@mj-biz-apps/orders-core-entities-server 0.0.1 → 5.2.0

package/dist/PaymentWebhookHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PaymentWebhookHandler.d.ts","sourceRoot":"","sources":["../src/PaymentWebhookHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAGH,iBAAiB,EAKjB,QAAQ,EACX,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAYvF,MAAM,WAAW,cAAc;IAC3B,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC5B,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,2CAA2C;IAC3C,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAA;KAAE,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACtC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,GACf,OAAO,CAAC,eAAe,CAAC,CAoF1B;AAiHD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAC/B,OAAO,EAAE,MAAM;IAAE,QAAQ,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC/D,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAiBtE;AAED,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC/C;AAED,iCAAiC;AACjC,MAAM,WAAW,mBAAmB;IAChC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvD"}

package/dist/PaymentWebhookHandler.js

@@ -0,0 +1,246 @@
+/**
+ * PaymentWebhookHandler — the unauthenticated door, and everything that makes it safe to open.
+ *
+ * THE ROUTE HAS NO AUTHENTICATION, by necessity (D19). Stripe will not present a bearer token; the
+ * signature IS the credential. Every guard below exists because of that.
+ *
+ * TRANSPORT-AGNOSTIC ON PURPOSE. This is a function over `(rawBody, headers)` returning a status and a
+ * body, not an Express handler. Two reasons. It is unit-testable without standing up a server, which
+ * matters because the interesting cases are a forged signature and a replayed event — neither of which
+ * you want to be exercising through HTTP. And the host application owns its middleware order: the route
+ * must be mounted BEFORE the auth middleware and with a raw-body parser, and only the bootstrap knows
+ * how to do that. `MountPaymentWebhook` at the bottom is the thin adapter.
+ *
+ * THE RAW BODY IS LOAD-BEARING. The signature covers the exact bytes sent. A JSON round-trip — key
+ * order, whitespace, unicode normalisation — invalidates it, so any parser that runs before this
+ * silently breaks every webhook. `express.raw({ type: 'application/json' })` on this path only.
+ *
+ * WHAT THE RESPONSE SAYS, AND WHY IT SAYS SO LITTLE. A 2xx means "we will not need this again". A
+ * gateway retries anything else, so:
+ *
+ *   200  applied, or ALREADY applied, or deliberately ignored — all three are settled
+ *   400  malformed or unverifiable — retrying will not help, so do not ask again
+ *   500  we failed to record a valid event — PLEASE retry, this one is ours
+ *
+ * The body carries no detail. A public endpoint that explains why a signature failed is an oracle for
+ * anyone probing it, and the reason belongs in our logs where it is useful and not in a response where
+ * it is a hint.
+ *
+ * CONNECTS TO:
+ *   PURE:   ./PaymentProviderBehavior.ts — signature, idempotency decision
+ *   LOOKUP: ./PaymentProviderResolver.ts
+ *   DOC:    plans/archive/bizapps-orders-master.md D19
+ */
+import { CompositeKey, LogError, LogStatus, RunView, } from '@memberjunction/core';
+import { DecideWebhookAction } from './PaymentProviderBehavior.js';
+import { SettlePaymentForEvent } from './PaymentSettlement.js';
+import { BuildPaymentProvider, LoadPaymentProviderConfig } from './PaymentProviderResolver.js';
+import { CheckoutSessionService } from './CheckoutSessionService.js';
+import { CHECKOUT_CAPTURE_TERMINAL_LOG_MARKER, webhookEventExceedsRetryWindow, } from './checkoutCaptureRetry.js';
+const PAYMENT_INTENT_ENTITY = 'MJ_BizApps_Orders: Payment Intents';
+/**
+ * Handle one delivery.
+ *
+ * The order of operations is the security model, and it is deliberate:
+ *
+ *   1. resolve the provider   — so we know which secret to verify against
+ *   2. VERIFY THE SIGNATURE   — before the payload is parsed, let alone trusted
+ *   3. parse                  — now that we know it came from the gateway
+ *   4. decide idempotently    — before anything is written
+ *   5. apply                  — inside a transaction
+ *
+ * Nothing before step 2 reads the payload. Parsing first would mean acting on attacker-controlled JSON
+ * to decide whether to trust attacker-controlled JSON.
+ */
+export async function HandlePaymentWebhook(request, provider, user) {
+    // ── 1. Which provider is this endpoint for? ────────────────────────────
+    let driver;
+    try {
+        const config = await LoadPaymentProviderConfig(request.PaymentProviderID, provider, user);
+        if (!config.Capabilities.SupportsWebhooks) {
+            LogError(`Webhook delivered for provider '${config.Name}', whose type does not support webhooks.`);
+            return { Status: 400, Body: { received: false } };
+        }
+        driver = await BuildPaymentProvider(config, provider, user);
+    }
+    catch (err) {
+        // An unknown or misconfigured provider is a 400: the gateway is calling a URL we cannot serve,
+        // and retrying will not change that.
+        LogError(`Webhook could not resolve provider ${request.PaymentProviderID}: ${err.message}`);
+        return { Status: 400, Body: { received: false } };
+    }
+    // ── 2. Is it really from them? ─────────────────────────────────────────
+    const verification = await driver.VerifyWebhook(request.RawBody, request.Headers);
+    if (!verification.Valid) {
+        // Logged in full, returned as nothing. This is the line between a useful log and an oracle.
+        LogError(`Rejected a webhook for provider ${request.PaymentProviderID}: ${verification.Reason ?? 'signature did not verify'}`);
+        return { Status: 400, Body: { received: false } };
+    }
+    // ── 3. Now it can be read. ─────────────────────────────────────────────
+    const event = driver.ParseWebhookEvent(request.RawBody);
+    if (!event) {
+        LogError(`A verified webhook for provider ${request.PaymentProviderID} could not be parsed.`);
+        return { Status: 400, Body: { received: false } };
+    }
+    // ── 4. Have we seen it, and do we care? ────────────────────────────────
+    const existing = await findIntent(event, provider, user);
+    const decision = DecideWebhookAction({
+        EventID: event.EventID,
+        EventKind: event.Kind,
+        AlreadySeen: existing?.ProviderEventID === event.EventID,
+        HandledKinds: driver.HandledEventKinds,
+        IntentKnown: existing != null,
+    });
+    if (decision.Action !== 'Apply') {
+        // Ignore / Reject stay 200 or 400 as before. AlreadyApplied is a settled *intent*
+        // stamp, not a settled checkout capture: if CapturePayment failed after confirm,
+        // Stripe's retry lands here and we still try to book (idempotent).
+        LogStatus(`Webhook ${event.EventID}: ${decision.Action} — ${decision.Reason}`);
+        if (decision.Action === 'AlreadyApplied' && existing) {
+            const booked = await bookCheckoutCaptureFromWebhook(event, existing.ID, user);
+            if (!booked) {
+                return { Status: 500, Body: { received: false } };
+            }
+        }
+        return { Status: 200, Body: { received: true, outcome: decision.Action } };
+    }
+    // ── 5. Apply it. ───────────────────────────────────────────────────────
+    try {
+        // SETTLEMENT RUNS FIRST, AND THE ORDER IS LOAD-BEARING. `applyEvent` stamps
+        // `ProviderEventID`, which is the idempotency key — so an event recorded BEFORE settlement
+        // that then failed to settle would be judged `AlreadyApplied` on every retry, and a payment
+        // the bank confirmed would sit `Pending` for ever with nothing left to move it. Settling
+        // first means a failure returns 500 with nothing stamped and the gateway asks again.
+        //
+        // Only for drivers that have SAID they settle late. A card driver never reaches this line, so
+        // the guarantee in `applyEvent`'s note — that a webhook cannot reach the ledger — still holds
+        // everywhere it held before. Checkout CapturePayment is a separate, explicit call below.
+        if (driver.SettlesAsynchronously) {
+            await SettlePaymentForEvent(event, existing.ID, provider, user);
+        }
+        await applyEvent(event, existing.ID, provider, user);
+        const booked = await bookCheckoutCaptureFromWebhook(event, existing.ID, user);
+        if (!booked) {
+            return { Status: 500, Body: { received: false } };
+        }
+        return { Status: 200, Body: { received: true, outcome: 'Apply' } };
+    }
+    catch (err) {
+        // OURS, not theirs. The event was valid and we failed to record it, so ask again — a 200 here
+        // would lose a real payment notification silently.
+        LogError(`Failed to apply webhook ${event.EventID}: ${err.message}`);
+        return { Status: 500, Body: { received: false } };
+    }
+}
+/**
+ * After the intent row reflects Succeeded, book CapturePayment for a Confirmed
+ * checkout session if the complete path failed to. No-op for back-office intents.
+ * Returns false when a checkout capture was attempted, did not book, and is
+ * Retryable inside the event-age window — caller 500s so Stripe retries.
+ * Terminal refusals (and events older than the window) return true after a
+ * CHECKOUT-CAPTURE-TERMINAL log so Stripe stops and a human can see it.
+ */
+async function bookCheckoutCaptureFromWebhook(event, paymentIntentID, user) {
+    if (event.Status !== 'Succeeded') {
+        return true;
+    }
+    try {
+        const book = await CheckoutSessionService.BookSettledCheckoutPaymentIfNeeded(paymentIntentID, user);
+        if (!(book.Attempted && !book.Booked)) {
+            return true;
+        }
+        const retryable = book.Retryable !== false;
+        if (retryable && !event.OccurredAt) {
+            LogError(`[CHECKOUT-CAPTURE-RETRY] Webhook event ${event.EventID} has no OccurredAt; retry window cannot be applied — treating as Retryable`);
+        }
+        const pastWindow = webhookEventExceedsRetryWindow(event);
+        if (retryable && !pastWindow) {
+            LogError(`Checkout CapturePayment did not book for intent ${paymentIntentID} (retryable): ${book.ErrorMessage ?? 'unknown error'}`);
+            return false;
+        }
+        LogError(`${CHECKOUT_CAPTURE_TERMINAL_LOG_MARKER} Settled checkout payment will not be retried via webhook` +
+            ` intent=${paymentIntentID} event=${event.EventID}` +
+            ` retryable=${retryable} pastWindow=${pastWindow}: ${book.ErrorMessage ?? 'unknown error'}`);
+        return true;
+    }
+    catch (err) {
+        LogError(`Checkout CapturePayment threw for intent ${paymentIntentID}: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
+/** The `PaymentIntent` row this event is about, if we opened it. */
+async function findIntent(event, provider, user) {
+    if (!event.ProviderIntentID)
+        return null;
+    // Escaped rather than interpolated raw: this value came off the wire. It is inside a verified
+    // payload, so it is not attacker-controlled in practice — but "verified" and "safe to concatenate
+    // into SQL" are different claims, and only one of them is being made here.
+    const safe = event.ProviderIntentID.replace(/'/g, "''");
+    const rv = new RunView(provider);
+    const result = await rv.RunView({
+        EntityName: PAYMENT_INTENT_ENTITY,
+        ExtraFilter: `ProviderIntentID = '${safe}'`,
+        ResultType: 'simple',
+    }, user);
+    return result?.Results?.[0] ?? null;
+}
+/**
+ * Record what the gateway told us.
+ *
+ * DELIBERATELY NARROW: this moves the `PaymentIntent` and nothing else. It does not capture the
+ * `PaymentHeader`, book cash, or touch allocations — `PaymentHeaderEntityServer` owns all of that, and a
+ * webhook that reached into it would give the gateway a second path into the ledger.
+ *
+ * The intent is the RECORD OF WHAT THE GATEWAY SAYS; promoting that into cash is a separate, deliberate
+ * step. `ProviderEventID` is stamped in the same save, which is what makes the next delivery of this
+ * event a no-op rather than a second application.
+ */
+async function applyEvent(event, paymentIntentID, provider, user) {
+    const intent = await provider.GetEntityObject(PAYMENT_INTENT_ENTITY, CompositeKey.FromID(paymentIntentID), user);
+    if (event.Status)
+        intent.Status = event.Status;
+    intent.ProviderEventID = event.EventID;
+    intent.LastEventAt = new Date();
+    if (!(await intent.Save())) {
+        throw new Error(`Could not record event ${event.EventID} against payment intent ${paymentIntentID}: ` +
+            `${intent.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+    }
+    LogStatus(`Payment intent ${paymentIntentID} is now ${event.Status ?? 'unchanged'} from event ${event.EventID}` +
+        `${event.FailureReason ? ` (${event.FailureReason})` : ''}`);
+}
+/**
+ * Mount the route on an Express-shaped app.
+ *
+ * Typed structurally rather than against `express`, so this package takes no dependency on it — the
+ * host already has one, and this file should not be the reason a shared server package pulls in a web
+ * framework.
+ *
+ * TWO THINGS THE CALLER MUST GET RIGHT, and neither can be enforced from here:
+ *
+ *   · Mount BEFORE the auth middleware. Stripe presents no token; auth would reject every delivery.
+ *   · Give this path a RAW body parser and nothing else. `express.json()` anywhere upstream re-encodes
+ *     the payload and every signature fails.
+ *
+ * ```ts
+ * app.post(
+ *     '/webhooks/payments/:providerId',
+ *     express.raw({ type: 'application/json' }),
+ *     MountPaymentWebhook(() => ({ provider: Metadata.Provider, user: systemUser })),
+ * );
+ * ```
+ */
+export function MountPaymentWebhook(context) {
+    return async (req, res) => {
+        const { provider, user } = context();
+        // `req.body` is a Buffer under a raw parser and a string if something already decoded it.
+        // Both are accepted; anything else has been through a JSON parser and cannot verify.
+        const rawBody = typeof req.body === 'string' ? req.body : String(req.body ?? '');
+        const result = await HandlePaymentWebhook({
+            RawBody: rawBody,
+            Headers: req.headers ?? {},
+            PaymentProviderID: req.params?.providerId ?? '',
+        }, provider, user);
+        res.status(result.Status).json(result.Body);
+    };
+}
+//# sourceMappingURL=PaymentWebhookHandler.js.map

package/dist/PaymentWebhookHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PaymentWebhookHandler.js","sourceRoot":"","sources":["../src/PaymentWebhookHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAEH,YAAY,EAGZ,QAAQ,EACR,SAAS,EACT,OAAO,GAEV,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACH,oCAAoC,EACpC,8BAA8B,GACjC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAgBnE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,OAAuB,EACvB,QAA2B,EAC3B,IAAc;IAEd,0EAA0E;IAC1E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YACxC,QAAQ,CAAC,mCAAmC,MAAM,CAAC,IAAI,0CAA0C,CAAC,CAAC;YACnG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,+FAA+F;QAC/F,qCAAqC;QACrC,QAAQ,CAAC,sCAAsC,OAAO,CAAC,iBAAiB,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,0EAA0E;IAC1E,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACtB,4FAA4F;QAC5F,QAAQ,CACJ,mCAAmC,OAAO,CAAC,iBAAiB,KAAK,YAAY,CAAC,MAAM,IAAI,0BAA0B,EAAE,CACvH,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,QAAQ,CAAC,mCAAmC,OAAO,CAAC,iBAAiB,uBAAuB,CAAC,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,WAAW,EAAE,QAAQ,EAAE,eAAe,KAAK,KAAK,CAAC,OAAO;QACxD,YAAY,EAAE,MAAM,CAAC,iBAAiB;QACtC,WAAW,EAAE,QAAQ,IAAI,IAAI;KAChC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,kFAAkF;QAClF,iFAAiF;QACjF,mEAAmE;QACnE,SAAS,CAAC,WAAW,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB,IAAI,QAAQ,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,CAAC;QACL,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC;QACD,4EAA4E;QAC5E,2FAA2F;QAC3F,4FAA4F;QAC5F,yFAAyF;QACzF,qFAAqF;QACrF,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,yFAAyF;QACzF,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,QAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,QAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,8FAA8F;QAC9F,mDAAmD;QACnD,QAAQ,CAAC,2BAA2B,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IACtD,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,8BAA8B,CACzC,KAAmB,EACnB,eAAuB,EACvB,IAAc;IAEd,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,kCAAkC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;QAC3C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACjC,QAAQ,CACJ,0CAA0C,KAAK,CAAC,OAAO,4EAA4E,CACtI,CAAC;QACN,CAAC;QACD,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3B,QAAQ,CACJ,mDAAmD,eAAe,iBAAiB,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAC5H,CAAC;YACF,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,QAAQ,CACJ,GAAG,oCAAoC,2DAA2D;YAC9F,WAAW,eAAe,UAAU,KAAK,CAAC,OAAO,EAAE;YACnD,cAAc,SAAS,eAAe,UAAU,KAAK,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAClG,CAAC;QACF,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,QAAQ,CACJ,4CAA4C,eAAe,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrH,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,UAAU,CACrB,KAAmB,EACnB,QAA2B,EAC3B,IAAc;IAEd,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACzC,8FAA8F;IAC9F,kGAAkG;IAClG,2EAA2E;IAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,uBAAuB,IAAI,GAAG;QAC3C,UAAU,EAAE,QAAQ;KACvB,EACD,IAAI,CACP,CAAC;IACF,OAAO,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,UAAU,CACrB,KAAmB,EACnB,eAAuB,EACvB,QAA2B,EAC3B,IAAc;IAEd,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,eAAe,CACzC,qBAAqB,EACrB,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,EACpC,IAAI,CACP,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC;IACvC,MAAM,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAEhC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACX,0BAA0B,KAAK,CAAC,OAAO,2BAA2B,eAAe,IAAI;YACjF,GAAG,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CACnE,CAAC;IACN,CAAC;IAED,SAAS,CACL,kBAAkB,eAAe,WAAW,KAAK,CAAC,MAAM,IAAI,WAAW,eAAe,KAAK,CAAC,OAAO,EAAE;QACjG,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAC/B,OAA8D;IAE9D,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,0FAA0F;QAC1F,qFAAqF;QACrF,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACrC;YACI,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;YAC1B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE;SAClD,EACD,QAAQ,EACR,IAAI,CACP,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC;AACN,CAAC"}

package/dist/PreviewPriceOperation.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Orders.PreviewPrice — what would this customer pay for this product, and why? (plan D69)
+ *
+ * THE ONE RULE THAT MATTERS: this is a one-line `OrderPricingService` call. Save, `Orders.PriceOrder`,
+ * and this operation share that walk. Calling `ResolvePrice` here used to be a second entry point;
+ * it could return base list while booking used the member list (IT PC14).
+ *
+ * Nothing is written. Lines are materialised with `NewRecord()` and never `Save()`'d — same as
+ * `Orders.PriceOrder`.
+ *
+ * The output is still one SKU's unit price and decomposition. Promotions / charges / tax that the
+ * walk also runs on a one-line order are not the contract of this operation (they need a full
+ * header; use `Orders.PriceOrder`). UnitPrice / ExtendedAmount come from the walk's line stamp.
+ *
+ * Refusals come back INSIDE the output as `Success: false`. Ambiguous rules and unpriced products
+ * are refusals, not faults.
+ */
+import { BaseRemotableOperation, IMetadataProvider, UserInfo } from '@memberjunction/core';
+export interface PreviewPriceInput {
+    ProductID: string;
+    /** Defaults to 1 — the common "what does one cost" question. */
+    Quantity?: number;
+    /** Who is buying. Either may be omitted; both omitted means base pricing. */
+    OrganizationID?: string | null;
+    PersonID?: string | null;
+    /** Defaults to now. Pass a future date to check a seasonal rate before it starts. */
+    AsOf?: string | Date;
+    /** Force a specific list, ignoring the customer's assignment — for "what if" comparisons. */
+    PriceListID?: string | null;
+    FeeType?: string;
+}
+/** One line of the explanation. */
+export interface PreviewComponent {
+    ComponentType: string;
+    Label: string;
+    Amount: number;
+    RunningTotal: number;
+}
+export interface PreviewPriceOutput {
+    Success: boolean;
+    Message?: string;
+    UnitPrice?: number;
+    ExtendedAmount?: number;
+    Quantity?: number;
+    /** The list that applied, and how it was arrived at. */
+    PriceListID?: string | null;
+    PriceListName?: string | null;
+    /** Which rule won, for a rule author checking their work. */
+    ProductPriceID?: string | null;
+    /** Which resolver answered — 'default', or a plugin key like `Company:<id>`. */
+    ResolvedBy?: string;
+    Components?: PreviewComponent[];
+}
+export declare class PreviewPriceOperation extends BaseRemotableOperation<PreviewPriceInput, PreviewPriceOutput> {
+    OperationKey: string;
+    protected InternalExecute(input: PreviewPriceInput, provider: IMetadataProvider, user: UserInfo): Promise<PreviewPriceOutput>;
+    private loadProduct;
+    private loadPriceListName;
+}
+/** Tree-shaking anchor — called from the server bootstrap so the registration is retained. */
+export declare function LoadPreviewPriceOperation(): void;
+//# sourceMappingURL=PreviewPriceOperation.d.ts.map

package/dist/PreviewPriceOperation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreviewPriceOperation.d.ts","sourceRoot":"","sources":["../src/PreviewPriceOperation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACH,sBAAsB,EACtB,iBAAiB,EAKjB,QAAQ,EACX,MAAM,sBAAsB,CAAC;AAQ9B,MAAM,WAAW,iBAAiB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACnC;AAED,qBACa,qBAAsB,SAAQ,sBAAsB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAC7F,YAAY,SAAyB;cAE5B,eAAe,CAC3B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,GACf,OAAO,CAAC,kBAAkB,CAAC;YA2GhB,WAAW;YAmBX,iBAAiB;CAclC;AAED,8FAA8F;AAC9F,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD"}

package/dist/PreviewPriceOperation.js

@@ -0,0 +1,161 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/**
+ * Orders.PreviewPrice — what would this customer pay for this product, and why? (plan D69)
+ *
+ * THE ONE RULE THAT MATTERS: this is a one-line `OrderPricingService` call. Save, `Orders.PriceOrder`,
+ * and this operation share that walk. Calling `ResolvePrice` here used to be a second entry point;
+ * it could return base list while booking used the member list (IT PC14).
+ *
+ * Nothing is written. Lines are materialised with `NewRecord()` and never `Save()`'d — same as
+ * `Orders.PriceOrder`.
+ *
+ * The output is still one SKU's unit price and decomposition. Promotions / charges / tax that the
+ * walk also runs on a one-line order are not the contract of this operation (they need a full
+ * header; use `Orders.PriceOrder`). UnitPrice / ExtendedAmount come from the walk's line stamp.
+ *
+ * Refusals come back INSIDE the output as `Success: false`. Ambiguous rules and unpriced products
+ * are refusals, not faults.
+ */
+import { BaseRemotableOperation, LogError, Metadata, RunView, } from '@memberjunction/core';
+import { RegisterClass } from '@memberjunction/global';
+import { OrderPricingService, PriceResolutionError, ResolvePriceListForCustomer } from '@mj-biz-apps/orders-entities';
+import { RequireOptionalUUID, RequireUUID } from './sql-guards.js';
+const ORDER_LINE_ENTITY = 'MJ_BizApps_Orders: Order Lines';
+let PreviewPriceOperation = class PreviewPriceOperation extends BaseRemotableOperation {
+    constructor() {
+        super(...arguments);
+        this.OperationKey = 'Orders.PreviewPrice';
+    }
+    async InternalExecute(input, provider, user) {
+        if (!input?.ProductID) {
+            return { Success: false, Message: 'ProductID is required.' };
+        }
+        // Caller-supplied ids reach SQL filter text downstream. Validated here,
+        // at the boundary, so every frame below this one can trust them.
+        RequireUUID(input.ProductID, 'ProductID');
+        RequireOptionalUUID(input.PriceListID, 'PriceListID');
+        RequireOptionalUUID(input.OrganizationID, 'OrganizationID');
+        RequireOptionalUUID(input.PersonID, 'PersonID');
+        const quantity = input.Quantity == null ? 1 : Number(input.Quantity);
+        if (!(quantity > 0)) {
+            return { Success: false, Message: `Quantity must be greater than zero (received ${input.Quantity}).` };
+        }
+        const product = await this.loadProduct(provider, user, input.ProductID);
+        if (!product) {
+            return { Success: false, Message: `Product ${input.ProductID} was not found.` };
+        }
+        const asOf = input.AsOf ? new Date(input.AsOf) : new Date();
+        if (Number.isNaN(asOf.getTime())) {
+            return { Success: false, Message: `AsOf is not a valid date (received ${String(input.AsOf)}).` };
+        }
+        const md = new Metadata();
+        const line = await md.GetEntityObject(ORDER_LINE_ENTITY, user);
+        line.NewRecord();
+        line.ProductID = input.ProductID;
+        line.Quantity = quantity;
+        const listCtx = {
+            ProductID: input.ProductID,
+            ProductCategoryID: product.ProductCategoryID,
+            CompanyID: product.CompanyID,
+            Quantity: quantity,
+            AsOf: asOf,
+            OrganizationID: input.OrganizationID ?? null,
+            PersonID: input.PersonID ?? null,
+            ...(input.PriceListID !== undefined ? { PriceListID: input.PriceListID } : {}),
+            ...(input.FeeType ? { FeeType: input.FeeType } : {}),
+        };
+        try {
+            const result = await new OrderPricingService({ Provider: provider, User: user }).Price({
+                OrderHeaderID: null,
+                CompanyID: product.CompanyID,
+                BillToPersonID: input.PersonID ?? null,
+                BillToOrganizationID: input.OrganizationID ?? null,
+                OrderDate: asOf,
+                ShipToAddressID: null,
+                Lines: [line],
+                PromotionCodes: [],
+                ManualDiscounts: [],
+                Charges: [],
+                ...(input.PriceListID !== undefined ? { PriceListID: input.PriceListID } : {}),
+                ...(input.FeeType ? { FeeType: input.FeeType } : {}),
+            });
+            const resolved = result.PriceComponents.get(line);
+            if (!resolved) {
+                return {
+                    Success: false,
+                    Message: `No price is configured for ${product.Name}. Add a ProductPrice for it — either a base ` +
+                        `price (no list) or one on the list this customer is assigned to.`,
+                    Quantity: quantity,
+                };
+            }
+            // Report the list actually in force, even when the winning rule was a base rule: "you are
+            // on WHOLESALE but this SKU has no wholesale rate" is the answer people are looking for.
+            const listID = resolved.PriceListID ?? (await ResolvePriceListForCustomer(listCtx, provider, user));
+            const listName = listID ? await this.loadPriceListName(provider, user, listID) : null;
+            return {
+                Success: true,
+                Message: `${product.Name} × ${quantity} = ${resolved.ExtendedAmount}` +
+                    (listName ? ` on price list ${listName}` : ' at base price'),
+                UnitPrice: resolved.UnitPrice,
+                ExtendedAmount: resolved.ExtendedAmount,
+                Quantity: quantity,
+                PriceListID: listID,
+                PriceListName: listName,
+                ProductPriceID: resolved.ProductPriceID,
+                ResolvedBy: resolved.ResolvedBy,
+                Components: resolved.Components.map((c) => ({
+                    ComponentType: c.ComponentType,
+                    Label: c.Label,
+                    Amount: c.Amount,
+                    RunningTotal: c.RunningTotal,
+                })),
+            };
+        }
+        catch (err) {
+            // Configuration problems (ambiguous rules, unpriced SKU) are REFUSALS with a reason, not
+            // faults. The walk throws those; mapping them here keeps the PreviewPrice contract.
+            const message = err instanceof Error ? err.message : String(err);
+            if (err instanceof PriceResolutionError || /cannot be priced|ambiguous/i.test(message)) {
+                return { Success: false, Message: message, Quantity: quantity };
+            }
+            LogError(err);
+            throw err;
+        }
+    }
+    async loadProduct(provider, user, id) {
+        const rv = new RunView(provider);
+        const res = await rv.RunView({
+            EntityName: 'MJ_BizApps_Orders: Products',
+            ExtraFilter: `ID = '${id}'`,
+            Fields: ['Name', 'ProductCategoryID', 'CompanyID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        }, user);
+        return res?.Results?.[0] ?? null;
+    }
+    async loadPriceListName(provider, user, id) {
+        const rv = new RunView(provider);
+        const res = await rv.RunView({
+            EntityName: 'MJ_BizApps_Orders: Price Lists',
+            ExtraFilter: `ID = '${id}'`,
+            Fields: ['Name'],
+            ResultType: 'simple',
+            BypassCache: true,
+        }, user);
+        return res?.Results?.[0]?.Name ?? null;
+    }
+};
+PreviewPriceOperation = __decorate([
+    RegisterClass(BaseRemotableOperation, 'Orders.PreviewPrice')
+], PreviewPriceOperation);
+export { PreviewPriceOperation };
+/** Tree-shaking anchor — called from the server bootstrap so the registration is retained. */
+export function LoadPreviewPriceOperation() {
+    // intentionally empty
+}
+//# sourceMappingURL=PreviewPriceOperation.js.map

package/dist/PreviewPriceOperation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreviewPriceOperation.js","sourceRoot":"","sources":["../src/PreviewPriceOperation.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACH,sBAAsB,EAGtB,QAAQ,EACR,QAAQ,EACR,OAAO,GAEV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AACtH,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnE,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAyCpD,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,sBAA6D;IAAjG;;QACI,iBAAY,GAAG,qBAAqB,CAAC;IAkJhD,CAAC;IAhJa,KAAK,CAAC,eAAe,CAC3B,KAAwB,EACxB,QAA2B,EAC3B,IAAc;QAEd,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;QACjE,CAAC;QACD,wEAAwE;QACxE,iEAAiE;QACjE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACtD,mBAAmB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAC5D,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gDAAgD,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC3G,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,KAAK,CAAC,SAAS,iBAAiB,EAAE,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrG,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAiC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,MAAM,OAAO,GAAG;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,mBAAmB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;gBACnF,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBACtC,oBAAoB,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;gBAClD,SAAS,EAAE,IAAI;gBACf,eAAe,EAAE,IAAI;gBACrB,KAAK,EAAE,CAAC,IAAI,CAAC;gBACb,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,EAAE;gBACnB,OAAO,EAAE,EAAE;gBACX,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,OAAO,EACH,8BAA8B,OAAO,CAAC,IAAI,8CAA8C;wBACxF,kEAAkE;oBACtE,QAAQ,EAAE,QAAQ;iBACrB,CAAC;YACN,CAAC;YAED,0FAA0F;YAC1F,yFAAyF;YACzF,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,IAAI,CAAC,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YACpG,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAEtF,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,OAAO,EACH,GAAG,OAAO,CAAC,IAAI,MAAM,QAAQ,MAAM,QAAQ,CAAC,cAAc,EAAE;oBAC5D,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAChE,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,MAAM;gBACnB,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,YAAY,EAAE,CAAC,CAAC,YAAY;iBAC/B,CAAC,CAAC;aACN,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,yFAAyF;YACzF,oFAAoF;YACpF,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,GAAG,YAAY,oBAAoB,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACpE,CAAC;YACD,QAAQ,CAAC,GAAY,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CACrB,QAA2B,EAC3B,IAAc,EACd,EAAU;QAEV,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CACxB;YACI,UAAU,EAAE,6BAA6B;YACzC,WAAW,EAAE,SAAS,EAAE,GAAG;YAC3B,MAAM,EAAE,CAAC,MAAM,EAAE,mBAAmB,EAAE,WAAW,CAAC;YAClD,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,EACD,IAAI,CACP,CAAC;QACF,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,QAA2B,EAAE,IAAc,EAAE,EAAU;QACnF,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAuC,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CACxB;YACI,UAAU,EAAE,gCAAgC;YAC5C,WAAW,EAAE,SAAS,EAAE,GAAG;YAC3B,MAAM,EAAE,CAAC,MAAM,CAAC;YAChB,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,EACD,IAAI,CACP,CAAC;QACF,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAC3C,CAAC;CACJ,CAAA;AAnJY,qBAAqB;IADjC,aAAa,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;GAChD,qBAAqB,CAmJjC;;AAED,8FAA8F;AAC9F,MAAM,UAAU,yBAAyB;IACrC,sBAAsB;AAC1B,CAAC"}

package/dist/PriceOrderOperation.d.ts

@@ -0,0 +1,93 @@
+/**
+ * @fileoverview `Orders.PriceOrder` — what a whole order comes to, persisting nothing.
+ *
+ * THE ONE RULE THAT MATTERS: this runs `OrderPricingService`, which is precisely what
+ * `OrderEntityServer.Save()` and `Orders.PreviewPrice` call. There is no second implementation to
+ * drift, which is the only way the number on the screen and the number in the ledger stay the same.
+ *
+ * WHY IT EXISTS ALONGSIDE `PreviewPrice`. That operation is a one-line call to the same service and
+ * reports one SKU's unit price. This one prices the whole header — promotions, charges, tax.
+ *
+ * WHAT IT REPLACED. An earlier `Orders.PreviewOrder` ran the REAL save inside a transaction that
+ * always rolled back, then read the computed values off the entities before they vanished. The
+ * reasoning was sound — a preview that reimplements pricing is a second copy of the rules — but the
+ * cost was not: it fired on every keystroke, so composing one order ran the full booking walk
+ * (journal entries, subscription decisions, entitlement grants, sequence numbers) dozens of times
+ * and discarded all of it, and the confirm was GATED on it. Extracting the pricing walk is what
+ * makes the honest version cheap: the decide step without the write.
+ *
+ * @module @mj-biz-apps/orders-core-entities-server
+ */
+import { BaseRemotableOperation, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+interface PriceOrderInput {
+    OrderHeaderID?: string | null;
+    CompanyID: string;
+    BillToPersonID?: string | null;
+    BillToOrganizationID?: string | null;
+    OrderDate?: string | null;
+    ShipToAddressID?: string | null;
+    Lines: Array<{
+        ProductID: string;
+        Quantity: number;
+        UnitPrice?: number | null;
+        DiscountPct?: number | null;
+        ServicePeriodStart?: string | null;
+        ServicePeriodEnd?: string | null;
+    }>;
+    PromotionCodes?: string[];
+    ManualDiscounts?: Array<{
+        LineIndex: number;
+        Amount?: number | null;
+        Percent?: number | null;
+        Reason: string;
+    }>;
+    Charges?: Array<{
+        Code: string;
+        Amount?: number | null;
+        Rate?: number | null;
+        TargetLineIndex?: number | null;
+    }>;
+}
+interface PricedLine {
+    ProductID: string;
+    Quantity: number;
+    UnitPrice: number;
+    DiscountAmount: number;
+    ChargeAmount: number;
+    LineTax: number;
+    LineTotalNet: number;
+    LineTotalGross: number;
+    Components?: Array<{
+        Kind: string;
+        Label: string;
+        Amount: number;
+    }>;
+    TaxExemptReason?: string | null;
+}
+interface PriceOrderOutput {
+    Success: boolean;
+    Message?: string | null;
+    Lines: PricedLine[];
+    Totals: {
+        Net: number;
+        Discount: number;
+        Charges: number;
+        Tax: number;
+        Gross: number;
+    };
+    UnusableCodes: Array<{
+        Code: string;
+        Reason: string;
+    }>;
+}
+export declare class PriceOrderOperation extends BaseRemotableOperation<PriceOrderInput, PriceOrderOutput> {
+    OperationKey: string;
+    protected InternalExecute(input: PriceOrderInput, provider: IMetadataProvider, user: UserInfo): Promise<PriceOrderOutput>;
+}
+/**
+ * Force the class registration. Tree-shaking removes a class nobody imports, and the decorator only
+ * runs if the module is loaded — so the server's bootstrap calls this.
+ */
+export declare function LoadPriceOrderOperation(): void;
+export {};
+//# sourceMappingURL=PriceOrderOperation.d.ts.map

package/dist/PriceOrderOperation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PriceOrderOperation.d.ts","sourceRoot":"","sources":["../src/PriceOrderOperation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACH,sBAAsB,EAEtB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAChB,MAAM,sBAAsB,CAAC;AAQ9B,UAAU,eAAe;IACrB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,CAAC,CAAC;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACpH;AAED,UAAU,UAAU;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,UAAU,gBAAgB;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,qBACa,mBAAoB,SAAQ,sBAAsB,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACvF,YAAY,SAAuB;cAE1B,eAAe,CAC3B,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,GACf,OAAO,CAAC,gBAAgB,CAAC;CAmG/B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}