@aglyn/plugins-commerce 1.0.0-beta.288 → 1.0.0-beta.290

package/src/lib/server/quote-pay.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/quote-pay.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  claimAttempt,\n  deriveStripeObjectKey,\n  resolveTransactionFeeCents,\n  type PluginApiHandler,\n  type PluginApiRequest,\n} from '@aglyn/aglyn/server'\nimport { resolveHostToken, type HostTokenSource } from '@aglyn/aglyn/app-utils/host-tokens'\nimport { readClientIp } from '@aglyn/aglyn/app-utils/request-ip'\nimport { type SiteReturnHost, siteReturnOrigin } from '@aglyn/aglyn/app-utils/site-return-url'\nimport { consumeRateLimit, firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { merchantAccountIsReady } from '@aglyn/tenant-data-admin/server/payment-provider'\nimport { checkoutSessionCardAuthenticationParams } from '@aglyn/tenant-data-admin/server/stripe-card-authentication'\nimport { quotePageHref } from '../constants/quote-page'\nimport * as CommerceModel from '../model'\nimport { expireCheckoutSession, type CheckoutSessionExpiry } from './checkout-session-expiry'\nimport { resolveManualTaxRateId } from './manual-tax-rate'\nimport {\n  applyNativeCheckoutParams,\n  nativeCheckoutStripeHeaders,\n  readCheckoutSessionPayload,\n  resolveNativeCheckoutMode,\n  type NativeCheckoutMode,\n} from './native-checkout'\nimport { orderStatusUrl } from './order-status-token'\nimport { ensureCheckoutDomain } from './payment-method-domains'\nimport { verifyQuoteLinkToken } from './quote-link-token'\n\n/*==========================================\n * THE CUSTOMER'S QUOTE PAGE AND ITS PAY BUTTON (AGL-4094).\n *\n *   GET  /api/commerce/quote-view?hostId=&q=<quoteId>&t=<token>\n *        → 200 QuotePageView | 200 { state: 'replaced', storeName } | 404\n *   POST /api/commerce/quote-pay  { hostId, q, t, v }  + Idempotency-Key\n *        → 200 { url } (Stripe's page) | 200 { clientSecret, publishableKey, sessionId, wallets? }\n *          (the in-page form) | 409 { error, reason } | 410 { error, replaced: true } | 404\n *\n * The signed link (`quote-link-token.ts`) is the whole credential. A wrong\n * token answers exactly as a missing quote does, so neither route tells\n * anyone which quote ids exist; both are rate-limited per address per site\n * BEFORE the token check, so guessing costs what looking does. A link signed\n * for an older version of the quote opens the replaced page and nothing else.\n *\n * Pay opens a FRESH Checkout Session from the stored quote on every press:\n * the prices are the stored lines', never anything the page sends, and the\n * session the previous press opened is expired first, so two sessions for one\n * quote can never both be open. The quote keeps the open one in\n * `checkoutSessionId`. A Stripe session lapses after a day; the quote and its\n * link do not, because the next press opens another.\n *\n * The payment completes in `billing-webhook.ts`, which turns this same\n * document into the order (`paidQuoteOrder`); nothing here marks it paid.\n *=========================================*/\n\n/** Lookups and presses one address may make per site, per ten minutes. */\nexport const QUOTE_VIEW_LOOKUPS_PER_WINDOW = 60\nexport const QUOTE_PAY_PRESSES_PER_WINDOW = 20\nexport const QUOTE_WINDOW_MS = 10 * 60_000\n\nexport interface QuotePayDeps {\n  firestore(): FirebaseFirestore.Firestore\n  consumeRateLimit(key: string, options: { limit: number; windowMs: number }): Promise<{ allowed: boolean; resetMs: number }>\n  orgForHost(hostId: string): Promise<{ id?: string; org?: any } | null>\n  nativeMode(orgId: string): Promise<NativeCheckoutMode>\n  /** The store's manual tax rate as a Stripe tax rate, or null when one cannot be had. */\n  taxRateId(input: Parameters<typeof resolveManualTaxRateId>[0]): Promise<string | null>\n  createSession(\n    params: URLSearchParams,\n    headers: Record<string, string>,\n  ): Promise<{ ok: boolean; session: { id?: string; url?: string; client_secret?: string; error?: unknown } }>\n  expireSession(sessionId: string): Promise<CheckoutSessionExpiry>\n  /** Registers the page's domain for Apple Pay; never throws. */\n  ensureDomain(input: Parameters<typeof ensureCheckoutDomain>[0]): Promise<unknown>\n  now(): number\n}\n\nexport function defaultQuotePayDeps(): QuotePayDeps {\n  return {\n    firestore: () => firebaseAdmin.app().firestore(),\n    consumeRateLimit: (key, options) => consumeRateLimit(key, options),\n    orgForHost: async (hostId) => {\n      const found = await getOrgForHost(hostId)\n      return found ? { id: found.orgId, org: found.org } : null\n    },\n    nativeMode: (orgId) => resolveNativeCheckoutMode(orgId),\n    taxRateId: (input) => resolveManualTaxRateId(input),\n    createSession: async (params, headers) => {\n      const response = await fetch('https://api.stripe.com/v1/checkout/sessions', {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n          'Content-Type': 'application/x-www-form-urlencoded',\n          ...headers,\n        },\n        body: params.toString(),\n      })\n      return { ok: response.ok, session: (await response.json().catch(() => ({}))) as never }\n    },\n    expireSession: (sessionId) => expireCheckoutSession(sessionId),\n    ensureDomain: (input) => ensureCheckoutDomain(input).catch(() => null),\n    now: () => Date.now(),\n  }\n}\n\n/** A link route's answer: a status, a JSON body and any extra headers. */\nexport type QuoteLinkOutcome = { status: number; body: Record<string, unknown>; headers?: Record<string, string> }\n\nconst DOC_ID = /^(?!__.*__$)[^/]{1,200}$/\n\nconst NOT_FOUND: QuoteLinkOutcome = {\n  status: 404,\n  body: { error: 'We could not find that quote. Check the link you were sent.' },\n}\n\nfunction bodyOf(req: PluginApiRequest): Record<string, unknown> {\n  const raw = req.body\n  if (typeof raw === 'string') {\n    try {\n      const parsed = JSON.parse(raw)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return raw && typeof raw === 'object' ? (raw as Record<string, unknown>) : {}\n}\n\nfunction headerOf(req: PluginApiRequest, name: string): string {\n  const headers = (req.headers ?? {}) as Record<string, unknown>\n  const value = headers[name.toLowerCase()] ?? headers[name]\n  return String(Array.isArray(value) ? (value[0] ?? '') : (value ?? '')).trim()\n}\n\n/** The rate limit a link route spends per address per site, BEFORE the token is checked. */\nexport async function limitedQuoteLink(\n  deps: QuotePayDeps,\n  req: PluginApiRequest,\n  key: string,\n  limit: number,\n): Promise<QuoteLinkOutcome | null> {\n  const ip = readClientIp(req.headers as never, { remoteAddress: req.socket?.remoteAddress }) ?? 'no-address'\n  const rate = await deps.consumeRateLimit(`${key}:${ip}`, { limit, windowMs: QUOTE_WINDOW_MS })\n  if (rate.allowed) return null\n  return {\n    status: 429,\n    body: { error: 'Too many tries. Try again in a few minutes.' },\n    headers: { 'Retry-After': String(Math.max(1, Math.ceil((rate.resetMs - deps.now()) / 1000))) },\n  }\n}\n\nexport interface LoadedQuote {\n  hostRef: FirebaseFirestore.DocumentReference\n  host: Record<string, unknown>\n  order: CommerceModel.HostOrder\n  storeName: string\n  store: FirebaseFirestore.DocumentSnapshot\n}\n\n/**\n * The quote a link names, after its token: the quote, the replaced answer for\n * a link to an older version, or the one not-found answer for everything else.\n */\nexport async function loadLinkedQuote(\n  deps: QuotePayDeps,\n  hostId: string,\n  quoteId: string,\n  token: string,\n): Promise<{ loaded: LoadedQuote } | { outcome: QuoteLinkOutcome }> {\n  const version = verifyQuoteLinkToken(hostId, quoteId, token)\n  if (version === null) return { outcome: NOT_FOUND }\n  const hostRef = deps.firestore().collection('hosts').doc(hostId)\n  const [hostSnapshot, store, orderSnapshot] = await Promise.all([\n    hostRef.get(),\n    hostRef.collection('settings').doc('store').get(),\n    hostRef.collection('orders').doc(quoteId).get(),\n  ])\n  if (!hostSnapshot.exists || !orderSnapshot.exists) return { outcome: NOT_FOUND }\n  const order = orderSnapshot.data() as CommerceModel.HostOrder\n  if (!CommerceModel.isQuote(order) || !order.quote) return { outcome: NOT_FOUND }\n  const host = (hostSnapshot.data() ?? {}) as Record<string, unknown>\n  const storeName = String(resolveHostToken('businessName', host as HostTokenSource) ?? '')\n  const current = CommerceModel.quoteLinkVersion(order.quote)\n  if (version > current) return { outcome: NOT_FOUND }\n  if (version < current) {\n    return {\n      outcome: {\n        status: 410,\n        body: {\n          state: 'replaced',\n          storeName,\n          replaced: true,\n          error: `This quote was updated, and ${storeName || 'the business'} sent you a newer link.`,\n        },\n      },\n    }\n  }\n  return { loaded: { hostRef, host, order, storeName, store } }\n}\n\n/** The link's site, quote and token from a query or a body, and whether all three are there. */\nexport function quoteLinkParams(source: Record<string, unknown>) {\n  const hostId = String(source['hostId'] ?? '')\n  const quoteId = String(source['q'] ?? '').slice(0, 200)\n  const token = String(source['t'] ?? '').slice(0, 200)\n  const complete = DOC_ID.test(hostId) && DOC_ID.test(quoteId) && Boolean(token)\n  return { hostId, quoteId, token, complete }\n}\n\n/** `GET /api/commerce/quote-view`: the quote page's data. */\nexport async function handleQuoteView(deps: QuotePayDeps, req: PluginApiRequest): Promise<QuoteLinkOutcome> {\n  if (req.method !== 'GET') return { status: 405, body: { error: 'Method not allowed' } }\n  const { hostId, quoteId, token, complete } = quoteLinkParams((req.query ?? {}) as Record<string, unknown>)\n  if (!complete) return { status: 400, body: { error: 'This link is incomplete.' } }\n  const refused = await limitedQuoteLink(deps, req, `commerce-quote-view:${hostId}`, QUOTE_VIEW_LOOKUPS_PER_WINDOW)\n  if (refused) return refused\n  const linked = await loadLinkedQuote(deps, hostId, quoteId, token)\n  if ('outcome' in linked) {\n    // The replaced page is a page, not a failure: answered as data.\n    if (linked.outcome.status === 410) {\n      const { storeName } = linked.outcome.body as { storeName: string }\n      return { status: 200, body: { state: 'replaced', storeName } }\n    }\n    return linked.outcome\n  }\n  const { host, order, storeName, store } = linked.loaded\n  const view = CommerceModel.buildQuotePageView({\n    order,\n    orderId: quoteId,\n    storeName,\n    currency: String(store.get('currency') ?? 'USD'),\n    receiptUrl: CommerceModel.isUnpaidQuote(order) ? null : orderStatusUrl(host, hostId, quoteId),\n  })\n  return { status: 200, body: view as unknown as Record<string, unknown> }\n}\n\n/** The Checkout Session a quote's Pay opens, as form params. Pure over its inputs. */\nexport function buildQuoteSessionParams(input: {\n  hostId: string\n  quoteId: string\n  order: CommerceModel.HostOrder\n  charge: CommerceModel.QuoteCheckoutCharge\n  accountId: string\n  feeCents: number\n  taxRateId: string\n  returnUrl: string\n  paymentMethods: CommerceModel.StorefrontPaymentMethodControls\n}): URLSearchParams {\n  const { charge, order } = input\n  const quote = order.quote as CommerceModel.OrderQuote\n  const params = new URLSearchParams({\n    mode: 'payment',\n    ...checkoutSessionCardAuthenticationParams('payment'),\n    ...(charge.taxAtPayment ? { 'automatic_tax[enabled]': 'true' } : {}),\n  })\n  charge.lines.forEach((line, index) => {\n    const at = `line_items[${index}]`\n    params.set(`${at}[quantity]`, '1')\n    params.set(`${at}[price_data][currency]`, 'usd')\n    params.set(`${at}[price_data][unit_amount]`, String(line.amountCents))\n    params.set(`${at}[price_data][product_data][name]`, line.name.slice(0, 120))\n    if (line.description) params.set(`${at}[price_data][product_data][description]`, line.description)\n    // Stripe Tax's nontaxable code, for tax-exempt products and a tax charged as its own line.\n    if (!line.taxable) params.set(`${at}[price_data][product_data][tax_code]`, 'txcd_00000000')\n    if (line.taxable && input.taxRateId) params.set(`${at}[tax_rates][0]`, input.taxRateId)\n  })\n  // Shipping the business priced for the quote's ship-to, charged as the one\n  // option, with the address asked for where it ships (and where Stripe Tax\n  // reads the tax from). The quote's own address stands when it asks nothing.\n  if (charge.shippingCents > 0) {\n    const country = String(quote.shipTo?.country ?? '').toUpperCase()\n    CommerceModel.appendShippingAddressCollectionParams(\n      params,\n      /^[A-Z]{2}$/.test(country) ? [country] : CommerceModel.CHECKOUT_SHIPPING_COUNTRIES,\n    )\n    CommerceModel.appendCheckoutShippingParams(params, [\n      { rateId: 'quote', name: 'Shipping', amountCents: charge.shippingCents },\n    ])\n  }\n  const shippingFloorCents = charge.shippingCents\n  for (const [key, value] of Object.entries(\n    CommerceModel.destinationChargeParams({\n      accountId: input.accountId,\n      feeCents: input.feeCents,\n      taxOwner: charge.taxAtPayment ? 'platform' : 'merchant',\n      merchantGoodsCents: charge.goodsCents,\n      shippingFloorCents,\n    }),\n  )) {\n    params.set(key, value)\n  }\n  const email = String(quote.customer?.email ?? '').trim()\n  if (email) params.set('customer_email', email)\n  const separator = input.returnUrl.includes('?') ? '&' : '?'\n  params.set('success_url', `${input.returnUrl}${separator}session_id={CHECKOUT_SESSION_ID}`)\n  params.set('cancel_url', input.returnUrl)\n  // What the `commerce-draft` webhook branch reads to turn this quote into\n  // its order, and to tell a payment for the quote as it stands from one for\n  // a replaced link or an earlier edit.\n  params.set('metadata[type]', 'commerce-draft')\n  params.set('metadata[hostId]', input.hostId)\n  params.set('metadata[orderId]', input.quoteId)\n  params.set('metadata[quoteId]', input.quoteId)\n  params.set('metadata[quoteLinkVersion]', String(CommerceModel.quoteLinkVersion(quote)))\n  params.set('metadata[quoteUpdatedAtMs]', String(Number(quote.updatedAtMs) || 0))\n  params.set('metadata[feeCents]', String(input.feeCents))\n  // A tax charged as its own line is invisible to Stripe's tax total; this\n  // witness is what records it as the business's tax.\n  if (charge.taxCents > 0 && charge.taxPct === null) {\n    params.set('metadata[taxCents]', String(charge.taxCents))\n  }\n  if (charge.taxAtPayment) {\n    params.set(\n      'metadata[transferCents]',\n      String(\n        CommerceModel.platformLiableTransferCents({\n          feeCents: input.feeCents,\n          merchantGoodsCents: charge.goodsCents,\n          shippingFloorCents,\n        }),\n      ),\n    )\n    params.set('metadata[transferShippingCents]', String(shippingFloorCents))\n  }\n  CommerceModel.appendStorefrontPaymentMethodParams(params, input.paymentMethods)\n  return params\n}\n\nconst QUOTE_UPDATED_MESSAGE = 'This quote was updated since you opened it. Reload the page to see it before you pay.'\n\nconst refusal = (status: number, reason: string, error: string, extra: Record<string, unknown> = {}): QuoteLinkOutcome => ({\n  status,\n  body: { error, reason, ...extra },\n})\n\n/** `POST /api/commerce/quote-pay`: a fresh Checkout Session for the quote. */\nexport async function handleQuotePay(deps: QuotePayDeps, req: PluginApiRequest): Promise<QuoteLinkOutcome> {\n  if (req.method !== 'POST') return { status: 405, body: { error: 'Method not allowed' } }\n  if (!process.env.STRIPE_SECRET_KEY) return { status: 501, body: { error: 'Payments are not configured.' } }\n  const { hostId, quoteId, token, complete } = quoteLinkParams(bodyOf(req))\n  if (!complete) return { status: 400, body: { error: 'This link is incomplete.' } }\n  const idempotencyKey = headerOf(req, 'idempotency-key').slice(0, 200)\n  if (!idempotencyKey) return { status: 400, body: { error: 'Paying needs an Idempotency-Key header.' } }\n  const refused = await limitedQuoteLink(deps, req, `commerce-quote-pay:${hostId}`, QUOTE_PAY_PRESSES_PER_WINDOW)\n  if (refused) return refused\n  const linked = await loadLinkedQuote(deps, hostId, quoteId, token)\n  if ('outcome' in linked) return linked.outcome\n  const { hostRef, host, order, storeName, store } = linked.loaded\n\n  // Every refusal the customer can be given is above the claim, so none of\n  // them spends the press. `v` is the edit of the quote the page showed: a\n  // quote changed since is shown again before it is paid, never charged unseen.\n  const seen = Number(bodyOf(req)['v'])\n  if (Number.isFinite(seen) && seen > 0 && seen !== (Number(order.quote?.updatedAtMs) || 0)) {\n    return refusal(409, 'updated', QUOTE_UPDATED_MESSAGE)\n  }\n  const blocked = CommerceModel.quotePayRefusal(order, quoteId)\n  if (blocked) return refusal(409, blocked, CommerceModel.quotePayRefusalMessage(blocked, storeName))\n  const owner = await deps.orgForHost(hostId)\n  const unavailable = refusal(\n    409,\n    'payments-unavailable',\n    `${storeName || 'This business'} can’t take payments online right now. Contact them to pay this quote.`,\n  )\n  if (!checkEntitlement(owner?.org as never, 'commerce')) return unavailable\n  const ownerUid = owner?.org?.ownerUid\n  const profile = ownerUid ? await deps.firestore().collection('profiles').doc(String(ownerUid)).get() : null\n  const accountId = profile?.get('stripeAccountId')\n  const ready = merchantAccountIsReady(\n    {\n      accountId,\n      chargesEnabled: profile?.get('stripeChargesEnabled'),\n      accountLivemode: profile?.get('stripeAccountLivemode'),\n    },\n    { subject: `quote ${quoteId} on host ${hostId}` },\n  )\n  if (!ready) return unavailable\n  const taxSettings = (store.get('tax') ?? {}) as CommerceModel.TaxSettings\n  if (CommerceModel.storefrontTaxDecision({ settings: taxSettings }).kind === 'undecided') {\n    return refusal(409, 'tax-undecided', CommerceModel.quotePayRefusalMessage('tax-undecided', storeName))\n  }\n\n  const charge = CommerceModel.quoteCheckoutCharge(order, quoteId)\n  const feeCents = resolveTransactionFeeCents(owner?.org as never, charge.feeProductType, charge.goodsCents, charge.totalCents)\n  const nativeMode = await deps.nativeMode(String(owner?.id ?? ''))\n  const site = host as SiteReturnHost\n  const origin = siteReturnOrigin({\n    candidates: [headerOf(req, 'referer'), `https://${headerOf(req, 'host')}`],\n    site,\n    requestHost: headerOf(req, 'host'),\n  })\n  const returnUrl = `${origin}${quotePageHref(quoteId, token)}`\n  const openedFor = order.checkoutSessionId ?? ''\n  const openedAtEdit = Number(order.quote?.updatedAtMs) || 0\n\n  const claimed = await claimAttempt(deps.firestore(), {\n    kind: 'commerce-quote-pay',\n    scopeId: `${hostId}:${quoteId}`,\n    orgId: String(owner?.id ?? ''),\n    key: idempotencyKey,\n    busyMessage: 'Your payment is already being set up',\n  })\n  if ('replay' in claimed) {\n    return { status: claimed.replay.status, body: claimed.replay.body as Record<string, unknown> }\n  }\n  const claim = claimed.claim\n  const stripeKey = (object: string): Record<string, string> => {\n    const derived = deriveStripeObjectKey(claim.stripeKey, object)\n    return derived ? { 'Idempotency-Key': derived } : {}\n  }\n  let minted = ''\n  try {\n    // The session the last press opened is closed before another opens. One\n    // that was paid a moment ago means the quote is paid; one that cannot be\n    // closed means a second session would be a second way to pay.\n    if (openedFor) {\n      const previous = await deps.expireSession(openedFor)\n      if (previous === 'complete') {\n        await claim.release()\n        return refusal(409, 'paid', 'This quote has just been paid. Your receipt is on its way.', { confirming: true })\n      }\n      if (previous === 'open') {\n        await claim.release()\n        return { status: 502, body: { error: 'Your payment could not be set up. Try again.' } }\n      }\n    }\n\n    let taxRateId = ''\n    if (charge.taxPct !== null && charge.taxableCents > 0) {\n      const basis = order.quote?.tax\n      taxRateId =\n        (await deps.taxRateId({\n          hostRef,\n          taxPct: charge.taxPct,\n          taxLabel:\n            basis?.kind === 'rate'\n              ? basis.label || `Tax (${charge.taxPct}%)`\n              : 'Sales tax',\n          headers: stripeKey(`tax-rate-${Math.round(charge.taxPct * 10_000)}`),\n        })) ?? ''\n      if (!taxRateId) {\n        // Never an untaxed session for a taxed quote.\n        await claim.release()\n        return { status: 502, body: { error: 'Your payment could not be set up. Try again.' } }\n      }\n    }\n\n    const paymentMethods = CommerceModel.resolveStorefrontPaymentMethodControls(\n      CommerceModel.normalizeStorefrontPaymentMethodSettings(store.get('paymentMethods')),\n    )\n    const params = buildQuoteSessionParams({\n      hostId,\n      quoteId,\n      order,\n      charge,\n      accountId: String(accountId),\n      feeCents,\n      taxRateId,\n      returnUrl,\n      paymentMethods,\n    })\n    if (nativeMode.native) {\n      applyNativeCheckoutParams(params, params.get('success_url') ?? returnUrl)\n    }\n    const domain = nativeMode.native\n      ? deps.ensureDomain({ pageUrl: returnUrl, site, hostId })\n      : Promise.resolve(null)\n    const created = await deps.createSession(params, {\n      ...stripeKey('session'),\n      ...nativeCheckoutStripeHeaders(nativeMode),\n    })\n    await domain\n    const payload = created.ok\n      ? readCheckoutSessionPayload(created.session, nativeMode, paymentMethods.wallets)\n      : null\n    if (!payload || !created.session.id) {\n      console.error('Stripe quote checkout error', created.session?.error)\n      await claim.release()\n      return { status: 502, body: { error: 'Your payment could not be set up. Try again.' } }\n    }\n    minted = String(created.session.id)\n\n    // The quote keeps the session it now has open. Whatever another press\n    // stored meanwhile is closed after, so the last press is the one open\n    // session; a quote that was paid, replaced or edited meanwhile closes\n    // this one instead.\n    const orderRef = hostRef.collection('orders').doc(quoteId)\n    const settled = await deps.firestore().runTransaction(async (transaction) => {\n      const snapshot = await transaction.get(orderRef)\n      const current = snapshot.exists ? (snapshot.data() as CommerceModel.HostOrder) : null\n      if (!current || !CommerceModel.isQuote(current)) return { outcome: NOT_FOUND, displaced: '' }\n      if (!CommerceModel.isUnpaidQuote(current)) {\n        return {\n          outcome: refusal(409, 'paid', CommerceModel.quotePayRefusalMessage('paid', storeName)),\n          displaced: '',\n        }\n      }\n      if (CommerceModel.quoteLinkVersion(current.quote) !== CommerceModel.quoteLinkVersion(order.quote)) {\n        return {\n          outcome: {\n            status: 410,\n            body: { replaced: true, error: `This quote was updated, and ${storeName || 'the business'} sent you a newer link.` },\n          },\n          displaced: '',\n        }\n      }\n      if ((Number(current.quote?.updatedAtMs) || 0) !== openedAtEdit) {\n        return { outcome: refusal(409, 'updated', QUOTE_UPDATED_MESSAGE), displaced: '' }\n      }\n      transaction.set(orderRef, { checkoutSessionId: minted }, { merge: true })\n      const displaced = current.checkoutSessionId && current.checkoutSessionId !== openedFor ? current.checkoutSessionId : ''\n      return { outcome: null, displaced }\n    })\n    if (settled.outcome) {\n      await deps.expireSession(minted)\n      await claim.release()\n      return settled.outcome\n    }\n    if (settled.displaced && settled.displaced !== minted) await deps.expireSession(settled.displaced)\n    await claim.record(200, payload)\n    return { status: 200, body: payload as unknown as Record<string, unknown> }\n  } catch (error) {\n    console.error('quote pay failed', error)\n    if (minted) await deps.expireSession(minted).catch(() => 'open')\n    await claim.release()\n    return { status: 500, body: { error: 'Your payment could not be set up. Try again.' } }\n  }\n}\n\n/** Sends a link route's answer, never cached or indexed. */\nexport function sendQuoteLinkOutcome(res: Parameters<PluginApiHandler>[1], outcome: QuoteLinkOutcome) {\n  res.setHeader('Cache-Control', 'private, no-store')\n  res.setHeader('X-Robots-Tag', 'noindex, nofollow')\n  for (const [name, value] of Object.entries(outcome.headers ?? {})) res.setHeader(name, value)\n  return res.status(outcome.status).json(outcome.body)\n}\n\n/** `GET /api/commerce/quote-view`. */\nexport const quoteViewHandler: PluginApiHandler = async (req, res) => {\n  try {\n    return sendQuoteLinkOutcome(res, await handleQuoteView(defaultQuotePayDeps(), req))\n  } catch (error) {\n    console.error('quote view failed', error)\n    return sendQuoteLinkOutcome(res, { status: 500, body: { error: 'This quote could not be loaded. Try again.' } })\n  }\n}\n\n/** `POST /api/commerce/quote-pay`. */\nexport const quotePayHandler: PluginApiHandler = async (req, res) =>\n  sendQuoteLinkOutcome(res, await handleQuotePay(defaultQuotePayDeps(), req))\n"],"names":["checkEntitlement","claimAttempt","deriveStripeObjectKey","resolveTransactionFeeCents","resolveHostToken","readClientIp","siteReturnOrigin","consumeRateLimit","firebaseAdmin","getOrgForHost","merchantAccountIsReady","checkoutSessionCardAuthenticationParams","quotePageHref","CommerceModel","expireCheckoutSession","resolveManualTaxRateId","applyNativeCheckoutParams","nativeCheckoutStripeHeaders","readCheckoutSessionPayload","resolveNativeCheckoutMode","orderStatusUrl","ensureCheckoutDomain","verifyQuoteLinkToken","QUOTE_VIEW_LOOKUPS_PER_WINDOW","QUOTE_PAY_PRESSES_PER_WINDOW","QUOTE_WINDOW_MS","defaultQuotePayDeps","firestore","app","key","options","orgForHost","hostId","found","id","orgId","org","nativeMode","taxRateId","input","createSession","params","headers","response","fetch","method","Authorization","process","env","STRIPE_SECRET_KEY","body","toString","ok","session","json","catch","expireSession","sessionId","ensureDomain","now","Date","DOC_ID","NOT_FOUND","status","error","bodyOf","req","raw","parsed","JSON","parse","headerOf","name","value","toLowerCase","String","Array","isArray","trim","limitedQuoteLink","deps","limit","ip","remoteAddress","socket","rate","windowMs","allowed","Math","max","ceil","resetMs","loadLinkedQuote","quoteId","token","hostSnapshot","version","outcome","hostRef","collection","doc","store","orderSnapshot","Promise","all","get","exists","order","data","isQuote","quote","host","storeName","current","quoteLinkVersion","state","replaced","loaded","quoteLinkParams","source","slice","complete","test","Boolean","handleQuoteView","query","refused","linked","view","buildQuotePageView","orderId","currency","receiptUrl","isUnpaidQuote","buildQuoteSessionParams","charge","URLSearchParams","mode","taxAtPayment","lines","forEach","line","index","at","set","amountCents","description","taxable","shippingCents","country","shipTo","toUpperCase","appendShippingAddressCollectionParams","CHECKOUT_SHIPPING_COUNTRIES","appendCheckoutShippingParams","rateId","shippingFloorCents","Object","entries","destinationChargeParams","accountId","feeCents","taxOwner","merchantGoodsCents","goodsCents","email","customer","separator","returnUrl","includes","Number","updatedAtMs","taxCents","taxPct","platformLiableTransferCents","appendStorefrontPaymentMethodParams","paymentMethods","QUOTE_UPDATED_MESSAGE","refusal","reason","extra","handleQuotePay","owner","idempotencyKey","seen","isFinite","blocked","quotePayRefusal","quotePayRefusalMessage","unavailable","ownerUid","profile","ready","chargesEnabled","accountLivemode","subject","taxSettings","storefrontTaxDecision","settings","kind","quoteCheckoutCharge","feeProductType","totalCents","site","origin","candidates","requestHost","openedFor","checkoutSessionId","openedAtEdit","claimed","scopeId","busyMessage","replay","claim","stripeKey","object","derived","minted","previous","release","confirming","taxableCents","basis","tax","taxLabel","label","round","resolveStorefrontPaymentMethodControls","normalizeStorefrontPaymentMethodSettings","native","domain","pageUrl","resolve","created","payload","wallets","console","orderRef","settled","runTransaction","transaction","snapshot","displaced","merge","record","sendQuoteLinkOutcome","res","setHeader","quoteViewHandler","quotePayHandler"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,YAAY,EACZC,qBAAqB,EACrBC,0BAA0B,QAGrB,sBAAqB;AAC5B,SAASC,gBAAgB,QAA8B,qCAAoC;AAC3F,SAASC,YAAY,QAAQ,oCAAmC;AAChE,SAA8BC,gBAAgB,QAAQ,yCAAwC;AAC9F,SAASC,gBAAgB,EAAEC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACzF,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SAASC,uCAAuC,QAAQ,6DAA4D;AACpH,SAASC,aAAa,QAAQ,6BAAyB;AACvD,YAAYC,mBAAmB,oBAAU;AACzC,SAASC,qBAAqB,QAAoC,+BAA2B;AAC7F,SAASC,sBAAsB,QAAQ,uBAAmB;AAC1D,SACEC,yBAAyB,EACzBC,2BAA2B,EAC3BC,0BAA0B,EAC1BC,yBAAyB,QAEpB,uBAAmB;AAC1B,SAASC,cAAc,QAAQ,0BAAsB;AACrD,SAASC,oBAAoB,QAAQ,8BAA0B;AAC/D,SAASC,oBAAoB,QAAQ,wBAAoB;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;2CAwB2C,GAE3C,wEAAwE,GACxE,OAAO,MAAMC,gCAAgC,GAAE;AAC/C,OAAO,MAAMC,+BAA+B,GAAE;AAC9C,OAAO,MAAMC,kBAAkB,KAAK,MAAM;AAmB1C,OAAO,SAASC;IACd,OAAO;QACLC,WAAW,IAAMnB,cAAcoB,GAAG,GAAGD,SAAS;QAC9CpB,kBAAkB,CAACsB,KAAKC,UAAYvB,iBAAiBsB,KAAKC;QAC1DC,YAAY,OAAOC;YACjB,MAAMC,QAAQ,MAAMxB,cAAcuB;YAClC,OAAOC,QAAQ;gBAAEC,IAAID,MAAME,KAAK;gBAAEC,KAAKH,MAAMG,GAAG;YAAC,IAAI;QACvD;QACAC,YAAY,CAACF,QAAUhB,0BAA0BgB;QACjDG,WAAW,CAACC,QAAUxB,uBAAuBwB;QAC7CC,eAAe,OAAOC,QAAQC;YAC5B,MAAMC,WAAW,MAAMC,MAAM,+CAA+C;gBAC1EC,QAAQ;gBACRH,SAAS;oBACPI,eAAe,CAAC,OAAO,EAAEC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;oBACxD,gBAAgB;mBACbP;gBAELQ,MAAMT,OAAOU,QAAQ;YACvB;YACA,OAAO;gBAAEC,IAAIT,SAASS,EAAE;gBAAEC,SAAU,MAAMV,SAASW,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;YAAc;QACxF;QACAC,eAAe,CAACC,YAAc3C,sBAAsB2C;QACpDC,cAAc,CAACnB,QAAUlB,qBAAqBkB,OAAOgB,KAAK,CAAC,IAAM;QACjEI,KAAK,IAAMC,KAAKD,GAAG;IACrB;AACF;AAKA,MAAME,SAAS;AAEf,MAAMC,YAA8B;IAClCC,QAAQ;IACRb,MAAM;QAAEc,OAAO;IAA8D;AAC/E;AAEA,SAASC,OAAOC,GAAqB;IACnC,MAAMC,MAAMD,IAAIhB,IAAI;IACpB,IAAI,OAAOiB,QAAQ,UAAU;QAC3B,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACH;YAC1B,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOD,OAAO,OAAOA,QAAQ,WAAYA,MAAkC,CAAC;AAC9E;AAEA,SAASI,SAASL,GAAqB,EAAEM,IAAY;QAClCN,cACHxB,2BACwB+B;IAFtC,MAAM/B,WAAWwB,eAAAA,IAAIxB,OAAO,YAAXwB,eAAe,CAAC;IACjC,MAAMO,SAAQ/B,4BAAAA,OAAO,CAAC8B,KAAKE,WAAW,GAAG,YAA3BhC,4BAA+BA,OAAO,CAAC8B,KAAK;IAC1D,OAAOG,OAAOC,MAAMC,OAAO,CAACJ,UAAUA,UAAAA,KAAK,CAAC,EAAE,YAARA,UAAY,KAAOA,gBAAAA,QAAS,IAAKK,IAAI;AAC7E;AAEA,0FAA0F,GAC1F,OAAO,eAAeC,iBACpBC,IAAkB,EAClBd,GAAqB,EACrBrC,GAAW,EACXoD,KAAa;QAEF5E;QAAoD6D;IAA/D,MAAMgB,MAAK7E,gBAAAA,aAAa6D,IAAIxB,OAAO,EAAW;QAAEyC,aAAa,GAAEjB,cAAAA,IAAIkB,MAAM,qBAAVlB,YAAYiB,aAAa;IAAC,cAA9E9E,gBAAoF;IAC/F,MAAMgF,OAAO,MAAML,KAAKzE,gBAAgB,CAAC,GAAGsB,IAAI,CAAC,EAAEqD,IAAI,EAAE;QAAED;QAAOK,UAAU7D;IAAgB;IAC5F,IAAI4D,KAAKE,OAAO,EAAE,OAAO;IACzB,OAAO;QACLxB,QAAQ;QACRb,MAAM;YAAEc,OAAO;QAA8C;QAC7DtB,SAAS;YAAE,eAAeiC,OAAOa,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACL,CAAAA,KAAKM,OAAO,GAAGX,KAAKrB,GAAG,EAAC,IAAK;QAAQ;IAC/F;AACF;AAUA;;;CAGC,GACD,OAAO,eAAeiC,gBACpBZ,IAAkB,EAClBhD,MAAc,EACd6D,OAAe,EACfC,KAAa;QAaCC,oBACW3F;IAZzB,MAAM4F,UAAU1E,qBAAqBU,QAAQ6D,SAASC;IACtD,IAAIE,YAAY,MAAM,OAAO;QAAEC,SAASnC;IAAU;IAClD,MAAMoC,UAAUlB,KAAKrD,SAAS,GAAGwE,UAAU,CAAC,SAASC,GAAG,CAACpE;IACzD,MAAM,CAAC+D,cAAcM,OAAOC,cAAc,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC7DN,QAAQO,GAAG;QACXP,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAAC,SAASK,GAAG;QAC/CP,QAAQC,UAAU,CAAC,UAAUC,GAAG,CAACP,SAASY,GAAG;KAC9C;IACD,IAAI,CAACV,aAAaW,MAAM,IAAI,CAACJ,cAAcI,MAAM,EAAE,OAAO;QAAET,SAASnC;IAAU;IAC/E,MAAM6C,QAAQL,cAAcM,IAAI;IAChC,IAAI,CAAC/F,cAAcgG,OAAO,CAACF,UAAU,CAACA,MAAMG,KAAK,EAAE,OAAO;QAAEb,SAASnC;IAAU;IAC/E,MAAMiD,QAAQhB,qBAAAA,aAAaa,IAAI,cAAjBb,qBAAuB,CAAC;IACtC,MAAMiB,YAAYrC,QAAOvE,oBAAAA,iBAAiB,gBAAgB2G,iBAAjC3G,oBAA6D;IACtF,MAAM6G,UAAUpG,cAAcqG,gBAAgB,CAACP,MAAMG,KAAK;IAC1D,IAAId,UAAUiB,SAAS,OAAO;QAAEhB,SAASnC;IAAU;IACnD,IAAIkC,UAAUiB,SAAS;QACrB,OAAO;YACLhB,SAAS;gBACPlC,QAAQ;gBACRb,MAAM;oBACJiE,OAAO;oBACPH;oBACAI,UAAU;oBACVpD,OAAO,CAAC,4BAA4B,EAAEgD,aAAa,eAAe,uBAAuB,CAAC;gBAC5F;YACF;QACF;IACF;IACA,OAAO;QAAEK,QAAQ;YAAEnB;YAASa;YAAMJ;YAAOK;YAAWX;QAAM;IAAE;AAC9D;AAEA,8FAA8F,GAC9F,OAAO,SAASiB,gBAAgBC,MAA+B;QACvCA,gBACCA,WACFA;IAFrB,MAAMvF,SAAS2C,QAAO4C,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB;IAC1C,MAAM1B,UAAUlB,QAAO4C,YAAAA,MAAM,CAAC,IAAI,YAAXA,YAAe,IAAIC,KAAK,CAAC,GAAG;IACnD,MAAM1B,QAAQnB,QAAO4C,YAAAA,MAAM,CAAC,IAAI,YAAXA,YAAe,IAAIC,KAAK,CAAC,GAAG;IACjD,MAAMC,WAAW5D,OAAO6D,IAAI,CAAC1F,WAAW6B,OAAO6D,IAAI,CAAC7B,YAAY8B,QAAQ7B;IACxE,OAAO;QAAE9D;QAAQ6D;QAASC;QAAO2B;IAAS;AAC5C;AAEA,2DAA2D,GAC3D,OAAO,eAAeG,gBAAgB5C,IAAkB,EAAEd,GAAqB;QAEfA,YAkB3CmC;IAnBnB,IAAInC,IAAIrB,MAAM,KAAK,OAAO,OAAO;QAAEkB,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAAqB;IAAE;IACtF,MAAM,EAAEhC,MAAM,EAAE6D,OAAO,EAAEC,KAAK,EAAE2B,QAAQ,EAAE,GAAGH,iBAAiBpD,aAAAA,IAAI2D,KAAK,YAAT3D,aAAa,CAAC;IAC5E,IAAI,CAACuD,UAAU,OAAO;QAAE1D,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA2B;IAAE;IACjF,MAAM8D,UAAU,MAAM/C,iBAAiBC,MAAMd,KAAK,CAAC,oBAAoB,EAAElC,QAAQ,EAAET;IACnF,IAAIuG,SAAS,OAAOA;IACpB,MAAMC,SAAS,MAAMnC,gBAAgBZ,MAAMhD,QAAQ6D,SAASC;IAC5D,IAAI,aAAaiC,QAAQ;QACvB,gEAAgE;QAChE,IAAIA,OAAO9B,OAAO,CAAClC,MAAM,KAAK,KAAK;YACjC,MAAM,EAAEiD,SAAS,EAAE,GAAGe,OAAO9B,OAAO,CAAC/C,IAAI;YACzC,OAAO;gBAAEa,QAAQ;gBAAKb,MAAM;oBAAEiE,OAAO;oBAAYH;gBAAU;YAAE;QAC/D;QACA,OAAOe,OAAO9B,OAAO;IACvB;IACA,MAAM,EAAEc,IAAI,EAAEJ,KAAK,EAAEK,SAAS,EAAEX,KAAK,EAAE,GAAG0B,OAAOV,MAAM;IACvD,MAAMW,OAAOnH,cAAcoH,kBAAkB,CAAC;QAC5CtB;QACAuB,SAASrC;QACTmB;QACAmB,UAAUxD,QAAO0B,aAAAA,MAAMI,GAAG,CAAC,uBAAVJ,aAAyB;QAC1C+B,YAAYvH,cAAcwH,aAAa,CAAC1B,SAAS,OAAOvF,eAAe2F,MAAM/E,QAAQ6D;IACvF;IACA,OAAO;QAAE9B,QAAQ;QAAKb,MAAM8E;IAA2C;AACzE;AAEA,oFAAoF,GACpF,OAAO,SAASM,wBAAwB/F,KAUvC;;QA4CsBuE;IA3CrB,MAAM,EAAEyB,MAAM,EAAE5B,KAAK,EAAE,GAAGpE;IAC1B,MAAMuE,QAAQH,MAAMG,KAAK;IACzB,MAAMrE,SAAS,IAAI+F,gBAAgB;QACjCC,MAAM;OACH9H,wCAAwC,YACvC4H,OAAOG,YAAY,GAAG;QAAE,0BAA0B;IAAO,IAAI,CAAC;IAEpEH,OAAOI,KAAK,CAACC,OAAO,CAAC,CAACC,MAAMC;QAC1B,MAAMC,KAAK,CAAC,WAAW,EAAED,MAAM,CAAC,CAAC;QACjCrG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,UAAU,CAAC,EAAE;QAC9BtG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,sBAAsB,CAAC,EAAE;QAC1CtG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,yBAAyB,CAAC,EAAEpE,OAAOkE,KAAKI,WAAW;QACpExG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,gCAAgC,CAAC,EAAEF,KAAKrE,IAAI,CAACgD,KAAK,CAAC,GAAG;QACvE,IAAIqB,KAAKK,WAAW,EAAEzG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,uCAAuC,CAAC,EAAEF,KAAKK,WAAW;QACjG,2FAA2F;QAC3F,IAAI,CAACL,KAAKM,OAAO,EAAE1G,OAAOuG,GAAG,CAAC,GAAGD,GAAG,oCAAoC,CAAC,EAAE;QAC3E,IAAIF,KAAKM,OAAO,IAAI5G,MAAMD,SAAS,EAAEG,OAAOuG,GAAG,CAAC,GAAGD,GAAG,cAAc,CAAC,EAAExG,MAAMD,SAAS;IACxF;IACA,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAIiG,OAAOa,aAAa,GAAG,GAAG;;YACLtC;QAAvB,MAAMuC,UAAU1E,iBAAOmC,gBAAAA,MAAMwC,MAAM,qBAAZxC,cAAcuC,OAAO,oBAAI,IAAIE,WAAW;QAC/D1I,cAAc2I,qCAAqC,CACjD/G,QACA,aAAaiF,IAAI,CAAC2B,WAAW;YAACA;SAAQ,GAAGxI,cAAc4I,2BAA2B;QAEpF5I,cAAc6I,4BAA4B,CAACjH,QAAQ;YACjD;gBAAEkH,QAAQ;gBAASnF,MAAM;gBAAYyE,aAAaV,OAAOa,aAAa;YAAC;SACxE;IACH;IACA,MAAMQ,qBAAqBrB,OAAOa,aAAa;IAC/C,KAAK,MAAM,CAACvH,KAAK4C,MAAM,IAAIoF,OAAOC,OAAO,CACvCjJ,cAAckJ,uBAAuB,CAAC;QACpCC,WAAWzH,MAAMyH,SAAS;QAC1BC,UAAU1H,MAAM0H,QAAQ;QACxBC,UAAU3B,OAAOG,YAAY,GAAG,aAAa;QAC7CyB,oBAAoB5B,OAAO6B,UAAU;QACrCR;IACF,IACC;QACDnH,OAAOuG,GAAG,CAACnH,KAAK4C;IAClB;IACA,MAAM4F,QAAQ1F,gBAAOmC,kBAAAA,MAAMwD,QAAQ,qBAAdxD,gBAAgBuD,KAAK,mBAAI,IAAIvF,IAAI;IACtD,IAAIuF,OAAO5H,OAAOuG,GAAG,CAAC,kBAAkBqB;IACxC,MAAME,YAAYhI,MAAMiI,SAAS,CAACC,QAAQ,CAAC,OAAO,MAAM;IACxDhI,OAAOuG,GAAG,CAAC,eAAe,GAAGzG,MAAMiI,SAAS,GAAGD,UAAU,gCAAgC,CAAC;IAC1F9H,OAAOuG,GAAG,CAAC,cAAczG,MAAMiI,SAAS;IACxC,yEAAyE;IACzE,2EAA2E;IAC3E,sCAAsC;IACtC/H,OAAOuG,GAAG,CAAC,kBAAkB;IAC7BvG,OAAOuG,GAAG,CAAC,oBAAoBzG,MAAMP,MAAM;IAC3CS,OAAOuG,GAAG,CAAC,qBAAqBzG,MAAMsD,OAAO;IAC7CpD,OAAOuG,GAAG,CAAC,qBAAqBzG,MAAMsD,OAAO;IAC7CpD,OAAOuG,GAAG,CAAC,8BAA8BrE,OAAO9D,cAAcqG,gBAAgB,CAACJ;IAC/ErE,OAAOuG,GAAG,CAAC,8BAA8BrE,OAAO+F,OAAO5D,MAAM6D,WAAW,KAAK;IAC7ElI,OAAOuG,GAAG,CAAC,sBAAsBrE,OAAOpC,MAAM0H,QAAQ;IACtD,yEAAyE;IACzE,oDAAoD;IACpD,IAAI1B,OAAOqC,QAAQ,GAAG,KAAKrC,OAAOsC,MAAM,KAAK,MAAM;QACjDpI,OAAOuG,GAAG,CAAC,sBAAsBrE,OAAO4D,OAAOqC,QAAQ;IACzD;IACA,IAAIrC,OAAOG,YAAY,EAAE;QACvBjG,OAAOuG,GAAG,CACR,2BACArE,OACE9D,cAAciK,2BAA2B,CAAC;YACxCb,UAAU1H,MAAM0H,QAAQ;YACxBE,oBAAoB5B,OAAO6B,UAAU;YACrCR;QACF;QAGJnH,OAAOuG,GAAG,CAAC,mCAAmCrE,OAAOiF;IACvD;IACA/I,cAAckK,mCAAmC,CAACtI,QAAQF,MAAMyI,cAAc;IAC9E,OAAOvI;AACT;AAEA,MAAMwI,wBAAwB;AAE9B,MAAMC,UAAU,CAACnH,QAAgBoH,QAAgBnH,OAAeoH,QAAiC,CAAC,CAAC,GAAwB,CAAA;QACzHrH;QACAb,MAAM;YAAEc;YAAOmH;WAAWC;IAC5B,CAAA;AAEA,4EAA4E,GAC5E,OAAO,eAAeC,eAAerG,IAAkB,EAAEd,GAAqB;QAyCvDmC,kBAeHM;QAvCwCA,cAYzC2E,YA4BW3E;IAxD5B,IAAIzC,IAAIrB,MAAM,KAAK,QAAQ,OAAO;QAAEkB,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAAqB;IAAE;IACvF,IAAI,CAACjB,QAAQC,GAAG,CAACC,iBAAiB,EAAE,OAAO;QAAEc,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA+B;IAAE;IAC1G,MAAM,EAAEhC,MAAM,EAAE6D,OAAO,EAAEC,KAAK,EAAE2B,QAAQ,EAAE,GAAGH,gBAAgBrD,OAAOC;IACpE,IAAI,CAACuD,UAAU,OAAO;QAAE1D,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA2B;IAAE;IACjF,MAAMuH,iBAAiBhH,SAASL,KAAK,mBAAmBsD,KAAK,CAAC,GAAG;IACjE,IAAI,CAAC+D,gBAAgB,OAAO;QAAExH,QAAQ;QAAKb,MAAM;YAAEc,OAAO;QAA0C;IAAE;IACtG,MAAM8D,UAAU,MAAM/C,iBAAiBC,MAAMd,KAAK,CAAC,mBAAmB,EAAElC,QAAQ,EAAER;IAClF,IAAIsG,SAAS,OAAOA;IACpB,MAAMC,SAAS,MAAMnC,gBAAgBZ,MAAMhD,QAAQ6D,SAASC;IAC5D,IAAI,aAAaiC,QAAQ,OAAOA,OAAO9B,OAAO;IAC9C,MAAM,EAAEC,OAAO,EAAEa,IAAI,EAAEJ,KAAK,EAAEK,SAAS,EAAEX,KAAK,EAAE,GAAG0B,OAAOV,MAAM;IAEhE,yEAAyE;IACzE,yEAAyE;IACzE,8EAA8E;IAC9E,MAAMmE,OAAOd,OAAOzG,OAAOC,IAAI,CAAC,IAAI;IACpC,IAAIwG,OAAOe,QAAQ,CAACD,SAASA,OAAO,KAAKA,SAAUd,CAAAA,QAAO/D,eAAAA,MAAMG,KAAK,qBAAXH,aAAagE,WAAW,KAAK,CAAA,GAAI;QACzF,OAAOO,QAAQ,KAAK,WAAWD;IACjC;IACA,MAAMS,UAAU7K,cAAc8K,eAAe,CAAChF,OAAOd;IACrD,IAAI6F,SAAS,OAAOR,QAAQ,KAAKQ,SAAS7K,cAAc+K,sBAAsB,CAACF,SAAS1E;IACxF,MAAMsE,QAAQ,MAAMtG,KAAKjD,UAAU,CAACC;IACpC,MAAM6J,cAAcX,QAClB,KACA,wBACA,GAAGlE,aAAa,gBAAgB,sEAAsE,CAAC;IAEzG,IAAI,CAAChH,iBAAiBsL,yBAAAA,MAAOlJ,GAAG,EAAW,aAAa,OAAOyJ;IAC/D,MAAMC,WAAWR,0BAAAA,aAAAA,MAAOlJ,GAAG,qBAAVkJ,WAAYQ,QAAQ;IACrC,MAAMC,UAAUD,WAAW,MAAM9G,KAAKrD,SAAS,GAAGwE,UAAU,CAAC,YAAYC,GAAG,CAACzB,OAAOmH,WAAWrF,GAAG,KAAK;IACvG,MAAMuD,YAAY+B,2BAAAA,QAAStF,GAAG,CAAC;IAC/B,MAAMuF,QAAQtL,uBACZ;QACEsJ;QACAiC,cAAc,EAAEF,2BAAAA,QAAStF,GAAG,CAAC;QAC7ByF,eAAe,EAAEH,2BAAAA,QAAStF,GAAG,CAAC;IAChC,GACA;QAAE0F,SAAS,CAAC,MAAM,EAAEtG,QAAQ,SAAS,EAAE7D,QAAQ;IAAC;IAElD,IAAI,CAACgK,OAAO,OAAOH;IACnB,MAAMO,eAAe/F,aAAAA,MAAMI,GAAG,CAAC,kBAAVJ,aAAoB,CAAC;IAC1C,IAAIxF,cAAcwL,qBAAqB,CAAC;QAAEC,UAAUF;IAAY,GAAGG,IAAI,KAAK,aAAa;QACvF,OAAOrB,QAAQ,KAAK,iBAAiBrK,cAAc+K,sBAAsB,CAAC,iBAAiB5E;IAC7F;IAEA,MAAMuB,SAAS1H,cAAc2L,mBAAmB,CAAC7F,OAAOd;IACxD,MAAMoE,WAAW9J,2BAA2BmL,yBAAAA,MAAOlJ,GAAG,EAAWmG,OAAOkE,cAAc,EAAElE,OAAO6B,UAAU,EAAE7B,OAAOmE,UAAU;IAC5H,MAAMrK,aAAa,MAAM2C,KAAK3C,UAAU,CAACsC,eAAO2G,yBAAAA,MAAOpJ,EAAE,mBAAI;IAC7D,MAAMyK,OAAO5F;IACb,MAAM6F,SAAStM,iBAAiB;QAC9BuM,YAAY;YAACtI,SAASL,KAAK;YAAY,CAAC,QAAQ,EAAEK,SAASL,KAAK,SAAS;SAAC;QAC1EyI;QACAG,aAAavI,SAASL,KAAK;IAC7B;IACA,MAAMsG,YAAY,GAAGoC,SAAShM,cAAciF,SAASC,QAAQ;IAC7D,MAAMiH,aAAYpG,2BAAAA,MAAMqG,iBAAiB,YAAvBrG,2BAA2B;IAC7C,MAAMsG,eAAevC,QAAO/D,gBAAAA,MAAMG,KAAK,qBAAXH,cAAagE,WAAW,KAAK;IAEzD,MAAMuC,UAAU,MAAMjN,aAAa+E,KAAKrD,SAAS,IAAI;QACnD4K,MAAM;QACNY,SAAS,GAAGnL,OAAO,CAAC,EAAE6D,SAAS;QAC/B1D,OAAOwC,gBAAO2G,yBAAAA,MAAOpJ,EAAE,oBAAI;QAC3BL,KAAK0J;QACL6B,aAAa;IACf;IACA,IAAI,YAAYF,SAAS;QACvB,OAAO;YAAEnJ,QAAQmJ,QAAQG,MAAM,CAACtJ,MAAM;YAAEb,MAAMgK,QAAQG,MAAM,CAACnK,IAAI;QAA4B;IAC/F;IACA,MAAMoK,QAAQJ,QAAQI,KAAK;IAC3B,MAAMC,YAAY,CAACC;QACjB,MAAMC,UAAUvN,sBAAsBoN,MAAMC,SAAS,EAAEC;QACvD,OAAOC,UAAU;YAAE,mBAAmBA;QAAQ,IAAI,CAAC;IACrD;IACA,IAAIC,SAAS;IACb,IAAI;QACF,wEAAwE;QACxE,yEAAyE;QACzE,8DAA8D;QAC9D,IAAIX,WAAW;YACb,MAAMY,WAAW,MAAM3I,KAAKxB,aAAa,CAACuJ;YAC1C,IAAIY,aAAa,YAAY;gBAC3B,MAAML,MAAMM,OAAO;gBACnB,OAAO1C,QAAQ,KAAK,QAAQ,8DAA8D;oBAAE2C,YAAY;gBAAK;YAC/G;YACA,IAAIF,aAAa,QAAQ;gBACvB,MAAML,MAAMM,OAAO;gBACnB,OAAO;oBAAE7J,QAAQ;oBAAKb,MAAM;wBAAEc,OAAO;oBAA+C;gBAAE;YACxF;QACF;QAEA,IAAI1B,YAAY;QAChB,IAAIiG,OAAOsC,MAAM,KAAK,QAAQtC,OAAOuF,YAAY,GAAG,GAAG;gBAGlD;gBAFWnH;YAAd,MAAMoH,SAAQpH,gBAAAA,MAAMG,KAAK,qBAAXH,cAAaqH,GAAG;YAC9B1L,aACG,QAAA,MAAM0C,KAAK1C,SAAS,CAAC;gBACpB4D;gBACA2E,QAAQtC,OAAOsC,MAAM;gBACrBoD,UACEF,CAAAA,yBAAAA,MAAOxB,IAAI,MAAK,SACZwB,MAAMG,KAAK,IAAI,CAAC,KAAK,EAAE3F,OAAOsC,MAAM,CAAC,EAAE,CAAC,GACxC;gBACNnI,SAAS6K,UAAU,CAAC,SAAS,EAAE/H,KAAK2I,KAAK,CAAC5F,OAAOsC,MAAM,GAAG,QAAS;YACrE,cARC,QAQM;YACT,IAAI,CAACvI,WAAW;gBACd,8CAA8C;gBAC9C,MAAMgL,MAAMM,OAAO;gBACnB,OAAO;oBAAE7J,QAAQ;oBAAKb,MAAM;wBAAEc,OAAO;oBAA+C;gBAAE;YACxF;QACF;QAEA,MAAMgH,iBAAiBnK,cAAcuN,sCAAsC,CACzEvN,cAAcwN,wCAAwC,CAAChI,MAAMI,GAAG,CAAC;QAEnE,MAAMhE,SAAS6F,wBAAwB;YACrCtG;YACA6D;YACAc;YACA4B;YACAyB,WAAWrF,OAAOqF;YAClBC;YACA3H;YACAkI;YACAQ;QACF;QACA,IAAI3I,WAAWiM,MAAM,EAAE;gBACa7L;YAAlCzB,0BAA0ByB,SAAQA,cAAAA,OAAOgE,GAAG,CAAC,0BAAXhE,cAA6B+H;QACjE;QACA,MAAM+D,SAASlM,WAAWiM,MAAM,GAC5BtJ,KAAKtB,YAAY,CAAC;YAAE8K,SAAShE;YAAWmC;YAAM3K;QAAO,KACrDuE,QAAQkI,OAAO,CAAC;QACpB,MAAMC,UAAU,MAAM1J,KAAKxC,aAAa,CAACC,QAAQ,aAC5C8K,UAAU,YACVtM,4BAA4BoB;QAEjC,MAAMkM;QACN,MAAMI,UAAUD,QAAQtL,EAAE,GACtBlC,2BAA2BwN,QAAQrL,OAAO,EAAEhB,YAAY2I,eAAe4D,OAAO,IAC9E;QACJ,IAAI,CAACD,WAAW,CAACD,QAAQrL,OAAO,CAACnB,EAAE,EAAE;gBACUwM;YAA7CG,QAAQ7K,KAAK,CAAC,gCAA+B0K,mBAAAA,QAAQrL,OAAO,qBAAfqL,iBAAiB1K,KAAK;YACnE,MAAMsJ,MAAMM,OAAO;YACnB,OAAO;gBAAE7J,QAAQ;gBAAKb,MAAM;oBAAEc,OAAO;gBAA+C;YAAE;QACxF;QACA0J,SAAS/I,OAAO+J,QAAQrL,OAAO,CAACnB,EAAE;QAElC,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,oBAAoB;QACpB,MAAM4M,WAAW5I,QAAQC,UAAU,CAAC,UAAUC,GAAG,CAACP;QAClD,MAAMkJ,UAAU,MAAM/J,KAAKrD,SAAS,GAAGqN,cAAc,CAAC,OAAOC;gBAmB/ChI;YAlBZ,MAAMiI,WAAW,MAAMD,YAAYxI,GAAG,CAACqI;YACvC,MAAM7H,UAAUiI,SAASxI,MAAM,GAAIwI,SAAStI,IAAI,KAAiC;YACjF,IAAI,CAACK,WAAW,CAACpG,cAAcgG,OAAO,CAACI,UAAU,OAAO;gBAAEhB,SAASnC;gBAAWqL,WAAW;YAAG;YAC5F,IAAI,CAACtO,cAAcwH,aAAa,CAACpB,UAAU;gBACzC,OAAO;oBACLhB,SAASiF,QAAQ,KAAK,QAAQrK,cAAc+K,sBAAsB,CAAC,QAAQ5E;oBAC3EmI,WAAW;gBACb;YACF;YACA,IAAItO,cAAcqG,gBAAgB,CAACD,QAAQH,KAAK,MAAMjG,cAAcqG,gBAAgB,CAACP,MAAMG,KAAK,GAAG;gBACjG,OAAO;oBACLb,SAAS;wBACPlC,QAAQ;wBACRb,MAAM;4BAAEkE,UAAU;4BAAMpD,OAAO,CAAC,4BAA4B,EAAEgD,aAAa,eAAe,uBAAuB,CAAC;wBAAC;oBACrH;oBACAmI,WAAW;gBACb;YACF;YACA,IAAI,AAACzE,CAAAA,QAAOzD,iBAAAA,QAAQH,KAAK,qBAAbG,eAAe0D,WAAW,KAAK,CAAA,MAAOsC,cAAc;gBAC9D,OAAO;oBAAEhH,SAASiF,QAAQ,KAAK,WAAWD;oBAAwBkE,WAAW;gBAAG;YAClF;YACAF,YAAYjG,GAAG,CAAC8F,UAAU;gBAAE9B,mBAAmBU;YAAO,GAAG;gBAAE0B,OAAO;YAAK;YACvE,MAAMD,YAAYlI,QAAQ+F,iBAAiB,IAAI/F,QAAQ+F,iBAAiB,KAAKD,YAAY9F,QAAQ+F,iBAAiB,GAAG;YACrH,OAAO;gBAAE/G,SAAS;gBAAMkJ;YAAU;QACpC;QACA,IAAIJ,QAAQ9I,OAAO,EAAE;YACnB,MAAMjB,KAAKxB,aAAa,CAACkK;YACzB,MAAMJ,MAAMM,OAAO;YACnB,OAAOmB,QAAQ9I,OAAO;QACxB;QACA,IAAI8I,QAAQI,SAAS,IAAIJ,QAAQI,SAAS,KAAKzB,QAAQ,MAAM1I,KAAKxB,aAAa,CAACuL,QAAQI,SAAS;QACjG,MAAM7B,MAAM+B,MAAM,CAAC,KAAKV;QACxB,OAAO;YAAE5K,QAAQ;YAAKb,MAAMyL;QAA8C;IAC5E,EAAE,OAAO3K,OAAO;QACd6K,QAAQ7K,KAAK,CAAC,oBAAoBA;QAClC,IAAI0J,QAAQ,MAAM1I,KAAKxB,aAAa,CAACkK,QAAQnK,KAAK,CAAC,IAAM;QACzD,MAAM+J,MAAMM,OAAO;QACnB,OAAO;YAAE7J,QAAQ;YAAKb,MAAM;gBAAEc,OAAO;YAA+C;QAAE;IACxF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASsL,qBAAqBC,GAAoC,EAAEtJ,OAAyB;QAGvDA;IAF3CsJ,IAAIC,SAAS,CAAC,iBAAiB;IAC/BD,IAAIC,SAAS,CAAC,gBAAgB;IAC9B,KAAK,MAAM,CAAChL,MAAMC,MAAM,IAAIoF,OAAOC,OAAO,EAAC7D,mBAAAA,QAAQvD,OAAO,YAAfuD,mBAAmB,CAAC,GAAIsJ,IAAIC,SAAS,CAAChL,MAAMC;IACvF,OAAO8K,IAAIxL,MAAM,CAACkC,QAAQlC,MAAM,EAAET,IAAI,CAAC2C,QAAQ/C,IAAI;AACrD;AAEA,oCAAoC,GACpC,OAAO,MAAMuM,mBAAqC,OAAOvL,KAAKqL;IAC5D,IAAI;QACF,OAAOD,qBAAqBC,KAAK,MAAM3H,gBAAgBlG,uBAAuBwC;IAChF,EAAE,OAAOF,OAAO;QACd6K,QAAQ7K,KAAK,CAAC,qBAAqBA;QACnC,OAAOsL,qBAAqBC,KAAK;YAAExL,QAAQ;YAAKb,MAAM;gBAAEc,OAAO;YAA6C;QAAE;IAChH;AACF,EAAC;AAED,oCAAoC,GACpC,OAAO,MAAM0L,kBAAoC,OAAOxL,KAAKqL,MAC3DD,qBAAqBC,KAAK,MAAMlE,eAAe3J,uBAAuBwC,MAAK"}

package/src/lib/server/quote-proofs.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler, type PluginApiRequest } from '@aglyn/aglyn/server';
+import { notifyHostManagers } from '@aglyn/tenant-data-admin';
+import { type QuoteLinkOutcome, type QuotePayDeps } from './quote-pay';
+import { type QuoteUploadCalls } from './quote-uploads';
+/** Proofs one address may load per site, per ten minutes: every thumbnail of a few visits. */
+export declare const QUOTE_PROOF_LOADS_PER_WINDOW = 120;
+/** Upload calls (tickets and finalizes) one address may make per site, per ten minutes, before the upload's own limits. */
+export declare const QUOTE_UPLOAD_CALLS_PER_WINDOW = 80;
+/** Answers one address may send per site, per ten minutes. */
+export declare const QUOTE_RESPONSES_PER_WINDOW = 20;
+export interface QuoteProofDeps extends QuotePayDeps {
+    uploads(): Promise<QuoteUploadCalls>;
+    notify(...args: Parameters<typeof notifyHostManagers>): Promise<void>;
+}
+export declare function defaultQuoteProofDeps(): QuoteProofDeps;
+/** What a proof route answers: a JSON outcome, or a file to stream. */
+export type QuoteProofOutcome = QuoteLinkOutcome & {
+    file?: {
+        path: string;
+        name: string;
+        contentType: string;
+    };
+};
+/** `GET /api/commerce/quote-proof`: one of the current revision's proofs. */
+export declare function handleQuoteProof(deps: QuoteProofDeps, req: PluginApiRequest): Promise<QuoteProofOutcome>;
+/** `POST /api/commerce/quote-upload`: a ticket for one of the customer's files, or its finalize. */
+export declare function handleQuoteUpload(deps: QuoteProofDeps, req: PluginApiRequest): Promise<QuoteLinkOutcome>;
+/** `POST /api/commerce/quote-respond`: the customer approves the proof or asks for changes. */
+export declare function handleQuoteRespond(deps: QuoteProofDeps, req: PluginApiRequest): Promise<QuoteLinkOutcome>;
+/** `GET /api/commerce/quote-proof`. */
+export declare const quoteProofHandler: PluginApiHandler;
+/** `POST /api/commerce/quote-upload`. */
+export declare const quoteUploadHandler: PluginApiHandler;
+/** `POST /api/commerce/quote-respond`. */
+export declare const quoteRespondHandler: PluginApiHandler;

package/src/lib/server/quote-proofs.js

@@ -0,0 +1,500 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { claimAttempt } from "@aglyn/aglyn/server";
+import { readClientIp } from "@aglyn/aglyn/app-utils/request-ip";
+import { VISITOR_UPLOAD_HONEYPOT_FIELD, visitorUploadFileView } from "@aglyn/aglyn/app-utils/visitor-upload";
+import { notifyHostManagers } from "@aglyn/tenant-data-admin";
+import * as CommerceModel from "../model/index.js";
+import { orderStatusUrl } from "./order-status-token.js";
+import { defaultQuotePayDeps, limitedQuoteLink, loadLinkedQuote, quoteLinkParams, sendQuoteLinkOutcome } from "./quote-pay.js";
+import { quoteUploadCalls } from "./quote-uploads.js";
+/*==========================================
+ * THE CUSTOMER'S SIDE OF A PROOF (AGL-4096), on the business's site, behind
+ * the quote's signed pay link like the page itself:
+ *
+ *   GET  /api/commerce/quote-proof?hostId=&q=&t=&file=<proofId>
+ *        → the current revision's proof (a picture inline, anything else as a
+ *          download) | 404 | 410 replaced | 429
+ *   POST /api/commerce/quote-upload  { hostId, q, t, action: 'ticket', file: { name, contentType, size } }
+ *        → { ticket, upload: { url, fields }, file }
+ *   POST /api/commerce/quote-upload  { hostId, q, t, action: 'finalize', ticket }
+ *        → { file: { id, name, contentType, size, uploadedAtMs } }
+ *   POST /api/commerce/quote-respond { hostId, q, t, v, action: 'approve', name }
+ *                                    { hostId, q, t, v, action: 'changes', comment, fileIds? }
+ *        + Idempotency-Key → 200 { view } | 409 { error, reason } | 410 { replaced } | 404 | 400 | 429
+ *
+ * Every route spends a per-address rate limit on the site BEFORE the token is
+ * checked, answers a wrong token exactly as a missing quote, and answers a
+ * link to an older version as replaced. The uploads are the shared visitor
+ * upload (`@aglyn/tenant-data-admin/server/visitor-upload`), scoped to this
+ * quote's artwork; the answer names the files by id and the server reads
+ * them back from that scope, so nothing else can be attached.
+ *
+ * `v` is the edit of the quote the page showed, as Pay sends it: an answer to
+ * proofs the customer has not seen is refused and the page is shown again.
+ *=========================================*/ /** Proofs one address may load per site, per ten minutes: every thumbnail of a few visits. */ export const QUOTE_PROOF_LOADS_PER_WINDOW = 120;
+/** Upload calls (tickets and finalizes) one address may make per site, per ten minutes, before the upload's own limits. */ export const QUOTE_UPLOAD_CALLS_PER_WINDOW = 80;
+/** Answers one address may send per site, per ten minutes. */ export const QUOTE_RESPONSES_PER_WINDOW = 20;
+export function defaultQuoteProofDeps() {
+    return _extends({}, defaultQuotePayDeps(), {
+        uploads: async ()=>quoteUploadCalls(),
+        notify: (...args)=>notifyHostManagers(...args)
+    });
+}
+function bodyOf(req) {
+    const raw = req.body;
+    if (typeof raw === 'string') {
+        try {
+            const parsed = JSON.parse(raw);
+            return parsed && typeof parsed === 'object' ? parsed : {};
+        } catch (unused) {
+            return {};
+        }
+    }
+    return raw && typeof raw === 'object' ? raw : {};
+}
+function headerOf(req, name) {
+    var _req_headers, _headers_name_toLowerCase, _value_;
+    const headers = (_req_headers = req.headers) != null ? _req_headers : {};
+    const value = (_headers_name_toLowerCase = headers[name.toLowerCase()]) != null ? _headers_name_toLowerCase : headers[name];
+    return String(Array.isArray(value) ? (_value_ = value[0]) != null ? _value_ : '' : value != null ? value : '').trim();
+}
+const clientIp = (req)=>{
+    var _req_socket;
+    return readClientIp(req.headers, {
+        remoteAddress: (_req_socket = req.socket) == null ? void 0 : _req_socket.remoteAddress
+    });
+};
+const reasonRefusal = (status, reason, error)=>({
+        status,
+        body: {
+            error,
+            reason
+        }
+    });
+/** `GET /api/commerce/quote-proof`: one of the current revision's proofs. */ export async function handleQuoteProof(deps, req) {
+    var _req_query, _query_file;
+    if (req.method !== 'GET') return {
+        status: 405,
+        body: {
+            error: 'Method not allowed'
+        }
+    };
+    const query = (_req_query = req.query) != null ? _req_query : {};
+    const { hostId, quoteId, token, complete } = quoteLinkParams(query);
+    const fileId = String((_query_file = query['file']) != null ? _query_file : '').slice(0, 200);
+    if (!complete || !fileId) return {
+        status: 400,
+        body: {
+            error: 'This link is incomplete.'
+        }
+    };
+    const limited = await limitedQuoteLink(deps, req, `commerce-quote-proof:${hostId}`, QUOTE_PROOF_LOADS_PER_WINDOW);
+    if (limited) return limited;
+    const linked = await loadLinkedQuote(deps, hostId, quoteId, token);
+    if ('outcome' in linked) return linked.outcome;
+    const proof = CommerceModel.currentQuoteProofs(linked.loaded.order.quote).find((entry)=>entry.id === fileId);
+    if (!(proof == null ? void 0 : proof.path)) return {
+        status: 404,
+        body: {
+            error: 'That proof is no longer on this quote.'
+        }
+    };
+    return {
+        status: 200,
+        body: {},
+        file: {
+            path: proof.path,
+            name: proof.name,
+            contentType: proof.contentType
+        }
+    };
+}
+/** `POST /api/commerce/quote-upload`: a ticket for one of the customer's files, or its finalize. */ export async function handleQuoteUpload(deps, req) {
+    var _clientIp;
+    if (req.method !== 'POST') return {
+        status: 405,
+        body: {
+            error: 'Method not allowed'
+        }
+    };
+    const body = bodyOf(req);
+    const { hostId, quoteId, token, complete } = quoteLinkParams(body);
+    if (!complete) return {
+        status: 400,
+        body: {
+            error: 'This link is incomplete.'
+        }
+    };
+    // A form a person fills never fills this; a bot that did learns nothing.
+    const honeypot = body[VISITOR_UPLOAD_HONEYPOT_FIELD];
+    if (typeof honeypot === 'string' && honeypot.trim()) return {
+        status: 200,
+        body: {
+            received: true
+        }
+    };
+    const limited = await limitedQuoteLink(deps, req, `commerce-quote-upload:${hostId}`, QUOTE_UPLOAD_CALLS_PER_WINDOW);
+    if (limited) return limited;
+    const linked = await loadLinkedQuote(deps, hostId, quoteId, token);
+    if ('outcome' in linked) return linked.outcome;
+    const { order, storeName } = linked.loaded;
+    // Artwork rides an answer; a quote that cannot be answered takes none.
+    const refused = CommerceModel.quoteRespondRefusal(order);
+    if (refused) return reasonRefusal(409, refused, CommerceModel.quoteRespondRefusalMessage(refused, storeName));
+    const scope = {
+        hostId,
+        purpose: CommerceModel.QUOTE_ARTWORK_PURPOSE,
+        purposeId: quoteId
+    };
+    const caller = {
+        ip: (_clientIp = clientIp(req)) != null ? _clientIp : 'no-address'
+    };
+    const uploads = await deps.uploads();
+    if (body['action'] === 'ticket') {
+        const minted = await uploads.mint({
+            scope,
+            request: body['file'],
+            caller
+        });
+        if ('error' in minted) {
+            return _extends({
+                status: minted.status,
+                body: {
+                    error: minted.error,
+                    code: minted.code
+                }
+            }, minted.retryAfterSeconds ? {
+                headers: {
+                    'Retry-After': String(minted.retryAfterSeconds)
+                }
+            } : {});
+        }
+        return {
+            status: 200,
+            body: {
+                ticket: minted.ticket,
+                upload: minted.upload,
+                file: minted.file
+            }
+        };
+    }
+    if (body['action'] === 'finalize') {
+        const kept = await uploads.finalize({
+            scope,
+            ticket: body['ticket'],
+            caller
+        });
+        if ('error' in kept) return {
+            status: kept.status,
+            body: {
+                error: kept.error,
+                code: kept.code
+            }
+        };
+        return {
+            status: 200,
+            body: {
+                file: visitorUploadFileView(kept.file)
+            }
+        };
+    }
+    return {
+        status: 400,
+        body: {
+            error: 'Unknown action'
+        }
+    };
+}
+const UPDATED_MESSAGE = 'This quote was updated since you opened it. Look it over again before you answer.';
+/** The managers' notice of an answer: who, which quote and revision, what they said, and what to do next. */ function noticeOf(input) {
+    var _response_files, _response_name, _response_comment, _ref;
+    var _quote_customer, _quote_customer1, _quote_customer2, _quote_customer3, _quote_customer4, _quote_customer5, _quote_customer6;
+    const { hostId, quoteId, order, response } = input;
+    const quote = order.quote;
+    const number = CommerceModel.formatQuoteNumber(order, quoteId);
+    const customer = ((_quote_customer = quote.customer) == null ? void 0 : _quote_customer.name) || ((_quote_customer1 = quote.customer) == null ? void 0 : _quote_customer1.company) || ((_quote_customer2 = quote.customer) == null ? void 0 : _quote_customer2.email) || 'The customer';
+    const revision = response.revision;
+    const files = (_response_files = response.files) != null ? _response_files : [];
+    const approving = response.action === 'approve';
+    const payNote = quote.requireProofApproval === true ? ' They can pay the quote now.' : '';
+    const details = [
+        {
+            label: 'Quote',
+            value: number
+        },
+        {
+            label: 'Customer',
+            value: [
+                (_quote_customer3 = quote.customer) == null ? void 0 : _quote_customer3.name,
+                (_quote_customer4 = quote.customer) == null ? void 0 : _quote_customer4.company,
+                (_quote_customer5 = quote.customer) == null ? void 0 : _quote_customer5.email
+            ].filter(Boolean).join(', ')
+        },
+        {
+            label: 'Revision',
+            value: String(revision)
+        },
+        ...approving ? [
+            {
+                label: 'Approved as',
+                value: (_response_name = response.name) != null ? _response_name : ''
+            }
+        ] : [
+            {
+                label: 'What to change',
+                value: (_response_comment = response.comment) != null ? _response_comment : ''
+            },
+            ...files.length ? [
+                {
+                    label: 'Files sent',
+                    value: files.map((file)=>file.name).join(', ')
+                }
+            ] : []
+        ]
+    ];
+    const email = String((_ref = (_quote_customer6 = quote.customer) == null ? void 0 : _quote_customer6.email) != null ? _ref : '').trim();
+    return {
+        payload: {
+            type: 'content.order',
+            title: approving ? `Proof approved — ${number} on {site}` : `Changes requested — ${number} on {site}`,
+            body: approving ? `${customer} approved the proof for revision ${revision} of ${number}.${payNote} The approval, with the name, time and address it was given from, is on the quote.` : `${customer} asked for changes to revision ${revision} of ${number}` + (files.length ? ` and sent ${files.length} file${files.length === 1 ? '' : 's'}` : '') + `. Read what they asked for on the quote, then start revision ${revision + 1} with new proofs.`,
+            link: `/${hostId}/products/orders?quote=${encodeURIComponent(quoteId)}`
+        },
+        options: _extends({
+            emailDetails: details
+        }, /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) ? {
+            replyTo: email
+        } : {})
+    };
+}
+/** `POST /api/commerce/quote-respond`: the customer approves the proof or asks for changes. */ export async function handleQuoteRespond(deps, req) {
+    var _order_quote;
+    if (req.method !== 'POST') return {
+        status: 405,
+        body: {
+            error: 'Method not allowed'
+        }
+    };
+    const body = bodyOf(req);
+    const { hostId, quoteId, token, complete } = quoteLinkParams(body);
+    if (!complete) return {
+        status: 400,
+        body: {
+            error: 'This link is incomplete.'
+        }
+    };
+    const honeypot = body[VISITOR_UPLOAD_HONEYPOT_FIELD];
+    if (typeof honeypot === 'string' && honeypot.trim()) return {
+        status: 200,
+        body: {
+            received: true
+        }
+    };
+    const idempotencyKey = headerOf(req, 'idempotency-key').slice(0, 200);
+    if (!idempotencyKey) return {
+        status: 400,
+        body: {
+            error: 'An answer needs an Idempotency-Key header.'
+        }
+    };
+    const limited = await limitedQuoteLink(deps, req, `commerce-quote-respond:${hostId}`, QUOTE_RESPONSES_PER_WINDOW);
+    if (limited) return limited;
+    const linked = await loadLinkedQuote(deps, hostId, quoteId, token);
+    if ('outcome' in linked) return linked.outcome;
+    const { hostRef, host, order, storeName, store } = linked.loaded;
+    // Everything the customer can be refused is decided before the claim, so
+    // none of it spends the attempt.
+    const seen = Number(body['v']);
+    const version = Number((_order_quote = order.quote) == null ? void 0 : _order_quote.updatedAtMs) || 0;
+    if (!Number.isFinite(seen) || seen !== version) return reasonRefusal(409, 'updated', UPDATED_MESSAGE);
+    const parsed = CommerceModel.parseQuoteResponseInput(body);
+    if ('error' in parsed) return {
+        status: 400,
+        body: {
+            error: parsed.error
+        }
+    };
+    const refused = CommerceModel.quoteRespondRefusal(order);
+    if (refused) return reasonRefusal(409, refused, CommerceModel.quoteRespondRefusalMessage(refused, storeName));
+    // The files are read back from this quote's artwork, by id: nothing the
+    // browser says about a file is believed, and no other record's file can
+    // be named.
+    let files = [];
+    if (parsed.input.action === 'changes' && parsed.input.fileIds.length) {
+        const uploads = await deps.uploads();
+        const scope = {
+            hostId,
+            purpose: CommerceModel.QUOTE_ARTWORK_PURPOSE,
+            purposeId: quoteId
+        };
+        const read = await Promise.all(parsed.input.fileIds.map((id)=>uploads.read(scope, id)));
+        if (read.some((file)=>!file)) {
+            return {
+                status: 400,
+                body: {
+                    error: 'One of your files did not finish sending. Send it again.'
+                }
+            };
+        }
+        files = read.map((file)=>({
+                id: file.id,
+                name: file.name,
+                contentType: file.contentType,
+                size: file.size,
+                path: file.path
+            }));
+    }
+    const claimed = await claimAttempt(deps.firestore(), {
+        kind: 'commerce-quote-respond',
+        scopeId: `${hostId}:${quoteId}`,
+        orgId: '',
+        key: idempotencyKey,
+        busyMessage: 'Your answer is already being sent'
+    });
+    if ('replay' in claimed) {
+        return {
+            status: claimed.replay.status,
+            body: claimed.replay.body
+        };
+    }
+    const claim = claimed.claim;
+    const now = deps.now();
+    try {
+        var _store_get;
+        const ref = hostRef.collection('orders').doc(quoteId);
+        const settled = await deps.firestore().runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const current = snapshot.exists ? snapshot.data() : null;
+            if (!current || !CommerceModel.isQuote(current) || !current.quote) {
+                return {
+                    outcome: {
+                        status: 404,
+                        body: {
+                            error: 'We could not find that quote. Check the link you were sent.'
+                        }
+                    }
+                };
+            }
+            if (CommerceModel.quoteLinkVersion(current.quote) !== CommerceModel.quoteLinkVersion(order.quote)) {
+                return {
+                    outcome: {
+                        status: 410,
+                        body: {
+                            replaced: true,
+                            error: `This quote was updated, and ${storeName || 'the business'} sent you a newer link.`
+                        }
+                    }
+                };
+            }
+            if ((Number(current.quote.updatedAtMs) || 0) !== version) {
+                return {
+                    outcome: reasonRefusal(409, 'updated', UPDATED_MESSAGE)
+                };
+            }
+            const answered = CommerceModel.applyQuoteResponse(current, _extends({}, parsed.input, files.length ? {
+                files
+            } : {}), {
+                atMs: now,
+                ip: clientIp(req),
+                userAgent: headerOf(req, 'user-agent') || null
+            });
+            if ('reason' in answered) {
+                return {
+                    outcome: reasonRefusal(409, answered.reason, CommerceModel.quoteRespondRefusalMessage(answered.reason, storeName))
+                };
+            }
+            transaction.set(ref, answered.order);
+            return {
+                outcome: {
+                    status: 200,
+                    body: {}
+                },
+                order: answered.order,
+                response: answered.response
+            };
+        });
+        if (!settled.order || !settled.response) {
+            await claim.release();
+            return settled.outcome;
+        }
+        const view = CommerceModel.buildQuotePageView({
+            order: settled.order,
+            orderId: quoteId,
+            storeName,
+            currency: String((_store_get = store.get('currency')) != null ? _store_get : 'USD'),
+            receiptUrl: CommerceModel.isUnpaidQuote(settled.order) ? null : orderStatusUrl(host, hostId, quoteId)
+        });
+        const outcome = {
+            status: 200,
+            body: {
+                view
+            }
+        };
+        await claim.record(200, outcome.body);
+        const notice = noticeOf({
+            hostId,
+            quoteId,
+            order: settled.order,
+            response: settled.response
+        });
+        void deps.notify(hostId, notice.payload, notice.options);
+        return outcome;
+    } catch (error) {
+        console.error('quote respond failed', error);
+        await claim.release();
+        return {
+            status: 500,
+            body: {
+                error: 'Your answer could not be sent. Try again.'
+            }
+        };
+    }
+}
+/** `GET /api/commerce/quote-proof`. */ export const quoteProofHandler = async (req, res)=>{
+    const deps = defaultQuoteProofDeps();
+    try {
+        const outcome = await handleQuoteProof(deps, req);
+        if (!outcome.file) return sendQuoteLinkOutcome(res, outcome);
+        const uploads = await deps.uploads();
+        return await uploads.send(res, outcome.file);
+    } catch (error) {
+        console.error('quote proof failed', error);
+        return sendQuoteLinkOutcome(res, {
+            status: 500,
+            body: {
+                error: 'This proof could not be loaded. Try again.'
+            }
+        });
+    }
+};
+/** `POST /api/commerce/quote-upload`. */ export const quoteUploadHandler = async (req, res)=>{
+    try {
+        return sendQuoteLinkOutcome(res, await handleQuoteUpload(defaultQuoteProofDeps(), req));
+    } catch (error) {
+        console.error('quote upload failed', error);
+        return sendQuoteLinkOutcome(res, {
+            status: 500,
+            body: {
+                error: 'The file could not be sent. Try again.'
+            }
+        });
+    }
+};
+/** `POST /api/commerce/quote-respond`. */ export const quoteRespondHandler = async (req, res)=>sendQuoteLinkOutcome(res, await handleQuoteRespond(defaultQuoteProofDeps(), req));
+
+//# sourceMappingURL=quote-proofs.js.map