@aglyn/plugins-commerce 1.0.0-beta.289 → 1.0.0-beta.291

package/src/lib/server/quote.js

@@ -19,6 +19,7 @@ import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_wi
 import { createResourceUid } from "@aglyn/aglyn/app-utils/create-resource-uid";
 import { checkEntitlement } from "@aglyn/aglyn/server";
 import { searchPluginPeople } from "@aglyn/aglyn/plugin-manager/plugin-person-records";
+import { pluginRecordFactsReader } from "@aglyn/aglyn/plugin-manager/plugin-record-facts";
 import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
 import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
 import * as CommerceModel from "../model/index.js";
@@ -26,7 +27,8 @@ import { commerceSitePermissionRefusal } from "../model/plugin-permissions.js";
 import { holdsCommerceSiteKey } from "./commerce-site-keys.js";
 import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
 import { expireCheckoutSession } from "./checkout-session-expiry.js";
-import { quotePayLinkUrl } from "./quote-link-token.js";
+import { sendPdf } from "./pdf-response.js";
+import { quotePayLinkUrl, quoteProofLinkUrl } from "./quote-link-token.js";
 export function defaultQuoteDeps() {
     return {
         verifyIdToken: (token)=>firebaseAdmin.app().auth().verifyIdToken(token),
@@ -42,9 +44,47 @@ export function defaultQuoteDeps() {
         quoteTax: (request)=>quoteSaleTaxWithEngine(request),
         expireSession: (sessionId)=>expireCheckoutSession(sessionId),
         payLinkUrl: (host, hostId, quoteId, version)=>quotePayLinkUrl(host, hostId, quoteId, version),
+        proofLinkUrl: (host, hostId, quoteId, version, proofId)=>quoteProofLinkUrl(host, hostId, quoteId, version, proofId),
+        quotePdf: async (input)=>(await import("./commerce-pdf.js")).quotePdfFile(input),
+        uploads: async ()=>(await import("./quote-uploads.js")).quoteUploadCalls(),
+        mailer: async ()=>(await import("./quote-email.js")).quoteMailer(),
+        requestFacts: async (request)=>{
+            var _ref;
+            var _pluginRecordFactsReader;
+            return (_ref = await ((_pluginRecordFactsReader = pluginRecordFactsReader(CommerceModel.QUOTE_REQUEST_FACTS_RESOURCE)) == null ? void 0 : _pluginRecordFactsReader.reader.read(request))) != null ? _ref : null;
+        },
         now: ()=>Date.now()
     };
 }
+/** A request's facts for the member asking, or the refusal to answer with. */ async function readRequest(deps, input) {
+    var _ref, _ref1;
+    if (!DOC_ID.test(input.submissionId)) return {
+        outcome: refuse(400, 'Missing submissionId')
+    };
+    const owner = await deps.orgForHost(input.hostId);
+    const read = await deps.requestFacts({
+        orgId: (_ref = owner == null ? void 0 : owner.id) != null ? _ref : '',
+        hostId: input.hostId,
+        id: input.submissionId,
+        uid: input.uid,
+        staff: input.staff,
+        org: (_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : null,
+        now: new Date(deps.now())
+    });
+    if (!read) return {
+        outcome: refuse(404, 'Requests aren’t available on this site.')
+    };
+    if ('error' in read) return {
+        outcome: refuse(read.status, read.error)
+    };
+    const facts = CommerceModel.readQuoteRequestFacts(read.facts);
+    if (!facts) return {
+        outcome: refuse(404, 'That request is no longer in the Inbox.')
+    };
+    return {
+        facts
+    };
+}
 /** Expires the session the pay page opened, when there is one; a failure is logged, never thrown. */ async function closeOpenSession(deps, sessionId, context) {
     if (!sessionId) return;
     const result = await deps.expireSession(sessionId).catch(()=>'open');
@@ -79,6 +119,11 @@ function headerOf(req, name) {
     return String(Array.isArray(value) ? (_value_ = value[0]) != null ? _value_ : '' : value != null ? value : '').trim();
 }
 const DOC_ID = /^(?!__.*__$)[^/]{1,200}$/;
+/** The actions under "Send quotes and invoices to customers" (`commerce.quotes.send`). */ const SEND_ACTIONS = new Set([
+    'pay-link',
+    'replace-link',
+    'send'
+]);
 /** The ship-to as a tax service reads it, or `null` to tax at the store's address. */ function serviceAddress(shipTo) {
     if (!(shipTo == null ? void 0 : shipTo.country)) return null;
     return _extends({
@@ -197,7 +242,7 @@ const DOC_ID = /^(?!__.*__$)[^/]{1,200}$/;
     };
 }
 export async function handleQuote(deps, req) {
-    var _body_hostId, _body_action, _body_quoteId, _ref;
+    var _body_hostId, _body_action, _body_quoteId, _body_from, _ref;
     if (req.method !== 'POST') return refuse(405, 'Method not allowed');
     const authorization = headerOf(req, 'authorization');
     const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
@@ -217,7 +262,7 @@ export async function handleQuote(deps, req) {
     const hostRef = firestore.collection('hosts').doc(hostId);
     const host = await hostRef.get();
     if (!host.exists) return refuse(404, 'Unknown site');
-    const key = action === 'pay-link' || action === 'replace-link' ? 'commerce.quotes.send' : 'commerce.quotes';
+    const key = SEND_ACTIONS.has(action) ? 'commerce.quotes.send' : 'commerce.quotes';
     if (!holdsCommerceSiteKey(host, decoded.uid, key)) {
         return refuse(403, commerceSitePermissionRefusal(key));
     }
@@ -281,6 +326,90 @@ export async function handleQuote(deps, req) {
             }
         };
     }
+    if (action === 'send') {
+        var _body_quoteId2, _host_data1;
+        const quoteId = String((_body_quoteId2 = body['quoteId']) != null ? _body_quoteId2 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        return handleSendAction(deps, {
+            req,
+            body,
+            hostId,
+            quoteId,
+            hostRef,
+            host: (_host_data1 = host.data()) != null ? _host_data1 : {},
+            firestore,
+            actor,
+            senderEmail: decoded.email ? String(decoded.email) : null
+        });
+    }
+    if (action === 'start-from-request') {
+        var _body_submissionId;
+        const read = await readRequest(deps, {
+            hostId,
+            submissionId: String((_body_submissionId = body['submissionId']) != null ? _body_submissionId : ''),
+            uid: decoded.uid,
+            staff: decoded.staff === true
+        });
+        if ('outcome' in read) return read.outcome;
+        const started = CommerceModel.quoteStartFromRequest(String(body['submissionId']), read.facts);
+        return {
+            status: 200,
+            body: {
+                prefill: started.prefill,
+                request: started.request,
+                files: CommerceModel.quoteRequestFileViews(started.files),
+                threaded: Boolean(started.emailThread)
+            }
+        };
+    }
+    if (PROOF_ACTIONS.has(action)) {
+        var _body_quoteId3;
+        const quoteId = String((_body_quoteId3 = body['quoteId']) != null ? _body_quoteId3 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        return handleProofAction(deps, {
+            action,
+            body,
+            hostId,
+            quoteId,
+            hostRef,
+            firestore,
+            uid: decoded.uid,
+            actor
+        });
+    }
+    if (action === 'pdf') {
+        var _body_quoteId4, _host_data2;
+        const quoteId = String((_body_quoteId4 = body['quoteId']) != null ? _body_quoteId4 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        const [snapshot, store] = await Promise.all([
+            hostRef.collection('orders').doc(quoteId).get(),
+            hostRef.collection('settings').doc('store').get()
+        ]);
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
+        const hostData = (_host_data2 = host.data()) != null ? _host_data2 : {};
+        // The pay link is "Send quotes and invoices to customers"; without it the PDF leaves the link off.
+        const payUrl = CommerceModel.isUnpaidQuote(order) && holdsCommerceSiteKey(host, decoded.uid, 'commerce.quotes.send') ? deps.payLinkUrl(hostData, hostId, quoteId, CommerceModel.quoteLinkVersion(order.quote)) : null;
+        try {
+            var _store_data;
+            const pdf = await deps.quotePdf({
+                hostId,
+                quoteId,
+                order,
+                host: hostData,
+                store: (_store_data = store.data()) != null ? _store_data : null,
+                payUrl
+            });
+            return {
+                status: 200,
+                body: {},
+                pdf
+            };
+        } catch (error) {
+            console.error('commerce quote pdf failed', error);
+            return refuse(500, 'The PDF could not be made. Try again.');
+        }
+    }
     if (action === 'search-customers') {
         var _body_text;
         const text = String((_body_text = body['text']) != null ? _body_text : '').trim().slice(0, 120);
@@ -332,8 +461,8 @@ export async function handleQuote(deps, req) {
         if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
         const ref = hostRef.collection('orders').doc(quoteId);
         const deleted = await firestore.runTransaction(async (transaction)=>{
-            var _ref;
-            var _order_quote;
+            var _ref, _ref1;
+            var _order_quote, _order_quote1;
             const snapshot = await transaction.get(ref);
             // Already gone is what a retried delete finds.
             if (!snapshot.exists) return {
@@ -350,6 +479,11 @@ export async function handleQuote(deps, req) {
             if (((_ref = (_order_quote = order.quote) == null ? void 0 : _order_quote.stage) != null ? _ref : 'draft') !== 'draft') {
                 return refuse(409, 'Only a draft quote can be deleted.');
             }
+            // Earlier revisions are what the customer was shown and answered; a
+            // quote that has them stays on record.
+            if (Number((_ref1 = (_order_quote1 = order.quote) == null ? void 0 : _order_quote1.revision) != null ? _ref1 : 1) > 1) {
+                return refuse(409, 'This quote has earlier revisions the customer saw, so it stays on record.');
+            }
             transaction.delete(ref);
             return {
                 status: 200,
@@ -363,6 +497,8 @@ export async function handleQuote(deps, req) {
             "closeSession"
         ]);
         await closeOpenSession(deps, closeSession, 'quote deleted');
+        // Its proofs and anything the customer sent go with it.
+        if (outcome.status === 200) await removeQuoteFiles(deps, hostId, quoteId);
         return outcome;
     }
     if (action !== 'create' && action !== 'update') return refuse(400, 'Unknown action');
@@ -374,6 +510,24 @@ export async function handleQuote(deps, req) {
     const parsed = CommerceModel.parseQuoteInput(body['quote']);
     if ('error' in parsed) return refuse(400, parsed.error);
     const input = parsed.input;
+    /*
+   * A new quote from a request (AGL-4098): the request is read again, here,
+   * for the member saving, and what the quote takes from it — which request,
+   * its files, its conversation — comes from that read and never from the
+   * body. The editable fields (customer, lines, notes) are the editor's.
+   */ const from = (_body_from = body['from']) != null ? _body_from : null;
+    let started = null;
+    if (action === 'create' && (from == null ? void 0 : from.kind) === 'submission') {
+        var _from_id;
+        const read = await readRequest(deps, {
+            hostId,
+            submissionId: String((_from_id = from.id) != null ? _from_id : ''),
+            uid: decoded.uid,
+            staff: decoded.staff === true
+        });
+        if ('outcome' in read) return read.outcome;
+        started = CommerceModel.quoteStartFromRequest(String(from.id), read.facts);
+    }
     const priced = await priceQuote(deps, hostRef, hostId, input);
     if ('status' in priced) return priced;
     const claimed = await claimAttempt(firestore, {
@@ -411,7 +565,14 @@ export async function handleQuote(deps, req) {
                     revision: 1
                 }, editedQuoteFields(input), {
                     tax: priced.tax,
-                    requireProofApproval: (_input_requireProofApproval = input.requireProofApproval) != null ? _input_requireProofApproval : priced.requireProofApprovalDefault,
+                    requireProofApproval: (_input_requireProofApproval = input.requireProofApproval) != null ? _input_requireProofApproval : priced.requireProofApprovalDefault
+                }, started ? _extends({
+                    request: started.request
+                }, started.files.length ? {
+                    requestFiles: started.files
+                } : {}, started.emailThread ? {
+                    emailThread: started.emailThread
+                } : {}) : {}, {
                     createdAtMs: now,
                     updatedAtMs: now,
                     createdBy: actor,
@@ -432,7 +593,7 @@ export async function handleQuote(deps, req) {
                         {
                             atMs: now,
                             event: 'quote',
-                            detail: `Quote created by ${actor}`
+                            detail: started ? `Quote created by ${actor} from a request sent through “${started.request.formName}”` : `Quote created by ${actor}`
                         }
                     ],
                     quote
@@ -505,8 +666,477 @@ export async function handleQuote(deps, req) {
         return refuse(500, 'The quote could not be saved');
     }
 }
+/*==========================================
+ * PROOFS AND REVISIONS (AGL-4096)
+ *=========================================*/ const PROOF_ACTIONS = new Set([
+    'proof-ticket',
+    'proof-finalize',
+    'proof-remove',
+    'start-revision',
+    'revisions',
+    'file'
+]);
+/** Deletes a quote's kept files, its proofs and the customer's artwork; never throws. */ async function removeQuoteFiles(deps, hostId, quoteId) {
+    try {
+        const uploads = await deps.uploads();
+        await Promise.all([
+            CommerceModel.QUOTE_PROOF_PURPOSE,
+            CommerceModel.QUOTE_ARTWORK_PURPOSE
+        ].map((purpose)=>uploads.removeAll({
+                hostId,
+                purpose,
+                purposeId: quoteId
+            })));
+    } catch (error) {
+        console.error('quote files were not removed', {
+            hostId,
+            quoteId,
+            error
+        });
+    }
+}
+/** A file as the console is told about it: everything but where it is kept. */ function fileView(file) {
+    const rest = _extends({}, file);
+    delete rest.path;
+    return rest;
+}
+/** A revision as the console's history lists it. */ function revisionView(snapshot) {
+    var _snapshot_proofs, _snapshot_responses;
+    return _extends({}, snapshot, {
+        proofs: ((_snapshot_proofs = snapshot.proofs) != null ? _snapshot_proofs : []).map(fileView),
+        responses: ((_snapshot_responses = snapshot.responses) != null ? _snapshot_responses : []).map((response)=>_extends({}, response, response.files ? {
+                files: response.files.map(fileView)
+            } : {}))
+    });
+}
+/**
+ * Writes `next` over the quote in `transaction`, without the pay page's open
+ * session, which was priced from the quote as it stood; the caller closes it.
+ */ function writeEditedQuote(transaction, ref, next) {
+    const rest = _extends({}, next);
+    const session = rest.checkoutSessionId;
+    delete rest.checkoutSessionId;
+    transaction.set(ref, rest);
+    return session;
+}
+async function handleProofAction(deps, context) {
+    const { action, body, hostId, quoteId, hostRef, firestore, uid, actor } = context;
+    const ref = hostRef.collection('orders').doc(quoteId);
+    const proofScope = {
+        hostId,
+        purpose: CommerceModel.QUOTE_PROOF_PURPOSE,
+        purposeId: quoteId
+    };
+    if (action === 'revisions' || action === 'file') {
+        var _order_quote_revision, _body_fileId, _order_quote_responses, _ref, _ref1, _order_quote_requestFiles;
+        const snapshot = await ref.get();
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
+        const current = Number((_order_quote_revision = order.quote.revision) != null ? _order_quote_revision : 1);
+        const wanted = body['revision'] === undefined || body['revision'] === null ? current : Number(body['revision']);
+        let snapshots = [];
+        if (action === 'revisions' || wanted !== current) {
+            const listed = await ref.collection('revisions').get();
+            snapshots = listed.docs.map((entry)=>entry.data()).filter((entry)=>Number.isInteger(Number(entry == null ? void 0 : entry.revision))).sort((a, b)=>Number(a.revision) - Number(b.revision));
+        }
+        if (action === 'revisions') return {
+            status: 200,
+            body: {
+                revisions: snapshots.map(revisionView)
+            }
+        };
+        const fileId = String((_body_fileId = body['fileId']) != null ? _body_fileId : '');
+        const source = wanted === current ? {
+            proofs: CommerceModel.currentQuoteProofs(order.quote),
+            responses: (_order_quote_responses = order.quote.responses) != null ? _order_quote_responses : []
+        } : snapshots.find((entry)=>Number(entry.revision) === wanted);
+        const files = [
+            ...(_ref = source == null ? void 0 : source.proofs) != null ? _ref : [],
+            ...((_ref1 = source == null ? void 0 : source.responses) != null ? _ref1 : []).flatMap((response)=>{
+                var _response_files;
+                return (_response_files = response.files) != null ? _response_files : [];
+            }),
+            // The request's files (AGL-4098), on every revision: they came first.
+            ...(_order_quote_requestFiles = order.quote.requestFiles) != null ? _order_quote_requestFiles : []
+        ];
+        const file = files.find((entry)=>entry.id === fileId);
+        if (!(file == null ? void 0 : file.path)) return refuse(404, 'That file is no longer on this quote.');
+        return {
+            status: 200,
+            body: {},
+            file: {
+                path: file.path,
+                name: file.name,
+                contentType: file.contentType
+            }
+        };
+    }
+    if (action === 'proof-ticket') {
+        const snapshot = await ref.get();
+        const order = snapshot.exists ? snapshot.data() : null;
+        const refused = CommerceModel.quoteProofChangeRefusal(order, 'add');
+        if (refused) return refuse(refused === 'not-a-quote' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(refused));
+        // Storage is spent here, so the plan must sell, as a save's must.
+        const owner = await deps.orgForHost(hostId);
+        if (!checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) return refuse(403, 'Selling is not enabled');
+        const uploads = await deps.uploads();
+        const minted = await uploads.mint({
+            scope: proofScope,
+            request: body['file'],
+            caller: {
+                uid
+            }
+        });
+        if ('error' in minted) return refuse(minted.status, minted.error);
+        return {
+            status: 200,
+            body: {
+                ticket: minted.ticket,
+                upload: minted.upload,
+                file: minted.file
+            }
+        };
+    }
+    if (action === 'proof-finalize') {
+        const uploads = await deps.uploads();
+        const kept = await uploads.finalize({
+            scope: proofScope,
+            ticket: body['ticket'],
+            caller: {
+                uid
+            }
+        });
+        if ('error' in kept) return refuse(kept.status, kept.error);
+        const now = deps.now();
+        const answer = await firestore.runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const order = snapshot.exists ? snapshot.data() : null;
+            if (!order) return {
+                outcome: refuse(404, 'Unknown quote')
+            };
+            // A retried finalize finds its proof already on the quote.
+            const already = CommerceModel.currentQuoteProofs(order.quote).find((proof)=>proof.id === kept.file.id);
+            if (already) {
+                var _ref;
+                var _order_quote;
+                return {
+                    outcome: {
+                        status: 200,
+                        body: {
+                            proof: fileView(already),
+                            updatedAtMs: (_ref = (_order_quote = order.quote) == null ? void 0 : _order_quote.updatedAtMs) != null ? _ref : null
+                        }
+                    }
+                };
+            }
+            const added = CommerceModel.withQuoteProofAdded(order, {
+                id: kept.file.id,
+                name: kept.file.name,
+                contentType: kept.file.contentType,
+                size: kept.file.size,
+                path: kept.file.path
+            }, {
+                atMs: now,
+                by: actor
+            });
+            if ('reason' in added) {
+                return {
+                    outcome: refuse(added.reason === 'not-a-quote' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(added.reason))
+                };
+            }
+            const closeSession = writeEditedQuote(transaction, ref, added.order);
+            return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        proof: fileView(added.proof),
+                        updatedAtMs: now
+                    }
+                },
+                closeSession
+            };
+        });
+        if (answer.outcome.status !== 200) await uploads.remove(kept.file.path).catch(()=>undefined);
+        await closeOpenSession(deps, answer.closeSession, 'quote proof added');
+        return answer.outcome;
+    }
+    if (action === 'proof-remove') {
+        var _body_proofId;
+        const proofId = String((_body_proofId = body['proofId']) != null ? _body_proofId : '');
+        const now = deps.now();
+        const answer = await firestore.runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const order = snapshot.exists ? snapshot.data() : null;
+            if (!order) return {
+                outcome: refuse(404, 'Unknown quote')
+            };
+            const removed = CommerceModel.withQuoteProofRemoved(order, proofId, {
+                atMs: now,
+                by: actor
+            });
+            if ('reason' in removed) {
+                return {
+                    outcome: refuse(removed.reason === 'not-a-quote' || removed.reason === 'unknown-proof' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(removed.reason))
+                };
+            }
+            const closeSession = writeEditedQuote(transaction, ref, removed.order);
+            return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        removed: true,
+                        updatedAtMs: now
+                    }
+                },
+                closeSession,
+                path: removed.proof.path
+            };
+        });
+        if (answer.path) {
+            const uploads = await deps.uploads();
+            await uploads.remove(answer.path).catch((error)=>console.error('quote proof file was not deleted', error));
+        }
+        await closeOpenSession(deps, answer.closeSession, 'quote proof removed');
+        return answer.outcome;
+    }
+    // start-revision
+    const now = deps.now();
+    const answer = await firestore.runTransaction(async (transaction)=>{
+        const snapshot = await transaction.get(ref);
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order) return {
+            outcome: refuse(404, 'Unknown quote')
+        };
+        const started = CommerceModel.startQuoteRevision(order, {
+            atMs: now,
+            by: actor
+        });
+        if ('reason' in started) return {
+            outcome: refuse(started.reason === 'paid' ? 409 : 404, started.error)
+        };
+        const revisionRef = ref.collection('revisions').doc(String(started.revision));
+        // A revision on record is never written over.
+        if ((await transaction.get(revisionRef)).exists) {
+            return {
+                outcome: refuse(409, `Revision ${started.revision} is already on record. Close the quote and open it again.`)
+            };
+        }
+        transaction.set(revisionRef, started.snapshot);
+        const closeSession = writeEditedQuote(transaction, ref, started.order);
+        return {
+            outcome: {
+                status: 200,
+                body: {
+                    revision: started.revision + 1,
+                    updatedAtMs: now
+                }
+            },
+            closeSession
+        };
+    });
+    await closeOpenSession(deps, answer.closeSession, 'quote revision started');
+    return answer.outcome;
+}
+/*==========================================
+ * SENDING THE QUOTE (AGL-4097)
+ *
+ *   { action: 'send', hostId, quoteId, to?, subject?, message } + Idempotency-Key
+ *
+ * Emails the quote to `to` (else the customer's email) under `subject` (else
+ * the conversation's, else "Quote #N from {business}"), with the business's
+ * message, the proof, the PDF and the pay link. Refused for a paid quote, one
+ * with nowhere to send it, and an address on a suppression list.
+ *
+ * When the customer was emailed an earlier revision and the link has not
+ * been replaced since, the link is replaced first (as Replace link does: the
+ * version moves on, the open payment closes) so the earlier email's link
+ * says the quote was updated. A resend of the same revision keeps it. Then
+ * the send is recorded (`quote.sends`), the conversation moves on
+ * (`quote.emailThread`), the quote moves to Sent unless the customer has
+ * answered this revision, and the timeline says so.
+ *
+ * One attempt per key: a retried press replays the answer and never sends a
+ * second email. A send that fails releases the key, and a retry finds the
+ * link already replaced, so it never replaces it twice.
+ *=========================================*/ async function handleSendAction(deps, context) {
+    var _ref, _ref1;
+    var _order_quote;
+    const { req, body, hostId, quoteId, hostRef, host, firestore, actor } = context;
+    const parsed = CommerceModel.parseQuoteSendInput(body);
+    if ('error' in parsed) return refuse(400, parsed.error);
+    const idempotencyKey = headerOf(req, 'idempotency-key').slice(0, 200);
+    if (!idempotencyKey) return refuse(400, 'Sending a quote needs an Idempotency-Key header.');
+    const ref = hostRef.collection('orders').doc(quoteId);
+    const [snapshot, store] = await Promise.all([
+        ref.get(),
+        hostRef.collection('settings').doc('store').get()
+    ]);
+    const stored = snapshot.exists ? snapshot.data() : null;
+    const to = CommerceModel.quoteSendRecipient(stored, parsed.input.to);
+    const refused = CommerceModel.quoteSendRefusal(stored, to);
+    if (refused) {
+        return refuse(refused === 'not-a-quote' ? 404 : refused === 'paid' ? 409 : 400, CommerceModel.quoteSendRefusalMessage(refused));
+    }
+    if (!deps.payLinkUrl(host, hostId, quoteId, CommerceModel.quoteLinkVersion(stored == null ? void 0 : stored.quote))) {
+        return refuse(409, 'This site has no web address yet, so its quotes have no pay link. Publish the site first.');
+    }
+    const owner = await deps.orgForHost(hostId);
+    if (!checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) return refuse(403, 'Selling is not enabled');
+    const mailer = await deps.mailer();
+    if (!mailer.configured()) {
+        return refuse(503, 'Email isn’t set up here, so quotes can’t be emailed. Copy the pay link and send it yourself.');
+    }
+    // The bounce and complaint list only (AGL-4098): the customer asked for the
+    // quote, so unsubscribing from the site's newsletter does not refuse it.
+    if (await mailer.suppression(to)) {
+        return refuse(409, `${to} bounced or reported an email as spam, so it can’t be emailed. Copy the pay link and send it another way.`);
+    }
+    const claimed = await claimAttempt(firestore, {
+        kind: 'commerce-quote-send',
+        scopeId: `${hostId}:${quoteId}`,
+        orgId: (_ref = owner == null ? void 0 : owner.id) != null ? _ref : '',
+        key: idempotencyKey,
+        busyMessage: 'This quote is already being sent'
+    });
+    if ('replay' in claimed) {
+        return {
+            status: claimed.replay.status,
+            body: claimed.replay.body
+        };
+    }
+    const claim = claimed.claim;
+    const now = deps.now();
+    let prepared;
+    try {
+        // A new revision's first email replaces the link the customer was sent.
+        prepared = await firestore.runTransaction(async (transaction)=>{
+            var _order_quote_revision;
+            const current = await transaction.get(ref);
+            const order = current.exists ? current.data() : null;
+            const again = CommerceModel.quoteSendRefusal(order, to);
+            if (again || !(order == null ? void 0 : order.quote)) {
+                const reason = again != null ? again : 'not-a-quote';
+                return {
+                    outcome: refuse(reason === 'not-a-quote' ? 404 : 409, CommerceModel.quoteSendRefusalMessage(reason))
+                };
+            }
+            const version = CommerceModel.quoteLinkVersion(order.quote);
+            if (!CommerceModel.quoteSendReplacesLink(order.quote)) return {
+                order,
+                linkVersion: version,
+                linkReplaced: false
+            };
+            const rest = _extends({}, order);
+            delete rest.checkoutSessionId;
+            const replaced = _extends({}, rest, {
+                timeline: CommerceModel.appendOrderEvent(order, 'quote-link-replaced', `Pay link replaced to send revision ${Number((_order_quote_revision = order.quote.revision) != null ? _order_quote_revision : 1)}; the earlier email's link no longer opens the quote`, now),
+                quote: _extends({}, order.quote, {
+                    linkVersion: version + 1
+                })
+            });
+            transaction.set(ref, replaced);
+            return {
+                order: replaced,
+                linkVersion: version + 1,
+                linkReplaced: true,
+                closeSession: order.checkoutSessionId
+            };
+        });
+    } catch (error) {
+        console.error('commerce quote send failed before sending', error);
+        await claim.release();
+        return refuse(500, 'The quote could not be sent. Try again.');
+    }
+    if ('outcome' in prepared) {
+        await claim.release();
+        return prepared.outcome;
+    }
+    const { order, linkVersion, linkReplaced } = prepared;
+    await closeOpenSession(deps, prepared.closeSession, 'quote link replaced to send a revision');
+    const payUrl = deps.payLinkUrl(host, hostId, quoteId, linkVersion);
+    let delivered;
+    try {
+        var _store_data;
+        delivered = await mailer.deliver({
+            hostId,
+            quoteId,
+            order,
+            host,
+            store: (_store_data = store.data()) != null ? _store_data : null,
+            owner: owner ? {
+                id: owner.id,
+                org: owner.org
+            } : null,
+            to,
+            subject: parsed.input.subject,
+            message: parsed.input.message,
+            payUrl,
+            proofUrl: (proofId)=>deps.proofLinkUrl(host, hostId, quoteId, linkVersion, proofId),
+            linkReplaced,
+            senderEmail: context.senderEmail,
+            atMs: now
+        });
+    } catch (error) {
+        console.error('commerce quote send failed', error);
+        await claim.release();
+        return refuse(502, 'The quote email could not be sent. Try again.');
+    }
+    // `strictNullChecks` is off, so the result does not narrow on `sent`.
+    if ('error' in delivered) {
+        await claim.release();
+        return refuse(delivered.status, delivered.error);
+    }
+    const done = delivered;
+    // The email is out: from here a failure is logged, never answered as one,
+    // so a retry does not send it twice.
+    const revision = Math.max(1, Number((_ref1 = (_order_quote = order.quote) == null ? void 0 : _order_quote.revision) != null ? _ref1 : 1) || 1);
+    const send = {
+        revision,
+        to,
+        subject: done.subject,
+        atMs: now,
+        by: actor,
+        messageId: done.messageId,
+        providerId: done.providerId,
+        linkVersion
+    };
+    try {
+        await firestore.runTransaction(async (transaction)=>{
+            const current = await transaction.get(ref);
+            const latest = current.exists ? current.data() : null;
+            if (!(latest == null ? void 0 : latest.quote)) return;
+            transaction.set(ref, CommerceModel.quoteAfterSend(latest, send, done.thread));
+        });
+    } catch (error) {
+        console.error('commerce quote sent but not recorded', {
+            hostId,
+            quoteId,
+            messageId: done.messageId,
+            error
+        });
+    }
+    const outcome = {
+        status: 200,
+        body: {
+            sent: true,
+            to,
+            atMs: now,
+            revision,
+            linkVersion,
+            linkReplaced
+        }
+    };
+    await claim.record(outcome.status, outcome.body);
+    return outcome;
+}
 /** `POST /api/commerce/quote`. */ export const quoteHandler = async (req, res)=>{
-    const outcome = await handleQuote(defaultQuoteDeps(), req);
+    const deps = defaultQuoteDeps();
+    const outcome = await handleQuote(deps, req);
+    if (outcome.pdf) return sendPdf(res, outcome.pdf);
+    if (outcome.file) {
+        const uploads = await deps.uploads();
+        return uploads.send(res, outcome.file);
+    }
     return res.status(outcome.status).json(outcome.body);
 };