@aglyn/aglyn 1.0.0-beta.249 → 1.0.0-beta.250

package/src/lib/app-utils/operator-alerts.js

@@ -78,6 +78,22 @@ const DAY = 24 * 60;
         defaultEnabled: true,
         notificationType: 'system.abuseReportUrgent'
     },
+    {
+        type: 'security.paymentFraudHold',
+        label: 'Automatic security hold for payment fraud',
+        description: 'Stripe flagged a workspace\'s own subscription payment as fraud — a Radar block at highest risk, a Stripe fraud report, three or more cards failing within 30 minutes, an early fraud warning or a Radar review. A new workspace that never paid is locked as security (takedown) with its subscriptions canceled; an older or paying one is not locked and needs a decision. Confirm it on Staff → Abuse reports, then re-place it as abuse on Staff → Lockdown, or lift it there.',
+        tier: 'must',
+        category: 'security',
+        title: '{{action}}: {{orgName}}',
+        body: '{{trigger}} on {{orgName}} ({{orgId}}). Charges: {{charges}}; cards: {{cards}}, issued in {{cardCountries}}. Locked: {{locks}}. The abuse row is {{reference}}. Lift it, or re-place it as abuse, on Staff → Lockdown (/admin/lockdown).',
+        link: '/admin/abuse-reports?report={{reviewId}}',
+        delivery: 'immediate',
+        // One per workspace per window: every further card in the burst is the
+        // same event, and the abuse row carries all of them.
+        dedupeWindowMinutes: DAY,
+        defaultEnabled: true,
+        notificationType: 'system.abuseReportUrgent'
+    },
     {
         type: 'system.disputeUnattributed',
         label: 'Card dispute with no owner',

package/src/lib/app-utils/operator-alerts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/operator-alerts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynNotificationType, NotificationLevel } from './notifications'\n\n/**\n * OPERATOR ALERTS (AGL-3377): the events whoever runs an install must hear\n * about, as one typed catalog.\n *\n * Every alert is an entry here (or a plugin's entry in the same shape,\n * registered through `@aglyn/aglyn/plugin-manager/operator-alerts`) and is\n * raised through ONE server entry point, `raiseOperatorAlert` in\n * `@aglyn/tenant-data-admin/server/operator-alerts`. That entry point writes\n * the staff console notification, dedupes a flapping condition, honours the\n * per-type switches staff set on Staff → Operator alerts, and delivers by\n * email (the `operator-alert` system email) and the optional out-of-band\n * webhook. No call site composes or sends its own mail.\n *\n * The catalog holds nothing install-specific: no address, no domain, no\n * host. Recipients come from `resolveStaffAlertRecipients()` and the webhook\n * from `OPERATOR_ALERT_WEBHOOK_URL`, so an entry reads the same on aglyn.com,\n * on a self-hosted install and in an OSS consumer's deployment.\n *\n * Copy is written against merge tokens (`{{orgId}}`), filled from the\n * `context` the call site passes. A token the call site did not supply is\n * blanked, so every sentence must still read when its optional tokens are\n * empty. Never put a data subject's address or other personal data into a\n * context: the alert travels to an inbox and a webhook, not only the console.\n */\n\n/**\n * How much an alert matters.\n *\n * - `must` — money moving with nobody looking, a legal duty unmet, data not\n *   protected or not erased. On and immediate unless staff change it.\n * - `should` — a fault an operator wants to know about today.\n * - `low` — routine review work; on, and batched into the daily digest.\n */\nexport type OperatorAlertTier = 'must' | 'should' | 'low'\n\nexport type OperatorAlertCategory =\n  | 'billing'\n  | 'payments'\n  | 'legal'\n  | 'data'\n  | 'ops'\n  | 'deliverability'\n  | 'security'\n  | 'support'\n\n/** `digest` batches the alert into the once-a-day operator digest. */\nexport type OperatorAlertDelivery = 'immediate' | 'digest'\n\nexport interface OperatorAlertDefinition {\n  /**\n   * Stable id, also the key of its settings row. Never rename: staff\n   * switches are stored under it. A plugin's types start with its plugin id\n   * and a dot (`commerce.taxNotReversed`).\n   */\n  type: string\n  /** The settings row's name. */\n  label: string\n  /** What it means and the first thing to do, for the settings page. */\n  description: string\n  tier: OperatorAlertTier\n  category: OperatorAlertCategory\n  /** The notification title and email subject, with `{{tokens}}`. */\n  title: string\n  /** What happened and what to do, with `{{tokens}}`. */\n  body: string\n  /** Console path the alert opens, with `{{tokens}}`; the call may override. */\n  link?: string\n  /** The coded default; staff may change it. */\n  delivery: OperatorAlertDelivery\n  /**\n   * How long one `dedupeKey` stays quiet after it fired, in minutes. A\n   * condition that flaps inside the window is told once. `0` never dedupes.\n   * A call without a `dedupeKey` is never deduped.\n   */\n  dedupeWindowMinutes: number\n  /**\n   * Fire only once the same `dedupeKey` has been raised this many times\n   * inside the window — for an endpoint any stranger can hit, where one\n   * refused request is noise and several are a broken secret. Default 1.\n   */\n  minOccurrences?: number\n  /** The coded default; staff may change it. */\n  defaultEnabled: boolean\n  /**\n   * The console notification's type. Absent is the generic\n   * `system.operatorAlert`; a type that already had its own notification\n   * keeps it, so its icon, label and everyone's mutes are unchanged.\n   */\n  notificationType?: AglynNotificationType\n  /**\n   * How loud its console notification is drawn (AGL-3437). Absent, the\n   * tier answers — see {@link operatorAlertLevel}. Set where the tone and\n   * the importance part ways: a recovery is worth hearing about and is good\n   * news, and a degraded check is a must-know that is not yet an outage.\n   */\n  level?: NotificationLevel\n  /** The plugin that contributed it; absent for core's own. */\n  pluginId?: string\n}\n\n/** Values a call site passes for an alert's `{{tokens}}`. */\nexport type OperatorAlertContext = Readonly<\n  Record<string, string | number | boolean | null | undefined>\n>\n\n/** The notification type an alert without its own writes under. */\nexport const OPERATOR_ALERT_DEFAULT_NOTIFICATION_TYPE: AglynNotificationType =\n  'system.operatorAlert'\n\nexport const OPERATOR_ALERT_TIER_LABELS: Record<OperatorAlertTier, string> = {\n  must: 'Must know',\n  should: 'Should know',\n  low: 'Routine',\n}\n\n/**\n * The level an alert's notification is drawn at when its entry names none:\n * a must-know is red, a should-know amber, routine review work informational.\n */\nexport const OPERATOR_ALERT_TIER_LEVELS: Record<\n  OperatorAlertTier,\n  NotificationLevel\n> = {\n  must: 'critical',\n  should: 'warning',\n  low: 'info',\n}\n\n/** The level an alert's console notification carries (AGL-3437). */\nexport function operatorAlertLevel(\n  definition: Pick<OperatorAlertDefinition, 'tier' | 'level'>,\n): NotificationLevel {\n  return definition.level ?? OPERATOR_ALERT_TIER_LEVELS[definition.tier]\n}\n\nexport const OPERATOR_ALERT_CATEGORY_LABELS: Record<\n  OperatorAlertCategory,\n  string\n> = {\n  billing: 'Billing',\n  payments: 'Payments & payouts',\n  legal: 'Legal',\n  data: 'Data protection',\n  ops: 'Operations',\n  deliverability: 'Email deliverability',\n  security: 'Security',\n  support: 'Support',\n}\n\nconst DAY = 24 * 60\n\n/**\n * Core's alerts. Plugins contribute theirs through the plugin-manager\n * registry; nothing plugin-specific belongs in this list.\n */\nexport const CORE_OPERATOR_ALERTS: readonly OperatorAlertDefinition[] = [\n  // ── Fraud, risk and legal duties already alerting before AGL-3377 ──────\n  {\n    type: 'system.abuseReportUrgent',\n    label: 'Urgent abuse, fraud or risk alert',\n    description:\n      'Phishing, malware or CSAM reported on a site, card testing, a flagged or disputed payment, a held phishing email, a seller under review. Review it on Staff → Abuse reports.',\n    tier: 'must',\n    category: 'security',\n    title: '{{title}}',\n    body: '{{body}}',\n    link: '/admin/abuse-reports',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.abuseReportUrgent',\n  },\n  {\n    // The one lock no person placed (AGL-3450): staff confirm it before the\n    // customer's appeal arrives, and re-place it as `abuse` or lift it.\n    type: 'security.pageSecurityHold',\n    label: 'Automatic security hold on a new workspace',\n    description:\n      'The page screen held a phishing page from a workspace in its first two weeks and locked the workspace, the site and the publishing account as security. Confirm it on Staff → Abuse reports, then re-place it as abuse on Staff → Lockdown, or lift it there if it is a false positive.',\n    tier: 'must',\n    category: 'security',\n    title: 'Security hold placed on {{orgName}}',\n    body:\n      '{{page}} on {{siteName}} ({{hostId}}) was held for review: {{signal}} Locked as security, pending your review: {{locks}}. The abuse row is {{reference}}. Lift the hold, or re-place it as abuse, on Staff → Lockdown (/admin/lockdown).',\n    link: '/admin/abuse-reports?report={{reviewId}}',\n    delivery: 'immediate',\n    // One hold per workspace; a repeat inside the day is the same event.\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n    notificationType: 'system.abuseReportUrgent',\n  },\n  {\n    type: 'system.disputeUnattributed',\n    label: 'Card dispute with no owner',\n    description:\n      'A chargeback arrived that no subscription, order or marketplace purchase claimed, so nothing is answering it. Find the charge in Stripe and respond before the evidence deadline.',\n    tier: 'must',\n    category: 'billing',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.disputeUnattributed',\n  },\n  {\n    type: 'system.dmcaCounterNotice',\n    label: 'DMCA counter-notice',\n    description:\n      'A customer contested a takedown. The statutory clock is already running; forward it to the complainant and restore on time unless they file suit.',\n    tier: 'must',\n    category: 'legal',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.dmcaCounterNotice',\n  },\n  {\n    type: 'system.billingWebhookHalfApplied',\n    label: 'Billing webhook half applied',\n    description:\n      'A Stripe event threw after its handlers began, so its effects may be partly applied and Stripe will not retry it. Reconcile the event by hand.',\n    tier: 'must',\n    category: 'billing',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.billingWebhookHalfApplied',\n  },\n\n  // ── MUST: billing ───────────────────────────────────────────────────────\n  {\n    type: 'billing.platformDisputeLost',\n    label: 'Subscription dispute lost',\n    description:\n      'A card dispute on a workspace subscription closed as lost: the money has been taken back. Decide whether the workspace keeps its plan.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Subscription dispute lost on workspace {{orgId}}',\n    body:\n      'The card dispute {{disputeId}} on invoice {{invoiceId}} for workspace {{orgName}} ({{orgId}}) closed as lost ({{reason}}), and {{amount}} was taken back. The workspace keeps its plan until somebody decides otherwise.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 30 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.orphanedSubscription',\n    label: 'Stripe is billing a workspace that does not exist',\n    description:\n      'A subscription names a workspace that was deleted or erased, so the customer keeps being charged for nothing. Cancel or refund it in Stripe.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Subscription bills a missing workspace',\n    body:\n      'Stripe subscription {{subscriptionId}} (customer {{customerId}}, plan {{plan}}) names workspace {{orgId}}, which {{reason}}. The {{eventType}} event changed nothing. Cancel or refund it in Stripe.',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.usageNotReported',\n    label: 'Metered usage not reported to Stripe',\n    description:\n      'A closed month measured billable usage and it reached no invoice. Report it to Stripe by hand or the revenue is lost.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Usage for {{month}} not billed on {{orgId}}',\n    body:\n      'The closed month {{month}} measured {{amount}} of billable usage on workspace {{orgName}} ({{orgId}}), and it was not reported to Stripe ({{reason}}). Nothing will invoice it until somebody does.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 7 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.webhookSignatureRejected',\n    label: 'Billing webhook failing its signature check',\n    description:\n      'Repeated deliveries to the billing webhook were refused because their signature did not match. Usually a rolled signing secret: until it is fixed, Stripe cannot tell the install about money.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Billing webhook is refusing deliveries',\n    body:\n      'The billing webhook refused several signed deliveries within six hours because their Stripe signature matched none of the configured secrets. If Stripe is the sender, its signing secret no longer matches this install’s, and no billing event is being applied.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    minOccurrences: 3,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.webhookInert',\n    label: 'Billing webhook delivery moved nothing',\n    description:\n      'Stripe delivered an event this install subscribed to, and no handler did anything with it. Usually a handler that stopped being registered.',\n    tier: 'must',\n    category: 'billing',\n    title: 'A {{eventType}} delivery changed nothing',\n    body:\n      'Stripe event {{eventId}} ({{eventType}}) was accepted and no handler acted on it. Check which handler stopped being registered, then replay the event.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n\n  // ── MUST: data protection and records ───────────────────────────────────\n  {\n    type: 'data.personErasureFailed',\n    label: 'Personal data erasure failed',\n    description:\n      'A data subject’s erasure request failed. It will be retried, but the legal deadline keeps running: read the error and fix the cause.',\n    tier: 'must',\n    category: 'data',\n    title: 'Erasure request {{requestId}} failed',\n    body:\n      'The erasure request {{requestId}} on workspace {{orgName}} ({{orgId}}) failed (attempt {{attempt}}): {{error}}. The statutory deadline keeps running while it retries.',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'data.orgErasureFailed',\n    label: 'Workspace erasure failed',\n    description:\n      'A workspace scheduled for erasure could not be erased. Its data is still held after the date it was promised gone.',\n    tier: 'must',\n    category: 'data',\n    title: 'Workspace {{orgId}} could not be erased',\n    body:\n      'The scheduled erasure of workspace {{orgName}} ({{orgId}}) did not complete: {{reason}}. It will be retried on the next run; its data is held until it succeeds.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'data.backupExportFailed',\n    label: 'Database export failed',\n    description:\n      'The scheduled database export did not start. A stale export means the worst day has nothing to restore from.',\n    tier: 'must',\n    category: 'data',\n    title: 'Database export failed',\n    body:\n      'The scheduled database export did not start ({{reason}}). The last good export is getting older; check the service account’s export permission and the bucket.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 12 * 60,\n    defaultEnabled: true,\n  },\n\n  // ── MUST: legal ─────────────────────────────────────────────────────────\n  {\n    type: 'legal.abuseReportHigh',\n    label: 'Takedown, impersonation or illegal-content report',\n    description:\n      'A DMCA takedown, impersonation or illegal-content report. Each carries a response duty; review it on Staff → Abuse reports.',\n    tier: 'must',\n    category: 'legal',\n    title: '{{category}} report on {{site}}',\n    body:\n      '{{site}} was reported for {{category}}. Reference {{reference}}. Review it and respond within the policy’s window.',\n    link: '/admin/abuse-reports',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n  },\n\n  // ── MUST/SHOULD: health ─────────────────────────────────────────────────\n  {\n    type: 'system.healthDegraded',\n    label: 'Health check degraded',\n    description:\n      'A health check went from healthy to degraded: scheduled jobs silent, backups stale, billing deliveries failing, sign-ups refused, server errors, a site not rendering. Told once per incident.',\n    tier: 'must',\n    category: 'ops',\n    title: '{{check}} is degraded',\n    body: '{{check}} went from healthy to degraded. {{detail}}',\n    link: '/admin/health',\n    delivery: 'immediate',\n    // Must-know, and still amber rather than red: degraded is not down.\n    level: 'warning',\n    // A check flapping across the line is told once an hour, not on\n    // every swing.\n    dedupeWindowMinutes: 60,\n    defaultEnabled: true,\n  },\n  {\n    // The post-deploy production canary (AGL-3567), raised from GitHub\n    // Actions through `/api/admin/operator-alerts/canary`. Red because a\n    // deploy that stops rendering pages is every published site down.\n    type: 'ops.productionCanaryRed',\n    label: 'Production canary failed after a deploy',\n    description:\n      'Right after a tenant or console production deploy, uncached pages stopped rendering. The canary rolls the deploy back by itself when the failure holds across sites; after any rollback the next release must be promoted by hand.',\n    tier: 'must',\n    category: 'ops',\n    title: '{{project}} production canary: {{outcome}}',\n    body: '{{detail}}',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'critical',\n    // The caller dedupes per deployment and verdict; this only stops a\n    // re-run of the same red run from telling it twice.\n    dedupeWindowMinutes: 30,\n    defaultEnabled: true,\n  },\n  {\n    type: 'system.healthRecovered',\n    label: 'Health check recovered',\n    description: 'A degraded health check is healthy again.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{check}} recovered',\n    body: '{{check}} is healthy again after {{duration}}.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'success',\n    // A check flapping across the line is told once an hour, not on\n    // every swing.\n    dedupeWindowMinutes: 60,\n    defaultEnabled: true,\n  },\n  {\n    // The render monitor (AGL-3568): a published site fetched over HTTP, on\n    // pages no cache can answer, failed several runs in a row. Red, not the\n    // amber of a degraded check: every visitor without a cached copy is\n    // getting an error page or a timeout right now.\n    type: 'system.siteRenderFailing',\n    label: 'Published site not rendering pages',\n    description:\n      'The render monitor asked a published site for pages no cache can answer, several runs in a row, and got no complete page back. Visitors to cached pages may still see them, so the site can look up while every other page fails. Check the latest site runtime deployment first and roll it back if it just shipped.',\n    tier: 'must',\n    category: 'ops',\n    title: 'Pages are not rendering on {{site}}',\n    body:\n      '{{site}} failed {{failures}} render checks in a row, over {{since}}. {{detail}} Cached pages may still load, so the site can look up while new renders fail.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    // Told once per outage: the monitor raises it on the edge, and the\n    // window only covers a site flapping across the line.\n    dedupeWindowMinutes: 30,\n    defaultEnabled: true,\n  },\n  {\n    type: 'system.siteRenderRecovered',\n    label: 'Published site rendering again',\n    description:\n      'A published site the render monitor had reported as not rendering serves fresh pages again.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{site}} is rendering pages again',\n    body: 'Fresh page renders on {{site}} pass again after {{duration}}.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'success',\n    dedupeWindowMinutes: 30,\n    defaultEnabled: true,\n  },\n  {\n    // The render monitor could not see the site (AGL-3580): bot protection\n    // answered every probe it made, so it knows nothing about whether pages\n    // render. Not an outage, and never worded as one — on 2026-10-05 a\n    // missing probe token read as \"pages are not rendering\" for three hours\n    // while the site served pages. Amber: detection is off until it is fixed.\n    type: 'system.renderMonitorBlind',\n    label: 'Render monitor cannot see a site',\n    description:\n      'Bot protection answered the render monitor instead of a published site, several runs in a row, so nothing is checking whether that site renders pages. The site itself may be fine. Check AGLYN_PROBE_TOKEN on the console and the \"CI and uptime probe bypass\" firewall rule on the site runtime.',\n    tier: 'must',\n    category: 'ops',\n    title: 'The render monitor cannot see {{site}}',\n    body:\n      'Bot protection answered instead of {{site}} for {{runs}} runs in a row, so nothing is checking its pages. {{detail}} This is not a verdict on the site.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'warning',\n    dedupeWindowMinutes: 360,\n    defaultEnabled: true,\n  },\n\n  // ── SHOULD: billing ─────────────────────────────────────────────────────\n  {\n    type: 'billing.autoLocked',\n    label: 'Workspace billing locked automatically',\n    description:\n      'A workspace crossed its spend guard and the platform locked its billable activity. Check it is not a false positive before the customer notices.',\n    tier: 'should',\n    category: 'billing',\n    title: 'Billing locked on {{orgName}}',\n    body:\n      'Workspace {{orgName}} ({{orgId}}) was locked automatically: {{reason}}.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.platformInvoiceUncollectible',\n    label: 'Subscription invoice voided or uncollectible',\n    description:\n      'A workspace invoice was voided or marked uncollectible: revenue the books expected is not coming.',\n    tier: 'should',\n    category: 'billing',\n    title: 'Invoice {{status}} on {{orgId}}',\n    body:\n      'Invoice {{invoiceId}} for {{amount}} on workspace {{orgName}} ({{orgId}}) was marked {{status}}, so Stripe has stopped collecting it.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 30 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.connectPayoutFailed',\n    label: 'Connected account payout or transfer failed',\n    description:\n      'Money due to a merchant or seller did not arrive. Stripe retries on its own schedule; a human decides what happens next.',\n    tier: 'should',\n    category: 'billing',\n    title: 'A {{kind}} to {{account}} failed',\n    body:\n      'A {{amount}} Stripe {{kind}} ({{stripeId}}) to connected account {{account}} ({{merchant}}) failed: {{reason}}. The merchant’s funds are not where the ledger says.',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 30 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'staff.paymentFailed',\n    label: 'Workspace payment failed',\n    description:\n      'A paying workspace’s renewal failed. Stripe is retrying; the customer has been told.',\n    tier: 'should',\n    category: 'billing',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'staff.paymentFailed',\n  },\n\n  // ── SHOULD: security ────────────────────────────────────────────────────\n  {\n    type: 'security.staffGranted',\n    label: 'Staff access granted or raised',\n    description:\n      'Somebody was made staff, or a staff role was raised. If nobody on the team did it, revoke it and rotate credentials.',\n    tier: 'should',\n    category: 'security',\n    title: '{{target}} is now {{role}} staff',\n    body: '{{actor}} granted {{target}} the {{role}} staff role (was {{previous}}).',\n    link: '/admin/users',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n  },\n\n  // ── SHOULD: support ─────────────────────────────────────────────────────\n  {\n    type: 'support.slaBreached',\n    label: 'Support ticket past its response time',\n    description:\n      'A support ticket passed its promised response time without a staff reply.',\n    tier: 'should',\n    category: 'support',\n    title: 'Ticket past its response time: {{subject}}',\n    body:\n      'The {{tier}} ticket “{{subject}}” from workspace {{orgName}} ({{orgId}}) was due a first response {{overdue}} ago and has none.',\n    // The ticket itself: the support page opens `?ticketId=` on load.\n    link: '/admin/support?ticketId={{ticketId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'support.ticketOpened',\n    label: 'New support ticket',\n    description: 'A subscriber opened a support ticket.',\n    tier: 'should',\n    category: 'support',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'support.ticketOpened',\n    // A customer asking for help, not a fault.\n    level: 'info',\n  },\n  {\n    type: 'support.ticketReply',\n    label: 'Support ticket reply',\n    description: 'A subscriber replied on a support ticket.',\n    tier: 'should',\n    category: 'support',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'support.ticketReply',\n    level: 'info',\n  },\n\n  // ── SHOULD: deliverability ──────────────────────────────────────────────\n  {\n    type: 'deliverability.sendRateSaturated',\n    label: 'Email send-rate governor saturated',\n    description:\n      'The platform’s email send-rate budget is exhausted, so sends are being deferred. Raise the budget or find the sender filling it.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Email sending is being throttled',\n    body:\n      'The {{scope}} send-rate budget is full ({{detail}}), so sends are being deferred.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    type: 'deliverability.sendRateUnavailable',\n    label: 'Email send-rate governor unavailable',\n    description:\n      'The send-rate governor could not read its counters, so mail is going out unmetered: nothing is holding the shared domains under their hourly ceiling.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Email send-rate governor unavailable',\n    body:\n      'The send-rate governor could not read its counters ({{error}}), so sends are being allowed unmetered until it can.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    type: 'deliverability.gatewayBlocking',\n    label: 'A recipient gateway is blocking the shared domain',\n    description:\n      'A mail gateway is refusing mail from the shared sending domain, so everyone behind that gateway stops receiving it.',\n    tier: 'should',\n    category: 'deliverability',\n    title: '{{gateway}} is blocking {{domain}}',\n    body:\n      'Mail from {{domain}} is being refused by {{gateway}} ({{detail}}). Recipients behind that gateway are not receiving it.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'deliverability.providerCredentialsRejected',\n    label: 'Email provider rejected the credentials',\n    description:\n      'The email provider refused the API key, or a sending pool is unhealthy: invites, password resets and receipts are not leaving. The webhook channel is the one that still reaches you.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Email delivery is failing: {{problem}}',\n    body: '{{detail}}',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    // A purchasing ceiling, not a job failure: the provisioning sweep ran\n    // and every site keeps sending, so the copy must not read as an outage.\n    type: 'deliverability.sendingDomainCapacityFull',\n    label: 'Sending-domain allowance full',\n    description:\n      'Every dedicated sending domain the provider allowance covers is in use, so new sites that ask for one stay on the shared pool. No mail is lost; raise the allowance or move merchants onto domains they own.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Sending-domain allowance full ({{held}}/{{capacity}})',\n    body:\n      'The sending-domain allowance is full ({{held}} of {{capacity}} in use), so sites that asked for a dedicated domain keep sending on the shared pool. No mail is lost: what they go without is the isolation a domain of their own buys, and their campaigns are held to the pool’s stricter reputation limits. Raise AGLYN_SENDING_DOMAIN_CAPACITY once the provider allowance covers it, or move merchants onto domains they own.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n\n  // ── SHOULD: operations ──────────────────────────────────────────────────\n  {\n    type: 'ops.reaperStuck',\n    label: 'A reaper is stuck or failing',\n    description:\n      'A cleanup job (sending domains, unverified workspaces) could not finish, so what it removes keeps accumulating.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{job}} is stuck',\n    body: '{{job}} could not finish: {{detail}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'ops.pluginJobFailed',\n    label: 'A plugin job failed',\n    description:\n      'A plugin’s scheduled job threw: consent-group changes, the publish outbox, sending-domain provisioning, a plugin cron.',\n    tier: 'should',\n    category: 'ops',\n    // `job` is a noun phrase that reads as a subject on its own (\"The\n    // publish outbox drain\", \"The scheduled job acme-mail-send\"), so the\n    // title and the body open with the same words.\n    title: '{{job}} failed',\n    body: '{{job}} failed: {{error}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    type: 'system.pluginVerifierRegression',\n    label: 'Plugin verifier regression',\n    description:\n      'A live plugin version stopped passing the static verifier.',\n    tier: 'should',\n    category: 'security',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.pluginVerifierRegression',\n  },\n  {\n    type: 'system.bandwidthCeilingTripped',\n    label: 'Bandwidth ceiling reached',\n    description:\n      'A site crossed the per-month bandwidth abuse ceiling.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.bandwidthCeilingTripped',\n  },\n\n  // ── LOW ─────────────────────────────────────────────────────────────────\n  {\n    type: 'marketplace.review',\n    label: 'Plugin listing waiting for review',\n    description: 'A plugin listing or version was submitted for review.',\n    tier: 'low',\n    category: 'security',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'marketplace.review',\n  },\n  {\n    type: 'system.scopeDrift',\n    label: 'Resources missing a sharing scope',\n    description:\n      'The weekly sweep found documents invisible to every site-scoped read: a creation path forgot the field.',\n    tier: 'low',\n    category: 'data',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.scopeDrift',\n  },\n]\n\n/** An amount in minor units, as an alert prints it: `$12.40`. */\nexport function formatOperatorAlertAmount(\n  cents: number,\n  currency = 'usd',\n): string {\n  const value = Number(cents) / 100\n  if (!Number.isFinite(value)) return ''\n  try {\n    return new Intl.NumberFormat('en-US', {\n      style: 'currency',\n      currency: String(currency || 'usd').toUpperCase(),\n    }).format(value)\n  } catch {\n    return `${value.toFixed(2)} ${String(currency).toUpperCase()}`\n  }\n}\n\n/** Replaces each `{{token}}` with its context value, or nothing. */\nexport function renderOperatorAlertTemplate(\n  template: string,\n  context: OperatorAlertContext | undefined,\n): string {\n  return String(template ?? '')\n    .replace(/\\{\\{\\s*([\\w.]+)\\s*\\}\\}/g, (_match, name: string) => {\n      const value = context?.[name]\n      return value === null || value === undefined ? '' : String(value)\n    })\n    .replace(/\\(\\s*\\)/g, '')\n    .replace(/[ \\t]{2,}/g, ' ')\n    .replace(/ ([.,;:])/g, '$1')\n    .trim()\n}\n\n/** A staff member's answer for one type; an absent key keeps the default. */\nexport interface OperatorAlertTypeSetting {\n  enabled?: boolean\n  delivery?: OperatorAlertDelivery\n}\n\n/** `platformSettings/operatorAlerts`, keyed by alert type. */\nexport interface OperatorAlertSettings {\n  types?: Record<string, OperatorAlertTypeSetting>\n}\n\n/** Whether a type is on, and how it is delivered, after staff's answers. */\nexport function effectiveOperatorAlertSetting(\n  definition: Pick<OperatorAlertDefinition, 'type' | 'delivery' | 'defaultEnabled'>,\n  settings: OperatorAlertSettings | null | undefined,\n): { enabled: boolean; delivery: OperatorAlertDelivery } {\n  const answer = settings?.types?.[definition.type]\n  return {\n    enabled:\n      typeof answer?.enabled === 'boolean'\n        ? answer.enabled\n        : definition.defaultEnabled,\n    delivery:\n      answer?.delivery === 'immediate' || answer?.delivery === 'digest'\n        ? answer.delivery\n        : definition.delivery,\n  }\n}\n\n/**\n * Staff notification types whose alert emails the operator on a coded\n * default of immediate (AGL-3375), derived from the catalog so there is one\n * list.\n */\nexport const OPERATOR_ALERT_NOTIFICATION_TYPES: ReadonlySet<string> = new Set(\n  CORE_OPERATOR_ALERTS.flatMap((definition) =>\n    definition.notificationType ? [definition.notificationType] : [],\n  ),\n)\n"],"names":["OPERATOR_ALERT_DEFAULT_NOTIFICATION_TYPE","OPERATOR_ALERT_TIER_LABELS","must","should","low","OPERATOR_ALERT_TIER_LEVELS","operatorAlertLevel","definition","level","tier","OPERATOR_ALERT_CATEGORY_LABELS","billing","payments","legal","data","ops","deliverability","security","support","DAY","CORE_OPERATOR_ALERTS","type","label","description","category","title","body","link","delivery","dedupeWindowMinutes","defaultEnabled","notificationType","minOccurrences","formatOperatorAlertAmount","cents","currency","value","Number","isFinite","Intl","NumberFormat","style","String","toUpperCase","format","toFixed","renderOperatorAlertTemplate","template","context","replace","_match","name","undefined","trim","effectiveOperatorAlertSetting","settings","answer","types","enabled","OPERATOR_ALERT_NOTIFICATION_TYPES","Set","flatMap"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GA6GD,iEAAiE,GACjE,OAAO,MAAMA,2CACX,uBAAsB;AAExB,OAAO,MAAMC,6BAAgE;IAC3EC,MAAM;IACNC,QAAQ;IACRC,KAAK;AACP,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,6BAGT;IACFH,MAAM;IACNC,QAAQ;IACRC,KAAK;AACP,EAAC;AAED,kEAAkE,GAClE,OAAO,SAASE,mBACdC,UAA2D;QAEpDA;IAAP,QAAOA,oBAAAA,WAAWC,KAAK,YAAhBD,oBAAoBF,0BAA0B,CAACE,WAAWE,IAAI,CAAC;AACxE;AAEA,OAAO,MAAMC,iCAGT;IACFC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;IACNC,KAAK;IACLC,gBAAgB;IAChBC,UAAU;IACVC,SAAS;AACX,EAAC;AAED,MAAMC,MAAM,KAAK;AAEjB;;;CAGC,GACD,OAAO,MAAMC,uBAA2D;IACtE,0EAA0E;IAC1E;QACEC,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACE,wEAAwE;QACxE,oEAAoE;QACpEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACV,qEAAqE;QACrEC,qBAAqBV;QACrBW,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IAEA,2EAA2E;IAC3E;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,KAAKV;QAC1BW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFE,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAIV;QACzBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBG,gBAAgB;QAChBF,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFE,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,KAAK;QAC1BC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACV,oEAAoE;QACpEpB,OAAO;QACP,gEAAgE;QAChE,eAAe;QACfqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACE,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACP,mEAAmE;QACnE,oDAAoD;QACpDqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACP,gEAAgE;QAChE,eAAe;QACfqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,gDAAgD;QAChDT,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACV,mEAAmE;QACnE,sDAAsD;QACtDC,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACPqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1ET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACPqB,qBAAqB;QACrBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,KAAKV;QAC1BW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFE,UAAU;QACVC,qBAAqB,KAAKV;QAC1BW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IAEA,2EAA2E;IAC3E;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACF,kEAAkE;QAClEC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;QAClB,2CAA2C;QAC3CvB,OAAO;IACT;IACA;QACEa,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;QAClBvB,OAAO;IACT;IAEA,2EAA2E;IAC3E;QACEa,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACE,sEAAsE;QACtE,wEAAwE;QACxET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACV,kEAAkE;QAClE,qEAAqE;QACrE,+CAA+C;QAC/CC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IAEA,2EAA2E;IAC3E;QACEV,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;CACD,CAAA;AAED,+DAA+D,GAC/D,OAAO,SAASE,0BACdC,KAAa,EACbC,WAAW,KAAK;IAEhB,MAAMC,QAAQC,OAAOH,SAAS;IAC9B,IAAI,CAACG,OAAOC,QAAQ,CAACF,QAAQ,OAAO;IACpC,IAAI;QACF,OAAO,IAAIG,KAAKC,YAAY,CAAC,SAAS;YACpCC,OAAO;YACPN,UAAUO,OAAOP,YAAY,OAAOQ,WAAW;QACjD,GAAGC,MAAM,CAACR;IACZ,EAAE,eAAM;QACN,OAAO,GAAGA,MAAMS,OAAO,CAAC,GAAG,CAAC,EAAEH,OAAOP,UAAUQ,WAAW,IAAI;IAChE;AACF;AAEA,kEAAkE,GAClE,OAAO,SAASG,4BACdC,QAAgB,EAChBC,OAAyC;IAEzC,OAAON,OAAOK,mBAAAA,WAAY,IACvBE,OAAO,CAAC,2BAA2B,CAACC,QAAQC;QAC3C,MAAMf,QAAQY,2BAAAA,OAAS,CAACG,KAAK;QAC7B,OAAOf,UAAU,QAAQA,UAAUgB,YAAY,KAAKV,OAAON;IAC7D,GACCa,OAAO,CAAC,YAAY,IACpBA,OAAO,CAAC,cAAc,KACtBA,OAAO,CAAC,cAAc,MACtBI,IAAI;AACT;AAaA,0EAA0E,GAC1E,OAAO,SAASC,8BACd/C,UAAiF,EACjFgD,QAAkD;QAEnCA;IAAf,MAAMC,SAASD,6BAAAA,kBAAAA,SAAUE,KAAK,qBAAfF,eAAiB,CAAChD,WAAWc,IAAI,CAAC;IACjD,OAAO;QACLqC,SACE,QAAOF,0BAAAA,OAAQE,OAAO,MAAK,YACvBF,OAAOE,OAAO,GACdnD,WAAWuB,cAAc;QAC/BF,UACE4B,CAAAA,0BAAAA,OAAQ5B,QAAQ,MAAK,eAAe4B,CAAAA,0BAAAA,OAAQ5B,QAAQ,MAAK,WACrD4B,OAAO5B,QAAQ,GACfrB,WAAWqB,QAAQ;IAC3B;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAM+B,oCAAyD,IAAIC,IACxExC,qBAAqByC,OAAO,CAAC,CAACtD,aAC5BA,WAAWwB,gBAAgB,GAAG;QAACxB,WAAWwB,gBAAgB;KAAC,GAAG,EAAE,GAEnE"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/operator-alerts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynNotificationType, NotificationLevel } from './notifications'\n\n/**\n * OPERATOR ALERTS (AGL-3377): the events whoever runs an install must hear\n * about, as one typed catalog.\n *\n * Every alert is an entry here (or a plugin's entry in the same shape,\n * registered through `@aglyn/aglyn/plugin-manager/operator-alerts`) and is\n * raised through ONE server entry point, `raiseOperatorAlert` in\n * `@aglyn/tenant-data-admin/server/operator-alerts`. That entry point writes\n * the staff console notification, dedupes a flapping condition, honours the\n * per-type switches staff set on Staff → Operator alerts, and delivers by\n * email (the `operator-alert` system email) and the optional out-of-band\n * webhook. No call site composes or sends its own mail.\n *\n * The catalog holds nothing install-specific: no address, no domain, no\n * host. Recipients come from `resolveStaffAlertRecipients()` and the webhook\n * from `OPERATOR_ALERT_WEBHOOK_URL`, so an entry reads the same on aglyn.com,\n * on a self-hosted install and in an OSS consumer's deployment.\n *\n * Copy is written against merge tokens (`{{orgId}}`), filled from the\n * `context` the call site passes. A token the call site did not supply is\n * blanked, so every sentence must still read when its optional tokens are\n * empty. Never put a data subject's address or other personal data into a\n * context: the alert travels to an inbox and a webhook, not only the console.\n */\n\n/**\n * How much an alert matters.\n *\n * - `must` — money moving with nobody looking, a legal duty unmet, data not\n *   protected or not erased. On and immediate unless staff change it.\n * - `should` — a fault an operator wants to know about today.\n * - `low` — routine review work; on, and batched into the daily digest.\n */\nexport type OperatorAlertTier = 'must' | 'should' | 'low'\n\nexport type OperatorAlertCategory =\n  | 'billing'\n  | 'payments'\n  | 'legal'\n  | 'data'\n  | 'ops'\n  | 'deliverability'\n  | 'security'\n  | 'support'\n\n/** `digest` batches the alert into the once-a-day operator digest. */\nexport type OperatorAlertDelivery = 'immediate' | 'digest'\n\nexport interface OperatorAlertDefinition {\n  /**\n   * Stable id, also the key of its settings row. Never rename: staff\n   * switches are stored under it. A plugin's types start with its plugin id\n   * and a dot (`commerce.taxNotReversed`).\n   */\n  type: string\n  /** The settings row's name. */\n  label: string\n  /** What it means and the first thing to do, for the settings page. */\n  description: string\n  tier: OperatorAlertTier\n  category: OperatorAlertCategory\n  /** The notification title and email subject, with `{{tokens}}`. */\n  title: string\n  /** What happened and what to do, with `{{tokens}}`. */\n  body: string\n  /** Console path the alert opens, with `{{tokens}}`; the call may override. */\n  link?: string\n  /** The coded default; staff may change it. */\n  delivery: OperatorAlertDelivery\n  /**\n   * How long one `dedupeKey` stays quiet after it fired, in minutes. A\n   * condition that flaps inside the window is told once. `0` never dedupes.\n   * A call without a `dedupeKey` is never deduped.\n   */\n  dedupeWindowMinutes: number\n  /**\n   * Fire only once the same `dedupeKey` has been raised this many times\n   * inside the window — for an endpoint any stranger can hit, where one\n   * refused request is noise and several are a broken secret. Default 1.\n   */\n  minOccurrences?: number\n  /** The coded default; staff may change it. */\n  defaultEnabled: boolean\n  /**\n   * The console notification's type. Absent is the generic\n   * `system.operatorAlert`; a type that already had its own notification\n   * keeps it, so its icon, label and everyone's mutes are unchanged.\n   */\n  notificationType?: AglynNotificationType\n  /**\n   * How loud its console notification is drawn (AGL-3437). Absent, the\n   * tier answers — see {@link operatorAlertLevel}. Set where the tone and\n   * the importance part ways: a recovery is worth hearing about and is good\n   * news, and a degraded check is a must-know that is not yet an outage.\n   */\n  level?: NotificationLevel\n  /** The plugin that contributed it; absent for core's own. */\n  pluginId?: string\n}\n\n/** Values a call site passes for an alert's `{{tokens}}`. */\nexport type OperatorAlertContext = Readonly<\n  Record<string, string | number | boolean | null | undefined>\n>\n\n/** The notification type an alert without its own writes under. */\nexport const OPERATOR_ALERT_DEFAULT_NOTIFICATION_TYPE: AglynNotificationType =\n  'system.operatorAlert'\n\nexport const OPERATOR_ALERT_TIER_LABELS: Record<OperatorAlertTier, string> = {\n  must: 'Must know',\n  should: 'Should know',\n  low: 'Routine',\n}\n\n/**\n * The level an alert's notification is drawn at when its entry names none:\n * a must-know is red, a should-know amber, routine review work informational.\n */\nexport const OPERATOR_ALERT_TIER_LEVELS: Record<\n  OperatorAlertTier,\n  NotificationLevel\n> = {\n  must: 'critical',\n  should: 'warning',\n  low: 'info',\n}\n\n/** The level an alert's console notification carries (AGL-3437). */\nexport function operatorAlertLevel(\n  definition: Pick<OperatorAlertDefinition, 'tier' | 'level'>,\n): NotificationLevel {\n  return definition.level ?? OPERATOR_ALERT_TIER_LEVELS[definition.tier]\n}\n\nexport const OPERATOR_ALERT_CATEGORY_LABELS: Record<\n  OperatorAlertCategory,\n  string\n> = {\n  billing: 'Billing',\n  payments: 'Payments & payouts',\n  legal: 'Legal',\n  data: 'Data protection',\n  ops: 'Operations',\n  deliverability: 'Email deliverability',\n  security: 'Security',\n  support: 'Support',\n}\n\nconst DAY = 24 * 60\n\n/**\n * Core's alerts. Plugins contribute theirs through the plugin-manager\n * registry; nothing plugin-specific belongs in this list.\n */\nexport const CORE_OPERATOR_ALERTS: readonly OperatorAlertDefinition[] = [\n  // ── Fraud, risk and legal duties already alerting before AGL-3377 ──────\n  {\n    type: 'system.abuseReportUrgent',\n    label: 'Urgent abuse, fraud or risk alert',\n    description:\n      'Phishing, malware or CSAM reported on a site, card testing, a flagged or disputed payment, a held phishing email, a seller under review. Review it on Staff → Abuse reports.',\n    tier: 'must',\n    category: 'security',\n    title: '{{title}}',\n    body: '{{body}}',\n    link: '/admin/abuse-reports',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.abuseReportUrgent',\n  },\n  {\n    // The one lock no person placed (AGL-3450): staff confirm it before the\n    // customer's appeal arrives, and re-place it as `abuse` or lift it.\n    type: 'security.pageSecurityHold',\n    label: 'Automatic security hold on a new workspace',\n    description:\n      'The page screen held a phishing page from a workspace in its first two weeks and locked the workspace, the site and the publishing account as security. Confirm it on Staff → Abuse reports, then re-place it as abuse on Staff → Lockdown, or lift it there if it is a false positive.',\n    tier: 'must',\n    category: 'security',\n    title: 'Security hold placed on {{orgName}}',\n    body:\n      '{{page}} on {{siteName}} ({{hostId}}) was held for review: {{signal}} Locked as security, pending your review: {{locks}}. The abuse row is {{reference}}. Lift the hold, or re-place it as abuse, on Staff → Lockdown (/admin/lockdown).',\n    link: '/admin/abuse-reports?report={{reviewId}}',\n    delivery: 'immediate',\n    // One hold per workspace; a repeat inside the day is the same event.\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n    notificationType: 'system.abuseReportUrgent',\n  },\n  {\n    type: 'security.paymentFraudHold',\n    label: 'Automatic security hold for payment fraud',\n    description:\n      'Stripe flagged a workspace\\'s own subscription payment as fraud — a Radar block at highest risk, a Stripe fraud report, three or more cards failing within 30 minutes, an early fraud warning or a Radar review. A new workspace that never paid is locked as security (takedown) with its subscriptions canceled; an older or paying one is not locked and needs a decision. Confirm it on Staff → Abuse reports, then re-place it as abuse on Staff → Lockdown, or lift it there.',\n    tier: 'must',\n    category: 'security',\n    title: '{{action}}: {{orgName}}',\n    body:\n      '{{trigger}} on {{orgName}} ({{orgId}}). Charges: {{charges}}; cards: {{cards}}, issued in {{cardCountries}}. Locked: {{locks}}. The abuse row is {{reference}}. Lift it, or re-place it as abuse, on Staff → Lockdown (/admin/lockdown).',\n    link: '/admin/abuse-reports?report={{reviewId}}',\n    delivery: 'immediate',\n    // One per workspace per window: every further card in the burst is the\n    // same event, and the abuse row carries all of them.\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n    notificationType: 'system.abuseReportUrgent',\n  },\n  {\n    type: 'system.disputeUnattributed',\n    label: 'Card dispute with no owner',\n    description:\n      'A chargeback arrived that no subscription, order or marketplace purchase claimed, so nothing is answering it. Find the charge in Stripe and respond before the evidence deadline.',\n    tier: 'must',\n    category: 'billing',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.disputeUnattributed',\n  },\n  {\n    type: 'system.dmcaCounterNotice',\n    label: 'DMCA counter-notice',\n    description:\n      'A customer contested a takedown. The statutory clock is already running; forward it to the complainant and restore on time unless they file suit.',\n    tier: 'must',\n    category: 'legal',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.dmcaCounterNotice',\n  },\n  {\n    type: 'system.billingWebhookHalfApplied',\n    label: 'Billing webhook half applied',\n    description:\n      'A Stripe event threw after its handlers began, so its effects may be partly applied and Stripe will not retry it. Reconcile the event by hand.',\n    tier: 'must',\n    category: 'billing',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.billingWebhookHalfApplied',\n  },\n\n  // ── MUST: billing ───────────────────────────────────────────────────────\n  {\n    type: 'billing.platformDisputeLost',\n    label: 'Subscription dispute lost',\n    description:\n      'A card dispute on a workspace subscription closed as lost: the money has been taken back. Decide whether the workspace keeps its plan.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Subscription dispute lost on workspace {{orgId}}',\n    body:\n      'The card dispute {{disputeId}} on invoice {{invoiceId}} for workspace {{orgName}} ({{orgId}}) closed as lost ({{reason}}), and {{amount}} was taken back. The workspace keeps its plan until somebody decides otherwise.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 30 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.orphanedSubscription',\n    label: 'Stripe is billing a workspace that does not exist',\n    description:\n      'A subscription names a workspace that was deleted or erased, so the customer keeps being charged for nothing. Cancel or refund it in Stripe.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Subscription bills a missing workspace',\n    body:\n      'Stripe subscription {{subscriptionId}} (customer {{customerId}}, plan {{plan}}) names workspace {{orgId}}, which {{reason}}. The {{eventType}} event changed nothing. Cancel or refund it in Stripe.',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.usageNotReported',\n    label: 'Metered usage not reported to Stripe',\n    description:\n      'A closed month measured billable usage and it reached no invoice. Report it to Stripe by hand or the revenue is lost.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Usage for {{month}} not billed on {{orgId}}',\n    body:\n      'The closed month {{month}} measured {{amount}} of billable usage on workspace {{orgName}} ({{orgId}}), and it was not reported to Stripe ({{reason}}). Nothing will invoice it until somebody does.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 7 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.webhookSignatureRejected',\n    label: 'Billing webhook failing its signature check',\n    description:\n      'Repeated deliveries to the billing webhook were refused because their signature did not match. Usually a rolled signing secret: until it is fixed, Stripe cannot tell the install about money.',\n    tier: 'must',\n    category: 'billing',\n    title: 'Billing webhook is refusing deliveries',\n    body:\n      'The billing webhook refused several signed deliveries within six hours because their Stripe signature matched none of the configured secrets. If Stripe is the sender, its signing secret no longer matches this install’s, and no billing event is being applied.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    minOccurrences: 3,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.webhookInert',\n    label: 'Billing webhook delivery moved nothing',\n    description:\n      'Stripe delivered an event this install subscribed to, and no handler did anything with it. Usually a handler that stopped being registered.',\n    tier: 'must',\n    category: 'billing',\n    title: 'A {{eventType}} delivery changed nothing',\n    body:\n      'Stripe event {{eventId}} ({{eventType}}) was accepted and no handler acted on it. Check which handler stopped being registered, then replay the event.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n\n  // ── MUST: data protection and records ───────────────────────────────────\n  {\n    type: 'data.personErasureFailed',\n    label: 'Personal data erasure failed',\n    description:\n      'A data subject’s erasure request failed. It will be retried, but the legal deadline keeps running: read the error and fix the cause.',\n    tier: 'must',\n    category: 'data',\n    title: 'Erasure request {{requestId}} failed',\n    body:\n      'The erasure request {{requestId}} on workspace {{orgName}} ({{orgId}}) failed (attempt {{attempt}}): {{error}}. The statutory deadline keeps running while it retries.',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'data.orgErasureFailed',\n    label: 'Workspace erasure failed',\n    description:\n      'A workspace scheduled for erasure could not be erased. Its data is still held after the date it was promised gone.',\n    tier: 'must',\n    category: 'data',\n    title: 'Workspace {{orgId}} could not be erased',\n    body:\n      'The scheduled erasure of workspace {{orgName}} ({{orgId}}) did not complete: {{reason}}. It will be retried on the next run; its data is held until it succeeds.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'data.backupExportFailed',\n    label: 'Database export failed',\n    description:\n      'The scheduled database export did not start. A stale export means the worst day has nothing to restore from.',\n    tier: 'must',\n    category: 'data',\n    title: 'Database export failed',\n    body:\n      'The scheduled database export did not start ({{reason}}). The last good export is getting older; check the service account’s export permission and the bucket.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 12 * 60,\n    defaultEnabled: true,\n  },\n\n  // ── MUST: legal ─────────────────────────────────────────────────────────\n  {\n    type: 'legal.abuseReportHigh',\n    label: 'Takedown, impersonation or illegal-content report',\n    description:\n      'A DMCA takedown, impersonation or illegal-content report. Each carries a response duty; review it on Staff → Abuse reports.',\n    tier: 'must',\n    category: 'legal',\n    title: '{{category}} report on {{site}}',\n    body:\n      '{{site}} was reported for {{category}}. Reference {{reference}}. Review it and respond within the policy’s window.',\n    link: '/admin/abuse-reports',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n  },\n\n  // ── MUST/SHOULD: health ─────────────────────────────────────────────────\n  {\n    type: 'system.healthDegraded',\n    label: 'Health check degraded',\n    description:\n      'A health check went from healthy to degraded: scheduled jobs silent, backups stale, billing deliveries failing, sign-ups refused, server errors, a site not rendering. Told once per incident.',\n    tier: 'must',\n    category: 'ops',\n    title: '{{check}} is degraded',\n    body: '{{check}} went from healthy to degraded. {{detail}}',\n    link: '/admin/health',\n    delivery: 'immediate',\n    // Must-know, and still amber rather than red: degraded is not down.\n    level: 'warning',\n    // A check flapping across the line is told once an hour, not on\n    // every swing.\n    dedupeWindowMinutes: 60,\n    defaultEnabled: true,\n  },\n  {\n    // The post-deploy production canary (AGL-3567), raised from GitHub\n    // Actions through `/api/admin/operator-alerts/canary`. Red because a\n    // deploy that stops rendering pages is every published site down.\n    type: 'ops.productionCanaryRed',\n    label: 'Production canary failed after a deploy',\n    description:\n      'Right after a tenant or console production deploy, uncached pages stopped rendering. The canary rolls the deploy back by itself when the failure holds across sites; after any rollback the next release must be promoted by hand.',\n    tier: 'must',\n    category: 'ops',\n    title: '{{project}} production canary: {{outcome}}',\n    body: '{{detail}}',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'critical',\n    // The caller dedupes per deployment and verdict; this only stops a\n    // re-run of the same red run from telling it twice.\n    dedupeWindowMinutes: 30,\n    defaultEnabled: true,\n  },\n  {\n    type: 'system.healthRecovered',\n    label: 'Health check recovered',\n    description: 'A degraded health check is healthy again.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{check}} recovered',\n    body: '{{check}} is healthy again after {{duration}}.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'success',\n    // A check flapping across the line is told once an hour, not on\n    // every swing.\n    dedupeWindowMinutes: 60,\n    defaultEnabled: true,\n  },\n  {\n    // The render monitor (AGL-3568): a published site fetched over HTTP, on\n    // pages no cache can answer, failed several runs in a row. Red, not the\n    // amber of a degraded check: every visitor without a cached copy is\n    // getting an error page or a timeout right now.\n    type: 'system.siteRenderFailing',\n    label: 'Published site not rendering pages',\n    description:\n      'The render monitor asked a published site for pages no cache can answer, several runs in a row, and got no complete page back. Visitors to cached pages may still see them, so the site can look up while every other page fails. Check the latest site runtime deployment first and roll it back if it just shipped.',\n    tier: 'must',\n    category: 'ops',\n    title: 'Pages are not rendering on {{site}}',\n    body:\n      '{{site}} failed {{failures}} render checks in a row, over {{since}}. {{detail}} Cached pages may still load, so the site can look up while new renders fail.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    // Told once per outage: the monitor raises it on the edge, and the\n    // window only covers a site flapping across the line.\n    dedupeWindowMinutes: 30,\n    defaultEnabled: true,\n  },\n  {\n    type: 'system.siteRenderRecovered',\n    label: 'Published site rendering again',\n    description:\n      'A published site the render monitor had reported as not rendering serves fresh pages again.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{site}} is rendering pages again',\n    body: 'Fresh page renders on {{site}} pass again after {{duration}}.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'success',\n    dedupeWindowMinutes: 30,\n    defaultEnabled: true,\n  },\n  {\n    // The render monitor could not see the site (AGL-3580): bot protection\n    // answered every probe it made, so it knows nothing about whether pages\n    // render. Not an outage, and never worded as one — on 2026-10-05 a\n    // missing probe token read as \"pages are not rendering\" for three hours\n    // while the site served pages. Amber: detection is off until it is fixed.\n    type: 'system.renderMonitorBlind',\n    label: 'Render monitor cannot see a site',\n    description:\n      'Bot protection answered the render monitor instead of a published site, several runs in a row, so nothing is checking whether that site renders pages. The site itself may be fine. Check AGLYN_PROBE_TOKEN on the console and the \"CI and uptime probe bypass\" firewall rule on the site runtime.',\n    tier: 'must',\n    category: 'ops',\n    title: 'The render monitor cannot see {{site}}',\n    body:\n      'Bot protection answered instead of {{site}} for {{runs}} runs in a row, so nothing is checking its pages. {{detail}} This is not a verdict on the site.',\n    link: '/admin/health',\n    delivery: 'immediate',\n    level: 'warning',\n    dedupeWindowMinutes: 360,\n    defaultEnabled: true,\n  },\n\n  // ── SHOULD: billing ─────────────────────────────────────────────────────\n  {\n    type: 'billing.autoLocked',\n    label: 'Workspace billing locked automatically',\n    description:\n      'A workspace crossed its spend guard and the platform locked its billable activity. Check it is not a false positive before the customer notices.',\n    tier: 'should',\n    category: 'billing',\n    title: 'Billing locked on {{orgName}}',\n    body:\n      'Workspace {{orgName}} ({{orgId}}) was locked automatically: {{reason}}.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.platformInvoiceUncollectible',\n    label: 'Subscription invoice voided or uncollectible',\n    description:\n      'A workspace invoice was voided or marked uncollectible: revenue the books expected is not coming.',\n    tier: 'should',\n    category: 'billing',\n    title: 'Invoice {{status}} on {{orgId}}',\n    body:\n      'Invoice {{invoiceId}} for {{amount}} on workspace {{orgName}} ({{orgId}}) was marked {{status}}, so Stripe has stopped collecting it.',\n    link: '/admin/orgs/{{orgId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 30 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'billing.connectPayoutFailed',\n    label: 'Connected account payout or transfer failed',\n    description:\n      'Money due to a merchant or seller did not arrive. Stripe retries on its own schedule; a human decides what happens next.',\n    tier: 'should',\n    category: 'billing',\n    title: 'A {{kind}} to {{account}} failed',\n    body:\n      'A {{amount}} Stripe {{kind}} ({{stripeId}}) to connected account {{account}} ({{merchant}}) failed: {{reason}}. The merchant’s funds are not where the ledger says.',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 30 * DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'staff.paymentFailed',\n    label: 'Workspace payment failed',\n    description:\n      'A paying workspace’s renewal failed. Stripe is retrying; the customer has been told.',\n    tier: 'should',\n    category: 'billing',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'staff.paymentFailed',\n  },\n\n  // ── SHOULD: security ────────────────────────────────────────────────────\n  {\n    type: 'security.staffGranted',\n    label: 'Staff access granted or raised',\n    description:\n      'Somebody was made staff, or a staff role was raised. If nobody on the team did it, revoke it and rotate credentials.',\n    tier: 'should',\n    category: 'security',\n    title: '{{target}} is now {{role}} staff',\n    body: '{{actor}} granted {{target}} the {{role}} staff role (was {{previous}}).',\n    link: '/admin/users',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n  },\n\n  // ── SHOULD: support ─────────────────────────────────────────────────────\n  {\n    type: 'support.slaBreached',\n    label: 'Support ticket past its response time',\n    description:\n      'A support ticket passed its promised response time without a staff reply.',\n    tier: 'should',\n    category: 'support',\n    title: 'Ticket past its response time: {{subject}}',\n    body:\n      'The {{tier}} ticket “{{subject}}” from workspace {{orgName}} ({{orgId}}) was due a first response {{overdue}} ago and has none.',\n    // The ticket itself: the support page opens `?ticketId=` on load.\n    link: '/admin/support?ticketId={{ticketId}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'support.ticketOpened',\n    label: 'New support ticket',\n    description: 'A subscriber opened a support ticket.',\n    tier: 'should',\n    category: 'support',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'support.ticketOpened',\n    // A customer asking for help, not a fault.\n    level: 'info',\n  },\n  {\n    type: 'support.ticketReply',\n    label: 'Support ticket reply',\n    description: 'A subscriber replied on a support ticket.',\n    tier: 'should',\n    category: 'support',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'support.ticketReply',\n    level: 'info',\n  },\n\n  // ── SHOULD: deliverability ──────────────────────────────────────────────\n  {\n    type: 'deliverability.sendRateSaturated',\n    label: 'Email send-rate governor saturated',\n    description:\n      'The platform’s email send-rate budget is exhausted, so sends are being deferred. Raise the budget or find the sender filling it.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Email sending is being throttled',\n    body:\n      'The {{scope}} send-rate budget is full ({{detail}}), so sends are being deferred.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    type: 'deliverability.sendRateUnavailable',\n    label: 'Email send-rate governor unavailable',\n    description:\n      'The send-rate governor could not read its counters, so mail is going out unmetered: nothing is holding the shared domains under their hourly ceiling.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Email send-rate governor unavailable',\n    body:\n      'The send-rate governor could not read its counters ({{error}}), so sends are being allowed unmetered until it can.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    type: 'deliverability.gatewayBlocking',\n    label: 'A recipient gateway is blocking the shared domain',\n    description:\n      'A mail gateway is refusing mail from the shared sending domain, so everyone behind that gateway stops receiving it.',\n    tier: 'should',\n    category: 'deliverability',\n    title: '{{gateway}} is blocking {{domain}}',\n    body:\n      'Mail from {{domain}} is being refused by {{gateway}} ({{detail}}). Recipients behind that gateway are not receiving it.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'deliverability.providerCredentialsRejected',\n    label: 'Email provider rejected the credentials',\n    description:\n      'The email provider refused the API key, or a sending pool is unhealthy: invites, password resets and receipts are not leaving. The webhook channel is the one that still reaches you.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Email delivery is failing: {{problem}}',\n    body: '{{detail}}',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    // A purchasing ceiling, not a job failure: the provisioning sweep ran\n    // and every site keeps sending, so the copy must not read as an outage.\n    type: 'deliverability.sendingDomainCapacityFull',\n    label: 'Sending-domain allowance full',\n    description:\n      'Every dedicated sending domain the provider allowance covers is in use, so new sites that ask for one stay on the shared pool. No mail is lost; raise the allowance or move merchants onto domains they own.',\n    tier: 'should',\n    category: 'deliverability',\n    title: 'Sending-domain allowance full ({{held}}/{{capacity}})',\n    body:\n      'The sending-domain allowance is full ({{held}} of {{capacity}} in use), so sites that asked for a dedicated domain keep sending on the shared pool. No mail is lost: what they go without is the isolation a domain of their own buys, and their campaigns are held to the pool’s stricter reputation limits. Raise AGLYN_SENDING_DOMAIN_CAPACITY once the provider allowance covers it, or move merchants onto domains they own.',\n    link: '/admin/emails',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n\n  // ── SHOULD: operations ──────────────────────────────────────────────────\n  {\n    type: 'ops.reaperStuck',\n    label: 'A reaper is stuck or failing',\n    description:\n      'A cleanup job (sending domains, unverified workspaces) could not finish, so what it removes keeps accumulating.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{job}} is stuck',\n    body: '{{job}} could not finish: {{detail}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: DAY,\n    defaultEnabled: true,\n  },\n  {\n    type: 'ops.pluginJobFailed',\n    label: 'A plugin job failed',\n    description:\n      'A plugin’s scheduled job threw: consent-group changes, the publish outbox, sending-domain provisioning, a plugin cron.',\n    tier: 'should',\n    category: 'ops',\n    // `job` is a noun phrase that reads as a subject on its own (\"The\n    // publish outbox drain\", \"The scheduled job acme-mail-send\"), so the\n    // title and the body open with the same words.\n    title: '{{job}} failed',\n    body: '{{job}} failed: {{error}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 6 * 60,\n    defaultEnabled: true,\n  },\n  {\n    type: 'system.pluginVerifierRegression',\n    label: 'Plugin verifier regression',\n    description:\n      'A live plugin version stopped passing the static verifier.',\n    tier: 'should',\n    category: 'security',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.pluginVerifierRegression',\n  },\n  {\n    type: 'system.bandwidthCeilingTripped',\n    label: 'Bandwidth ceiling reached',\n    description:\n      'A site crossed the per-month bandwidth abuse ceiling.',\n    tier: 'should',\n    category: 'ops',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'immediate',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.bandwidthCeilingTripped',\n  },\n\n  // ── LOW ─────────────────────────────────────────────────────────────────\n  {\n    type: 'marketplace.review',\n    label: 'Plugin listing waiting for review',\n    description: 'A plugin listing or version was submitted for review.',\n    tier: 'low',\n    category: 'security',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'marketplace.review',\n  },\n  {\n    type: 'system.scopeDrift',\n    label: 'Resources missing a sharing scope',\n    description:\n      'The weekly sweep found documents invisible to every site-scoped read: a creation path forgot the field.',\n    tier: 'low',\n    category: 'data',\n    title: '{{title}}',\n    body: '{{body}}',\n    delivery: 'digest',\n    dedupeWindowMinutes: 0,\n    defaultEnabled: true,\n    notificationType: 'system.scopeDrift',\n  },\n]\n\n/** An amount in minor units, as an alert prints it: `$12.40`. */\nexport function formatOperatorAlertAmount(\n  cents: number,\n  currency = 'usd',\n): string {\n  const value = Number(cents) / 100\n  if (!Number.isFinite(value)) return ''\n  try {\n    return new Intl.NumberFormat('en-US', {\n      style: 'currency',\n      currency: String(currency || 'usd').toUpperCase(),\n    }).format(value)\n  } catch {\n    return `${value.toFixed(2)} ${String(currency).toUpperCase()}`\n  }\n}\n\n/** Replaces each `{{token}}` with its context value, or nothing. */\nexport function renderOperatorAlertTemplate(\n  template: string,\n  context: OperatorAlertContext | undefined,\n): string {\n  return String(template ?? '')\n    .replace(/\\{\\{\\s*([\\w.]+)\\s*\\}\\}/g, (_match, name: string) => {\n      const value = context?.[name]\n      return value === null || value === undefined ? '' : String(value)\n    })\n    .replace(/\\(\\s*\\)/g, '')\n    .replace(/[ \\t]{2,}/g, ' ')\n    .replace(/ ([.,;:])/g, '$1')\n    .trim()\n}\n\n/** A staff member's answer for one type; an absent key keeps the default. */\nexport interface OperatorAlertTypeSetting {\n  enabled?: boolean\n  delivery?: OperatorAlertDelivery\n}\n\n/** `platformSettings/operatorAlerts`, keyed by alert type. */\nexport interface OperatorAlertSettings {\n  types?: Record<string, OperatorAlertTypeSetting>\n}\n\n/** Whether a type is on, and how it is delivered, after staff's answers. */\nexport function effectiveOperatorAlertSetting(\n  definition: Pick<OperatorAlertDefinition, 'type' | 'delivery' | 'defaultEnabled'>,\n  settings: OperatorAlertSettings | null | undefined,\n): { enabled: boolean; delivery: OperatorAlertDelivery } {\n  const answer = settings?.types?.[definition.type]\n  return {\n    enabled:\n      typeof answer?.enabled === 'boolean'\n        ? answer.enabled\n        : definition.defaultEnabled,\n    delivery:\n      answer?.delivery === 'immediate' || answer?.delivery === 'digest'\n        ? answer.delivery\n        : definition.delivery,\n  }\n}\n\n/**\n * Staff notification types whose alert emails the operator on a coded\n * default of immediate (AGL-3375), derived from the catalog so there is one\n * list.\n */\nexport const OPERATOR_ALERT_NOTIFICATION_TYPES: ReadonlySet<string> = new Set(\n  CORE_OPERATOR_ALERTS.flatMap((definition) =>\n    definition.notificationType ? [definition.notificationType] : [],\n  ),\n)\n"],"names":["OPERATOR_ALERT_DEFAULT_NOTIFICATION_TYPE","OPERATOR_ALERT_TIER_LABELS","must","should","low","OPERATOR_ALERT_TIER_LEVELS","operatorAlertLevel","definition","level","tier","OPERATOR_ALERT_CATEGORY_LABELS","billing","payments","legal","data","ops","deliverability","security","support","DAY","CORE_OPERATOR_ALERTS","type","label","description","category","title","body","link","delivery","dedupeWindowMinutes","defaultEnabled","notificationType","minOccurrences","formatOperatorAlertAmount","cents","currency","value","Number","isFinite","Intl","NumberFormat","style","String","toUpperCase","format","toFixed","renderOperatorAlertTemplate","template","context","replace","_match","name","undefined","trim","effectiveOperatorAlertSetting","settings","answer","types","enabled","OPERATOR_ALERT_NOTIFICATION_TYPES","Set","flatMap"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GA6GD,iEAAiE,GACjE,OAAO,MAAMA,2CACX,uBAAsB;AAExB,OAAO,MAAMC,6BAAgE;IAC3EC,MAAM;IACNC,QAAQ;IACRC,KAAK;AACP,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,6BAGT;IACFH,MAAM;IACNC,QAAQ;IACRC,KAAK;AACP,EAAC;AAED,kEAAkE,GAClE,OAAO,SAASE,mBACdC,UAA2D;QAEpDA;IAAP,QAAOA,oBAAAA,WAAWC,KAAK,YAAhBD,oBAAoBF,0BAA0B,CAACE,WAAWE,IAAI,CAAC;AACxE;AAEA,OAAO,MAAMC,iCAGT;IACFC,SAAS;IACTC,UAAU;IACVC,OAAO;IACPC,MAAM;IACNC,KAAK;IACLC,gBAAgB;IAChBC,UAAU;IACVC,SAAS;AACX,EAAC;AAED,MAAMC,MAAM,KAAK;AAEjB;;;CAGC,GACD,OAAO,MAAMC,uBAA2D;IACtE,0EAA0E;IAC1E;QACEC,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACE,wEAAwE;QACxE,oEAAoE;QACpEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACV,qEAAqE;QACrEC,qBAAqBV;QACrBW,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACV,uEAAuE;QACvE,qDAAqD;QACrDC,qBAAqBV;QACrBW,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IAEA,2EAA2E;IAC3E;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,KAAKV;QAC1BW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFE,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAIV;QACzBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBG,gBAAgB;QAChBF,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFE,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,KAAK;QAC1BC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACV,oEAAoE;QACpEpB,OAAO;QACP,gEAAgE;QAChE,eAAe;QACfqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACE,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACP,mEAAmE;QACnE,oDAAoD;QACpDqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACP,gEAAgE;QAChE,eAAe;QACfqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,gDAAgD;QAChDT,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACV,mEAAmE;QACnE,sDAAsD;QACtDC,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACPqB,qBAAqB;QACrBC,gBAAgB;IAClB;IACA;QACE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1ET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVpB,OAAO;QACPqB,qBAAqB;QACrBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,KAAKV;QAC1BW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFE,UAAU;QACVC,qBAAqB,KAAKV;QAC1BW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IAEA,2EAA2E;IAC3E;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACF,kEAAkE;QAClEC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;QAClB,2CAA2C;QAC3CvB,OAAO;IACT;IACA;QACEa,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;QAClBvB,OAAO;IACT;IAEA,2EAA2E;IAC3E;QACEa,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNC,MAAM;QACNC,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACE,sEAAsE;QACtE,wEAAwE;QACxET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MACE;QACFC,MAAM;QACNC,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IAEA,2EAA2E;IAC3E;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqBV;QACrBW,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACV,kEAAkE;QAClE,qEAAqE;QACrE,+CAA+C;QAC/CC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB,IAAI;QACzBC,gBAAgB;IAClB;IACA;QACET,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IAEA,2EAA2E;IAC3E;QACEV,MAAM;QACNC,OAAO;QACPC,aAAa;QACbd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;IACA;QACEV,MAAM;QACNC,OAAO;QACPC,aACE;QACFd,MAAM;QACNe,UAAU;QACVC,OAAO;QACPC,MAAM;QACNE,UAAU;QACVC,qBAAqB;QACrBC,gBAAgB;QAChBC,kBAAkB;IACpB;CACD,CAAA;AAED,+DAA+D,GAC/D,OAAO,SAASE,0BACdC,KAAa,EACbC,WAAW,KAAK;IAEhB,MAAMC,QAAQC,OAAOH,SAAS;IAC9B,IAAI,CAACG,OAAOC,QAAQ,CAACF,QAAQ,OAAO;IACpC,IAAI;QACF,OAAO,IAAIG,KAAKC,YAAY,CAAC,SAAS;YACpCC,OAAO;YACPN,UAAUO,OAAOP,YAAY,OAAOQ,WAAW;QACjD,GAAGC,MAAM,CAACR;IACZ,EAAE,eAAM;QACN,OAAO,GAAGA,MAAMS,OAAO,CAAC,GAAG,CAAC,EAAEH,OAAOP,UAAUQ,WAAW,IAAI;IAChE;AACF;AAEA,kEAAkE,GAClE,OAAO,SAASG,4BACdC,QAAgB,EAChBC,OAAyC;IAEzC,OAAON,OAAOK,mBAAAA,WAAY,IACvBE,OAAO,CAAC,2BAA2B,CAACC,QAAQC;QAC3C,MAAMf,QAAQY,2BAAAA,OAAS,CAACG,KAAK;QAC7B,OAAOf,UAAU,QAAQA,UAAUgB,YAAY,KAAKV,OAAON;IAC7D,GACCa,OAAO,CAAC,YAAY,IACpBA,OAAO,CAAC,cAAc,KACtBA,OAAO,CAAC,cAAc,MACtBI,IAAI;AACT;AAaA,0EAA0E,GAC1E,OAAO,SAASC,8BACd/C,UAAiF,EACjFgD,QAAkD;QAEnCA;IAAf,MAAMC,SAASD,6BAAAA,kBAAAA,SAAUE,KAAK,qBAAfF,eAAiB,CAAChD,WAAWc,IAAI,CAAC;IACjD,OAAO;QACLqC,SACE,QAAOF,0BAAAA,OAAQE,OAAO,MAAK,YACvBF,OAAOE,OAAO,GACdnD,WAAWuB,cAAc;QAC/BF,UACE4B,CAAAA,0BAAAA,OAAQ5B,QAAQ,MAAK,eAAe4B,CAAAA,0BAAAA,OAAQ5B,QAAQ,MAAK,WACrD4B,OAAO5B,QAAQ,GACfrB,WAAWqB,QAAQ;IAC3B;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAM+B,oCAAyD,IAAIC,IACxExC,qBAAqByC,OAAO,CAAC,CAACtD,aAC5BA,WAAWwB,gBAAgB,GAAG;QAACxB,WAAWwB,gBAAgB;KAAC,GAAG,EAAE,GAEnE"}

package/src/lib/app-utils/webhook-delivery.js

@@ -110,6 +110,8 @@
     // Fraud signals to staff (AGL-3356).
     'radar.early_fraud_warning.created',
     'review.opened',
+    // A workspace's own failed charge, read for fraud (AGL-3767).
+    'charge.failed',
     // Register card readers (AGL-3607).
     'terminal.reader.action_succeeded',
     'terminal.reader.action_failed'

package/src/lib/app-utils/webhook-delivery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/webhook-delivery.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * DID THE WEBHOOK ACTUALLY DO ANYTHING? (AGL-1954)\n *\n * Every signal we have about the billing webhook is a signal about the\n * REQUEST. Stripe records `delivery_success` off the status code. The\n * idempotency claim in `stripeEvents` records that the signature verified and\n * the handler was entered. `/api/health/billing` (AGL-1924) counts what\n * Stripe attempted and failed to deliver. All three read green for the one\n * failure this module exists to catch: **a handler that answers 200 and moves\n * nothing.**\n *\n * That is not hypothetical here. AGL-1798 is exactly it — `charge.refunded`\n * was never subscribed on the live destination, so AGL-1546's entitlement\n * revocation had no trigger, and every other indicator looked fine for as\n * long as it lasted. AGL-1551 is the same class from the other side: a week\n * of 100% rejected deliveries behind a green \"Active\" badge.\n *\n * ## The honest signal is an EFFECT, not a return code\n *\n * A check that asserts \"the handler ran\" is nearly as blind as the 200 —\n * the handler DID run in the AGL-1798 shape, it just had no work registered\n * for the event. So the route reports what it COMMITTED: an org's plan\n * mirrored, a `platformRevenue` row written, a refund stamped, an orphan\n * recorded, an audit row appended, a plugin claiming the event. Those are the\n * things whose absence is the bug.\n *\n * ## Three outcomes, and conflating the middle two is its own failure\n *\n * A binary \"did it write something\" would fire on every legitimately\n * irrelevant delivery — a tenant shopper's subscription carries no\n * `metadata.orgId` and correctly moves nothing on OUR side; a marketplace\n * refund resolves to no workspace customer and is correctly left to the\n * plugins; a `won` dispute nobody claimed reversed no money and correctly\n * wakes nobody. Alerting on those is alert fatigue, which ends with the alarm\n * muted and the real one lost inside it.\n *\n * So a branch that decides an event is not its business must SAY SO, by\n * name, through {@link WebhookEffectLedger.skip}. That is what separates:\n *\n * | outcome   | meaning                                            | alarm |\n * |-----------|----------------------------------------------------|-------|\n * | `acted`   | something durable committed, or a plugin claimed it | no    |\n * | `ignored` | a branch named a reason, or we never asked for this event type | no |\n * | `inert`   | an event we deliberately subscribe to produced NEITHER | YES  |\n *\n * `inert` is the whole point. Falling off the end of the dispatch with no\n * effect and no stated reason is precisely what a deleted write, an\n * unregistered plugin handler, or a renamed event type looks like from\n * inside the process — and it is the only one of the three that nothing else\n * in this system can see.\n *\n * ## Why the \"did we ask for it\" test is the required-events list\n *\n * Stripe delivers what the destination is subscribed to, and the destination\n * is created by `tools/scripts/setup-stripe.mjs` from `WEBHOOK_EVENTS`. An\n * event type outside that list reaching us is either a hand-added\n * subscription or a Connect delivery arriving at the platform destination —\n * unremarkable, and never our silent-drop bug, because we never claimed to\n * handle it. An event type INSIDE it is one we went out of our way to ask\n * Stripe for, so producing nothing from it is a contradiction by\n * construction.\n *\n * `REQUIRED_WEBHOOK_EVENTS` below is a copy of that list, and a copy is a\n * drift hazard — so `webhook-delivery.spec.ts` reads the `.mjs` and fails on\n * any divergence, in either direction. The alternative (moving the list\n * across the nx boundary out of `tools/`) is a wider change than this\n * warrants and is tracked on AGL-1948.\n *\n * Pure: no clock, no I/O, no Firestore. The route records, this decides, the\n * spec exercises every branch without a network.\n */\n\n/** What a single delivery turned out to be. */\nexport type WebhookDeliveryOutcome = 'acted' | 'ignored' | 'inert'\n\n/**\n * The event types the platform destination is subscribed to, mirroring\n * `WEBHOOK_EVENTS` in `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * The list is the definition of \"we asked for this\", which is what makes a\n * no-op delivery of one of them a defect rather than a non-event. Kept in\n * the same order as the source so a diff between the two reads cleanly.\n */\nexport const REQUIRED_WEBHOOK_EVENTS: readonly string[] = [\n  'customer.subscription.created',\n  'customer.subscription.updated',\n  'customer.subscription.deleted',\n  'checkout.session.completed',\n  'invoice.finalized',\n  'invoice.paid',\n  'invoice.payment_failed',\n  'charge.refunded',\n  'charge.dispute.created',\n  'charge.dispute.closed',\n  // AI overage charged as it accrues (AGL-3011), in the source list's order.\n  'invoice.voided',\n  'invoice.marked_uncollectible',\n  'customer.updated',\n  'payment_method.attached',\n  'payment_method.detached',\n  // Fraud signals to staff (AGL-3356).\n  'radar.early_fraud_warning.created',\n  'review.opened',\n  // Register card readers (AGL-3607).\n  'terminal.reader.action_succeeded',\n  'terminal.reader.action_failed',\n]\n\n/**\n * How the CONNECT destination identifies itself (AGL-1948), mirroring\n * `CONNECT_SCOPE_METADATA_KEY` / `CONNECT_SCOPE_METADATA_VALUE` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * Connected-account events are delivered only to a destination created with\n * `connect: true`, and Stripe's API does not report that flag back on the\n * endpoint object — so the destination is identified by metadata we set at\n * creation instead. Same copy-and-guard arrangement as the list above.\n */\nexport const CONNECT_SCOPE_METADATA_KEY = 'aglyn_scope'\nexport const CONNECT_SCOPE_METADATA_VALUE = 'connect'\n\n/**\n * What the Connect destination must carry, mirroring\n * `CONNECT_WEBHOOK_EVENTS` in the same script lib.\n *\n * `account.updated` is the whole point of it: AGL-1997's `syncConnectAccountStatus`\n * is what stops a merchant whose Stripe account was later restricted from\n * going on selling against a stale `stripeChargesEnabled`, with the SHOPPER\n * meeting the failure at payment time. Without this event the handler cannot\n * run — which is exactly the state AGL-2122 found and fixed.\n */\nexport const REQUIRED_CONNECT_WEBHOOK_EVENTS: readonly string[] = [\n  'account.updated',\n  'payout.failed',\n  'payout.paid',\n]\n\n/**\n * Does this Stripe endpoint object carry our Connect scope marker?\n *\n * Coverage for it reuses `unsubscribedRequiredEvents` with\n * `REQUIRED_CONNECT_WEBHOOK_EVENTS` as the `required` argument — the wildcard\n * and null handling are identical questions, and a second copy of that logic\n * is a second place for it to drift.\n */\nexport function isConnectWebhookEndpoint(endpoint: unknown): boolean {\n  const metadata = (endpoint as { metadata?: Record<string, unknown> })?.metadata\n  return metadata?.[CONNECT_SCOPE_METADATA_KEY] === CONNECT_SCOPE_METADATA_VALUE\n}\n\n/**\n * A per-delivery record of what actually committed.\n *\n * Deliberately append-only and stringly-typed: the reasons are read by a\n * human in a log line and by a spec, never switched on. Keeping it dumb is\n * what stops it growing into a second dispatch table that can disagree with\n * the real one.\n */\nexport interface WebhookEffectLedger {\n  /** Durable things this delivery committed, in the order they landed. */\n  readonly effects: readonly string[]\n  /** Reasons a branch decided the event was none of its business. */\n  readonly skips: readonly string[]\n  /**\n   * Record a committed effect. Call this AFTER the write it names, so a\n   * throw between the two cannot claim an effect that never landed.\n   */\n  effect(name: string): void\n  /**\n   * Record a deliberate no-op and why. This is the difference between \"not\n   * ours\" and \"broken\", and it is the half that prevents alert fatigue.\n   */\n  skip(reason: string): void\n}\n\nexport function createWebhookEffectLedger(): WebhookEffectLedger {\n  const effects: string[] = []\n  const skips: string[] = []\n  return {\n    effects,\n    skips,\n    effect(name: string) {\n      effects.push(name)\n    },\n    skip(reason: string) {\n      skips.push(reason)\n    },\n  }\n}\n\n/** Firestore methods that MUTATE. Everything else is a read or a builder. */\nconst WRITE_METHODS = new Set(['set', 'update', 'create', 'delete', 'add'])\n\n/**\n * Wrap a Firestore handle so every write it commits lands in the ledger.\n *\n * ## Why this exists rather than a `ledger.effect()` beside each write\n *\n * A hand-placed note next to a write is a check that CANNOT FAIL in the one\n * way that matters. Delete the write and leave the note, and the ledger\n * cheerfully reports an effect that never happened — which is the same\n * \"asserts its own literals\" defect the health probes are written to avoid.\n * The note has to be caused by the write, not merely adjacent to it.\n *\n * So the effect is recorded from INSIDE the call, after it resolves. A write\n * that throws records nothing (it did not commit); a write that is deleted\n * from the source records nothing (it is not called). There is no edit to\n * the handler that removes the work and keeps the signal.\n *\n * ## What it deliberately does not see\n *\n * Writes issued through a DIFFERENT Firestore handle — the shared\n * `tenant-data-admin` writers (`writeOrgBilling`, `notifyOrgAdmins`,\n * `notifyStaff`), which each open their own — and anything a plugin does\n * inside its own handler. Those are noted explicitly by the caller where\n * they are the only consequence of a branch, and the comments at those call\n * sites say so. The boundary is stated rather than hidden: this covers the\n * route's own writes, which is where the route's own bugs live.\n *\n * A Proxy rather than a hand-written facade because the wrapped object is\n * passed on to `updateExisting` and friends, which call methods this module\n * has never heard of. A facade would have to enumerate them and would\n * silently drop the ones it forgot.\n */\nexport function observeWrites<T extends object>(\n  handle: T,\n  ledger: WebhookEffectLedger,\n  label = 'firestore',\n): T {\n  return new Proxy(handle, {\n    get(target, property, receiver) {\n      const value = Reflect.get(target, property, receiver)\n      if (typeof value !== 'function' || typeof property !== 'string') {\n        return value\n      }\n      const method = property\n      return (...args: unknown[]) => {\n        const result = (value as (...a: unknown[]) => unknown).apply(\n          target,\n          args,\n        )\n        // `collection('orgs')` names the thing being written, so the ledger\n        // reads `orgs.update` rather than `firestore.update`. Everything\n        // else inherits the label it was reached through.\n        const nextLabel =\n          method === 'collection' && typeof args[0] === 'string'\n            ? (args[0] as string)\n            : label\n        if (WRITE_METHODS.has(method)) {\n          // Recorded on RESOLUTION. A rejected write committed nothing and\n          // must not read as an effect.\n          return Promise.resolve(result).then((settled) => {\n            ledger.effect(`${nextLabel}.${method}`)\n            return settled\n          })\n        }\n        // Builders (`collection`, `doc`, `where`, `limit`) return objects\n        // that can themselves be written through, so the wrapper follows\n        // them. Thenables are returned bare: wrapping a promise would make\n        // `then` look like a builder and recurse forever.\n        if (\n          result &&\n          typeof result === 'object' &&\n          typeof (result as { then?: unknown }).then !== 'function'\n        ) {\n          return observeWrites(result as object, ledger, nextLabel)\n        }\n        return result\n      }\n    },\n  })\n}\n\nexport interface WebhookDeliveryVerdict {\n  outcome: WebhookDeliveryOutcome\n  /** One short phrase naming WHY, for the log line and the spec. */\n  reason: string\n}\n\n/**\n * Classify one delivery.\n *\n * Order is the argument:\n *\n * 1. **Any effect, or any plugin claim, wins.** A delivery that both wrote\n *    something and skipped something else did work; a partially-skipped\n *    handler is not an idle one.\n * 2. **A named skip is an answer.** Reaching a branch that consciously\n *    decided \"not ours\" is a handled event, not a dropped one.\n * 3. **An event type we never subscribed to is not our problem.** Nothing\n *    promised to handle it.\n * 4. **Everything else is inert** — and by elimination that means: we asked\n *    Stripe for this event, we received it, no handler claimed it, no branch\n *    wrote anything, and no branch could say why.\n */\nexport function classifyWebhookDelivery(input: {\n  type: string\n  effects: readonly string[]\n  skips: readonly string[]\n  claimed: boolean\n  /** Overridable so the spec can prove the rule rather than the list. */\n  required?: readonly string[]\n}): WebhookDeliveryVerdict {\n  const { type, effects, skips, claimed } = input\n  const required = input.required ?? REQUIRED_WEBHOOK_EVENTS\n  if (effects.length > 0) return { outcome: 'acted', reason: effects[0] }\n  if (claimed) return { outcome: 'acted', reason: 'plugin-claimed' }\n  if (skips.length > 0) return { outcome: 'ignored', reason: skips[0] }\n  if (!required.includes(type)) {\n    return { outcome: 'ignored', reason: 'not-subscribed' }\n  }\n  return { outcome: 'inert', reason: 'no-effect' }\n}\n\n/**\n * How long after Stripe CREATES an event its first delivery attempt may\n * plausibly take to reach us, in seconds. Mirrors `RETRY_LAG_SECONDS` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`, under the same\n * read-the-`.mjs`-as-text drift guard as the lists above.\n *\n * Calibrated against the live account on 2026-08-18: the five deliveries that\n * succeeded first time landed in 1.0–3.7s; the one that did not —\n * `evt_1U49XtDYHP4psn7hA9VHPnZz`, whose three 400s ARE the three failures the\n * Stripe Dashboard was showing — landed 16,665s (4h 37m) late. Two minutes\n * sits three orders of magnitude clear of the healthy band and still inside\n * Stripe's first automatic retry interval, so it separates the two without\n * straddling either.\n */\nexport const RETRY_LAG_SECONDS = 120\n\n/**\n * What a delivery's lag says about the attempts BEFORE it.\n *\n * `unknown` is a first-class outcome, not a synonym for either answer. See\n * {@link classifyDeliveryLag} for why that matters more here than usual.\n */\nexport type WebhookDeliveryAttempt = 'first-attempt' | 'retried' | 'unknown'\n\n/** Why {@link classifyDeliveryLag} answered as it did. */\nexport type WebhookDeliveryLagReason =\n  | 'measured'\n  | 'created-absent'\n  | 'created-not-a-number'\n  | 'created-non-positive'\n  | 'received-unusable'\n  | 'clock-skew'\n\nexport interface WebhookDeliveryLagVerdict {\n  attempt: WebhookDeliveryAttempt\n  /** Seconds between `event.created` and our claim. Null unless `measured`. */\n  lagSeconds: number | null\n  reason: WebhookDeliveryLagReason\n}\n\n/**\n * DID THIS DELIVERY ONLY LAND ON A RETRY? (AGL-2039, the last arm of AGL-1948)\n *\n * ## The reconciliation this exists to close\n *\n * `/api/health/billing` scores EVENTS and `GET /v1/events?delivery_success=false`\n * is a TERMINAL-state filter: it selects events that are still pending or\n * failed EVERY attempt. An event that 400s three times and then succeeds on\n * the fourth reads back `delivery_success: true` and is, to that filter,\n * indistinguishable from one that succeeded immediately. The Stripe Dashboard\n * scores delivery ATTEMPTS, so the same hour reads 0% here and 30% there —\n * and both numbers are right. The three real failures were visible only in\n * the second reading, and each was a mirror that did not run when it should\n * have.\n *\n * The recoverable half of the attempt history is in our own data. The route\n * claims `stripeEvents/{id}` AFTER signature verification and DELETES the\n * claim when a handler throws, so the stamp always records the attempt that\n * actually got through. The distance from `event.created` to that stamp is\n * the delivery lag, and a lag of minutes means an earlier attempt failed.\n *\n * ## Why this is decided at WRITE time, not at read time\n *\n * The obvious implementation reads `receivedAt` off every claim document in\n * the window and subtracts. That turns a `.count()` aggregation — one\n * integer, zero documents read — into a document scan on a PUBLIC,\n * unauthenticated health endpoint polled every five minutes. Deciding here,\n * once, at the moment of the claim, lets the probe stay an aggregation over a\n * marker field, exactly like AGL-1954's `inertAtMs`.\n *\n * ## Absent, zero and unknown are THREE different things\n *\n * `strictNullChecks` is off repo-wide, so an absent `created` folds to falsy\n * and a naive `Number(event?.created ?? 0)` yields 0 — which subtracts to a\n * lag of ~1.7 BILLION seconds and reports every such delivery as a retry,\n * forever, on a perfectly healthy webhook. A monitoring signal that reds on\n * its own missing input is worse than no signal, because it is the thing that\n * gets muted. So each of those inputs is rejected by name:\n *\n * | input                       | attempt    | reason                  |\n * |-----------------------------|------------|-------------------------|\n * | field absent / null         | `unknown`  | `created-absent`        |\n * | a string, NaN, Infinity     | `unknown`  | `created-not-a-number`  |\n * | `0` or negative             | `unknown`  | `created-non-positive`  |\n * | our own stamp unusable      | `unknown`  | `received-unusable`     |\n * | created in the FUTURE by more than the bar | `unknown` | `clock-skew` |\n *\n * A lag between `-threshold` and `+threshold` is `first-attempt`: sub-second\n * clock skew between Stripe's clock and ours is ordinary and is not evidence\n * of anything.\n *\n * Pure: no clock, no I/O. The caller supplies both timestamps.\n */\nexport function classifyDeliveryLag(input: {\n  /** `event.created`, in unix SECONDS, exactly as Stripe sent it. */\n  eventCreatedSeconds: unknown\n  /** When we claimed the event, in unix MILLISECONDS. */\n  receivedAtMs: unknown\n  /** Overridable so the spec can prove the rule rather than the constant. */\n  thresholdSeconds?: number\n}): WebhookDeliveryLagVerdict {\n  const threshold = input.thresholdSeconds ?? RETRY_LAG_SECONDS\n  const created = input.eventCreatedSeconds\n  if (created === undefined || created === null) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'created-absent' }\n  }\n  if (typeof created !== 'number' || !Number.isFinite(created)) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-not-a-number',\n    }\n  }\n  // Zero is the value an absent field folds to under the repo's null rules,\n  // and no Stripe event was created at the epoch. Rejected by name so it can\n  // never be mistaken for a measurement.\n  if (created <= 0) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-non-positive',\n    }\n  }\n  const received = input.receivedAtMs\n  if (typeof received !== 'number' || !Number.isFinite(received) || received <= 0) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'received-unusable' }\n  }\n  const lagSeconds = received / 1000 - created\n  // An event stamped in OUR future by more than the threshold is a clock\n  // disagreement, not a fast delivery, and reporting it as a healthy first\n  // attempt would be an answer we cannot support.\n  if (lagSeconds < -threshold) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'clock-skew' }\n  }\n  return {\n    attempt: lagSeconds > threshold ? 'retried' : 'first-attempt',\n    lagSeconds,\n    reason: 'measured',\n  }\n}\n\n/**\n * Which required events is a destination NOT subscribed to? (AGL-1948)\n *\n * The same blind spot from the configuration side, and the cheaper half of\n * it: a subscription removed by hand in the Stripe dashboard produces no\n * failed delivery, no rejected request and no inert one either — Stripe\n * simply stops sending, and every count on the health probe reads a\n * perfectly healthy zero. `charge.refunded` was missing from the live\n * endpoint for exactly this reason (AGL-1798) and the only thing that ever\n * noticed was a script nobody ran.\n *\n * `['*']` is Stripe's wildcard subscription and covers everything.\n *\n * Returns the names, sorted, so the probe body is stable and a diff between\n * two readings is meaningful.\n */\nexport function unsubscribedRequiredEvents(\n  enabledEvents: readonly string[] | null | undefined,\n  required: readonly string[] = REQUIRED_WEBHOOK_EVENTS,\n): string[] {\n  if (!enabledEvents) return []\n  if (enabledEvents.includes('*')) return []\n  const enabled = new Set(enabledEvents)\n  return required.filter((event) => !enabled.has(event)).sort()\n}\n"],"names":["REQUIRED_WEBHOOK_EVENTS","CONNECT_SCOPE_METADATA_KEY","CONNECT_SCOPE_METADATA_VALUE","REQUIRED_CONNECT_WEBHOOK_EVENTS","isConnectWebhookEndpoint","endpoint","metadata","createWebhookEffectLedger","effects","skips","effect","name","push","skip","reason","WRITE_METHODS","Set","observeWrites","handle","ledger","label","Proxy","get","target","property","receiver","value","Reflect","method","args","result","apply","nextLabel","has","Promise","resolve","then","settled","classifyWebhookDelivery","input","type","claimed","required","length","outcome","includes","RETRY_LAG_SECONDS","classifyDeliveryLag","threshold","thresholdSeconds","created","eventCreatedSeconds","undefined","attempt","lagSeconds","Number","isFinite","received","receivedAtMs","unsubscribedRequiredEvents","enabledEvents","enabled","filter","event","sort"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEC,GAED,6CAA6C,GAG7C;;;;;;;CAOC,GACD,OAAO,MAAMA,0BAA6C;IACxD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,2EAA2E;IAC3E;IACA;IACA;IACA;IACA;IACA,qCAAqC;IACrC;IACA;IACA,oCAAoC;IACpC;IACA;CACD,CAAA;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,6BAA6B,cAAa;AACvD,OAAO,MAAMC,+BAA+B,UAAS;AAErD;;;;;;;;;CASC,GACD,OAAO,MAAMC,kCAAqD;IAChE;IACA;IACA;CACD,CAAA;AAED;;;;;;;CAOC,GACD,OAAO,SAASC,yBAAyBC,QAAiB;IACxD,MAAMC,WAAYD,4BAAD,AAACA,SAAqDC,QAAQ;IAC/E,OAAOA,CAAAA,4BAAAA,QAAU,CAACL,2BAA2B,MAAKC;AACpD;AA2BA,OAAO,SAASK;IACd,MAAMC,UAAoB,EAAE;IAC5B,MAAMC,QAAkB,EAAE;IAC1B,OAAO;QACLD;QACAC;QACAC,QAAOC,IAAY;YACjBH,QAAQI,IAAI,CAACD;QACf;QACAE,MAAKC,MAAc;YACjBL,MAAMG,IAAI,CAACE;QACb;IACF;AACF;AAEA,2EAA2E,GAC3E,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAO;IAAU;IAAU;IAAU;CAAM;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASC,cACdC,MAAS,EACTC,MAA2B,EAC3BC,QAAQ,WAAW;IAEnB,OAAO,IAAIC,MAAMH,QAAQ;QACvBI,KAAIC,MAAM,EAAEC,QAAQ,EAAEC,QAAQ;YAC5B,MAAMC,QAAQC,QAAQL,GAAG,CAACC,QAAQC,UAAUC;YAC5C,IAAI,OAAOC,UAAU,cAAc,OAAOF,aAAa,UAAU;gBAC/D,OAAOE;YACT;YACA,MAAME,SAASJ;YACf,OAAO,CAAC,GAAGK;gBACT,MAAMC,SAAS,AAACJ,MAAuCK,KAAK,CAC1DR,QACAM;gBAEF,oEAAoE;gBACpE,iEAAiE;gBACjE,kDAAkD;gBAClD,MAAMG,YACJJ,WAAW,gBAAgB,OAAOC,IAAI,CAAC,EAAE,KAAK,WACzCA,IAAI,CAAC,EAAE,GACRT;gBACN,IAAIL,cAAckB,GAAG,CAACL,SAAS;oBAC7B,iEAAiE;oBACjE,8BAA8B;oBAC9B,OAAOM,QAAQC,OAAO,CAACL,QAAQM,IAAI,CAAC,CAACC;wBACnClB,OAAOT,MAAM,CAAC,GAAGsB,UAAU,CAAC,EAAEJ,QAAQ;wBACtC,OAAOS;oBACT;gBACF;gBACA,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,kDAAkD;gBAClD,IACEP,UACA,OAAOA,WAAW,YAClB,OAAO,AAACA,OAA8BM,IAAI,KAAK,YAC/C;oBACA,OAAOnB,cAAca,QAAkBX,QAAQa;gBACjD;gBACA,OAAOF;YACT;QACF;IACF;AACF;AAQA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASQ,wBAAwBC,KAOvC;QAEkBA;IADjB,MAAM,EAAEC,IAAI,EAAEhC,OAAO,EAAEC,KAAK,EAAEgC,OAAO,EAAE,GAAGF;IAC1C,MAAMG,YAAWH,kBAAAA,MAAMG,QAAQ,YAAdH,kBAAkBvC;IACnC,IAAIQ,QAAQmC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAS9B,QAAQN,OAAO,CAAC,EAAE;IAAC;IACtE,IAAIiC,SAAS,OAAO;QAAEG,SAAS;QAAS9B,QAAQ;IAAiB;IACjE,IAAIL,MAAMkC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAW9B,QAAQL,KAAK,CAAC,EAAE;IAAC;IACpE,IAAI,CAACiC,SAASG,QAAQ,CAACL,OAAO;QAC5B,OAAO;YAAEI,SAAS;YAAW9B,QAAQ;QAAiB;IACxD;IACA,OAAO;QAAE8B,SAAS;QAAS9B,QAAQ;IAAY;AACjD;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMgC,oBAAoB,IAAG;AA0BpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDC,GACD,OAAO,SAASC,oBAAoBR,KAOnC;QACmBA;IAAlB,MAAMS,aAAYT,0BAAAA,MAAMU,gBAAgB,YAAtBV,0BAA0BO;IAC5C,MAAMI,UAAUX,MAAMY,mBAAmB;IACzC,IAAID,YAAYE,aAAaF,YAAY,MAAM;QAC7C,OAAO;YAAEG,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAiB;IAC1E;IACA,IAAI,OAAOoC,YAAY,YAAY,CAACK,OAAOC,QAAQ,CAACN,UAAU;QAC5D,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,IAAIoC,WAAW,GAAG;QAChB,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,MAAM2C,WAAWlB,MAAMmB,YAAY;IACnC,IAAI,OAAOD,aAAa,YAAY,CAACF,OAAOC,QAAQ,CAACC,aAAaA,YAAY,GAAG;QAC/E,OAAO;YAAEJ,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAoB;IAC7E;IACA,MAAMwC,aAAaG,WAAW,OAAOP;IACrC,uEAAuE;IACvE,yEAAyE;IACzE,gDAAgD;IAChD,IAAII,aAAa,CAACN,WAAW;QAC3B,OAAO;YAAEK,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAa;IACtE;IACA,OAAO;QACLuC,SAASC,aAAaN,YAAY,YAAY;QAC9CM;QACAxC,QAAQ;IACV;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAAS6C,2BACdC,aAAmD,EACnDlB,WAA8B1C,uBAAuB;IAErD,IAAI,CAAC4D,eAAe,OAAO,EAAE;IAC7B,IAAIA,cAAcf,QAAQ,CAAC,MAAM,OAAO,EAAE;IAC1C,MAAMgB,UAAU,IAAI7C,IAAI4C;IACxB,OAAOlB,SAASoB,MAAM,CAAC,CAACC,QAAU,CAACF,QAAQ5B,GAAG,CAAC8B,QAAQC,IAAI;AAC7D"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/webhook-delivery.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * DID THE WEBHOOK ACTUALLY DO ANYTHING? (AGL-1954)\n *\n * Every signal we have about the billing webhook is a signal about the\n * REQUEST. Stripe records `delivery_success` off the status code. The\n * idempotency claim in `stripeEvents` records that the signature verified and\n * the handler was entered. `/api/health/billing` (AGL-1924) counts what\n * Stripe attempted and failed to deliver. All three read green for the one\n * failure this module exists to catch: **a handler that answers 200 and moves\n * nothing.**\n *\n * That is not hypothetical here. AGL-1798 is exactly it — `charge.refunded`\n * was never subscribed on the live destination, so AGL-1546's entitlement\n * revocation had no trigger, and every other indicator looked fine for as\n * long as it lasted. AGL-1551 is the same class from the other side: a week\n * of 100% rejected deliveries behind a green \"Active\" badge.\n *\n * ## The honest signal is an EFFECT, not a return code\n *\n * A check that asserts \"the handler ran\" is nearly as blind as the 200 —\n * the handler DID run in the AGL-1798 shape, it just had no work registered\n * for the event. So the route reports what it COMMITTED: an org's plan\n * mirrored, a `platformRevenue` row written, a refund stamped, an orphan\n * recorded, an audit row appended, a plugin claiming the event. Those are the\n * things whose absence is the bug.\n *\n * ## Three outcomes, and conflating the middle two is its own failure\n *\n * A binary \"did it write something\" would fire on every legitimately\n * irrelevant delivery — a tenant shopper's subscription carries no\n * `metadata.orgId` and correctly moves nothing on OUR side; a marketplace\n * refund resolves to no workspace customer and is correctly left to the\n * plugins; a `won` dispute nobody claimed reversed no money and correctly\n * wakes nobody. Alerting on those is alert fatigue, which ends with the alarm\n * muted and the real one lost inside it.\n *\n * So a branch that decides an event is not its business must SAY SO, by\n * name, through {@link WebhookEffectLedger.skip}. That is what separates:\n *\n * | outcome   | meaning                                            | alarm |\n * |-----------|----------------------------------------------------|-------|\n * | `acted`   | something durable committed, or a plugin claimed it | no    |\n * | `ignored` | a branch named a reason, or we never asked for this event type | no |\n * | `inert`   | an event we deliberately subscribe to produced NEITHER | YES  |\n *\n * `inert` is the whole point. Falling off the end of the dispatch with no\n * effect and no stated reason is precisely what a deleted write, an\n * unregistered plugin handler, or a renamed event type looks like from\n * inside the process — and it is the only one of the three that nothing else\n * in this system can see.\n *\n * ## Why the \"did we ask for it\" test is the required-events list\n *\n * Stripe delivers what the destination is subscribed to, and the destination\n * is created by `tools/scripts/setup-stripe.mjs` from `WEBHOOK_EVENTS`. An\n * event type outside that list reaching us is either a hand-added\n * subscription or a Connect delivery arriving at the platform destination —\n * unremarkable, and never our silent-drop bug, because we never claimed to\n * handle it. An event type INSIDE it is one we went out of our way to ask\n * Stripe for, so producing nothing from it is a contradiction by\n * construction.\n *\n * `REQUIRED_WEBHOOK_EVENTS` below is a copy of that list, and a copy is a\n * drift hazard — so `webhook-delivery.spec.ts` reads the `.mjs` and fails on\n * any divergence, in either direction. The alternative (moving the list\n * across the nx boundary out of `tools/`) is a wider change than this\n * warrants and is tracked on AGL-1948.\n *\n * Pure: no clock, no I/O, no Firestore. The route records, this decides, the\n * spec exercises every branch without a network.\n */\n\n/** What a single delivery turned out to be. */\nexport type WebhookDeliveryOutcome = 'acted' | 'ignored' | 'inert'\n\n/**\n * The event types the platform destination is subscribed to, mirroring\n * `WEBHOOK_EVENTS` in `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * The list is the definition of \"we asked for this\", which is what makes a\n * no-op delivery of one of them a defect rather than a non-event. Kept in\n * the same order as the source so a diff between the two reads cleanly.\n */\nexport const REQUIRED_WEBHOOK_EVENTS: readonly string[] = [\n  'customer.subscription.created',\n  'customer.subscription.updated',\n  'customer.subscription.deleted',\n  'checkout.session.completed',\n  'invoice.finalized',\n  'invoice.paid',\n  'invoice.payment_failed',\n  'charge.refunded',\n  'charge.dispute.created',\n  'charge.dispute.closed',\n  // AI overage charged as it accrues (AGL-3011), in the source list's order.\n  'invoice.voided',\n  'invoice.marked_uncollectible',\n  'customer.updated',\n  'payment_method.attached',\n  'payment_method.detached',\n  // Fraud signals to staff (AGL-3356).\n  'radar.early_fraud_warning.created',\n  'review.opened',\n  // A workspace's own failed charge, read for fraud (AGL-3767).\n  'charge.failed',\n  // Register card readers (AGL-3607).\n  'terminal.reader.action_succeeded',\n  'terminal.reader.action_failed',\n]\n\n/**\n * How the CONNECT destination identifies itself (AGL-1948), mirroring\n * `CONNECT_SCOPE_METADATA_KEY` / `CONNECT_SCOPE_METADATA_VALUE` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * Connected-account events are delivered only to a destination created with\n * `connect: true`, and Stripe's API does not report that flag back on the\n * endpoint object — so the destination is identified by metadata we set at\n * creation instead. Same copy-and-guard arrangement as the list above.\n */\nexport const CONNECT_SCOPE_METADATA_KEY = 'aglyn_scope'\nexport const CONNECT_SCOPE_METADATA_VALUE = 'connect'\n\n/**\n * What the Connect destination must carry, mirroring\n * `CONNECT_WEBHOOK_EVENTS` in the same script lib.\n *\n * `account.updated` is the whole point of it: AGL-1997's `syncConnectAccountStatus`\n * is what stops a merchant whose Stripe account was later restricted from\n * going on selling against a stale `stripeChargesEnabled`, with the SHOPPER\n * meeting the failure at payment time. Without this event the handler cannot\n * run — which is exactly the state AGL-2122 found and fixed.\n */\nexport const REQUIRED_CONNECT_WEBHOOK_EVENTS: readonly string[] = [\n  'account.updated',\n  'payout.failed',\n  'payout.paid',\n]\n\n/**\n * Does this Stripe endpoint object carry our Connect scope marker?\n *\n * Coverage for it reuses `unsubscribedRequiredEvents` with\n * `REQUIRED_CONNECT_WEBHOOK_EVENTS` as the `required` argument — the wildcard\n * and null handling are identical questions, and a second copy of that logic\n * is a second place for it to drift.\n */\nexport function isConnectWebhookEndpoint(endpoint: unknown): boolean {\n  const metadata = (endpoint as { metadata?: Record<string, unknown> })?.metadata\n  return metadata?.[CONNECT_SCOPE_METADATA_KEY] === CONNECT_SCOPE_METADATA_VALUE\n}\n\n/**\n * A per-delivery record of what actually committed.\n *\n * Deliberately append-only and stringly-typed: the reasons are read by a\n * human in a log line and by a spec, never switched on. Keeping it dumb is\n * what stops it growing into a second dispatch table that can disagree with\n * the real one.\n */\nexport interface WebhookEffectLedger {\n  /** Durable things this delivery committed, in the order they landed. */\n  readonly effects: readonly string[]\n  /** Reasons a branch decided the event was none of its business. */\n  readonly skips: readonly string[]\n  /**\n   * Record a committed effect. Call this AFTER the write it names, so a\n   * throw between the two cannot claim an effect that never landed.\n   */\n  effect(name: string): void\n  /**\n   * Record a deliberate no-op and why. This is the difference between \"not\n   * ours\" and \"broken\", and it is the half that prevents alert fatigue.\n   */\n  skip(reason: string): void\n}\n\nexport function createWebhookEffectLedger(): WebhookEffectLedger {\n  const effects: string[] = []\n  const skips: string[] = []\n  return {\n    effects,\n    skips,\n    effect(name: string) {\n      effects.push(name)\n    },\n    skip(reason: string) {\n      skips.push(reason)\n    },\n  }\n}\n\n/** Firestore methods that MUTATE. Everything else is a read or a builder. */\nconst WRITE_METHODS = new Set(['set', 'update', 'create', 'delete', 'add'])\n\n/**\n * Wrap a Firestore handle so every write it commits lands in the ledger.\n *\n * ## Why this exists rather than a `ledger.effect()` beside each write\n *\n * A hand-placed note next to a write is a check that CANNOT FAIL in the one\n * way that matters. Delete the write and leave the note, and the ledger\n * cheerfully reports an effect that never happened — which is the same\n * \"asserts its own literals\" defect the health probes are written to avoid.\n * The note has to be caused by the write, not merely adjacent to it.\n *\n * So the effect is recorded from INSIDE the call, after it resolves. A write\n * that throws records nothing (it did not commit); a write that is deleted\n * from the source records nothing (it is not called). There is no edit to\n * the handler that removes the work and keeps the signal.\n *\n * ## What it deliberately does not see\n *\n * Writes issued through a DIFFERENT Firestore handle — the shared\n * `tenant-data-admin` writers (`writeOrgBilling`, `notifyOrgAdmins`,\n * `notifyStaff`), which each open their own — and anything a plugin does\n * inside its own handler. Those are noted explicitly by the caller where\n * they are the only consequence of a branch, and the comments at those call\n * sites say so. The boundary is stated rather than hidden: this covers the\n * route's own writes, which is where the route's own bugs live.\n *\n * A Proxy rather than a hand-written facade because the wrapped object is\n * passed on to `updateExisting` and friends, which call methods this module\n * has never heard of. A facade would have to enumerate them and would\n * silently drop the ones it forgot.\n */\nexport function observeWrites<T extends object>(\n  handle: T,\n  ledger: WebhookEffectLedger,\n  label = 'firestore',\n): T {\n  return new Proxy(handle, {\n    get(target, property, receiver) {\n      const value = Reflect.get(target, property, receiver)\n      if (typeof value !== 'function' || typeof property !== 'string') {\n        return value\n      }\n      const method = property\n      return (...args: unknown[]) => {\n        const result = (value as (...a: unknown[]) => unknown).apply(\n          target,\n          args,\n        )\n        // `collection('orgs')` names the thing being written, so the ledger\n        // reads `orgs.update` rather than `firestore.update`. Everything\n        // else inherits the label it was reached through.\n        const nextLabel =\n          method === 'collection' && typeof args[0] === 'string'\n            ? (args[0] as string)\n            : label\n        if (WRITE_METHODS.has(method)) {\n          // Recorded on RESOLUTION. A rejected write committed nothing and\n          // must not read as an effect.\n          return Promise.resolve(result).then((settled) => {\n            ledger.effect(`${nextLabel}.${method}`)\n            return settled\n          })\n        }\n        // Builders (`collection`, `doc`, `where`, `limit`) return objects\n        // that can themselves be written through, so the wrapper follows\n        // them. Thenables are returned bare: wrapping a promise would make\n        // `then` look like a builder and recurse forever.\n        if (\n          result &&\n          typeof result === 'object' &&\n          typeof (result as { then?: unknown }).then !== 'function'\n        ) {\n          return observeWrites(result as object, ledger, nextLabel)\n        }\n        return result\n      }\n    },\n  })\n}\n\nexport interface WebhookDeliveryVerdict {\n  outcome: WebhookDeliveryOutcome\n  /** One short phrase naming WHY, for the log line and the spec. */\n  reason: string\n}\n\n/**\n * Classify one delivery.\n *\n * Order is the argument:\n *\n * 1. **Any effect, or any plugin claim, wins.** A delivery that both wrote\n *    something and skipped something else did work; a partially-skipped\n *    handler is not an idle one.\n * 2. **A named skip is an answer.** Reaching a branch that consciously\n *    decided \"not ours\" is a handled event, not a dropped one.\n * 3. **An event type we never subscribed to is not our problem.** Nothing\n *    promised to handle it.\n * 4. **Everything else is inert** — and by elimination that means: we asked\n *    Stripe for this event, we received it, no handler claimed it, no branch\n *    wrote anything, and no branch could say why.\n */\nexport function classifyWebhookDelivery(input: {\n  type: string\n  effects: readonly string[]\n  skips: readonly string[]\n  claimed: boolean\n  /** Overridable so the spec can prove the rule rather than the list. */\n  required?: readonly string[]\n}): WebhookDeliveryVerdict {\n  const { type, effects, skips, claimed } = input\n  const required = input.required ?? REQUIRED_WEBHOOK_EVENTS\n  if (effects.length > 0) return { outcome: 'acted', reason: effects[0] }\n  if (claimed) return { outcome: 'acted', reason: 'plugin-claimed' }\n  if (skips.length > 0) return { outcome: 'ignored', reason: skips[0] }\n  if (!required.includes(type)) {\n    return { outcome: 'ignored', reason: 'not-subscribed' }\n  }\n  return { outcome: 'inert', reason: 'no-effect' }\n}\n\n/**\n * How long after Stripe CREATES an event its first delivery attempt may\n * plausibly take to reach us, in seconds. Mirrors `RETRY_LAG_SECONDS` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`, under the same\n * read-the-`.mjs`-as-text drift guard as the lists above.\n *\n * Calibrated against the live account on 2026-08-18: the five deliveries that\n * succeeded first time landed in 1.0–3.7s; the one that did not —\n * `evt_1U49XtDYHP4psn7hA9VHPnZz`, whose three 400s ARE the three failures the\n * Stripe Dashboard was showing — landed 16,665s (4h 37m) late. Two minutes\n * sits three orders of magnitude clear of the healthy band and still inside\n * Stripe's first automatic retry interval, so it separates the two without\n * straddling either.\n */\nexport const RETRY_LAG_SECONDS = 120\n\n/**\n * What a delivery's lag says about the attempts BEFORE it.\n *\n * `unknown` is a first-class outcome, not a synonym for either answer. See\n * {@link classifyDeliveryLag} for why that matters more here than usual.\n */\nexport type WebhookDeliveryAttempt = 'first-attempt' | 'retried' | 'unknown'\n\n/** Why {@link classifyDeliveryLag} answered as it did. */\nexport type WebhookDeliveryLagReason =\n  | 'measured'\n  | 'created-absent'\n  | 'created-not-a-number'\n  | 'created-non-positive'\n  | 'received-unusable'\n  | 'clock-skew'\n\nexport interface WebhookDeliveryLagVerdict {\n  attempt: WebhookDeliveryAttempt\n  /** Seconds between `event.created` and our claim. Null unless `measured`. */\n  lagSeconds: number | null\n  reason: WebhookDeliveryLagReason\n}\n\n/**\n * DID THIS DELIVERY ONLY LAND ON A RETRY? (AGL-2039, the last arm of AGL-1948)\n *\n * ## The reconciliation this exists to close\n *\n * `/api/health/billing` scores EVENTS and `GET /v1/events?delivery_success=false`\n * is a TERMINAL-state filter: it selects events that are still pending or\n * failed EVERY attempt. An event that 400s three times and then succeeds on\n * the fourth reads back `delivery_success: true` and is, to that filter,\n * indistinguishable from one that succeeded immediately. The Stripe Dashboard\n * scores delivery ATTEMPTS, so the same hour reads 0% here and 30% there —\n * and both numbers are right. The three real failures were visible only in\n * the second reading, and each was a mirror that did not run when it should\n * have.\n *\n * The recoverable half of the attempt history is in our own data. The route\n * claims `stripeEvents/{id}` AFTER signature verification and DELETES the\n * claim when a handler throws, so the stamp always records the attempt that\n * actually got through. The distance from `event.created` to that stamp is\n * the delivery lag, and a lag of minutes means an earlier attempt failed.\n *\n * ## Why this is decided at WRITE time, not at read time\n *\n * The obvious implementation reads `receivedAt` off every claim document in\n * the window and subtracts. That turns a `.count()` aggregation — one\n * integer, zero documents read — into a document scan on a PUBLIC,\n * unauthenticated health endpoint polled every five minutes. Deciding here,\n * once, at the moment of the claim, lets the probe stay an aggregation over a\n * marker field, exactly like AGL-1954's `inertAtMs`.\n *\n * ## Absent, zero and unknown are THREE different things\n *\n * `strictNullChecks` is off repo-wide, so an absent `created` folds to falsy\n * and a naive `Number(event?.created ?? 0)` yields 0 — which subtracts to a\n * lag of ~1.7 BILLION seconds and reports every such delivery as a retry,\n * forever, on a perfectly healthy webhook. A monitoring signal that reds on\n * its own missing input is worse than no signal, because it is the thing that\n * gets muted. So each of those inputs is rejected by name:\n *\n * | input                       | attempt    | reason                  |\n * |-----------------------------|------------|-------------------------|\n * | field absent / null         | `unknown`  | `created-absent`        |\n * | a string, NaN, Infinity     | `unknown`  | `created-not-a-number`  |\n * | `0` or negative             | `unknown`  | `created-non-positive`  |\n * | our own stamp unusable      | `unknown`  | `received-unusable`     |\n * | created in the FUTURE by more than the bar | `unknown` | `clock-skew` |\n *\n * A lag between `-threshold` and `+threshold` is `first-attempt`: sub-second\n * clock skew between Stripe's clock and ours is ordinary and is not evidence\n * of anything.\n *\n * Pure: no clock, no I/O. The caller supplies both timestamps.\n */\nexport function classifyDeliveryLag(input: {\n  /** `event.created`, in unix SECONDS, exactly as Stripe sent it. */\n  eventCreatedSeconds: unknown\n  /** When we claimed the event, in unix MILLISECONDS. */\n  receivedAtMs: unknown\n  /** Overridable so the spec can prove the rule rather than the constant. */\n  thresholdSeconds?: number\n}): WebhookDeliveryLagVerdict {\n  const threshold = input.thresholdSeconds ?? RETRY_LAG_SECONDS\n  const created = input.eventCreatedSeconds\n  if (created === undefined || created === null) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'created-absent' }\n  }\n  if (typeof created !== 'number' || !Number.isFinite(created)) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-not-a-number',\n    }\n  }\n  // Zero is the value an absent field folds to under the repo's null rules,\n  // and no Stripe event was created at the epoch. Rejected by name so it can\n  // never be mistaken for a measurement.\n  if (created <= 0) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-non-positive',\n    }\n  }\n  const received = input.receivedAtMs\n  if (typeof received !== 'number' || !Number.isFinite(received) || received <= 0) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'received-unusable' }\n  }\n  const lagSeconds = received / 1000 - created\n  // An event stamped in OUR future by more than the threshold is a clock\n  // disagreement, not a fast delivery, and reporting it as a healthy first\n  // attempt would be an answer we cannot support.\n  if (lagSeconds < -threshold) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'clock-skew' }\n  }\n  return {\n    attempt: lagSeconds > threshold ? 'retried' : 'first-attempt',\n    lagSeconds,\n    reason: 'measured',\n  }\n}\n\n/**\n * Which required events is a destination NOT subscribed to? (AGL-1948)\n *\n * The same blind spot from the configuration side, and the cheaper half of\n * it: a subscription removed by hand in the Stripe dashboard produces no\n * failed delivery, no rejected request and no inert one either — Stripe\n * simply stops sending, and every count on the health probe reads a\n * perfectly healthy zero. `charge.refunded` was missing from the live\n * endpoint for exactly this reason (AGL-1798) and the only thing that ever\n * noticed was a script nobody ran.\n *\n * `['*']` is Stripe's wildcard subscription and covers everything.\n *\n * Returns the names, sorted, so the probe body is stable and a diff between\n * two readings is meaningful.\n */\nexport function unsubscribedRequiredEvents(\n  enabledEvents: readonly string[] | null | undefined,\n  required: readonly string[] = REQUIRED_WEBHOOK_EVENTS,\n): string[] {\n  if (!enabledEvents) return []\n  if (enabledEvents.includes('*')) return []\n  const enabled = new Set(enabledEvents)\n  return required.filter((event) => !enabled.has(event)).sort()\n}\n"],"names":["REQUIRED_WEBHOOK_EVENTS","CONNECT_SCOPE_METADATA_KEY","CONNECT_SCOPE_METADATA_VALUE","REQUIRED_CONNECT_WEBHOOK_EVENTS","isConnectWebhookEndpoint","endpoint","metadata","createWebhookEffectLedger","effects","skips","effect","name","push","skip","reason","WRITE_METHODS","Set","observeWrites","handle","ledger","label","Proxy","get","target","property","receiver","value","Reflect","method","args","result","apply","nextLabel","has","Promise","resolve","then","settled","classifyWebhookDelivery","input","type","claimed","required","length","outcome","includes","RETRY_LAG_SECONDS","classifyDeliveryLag","threshold","thresholdSeconds","created","eventCreatedSeconds","undefined","attempt","lagSeconds","Number","isFinite","received","receivedAtMs","unsubscribedRequiredEvents","enabledEvents","enabled","filter","event","sort"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEC,GAED,6CAA6C,GAG7C;;;;;;;CAOC,GACD,OAAO,MAAMA,0BAA6C;IACxD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,2EAA2E;IAC3E;IACA;IACA;IACA;IACA;IACA,qCAAqC;IACrC;IACA;IACA,8DAA8D;IAC9D;IACA,oCAAoC;IACpC;IACA;CACD,CAAA;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,6BAA6B,cAAa;AACvD,OAAO,MAAMC,+BAA+B,UAAS;AAErD;;;;;;;;;CASC,GACD,OAAO,MAAMC,kCAAqD;IAChE;IACA;IACA;CACD,CAAA;AAED;;;;;;;CAOC,GACD,OAAO,SAASC,yBAAyBC,QAAiB;IACxD,MAAMC,WAAYD,4BAAD,AAACA,SAAqDC,QAAQ;IAC/E,OAAOA,CAAAA,4BAAAA,QAAU,CAACL,2BAA2B,MAAKC;AACpD;AA2BA,OAAO,SAASK;IACd,MAAMC,UAAoB,EAAE;IAC5B,MAAMC,QAAkB,EAAE;IAC1B,OAAO;QACLD;QACAC;QACAC,QAAOC,IAAY;YACjBH,QAAQI,IAAI,CAACD;QACf;QACAE,MAAKC,MAAc;YACjBL,MAAMG,IAAI,CAACE;QACb;IACF;AACF;AAEA,2EAA2E,GAC3E,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAO;IAAU;IAAU;IAAU;CAAM;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASC,cACdC,MAAS,EACTC,MAA2B,EAC3BC,QAAQ,WAAW;IAEnB,OAAO,IAAIC,MAAMH,QAAQ;QACvBI,KAAIC,MAAM,EAAEC,QAAQ,EAAEC,QAAQ;YAC5B,MAAMC,QAAQC,QAAQL,GAAG,CAACC,QAAQC,UAAUC;YAC5C,IAAI,OAAOC,UAAU,cAAc,OAAOF,aAAa,UAAU;gBAC/D,OAAOE;YACT;YACA,MAAME,SAASJ;YACf,OAAO,CAAC,GAAGK;gBACT,MAAMC,SAAS,AAACJ,MAAuCK,KAAK,CAC1DR,QACAM;gBAEF,oEAAoE;gBACpE,iEAAiE;gBACjE,kDAAkD;gBAClD,MAAMG,YACJJ,WAAW,gBAAgB,OAAOC,IAAI,CAAC,EAAE,KAAK,WACzCA,IAAI,CAAC,EAAE,GACRT;gBACN,IAAIL,cAAckB,GAAG,CAACL,SAAS;oBAC7B,iEAAiE;oBACjE,8BAA8B;oBAC9B,OAAOM,QAAQC,OAAO,CAACL,QAAQM,IAAI,CAAC,CAACC;wBACnClB,OAAOT,MAAM,CAAC,GAAGsB,UAAU,CAAC,EAAEJ,QAAQ;wBACtC,OAAOS;oBACT;gBACF;gBACA,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,kDAAkD;gBAClD,IACEP,UACA,OAAOA,WAAW,YAClB,OAAO,AAACA,OAA8BM,IAAI,KAAK,YAC/C;oBACA,OAAOnB,cAAca,QAAkBX,QAAQa;gBACjD;gBACA,OAAOF;YACT;QACF;IACF;AACF;AAQA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASQ,wBAAwBC,KAOvC;QAEkBA;IADjB,MAAM,EAAEC,IAAI,EAAEhC,OAAO,EAAEC,KAAK,EAAEgC,OAAO,EAAE,GAAGF;IAC1C,MAAMG,YAAWH,kBAAAA,MAAMG,QAAQ,YAAdH,kBAAkBvC;IACnC,IAAIQ,QAAQmC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAS9B,QAAQN,OAAO,CAAC,EAAE;IAAC;IACtE,IAAIiC,SAAS,OAAO;QAAEG,SAAS;QAAS9B,QAAQ;IAAiB;IACjE,IAAIL,MAAMkC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAW9B,QAAQL,KAAK,CAAC,EAAE;IAAC;IACpE,IAAI,CAACiC,SAASG,QAAQ,CAACL,OAAO;QAC5B,OAAO;YAAEI,SAAS;YAAW9B,QAAQ;QAAiB;IACxD;IACA,OAAO;QAAE8B,SAAS;QAAS9B,QAAQ;IAAY;AACjD;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMgC,oBAAoB,IAAG;AA0BpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDC,GACD,OAAO,SAASC,oBAAoBR,KAOnC;QACmBA;IAAlB,MAAMS,aAAYT,0BAAAA,MAAMU,gBAAgB,YAAtBV,0BAA0BO;IAC5C,MAAMI,UAAUX,MAAMY,mBAAmB;IACzC,IAAID,YAAYE,aAAaF,YAAY,MAAM;QAC7C,OAAO;YAAEG,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAiB;IAC1E;IACA,IAAI,OAAOoC,YAAY,YAAY,CAACK,OAAOC,QAAQ,CAACN,UAAU;QAC5D,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,IAAIoC,WAAW,GAAG;QAChB,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,MAAM2C,WAAWlB,MAAMmB,YAAY;IACnC,IAAI,OAAOD,aAAa,YAAY,CAACF,OAAOC,QAAQ,CAACC,aAAaA,YAAY,GAAG;QAC/E,OAAO;YAAEJ,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAoB;IAC7E;IACA,MAAMwC,aAAaG,WAAW,OAAOP;IACrC,uEAAuE;IACvE,yEAAyE;IACzE,gDAAgD;IAChD,IAAII,aAAa,CAACN,WAAW;QAC3B,OAAO;YAAEK,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAa;IACtE;IACA,OAAO;QACLuC,SAASC,aAAaN,YAAY,YAAY;QAC9CM;QACAxC,QAAQ;IACV;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAAS6C,2BACdC,aAAmD,EACnDlB,WAA8B1C,uBAAuB;IAErD,IAAI,CAAC4D,eAAe,OAAO,EAAE;IAC7B,IAAIA,cAAcf,QAAQ,CAAC,MAAM,OAAO,EAAE;IAC1C,MAAMgB,UAAU,IAAI7C,IAAI4C;IACxB,OAAOlB,SAASoB,MAAM,CAAC,CAACC,QAAU,CAACF,QAAQ5B,GAAG,CAAC8B,QAAQC,IAAI;AAC7D"}