@aglyn/plugins-commerce 1.0.0-beta.288 → 1.0.0-beta.289

package/src/lib/server/quote-pay.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/quote-pay.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  claimAttempt,\n  deriveStripeObjectKey,\n  resolveTransactionFeeCents,\n  type PluginApiHandler,\n  type PluginApiRequest,\n} from '@aglyn/aglyn/server'\nimport { resolveHostToken, type HostTokenSource } from '@aglyn/aglyn/app-utils/host-tokens'\nimport { readClientIp } from '@aglyn/aglyn/app-utils/request-ip'\nimport { type SiteReturnHost, siteReturnOrigin } from '@aglyn/aglyn/app-utils/site-return-url'\nimport { consumeRateLimit, firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { merchantAccountIsReady } from '@aglyn/tenant-data-admin/server/payment-provider'\nimport { checkoutSessionCardAuthenticationParams } from '@aglyn/tenant-data-admin/server/stripe-card-authentication'\nimport { quotePageHref } from '../constants/quote-page'\nimport * as CommerceModel from '../model'\nimport { expireCheckoutSession, type CheckoutSessionExpiry } from './checkout-session-expiry'\nimport { resolveManualTaxRateId } from './manual-tax-rate'\nimport {\n  applyNativeCheckoutParams,\n  nativeCheckoutStripeHeaders,\n  readCheckoutSessionPayload,\n  resolveNativeCheckoutMode,\n  type NativeCheckoutMode,\n} from './native-checkout'\nimport { orderStatusUrl } from './order-status-token'\nimport { ensureCheckoutDomain } from './payment-method-domains'\nimport { verifyQuoteLinkToken } from './quote-link-token'\n\n/*==========================================\n * THE CUSTOMER'S QUOTE PAGE AND ITS PAY BUTTON (AGL-4094).\n *\n *   GET  /api/commerce/quote-view?hostId=&q=<quoteId>&t=<token>\n *        → 200 QuotePageView | 200 { state: 'replaced', storeName } | 404\n *   POST /api/commerce/quote-pay  { hostId, q, t, v }  + Idempotency-Key\n *        → 200 { url } (Stripe's page) | 200 { clientSecret, publishableKey, sessionId, wallets? }\n *          (the in-page form) | 409 { error, reason } | 410 { error, replaced: true } | 404\n *\n * The signed link (`quote-link-token.ts`) is the whole credential. A wrong\n * token answers exactly as a missing quote does, so neither route tells\n * anyone which quote ids exist; both are rate-limited per address per site\n * BEFORE the token check, so guessing costs what looking does. A link signed\n * for an older version of the quote opens the replaced page and nothing else.\n *\n * Pay opens a FRESH Checkout Session from the stored quote on every press:\n * the prices are the stored lines', never anything the page sends, and the\n * session the previous press opened is expired first, so two sessions for one\n * quote can never both be open. The quote keeps the open one in\n * `checkoutSessionId`. A Stripe session lapses after a day; the quote and its\n * link do not, because the next press opens another.\n *\n * The payment completes in `billing-webhook.ts`, which turns this same\n * document into the order (`paidQuoteOrder`); nothing here marks it paid.\n *=========================================*/\n\n/** Lookups and presses one address may make per site, per ten minutes. */\nexport const QUOTE_VIEW_LOOKUPS_PER_WINDOW = 60\nexport const QUOTE_PAY_PRESSES_PER_WINDOW = 20\nexport const QUOTE_WINDOW_MS = 10 * 60_000\n\nexport interface QuotePayDeps {\n  firestore(): FirebaseFirestore.Firestore\n  consumeRateLimit(key: string, options: { limit: number; windowMs: number }): Promise<{ allowed: boolean; resetMs: number }>\n  orgForHost(hostId: string): Promise<{ id?: string; org?: any } | null>\n  nativeMode(orgId: string): Promise<NativeCheckoutMode>\n  /** The store's manual tax rate as a Stripe tax rate, or null when one cannot be had. */\n  taxRateId(input: Parameters<typeof resolveManualTaxRateId>[0]): Promise<string | null>\n  createSession(\n    params: URLSearchParams,\n    headers: Record<string, string>,\n  ): Promise<{ ok: boolean; session: { id?: string; url?: string; client_secret?: string; error?: unknown } }>\n  expireSession(sessionId: string): Promise<CheckoutSessionExpiry>\n  /** Registers the page's domain for Apple Pay; never throws. */\n  ensureDomain(input: Parameters<typeof ensureCheckoutDomain>[0]): Promise<unknown>\n  now(): number\n}\n\nexport function defaultQuotePayDeps(): QuotePayDeps {\n  return {\n    firestore: () => firebaseAdmin.app().firestore(),\n    consumeRateLimit: (key, options) => consumeRateLimit(key, options),\n    orgForHost: async (hostId) => {\n      const found = await getOrgForHost(hostId)\n      return found ? { id: found.orgId, org: found.org } : null\n    },\n    nativeMode: (orgId) => resolveNativeCheckoutMode(orgId),\n    taxRateId: (input) => resolveManualTaxRateId(input),\n    createSession: async (params, headers) => {\n      const response = await fetch('https://api.stripe.com/v1/checkout/sessions', {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n          'Content-Type': 'application/x-www-form-urlencoded',\n          ...headers,\n        },\n        body: params.toString(),\n      })\n      return { ok: response.ok, session: (await response.json().catch(() => ({}))) as never }\n    },\n    expireSession: (sessionId) => expireCheckoutSession(sessionId),\n    ensureDomain: (input) => ensureCheckoutDomain(input).catch(() => null),\n    now: () => Date.now(),\n  }\n}\n\ntype Outcome = { status: number; body: Record<string, unknown>; headers?: Record<string, string> }\n\nconst DOC_ID = /^(?!__.*__$)[^/]{1,200}$/\n\nconst NOT_FOUND: Outcome = {\n  status: 404,\n  body: { error: 'We could not find that quote. Check the link you were sent.' },\n}\n\nfunction bodyOf(req: PluginApiRequest): Record<string, unknown> {\n  const raw = req.body\n  if (typeof raw === 'string') {\n    try {\n      const parsed = JSON.parse(raw)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return raw && typeof raw === 'object' ? (raw as Record<string, unknown>) : {}\n}\n\nfunction headerOf(req: PluginApiRequest, name: string): string {\n  const headers = (req.headers ?? {}) as Record<string, unknown>\n  const value = headers[name.toLowerCase()] ?? headers[name]\n  return String(Array.isArray(value) ? (value[0] ?? '') : (value ?? '')).trim()\n}\n\nasync function limited(\n  deps: QuotePayDeps,\n  req: PluginApiRequest,\n  key: string,\n  limit: number,\n): Promise<Outcome | null> {\n  const ip = readClientIp(req.headers as never, { remoteAddress: req.socket?.remoteAddress }) ?? 'no-address'\n  const rate = await deps.consumeRateLimit(`${key}:${ip}`, { limit, windowMs: QUOTE_WINDOW_MS })\n  if (rate.allowed) return null\n  return {\n    status: 429,\n    body: { error: 'Too many tries. Try again in a few minutes.' },\n    headers: { 'Retry-After': String(Math.max(1, Math.ceil((rate.resetMs - deps.now()) / 1000))) },\n  }\n}\n\ninterface LoadedQuote {\n  hostRef: FirebaseFirestore.DocumentReference\n  host: Record<string, unknown>\n  order: CommerceModel.HostOrder\n  storeName: string\n  store: FirebaseFirestore.DocumentSnapshot\n}\n\n/**\n * The quote a link names, after its token: the quote, the replaced answer for\n * a link to an older version, or the one not-found answer for everything else.\n */\nasync function loadLinkedQuote(\n  deps: QuotePayDeps,\n  hostId: string,\n  quoteId: string,\n  token: string,\n): Promise<{ loaded: LoadedQuote } | { outcome: Outcome }> {\n  const version = verifyQuoteLinkToken(hostId, quoteId, token)\n  if (version === null) return { outcome: NOT_FOUND }\n  const hostRef = deps.firestore().collection('hosts').doc(hostId)\n  const [hostSnapshot, store, orderSnapshot] = await Promise.all([\n    hostRef.get(),\n    hostRef.collection('settings').doc('store').get(),\n    hostRef.collection('orders').doc(quoteId).get(),\n  ])\n  if (!hostSnapshot.exists || !orderSnapshot.exists) return { outcome: NOT_FOUND }\n  const order = orderSnapshot.data() as CommerceModel.HostOrder\n  if (!CommerceModel.isQuote(order) || !order.quote) return { outcome: NOT_FOUND }\n  const host = (hostSnapshot.data() ?? {}) as Record<string, unknown>\n  const storeName = String(resolveHostToken('businessName', host as HostTokenSource) ?? '')\n  const current = CommerceModel.quoteLinkVersion(order.quote)\n  if (version > current) return { outcome: NOT_FOUND }\n  if (version < current) {\n    return {\n      outcome: {\n        status: 410,\n        body: {\n          state: 'replaced',\n          storeName,\n          replaced: true,\n          error: `This quote was updated, and ${storeName || 'the business'} sent you a newer link.`,\n        },\n      },\n    }\n  }\n  return { loaded: { hostRef, host, order, storeName, store } }\n}\n\nfunction linkParams(req: PluginApiRequest, source: Record<string, unknown>) {\n  const hostId = String(source['hostId'] ?? '')\n  const quoteId = String(source['q'] ?? '').slice(0, 200)\n  const token = String(source['t'] ?? '').slice(0, 200)\n  const complete = DOC_ID.test(hostId) && DOC_ID.test(quoteId) && Boolean(token)\n  return { hostId, quoteId, token, complete }\n}\n\n/** `GET /api/commerce/quote-view`: the quote page's data. */\nexport async function handleQuoteView(deps: QuotePayDeps, req: PluginApiRequest): Promise<Outcome> {\n  if (req.method !== 'GET') return { status: 405, body: { error: 'Method not allowed' } }\n  const { hostId, quoteId, token, complete } = linkParams(req, (req.query ?? {}) as Record<string, unknown>)\n  if (!complete) return { status: 400, body: { error: 'This link is incomplete.' } }\n  const refused = await limited(deps, req, `commerce-quote-view:${hostId}`, QUOTE_VIEW_LOOKUPS_PER_WINDOW)\n  if (refused) return refused\n  const linked = await loadLinkedQuote(deps, hostId, quoteId, token)\n  if ('outcome' in linked) {\n    // The replaced page is a page, not a failure: answered as data.\n    if (linked.outcome.status === 410) {\n      const { storeName } = linked.outcome.body as { storeName: string }\n      return { status: 200, body: { state: 'replaced', storeName } }\n    }\n    return linked.outcome\n  }\n  const { host, order, storeName, store } = linked.loaded\n  const view = CommerceModel.buildQuotePageView({\n    order,\n    orderId: quoteId,\n    storeName,\n    currency: String(store.get('currency') ?? 'USD'),\n    receiptUrl: CommerceModel.isUnpaidQuote(order) ? null : orderStatusUrl(host, hostId, quoteId),\n  })\n  return { status: 200, body: view as unknown as Record<string, unknown> }\n}\n\n/** The Checkout Session a quote's Pay opens, as form params. Pure over its inputs. */\nexport function buildQuoteSessionParams(input: {\n  hostId: string\n  quoteId: string\n  order: CommerceModel.HostOrder\n  charge: CommerceModel.QuoteCheckoutCharge\n  accountId: string\n  feeCents: number\n  taxRateId: string\n  returnUrl: string\n  paymentMethods: CommerceModel.StorefrontPaymentMethodControls\n}): URLSearchParams {\n  const { charge, order } = input\n  const quote = order.quote as CommerceModel.OrderQuote\n  const params = new URLSearchParams({\n    mode: 'payment',\n    ...checkoutSessionCardAuthenticationParams('payment'),\n    ...(charge.taxAtPayment ? { 'automatic_tax[enabled]': 'true' } : {}),\n  })\n  charge.lines.forEach((line, index) => {\n    const at = `line_items[${index}]`\n    params.set(`${at}[quantity]`, '1')\n    params.set(`${at}[price_data][currency]`, 'usd')\n    params.set(`${at}[price_data][unit_amount]`, String(line.amountCents))\n    params.set(`${at}[price_data][product_data][name]`, line.name.slice(0, 120))\n    if (line.description) params.set(`${at}[price_data][product_data][description]`, line.description)\n    // Stripe Tax's nontaxable code, for tax-exempt products and a tax charged as its own line.\n    if (!line.taxable) params.set(`${at}[price_data][product_data][tax_code]`, 'txcd_00000000')\n    if (line.taxable && input.taxRateId) params.set(`${at}[tax_rates][0]`, input.taxRateId)\n  })\n  // Shipping the business priced for the quote's ship-to, charged as the one\n  // option, with the address asked for where it ships (and where Stripe Tax\n  // reads the tax from). The quote's own address stands when it asks nothing.\n  if (charge.shippingCents > 0) {\n    const country = String(quote.shipTo?.country ?? '').toUpperCase()\n    CommerceModel.appendShippingAddressCollectionParams(\n      params,\n      /^[A-Z]{2}$/.test(country) ? [country] : CommerceModel.CHECKOUT_SHIPPING_COUNTRIES,\n    )\n    CommerceModel.appendCheckoutShippingParams(params, [\n      { rateId: 'quote', name: 'Shipping', amountCents: charge.shippingCents },\n    ])\n  }\n  const shippingFloorCents = charge.shippingCents\n  for (const [key, value] of Object.entries(\n    CommerceModel.destinationChargeParams({\n      accountId: input.accountId,\n      feeCents: input.feeCents,\n      taxOwner: charge.taxAtPayment ? 'platform' : 'merchant',\n      merchantGoodsCents: charge.goodsCents,\n      shippingFloorCents,\n    }),\n  )) {\n    params.set(key, value)\n  }\n  const email = String(quote.customer?.email ?? '').trim()\n  if (email) params.set('customer_email', email)\n  const separator = input.returnUrl.includes('?') ? '&' : '?'\n  params.set('success_url', `${input.returnUrl}${separator}session_id={CHECKOUT_SESSION_ID}`)\n  params.set('cancel_url', input.returnUrl)\n  // What the `commerce-draft` webhook branch reads to turn this quote into\n  // its order, and to tell a payment for the quote as it stands from one for\n  // a replaced link or an earlier edit.\n  params.set('metadata[type]', 'commerce-draft')\n  params.set('metadata[hostId]', input.hostId)\n  params.set('metadata[orderId]', input.quoteId)\n  params.set('metadata[quoteId]', input.quoteId)\n  params.set('metadata[quoteLinkVersion]', String(CommerceModel.quoteLinkVersion(quote)))\n  params.set('metadata[quoteUpdatedAtMs]', String(Number(quote.updatedAtMs) || 0))\n  params.set('metadata[feeCents]', String(input.feeCents))\n  // A tax charged as its own line is invisible to Stripe's tax total; this\n  // witness is what records it as the business's tax.\n  if (charge.taxCents > 0 && charge.taxPct === null) {\n    params.set('metadata[taxCents]', String(charge.taxCents))\n  }\n  if (charge.taxAtPayment) {\n    params.set(\n      'metadata[transferCents]',\n      String(\n        CommerceModel.platformLiableTransferCents({\n          feeCents: input.feeCents,\n          merchantGoodsCents: charge.goodsCents,\n          shippingFloorCents,\n        }),\n      ),\n    )\n    params.set('metadata[transferShippingCents]', String(shippingFloorCents))\n  }\n  CommerceModel.appendStorefrontPaymentMethodParams(params, input.paymentMethods)\n  return params\n}\n\nconst QUOTE_UPDATED_MESSAGE = 'This quote was updated since you opened it. Reload the page to see it before you pay.'\n\nconst refusal = (status: number, reason: string, error: string, extra: Record<string, unknown> = {}): Outcome => ({\n  status,\n  body: { error, reason, ...extra },\n})\n\n/** `POST /api/commerce/quote-pay`: a fresh Checkout Session for the quote. */\nexport async function handleQuotePay(deps: QuotePayDeps, req: PluginApiRequest): Promise<Outcome> {\n  if (req.method !== 'POST') return { status: 405, body: { error: 'Method not allowed' } }\n  if (!process.env.STRIPE_SECRET_KEY) return { status: 501, body: { error: 'Payments are not configured.' } }\n  const { hostId, quoteId, token, complete } = linkParams(req, bodyOf(req))\n  if (!complete) return { status: 400, body: { error: 'This link is incomplete.' } }\n  const idempotencyKey = headerOf(req, 'idempotency-key').slice(0, 200)\n  if (!idempotencyKey) return { status: 400, body: { error: 'Paying needs an Idempotency-Key header.' } }\n  const refused = await limited(deps, req, `commerce-quote-pay:${hostId}`, QUOTE_PAY_PRESSES_PER_WINDOW)\n  if (refused) return refused\n  const linked = await loadLinkedQuote(deps, hostId, quoteId, token)\n  if ('outcome' in linked) return linked.outcome\n  const { hostRef, host, order, storeName, store } = linked.loaded\n\n  // Every refusal the customer can be given is above the claim, so none of\n  // them spends the press. `v` is the edit of the quote the page showed: a\n  // quote changed since is shown again before it is paid, never charged unseen.\n  const seen = Number(bodyOf(req)['v'])\n  if (Number.isFinite(seen) && seen > 0 && seen !== (Number(order.quote?.updatedAtMs) || 0)) {\n    return refusal(409, 'updated', QUOTE_UPDATED_MESSAGE)\n  }\n  const blocked = CommerceModel.quotePayRefusal(order, quoteId)\n  if (blocked) return refusal(409, blocked, CommerceModel.quotePayRefusalMessage(blocked, storeName))\n  const owner = await deps.orgForHost(hostId)\n  const unavailable = refusal(\n    409,\n    'payments-unavailable',\n    `${storeName || 'This business'} can’t take payments online right now. Contact them to pay this quote.`,\n  )\n  if (!checkEntitlement(owner?.org as never, 'commerce')) return unavailable\n  const ownerUid = owner?.org?.ownerUid\n  const profile = ownerUid ? await deps.firestore().collection('profiles').doc(String(ownerUid)).get() : null\n  const accountId = profile?.get('stripeAccountId')\n  const ready = merchantAccountIsReady(\n    {\n      accountId,\n      chargesEnabled: profile?.get('stripeChargesEnabled'),\n      accountLivemode: profile?.get('stripeAccountLivemode'),\n    },\n    { subject: `quote ${quoteId} on host ${hostId}` },\n  )\n  if (!ready) return unavailable\n  const taxSettings = (store.get('tax') ?? {}) as CommerceModel.TaxSettings\n  if (CommerceModel.storefrontTaxDecision({ settings: taxSettings }).kind === 'undecided') {\n    return refusal(409, 'tax-undecided', CommerceModel.quotePayRefusalMessage('tax-undecided', storeName))\n  }\n\n  const charge = CommerceModel.quoteCheckoutCharge(order, quoteId)\n  const feeCents = resolveTransactionFeeCents(owner?.org as never, charge.feeProductType, charge.goodsCents, charge.totalCents)\n  const nativeMode = await deps.nativeMode(String(owner?.id ?? ''))\n  const site = host as SiteReturnHost\n  const origin = siteReturnOrigin({\n    candidates: [headerOf(req, 'referer'), `https://${headerOf(req, 'host')}`],\n    site,\n    requestHost: headerOf(req, 'host'),\n  })\n  const returnUrl = `${origin}${quotePageHref(quoteId, token)}`\n  const openedFor = order.checkoutSessionId ?? ''\n  const openedAtEdit = Number(order.quote?.updatedAtMs) || 0\n\n  const claimed = await claimAttempt(deps.firestore(), {\n    kind: 'commerce-quote-pay',\n    scopeId: `${hostId}:${quoteId}`,\n    orgId: String(owner?.id ?? ''),\n    key: idempotencyKey,\n    busyMessage: 'Your payment is already being set up',\n  })\n  if ('replay' in claimed) {\n    return { status: claimed.replay.status, body: claimed.replay.body as Record<string, unknown> }\n  }\n  const claim = claimed.claim\n  const stripeKey = (object: string): Record<string, string> => {\n    const derived = deriveStripeObjectKey(claim.stripeKey, object)\n    return derived ? { 'Idempotency-Key': derived } : {}\n  }\n  let minted = ''\n  try {\n    // The session the last press opened is closed before another opens. One\n    // that was paid a moment ago means the quote is paid; one that cannot be\n    // closed means a second session would be a second way to pay.\n    if (openedFor) {\n      const previous = await deps.expireSession(openedFor)\n      if (previous === 'complete') {\n        await claim.release()\n        return refusal(409, 'paid', 'This quote has just been paid. Your receipt is on its way.', { confirming: true })\n      }\n      if (previous === 'open') {\n        await claim.release()\n        return { status: 502, body: { error: 'Your payment could not be set up. Try again.' } }\n      }\n    }\n\n    let taxRateId = ''\n    if (charge.taxPct !== null && charge.taxableCents > 0) {\n      const basis = order.quote?.tax\n      taxRateId =\n        (await deps.taxRateId({\n          hostRef,\n          taxPct: charge.taxPct,\n          taxLabel:\n            basis?.kind === 'rate'\n              ? basis.label || `Tax (${charge.taxPct}%)`\n              : 'Sales tax',\n          headers: stripeKey(`tax-rate-${Math.round(charge.taxPct * 10_000)}`),\n        })) ?? ''\n      if (!taxRateId) {\n        // Never an untaxed session for a taxed quote.\n        await claim.release()\n        return { status: 502, body: { error: 'Your payment could not be set up. Try again.' } }\n      }\n    }\n\n    const paymentMethods = CommerceModel.resolveStorefrontPaymentMethodControls(\n      CommerceModel.normalizeStorefrontPaymentMethodSettings(store.get('paymentMethods')),\n    )\n    const params = buildQuoteSessionParams({\n      hostId,\n      quoteId,\n      order,\n      charge,\n      accountId: String(accountId),\n      feeCents,\n      taxRateId,\n      returnUrl,\n      paymentMethods,\n    })\n    if (nativeMode.native) {\n      applyNativeCheckoutParams(params, params.get('success_url') ?? returnUrl)\n    }\n    const domain = nativeMode.native\n      ? deps.ensureDomain({ pageUrl: returnUrl, site, hostId })\n      : Promise.resolve(null)\n    const created = await deps.createSession(params, {\n      ...stripeKey('session'),\n      ...nativeCheckoutStripeHeaders(nativeMode),\n    })\n    await domain\n    const payload = created.ok\n      ? readCheckoutSessionPayload(created.session, nativeMode, paymentMethods.wallets)\n      : null\n    if (!payload || !created.session.id) {\n      console.error('Stripe quote checkout error', created.session?.error)\n      await claim.release()\n      return { status: 502, body: { error: 'Your payment could not be set up. Try again.' } }\n    }\n    minted = String(created.session.id)\n\n    // The quote keeps the session it now has open. Whatever another press\n    // stored meanwhile is closed after, so the last press is the one open\n    // session; a quote that was paid, replaced or edited meanwhile closes\n    // this one instead.\n    const orderRef = hostRef.collection('orders').doc(quoteId)\n    const settled = await deps.firestore().runTransaction(async (transaction) => {\n      const snapshot = await transaction.get(orderRef)\n      const current = snapshot.exists ? (snapshot.data() as CommerceModel.HostOrder) : null\n      if (!current || !CommerceModel.isQuote(current)) return { outcome: NOT_FOUND, displaced: '' }\n      if (!CommerceModel.isUnpaidQuote(current)) {\n        return {\n          outcome: refusal(409, 'paid', CommerceModel.quotePayRefusalMessage('paid', storeName)),\n          displaced: '',\n        }\n      }\n      if (CommerceModel.quoteLinkVersion(current.quote) !== CommerceModel.quoteLinkVersion(order.quote)) {\n        return {\n          outcome: {\n            status: 410,\n            body: { replaced: true, error: `This quote was updated, and ${storeName || 'the business'} sent you a newer link.` },\n          },\n          displaced: '',\n        }\n      }\n      if ((Number(current.quote?.updatedAtMs) || 0) !== openedAtEdit) {\n        return { outcome: refusal(409, 'updated', QUOTE_UPDATED_MESSAGE), displaced: '' }\n      }\n      transaction.set(orderRef, { checkoutSessionId: minted }, { merge: true })\n      const displaced = current.checkoutSessionId && current.checkoutSessionId !== openedFor ? current.checkoutSessionId : ''\n      return { outcome: null, displaced }\n    })\n    if (settled.outcome) {\n      await deps.expireSession(minted)\n      await claim.release()\n      return settled.outcome\n    }\n    if (settled.displaced && settled.displaced !== minted) await deps.expireSession(settled.displaced)\n    await claim.record(200, payload)\n    return { status: 200, body: payload as unknown as Record<string, unknown> }\n  } catch (error) {\n    console.error('quote pay failed', error)\n    if (minted) await deps.expireSession(minted).catch(() => 'open')\n    await claim.release()\n    return { status: 500, body: { error: 'Your payment could not be set up. Try again.' } }\n  }\n}\n\nfunction send(res: Parameters<PluginApiHandler>[1], outcome: Outcome) {\n  res.setHeader('Cache-Control', 'private, no-store')\n  res.setHeader('X-Robots-Tag', 'noindex, nofollow')\n  for (const [name, value] of Object.entries(outcome.headers ?? {})) res.setHeader(name, value)\n  return res.status(outcome.status).json(outcome.body)\n}\n\n/** `GET /api/commerce/quote-view`. */\nexport const quoteViewHandler: PluginApiHandler = async (req, res) => {\n  try {\n    return send(res, await handleQuoteView(defaultQuotePayDeps(), req))\n  } catch (error) {\n    console.error('quote view failed', error)\n    return send(res, { status: 500, body: { error: 'This quote could not be loaded. Try again.' } })\n  }\n}\n\n/** `POST /api/commerce/quote-pay`. */\nexport const quotePayHandler: PluginApiHandler = async (req, res) =>\n  send(res, await handleQuotePay(defaultQuotePayDeps(), req))\n"],"names":["checkEntitlement","claimAttempt","deriveStripeObjectKey","resolveTransactionFeeCents","resolveHostToken","readClientIp","siteReturnOrigin","consumeRateLimit","firebaseAdmin","getOrgForHost","merchantAccountIsReady","checkoutSessionCardAuthenticationParams","quotePageHref","CommerceModel","expireCheckoutSession","resolveManualTaxRateId","applyNativeCheckoutParams","nativeCheckoutStripeHeaders","readCheckoutSessionPayload","resolveNativeCheckoutMode","orderStatusUrl","ensureCheckoutDomain","verifyQuoteLinkToken","QUOTE_VIEW_LOOKUPS_PER_WINDOW","QUOTE_PAY_PRESSES_PER_WINDOW","QUOTE_WINDOW_MS","defaultQuotePayDeps","firestore","app","key","options","orgForHost","hostId","found","id","orgId","org","nativeMode","taxRateId","input","createSession","params","headers","response","fetch","method","Authorization","process","env","STRIPE_SECRET_KEY","body","toString","ok","session","json","catch","expireSession","sessionId","ensureDomain","now","Date","DOC_ID","NOT_FOUND","status","error","bodyOf","req","raw","parsed","JSON","parse","headerOf","name","value","toLowerCase","String","Array","isArray","trim","limited","deps","limit","ip","remoteAddress","socket","rate","windowMs","allowed","Math","max","ceil","resetMs","loadLinkedQuote","quoteId","token","hostSnapshot","version","outcome","hostRef","collection","doc","store","orderSnapshot","Promise","all","get","exists","order","data","isQuote","quote","host","storeName","current","quoteLinkVersion","state","replaced","loaded","linkParams","source","slice","complete","test","Boolean","handleQuoteView","query","refused","linked","view","buildQuotePageView","orderId","currency","receiptUrl","isUnpaidQuote","buildQuoteSessionParams","charge","URLSearchParams","mode","taxAtPayment","lines","forEach","line","index","at","set","amountCents","description","taxable","shippingCents","country","shipTo","toUpperCase","appendShippingAddressCollectionParams","CHECKOUT_SHIPPING_COUNTRIES","appendCheckoutShippingParams","rateId","shippingFloorCents","Object","entries","destinationChargeParams","accountId","feeCents","taxOwner","merchantGoodsCents","goodsCents","email","customer","separator","returnUrl","includes","Number","updatedAtMs","taxCents","taxPct","platformLiableTransferCents","appendStorefrontPaymentMethodParams","paymentMethods","QUOTE_UPDATED_MESSAGE","refusal","reason","extra","handleQuotePay","owner","idempotencyKey","seen","isFinite","blocked","quotePayRefusal","quotePayRefusalMessage","unavailable","ownerUid","profile","ready","chargesEnabled","accountLivemode","subject","taxSettings","storefrontTaxDecision","settings","kind","quoteCheckoutCharge","feeProductType","totalCents","site","origin","candidates","requestHost","openedFor","checkoutSessionId","openedAtEdit","claimed","scopeId","busyMessage","replay","claim","stripeKey","object","derived","minted","previous","release","confirming","taxableCents","basis","tax","taxLabel","label","round","resolveStorefrontPaymentMethodControls","normalizeStorefrontPaymentMethodSettings","native","domain","pageUrl","resolve","created","payload","wallets","console","orderRef","settled","runTransaction","transaction","snapshot","displaced","merge","record","send","res","setHeader","quoteViewHandler","quotePayHandler"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,YAAY,EACZC,qBAAqB,EACrBC,0BAA0B,QAGrB,sBAAqB;AAC5B,SAASC,gBAAgB,QAA8B,qCAAoC;AAC3F,SAASC,YAAY,QAAQ,oCAAmC;AAChE,SAA8BC,gBAAgB,QAAQ,yCAAwC;AAC9F,SAASC,gBAAgB,EAAEC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACzF,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SAASC,uCAAuC,QAAQ,6DAA4D;AACpH,SAASC,aAAa,QAAQ,6BAAyB;AACvD,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,qBAAqB,QAAoC,+BAA2B;AAC7F,SAASC,sBAAsB,QAAQ,uBAAmB;AAC1D,SACEC,yBAAyB,EACzBC,2BAA2B,EAC3BC,0BAA0B,EAC1BC,yBAAyB,QAEpB,uBAAmB;AAC1B,SAASC,cAAc,QAAQ,0BAAsB;AACrD,SAASC,oBAAoB,QAAQ,8BAA0B;AAC/D,SAASC,oBAAoB,QAAQ,wBAAoB;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;2CAwB2C,GAE3C,wEAAwE,GACxE,OAAO,MAAMC,gCAAgC,GAAE;AAC/C,OAAO,MAAMC,+BAA+B,GAAE;AAC9C,OAAO,MAAMC,kBAAkB,KAAK,MAAM;AAmB1C,OAAO,SAASC;IACd,OAAO;QACLC,WAAW,IAAMnB,cAAcoB,GAAG,GAAGD,SAAS;QAC9CpB,kBAAkB,CAACsB,KAAKC,UAAYvB,iBAAiBsB,KAAKC;QAC1DC,YAAY,OAAOC;YACjB,MAAMC,QAAQ,MAAMxB,cAAcuB;YAClC,OAAOC,QAAQ;gBAAEC,IAAID,MAAME,KAAK;gBAAEC,KAAKH,MAAMG,GAAG;YAAC,IAAI;QACvD;QACAC,YAAY,CAACF,QAAUhB,0BAA0BgB;QACjDG,WAAW,CAACC,QAAUxB,uBAAuBwB;QAC7CC,eAAe,OAAOC,QAAQC;YAC5B,MAAMC,WAAW,MAAMC,MAAM,+CAA+C;gBAC1EC,QAAQ;gBACRH,SAAS;oBACPI,eAAe,CAAC,OAAO,EAAEC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;oBACxD,gBAAgB;mBACbP;gBAELQ,MAAMT,OAAOU,QAAQ;YACvB;YACA,OAAO;gBAAEC,IAAIT,SAASS,EAAE;gBAAEC,SAAU,MAAMV,SAASW,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;YAAc;QACxF;QACAC,eAAe,CAACC,YAAc3C,sBAAsB2C;QACpDC,cAAc,CAACnB,QAAUlB,qBAAqBkB,OAAOgB,KAAK,CAAC,IAAM;QACjEI,KAAK,IAAMC,KAAKD,GAAG;IACrB;AACF;AAIA,MAAME,SAAS;AAEf,MAAMC,YAAqB;IACzBC,QAAQ;IACRb,MAAM;QAAEc,OAAO;IAA8D;AAC/E;AAEA,SAASC,OAAOC,GAAqB;IACnC,MAAMC,MAAMD,IAAIhB,IAAI;IACpB,IAAI,OAAOiB,QAAQ,UAAU;QAC3B,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACH;YAC1B,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOD,OAAO,OAAOA,QAAQ,WAAYA,MAAkC,CAAC;AAC9E;AAEA,SAASI,SAASL,GAAqB,EAAEM,IAAY;QAClCN,cACHxB,2BACwB+B;IAFtC,MAAM/B,WAAWwB,eAAAA,IAAIxB,OAAO,YAAXwB,eAAe,CAAC;IACjC,MAAMO,SAAQ/B,4BAAAA,OAAO,CAAC8B,KAAKE,WAAW,GAAG,YAA3BhC,4BAA+BA,OAAO,CAAC8B,KAAK;IAC1D,OAAOG,OAAOC,MAAMC,OAAO,CAACJ,UAAUA,UAAAA,KAAK,CAAC,EAAE,YAARA,UAAY,KAAOA,gBAAAA,QAAS,IAAKK,IAAI;AAC7E;AAEA,eAAeC,QACbC,IAAkB,EAClBd,GAAqB,EACrBrC,GAAW,EACXoD,KAAa;QAEF5E;QAAoD6D;IAA/D,MAAMgB,MAAK7E,gBAAAA,aAAa6D,IAAIxB,OAAO,EAAW;QAAEyC,aAAa,GAAEjB,cAAAA,IAAIkB,MAAM,qBAAVlB,YAAYiB,aAAa;IAAC,cAA9E9E,gBAAoF;IAC/F,MAAMgF,OAAO,MAAML,KAAKzE,gBAAgB,CAAC,GAAGsB,IAAI,CAAC,EAAEqD,IAAI,EAAE;QAAED;QAAOK,UAAU7D;IAAgB;IAC5F,IAAI4D,KAAKE,OAAO,EAAE,OAAO;IACzB,OAAO;QACLxB,QAAQ;QACRb,MAAM;YAAEc,OAAO;QAA8C;QAC7DtB,SAAS;YAAE,eAAeiC,OAAOa,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACL,CAAAA,KAAKM,OAAO,GAAGX,KAAKrB,GAAG,EAAC,IAAK;QAAQ;IAC/F;AACF;AAUA;;;CAGC,GACD,eAAeiC,gBACbZ,IAAkB,EAClBhD,MAAc,EACd6D,OAAe,EACfC,KAAa;QAaCC,oBACW3F;IAZzB,MAAM4F,UAAU1E,qBAAqBU,QAAQ6D,SAASC;IACtD,IAAIE,YAAY,MAAM,OAAO;QAAEC,SAASnC;IAAU;IAClD,MAAMoC,UAAUlB,KAAKrD,SAAS,GAAGwE,UAAU,CAAC,SAASC,GAAG,CAACpE;IACzD,MAAM,CAAC+D,cAAcM,OAAOC,cAAc,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC7DN,QAAQO,GAAG;QACXP,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAAC,SAASK,GAAG;QAC/CP,QAAQC,UAAU,CAAC,UAAUC,GAAG,CAACP,SAASY,GAAG;KAC9C;IACD,IAAI,CAACV,aAAaW,MAAM,IAAI,CAACJ,cAAcI,MAAM,EAAE,OAAO;QAAET,SAASnC;IAAU;IAC/E,MAAM6C,QAAQL,cAAcM,IAAI;IAChC,IAAI,CAAC/F,cAAcgG,OAAO,CAACF,UAAU,CAACA,MAAMG,KAAK,EAAE,OAAO;QAAEb,SAASnC;IAAU;IAC/E,MAAMiD,QAAQhB,qBAAAA,aAAaa,IAAI,cAAjBb,qBAAuB,CAAC;IACtC,MAAMiB,YAAYrC,QAAOvE,oBAAAA,iBAAiB,gBAAgB2G,iBAAjC3G,oBAA6D;IACtF,MAAM6G,UAAUpG,cAAcqG,gBAAgB,CAACP,MAAMG,KAAK;IAC1D,IAAId,UAAUiB,SAAS,OAAO;QAAEhB,SAASnC;IAAU;IACnD,IAAIkC,UAAUiB,SAAS;QACrB,OAAO;YACLhB,SAAS;gBACPlC,QAAQ;gBACRb,MAAM;oBACJiE,OAAO;oBACPH;oBACAI,UAAU;oBACVpD,OAAO,CAAC,4BAA4B,EAAEgD,aAAa,eAAe,uBAAuB,CAAC;gBAC5F;YACF;QACF;IACF;IACA,OAAO;QAAEK,QAAQ;YAAEnB;YAASa;YAAMJ;YAAOK;YAAWX;QAAM;IAAE;AAC9D;AAEA,SAASiB,WAAWpD,GAAqB,EAAEqD,MAA+B;QAClDA,gBACCA,WACFA;IAFrB,MAAMvF,SAAS2C,QAAO4C,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB;IAC1C,MAAM1B,UAAUlB,QAAO4C,YAAAA,MAAM,CAAC,IAAI,YAAXA,YAAe,IAAIC,KAAK,CAAC,GAAG;IACnD,MAAM1B,QAAQnB,QAAO4C,YAAAA,MAAM,CAAC,IAAI,YAAXA,YAAe,IAAIC,KAAK,CAAC,GAAG;IACjD,MAAMC,WAAW5D,OAAO6D,IAAI,CAAC1F,WAAW6B,OAAO6D,IAAI,CAAC7B,YAAY8B,QAAQ7B;IACxE,OAAO;QAAE9D;QAAQ6D;QAASC;QAAO2B;IAAS;AAC5C;AAEA,2DAA2D,GAC3D,OAAO,eAAeG,gBAAgB5C,IAAkB,EAAEd,GAAqB;QAEfA,YAkB3CmC;IAnBnB,IAAInC,IAAIrB,MAAM,KAAK,OAAO,OAAO;QAAEkB,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAAqB;IAAE;IACtF,MAAM,EAAEhC,MAAM,EAAE6D,OAAO,EAAEC,KAAK,EAAE2B,QAAQ,EAAE,GAAGH,WAAWpD,MAAMA,aAAAA,IAAI2D,KAAK,YAAT3D,aAAa,CAAC;IAC5E,IAAI,CAACuD,UAAU,OAAO;QAAE1D,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA2B;IAAE;IACjF,MAAM8D,UAAU,MAAM/C,QAAQC,MAAMd,KAAK,CAAC,oBAAoB,EAAElC,QAAQ,EAAET;IAC1E,IAAIuG,SAAS,OAAOA;IACpB,MAAMC,SAAS,MAAMnC,gBAAgBZ,MAAMhD,QAAQ6D,SAASC;IAC5D,IAAI,aAAaiC,QAAQ;QACvB,gEAAgE;QAChE,IAAIA,OAAO9B,OAAO,CAAClC,MAAM,KAAK,KAAK;YACjC,MAAM,EAAEiD,SAAS,EAAE,GAAGe,OAAO9B,OAAO,CAAC/C,IAAI;YACzC,OAAO;gBAAEa,QAAQ;gBAAKb,MAAM;oBAAEiE,OAAO;oBAAYH;gBAAU;YAAE;QAC/D;QACA,OAAOe,OAAO9B,OAAO;IACvB;IACA,MAAM,EAAEc,IAAI,EAAEJ,KAAK,EAAEK,SAAS,EAAEX,KAAK,EAAE,GAAG0B,OAAOV,MAAM;IACvD,MAAMW,OAAOnH,cAAcoH,kBAAkB,CAAC;QAC5CtB;QACAuB,SAASrC;QACTmB;QACAmB,UAAUxD,QAAO0B,aAAAA,MAAMI,GAAG,CAAC,uBAAVJ,aAAyB;QAC1C+B,YAAYvH,cAAcwH,aAAa,CAAC1B,SAAS,OAAOvF,eAAe2F,MAAM/E,QAAQ6D;IACvF;IACA,OAAO;QAAE9B,QAAQ;QAAKb,MAAM8E;IAA2C;AACzE;AAEA,oFAAoF,GACpF,OAAO,SAASM,wBAAwB/F,KAUvC;;QA4CsBuE;IA3CrB,MAAM,EAAEyB,MAAM,EAAE5B,KAAK,EAAE,GAAGpE;IAC1B,MAAMuE,QAAQH,MAAMG,KAAK;IACzB,MAAMrE,SAAS,IAAI+F,gBAAgB;QACjCC,MAAM;OACH9H,wCAAwC,YACvC4H,OAAOG,YAAY,GAAG;QAAE,0BAA0B;IAAO,IAAI,CAAC;IAEpEH,OAAOI,KAAK,CAACC,OAAO,CAAC,CAACC,MAAMC;QAC1B,MAAMC,KAAK,CAAC,WAAW,EAAED,MAAM,CAAC,CAAC;QACjCrG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,UAAU,CAAC,EAAE;QAC9BtG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,sBAAsB,CAAC,EAAE;QAC1CtG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,yBAAyB,CAAC,EAAEpE,OAAOkE,KAAKI,WAAW;QACpExG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,gCAAgC,CAAC,EAAEF,KAAKrE,IAAI,CAACgD,KAAK,CAAC,GAAG;QACvE,IAAIqB,KAAKK,WAAW,EAAEzG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,uCAAuC,CAAC,EAAEF,KAAKK,WAAW;QACjG,2FAA2F;QAC3F,IAAI,CAACL,KAAKM,OAAO,EAAE1G,OAAOuG,GAAG,CAAC,GAAGD,GAAG,oCAAoC,CAAC,EAAE;QAC3E,IAAIF,KAAKM,OAAO,IAAI5G,MAAMD,SAAS,EAAEG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,cAAc,CAAC,EAAExG,MAAMD,SAAS;IACxF;IACA,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAIiG,OAAOa,aAAa,GAAG,GAAG;;YACLtC;QAAvB,MAAMuC,UAAU1E,iBAAOmC,gBAAAA,MAAMwC,MAAM,qBAAZxC,cAAcuC,OAAO,oBAAI,IAAIE,WAAW;QAC/D1I,cAAc2I,qCAAqC,CACjD/G,QACA,aAAaiF,IAAI,CAAC2B,WAAW;YAACA;SAAQ,GAAGxI,cAAc4I,2BAA2B;QAEpF5I,cAAc6I,4BAA4B,CAACjH,QAAQ;YACjD;gBAAEkH,QAAQ;gBAASnF,MAAM;gBAAYyE,aAAaV,OAAOa,aAAa;YAAC;SACxE;IACH;IACA,MAAMQ,qBAAqBrB,OAAOa,aAAa;IAC/C,KAAK,MAAM,CAACvH,KAAK4C,MAAM,IAAIoF,OAAOC,OAAO,CACvCjJ,cAAckJ,uBAAuB,CAAC;QACpCC,WAAWzH,MAAMyH,SAAS;QAC1BC,UAAU1H,MAAM0H,QAAQ;QACxBC,UAAU3B,OAAOG,YAAY,GAAG,aAAa;QAC7CyB,oBAAoB5B,OAAO6B,UAAU;QACrCR;IACF,IACC;QACDnH,OAAOuG,GAAG,CAACnH,KAAK4C;IAClB;IACA,MAAM4F,QAAQ1F,gBAAOmC,kBAAAA,MAAMwD,QAAQ,qBAAdxD,gBAAgBuD,KAAK,mBAAI,IAAIvF,IAAI;IACtD,IAAIuF,OAAO5H,OAAOuG,GAAG,CAAC,kBAAkBqB;IACxC,MAAME,YAAYhI,MAAMiI,SAAS,CAACC,QAAQ,CAAC,OAAO,MAAM;IACxDhI,OAAOuG,GAAG,CAAC,eAAe,GAAGzG,MAAMiI,SAAS,GAAGD,UAAU,gCAAgC,CAAC;IAC1F9H,OAAOuG,GAAG,CAAC,cAAczG,MAAMiI,SAAS;IACxC,yEAAyE;IACzE,2EAA2E;IAC3E,sCAAsC;IACtC/H,OAAOuG,GAAG,CAAC,kBAAkB;IAC7BvG,OAAOuG,GAAG,CAAC,oBAAoBzG,MAAMP,MAAM;IAC3CS,OAAOuG,GAAG,CAAC,qBAAqBzG,MAAMsD,OAAO;IAC7CpD,OAAOuG,GAAG,CAAC,qBAAqBzG,MAAMsD,OAAO;IAC7CpD,OAAOuG,GAAG,CAAC,8BAA8BrE,OAAO9D,cAAcqG,gBAAgB,CAACJ;IAC/ErE,OAAOuG,GAAG,CAAC,8BAA8BrE,OAAO+F,OAAO5D,MAAM6D,WAAW,KAAK;IAC7ElI,OAAOuG,GAAG,CAAC,sBAAsBrE,OAAOpC,MAAM0H,QAAQ;IACtD,yEAAyE;IACzE,oDAAoD;IACpD,IAAI1B,OAAOqC,QAAQ,GAAG,KAAKrC,OAAOsC,MAAM,KAAK,MAAM;QACjDpI,OAAOuG,GAAG,CAAC,sBAAsBrE,OAAO4D,OAAOqC,QAAQ;IACzD;IACA,IAAIrC,OAAOG,YAAY,EAAE;QACvBjG,OAAOuG,GAAG,CACR,2BACArE,OACE9D,cAAciK,2BAA2B,CAAC;YACxCb,UAAU1H,MAAM0H,QAAQ;YACxBE,oBAAoB5B,OAAO6B,UAAU;YACrCR;QACF;QAGJnH,OAAOuG,GAAG,CAAC,mCAAmCrE,OAAOiF;IACvD;IACA/I,cAAckK,mCAAmC,CAACtI,QAAQF,MAAMyI,cAAc;IAC9E,OAAOvI;AACT;AAEA,MAAMwI,wBAAwB;AAE9B,MAAMC,UAAU,CAACnH,QAAgBoH,QAAgBnH,OAAeoH,QAAiC,CAAC,CAAC,GAAe,CAAA;QAChHrH;QACAb,MAAM;YAAEc;YAAOmH;WAAWC;IAC5B,CAAA;AAEA,4EAA4E,GAC5E,OAAO,eAAeC,eAAerG,IAAkB,EAAEd,GAAqB;QAyCvDmC,kBAeHM;QAvCwCA,cAYzC2E,YA4BW3E;IAxD5B,IAAIzC,IAAIrB,MAAM,KAAK,QAAQ,OAAO;QAAEkB,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAAqB;IAAE;IACvF,IAAI,CAACjB,QAAQC,GAAG,CAACC,iBAAiB,EAAE,OAAO;QAAEc,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA+B;IAAE;IAC1G,MAAM,EAAEhC,MAAM,EAAE6D,OAAO,EAAEC,KAAK,EAAE2B,QAAQ,EAAE,GAAGH,WAAWpD,KAAKD,OAAOC;IACpE,IAAI,CAACuD,UAAU,OAAO;QAAE1D,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA2B;IAAE;IACjF,MAAMuH,iBAAiBhH,SAASL,KAAK,mBAAmBsD,KAAK,CAAC,GAAG;IACjE,IAAI,CAAC+D,gBAAgB,OAAO;QAAExH,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA0C;IAAE;IACtG,MAAM8D,UAAU,MAAM/C,QAAQC,MAAMd,KAAK,CAAC,mBAAmB,EAAElC,QAAQ,EAAER;IACzE,IAAIsG,SAAS,OAAOA;IACpB,MAAMC,SAAS,MAAMnC,gBAAgBZ,MAAMhD,QAAQ6D,SAASC;IAC5D,IAAI,aAAaiC,QAAQ,OAAOA,OAAO9B,OAAO;IAC9C,MAAM,EAAEC,OAAO,EAAEa,IAAI,EAAEJ,KAAK,EAAEK,SAAS,EAAEX,KAAK,EAAE,GAAG0B,OAAOV,MAAM;IAEhE,yEAAyE;IACzE,yEAAyE;IACzE,8EAA8E;IAC9E,MAAMmE,OAAOd,OAAOzG,OAAOC,IAAI,CAAC,IAAI;IACpC,IAAIwG,OAAOe,QAAQ,CAACD,SAASA,OAAO,KAAKA,SAAUd,CAAAA,QAAO/D,eAAAA,MAAMG,KAAK,qBAAXH,aAAagE,WAAW,KAAK,CAAA,GAAI;QACzF,OAAOO,QAAQ,KAAK,WAAWD;IACjC;IACA,MAAMS,UAAU7K,cAAc8K,eAAe,CAAChF,OAAOd;IACrD,IAAI6F,SAAS,OAAOR,QAAQ,KAAKQ,SAAS7K,cAAc+K,sBAAsB,CAACF,SAAS1E;IACxF,MAAMsE,QAAQ,MAAMtG,KAAKjD,UAAU,CAACC;IACpC,MAAM6J,cAAcX,QAClB,KACA,wBACA,GAAGlE,aAAa,gBAAgB,sEAAsE,CAAC;IAEzG,IAAI,CAAChH,iBAAiBsL,yBAAAA,MAAOlJ,GAAG,EAAW,aAAa,OAAOyJ;IAC/D,MAAMC,WAAWR,0BAAAA,aAAAA,MAAOlJ,GAAG,qBAAVkJ,WAAYQ,QAAQ;IACrC,MAAMC,UAAUD,WAAW,MAAM9G,KAAKrD,SAAS,GAAGwE,UAAU,CAAC,YAAYC,GAAG,CAACzB,OAAOmH,WAAWrF,GAAG,KAAK;IACvG,MAAMuD,YAAY+B,2BAAAA,QAAStF,GAAG,CAAC;IAC/B,MAAMuF,QAAQtL,uBACZ;QACEsJ;QACAiC,cAAc,EAAEF,2BAAAA,QAAStF,GAAG,CAAC;QAC7ByF,eAAe,EAAEH,2BAAAA,QAAStF,GAAG,CAAC;IAChC,GACA;QAAE0F,SAAS,CAAC,MAAM,EAAEtG,QAAQ,SAAS,EAAE7D,QAAQ;IAAC;IAElD,IAAI,CAACgK,OAAO,OAAOH;IACnB,MAAMO,eAAe/F,aAAAA,MAAMI,GAAG,CAAC,kBAAVJ,aAAoB,CAAC;IAC1C,IAAIxF,cAAcwL,qBAAqB,CAAC;QAAEC,UAAUF;IAAY,GAAGG,IAAI,KAAK,aAAa;QACvF,OAAOrB,QAAQ,KAAK,iBAAiBrK,cAAc+K,sBAAsB,CAAC,iBAAiB5E;IAC7F;IAEA,MAAMuB,SAAS1H,cAAc2L,mBAAmB,CAAC7F,OAAOd;IACxD,MAAMoE,WAAW9J,2BAA2BmL,yBAAAA,MAAOlJ,GAAG,EAAWmG,OAAOkE,cAAc,EAAElE,OAAO6B,UAAU,EAAE7B,OAAOmE,UAAU;IAC5H,MAAMrK,aAAa,MAAM2C,KAAK3C,UAAU,CAACsC,eAAO2G,yBAAAA,MAAOpJ,EAAE,mBAAI;IAC7D,MAAMyK,OAAO5F;IACb,MAAM6F,SAAStM,iBAAiB;QAC9BuM,YAAY;YAACtI,SAASL,KAAK;YAAY,CAAC,QAAQ,EAAEK,SAASL,KAAK,SAAS;SAAC;QAC1EyI;QACAG,aAAavI,SAASL,KAAK;IAC7B;IACA,MAAMsG,YAAY,GAAGoC,SAAShM,cAAciF,SAASC,QAAQ;IAC7D,MAAMiH,aAAYpG,2BAAAA,MAAMqG,iBAAiB,YAAvBrG,2BAA2B;IAC7C,MAAMsG,eAAevC,QAAO/D,gBAAAA,MAAMG,KAAK,qBAAXH,cAAagE,WAAW,KAAK;IAEzD,MAAMuC,UAAU,MAAMjN,aAAa+E,KAAKrD,SAAS,IAAI;QACnD4K,MAAM;QACNY,SAAS,GAAGnL,OAAO,CAAC,EAAE6D,SAAS;QAC/B1D,OAAOwC,gBAAO2G,yBAAAA,MAAOpJ,EAAE,oBAAI;QAC3BL,KAAK0J;QACL6B,aAAa;IACf;IACA,IAAI,YAAYF,SAAS;QACvB,OAAO;YAAEnJ,QAAQmJ,QAAQG,MAAM,CAACtJ,MAAM;YAAEb,MAAMgK,QAAQG,MAAM,CAACnK,IAAI;QAA4B;IAC/F;IACA,MAAMoK,QAAQJ,QAAQI,KAAK;IAC3B,MAAMC,YAAY,CAACC;QACjB,MAAMC,UAAUvN,sBAAsBoN,MAAMC,SAAS,EAAEC;QACvD,OAAOC,UAAU;YAAE,mBAAmBA;QAAQ,IAAI,CAAC;IACrD;IACA,IAAIC,SAAS;IACb,IAAI;QACF,wEAAwE;QACxE,yEAAyE;QACzE,8DAA8D;QAC9D,IAAIX,WAAW;YACb,MAAMY,WAAW,MAAM3I,KAAKxB,aAAa,CAACuJ;YAC1C,IAAIY,aAAa,YAAY;gBAC3B,MAAML,MAAMM,OAAO;gBACnB,OAAO1C,QAAQ,KAAK,QAAQ,8DAA8D;oBAAE2C,YAAY;gBAAK;YAC/G;YACA,IAAIF,aAAa,QAAQ;gBACvB,MAAML,MAAMM,OAAO;gBACnB,OAAO;oBAAE7J,QAAQ;oBAAKb,MAAM;wBAAEc,OAAO;oBAA+C;gBAAE;YACxF;QACF;QAEA,IAAI1B,YAAY;QAChB,IAAIiG,OAAOsC,MAAM,KAAK,QAAQtC,OAAOuF,YAAY,GAAG,GAAG;gBAGlD;gBAFWnH;YAAd,MAAMoH,SAAQpH,gBAAAA,MAAMG,KAAK,qBAAXH,cAAaqH,GAAG;YAC9B1L,aACG,QAAA,MAAM0C,KAAK1C,SAAS,CAAC;gBACpB4D;gBACA2E,QAAQtC,OAAOsC,MAAM;gBACrBoD,UACEF,CAAAA,yBAAAA,MAAOxB,IAAI,MAAK,SACZwB,MAAMG,KAAK,IAAI,CAAC,KAAK,EAAE3F,OAAOsC,MAAM,CAAC,EAAE,CAAC,GACxC;gBACNnI,SAAS6K,UAAU,CAAC,SAAS,EAAE/H,KAAK2I,KAAK,CAAC5F,OAAOsC,MAAM,GAAG,QAAS;YACrE,cARC,QAQM;YACT,IAAI,CAACvI,WAAW;gBACd,8CAA8C;gBAC9C,MAAMgL,MAAMM,OAAO;gBACnB,OAAO;oBAAE7J,QAAQ;oBAAKb,MAAM;wBAAEc,OAAO;oBAA+C;gBAAE;YACxF;QACF;QAEA,MAAMgH,iBAAiBnK,cAAcuN,sCAAsC,CACzEvN,cAAcwN,wCAAwC,CAAChI,MAAMI,GAAG,CAAC;QAEnE,MAAMhE,SAAS6F,wBAAwB;YACrCtG;YACA6D;YACAc;YACA4B;YACAyB,WAAWrF,OAAOqF;YAClBC;YACA3H;YACAkI;YACAQ;QACF;QACA,IAAI3I,WAAWiM,MAAM,EAAE;gBACa7L;YAAlCzB,0BAA0ByB,SAAQA,cAAAA,OAAOgE,GAAG,CAAC,0BAAXhE,cAA6B+H;QACjE;QACA,MAAM+D,SAASlM,WAAWiM,MAAM,GAC5BtJ,KAAKtB,YAAY,CAAC;YAAE8K,SAAShE;YAAWmC;YAAM3K;QAAO,KACrDuE,QAAQkI,OAAO,CAAC;QACpB,MAAMC,UAAU,MAAM1J,KAAKxC,aAAa,CAACC,QAAQ,aAC5C8K,UAAU,YACVtM,4BAA4BoB;QAEjC,MAAMkM;QACN,MAAMI,UAAUD,QAAQtL,EAAE,GACtBlC,2BAA2BwN,QAAQrL,OAAO,EAAEhB,YAAY2I,eAAe4D,OAAO,IAC9E;QACJ,IAAI,CAACD,WAAW,CAACD,QAAQrL,OAAO,CAACnB,EAAE,EAAE;gBACUwM;YAA7CG,QAAQ7K,KAAK,CAAC,gCAA+B0K,mBAAAA,QAAQrL,OAAO,qBAAfqL,iBAAiB1K,KAAK;YACnE,MAAMsJ,MAAMM,OAAO;YACnB,OAAO;gBAAE7J,QAAQ;gBAAKb,MAAM;oBAAEc,OAAO;gBAA+C;YAAE;QACxF;QACA0J,SAAS/I,OAAO+J,QAAQrL,OAAO,CAACnB,EAAE;QAElC,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,oBAAoB;QACpB,MAAM4M,WAAW5I,QAAQC,UAAU,CAAC,UAAUC,GAAG,CAACP;QAClD,MAAMkJ,UAAU,MAAM/J,KAAKrD,SAAS,GAAGqN,cAAc,CAAC,OAAOC;gBAmB/ChI;YAlBZ,MAAMiI,WAAW,MAAMD,YAAYxI,GAAG,CAACqI;YACvC,MAAM7H,UAAUiI,SAASxI,MAAM,GAAIwI,SAAStI,IAAI,KAAiC;YACjF,IAAI,CAACK,WAAW,CAACpG,cAAcgG,OAAO,CAACI,UAAU,OAAO;gBAAEhB,SAASnC;gBAAWqL,WAAW;YAAG;YAC5F,IAAI,CAACtO,cAAcwH,aAAa,CAACpB,UAAU;gBACzC,OAAO;oBACLhB,SAASiF,QAAQ,KAAK,QAAQrK,cAAc+K,sBAAsB,CAAC,QAAQ5E;oBAC3EmI,WAAW;gBACb;YACF;YACA,IAAItO,cAAcqG,gBAAgB,CAACD,QAAQH,KAAK,MAAMjG,cAAcqG,gBAAgB,CAACP,MAAMG,KAAK,GAAG;gBACjG,OAAO;oBACLb,SAAS;wBACPlC,QAAQ;wBACRb,MAAM;4BAAEkE,UAAU;4BAAMpD,OAAO,CAAC,4BAA4B,EAAEgD,aAAa,eAAe,uBAAuB,CAAC;wBAAC;oBACrH;oBACAmI,WAAW;gBACb;YACF;YACA,IAAI,AAACzE,CAAAA,QAAOzD,iBAAAA,QAAQH,KAAK,qBAAbG,eAAe0D,WAAW,KAAK,CAAA,MAAOsC,cAAc;gBAC9D,OAAO;oBAAEhH,SAASiF,QAAQ,KAAK,WAAWD;oBAAwBkE,WAAW;gBAAG;YAClF;YACAF,YAAYjG,GAAG,CAAC8F,UAAU;gBAAE9B,mBAAmBU;YAAO,GAAG;gBAAE0B,OAAO;YAAK;YACvE,MAAMD,YAAYlI,QAAQ+F,iBAAiB,IAAI/F,QAAQ+F,iBAAiB,KAAKD,YAAY9F,QAAQ+F,iBAAiB,GAAG;YACrH,OAAO;gBAAE/G,SAAS;gBAAMkJ;YAAU;QACpC;QACA,IAAIJ,QAAQ9I,OAAO,EAAE;YACnB,MAAMjB,KAAKxB,aAAa,CAACkK;YACzB,MAAMJ,MAAMM,OAAO;YACnB,OAAOmB,QAAQ9I,OAAO;QACxB;QACA,IAAI8I,QAAQI,SAAS,IAAIJ,QAAQI,SAAS,KAAKzB,QAAQ,MAAM1I,KAAKxB,aAAa,CAACuL,QAAQI,SAAS;QACjG,MAAM7B,MAAM+B,MAAM,CAAC,KAAKV;QACxB,OAAO;YAAE5K,QAAQ;YAAKb,MAAMyL;QAA8C;IAC5E,EAAE,OAAO3K,OAAO;QACd6K,QAAQ7K,KAAK,CAAC,oBAAoBA;QAClC,IAAI0J,QAAQ,MAAM1I,KAAKxB,aAAa,CAACkK,QAAQnK,KAAK,CAAC,IAAM;QACzD,MAAM+J,MAAMM,OAAO;QACnB,OAAO;YAAE7J,QAAQ;YAAKb,MAAM;gBAAEc,OAAO;YAA+C;QAAE;IACxF;AACF;AAEA,SAASsL,KAAKC,GAAoC,EAAEtJ,OAAgB;QAGvBA;IAF3CsJ,IAAIC,SAAS,CAAC,iBAAiB;IAC/BD,IAAIC,SAAS,CAAC,gBAAgB;IAC9B,KAAK,MAAM,CAAChL,MAAMC,MAAM,IAAIoF,OAAOC,OAAO,EAAC7D,mBAAAA,QAAQvD,OAAO,YAAfuD,mBAAmB,CAAC,GAAIsJ,IAAIC,SAAS,CAAChL,MAAMC;IACvF,OAAO8K,IAAIxL,MAAM,CAACkC,QAAQlC,MAAM,EAAET,IAAI,CAAC2C,QAAQ/C,IAAI;AACrD;AAEA,oCAAoC,GACpC,OAAO,MAAMuM,mBAAqC,OAAOvL,KAAKqL;IAC5D,IAAI;QACF,OAAOD,KAAKC,KAAK,MAAM3H,gBAAgBlG,uBAAuBwC;IAChE,EAAE,OAAOF,OAAO;QACd6K,QAAQ7K,KAAK,CAAC,qBAAqBA;QACnC,OAAOsL,KAAKC,KAAK;YAAExL,QAAQ;YAAKb,MAAM;gBAAEc,OAAO;YAA6C;QAAE;IAChG;AACF,EAAC;AAED,oCAAoC,GACpC,OAAO,MAAM0L,kBAAoC,OAAOxL,KAAKqL,MAC3DD,KAAKC,KAAK,MAAMlE,eAAe3J,uBAAuBwC,MAAK"}

package/src/lib/server/quote.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler, type PluginApiRequest } from '@aglyn/aglyn/server';
+import { type PluginPersonRecord, type PluginPersonSearchRequest } from '@aglyn/aglyn/plugin-manager/plugin-person-records';
+import { type SaleTaxEngineRequest, type SaleTaxEngineResult } from './tax-engine-quote';
+import { type CheckoutSessionExpiry } from './checkout-session-expiry';
+export interface QuoteDeps {
+    verifyIdToken(token: string): Promise<{
+        uid: string;
+        email?: string | null;
+    }>;
+    firestore(): FirebaseFirestore.Firestore;
+    /** The workspace that owns the site, for its plan. */
+    orgForHost(hostId: string): Promise<{
+        id?: string;
+        org?: unknown;
+    } | null>;
+    searchPeople(request: PluginPersonSearchRequest): Promise<PluginPersonRecord[] | null>;
+    /** The site's tax service, where one is connected; `{ quote: null }` otherwise. */
+    quoteTax(request: SaleTaxEngineRequest): Promise<SaleTaxEngineResult>;
+    /** Closes a Checkout Session the pay page opened for the quote. */
+    expireSession(sessionId: string): Promise<CheckoutSessionExpiry>;
+    /** The quote's pay link at a link version, or null when the site has no address or no signing secret. */
+    payLinkUrl(host: Record<string, unknown>, hostId: string, quoteId: string, version: number): string | null;
+    now(): number;
+}
+export declare function defaultQuoteDeps(): QuoteDeps;
+type Outcome = {
+    status: number;
+    body: Record<string, unknown>;
+};
+export declare function handleQuote(deps: QuoteDeps, req: PluginApiRequest): Promise<Outcome>;
+/** `POST /api/commerce/quote`. */
+export declare const quoteHandler: PluginApiHandler;
+export {};