@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/checkout.js

@@ -0,0 +1,477 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { connectLinkageIsReady } from "@aglyn/tenant-data-admin/server/stripe-account-mode";
+import { buildRoute, checkEntitlement, claimAttempt, isListingWideRevocation, resolveMarketplaceFeePct, Route } from "@aglyn/aglyn/server";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { isListingBrowsable, isPrivateListing } from "../model/marketplace.js";
+import { canActAsPublisher, resolvePublisherProfile } from "./publisher-profile.js";
+import { hasLivePurchase } from "./purchase-entitlement.js";
+/**
+ * THE TAX CLASSIFICATION OF A MARKETPLACE SALE (AGL-1553).
+ *
+ * "Software as a service (SaaS) — business use". Sent explicitly on the line
+ * item below, because this session builds its product ad hoc from
+ * `price_data` and an ad-hoc product with no `tax_code` is classified by the
+ * ACCOUNT-LEVEL preset instead — a value set by hand in the Stripe Dashboard
+ * for Aglyn's own subscription products (AGL-1537/1877), which happens to be
+ * this same string.
+ *
+ * So this is not a change of tax position, and deliberately not: it is the
+ * position Aglyn already collects on, already verified, and already states in
+ * a signed filing. The pending Texas private letter ruling request proposes at
+ * Part 6.1 that plugin charges are DATA PROCESSING SERVICES under Tax Code
+ * § 151.0035, of which § 151.351 exempts 20%, so tax is due on 80% of the
+ * charge; Part 4.5 ¶ 4 represents to the Comptroller that "the payment
+ * processor's tax classification applied to these charges is the
+ * software-as-a-service category" and that the 80% measure was confirmed by
+ * computation. AGL-1817 ran that computation against the live account: $6.60
+ * of tax on a $100.00 charge at an 8.25% Texas address — 8.25% x $80.
+ *
+ * What was actually broken is that none of that was expressed HERE. The
+ * classification of every marketplace sale hung on a Dashboard field owned by
+ * a different product line. Re-preset the account for storefront goods or
+ * bookings and these sales silently re-classify, moving the Texas base off the
+ * 80% the filing describes — with no diff to review, no failing test, and no
+ * symptom short of reconciling a return. Naming it here is what makes the
+ * filed representation survive a Dashboard edit.
+ *
+ * NOT merged with `PLATFORM_TAX_CODE` in `tools/scripts/lib/stripe-tax-code.mjs`,
+ * which stamps Aglyn's OWN products with the same string today. They answer
+ * different questions — Aglyn's first-party subscription vs. a third party's
+ * sale through Aglyn's marketplace — and the ruling request itself flags at
+ * Part 8 ¶ 8 that the Comptroller could characterize the two differently. One
+ * shared constant would make a divergence the filing anticipates impossible to
+ * express without touching the other business.
+ *
+ * DO NOT change this value to a downloadable-software code (`txcd_10202003`,
+ * `txcd_10203001`) on the reasoning that a plugin is "downloaded". That is the
+ * OPPOSING characterization — tangible personal property under Rule 3.308,
+ * taxable in full — which Part 6.1 argues against and which the filing already
+ * states against itself, in full, at Part 8 ¶¶ 1-2. Adopting
+ * it here would raise the tax charged to every buyer by a quarter of the base
+ * and make Part 4.5 ¶ 4 false. It is the Comptroller's call, and if the ruling
+ * goes that way the change is a one-line edit at this constant plus a
+ * prospective conformance — which is exactly what naming it here buys.
+ */ export const MARKETPLACE_TAX_CODE = 'txcd_10103001';
+/**
+ * Checkout for a paid marketplace listing (AGL-46): one-time destination
+ * charge to the publisher's Express account. The platform's cut comes from
+ * the seller org's ENTITLEMENTS (AGL-1543: 20%, 30% effective-free), sales
+ * tax is collected platform-side per the marketplace-provider registration
+ * (AGL-1544), and the seller receives a fixed transfer of their pre-tax
+ * share. The webhook writes the purchase record on
+ * `checkout.session.completed`; install stays gated on that record. 501
+ * without Stripe env.
+ */ export const checkoutHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _ref3, _req_headers_idempotencykey, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    if (!process.env.STRIPE_SECRET_KEY) {
+        return res.status(501).json({
+            error: 'Purchases are not configured (STRIPE_SECRET_KEY).'
+        });
+    }
+    const listingId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.listingId) != null ? _ref : '');
+    const hostId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.hostId) != null ? _ref1 : '');
+    // The org this licence is being bought FOR (AGL-2331). Requested, never
+    // trusted: it is resolved through the caller's own membership below, exactly
+    // as `connect.ts` resolves the org a payout account is being set up for.
+    const requestedOrgId = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.orgId) != null ? _ref2 : '');
+    // One purchase attempt, minted by the browser (AGL-1697). Node lowercases
+    // incoming headers, but read both spellings — the plugin API request type
+    // makes no promise about casing.
+    const idempotencyKey = String((_ref3 = (_req_headers_idempotencykey = req.headers['idempotency-key']) != null ? _req_headers_idempotencykey : req.headers['Idempotency-Key']) != null ? _ref3 : '').trim().slice(0, 200);
+    if (!listingId) return res.status(400).json({
+        error: 'Missing listingId'
+    });
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    let claim = null;
+    try {
+        var _membership_orgId, _listing_priceUsd, _listing_profileId, _sellerOrgDoc_data, _req_headers_origin, _listing_displayName, _ref4;
+        var _req_body3;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        // WHICH ORGANIZATION IS BUYING (AGL-2331).
+        //
+        // A marketplace purchase licenses an organization, not a person — see
+        // `purchaseEntitlesOrg` in the model for why, and for what the published
+        // Publisher Agreement §8.1 already says about it. So a Checkout session
+        // that cannot name the org it licenses must not open: the purchase
+        // document it produces would carry no `buyerOrgId`, and a half-populated
+        // org field is a worse premise for an entitlement than an absent one —
+        // the gate would have to guess whether a missing value means "legacy,
+        // grandfathered" or "modern, but nobody wrote it".
+        //
+        // Resolved through `resolveOrgPermissions`, not from the body and not from
+        // `hostIndex`. The old derivation was `hostId` → `hostIndex.orgId` with no
+        // membership test at all, which is a real hole once the field grants
+        // anything: post any host id and the purchase would be stamped with an org
+        // the buyer has no standing in, entitling strangers. This is the same
+        // resolution the seven install routes and `connect.ts` use, so the org
+        // that gets the licence is by construction an org the buyer could install
+        // into.
+        //
+        // `installPlugins` rather than a bare membership: buying is the act of
+        // acquiring something to install, and a viewer who cannot install must not
+        // be able to spend the workspace's money on one. It is also what keeps
+        // this door and the install door agreeing about who the licence is for.
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            orgId: requestedOrgId || null,
+            hostId: requestedOrgId ? null : hostId || null
+        });
+        const buyerOrgId = (_membership_orgId = membership.orgId) != null ? _membership_orgId : '';
+        if (!buyerOrgId) {
+            return res.status(400).json({
+                error: 'A purchase is licensed to an organization — open the marketplace ' + 'from the workspace you are buying for.'
+            });
+        }
+        if (requestedOrgId && buyerOrgId !== requestedOrgId) {
+            return res.status(403).json({
+                error: 'Not a member of that organization'
+            });
+        }
+        if (!membership.permissions.installPlugins) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow installing from the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const listingSnapshot = await firestore.collection('marketplaceListings').doc(listingId).get();
+        const listing = listingSnapshot.data();
+        if (!listing || listing.deletedAt) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        // Review gating holds on the PAID path too (AGL-1543): browse hides
+        // rejected/submitted/in_review listings, so a direct checkout call must
+        // not be a side door that takes money for one. Absent = legacy = listed
+        // (AGL-432), and the same 404 as an unknown listing — purchasability is
+        // not a probe for review state.
+        const reviewStatus = listing.reviewStatus;
+        if (reviewStatus && reviewStatus !== 'listed' && reviewStatus !== 'verified') {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        // A TAKEN-DOWN or PRIVATE listing is not on sale (AGL-2288).
+        //
+        // The check above is a hand-rolled subset of `isListingBrowsable`, and
+        // the two lines it dropped are the two that matter here: `hiddenAt` and
+        // `isPrivateListing`. A staff takedown does NOT set a blocking
+        // `reviewStatus` — `plugin-reviews` demotes a verified listing to
+        // `VERIFIED_STRIPPED_STATUS`, which is literally `'listed'` — so after a
+        // takedown this route read `reviewStatus: 'listed'` and sold the listing
+        // in full, while `install-plugin` refused the very same listing at
+        // `hiddenAt` with a 404. The buyer was charged for something the platform
+        // had already decided nobody may install, and the only way out was a
+        // refund — which is Aglyn's Stripe fee, Aglyn's support time, and (until
+        // the partial-refund fix) a real hole in the split.
+        //
+        // Both tests are kept rather than replaced by the shared predicate: for a
+        // NON-plugin artifact `isListingBrowsable` returns true whatever the
+        // review status says, because pre-publication review is plugin-only. This
+        // route has always been stricter than that, and a sale is the wrong place
+        // to loosen a gate.
+        //
+        // No owner exemption, unlike the install routes: `canActAsPublisher`
+        // below already refuses a publisher buying their own listing, so the
+        // buyer here is never the owner.
+        if (!isListingBrowsable(listing) || isPrivateListing(listing)) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        const priceUsd = Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0);
+        if (!(priceUsd > 0)) {
+            return res.status(400).json({
+                error: 'Listing is free'
+            });
+        }
+        // Publishing is org-owned (AGL-652): `profileId` IS the publisher org id.
+        const sellerOrgId = String((_listing_profileId = listing.profileId) != null ? _listing_profileId : '');
+        if (await canActAsPublisher(firestore, decoded.uid, sellerOrgId)) {
+            return res.status(400).json({
+                error: 'Your organization published this listing'
+            });
+        }
+        // You cannot buy the same component twice (AGL-1697).
+        //
+        // This route validated review status, self-purchase and the seller's
+        // entitlements, and then never asked the one question the buyer cares
+        // about: do they already own it. A marketplace listing is a buy-once good —
+        // a second purchase buys nothing, since `requirePurchase` is satisfied by
+        // the first — so a buyer who clicked Buy again from a stale tab, or came
+        // back through a bookmarked checkout, was simply charged twice for it.
+        //
+        // Deliberately the SAME predicate the seven install routes gate on
+        // (AGL-1546/1699) rather than a second query beside it: "has this buyer
+        // paid for this listing" must have one answer, or the marketplace can take
+        // money for something it will not install, or refuse to sell something it
+        // will not install either. That predicate reads a fully REFUNDED purchase
+        // as absent, which is exactly right here too — a refunded buyer must be
+        // able to buy again, and a refunded row sitting beside a live one does not
+        // veto it.
+        //
+        // 409 rather than 400: nothing about the request is malformed, the buyer
+        // is just asking for a state that already holds.
+        //
+        // KEYED ON THE ORGANIZATION SINCE AGL-2331, and that is what turns this
+        // guard from a blocked sale back into a real one. A licence belongs to a
+        // workspace, so an agency developer who bought a component for one client
+        // must be able to buy it again for the next — the person-keyed version of
+        // this check answered `409 already_purchased` to exactly the second sale
+        // we want. It still refuses the case it was written for: the same
+        // workspace buying the same listing twice.
+        //
+        // A pre-AGL-2331 purchase still refuses, through the legacy grant inside
+        // the shared predicate: that buyer can already install this listing
+        // anywhere, so selling them a second copy would take money for nothing.
+        if (await hasLivePurchase({
+            firestore,
+            buyerUid: decoded.uid,
+            buyerOrgId,
+            listingId
+        })) {
+            return res.status(409).json({
+                error: 'This organization already owns this listing — install it from ' + 'your library.',
+                code: 'already_purchased'
+            });
+        }
+        // The kill switch, on the SELL side too (AGL-2288).
+        //
+        // `revocations/{listingId}` with `versions: 'all'` is the listing-wide
+        // kill: `install-plugin` 409s on it through this same predicate, and the
+        // tenant runtime renders the disabled placeholder for anything already
+        // pinned. Selling into that state takes money for an artifact the
+        // platform has switched off.
+        //
+        // Only `'all'` is consulted, deliberately. A per-version revocation
+        // (AGL-1085) stops one build while other approved versions stay
+        // installable, and refusing the sale for it would turn a targeted control
+        // into a de-listing. Whether the newest approved version happens to be
+        // the revoked one is a question `install-plugin` answers with live data;
+        // duplicating that resolution here would be a second copy of it.
+        //
+        // One extra read on a path that already makes several Firestore and
+        // Stripe round trips, and it is the cheap half of the takedown check
+        // above: a hand-written revocation doc — which the rules permit any staff
+        // client to write — is caught here even when `hiddenAt` was never set.
+        const revocation = (await firestore.collection('revocations').doc(listingId).get()).data();
+        if (isListingWideRevocation(revocation)) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        const publisher = await resolvePublisherProfile(firestore, sellerOrgId);
+        const accountId = publisher == null ? void 0 : publisher.stripeAccountId;
+        if (!connectLinkageIsReady({
+            accountId,
+            chargesEnabled: publisher == null ? void 0 : publisher.stripeChargesEnabled,
+            accountLivemode: publisher == null ? void 0 : publisher.stripeAccountLivemode
+        }, {
+            subject: `marketplace publisher org ${sellerOrgId}`
+        })) {
+            return res.status(409).json({
+                error: 'The publisher has not enabled payouts yet'
+            });
+        }
+        // The platform's cut comes from ENTITLEMENTS (AGL-1543), never the raw
+        // `plan` field: `resolveMarketplaceFeePct` prices a dead subscription
+        // as free-plan (30%) while the stale field still says pro, and honors
+        // a negotiated per-org `marketplaceFeePct` override. Same read gates
+        // SALE time on `marketplaceSelling` — publish already refuses without
+        // it, and a publisher who downgrades must stop selling, not merely
+        // stop publishing. Resolved per request; entitlements are never cached.
+        const sellerOrgDoc = await firestore.collection('orgs').doc(sellerOrgId).get();
+        const sellerOrg = (_sellerOrgDoc_data = sellerOrgDoc.data()) != null ? _sellerOrgDoc_data : {};
+        if (!checkEntitlement(sellerOrg, 'marketplaceSelling')) {
+            return res.status(409).json({
+                error: "The publisher's current plan does not include marketplace selling"
+            });
+        }
+        const feePercent = resolveMarketplaceFeePct(sellerOrg);
+        const amountCents = Math.round(priceUsd * 100);
+        const feeCents = Math.round(amountCents * feePercent / 100);
+        const origin = (_req_headers_origin = req.headers.origin) != null ? _req_headers_origin : `https://${req.headers.host}`;
+        // Stripe returns the BUYER to the org marketplace (AGL-775) — the
+        // per-site marketplace page it used to land on was retired. Only the
+        // buyer's org slug is needed now (`sellerOrgId` is the wrong org), and
+        // it's resolved from the host here since server code cannot call
+        // useConsoleHostRoute. `/manage/marketplace` is the hostless fallback.
+        //
+        // The slug comes off the VALIDATED buyer org resolved at the top of the
+        // handler now (AGL-2331) rather than a second, unvalidated `hostIndex`
+        // read: one org id decides where the buyer lands, which org the licence
+        // entitles, and which org's erasure sweeps the idempotency claim, so
+        // having two derivations of it was a way for those three to disagree.
+        const buyerOrgSlug = (await firestore.collection('orgs').doc(buyerOrgId).get()).get('slug');
+        const returnPath = buyerOrgSlug ? buildRoute(Route.ORG_MARKETPLACE, {
+            orgSlug: buyerOrgSlug
+        }) : Route.ORG_MARKETPLACE;
+        // Tax + funds flow (AGL-1544). Aglyn registered as a marketplace
+        // provider with the Texas Comptroller: it collects and remits sales tax
+        // on sellers' behalf. That is the PLATFORM's charge — no `on_behalf_of`,
+        // `automatic_tax` on the platform session, tax added ON TOP of the
+        // listing price (`tax_behavior: exclusive`) with a full billing address
+        // to compute from. The transfer is a FIXED amount (the seller's share of
+        // the pre-tax price) rather than `application_fee_amount`, because the
+        // fee form makes Stripe transfer `amount_total − fee` — and amount_total
+        // includes the tax, which must stay with the platform that owes it.
+        const transferCents = amountCents - feeCents;
+        const params = new URLSearchParams(_extends({
+            mode: 'payment',
+            'line_items[0][quantity]': '1',
+            'line_items[0][price_data][currency]': 'usd',
+            'line_items[0][price_data][unit_amount]': String(amountCents),
+            'line_items[0][price_data][tax_behavior]': 'exclusive',
+            'line_items[0][price_data][product_data][name]': String((_listing_displayName = listing.displayName) != null ? _listing_displayName : 'Marketplace component').slice(0, 120),
+            // The classification, stated rather than inherited (AGL-1553). See
+            // MARKETPLACE_TAX_CODE above: same value the account preset carries, so
+            // the tax computed is unchanged, but it no longer depends on a Dashboard
+            // field owned by Aglyn's subscription products.
+            'line_items[0][price_data][product_data][tax_code]': MARKETPLACE_TAX_CODE,
+            'automatic_tax[enabled]': 'true',
+            billing_address_collection: 'required',
+            'payment_intent_data[transfer_data][destination]': String(accountId),
+            'payment_intent_data[transfer_data][amount]': String(transferCents),
+            // THE DISCRIMINATOR THE REFUND DOOR HAS NO OTHER WAY TO GET (AGL-2148).
+            //
+            // `metadata[type]` below rides on the SESSION, and `charge.refunded`
+            // never sees a session — its object is the charge. The platform
+            // endpoint receives `charge.refunded` for storefront orders and
+            // subscription charges too, so the webhook cannot tell a marketplace
+            // refund from any other one except by joining on the payment intent,
+            // which is exactly the join that comes up empty during the window this
+            // metadata exists to close (the purchase document is written by
+            // `checkout.session.completed`, and that delivery retries).
+            //
+            // Stripe copies a PaymentIntent's metadata onto the charge it creates,
+            // so stamping it here makes `charge.metadata.type` readable straight
+            // off the refund event — no Firestore join, no Stripe round trip, and
+            // no orphan record written for the commerce and subscription refunds
+            // that share this endpoint.
+            //
+            // `listingId`/`buyerUid` ride along for forensics only: an orphan that
+            // never drains is a support case, and the payment intent alone does not
+            // say whose purchase of what it was.
+            'payment_intent_data[metadata][type]': 'marketplace-purchase',
+            'payment_intent_data[metadata][listingId]': listingId,
+            'payment_intent_data[metadata][buyerUid]': decoded.uid,
+            'payment_intent_data[metadata][buyerOrgId]': buyerOrgId,
+            success_url: `${origin}${returnPath}?purchase=success`,
+            cancel_url: `${origin}${returnPath}?purchase=canceled`,
+            client_reference_id: decoded.uid,
+            'metadata[type]': 'marketplace-purchase',
+            'metadata[listingId]': listingId,
+            'metadata[buyerUid]': decoded.uid,
+            // THE ORG THE LICENCE IS FOR (AGL-2331). The webhook writes the
+            // purchase document from this metadata and had no buyer org to write,
+            // which is why the entitlement could only ever be person-scoped: the
+            // one field the gate needs was never carried across the Stripe
+            // boundary. Validated above against the caller's own membership, so a
+            // session can never license an org the buyer has no standing in.
+            'metadata[buyerOrgId]': buyerOrgId,
+            'metadata[sellerOrgId]': sellerOrgId,
+            'metadata[feeCents]': String(feeCents),
+            'metadata[transferCents]': String(transferCents)
+        }, /^\d+\.\d+$/.test(String((_ref4 = (_req_body3 = req.body) == null ? void 0 : _req_body3.gaClientId) != null ? _ref4 : '')) ? {
+            'metadata[ga_client_id]': String(req.body.gaClientId)
+        } : {}, decoded.email ? {
+            customer_email: decoded.email
+        } : {}));
+        // Point of no return (AGL-1697). The purchase check above closes the
+        // SEQUENTIAL duplicate — a second buy after the webhook has written the
+        // first purchase — and cannot close the concurrent one, because between two
+        // clicks a second apart there is no purchase record yet to find. The claim
+        // is what covers that window: `create()` on a document Firestore refuses to
+        // create twice.
+        //
+        // Scoped to the listing AND the buyer, so two people buying the same
+        // component at the same moment never contend, and one person's two tabs
+        // always do.
+        //
+        // The claim is taken here rather than at the top so that every deterministic
+        // refusal above it — unknown listing, free listing, self-purchase, already
+        // owned, publisher not paid out, seller cannot sell — answers without
+        // burning the key. Those are all states a buyer or publisher fixes and then
+        // presses the same button again.
+        const claimed = await claimAttempt(firestore, {
+            kind: 'marketplace-checkout',
+            // Scoped to the ORG as well as the buyer since AGL-2331. The scope is
+            // what decides which two attempts are allowed to contend, and a
+            // licence for one workspace and a licence for another are now two
+            // different goods — an agency owner buying for two clients from two
+            // tabs must not have one of them read as a double-click of the other.
+            scopeId: `${listingId}:${buyerOrgId}:${decoded.uid}`,
+            // The BUYER's org, so `eraseOrgIdempotencyKeys` sweeps this with the
+            // buyer's data (AGL-1448) — the seller keeps the sale.
+            orgId: buyerOrgId,
+            key: idempotencyKey,
+            busyMessage: 'This purchase is already being processed'
+        });
+        if ('replay' in claimed) {
+            return res.status(claimed.replay.status).json(claimed.replay.body);
+        }
+        claim = claimed.claim;
+        const response = await fetch('https://api.stripe.com/v1/checkout/sessions', {
+            method: 'POST',
+            headers: _extends({
+                Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
+                'Content-Type': 'application/x-www-form-urlencoded'
+            }, claim.stripeKey ? {
+                'Idempotency-Key': claim.stripeKey
+            } : {}),
+            body: params.toString()
+        });
+        const session = await response.json();
+        if (!response.ok || !session.url) {
+            console.error('Stripe checkout error', session.error);
+            // The purchase did not start — let the same key be tried again rather
+            // than locking this buyer out of this listing over one flaky moment.
+            await claim.release();
+            return res.status(502).json({
+                error: 'Stripe checkout failed'
+            });
+        }
+        const payload = {
+            url: session.url
+        };
+        // A repeat of this attempt now replays the SAME session url. Better than
+        // refusing it: the buyer lands back on the checkout they already had open.
+        await claim.record(200, payload);
+        return res.status(200).json(payload);
+    } catch (error) {
+        console.error(error);
+        // Release on the way out so a transient failure does not strand the key
+        // and lock the buyer out of this listing until they reload.
+        await (claim == null ? void 0 : claim.release());
+        return res.status(500).json({
+            error: 'Checkout failed'
+        });
+    }
+};
+
+//# sourceMappingURL=checkout.js.map

package/src/lib/server/checkout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/checkout.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { connectLinkageIsReady } from '@aglyn/tenant-data-admin/server/stripe-account-mode'\nimport {\n  buildRoute,\n  checkEntitlement,\n  claimAttempt,\n  isListingWideRevocation,\n  resolveMarketplaceFeePct,\n  Route,\n  type AttemptClaim,\n  type PluginApiHandler,\n  type PluginRevocation,\n} from '@aglyn/aglyn/server'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { isListingBrowsable, isPrivateListing } from '../model/marketplace'\nimport {\n  canActAsPublisher,\n  resolvePublisherProfile,\n} from './publisher-profile'\nimport { hasLivePurchase } from './purchase-entitlement'\n\n/**\n * THE TAX CLASSIFICATION OF A MARKETPLACE SALE (AGL-1553).\n *\n * \"Software as a service (SaaS) — business use\". Sent explicitly on the line\n * item below, because this session builds its product ad hoc from\n * `price_data` and an ad-hoc product with no `tax_code` is classified by the\n * ACCOUNT-LEVEL preset instead — a value set by hand in the Stripe Dashboard\n * for Aglyn's own subscription products (AGL-1537/1877), which happens to be\n * this same string.\n *\n * So this is not a change of tax position, and deliberately not: it is the\n * position Aglyn already collects on, already verified, and already states in\n * a signed filing. The pending Texas private letter ruling request proposes at\n * Part 6.1 that plugin charges are DATA PROCESSING SERVICES under Tax Code\n * § 151.0035, of which § 151.351 exempts 20%, so tax is due on 80% of the\n * charge; Part 4.5 ¶ 4 represents to the Comptroller that \"the payment\n * processor's tax classification applied to these charges is the\n * software-as-a-service category\" and that the 80% measure was confirmed by\n * computation. AGL-1817 ran that computation against the live account: $6.60\n * of tax on a $100.00 charge at an 8.25% Texas address — 8.25% x $80.\n *\n * What was actually broken is that none of that was expressed HERE. The\n * classification of every marketplace sale hung on a Dashboard field owned by\n * a different product line. Re-preset the account for storefront goods or\n * bookings and these sales silently re-classify, moving the Texas base off the\n * 80% the filing describes — with no diff to review, no failing test, and no\n * symptom short of reconciling a return. Naming it here is what makes the\n * filed representation survive a Dashboard edit.\n *\n * NOT merged with `PLATFORM_TAX_CODE` in `tools/scripts/lib/stripe-tax-code.mjs`,\n * which stamps Aglyn's OWN products with the same string today. They answer\n * different questions — Aglyn's first-party subscription vs. a third party's\n * sale through Aglyn's marketplace — and the ruling request itself flags at\n * Part 8 ¶ 8 that the Comptroller could characterize the two differently. One\n * shared constant would make a divergence the filing anticipates impossible to\n * express without touching the other business.\n *\n * DO NOT change this value to a downloadable-software code (`txcd_10202003`,\n * `txcd_10203001`) on the reasoning that a plugin is \"downloaded\". That is the\n * OPPOSING characterization — tangible personal property under Rule 3.308,\n * taxable in full — which Part 6.1 argues against and which the filing already\n * states against itself, in full, at Part 8 ¶¶ 1-2. Adopting\n * it here would raise the tax charged to every buyer by a quarter of the base\n * and make Part 4.5 ¶ 4 false. It is the Comptroller's call, and if the ruling\n * goes that way the change is a one-line edit at this constant plus a\n * prospective conformance — which is exactly what naming it here buys.\n */\nexport const MARKETPLACE_TAX_CODE = 'txcd_10103001'\n\n/**\n * Checkout for a paid marketplace listing (AGL-46): one-time destination\n * charge to the publisher's Express account. The platform's cut comes from\n * the seller org's ENTITLEMENTS (AGL-1543: 20%, 30% effective-free), sales\n * tax is collected platform-side per the marketplace-provider registration\n * (AGL-1544), and the seller receives a fixed transfer of their pre-tax\n * share. The webhook writes the purchase record on\n * `checkout.session.completed`; install stays gated on that record. 501\n * without Stripe env.\n */\nexport const checkoutHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return res\n      .status(501)\n      .json({ error: 'Purchases are not configured (STRIPE_SECRET_KEY).' })\n  }\n  const listingId = String(req.body?.listingId ?? '')\n  const hostId = String(req.body?.hostId ?? '')\n  // The org this licence is being bought FOR (AGL-2331). Requested, never\n  // trusted: it is resolved through the caller's own membership below, exactly\n  // as `connect.ts` resolves the org a payout account is being set up for.\n  const requestedOrgId = String(req.body?.orgId ?? '')\n  // One purchase attempt, minted by the browser (AGL-1697). Node lowercases\n  // incoming headers, but read both spellings — the plugin API request type\n  // makes no promise about casing.\n  const idempotencyKey = String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n  if (!listingId) return res.status(400).json({ error: 'Missing listingId' })\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  let claim: AttemptClaim | null = null\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    // WHICH ORGANIZATION IS BUYING (AGL-2331).\n    //\n    // A marketplace purchase licenses an organization, not a person — see\n    // `purchaseEntitlesOrg` in the model for why, and for what the published\n    // Publisher Agreement §8.1 already says about it. So a Checkout session\n    // that cannot name the org it licenses must not open: the purchase\n    // document it produces would carry no `buyerOrgId`, and a half-populated\n    // org field is a worse premise for an entitlement than an absent one —\n    // the gate would have to guess whether a missing value means \"legacy,\n    // grandfathered\" or \"modern, but nobody wrote it\".\n    //\n    // Resolved through `resolveOrgPermissions`, not from the body and not from\n    // `hostIndex`. The old derivation was `hostId` → `hostIndex.orgId` with no\n    // membership test at all, which is a real hole once the field grants\n    // anything: post any host id and the purchase would be stamped with an org\n    // the buyer has no standing in, entitling strangers. This is the same\n    // resolution the seven install routes and `connect.ts` use, so the org\n    // that gets the licence is by construction an org the buyer could install\n    // into.\n    //\n    // `installPlugins` rather than a bare membership: buying is the act of\n    // acquiring something to install, and a viewer who cannot install must not\n    // be able to spend the workspace's money on one. It is also what keeps\n    // this door and the install door agreeing about who the licence is for.\n    const membership = await resolveOrgPermissions(decoded.uid, {\n      orgId: requestedOrgId || null,\n      hostId: requestedOrgId ? null : hostId || null,\n    })\n    const buyerOrgId = membership.orgId ?? ''\n    if (!buyerOrgId) {\n      return res.status(400).json({\n        error:\n          'A purchase is licensed to an organization — open the marketplace ' +\n          'from the workspace you are buying for.',\n      })\n    }\n    if (requestedOrgId && buyerOrgId !== requestedOrgId) {\n      return res.status(403).json({ error: 'Not a member of that organization' })\n    }\n    if (!membership.permissions.installPlugins) {\n      return res.status(403).json({\n        error:\n          'Your organization role does not allow installing from the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const listingSnapshot = await firestore\n      .collection('marketplaceListings')\n      .doc(listingId)\n      .get()\n    const listing = listingSnapshot.data() as any\n    if (!listing || listing.deletedAt) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    // Review gating holds on the PAID path too (AGL-1543): browse hides\n    // rejected/submitted/in_review listings, so a direct checkout call must\n    // not be a side door that takes money for one. Absent = legacy = listed\n    // (AGL-432), and the same 404 as an unknown listing — purchasability is\n    // not a probe for review state.\n    const reviewStatus = listing.reviewStatus as string | undefined\n    if (reviewStatus && reviewStatus !== 'listed' && reviewStatus !== 'verified') {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    // A TAKEN-DOWN or PRIVATE listing is not on sale (AGL-2288).\n    //\n    // The check above is a hand-rolled subset of `isListingBrowsable`, and\n    // the two lines it dropped are the two that matter here: `hiddenAt` and\n    // `isPrivateListing`. A staff takedown does NOT set a blocking\n    // `reviewStatus` — `plugin-reviews` demotes a verified listing to\n    // `VERIFIED_STRIPPED_STATUS`, which is literally `'listed'` — so after a\n    // takedown this route read `reviewStatus: 'listed'` and sold the listing\n    // in full, while `install-plugin` refused the very same listing at\n    // `hiddenAt` with a 404. The buyer was charged for something the platform\n    // had already decided nobody may install, and the only way out was a\n    // refund — which is Aglyn's Stripe fee, Aglyn's support time, and (until\n    // the partial-refund fix) a real hole in the split.\n    //\n    // Both tests are kept rather than replaced by the shared predicate: for a\n    // NON-plugin artifact `isListingBrowsable` returns true whatever the\n    // review status says, because pre-publication review is plugin-only. This\n    // route has always been stricter than that, and a sale is the wrong place\n    // to loosen a gate.\n    //\n    // No owner exemption, unlike the install routes: `canActAsPublisher`\n    // below already refuses a publisher buying their own listing, so the\n    // buyer here is never the owner.\n    if (!isListingBrowsable(listing) || isPrivateListing(listing)) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    const priceUsd = Number(listing.priceUsd ?? 0)\n    if (!(priceUsd > 0)) {\n      return res.status(400).json({ error: 'Listing is free' })\n    }\n    // Publishing is org-owned (AGL-652): `profileId` IS the publisher org id.\n    const sellerOrgId = String(listing.profileId ?? '')\n    if (await canActAsPublisher(firestore, decoded.uid, sellerOrgId)) {\n      return res.status(400).json({ error: 'Your organization published this listing' })\n    }\n    // You cannot buy the same component twice (AGL-1697).\n    //\n    // This route validated review status, self-purchase and the seller's\n    // entitlements, and then never asked the one question the buyer cares\n    // about: do they already own it. A marketplace listing is a buy-once good —\n    // a second purchase buys nothing, since `requirePurchase` is satisfied by\n    // the first — so a buyer who clicked Buy again from a stale tab, or came\n    // back through a bookmarked checkout, was simply charged twice for it.\n    //\n    // Deliberately the SAME predicate the seven install routes gate on\n    // (AGL-1546/1699) rather than a second query beside it: \"has this buyer\n    // paid for this listing\" must have one answer, or the marketplace can take\n    // money for something it will not install, or refuse to sell something it\n    // will not install either. That predicate reads a fully REFUNDED purchase\n    // as absent, which is exactly right here too — a refunded buyer must be\n    // able to buy again, and a refunded row sitting beside a live one does not\n    // veto it.\n    //\n    // 409 rather than 400: nothing about the request is malformed, the buyer\n    // is just asking for a state that already holds.\n    //\n    // KEYED ON THE ORGANIZATION SINCE AGL-2331, and that is what turns this\n    // guard from a blocked sale back into a real one. A licence belongs to a\n    // workspace, so an agency developer who bought a component for one client\n    // must be able to buy it again for the next — the person-keyed version of\n    // this check answered `409 already_purchased` to exactly the second sale\n    // we want. It still refuses the case it was written for: the same\n    // workspace buying the same listing twice.\n    //\n    // A pre-AGL-2331 purchase still refuses, through the legacy grant inside\n    // the shared predicate: that buyer can already install this listing\n    // anywhere, so selling them a second copy would take money for nothing.\n    if (\n      await hasLivePurchase({\n        firestore,\n        buyerUid: decoded.uid,\n        buyerOrgId,\n        listingId,\n      })\n    ) {\n      return res.status(409).json({\n        error:\n          'This organization already owns this listing — install it from ' +\n          'your library.',\n        code: 'already_purchased',\n      })\n    }\n    // The kill switch, on the SELL side too (AGL-2288).\n    //\n    // `revocations/{listingId}` with `versions: 'all'` is the listing-wide\n    // kill: `install-plugin` 409s on it through this same predicate, and the\n    // tenant runtime renders the disabled placeholder for anything already\n    // pinned. Selling into that state takes money for an artifact the\n    // platform has switched off.\n    //\n    // Only `'all'` is consulted, deliberately. A per-version revocation\n    // (AGL-1085) stops one build while other approved versions stay\n    // installable, and refusing the sale for it would turn a targeted control\n    // into a de-listing. Whether the newest approved version happens to be\n    // the revoked one is a question `install-plugin` answers with live data;\n    // duplicating that resolution here would be a second copy of it.\n    //\n    // One extra read on a path that already makes several Firestore and\n    // Stripe round trips, and it is the cheap half of the takedown check\n    // above: a hand-written revocation doc — which the rules permit any staff\n    // client to write — is caught here even when `hiddenAt` was never set.\n    const revocation = (\n      await firestore.collection('revocations').doc(listingId).get()\n    ).data() as PluginRevocation | undefined\n    if (isListingWideRevocation(revocation)) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    const publisher = await resolvePublisherProfile(firestore, sellerOrgId)\n    const accountId = publisher?.stripeAccountId\n    if (\n      !connectLinkageIsReady(\n        {\n          accountId,\n          chargesEnabled: publisher?.stripeChargesEnabled,\n          accountLivemode: publisher?.stripeAccountLivemode,\n        },\n        { subject: `marketplace publisher org ${sellerOrgId}` },\n      )\n    ) {\n      return res\n        .status(409)\n        .json({ error: 'The publisher has not enabled payouts yet' })\n    }\n\n    // The platform's cut comes from ENTITLEMENTS (AGL-1543), never the raw\n    // `plan` field: `resolveMarketplaceFeePct` prices a dead subscription\n    // as free-plan (30%) while the stale field still says pro, and honors\n    // a negotiated per-org `marketplaceFeePct` override. Same read gates\n    // SALE time on `marketplaceSelling` — publish already refuses without\n    // it, and a publisher who downgrades must stop selling, not merely\n    // stop publishing. Resolved per request; entitlements are never cached.\n    const sellerOrgDoc = await firestore.collection('orgs').doc(sellerOrgId).get()\n    const sellerOrg = (sellerOrgDoc.data() ?? {}) as any\n    if (!checkEntitlement(sellerOrg, 'marketplaceSelling')) {\n      return res.status(409).json({\n        error:\n          \"The publisher's current plan does not include marketplace selling\",\n      })\n    }\n    const feePercent = resolveMarketplaceFeePct(sellerOrg)\n    const amountCents = Math.round(priceUsd * 100)\n    const feeCents = Math.round((amountCents * feePercent) / 100)\n\n    const origin = req.headers.origin ?? `https://${req.headers.host}`\n    // Stripe returns the BUYER to the org marketplace (AGL-775) — the\n    // per-site marketplace page it used to land on was retired. Only the\n    // buyer's org slug is needed now (`sellerOrgId` is the wrong org), and\n    // it's resolved from the host here since server code cannot call\n    // useConsoleHostRoute. `/manage/marketplace` is the hostless fallback.\n    //\n    // The slug comes off the VALIDATED buyer org resolved at the top of the\n    // handler now (AGL-2331) rather than a second, unvalidated `hostIndex`\n    // read: one org id decides where the buyer lands, which org the licence\n    // entitles, and which org's erasure sweeps the idempotency claim, so\n    // having two derivations of it was a way for those three to disagree.\n    const buyerOrgSlug = (\n      await firestore.collection('orgs').doc(buyerOrgId).get()\n    ).get('slug') as string | undefined\n    const returnPath = buyerOrgSlug\n      ? buildRoute(Route.ORG_MARKETPLACE, { orgSlug: buyerOrgSlug })\n      : Route.ORG_MARKETPLACE\n    // Tax + funds flow (AGL-1544). Aglyn registered as a marketplace\n    // provider with the Texas Comptroller: it collects and remits sales tax\n    // on sellers' behalf. That is the PLATFORM's charge — no `on_behalf_of`,\n    // `automatic_tax` on the platform session, tax added ON TOP of the\n    // listing price (`tax_behavior: exclusive`) with a full billing address\n    // to compute from. The transfer is a FIXED amount (the seller's share of\n    // the pre-tax price) rather than `application_fee_amount`, because the\n    // fee form makes Stripe transfer `amount_total − fee` — and amount_total\n    // includes the tax, which must stay with the platform that owes it.\n    const transferCents = amountCents - feeCents\n    const params = new URLSearchParams({\n      mode: 'payment',\n      'line_items[0][quantity]': '1',\n      'line_items[0][price_data][currency]': 'usd',\n      'line_items[0][price_data][unit_amount]': String(amountCents),\n      'line_items[0][price_data][tax_behavior]': 'exclusive',\n      'line_items[0][price_data][product_data][name]': String(\n        listing.displayName ?? 'Marketplace component',\n      ).slice(0, 120),\n      // The classification, stated rather than inherited (AGL-1553). See\n      // MARKETPLACE_TAX_CODE above: same value the account preset carries, so\n      // the tax computed is unchanged, but it no longer depends on a Dashboard\n      // field owned by Aglyn's subscription products.\n      'line_items[0][price_data][product_data][tax_code]': MARKETPLACE_TAX_CODE,\n      'automatic_tax[enabled]': 'true',\n      billing_address_collection: 'required',\n      'payment_intent_data[transfer_data][destination]': String(accountId),\n      'payment_intent_data[transfer_data][amount]': String(transferCents),\n      // THE DISCRIMINATOR THE REFUND DOOR HAS NO OTHER WAY TO GET (AGL-2148).\n      //\n      // `metadata[type]` below rides on the SESSION, and `charge.refunded`\n      // never sees a session — its object is the charge. The platform\n      // endpoint receives `charge.refunded` for storefront orders and\n      // subscription charges too, so the webhook cannot tell a marketplace\n      // refund from any other one except by joining on the payment intent,\n      // which is exactly the join that comes up empty during the window this\n      // metadata exists to close (the purchase document is written by\n      // `checkout.session.completed`, and that delivery retries).\n      //\n      // Stripe copies a PaymentIntent's metadata onto the charge it creates,\n      // so stamping it here makes `charge.metadata.type` readable straight\n      // off the refund event — no Firestore join, no Stripe round trip, and\n      // no orphan record written for the commerce and subscription refunds\n      // that share this endpoint.\n      //\n      // `listingId`/`buyerUid` ride along for forensics only: an orphan that\n      // never drains is a support case, and the payment intent alone does not\n      // say whose purchase of what it was.\n      'payment_intent_data[metadata][type]': 'marketplace-purchase',\n      'payment_intent_data[metadata][listingId]': listingId,\n      'payment_intent_data[metadata][buyerUid]': decoded.uid,\n      'payment_intent_data[metadata][buyerOrgId]': buyerOrgId,\n      success_url: `${origin}${returnPath}?purchase=success`,\n      cancel_url: `${origin}${returnPath}?purchase=canceled`,\n      client_reference_id: decoded.uid,\n      'metadata[type]': 'marketplace-purchase',\n      'metadata[listingId]': listingId,\n      'metadata[buyerUid]': decoded.uid,\n      // THE ORG THE LICENCE IS FOR (AGL-2331). The webhook writes the\n      // purchase document from this metadata and had no buyer org to write,\n      // which is why the entitlement could only ever be person-scoped: the\n      // one field the gate needs was never carried across the Stripe\n      // boundary. Validated above against the caller's own membership, so a\n      // session can never license an org the buyer has no standing in.\n      'metadata[buyerOrgId]': buyerOrgId,\n      'metadata[sellerOrgId]': sellerOrgId,\n      'metadata[feeCents]': String(feeCents),\n      'metadata[transferCents]': String(transferCents),\n      // The buyer's GA client id (AGL-1638), so the server-side `purchase`\n      // the webhook sends joins the browser session that produced it. The\n      // webhook has always READ `metadata.ga_client_id`; nothing wrote it,\n      // so the read was dead and every marketplace sale fell through to a\n      // synthesized, sessionless GA user — making plugin revenue permanently\n      // unattributable to any channel.\n      //\n      // Carried on the SESSION rather than a subscription because this is a\n      // one-time payment; `checkout.session.completed` is where it is read.\n      //\n      // Validated to GA's `<digits>.<digits>` shape and dropped otherwise:\n      // the value is client-supplied and ends up in Stripe metadata, so it is\n      // not accepted on trust. Same guard /api/billing/checkout applies.\n      ...(/^\\d+\\.\\d+$/.test(String(req.body?.gaClientId ?? ''))\n        ? { 'metadata[ga_client_id]': String(req.body.gaClientId) }\n        : {}),\n      ...(decoded.email ? { customer_email: decoded.email } : {}),\n    })\n    // Point of no return (AGL-1697). The purchase check above closes the\n    // SEQUENTIAL duplicate — a second buy after the webhook has written the\n    // first purchase — and cannot close the concurrent one, because between two\n    // clicks a second apart there is no purchase record yet to find. The claim\n    // is what covers that window: `create()` on a document Firestore refuses to\n    // create twice.\n    //\n    // Scoped to the listing AND the buyer, so two people buying the same\n    // component at the same moment never contend, and one person's two tabs\n    // always do.\n    //\n    // The claim is taken here rather than at the top so that every deterministic\n    // refusal above it — unknown listing, free listing, self-purchase, already\n    // owned, publisher not paid out, seller cannot sell — answers without\n    // burning the key. Those are all states a buyer or publisher fixes and then\n    // presses the same button again.\n    const claimed = await claimAttempt(firestore, {\n      kind: 'marketplace-checkout',\n      // Scoped to the ORG as well as the buyer since AGL-2331. The scope is\n      // what decides which two attempts are allowed to contend, and a\n      // licence for one workspace and a licence for another are now two\n      // different goods — an agency owner buying for two clients from two\n      // tabs must not have one of them read as a double-click of the other.\n      scopeId: `${listingId}:${buyerOrgId}:${decoded.uid}`,\n      // The BUYER's org, so `eraseOrgIdempotencyKeys` sweeps this with the\n      // buyer's data (AGL-1448) — the seller keeps the sale.\n      orgId: buyerOrgId,\n      key: idempotencyKey,\n      busyMessage: 'This purchase is already being processed',\n    })\n    if ('replay' in claimed) {\n      return res.status(claimed.replay.status).json(claimed.replay.body)\n    }\n    claim = claimed.claim\n\n    const response = await fetch(\n      'https://api.stripe.com/v1/checkout/sessions',\n      {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n          'Content-Type': 'application/x-www-form-urlencoded',\n          // The half that costs real money. Stripe replays the existing\n          // session for a repeated key instead of opening a second one, which\n          // covers the window where our own claim is written but the response\n          // never arrives — the failure this route was most exposed to, since\n          // it writes nothing of its own to reconcile against.\n          ...(claim.stripeKey ? { 'Idempotency-Key': claim.stripeKey } : {}),\n        },\n        body: params.toString(),\n      },\n    )\n    const session = (await response.json()) as { url?: string; error?: any }\n    if (!response.ok || !session.url) {\n      console.error('Stripe checkout error', session.error)\n      // The purchase did not start — let the same key be tried again rather\n      // than locking this buyer out of this listing over one flaky moment.\n      await claim.release()\n      return res.status(502).json({ error: 'Stripe checkout failed' })\n    }\n    const payload = { url: session.url }\n    // A repeat of this attempt now replays the SAME session url. Better than\n    // refusing it: the buyer lands back on the checkout they already had open.\n    await claim.record(200, payload)\n    return res.status(200).json(payload)\n  } catch (error) {\n    console.error(error)\n    // Release on the way out so a transient failure does not strand the key\n    // and lock the buyer out of this listing until they reload.\n    await claim?.release()\n    return res.status(500).json({ error: 'Checkout failed' })\n  }\n}\n"],"names":["firebaseAdmin","connectLinkageIsReady","buildRoute","checkEntitlement","claimAttempt","isListingWideRevocation","resolveMarketplaceFeePct","Route","resolveOrgPermissions","isListingBrowsable","isPrivateListing","canActAsPublisher","resolvePublisherProfile","hasLivePurchase","MARKETPLACE_TAX_CODE","checkoutHandler","req","res","method","status","json","error","process","env","STRIPE_SECRET_KEY","listingId","String","body","hostId","requestedOrgId","orgId","idempotencyKey","headers","trim","slice","authorization","idToken","startsWith","length","undefined","claim","membership","listing","sellerOrgDoc","decoded","app","auth","verifyIdToken","uid","buyerOrgId","permissions","installPlugins","firestore","listingSnapshot","collection","doc","get","data","deletedAt","reviewStatus","priceUsd","Number","sellerOrgId","profileId","buyerUid","code","revocation","publisher","accountId","stripeAccountId","chargesEnabled","stripeChargesEnabled","accountLivemode","stripeAccountLivemode","subject","sellerOrg","feePercent","amountCents","Math","round","feeCents","origin","host","buyerOrgSlug","returnPath","ORG_MARKETPLACE","orgSlug","transferCents","params","URLSearchParams","mode","displayName","billing_address_collection","success_url","cancel_url","client_reference_id","test","gaClientId","email","customer_email","claimed","kind","scopeId","key","busyMessage","replay","response","fetch","Authorization","stripeKey","toString","session","ok","url","console","release","payload","record"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,qBAAqB,QAAQ,sDAAqD;AAC3F,SACEC,UAAU,EACVC,gBAAgB,EAChBC,YAAY,EACZC,uBAAuB,EACvBC,wBAAwB,EACxBC,KAAK,QAIA,sBAAqB;AAC5B,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,kBAAkB,EAAEC,gBAAgB,QAAQ,0BAAsB;AAC3E,SACEC,iBAAiB,EACjBC,uBAAuB,QAClB,yBAAqB;AAC5B,SAASC,eAAe,QAAQ,4BAAwB;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CC,GACD,OAAO,MAAMC,uBAAuB,gBAAe;AAEnD;;;;;;;;;CASC,GACD,OAAO,MAAMC,kBAAoC,OAAOC,KAAKC;4BAmBzDD,OAAAA,6BAM2BA;QAhBJA,WACHA,YAIQA;IAb9B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI,CAACC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOP,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAoD;IACvE;IACA,MAAMI,YAAYC,gBAAOV,YAAAA,IAAIW,IAAI,qBAARX,UAAUS,SAAS,mBAAI;IAChD,MAAMG,SAASF,iBAAOV,aAAAA,IAAIW,IAAI,qBAARX,WAAUY,MAAM,oBAAI;IAC1C,wEAAwE;IACxE,6EAA6E;IAC7E,yEAAyE;IACzE,MAAMC,iBAAiBH,iBAAOV,aAAAA,IAAIW,IAAI,qBAARX,WAAUc,KAAK,oBAAI;IACjD,0EAA0E;IAC1E,0EAA0E;IAC1E,iCAAiC;IACjC,MAAMC,iBAAiBL,QACrBV,SAAAA,8BAAAA,IAAIgB,OAAO,CAAC,kBAAkB,YAA9BhB,8BAAkCA,IAAIgB,OAAO,CAAC,kBAAkB,YAAhEhB,QAAoE,IAEnEiB,IAAI,GACJC,KAAK,CAAC,GAAG;IACZ,IAAI,CAACT,WAAW,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAoB;IAEzE,MAAMc,gBAAgBT,QAAOV,6BAAAA,IAAIgB,OAAO,CAACG,aAAa,YAAzBnB,6BAA6B;IAC1D,MAAMoB,UAAUD,cAAcE,UAAU,CAAC,aACrCF,cAAcD,KAAK,CAAC,UAAUI,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAImB,QAA6B;IACjC,IAAI;YA8BiBC,mBA6DKC,mBAKGA,oBAqGRC,oBAWJ3B,qBAmCX0B;YAgE2B1B;QAlT/B,MAAM4B,UAAU,MAAM5C,cAAc6C,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACX;QAC/D,2CAA2C;QAC3C,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,qEAAqE;QACrE,2EAA2E;QAC3E,sEAAsE;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,QAAQ;QACR,EAAE;QACF,uEAAuE;QACvE,2EAA2E;QAC3E,uEAAuE;QACvE,wEAAwE;QACxE,MAAMK,aAAa,MAAMjC,sBAAsBoC,QAAQI,GAAG,EAAE;YAC1DlB,OAAOD,kBAAkB;YACzBD,QAAQC,iBAAiB,OAAOD,UAAU;QAC5C;QACA,MAAMqB,cAAaR,oBAAAA,WAAWX,KAAK,YAAhBW,oBAAoB;QACvC,IAAI,CAACQ,YAAY;YACf,OAAOhC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,sEACA;YACJ;QACF;QACA,IAAIQ,kBAAkBoB,eAAepB,gBAAgB;YACnD,OAAOZ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAoC;QAC3E;QACA,IAAI,CAACoB,WAAWS,WAAW,CAACC,cAAc,EAAE;YAC1C,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE;YACJ;QACF;QACA,MAAM+B,YAAYpD,cAAc6C,GAAG,GAAGO,SAAS;QAC/C,MAAMC,kBAAkB,MAAMD,UAC3BE,UAAU,CAAC,uBACXC,GAAG,CAAC9B,WACJ+B,GAAG;QACN,MAAMd,UAAUW,gBAAgBI,IAAI;QACpC,IAAI,CAACf,WAAWA,QAAQgB,SAAS,EAAE;YACjC,OAAOzC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,gCAAgC;QAChC,MAAMsC,eAAejB,QAAQiB,YAAY;QACzC,IAAIA,gBAAgBA,iBAAiB,YAAYA,iBAAiB,YAAY;YAC5E,OAAO1C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,6DAA6D;QAC7D,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,+DAA+D;QAC/D,kEAAkE;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,oDAAoD;QACpD,EAAE;QACF,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,oBAAoB;QACpB,EAAE;QACF,qEAAqE;QACrE,qEAAqE;QACrE,iCAAiC;QACjC,IAAI,CAACZ,mBAAmBiC,YAAYhC,iBAAiBgC,UAAU;YAC7D,OAAOzB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAMuC,WAAWC,QAAOnB,oBAAAA,QAAQkB,QAAQ,YAAhBlB,oBAAoB;QAC5C,IAAI,CAAEkB,CAAAA,WAAW,CAAA,GAAI;YACnB,OAAO3C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,0EAA0E;QAC1E,MAAMyC,cAAcpC,QAAOgB,qBAAAA,QAAQqB,SAAS,YAAjBrB,qBAAqB;QAChD,IAAI,MAAM/B,kBAAkByC,WAAWR,QAAQI,GAAG,EAAEc,cAAc;YAChE,OAAO7C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA2C;QAClF;QACA,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,EAAE;QACF,mEAAmE;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,WAAW;QACX,EAAE;QACF,yEAAyE;QACzE,iDAAiD;QACjD,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,2CAA2C;QAC3C,EAAE;QACF,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,IACE,MAAMR,gBAAgB;YACpBuC;YACAY,UAAUpB,QAAQI,GAAG;YACrBC;YACAxB;QACF,IACA;YACA,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,mEACA;gBACF4C,MAAM;YACR;QACF;QACA,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,kEAAkE;QAClE,6BAA6B;QAC7B,EAAE;QACF,oEAAoE;QACpE,gEAAgE;QAChE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,iEAAiE;QACjE,EAAE;QACF,oEAAoE;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAMC,aAAa,AACjB,CAAA,MAAMd,UAAUE,UAAU,CAAC,eAAeC,GAAG,CAAC9B,WAAW+B,GAAG,EAAC,EAC7DC,IAAI;QACN,IAAIpD,wBAAwB6D,aAAa;YACvC,OAAOjD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAM8C,YAAY,MAAMvD,wBAAwBwC,WAAWU;QAC3D,MAAMM,YAAYD,6BAAAA,UAAWE,eAAe;QAC5C,IACE,CAACpE,sBACC;YACEmE;YACAE,cAAc,EAAEH,6BAAAA,UAAWI,oBAAoB;YAC/CC,eAAe,EAAEL,6BAAAA,UAAWM,qBAAqB;QACnD,GACA;YAAEC,SAAS,CAAC,0BAA0B,EAAEZ,aAAa;QAAC,IAExD;YACA,OAAO7C,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAA4C;QAC/D;QAEA,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,wEAAwE;QACxE,MAAMsB,eAAe,MAAMS,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACO,aAAaN,GAAG;QAC5E,MAAMmB,aAAahC,qBAAAA,aAAac,IAAI,cAAjBd,qBAAuB,CAAC;QAC3C,IAAI,CAACxC,iBAAiBwE,WAAW,uBAAuB;YACtD,OAAO1D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE;YACJ;QACF;QACA,MAAMuD,aAAatE,yBAAyBqE;QAC5C,MAAME,cAAcC,KAAKC,KAAK,CAACnB,WAAW;QAC1C,MAAMoB,WAAWF,KAAKC,KAAK,CAAC,AAACF,cAAcD,aAAc;QAEzD,MAAMK,UAASjE,sBAAAA,IAAIgB,OAAO,CAACiD,MAAM,YAAlBjE,sBAAsB,CAAC,QAAQ,EAAEA,IAAIgB,OAAO,CAACkD,IAAI,EAAE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,uEAAuE;QACvE,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,MAAMC,eAAe,AACnB,CAAA,MAAM/B,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACN,YAAYO,GAAG,EAAC,EACvDA,GAAG,CAAC;QACN,MAAM4B,aAAaD,eACfjF,WAAWK,MAAM8E,eAAe,EAAE;YAAEC,SAASH;QAAa,KAC1D5E,MAAM8E,eAAe;QACzB,iEAAiE;QACjE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,MAAME,gBAAgBV,cAAcG;QACpC,MAAMQ,SAAS,IAAIC,gBAAgB;YACjCC,MAAM;YACN,2BAA2B;YAC3B,uCAAuC;YACvC,0CAA0ChE,OAAOmD;YACjD,2CAA2C;YAC3C,iDAAiDnD,QAC/CgB,uBAAAA,QAAQiD,WAAW,YAAnBjD,uBAAuB,yBACvBR,KAAK,CAAC,GAAG;YACX,mEAAmE;YACnE,wEAAwE;YACxE,yEAAyE;YACzE,gDAAgD;YAChD,qDAAqDpB;YACrD,0BAA0B;YAC1B8E,4BAA4B;YAC5B,mDAAmDlE,OAAO0C;YAC1D,8CAA8C1C,OAAO6D;YACrD,wEAAwE;YACxE,EAAE;YACF,qEAAqE;YACrE,gEAAgE;YAChE,gEAAgE;YAChE,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,gEAAgE;YAChE,4DAA4D;YAC5D,EAAE;YACF,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,4BAA4B;YAC5B,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,qCAAqC;YACrC,uCAAuC;YACvC,4CAA4C9D;YAC5C,2CAA2CmB,QAAQI,GAAG;YACtD,6CAA6CC;YAC7C4C,aAAa,GAAGZ,SAASG,WAAW,iBAAiB,CAAC;YACtDU,YAAY,GAAGb,SAASG,WAAW,kBAAkB,CAAC;YACtDW,qBAAqBnD,QAAQI,GAAG;YAChC,kBAAkB;YAClB,uBAAuBvB;YACvB,sBAAsBmB,QAAQI,GAAG;YACjC,gEAAgE;YAChE,sEAAsE;YACtE,qEAAqE;YACrE,+DAA+D;YAC/D,sEAAsE;YACtE,iEAAiE;YACjE,wBAAwBC;YACxB,yBAAyBa;YACzB,sBAAsBpC,OAAOsD;YAC7B,2BAA2BtD,OAAO6D;WAc9B,aAAaS,IAAI,CAACtE,iBAAOV,aAAAA,IAAIW,IAAI,qBAARX,WAAUiF,UAAU,oBAAI,OACjD;YAAE,0BAA0BvE,OAAOV,IAAIW,IAAI,CAACsE,UAAU;QAAE,IACxD,CAAC,GACDrD,QAAQsD,KAAK,GAAG;YAAEC,gBAAgBvD,QAAQsD,KAAK;QAAC,IAAI,CAAC;QAE3D,qEAAqE;QACrE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,gBAAgB;QAChB,EAAE;QACF,qEAAqE;QACrE,wEAAwE;QACxE,aAAa;QACb,EAAE;QACF,6EAA6E;QAC7E,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,iCAAiC;QACjC,MAAME,UAAU,MAAMhG,aAAagD,WAAW;YAC5CiD,MAAM;YACN,sEAAsE;YACtE,gEAAgE;YAChE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtEC,SAAS,GAAG7E,UAAU,CAAC,EAAEwB,WAAW,CAAC,EAAEL,QAAQI,GAAG,EAAE;YACpD,qEAAqE;YACrE,uDAAuD;YACvDlB,OAAOmB;YACPsD,KAAKxE;YACLyE,aAAa;QACf;QACA,IAAI,YAAYJ,SAAS;YACvB,OAAOnF,IAAIE,MAAM,CAACiF,QAAQK,MAAM,CAACtF,MAAM,EAAEC,IAAI,CAACgF,QAAQK,MAAM,CAAC9E,IAAI;QACnE;QACAa,QAAQ4D,QAAQ5D,KAAK;QAErB,MAAMkE,WAAW,MAAMC,MACrB,+CACA;YACEzF,QAAQ;YACRc,SAAS;gBACP4E,eAAe,CAAC,OAAO,EAAEtF,QAAQC,GAAG,CAACC,iBAAiB,EAAE;gBACxD,gBAAgB;eAMZgB,MAAMqE,SAAS,GAAG;gBAAE,mBAAmBrE,MAAMqE,SAAS;YAAC,IAAI,CAAC;YAElElF,MAAM6D,OAAOsB,QAAQ;QACvB;QAEF,MAAMC,UAAW,MAAML,SAAStF,IAAI;QACpC,IAAI,CAACsF,SAASM,EAAE,IAAI,CAACD,QAAQE,GAAG,EAAE;YAChCC,QAAQ7F,KAAK,CAAC,yBAAyB0F,QAAQ1F,KAAK;YACpD,sEAAsE;YACtE,qEAAqE;YACrE,MAAMmB,MAAM2E,OAAO;YACnB,OAAOlG,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QACA,MAAM+F,UAAU;YAAEH,KAAKF,QAAQE,GAAG;QAAC;QACnC,yEAAyE;QACzE,2EAA2E;QAC3E,MAAMzE,MAAM6E,MAAM,CAAC,KAAKD;QACxB,OAAOnG,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAACgG;IAC9B,EAAE,OAAO/F,OAAO;QACd6F,QAAQ7F,KAAK,CAACA;QACd,wEAAwE;QACxE,4DAA4D;QAC5D,OAAMmB,yBAAAA,MAAO2E,OAAO;QACpB,OAAOlG,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;AACF,EAAC"}

package/src/lib/server/connect.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Stripe Connect onboarding for marketplace publishers (AGL-46): creates an
+ * Express account on first call (id stored on the profile via Admin SDK),
+ * refreshes `stripeChargesEnabled` on every call, and returns an
+ * account-link URL while onboarding is incomplete. 501 without Stripe env.
+ */
+export declare const connectHandler: PluginApiHandler;