@aglyn/plugins-commerce 1.0.0-beta.288 → 1.0.0-beta.290

package/src/lib/server/quote.js

@@ -0,0 +1,846 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { claimAttempt } from "@aglyn/aglyn/server";
+import { createResourceUid } from "@aglyn/aglyn/app-utils/create-resource-uid";
+import { checkEntitlement } from "@aglyn/aglyn/server";
+import { searchPluginPeople } from "@aglyn/aglyn/plugin-manager/plugin-person-records";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import * as CommerceModel from "../model/index.js";
+import { commerceSitePermissionRefusal } from "../model/plugin-permissions.js";
+import { holdsCommerceSiteKey } from "./commerce-site-keys.js";
+import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
+import { expireCheckoutSession } from "./checkout-session-expiry.js";
+import { sendPdf } from "./pdf-response.js";
+import { quotePayLinkUrl } from "./quote-link-token.js";
+export function defaultQuoteDeps() {
+    return {
+        verifyIdToken: (token)=>firebaseAdmin.app().auth().verifyIdToken(token),
+        firestore: ()=>firebaseAdmin.app().firestore(),
+        orgForHost: async (hostId)=>{
+            const found = await getOrgForHost(hostId);
+            return found ? {
+                id: found.orgId,
+                org: found.org
+            } : null;
+        },
+        searchPeople: (request)=>searchPluginPeople(request),
+        quoteTax: (request)=>quoteSaleTaxWithEngine(request),
+        expireSession: (sessionId)=>expireCheckoutSession(sessionId),
+        payLinkUrl: (host, hostId, quoteId, version)=>quotePayLinkUrl(host, hostId, quoteId, version),
+        quotePdf: async (input)=>(await import("./commerce-pdf.js")).quotePdfFile(input),
+        uploads: async ()=>(await import("./quote-uploads.js")).quoteUploadCalls(),
+        now: ()=>Date.now()
+    };
+}
+/** Expires the session the pay page opened, when there is one; a failure is logged, never thrown. */ async function closeOpenSession(deps, sessionId, context) {
+    if (!sessionId) return;
+    const result = await deps.expireSession(sessionId).catch(()=>'open');
+    if (result === 'open') {
+        console.error(`${context}: the quote's Stripe session was not expired and may still be paid`, {
+            sessionId
+        });
+    }
+}
+const refuse = (status, error)=>({
+        status,
+        body: {
+            error
+        }
+    });
+function bodyOf(req) {
+    const raw = req.body;
+    if (typeof raw === 'string') {
+        try {
+            const parsed = JSON.parse(raw);
+            return parsed && typeof parsed === 'object' ? parsed : {};
+        } catch (unused) {
+            return {};
+        }
+    }
+    return raw && typeof raw === 'object' ? raw : {};
+}
+function headerOf(req, name) {
+    var _req_headers, _headers_name_toLowerCase, _value_;
+    const headers = (_req_headers = req.headers) != null ? _req_headers : {};
+    const value = (_headers_name_toLowerCase = headers[name.toLowerCase()]) != null ? _headers_name_toLowerCase : headers[name];
+    return String(Array.isArray(value) ? (_value_ = value[0]) != null ? _value_ : '' : value != null ? value : '').trim();
+}
+const DOC_ID = /^(?!__.*__$)[^/]{1,200}$/;
+/** The ship-to as a tax service reads it, or `null` to tax at the store's address. */ function serviceAddress(shipTo) {
+    if (!(shipTo == null ? void 0 : shipTo.country)) return null;
+    return _extends({
+        country: shipTo.country
+    }, shipTo.line1 ? {
+        line1: shipTo.line1
+    } : {}, shipTo.line2 ? {
+        line2: shipTo.line2
+    } : {}, shipTo.city ? {
+        city: shipTo.city
+    } : {}, shipTo.state ? {
+        region: shipTo.state
+    } : {}, shipTo.postalCode ? {
+        postalCode: shipTo.postalCode
+    } : {});
+}
+/**
+ * Prices a quote: each product line from its product, the tax from the
+ * store's settings and, where the site connected one, its tax service.
+ */ async function priceQuote(deps, hostRef, hostId, input) {
+    var _store_get, _ref;
+    var _input_shipping;
+    const productIds = [
+        ...new Set(input.lines.flatMap((line)=>line.kind === 'catalog' ? [
+                line.productId
+            ] : []))
+    ];
+    const productDocs = await Promise.all(productIds.map((id)=>hostRef.collection('products').doc(id).get()));
+    const products = new Map(productDocs.map((snapshot, index)=>[
+            productIds[index],
+            snapshot.exists ? snapshot.data() : null
+        ]));
+    const lineItems = [];
+    for (const line of input.lines){
+        if (line.kind === 'custom') {
+            lineItems.push(CommerceModel.priceQuoteCustomLine(line));
+            continue;
+        }
+        const priced = CommerceModel.priceQuoteCatalogLine(products.get(line.productId), line);
+        if ('error' in priced) return refuse(400, priced.error);
+        lineItems.push(priced.line);
+    }
+    const store = await hostRef.collection('settings').doc('store').get();
+    const taxSettings = (_store_get = store.get('tax')) != null ? _store_get : {};
+    let tax = CommerceModel.quoteTaxBasisFromSettings(taxSettings, input.shipTo);
+    const shippingCents = (_ref = (_input_shipping = input.shipping) == null ? void 0 : _input_shipping.amountCents) != null ? _ref : 0;
+    const amounts = CommerceModel.quoteLineAmounts(lineItems, input.discount);
+    // A tax service answers only for a store on its own rates; it is asked about
+    // what each line is charged after its share of the discount.
+    if (taxSettings.mode === 'manual' && amounts.itemsCents > 0) {
+        var _input_customer_email;
+        const serviceLines = lineItems.map((line, index)=>({
+                line,
+                index,
+                amountCents: amounts.netCents[index]
+            })).filter((entry)=>entry.amountCents > 0);
+        const answer = await deps.quoteTax(_extends({
+            hostId,
+            settings: taxSettings,
+            channel: 'invoice',
+            lines: serviceLines.map(({ line, index, amountCents })=>_extends({
+                    id: String(index)
+                }, line.productId ? {
+                    productId: line.productId
+                } : {}, line.variantId ? {
+                    variantId: line.variantId
+                } : {}, line.sku ? {
+                    sku: line.sku
+                } : {}, {
+                    description: [
+                        line.name,
+                        line.variantLabel
+                    ].filter(Boolean).join(' — '),
+                    quantity: line.quantity,
+                    amountCents
+                }, line.taxExempt ? {
+                    exempt: true
+                } : {}))
+        }, shippingCents ? {
+            shippingCents
+        } : {}, {
+            shipTo: serviceAddress(input.shipTo),
+            customerEmail: (_input_customer_email = input.customer.email) != null ? _input_customer_email : null
+        }));
+        if (answer.quote) {
+            tax = {
+                kind: 'service',
+                taxCents: answer.quote.taxCents,
+                providerLabel: answer.quote.providerLabel || answer.quote.provider
+            };
+        }
+    }
+    const totals = CommerceModel.computeQuoteTotals({
+        lines: lineItems,
+        discount: input.discount,
+        shippingCents,
+        tax
+    });
+    return {
+        lineItems,
+        totals: CommerceModel.quoteOrderTotals(totals),
+        tax,
+        taxMode: CommerceModel.quoteTaxMode(tax, totals.taxCents),
+        requireProofApprovalDefault: CommerceModel.quoteRequiresProofApprovalByDefault(store.get('quotes'))
+    };
+}
+/** The editable half of the `quote` section, every key written so a save clears what was removed. */ function editedQuoteFields(input) {
+    return {
+        customer: input.customer,
+        billTo: input.billTo,
+        shipTo: input.shipTo,
+        notes: input.notes,
+        terms: input.terms,
+        discount: input.discount,
+        shipping: input.shipping
+    };
+}
+export async function handleQuote(deps, req) {
+    var _body_hostId, _body_action, _body_quoteId, _ref;
+    if (req.method !== 'POST') return refuse(405, 'Method not allowed');
+    const authorization = headerOf(req, 'authorization');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
+    if (!idToken) return refuse(401, 'Unauthenticated');
+    const body = bodyOf(req);
+    const hostId = String((_body_hostId = body['hostId']) != null ? _body_hostId : '');
+    const action = String((_body_action = body['action']) != null ? _body_action : '');
+    if (!DOC_ID.test(hostId)) return refuse(400, 'Missing hostId');
+    let decoded;
+    try {
+        decoded = await deps.verifyIdToken(idToken);
+    } catch (error) {
+        if (!isRefusedIdToken(error)) throw error;
+        return refuse(401, 'Unauthenticated');
+    }
+    const firestore = deps.firestore();
+    const hostRef = firestore.collection('hosts').doc(hostId);
+    const host = await hostRef.get();
+    if (!host.exists) return refuse(404, 'Unknown site');
+    const key = action === 'pay-link' || action === 'replace-link' ? 'commerce.quotes.send' : 'commerce.quotes';
+    if (!holdsCommerceSiteKey(host, decoded.uid, key)) {
+        return refuse(403, commerceSitePermissionRefusal(key));
+    }
+    const actor = String(decoded.email || decoded.uid);
+    if (action === 'pay-link' || action === 'replace-link') {
+        var _body_quoteId1, _host_data;
+        const quoteId = String((_body_quoteId1 = body['quoteId']) != null ? _body_quoteId1 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        const ref = hostRef.collection('orders').doc(quoteId);
+        const now = deps.now();
+        const answer = await firestore.runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const order = snapshot.exists ? snapshot.data() : null;
+            if (!order || !CommerceModel.isQuote(order) || !order.quote) return {
+                outcome: refuse(404, 'Unknown quote')
+            };
+            const version = CommerceModel.quoteLinkVersion(order.quote);
+            if (action === 'pay-link') return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        linkVersion: version
+                    }
+                }
+            };
+            if (!CommerceModel.isUnpaidQuote(order)) {
+                return {
+                    outcome: refuse(409, 'This quote has been paid, so its link can no longer be replaced.')
+                };
+            }
+            const next = version + 1;
+            // The open session goes with the link it was opened from.
+            const rest = _extends({}, order);
+            delete rest.checkoutSessionId;
+            transaction.set(ref, _extends({}, rest, {
+                timeline: CommerceModel.appendOrderEvent(order, 'quote-link-replaced', `Pay link replaced by ${actor}; the earlier link no longer opens the quote`, now),
+                quote: _extends({}, order.quote, {
+                    linkVersion: next
+                })
+            }));
+            return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        linkVersion: next
+                    }
+                },
+                closeSession: order.checkoutSessionId
+            };
+        });
+        if (answer.closeSession) await closeOpenSession(deps, answer.closeSession, 'quote link replaced');
+        if (answer.outcome.status !== 200) return answer.outcome;
+        const linkVersion = Number(answer.outcome.body['linkVersion']);
+        const url = deps.payLinkUrl((_host_data = host.data()) != null ? _host_data : {}, hostId, quoteId, linkVersion);
+        if (!url) return refuse(409, 'This site has no web address yet, so its quotes have no pay link. Publish the site first.');
+        return {
+            status: 200,
+            body: {
+                url,
+                linkVersion
+            }
+        };
+    }
+    if (PROOF_ACTIONS.has(action)) {
+        var _body_quoteId2;
+        const quoteId = String((_body_quoteId2 = body['quoteId']) != null ? _body_quoteId2 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        return handleProofAction(deps, {
+            action,
+            body,
+            hostId,
+            quoteId,
+            hostRef,
+            firestore,
+            uid: decoded.uid,
+            actor
+        });
+    }
+    if (action === 'pdf') {
+        var _body_quoteId3, _host_data1;
+        const quoteId = String((_body_quoteId3 = body['quoteId']) != null ? _body_quoteId3 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        const [snapshot, store] = await Promise.all([
+            hostRef.collection('orders').doc(quoteId).get(),
+            hostRef.collection('settings').doc('store').get()
+        ]);
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
+        const hostData = (_host_data1 = host.data()) != null ? _host_data1 : {};
+        // The pay link is "Send quotes and invoices to customers"; without it the PDF leaves the link off.
+        const payUrl = CommerceModel.isUnpaidQuote(order) && holdsCommerceSiteKey(host, decoded.uid, 'commerce.quotes.send') ? deps.payLinkUrl(hostData, hostId, quoteId, CommerceModel.quoteLinkVersion(order.quote)) : null;
+        try {
+            var _store_data;
+            const pdf = await deps.quotePdf({
+                hostId,
+                quoteId,
+                order,
+                host: hostData,
+                store: (_store_data = store.data()) != null ? _store_data : null,
+                payUrl
+            });
+            return {
+                status: 200,
+                body: {},
+                pdf
+            };
+        } catch (error) {
+            console.error('commerce quote pdf failed', error);
+            return refuse(500, 'The PDF could not be made. Try again.');
+        }
+    }
+    if (action === 'search-customers') {
+        var _body_text;
+        const text = String((_body_text = body['text']) != null ? _body_text : '').trim().slice(0, 120);
+        if (text.length < 2) return {
+            status: 200,
+            body: {
+                available: true,
+                customers: []
+            }
+        };
+        const owner = await deps.orgForHost(hostId);
+        const people = await deps.searchPeople({
+            hostId,
+            orgId: (owner == null ? void 0 : owner.id) || null,
+            text,
+            limit: 10
+        });
+        if (people === null) return {
+            status: 200,
+            body: {
+                available: false,
+                customers: []
+            }
+        };
+        return {
+            status: 200,
+            body: {
+                available: true,
+                customers: people.map((person)=>{
+                    var _person_data;
+                    const data = (_person_data = person.data) != null ? _person_data : {};
+                    const read = (key)=>typeof data[key] === 'string' ? String(data[key]).trim() : '';
+                    return {
+                        record: {
+                            kind: person.kind,
+                            id: person.id
+                        },
+                        name: read('name'),
+                        company: read('company'),
+                        email: person.email,
+                        phone: read('phone') || null
+                    };
+                })
+            }
+        };
+    }
+    const quoteId = String((_body_quoteId = body['quoteId']) != null ? _body_quoteId : '');
+    if (action === 'delete') {
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        const ref = hostRef.collection('orders').doc(quoteId);
+        const deleted = await firestore.runTransaction(async (transaction)=>{
+            var _ref, _ref1;
+            var _order_quote, _order_quote1;
+            const snapshot = await transaction.get(ref);
+            // Already gone is what a retried delete finds.
+            if (!snapshot.exists) return {
+                status: 200,
+                body: {
+                    deleted: true
+                }
+            };
+            const order = snapshot.data();
+            if (!CommerceModel.isQuote(order)) return refuse(404, 'Unknown quote');
+            if (!CommerceModel.isUnpaidQuote(order)) {
+                return refuse(409, 'This quote has been paid, so it is an order now and stays on record.');
+            }
+            if (((_ref = (_order_quote = order.quote) == null ? void 0 : _order_quote.stage) != null ? _ref : 'draft') !== 'draft') {
+                return refuse(409, 'Only a draft quote can be deleted.');
+            }
+            // Earlier revisions are what the customer was shown and answered; a
+            // quote that has them stays on record.
+            if (Number((_ref1 = (_order_quote1 = order.quote) == null ? void 0 : _order_quote1.revision) != null ? _ref1 : 1) > 1) {
+                return refuse(409, 'This quote has earlier revisions the customer saw, so it stays on record.');
+            }
+            transaction.delete(ref);
+            return {
+                status: 200,
+                body: {
+                    deleted: true
+                },
+                closeSession: order.checkoutSessionId
+            };
+        });
+        const { closeSession } = deleted, outcome = _object_without_properties_loose(deleted, [
+            "closeSession"
+        ]);
+        await closeOpenSession(deps, closeSession, 'quote deleted');
+        // Its proofs and anything the customer sent go with it.
+        if (outcome.status === 200) await removeQuoteFiles(deps, hostId, quoteId);
+        return outcome;
+    }
+    if (action !== 'create' && action !== 'update') return refuse(400, 'Unknown action');
+    if (action === 'update' && !DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+    const idempotencyKey = headerOf(req, 'idempotency-key').slice(0, 200);
+    if (!idempotencyKey) return refuse(400, 'A quote save needs an Idempotency-Key header.');
+    const owner = await deps.orgForHost(hostId);
+    if (!checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) return refuse(403, 'Selling is not enabled');
+    const parsed = CommerceModel.parseQuoteInput(body['quote']);
+    if ('error' in parsed) return refuse(400, parsed.error);
+    const input = parsed.input;
+    const priced = await priceQuote(deps, hostRef, hostId, input);
+    if ('status' in priced) return priced;
+    const claimed = await claimAttempt(firestore, {
+        kind: action === 'create' ? 'commerce-quote' : 'commerce-quote-update',
+        scopeId: action === 'create' ? hostId : `${hostId}:${quoteId}`,
+        orgId: (_ref = owner == null ? void 0 : owner.id) != null ? _ref : '',
+        key: idempotencyKey,
+        busyMessage: 'This quote is already being saved'
+    });
+    if ('replay' in claimed) {
+        return {
+            status: claimed.replay.status,
+            body: claimed.replay.body
+        };
+    }
+    const claim = claimed.claim;
+    const now = deps.now();
+    try {
+        let outcome;
+        if (action === 'create') {
+            const orderRef = hostRef.collection('orders').doc(createResourceUid());
+            const counterRef = hostRef.collection('counters').doc('orders');
+            let number = 0;
+            await firestore.runTransaction(async (transaction)=>{
+                var _counter_get, _input_requireProofApproval;
+                const counter = await transaction.get(counterRef);
+                number = Number((_counter_get = counter.get('next')) != null ? _counter_get : 1);
+                transaction.set(counterRef, {
+                    next: number + 1
+                }, {
+                    merge: true
+                });
+                const quote = _extends({
+                    stage: 'draft',
+                    revision: 1
+                }, editedQuoteFields(input), {
+                    tax: priced.tax,
+                    requireProofApproval: (_input_requireProofApproval = input.requireProofApproval) != null ? _input_requireProofApproval : priced.requireProofApprovalDefault,
+                    createdAtMs: now,
+                    updatedAtMs: now,
+                    createdBy: actor,
+                    updatedBy: actor
+                });
+                // No `createdAtMs`, list fields or customer fields at the top: an
+                // unpaid quote is not an order any list counts (`commerce-quotes.ts`).
+                transaction.set(orderRef, _extends({
+                    number,
+                    status: 'pending',
+                    channel: 'quote',
+                    lineItems: priced.lineItems,
+                    totals: priced.totals
+                }, priced.taxMode ? {
+                    taxMode: priced.taxMode
+                } : {}, {
+                    timeline: [
+                        {
+                            atMs: now,
+                            event: 'quote',
+                            detail: `Quote created by ${actor}`
+                        }
+                    ],
+                    quote
+                }));
+            });
+            outcome = {
+                status: 200,
+                body: {
+                    quoteId: orderRef.id,
+                    number,
+                    updatedAtMs: now
+                }
+            };
+        } else {
+            const baseUpdatedAtMs = Number(body['baseUpdatedAtMs']);
+            const orderRef = hostRef.collection('orders').doc(quoteId);
+            let closeSession;
+            outcome = await firestore.runTransaction(async (transaction)=>{
+                var _input_requireProofApproval, _existing_number;
+                closeSession = undefined;
+                const snapshot = await transaction.get(orderRef);
+                const existing = snapshot.exists ? snapshot.data() : null;
+                if (!existing || !CommerceModel.isQuote(existing) || !existing.quote) {
+                    return refuse(404, 'Unknown quote');
+                }
+                if (!CommerceModel.isUnpaidQuote(existing)) {
+                    return refuse(409, 'This quote has been paid, so it can no longer be changed.');
+                }
+                if (Number(existing.quote.updatedAtMs) !== baseUpdatedAtMs) {
+                    return refuse(409, 'Someone else changed this quote. Close it and open it again to see their changes.');
+                }
+                // The tax mode is restated from this pricing, and dropped when it has
+                // none. The pay page's open session was priced from the quote before
+                // this edit, so it is closed and forgotten.
+                const rest = _extends({}, existing);
+                delete rest.taxMode;
+                delete rest.checkoutSessionId;
+                closeSession = existing.checkoutSessionId;
+                transaction.set(orderRef, _extends({}, rest, {
+                    lineItems: priced.lineItems,
+                    totals: priced.totals
+                }, priced.taxMode ? {
+                    taxMode: priced.taxMode
+                } : {}, {
+                    timeline: CommerceModel.appendOrderEvent(existing, 'quote-updated', `Quote edited by ${actor}`, now),
+                    quote: _extends({}, existing.quote, editedQuoteFields(input), {
+                        tax: priced.tax,
+                        requireProofApproval: (_input_requireProofApproval = input.requireProofApproval) != null ? _input_requireProofApproval : existing.quote.requireProofApproval === true,
+                        updatedAtMs: now,
+                        updatedBy: actor
+                    })
+                }));
+                return {
+                    status: 200,
+                    body: {
+                        quoteId,
+                        number: (_existing_number = existing.number) != null ? _existing_number : null,
+                        updatedAtMs: now
+                    }
+                };
+            });
+            if (outcome.status === 200) await closeOpenSession(deps, closeSession, 'quote edited');
+        }
+        if (outcome.status === 200) await claim.record(outcome.status, outcome.body);
+        else await claim.release();
+        return outcome;
+    } catch (error) {
+        console.error('commerce quote save failed', error);
+        await claim.release();
+        return refuse(500, 'The quote could not be saved');
+    }
+}
+/*==========================================
+ * PROOFS AND REVISIONS (AGL-4096)
+ *=========================================*/ const PROOF_ACTIONS = new Set([
+    'proof-ticket',
+    'proof-finalize',
+    'proof-remove',
+    'start-revision',
+    'revisions',
+    'file'
+]);
+/** Deletes a quote's kept files, its proofs and the customer's artwork; never throws. */ async function removeQuoteFiles(deps, hostId, quoteId) {
+    try {
+        const uploads = await deps.uploads();
+        await Promise.all([
+            CommerceModel.QUOTE_PROOF_PURPOSE,
+            CommerceModel.QUOTE_ARTWORK_PURPOSE
+        ].map((purpose)=>uploads.removeAll({
+                hostId,
+                purpose,
+                purposeId: quoteId
+            })));
+    } catch (error) {
+        console.error('quote files were not removed', {
+            hostId,
+            quoteId,
+            error
+        });
+    }
+}
+/** A file as the console is told about it: everything but where it is kept. */ function fileView(file) {
+    const rest = _extends({}, file);
+    delete rest.path;
+    return rest;
+}
+/** A revision as the console's history lists it. */ function revisionView(snapshot) {
+    var _snapshot_proofs, _snapshot_responses;
+    return _extends({}, snapshot, {
+        proofs: ((_snapshot_proofs = snapshot.proofs) != null ? _snapshot_proofs : []).map(fileView),
+        responses: ((_snapshot_responses = snapshot.responses) != null ? _snapshot_responses : []).map((response)=>_extends({}, response, response.files ? {
+                files: response.files.map(fileView)
+            } : {}))
+    });
+}
+/**
+ * Writes `next` over the quote in `transaction`, without the pay page's open
+ * session, which was priced from the quote as it stood; the caller closes it.
+ */ function writeEditedQuote(transaction, ref, next) {
+    const rest = _extends({}, next);
+    const session = rest.checkoutSessionId;
+    delete rest.checkoutSessionId;
+    transaction.set(ref, rest);
+    return session;
+}
+async function handleProofAction(deps, context) {
+    const { action, body, hostId, quoteId, hostRef, firestore, uid, actor } = context;
+    const ref = hostRef.collection('orders').doc(quoteId);
+    const proofScope = {
+        hostId,
+        purpose: CommerceModel.QUOTE_PROOF_PURPOSE,
+        purposeId: quoteId
+    };
+    if (action === 'revisions' || action === 'file') {
+        var _order_quote_revision, _body_fileId, _order_quote_responses, _ref, _ref1;
+        const snapshot = await ref.get();
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
+        const current = Number((_order_quote_revision = order.quote.revision) != null ? _order_quote_revision : 1);
+        const wanted = body['revision'] === undefined || body['revision'] === null ? current : Number(body['revision']);
+        let snapshots = [];
+        if (action === 'revisions' || wanted !== current) {
+            const listed = await ref.collection('revisions').get();
+            snapshots = listed.docs.map((entry)=>entry.data()).filter((entry)=>Number.isInteger(Number(entry == null ? void 0 : entry.revision))).sort((a, b)=>Number(a.revision) - Number(b.revision));
+        }
+        if (action === 'revisions') return {
+            status: 200,
+            body: {
+                revisions: snapshots.map(revisionView)
+            }
+        };
+        const fileId = String((_body_fileId = body['fileId']) != null ? _body_fileId : '');
+        const source = wanted === current ? {
+            proofs: CommerceModel.currentQuoteProofs(order.quote),
+            responses: (_order_quote_responses = order.quote.responses) != null ? _order_quote_responses : []
+        } : snapshots.find((entry)=>Number(entry.revision) === wanted);
+        const files = [
+            ...(_ref = source == null ? void 0 : source.proofs) != null ? _ref : [],
+            ...((_ref1 = source == null ? void 0 : source.responses) != null ? _ref1 : []).flatMap((response)=>{
+                var _response_files;
+                return (_response_files = response.files) != null ? _response_files : [];
+            })
+        ];
+        const file = files.find((entry)=>entry.id === fileId);
+        if (!(file == null ? void 0 : file.path)) return refuse(404, 'That file is no longer on this quote.');
+        return {
+            status: 200,
+            body: {},
+            file: {
+                path: file.path,
+                name: file.name,
+                contentType: file.contentType
+            }
+        };
+    }
+    if (action === 'proof-ticket') {
+        const snapshot = await ref.get();
+        const order = snapshot.exists ? snapshot.data() : null;
+        const refused = CommerceModel.quoteProofChangeRefusal(order, 'add');
+        if (refused) return refuse(refused === 'not-a-quote' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(refused));
+        // Storage is spent here, so the plan must sell, as a save's must.
+        const owner = await deps.orgForHost(hostId);
+        if (!checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) return refuse(403, 'Selling is not enabled');
+        const uploads = await deps.uploads();
+        const minted = await uploads.mint({
+            scope: proofScope,
+            request: body['file'],
+            caller: {
+                uid
+            }
+        });
+        if ('error' in minted) return refuse(minted.status, minted.error);
+        return {
+            status: 200,
+            body: {
+                ticket: minted.ticket,
+                upload: minted.upload,
+                file: minted.file
+            }
+        };
+    }
+    if (action === 'proof-finalize') {
+        const uploads = await deps.uploads();
+        const kept = await uploads.finalize({
+            scope: proofScope,
+            ticket: body['ticket'],
+            caller: {
+                uid
+            }
+        });
+        if ('error' in kept) return refuse(kept.status, kept.error);
+        const now = deps.now();
+        const answer = await firestore.runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const order = snapshot.exists ? snapshot.data() : null;
+            if (!order) return {
+                outcome: refuse(404, 'Unknown quote')
+            };
+            // A retried finalize finds its proof already on the quote.
+            const already = CommerceModel.currentQuoteProofs(order.quote).find((proof)=>proof.id === kept.file.id);
+            if (already) {
+                var _ref;
+                var _order_quote;
+                return {
+                    outcome: {
+                        status: 200,
+                        body: {
+                            proof: fileView(already),
+                            updatedAtMs: (_ref = (_order_quote = order.quote) == null ? void 0 : _order_quote.updatedAtMs) != null ? _ref : null
+                        }
+                    }
+                };
+            }
+            const added = CommerceModel.withQuoteProofAdded(order, {
+                id: kept.file.id,
+                name: kept.file.name,
+                contentType: kept.file.contentType,
+                size: kept.file.size,
+                path: kept.file.path
+            }, {
+                atMs: now,
+                by: actor
+            });
+            if ('reason' in added) {
+                return {
+                    outcome: refuse(added.reason === 'not-a-quote' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(added.reason))
+                };
+            }
+            const closeSession = writeEditedQuote(transaction, ref, added.order);
+            return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        proof: fileView(added.proof),
+                        updatedAtMs: now
+                    }
+                },
+                closeSession
+            };
+        });
+        if (answer.outcome.status !== 200) await uploads.remove(kept.file.path).catch(()=>undefined);
+        await closeOpenSession(deps, answer.closeSession, 'quote proof added');
+        return answer.outcome;
+    }
+    if (action === 'proof-remove') {
+        var _body_proofId;
+        const proofId = String((_body_proofId = body['proofId']) != null ? _body_proofId : '');
+        const now = deps.now();
+        const answer = await firestore.runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const order = snapshot.exists ? snapshot.data() : null;
+            if (!order) return {
+                outcome: refuse(404, 'Unknown quote')
+            };
+            const removed = CommerceModel.withQuoteProofRemoved(order, proofId, {
+                atMs: now,
+                by: actor
+            });
+            if ('reason' in removed) {
+                return {
+                    outcome: refuse(removed.reason === 'not-a-quote' || removed.reason === 'unknown-proof' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(removed.reason))
+                };
+            }
+            const closeSession = writeEditedQuote(transaction, ref, removed.order);
+            return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        removed: true,
+                        updatedAtMs: now
+                    }
+                },
+                closeSession,
+                path: removed.proof.path
+            };
+        });
+        if (answer.path) {
+            const uploads = await deps.uploads();
+            await uploads.remove(answer.path).catch((error)=>console.error('quote proof file was not deleted', error));
+        }
+        await closeOpenSession(deps, answer.closeSession, 'quote proof removed');
+        return answer.outcome;
+    }
+    // start-revision
+    const now = deps.now();
+    const answer = await firestore.runTransaction(async (transaction)=>{
+        const snapshot = await transaction.get(ref);
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order) return {
+            outcome: refuse(404, 'Unknown quote')
+        };
+        const started = CommerceModel.startQuoteRevision(order, {
+            atMs: now,
+            by: actor
+        });
+        if ('reason' in started) return {
+            outcome: refuse(started.reason === 'paid' ? 409 : 404, started.error)
+        };
+        const revisionRef = ref.collection('revisions').doc(String(started.revision));
+        // A revision on record is never written over.
+        if ((await transaction.get(revisionRef)).exists) {
+            return {
+                outcome: refuse(409, `Revision ${started.revision} is already on record. Close the quote and open it again.`)
+            };
+        }
+        transaction.set(revisionRef, started.snapshot);
+        const closeSession = writeEditedQuote(transaction, ref, started.order);
+        return {
+            outcome: {
+                status: 200,
+                body: {
+                    revision: started.revision + 1,
+                    updatedAtMs: now
+                }
+            },
+            closeSession
+        };
+    });
+    await closeOpenSession(deps, answer.closeSession, 'quote revision started');
+    return answer.outcome;
+}
+/** `POST /api/commerce/quote`. */ export const quoteHandler = async (req, res)=>{
+    const deps = defaultQuoteDeps();
+    const outcome = await handleQuote(deps, req);
+    if (outcome.pdf) return sendPdf(res, outcome.pdf);
+    if (outcome.file) {
+        const uploads = await deps.uploads();
+        return uploads.send(res, outcome.file);
+    }
+    return res.status(outcome.status).json(outcome.body);
+};
+
+//# sourceMappingURL=quote.js.map