@aglyn/plugins-commerce 1.0.0-beta.290 → 1.0.0-beta.292

package/src/lib/server/product.js

@@ -17,6 +17,21 @@
 import * as CommerceModel from "../model/index.js";
 import { firebaseAdmin } from "@aglyn/tenant-data-admin";
 import { readStoreDay } from "./store-day.js";
+/** The website add-on groups of a product, in the page's shape (AGL-4100). */ export function publicModifierGroups(product) {
+    return CommerceModel.websiteModifierGroups(product).map((group)=>({
+            id: group.id,
+            name: group.name,
+            min: group.min,
+            max: group.max,
+            options: group.options.map((option)=>_extends({
+                    id: option.id,
+                    name: option.name,
+                    priceCents: option.priceCents
+                }, option.priceCentsByVariant && Object.keys(option.priceCentsByVariant).length ? {
+                    priceCentsByVariant: _extends({}, option.priceCentsByVariant)
+                } : {}))
+        }));
+}
 /**
  * Map a lifted product onto the public PDP DTO.
  *
@@ -32,6 +47,7 @@ import { readStoreDay } from "./store-day.js";
     var _product_mediaUrls, _product_options;
     var _product_tags;
     const asksUseDate = productAsksUseDateAnywhere(product);
+    const modifierGroups = publicModifierGroups(product);
     return _extends({
         id,
         name: product.name,
@@ -69,6 +85,8 @@ import { readStoreDay } from "./store-day.js";
         subscription: product.subscription
     } : {}, product.subscription && product.subscriptionOptional ? {
         subscriptionOptional: true
+    } : {}, modifierGroups.length ? {
+        modifierGroups
     } : {});
 }
 /** Whether any variant of a product asks the buyer for a use day (AGL-4043). */ export function productAsksUseDateAnywhere(product) {

package/src/lib/server/product.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/product.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { readStoreDay } from './store-day'\n\nexport interface PublicProductDetail {\n  id: string\n  name: string\n  slug: string\n  description?: string\n  type: CommerceModel.ProductType\n  mediaUrls: string[]\n  options: CommerceModel.ProductOption[]\n  variants: Array<{\n    id: string\n    options?: Record<string, string>\n    /**\n     * `null` for a variant listed before it has a price (AGL-3676): the page\n     * says \"Price coming soon\" and offers nothing to buy, as no sale door\n     * would sell it.\n     */\n    priceUsd: number | null\n    compareAtPriceUsd?: number\n    soldOut: boolean\n    imageUrl?: string\n    /**\n     * Merchant's stock-keeping unit (AGL-686). Carried into the public DTO\n     * so the server can put `sku` on the Product structured data — Google\n     * Merchant treats it as required for a product offer, and without it a\n     * listing is simply ineligible for rich results rather than warned about.\n     * It is already public information: it prints on receipts and invoices.\n     */\n    sku?: string\n    /**\n     * The buyer may choose the day they will use it (a pass bought ahead,\n     * AGL-4043): the page offers an optional date. Absent when it does not.\n     */\n    asksUseDate?: true\n  }>\n  /**\n   * The store's time zone, sent only when a variant asks for a use day, so\n   * the page offers no day that has passed on the store's calendar.\n   */\n  useDayTimeZone?: string\n  tags?: string[]\n  /** Recurring billing (AGL-303) so the PDP frames the price. */\n  subscription?: { interval: 'month' | 'year'; trialDays?: number }\n  /** Buyer may choose one-time OR subscribe (AGL-545). */\n  subscriptionOptional?: boolean\n}\n\n/**\n * Map a lifted product onto the public PDP DTO.\n *\n * Extracted (AGL-659) so the site-page resolver can put the SAME payload\n * into page props as the API returns — the PDP block used to fetch this in\n * an effect, which meant the server rendered a skeleton and crawlers saw a\n * product page with no product in it. One definition keeps the server-\n * rendered and client-fetched shapes from drifting.\n *\n * Display-only by design: stock is a `soldOut` boolean rather than a raw\n * count, and the charge still prices server-side.\n */\nexport function toPublicProductDetail(\n  id: string,\n  product: ReturnType<typeof CommerceModel.liftLegacyProduct>,\n  options: { timeZone?: string | null } = {},\n): PublicProductDetail {\n  const asksUseDate = productAsksUseDateAnywhere(product)\n  return {\n    id,\n    name: product.name,\n    slug: product.slug,\n    ...(product.description ? { description: product.description } : {}),\n    type: product.type,\n    mediaUrls:\n      product.mediaUrls ?? (product.imageUrl ? [product.imageUrl] : []),\n    options: product.options ?? [],\n    variants: product.variants.map((variant) => ({\n      id: variant.id,\n      ...(variant.options ? { options: variant.options } : {}),\n      priceUsd: CommerceModel.variantHasPrice(variant) ? variant.priceUsd : null,\n      ...(variant.compareAtPriceUsd\n        ? { compareAtPriceUsd: variant.compareAtPriceUsd }\n        : {}),\n      soldOut:\n        variant.inventory != null &&\n        Number(variant.inventory) <= 0 &&\n        product.oversellPolicy !== 'backorder',\n      ...(variant.imageUrl ? { imageUrl: variant.imageUrl } : {}),\n      ...(variant.sku ? { sku: variant.sku } : {}),\n      ...(CommerceModel.productAsksUseDate(product, variant.id) ? { asksUseDate: true as const } : {}),\n    })),\n    ...(asksUseDate ? { useDayTimeZone: options.timeZone || 'UTC' } : {}),\n    ...(product.tags?.length ? { tags: product.tags } : {}),\n    ...(product.subscription ? { subscription: product.subscription } : {}),\n    ...(product.subscription && product.subscriptionOptional\n      ? { subscriptionOptional: true }\n      : {}),\n  }\n}\n\n/** Whether any variant of a product asks the buyer for a use day (AGL-4043). */\nexport function productAsksUseDateAnywhere(\n  product: Pick<ReturnType<typeof CommerceModel.liftLegacyProduct>, 'variants' | 'checkIn'>,\n): boolean {\n  return product.variants.some((variant) => CommerceModel.productAsksUseDate(product, variant.id))\n}\n\n/**\n * Public product detail by slug (AGL-292): everything the PDP block\n * needs — variants with per-option prices and stock booleans, never raw\n * counts. Display-only; the charge still prices server-side.\n */\nexport const productHandler: PluginApiHandler = async (req, res) => {\n  const hostId = String(req.query.hostId ?? '')\n  const slug = String(req.query.slug ?? '')\n  if (!hostId || !slug) {\n    return res.status(400).json({ error: 'Missing hostId or slug' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const snapshot = await firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('products')\n      .where('slug', '==', slug)\n      .limit(1)\n      .get()\n    const docSnapshot = snapshot.docs[0]\n    const raw = docSnapshot?.data() as any\n    // A product sold in person only (AGL-4060) has no page online: the same\n    // 404 as a draft, so its address says nothing about it.\n    if (!CommerceModel.productListedOnline(raw)) {\n      return res.status(404).json({ error: 'Unknown product' })\n    }\n    const product = CommerceModel.liftLegacyProduct(raw)\n    // The store's calendar, only for a product that asks for a use day.\n    const timeZone = productAsksUseDateAnywhere(product)\n      ? (await readStoreDay(firestore.collection('hosts').doc(hostId))).timeZone\n      : null\n    const detail = toPublicProductDetail(docSnapshot.id, product, { timeZone })\n    res.setHeader(\n      'Cache-Control',\n      'public, s-maxage=60, stale-while-revalidate=300',\n    )\n    return res.status(200).json({ product: detail })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Product unavailable' })\n  }\n}\n"],"names":["CommerceModel","firebaseAdmin","readStoreDay","toPublicProductDetail","id","product","options","asksUseDate","productAsksUseDateAnywhere","name","slug","description","type","mediaUrls","imageUrl","variants","map","variant","priceUsd","variantHasPrice","compareAtPriceUsd","soldOut","inventory","Number","oversellPolicy","sku","productAsksUseDate","useDayTimeZone","timeZone","tags","length","subscription","subscriptionOptional","some","productHandler","req","res","hostId","String","query","status","json","error","firestore","app","snapshot","collection","doc","where","limit","get","docSnapshot","docs","raw","data","productListedOnline","liftLegacyProduct","detail","setHeader","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAID,YAAYA,mBAAmB,oBAAU;AACzC,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,YAAY,QAAQ,iBAAa;AAgD1C;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,sBACdC,EAAU,EACVC,OAA2D,EAC3DC,UAAwC,CAAC,CAAC;QAUtCD,oBACOA;QAiBLA;IA1BN,MAAME,cAAcC,2BAA2BH;IAC/C,OAAO;QACLD;QACAK,MAAMJ,QAAQI,IAAI;QAClBC,MAAML,QAAQK,IAAI;OACdL,QAAQM,WAAW,GAAG;QAAEA,aAAaN,QAAQM,WAAW;IAAC,IAAI,CAAC;QAClEC,MAAMP,QAAQO,IAAI;QAClBC,SAAS,GACPR,qBAAAA,QAAQQ,SAAS,YAAjBR,qBAAsBA,QAAQS,QAAQ,GAAG;YAACT,QAAQS,QAAQ;SAAC,GAAG,EAAE;QAClER,OAAO,GAAED,mBAAAA,QAAQC,OAAO,YAAfD,mBAAmB,EAAE;QAC9BU,UAAUV,QAAQU,QAAQ,CAACC,GAAG,CAAC,CAACC,UAAa;gBAC3Cb,IAAIa,QAAQb,EAAE;eACVa,QAAQX,OAAO,GAAG;gBAAEA,SAASW,QAAQX,OAAO;YAAC,IAAI,CAAC;gBACtDY,UAAUlB,cAAcmB,eAAe,CAACF,WAAWA,QAAQC,QAAQ,GAAG;eAClED,QAAQG,iBAAiB,GACzB;gBAAEA,mBAAmBH,QAAQG,iBAAiB;YAAC,IAC/C,CAAC;gBACLC,SACEJ,QAAQK,SAAS,IAAI,QACrBC,OAAON,QAAQK,SAAS,KAAK,KAC7BjB,QAAQmB,cAAc,KAAK;eACzBP,QAAQH,QAAQ,GAAG;gBAAEA,UAAUG,QAAQH,QAAQ;YAAC,IAAI,CAAC,GACrDG,QAAQQ,GAAG,GAAG;gBAAEA,KAAKR,QAAQQ,GAAG;YAAC,IAAI,CAAC,GACtCzB,cAAc0B,kBAAkB,CAACrB,SAASY,QAAQb,EAAE,IAAI;gBAAEG,aAAa;YAAc,IAAI,CAAC;OAE5FA,cAAc;QAAEoB,gBAAgBrB,QAAQsB,QAAQ,IAAI;IAAM,IAAI,CAAC,GAC/DvB,EAAAA,gBAAAA,QAAQwB,IAAI,qBAAZxB,cAAcyB,MAAM,IAAG;QAAED,MAAMxB,QAAQwB,IAAI;IAAC,IAAI,CAAC,GACjDxB,QAAQ0B,YAAY,GAAG;QAAEA,cAAc1B,QAAQ0B,YAAY;IAAC,IAAI,CAAC,GACjE1B,QAAQ0B,YAAY,IAAI1B,QAAQ2B,oBAAoB,GACpD;QAAEA,sBAAsB;IAAK,IAC7B,CAAC;AAET;AAEA,8EAA8E,GAC9E,OAAO,SAASxB,2BACdH,OAAyF;IAEzF,OAAOA,QAAQU,QAAQ,CAACkB,IAAI,CAAC,CAAChB,UAAYjB,cAAc0B,kBAAkB,CAACrB,SAASY,QAAQb,EAAE;AAChG;AAEA;;;;CAIC,GACD,OAAO,MAAM8B,iBAAmC,OAAOC,KAAKC;QACpCD,mBACFA;IADpB,MAAME,SAASC,QAAOH,oBAAAA,IAAII,KAAK,CAACF,MAAM,YAAhBF,oBAAoB;IAC1C,MAAMzB,OAAO4B,QAAOH,kBAAAA,IAAII,KAAK,CAAC7B,IAAI,YAAdyB,kBAAkB;IACtC,IAAI,CAACE,UAAU,CAAC3B,MAAM;QACpB,OAAO0B,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAyB;IAChE;IACA,IAAI;QACF,MAAMC,YAAY1C,cAAc2C,GAAG,GAAGD,SAAS;QAC/C,MAAME,WAAW,MAAMF,UACpBG,UAAU,CAAC,SACXC,GAAG,CAACV,QACJS,UAAU,CAAC,YACXE,KAAK,CAAC,QAAQ,MAAMtC,MACpBuC,KAAK,CAAC,GACNC,GAAG;QACN,MAAMC,cAAcN,SAASO,IAAI,CAAC,EAAE;QACpC,MAAMC,MAAMF,+BAAAA,YAAaG,IAAI;QAC7B,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,CAACtD,cAAcuD,mBAAmB,CAACF,MAAM;YAC3C,OAAOjB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAMrC,UAAUL,cAAcwD,iBAAiB,CAACH;QAChD,oEAAoE;QACpE,MAAMzB,WAAWpB,2BAA2BH,WACxC,AAAC,CAAA,MAAMH,aAAayC,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACV,QAAO,EAAGT,QAAQ,GACxE;QACJ,MAAM6B,SAAStD,sBAAsBgD,YAAY/C,EAAE,EAAEC,SAAS;YAAEuB;QAAS;QACzEQ,IAAIsB,SAAS,CACX,iBACA;QAEF,OAAOtB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEpC,SAASoD;QAAO;IAChD,EAAE,OAAOf,OAAO;QACdiB,QAAQjB,KAAK,CAACA;QACd,OAAON,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/product.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport * as CommerceModel from '../model'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { readStoreDay } from './store-day'\n\nexport interface PublicProductDetail {\n  id: string\n  name: string\n  slug: string\n  description?: string\n  type: CommerceModel.ProductType\n  mediaUrls: string[]\n  options: CommerceModel.ProductOption[]\n  variants: Array<{\n    id: string\n    options?: Record<string, string>\n    /**\n     * `null` for a variant listed before it has a price (AGL-3676): the page\n     * says \"Price coming soon\" and offers nothing to buy, as no sale door\n     * would sell it.\n     */\n    priceUsd: number | null\n    compareAtPriceUsd?: number\n    soldOut: boolean\n    imageUrl?: string\n    /**\n     * Merchant's stock-keeping unit (AGL-686). Carried into the public DTO\n     * so the server can put `sku` on the Product structured data — Google\n     * Merchant treats it as required for a product offer, and without it a\n     * listing is simply ineligible for rich results rather than warned about.\n     * It is already public information: it prints on receipts and invoices.\n     */\n    sku?: string\n    /**\n     * The buyer may choose the day they will use it (a pass bought ahead,\n     * AGL-4043): the page offers an optional date. Absent when it does not.\n     */\n    asksUseDate?: true\n  }>\n  /**\n   * The store's time zone, sent only when a variant asks for a use day, so\n   * the page offers no day that has passed on the store's calendar.\n   */\n  useDayTimeZone?: string\n  tags?: string[]\n  /** Recurring billing (AGL-303) so the PDP frames the price. */\n  subscription?: { interval: 'month' | 'year'; trialDays?: number }\n  /** Buyer may choose one-time OR subscribe (AGL-545). */\n  subscriptionOptional?: boolean\n  /**\n   * The add-ons the page offers (AGL-4100): ONLY the groups switched to\n   * \"Show on the website\". A register-only group never leaves the server, so\n   * a shop's in-person choices and prices are not published. Absent: none.\n   * Display-only like the prices above; every sale door prices them again\n   * from the product.\n   */\n  modifierGroups?: PublicModifierGroup[]\n}\n\n/** An add-on group as the product page shows it (AGL-4100). */\nexport interface PublicModifierGroup {\n  id: string\n  name: string\n  min: number\n  max: number\n  options: Array<{\n    id: string\n    name: string\n    priceCents: number\n    /** What the choice adds on a variant priced differently, by variant id. */\n    priceCentsByVariant?: Record<string, number>\n  }>\n}\n\n/** The website add-on groups of a product, in the page's shape (AGL-4100). */\nexport function publicModifierGroups(\n  product: { modifierGroups?: unknown },\n): PublicModifierGroup[] {\n  return CommerceModel.websiteModifierGroups(product).map((group) => ({\n    id: group.id,\n    name: group.name,\n    min: group.min,\n    max: group.max,\n    options: group.options.map((option) => ({\n      id: option.id,\n      name: option.name,\n      priceCents: option.priceCents,\n      ...(option.priceCentsByVariant && Object.keys(option.priceCentsByVariant).length\n        ? { priceCentsByVariant: { ...option.priceCentsByVariant } }\n        : {}),\n    })),\n  }))\n}\n\n/**\n * Map a lifted product onto the public PDP DTO.\n *\n * Extracted (AGL-659) so the site-page resolver can put the SAME payload\n * into page props as the API returns — the PDP block used to fetch this in\n * an effect, which meant the server rendered a skeleton and crawlers saw a\n * product page with no product in it. One definition keeps the server-\n * rendered and client-fetched shapes from drifting.\n *\n * Display-only by design: stock is a `soldOut` boolean rather than a raw\n * count, and the charge still prices server-side.\n */\nexport function toPublicProductDetail(\n  id: string,\n  product: ReturnType<typeof CommerceModel.liftLegacyProduct>,\n  options: { timeZone?: string | null } = {},\n): PublicProductDetail {\n  const asksUseDate = productAsksUseDateAnywhere(product)\n  const modifierGroups = publicModifierGroups(product)\n  return {\n    id,\n    name: product.name,\n    slug: product.slug,\n    ...(product.description ? { description: product.description } : {}),\n    type: product.type,\n    mediaUrls:\n      product.mediaUrls ?? (product.imageUrl ? [product.imageUrl] : []),\n    options: product.options ?? [],\n    variants: product.variants.map((variant) => ({\n      id: variant.id,\n      ...(variant.options ? { options: variant.options } : {}),\n      priceUsd: CommerceModel.variantHasPrice(variant) ? variant.priceUsd : null,\n      ...(variant.compareAtPriceUsd\n        ? { compareAtPriceUsd: variant.compareAtPriceUsd }\n        : {}),\n      soldOut:\n        variant.inventory != null &&\n        Number(variant.inventory) <= 0 &&\n        product.oversellPolicy !== 'backorder',\n      ...(variant.imageUrl ? { imageUrl: variant.imageUrl } : {}),\n      ...(variant.sku ? { sku: variant.sku } : {}),\n      ...(CommerceModel.productAsksUseDate(product, variant.id) ? { asksUseDate: true as const } : {}),\n    })),\n    ...(asksUseDate ? { useDayTimeZone: options.timeZone || 'UTC' } : {}),\n    ...(product.tags?.length ? { tags: product.tags } : {}),\n    ...(product.subscription ? { subscription: product.subscription } : {}),\n    ...(product.subscription && product.subscriptionOptional\n      ? { subscriptionOptional: true }\n      : {}),\n    ...(modifierGroups.length ? { modifierGroups } : {}),\n  }\n}\n\n/** Whether any variant of a product asks the buyer for a use day (AGL-4043). */\nexport function productAsksUseDateAnywhere(\n  product: Pick<ReturnType<typeof CommerceModel.liftLegacyProduct>, 'variants' | 'checkIn'>,\n): boolean {\n  return product.variants.some((variant) => CommerceModel.productAsksUseDate(product, variant.id))\n}\n\n/**\n * Public product detail by slug (AGL-292): everything the PDP block\n * needs — variants with per-option prices and stock booleans, never raw\n * counts. Display-only; the charge still prices server-side.\n */\nexport const productHandler: PluginApiHandler = async (req, res) => {\n  const hostId = String(req.query.hostId ?? '')\n  const slug = String(req.query.slug ?? '')\n  if (!hostId || !slug) {\n    return res.status(400).json({ error: 'Missing hostId or slug' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const snapshot = await firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('products')\n      .where('slug', '==', slug)\n      .limit(1)\n      .get()\n    const docSnapshot = snapshot.docs[0]\n    const raw = docSnapshot?.data() as any\n    // A product sold in person only (AGL-4060) has no page online: the same\n    // 404 as a draft, so its address says nothing about it.\n    if (!CommerceModel.productListedOnline(raw)) {\n      return res.status(404).json({ error: 'Unknown product' })\n    }\n    const product = CommerceModel.liftLegacyProduct(raw)\n    // The store's calendar, only for a product that asks for a use day.\n    const timeZone = productAsksUseDateAnywhere(product)\n      ? (await readStoreDay(firestore.collection('hosts').doc(hostId))).timeZone\n      : null\n    const detail = toPublicProductDetail(docSnapshot.id, product, { timeZone })\n    res.setHeader(\n      'Cache-Control',\n      'public, s-maxage=60, stale-while-revalidate=300',\n    )\n    return res.status(200).json({ product: detail })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Product unavailable' })\n  }\n}\n"],"names":["CommerceModel","firebaseAdmin","readStoreDay","publicModifierGroups","product","websiteModifierGroups","map","group","id","name","min","max","options","option","priceCents","priceCentsByVariant","Object","keys","length","toPublicProductDetail","asksUseDate","productAsksUseDateAnywhere","modifierGroups","slug","description","type","mediaUrls","imageUrl","variants","variant","priceUsd","variantHasPrice","compareAtPriceUsd","soldOut","inventory","Number","oversellPolicy","sku","productAsksUseDate","useDayTimeZone","timeZone","tags","subscription","subscriptionOptional","some","productHandler","req","res","hostId","String","query","status","json","error","firestore","app","snapshot","collection","doc","where","limit","get","docSnapshot","docs","raw","data","productListedOnline","liftLegacyProduct","detail","setHeader","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAID,YAAYA,mBAAmB,oBAAU;AACzC,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,YAAY,QAAQ,iBAAa;AAuE1C,4EAA4E,GAC5E,OAAO,SAASC,qBACdC,OAAqC;IAErC,OAAOJ,cAAcK,qBAAqB,CAACD,SAASE,GAAG,CAAC,CAACC,QAAW,CAAA;YAClEC,IAAID,MAAMC,EAAE;YACZC,MAAMF,MAAME,IAAI;YAChBC,KAAKH,MAAMG,GAAG;YACdC,KAAKJ,MAAMI,GAAG;YACdC,SAASL,MAAMK,OAAO,CAACN,GAAG,CAAC,CAACO,SAAY;oBACtCL,IAAIK,OAAOL,EAAE;oBACbC,MAAMI,OAAOJ,IAAI;oBACjBK,YAAYD,OAAOC,UAAU;mBACzBD,OAAOE,mBAAmB,IAAIC,OAAOC,IAAI,CAACJ,OAAOE,mBAAmB,EAAEG,MAAM,GAC5E;oBAAEH,qBAAqB,aAAKF,OAAOE,mBAAmB;gBAAG,IACzD,CAAC;QAET,CAAA;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASI,sBACdX,EAAU,EACVJ,OAA2D,EAC3DQ,UAAwC,CAAC,CAAC;QAWtCR,oBACOA;QAiBLA;IA3BN,MAAMgB,cAAcC,2BAA2BjB;IAC/C,MAAMkB,iBAAiBnB,qBAAqBC;IAC5C,OAAO;QACLI;QACAC,MAAML,QAAQK,IAAI;QAClBc,MAAMnB,QAAQmB,IAAI;OACdnB,QAAQoB,WAAW,GAAG;QAAEA,aAAapB,QAAQoB,WAAW;IAAC,IAAI,CAAC;QAClEC,MAAMrB,QAAQqB,IAAI;QAClBC,SAAS,GACPtB,qBAAAA,QAAQsB,SAAS,YAAjBtB,qBAAsBA,QAAQuB,QAAQ,GAAG;YAACvB,QAAQuB,QAAQ;SAAC,GAAG,EAAE;QAClEf,OAAO,GAAER,mBAAAA,QAAQQ,OAAO,YAAfR,mBAAmB,EAAE;QAC9BwB,UAAUxB,QAAQwB,QAAQ,CAACtB,GAAG,CAAC,CAACuB,UAAa;gBAC3CrB,IAAIqB,QAAQrB,EAAE;eACVqB,QAAQjB,OAAO,GAAG;gBAAEA,SAASiB,QAAQjB,OAAO;YAAC,IAAI,CAAC;gBACtDkB,UAAU9B,cAAc+B,eAAe,CAACF,WAAWA,QAAQC,QAAQ,GAAG;eAClED,QAAQG,iBAAiB,GACzB;gBAAEA,mBAAmBH,QAAQG,iBAAiB;YAAC,IAC/C,CAAC;gBACLC,SACEJ,QAAQK,SAAS,IAAI,QACrBC,OAAON,QAAQK,SAAS,KAAK,KAC7B9B,QAAQgC,cAAc,KAAK;eACzBP,QAAQF,QAAQ,GAAG;gBAAEA,UAAUE,QAAQF,QAAQ;YAAC,IAAI,CAAC,GACrDE,QAAQQ,GAAG,GAAG;gBAAEA,KAAKR,QAAQQ,GAAG;YAAC,IAAI,CAAC,GACtCrC,cAAcsC,kBAAkB,CAAClC,SAASyB,QAAQrB,EAAE,IAAI;gBAAEY,aAAa;YAAc,IAAI,CAAC;OAE5FA,cAAc;QAAEmB,gBAAgB3B,QAAQ4B,QAAQ,IAAI;IAAM,IAAI,CAAC,GAC/DpC,EAAAA,gBAAAA,QAAQqC,IAAI,qBAAZrC,cAAcc,MAAM,IAAG;QAAEuB,MAAMrC,QAAQqC,IAAI;IAAC,IAAI,CAAC,GACjDrC,QAAQsC,YAAY,GAAG;QAAEA,cAActC,QAAQsC,YAAY;IAAC,IAAI,CAAC,GACjEtC,QAAQsC,YAAY,IAAItC,QAAQuC,oBAAoB,GACpD;QAAEA,sBAAsB;IAAK,IAC7B,CAAC,GACDrB,eAAeJ,MAAM,GAAG;QAAEI;IAAe,IAAI,CAAC;AAEtD;AAEA,8EAA8E,GAC9E,OAAO,SAASD,2BACdjB,OAAyF;IAEzF,OAAOA,QAAQwB,QAAQ,CAACgB,IAAI,CAAC,CAACf,UAAY7B,cAAcsC,kBAAkB,CAAClC,SAASyB,QAAQrB,EAAE;AAChG;AAEA;;;;CAIC,GACD,OAAO,MAAMqC,iBAAmC,OAAOC,KAAKC;QACpCD,mBACFA;IADpB,MAAME,SAASC,QAAOH,oBAAAA,IAAII,KAAK,CAACF,MAAM,YAAhBF,oBAAoB;IAC1C,MAAMvB,OAAO0B,QAAOH,kBAAAA,IAAII,KAAK,CAAC3B,IAAI,YAAduB,kBAAkB;IACtC,IAAI,CAACE,UAAU,CAACzB,MAAM;QACpB,OAAOwB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAyB;IAChE;IACA,IAAI;QACF,MAAMC,YAAYrD,cAAcsD,GAAG,GAAGD,SAAS;QAC/C,MAAME,WAAW,MAAMF,UACpBG,UAAU,CAAC,SACXC,GAAG,CAACV,QACJS,UAAU,CAAC,YACXE,KAAK,CAAC,QAAQ,MAAMpC,MACpBqC,KAAK,CAAC,GACNC,GAAG;QACN,MAAMC,cAAcN,SAASO,IAAI,CAAC,EAAE;QACpC,MAAMC,MAAMF,+BAAAA,YAAaG,IAAI;QAC7B,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,CAACjE,cAAckE,mBAAmB,CAACF,MAAM;YAC3C,OAAOjB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAMjD,UAAUJ,cAAcmE,iBAAiB,CAACH;QAChD,oEAAoE;QACpE,MAAMxB,WAAWnB,2BAA2BjB,WACxC,AAAC,CAAA,MAAMF,aAAaoD,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACV,QAAO,EAAGR,QAAQ,GACxE;QACJ,MAAM4B,SAASjD,sBAAsB2C,YAAYtD,EAAE,EAAEJ,SAAS;YAAEoC;QAAS;QACzEO,IAAIsB,SAAS,CACX,iBACA;QAEF,OAAOtB,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEhD,SAASgE;QAAO;IAChD,EAAE,OAAOf,OAAO;QACdiB,QAAQjB,KAAK,CAACA;QACd,OAAON,IAAII,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;AACF,EAAC"}

package/src/lib/server/products-write.js

@@ -22,7 +22,7 @@ import { countLiveDocuments } from "@aglyn/aglyn/app-utils/live-document-count";
 import { dropPluginSiteCache } from "@aglyn/aglyn/plugin-manager/plugin-site-cache";
 import { firebaseAdmin, getLockdownVerdict, getOrgForHost, isImpersonationSession } from "@aglyn/tenant-data-admin";
 import { FieldValue } from "firebase-admin/firestore";
-import { liftLegacyProduct, productCollectionIds, productDuplicateFields, productDuplicateName, productDuplicateSlugBase, productEditWrite, productMembershipInput, productSaveFields, smartCollectionRulesOf, stockAdjustmentWrite, validateProduct } from "../model/index.js";
+import { liftLegacyProduct, productCollectionIds, productDuplicateFields, productDuplicateName, productDuplicateSlugBase, productEditWrite, productMembershipInput, productSaveFields, smartCollectionRulesOf, stockAdjustmentWrite, validateProduct, variantMatrixProblem } from "../model/index.js";
 import { planRefusal, roomRefusal } from "./product-drafts.js";
 /** Names "Edit site content" (`site.edit`, AGL-4047), never a role. */ export const ROLE_REFUSAL = siteKeyRefusal('site.edit');
 const MAX_BODY_BYTES = 256000;
@@ -173,11 +173,14 @@ export function resolved(deps) {
             error: 'Product name is required'
         });
         try {
+            var _variantMatrixProblem;
             const door = await gate(req, res, hostId, deps);
             if (!door) return;
             const nowMs = deps.now();
             const fields = productSaveFields(product, nowMs);
-            const problem = validateProduct(fields);
+            // More combinations than a product holds is refused with the count
+            // (AGL-4100), never saved short of the options it names.
+            const problem = (_variantMatrixProblem = variantMatrixProblem(fields.options)) != null ? _variantMatrixProblem : validateProduct(fields);
             if (problem) return res.status(400).json({
                 error: problem
             });

package/src/lib/server/products-write.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/products-write.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createHash } from 'node:crypto'\nimport { holdsSiteKey, hostStampedSitePermission, siteKeyRefusal } from '@aglyn/aglyn/app-utils/host-permissions'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { createResourceUid } from '@aglyn/aglyn/app-utils/create-resource-uid'\nimport type { HostAccessRole } from '@aglyn/aglyn/foundation/definitions/organization.types'\nimport { countLiveDocuments } from '@aglyn/aglyn/app-utils/live-document-count'\nimport { dropPluginSiteCache } from '@aglyn/aglyn/plugin-manager/plugin-site-cache'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getLockdownVerdict, getOrgForHost, isImpersonationSession } from '@aglyn/tenant-data-admin'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n  type EditedProduct,\n  liftLegacyProduct,\n  productCollectionIds,\n  productDuplicateFields,\n  productDuplicateName,\n  productDuplicateSlugBase,\n  productEditWrite,\n  productMembershipInput,\n  productSaveFields,\n  smartCollectionRulesOf,\n  stockAdjustmentWrite,\n  validateProduct,\n  type InventoryAdjustmentReason,\n} from '../model'\nimport { planRefusal, roomRefusal } from './product-drafts'\n\n/*\n * `POST /api/commerce/products/save` and `POST /api/commerce/products/stock`\n * (AGL-3652): the console product editor's save and its Adjust stock dialog,\n * for the native apps.\n *\n * The console makes both writes from the browser, computing derived fields\n * first (search keys, stock verdict, price, image, smart-collection\n * membership). These routes run THAT computation (`model/product-write.ts`,\n * which the console imports too) and make the same writes, under the gate\n * the Firestore rules put on them: a verified member with a write role on the\n * site (`canWriteHostContent`), or staff, while the site, its org and the\n * platform are not frozen (`hostWritesFrozen`). A new product also meets the\n * create path's own door: the plan's `commerce` entitlement and its\n * `productsPerHost` quota, counted in the same transaction as the create.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/** Names \"Edit site content\" (`site.edit`, AGL-4047), never a role. */\nexport const ROLE_REFUSAL = siteKeyRefusal('site.edit')\nconst MAX_BODY_BYTES = 256_000\n\n/** The reasons the Adjust stock dialog offers. */\nexport const STOCK_ADJUST_REASONS: readonly InventoryAdjustmentReason[] = ['restock', 'correction', 'damage', 'refund']\n\nexport interface ProductsWriteDeps {\n  firestore?: () => Firestore\n  verifyIdToken?: (token: string) => Promise<Record<string, unknown> & { uid: string }>\n  orgForHost?: (hostId: string) => Promise<{ org: Record<string, unknown> } | null>\n  lockdown?: (options: Parameters<typeof getLockdownVerdict>[0]) => Promise<unknown>\n  dropCache?: typeof dropPluginSiteCache\n  now?: () => number\n}\n\ntype Reply = Parameters<PluginApiHandler>[1]\n\nexport function bodyOf(req: Parameters<PluginApiHandler>[0]): Record<string, unknown> {\n  const raw = req.body\n  if (typeof raw === 'string') {\n    if (raw.length > MAX_BODY_BYTES) return {}\n    try {\n      return JSON.parse(raw || '{}')\n    } catch {\n      return {}\n    }\n  }\n  return (raw ?? {}) as Record<string, unknown>\n}\n\nexport const validId = (value: unknown): value is string =>\n  typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value)\n\nexport interface Gate {\n  uid: string\n  /** The caller's address, for an activity line; null when the token has none. */\n  email: string | null\n  staff: boolean\n  host: FirebaseFirestore.DocumentSnapshot\n  org: Record<string, unknown>\n}\n\n/**\n * The permission a route built on {@link gate} checks instead of the site\n * role (AGL-4047): a key whose preset is the site role, that preset (the\n * declaring plugin's own table, so the answer does not depend on which\n * plugins this process loaded), and the refusal naming it.\n */\nexport interface GatePermission {\n  key: string\n  presetFor: Readonly<Record<HostAccessRole, boolean>>\n  refusal: string\n}\n\n/**\n * Who may write this site's products, as the rules decide it. Answers the\n * caller's reply on a refusal and returns null.\n *\n * A route that is not about products names the key it checks instead\n * (`permission`, AGL-4047): the walk-in and the guests change ask their\n * reservation key, read as the rules read it, from the site's\n * `memberPermissions` stamp, else the preset of the member's `memberRoles`\n * entry, so the route and the rules give one answer. Without it, the\n * product routes ask \"Edit site content\" (`site.edit`) the same way.\n */\nexport async function gate(\n  req: Parameters<PluginApiHandler>[0],\n  res: Reply,\n  hostId: string,\n  deps: Required<ProductsWriteDeps>,\n  options: { permission?: GatePermission } = {},\n): Promise<Gate | null> {\n  const authorization = String(req.headers.authorization ?? '')\n  const token = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : ''\n  if (!token) return void res.status(401).json({ error: 'Unauthenticated' }), null\n  let decoded: Record<string, unknown> & { uid: string }\n  try {\n    decoded = await deps.verifyIdToken(token)\n  } catch (error) {\n    // Only a refused token is the caller's; an Auth outage is a 500 (AGL-2852).\n    if (!isRefusedIdToken(error)) throw error\n    return void res.status(401).json({ error: 'Sign in again to continue' }), null\n  }\n  const staff = decoded['staff'] === true\n  if (!staff && decoded['email_verified'] !== true && !isImpersonationSession(decoded as never)) {\n    return void res.status(403).json({ error: 'Verify your email address to make changes' }), null\n  }\n  const host = await deps.firestore().collection('hosts').doc(hostId).get()\n  if (!host.exists) return void res.status(404).json({ error: 'Unknown site' }), null\n  if (!staff) {\n    const { permission } = options\n    const allowed = permission\n      ? hostStampedSitePermission(host.data(), decoded.uid, permission.key, permission.presetFor)\n      : holdsSiteKey(host, decoded.uid, 'site.edit')\n    if (!allowed) return void res.status(403).json({ error: permission?.refusal ?? ROLE_REFUSAL }), null\n  }\n  const org = ((await deps.orgForHost(hostId))?.org ?? {}) as Record<string, unknown>\n  const locked = await deps.lockdown({ staff, uid: decoded.uid, org: org as never, host: host.data() as never, request: { method: 'POST' } as never })\n  if (locked) return void res.status(423).json({ error: 'This site is not accepting changes right now' }), null\n  const email = typeof decoded['email'] === 'string' ? decoded['email'] : null\n  return { uid: decoded.uid, email, staff, host, org }\n}\n\n/** The site-wide cache drop a product change is owed (AGL-3386): an outbox entry in the write, then the drop. */\nexport function outboxEntry(firestore: Firestore, hostId: string) {\n  return {\n    ref: firestore.collection('publishOutbox').doc(createResourceUid()),\n    data: { hostId, paths: ['/'], createdAt: FieldValue.serverTimestamp(), attempts: 0, entireHost: true },\n  }\n}\n\nexport async function settleCache(deps: Required<ProductsWriteDeps>, hostId: string, entry: FirebaseFirestore.DocumentReference, reason: string) {\n  const dropped = await deps.dropCache({ hostIds: [hostId], reason }).catch(() => ({ complete: false }))\n  if (dropped.complete) await entry.delete().catch(() => undefined)\n}\n\nexport function resolved(deps: ProductsWriteDeps): Required<ProductsWriteDeps> {\n  return {\n    firestore: deps.firestore ?? (() => firebaseAdmin.app().firestore() as unknown as Firestore),\n    verifyIdToken: deps.verifyIdToken ?? ((token) => firebaseAdmin.app().auth().verifyIdToken(token) as never),\n    orgForHost: deps.orgForHost ?? ((hostId) => getOrgForHost(hostId) as never),\n    lockdown: deps.lockdown ?? ((options) => getLockdownVerdict(options)),\n    dropCache: deps.dropCache ?? dropPluginSiteCache,\n    now: deps.now ?? (() => Date.now()),\n  }\n}\n\n/**\n * Saves a product as the console editor does. `create: true` makes a new\n * product under the client-minted `productId` (a retry finds its own product\n * and answers `replayed`); otherwise it replaces the live product, keeping\n * its live stock holds.\n */\nexport function createProductSaveHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const hostId = body['hostId']\n    const productId = body['productId']\n    const product = body['product'] as EditedProduct | undefined\n    if (!validId(hostId) || !validId(productId) || !product || typeof product !== 'object' || !Array.isArray(product.variants)) {\n      return res.status(400).json({ error: 'Missing site, product or its variants' })\n    }\n    if (typeof product.name !== 'string' || !product.name.trim()) return res.status(400).json({ error: 'Product name is required' })\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const nowMs = deps.now()\n      const fields = productSaveFields(product, nowMs)\n      const problem = validateProduct(fields as never)\n      if (problem) return res.status(400).json({ error: problem })\n      const db = deps.firestore()\n      const hostRef = db.collection('hosts').doc(hostId)\n      const products = hostRef.collection('products')\n      const productRef = products.doc(productId)\n      const smartQuery = hostRef.collection('collections').where('kind', '==', 'catalog').where('mode', '==', 'smart')\n      const outbox = outboxEntry(db, hostId)\n      const create = body['create'] === true\n      const answer = await db.runTransaction(async (tx) => {\n        const [existing, smart] = await Promise.all([tx.get(productRef), tx.get(smartQuery)])\n        const membership = {\n          collectionIds: productCollectionIds(\n            productMembershipInput(fields, product) as never,\n            smart.docs.map((doc) => smartCollectionRulesOf(doc.id, doc.data())),\n          ),\n        }\n        if (create) {\n          if (existing.exists) return { status: 200, body: { ok: true, id: productId, replayed: true } }\n          const early = planRefusal(door.org as never)\n          if (early) return { status: early.status, body: { error: early.error } }\n          const used = await countLiveDocuments(products, (aggregate) => tx.get(aggregate))\n          const room = roomRefusal(door.org as never, Number(used) || 0)\n          if (room) return { status: room.status, body: { error: room.error } }\n          tx.create(productRef, {\n            ...fields,\n            ...membership,\n            createdAtMs: nowMs,\n            deletedAt: null,\n            createdAt: FieldValue.serverTimestamp(),\n            updatedAt: FieldValue.serverTimestamp(),\n            createdBy: door.uid,\n          })\n        } else {\n          if (!existing.exists || existing.get('deletedAt')) return { status: 404, body: { error: 'This product was deleted' } }\n          tx.set(productRef, {\n            ...storedTimestamps(existing.data() ?? {}, product as unknown as Record<string, unknown>),\n            ...productEditWrite(fields, existing.get('stockHolds')),\n            ...membership,\n            updatedAt: FieldValue.serverTimestamp(),\n          })\n        }\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, id: productId, replayed: false } }\n      })\n      if (answer.status === 200 && !(answer.body as { replayed?: boolean }).replayed) {\n        await settleCache(deps, hostId, outbox.ref, 'product saved from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/save]', error)\n      return res.status(500).json({ error: 'The product could not be saved' })\n    }\n  }\n}\n\n/**\n * The stored timestamps an edit keeps. The console's replace writes back the\n * Timestamps its seed carried (`createdAt`, a publish time); a client's JSON\n * cannot carry one, so each stored Timestamp field the request does not name\n * is kept as stored.\n */\nexport function storedTimestamps(stored: Record<string, unknown>, asked: Record<string, unknown>): Record<string, unknown> {\n  return Object.fromEntries(\n    Object.entries(stored).filter(\n      ([key, value]) => !(key in asked) && typeof (value as { toDate?: unknown } | null)?.toDate === 'function',\n    ),\n  )\n}\n\n/** The ledger row id one attempt owns: the same key from the same member is the same row. */\nexport function stockAttemptId(uid: string, key: string): string {\n  return 'app-' + createHash('sha256').update(`${uid}:${key}`).digest('hex').slice(0, 40)\n}\n\n/**\n * Adjusts one variant's stock as the Adjust stock dialog does: the variants\n * and stock fields on the product, and one `inventoryAdjustments` row, in one\n * transaction. The Idempotency-Key names that row, so a retried attempt finds\n * it and moves nothing twice.\n */\nexport function createProductStockHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const hostId = body['hostId']\n    const productId = body['productId']\n    const variantId = body['variantId']\n    const key = String(req.headers['idempotency-key'] ?? '').trim().slice(0, 200)\n    const reason = body['reason'] as InventoryAdjustmentReason\n    const delta = Math.round(Number(body['delta']))\n    const locationId = typeof body['locationId'] === 'string' && body['locationId'] ? body['locationId'] : undefined\n    if (!validId(hostId) || !validId(productId) || typeof variantId !== 'string' || !variantId) {\n      return res.status(400).json({ error: 'Missing site, product or variant' })\n    }\n    if (!key) return res.status(400).json({ error: 'Missing Idempotency-Key' })\n    if (!STOCK_ADJUST_REASONS.includes(reason)) return res.status(400).json({ error: 'Unknown reason' })\n    if (!Number.isFinite(delta) || delta === 0) return res.status(400).json({ error: 'Enter a number of units' })\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const db = deps.firestore()\n      const hostRef = db.collection('hosts').doc(hostId)\n      const productRef = hostRef.collection('products').doc(productId)\n      const ledgerRef = hostRef.collection('inventoryAdjustments').doc(stockAttemptId(door.uid, key))\n      const outbox = outboxEntry(db, hostId)\n      const answer = await db.runTransaction(async (tx) => {\n        const [ledger, stored] = await Promise.all([tx.get(ledgerRef), tx.get(productRef)])\n        if (ledger.exists) {\n          return { status: 200, body: { ok: true, replayed: true, inventory: stored.get('inventory') ?? null } }\n        }\n        if (!stored.exists || stored.get('deletedAt')) return { status: 404, body: { error: 'This product was deleted' } }\n        const product = stored.data() as never as Parameters<typeof stockAdjustmentWrite>[0]\n        if (!(product.variants ?? []).some((variant) => variant.id === variantId)) {\n          return { status: 404, body: { error: 'That variant is no longer on this product' } }\n        }\n        const write = stockAdjustmentWrite(product, productId, { variantId, delta, reason, locationId }, deps.now())\n        if (!write) return { status: 400, body: { error: 'Enter a number of units' } }\n        tx.update(productRef, write.update)\n        tx.create(ledgerRef, write.ledger)\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, replayed: false, inventory: (write.update as { inventory?: unknown }).inventory ?? null } }\n      })\n      if (answer.status === 200 && !(answer.body as { replayed?: boolean }).replayed) {\n        await settleCache(deps, hostId, outbox.ref, 'stock adjusted from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/stock]', error)\n      return res.status(500).json({ error: 'Stock could not be adjusted' })\n    }\n  }\n}\n\n/**\n * The first slug in `base`, `base-2`, `base-3`… no product of the site holds,\n * as the console's slug ledger claims one (`product-slugs.ts`): a second\n * Duplicate of the same product does not mint a second `-copy` (AGL-3321).\n */\nexport async function claimProductSlug(products: FirebaseFirestore.CollectionReference, base: string): Promise<string> {\n  for (let suffix = 1; suffix < 1000; suffix += 1) {\n    const candidate = suffix < 2 ? base : `${base}-${suffix}`\n    const held = await products.where('slug', '==', candidate).limit(1).get()\n    if (held.empty) return candidate\n  }\n  return `${base}-${Date.now()}`\n}\n\n/**\n * `POST /api/commerce/products/duplicate` (AGL-3841): the products list's\n * Duplicate for the native apps. The console builds the copy in the browser\n * (`productDuplicateFields`, its slug ledger, the copy's smart collections)\n * and creates it through the quota-enforcing resources route; this runs the\n * same model over the stored product and creates it under the save route's\n * create door (the plan's commerce entitlement and its product quota, counted\n * in the same transaction). `newProductId` is the client's, so a retry finds\n * its own copy and answers `replayed`.\n */\nexport function createProductDuplicateHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const { hostId, productId, newProductId } = body\n    if (!validId(hostId) || !validId(productId) || !validId(newProductId) || productId === newProductId) {\n      return res.status(400).json({ error: 'Missing site or product' })\n    }\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const db = deps.firestore()\n      const hostRef = db.collection('hosts').doc(hostId)\n      const products = hostRef.collection('products')\n      const copyRef = products.doc(newProductId)\n      const already = await copyRef.get()\n      if (already.exists) return res.status(200).json({ ok: true, id: newProductId, replayed: true })\n      const source = await products.doc(productId).get()\n      if (!source.exists || source.get('deletedAt')) return res.status(404).json({ error: 'This product was deleted' })\n      const product = liftLegacyProduct((source.data() ?? {}) as never)\n      const slug = await claimProductSlug(products, productDuplicateSlugBase(product.slug, product.name))\n      const nowMs = deps.now()\n      const fields = productDuplicateFields(product, slug, nowMs)\n      const smartQuery = hostRef.collection('collections').where('kind', '==', 'catalog').where('mode', '==', 'smart')\n      const outbox = outboxEntry(db, hostId)\n      const answer = await db.runTransaction(async (tx) => {\n        const [existing, smart] = await Promise.all([tx.get(copyRef), tx.get(smartQuery)])\n        if (existing.exists) return { status: 200, body: { ok: true, id: newProductId, replayed: true } }\n        const early = planRefusal(door.org as never)\n        if (early) return { status: early.status, body: { error: early.error } }\n        const used = await countLiveDocuments(products, (aggregate) => tx.get(aggregate))\n        const room = roomRefusal(door.org as never, Number(used) || 0)\n        if (room) return { status: room.status, body: { error: room.error } }\n        // The COPY's smart collections: its name differs from the source's.\n        const collectionIds = productCollectionIds(\n          productMembershipInput({ name: productDuplicateName(product.name) }, product) as never,\n          smart.docs.map((doc) => smartCollectionRulesOf(doc.id, doc.data())),\n        )\n        tx.create(copyRef, {\n          ...fields,\n          collectionIds,\n          deletedAt: null,\n          createdAt: FieldValue.serverTimestamp(),\n          updatedAt: FieldValue.serverTimestamp(),\n          createdBy: door.uid,\n        })\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, id: newProductId, replayed: false, slug } }\n      })\n      if (answer.status === 200 && !(answer.body as { replayed?: boolean }).replayed) {\n        await settleCache(deps, hostId, outbox.ref, 'product duplicated from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/duplicate]', error)\n      return res.status(500).json({ error: 'Could not duplicate product' })\n    }\n  }\n}\n\n/**\n * `POST /api/commerce/products/delete` (AGL-3841): the products list's Delete\n * for the native apps, the console's write (`deletedAt` on the product, which\n * stops it being purchasable) with the site-wide cache drop, under the save\n * route's gate. Deleting a deleted product answers `already`.\n */\nexport function createProductDeleteHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const { hostId, productId } = body\n    if (!validId(hostId) || !validId(productId)) return res.status(400).json({ error: 'Missing site or product' })\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const db = deps.firestore()\n      const productRef = db.collection('hosts').doc(hostId).collection('products').doc(productId)\n      const outbox = outboxEntry(db, hostId)\n      const answer = await db.runTransaction(async (tx) => {\n        const stored = await tx.get(productRef)\n        if (!stored.exists) return { status: 404, body: { error: 'This product no longer exists' } }\n        if (stored.get('deletedAt')) return { status: 200, body: { ok: true, already: true } }\n        tx.update(productRef, { deletedAt: FieldValue.serverTimestamp() })\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, already: false } }\n      })\n      if (answer.status === 200 && !(answer.body as { already?: boolean }).already) {\n        await settleCache(deps, hostId, outbox.ref, 'product deleted from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/delete]', error)\n      return res.status(500).json({ error: 'Could not delete product' })\n    }\n  }\n}\n\nexport const productSaveHandler = createProductSaveHandler()\nexport const productStockHandler = createProductStockHandler()\nexport const productDuplicateHandler = createProductDuplicateHandler()\nexport const productDeleteHandler = createProductDeleteHandler()\n"],"names":["createHash","holdsSiteKey","hostStampedSitePermission","siteKeyRefusal","isRefusedIdToken","createResourceUid","countLiveDocuments","dropPluginSiteCache","firebaseAdmin","getLockdownVerdict","getOrgForHost","isImpersonationSession","FieldValue","liftLegacyProduct","productCollectionIds","productDuplicateFields","productDuplicateName","productDuplicateSlugBase","productEditWrite","productMembershipInput","productSaveFields","smartCollectionRulesOf","stockAdjustmentWrite","validateProduct","planRefusal","roomRefusal","ROLE_REFUSAL","MAX_BODY_BYTES","STOCK_ADJUST_REASONS","bodyOf","req","raw","body","length","JSON","parse","validId","value","test","gate","res","hostId","deps","options","authorization","String","headers","token","startsWith","slice","status","json","error","decoded","verifyIdToken","staff","host","firestore","collection","doc","get","exists","permission","allowed","data","uid","key","presetFor","refusal","org","orgForHost","locked","lockdown","request","method","email","outboxEntry","ref","paths","createdAt","serverTimestamp","attempts","entireHost","settleCache","entry","reason","dropped","dropCache","hostIds","catch","complete","delete","undefined","resolved","app","auth","now","Date","createProductSaveHandler","productId","product","Array","isArray","variants","name","trim","door","nowMs","fields","problem","db","hostRef","products","productRef","smartQuery","where","outbox","create","answer","runTransaction","tx","existing","smart","Promise","all","membership","collectionIds","docs","map","id","ok","replayed","early","used","aggregate","room","Number","createdAtMs","deletedAt","updatedAt","createdBy","set","storedTimestamps","console","stored","asked","Object","fromEntries","entries","filter","toDate","stockAttemptId","update","digest","createProductStockHandler","variantId","delta","Math","round","locationId","includes","isFinite","ledgerRef","ledger","inventory","some","variant","write","claimProductSlug","base","suffix","candidate","held","limit","empty","createProductDuplicateHandler","newProductId","source","copyRef","already","slug","createProductDeleteHandler","productSaveHandler","productStockHandler","productDuplicateHandler","productDeleteHandler"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,YAAY,EAAEC,yBAAyB,EAAEC,cAAc,QAAQ,0CAAyC;AACjH,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,iBAAiB,QAAQ,6CAA4C;AAE9E,SAASC,kBAAkB,QAAQ,6CAA4C;AAC/E,SAASC,mBAAmB,QAAQ,gDAA+C;AAEnF,SAASC,aAAa,EAAEC,kBAAkB,EAAEC,aAAa,EAAEC,sBAAsB,QAAQ,2BAA0B;AACnH,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAEEC,iBAAiB,EACjBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,wBAAwB,EACxBC,gBAAgB,EAChBC,sBAAsB,EACtBC,iBAAiB,EACjBC,sBAAsB,EACtBC,oBAAoB,EACpBC,eAAe,QAEV,oBAAU;AACjB,SAASC,WAAW,EAAEC,WAAW,QAAQ,sBAAkB;AAoB3D,qEAAqE,GACrE,OAAO,MAAMC,eAAevB,eAAe,aAAY;AACvD,MAAMwB,iBAAiB;AAEvB,gDAAgD,GAChD,OAAO,MAAMC,uBAA6D;IAAC;IAAW;IAAc;IAAU;CAAS,CAAA;AAavH,OAAO,SAASC,OAAOC,GAAoC;IACzD,MAAMC,MAAMD,IAAIE,IAAI;IACpB,IAAI,OAAOD,QAAQ,UAAU;QAC3B,IAAIA,IAAIE,MAAM,GAAGN,gBAAgB,OAAO,CAAC;QACzC,IAAI;YACF,OAAOO,KAAKC,KAAK,CAACJ,OAAO;QAC3B,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAQA,cAAAA,MAAO,CAAC;AAClB;AAEA,OAAO,MAAMK,UAAU,CAACC,QACtB,OAAOA,UAAU,YAAY,yBAAyBC,IAAI,CAACD,OAAM;AAuBnE;;;;;;;;;;CAUC,GACD,OAAO,eAAeE,KACpBT,GAAoC,EACpCU,GAAU,EACVC,MAAc,EACdC,IAAiC,EACjCC,UAA2C,CAAC,CAAC;QAEhBb;QAwBf;IAxBd,MAAMc,gBAAgBC,QAAOf,6BAAAA,IAAIgB,OAAO,CAACF,aAAa,YAAzBd,6BAA6B;IAC1D,MAAMiB,QAAQH,cAAcI,UAAU,CAAC,aAAaJ,cAAcK,KAAK,CAAC,UAAUhB,MAAM,IAAI;IAC5F,IAAI,CAACc,OAAO,OAAO,AAAKP,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB,IAAI;IAC5E,IAAIC;IACJ,IAAI;QACFA,UAAU,MAAMX,KAAKY,aAAa,CAACP;IACrC,EAAE,OAAOK,OAAO;QACd,4EAA4E;QAC5E,IAAI,CAAChD,iBAAiBgD,QAAQ,MAAMA;QACpC,OAAO,AAAKZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B,IAAI;IAC5E;IACA,MAAMG,QAAQF,OAAO,CAAC,QAAQ,KAAK;IACnC,IAAI,CAACE,SAASF,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC1C,uBAAuB0C,UAAmB;QAC7F,OAAO,AAAKb,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4C,IAAI;IAC5F;IACA,MAAMI,OAAO,MAAMd,KAAKe,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAAClB,QAAQmB,GAAG;IACvE,IAAI,CAACJ,KAAKK,MAAM,EAAE,OAAO,AAAKrB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAe,IAAI;IAC/E,IAAI,CAACG,OAAO;;QACV,MAAM,EAAEO,UAAU,EAAE,GAAGnB;QACvB,MAAMoB,UAAUD,aACZ5D,0BAA0BsD,KAAKQ,IAAI,IAAIX,QAAQY,GAAG,EAAEH,WAAWI,GAAG,EAAEJ,WAAWK,SAAS,IACxFlE,aAAauD,MAAMH,QAAQY,GAAG,EAAE;QACpC,IAAI,CAACF,SAAS,OAAO,AAAKvB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,KAAK,WAAEU,8BAAAA,WAAYM,OAAO,oBAAI1C;QAAa,IAAI;IAClG;IACA,MAAM2C,eAAQ,QAAA,MAAM3B,KAAK4B,UAAU,CAAC7B,4BAAvB,AAAC,MAAgC4B,GAAG,mBAAI,CAAC;IACtD,MAAME,SAAS,MAAM7B,KAAK8B,QAAQ,CAAC;QAAEjB;QAAOU,KAAKZ,QAAQY,GAAG;QAAEI,KAAKA;QAAcb,MAAMA,KAAKQ,IAAI;QAAaS,SAAS;YAAEC,QAAQ;QAAO;IAAW;IAClJ,IAAIH,QAAQ,OAAO,AAAK/B,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAA+C,IAAI;IACzG,MAAMuB,QAAQ,OAAOtB,OAAO,CAAC,QAAQ,KAAK,WAAWA,OAAO,CAAC,QAAQ,GAAG;IACxE,OAAO;QAAEY,KAAKZ,QAAQY,GAAG;QAAEU;QAAOpB;QAAOC;QAAMa;IAAI;AACrD;AAEA,+GAA+G,GAC/G,OAAO,SAASO,YAAYnB,SAAoB,EAAEhB,MAAc;IAC9D,OAAO;QACLoC,KAAKpB,UAAUC,UAAU,CAAC,iBAAiBC,GAAG,CAACtD;QAC/C2D,MAAM;YAAEvB;YAAQqC,OAAO;gBAAC;aAAI;YAAEC,WAAWnE,WAAWoE,eAAe;YAAIC,UAAU;YAAGC,YAAY;QAAK;IACvG;AACF;AAEA,OAAO,eAAeC,YAAYzC,IAAiC,EAAED,MAAc,EAAE2C,KAA0C,EAAEC,MAAc;IAC7I,MAAMC,UAAU,MAAM5C,KAAK6C,SAAS,CAAC;QAAEC,SAAS;YAAC/C;SAAO;QAAE4C;IAAO,GAAGI,KAAK,CAAC,IAAO,CAAA;YAAEC,UAAU;QAAM,CAAA;IACnG,IAAIJ,QAAQI,QAAQ,EAAE,MAAMN,MAAMO,MAAM,GAAGF,KAAK,CAAC,IAAMG;AACzD;AAEA,OAAO,SAASC,SAASnD,IAAuB;QAEjCA,iBACIA,qBACHA,kBACFA,gBACCA,iBACNA;IANP,OAAO;QACLe,SAAS,GAAEf,kBAAAA,KAAKe,SAAS,YAAdf,kBAAmB,IAAMlC,cAAcsF,GAAG,GAAGrC,SAAS;QACjEH,aAAa,GAAEZ,sBAAAA,KAAKY,aAAa,YAAlBZ,sBAAuB,CAACK,QAAUvC,cAAcsF,GAAG,GAAGC,IAAI,GAAGzC,aAAa,CAACP;QAC1FuB,UAAU,GAAE5B,mBAAAA,KAAK4B,UAAU,YAAf5B,mBAAoB,CAACD,SAAW/B,cAAc+B;QAC1D+B,QAAQ,GAAE9B,iBAAAA,KAAK8B,QAAQ,YAAb9B,iBAAkB,CAACC,UAAYlC,mBAAmBkC;QAC5D4C,SAAS,GAAE7C,kBAAAA,KAAK6C,SAAS,YAAd7C,kBAAkBnC;QAC7ByF,GAAG,GAAEtD,YAAAA,KAAKsD,GAAG,YAARtD,YAAa,IAAMuD,KAAKD,GAAG;IAClC;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASE,yBAAyBvD,UAA6B,CAAC,CAAC;IACtE,OAAO,OAAOb,KAAKU;QACjB,IAAIV,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAMW,SAAST,IAAI,CAAC,SAAS;QAC7B,MAAMmE,YAAYnE,IAAI,CAAC,YAAY;QACnC,MAAMoE,UAAUpE,IAAI,CAAC,UAAU;QAC/B,IAAI,CAACI,QAAQK,WAAW,CAACL,QAAQ+D,cAAc,CAACC,WAAW,OAAOA,YAAY,YAAY,CAACC,MAAMC,OAAO,CAACF,QAAQG,QAAQ,GAAG;YAC1H,OAAO/D,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAwC;QAC/E;QACA,IAAI,OAAOgD,QAAQI,IAAI,KAAK,YAAY,CAACJ,QAAQI,IAAI,CAACC,IAAI,IAAI,OAAOjE,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA2B;QAC9H,IAAI;YACF,MAAMsD,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMC,QAAQjE,KAAKsD,GAAG;YACtB,MAAMY,SAASxF,kBAAkBgF,SAASO;YAC1C,MAAME,UAAUtF,gBAAgBqF;YAChC,IAAIC,SAAS,OAAOrE,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOyD;YAAQ;YAC1D,MAAMC,KAAKpE,KAAKe,SAAS;YACzB,MAAMsD,UAAUD,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB;YAC3C,MAAMuE,WAAWD,QAAQrD,UAAU,CAAC;YACpC,MAAMuD,aAAaD,SAASrD,GAAG,CAACwC;YAChC,MAAMe,aAAaH,QAAQrD,UAAU,CAAC,eAAeyD,KAAK,CAAC,QAAQ,MAAM,WAAWA,KAAK,CAAC,QAAQ,MAAM;YACxG,MAAMC,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM4E,SAASrF,IAAI,CAAC,SAAS,KAAK;YAClC,MAAMsF,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;gBAC5C,MAAM,CAACC,UAAUC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;oBAACJ,GAAG5D,GAAG,CAACqD;oBAAaO,GAAG5D,GAAG,CAACsD;iBAAY;gBACpF,MAAMW,aAAa;oBACjBC,eAAehH,qBACbK,uBAAuByF,QAAQR,UAC/BsB,MAAMK,IAAI,CAACC,GAAG,CAAC,CAACrE,MAAQtC,uBAAuBsC,IAAIsE,EAAE,EAAEtE,IAAIK,IAAI;gBAEnE;gBACA,IAAIqD,QAAQ;oBACV,IAAII,SAAS5D,MAAM,EAAE,OAAO;wBAAEX,QAAQ;wBAAKlB,MAAM;4BAAEkG,IAAI;4BAAMD,IAAI9B;4BAAWgC,UAAU;wBAAK;oBAAE;oBAC7F,MAAMC,QAAQ5G,YAAYkF,KAAKrC,GAAG;oBAClC,IAAI+D,OAAO,OAAO;wBAAElF,QAAQkF,MAAMlF,MAAM;wBAAElB,MAAM;4BAAEoB,OAAOgF,MAAMhF,KAAK;wBAAC;oBAAE;oBACvE,MAAMiF,OAAO,MAAM/H,mBAAmB0G,UAAU,CAACsB,YAAcd,GAAG5D,GAAG,CAAC0E;oBACtE,MAAMC,OAAO9G,YAAYiF,KAAKrC,GAAG,EAAWmE,OAAOH,SAAS;oBAC5D,IAAIE,MAAM,OAAO;wBAAErF,QAAQqF,KAAKrF,MAAM;wBAAElB,MAAM;4BAAEoB,OAAOmF,KAAKnF,KAAK;wBAAC;oBAAE;oBACpEoE,GAAGH,MAAM,CAACJ,YAAY,aACjBL,QACAiB;wBACHY,aAAa9B;wBACb+B,WAAW;wBACX3D,WAAWnE,WAAWoE,eAAe;wBACrC2D,WAAW/H,WAAWoE,eAAe;wBACrC4D,WAAWlC,KAAKzC,GAAG;;gBAEvB,OAAO;wBAGiBwD;oBAFtB,IAAI,CAACA,SAAS5D,MAAM,IAAI4D,SAAS7D,GAAG,CAAC,cAAc,OAAO;wBAAEV,QAAQ;wBAAKlB,MAAM;4BAAEoB,OAAO;wBAA2B;oBAAE;oBACrHoE,GAAGqB,GAAG,CAAC5B,YAAY,aACd6B,kBAAiBrB,iBAAAA,SAASzD,IAAI,cAAbyD,iBAAmB,CAAC,GAAGrB,UACxClF,iBAAiB0F,QAAQa,SAAS7D,GAAG,CAAC,gBACtCiE;wBACHc,WAAW/H,WAAWoE,eAAe;;gBAEzC;gBACAwC,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMD,IAAI9B;wBAAWgC,UAAU;oBAAM;gBAAE;YAC3E;YACA,IAAIb,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA4BmG,QAAQ,EAAE;gBAC9E,MAAMhD,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,4BAA4BA;YAC1C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAAS0F,iBAAiBE,MAA+B,EAAEC,KAA8B;IAC9F,OAAOC,OAAOC,WAAW,CACvBD,OAAOE,OAAO,CAACJ,QAAQK,MAAM,CAC3B,CAAC,CAACnF,KAAK7B,MAAM,GAAK,CAAE6B,CAAAA,OAAO+E,KAAI,KAAM,QAAQ5G,yBAAD,AAACA,MAAuCiH,MAAM,MAAK;AAGrG;AAEA,2FAA2F,GAC3F,OAAO,SAASC,eAAetF,GAAW,EAAEC,GAAW;IACrD,OAAO,SAASlE,WAAW,UAAUwJ,MAAM,CAAC,GAAGvF,IAAI,CAAC,EAAEC,KAAK,EAAEuF,MAAM,CAAC,OAAOxG,KAAK,CAAC,GAAG;AACtF;AAEA;;;;;CAKC,GACD,OAAO,SAASyG,0BAA0B/G,UAA6B,CAAC,CAAC;IACvE,OAAO,OAAOb,KAAKU;YAOEV;QANnB,IAAIA,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAMW,SAAST,IAAI,CAAC,SAAS;QAC7B,MAAMmE,YAAYnE,IAAI,CAAC,YAAY;QACnC,MAAM2H,YAAY3H,IAAI,CAAC,YAAY;QACnC,MAAMkC,MAAMrB,QAAOf,8BAAAA,IAAIgB,OAAO,CAAC,kBAAkB,YAA9BhB,8BAAkC,IAAI2E,IAAI,GAAGxD,KAAK,CAAC,GAAG;QACzE,MAAMoC,SAASrD,IAAI,CAAC,SAAS;QAC7B,MAAM4H,QAAQC,KAAKC,KAAK,CAACtB,OAAOxG,IAAI,CAAC,QAAQ;QAC7C,MAAM+H,aAAa,OAAO/H,IAAI,CAAC,aAAa,KAAK,YAAYA,IAAI,CAAC,aAAa,GAAGA,IAAI,CAAC,aAAa,GAAG4D;QACvG,IAAI,CAACxD,QAAQK,WAAW,CAACL,QAAQ+D,cAAc,OAAOwD,cAAc,YAAY,CAACA,WAAW;YAC1F,OAAOnH,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAmC;QAC1E;QACA,IAAI,CAACc,KAAK,OAAO1B,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;QACzE,IAAI,CAACxB,qBAAqBoI,QAAQ,CAAC3E,SAAS,OAAO7C,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;QAClG,IAAI,CAACoF,OAAOyB,QAAQ,CAACL,UAAUA,UAAU,GAAG,OAAOpH,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;QAC3G,IAAI;YACF,MAAMsD,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMI,KAAKpE,KAAKe,SAAS;YACzB,MAAMsD,UAAUD,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB;YAC3C,MAAMwE,aAAaF,QAAQrD,UAAU,CAAC,YAAYC,GAAG,CAACwC;YACtD,MAAM+D,YAAYnD,QAAQrD,UAAU,CAAC,wBAAwBC,GAAG,CAAC4F,eAAe7C,KAAKzC,GAAG,EAAEC;YAC1F,MAAMkD,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM6E,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;oBAOtCpB,mBAQ8D;gBAdpE,MAAM,CAAC+D,QAAQnB,OAAO,GAAG,MAAMrB,QAAQC,GAAG,CAAC;oBAACJ,GAAG5D,GAAG,CAACsG;oBAAY1C,GAAG5D,GAAG,CAACqD;iBAAY;gBAClF,IAAIkD,OAAOtG,MAAM,EAAE;wBACkDmF;oBAAnE,OAAO;wBAAE9F,QAAQ;wBAAKlB,MAAM;4BAAEkG,IAAI;4BAAMC,UAAU;4BAAMiC,SAAS,GAAEpB,cAAAA,OAAOpF,GAAG,CAAC,wBAAXoF,cAA2B;wBAAK;oBAAE;gBACvG;gBACA,IAAI,CAACA,OAAOnF,MAAM,IAAImF,OAAOpF,GAAG,CAAC,cAAc,OAAO;oBAAEV,QAAQ;oBAAKlB,MAAM;wBAAEoB,OAAO;oBAA2B;gBAAE;gBACjH,MAAMgD,UAAU4C,OAAOhF,IAAI;gBAC3B,IAAI,CAAC,EAACoC,oBAAAA,QAAQG,QAAQ,YAAhBH,oBAAoB,EAAE,EAAEiE,IAAI,CAAC,CAACC,UAAYA,QAAQrC,EAAE,KAAK0B,YAAY;oBACzE,OAAO;wBAAEzG,QAAQ;wBAAKlB,MAAM;4BAAEoB,OAAO;wBAA4C;oBAAE;gBACrF;gBACA,MAAMmH,QAAQjJ,qBAAqB8E,SAASD,WAAW;oBAAEwD;oBAAWC;oBAAOvE;oBAAQ0E;gBAAW,GAAGrH,KAAKsD,GAAG;gBACzG,IAAI,CAACuE,OAAO,OAAO;oBAAErH,QAAQ;oBAAKlB,MAAM;wBAAEoB,OAAO;oBAA0B;gBAAE;gBAC7EoE,GAAGgC,MAAM,CAACvC,YAAYsD,MAAMf,MAAM;gBAClChC,GAAGH,MAAM,CAAC6C,WAAWK,MAAMJ,MAAM;gBACjC3C,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMC,UAAU;wBAAOiC,SAAS,GAAE,0BAAA,AAACG,MAAMf,MAAM,CAA6BY,SAAS,YAAnD,0BAAuD;oBAAK;gBAAE;YACpI;YACA,IAAI9C,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA4BmG,QAAQ,EAAE;gBAC9E,MAAMhD,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,6BAA6BA;YAC3C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA8B;QACrE;IACF;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeoH,iBAAiBxD,QAA+C,EAAEyD,IAAY;IAClG,IAAK,IAAIC,SAAS,GAAGA,SAAS,MAAMA,UAAU,EAAG;QAC/C,MAAMC,YAAYD,SAAS,IAAID,OAAO,GAAGA,KAAK,CAAC,EAAEC,QAAQ;QACzD,MAAME,OAAO,MAAM5D,SAASG,KAAK,CAAC,QAAQ,MAAMwD,WAAWE,KAAK,CAAC,GAAGjH,GAAG;QACvE,IAAIgH,KAAKE,KAAK,EAAE,OAAOH;IACzB;IACA,OAAO,GAAGF,KAAK,CAAC,EAAExE,KAAKD,GAAG,IAAI;AAChC;AAEA;;;;;;;;;CASC,GACD,OAAO,SAAS+E,8BAA8BpI,UAA6B,CAAC,CAAC;IAC3E,OAAO,OAAOb,KAAKU;QACjB,IAAIV,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAM,EAAEW,MAAM,EAAE0D,SAAS,EAAE6E,YAAY,EAAE,GAAGhJ;QAC5C,IAAI,CAACI,QAAQK,WAAW,CAACL,QAAQ+D,cAAc,CAAC/D,QAAQ4I,iBAAiB7E,cAAc6E,cAAc;YACnG,OAAOxI,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA0B;QACjE;QACA,IAAI;gBAWiC6H;YAVnC,MAAMvE,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMI,KAAKpE,KAAKe,SAAS;YACzB,MAAMsD,UAAUD,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB;YAC3C,MAAMuE,WAAWD,QAAQrD,UAAU,CAAC;YACpC,MAAMwH,UAAUlE,SAASrD,GAAG,CAACqH;YAC7B,MAAMG,UAAU,MAAMD,QAAQtH,GAAG;YACjC,IAAIuH,QAAQtH,MAAM,EAAE,OAAOrB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE+E,IAAI;gBAAMD,IAAI+C;gBAAc7C,UAAU;YAAK;YAC7F,MAAM8C,SAAS,MAAMjE,SAASrD,GAAG,CAACwC,WAAWvC,GAAG;YAChD,IAAI,CAACqH,OAAOpH,MAAM,IAAIoH,OAAOrH,GAAG,CAAC,cAAc,OAAOpB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA2B;YAC/G,MAAMgD,UAAUvF,mBAAmBoK,eAAAA,OAAOjH,IAAI,cAAXiH,eAAiB,CAAC;YACrD,MAAMG,OAAO,MAAMZ,iBAAiBxD,UAAU/F,yBAAyBmF,QAAQgF,IAAI,EAAEhF,QAAQI,IAAI;YACjG,MAAMG,QAAQjE,KAAKsD,GAAG;YACtB,MAAMY,SAAS7F,uBAAuBqF,SAASgF,MAAMzE;YACrD,MAAMO,aAAaH,QAAQrD,UAAU,CAAC,eAAeyD,KAAK,CAAC,QAAQ,MAAM,WAAWA,KAAK,CAAC,QAAQ,MAAM;YACxG,MAAMC,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM6E,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;gBAC5C,MAAM,CAACC,UAAUC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;oBAACJ,GAAG5D,GAAG,CAACsH;oBAAU1D,GAAG5D,GAAG,CAACsD;iBAAY;gBACjF,IAAIO,SAAS5D,MAAM,EAAE,OAAO;oBAAEX,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMD,IAAI+C;wBAAc7C,UAAU;oBAAK;gBAAE;gBAChG,MAAMC,QAAQ5G,YAAYkF,KAAKrC,GAAG;gBAClC,IAAI+D,OAAO,OAAO;oBAAElF,QAAQkF,MAAMlF,MAAM;oBAAElB,MAAM;wBAAEoB,OAAOgF,MAAMhF,KAAK;oBAAC;gBAAE;gBACvE,MAAMiF,OAAO,MAAM/H,mBAAmB0G,UAAU,CAACsB,YAAcd,GAAG5D,GAAG,CAAC0E;gBACtE,MAAMC,OAAO9G,YAAYiF,KAAKrC,GAAG,EAAWmE,OAAOH,SAAS;gBAC5D,IAAIE,MAAM,OAAO;oBAAErF,QAAQqF,KAAKrF,MAAM;oBAAElB,MAAM;wBAAEoB,OAAOmF,KAAKnF,KAAK;oBAAC;gBAAE;gBACpE,oEAAoE;gBACpE,MAAM0E,gBAAgBhH,qBACpBK,uBAAuB;oBAAEqF,MAAMxF,qBAAqBoF,QAAQI,IAAI;gBAAE,GAAGJ,UACrEsB,MAAMK,IAAI,CAACC,GAAG,CAAC,CAACrE,MAAQtC,uBAAuBsC,IAAIsE,EAAE,EAAEtE,IAAIK,IAAI;gBAEjEwD,GAAGH,MAAM,CAAC6D,SAAS,aACdtE;oBACHkB;oBACAY,WAAW;oBACX3D,WAAWnE,WAAWoE,eAAe;oBACrC2D,WAAW/H,WAAWoE,eAAe;oBACrC4D,WAAWlC,KAAKzC,GAAG;;gBAErBuD,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMD,IAAI+C;wBAAc7C,UAAU;wBAAOiD;oBAAK;gBAAE;YACpF;YACA,IAAI9D,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA4BmG,QAAQ,EAAE;gBAC9E,MAAMhD,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,iCAAiCA;YAC/C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA8B;QACrE;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASiI,2BAA2B1I,UAA6B,CAAC,CAAC;IACxE,OAAO,OAAOb,KAAKU;QACjB,IAAIV,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAM,EAAEW,MAAM,EAAE0D,SAAS,EAAE,GAAGnE;QAC9B,IAAI,CAACI,QAAQK,WAAW,CAACL,QAAQ+D,YAAY,OAAO3D,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;QAC5G,IAAI;YACF,MAAMsD,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMI,KAAKpE,KAAKe,SAAS;YACzB,MAAMwD,aAAaH,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB,QAAQiB,UAAU,CAAC,YAAYC,GAAG,CAACwC;YACjF,MAAMiB,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM6E,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;gBAC5C,MAAMwB,SAAS,MAAMxB,GAAG5D,GAAG,CAACqD;gBAC5B,IAAI,CAAC+B,OAAOnF,MAAM,EAAE,OAAO;oBAAEX,QAAQ;oBAAKlB,MAAM;wBAAEoB,OAAO;oBAAgC;gBAAE;gBAC3F,IAAI4F,OAAOpF,GAAG,CAAC,cAAc,OAAO;oBAAEV,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMiD,SAAS;oBAAK;gBAAE;gBACrF3D,GAAGgC,MAAM,CAACvC,YAAY;oBAAEyB,WAAW9H,WAAWoE,eAAe;gBAAG;gBAChEwC,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMiD,SAAS;oBAAM;gBAAE;YAC3D;YACA,IAAI7D,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA2BmJ,OAAO,EAAE;gBAC5E,MAAMhG,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,8BAA8BA;YAC5C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA2B;QAClE;IACF;AACF;AAEA,OAAO,MAAMkI,qBAAqBpF,2BAA0B;AAC5D,OAAO,MAAMqF,sBAAsB7B,4BAA2B;AAC9D,OAAO,MAAM8B,0BAA0BT,gCAA+B;AACtE,OAAO,MAAMU,uBAAuBJ,6BAA4B"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/products-write.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createHash } from 'node:crypto'\nimport { holdsSiteKey, hostStampedSitePermission, siteKeyRefusal } from '@aglyn/aglyn/app-utils/host-permissions'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { createResourceUid } from '@aglyn/aglyn/app-utils/create-resource-uid'\nimport type { HostAccessRole } from '@aglyn/aglyn/foundation/definitions/organization.types'\nimport { countLiveDocuments } from '@aglyn/aglyn/app-utils/live-document-count'\nimport { dropPluginSiteCache } from '@aglyn/aglyn/plugin-manager/plugin-site-cache'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getLockdownVerdict, getOrgForHost, isImpersonationSession } from '@aglyn/tenant-data-admin'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n  type EditedProduct,\n  liftLegacyProduct,\n  productCollectionIds,\n  productDuplicateFields,\n  productDuplicateName,\n  productDuplicateSlugBase,\n  productEditWrite,\n  productMembershipInput,\n  productSaveFields,\n  smartCollectionRulesOf,\n  stockAdjustmentWrite,\n  validateProduct,\n  variantMatrixProblem,\n  type InventoryAdjustmentReason,\n} from '../model'\nimport { planRefusal, roomRefusal } from './product-drafts'\n\n/*\n * `POST /api/commerce/products/save` and `POST /api/commerce/products/stock`\n * (AGL-3652): the console product editor's save and its Adjust stock dialog,\n * for the native apps.\n *\n * The console makes both writes from the browser, computing derived fields\n * first (search keys, stock verdict, price, image, smart-collection\n * membership). These routes run THAT computation (`model/product-write.ts`,\n * which the console imports too) and make the same writes, under the gate\n * the Firestore rules put on them: a verified member with a write role on the\n * site (`canWriteHostContent`), or staff, while the site, its org and the\n * platform are not frozen (`hostWritesFrozen`). A new product also meets the\n * create path's own door: the plan's `commerce` entitlement and its\n * `productsPerHost` quota, counted in the same transaction as the create.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/** Names \"Edit site content\" (`site.edit`, AGL-4047), never a role. */\nexport const ROLE_REFUSAL = siteKeyRefusal('site.edit')\nconst MAX_BODY_BYTES = 256_000\n\n/** The reasons the Adjust stock dialog offers. */\nexport const STOCK_ADJUST_REASONS: readonly InventoryAdjustmentReason[] = ['restock', 'correction', 'damage', 'refund']\n\nexport interface ProductsWriteDeps {\n  firestore?: () => Firestore\n  verifyIdToken?: (token: string) => Promise<Record<string, unknown> & { uid: string }>\n  orgForHost?: (hostId: string) => Promise<{ org: Record<string, unknown> } | null>\n  lockdown?: (options: Parameters<typeof getLockdownVerdict>[0]) => Promise<unknown>\n  dropCache?: typeof dropPluginSiteCache\n  now?: () => number\n}\n\ntype Reply = Parameters<PluginApiHandler>[1]\n\nexport function bodyOf(req: Parameters<PluginApiHandler>[0]): Record<string, unknown> {\n  const raw = req.body\n  if (typeof raw === 'string') {\n    if (raw.length > MAX_BODY_BYTES) return {}\n    try {\n      return JSON.parse(raw || '{}')\n    } catch {\n      return {}\n    }\n  }\n  return (raw ?? {}) as Record<string, unknown>\n}\n\nexport const validId = (value: unknown): value is string =>\n  typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value)\n\nexport interface Gate {\n  uid: string\n  /** The caller's address, for an activity line; null when the token has none. */\n  email: string | null\n  staff: boolean\n  host: FirebaseFirestore.DocumentSnapshot\n  org: Record<string, unknown>\n}\n\n/**\n * The permission a route built on {@link gate} checks instead of the site\n * role (AGL-4047): a key whose preset is the site role, that preset (the\n * declaring plugin's own table, so the answer does not depend on which\n * plugins this process loaded), and the refusal naming it.\n */\nexport interface GatePermission {\n  key: string\n  presetFor: Readonly<Record<HostAccessRole, boolean>>\n  refusal: string\n}\n\n/**\n * Who may write this site's products, as the rules decide it. Answers the\n * caller's reply on a refusal and returns null.\n *\n * A route that is not about products names the key it checks instead\n * (`permission`, AGL-4047): the walk-in and the guests change ask their\n * reservation key, read as the rules read it, from the site's\n * `memberPermissions` stamp, else the preset of the member's `memberRoles`\n * entry, so the route and the rules give one answer. Without it, the\n * product routes ask \"Edit site content\" (`site.edit`) the same way.\n */\nexport async function gate(\n  req: Parameters<PluginApiHandler>[0],\n  res: Reply,\n  hostId: string,\n  deps: Required<ProductsWriteDeps>,\n  options: { permission?: GatePermission } = {},\n): Promise<Gate | null> {\n  const authorization = String(req.headers.authorization ?? '')\n  const token = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : ''\n  if (!token) return void res.status(401).json({ error: 'Unauthenticated' }), null\n  let decoded: Record<string, unknown> & { uid: string }\n  try {\n    decoded = await deps.verifyIdToken(token)\n  } catch (error) {\n    // Only a refused token is the caller's; an Auth outage is a 500 (AGL-2852).\n    if (!isRefusedIdToken(error)) throw error\n    return void res.status(401).json({ error: 'Sign in again to continue' }), null\n  }\n  const staff = decoded['staff'] === true\n  if (!staff && decoded['email_verified'] !== true && !isImpersonationSession(decoded as never)) {\n    return void res.status(403).json({ error: 'Verify your email address to make changes' }), null\n  }\n  const host = await deps.firestore().collection('hosts').doc(hostId).get()\n  if (!host.exists) return void res.status(404).json({ error: 'Unknown site' }), null\n  if (!staff) {\n    const { permission } = options\n    const allowed = permission\n      ? hostStampedSitePermission(host.data(), decoded.uid, permission.key, permission.presetFor)\n      : holdsSiteKey(host, decoded.uid, 'site.edit')\n    if (!allowed) return void res.status(403).json({ error: permission?.refusal ?? ROLE_REFUSAL }), null\n  }\n  const org = ((await deps.orgForHost(hostId))?.org ?? {}) as Record<string, unknown>\n  const locked = await deps.lockdown({ staff, uid: decoded.uid, org: org as never, host: host.data() as never, request: { method: 'POST' } as never })\n  if (locked) return void res.status(423).json({ error: 'This site is not accepting changes right now' }), null\n  const email = typeof decoded['email'] === 'string' ? decoded['email'] : null\n  return { uid: decoded.uid, email, staff, host, org }\n}\n\n/** The site-wide cache drop a product change is owed (AGL-3386): an outbox entry in the write, then the drop. */\nexport function outboxEntry(firestore: Firestore, hostId: string) {\n  return {\n    ref: firestore.collection('publishOutbox').doc(createResourceUid()),\n    data: { hostId, paths: ['/'], createdAt: FieldValue.serverTimestamp(), attempts: 0, entireHost: true },\n  }\n}\n\nexport async function settleCache(deps: Required<ProductsWriteDeps>, hostId: string, entry: FirebaseFirestore.DocumentReference, reason: string) {\n  const dropped = await deps.dropCache({ hostIds: [hostId], reason }).catch(() => ({ complete: false }))\n  if (dropped.complete) await entry.delete().catch(() => undefined)\n}\n\nexport function resolved(deps: ProductsWriteDeps): Required<ProductsWriteDeps> {\n  return {\n    firestore: deps.firestore ?? (() => firebaseAdmin.app().firestore() as unknown as Firestore),\n    verifyIdToken: deps.verifyIdToken ?? ((token) => firebaseAdmin.app().auth().verifyIdToken(token) as never),\n    orgForHost: deps.orgForHost ?? ((hostId) => getOrgForHost(hostId) as never),\n    lockdown: deps.lockdown ?? ((options) => getLockdownVerdict(options)),\n    dropCache: deps.dropCache ?? dropPluginSiteCache,\n    now: deps.now ?? (() => Date.now()),\n  }\n}\n\n/**\n * Saves a product as the console editor does. `create: true` makes a new\n * product under the client-minted `productId` (a retry finds its own product\n * and answers `replayed`); otherwise it replaces the live product, keeping\n * its live stock holds.\n */\nexport function createProductSaveHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const hostId = body['hostId']\n    const productId = body['productId']\n    const product = body['product'] as EditedProduct | undefined\n    if (!validId(hostId) || !validId(productId) || !product || typeof product !== 'object' || !Array.isArray(product.variants)) {\n      return res.status(400).json({ error: 'Missing site, product or its variants' })\n    }\n    if (typeof product.name !== 'string' || !product.name.trim()) return res.status(400).json({ error: 'Product name is required' })\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const nowMs = deps.now()\n      const fields = productSaveFields(product, nowMs)\n      // More combinations than a product holds is refused with the count\n      // (AGL-4100), never saved short of the options it names.\n      const problem = variantMatrixProblem(fields.options) ?? validateProduct(fields as never)\n      if (problem) return res.status(400).json({ error: problem })\n      const db = deps.firestore()\n      const hostRef = db.collection('hosts').doc(hostId)\n      const products = hostRef.collection('products')\n      const productRef = products.doc(productId)\n      const smartQuery = hostRef.collection('collections').where('kind', '==', 'catalog').where('mode', '==', 'smart')\n      const outbox = outboxEntry(db, hostId)\n      const create = body['create'] === true\n      const answer = await db.runTransaction(async (tx) => {\n        const [existing, smart] = await Promise.all([tx.get(productRef), tx.get(smartQuery)])\n        const membership = {\n          collectionIds: productCollectionIds(\n            productMembershipInput(fields, product) as never,\n            smart.docs.map((doc) => smartCollectionRulesOf(doc.id, doc.data())),\n          ),\n        }\n        if (create) {\n          if (existing.exists) return { status: 200, body: { ok: true, id: productId, replayed: true } }\n          const early = planRefusal(door.org as never)\n          if (early) return { status: early.status, body: { error: early.error } }\n          const used = await countLiveDocuments(products, (aggregate) => tx.get(aggregate))\n          const room = roomRefusal(door.org as never, Number(used) || 0)\n          if (room) return { status: room.status, body: { error: room.error } }\n          tx.create(productRef, {\n            ...fields,\n            ...membership,\n            createdAtMs: nowMs,\n            deletedAt: null,\n            createdAt: FieldValue.serverTimestamp(),\n            updatedAt: FieldValue.serverTimestamp(),\n            createdBy: door.uid,\n          })\n        } else {\n          if (!existing.exists || existing.get('deletedAt')) return { status: 404, body: { error: 'This product was deleted' } }\n          tx.set(productRef, {\n            ...storedTimestamps(existing.data() ?? {}, product as unknown as Record<string, unknown>),\n            ...productEditWrite(fields, existing.get('stockHolds')),\n            ...membership,\n            updatedAt: FieldValue.serverTimestamp(),\n          })\n        }\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, id: productId, replayed: false } }\n      })\n      if (answer.status === 200 && !(answer.body as { replayed?: boolean }).replayed) {\n        await settleCache(deps, hostId, outbox.ref, 'product saved from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/save]', error)\n      return res.status(500).json({ error: 'The product could not be saved' })\n    }\n  }\n}\n\n/**\n * The stored timestamps an edit keeps. The console's replace writes back the\n * Timestamps its seed carried (`createdAt`, a publish time); a client's JSON\n * cannot carry one, so each stored Timestamp field the request does not name\n * is kept as stored.\n */\nexport function storedTimestamps(stored: Record<string, unknown>, asked: Record<string, unknown>): Record<string, unknown> {\n  return Object.fromEntries(\n    Object.entries(stored).filter(\n      ([key, value]) => !(key in asked) && typeof (value as { toDate?: unknown } | null)?.toDate === 'function',\n    ),\n  )\n}\n\n/** The ledger row id one attempt owns: the same key from the same member is the same row. */\nexport function stockAttemptId(uid: string, key: string): string {\n  return 'app-' + createHash('sha256').update(`${uid}:${key}`).digest('hex').slice(0, 40)\n}\n\n/**\n * Adjusts one variant's stock as the Adjust stock dialog does: the variants\n * and stock fields on the product, and one `inventoryAdjustments` row, in one\n * transaction. The Idempotency-Key names that row, so a retried attempt finds\n * it and moves nothing twice.\n */\nexport function createProductStockHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const hostId = body['hostId']\n    const productId = body['productId']\n    const variantId = body['variantId']\n    const key = String(req.headers['idempotency-key'] ?? '').trim().slice(0, 200)\n    const reason = body['reason'] as InventoryAdjustmentReason\n    const delta = Math.round(Number(body['delta']))\n    const locationId = typeof body['locationId'] === 'string' && body['locationId'] ? body['locationId'] : undefined\n    if (!validId(hostId) || !validId(productId) || typeof variantId !== 'string' || !variantId) {\n      return res.status(400).json({ error: 'Missing site, product or variant' })\n    }\n    if (!key) return res.status(400).json({ error: 'Missing Idempotency-Key' })\n    if (!STOCK_ADJUST_REASONS.includes(reason)) return res.status(400).json({ error: 'Unknown reason' })\n    if (!Number.isFinite(delta) || delta === 0) return res.status(400).json({ error: 'Enter a number of units' })\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const db = deps.firestore()\n      const hostRef = db.collection('hosts').doc(hostId)\n      const productRef = hostRef.collection('products').doc(productId)\n      const ledgerRef = hostRef.collection('inventoryAdjustments').doc(stockAttemptId(door.uid, key))\n      const outbox = outboxEntry(db, hostId)\n      const answer = await db.runTransaction(async (tx) => {\n        const [ledger, stored] = await Promise.all([tx.get(ledgerRef), tx.get(productRef)])\n        if (ledger.exists) {\n          return { status: 200, body: { ok: true, replayed: true, inventory: stored.get('inventory') ?? null } }\n        }\n        if (!stored.exists || stored.get('deletedAt')) return { status: 404, body: { error: 'This product was deleted' } }\n        const product = stored.data() as never as Parameters<typeof stockAdjustmentWrite>[0]\n        if (!(product.variants ?? []).some((variant) => variant.id === variantId)) {\n          return { status: 404, body: { error: 'That variant is no longer on this product' } }\n        }\n        const write = stockAdjustmentWrite(product, productId, { variantId, delta, reason, locationId }, deps.now())\n        if (!write) return { status: 400, body: { error: 'Enter a number of units' } }\n        tx.update(productRef, write.update)\n        tx.create(ledgerRef, write.ledger)\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, replayed: false, inventory: (write.update as { inventory?: unknown }).inventory ?? null } }\n      })\n      if (answer.status === 200 && !(answer.body as { replayed?: boolean }).replayed) {\n        await settleCache(deps, hostId, outbox.ref, 'stock adjusted from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/stock]', error)\n      return res.status(500).json({ error: 'Stock could not be adjusted' })\n    }\n  }\n}\n\n/**\n * The first slug in `base`, `base-2`, `base-3`… no product of the site holds,\n * as the console's slug ledger claims one (`product-slugs.ts`): a second\n * Duplicate of the same product does not mint a second `-copy` (AGL-3321).\n */\nexport async function claimProductSlug(products: FirebaseFirestore.CollectionReference, base: string): Promise<string> {\n  for (let suffix = 1; suffix < 1000; suffix += 1) {\n    const candidate = suffix < 2 ? base : `${base}-${suffix}`\n    const held = await products.where('slug', '==', candidate).limit(1).get()\n    if (held.empty) return candidate\n  }\n  return `${base}-${Date.now()}`\n}\n\n/**\n * `POST /api/commerce/products/duplicate` (AGL-3841): the products list's\n * Duplicate for the native apps. The console builds the copy in the browser\n * (`productDuplicateFields`, its slug ledger, the copy's smart collections)\n * and creates it through the quota-enforcing resources route; this runs the\n * same model over the stored product and creates it under the save route's\n * create door (the plan's commerce entitlement and its product quota, counted\n * in the same transaction). `newProductId` is the client's, so a retry finds\n * its own copy and answers `replayed`.\n */\nexport function createProductDuplicateHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const { hostId, productId, newProductId } = body\n    if (!validId(hostId) || !validId(productId) || !validId(newProductId) || productId === newProductId) {\n      return res.status(400).json({ error: 'Missing site or product' })\n    }\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const db = deps.firestore()\n      const hostRef = db.collection('hosts').doc(hostId)\n      const products = hostRef.collection('products')\n      const copyRef = products.doc(newProductId)\n      const already = await copyRef.get()\n      if (already.exists) return res.status(200).json({ ok: true, id: newProductId, replayed: true })\n      const source = await products.doc(productId).get()\n      if (!source.exists || source.get('deletedAt')) return res.status(404).json({ error: 'This product was deleted' })\n      const product = liftLegacyProduct((source.data() ?? {}) as never)\n      const slug = await claimProductSlug(products, productDuplicateSlugBase(product.slug, product.name))\n      const nowMs = deps.now()\n      const fields = productDuplicateFields(product, slug, nowMs)\n      const smartQuery = hostRef.collection('collections').where('kind', '==', 'catalog').where('mode', '==', 'smart')\n      const outbox = outboxEntry(db, hostId)\n      const answer = await db.runTransaction(async (tx) => {\n        const [existing, smart] = await Promise.all([tx.get(copyRef), tx.get(smartQuery)])\n        if (existing.exists) return { status: 200, body: { ok: true, id: newProductId, replayed: true } }\n        const early = planRefusal(door.org as never)\n        if (early) return { status: early.status, body: { error: early.error } }\n        const used = await countLiveDocuments(products, (aggregate) => tx.get(aggregate))\n        const room = roomRefusal(door.org as never, Number(used) || 0)\n        if (room) return { status: room.status, body: { error: room.error } }\n        // The COPY's smart collections: its name differs from the source's.\n        const collectionIds = productCollectionIds(\n          productMembershipInput({ name: productDuplicateName(product.name) }, product) as never,\n          smart.docs.map((doc) => smartCollectionRulesOf(doc.id, doc.data())),\n        )\n        tx.create(copyRef, {\n          ...fields,\n          collectionIds,\n          deletedAt: null,\n          createdAt: FieldValue.serverTimestamp(),\n          updatedAt: FieldValue.serverTimestamp(),\n          createdBy: door.uid,\n        })\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, id: newProductId, replayed: false, slug } }\n      })\n      if (answer.status === 200 && !(answer.body as { replayed?: boolean }).replayed) {\n        await settleCache(deps, hostId, outbox.ref, 'product duplicated from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/duplicate]', error)\n      return res.status(500).json({ error: 'Could not duplicate product' })\n    }\n  }\n}\n\n/**\n * `POST /api/commerce/products/delete` (AGL-3841): the products list's Delete\n * for the native apps, the console's write (`deletedAt` on the product, which\n * stops it being purchasable) with the site-wide cache drop, under the save\n * route's gate. Deleting a deleted product answers `already`.\n */\nexport function createProductDeleteHandler(options: ProductsWriteDeps = {}): PluginApiHandler {\n  return async (req, res) => {\n    if (req.method !== 'POST') return res.status(405).json({ error: 'Method not allowed' })\n    const deps = resolved(options)\n    const body = bodyOf(req)\n    const { hostId, productId } = body\n    if (!validId(hostId) || !validId(productId)) return res.status(400).json({ error: 'Missing site or product' })\n    try {\n      const door = await gate(req, res, hostId, deps)\n      if (!door) return\n      const db = deps.firestore()\n      const productRef = db.collection('hosts').doc(hostId).collection('products').doc(productId)\n      const outbox = outboxEntry(db, hostId)\n      const answer = await db.runTransaction(async (tx) => {\n        const stored = await tx.get(productRef)\n        if (!stored.exists) return { status: 404, body: { error: 'This product no longer exists' } }\n        if (stored.get('deletedAt')) return { status: 200, body: { ok: true, already: true } }\n        tx.update(productRef, { deletedAt: FieldValue.serverTimestamp() })\n        tx.set(outbox.ref, outbox.data)\n        return { status: 200, body: { ok: true, already: false } }\n      })\n      if (answer.status === 200 && !(answer.body as { already?: boolean }).already) {\n        await settleCache(deps, hostId, outbox.ref, 'product deleted from the app')\n      }\n      return res.status(answer.status).json(answer.body)\n    } catch (error) {\n      console.error('[commerce/products/delete]', error)\n      return res.status(500).json({ error: 'Could not delete product' })\n    }\n  }\n}\n\nexport const productSaveHandler = createProductSaveHandler()\nexport const productStockHandler = createProductStockHandler()\nexport const productDuplicateHandler = createProductDuplicateHandler()\nexport const productDeleteHandler = createProductDeleteHandler()\n"],"names":["createHash","holdsSiteKey","hostStampedSitePermission","siteKeyRefusal","isRefusedIdToken","createResourceUid","countLiveDocuments","dropPluginSiteCache","firebaseAdmin","getLockdownVerdict","getOrgForHost","isImpersonationSession","FieldValue","liftLegacyProduct","productCollectionIds","productDuplicateFields","productDuplicateName","productDuplicateSlugBase","productEditWrite","productMembershipInput","productSaveFields","smartCollectionRulesOf","stockAdjustmentWrite","validateProduct","variantMatrixProblem","planRefusal","roomRefusal","ROLE_REFUSAL","MAX_BODY_BYTES","STOCK_ADJUST_REASONS","bodyOf","req","raw","body","length","JSON","parse","validId","value","test","gate","res","hostId","deps","options","authorization","String","headers","token","startsWith","slice","status","json","error","decoded","verifyIdToken","staff","host","firestore","collection","doc","get","exists","permission","allowed","data","uid","key","presetFor","refusal","org","orgForHost","locked","lockdown","request","method","email","outboxEntry","ref","paths","createdAt","serverTimestamp","attempts","entireHost","settleCache","entry","reason","dropped","dropCache","hostIds","catch","complete","delete","undefined","resolved","app","auth","now","Date","createProductSaveHandler","productId","product","Array","isArray","variants","name","trim","door","nowMs","fields","problem","db","hostRef","products","productRef","smartQuery","where","outbox","create","answer","runTransaction","tx","existing","smart","Promise","all","membership","collectionIds","docs","map","id","ok","replayed","early","used","aggregate","room","Number","createdAtMs","deletedAt","updatedAt","createdBy","set","storedTimestamps","console","stored","asked","Object","fromEntries","entries","filter","toDate","stockAttemptId","update","digest","createProductStockHandler","variantId","delta","Math","round","locationId","includes","isFinite","ledgerRef","ledger","inventory","some","variant","write","claimProductSlug","base","suffix","candidate","held","limit","empty","createProductDuplicateHandler","newProductId","source","copyRef","already","slug","createProductDeleteHandler","productSaveHandler","productStockHandler","productDuplicateHandler","productDeleteHandler"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,YAAY,EAAEC,yBAAyB,EAAEC,cAAc,QAAQ,0CAAyC;AACjH,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,iBAAiB,QAAQ,6CAA4C;AAE9E,SAASC,kBAAkB,QAAQ,6CAA4C;AAC/E,SAASC,mBAAmB,QAAQ,gDAA+C;AAEnF,SAASC,aAAa,EAAEC,kBAAkB,EAAEC,aAAa,EAAEC,sBAAsB,QAAQ,2BAA0B;AACnH,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAEEC,iBAAiB,EACjBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,wBAAwB,EACxBC,gBAAgB,EAChBC,sBAAsB,EACtBC,iBAAiB,EACjBC,sBAAsB,EACtBC,oBAAoB,EACpBC,eAAe,EACfC,oBAAoB,QAEf,oBAAU;AACjB,SAASC,WAAW,EAAEC,WAAW,QAAQ,sBAAkB;AAoB3D,qEAAqE,GACrE,OAAO,MAAMC,eAAexB,eAAe,aAAY;AACvD,MAAMyB,iBAAiB;AAEvB,gDAAgD,GAChD,OAAO,MAAMC,uBAA6D;IAAC;IAAW;IAAc;IAAU;CAAS,CAAA;AAavH,OAAO,SAASC,OAAOC,GAAoC;IACzD,MAAMC,MAAMD,IAAIE,IAAI;IACpB,IAAI,OAAOD,QAAQ,UAAU;QAC3B,IAAIA,IAAIE,MAAM,GAAGN,gBAAgB,OAAO,CAAC;QACzC,IAAI;YACF,OAAOO,KAAKC,KAAK,CAACJ,OAAO;QAC3B,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAQA,cAAAA,MAAO,CAAC;AAClB;AAEA,OAAO,MAAMK,UAAU,CAACC,QACtB,OAAOA,UAAU,YAAY,yBAAyBC,IAAI,CAACD,OAAM;AAuBnE;;;;;;;;;;CAUC,GACD,OAAO,eAAeE,KACpBT,GAAoC,EACpCU,GAAU,EACVC,MAAc,EACdC,IAAiC,EACjCC,UAA2C,CAAC,CAAC;QAEhBb;QAwBf;IAxBd,MAAMc,gBAAgBC,QAAOf,6BAAAA,IAAIgB,OAAO,CAACF,aAAa,YAAzBd,6BAA6B;IAC1D,MAAMiB,QAAQH,cAAcI,UAAU,CAAC,aAAaJ,cAAcK,KAAK,CAAC,UAAUhB,MAAM,IAAI;IAC5F,IAAI,CAACc,OAAO,OAAO,AAAKP,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB,IAAI;IAC5E,IAAIC;IACJ,IAAI;QACFA,UAAU,MAAMX,KAAKY,aAAa,CAACP;IACrC,EAAE,OAAOK,OAAO;QACd,4EAA4E;QAC5E,IAAI,CAACjD,iBAAiBiD,QAAQ,MAAMA;QACpC,OAAO,AAAKZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4B,IAAI;IAC5E;IACA,MAAMG,QAAQF,OAAO,CAAC,QAAQ,KAAK;IACnC,IAAI,CAACE,SAASF,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC3C,uBAAuB2C,UAAmB;QAC7F,OAAO,AAAKb,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4C,IAAI;IAC5F;IACA,MAAMI,OAAO,MAAMd,KAAKe,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAAClB,QAAQmB,GAAG;IACvE,IAAI,CAACJ,KAAKK,MAAM,EAAE,OAAO,AAAKrB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAe,IAAI;IAC/E,IAAI,CAACG,OAAO;;QACV,MAAM,EAAEO,UAAU,EAAE,GAAGnB;QACvB,MAAMoB,UAAUD,aACZ7D,0BAA0BuD,KAAKQ,IAAI,IAAIX,QAAQY,GAAG,EAAEH,WAAWI,GAAG,EAAEJ,WAAWK,SAAS,IACxFnE,aAAawD,MAAMH,QAAQY,GAAG,EAAE;QACpC,IAAI,CAACF,SAAS,OAAO,AAAKvB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,KAAK,WAAEU,8BAAAA,WAAYM,OAAO,oBAAI1C;QAAa,IAAI;IAClG;IACA,MAAM2C,eAAQ,QAAA,MAAM3B,KAAK4B,UAAU,CAAC7B,4BAAvB,AAAC,MAAgC4B,GAAG,mBAAI,CAAC;IACtD,MAAME,SAAS,MAAM7B,KAAK8B,QAAQ,CAAC;QAAEjB;QAAOU,KAAKZ,QAAQY,GAAG;QAAEI,KAAKA;QAAcb,MAAMA,KAAKQ,IAAI;QAAaS,SAAS;YAAEC,QAAQ;QAAO;IAAW;IAClJ,IAAIH,QAAQ,OAAO,AAAK/B,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAA+C,IAAI;IACzG,MAAMuB,QAAQ,OAAOtB,OAAO,CAAC,QAAQ,KAAK,WAAWA,OAAO,CAAC,QAAQ,GAAG;IACxE,OAAO;QAAEY,KAAKZ,QAAQY,GAAG;QAAEU;QAAOpB;QAAOC;QAAMa;IAAI;AACrD;AAEA,+GAA+G,GAC/G,OAAO,SAASO,YAAYnB,SAAoB,EAAEhB,MAAc;IAC9D,OAAO;QACLoC,KAAKpB,UAAUC,UAAU,CAAC,iBAAiBC,GAAG,CAACvD;QAC/C4D,MAAM;YAAEvB;YAAQqC,OAAO;gBAAC;aAAI;YAAEC,WAAWpE,WAAWqE,eAAe;YAAIC,UAAU;YAAGC,YAAY;QAAK;IACvG;AACF;AAEA,OAAO,eAAeC,YAAYzC,IAAiC,EAAED,MAAc,EAAE2C,KAA0C,EAAEC,MAAc;IAC7I,MAAMC,UAAU,MAAM5C,KAAK6C,SAAS,CAAC;QAAEC,SAAS;YAAC/C;SAAO;QAAE4C;IAAO,GAAGI,KAAK,CAAC,IAAO,CAAA;YAAEC,UAAU;QAAM,CAAA;IACnG,IAAIJ,QAAQI,QAAQ,EAAE,MAAMN,MAAMO,MAAM,GAAGF,KAAK,CAAC,IAAMG;AACzD;AAEA,OAAO,SAASC,SAASnD,IAAuB;QAEjCA,iBACIA,qBACHA,kBACFA,gBACCA,iBACNA;IANP,OAAO;QACLe,SAAS,GAAEf,kBAAAA,KAAKe,SAAS,YAAdf,kBAAmB,IAAMnC,cAAcuF,GAAG,GAAGrC,SAAS;QACjEH,aAAa,GAAEZ,sBAAAA,KAAKY,aAAa,YAAlBZ,sBAAuB,CAACK,QAAUxC,cAAcuF,GAAG,GAAGC,IAAI,GAAGzC,aAAa,CAACP;QAC1FuB,UAAU,GAAE5B,mBAAAA,KAAK4B,UAAU,YAAf5B,mBAAoB,CAACD,SAAWhC,cAAcgC;QAC1D+B,QAAQ,GAAE9B,iBAAAA,KAAK8B,QAAQ,YAAb9B,iBAAkB,CAACC,UAAYnC,mBAAmBmC;QAC5D4C,SAAS,GAAE7C,kBAAAA,KAAK6C,SAAS,YAAd7C,kBAAkBpC;QAC7B0F,GAAG,GAAEtD,YAAAA,KAAKsD,GAAG,YAARtD,YAAa,IAAMuD,KAAKD,GAAG;IAClC;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASE,yBAAyBvD,UAA6B,CAAC,CAAC;IACtE,OAAO,OAAOb,KAAKU;QACjB,IAAIV,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAMW,SAAST,IAAI,CAAC,SAAS;QAC7B,MAAMmE,YAAYnE,IAAI,CAAC,YAAY;QACnC,MAAMoE,UAAUpE,IAAI,CAAC,UAAU;QAC/B,IAAI,CAACI,QAAQK,WAAW,CAACL,QAAQ+D,cAAc,CAACC,WAAW,OAAOA,YAAY,YAAY,CAACC,MAAMC,OAAO,CAACF,QAAQG,QAAQ,GAAG;YAC1H,OAAO/D,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAwC;QAC/E;QACA,IAAI,OAAOgD,QAAQI,IAAI,KAAK,YAAY,CAACJ,QAAQI,IAAI,CAACC,IAAI,IAAI,OAAOjE,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA2B;QAC9H,IAAI;gBAOc7B;YANhB,MAAMmF,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMC,QAAQjE,KAAKsD,GAAG;YACtB,MAAMY,SAASzF,kBAAkBiF,SAASO;YAC1C,mEAAmE;YACnE,yDAAyD;YACzD,MAAME,WAAUtF,wBAAAA,qBAAqBqF,OAAOjE,OAAO,aAAnCpB,wBAAwCD,gBAAgBsF;YACxE,IAAIC,SAAS,OAAOrE,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOyD;YAAQ;YAC1D,MAAMC,KAAKpE,KAAKe,SAAS;YACzB,MAAMsD,UAAUD,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB;YAC3C,MAAMuE,WAAWD,QAAQrD,UAAU,CAAC;YACpC,MAAMuD,aAAaD,SAASrD,GAAG,CAACwC;YAChC,MAAMe,aAAaH,QAAQrD,UAAU,CAAC,eAAeyD,KAAK,CAAC,QAAQ,MAAM,WAAWA,KAAK,CAAC,QAAQ,MAAM;YACxG,MAAMC,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM4E,SAASrF,IAAI,CAAC,SAAS,KAAK;YAClC,MAAMsF,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;gBAC5C,MAAM,CAACC,UAAUC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;oBAACJ,GAAG5D,GAAG,CAACqD;oBAAaO,GAAG5D,GAAG,CAACsD;iBAAY;gBACpF,MAAMW,aAAa;oBACjBC,eAAejH,qBACbK,uBAAuB0F,QAAQR,UAC/BsB,MAAMK,IAAI,CAACC,GAAG,CAAC,CAACrE,MAAQvC,uBAAuBuC,IAAIsE,EAAE,EAAEtE,IAAIK,IAAI;gBAEnE;gBACA,IAAIqD,QAAQ;oBACV,IAAII,SAAS5D,MAAM,EAAE,OAAO;wBAAEX,QAAQ;wBAAKlB,MAAM;4BAAEkG,IAAI;4BAAMD,IAAI9B;4BAAWgC,UAAU;wBAAK;oBAAE;oBAC7F,MAAMC,QAAQ5G,YAAYkF,KAAKrC,GAAG;oBAClC,IAAI+D,OAAO,OAAO;wBAAElF,QAAQkF,MAAMlF,MAAM;wBAAElB,MAAM;4BAAEoB,OAAOgF,MAAMhF,KAAK;wBAAC;oBAAE;oBACvE,MAAMiF,OAAO,MAAMhI,mBAAmB2G,UAAU,CAACsB,YAAcd,GAAG5D,GAAG,CAAC0E;oBACtE,MAAMC,OAAO9G,YAAYiF,KAAKrC,GAAG,EAAWmE,OAAOH,SAAS;oBAC5D,IAAIE,MAAM,OAAO;wBAAErF,QAAQqF,KAAKrF,MAAM;wBAAElB,MAAM;4BAAEoB,OAAOmF,KAAKnF,KAAK;wBAAC;oBAAE;oBACpEoE,GAAGH,MAAM,CAACJ,YAAY,aACjBL,QACAiB;wBACHY,aAAa9B;wBACb+B,WAAW;wBACX3D,WAAWpE,WAAWqE,eAAe;wBACrC2D,WAAWhI,WAAWqE,eAAe;wBACrC4D,WAAWlC,KAAKzC,GAAG;;gBAEvB,OAAO;wBAGiBwD;oBAFtB,IAAI,CAACA,SAAS5D,MAAM,IAAI4D,SAAS7D,GAAG,CAAC,cAAc,OAAO;wBAAEV,QAAQ;wBAAKlB,MAAM;4BAAEoB,OAAO;wBAA2B;oBAAE;oBACrHoE,GAAGqB,GAAG,CAAC5B,YAAY,aACd6B,kBAAiBrB,iBAAAA,SAASzD,IAAI,cAAbyD,iBAAmB,CAAC,GAAGrB,UACxCnF,iBAAiB2F,QAAQa,SAAS7D,GAAG,CAAC,gBACtCiE;wBACHc,WAAWhI,WAAWqE,eAAe;;gBAEzC;gBACAwC,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMD,IAAI9B;wBAAWgC,UAAU;oBAAM;gBAAE;YAC3E;YACA,IAAIb,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA4BmG,QAAQ,EAAE;gBAC9E,MAAMhD,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,4BAA4BA;YAC1C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAAS0F,iBAAiBE,MAA+B,EAAEC,KAA8B;IAC9F,OAAOC,OAAOC,WAAW,CACvBD,OAAOE,OAAO,CAACJ,QAAQK,MAAM,CAC3B,CAAC,CAACnF,KAAK7B,MAAM,GAAK,CAAE6B,CAAAA,OAAO+E,KAAI,KAAM,QAAQ5G,yBAAD,AAACA,MAAuCiH,MAAM,MAAK;AAGrG;AAEA,2FAA2F,GAC3F,OAAO,SAASC,eAAetF,GAAW,EAAEC,GAAW;IACrD,OAAO,SAASnE,WAAW,UAAUyJ,MAAM,CAAC,GAAGvF,IAAI,CAAC,EAAEC,KAAK,EAAEuF,MAAM,CAAC,OAAOxG,KAAK,CAAC,GAAG;AACtF;AAEA;;;;;CAKC,GACD,OAAO,SAASyG,0BAA0B/G,UAA6B,CAAC,CAAC;IACvE,OAAO,OAAOb,KAAKU;YAOEV;QANnB,IAAIA,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAMW,SAAST,IAAI,CAAC,SAAS;QAC7B,MAAMmE,YAAYnE,IAAI,CAAC,YAAY;QACnC,MAAM2H,YAAY3H,IAAI,CAAC,YAAY;QACnC,MAAMkC,MAAMrB,QAAOf,8BAAAA,IAAIgB,OAAO,CAAC,kBAAkB,YAA9BhB,8BAAkC,IAAI2E,IAAI,GAAGxD,KAAK,CAAC,GAAG;QACzE,MAAMoC,SAASrD,IAAI,CAAC,SAAS;QAC7B,MAAM4H,QAAQC,KAAKC,KAAK,CAACtB,OAAOxG,IAAI,CAAC,QAAQ;QAC7C,MAAM+H,aAAa,OAAO/H,IAAI,CAAC,aAAa,KAAK,YAAYA,IAAI,CAAC,aAAa,GAAGA,IAAI,CAAC,aAAa,GAAG4D;QACvG,IAAI,CAACxD,QAAQK,WAAW,CAACL,QAAQ+D,cAAc,OAAOwD,cAAc,YAAY,CAACA,WAAW;YAC1F,OAAOnH,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAmC;QAC1E;QACA,IAAI,CAACc,KAAK,OAAO1B,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;QACzE,IAAI,CAACxB,qBAAqBoI,QAAQ,CAAC3E,SAAS,OAAO7C,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;QAClG,IAAI,CAACoF,OAAOyB,QAAQ,CAACL,UAAUA,UAAU,GAAG,OAAOpH,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;QAC3G,IAAI;YACF,MAAMsD,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMI,KAAKpE,KAAKe,SAAS;YACzB,MAAMsD,UAAUD,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB;YAC3C,MAAMwE,aAAaF,QAAQrD,UAAU,CAAC,YAAYC,GAAG,CAACwC;YACtD,MAAM+D,YAAYnD,QAAQrD,UAAU,CAAC,wBAAwBC,GAAG,CAAC4F,eAAe7C,KAAKzC,GAAG,EAAEC;YAC1F,MAAMkD,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM6E,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;oBAOtCpB,mBAQ8D;gBAdpE,MAAM,CAAC+D,QAAQnB,OAAO,GAAG,MAAMrB,QAAQC,GAAG,CAAC;oBAACJ,GAAG5D,GAAG,CAACsG;oBAAY1C,GAAG5D,GAAG,CAACqD;iBAAY;gBAClF,IAAIkD,OAAOtG,MAAM,EAAE;wBACkDmF;oBAAnE,OAAO;wBAAE9F,QAAQ;wBAAKlB,MAAM;4BAAEkG,IAAI;4BAAMC,UAAU;4BAAMiC,SAAS,GAAEpB,cAAAA,OAAOpF,GAAG,CAAC,wBAAXoF,cAA2B;wBAAK;oBAAE;gBACvG;gBACA,IAAI,CAACA,OAAOnF,MAAM,IAAImF,OAAOpF,GAAG,CAAC,cAAc,OAAO;oBAAEV,QAAQ;oBAAKlB,MAAM;wBAAEoB,OAAO;oBAA2B;gBAAE;gBACjH,MAAMgD,UAAU4C,OAAOhF,IAAI;gBAC3B,IAAI,CAAC,EAACoC,oBAAAA,QAAQG,QAAQ,YAAhBH,oBAAoB,EAAE,EAAEiE,IAAI,CAAC,CAACC,UAAYA,QAAQrC,EAAE,KAAK0B,YAAY;oBACzE,OAAO;wBAAEzG,QAAQ;wBAAKlB,MAAM;4BAAEoB,OAAO;wBAA4C;oBAAE;gBACrF;gBACA,MAAMmH,QAAQlJ,qBAAqB+E,SAASD,WAAW;oBAAEwD;oBAAWC;oBAAOvE;oBAAQ0E;gBAAW,GAAGrH,KAAKsD,GAAG;gBACzG,IAAI,CAACuE,OAAO,OAAO;oBAAErH,QAAQ;oBAAKlB,MAAM;wBAAEoB,OAAO;oBAA0B;gBAAE;gBAC7EoE,GAAGgC,MAAM,CAACvC,YAAYsD,MAAMf,MAAM;gBAClChC,GAAGH,MAAM,CAAC6C,WAAWK,MAAMJ,MAAM;gBACjC3C,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMC,UAAU;wBAAOiC,SAAS,GAAE,0BAAA,AAACG,MAAMf,MAAM,CAA6BY,SAAS,YAAnD,0BAAuD;oBAAK;gBAAE;YACpI;YACA,IAAI9C,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA4BmG,QAAQ,EAAE;gBAC9E,MAAMhD,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,6BAA6BA;YAC3C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA8B;QACrE;IACF;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeoH,iBAAiBxD,QAA+C,EAAEyD,IAAY;IAClG,IAAK,IAAIC,SAAS,GAAGA,SAAS,MAAMA,UAAU,EAAG;QAC/C,MAAMC,YAAYD,SAAS,IAAID,OAAO,GAAGA,KAAK,CAAC,EAAEC,QAAQ;QACzD,MAAME,OAAO,MAAM5D,SAASG,KAAK,CAAC,QAAQ,MAAMwD,WAAWE,KAAK,CAAC,GAAGjH,GAAG;QACvE,IAAIgH,KAAKE,KAAK,EAAE,OAAOH;IACzB;IACA,OAAO,GAAGF,KAAK,CAAC,EAAExE,KAAKD,GAAG,IAAI;AAChC;AAEA;;;;;;;;;CASC,GACD,OAAO,SAAS+E,8BAA8BpI,UAA6B,CAAC,CAAC;IAC3E,OAAO,OAAOb,KAAKU;QACjB,IAAIV,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAM,EAAEW,MAAM,EAAE0D,SAAS,EAAE6E,YAAY,EAAE,GAAGhJ;QAC5C,IAAI,CAACI,QAAQK,WAAW,CAACL,QAAQ+D,cAAc,CAAC/D,QAAQ4I,iBAAiB7E,cAAc6E,cAAc;YACnG,OAAOxI,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA0B;QACjE;QACA,IAAI;gBAWiC6H;YAVnC,MAAMvE,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMI,KAAKpE,KAAKe,SAAS;YACzB,MAAMsD,UAAUD,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB;YAC3C,MAAMuE,WAAWD,QAAQrD,UAAU,CAAC;YACpC,MAAMwH,UAAUlE,SAASrD,GAAG,CAACqH;YAC7B,MAAMG,UAAU,MAAMD,QAAQtH,GAAG;YACjC,IAAIuH,QAAQtH,MAAM,EAAE,OAAOrB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE+E,IAAI;gBAAMD,IAAI+C;gBAAc7C,UAAU;YAAK;YAC7F,MAAM8C,SAAS,MAAMjE,SAASrD,GAAG,CAACwC,WAAWvC,GAAG;YAChD,IAAI,CAACqH,OAAOpH,MAAM,IAAIoH,OAAOrH,GAAG,CAAC,cAAc,OAAOpB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA2B;YAC/G,MAAMgD,UAAUxF,mBAAmBqK,eAAAA,OAAOjH,IAAI,cAAXiH,eAAiB,CAAC;YACrD,MAAMG,OAAO,MAAMZ,iBAAiBxD,UAAUhG,yBAAyBoF,QAAQgF,IAAI,EAAEhF,QAAQI,IAAI;YACjG,MAAMG,QAAQjE,KAAKsD,GAAG;YACtB,MAAMY,SAAS9F,uBAAuBsF,SAASgF,MAAMzE;YACrD,MAAMO,aAAaH,QAAQrD,UAAU,CAAC,eAAeyD,KAAK,CAAC,QAAQ,MAAM,WAAWA,KAAK,CAAC,QAAQ,MAAM;YACxG,MAAMC,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM6E,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;gBAC5C,MAAM,CAACC,UAAUC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;oBAACJ,GAAG5D,GAAG,CAACsH;oBAAU1D,GAAG5D,GAAG,CAACsD;iBAAY;gBACjF,IAAIO,SAAS5D,MAAM,EAAE,OAAO;oBAAEX,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMD,IAAI+C;wBAAc7C,UAAU;oBAAK;gBAAE;gBAChG,MAAMC,QAAQ5G,YAAYkF,KAAKrC,GAAG;gBAClC,IAAI+D,OAAO,OAAO;oBAAElF,QAAQkF,MAAMlF,MAAM;oBAAElB,MAAM;wBAAEoB,OAAOgF,MAAMhF,KAAK;oBAAC;gBAAE;gBACvE,MAAMiF,OAAO,MAAMhI,mBAAmB2G,UAAU,CAACsB,YAAcd,GAAG5D,GAAG,CAAC0E;gBACtE,MAAMC,OAAO9G,YAAYiF,KAAKrC,GAAG,EAAWmE,OAAOH,SAAS;gBAC5D,IAAIE,MAAM,OAAO;oBAAErF,QAAQqF,KAAKrF,MAAM;oBAAElB,MAAM;wBAAEoB,OAAOmF,KAAKnF,KAAK;oBAAC;gBAAE;gBACpE,oEAAoE;gBACpE,MAAM0E,gBAAgBjH,qBACpBK,uBAAuB;oBAAEsF,MAAMzF,qBAAqBqF,QAAQI,IAAI;gBAAE,GAAGJ,UACrEsB,MAAMK,IAAI,CAACC,GAAG,CAAC,CAACrE,MAAQvC,uBAAuBuC,IAAIsE,EAAE,EAAEtE,IAAIK,IAAI;gBAEjEwD,GAAGH,MAAM,CAAC6D,SAAS,aACdtE;oBACHkB;oBACAY,WAAW;oBACX3D,WAAWpE,WAAWqE,eAAe;oBACrC2D,WAAWhI,WAAWqE,eAAe;oBACrC4D,WAAWlC,KAAKzC,GAAG;;gBAErBuD,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMD,IAAI+C;wBAAc7C,UAAU;wBAAOiD;oBAAK;gBAAE;YACpF;YACA,IAAI9D,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA4BmG,QAAQ,EAAE;gBAC9E,MAAMhD,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,iCAAiCA;YAC/C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA8B;QACrE;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASiI,2BAA2B1I,UAA6B,CAAC,CAAC;IACxE,OAAO,OAAOb,KAAKU;QACjB,IAAIV,IAAI4C,MAAM,KAAK,QAAQ,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACrF,MAAMV,OAAOmD,SAASlD;QACtB,MAAMX,OAAOH,OAAOC;QACpB,MAAM,EAAEW,MAAM,EAAE0D,SAAS,EAAE,GAAGnE;QAC9B,IAAI,CAACI,QAAQK,WAAW,CAACL,QAAQ+D,YAAY,OAAO3D,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;QAC5G,IAAI;YACF,MAAMsD,OAAO,MAAMnE,KAAKT,KAAKU,KAAKC,QAAQC;YAC1C,IAAI,CAACgE,MAAM;YACX,MAAMI,KAAKpE,KAAKe,SAAS;YACzB,MAAMwD,aAAaH,GAAGpD,UAAU,CAAC,SAASC,GAAG,CAAClB,QAAQiB,UAAU,CAAC,YAAYC,GAAG,CAACwC;YACjF,MAAMiB,SAASxC,YAAYkC,IAAIrE;YAC/B,MAAM6E,SAAS,MAAMR,GAAGS,cAAc,CAAC,OAAOC;gBAC5C,MAAMwB,SAAS,MAAMxB,GAAG5D,GAAG,CAACqD;gBAC5B,IAAI,CAAC+B,OAAOnF,MAAM,EAAE,OAAO;oBAAEX,QAAQ;oBAAKlB,MAAM;wBAAEoB,OAAO;oBAAgC;gBAAE;gBAC3F,IAAI4F,OAAOpF,GAAG,CAAC,cAAc,OAAO;oBAAEV,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMiD,SAAS;oBAAK;gBAAE;gBACrF3D,GAAGgC,MAAM,CAACvC,YAAY;oBAAEyB,WAAW/H,WAAWqE,eAAe;gBAAG;gBAChEwC,GAAGqB,GAAG,CAACzB,OAAOvC,GAAG,EAAEuC,OAAOpD,IAAI;gBAC9B,OAAO;oBAAEd,QAAQ;oBAAKlB,MAAM;wBAAEkG,IAAI;wBAAMiD,SAAS;oBAAM;gBAAE;YAC3D;YACA,IAAI7D,OAAOpE,MAAM,KAAK,OAAO,CAAC,AAACoE,OAAOtF,IAAI,CAA2BmJ,OAAO,EAAE;gBAC5E,MAAMhG,YAAYzC,MAAMD,QAAQ2E,OAAOvC,GAAG,EAAE;YAC9C;YACA,OAAOrC,IAAIU,MAAM,CAACoE,OAAOpE,MAAM,EAAEC,IAAI,CAACmE,OAAOtF,IAAI;QACnD,EAAE,OAAOoB,OAAO;YACd2F,QAAQ3F,KAAK,CAAC,8BAA8BA;YAC5C,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA2B;QAClE;IACF;AACF;AAEA,OAAO,MAAMkI,qBAAqBpF,2BAA0B;AAC5D,OAAO,MAAMqF,sBAAsB7B,4BAA2B;AAC9D,OAAO,MAAM8B,0BAA0BT,gCAA+B;AACtE,OAAO,MAAMU,uBAAuBJ,6BAA4B"}

package/src/lib/server/quote-email.d.ts

@@ -0,0 +1,85 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type EmailTheme, type RenderedHostEmail, type SendEmailOptions, type SendEmailResult, type SendingIdentityVerdict } from '@aglyn/shared-util-email';
+import * as CommerceModel from '../model';
+import type { quotePdfFile } from './commerce-pdf';
+import type { CommercePdfFile } from './pdf-response';
+/** What the route hands over for one send. */
+export interface QuoteDeliveryInput {
+    hostId: string;
+    quoteId: string;
+    /** The quote as it stands, after any pay link replacement this send made. */
+    order: CommerceModel.HostOrder;
+    host: Record<string, unknown>;
+    store: Record<string, unknown> | null;
+    owner: {
+        id?: string;
+        org?: unknown;
+    } | null;
+    to: string;
+    /** The subject as typed; empty takes the default. */
+    subject: string;
+    message: string;
+    payUrl: string;
+    proofUrl: (proofId: string) => string | null;
+    linkReplaced: boolean;
+    /** The sending member's email: the Reply-To when the site has no contact email. */
+    senderEmail: string | null;
+    atMs: number;
+}
+export type QuoteDeliveryResult = {
+    sent: true;
+    messageId: string;
+    providerId: string | null;
+    subject: string;
+    replyTo: string | null;
+    thread: CommerceModel.QuoteEmailThread;
+} | {
+    sent: false;
+    status: number;
+    error: string;
+};
+/** The calls the send makes, injectable for specs. */
+export interface QuoteMailerDeps {
+    configured(): boolean;
+    sendingIdentity(hostId: string): Promise<SendingIdentityVerdict>;
+    render(hostId: string, key: string, tokens: Record<string, string>): Promise<RenderedHostEmail | null>;
+    /** The site's email theme, for the colors the composed proof markup draws with. */
+    theme(hostId: string): Promise<EmailTheme | null>;
+    /** The quote's PDF; loads the PDF writer and sharp only here. */
+    quotePdf(input: Parameters<typeof quotePdfFile>[0]): Promise<CommercePdfFile>;
+    send(options: SendEmailOptions): Promise<SendEmailResult>;
+    meter(hostId: string): Promise<void>;
+    /** The bounce and complaint list only: a quote is mail the customer asked for. */
+    suppression(email: string): Promise<'suppressed-platform' | null>;
+}
+export declare function defaultQuoteMailerDeps(): QuoteMailerDeps;
+/** What the console's Send quote reaches: whether mail can go, whether this address may be mailed, and the send. */
+export interface QuoteMailer {
+    configured(): boolean;
+    suppression(email: string): Promise<'suppressed-platform' | null>;
+    deliver(input: QuoteDeliveryInput): Promise<QuoteDeliveryResult>;
+}
+/** The business's name as its documents print it. */
+export declare function quoteBusinessName(host: Record<string, unknown>): string;
+/**
+ * Who a reply reaches: the site's contact email, else the person sending, as
+ * an inbox reply answers to them. Null only when neither is an address.
+ */
+export declare function quoteReplyTo(host: Record<string, unknown>, senderEmail: string | null | undefined): string | null;
+/** The quote email, said and sent. */
+export declare function quoteMailer(deps?: QuoteMailerDeps): QuoteMailer;

package/src/lib/server/quote-email.js

@@ -0,0 +1,211 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { siteContactEmail, resolveHostToken } from "@aglyn/aglyn/app-utils/host-tokens";
+import { resolveBrandingProfile } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { emailThreadAfterSend, isEmailConfigured, mintEmailMessageId, nextThreadHeaders, PLATFORM_EMAIL_PALETTE, readEmailThread, resolveEmailColor, sendEmail } from "@aglyn/shared-util-email";
+import { firebaseAdmin, hostSendingIdentity, meterHostEmail, renderHostEmailWithTokens, siteEmailFrame, transactionalAddressSuppression } from "@aglyn/tenant-data-admin";
+import * as CommerceModel from "../model/index.js";
+import { QUOTE_EMAIL_KEY, quoteEmailContent } from "../utils/quote-email-content.js";
+export function defaultQuoteMailerDeps() {
+    const firestore = ()=>firebaseAdmin.app().firestore();
+    return {
+        configured: ()=>isEmailConfigured(),
+        sendingIdentity: (hostId)=>hostSendingIdentity(hostId),
+        render: (hostId, key, tokens)=>renderHostEmailWithTokens(firestore(), hostId, key, tokens),
+        theme: async (hostId)=>(await siteEmailFrame(firestore(), hostId, QUOTE_EMAIL_KEY)).theme,
+        quotePdf: async (input)=>(await import("./commerce-pdf.js")).quotePdfFile(input),
+        send: (options)=>sendEmail(options),
+        meter: async (hostId)=>{
+            await meterHostEmail(hostId);
+        },
+        suppression: (email)=>transactionalAddressSuppression(email)
+    };
+}
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** The business's name as its documents print it. */ export function quoteBusinessName(host) {
+    var _host_name;
+    const named = resolveHostToken('businessName', host);
+    return String(named != null ? named : '').trim() || String((_host_name = host['name']) != null ? _host_name : '').trim();
+}
+/**
+ * Who a reply reaches: the site's contact email, else the person sending, as
+ * an inbox reply answers to them. Null only when neither is an address.
+ */ export function quoteReplyTo(host, senderEmail) {
+    const contact = siteContactEmail(host);
+    if (contact && EMAIL.test(contact)) return contact;
+    const sender = String(senderEmail != null ? senderEmail : '').trim();
+    return EMAIL.test(sender) ? sender : null;
+}
+/** The theme's colors for the composed proof markup, the platform's where the site's cannot answer. */ function proofColors(theme) {
+    const read = (token)=>{
+        var _ref, _resolveEmailColor;
+        return (_ref = (_resolveEmailColor = resolveEmailColor(token, theme == null ? void 0 : theme.palette)) != null ? _resolveEmailColor : resolveEmailColor(token, PLATFORM_EMAIL_PALETTE)) != null ? _ref : 'inherit';
+    };
+    return {
+        border: read('divider'),
+        muted: read('text.secondary')
+    };
+}
+/** A refused send in the words the console shows. */ function refusalOf(result) {
+    switch(result.reason){
+        case 'unconfigured':
+            return {
+                status: 503,
+                error: 'Email isn’t set up here, so the quote wasn’t sent.'
+            };
+        case 'rate-limited':
+            return {
+                status: 429,
+                error: 'Too many emails are going out right now. Try again in a minute.'
+            };
+        case 'suppressed':
+        case 'undeliverable':
+            return {
+                status: 409,
+                error: 'This address can’t receive email, so the quote wasn’t sent. Copy the pay link and send it another way.'
+            };
+        case 'unverified-domain':
+            return {
+                status: 409,
+                error: 'This site’s sending domain isn’t verified, so the quote wasn’t sent. Check Email settings.'
+            };
+        case 'suspended':
+            return {
+                status: 423,
+                error: 'This site can’t send email right now, so the quote wasn’t sent.'
+            };
+        case 'held-for-review':
+            return {
+                status: 409,
+                error: `The email was held for review, so it hasn’t gone out yet.${result.detail ? ` ${result.detail}` : ''}`
+            };
+        default:
+            return {
+                status: 502,
+                error: 'The quote email could not be sent. Try again.'
+            };
+    }
+}
+/** The quote email, said and sent. */ export function quoteMailer(deps = defaultQuoteMailerDeps()) {
+    return {
+        configured: ()=>deps.configured(),
+        suppression: (email)=>deps.suppression(email),
+        deliver: async (input)=>{
+            var _ref, _host_cname, _result_id;
+            var _input_store, _order_quote, _input_owner;
+            const { hostId, quoteId, order, host } = input;
+            const businessName = quoteBusinessName(host);
+            const subject = input.subject || CommerceModel.quoteEmailDefaultSubject(order, businessName, quoteId);
+            const [identity, theme] = await Promise.all([
+                deps.sendingIdentity(hostId),
+                deps.theme(hostId).catch(()=>null)
+            ]);
+            const content = quoteEmailContent({
+                order,
+                quoteId,
+                businessName,
+                currency: String((_ref = (_input_store = input.store) == null ? void 0 : _input_store['currency']) != null ? _ref : 'USD'),
+                subject,
+                message: input.message,
+                payUrl: input.payUrl,
+                proofUrl: input.proofUrl,
+                linkReplaced: input.linkReplaced,
+                colors: proofColors(theme),
+                radius: theme == null ? void 0 : theme.buttonRadius
+            });
+            // The PDF is what the email says is attached; without it nothing goes.
+            let pdf;
+            try {
+                pdf = await deps.quotePdf({
+                    hostId,
+                    quoteId,
+                    order,
+                    host,
+                    store: input.store,
+                    owner: input.owner,
+                    payUrl: input.payUrl
+                });
+            } catch (error) {
+                console.error('[commerce/quote-email] the PDF could not be made', {
+                    hostId,
+                    quoteId,
+                    error
+                });
+                return {
+                    sent: false,
+                    status: 500,
+                    error: 'The quote’s PDF could not be made, so nothing was sent. Try again.'
+                };
+            }
+            const rendered = await deps.render(hostId, QUOTE_EMAIL_KEY, content.tokens);
+            const thread = readEmailThread((_order_quote = order.quote) == null ? void 0 : _order_quote.emailThread);
+            const siteHost = String((_host_cname = host['cname']) != null ? _host_cname : '').trim() || null;
+            const messageId = mintEmailMessageId([
+                identity == null ? void 0 : identity.domain,
+                identity == null ? void 0 : identity.from,
+                siteHost
+            ], {
+                label: 'quote',
+                atMs: input.atMs
+            });
+            const replyTo = quoteReplyTo(host, input.senderEmail);
+            const result = await deps.send(_extends({
+                to: input.to,
+                // The subject as sent, whatever a design's own says: it is what keeps
+                // the conversation together, and it was typed for this send.
+                subject,
+                text: (rendered == null ? void 0 : rendered.text) || content.text
+            }, (rendered == null ? void 0 : rendered.html) ? {
+                html: rendered.html
+            } : {}, {
+                headers: nextThreadHeaders(thread, messageId)
+            }, replyTo ? {
+                replyTo
+            } : {}, {
+                fromName: resolveBrandingProfile((_input_owner = input.owner) == null ? void 0 : _input_owner.org).fromName,
+                sendingIdentity: identity,
+                audience: 'tenant',
+                context: 'quote',
+                attachments: [
+                    {
+                        filename: pdf.filename,
+                        contentType: 'application/pdf',
+                        content: Buffer.from(pdf.bytes).toString('base64')
+                    }
+                ]
+            }));
+            if (!result.sent) return _extends({
+                sent: false
+            }, refusalOf(result));
+            // Cost meter (AGL-1438), as every transactional site email.
+            await deps.meter(hostId).catch((error)=>console.error('[commerce/quote-email] not metered', error));
+            return {
+                sent: true,
+                messageId,
+                providerId: (_result_id = result.id) != null ? _result_id : null,
+                subject,
+                replyTo,
+                thread: emailThreadAfterSend(thread, {
+                    messageId,
+                    subject
+                })
+            };
+        }
+    };
+}
+
+//# sourceMappingURL=quote-email.js.map