array(a), new Uint8Array(b))) return null\n  let claims: AssertionClaims\n  try {\n    claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'))\n  } catch {\n    return null\n  }\n  if (\n    claims?.v !== 1 ||\n    claims.h !== expected.hostId ||\n    claims.r !== expected.registerId ||\n    claims.p !== expected.purpose ||\n    typeof claims.u !== 'string' ||\n    !claims.u ||\n    !(Number(claims.e) > deps.now())\n  ) {\n    return null\n  }\n  return { memberUid: claims.u, expiresAtMs: Number(claims.e) }\n}\n\n/**\n * The member an assertion puts at the register, re-checked NOW against the\n * site's roles and the organization's permissions — or `null` when the\n * assertion is bad or the member may no longer do what it was minted for.\n */\nexport async function resolvePosStaffAssertion(\n  deps: PosOpsDeps,\n  hostRef: FirebaseFirestore.DocumentReference,\n  token: unknown,\n  expected: { hostId: string; registerId: string; purpose: PosAssertionPurpose },\n): Promise<string | null> {\n  const read = readPosAssertion(deps, token, expected)\n  if (!read) return null\n  const membership = await deps.membership(read.memberUid, expected.hostId)\n  if (expected.purpose !== 'manager') return mayWorkRegister(membership) ? read.memberUid : null\n  return isPosManager(await hostRef.get(), read.memberUid, membership) ? read.memberUid : null\n}\n\n/**\n * Who rang this: the member a valid cashier assertion names, or the member\n * signed in on the device when there is none or it no longer holds. The\n * signed-in member already passed the gate, so the fallback never admits\n * anybody new; it only decides whose name the sale carries.\n */\nexport async function resolvePosCashier(\n  deps: PosOpsDeps,\n  staff: Pick<PosOpsStaff, 'uid' | 'hostId' | 'hostRef'>,\n  registerId: string,\n  token: unknown,\n): Promise<{ cashierId: string; via: 'pin' | 'session' }> {\n  if (token) {\n    const memberUid = await resolvePosStaffAssertion(deps, staff.hostRef, token, {\n      hostId: staff.hostId,\n      registerId,\n      purpose: 'cashier',\n    })\n    if (memberUid) return { cashierId: memberUid, via: 'pin' }\n  }\n  return { cashierId: staff.uid, via: 'session' }\n}\n"],"names":["Aglyn","firebaseAdmin","getOrgForHost","getPluginConfig","findUserByUidAcrossPools","resolveOrgPermissions","createHmac","timingSafeEqual","POS_CASHIER_ASSERTION_TTL_MS","POS_MANAGER_ASSERTION_TTL_MS","holdsPosPermission","posPermissionRefusal","posOpsSettings","holdsCommerceWorkspaceSiteKey","isRefusedIdToken","POS_PERMISSION_KEYS","defaultPosOpsDeps","firestore","app","verifyIdToken","token","decoded","auth","uid","membership","hostId","resolved","orgWide","hostRole","permissions","managePos","Object","fromEntries","filter","key","map","orgForHost","found","orgId","String","org","id","pluginConfig","posEntitled","checkEntitlement","signingSecret","secret","process","env","TOKEN_SIGNING_SECRET","Error","memberName","user","record","displayName","email","now","Date","fetch","input","init","printer","kickDrawer","kickPosDrawer","printReport","printPosShiftReport","posOpsBody","req","body","parsed","JSON","parse","posOpsIdempotencyKey","headers","trim","slice","cleanId","value","test","posOpsCleanId","mayWorkRegister","isPosManager","hostDoc","authorizePosOps","deps","rawHostId","permission","authorization","idToken","startsWith","length","ok","status","error","hostRef","collection","doc","hostSnapshot","get","exists","owner","settings","catch","staff","isManager","readPosRegister","rawRegisterId","snapshot","registerId","ref","data","signClaims","payload","update","digest","mintPosAssertion","expiresAtMs","purpose","claims","v","h","r","u","memberUid","p","e","Buffer","from","stringify","toString","readPosAssertion","expected","dot","lastIndexOf","signature","expected64","a","b","Uint8Array","Number","resolvePosStaffAssertion","read","resolvePosCashier","cashierId","via"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAE5C,SAASC,aAAa,EAAEC,aAAa,EAAEC,eAAe,QAAQ,2BAA0B;AACxF,SAASC,wBAAwB,QAAQ,6CAA4C;AACrF,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,UAAU,EAAEC,eAAe,QAAQ,SAAQ;AACpD,SACEC,4BAA4B,EAC5BC,4BAA4B,QACvB,+BAA2B;AAElC,SACEC,kBAAkB,EAClBC,oBAAoB,QAEf,iCAA6B;AACpC,SAASC,cAAc,QAA6B,uBAAmB;AACvE,SAASC,6BAA6B,QAAQ,0BAAsB;AACpE,SAASC,gBAAgB,QAAQ,mDAAkD;AA6BnF,+DAA+D,GAC/D,MAAMC,sBAAgD;IACpD;IACA;IACA;IACA;IACA;IACA;CACD;AAwCD,OAAO,SAASC;IACd,OAAO;QACLC,WAAW,IAAMhB,cAAciB,GAAG,GAAGD,SAAS;QAC9CE,eAAe,OAAOC;YACpB,MAAMC,UAAU,MAAMpB,cAAciB,GAAG,GAAGI,IAAI,GAAGH,aAAa,CAACC;YAC/D,OAAO;gBAAEG,KAAKF,QAAQE,GAAG;YAAC;QAC5B;QACAC,YAAY,OAAOD,KAAKE;gBAIVC;gBAEGA;YALf,MAAMA,WAAW,MAAMrB,sBAAsBkB,KAAK;gBAAEE;YAAO;YAC3D,OAAO;gBACLE,SAASD,SAASC,OAAO,KAAK;gBAC9BC,QAAQ,GAAEF,qBAAAA,SAASE,QAAQ,YAAjBF,qBAAqB;gBAC/BG,aAAa;oBACXC,WAAWJ,EAAAA,wBAAAA,SAASG,WAAW,qBAApBH,sBAAsBI,SAAS,MAAK;mBAG5CC,OAAOC,WAAW,CACnBjB,oBAAoBkB,MAAM,CACxB,CAACC;wBAAeR;2BAAP,SAAOA,wBAAAA,SAASG,WAAW,qBAApBH,qBAAsB,CAACQ,IAAI,MAAK;mBAChDC,GAAG,CAAC,CAACD,MAAQ;wBAACA;wBAAKR,SAASG,WAAW,CAACK,IAAI,KAAK;qBAAK;YAG9D;QACF;QACAE,YAAY,OAAOX;gBAIDY,aACRA;gBADQA;YAHhB,MAAMA,QAAQ,MAAMnC,cAAcuB;YAClC,IAAI,CAACY,OAAO,OAAO;YACnB,OAAO;gBACLC,OAAOC,QAAOF,iBAAAA,cAAAA,MAAMG,GAAG,qBAATH,YAAWI,EAAE,oBAAIJ,MAAMC,KAAK,YAA5BD,OAAgC;gBAC9CG,GAAG,GAAGH,aAAAA,MAAMG,GAAG,YAATH,aAAqC;YAC7C;QACF;QACAK,cAAc,OAAOJ,OAAOb;gBACxB;oBAAA,OAAA,MAAMtB,gBAAgBmC,OAAO,YAAY;gBAAEb;YAAO,cAAlD,OAAyD,CAAC;;QAC9DkB,aAAa,CAACH,MAAQxC,MAAM4C,gBAAgB,CAACJ,KAAY;QACzDK,eAAe;YACb,MAAMC,SAASC,QAAQC,GAAG,CAACC,oBAAoB;YAC/C,IAAI,CAACH,QAAQ,MAAM,IAAII,MAAM;YAC7B,OAAOJ;QACT;QACAK,YAAY,OAAO5B;YACjB,uEAAuE;YACvE,wCAAwC;YACxC,IAAI;oBACY;gBAAd,MAAM6B,QAAQ,QAAA,MAAMhD,yBAAyBmB,yBAAhC,AAAC,MAAsC8B,MAAM;gBAC1D,OAAOD,CAAAA,wBAAAA,KAAME,WAAW,MAAIF,wBAAAA,KAAMG,KAAK,KAAI;YAC7C,EAAE,eAAM;gBACN,OAAO;YACT;QACF;QACAC,KAAK,IAAMC,KAAKD,GAAG;QACnBE,OAAO,CAACC,OAAOC,OAASF,MAAMC,OAAOC;QACrC,sEAAsE;QACtE,kDAAkD;QAClDC,SAAS;YACPC,YAAY,OAAOH,QAAU,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGI,aAAa,CAACJ;YACzEK,aAAa,OAAOL,QAAU,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGM,mBAAmB,CAACN;QAClF;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASO,WAAWC,GAAqB;IAC9C,IAAI,OAAOA,IAAIC,IAAI,KAAK,UAAU;QAChC,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACJ,IAAIC,IAAI;YAClC,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOF,IAAIC,IAAI,IAAI,OAAOD,IAAIC,IAAI,KAAK,WAAYD,IAAIC,IAAI,GAA2B,CAAC;AACzF;AAEA,oEAAoE,GACpE,OAAO,SAASI,qBAAqBL,GAAqB;QAC1CA,MAAAA;IAAd,OAAO5B,QAAO4B,QAAAA,8BAAAA,IAAIM,OAAO,CAAC,kBAAkB,YAA9BN,8BAAkCA,IAAIM,OAAO,CAAC,kBAAkB,YAAhEN,OAAoE,IAC/EO,IAAI,GACJC,KAAK,CAAC,GAAG;AACd;AAsBA,8EAA8E,GAC9E,SAASC,QAAQC,KAAc;IAC7B,MAAMpC,KAAKF,OAAOsC,gBAAAA,QAAS,IAAIH,IAAI;IACnC,OAAO,yBAAyBI,IAAI,CAACrC,OAAO,CAAC,WAAWqC,IAAI,CAACrC,MAAMA,KAAK;AAC1E;AAEA,SAASmC,WAAWG,aAAa,GAAE;AAEnC;;;;CAIC,GACD,OAAO,SAASC,gBAAgBxD,UAA4B;IAC1D,OAAOA,WAAWK,WAAW,CAACC,SAAS,KAAK;AAC9C;AAEA;;;;;;;CAOC,GACD,OAAO,SAASmD,aACdC,OAA2D,EAC3D3D,GAAW,EACXC,UAA4B;IAE5B,OAAOX,8BAA8BqE,SAAS3D,KAAK,yBAAyBC;AAC9E;AAEA;;;;CAIC,GACD,OAAO,eAAe2D,gBACpBC,IAAgB,EAChBjB,GAAqB,EACrBkB,SAAkB,EAClBC,UAA0B;QAEGnB;IAA7B,MAAMoB,gBAAgBhD,QAAO4B,6BAAAA,IAAIM,OAAO,CAACc,aAAa,YAAzBpB,6BAA6B;IAC1D,MAAMqB,UAAUD,cAAcE,UAAU,CAAC,aAAaF,cAAcZ,KAAK,CAAC,UAAUe,MAAM,IAAI;IAC9F,IAAI,CAACF,SAAS,OAAO;QAAEG,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,MAAMpE,SAASmD,QAAQS;IACvB,IAAI,CAAC5D,QAAQ,OAAO;QAAEkE,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAiB;IACtE,IAAItE;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAM6D,KAAKjE,aAAa,CAACqE,QAAO,EAAGjE,GAAG;IAC/C,EAAE,OAAOsE,OAAO;QACd,IAAI,CAAC/E,iBAAiB+E,QAAQ,MAAMA;QACpC,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;IAC5D;IACA,MAAMC,UAAUV,KAAKnE,SAAS,GAAG8E,UAAU,CAAC,SAASC,GAAG,CAACvE;IACzD,MAAMwE,eAAe,MAAMH,QAAQI,GAAG;IACtC,IAAI,CAACD,aAAaE,MAAM,EAAE,OAAO;QAAER,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACjF,MAAMrE,aAAa,MAAM4D,KAAK5D,UAAU,CAACD,KAAKE;IAC9C,IAAI,CAACuD,gBAAgBxD,aAAa;QAChC,OAAO;YAAEmE,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,IAAIP,cAAc,CAAC5E,mBAAmBc,WAAWK,WAAW,EAAEyD,aAAa;QACzE,OAAO;YAAEK,IAAI;YAAOC,QAAQ;YAAKC,OAAOlF,qBAAqB2E;QAAY;IAC3E;IACA,MAAMc,QAAQ,MAAMhB,KAAKhD,UAAU,CAACX;IACpC,IAAI,CAAC2D,KAAKzC,WAAW,SAACyD,yBAAAA,MAAO5D,GAAG,mBAAI,OAAO;QACzC,OAAO;YAAEmD,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAqC;IAC/E;IACA,MAAMQ,WAAWzF,eACfwF,CAAAA,yBAAAA,MAAO9D,KAAK,IAAG,MAAM8C,KAAK1C,YAAY,CAAC0D,MAAM9D,KAAK,EAAEb,QAAQ6E,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA,KAAM,CAAC;IAEnF,OAAO;QACLX,IAAI;QACJY,OAAO;YACLhF;YACAE;YACAa,KAAK,WAAE8D,yBAAAA,MAAO9D,KAAK,oBAAI;YACvBE,GAAG,WAAE4D,yBAAAA,MAAO5D,GAAG,oBAAI;YACnBhB;YACAgF,WAAWvB,aAAagB,cAAc1E,KAAKC;YAC3C6E;YACAP;QACF;IACF;AACF;AAEA,4FAA4F,GAC5F,OAAO,eAAeW,gBACpBF,KAAkB,EAClBG,aAAsB;QAUSC;IAL/B,MAAMC,aAAahC,QAAQ8B;IAC3B,IAAI,CAACE,YAAY,OAAO;QAAEjB,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAqB;IAC9E,MAAMgB,MAAMN,MAAMT,OAAO,CAACC,UAAU,CAAC,aAAaC,GAAG,CAACY;IACtD,MAAMD,WAAW,MAAME,IAAIX,GAAG;IAC9B,IAAI,CAACS,SAASR,MAAM,EAAE,OAAO;QAAER,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAmB;IACjF,OAAO;QAAEF,IAAI;QAAMkB;QAAKC,IAAI,GAAGH,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,CAAC;IAA0B;AAC/E;AAwBA,SAASI,WAAW3B,IAAgB,EAAE4B,OAAe;IACnD,OAAO1G,WAAW,UAAU8E,KAAKvC,aAAa,IAAIoE,MAAM,CAAC,CAAC,cAAc,EAAED,SAAS,EAAEE,MAAM,CAAC;AAC9F;AAEA,OAAO,SAASC,iBACd/B,IAAgB,EAChBzB,KAA8F;IAE9F,MAAMyD,cACJhC,KAAK5B,GAAG,KACPG,CAAAA,MAAM0D,OAAO,KAAK,YAAY5G,+BAA+BD,4BAA2B;IAC3F,MAAM8G,SAA0B;QAC9BC,GAAG;QACHC,GAAG7D,MAAMlC,MAAM;QACfgG,GAAG9D,MAAMiD,UAAU;QACnBc,GAAG/D,MAAMgE,SAAS;QAClBC,GAAGjE,MAAM0D,OAAO;QAChBQ,GAAGT;IACL;IACA,MAAMJ,UAAUc,OAAOC,IAAI,CAACzD,KAAK0D,SAAS,CAACV,SAASW,QAAQ,CAAC;IAC7D,OAAO;QAAE7G,OAAO,GAAG4F,QAAQ,CAAC,EAAED,WAAW3B,MAAM4B,UAAU;QAAEI;IAAY;AACzE;AAEA;;;;CAIC,GACD,OAAO,SAASc,iBACd9C,IAAgB,EAChBhE,KAAc,EACd+G,QAA8E;IAE9E,MAAMtD,QAAQ,OAAOzD,UAAU,WAAWA,MAAMsD,IAAI,KAAK;IACzD,MAAM0D,MAAMvD,MAAMwD,WAAW,CAAC;IAC9B,IAAID,OAAO,KAAKvD,MAAMa,MAAM,GAAG,MAAM,OAAO;IAC5C,MAAMsB,UAAUnC,MAAMF,KAAK,CAAC,GAAGyD;IAC/B,MAAME,YAAYzD,MAAMF,KAAK,CAACyD,MAAM;IACpC,IAAIG;IACJ,IAAI;QACFA,aAAaxB,WAAW3B,MAAM4B;IAChC,EAAE,eAAM;QACN,OAAO;IACT;IACA,MAAMwB,IAAIV,OAAOC,IAAI,CAACO;IACtB,MAAMG,IAAIX,OAAOC,IAAI,CAACQ;IACtB,IAAIC,EAAE9C,MAAM,KAAK+C,EAAE/C,MAAM,IAAI,CAACnF,gBAAgB,IAAImI,WAAWF,IAAI,IAAIE,WAAWD,KAAK,OAAO;IAC5F,IAAInB;IACJ,IAAI;QACFA,SAAShD,KAAKC,KAAK,CAACuD,OAAOC,IAAI,CAACf,SAAS,aAAaiB,QAAQ,CAAC;IACjE,EAAE,eAAM;QACN,OAAO;IACT;IACA,IACEX,CAAAA,0BAAAA,OAAQC,CAAC,MAAK,KACdD,OAAOE,CAAC,KAAKW,SAAS1G,MAAM,IAC5B6F,OAAOG,CAAC,KAAKU,SAASvB,UAAU,IAChCU,OAAOM,CAAC,KAAKO,SAASd,OAAO,IAC7B,OAAOC,OAAOI,CAAC,KAAK,YACpB,CAACJ,OAAOI,CAAC,IACT,CAAEiB,CAAAA,OAAOrB,OAAOO,CAAC,IAAIzC,KAAK5B,GAAG,EAAC,GAC9B;QACA,OAAO;IACT;IACA,OAAO;QAAEmE,WAAWL,OAAOI,CAAC;QAAEN,aAAauB,OAAOrB,OAAOO,CAAC;IAAE;AAC9D;AAEA;;;;CAIC,GACD,OAAO,eAAee,yBACpBxD,IAAgB,EAChBU,OAA4C,EAC5C1E,KAAc,EACd+G,QAA8E;IAE9E,MAAMU,OAAOX,iBAAiB9C,MAAMhE,OAAO+G;IAC3C,IAAI,CAACU,MAAM,OAAO;IAClB,MAAMrH,aAAa,MAAM4D,KAAK5D,UAAU,CAACqH,KAAKlB,SAAS,EAAEQ,SAAS1G,MAAM;IACxE,IAAI0G,SAASd,OAAO,KAAK,WAAW,OAAOrC,gBAAgBxD,cAAcqH,KAAKlB,SAAS,GAAG;IAC1F,OAAO1C,aAAa,MAAMa,QAAQI,GAAG,IAAI2C,KAAKlB,SAAS,EAAEnG,cAAcqH,KAAKlB,SAAS,GAAG;AAC1F;AAEA;;;;;CAKC,GACD,OAAO,eAAemB,kBACpB1D,IAAgB,EAChBmB,KAAsD,EACtDK,UAAkB,EAClBxF,KAAc;IAEd,IAAIA,OAAO;QACT,MAAMuG,YAAY,MAAMiB,yBAAyBxD,MAAMmB,MAAMT,OAAO,EAAE1E,OAAO;YAC3EK,QAAQ8E,MAAM9E,MAAM;YACpBmF;YACAS,SAAS;QACX;QACA,IAAIM,WAAW,OAAO;YAAEoB,WAAWpB;YAAWqB,KAAK;QAAM;IAC3D;IACA,OAAO;QAAED,WAAWxC,MAAMhF,GAAG;QAAEyH,KAAK;IAAU;AAChD"}

package/src/lib/server/pos-ops-routes.js

@@ -18,6 +18,8 @@ import { posCheckInHandler, registerPosSaleCheckIns } from "./pos-check-in.js";
 import { posCustomerHandler } from "./pos-customer.js";
 import { posDayReportHandler } from "./pos-day-report.js";
 import { registerPosSalePrinting } from "./pos-print.js";
+import { onPosSaleCompleted } from "./pos-sale.js";
+import { parsePosHardwareInPersonConfig } from "../model/pos-hardware.js";
 import { posReturnHandler } from "./pos-return.js";
 import { posShiftHandler } from "./pos-shift.js";
 import { posStaffPinHandler } from "./pos-staff-pin.js";
@@ -43,6 +45,28 @@ import { posStaffPinHandler } from "./pos-staff-pin.js";
     // A completed sale's receipt and drawer kick on the register's cloud
     // printers (AGL-3619), through the sale-completed seam every path fires.
     registerPosSalePrinting();
+    // A card reader sold at the platform's own store's register becomes a
+    // hardware order for the buyer's workspace (AGL-4038).
+    registerPosSaleHardware();
+}
+let hardwareSubscribed = false;
+/**
+ * Records the hardware order of a completed sale on the platform's own
+ * store. Every other store's sale is answered from the environment alone,
+ * without loading the recorder. Never throws into a sale; a sale this misses
+ * stays marked and the To attach list's sweep records it.
+ */ function registerPosSaleHardware() {
+    if (hardwareSubscribed) return;
+    hardwareSubscribed = true;
+    onPosSaleCompleted(async (event)=>{
+        var _parsePosHardwareInPersonConfig;
+        if (((_parsePosHardwareInPersonConfig = parsePosHardwareInPersonConfig(process.env)) == null ? void 0 : _parsePosHardwareInPersonConfig.sellerHostId) !== event.hostId) return;
+        try {
+            await (await import("./pos-hardware-in-person.js")).recordCompletedSaleHardware(event);
+        } catch (error) {
+            console.error('[pos-hardware-in-person] recorder not loaded', event.orderId, error);
+        }
+    });
 }
 
 //# sourceMappingURL=pos-ops-routes.js.map

package/src/lib/server/pos-ops-routes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-ops-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { posCheckInHandler, registerPosSaleCheckIns } from './pos-check-in'\nimport { posCustomerHandler } from './pos-customer'\nimport { posDayReportHandler } from './pos-day-report'\nimport { registerPosSalePrinting } from './pos-print'\nimport { posReturnHandler } from './pos-return'\nimport { posShiftHandler } from './pos-shift'\nimport { posStaffPinHandler } from './pos-staff-pin'\n\n/**\n * The register's operations routes (AGL-3609): shifts and the drawer, staff\n * PINs, the customer lookup and returns, the day totals (AGL-4037), the\n * check-in (AGL-4043), plus the\n * sale printing. Console-auth, so they register on the console surface with\n * the sale route itself.\n */\nexport function registerPosOpsRoutes(): void {\n  registerPluginApiRoute('commerce/pos-shift', posShiftHandler)\n  registerPluginApiRoute('commerce/pos-staff-pin', posStaffPinHandler)\n  registerPluginApiRoute('commerce/pos-customer', posCustomerHandler)\n  registerPluginApiRoute('commerce/pos-return', posReturnHandler)\n  // One day's or one event's totals across every register, shift and cashier\n  // (AGL-4037): a GET, read with the same gate as the shift reports.\n  registerPluginApiRoute('commerce/pos-day-report', posDayReportHandler)\n  // Check-in at the window (AGL-4043): who is due today, checking them in\n  // with a wristband, and the day's list; a register sale's check-ins are\n  // written the moment it completes, through the same seam as its printing.\n  registerPluginApiRoute('commerce/pos-check-in', posCheckInHandler)\n  registerPosSaleCheckIns()\n  // A completed sale's receipt and drawer kick on the register's cloud\n  // printers (AGL-3619), through the sale-completed seam every path fires.\n  registerPosSalePrinting()\n}\n"],"names":["registerPluginApiRoute","posCheckInHandler","registerPosSaleCheckIns","posCustomerHandler","posDayReportHandler","registerPosSalePrinting","posReturnHandler","posShiftHandler","posStaffPinHandler","registerPosOpsRoutes"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,iBAAiB,EAAEC,uBAAuB,QAAQ,oBAAgB;AAC3E,SAASC,kBAAkB,QAAQ,oBAAgB;AACnD,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SAASC,uBAAuB,QAAQ,iBAAa;AACrD,SAASC,gBAAgB,QAAQ,kBAAc;AAC/C,SAASC,eAAe,QAAQ,iBAAa;AAC7C,SAASC,kBAAkB,QAAQ,qBAAiB;AAEpD;;;;;;CAMC,GACD,OAAO,SAASC;IACdT,uBAAuB,sBAAsBO;IAC7CP,uBAAuB,0BAA0BQ;IACjDR,uBAAuB,yBAAyBG;IAChDH,uBAAuB,uBAAuBM;IAC9C,2EAA2E;IAC3E,mEAAmE;IACnEN,uBAAuB,2BAA2BI;IAClD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1EJ,uBAAuB,yBAAyBC;IAChDC;IACA,qEAAqE;IACrE,yEAAyE;IACzEG;AACF"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-ops-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { posCheckInHandler, registerPosSaleCheckIns } from './pos-check-in'\nimport { posCustomerHandler } from './pos-customer'\nimport { posDayReportHandler } from './pos-day-report'\nimport { registerPosSalePrinting } from './pos-print'\nimport { onPosSaleCompleted } from './pos-sale'\nimport { parsePosHardwareInPersonConfig } from '../model/pos-hardware'\nimport { posReturnHandler } from './pos-return'\nimport { posShiftHandler } from './pos-shift'\nimport { posStaffPinHandler } from './pos-staff-pin'\n\n/**\n * The register's operations routes (AGL-3609): shifts and the drawer, staff\n * PINs, the customer lookup and returns, the day totals (AGL-4037), the\n * check-in (AGL-4043), plus the\n * sale printing. Console-auth, so they register on the console surface with\n * the sale route itself.\n */\nexport function registerPosOpsRoutes(): void {\n  registerPluginApiRoute('commerce/pos-shift', posShiftHandler)\n  registerPluginApiRoute('commerce/pos-staff-pin', posStaffPinHandler)\n  registerPluginApiRoute('commerce/pos-customer', posCustomerHandler)\n  registerPluginApiRoute('commerce/pos-return', posReturnHandler)\n  // One day's or one event's totals across every register, shift and cashier\n  // (AGL-4037): a GET, read with the same gate as the shift reports.\n  registerPluginApiRoute('commerce/pos-day-report', posDayReportHandler)\n  // Check-in at the window (AGL-4043): who is due today, checking them in\n  // with a wristband, and the day's list; a register sale's check-ins are\n  // written the moment it completes, through the same seam as its printing.\n  registerPluginApiRoute('commerce/pos-check-in', posCheckInHandler)\n  registerPosSaleCheckIns()\n  // A completed sale's receipt and drawer kick on the register's cloud\n  // printers (AGL-3619), through the sale-completed seam every path fires.\n  registerPosSalePrinting()\n  // A card reader sold at the platform's own store's register becomes a\n  // hardware order for the buyer's workspace (AGL-4038).\n  registerPosSaleHardware()\n}\n\nlet hardwareSubscribed = false\n\n/**\n * Records the hardware order of a completed sale on the platform's own\n * store. Every other store's sale is answered from the environment alone,\n * without loading the recorder. Never throws into a sale; a sale this misses\n * stays marked and the To attach list's sweep records it.\n */\nfunction registerPosSaleHardware(): void {\n  if (hardwareSubscribed) return\n  hardwareSubscribed = true\n  onPosSaleCompleted(async (event) => {\n    if (parsePosHardwareInPersonConfig(process.env)?.sellerHostId !== event.hostId) return\n    try {\n      await (await import('./pos-hardware-in-person')).recordCompletedSaleHardware(event)\n    } catch (error) {\n      console.error('[pos-hardware-in-person] recorder not loaded', event.orderId, error)\n    }\n  })\n}\n"],"names":["registerPluginApiRoute","posCheckInHandler","registerPosSaleCheckIns","posCustomerHandler","posDayReportHandler","registerPosSalePrinting","onPosSaleCompleted","parsePosHardwareInPersonConfig","posReturnHandler","posShiftHandler","posStaffPinHandler","registerPosOpsRoutes","registerPosSaleHardware","hardwareSubscribed","event","process","env","sellerHostId","hostId","recordCompletedSaleHardware","error","console","orderId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,iBAAiB,EAAEC,uBAAuB,QAAQ,oBAAgB;AAC3E,SAASC,kBAAkB,QAAQ,oBAAgB;AACnD,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SAASC,uBAAuB,QAAQ,iBAAa;AACrD,SAASC,kBAAkB,QAAQ,gBAAY;AAC/C,SAASC,8BAA8B,QAAQ,2BAAuB;AACtE,SAASC,gBAAgB,QAAQ,kBAAc;AAC/C,SAASC,eAAe,QAAQ,iBAAa;AAC7C,SAASC,kBAAkB,QAAQ,qBAAiB;AAEpD;;;;;;CAMC,GACD,OAAO,SAASC;IACdX,uBAAuB,sBAAsBS;IAC7CT,uBAAuB,0BAA0BU;IACjDV,uBAAuB,yBAAyBG;IAChDH,uBAAuB,uBAAuBQ;IAC9C,2EAA2E;IAC3E,mEAAmE;IACnER,uBAAuB,2BAA2BI;IAClD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1EJ,uBAAuB,yBAAyBC;IAChDC;IACA,qEAAqE;IACrE,yEAAyE;IACzEG;IACA,sEAAsE;IACtE,uDAAuD;IACvDO;AACF;AAEA,IAAIC,qBAAqB;AAEzB;;;;;CAKC,GACD,SAASD;IACP,IAAIC,oBAAoB;IACxBA,qBAAqB;IACrBP,mBAAmB,OAAOQ;YACpBP;QAAJ,IAAIA,EAAAA,kCAAAA,+BAA+BQ,QAAQC,GAAG,sBAA1CT,gCAA6CU,YAAY,MAAKH,MAAMI,MAAM,EAAE;QAChF,IAAI;YACF,MAAM,AAAC,CAAA,MAAM,MAAM,CAAC,8BAA0B,EAAGC,2BAA2B,CAACL;QAC/E,EAAE,OAAOM,OAAO;YACdC,QAAQD,KAAK,CAAC,gDAAgDN,MAAMQ,OAAO,EAAEF;QAC/E;IACF;AACF"}

package/src/lib/server/pos-order-refund-ids.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The ids of the register refund records the day report reads
+ * (`registers/{registerId}/orderRefunds/{id}`, AGL-4037). Each is derived on
+ * purpose, so a replayed write lands on the same record instead of counting
+ * a refund twice; the schemes are written here, once, for every writer.
+ */
+/** A refund Stripe reported for a register sale: the charge (else the order) and the refunded total. */
+export declare function posOrderRefundStripeId(chargeOrOrderId: string, refundedCents: number): string;
+/** A refund given from the console's order dialog, keyed by its Stripe claim (else its time). */
+export declare function posOrderRefundDialogId(orderId: string, claimKey: string | number): string;
+/** The hardware part of a register sale refunded through the staff page (AGL-4038), per attempt. */
+export declare function posOrderRefundHardwareId(registerOrderId: string, attempt: number | string): string;

package/src/lib/server/pos-order-refund-ids.js

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The ids of the register refund records the day report reads
+ * (`registers/{registerId}/orderRefunds/{id}`, AGL-4037). Each is derived on
+ * purpose, so a replayed write lands on the same record instead of counting
+ * a refund twice; the schemes are written here, once, for every writer.
+ */ /** A refund Stripe reported for a register sale: the charge (else the order) and the refunded total. */ export function posOrderRefundStripeId(chargeOrOrderId, refundedCents) {
+    return `stripe-${chargeOrOrderId}-${refundedCents}`;
+}
+/** A refund given from the console's order dialog, keyed by its Stripe claim (else its time). */ export function posOrderRefundDialogId(orderId, claimKey) {
+    return `${orderId}-${claimKey}`;
+}
+/** The hardware part of a register sale refunded through the staff page (AGL-4038), per attempt. */ export function posOrderRefundHardwareId(registerOrderId, attempt) {
+    return `${registerOrderId}-hw-${attempt}`;
+}
+
+//# sourceMappingURL=pos-order-refund-ids.js.map

package/src/lib/server/pos-order-refund-ids.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-order-refund-ids.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The ids of the register refund records the day report reads\n * (`registers/{registerId}/orderRefunds/{id}`, AGL-4037). Each is derived on\n * purpose, so a replayed write lands on the same record instead of counting\n * a refund twice; the schemes are written here, once, for every writer.\n */\n\n/** A refund Stripe reported for a register sale: the charge (else the order) and the refunded total. */\nexport function posOrderRefundStripeId(chargeOrOrderId: string, refundedCents: number): string {\n  return `stripe-${chargeOrOrderId}-${refundedCents}`\n}\n\n/** A refund given from the console's order dialog, keyed by its Stripe claim (else its time). */\nexport function posOrderRefundDialogId(orderId: string, claimKey: string | number): string {\n  return `${orderId}-${claimKey}`\n}\n\n/** The hardware part of a register sale refunded through the staff page (AGL-4038), per attempt. */\nexport function posOrderRefundHardwareId(registerOrderId: string, attempt: number | string): string {\n  return `${registerOrderId}-hw-${attempt}`\n}\n"],"names":["posOrderRefundStripeId","chargeOrOrderId","refundedCents","posOrderRefundDialogId","orderId","claimKey","posOrderRefundHardwareId","registerOrderId","attempt"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;CAKC,GAED,sGAAsG,GACtG,OAAO,SAASA,uBAAuBC,eAAuB,EAAEC,aAAqB;IACnF,OAAO,CAAC,OAAO,EAAED,gBAAgB,CAAC,EAAEC,eAAe;AACrD;AAEA,+FAA+F,GAC/F,OAAO,SAASC,uBAAuBC,OAAe,EAAEC,QAAyB;IAC/E,OAAO,GAAGD,QAAQ,CAAC,EAAEC,UAAU;AACjC;AAEA,kGAAkG,GAClG,OAAO,SAASC,yBAAyBC,eAAuB,EAAEC,OAAwB;IACxF,OAAO,GAAGD,gBAAgB,IAAI,EAAEC,SAAS;AAC3C"}

package/src/lib/server/pos-order.js

@@ -28,9 +28,11 @@ import { raiseOrderEvent } from "./order-events.js";
 import { decrementVariantStock } from "./reserve-stock.js";
 import { holdPromotionSlot, promotionHoldKey, settlePromotionSlot } from "./promotion-hold.js";
 import { posMaxDiscountPct } from "../plugin-config.js";
+import { holdsPosPermission, posPermissionRefusal } from "../model/plugin-permissions.js";
 import { offlineFeeMonthKey } from "./pos-fee-month.js";
 import { notifyPosSaleCompleted } from "./pos-sale.js";
 import { posSaleStamp } from "./pos-sale-stamp.js";
+import { posHardwareSaleFields } from "./pos-hardware-sale-fields.js";
 import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
 import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
 import { posKioskPrincipal } from "./pos-kiosk-principal.js";
@@ -138,53 +140,31 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
         if (slot) await slot.release();
     };
     try {
-        var _hostSnapshot_get, _storeSettings_get, _taxSettings_origin, _ref2, _ref3;
-        var _registerDocs_rank, _ownerOrg_org, _ownerOrg_org1;
+        var _ref2, _ref3, _storeSettings_get, _taxSettings_origin, _ref4, _ref5;
+        var _registerDocs_rank, _ownerOrg_org, _ownerOrg_org1, _ownerOrg_org2;
         const decoded = kiosk ? {
             uid: kiosk.uid
         } : await firebaseAdmin.app().auth().verifyIdToken(idToken);
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
         const hostSnapshot = await hostRef.get();
-        // AN ALLOWLIST (AGL-2262), matching `cancel-order.ts`, `fulfill-order.ts`
-        // and the Firestore rules' own `hostMemberRole(hostId) in
-        // ['admin','editor']`. The old `!role || role === 'viewer'` denylist
-        // admitted every string that was not literally `viewer` on the route that
-        // takes cash, mints a card QR and decrements real inventory.
-        // The union has since GROWN: `HostAccessRole` is `admin | editor | author
-        // | viewer` (AGL-2334), and `author` is grantable on this host through
-        // `/api/hosts/members`. So this allowlist now refuses a role a real
-        // projection CAN produce, deliberately — an author edits content and does
-        // not take money. That is the whole reason it is an allowlist: a role
-        // added later is refused until someone decides otherwise, rather than
-        // admitted by the silence of a denylist.
-        //
-        // What it does NOT decide is WHOSE admin. `memberRoles` is a per-host
-        // projection, so a SITE COLLABORATOR granted `admin` on this one site
-        // (`hostAccess: { [hostId]: 'admin' }`, `allHosts: false`) is
-        // indistinguishable here from an org owner. That is correct for ringing a
-        // sale — they were invited to run this till — but it means this value
-        // alone cannot carry an elevated, manager-only control such as the
-        // AGL-2372 oversell override. The discriminator is `orgWide` on the
-        // membership resolved just below, not the role string.
-        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
-        if (memberRole !== 'admin' && memberRole !== 'editor') {
-            return res.status(403).json({
-                error: 'Not permitted'
-            });
-        }
-        // THE `managePos` PERMISSION, actually read (AGL-2474). The allowlist
-        // above is a HOST-level fact and stays — it is what the Firestore rules
-        // enforce and dropping it would widen this route. This is the org-level
-        // half: `managePos` was declared by COMMERCE_PERMISSIONS, resolved into
-        // every permission map, displayed nowhere and read by nothing, so the
-        // capability was inert. Both must hold, matching the marketplace
-        // install/publish routes' resolveOrgPermissions + memberRoles pairing.
+        if (!hostSnapshot.exists) return res.status(404).json({
+            error: 'Unknown site'
+        });
+        // THE KEYS DECIDE, NOT THE SITE ROLE (AGL-4047). This route asked for
+        // `admin` or `editor` in the site's `memberRoles` (an allowlist, AGL-2262)
+        // AND `managePos` (AGL-2474). Those two agreed for everyone by default —
+        // `managePos` is on for exactly the admin and editor tiers — so dropping
+        // the role check takes the register from nobody. What changes is who the
+        // workspace can hand it to: a site viewer granted `managePos` rings sales,
+        // and an admin a role narrows is refused, as the waivers doors already do.
         //
-        // Behaviour is unchanged for anyone who has not been given an explicit
-        // override: `managePos` defaults to true for the admin and editor tiers,
-        // which is exactly the set the allowlist already admits. What it adds is
-        // the ability to REVOKE POS from one admin without demoting them.
+        // `resolveOrgPermissions` answers for THIS site: an org-wide member from
+        // their org role, custom role and overrides; a site collaborator from the
+        // role they hold here and their overrides; and anyone without access to
+        // the site with nothing. Whose admin a member is stays the `orgWide`
+        // discriminator below, for the manager-only controls such as the AGL-2372
+        // oversell override; a site role alone never carried those.
         const membership = await resolveOrgPermissions(decoded.uid, {
             hostId
         });
@@ -193,6 +173,20 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
                 error: 'Not permitted'
             });
         }
+        // THE REGISTER'S FINER KEYS (AGL-4047), each following `managePos` until
+        // a role or the member sets it: ringing a sale at all, and the cashier's
+        // own percentage off. A shopper's code and the store's promotions are the
+        // merchant's, and apply without the discount key.
+        if (!holdsPosPermission(membership.permissions, 'posSell')) {
+            return res.status(403).json({
+                error: posPermissionRefusal('posSell')
+            });
+        }
+        if (discountPct > 0 && !holdsPosPermission(membership.permissions, 'posDiscount')) {
+            return res.status(403).json({
+                error: posPermissionRefusal('posDiscount')
+            });
+        }
         const ownerOrg = await getOrgForHost(hostId);
         if (!Aglyn.checkEntitlement(ownerOrg == null ? void 0 : ownerOrg.org, 'pos')) {
             return res.status(403).json({
@@ -336,6 +330,15 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
                 error: 'No valid lines'
             });
         }
+        // A sale of card readers on the platform's own store (AGL-4038) is
+        // marked from the moment it is written, so its hardware order is
+        // recorded once it is paid even if the completion listener misses it.
+        const hardwareFields = posHardwareSaleFields({
+            hostId,
+            orgId: String((_ref2 = (_ref3 = ownerOrg == null ? void 0 : (_ownerOrg_org = ownerOrg.org) == null ? void 0 : _ownerOrg_org.id) != null ? _ref3 : ownerOrg == null ? void 0 : ownerOrg.orgId) != null ? _ref2 : ''),
+            lineItems,
+            products: productsById
+        });
         // WHAT THE COUNT SAYS, said out loud (AGL-2357). Every storefront door
         // gates on `canPurchase`; a register that skips it silently downgrades a
         // merchant's `oversellPolicy: 'deny'` to `backorder` at the till.
@@ -630,7 +633,7 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
         // `orgs//offlineFees/…`; the sale still rings, and the fee is forgone
         // rather than written somewhere no invoice will ever find it.
         const offlineFeeMonth = offlineFeeMonthKey();
-        const offlineFeeOrgId = String((_ref2 = ownerOrg == null ? void 0 : (_ownerOrg_org = ownerOrg.org) == null ? void 0 : _ownerOrg_org.id) != null ? _ref2 : '');
+        const offlineFeeOrgId = String((_ref4 = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.id) != null ? _ref4 : '');
         const offlineFeeRef = offlineFeeOrgId ? firestore.collection('orgs').doc(offlineFeeOrgId).collection('offlineFees').doc(offlineFeeMonth) : null;
         // Deterministic tender rejections run BEFORE the claim is taken, so they
         // never burn the key (AGL-1691): "cash received is short" is a 400 the
@@ -686,7 +689,7 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
         const claimed = await claimAttempt(firestore, {
             kind: 'pos',
             scopeId: hostId,
-            orgId: String((_ref3 = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.id) != null ? _ref3 : ''),
+            orgId: String((_ref5 = ownerOrg == null ? void 0 : (_ownerOrg_org2 = ownerOrg.org) == null ? void 0 : _ownerOrg_org2.id) != null ? _ref5 : ''),
             key: idempotencyKey,
             busyMessage: 'This sale is already being processed'
         });
@@ -759,7 +762,7 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
                     channel: 'pos',
                     registerId,
                     cashierId: saleStamp.cashierId
-                }, saleStamp.fields, discountPct > 0 ? {
+                }, saleStamp.fields, hardwareFields, discountPct > 0 ? {
                     discountPct,
                     discountBy: saleStamp.cashierId
                 } : {}, appliedDiscountId ? {
@@ -807,10 +810,10 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
             return res.status(200).json(openPayload);
         }
         if (payment === 'link') {
-            var _ref4, _session_id;
-            var _ownerOrg_org2, _ownerOrg_org3;
+            var _ref6, _session_id;
+            var _ownerOrg_org3, _ownerOrg_org4;
             // QR payment link on the merchant account, completed by webhook.
-            const ownerProfile = await firestore.collection('profiles').doc(String((_ref4 = ownerOrg == null ? void 0 : (_ownerOrg_org2 = ownerOrg.org) == null ? void 0 : _ownerOrg_org2.ownerUid) != null ? _ref4 : '')).get();
+            const ownerProfile = await firestore.collection('profiles').doc(String((_ref6 = ownerOrg == null ? void 0 : (_ownerOrg_org3 = ownerOrg.org) == null ? void 0 : _ownerOrg_org3.ownerUid) != null ? _ref6 : '')).get();
             const accountId = ownerProfile.get('stripeAccountId');
             if (!merchantAccountIsReady({
                 accountId,
@@ -846,7 +849,7 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
                     channel: 'pos',
                     registerId,
                     cashierId: saleStamp.cashierId
-                }, saleStamp.fields, discountPct > 0 ? {
+                }, saleStamp.fields, hardwareFields, discountPct > 0 ? {
                     discountPct,
                     discountBy: saleStamp.cashierId
                 } : {}, appliedDiscountId ? {
@@ -889,7 +892,7 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
             // origin root rather than a fabricated dead path.
             const posOrigin = `https://${req.headers.host}`;
             const posSubdomain = (await firestore.collection('hostIndex').doc(hostId).get()).get('subdomain');
-            const posOrgSlug = ownerOrg == null ? void 0 : (_ownerOrg_org3 = ownerOrg.org) == null ? void 0 : _ownerOrg_org3.slug;
+            const posOrgSlug = ownerOrg == null ? void 0 : (_ownerOrg_org4 = ownerOrg.org) == null ? void 0 : _ownerOrg_org4.slug;
             const posUrl = posOrgSlug && posSubdomain ? `${posOrigin}${buildRoute(Route.HOST_PLUGIN, {
                 orgSlug: posOrgSlug,
                 host: posSubdomain,
@@ -1051,7 +1054,7 @@ import { posKioskPrincipal } from "./pos-kiosk-principal.js";
                 // THE TENDER, RECORDED (AGL-3607): one settled payment, so this sale
                 // reads the same as a split one rather than by inference.
                 cashierId: saleStamp.cashierId
-            }, saleStamp.fields, {
+            }, saleStamp.fields, hardwareFields, {
                 payments: [
                     _extends({
                         id: `pay_${payment}`,