@teleporthq/teleport-plugin-next-workflows 0.44.4 → 0.44.6

package/__tests__/invoice-paid-status.test.ts

@@ -0,0 +1,382 @@
+/* tslint:disable:function-constructor */
+import { generateInvoiceAssemblyCode } from '../src/invoice/invoice-assembly-code'
+import { generatePdfGeneratorCode } from '../src/invoice/pdf-generator-code'
+import type { UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+import { evaluateEmittedModule } from './_helpers/load-invoice-route'
+
+/**
+ * What the invoice says about being paid, and how it writes money.
+ *
+ * A store invoices an order the moment its payment webhook marks it paid, so
+ * that invoice — its email and its PDF — must not ask for a payment already
+ * made: no due date, no amount due. A cash-on-delivery order is invoiced
+ * unpaid when it is placed and keeps both. A summary line whose amount is zero
+ * (no delivery, no discount, no tax, no gift card) is left out. And an empty
+ * field on the real invoice prints nothing — never the design canvas's sample.
+ *
+ * Every piece below is the EMITTED code, run: the assembly the generate route
+ * builds the invoice with, then the renderer the email and the PDF go through
+ * (`email-sender-code.ts` fills the body with `buildDataContext` +
+ * `replacePlaceholders`).
+ */
+
+const SETTINGS = {
+  invoicePrefix: 'INV-',
+  defaultTaxRate: 0,
+  showDiscount: false,
+  taxIncludedInPrice: false,
+  companyDetails: {},
+  template: { document: null as unknown },
+  tables: { invoicesTable: 'teleport_invoices', invoiceItemsTable: 'teleport_invoice_items' },
+  emailDelivery: { enabled: false },
+} as unknown as UIDLInvoiceSettings
+
+type Row = Record<string, unknown>
+
+interface AssemblyModule {
+  assembleInvoiceData: (body: Row, order: Row | null, items: Row[]) => Row
+}
+
+interface PdfGeneratorModule {
+  buildInvoiceDataScope: (invoiceData: Row) => {
+    invoiceData: { Invoice: Record<string, string>; Company: Record<string, string> }
+  }
+  buildInvoiceHtml: (invoiceData: Row) => string
+  replacePlaceholders: (template: string, data: Row) => string
+  buildDataContext: (invoiceData: Row) => Row
+}
+
+function loadAssembly(): AssemblyModule {
+  const requireFn = ((id: string) => {
+    if (id.indexOf('pdf-generator') !== -1) {
+      return { COMPANY_DETAILS: {} }
+    }
+    if (id.indexOf('data-access') !== -1) {
+      return {}
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(id)
+  }) as unknown as NodeRequire
+  return evaluateEmittedModule<AssemblyModule>(generateInvoiceAssemblyCode(SETTINGS), requireFn)
+}
+
+function loadPdfGenerator(templateUidl: unknown = null): PdfGeneratorModule {
+  return evaluateEmittedModule<PdfGeneratorModule>(
+    generatePdfGeneratorCode(SETTINGS, templateUidl, templateUidl ? {} : null),
+    require
+  )
+}
+
+// The date the renderer prints for a stored date: it reads the calendar day in
+// the server's own time zone, so the expectation does too.
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']
+const printedDate = (raw: unknown): string => {
+  const date = new Date(raw as string)
+  return MONTHS[date.getMonth()] + ' ' + date.getDate() + ', ' + date.getFullYear()
+}
+
+// The editor's invoice email design (teleport-gui purposed-email-designs.ts) as
+// it is published: each summary row is a <div> of <span>s, copied from a body a
+// store sent on 2026-10-23 with its values put back to their tokens.
+const SUMMARY_ROW_STYLE =
+  'color: #374151; margin: 0; padding: 10px 0; font-size: 14px; line-height: 1.5'
+const summaryRow = (label: string, value: string, last = false) =>
+  `<div style="${SUMMARY_ROW_STYLE}${last ? '' : '; border-bottom: 1px solid #f0f1f3'}">` +
+  `<span>${label}: </span>${value}</div>`
+const INVOICE_EMAIL_BODY =
+  '<div style="color: #1f2937; margin: 0 auto; padding: 8px; max-width: 600px; font-family: \'Segoe UI\',Roboto,Helvetica,Arial,sans-serif">' +
+  '<div style="border: 1px solid #e5e7eb; overflow: hidden; background: #ffffff; border-radius: 14px">' +
+  '<div style="padding: 24px 32px; background: #1e293b"><small style="color: #94a3b8; margin: 0; font-size: 12px; font-weight: 600; letter-spacing: 1px; text-transform: uppercase">Invoice</small>' +
+  '<p style="color: #ffffff; margin: 6px 0 0; font-size: 22px; font-weight: 700">Your invoice</p></div>' +
+  '<div style="padding: 28px 32px">' +
+  '<div style="color: #1f2937; margin: 0 0 16px; font-size: 15px; line-height: 1.6"><span>Dear </span><span>{{customerName}}</span><span>,</span></div>' +
+  '<p style="color: #4b5563; margin: 0 0 18px; font-size: 15px; line-height: 1.6">Thank you for your purchase. Your invoice is attached to this email. Here is a quick summary:</p>' +
+  '<div style="margin: 0 0 22px">' +
+  summaryRow('Invoice number', '<span>{{invoiceNumber}}</span>') +
+  summaryRow('Invoice date', '<span>{{invoiceDate}}</span>') +
+  summaryRow('Due date', '<span>{{dueDate}}</span>') +
+  summaryRow('Subtotal', '<span>{{subtotal}}</span>') +
+  summaryRow('Discount', '<span>−</span><span>{{discountAmount}}</span>') +
+  summaryRow('Tax', '<span>{{taxAmount}}</span>') +
+  summaryRow('Delivery', '<span>{{shippingAmount}}</span>') +
+  summaryRow('Total', '<span>{{totalAmount}}</span>') +
+  summaryRow('Paid by gift card', '<span>−</span><span>{{giftCardAmount}}</span>') +
+  summaryRow('Amount due', '<span>{{amountDue}}</span>', true) +
+  '</div>' +
+  '<div style="color: #4b5563; margin: 4px 0 0; font-size: 14px; line-height: 1.6"><span>If you have any questions about this invoice, contact us at </span><span>{{companyEmail}}</span><span>.</span></div>' +
+  '<p style="color: #4b5563; margin: 20px 0 2px; font-size: 14px; line-height: 1.6">Best regards,</p>' +
+  '<p style="color: #1f2937; margin: 0; font-size: 14px; font-weight: 600; line-height: 1.6">{{companyName}}</p>' +
+  '</div></div></div>'
+
+// ORD-2 of the store this was found on: one 119.00 lei line paid by card, no
+// delivery, discount, tax or gift card. The payment webhook marked it paid —
+// `payment_status` and the `updated_at` that write stamps — then asked for the
+// invoice with just the order id.
+const PAID_CARD_ORDER: Row = {
+  id: 'order-2',
+  order_number: 'ORD-2',
+  currency: 'RON',
+  total_amount: 119,
+  shipping_amount: 0,
+  discount_amount: 0,
+  gift_card_amount: 0,
+  status: 'confirmed',
+  payment_status: 'paid',
+  payment_method: 'stripe',
+  payment_provider: 'stripe',
+  updated_at: '2026-10-23T09:15:00.000Z',
+  billing_name: 'Card Buyer',
+}
+const LINES: Row[] = [
+  { product_id: 'p1', product_name: 'Bouquet', quantity: 1, unit_price: 119, total_price: 119 },
+]
+// The same basket, delivered and paid in cash at the door: invoiced when it is
+// placed, before any money moved.
+const CASH_ORDER: Row = {
+  ...PAID_CARD_ORDER,
+  id: 'order-3',
+  order_number: 'ORD-3',
+  total_amount: 134,
+  shipping_amount: 15,
+  status: 'pending',
+  payment_status: 'unpaid',
+  payment_method: 'cash_on_delivery',
+  payment_provider: '',
+}
+
+// The editor's default invoice template, reduced to the parts this covers: the
+// <context> carrying the design canvas's sample (teleport-gui
+// invoice-template-builder.ts), the dates under the number, the total, the
+// notes and the seller's VAT number.
+const SAMPLE_NOTES = 'Payment is due within 30 days. Thank you for your business.'
+const boundText = (path: string) => ({
+  type: 'element',
+  content: {
+    elementType: 'text',
+    semanticType: 'p',
+    children: [{ type: 'expr', content: `invoiceData?.${path}` }],
+  },
+})
+const INVOICE_TEMPLATE = {
+  name: 'invoice-template',
+  node: {
+    type: 'element',
+    content: {
+      elementType: 'context',
+      attrs: {
+        Company: {
+          type: 'static',
+          content: { name: 'Acme Corporation', vat: 'US123456789', logoUrl: '' },
+        },
+        Invoice: {
+          type: 'static',
+          content: {
+            invoiceNumber: '#INV-001',
+            status: 'paid',
+            issueDate: 'Jan 15, 2025',
+            dueDate: 'Feb 14, 2025',
+            paidDate: 'Jan 20, 2025',
+            total: '371.49',
+            currency: 'USD',
+            notes: SAMPLE_NOTES,
+          },
+        },
+      },
+      children: [
+        boundText('Invoice?.invoiceNumber'),
+        boundText('Invoice?.issueDate'),
+        boundText('Invoice?.dueDate'),
+        boundText('Invoice?.total'),
+        boundText('Invoice?.notes'),
+        boundText('Invoice?.paidDate'),
+        boundText('Company?.vat'),
+      ],
+    },
+  },
+}
+
+const assembly = loadAssembly()
+const pdfGenerator = loadPdfGenerator()
+
+function invoiceFor(order: Row, body: Row = {}): Row {
+  const invoice = assembly.assembleInvoiceData(
+    { orderId: order.id, issueDate: '2026-10-23', ...body },
+    order,
+    LINES
+  )
+  return { ...invoice, invoiceNumber: 'INV-0002' }
+}
+
+function emailFor(invoice: Row, body = INVOICE_EMAIL_BODY): string {
+  return pdfGenerator.replacePlaceholders(body, pdfGenerator.buildDataContext(invoice))
+}
+
+describe('the invoice of a paid order', () => {
+  it('is issued paid, at the time the payment marked the order', () => {
+    const invoice = invoiceFor(PAID_CARD_ORDER)
+    expect(invoice.status).toBe('paid')
+    expect(invoice.paidAt).toBe('2026-10-23T09:15:00.000Z')
+  })
+
+  it('keeps the status and payment time a caller states', () => {
+    const invoice = invoiceFor(PAID_CARD_ORDER, { status: 'issued' })
+    expect(invoice.status).toBe('issued')
+    expect(invoice.paidAt).toBeNull()
+    const stated = invoiceFor(PAID_CARD_ORDER, { status: 'paid', paidAt: '2026-10-20T08:00:00Z' })
+    expect(stated.paidAt).toBe('2026-10-20T08:00:00Z')
+  })
+
+  it('emails no due date, no amount due and no zero lines', () => {
+    const email = emailFor(invoiceFor(PAID_CARD_ORDER))
+    expect(email).toContain('<span>Invoice number: </span><span>INV-0002</span>')
+    expect(email).toContain(
+      '<span>Invoice date: </span><span>' + printedDate('2026-10-23') + '</span>'
+    )
+    expect(email).toContain('<span>Subtotal: </span><span>lei 119.00</span>')
+    expect(email).toContain('<span>Total: </span><span>lei 119.00</span>')
+    for (const gone of ['Due date', 'Amount due', 'Discount', 'Tax', 'Delivery', 'gift card']) {
+      expect(email).not.toContain(gone)
+    }
+    // Only the rows went: the summary box and the rest of the message stay.
+    expect(email).toContain('<div style="margin: 0 0 22px">')
+    expect(email).toContain('Best regards,')
+  })
+
+  it('prints a paid line where the PDF printed the due date', () => {
+    const invoice = invoiceFor(PAID_CARD_ORDER)
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(invoice)
+    expect(html).toContain('<p>Paid on ' + printedDate('2026-10-23T09:15:00.000Z') + '</p>')
+    expect(html).not.toContain(printedDate(invoice.dueDate))
+    expect(html).toContain('<p>lei 119.00</p>')
+    // The built-in layout of a store without a template says so too.
+    expect(pdfGenerator.buildInvoiceHtml(invoice)).toContain(
+      'Paid on ' + printedDate('2026-10-23T09:15:00.000Z')
+    )
+  })
+})
+
+describe('the invoice of a cash-on-delivery order', () => {
+  it('is issued unpaid and due in 30 days', () => {
+    const invoice = invoiceFor(CASH_ORDER)
+    expect(invoice.status).toBe('issued')
+    expect(invoice.paidAt).toBeNull()
+    expect(invoice.dueDate).toBe('2026-11-22')
+  })
+
+  it('emails its due date and the delivery, and no amount due without a gift card', () => {
+    const email = emailFor(invoiceFor(CASH_ORDER))
+    expect(email).toContain(
+      '<span>Due date: </span><span>' + printedDate('2026-11-22') + '</span></div>'
+    )
+    expect(email).toContain('<span>Delivery: </span><span>lei 15.00</span>')
+    expect(email).toContain('<span>Total: </span><span>lei 134.00</span>')
+    for (const gone of ['Amount due', 'Discount', 'Tax', 'gift card']) {
+      expect(email).not.toContain(gone)
+    }
+  })
+
+  it('keeps the due date on its PDF', () => {
+    const invoice = invoiceFor(CASH_ORDER)
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(invoice)
+    expect(html).toContain('<p>' + printedDate('2026-11-22') + '</p>')
+    expect(html).not.toContain('Paid on')
+    expect(pdfGenerator.buildInvoiceHtml(invoice)).not.toContain('Paid on')
+  })
+
+  it('emails what a gift card paid and what is left to pay at the door', () => {
+    const email = emailFor(invoiceFor({ ...CASH_ORDER, gift_card_amount: 50 }))
+    expect(email).toContain(
+      '<span>Paid by gift card: </span><span>−</span><span>lei 50.00</span></div>'
+    )
+    expect(email).toContain('<span>Amount due: </span><span>lei 84.00</span></div>')
+    expect(email).toContain('<span>Due date: </span>')
+  })
+
+  it('emails no amount due once the rest was paid by card', () => {
+    const email = emailFor(invoiceFor({ ...PAID_CARD_ORDER, gift_card_amount: 50 }))
+    expect(email).toContain('<span>Paid by gift card: </span><span>−</span><span>lei 50.00</span>')
+    expect(email).not.toContain('Amount due')
+  })
+})
+
+describe('the invoice email drops a zero line, never what holds it', () => {
+  const zeroDeliveryInvoice = invoiceFor(CASH_ORDER, { shippingAmount: 0 })
+
+  it("keeps a merchant's own block around the line it drops", () => {
+    const body =
+      '<div class="merchant-summary">' +
+      '<div class="row"><span>Delivery: </span><span>{{shippingAmount}}</span></div>' +
+      '<div class="row"><span>Total: </span><span>{{totalAmount}}</span></div>' +
+      '<p>Thank you for shopping with us.</p>' +
+      '</div>'
+    expect(emailFor(zeroDeliveryInvoice, body)).toBe(
+      '<div class="merchant-summary">' +
+        '<div class="row"><span>Total: </span><span>lei 119.00</span></div>' +
+        '<p>Thank you for shopping with us.</p>' +
+        '</div>'
+    )
+  })
+
+  it('keeps a block that holds more than the line', () => {
+    const withBlocks =
+      '<div class="note"><span>Delivery {{shippingAmount}}</span><p>See you soon.</p></div>'
+    expect(emailFor(zeroDeliveryInvoice, withBlocks)).toBe(
+      '<div class="note"><span>Delivery lei 0.00</span><p>See you soon.</p></div>'
+    )
+    const withFigures = '<div>Delivery {{shippingAmount}}, total {{totalAmount}}.</div>'
+    expect(emailFor(zeroDeliveryInvoice, withFigures)).toBe(
+      '<div>Delivery lei 0.00, total lei 119.00.</div>'
+    )
+  })
+})
+
+describe('money on the invoice', () => {
+  it.each([
+    ['RON', 'lei 119.00'],
+    ['CHF', 'CHF 119.00'],
+    ['USD', '$119.00'],
+    ['EUR', '€119.00'],
+  ])('writes %s as %s in the email and the PDF alike', (currency, printed) => {
+    const invoice = invoiceFor({ ...PAID_CARD_ORDER, currency })
+    expect(emailFor(invoice, '<span>{{totalAmount}}</span>')).toBe(`<span>${printed}</span>`)
+    expect(pdfGenerator.buildInvoiceDataScope(invoice).invoiceData.Invoice.total).toBe(printed)
+  })
+})
+
+describe("the invoice PDF never prints the template's sample", () => {
+  it('prints nothing for a field the real invoice leaves empty', () => {
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(
+      invoiceFor(CASH_ORDER, { notes: '' })
+    )
+    expect(html).not.toContain(SAMPLE_NOTES)
+    expect(html).not.toContain('Jan 20, 2025')
+    expect(html).not.toContain('US123456789')
+    expect(html).not.toContain('371.49')
+    expect(html).toContain('<p>#INV-0002</p>')
+    expect(html).toContain('<p>lei 134.00</p>')
+  })
+
+  it("prints the invoice's own notes", () => {
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(
+      invoiceFor(CASH_ORDER, { notes: 'Leave it with the neighbour.' })
+    )
+    expect(html).toContain('<p>Leave it with the neighbour.</p>')
+  })
+
+  it("keeps the company logo the editor wrote onto the template's context", () => {
+    const withLogo = {
+      ...INVOICE_TEMPLATE,
+      node: {
+        ...INVOICE_TEMPLATE.node,
+        content: {
+          ...INVOICE_TEMPLATE.node.content,
+          attrs: {
+            Company: { type: 'static', content: { name: '', logoUrl: 'https://cdn/logo.png' } },
+          },
+        },
+      },
+    }
+    const scope = loadPdfGenerator(withLogo).buildInvoiceDataScope(invoiceFor(CASH_ORDER))
+    expect(scope.invoiceData.Company.logoUrl).toBe('https://cdn/logo.png')
+  })
+})

package/__tests__/invoice-tender.test.ts

@@ -420,7 +420,9 @@ describe('invoice PDF renderer — vouchers and the gift-card tender', () => {
     expect(voucherEmail).not.toContain('Delivery')
     expect(voucherEmail).not.toContain('gift card')
     expect(voucherEmail).toContain('<tr><td>Discount</td><td>−$25.00</td></tr>')
-    expect(voucherEmail).toContain('<tr><td>Amount due</td><td>$75.00</td></tr>')
+    // Without a gift card nothing is left beside the total, so, as on the PDF,
+    // there is no amount due.
+    expect(voucherEmail).not.toContain('Amount due')
 
     const giftCardEmail = pdfGenerator.replacePlaceholders(
       body,
@@ -434,10 +436,10 @@ describe('invoice PDF renderer — vouchers and the gift-card tender', () => {
     // A rich-text editor turns table rows into paragraphs; the same rule holds.
     expect(
       pdfGenerator.replacePlaceholders(
-        '<p>Delivery {{shippingAmount}}</p><p>Due {{amountDue}}</p>',
+        '<p>Delivery {{shippingAmount}}</p><p>Total {{totalAmount}}</p>',
         pdfGenerator.buildDataContext(voucherInvoice)
       )
-    ).toBe('<p>Due $75.00</p>')
+    ).toBe('<p>Total $75.00</p>')
   })
 })
 

package/dist/cjs/account-delete-route-generator.d.ts

@@ -6,15 +6,18 @@
  *   1. resolves the current user from the NextAuth session (never trusting a
  *      client-supplied id),
  *   2. runs a single DB transaction that detaches + anonymises business/legal
- *      records (orders, withdrawal requests) so tracking survives, deletes the
- *      user's personal data (reviews, cart, favourites, chat history) and the
- *      user row, and
+ *      records (orders, withdrawal requests, bookings) so tracking survives,
+ *      deletes the user's personal data (reviews, cart, favourites, chat
+ *      history), deletes the rows the user owns in the project's own tables —
+ *      the ones the AI made for the site, each through the one column the
+ *      site's "My …" pages read it by (teleport-shared's resolveOwnerColumn,
+ *      shipped into the route as text) — and then the user row, and
  *   3. best-effort sends the farewell email (a failed send never fails the
  *      deletion).
  *
- * Every table statement is guarded by a runtime `information_schema` column
- * check, so the route is a no-op for feature tables a given project never
- * provisioned.
+ * Every platform-table statement is guarded by a runtime `information_schema`
+ * column check, so the route is a no-op for feature tables a given project
+ * never provisioned.
  */
 import { UIDLLocalizedEmailTemplates } from '@teleporthq/teleport-types';
 export interface AccountDeleteRouteOptions {

package/dist/cjs/account-delete-route-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-delete-route-generator.d.ts","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAYxE,MAAM,WAAW,yBAAyB;IAExC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAI3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IAGtB,kBAAkB,CAAC,EAAE,2BAA2B,CAAA;IAEhD,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAID,eAAO,MAAM,8BAA8B,+CAAiC,CAAA;AAE5E,eAAO,MAAM,0BAA0B,aAAa,yBAAyB,KAAQ,MAoPpF,CAAA"}
+{"version":3,"file":"account-delete-route-generator.d.ts","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAaxE,MAAM,WAAW,yBAAyB;IAExC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAI3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IAGtB,kBAAkB,CAAC,EAAE,2BAA2B,CAAA;IAEhD,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAID,eAAO,MAAM,8BAA8B,+CAAiC,CAAA;AAE5E,eAAO,MAAM,0BAA0B,aAAa,yBAAyB,KAAQ,MAqXpF,CAAA"}

package/dist/cjs/account-delete-route-generator.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateAccountDeleteRoute = exports.accountDeleteRouteDependencies = void 0;
+const teleport_shared_1 = require("@teleporthq/teleport-shared");
 const pg_client_code_1 = require("./pg-client-code");
 const session_cookie_resolver_1 = require("./session-cookie-resolver");
 const transactional_email_code_1 = require("./transactional-email-code");
@@ -35,11 +36,22 @@ const DELETE_TABLES = [
   'teleport_cart',
   'teleport_ai_chat_messages',
   'teleport_ai_chat_conversations',
+  // A push subscription is the capability to notify the user's device.
+  'teleport_push_subscriptions',
 ];
 // Business / legal records that must survive: the user link is nulled and any
 // stored personal email is replaced with a synthetic, self-describing address.
-const ANONYMIZE_TABLES = ['teleport_orders', 'teleport_withdrawal_requests'];
+const ANONYMIZE_TABLES = [
+  'teleport_orders',
+  'teleport_withdrawal_requests',
+  'teleport_bookings',
+  'teleport_subscriptions',
+  'teleport_abandoned_carts',
+  'teleport_voucher_redemptions',
+];
 const EMAIL_COLUMNS = ['billing_email', 'shipping_email', 'customer_email', 'email'];
+// A booking also names the customer and carries their phone; both are cleared.
+const CLEARED_COLUMNS = { teleport_bookings: ['customer_name', 'customer_phone'] };
 
 async function tableColumns(client, table) {
   var r = await client.query(
@@ -62,6 +74,10 @@ async function anonymizeUserRows(client, table, userId, syntheticEmail) {
       sets.push(EMAIL_COLUMNS[i] + ' = $' + params.length);
     }
   }
+  var cleared = CLEARED_COLUMNS[table] || [];
+  for (var c = 0; c < cleared.length; c++) {
+    if (cols.indexOf(cleared[c]) !== -1) { sets.push(cleared[c] + ' = NULL'); }
+  }
   await client.query('UPDATE ' + table + ' SET ' + sets.join(', ') + ' WHERE user_id = $1', params);
 }
 
@@ -78,6 +94,119 @@ async function deleteRowsByEmail(client, table, column, email) {
   await client.query('DELETE FROM ' + table + ' WHERE ' + column + ' = $1', [email]);
 }
 
+// Rows the user owns in the project's OWN tables — the ones the AI made for
+// this site (saved items, requests, reviews …). Their link to the user is
+// ON DELETE SET NULL, so they outlived the account with a blank owner, and the
+// "My …" pages read "owner = me OR owner IS NULL": every other signed-in
+// visitor saw them. Platform tables keep the explicit handling above —
+// deleted, anonymised, or kept as the business's records.
+//
+// Each table is attributed through exactly ONE column, the one its "My …"
+// pages read it by: resolveOwnerColumn below is the AI pipeline's own
+// decision, shipped here as text, so the two sides cannot disagree. Rows go
+// only through an "owner" column (whose the row is: author, submitter,
+// sender); an "actor" column (who approved, reviewed, was assigned or
+// addressed) names somebody else's row and leaves the table alone.
+${teleport_shared_1.OwnerColumns.generateOwnerColumnResolverCode()}
+
+const PLATFORM_TABLE_PREFIX = 'teleport_';
+const PLATFORM_TABLES = [AUTH_USERS_TABLE, 'password_reset_tokens'];
+
+function isPlatformTable(table) {
+  return PLATFORM_TABLES.indexOf(table) !== -1 || table.indexOf(PLATFORM_TABLE_PREFIX) === 0;
+}
+
+function quoteIdentifier(name) {
+  return '"' + String(name).split('"').join('""') + '"';
+}
+
+// The (table, column) pairs through which the project's own tables name their
+// owner: the resolved owner column when it references the users table — or
+// references nothing, in older projects whose link was dropped. One that
+// references another table (account_id -> accounts) is a domain link and the
+// table is left alone. Links are read from pg_constraint rather than
+// information_schema: constraint names are only unique per table, so a join
+// by name can pair the wrong tables.
+async function ownedRowLinks(client) {
+  var columns = await client.query(
+    "SELECT c.table_name, c.column_name, c.ordinal_position FROM information_schema.columns c" +
+      " JOIN information_schema.tables t ON t.table_schema = c.table_schema AND t.table_name = c.table_name" +
+      " WHERE c.table_schema = 'public' AND t.table_type = 'BASE TABLE'" +
+      " ORDER BY c.table_name, c.ordinal_position"
+  );
+  var links = await client.query(
+    "SELECT cl.relname AS table_name, a.attname AS column_name," +
+      " rcl.relname AS referenced_table, ra.attname AS referenced_column" +
+      " FROM pg_constraint k" +
+      " JOIN pg_class cl ON cl.oid = k.conrelid" +
+      " JOIN pg_namespace n ON n.oid = cl.relnamespace" +
+      " JOIN pg_attribute a ON a.attrelid = k.conrelid AND a.attnum = k.conkey[1]" +
+      " JOIN pg_class rcl ON rcl.oid = k.confrelid" +
+      " JOIN pg_attribute ra ON ra.attrelid = k.confrelid AND ra.attnum = k.confkey[1]" +
+      " WHERE k.contype = 'f' AND n.nspname = 'public' AND array_length(k.conkey, 1) = 1"
+  );
+  var referenced = {};
+  for (var i = 0; i < links.rows.length; i++) {
+    var link = links.rows[i];
+    referenced[link.table_name + '.' + link.column_name] = link.referenced_table + '.' + link.referenced_column;
+  }
+  var tables = [];
+  var columnsOf = {};
+  for (var j = 0; j < columns.rows.length; j++) {
+    var row = columns.rows[j];
+    if (!columnsOf[row.table_name]) {
+      columnsOf[row.table_name] = [];
+      tables.push(row.table_name);
+    }
+    columnsOf[row.table_name].push({ name: row.column_name, ordinalPosition: Number(row.ordinal_position) });
+  }
+  var owned = [];
+  for (var t = 0; t < tables.length; t++) {
+    var table = tables[t];
+    if (isPlatformTable(table)) { continue; }
+    var resolved = resolveOwnerColumn(columnsOf[table]);
+    if (!resolved || resolved.kind !== 'owner') { continue; }
+    var target = referenced[table + '.' + resolved.column];
+    if (target && target !== AUTH_USERS_TABLE + '.id') { continue; }
+    owned.push({ table: table, column: resolved.column });
+  }
+  return owned;
+}
+
+// Each table is deleted from under its own savepoint, so one that refuses
+// (another user's row still points at this user's, through a link without
+// ON DELETE CASCADE) stops neither the other tables nor the account from being
+// deleted. A refused table is retried once the rest are done — the blocker may
+// have been this user's own row in another table; what is still refused stays
+// as it always did, and the log names it.
+async function deleteOwnedRows(client, userId) {
+  var pending = await ownedRowLinks(client);
+  while (pending.length > 0) {
+    var refused = [];
+    for (var i = 0; i < pending.length; i++) {
+      var link = pending[i];
+      await client.query('SAVEPOINT owned_rows');
+      try {
+        await client.query(
+          'DELETE FROM ' + quoteIdentifier(link.table) + ' WHERE ' + quoteIdentifier(link.column) + ' = $1',
+          [userId]
+        );
+        await client.query('RELEASE SAVEPOINT owned_rows');
+      } catch (err) {
+        await client.query('ROLLBACK TO SAVEPOINT owned_rows');
+        await client.query('RELEASE SAVEPOINT owned_rows');
+        link.error = err && err.message ? err.message : String(err);
+        refused.push(link);
+      }
+    }
+    if (refused.length === pending.length) { break; }
+    pending = refused;
+  }
+  for (var k = 0; k < pending.length; k++) {
+    console.error('[account-delete] rows kept in ' + pending[k].table + ' (' + pending[k].column + '): ' + pending[k].error);
+  }
+}
+
 // Invoices are a financial/tax record that must survive, but they store the
 // customer's PII denormalised and link to the user only through order_id (no
 // user_id). Scrub the PII in place, matching invoices whose order belongs to the
@@ -197,6 +326,7 @@ module.exports = async function handler(req, res) {
         for (var d = 0; d < DELETE_TABLES.length; d++) {
           await deleteUserRows(client, DELETE_TABLES[d], userId);
         }
+        await deleteOwnedRows(client, userId);
         // password_reset_tokens has no user_id — it is keyed by the email string.
         await deleteRowsByEmail(client, 'password_reset_tokens', 'email', userEmail);
         await client.query('DELETE FROM ' + AUTH_USERS_TABLE + ' WHERE id = $1', [userId]);

package/dist/cjs/account-delete-route-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-delete-route-generator.js","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":";;;AAmBA,qDAAuD;AACvD,uEAAoF;AACpF,yEAOmC;AAuBnC,+EAA+E;AAC/E,oFAAoF;AACvE,QAAA,8BAA8B,GAAG,yDAA8B,CAAA;AAErE,MAAM,0BAA0B,GAAG,CAAC,UAAqC,EAAE,EAAU,EAAE;IAC5F,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAA;IAC5D,MAAM,QAAQ,GACZ,OAAO,CAAC,aAAa,IAAI,oDAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,IAAI,CAAA;IACV,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,yCAAyC,CAAA;IAE1E,OAAO,GAAG,IAAA,qCAAoB,GAAE;EAChC,IAAA,kEAAwC,GAAE;2BACjB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;oBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAC1B,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBAC1C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;qBAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;0BAClC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;wBACxD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,IAAI,+BAA+B,CAAC;0BACrE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;0BAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;EACxE,IAAA,qDAA0B,EAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6FtC,IAAA,iDAAsB,GAAE;;EAExB,IAAA,uDAA4B,EAAC;QAC7B,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,iBAAiB;QAC5B,cAAc,EAAE,iBAAiB;KAClC,CAAC;;EAEA,IAAA,uDAA4B,EAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,4BAA4B;QACvC,cAAc,EAAE,UAAU;KAC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2GA,QAAQ;QACN,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;CAGC,CAAA;AACD,CAAC,CAAA;AApPY,QAAA,0BAA0B,8BAoPtC"}
+{"version":3,"file":"account-delete-route-generator.js","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":";;;AAsBA,iEAA0D;AAC1D,qDAAuD;AACvD,uEAAoF;AACpF,yEAOmC;AAuBnC,+EAA+E;AAC/E,oFAAoF;AACvE,QAAA,8BAA8B,GAAG,yDAA8B,CAAA;AAErE,MAAM,0BAA0B,GAAG,CAAC,UAAqC,EAAE,EAAU,EAAE;IAC5F,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAA;IAC5D,MAAM,QAAQ,GACZ,OAAO,CAAC,aAAa,IAAI,oDAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,IAAI,CAAA;IACV,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,yCAAyC,CAAA;IAE1E,OAAO,GAAG,IAAA,qCAAoB,GAAE;EAChC,IAAA,kEAAwC,GAAE;2BACjB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;oBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAC1B,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBAC1C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;qBAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;0BAClC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;wBACxD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,IAAI,+BAA+B,CAAC;0BACrE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;0BAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;EACxE,IAAA,qDAA0B,EAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiFtC,8BAAY,CAAC,+BAA+B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4I9C,IAAA,iDAAsB,GAAE;;EAExB,IAAA,uDAA4B,EAAC;QAC7B,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,iBAAiB;QAC5B,cAAc,EAAE,iBAAiB;KAClC,CAAC;;EAEA,IAAA,uDAA4B,EAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,4BAA4B;QACvC,cAAc,EAAE,UAAU;KAC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4GA,QAAQ;QACN,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;CAGC,CAAA;AACD,CAAC,CAAA;AArXY,QAAA,0BAA0B,8BAqXtC"}

package/dist/cjs/invoice/invoice-assembly-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoice-assembly-code.d.ts","sourceRoot":"","sources":["../../../src/invoice/invoice-assembly-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAIhE;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,aAAc,mBAAmB,KAAG,MAgiB3E,CAAA"}
+{"version":3,"file":"invoice-assembly-code.d.ts","sourceRoot":"","sources":["../../../src/invoice/invoice-assembly-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAIhE;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,aAAc,mBAAmB,KAAG,MAijB3E,CAAA"}