@aglyn/plugins-commerce 1.0.0-beta.288 → 1.0.0-beta.290

package/src/lib/server/quote-pay.js

@@ -0,0 +1,606 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement, claimAttempt, deriveStripeObjectKey, resolveTransactionFeeCents } from "@aglyn/aglyn/server";
+import { resolveHostToken } from "@aglyn/aglyn/app-utils/host-tokens";
+import { readClientIp } from "@aglyn/aglyn/app-utils/request-ip";
+import { siteReturnOrigin } from "@aglyn/aglyn/app-utils/site-return-url";
+import { consumeRateLimit, firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { merchantAccountIsReady } from "@aglyn/tenant-data-admin/server/payment-provider";
+import { checkoutSessionCardAuthenticationParams } from "@aglyn/tenant-data-admin/server/stripe-card-authentication";
+import { quotePageHref } from "../constants/quote-page.js";
+import * as CommerceModel from "../model/index.js";
+import { expireCheckoutSession } from "./checkout-session-expiry.js";
+import { resolveManualTaxRateId } from "./manual-tax-rate.js";
+import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSessionPayload, resolveNativeCheckoutMode } from "./native-checkout.js";
+import { orderStatusUrl } from "./order-status-token.js";
+import { ensureCheckoutDomain } from "./payment-method-domains.js";
+import { verifyQuoteLinkToken } from "./quote-link-token.js";
+/*==========================================
+ * THE CUSTOMER'S QUOTE PAGE AND ITS PAY BUTTON (AGL-4094).
+ *
+ *   GET  /api/commerce/quote-view?hostId=&q=<quoteId>&t=<token>
+ *        → 200 QuotePageView | 200 { state: 'replaced', storeName } | 404
+ *   POST /api/commerce/quote-pay  { hostId, q, t, v }  + Idempotency-Key
+ *        → 200 { url } (Stripe's page) | 200 { clientSecret, publishableKey, sessionId, wallets? }
+ *          (the in-page form) | 409 { error, reason } | 410 { error, replaced: true } | 404
+ *
+ * The signed link (`quote-link-token.ts`) is the whole credential. A wrong
+ * token answers exactly as a missing quote does, so neither route tells
+ * anyone which quote ids exist; both are rate-limited per address per site
+ * BEFORE the token check, so guessing costs what looking does. A link signed
+ * for an older version of the quote opens the replaced page and nothing else.
+ *
+ * Pay opens a FRESH Checkout Session from the stored quote on every press:
+ * the prices are the stored lines', never anything the page sends, and the
+ * session the previous press opened is expired first, so two sessions for one
+ * quote can never both be open. The quote keeps the open one in
+ * `checkoutSessionId`. A Stripe session lapses after a day; the quote and its
+ * link do not, because the next press opens another.
+ *
+ * The payment completes in `billing-webhook.ts`, which turns this same
+ * document into the order (`paidQuoteOrder`); nothing here marks it paid.
+ *=========================================*/ /** Lookups and presses one address may make per site, per ten minutes. */ export const QUOTE_VIEW_LOOKUPS_PER_WINDOW = 60;
+export const QUOTE_PAY_PRESSES_PER_WINDOW = 20;
+export const QUOTE_WINDOW_MS = 10 * 60000;
+export function defaultQuotePayDeps() {
+    return {
+        firestore: ()=>firebaseAdmin.app().firestore(),
+        consumeRateLimit: (key, options)=>consumeRateLimit(key, options),
+        orgForHost: async (hostId)=>{
+            const found = await getOrgForHost(hostId);
+            return found ? {
+                id: found.orgId,
+                org: found.org
+            } : null;
+        },
+        nativeMode: (orgId)=>resolveNativeCheckoutMode(orgId),
+        taxRateId: (input)=>resolveManualTaxRateId(input),
+        createSession: async (params, headers)=>{
+            const response = await fetch('https://api.stripe.com/v1/checkout/sessions', {
+                method: 'POST',
+                headers: _extends({
+                    Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
+                    'Content-Type': 'application/x-www-form-urlencoded'
+                }, headers),
+                body: params.toString()
+            });
+            return {
+                ok: response.ok,
+                session: await response.json().catch(()=>({}))
+            };
+        },
+        expireSession: (sessionId)=>expireCheckoutSession(sessionId),
+        ensureDomain: (input)=>ensureCheckoutDomain(input).catch(()=>null),
+        now: ()=>Date.now()
+    };
+}
+const DOC_ID = /^(?!__.*__$)[^/]{1,200}$/;
+const NOT_FOUND = {
+    status: 404,
+    body: {
+        error: 'We could not find that quote. Check the link you were sent.'
+    }
+};
+function bodyOf(req) {
+    const raw = req.body;
+    if (typeof raw === 'string') {
+        try {
+            const parsed = JSON.parse(raw);
+            return parsed && typeof parsed === 'object' ? parsed : {};
+        } catch (unused) {
+            return {};
+        }
+    }
+    return raw && typeof raw === 'object' ? raw : {};
+}
+function headerOf(req, name) {
+    var _req_headers, _headers_name_toLowerCase, _value_;
+    const headers = (_req_headers = req.headers) != null ? _req_headers : {};
+    const value = (_headers_name_toLowerCase = headers[name.toLowerCase()]) != null ? _headers_name_toLowerCase : headers[name];
+    return String(Array.isArray(value) ? (_value_ = value[0]) != null ? _value_ : '' : value != null ? value : '').trim();
+}
+/** The rate limit a link route spends per address per site, BEFORE the token is checked. */ export async function limitedQuoteLink(deps, req, key, limit) {
+    var _readClientIp;
+    var _req_socket;
+    const ip = (_readClientIp = readClientIp(req.headers, {
+        remoteAddress: (_req_socket = req.socket) == null ? void 0 : _req_socket.remoteAddress
+    })) != null ? _readClientIp : 'no-address';
+    const rate = await deps.consumeRateLimit(`${key}:${ip}`, {
+        limit,
+        windowMs: QUOTE_WINDOW_MS
+    });
+    if (rate.allowed) return null;
+    return {
+        status: 429,
+        body: {
+            error: 'Too many tries. Try again in a few minutes.'
+        },
+        headers: {
+            'Retry-After': String(Math.max(1, Math.ceil((rate.resetMs - deps.now()) / 1000)))
+        }
+    };
+}
+/**
+ * The quote a link names, after its token: the quote, the replaced answer for
+ * a link to an older version, or the one not-found answer for everything else.
+ */ export async function loadLinkedQuote(deps, hostId, quoteId, token) {
+    var _hostSnapshot_data, _resolveHostToken;
+    const version = verifyQuoteLinkToken(hostId, quoteId, token);
+    if (version === null) return {
+        outcome: NOT_FOUND
+    };
+    const hostRef = deps.firestore().collection('hosts').doc(hostId);
+    const [hostSnapshot, store, orderSnapshot] = await Promise.all([
+        hostRef.get(),
+        hostRef.collection('settings').doc('store').get(),
+        hostRef.collection('orders').doc(quoteId).get()
+    ]);
+    if (!hostSnapshot.exists || !orderSnapshot.exists) return {
+        outcome: NOT_FOUND
+    };
+    const order = orderSnapshot.data();
+    if (!CommerceModel.isQuote(order) || !order.quote) return {
+        outcome: NOT_FOUND
+    };
+    const host = (_hostSnapshot_data = hostSnapshot.data()) != null ? _hostSnapshot_data : {};
+    const storeName = String((_resolveHostToken = resolveHostToken('businessName', host)) != null ? _resolveHostToken : '');
+    const current = CommerceModel.quoteLinkVersion(order.quote);
+    if (version > current) return {
+        outcome: NOT_FOUND
+    };
+    if (version < current) {
+        return {
+            outcome: {
+                status: 410,
+                body: {
+                    state: 'replaced',
+                    storeName,
+                    replaced: true,
+                    error: `This quote was updated, and ${storeName || 'the business'} sent you a newer link.`
+                }
+            }
+        };
+    }
+    return {
+        loaded: {
+            hostRef,
+            host,
+            order,
+            storeName,
+            store
+        }
+    };
+}
+/** The link's site, quote and token from a query or a body, and whether all three are there. */ export function quoteLinkParams(source) {
+    var _source_hostId, _source_q, _source_t;
+    const hostId = String((_source_hostId = source['hostId']) != null ? _source_hostId : '');
+    const quoteId = String((_source_q = source['q']) != null ? _source_q : '').slice(0, 200);
+    const token = String((_source_t = source['t']) != null ? _source_t : '').slice(0, 200);
+    const complete = DOC_ID.test(hostId) && DOC_ID.test(quoteId) && Boolean(token);
+    return {
+        hostId,
+        quoteId,
+        token,
+        complete
+    };
+}
+/** `GET /api/commerce/quote-view`: the quote page's data. */ export async function handleQuoteView(deps, req) {
+    var _req_query, _store_get;
+    if (req.method !== 'GET') return {
+        status: 405,
+        body: {
+            error: 'Method not allowed'
+        }
+    };
+    const { hostId, quoteId, token, complete } = quoteLinkParams((_req_query = req.query) != null ? _req_query : {});
+    if (!complete) return {
+        status: 400,
+        body: {
+            error: 'This link is incomplete.'
+        }
+    };
+    const refused = await limitedQuoteLink(deps, req, `commerce-quote-view:${hostId}`, QUOTE_VIEW_LOOKUPS_PER_WINDOW);
+    if (refused) return refused;
+    const linked = await loadLinkedQuote(deps, hostId, quoteId, token);
+    if ('outcome' in linked) {
+        // The replaced page is a page, not a failure: answered as data.
+        if (linked.outcome.status === 410) {
+            const { storeName } = linked.outcome.body;
+            return {
+                status: 200,
+                body: {
+                    state: 'replaced',
+                    storeName
+                }
+            };
+        }
+        return linked.outcome;
+    }
+    const { host, order, storeName, store } = linked.loaded;
+    const view = CommerceModel.buildQuotePageView({
+        order,
+        orderId: quoteId,
+        storeName,
+        currency: String((_store_get = store.get('currency')) != null ? _store_get : 'USD'),
+        receiptUrl: CommerceModel.isUnpaidQuote(order) ? null : orderStatusUrl(host, hostId, quoteId)
+    });
+    return {
+        status: 200,
+        body: view
+    };
+}
+/** The Checkout Session a quote's Pay opens, as form params. Pure over its inputs. */ export function buildQuoteSessionParams(input) {
+    var _ref;
+    var _quote_customer;
+    const { charge, order } = input;
+    const quote = order.quote;
+    const params = new URLSearchParams(_extends({
+        mode: 'payment'
+    }, checkoutSessionCardAuthenticationParams('payment'), charge.taxAtPayment ? {
+        'automatic_tax[enabled]': 'true'
+    } : {}));
+    charge.lines.forEach((line, index)=>{
+        const at = `line_items[${index}]`;
+        params.set(`${at}[quantity]`, '1');
+        params.set(`${at}[price_data][currency]`, 'usd');
+        params.set(`${at}[price_data][unit_amount]`, String(line.amountCents));
+        params.set(`${at}[price_data][product_data][name]`, line.name.slice(0, 120));
+        if (line.description) params.set(`${at}[price_data][product_data][description]`, line.description);
+        // Stripe Tax's nontaxable code, for tax-exempt products and a tax charged as its own line.
+        if (!line.taxable) params.set(`${at}[price_data][product_data][tax_code]`, 'txcd_00000000');
+        if (line.taxable && input.taxRateId) params.set(`${at}[tax_rates][0]`, input.taxRateId);
+    });
+    // Shipping the business priced for the quote's ship-to, charged as the one
+    // option, with the address asked for where it ships (and where Stripe Tax
+    // reads the tax from). The quote's own address stands when it asks nothing.
+    if (charge.shippingCents > 0) {
+        var _ref1;
+        var _quote_shipTo;
+        const country = String((_ref1 = (_quote_shipTo = quote.shipTo) == null ? void 0 : _quote_shipTo.country) != null ? _ref1 : '').toUpperCase();
+        CommerceModel.appendShippingAddressCollectionParams(params, /^[A-Z]{2}$/.test(country) ? [
+            country
+        ] : CommerceModel.CHECKOUT_SHIPPING_COUNTRIES);
+        CommerceModel.appendCheckoutShippingParams(params, [
+            {
+                rateId: 'quote',
+                name: 'Shipping',
+                amountCents: charge.shippingCents
+            }
+        ]);
+    }
+    const shippingFloorCents = charge.shippingCents;
+    for (const [key, value] of Object.entries(CommerceModel.destinationChargeParams({
+        accountId: input.accountId,
+        feeCents: input.feeCents,
+        taxOwner: charge.taxAtPayment ? 'platform' : 'merchant',
+        merchantGoodsCents: charge.goodsCents,
+        shippingFloorCents
+    }))){
+        params.set(key, value);
+    }
+    const email = String((_ref = (_quote_customer = quote.customer) == null ? void 0 : _quote_customer.email) != null ? _ref : '').trim();
+    if (email) params.set('customer_email', email);
+    const separator = input.returnUrl.includes('?') ? '&' : '?';
+    params.set('success_url', `${input.returnUrl}${separator}session_id={CHECKOUT_SESSION_ID}`);
+    params.set('cancel_url', input.returnUrl);
+    // What the `commerce-draft` webhook branch reads to turn this quote into
+    // its order, and to tell a payment for the quote as it stands from one for
+    // a replaced link or an earlier edit.
+    params.set('metadata[type]', 'commerce-draft');
+    params.set('metadata[hostId]', input.hostId);
+    params.set('metadata[orderId]', input.quoteId);
+    params.set('metadata[quoteId]', input.quoteId);
+    params.set('metadata[quoteLinkVersion]', String(CommerceModel.quoteLinkVersion(quote)));
+    params.set('metadata[quoteUpdatedAtMs]', String(Number(quote.updatedAtMs) || 0));
+    params.set('metadata[feeCents]', String(input.feeCents));
+    // A tax charged as its own line is invisible to Stripe's tax total; this
+    // witness is what records it as the business's tax.
+    if (charge.taxCents > 0 && charge.taxPct === null) {
+        params.set('metadata[taxCents]', String(charge.taxCents));
+    }
+    if (charge.taxAtPayment) {
+        params.set('metadata[transferCents]', String(CommerceModel.platformLiableTransferCents({
+            feeCents: input.feeCents,
+            merchantGoodsCents: charge.goodsCents,
+            shippingFloorCents
+        })));
+        params.set('metadata[transferShippingCents]', String(shippingFloorCents));
+    }
+    CommerceModel.appendStorefrontPaymentMethodParams(params, input.paymentMethods);
+    return params;
+}
+const QUOTE_UPDATED_MESSAGE = 'This quote was updated since you opened it. Reload the page to see it before you pay.';
+const refusal = (status, reason, error, extra = {})=>({
+        status,
+        body: _extends({
+            error,
+            reason
+        }, extra)
+    });
+/** `POST /api/commerce/quote-pay`: a fresh Checkout Session for the quote. */ export async function handleQuotePay(deps, req) {
+    var _store_get, _ref, _order_checkoutSessionId, _ref1;
+    var _order_quote, _owner_org, _order_quote1;
+    if (req.method !== 'POST') return {
+        status: 405,
+        body: {
+            error: 'Method not allowed'
+        }
+    };
+    if (!process.env.STRIPE_SECRET_KEY) return {
+        status: 501,
+        body: {
+            error: 'Payments are not configured.'
+        }
+    };
+    const { hostId, quoteId, token, complete } = quoteLinkParams(bodyOf(req));
+    if (!complete) return {
+        status: 400,
+        body: {
+            error: 'This link is incomplete.'
+        }
+    };
+    const idempotencyKey = headerOf(req, 'idempotency-key').slice(0, 200);
+    if (!idempotencyKey) return {
+        status: 400,
+        body: {
+            error: 'Paying needs an Idempotency-Key header.'
+        }
+    };
+    const refused = await limitedQuoteLink(deps, req, `commerce-quote-pay:${hostId}`, QUOTE_PAY_PRESSES_PER_WINDOW);
+    if (refused) return refused;
+    const linked = await loadLinkedQuote(deps, hostId, quoteId, token);
+    if ('outcome' in linked) return linked.outcome;
+    const { hostRef, host, order, storeName, store } = linked.loaded;
+    // Every refusal the customer can be given is above the claim, so none of
+    // them spends the press. `v` is the edit of the quote the page showed: a
+    // quote changed since is shown again before it is paid, never charged unseen.
+    const seen = Number(bodyOf(req)['v']);
+    if (Number.isFinite(seen) && seen > 0 && seen !== (Number((_order_quote = order.quote) == null ? void 0 : _order_quote.updatedAtMs) || 0)) {
+        return refusal(409, 'updated', QUOTE_UPDATED_MESSAGE);
+    }
+    const blocked = CommerceModel.quotePayRefusal(order, quoteId);
+    if (blocked) return refusal(409, blocked, CommerceModel.quotePayRefusalMessage(blocked, storeName));
+    const owner = await deps.orgForHost(hostId);
+    const unavailable = refusal(409, 'payments-unavailable', `${storeName || 'This business'} can’t take payments online right now. Contact them to pay this quote.`);
+    if (!checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) return unavailable;
+    const ownerUid = owner == null ? void 0 : (_owner_org = owner.org) == null ? void 0 : _owner_org.ownerUid;
+    const profile = ownerUid ? await deps.firestore().collection('profiles').doc(String(ownerUid)).get() : null;
+    const accountId = profile == null ? void 0 : profile.get('stripeAccountId');
+    const ready = merchantAccountIsReady({
+        accountId,
+        chargesEnabled: profile == null ? void 0 : profile.get('stripeChargesEnabled'),
+        accountLivemode: profile == null ? void 0 : profile.get('stripeAccountLivemode')
+    }, {
+        subject: `quote ${quoteId} on host ${hostId}`
+    });
+    if (!ready) return unavailable;
+    const taxSettings = (_store_get = store.get('tax')) != null ? _store_get : {};
+    if (CommerceModel.storefrontTaxDecision({
+        settings: taxSettings
+    }).kind === 'undecided') {
+        return refusal(409, 'tax-undecided', CommerceModel.quotePayRefusalMessage('tax-undecided', storeName));
+    }
+    const charge = CommerceModel.quoteCheckoutCharge(order, quoteId);
+    const feeCents = resolveTransactionFeeCents(owner == null ? void 0 : owner.org, charge.feeProductType, charge.goodsCents, charge.totalCents);
+    const nativeMode = await deps.nativeMode(String((_ref = owner == null ? void 0 : owner.id) != null ? _ref : ''));
+    const site = host;
+    const origin = siteReturnOrigin({
+        candidates: [
+            headerOf(req, 'referer'),
+            `https://${headerOf(req, 'host')}`
+        ],
+        site,
+        requestHost: headerOf(req, 'host')
+    });
+    const returnUrl = `${origin}${quotePageHref(quoteId, token)}`;
+    const openedFor = (_order_checkoutSessionId = order.checkoutSessionId) != null ? _order_checkoutSessionId : '';
+    const openedAtEdit = Number((_order_quote1 = order.quote) == null ? void 0 : _order_quote1.updatedAtMs) || 0;
+    const claimed = await claimAttempt(deps.firestore(), {
+        kind: 'commerce-quote-pay',
+        scopeId: `${hostId}:${quoteId}`,
+        orgId: String((_ref1 = owner == null ? void 0 : owner.id) != null ? _ref1 : ''),
+        key: idempotencyKey,
+        busyMessage: 'Your payment is already being set up'
+    });
+    if ('replay' in claimed) {
+        return {
+            status: claimed.replay.status,
+            body: claimed.replay.body
+        };
+    }
+    const claim = claimed.claim;
+    const stripeKey = (object)=>{
+        const derived = deriveStripeObjectKey(claim.stripeKey, object);
+        return derived ? {
+            'Idempotency-Key': derived
+        } : {};
+    };
+    let minted = '';
+    try {
+        // The session the last press opened is closed before another opens. One
+        // that was paid a moment ago means the quote is paid; one that cannot be
+        // closed means a second session would be a second way to pay.
+        if (openedFor) {
+            const previous = await deps.expireSession(openedFor);
+            if (previous === 'complete') {
+                await claim.release();
+                return refusal(409, 'paid', 'This quote has just been paid. Your receipt is on its way.', {
+                    confirming: true
+                });
+            }
+            if (previous === 'open') {
+                await claim.release();
+                return {
+                    status: 502,
+                    body: {
+                        error: 'Your payment could not be set up. Try again.'
+                    }
+                };
+            }
+        }
+        let taxRateId = '';
+        if (charge.taxPct !== null && charge.taxableCents > 0) {
+            var _ref2;
+            var _order_quote2;
+            const basis = (_order_quote2 = order.quote) == null ? void 0 : _order_quote2.tax;
+            taxRateId = (_ref2 = await deps.taxRateId({
+                hostRef,
+                taxPct: charge.taxPct,
+                taxLabel: (basis == null ? void 0 : basis.kind) === 'rate' ? basis.label || `Tax (${charge.taxPct}%)` : 'Sales tax',
+                headers: stripeKey(`tax-rate-${Math.round(charge.taxPct * 10000)}`)
+            })) != null ? _ref2 : '';
+            if (!taxRateId) {
+                // Never an untaxed session for a taxed quote.
+                await claim.release();
+                return {
+                    status: 502,
+                    body: {
+                        error: 'Your payment could not be set up. Try again.'
+                    }
+                };
+            }
+        }
+        const paymentMethods = CommerceModel.resolveStorefrontPaymentMethodControls(CommerceModel.normalizeStorefrontPaymentMethodSettings(store.get('paymentMethods')));
+        const params = buildQuoteSessionParams({
+            hostId,
+            quoteId,
+            order,
+            charge,
+            accountId: String(accountId),
+            feeCents,
+            taxRateId,
+            returnUrl,
+            paymentMethods
+        });
+        if (nativeMode.native) {
+            var _params_get;
+            applyNativeCheckoutParams(params, (_params_get = params.get('success_url')) != null ? _params_get : returnUrl);
+        }
+        const domain = nativeMode.native ? deps.ensureDomain({
+            pageUrl: returnUrl,
+            site,
+            hostId
+        }) : Promise.resolve(null);
+        const created = await deps.createSession(params, _extends({}, stripeKey('session'), nativeCheckoutStripeHeaders(nativeMode)));
+        await domain;
+        const payload = created.ok ? readCheckoutSessionPayload(created.session, nativeMode, paymentMethods.wallets) : null;
+        if (!payload || !created.session.id) {
+            var _created_session;
+            console.error('Stripe quote checkout error', (_created_session = created.session) == null ? void 0 : _created_session.error);
+            await claim.release();
+            return {
+                status: 502,
+                body: {
+                    error: 'Your payment could not be set up. Try again.'
+                }
+            };
+        }
+        minted = String(created.session.id);
+        // The quote keeps the session it now has open. Whatever another press
+        // stored meanwhile is closed after, so the last press is the one open
+        // session; a quote that was paid, replaced or edited meanwhile closes
+        // this one instead.
+        const orderRef = hostRef.collection('orders').doc(quoteId);
+        const settled = await deps.firestore().runTransaction(async (transaction)=>{
+            var _current_quote;
+            const snapshot = await transaction.get(orderRef);
+            const current = snapshot.exists ? snapshot.data() : null;
+            if (!current || !CommerceModel.isQuote(current)) return {
+                outcome: NOT_FOUND,
+                displaced: ''
+            };
+            if (!CommerceModel.isUnpaidQuote(current)) {
+                return {
+                    outcome: refusal(409, 'paid', CommerceModel.quotePayRefusalMessage('paid', storeName)),
+                    displaced: ''
+                };
+            }
+            if (CommerceModel.quoteLinkVersion(current.quote) !== CommerceModel.quoteLinkVersion(order.quote)) {
+                return {
+                    outcome: {
+                        status: 410,
+                        body: {
+                            replaced: true,
+                            error: `This quote was updated, and ${storeName || 'the business'} sent you a newer link.`
+                        }
+                    },
+                    displaced: ''
+                };
+            }
+            if ((Number((_current_quote = current.quote) == null ? void 0 : _current_quote.updatedAtMs) || 0) !== openedAtEdit) {
+                return {
+                    outcome: refusal(409, 'updated', QUOTE_UPDATED_MESSAGE),
+                    displaced: ''
+                };
+            }
+            transaction.set(orderRef, {
+                checkoutSessionId: minted
+            }, {
+                merge: true
+            });
+            const displaced = current.checkoutSessionId && current.checkoutSessionId !== openedFor ? current.checkoutSessionId : '';
+            return {
+                outcome: null,
+                displaced
+            };
+        });
+        if (settled.outcome) {
+            await deps.expireSession(minted);
+            await claim.release();
+            return settled.outcome;
+        }
+        if (settled.displaced && settled.displaced !== minted) await deps.expireSession(settled.displaced);
+        await claim.record(200, payload);
+        return {
+            status: 200,
+            body: payload
+        };
+    } catch (error) {
+        console.error('quote pay failed', error);
+        if (minted) await deps.expireSession(minted).catch(()=>'open');
+        await claim.release();
+        return {
+            status: 500,
+            body: {
+                error: 'Your payment could not be set up. Try again.'
+            }
+        };
+    }
+}
+/** Sends a link route's answer, never cached or indexed. */ export function sendQuoteLinkOutcome(res, outcome) {
+    var _outcome_headers;
+    res.setHeader('Cache-Control', 'private, no-store');
+    res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+    for (const [name, value] of Object.entries((_outcome_headers = outcome.headers) != null ? _outcome_headers : {}))res.setHeader(name, value);
+    return res.status(outcome.status).json(outcome.body);
+}
+/** `GET /api/commerce/quote-view`. */ export const quoteViewHandler = async (req, res)=>{
+    try {
+        return sendQuoteLinkOutcome(res, await handleQuoteView(defaultQuotePayDeps(), req));
+    } catch (error) {
+        console.error('quote view failed', error);
+        return sendQuoteLinkOutcome(res, {
+            status: 500,
+            body: {
+                error: 'This quote could not be loaded. Try again.'
+            }
+        });
+    }
+};
+/** `POST /api/commerce/quote-pay`. */ export const quotePayHandler = async (req, res)=>sendQuoteLinkOutcome(res, await handleQuotePay(defaultQuotePayDeps(), req));
+
+//# sourceMappingURL=quote-pay.js.map