@aglyn/aglyn 1.0.0-beta.285 → 1.0.0-beta.288

package/src/lib/app-utils/site-starter-theme.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/site-starter-theme.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { HostTheme, HostThemeSchemeColors } from '@aglyn/shared-data-types'\nimport { writeThemeFonts } from '@aglyn/shared-util-tools/theme-fonts'\nimport type { ConsoleThemePreset } from '../plugin-manager/feature-plugins'\nimport { diffOverride, overrideWriteValue } from './artifact-overrides'\nimport { DEFAULT_SITE_THEME } from './default-site'\nimport { siteFontPairing } from './site-font-pairings'\nimport type { SiteStarterTheme } from './site-starter'\nimport { themeArtifactContent } from './site-theme'\nimport {\n  planThemeLibraryAction,\n  THEME_FIELD_DELETE,\n  type ThemeLibraryAction,\n  type ThemeLibraryEntryWrite,\n} from './theme-library'\n\n/**\n * A site starter's theme on the site it creates (AGL-4049).\n *\n * A starter names its look one of two ways (`SiteStarterTheme`): a built-in\n * theme with its brand colors and font pairing over it, or a full theme of\n * its author's own. Either way the new site's theme is stored the way a\n * person's own pick is: the built-in picked through the theme library with\n * the starter's colors and fonts as the override over it, or the full theme\n * installed into the library as a marketplace theme is. So the Theme page\n * names the base a site came from, and every edit there starts from it.\n *\n * Planned against an EMPTY host, because the site does not exist yet: the\n * create writes these fields in the same `set` that makes the host, and the\n * library entries beside it, in one transaction.\n *\n * Pure: no I/O. The caller passes the built-in themes it has registered.\n */\n\n/**\n * The palette keys a built-in starter's brand sets: its three brand colors.\n * The status colors (error, warning, info, success) stay the base theme's,\n * since they mean the same thing on every site, and surfaces and text are the\n * base's design.\n */\nexport const SITE_STARTER_BRAND_KEYS = ['primary', 'secondary', 'tertiary'] as const\n\n/** The built-in theme a starter's `base` names, as the themes plugin registers it. */\nexport const siteStarterPresetId = (base: string) => `theme-presets.${base}`\n\ntype BuiltinStarterTheme = Extract<SiteStarterTheme, { kind: 'builtin' }>\ntype Scheme = 'light' | 'dark'\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object' && !Array.isArray(value)\n\n/**\n * One scheme's colors with the brand over them, each brand color written the\n * way the theme editor writes a palette color (`writeThemeColor`): a record of\n * `main` alone, so MUI derives its light, dark and contrast text from it, and\n * the base's tint for that color dropped, since it was a wash of the old one.\n */\nfunction brandScheme(\n  colors: HostThemeSchemeColors | undefined,\n  brand: Record<string, string> | undefined,\n): HostThemeSchemeColors | undefined {\n  let next: HostThemeSchemeColors | undefined = colors\n  for (const key of SITE_STARTER_BRAND_KEYS) {\n    const hex = brand?.[key]\n    if (typeof hex !== 'string' || !hex.trim()) continue\n    next = { ...next, [key]: { main: hex.trim() } }\n    const tint = next.tint as Record<string, string> | undefined\n    if (tint && key in tint) {\n      const rest = { ...tint }\n      delete rest[key]\n      if (Object.keys(rest).length) next.tint = rest as HostThemeSchemeColors['tint']\n      else delete next.tint\n    }\n  }\n  return next\n}\n\n/**\n * A built-in base with the starter's brand colors and font pairing over it,\n * modeled on the AI start's look (`aiSiteTheme`) but driven by the starter's\n * `brand` and `fonts` rather than a style. Everything the base sets beyond\n * those stays the base's: its status colors, surfaces, shapes and component\n * styles. A brand with no `dark` map colors both schemes with `light`; a\n * `fonts` of `null`, or a pairing id the platform does not have, keeps the\n * base's own fonts.\n */\nexport function siteStarterTheme(theme: BuiltinStarterTheme, base: HostTheme): HostTheme {\n  const brand = isRecord(theme?.brand) ? theme.brand : { light: {} }\n  const light = isRecord(brand.light) ? brand.light : {}\n  const dark = isRecord(brand.dark) ? brand.dark : light\n  const brandFor: Record<Scheme, Record<string, string>> = { light, dark }\n  const colorSchemes = { ...base.colorSchemes }\n  for (const scheme of ['light', 'dark'] as const) {\n    const colors = brandScheme(base.colorSchemes?.[scheme], brandFor[scheme])\n    if (colors) colorSchemes[scheme] = colors\n  }\n  let next: HostTheme = { ...base }\n  if (Object.keys(colorSchemes).length) next.colorSchemes = colorSchemes\n\n  const pairing = siteFontPairing(theme?.fonts)\n  if (!pairing) return next\n  // The same write the AI site look makes for a pairing: the body family,\n  // and the heading family where it differs.\n  const sameFamily = pairing.heading.family === pairing.body.family\n  next = writeThemeFonts(next, {\n    body: {\n      family: pairing.body.family,\n      category: pairing.body.category,\n      weights: [...pairing.body.weights],\n      source: 'google',\n    },\n    heading: sameFamily\n      ? null\n      : {\n          family: pairing.heading.family,\n          category: pairing.heading.category,\n          weights: [...new Set([pairing.heading.weight, pairing.heading.sub])].sort((a, b) => a - b),\n          source: 'google',\n        },\n  })\n  // A pairing whose heading is the body family loads the heading weights too.\n  if (sameFamily && next.fonts?.[0]) {\n    next.fonts = [\n      {\n        ...next.fonts[0],\n        weights: [\n          ...new Set([...(next.fonts[0].weights ?? []), pairing.heading.weight, pairing.heading.sub]),\n        ].sort((a, b) => a - b),\n      },\n      ...next.fonts.slice(1),\n    ]\n  }\n  return next\n}\n\n/** What a new site's host document and theme library start with. */\nexport interface SiteStarterThemePlan {\n  /** Host fields, written in the `set` that creates the host. */\n  host: Record<string, unknown>\n  /** Library entries to create under `hosts/{id}/themes`. */\n  entries: ThemeLibraryEntryWrite[]\n}\n\n/**\n * A plan's host fields as a new document takes them: a field the plan\n * deletes is simply not written, since an empty host has nothing to delete,\n * and an empty override is no field at all.\n */\nfunction creatable(fields: Record<string, unknown>): Record<string, unknown> {\n  return Object.fromEntries(\n    Object.entries(fields).filter(([, value]) => value !== THEME_FIELD_DELETE && value !== null),\n  )\n}\n\n/** The override a built-in starter stores over `base`, or `null` when it changes nothing. */\nfunction starterOverride(theme: BuiltinStarterTheme, base: HostTheme): unknown {\n  return overrideWriteValue(diffOverride(base, siteStarterTheme(theme, base)), null)\n}\n\n/**\n * The host fields and library entries a new site is born with for a\n * starter's theme, planned against an empty host through the same planner\n * the theme library runs (`planThemeLibraryAction`):\n *\n * - a full theme is installed, as the marketplace installs a theme, its\n *   entry named after the starter and its provenance the starter's listing;\n * - a built-in theme is picked as a preset, with the brand and fonts as the\n *   override over it;\n * - the `starter` base, or a base this deployment has no built-in for, is\n *   the theme every new site is born with (`DEFAULT_SITE_THEME`), with the\n *   brand and fonts as the override over it, and no library entry.\n */\nexport function planSiteStarterTheme(input: {\n  theme: SiteStarterTheme\n  presets: readonly ConsoleThemePreset[]\n  listing: { listingId: string; version: string | number; displayName: string }\n  newId: () => string\n}): SiteStarterThemePlan {\n  // `source`, not `listing`: this is the starter's id/version/name, not the\n  // listing document the listing write-deny guard partitions (AGL-1361).\n  const { theme, presets, listing: source, newId } = input\n  const plan = (action: ThemeLibraryAction) => {\n    const planned = planThemeLibraryAction({ host: {}, entries: {}, newId, action })\n    return planned.ok === false ? null : planned\n  }\n\n  if (theme?.kind === 'full' && isRecord(theme.theme)) {\n    const planned = plan({\n      action: 'install',\n      listingId: source.listingId,\n      name: `${source.displayName} theme`,\n      theme: themeArtifactContent(theme.theme),\n      installedFrom: {\n        listingId: source.listingId,\n        version: source.version,\n        artifactType: 'siteStarter',\n      },\n    })\n    if (planned) return { host: creatable(planned.host), entries: planned.entries }\n  }\n\n  const builtin: BuiltinStarterTheme =\n    theme?.kind === 'builtin' ? theme : { kind: 'builtin', base: 'starter', brand: { light: {} }, fonts: null }\n  const preset =\n    builtin.base === 'starter'\n      ? null\n      : (presets.find((entry) => entry?.id === siteStarterPresetId(builtin.base)) ?? null)\n  if (preset) {\n    const base = themeArtifactContent(preset.theme)\n    const planned = plan({\n      action: 'select',\n      target: { kind: 'preset', id: preset.id, name: preset.name, theme: base },\n    })\n    if (planned) {\n      return {\n        host: creatable({ ...planned.host, themeOverride: starterOverride(builtin, base) }),\n        entries: planned.entries,\n      }\n    }\n  }\n  return {\n    host: creatable({\n      theme: DEFAULT_SITE_THEME,\n      themeOverride: starterOverride(builtin, DEFAULT_SITE_THEME),\n    }),\n    entries: [],\n  }\n}\n"],"names":["writeThemeFonts","diffOverride","overrideWriteValue","DEFAULT_SITE_THEME","siteFontPairing","themeArtifactContent","planThemeLibraryAction","THEME_FIELD_DELETE","SITE_STARTER_BRAND_KEYS","siteStarterPresetId","base","isRecord","value","Array","isArray","brandScheme","colors","brand","next","key","hex","trim","main","tint","rest","Object","keys","length","siteStarterTheme","theme","light","dark","brandFor","colorSchemes","scheme","pairing","fonts","sameFamily","heading","family","body","category","weights","source","Set","weight","sub","sort","a","b","slice","creatable","fields","fromEntries","entries","filter","starterOverride","planSiteStarterTheme","input","presets","listing","newId","plan","action","planned","host","ok","kind","listingId","name","displayName","installedFrom","version","artifactType","builtin","preset","find","entry","id","target","themeOverride"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,eAAe,QAAQ,uCAAsC;AAEtE,SAASC,YAAY,EAAEC,kBAAkB,QAAQ,0BAAsB;AACvE,SAASC,kBAAkB,QAAQ,oBAAgB;AACnD,SAASC,eAAe,QAAQ,0BAAsB;AAEtD,SAASC,oBAAoB,QAAQ,kBAAc;AACnD,SACEC,sBAAsB,EACtBC,kBAAkB,QAGb,qBAAiB;AAExB;;;;;;;;;;;;;;;;CAgBC,GAED;;;;;CAKC,GACD,OAAO,MAAMC,0BAA0B;IAAC;IAAW;IAAa;CAAW,CAAS;AAEpF,oFAAoF,GACpF,OAAO,MAAMC,sBAAsB,CAACC,OAAiB,CAAC,cAAc,EAAEA,MAAM,CAAA;AAK5E,MAAMC,WAAW,CAACC,QAChB,CAAC,CAACA,SAAS,OAAOA,UAAU,YAAY,CAACC,MAAMC,OAAO,CAACF;AAEzD;;;;;CAKC,GACD,SAASG,YACPC,MAAyC,EACzCC,KAAyC;IAEzC,IAAIC,OAA0CF;IAC9C,KAAK,MAAMG,OAAOX,wBAAyB;QACzC,MAAMY,MAAMH,yBAAAA,KAAO,CAACE,IAAI;QACxB,IAAI,OAAOC,QAAQ,YAAY,CAACA,IAAIC,IAAI,IAAI;QAC5CH,OAAO,aAAKA;YAAM,CAACC,IAAI,EAAE;gBAAEG,MAAMF,IAAIC,IAAI;YAAG;;QAC5C,MAAME,OAAOL,KAAKK,IAAI;QACtB,IAAIA,QAAQJ,OAAOI,MAAM;YACvB,MAAMC,OAAO,aAAKD;YAClB,OAAOC,IAAI,CAACL,IAAI;YAChB,IAAIM,OAAOC,IAAI,CAACF,MAAMG,MAAM,EAAET,KAAKK,IAAI,GAAGC;iBACrC,OAAON,KAAKK,IAAI;QACvB;IACF;IACA,OAAOL;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASU,iBAAiBC,KAA0B,EAAEnB,IAAe;QAmCxDQ;IAlClB,MAAMD,QAAQN,SAASkB,yBAAAA,MAAOZ,KAAK,IAAIY,MAAMZ,KAAK,GAAG;QAAEa,OAAO,CAAC;IAAE;IACjE,MAAMA,QAAQnB,SAASM,MAAMa,KAAK,IAAIb,MAAMa,KAAK,GAAG,CAAC;IACrD,MAAMC,OAAOpB,SAASM,MAAMc,IAAI,IAAId,MAAMc,IAAI,GAAGD;IACjD,MAAME,WAAmD;QAAEF;QAAOC;IAAK;IACvE,MAAME,eAAe,aAAKvB,KAAKuB,YAAY;IAC3C,KAAK,MAAMC,UAAU;QAAC;QAAS;KAAO,CAAW;YACpBxB;QAA3B,MAAMM,SAASD,aAAYL,qBAAAA,KAAKuB,YAAY,qBAAjBvB,kBAAmB,CAACwB,OAAO,EAAEF,QAAQ,CAACE,OAAO;QACxE,IAAIlB,QAAQiB,YAAY,CAACC,OAAO,GAAGlB;IACrC;IACA,IAAIE,OAAkB,aAAKR;IAC3B,IAAIe,OAAOC,IAAI,CAACO,cAAcN,MAAM,EAAET,KAAKe,YAAY,GAAGA;IAE1D,MAAME,UAAU/B,gBAAgByB,yBAAAA,MAAOO,KAAK;IAC5C,IAAI,CAACD,SAAS,OAAOjB;IACrB,wEAAwE;IACxE,2CAA2C;IAC3C,MAAMmB,aAAaF,QAAQG,OAAO,CAACC,MAAM,KAAKJ,QAAQK,IAAI,CAACD,MAAM;IACjErB,OAAOlB,gBAAgBkB,MAAM;QAC3BsB,MAAM;YACJD,QAAQJ,QAAQK,IAAI,CAACD,MAAM;YAC3BE,UAAUN,QAAQK,IAAI,CAACC,QAAQ;YAC/BC,SAAS;mBAAIP,QAAQK,IAAI,CAACE,OAAO;aAAC;YAClCC,QAAQ;QACV;QACAL,SAASD,aACL,OACA;YACEE,QAAQJ,QAAQG,OAAO,CAACC,MAAM;YAC9BE,UAAUN,QAAQG,OAAO,CAACG,QAAQ;YAClCC,SAAS;mBAAI,IAAIE,IAAI;oBAACT,QAAQG,OAAO,CAACO,MAAM;oBAAEV,QAAQG,OAAO,CAACQ,GAAG;iBAAC;aAAE,CAACC,IAAI,CAAC,CAACC,GAAGC,IAAMD,IAAIC;YACxFN,QAAQ;QACV;IACN;IACA,4EAA4E;IAC5E,IAAIN,gBAAcnB,cAAAA,KAAKkB,KAAK,qBAAVlB,WAAY,CAAC,EAAE,GAAE;YAKXA;QAJtBA,KAAKkB,KAAK,GAAG;YACX,aACKlB,KAAKkB,KAAK,CAAC,EAAE;gBAChBM,SAAS;uBACJ,IAAIE,IAAI;4BAAK1B,uBAAAA,KAAKkB,KAAK,CAAC,EAAE,CAACM,OAAO,YAArBxB,uBAAyB,EAAE;wBAAGiB,QAAQG,OAAO,CAACO,MAAM;wBAAEV,QAAQG,OAAO,CAACQ,GAAG;qBAAC;iBAC3F,CAACC,IAAI,CAAC,CAACC,GAAGC,IAAMD,IAAIC;;eAEpB/B,KAAKkB,KAAK,CAACc,KAAK,CAAC;SACrB;IACH;IACA,OAAOhC;AACT;AAUA;;;;CAIC,GACD,SAASiC,UAAUC,MAA+B;IAChD,OAAO3B,OAAO4B,WAAW,CACvB5B,OAAO6B,OAAO,CAACF,QAAQG,MAAM,CAAC,CAAC,GAAG3C,MAAM,GAAKA,UAAUL,sBAAsBK,UAAU;AAE3F;AAEA,2FAA2F,GAC3F,SAAS4C,gBAAgB3B,KAA0B,EAAEnB,IAAe;IAClE,OAAOR,mBAAmBD,aAAaS,MAAMkB,iBAAiBC,OAAOnB,QAAQ;AAC/E;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAAS+C,qBAAqBC,KAKpC;QA6BQC;IA5BP,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,EAAE9B,KAAK,EAAE8B,OAAO,EAAEC,SAASjB,MAAM,EAAEkB,KAAK,EAAE,GAAGH;IACnD,MAAMI,OAAO,CAACC;QACZ,MAAMC,UAAU1D,uBAAuB;YAAE2D,MAAM,CAAC;YAAGX,SAAS,CAAC;YAAGO;YAAOE;QAAO;QAC9E,OAAOC,QAAQE,EAAE,KAAK,QAAQ,OAAOF;IACvC;IAEA,IAAInC,CAAAA,yBAAAA,MAAOsC,IAAI,MAAK,UAAUxD,SAASkB,MAAMA,KAAK,GAAG;QACnD,MAAMmC,UAAUF,KAAK;YACnBC,QAAQ;YACRK,WAAWzB,OAAOyB,SAAS;YAC3BC,MAAM,GAAG1B,OAAO2B,WAAW,CAAC,MAAM,CAAC;YACnCzC,OAAOxB,qBAAqBwB,MAAMA,KAAK;YACvC0C,eAAe;gBACbH,WAAWzB,OAAOyB,SAAS;gBAC3BI,SAAS7B,OAAO6B,OAAO;gBACvBC,cAAc;YAChB;QACF;QACA,IAAIT,SAAS,OAAO;YAAEC,MAAMd,UAAUa,QAAQC,IAAI;YAAGX,SAASU,QAAQV,OAAO;QAAC;IAChF;IAEA,MAAMoB,UACJ7C,CAAAA,yBAAAA,MAAOsC,IAAI,MAAK,YAAYtC,QAAQ;QAAEsC,MAAM;QAAWzD,MAAM;QAAWO,OAAO;YAAEa,OAAO,CAAC;QAAE;QAAGM,OAAO;IAAK;IAC5G,MAAMuC,SACJD,QAAQhE,IAAI,KAAK,YACb,QACCiD,gBAAAA,QAAQiB,IAAI,CAAC,CAACC,QAAUA,CAAAA,yBAAAA,MAAOC,EAAE,MAAKrE,oBAAoBiE,QAAQhE,IAAI,cAAtEiD,gBAA4E;IACnF,IAAIgB,QAAQ;QACV,MAAMjE,OAAOL,qBAAqBsE,OAAO9C,KAAK;QAC9C,MAAMmC,UAAUF,KAAK;YACnBC,QAAQ;YACRgB,QAAQ;gBAAEZ,MAAM;gBAAUW,IAAIH,OAAOG,EAAE;gBAAET,MAAMM,OAAON,IAAI;gBAAExC,OAAOnB;YAAK;QAC1E;QACA,IAAIsD,SAAS;YACX,OAAO;gBACLC,MAAMd,UAAU,aAAKa,QAAQC,IAAI;oBAAEe,eAAexB,gBAAgBkB,SAAShE;;gBAC3E4C,SAASU,QAAQV,OAAO;YAC1B;QACF;IACF;IACA,OAAO;QACLW,MAAMd,UAAU;YACdtB,OAAO1B;YACP6E,eAAexB,gBAAgBkB,SAASvE;QAC1C;QACAmD,SAAS,EAAE;IACb;AACF"}

package/src/lib/app-utils/webhook-delivery.js

@@ -114,7 +114,12 @@
     'charge.failed',
     // Register card readers (AGL-3607).
     'terminal.reader.action_succeeded',
-    'terminal.reader.action_failed'
+    'terminal.reader.action_failed',
+    // Cards taken offline on the Aglyn POS app reader (AGL-4039).
+    'payment_intent.amount_capturable_updated',
+    'payment_intent.succeeded',
+    'payment_intent.payment_failed',
+    'payment_intent.canceled'
 ];
 /**
  * How the CONNECT destination identifies itself (AGL-1948), mirroring

package/src/lib/app-utils/webhook-delivery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/webhook-delivery.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * DID THE WEBHOOK ACTUALLY DO ANYTHING? (AGL-1954)\n *\n * Every signal we have about the billing webhook is a signal about the\n * REQUEST. Stripe records `delivery_success` off the status code. The\n * idempotency claim in `stripeEvents` records that the signature verified and\n * the handler was entered. `/api/health/billing` (AGL-1924) counts what\n * Stripe attempted and failed to deliver. All three read green for the one\n * failure this module exists to catch: **a handler that answers 200 and moves\n * nothing.**\n *\n * That is not hypothetical here. AGL-1798 is exactly it — `charge.refunded`\n * was never subscribed on the live destination, so AGL-1546's entitlement\n * revocation had no trigger, and every other indicator looked fine for as\n * long as it lasted. AGL-1551 is the same class from the other side: a week\n * of 100% rejected deliveries behind a green \"Active\" badge.\n *\n * ## The honest signal is an EFFECT, not a return code\n *\n * A check that asserts \"the handler ran\" is nearly as blind as the 200 —\n * the handler DID run in the AGL-1798 shape, it just had no work registered\n * for the event. So the route reports what it COMMITTED: an org's plan\n * mirrored, a `platformRevenue` row written, a refund stamped, an orphan\n * recorded, an audit row appended, a plugin claiming the event. Those are the\n * things whose absence is the bug.\n *\n * ## Three outcomes, and conflating the middle two is its own failure\n *\n * A binary \"did it write something\" would fire on every legitimately\n * irrelevant delivery — a tenant shopper's subscription carries no\n * `metadata.orgId` and correctly moves nothing on OUR side; a marketplace\n * refund resolves to no workspace customer and is correctly left to the\n * plugins; a `won` dispute nobody claimed reversed no money and correctly\n * wakes nobody. Alerting on those is alert fatigue, which ends with the alarm\n * muted and the real one lost inside it.\n *\n * So a branch that decides an event is not its business must SAY SO, by\n * name, through {@link WebhookEffectLedger.skip}. That is what separates:\n *\n * | outcome   | meaning                                            | alarm |\n * |-----------|----------------------------------------------------|-------|\n * | `acted`   | something durable committed, or a plugin claimed it | no    |\n * | `ignored` | a branch named a reason, or we never asked for this event type | no |\n * | `inert`   | an event we deliberately subscribe to produced NEITHER | YES  |\n *\n * `inert` is the whole point. Falling off the end of the dispatch with no\n * effect and no stated reason is precisely what a deleted write, an\n * unregistered plugin handler, or a renamed event type looks like from\n * inside the process — and it is the only one of the three that nothing else\n * in this system can see.\n *\n * ## Why the \"did we ask for it\" test is the required-events list\n *\n * Stripe delivers what the destination is subscribed to, and the destination\n * is created by `tools/scripts/setup-stripe.mjs` from `WEBHOOK_EVENTS`. An\n * event type outside that list reaching us is either a hand-added\n * subscription or a Connect delivery arriving at the platform destination —\n * unremarkable, and never our silent-drop bug, because we never claimed to\n * handle it. An event type INSIDE it is one we went out of our way to ask\n * Stripe for, so producing nothing from it is a contradiction by\n * construction.\n *\n * `REQUIRED_WEBHOOK_EVENTS` below is a copy of that list, and a copy is a\n * drift hazard — so `webhook-delivery.spec.ts` reads the `.mjs` and fails on\n * any divergence, in either direction. The alternative (moving the list\n * across the nx boundary out of `tools/`) is a wider change than this\n * warrants and is tracked on AGL-1948.\n *\n * Pure: no clock, no I/O, no Firestore. The route records, this decides, the\n * spec exercises every branch without a network.\n */\n\n/** What a single delivery turned out to be. */\nexport type WebhookDeliveryOutcome = 'acted' | 'ignored' | 'inert'\n\n/**\n * The event types the platform destination is subscribed to, mirroring\n * `WEBHOOK_EVENTS` in `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * The list is the definition of \"we asked for this\", which is what makes a\n * no-op delivery of one of them a defect rather than a non-event. Kept in\n * the same order as the source so a diff between the two reads cleanly.\n */\nexport const REQUIRED_WEBHOOK_EVENTS: readonly string[] = [\n  'customer.subscription.created',\n  'customer.subscription.updated',\n  'customer.subscription.deleted',\n  'checkout.session.completed',\n  'invoice.finalized',\n  'invoice.paid',\n  'invoice.payment_failed',\n  'charge.refunded',\n  'charge.dispute.created',\n  'charge.dispute.closed',\n  // AI overage charged as it accrues (AGL-3011), in the source list's order.\n  'invoice.voided',\n  'invoice.marked_uncollectible',\n  'customer.updated',\n  'payment_method.attached',\n  'payment_method.detached',\n  // Fraud signals to staff (AGL-3356).\n  'radar.early_fraud_warning.created',\n  'review.opened',\n  // A workspace's own failed charge, read for fraud (AGL-3767).\n  'charge.failed',\n  // Register card readers (AGL-3607).\n  'terminal.reader.action_succeeded',\n  'terminal.reader.action_failed',\n]\n\n/**\n * How the CONNECT destination identifies itself (AGL-1948), mirroring\n * `CONNECT_SCOPE_METADATA_KEY` / `CONNECT_SCOPE_METADATA_VALUE` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * Connected-account events are delivered only to a destination created with\n * `connect: true`, and Stripe's API does not report that flag back on the\n * endpoint object — so the destination is identified by metadata we set at\n * creation instead. Same copy-and-guard arrangement as the list above.\n */\nexport const CONNECT_SCOPE_METADATA_KEY = 'aglyn_scope'\nexport const CONNECT_SCOPE_METADATA_VALUE = 'connect'\n\n/**\n * What the Connect destination must carry, mirroring\n * `CONNECT_WEBHOOK_EVENTS` in the same script lib.\n *\n * `account.updated` is the whole point of it: AGL-1997's `syncConnectAccountStatus`\n * is what stops a merchant whose Stripe account was later restricted from\n * going on selling against a stale `stripeChargesEnabled`, with the SHOPPER\n * meeting the failure at payment time. Without this event the handler cannot\n * run — which is exactly the state AGL-2122 found and fixed.\n */\nexport const REQUIRED_CONNECT_WEBHOOK_EVENTS: readonly string[] = [\n  'account.updated',\n  'payout.failed',\n  'payout.paid',\n]\n\n/**\n * Does this Stripe endpoint object carry our Connect scope marker?\n *\n * Coverage for it reuses `unsubscribedRequiredEvents` with\n * `REQUIRED_CONNECT_WEBHOOK_EVENTS` as the `required` argument — the wildcard\n * and null handling are identical questions, and a second copy of that logic\n * is a second place for it to drift.\n */\nexport function isConnectWebhookEndpoint(endpoint: unknown): boolean {\n  const metadata = (endpoint as { metadata?: Record<string, unknown> })?.metadata\n  return metadata?.[CONNECT_SCOPE_METADATA_KEY] === CONNECT_SCOPE_METADATA_VALUE\n}\n\n/**\n * A per-delivery record of what actually committed.\n *\n * Deliberately append-only and stringly-typed: the reasons are read by a\n * human in a log line and by a spec, never switched on. Keeping it dumb is\n * what stops it growing into a second dispatch table that can disagree with\n * the real one.\n */\nexport interface WebhookEffectLedger {\n  /** Durable things this delivery committed, in the order they landed. */\n  readonly effects: readonly string[]\n  /** Reasons a branch decided the event was none of its business. */\n  readonly skips: readonly string[]\n  /**\n   * Record a committed effect. Call this AFTER the write it names, so a\n   * throw between the two cannot claim an effect that never landed.\n   */\n  effect(name: string): void\n  /**\n   * Record a deliberate no-op and why. This is the difference between \"not\n   * ours\" and \"broken\", and it is the half that prevents alert fatigue.\n   */\n  skip(reason: string): void\n}\n\nexport function createWebhookEffectLedger(): WebhookEffectLedger {\n  const effects: string[] = []\n  const skips: string[] = []\n  return {\n    effects,\n    skips,\n    effect(name: string) {\n      effects.push(name)\n    },\n    skip(reason: string) {\n      skips.push(reason)\n    },\n  }\n}\n\n/** Firestore methods that MUTATE. Everything else is a read or a builder. */\nconst WRITE_METHODS = new Set(['set', 'update', 'create', 'delete', 'add'])\n\n/**\n * Wrap a Firestore handle so every write it commits lands in the ledger.\n *\n * ## Why this exists rather than a `ledger.effect()` beside each write\n *\n * A hand-placed note next to a write is a check that CANNOT FAIL in the one\n * way that matters. Delete the write and leave the note, and the ledger\n * cheerfully reports an effect that never happened — which is the same\n * \"asserts its own literals\" defect the health probes are written to avoid.\n * The note has to be caused by the write, not merely adjacent to it.\n *\n * So the effect is recorded from INSIDE the call, after it resolves. A write\n * that throws records nothing (it did not commit); a write that is deleted\n * from the source records nothing (it is not called). There is no edit to\n * the handler that removes the work and keeps the signal.\n *\n * ## What it deliberately does not see\n *\n * Writes issued through a DIFFERENT Firestore handle — the shared\n * `tenant-data-admin` writers (`writeOrgBilling`, `notifyOrgAdmins`,\n * `notifyStaff`), which each open their own — and anything a plugin does\n * inside its own handler. Those are noted explicitly by the caller where\n * they are the only consequence of a branch, and the comments at those call\n * sites say so. The boundary is stated rather than hidden: this covers the\n * route's own writes, which is where the route's own bugs live.\n *\n * A Proxy rather than a hand-written facade because the wrapped object is\n * passed on to `updateExisting` and friends, which call methods this module\n * has never heard of. A facade would have to enumerate them and would\n * silently drop the ones it forgot.\n */\nexport function observeWrites<T extends object>(\n  handle: T,\n  ledger: WebhookEffectLedger,\n  label = 'firestore',\n): T {\n  return new Proxy(handle, {\n    get(target, property, receiver) {\n      const value = Reflect.get(target, property, receiver)\n      if (typeof value !== 'function' || typeof property !== 'string') {\n        return value\n      }\n      const method = property\n      return (...args: unknown[]) => {\n        const result = (value as (...a: unknown[]) => unknown).apply(\n          target,\n          args,\n        )\n        // `collection('orgs')` names the thing being written, so the ledger\n        // reads `orgs.update` rather than `firestore.update`. Everything\n        // else inherits the label it was reached through.\n        const nextLabel =\n          method === 'collection' && typeof args[0] === 'string'\n            ? (args[0] as string)\n            : label\n        if (WRITE_METHODS.has(method)) {\n          // Recorded on RESOLUTION. A rejected write committed nothing and\n          // must not read as an effect.\n          return Promise.resolve(result).then((settled) => {\n            ledger.effect(`${nextLabel}.${method}`)\n            return settled\n          })\n        }\n        // Builders (`collection`, `doc`, `where`, `limit`) return objects\n        // that can themselves be written through, so the wrapper follows\n        // them. Thenables are returned bare: wrapping a promise would make\n        // `then` look like a builder and recurse forever.\n        if (\n          result &&\n          typeof result === 'object' &&\n          typeof (result as { then?: unknown }).then !== 'function'\n        ) {\n          return observeWrites(result as object, ledger, nextLabel)\n        }\n        return result\n      }\n    },\n  })\n}\n\nexport interface WebhookDeliveryVerdict {\n  outcome: WebhookDeliveryOutcome\n  /** One short phrase naming WHY, for the log line and the spec. */\n  reason: string\n}\n\n/**\n * Classify one delivery.\n *\n * Order is the argument:\n *\n * 1. **Any effect, or any plugin claim, wins.** A delivery that both wrote\n *    something and skipped something else did work; a partially-skipped\n *    handler is not an idle one.\n * 2. **A named skip is an answer.** Reaching a branch that consciously\n *    decided \"not ours\" is a handled event, not a dropped one.\n * 3. **An event type we never subscribed to is not our problem.** Nothing\n *    promised to handle it.\n * 4. **Everything else is inert** — and by elimination that means: we asked\n *    Stripe for this event, we received it, no handler claimed it, no branch\n *    wrote anything, and no branch could say why.\n */\nexport function classifyWebhookDelivery(input: {\n  type: string\n  effects: readonly string[]\n  skips: readonly string[]\n  claimed: boolean\n  /** Overridable so the spec can prove the rule rather than the list. */\n  required?: readonly string[]\n}): WebhookDeliveryVerdict {\n  const { type, effects, skips, claimed } = input\n  const required = input.required ?? REQUIRED_WEBHOOK_EVENTS\n  if (effects.length > 0) return { outcome: 'acted', reason: effects[0] }\n  if (claimed) return { outcome: 'acted', reason: 'plugin-claimed' }\n  if (skips.length > 0) return { outcome: 'ignored', reason: skips[0] }\n  if (!required.includes(type)) {\n    return { outcome: 'ignored', reason: 'not-subscribed' }\n  }\n  return { outcome: 'inert', reason: 'no-effect' }\n}\n\n/**\n * How long after Stripe CREATES an event its first delivery attempt may\n * plausibly take to reach us, in seconds. Mirrors `RETRY_LAG_SECONDS` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`, under the same\n * read-the-`.mjs`-as-text drift guard as the lists above.\n *\n * Calibrated against the live account on 2026-08-18: the five deliveries that\n * succeeded first time landed in 1.0–3.7s; the one that did not —\n * `evt_1U49XtDYHP4psn7hA9VHPnZz`, whose three 400s ARE the three failures the\n * Stripe Dashboard was showing — landed 16,665s (4h 37m) late. Two minutes\n * sits three orders of magnitude clear of the healthy band and still inside\n * Stripe's first automatic retry interval, so it separates the two without\n * straddling either.\n */\nexport const RETRY_LAG_SECONDS = 120\n\n/**\n * What a delivery's lag says about the attempts BEFORE it.\n *\n * `unknown` is a first-class outcome, not a synonym for either answer. See\n * {@link classifyDeliveryLag} for why that matters more here than usual.\n */\nexport type WebhookDeliveryAttempt = 'first-attempt' | 'retried' | 'unknown'\n\n/** Why {@link classifyDeliveryLag} answered as it did. */\nexport type WebhookDeliveryLagReason =\n  | 'measured'\n  | 'created-absent'\n  | 'created-not-a-number'\n  | 'created-non-positive'\n  | 'received-unusable'\n  | 'clock-skew'\n\nexport interface WebhookDeliveryLagVerdict {\n  attempt: WebhookDeliveryAttempt\n  /** Seconds between `event.created` and our claim. Null unless `measured`. */\n  lagSeconds: number | null\n  reason: WebhookDeliveryLagReason\n}\n\n/**\n * DID THIS DELIVERY ONLY LAND ON A RETRY? (AGL-2039, the last arm of AGL-1948)\n *\n * ## The reconciliation this exists to close\n *\n * `/api/health/billing` scores EVENTS and `GET /v1/events?delivery_success=false`\n * is a TERMINAL-state filter: it selects events that are still pending or\n * failed EVERY attempt. An event that 400s three times and then succeeds on\n * the fourth reads back `delivery_success: true` and is, to that filter,\n * indistinguishable from one that succeeded immediately. The Stripe Dashboard\n * scores delivery ATTEMPTS, so the same hour reads 0% here and 30% there —\n * and both numbers are right. The three real failures were visible only in\n * the second reading, and each was a mirror that did not run when it should\n * have.\n *\n * The recoverable half of the attempt history is in our own data. The route\n * claims `stripeEvents/{id}` AFTER signature verification and DELETES the\n * claim when a handler throws, so the stamp always records the attempt that\n * actually got through. The distance from `event.created` to that stamp is\n * the delivery lag, and a lag of minutes means an earlier attempt failed.\n *\n * ## Why this is decided at WRITE time, not at read time\n *\n * The obvious implementation reads `receivedAt` off every claim document in\n * the window and subtracts. That turns a `.count()` aggregation — one\n * integer, zero documents read — into a document scan on a PUBLIC,\n * unauthenticated health endpoint polled every five minutes. Deciding here,\n * once, at the moment of the claim, lets the probe stay an aggregation over a\n * marker field, exactly like AGL-1954's `inertAtMs`.\n *\n * ## Absent, zero and unknown are THREE different things\n *\n * `strictNullChecks` is off repo-wide, so an absent `created` folds to falsy\n * and a naive `Number(event?.created ?? 0)` yields 0 — which subtracts to a\n * lag of ~1.7 BILLION seconds and reports every such delivery as a retry,\n * forever, on a perfectly healthy webhook. A monitoring signal that reds on\n * its own missing input is worse than no signal, because it is the thing that\n * gets muted. So each of those inputs is rejected by name:\n *\n * | input                       | attempt    | reason                  |\n * |-----------------------------|------------|-------------------------|\n * | field absent / null         | `unknown`  | `created-absent`        |\n * | a string, NaN, Infinity     | `unknown`  | `created-not-a-number`  |\n * | `0` or negative             | `unknown`  | `created-non-positive`  |\n * | our own stamp unusable      | `unknown`  | `received-unusable`     |\n * | created in the FUTURE by more than the bar | `unknown` | `clock-skew` |\n *\n * A lag between `-threshold` and `+threshold` is `first-attempt`: sub-second\n * clock skew between Stripe's clock and ours is ordinary and is not evidence\n * of anything.\n *\n * Pure: no clock, no I/O. The caller supplies both timestamps.\n */\nexport function classifyDeliveryLag(input: {\n  /** `event.created`, in unix SECONDS, exactly as Stripe sent it. */\n  eventCreatedSeconds: unknown\n  /** When we claimed the event, in unix MILLISECONDS. */\n  receivedAtMs: unknown\n  /** Overridable so the spec can prove the rule rather than the constant. */\n  thresholdSeconds?: number\n}): WebhookDeliveryLagVerdict {\n  const threshold = input.thresholdSeconds ?? RETRY_LAG_SECONDS\n  const created = input.eventCreatedSeconds\n  if (created === undefined || created === null) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'created-absent' }\n  }\n  if (typeof created !== 'number' || !Number.isFinite(created)) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-not-a-number',\n    }\n  }\n  // Zero is the value an absent field folds to under the repo's null rules,\n  // and no Stripe event was created at the epoch. Rejected by name so it can\n  // never be mistaken for a measurement.\n  if (created <= 0) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-non-positive',\n    }\n  }\n  const received = input.receivedAtMs\n  if (typeof received !== 'number' || !Number.isFinite(received) || received <= 0) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'received-unusable' }\n  }\n  const lagSeconds = received / 1000 - created\n  // An event stamped in OUR future by more than the threshold is a clock\n  // disagreement, not a fast delivery, and reporting it as a healthy first\n  // attempt would be an answer we cannot support.\n  if (lagSeconds < -threshold) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'clock-skew' }\n  }\n  return {\n    attempt: lagSeconds > threshold ? 'retried' : 'first-attempt',\n    lagSeconds,\n    reason: 'measured',\n  }\n}\n\n/**\n * Which required events is a destination NOT subscribed to? (AGL-1948)\n *\n * The same blind spot from the configuration side, and the cheaper half of\n * it: a subscription removed by hand in the Stripe dashboard produces no\n * failed delivery, no rejected request and no inert one either — Stripe\n * simply stops sending, and every count on the health probe reads a\n * perfectly healthy zero. `charge.refunded` was missing from the live\n * endpoint for exactly this reason (AGL-1798) and the only thing that ever\n * noticed was a script nobody ran.\n *\n * `['*']` is Stripe's wildcard subscription and covers everything.\n *\n * Returns the names, sorted, so the probe body is stable and a diff between\n * two readings is meaningful.\n */\nexport function unsubscribedRequiredEvents(\n  enabledEvents: readonly string[] | null | undefined,\n  required: readonly string[] = REQUIRED_WEBHOOK_EVENTS,\n): string[] {\n  if (!enabledEvents) return []\n  if (enabledEvents.includes('*')) return []\n  const enabled = new Set(enabledEvents)\n  return required.filter((event) => !enabled.has(event)).sort()\n}\n"],"names":["REQUIRED_WEBHOOK_EVENTS","CONNECT_SCOPE_METADATA_KEY","CONNECT_SCOPE_METADATA_VALUE","REQUIRED_CONNECT_WEBHOOK_EVENTS","isConnectWebhookEndpoint","endpoint","metadata","createWebhookEffectLedger","effects","skips","effect","name","push","skip","reason","WRITE_METHODS","Set","observeWrites","handle","ledger","label","Proxy","get","target","property","receiver","value","Reflect","method","args","result","apply","nextLabel","has","Promise","resolve","then","settled","classifyWebhookDelivery","input","type","claimed","required","length","outcome","includes","RETRY_LAG_SECONDS","classifyDeliveryLag","threshold","thresholdSeconds","created","eventCreatedSeconds","undefined","attempt","lagSeconds","Number","isFinite","received","receivedAtMs","unsubscribedRequiredEvents","enabledEvents","enabled","filter","event","sort"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEC,GAED,6CAA6C,GAG7C;;;;;;;CAOC,GACD,OAAO,MAAMA,0BAA6C;IACxD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,2EAA2E;IAC3E;IACA;IACA;IACA;IACA;IACA,qCAAqC;IACrC;IACA;IACA,8DAA8D;IAC9D;IACA,oCAAoC;IACpC;IACA;CACD,CAAA;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,6BAA6B,cAAa;AACvD,OAAO,MAAMC,+BAA+B,UAAS;AAErD;;;;;;;;;CASC,GACD,OAAO,MAAMC,kCAAqD;IAChE;IACA;IACA;CACD,CAAA;AAED;;;;;;;CAOC,GACD,OAAO,SAASC,yBAAyBC,QAAiB;IACxD,MAAMC,WAAYD,4BAAD,AAACA,SAAqDC,QAAQ;IAC/E,OAAOA,CAAAA,4BAAAA,QAAU,CAACL,2BAA2B,MAAKC;AACpD;AA2BA,OAAO,SAASK;IACd,MAAMC,UAAoB,EAAE;IAC5B,MAAMC,QAAkB,EAAE;IAC1B,OAAO;QACLD;QACAC;QACAC,QAAOC,IAAY;YACjBH,QAAQI,IAAI,CAACD;QACf;QACAE,MAAKC,MAAc;YACjBL,MAAMG,IAAI,CAACE;QACb;IACF;AACF;AAEA,2EAA2E,GAC3E,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAO;IAAU;IAAU;IAAU;CAAM;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASC,cACdC,MAAS,EACTC,MAA2B,EAC3BC,QAAQ,WAAW;IAEnB,OAAO,IAAIC,MAAMH,QAAQ;QACvBI,KAAIC,MAAM,EAAEC,QAAQ,EAAEC,QAAQ;YAC5B,MAAMC,QAAQC,QAAQL,GAAG,CAACC,QAAQC,UAAUC;YAC5C,IAAI,OAAOC,UAAU,cAAc,OAAOF,aAAa,UAAU;gBAC/D,OAAOE;YACT;YACA,MAAME,SAASJ;YACf,OAAO,CAAC,GAAGK;gBACT,MAAMC,SAAS,AAACJ,MAAuCK,KAAK,CAC1DR,QACAM;gBAEF,oEAAoE;gBACpE,iEAAiE;gBACjE,kDAAkD;gBAClD,MAAMG,YACJJ,WAAW,gBAAgB,OAAOC,IAAI,CAAC,EAAE,KAAK,WACzCA,IAAI,CAAC,EAAE,GACRT;gBACN,IAAIL,cAAckB,GAAG,CAACL,SAAS;oBAC7B,iEAAiE;oBACjE,8BAA8B;oBAC9B,OAAOM,QAAQC,OAAO,CAACL,QAAQM,IAAI,CAAC,CAACC;wBACnClB,OAAOT,MAAM,CAAC,GAAGsB,UAAU,CAAC,EAAEJ,QAAQ;wBACtC,OAAOS;oBACT;gBACF;gBACA,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,kDAAkD;gBAClD,IACEP,UACA,OAAOA,WAAW,YAClB,OAAO,AAACA,OAA8BM,IAAI,KAAK,YAC/C;oBACA,OAAOnB,cAAca,QAAkBX,QAAQa;gBACjD;gBACA,OAAOF;YACT;QACF;IACF;AACF;AAQA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASQ,wBAAwBC,KAOvC;QAEkBA;IADjB,MAAM,EAAEC,IAAI,EAAEhC,OAAO,EAAEC,KAAK,EAAEgC,OAAO,EAAE,GAAGF;IAC1C,MAAMG,YAAWH,kBAAAA,MAAMG,QAAQ,YAAdH,kBAAkBvC;IACnC,IAAIQ,QAAQmC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAS9B,QAAQN,OAAO,CAAC,EAAE;IAAC;IACtE,IAAIiC,SAAS,OAAO;QAAEG,SAAS;QAAS9B,QAAQ;IAAiB;IACjE,IAAIL,MAAMkC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAW9B,QAAQL,KAAK,CAAC,EAAE;IAAC;IACpE,IAAI,CAACiC,SAASG,QAAQ,CAACL,OAAO;QAC5B,OAAO;YAAEI,SAAS;YAAW9B,QAAQ;QAAiB;IACxD;IACA,OAAO;QAAE8B,SAAS;QAAS9B,QAAQ;IAAY;AACjD;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMgC,oBAAoB,IAAG;AA0BpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDC,GACD,OAAO,SAASC,oBAAoBR,KAOnC;QACmBA;IAAlB,MAAMS,aAAYT,0BAAAA,MAAMU,gBAAgB,YAAtBV,0BAA0BO;IAC5C,MAAMI,UAAUX,MAAMY,mBAAmB;IACzC,IAAID,YAAYE,aAAaF,YAAY,MAAM;QAC7C,OAAO;YAAEG,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAiB;IAC1E;IACA,IAAI,OAAOoC,YAAY,YAAY,CAACK,OAAOC,QAAQ,CAACN,UAAU;QAC5D,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,IAAIoC,WAAW,GAAG;QAChB,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,MAAM2C,WAAWlB,MAAMmB,YAAY;IACnC,IAAI,OAAOD,aAAa,YAAY,CAACF,OAAOC,QAAQ,CAACC,aAAaA,YAAY,GAAG;QAC/E,OAAO;YAAEJ,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAoB;IAC7E;IACA,MAAMwC,aAAaG,WAAW,OAAOP;IACrC,uEAAuE;IACvE,yEAAyE;IACzE,gDAAgD;IAChD,IAAII,aAAa,CAACN,WAAW;QAC3B,OAAO;YAAEK,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAa;IACtE;IACA,OAAO;QACLuC,SAASC,aAAaN,YAAY,YAAY;QAC9CM;QACAxC,QAAQ;IACV;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAAS6C,2BACdC,aAAmD,EACnDlB,WAA8B1C,uBAAuB;IAErD,IAAI,CAAC4D,eAAe,OAAO,EAAE;IAC7B,IAAIA,cAAcf,QAAQ,CAAC,MAAM,OAAO,EAAE;IAC1C,MAAMgB,UAAU,IAAI7C,IAAI4C;IACxB,OAAOlB,SAASoB,MAAM,CAAC,CAACC,QAAU,CAACF,QAAQ5B,GAAG,CAAC8B,QAAQC,IAAI;AAC7D"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/webhook-delivery.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * DID THE WEBHOOK ACTUALLY DO ANYTHING? (AGL-1954)\n *\n * Every signal we have about the billing webhook is a signal about the\n * REQUEST. Stripe records `delivery_success` off the status code. The\n * idempotency claim in `stripeEvents` records that the signature verified and\n * the handler was entered. `/api/health/billing` (AGL-1924) counts what\n * Stripe attempted and failed to deliver. All three read green for the one\n * failure this module exists to catch: **a handler that answers 200 and moves\n * nothing.**\n *\n * That is not hypothetical here. AGL-1798 is exactly it — `charge.refunded`\n * was never subscribed on the live destination, so AGL-1546's entitlement\n * revocation had no trigger, and every other indicator looked fine for as\n * long as it lasted. AGL-1551 is the same class from the other side: a week\n * of 100% rejected deliveries behind a green \"Active\" badge.\n *\n * ## The honest signal is an EFFECT, not a return code\n *\n * A check that asserts \"the handler ran\" is nearly as blind as the 200 —\n * the handler DID run in the AGL-1798 shape, it just had no work registered\n * for the event. So the route reports what it COMMITTED: an org's plan\n * mirrored, a `platformRevenue` row written, a refund stamped, an orphan\n * recorded, an audit row appended, a plugin claiming the event. Those are the\n * things whose absence is the bug.\n *\n * ## Three outcomes, and conflating the middle two is its own failure\n *\n * A binary \"did it write something\" would fire on every legitimately\n * irrelevant delivery — a tenant shopper's subscription carries no\n * `metadata.orgId` and correctly moves nothing on OUR side; a marketplace\n * refund resolves to no workspace customer and is correctly left to the\n * plugins; a `won` dispute nobody claimed reversed no money and correctly\n * wakes nobody. Alerting on those is alert fatigue, which ends with the alarm\n * muted and the real one lost inside it.\n *\n * So a branch that decides an event is not its business must SAY SO, by\n * name, through {@link WebhookEffectLedger.skip}. That is what separates:\n *\n * | outcome   | meaning                                            | alarm |\n * |-----------|----------------------------------------------------|-------|\n * | `acted`   | something durable committed, or a plugin claimed it | no    |\n * | `ignored` | a branch named a reason, or we never asked for this event type | no |\n * | `inert`   | an event we deliberately subscribe to produced NEITHER | YES  |\n *\n * `inert` is the whole point. Falling off the end of the dispatch with no\n * effect and no stated reason is precisely what a deleted write, an\n * unregistered plugin handler, or a renamed event type looks like from\n * inside the process — and it is the only one of the three that nothing else\n * in this system can see.\n *\n * ## Why the \"did we ask for it\" test is the required-events list\n *\n * Stripe delivers what the destination is subscribed to, and the destination\n * is created by `tools/scripts/setup-stripe.mjs` from `WEBHOOK_EVENTS`. An\n * event type outside that list reaching us is either a hand-added\n * subscription or a Connect delivery arriving at the platform destination —\n * unremarkable, and never our silent-drop bug, because we never claimed to\n * handle it. An event type INSIDE it is one we went out of our way to ask\n * Stripe for, so producing nothing from it is a contradiction by\n * construction.\n *\n * `REQUIRED_WEBHOOK_EVENTS` below is a copy of that list, and a copy is a\n * drift hazard — so `webhook-delivery.spec.ts` reads the `.mjs` and fails on\n * any divergence, in either direction. The alternative (moving the list\n * across the nx boundary out of `tools/`) is a wider change than this\n * warrants and is tracked on AGL-1948.\n *\n * Pure: no clock, no I/O, no Firestore. The route records, this decides, the\n * spec exercises every branch without a network.\n */\n\n/** What a single delivery turned out to be. */\nexport type WebhookDeliveryOutcome = 'acted' | 'ignored' | 'inert'\n\n/**\n * The event types the platform destination is subscribed to, mirroring\n * `WEBHOOK_EVENTS` in `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * The list is the definition of \"we asked for this\", which is what makes a\n * no-op delivery of one of them a defect rather than a non-event. Kept in\n * the same order as the source so a diff between the two reads cleanly.\n */\nexport const REQUIRED_WEBHOOK_EVENTS: readonly string[] = [\n  'customer.subscription.created',\n  'customer.subscription.updated',\n  'customer.subscription.deleted',\n  'checkout.session.completed',\n  'invoice.finalized',\n  'invoice.paid',\n  'invoice.payment_failed',\n  'charge.refunded',\n  'charge.dispute.created',\n  'charge.dispute.closed',\n  // AI overage charged as it accrues (AGL-3011), in the source list's order.\n  'invoice.voided',\n  'invoice.marked_uncollectible',\n  'customer.updated',\n  'payment_method.attached',\n  'payment_method.detached',\n  // Fraud signals to staff (AGL-3356).\n  'radar.early_fraud_warning.created',\n  'review.opened',\n  // A workspace's own failed charge, read for fraud (AGL-3767).\n  'charge.failed',\n  // Register card readers (AGL-3607).\n  'terminal.reader.action_succeeded',\n  'terminal.reader.action_failed',\n  // Cards taken offline on the Aglyn POS app reader (AGL-4039).\n  'payment_intent.amount_capturable_updated',\n  'payment_intent.succeeded',\n  'payment_intent.payment_failed',\n  'payment_intent.canceled',\n]\n\n/**\n * How the CONNECT destination identifies itself (AGL-1948), mirroring\n * `CONNECT_SCOPE_METADATA_KEY` / `CONNECT_SCOPE_METADATA_VALUE` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`.\n *\n * Connected-account events are delivered only to a destination created with\n * `connect: true`, and Stripe's API does not report that flag back on the\n * endpoint object — so the destination is identified by metadata we set at\n * creation instead. Same copy-and-guard arrangement as the list above.\n */\nexport const CONNECT_SCOPE_METADATA_KEY = 'aglyn_scope'\nexport const CONNECT_SCOPE_METADATA_VALUE = 'connect'\n\n/**\n * What the Connect destination must carry, mirroring\n * `CONNECT_WEBHOOK_EVENTS` in the same script lib.\n *\n * `account.updated` is the whole point of it: AGL-1997's `syncConnectAccountStatus`\n * is what stops a merchant whose Stripe account was later restricted from\n * going on selling against a stale `stripeChargesEnabled`, with the SHOPPER\n * meeting the failure at payment time. Without this event the handler cannot\n * run — which is exactly the state AGL-2122 found and fixed.\n */\nexport const REQUIRED_CONNECT_WEBHOOK_EVENTS: readonly string[] = [\n  'account.updated',\n  'payout.failed',\n  'payout.paid',\n]\n\n/**\n * Does this Stripe endpoint object carry our Connect scope marker?\n *\n * Coverage for it reuses `unsubscribedRequiredEvents` with\n * `REQUIRED_CONNECT_WEBHOOK_EVENTS` as the `required` argument — the wildcard\n * and null handling are identical questions, and a second copy of that logic\n * is a second place for it to drift.\n */\nexport function isConnectWebhookEndpoint(endpoint: unknown): boolean {\n  const metadata = (endpoint as { metadata?: Record<string, unknown> })?.metadata\n  return metadata?.[CONNECT_SCOPE_METADATA_KEY] === CONNECT_SCOPE_METADATA_VALUE\n}\n\n/**\n * A per-delivery record of what actually committed.\n *\n * Deliberately append-only and stringly-typed: the reasons are read by a\n * human in a log line and by a spec, never switched on. Keeping it dumb is\n * what stops it growing into a second dispatch table that can disagree with\n * the real one.\n */\nexport interface WebhookEffectLedger {\n  /** Durable things this delivery committed, in the order they landed. */\n  readonly effects: readonly string[]\n  /** Reasons a branch decided the event was none of its business. */\n  readonly skips: readonly string[]\n  /**\n   * Record a committed effect. Call this AFTER the write it names, so a\n   * throw between the two cannot claim an effect that never landed.\n   */\n  effect(name: string): void\n  /**\n   * Record a deliberate no-op and why. This is the difference between \"not\n   * ours\" and \"broken\", and it is the half that prevents alert fatigue.\n   */\n  skip(reason: string): void\n}\n\nexport function createWebhookEffectLedger(): WebhookEffectLedger {\n  const effects: string[] = []\n  const skips: string[] = []\n  return {\n    effects,\n    skips,\n    effect(name: string) {\n      effects.push(name)\n    },\n    skip(reason: string) {\n      skips.push(reason)\n    },\n  }\n}\n\n/** Firestore methods that MUTATE. Everything else is a read or a builder. */\nconst WRITE_METHODS = new Set(['set', 'update', 'create', 'delete', 'add'])\n\n/**\n * Wrap a Firestore handle so every write it commits lands in the ledger.\n *\n * ## Why this exists rather than a `ledger.effect()` beside each write\n *\n * A hand-placed note next to a write is a check that CANNOT FAIL in the one\n * way that matters. Delete the write and leave the note, and the ledger\n * cheerfully reports an effect that never happened — which is the same\n * \"asserts its own literals\" defect the health probes are written to avoid.\n * The note has to be caused by the write, not merely adjacent to it.\n *\n * So the effect is recorded from INSIDE the call, after it resolves. A write\n * that throws records nothing (it did not commit); a write that is deleted\n * from the source records nothing (it is not called). There is no edit to\n * the handler that removes the work and keeps the signal.\n *\n * ## What it deliberately does not see\n *\n * Writes issued through a DIFFERENT Firestore handle — the shared\n * `tenant-data-admin` writers (`writeOrgBilling`, `notifyOrgAdmins`,\n * `notifyStaff`), which each open their own — and anything a plugin does\n * inside its own handler. Those are noted explicitly by the caller where\n * they are the only consequence of a branch, and the comments at those call\n * sites say so. The boundary is stated rather than hidden: this covers the\n * route's own writes, which is where the route's own bugs live.\n *\n * A Proxy rather than a hand-written facade because the wrapped object is\n * passed on to `updateExisting` and friends, which call methods this module\n * has never heard of. A facade would have to enumerate them and would\n * silently drop the ones it forgot.\n */\nexport function observeWrites<T extends object>(\n  handle: T,\n  ledger: WebhookEffectLedger,\n  label = 'firestore',\n): T {\n  return new Proxy(handle, {\n    get(target, property, receiver) {\n      const value = Reflect.get(target, property, receiver)\n      if (typeof value !== 'function' || typeof property !== 'string') {\n        return value\n      }\n      const method = property\n      return (...args: unknown[]) => {\n        const result = (value as (...a: unknown[]) => unknown).apply(\n          target,\n          args,\n        )\n        // `collection('orgs')` names the thing being written, so the ledger\n        // reads `orgs.update` rather than `firestore.update`. Everything\n        // else inherits the label it was reached through.\n        const nextLabel =\n          method === 'collection' && typeof args[0] === 'string'\n            ? (args[0] as string)\n            : label\n        if (WRITE_METHODS.has(method)) {\n          // Recorded on RESOLUTION. A rejected write committed nothing and\n          // must not read as an effect.\n          return Promise.resolve(result).then((settled) => {\n            ledger.effect(`${nextLabel}.${method}`)\n            return settled\n          })\n        }\n        // Builders (`collection`, `doc`, `where`, `limit`) return objects\n        // that can themselves be written through, so the wrapper follows\n        // them. Thenables are returned bare: wrapping a promise would make\n        // `then` look like a builder and recurse forever.\n        if (\n          result &&\n          typeof result === 'object' &&\n          typeof (result as { then?: unknown }).then !== 'function'\n        ) {\n          return observeWrites(result as object, ledger, nextLabel)\n        }\n        return result\n      }\n    },\n  })\n}\n\nexport interface WebhookDeliveryVerdict {\n  outcome: WebhookDeliveryOutcome\n  /** One short phrase naming WHY, for the log line and the spec. */\n  reason: string\n}\n\n/**\n * Classify one delivery.\n *\n * Order is the argument:\n *\n * 1. **Any effect, or any plugin claim, wins.** A delivery that both wrote\n *    something and skipped something else did work; a partially-skipped\n *    handler is not an idle one.\n * 2. **A named skip is an answer.** Reaching a branch that consciously\n *    decided \"not ours\" is a handled event, not a dropped one.\n * 3. **An event type we never subscribed to is not our problem.** Nothing\n *    promised to handle it.\n * 4. **Everything else is inert** — and by elimination that means: we asked\n *    Stripe for this event, we received it, no handler claimed it, no branch\n *    wrote anything, and no branch could say why.\n */\nexport function classifyWebhookDelivery(input: {\n  type: string\n  effects: readonly string[]\n  skips: readonly string[]\n  claimed: boolean\n  /** Overridable so the spec can prove the rule rather than the list. */\n  required?: readonly string[]\n}): WebhookDeliveryVerdict {\n  const { type, effects, skips, claimed } = input\n  const required = input.required ?? REQUIRED_WEBHOOK_EVENTS\n  if (effects.length > 0) return { outcome: 'acted', reason: effects[0] }\n  if (claimed) return { outcome: 'acted', reason: 'plugin-claimed' }\n  if (skips.length > 0) return { outcome: 'ignored', reason: skips[0] }\n  if (!required.includes(type)) {\n    return { outcome: 'ignored', reason: 'not-subscribed' }\n  }\n  return { outcome: 'inert', reason: 'no-effect' }\n}\n\n/**\n * How long after Stripe CREATES an event its first delivery attempt may\n * plausibly take to reach us, in seconds. Mirrors `RETRY_LAG_SECONDS` in\n * `tools/scripts/lib/stripe-webhook-health.mjs`, under the same\n * read-the-`.mjs`-as-text drift guard as the lists above.\n *\n * Calibrated against the live account on 2026-08-18: the five deliveries that\n * succeeded first time landed in 1.0–3.7s; the one that did not —\n * `evt_1U49XtDYHP4psn7hA9VHPnZz`, whose three 400s ARE the three failures the\n * Stripe Dashboard was showing — landed 16,665s (4h 37m) late. Two minutes\n * sits three orders of magnitude clear of the healthy band and still inside\n * Stripe's first automatic retry interval, so it separates the two without\n * straddling either.\n */\nexport const RETRY_LAG_SECONDS = 120\n\n/**\n * What a delivery's lag says about the attempts BEFORE it.\n *\n * `unknown` is a first-class outcome, not a synonym for either answer. See\n * {@link classifyDeliveryLag} for why that matters more here than usual.\n */\nexport type WebhookDeliveryAttempt = 'first-attempt' | 'retried' | 'unknown'\n\n/** Why {@link classifyDeliveryLag} answered as it did. */\nexport type WebhookDeliveryLagReason =\n  | 'measured'\n  | 'created-absent'\n  | 'created-not-a-number'\n  | 'created-non-positive'\n  | 'received-unusable'\n  | 'clock-skew'\n\nexport interface WebhookDeliveryLagVerdict {\n  attempt: WebhookDeliveryAttempt\n  /** Seconds between `event.created` and our claim. Null unless `measured`. */\n  lagSeconds: number | null\n  reason: WebhookDeliveryLagReason\n}\n\n/**\n * DID THIS DELIVERY ONLY LAND ON A RETRY? (AGL-2039, the last arm of AGL-1948)\n *\n * ## The reconciliation this exists to close\n *\n * `/api/health/billing` scores EVENTS and `GET /v1/events?delivery_success=false`\n * is a TERMINAL-state filter: it selects events that are still pending or\n * failed EVERY attempt. An event that 400s three times and then succeeds on\n * the fourth reads back `delivery_success: true` and is, to that filter,\n * indistinguishable from one that succeeded immediately. The Stripe Dashboard\n * scores delivery ATTEMPTS, so the same hour reads 0% here and 30% there —\n * and both numbers are right. The three real failures were visible only in\n * the second reading, and each was a mirror that did not run when it should\n * have.\n *\n * The recoverable half of the attempt history is in our own data. The route\n * claims `stripeEvents/{id}` AFTER signature verification and DELETES the\n * claim when a handler throws, so the stamp always records the attempt that\n * actually got through. The distance from `event.created` to that stamp is\n * the delivery lag, and a lag of minutes means an earlier attempt failed.\n *\n * ## Why this is decided at WRITE time, not at read time\n *\n * The obvious implementation reads `receivedAt` off every claim document in\n * the window and subtracts. That turns a `.count()` aggregation — one\n * integer, zero documents read — into a document scan on a PUBLIC,\n * unauthenticated health endpoint polled every five minutes. Deciding here,\n * once, at the moment of the claim, lets the probe stay an aggregation over a\n * marker field, exactly like AGL-1954's `inertAtMs`.\n *\n * ## Absent, zero and unknown are THREE different things\n *\n * `strictNullChecks` is off repo-wide, so an absent `created` folds to falsy\n * and a naive `Number(event?.created ?? 0)` yields 0 — which subtracts to a\n * lag of ~1.7 BILLION seconds and reports every such delivery as a retry,\n * forever, on a perfectly healthy webhook. A monitoring signal that reds on\n * its own missing input is worse than no signal, because it is the thing that\n * gets muted. So each of those inputs is rejected by name:\n *\n * | input                       | attempt    | reason                  |\n * |-----------------------------|------------|-------------------------|\n * | field absent / null         | `unknown`  | `created-absent`        |\n * | a string, NaN, Infinity     | `unknown`  | `created-not-a-number`  |\n * | `0` or negative             | `unknown`  | `created-non-positive`  |\n * | our own stamp unusable      | `unknown`  | `received-unusable`     |\n * | created in the FUTURE by more than the bar | `unknown` | `clock-skew` |\n *\n * A lag between `-threshold` and `+threshold` is `first-attempt`: sub-second\n * clock skew between Stripe's clock and ours is ordinary and is not evidence\n * of anything.\n *\n * Pure: no clock, no I/O. The caller supplies both timestamps.\n */\nexport function classifyDeliveryLag(input: {\n  /** `event.created`, in unix SECONDS, exactly as Stripe sent it. */\n  eventCreatedSeconds: unknown\n  /** When we claimed the event, in unix MILLISECONDS. */\n  receivedAtMs: unknown\n  /** Overridable so the spec can prove the rule rather than the constant. */\n  thresholdSeconds?: number\n}): WebhookDeliveryLagVerdict {\n  const threshold = input.thresholdSeconds ?? RETRY_LAG_SECONDS\n  const created = input.eventCreatedSeconds\n  if (created === undefined || created === null) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'created-absent' }\n  }\n  if (typeof created !== 'number' || !Number.isFinite(created)) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-not-a-number',\n    }\n  }\n  // Zero is the value an absent field folds to under the repo's null rules,\n  // and no Stripe event was created at the epoch. Rejected by name so it can\n  // never be mistaken for a measurement.\n  if (created <= 0) {\n    return {\n      attempt: 'unknown',\n      lagSeconds: null,\n      reason: 'created-non-positive',\n    }\n  }\n  const received = input.receivedAtMs\n  if (typeof received !== 'number' || !Number.isFinite(received) || received <= 0) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'received-unusable' }\n  }\n  const lagSeconds = received / 1000 - created\n  // An event stamped in OUR future by more than the threshold is a clock\n  // disagreement, not a fast delivery, and reporting it as a healthy first\n  // attempt would be an answer we cannot support.\n  if (lagSeconds < -threshold) {\n    return { attempt: 'unknown', lagSeconds: null, reason: 'clock-skew' }\n  }\n  return {\n    attempt: lagSeconds > threshold ? 'retried' : 'first-attempt',\n    lagSeconds,\n    reason: 'measured',\n  }\n}\n\n/**\n * Which required events is a destination NOT subscribed to? (AGL-1948)\n *\n * The same blind spot from the configuration side, and the cheaper half of\n * it: a subscription removed by hand in the Stripe dashboard produces no\n * failed delivery, no rejected request and no inert one either — Stripe\n * simply stops sending, and every count on the health probe reads a\n * perfectly healthy zero. `charge.refunded` was missing from the live\n * endpoint for exactly this reason (AGL-1798) and the only thing that ever\n * noticed was a script nobody ran.\n *\n * `['*']` is Stripe's wildcard subscription and covers everything.\n *\n * Returns the names, sorted, so the probe body is stable and a diff between\n * two readings is meaningful.\n */\nexport function unsubscribedRequiredEvents(\n  enabledEvents: readonly string[] | null | undefined,\n  required: readonly string[] = REQUIRED_WEBHOOK_EVENTS,\n): string[] {\n  if (!enabledEvents) return []\n  if (enabledEvents.includes('*')) return []\n  const enabled = new Set(enabledEvents)\n  return required.filter((event) => !enabled.has(event)).sort()\n}\n"],"names":["REQUIRED_WEBHOOK_EVENTS","CONNECT_SCOPE_METADATA_KEY","CONNECT_SCOPE_METADATA_VALUE","REQUIRED_CONNECT_WEBHOOK_EVENTS","isConnectWebhookEndpoint","endpoint","metadata","createWebhookEffectLedger","effects","skips","effect","name","push","skip","reason","WRITE_METHODS","Set","observeWrites","handle","ledger","label","Proxy","get","target","property","receiver","value","Reflect","method","args","result","apply","nextLabel","has","Promise","resolve","then","settled","classifyWebhookDelivery","input","type","claimed","required","length","outcome","includes","RETRY_LAG_SECONDS","classifyDeliveryLag","threshold","thresholdSeconds","created","eventCreatedSeconds","undefined","attempt","lagSeconds","Number","isFinite","received","receivedAtMs","unsubscribedRequiredEvents","enabledEvents","enabled","filter","event","sort"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEC,GAED,6CAA6C,GAG7C;;;;;;;CAOC,GACD,OAAO,MAAMA,0BAA6C;IACxD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,2EAA2E;IAC3E;IACA;IACA;IACA;IACA;IACA,qCAAqC;IACrC;IACA;IACA,8DAA8D;IAC9D;IACA,oCAAoC;IACpC;IACA;IACA,8DAA8D;IAC9D;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,6BAA6B,cAAa;AACvD,OAAO,MAAMC,+BAA+B,UAAS;AAErD;;;;;;;;;CASC,GACD,OAAO,MAAMC,kCAAqD;IAChE;IACA;IACA;CACD,CAAA;AAED;;;;;;;CAOC,GACD,OAAO,SAASC,yBAAyBC,QAAiB;IACxD,MAAMC,WAAYD,4BAAD,AAACA,SAAqDC,QAAQ;IAC/E,OAAOA,CAAAA,4BAAAA,QAAU,CAACL,2BAA2B,MAAKC;AACpD;AA2BA,OAAO,SAASK;IACd,MAAMC,UAAoB,EAAE;IAC5B,MAAMC,QAAkB,EAAE;IAC1B,OAAO;QACLD;QACAC;QACAC,QAAOC,IAAY;YACjBH,QAAQI,IAAI,CAACD;QACf;QACAE,MAAKC,MAAc;YACjBL,MAAMG,IAAI,CAACE;QACb;IACF;AACF;AAEA,2EAA2E,GAC3E,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAO;IAAU;IAAU;IAAU;CAAM;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASC,cACdC,MAAS,EACTC,MAA2B,EAC3BC,QAAQ,WAAW;IAEnB,OAAO,IAAIC,MAAMH,QAAQ;QACvBI,KAAIC,MAAM,EAAEC,QAAQ,EAAEC,QAAQ;YAC5B,MAAMC,QAAQC,QAAQL,GAAG,CAACC,QAAQC,UAAUC;YAC5C,IAAI,OAAOC,UAAU,cAAc,OAAOF,aAAa,UAAU;gBAC/D,OAAOE;YACT;YACA,MAAME,SAASJ;YACf,OAAO,CAAC,GAAGK;gBACT,MAAMC,SAAS,AAACJ,MAAuCK,KAAK,CAC1DR,QACAM;gBAEF,oEAAoE;gBACpE,iEAAiE;gBACjE,kDAAkD;gBAClD,MAAMG,YACJJ,WAAW,gBAAgB,OAAOC,IAAI,CAAC,EAAE,KAAK,WACzCA,IAAI,CAAC,EAAE,GACRT;gBACN,IAAIL,cAAckB,GAAG,CAACL,SAAS;oBAC7B,iEAAiE;oBACjE,8BAA8B;oBAC9B,OAAOM,QAAQC,OAAO,CAACL,QAAQM,IAAI,CAAC,CAACC;wBACnClB,OAAOT,MAAM,CAAC,GAAGsB,UAAU,CAAC,EAAEJ,QAAQ;wBACtC,OAAOS;oBACT;gBACF;gBACA,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,kDAAkD;gBAClD,IACEP,UACA,OAAOA,WAAW,YAClB,OAAO,AAACA,OAA8BM,IAAI,KAAK,YAC/C;oBACA,OAAOnB,cAAca,QAAkBX,QAAQa;gBACjD;gBACA,OAAOF;YACT;QACF;IACF;AACF;AAQA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASQ,wBAAwBC,KAOvC;QAEkBA;IADjB,MAAM,EAAEC,IAAI,EAAEhC,OAAO,EAAEC,KAAK,EAAEgC,OAAO,EAAE,GAAGF;IAC1C,MAAMG,YAAWH,kBAAAA,MAAMG,QAAQ,YAAdH,kBAAkBvC;IACnC,IAAIQ,QAAQmC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAS9B,QAAQN,OAAO,CAAC,EAAE;IAAC;IACtE,IAAIiC,SAAS,OAAO;QAAEG,SAAS;QAAS9B,QAAQ;IAAiB;IACjE,IAAIL,MAAMkC,MAAM,GAAG,GAAG,OAAO;QAAEC,SAAS;QAAW9B,QAAQL,KAAK,CAAC,EAAE;IAAC;IACpE,IAAI,CAACiC,SAASG,QAAQ,CAACL,OAAO;QAC5B,OAAO;YAAEI,SAAS;YAAW9B,QAAQ;QAAiB;IACxD;IACA,OAAO;QAAE8B,SAAS;QAAS9B,QAAQ;IAAY;AACjD;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMgC,oBAAoB,IAAG;AA0BpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDC,GACD,OAAO,SAASC,oBAAoBR,KAOnC;QACmBA;IAAlB,MAAMS,aAAYT,0BAAAA,MAAMU,gBAAgB,YAAtBV,0BAA0BO;IAC5C,MAAMI,UAAUX,MAAMY,mBAAmB;IACzC,IAAID,YAAYE,aAAaF,YAAY,MAAM;QAC7C,OAAO;YAAEG,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAiB;IAC1E;IACA,IAAI,OAAOoC,YAAY,YAAY,CAACK,OAAOC,QAAQ,CAACN,UAAU;QAC5D,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,IAAIoC,WAAW,GAAG;QAChB,OAAO;YACLG,SAAS;YACTC,YAAY;YACZxC,QAAQ;QACV;IACF;IACA,MAAM2C,WAAWlB,MAAMmB,YAAY;IACnC,IAAI,OAAOD,aAAa,YAAY,CAACF,OAAOC,QAAQ,CAACC,aAAaA,YAAY,GAAG;QAC/E,OAAO;YAAEJ,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAoB;IAC7E;IACA,MAAMwC,aAAaG,WAAW,OAAOP;IACrC,uEAAuE;IACvE,yEAAyE;IACzE,gDAAgD;IAChD,IAAII,aAAa,CAACN,WAAW;QAC3B,OAAO;YAAEK,SAAS;YAAWC,YAAY;YAAMxC,QAAQ;QAAa;IACtE;IACA,OAAO;QACLuC,SAASC,aAAaN,YAAY,YAAY;QAC9CM;QACAxC,QAAQ;IACV;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAAS6C,2BACdC,aAAmD,EACnDlB,WAA8B1C,uBAAuB;IAErD,IAAI,CAAC4D,eAAe,OAAO,EAAE;IAC7B,IAAIA,cAAcf,QAAQ,CAAC,MAAM,OAAO,EAAE;IAC1C,MAAMgB,UAAU,IAAI7C,IAAI4C;IACxB,OAAOlB,SAASoB,MAAM,CAAC,CAACC,QAAU,CAACF,QAAQ5B,GAAG,CAAC8B,QAAQC,IAAI;AAC7D"}

package/src/lib/foundation/definitions/organization.types.d.ts

@@ -191,10 +191,20 @@ export interface AglynOrgMember extends AglynDocument {
      * Per-site permission overrides for a COLLABORATOR (AGL-2927), keyed by
      * the host the grant is for. Absent keys resolve by the host role's
      * default, so a document written before this field existed reads the same
-     * as one written after it. Org-wide members are never consulted here:
-     * their org role, custom role and `permissions` map decide.
+     * as one written after it. Org-wide members are consulted here only on a
+     * site where their access is narrower than their workspace role, and only
+     * for the keys such a site narrows (AGL-4047, `narrowPermissionsToSite`);
+     * everywhere else their org role, custom role and `permissions` map decide.
      */
     hostPermissions?: Record<HostUid, Partial<Record<HostPermissionKey, boolean>>>;
+    /**
+     * Per key a site can narrow (AGL-4047): `true` follows the site role on a
+     * site where this member's access is narrower than their workspace role,
+     * `false` keeps the permission there. A key it leaves out follows their
+     * custom role's `siteNarrowing`, then the built-in role's default. Read
+     * only for a member who works across the whole workspace.
+     */
+    siteNarrowing?: Partial<Record<string, boolean>>;
     /**
      * Denormalized reach as scope tokens (AGL-1038), so rules can intersect
      * it with a resource's `visibleTo` — they cannot derive it from

package/src/lib/foundation/definitions/organization.types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/aglyn/src/lib/foundation/definitions/organization.types.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Multi-tenant organizations (AGL-233, docs/MULTI_TENANT_FIRESTORE.md):\n * the org is the tenant boundary — one subscription, one workspace\n * subdomain, one isolation subtree. Billing fields mirror `AglynOrgBilling`\n * so the plan/entitlement resolvers work on either doc during the\n * transition; org-keyed billing lands with AGL-237.\n */\n\nimport type { ITimestamp } from '@aglyn/shared-util-timestamp'\nimport type { AccountAcquisition } from '../../app-utils/account-acquisition'\nimport type {\n  AiTierId,\n  OrgCrmSettings,\n  OrgEntitlements,\n  OrgPlan,\n  OrgSeatAddons,\n  OrgSubscription,\n  OrgUpgradeProposal,\n} from './org-billing.types'\nimport type {\n  AglynDocument,\n  HostUid,\n  OrgUid,\n  ScopeToken,\n  UserUid,\n} from './platform.types'\n\nexport type { OrgUid } from './platform.types'\n/** Workspace subdomain label: `{slug}.aglyn.com` (Slack-style). */\nexport type OrgSlug = string\n\n/** Org-wide roles, strongest to weakest. */\nexport type OrgRole = 'owner' | 'admin' | 'editor' | 'viewer'\n\n/**\n * Per-host refinement for editor/viewer members (\"3 of 15 sites\").\n *\n * `author` (AGL-2334) is `editor` MINUS publish: it may create and edit\n * every content document on the site, and it may not make any of it live.\n * It exists because the agency guide sells exactly that role — \"a client who\n * may edit content but not publish\" — and until now the narrowest thing we\n * could offer was `viewer`, which cannot edit at all.\n *\n * It is a HOST role rather than a twelfth org permission key deliberately.\n * Publishing is a set of client-direct Firestore writes, so it is enforced\n * in the security rules, and the rules resolve a host request from the\n * `memberRoles` projection with the one `get()` they already do. An org\n * permission key is on the wrong axis: rules cannot evaluate a custom role\n * without a second denormalized projection, and every publish surface would\n * need a server route it does not have.\n *\n * Ordered between `editor` and `viewer` because that is its strength, but\n * NOTHING may treat this union as ordered — `ORG_ROLE_WEIGHT` exists for the\n * org axis and has no counterpart here on purpose. Host roles are compared by\n * membership in a set (`HOST_CONTENT_WRITE_ROLES`, `HOST_PUBLISH_ROLES`), and\n * an author is not \"a weaker editor\" in a way any single number can express.\n */\nexport type HostAccessRole = 'admin' | 'editor' | 'author' | 'viewer'\n\n/**\n * A per-site permission key a collaborator can carry (AGL-2927, AGL-2984).\n * The host role decides what a collaborator may do to the SITE; these keys\n * decide what else they may do on it. Each is a catalog key a plugin\n * declares with host-role defaults, the same dotted key the org catalog\n * names, so one label serves both rosters.\n */\nexport type HostPermissionKey = string\n\n/**\n * Every host role, as a value — for `where('memberRoles.{uid}', 'in', …)`.\n *\n * `/hosts/{hostId}` is gated per document on `memberRoles.{uid}`, and\n * Firestore refuses to run a LIST that could return a denied document. So\n * every client query over `hosts` must carry this filter, and it must name\n * ALL the roles: a role missing from the array is a site the member owns and\n * cannot see, with no error to explain it (AGL-1145).\n *\n * Built from a `Record` rather than written as an array so that adding a role\n * to the union above fails to COMPILE here. A plain `HostAccessRole[]` would\n * happily stay short, which is the silent half of the bug.\n */\nconst HOST_ACCESS_ROLE_KEYS: Record<HostAccessRole, true> = {\n  admin: true,\n  editor: true,\n  author: true,\n  viewer: true,\n}\nexport const HOST_ACCESS_ROLES = Object.keys(\n  HOST_ACCESS_ROLE_KEYS,\n) as HostAccessRole[]\n\nexport interface AglynOrganization extends AglynDocument {\n  $id: OrgUid\n  name?: string\n  slug?: OrgSlug\n  /** Current owner; ownership can move without re-keying anything. */\n  ownerUid?: UserUid\n  /**\n   * Who CREATED the workspace — stamped once inside `createOrganization`'s\n   * transaction and mutated by nothing, `transferOrgOwnership` included\n   * (AGL-2265).\n   *\n   * `ownerUid` moves; this does not, and the difference is the whole point.\n   * The free-workspace ceiling counts the UNION of the two, so handing a\n   * workspace to an alt account, creating a fourth and taking the first one\n   * back is not a way past the limit. Denied to client writes in the rules\n   * for the same reason — a client that could clear its own attribution could\n   * mint free workspaces without limit.\n   *\n   * Absent on every org created before AGL-2265 shipped, and every reader\n   * must tolerate that: those are counted by `ownerUid` exactly as they\n   * always were.\n   */\n  createdByUid?: UserUid\n  /**\n   * Where the workspace came from (AGL-3289): its creator's acquisition\n   * record, copied by `createOrganization` at birth and naming the account it\n   * was copied from. Written by nothing else, and denied to client writes on\n   * every rules branch, for the reason `createdByUid` is: it is the\n   * platform's record about the workspace, not the workspace's about itself.\n   */\n  acquisition?: AccountAcquisition\n  /** Directory of the org's hosts (mirrors AglynOrgBilling.hosts). */\n  hosts?: Record<HostUid, true>\n\n  // Billing (mirrors AglynOrgBilling; source of truth moves here with AGL-237)\n  plan?: OrgPlan\n  entitlements?: OrgEntitlements\n  /**\n   * Per-org plugin switchboard (AGL-416): ids of plugins the workspace\n   * loads (see plugin-manager/enabled-plugins). Absent = all first-party\n   * plugins; always-on ids (base components) and the ids on for every\n   * workspace (AI) are unioned in regardless — a site switches those off for\n   * itself instead.\n   */\n  enabledPlugins?: string[]\n  seatAddons?: OrgSeatAddons\n  /** Which Aglyn AI tier `seatAddons.aiAddon` is (AGL-3965); see `AglynOrgBilling.aiTier`. */\n  aiTier?: AiTierId | null\n  stripeCustomerId?: string\n  subscription?: OrgSubscription\n  suspendedAt?: ITimestamp | null\n  /** Staff-internal rationale (AGL-202). NEVER shown to the customer. */\n  suspendedReason?: string\n  /**\n   * Lockdown extensions (AGL-1501) on the shipped AGL-202 carrier — the org\n   * scope of the panic button. `suspendedReasonCode` is the enum the notice\n   * copy switches on (`security`/`billing`/`maintenance`/`manual`; absent =\n   * `manual`), `suspendedMessage` is the CUSTOMER-FACING notice body (unlike\n   * `suspendedReason`), and `suspendedUntilMs` is an optional expiry — once\n   * it passes, the suspension is inactive with no write needed (maintenance\n   * windows end on their own). Plain epoch ms, not a Timestamp, so every\n   * cache serialization reads it back unchanged. All written only by\n   * /api/admin/lockdown; normalized by `app-utils/lockdown.ts`.\n   */\n  suspendedReasonCode?: string\n  suspendedMessage?: string\n  suspendedUntilMs?: number\n  /**\n   * Whether that suspension is in force, stored for the staff list's\n   * Suspended filter (AGL-3416). See `AglynOrgBilling.suspended`.\n   */\n  suspended?: boolean\n  erasureRequestedAt?: ITimestamp | null\n  /**\n   * Scope applied to newly created datasets when nobody chooses (AGL-1048). `'org'` — the default\n   * and today's behavior — shares them with every site. `'host'` starts them\n   * private to the site they were created in, which is what an agency\n   * running client sites wants: safe by default rather than safe by\n   * discipline.\n   *\n   * Only meaningful when there IS a site in context. Created from the org\n   * Data page there is no host to scope to, so those stay `'org'` either way.\n   *\n   * New media follows `defaultMediaScope` and new CRM records\n   * `crm.defaultRecordScope` instead; each falls back to this only while it\n   * is unset, because this one field decided all three before AGL-3662.\n   */\n  defaultResourceScope?: 'org' | 'host'\n  /**\n   * The same choice for new uploads and media folders (AGL-3662), set\n   * separately from datasets: an org can keep its rate card on one site\n   * while every site shares its photos. Unset reads `defaultResourceScope`\n   * — see `defaultMediaScopeOf` — which is what every org stored before the\n   * two were split.\n   */\n  defaultMediaScope?: 'org' | 'host'\n  /** The CRM's organization-wide settings (AGL-2613) — see `OrgCrmSettings`. */\n  crm?: OrgCrmSettings\n  /** The plan staff asked the workspace to move to (AGL-3466). */\n  upgradeProposal?: OrgUpgradeProposal\n  /**\n   * When any member last used the console inside this organization —\n   * stamped at creation, then by `/api/orgs/last-activity` at most once per\n   * 15 minutes. Server-owned: the rules deny it to every client write. The\n   * staff Organizations list sorts by it.\n   */\n  lastActivityAt?: ITimestamp\n}\n\n/**\n * `orgs/{orgId}/members/{uid}` — THE authorization doc: rules resolve a\n * request with this single read. Owner/admin span every host; editor and\n * viewer see `hostAccess` (or `allHosts`).\n */\nexport interface AglynOrgMember extends AglynDocument {\n  $id: UserUid\n  role?: OrgRole\n  /**\n   * Custom role reference (AGL-243): id of an `orgs/{orgId}/roles` doc\n   * whose permission map overrides the org role's defaults.\n   */\n  roleId?: string\n  /** Per-member permission overrides (AGL-243); win over every layer. */\n  permissions?: Record<string, boolean>\n  /** Org-wide host access shortcut; otherwise `hostAccess` decides. */\n  allHosts?: boolean\n  hostAccess?: Record<HostUid, HostAccessRole>\n  /**\n   * Per-site permission overrides for a COLLABORATOR (AGL-2927), keyed by\n   * the host the grant is for. Absent keys resolve by the host role's\n   * default, so a document written before this field existed reads the same\n   * as one written after it. Org-wide members are never consulted here:\n   * their org role, custom role and `permissions` map decide.\n   */\n  hostPermissions?: Record<HostUid, Partial<Record<HostPermissionKey, boolean>>>\n  /**\n   * Denormalized reach as scope tokens (AGL-1038), so rules can intersect\n   * it with a resource's `visibleTo` — they cannot derive it from\n   * `hostAccess` because the rules language has no `.map()`. Written only\n   * by `syncOrgAuthProjections`; never edit it by hand.\n   */\n  scopeTokens?: ScopeToken[]\n  /**\n   * Denormalized THREE-LAYER permission verdict, so rules can honor a custom\n   * role they cannot resolve.\n   *\n   * `roleId` points at another document and `permissions` is only the top\n   * layer, so a rule reading either alone answers a different question from\n   * the server — and reproducing the precedence in CEL needs a second\n   * cross-document get() plus correct handling of a dangling id. This is\n   * `resolveOrgPermissions(member, customRole)`, already applied.\n   *\n   * ⚠️ ABSENT IS NOT EMPTY, and the rules must never treat it as either\n   * \"everything allowed\" or \"nothing allowed\". Documents predating this\n   * field, and any written by a path that bypasses\n   * `syncOrgAuthProjections`, carry no map at all; the rules fall back to\n   * the layers they CAN read — the role and the per-member overrides — which\n   * is exactly the verdict they gave before this field existed. Written only\n   * by `syncOrgAuthProjections` and by `createOrganization`'s inline stamp;\n   * never edit it by hand.\n   */\n  resolvedPermissions?: Record<string, boolean>\n  /** Denormalized for member lists without N user lookups. */\n  displayName?: string\n  email?: string\n  invitedBy?: UserUid\n  joinedAt?: ITimestamp\n  /**\n   * Denormalized org suspension flag (AGL-210) so host writes stay a\n   * single rules read; maintained by the staff suspension API.\n   */\n  orgSuspended?: boolean\n  /**\n   * The row belongs to platform staff and takes none of the customer's seats\n   * (AGL-3466).\n   *\n   * Stamped by the server whenever it writes a row for an account that holds\n   * the `staff` claim at that moment — `createOrganization`, `upsertOrgMember`,\n   * `grantHostAccess` — and cleared on every row the account holds when the\n   * claim is revoked. Every seat counter and every seat gate skips a stamped\n   * row, so a staff member who builds a workspace for a prospect, or joins one\n   * to help, never fills the seat the customer is paying for. The rules refuse\n   * client writes to `members`, so nobody can stamp themselves.\n   */\n  staffSeat?: boolean\n}\n\n/**\n * What happens to the outgoing owner when an owner handoff is accepted\n * (AGL-3466): `stay` keeps them on as an admin, `leave` takes them off the\n * roster.\n */\nexport type OwnerHandoffPreviousOwner = 'stay' | 'leave'\n\n/** The handoff half of an owner-handoff invite (AGL-3466). */\nexport interface AglynOrgOwnerHandoff {\n  previousOwner: OwnerHandoffPreviousOwner\n}\n\n/** `orgs/{orgId}/invites/{inviteId}` — pending email invites. */\nexport interface AglynOrgInvite extends AglynDocument {\n  $id: string\n  email?: string\n  /**\n   * `owner` only on an owner-handoff invite, which always carries `handoff`\n   * beside it (AGL-3466). Every other invite is admin, editor or viewer.\n   */\n  role?: OrgRole\n  allHosts?: boolean\n  hostAccess?: Record<HostUid, HostAccessRole>\n  /**\n   * Accepting this invite moves the workspace to the invitee (AGL-3466). It\n   * reserves no seat: the owner seat moves rather than being added, and the\n   * send-time check refuses a `stay` that would need a seat the plan lacks.\n   */\n  handoff?: AglynOrgOwnerHandoff\n  /**\n   * The address belongs to an account holding the `staff` claim, checked when\n   * the invite is sent, so it reserves no seat (AGL-3466). Checked again at\n   * acceptance, against the account that actually accepts.\n   */\n  staffSeat?: boolean\n  invitedBy?: UserUid\n  createdAt?: ITimestamp\n  acceptedAt?: ITimestamp | null\n  acceptedBy?: UserUid\n}\n\n/**\n * `orgSlugs/{slug}` — transactional uniqueness reservation; created and\n * deleted only by the org APIs (Admin SDK), publicly readable so the\n * console can resolve a workspace subdomain client-side.\n */\nexport interface OrgSlugReservation {\n  orgId: OrgUid\n  /**\n   * Set when the previous holder renamed away — the tombstone that keeps old\n   * workspace URLs redirecting until somebody else wants the name.\n   */\n  movedTo?: string\n  /**\n   * Epoch millis at which a PENDING reservation lapses (AGL-2585).\n   *\n   * Present only on a workspace created by an owner whose email was not yet\n   * verified, which is every password signup: the address is held for them,\n   * not granted to them, and the hold ends unless they confirm the address.\n   * Absent means granted, and a grant never expires — so every workspace made\n   * by a verified owner, and every one that predates this field, is outside\n   * the rule entirely.\n   *\n   * Cleared by `reap-unverified-orgs` once the owner verifies. Public, like\n   * the rest of this document, which is why nothing identifying the owner is\n   * written beside it.\n   */\n  reservedUntil?: number\n}\n\n/**\n * `hostIndex/{hostId}` — server-written host → org resolver so the tenant\n * renderer and middleware find a host's org without scanning.\n */\nexport interface HostIndexEntry {\n  orgId: OrgUid\n  subdomain?: string\n}\n\n/**\n * `users/{uid}/orgs/{orgId}` — reverse index for \"my organizations\",\n * maintained transactionally with the member doc by the membership API.\n */\nexport interface UserOrgMembership extends AglynDocument {\n  $id: OrgUid\n  role?: OrgRole\n  orgName?: string\n  slug?: OrgSlug\n  /**\n   * Mirror of `isOrgWideMember(orgs/{orgId}/members/{uid})` (AGL-1032): does\n   * this membership reach the whole org, or only a list of sites?\n   *\n   * `role` alone cannot answer it — `grantHostAccess` writes `role: 'viewer'`\n   * here for a site collaborator, exactly what a genuine org-wide viewer\n   * carries, so the console could not tell them apart without a second read\n   * of the member doc on every org route. Denormalized because the console\n   * navigation guard has to be synchronous: an async answer flashes the org\n   * chrome before hiding it.\n   *\n   * ABSENT means org-wide. Rows predating the mirror carry no flag, and a\n   * missing field must never lock a real member out of their own workspace\n   * (the same legacy shape `isOrgWideMember` handles). Only an explicit\n   * `false` scopes the console — see `isOrgWideMembership`.\n   *\n   * Navigation only. The Firestore rules are the access boundary (AGL-1026);\n   * a stale mirror at worst shows a page whose reads then come back empty.\n   */\n  orgWide?: boolean\n}\n\n/**\n * `users/{uid}/hostMemberships/{hostId}` — reverse index of the sites a user\n * can reach, mirroring `hosts/{hostId}.memberRoles` (AGL-844). Denormalizes the\n * host name so the site switcher and subdomain→id routing query a user's own\n * sites, ordered and name-prefix-searched, without scanning the `hosts`\n * collection. Admin-SDK-maintained beside `memberRoles`; a best-effort\n * convenience index, never an authorization source (the rules still gate host\n * reads on `memberRoles`). NOT named `hosts` — that would collide with the\n * top-level `hosts` collection for collection-group rules/indexes.\n */\nexport interface UserHostMembership extends AglynDocument {\n  $id: HostUid\n  orgId?: OrgUid\n  subdomain?: string\n  displayName?: string\n  nameLower?: string\n  /**\n   * Mirror of the host's `seo.favicon` (AGL-1071). The site switcher renders\n   * from this projection rather than the host doc, so without the mirror it\n   * showed the generic glyph for every site — the favicon feature worked in\n   * the sites list and nowhere else. Absent when the site has none; writers\n   * must DELETE it on clear rather than omit it, since the rows are written\n   * with `{ merge: true }` and an omitted field would keep the old icon.\n   */\n  favicon?: string\n  role?: HostAccessRole\n  updatedAt?: ITimestamp\n}\n"],"names":["HOST_ACCESS_ROLE_KEYS","admin","editor","author","viewer","HOST_ACCESS_ROLES","Object","keys"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GA8DD;;;;;;;;;;;;CAYC,GACD,MAAMA,wBAAsD;IAC1DC,OAAO;IACPC,QAAQ;IACRC,QAAQ;IACRC,QAAQ;AACV;AACA,OAAO,MAAMC,oBAAoBC,OAAOC,IAAI,CAC1CP,uBACmB"}
+{"version":3,"sources":["../../../../../../../libs/aglyn/src/lib/foundation/definitions/organization.types.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Multi-tenant organizations (AGL-233, docs/MULTI_TENANT_FIRESTORE.md):\n * the org is the tenant boundary — one subscription, one workspace\n * subdomain, one isolation subtree. Billing fields mirror `AglynOrgBilling`\n * so the plan/entitlement resolvers work on either doc during the\n * transition; org-keyed billing lands with AGL-237.\n */\n\nimport type { ITimestamp } from '@aglyn/shared-util-timestamp'\nimport type { AccountAcquisition } from '../../app-utils/account-acquisition'\nimport type {\n  AiTierId,\n  OrgCrmSettings,\n  OrgEntitlements,\n  OrgPlan,\n  OrgSeatAddons,\n  OrgSubscription,\n  OrgUpgradeProposal,\n} from './org-billing.types'\nimport type {\n  AglynDocument,\n  HostUid,\n  OrgUid,\n  ScopeToken,\n  UserUid,\n} from './platform.types'\n\nexport type { OrgUid } from './platform.types'\n/** Workspace subdomain label: `{slug}.aglyn.com` (Slack-style). */\nexport type OrgSlug = string\n\n/** Org-wide roles, strongest to weakest. */\nexport type OrgRole = 'owner' | 'admin' | 'editor' | 'viewer'\n\n/**\n * Per-host refinement for editor/viewer members (\"3 of 15 sites\").\n *\n * `author` (AGL-2334) is `editor` MINUS publish: it may create and edit\n * every content document on the site, and it may not make any of it live.\n * It exists because the agency guide sells exactly that role — \"a client who\n * may edit content but not publish\" — and until now the narrowest thing we\n * could offer was `viewer`, which cannot edit at all.\n *\n * It is a HOST role rather than a twelfth org permission key deliberately.\n * Publishing is a set of client-direct Firestore writes, so it is enforced\n * in the security rules, and the rules resolve a host request from the\n * `memberRoles` projection with the one `get()` they already do. An org\n * permission key is on the wrong axis: rules cannot evaluate a custom role\n * without a second denormalized projection, and every publish surface would\n * need a server route it does not have.\n *\n * Ordered between `editor` and `viewer` because that is its strength, but\n * NOTHING may treat this union as ordered — `ORG_ROLE_WEIGHT` exists for the\n * org axis and has no counterpart here on purpose. Host roles are compared by\n * membership in a set (`HOST_CONTENT_WRITE_ROLES`, `HOST_PUBLISH_ROLES`), and\n * an author is not \"a weaker editor\" in a way any single number can express.\n */\nexport type HostAccessRole = 'admin' | 'editor' | 'author' | 'viewer'\n\n/**\n * A per-site permission key a collaborator can carry (AGL-2927, AGL-2984).\n * The host role decides what a collaborator may do to the SITE; these keys\n * decide what else they may do on it. Each is a catalog key a plugin\n * declares with host-role defaults, the same dotted key the org catalog\n * names, so one label serves both rosters.\n */\nexport type HostPermissionKey = string\n\n/**\n * Every host role, as a value — for `where('memberRoles.{uid}', 'in', …)`.\n *\n * `/hosts/{hostId}` is gated per document on `memberRoles.{uid}`, and\n * Firestore refuses to run a LIST that could return a denied document. So\n * every client query over `hosts` must carry this filter, and it must name\n * ALL the roles: a role missing from the array is a site the member owns and\n * cannot see, with no error to explain it (AGL-1145).\n *\n * Built from a `Record` rather than written as an array so that adding a role\n * to the union above fails to COMPILE here. A plain `HostAccessRole[]` would\n * happily stay short, which is the silent half of the bug.\n */\nconst HOST_ACCESS_ROLE_KEYS: Record<HostAccessRole, true> = {\n  admin: true,\n  editor: true,\n  author: true,\n  viewer: true,\n}\nexport const HOST_ACCESS_ROLES = Object.keys(\n  HOST_ACCESS_ROLE_KEYS,\n) as HostAccessRole[]\n\nexport interface AglynOrganization extends AglynDocument {\n  $id: OrgUid\n  name?: string\n  slug?: OrgSlug\n  /** Current owner; ownership can move without re-keying anything. */\n  ownerUid?: UserUid\n  /**\n   * Who CREATED the workspace — stamped once inside `createOrganization`'s\n   * transaction and mutated by nothing, `transferOrgOwnership` included\n   * (AGL-2265).\n   *\n   * `ownerUid` moves; this does not, and the difference is the whole point.\n   * The free-workspace ceiling counts the UNION of the two, so handing a\n   * workspace to an alt account, creating a fourth and taking the first one\n   * back is not a way past the limit. Denied to client writes in the rules\n   * for the same reason — a client that could clear its own attribution could\n   * mint free workspaces without limit.\n   *\n   * Absent on every org created before AGL-2265 shipped, and every reader\n   * must tolerate that: those are counted by `ownerUid` exactly as they\n   * always were.\n   */\n  createdByUid?: UserUid\n  /**\n   * Where the workspace came from (AGL-3289): its creator's acquisition\n   * record, copied by `createOrganization` at birth and naming the account it\n   * was copied from. Written by nothing else, and denied to client writes on\n   * every rules branch, for the reason `createdByUid` is: it is the\n   * platform's record about the workspace, not the workspace's about itself.\n   */\n  acquisition?: AccountAcquisition\n  /** Directory of the org's hosts (mirrors AglynOrgBilling.hosts). */\n  hosts?: Record<HostUid, true>\n\n  // Billing (mirrors AglynOrgBilling; source of truth moves here with AGL-237)\n  plan?: OrgPlan\n  entitlements?: OrgEntitlements\n  /**\n   * Per-org plugin switchboard (AGL-416): ids of plugins the workspace\n   * loads (see plugin-manager/enabled-plugins). Absent = all first-party\n   * plugins; always-on ids (base components) and the ids on for every\n   * workspace (AI) are unioned in regardless — a site switches those off for\n   * itself instead.\n   */\n  enabledPlugins?: string[]\n  seatAddons?: OrgSeatAddons\n  /** Which Aglyn AI tier `seatAddons.aiAddon` is (AGL-3965); see `AglynOrgBilling.aiTier`. */\n  aiTier?: AiTierId | null\n  stripeCustomerId?: string\n  subscription?: OrgSubscription\n  suspendedAt?: ITimestamp | null\n  /** Staff-internal rationale (AGL-202). NEVER shown to the customer. */\n  suspendedReason?: string\n  /**\n   * Lockdown extensions (AGL-1501) on the shipped AGL-202 carrier — the org\n   * scope of the panic button. `suspendedReasonCode` is the enum the notice\n   * copy switches on (`security`/`billing`/`maintenance`/`manual`; absent =\n   * `manual`), `suspendedMessage` is the CUSTOMER-FACING notice body (unlike\n   * `suspendedReason`), and `suspendedUntilMs` is an optional expiry — once\n   * it passes, the suspension is inactive with no write needed (maintenance\n   * windows end on their own). Plain epoch ms, not a Timestamp, so every\n   * cache serialization reads it back unchanged. All written only by\n   * /api/admin/lockdown; normalized by `app-utils/lockdown.ts`.\n   */\n  suspendedReasonCode?: string\n  suspendedMessage?: string\n  suspendedUntilMs?: number\n  /**\n   * Whether that suspension is in force, stored for the staff list's\n   * Suspended filter (AGL-3416). See `AglynOrgBilling.suspended`.\n   */\n  suspended?: boolean\n  erasureRequestedAt?: ITimestamp | null\n  /**\n   * Scope applied to newly created datasets when nobody chooses (AGL-1048). `'org'` — the default\n   * and today's behavior — shares them with every site. `'host'` starts them\n   * private to the site they were created in, which is what an agency\n   * running client sites wants: safe by default rather than safe by\n   * discipline.\n   *\n   * Only meaningful when there IS a site in context. Created from the org\n   * Data page there is no host to scope to, so those stay `'org'` either way.\n   *\n   * New media follows `defaultMediaScope` and new CRM records\n   * `crm.defaultRecordScope` instead; each falls back to this only while it\n   * is unset, because this one field decided all three before AGL-3662.\n   */\n  defaultResourceScope?: 'org' | 'host'\n  /**\n   * The same choice for new uploads and media folders (AGL-3662), set\n   * separately from datasets: an org can keep its rate card on one site\n   * while every site shares its photos. Unset reads `defaultResourceScope`\n   * — see `defaultMediaScopeOf` — which is what every org stored before the\n   * two were split.\n   */\n  defaultMediaScope?: 'org' | 'host'\n  /** The CRM's organization-wide settings (AGL-2613) — see `OrgCrmSettings`. */\n  crm?: OrgCrmSettings\n  /** The plan staff asked the workspace to move to (AGL-3466). */\n  upgradeProposal?: OrgUpgradeProposal\n  /**\n   * When any member last used the console inside this organization —\n   * stamped at creation, then by `/api/orgs/last-activity` at most once per\n   * 15 minutes. Server-owned: the rules deny it to every client write. The\n   * staff Organizations list sorts by it.\n   */\n  lastActivityAt?: ITimestamp\n}\n\n/**\n * `orgs/{orgId}/members/{uid}` — THE authorization doc: rules resolve a\n * request with this single read. Owner/admin span every host; editor and\n * viewer see `hostAccess` (or `allHosts`).\n */\nexport interface AglynOrgMember extends AglynDocument {\n  $id: UserUid\n  role?: OrgRole\n  /**\n   * Custom role reference (AGL-243): id of an `orgs/{orgId}/roles` doc\n   * whose permission map overrides the org role's defaults.\n   */\n  roleId?: string\n  /** Per-member permission overrides (AGL-243); win over every layer. */\n  permissions?: Record<string, boolean>\n  /** Org-wide host access shortcut; otherwise `hostAccess` decides. */\n  allHosts?: boolean\n  hostAccess?: Record<HostUid, HostAccessRole>\n  /**\n   * Per-site permission overrides for a COLLABORATOR (AGL-2927), keyed by\n   * the host the grant is for. Absent keys resolve by the host role's\n   * default, so a document written before this field existed reads the same\n   * as one written after it. Org-wide members are consulted here only on a\n   * site where their access is narrower than their workspace role, and only\n   * for the keys such a site narrows (AGL-4047, `narrowPermissionsToSite`);\n   * everywhere else their org role, custom role and `permissions` map decide.\n   */\n  hostPermissions?: Record<HostUid, Partial<Record<HostPermissionKey, boolean>>>\n  /**\n   * Per key a site can narrow (AGL-4047): `true` follows the site role on a\n   * site where this member's access is narrower than their workspace role,\n   * `false` keeps the permission there. A key it leaves out follows their\n   * custom role's `siteNarrowing`, then the built-in role's default. Read\n   * only for a member who works across the whole workspace.\n   */\n  siteNarrowing?: Partial<Record<string, boolean>>\n  /**\n   * Denormalized reach as scope tokens (AGL-1038), so rules can intersect\n   * it with a resource's `visibleTo` — they cannot derive it from\n   * `hostAccess` because the rules language has no `.map()`. Written only\n   * by `syncOrgAuthProjections`; never edit it by hand.\n   */\n  scopeTokens?: ScopeToken[]\n  /**\n   * Denormalized THREE-LAYER permission verdict, so rules can honor a custom\n   * role they cannot resolve.\n   *\n   * `roleId` points at another document and `permissions` is only the top\n   * layer, so a rule reading either alone answers a different question from\n   * the server — and reproducing the precedence in CEL needs a second\n   * cross-document get() plus correct handling of a dangling id. This is\n   * `resolveOrgPermissions(member, customRole)`, already applied.\n   *\n   * ⚠️ ABSENT IS NOT EMPTY, and the rules must never treat it as either\n   * \"everything allowed\" or \"nothing allowed\". Documents predating this\n   * field, and any written by a path that bypasses\n   * `syncOrgAuthProjections`, carry no map at all; the rules fall back to\n   * the layers they CAN read — the role and the per-member overrides — which\n   * is exactly the verdict they gave before this field existed. Written only\n   * by `syncOrgAuthProjections` and by `createOrganization`'s inline stamp;\n   * never edit it by hand.\n   */\n  resolvedPermissions?: Record<string, boolean>\n  /** Denormalized for member lists without N user lookups. */\n  displayName?: string\n  email?: string\n  invitedBy?: UserUid\n  joinedAt?: ITimestamp\n  /**\n   * Denormalized org suspension flag (AGL-210) so host writes stay a\n   * single rules read; maintained by the staff suspension API.\n   */\n  orgSuspended?: boolean\n  /**\n   * The row belongs to platform staff and takes none of the customer's seats\n   * (AGL-3466).\n   *\n   * Stamped by the server whenever it writes a row for an account that holds\n   * the `staff` claim at that moment — `createOrganization`, `upsertOrgMember`,\n   * `grantHostAccess` — and cleared on every row the account holds when the\n   * claim is revoked. Every seat counter and every seat gate skips a stamped\n   * row, so a staff member who builds a workspace for a prospect, or joins one\n   * to help, never fills the seat the customer is paying for. The rules refuse\n   * client writes to `members`, so nobody can stamp themselves.\n   */\n  staffSeat?: boolean\n}\n\n/**\n * What happens to the outgoing owner when an owner handoff is accepted\n * (AGL-3466): `stay` keeps them on as an admin, `leave` takes them off the\n * roster.\n */\nexport type OwnerHandoffPreviousOwner = 'stay' | 'leave'\n\n/** The handoff half of an owner-handoff invite (AGL-3466). */\nexport interface AglynOrgOwnerHandoff {\n  previousOwner: OwnerHandoffPreviousOwner\n}\n\n/** `orgs/{orgId}/invites/{inviteId}` — pending email invites. */\nexport interface AglynOrgInvite extends AglynDocument {\n  $id: string\n  email?: string\n  /**\n   * `owner` only on an owner-handoff invite, which always carries `handoff`\n   * beside it (AGL-3466). Every other invite is admin, editor or viewer.\n   */\n  role?: OrgRole\n  allHosts?: boolean\n  hostAccess?: Record<HostUid, HostAccessRole>\n  /**\n   * Accepting this invite moves the workspace to the invitee (AGL-3466). It\n   * reserves no seat: the owner seat moves rather than being added, and the\n   * send-time check refuses a `stay` that would need a seat the plan lacks.\n   */\n  handoff?: AglynOrgOwnerHandoff\n  /**\n   * The address belongs to an account holding the `staff` claim, checked when\n   * the invite is sent, so it reserves no seat (AGL-3466). Checked again at\n   * acceptance, against the account that actually accepts.\n   */\n  staffSeat?: boolean\n  invitedBy?: UserUid\n  createdAt?: ITimestamp\n  acceptedAt?: ITimestamp | null\n  acceptedBy?: UserUid\n}\n\n/**\n * `orgSlugs/{slug}` — transactional uniqueness reservation; created and\n * deleted only by the org APIs (Admin SDK), publicly readable so the\n * console can resolve a workspace subdomain client-side.\n */\nexport interface OrgSlugReservation {\n  orgId: OrgUid\n  /**\n   * Set when the previous holder renamed away — the tombstone that keeps old\n   * workspace URLs redirecting until somebody else wants the name.\n   */\n  movedTo?: string\n  /**\n   * Epoch millis at which a PENDING reservation lapses (AGL-2585).\n   *\n   * Present only on a workspace created by an owner whose email was not yet\n   * verified, which is every password signup: the address is held for them,\n   * not granted to them, and the hold ends unless they confirm the address.\n   * Absent means granted, and a grant never expires — so every workspace made\n   * by a verified owner, and every one that predates this field, is outside\n   * the rule entirely.\n   *\n   * Cleared by `reap-unverified-orgs` once the owner verifies. Public, like\n   * the rest of this document, which is why nothing identifying the owner is\n   * written beside it.\n   */\n  reservedUntil?: number\n}\n\n/**\n * `hostIndex/{hostId}` — server-written host → org resolver so the tenant\n * renderer and middleware find a host's org without scanning.\n */\nexport interface HostIndexEntry {\n  orgId: OrgUid\n  subdomain?: string\n}\n\n/**\n * `users/{uid}/orgs/{orgId}` — reverse index for \"my organizations\",\n * maintained transactionally with the member doc by the membership API.\n */\nexport interface UserOrgMembership extends AglynDocument {\n  $id: OrgUid\n  role?: OrgRole\n  orgName?: string\n  slug?: OrgSlug\n  /**\n   * Mirror of `isOrgWideMember(orgs/{orgId}/members/{uid})` (AGL-1032): does\n   * this membership reach the whole org, or only a list of sites?\n   *\n   * `role` alone cannot answer it — `grantHostAccess` writes `role: 'viewer'`\n   * here for a site collaborator, exactly what a genuine org-wide viewer\n   * carries, so the console could not tell them apart without a second read\n   * of the member doc on every org route. Denormalized because the console\n   * navigation guard has to be synchronous: an async answer flashes the org\n   * chrome before hiding it.\n   *\n   * ABSENT means org-wide. Rows predating the mirror carry no flag, and a\n   * missing field must never lock a real member out of their own workspace\n   * (the same legacy shape `isOrgWideMember` handles). Only an explicit\n   * `false` scopes the console — see `isOrgWideMembership`.\n   *\n   * Navigation only. The Firestore rules are the access boundary (AGL-1026);\n   * a stale mirror at worst shows a page whose reads then come back empty.\n   */\n  orgWide?: boolean\n}\n\n/**\n * `users/{uid}/hostMemberships/{hostId}` — reverse index of the sites a user\n * can reach, mirroring `hosts/{hostId}.memberRoles` (AGL-844). Denormalizes the\n * host name so the site switcher and subdomain→id routing query a user's own\n * sites, ordered and name-prefix-searched, without scanning the `hosts`\n * collection. Admin-SDK-maintained beside `memberRoles`; a best-effort\n * convenience index, never an authorization source (the rules still gate host\n * reads on `memberRoles`). NOT named `hosts` — that would collide with the\n * top-level `hosts` collection for collection-group rules/indexes.\n */\nexport interface UserHostMembership extends AglynDocument {\n  $id: HostUid\n  orgId?: OrgUid\n  subdomain?: string\n  displayName?: string\n  nameLower?: string\n  /**\n   * Mirror of the host's `seo.favicon` (AGL-1071). The site switcher renders\n   * from this projection rather than the host doc, so without the mirror it\n   * showed the generic glyph for every site — the favicon feature worked in\n   * the sites list and nowhere else. Absent when the site has none; writers\n   * must DELETE it on clear rather than omit it, since the rows are written\n   * with `{ merge: true }` and an omitted field would keep the old icon.\n   */\n  favicon?: string\n  role?: HostAccessRole\n  updatedAt?: ITimestamp\n}\n"],"names":["HOST_ACCESS_ROLE_KEYS","admin","editor","author","viewer","HOST_ACCESS_ROLES","Object","keys"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GA8DD;;;;;;;;;;;;CAYC,GACD,MAAMA,wBAAsD;IAC1DC,OAAO;IACPC,QAAQ;IACRC,QAAQ;IACRC,QAAQ;AACV;AACA,OAAO,MAAMC,oBAAoBC,OAAOC,IAAI,CAC1CP,uBACmB"}

package/src/lib/plugin-manager/first-party-plugins.generated.js

@@ -567,7 +567,13 @@ export const PUBLISHED_SITE_IMPACT = {
                 "relatedProductIds",
                 "giftCard",
                 "lowStockThreshold",
+                "modifierGroups",
+                "posQuickKey",
                 "sellOnline",
+                "inStoreReviews",
+                "offerOnKiosk",
+                "hardwareSku",
+                "checkIn",
                 "shipping",
                 "createdAtMs",
                 "updatedAtMs",
@@ -1167,6 +1173,12 @@ export const PUBLISHED_SITE_IMPACT = {
             }
         }
     },
+    {
+        "pluginId": "waivers",
+        "name": "waiverTitles",
+        "mediaScan": "none",
+        "mediaScanReason": "Each waiver's title, status, version and last change, mirrored from the org's waivers by the waivers routes (AGL-4042) so the Besigner's Sign waiver element can pick one. No content field: a waiver's words stay in the org's waivers, and nothing here can name a library asset."
+    },
     {
         "pluginId": "sales-channels",
         "name": "salesChannels",
@@ -1954,6 +1966,23 @@ export const PUBLISHED_SITE_IMPACT = {
         "singular": "dataset",
         "plural": "datasets",
         "page": "the Data page"
+    },
+    {
+        "pluginId": "waivers",
+        "kind": "waivers",
+        "attribute": "waiver-select",
+        "scope": "host",
+        "collection": "waiverTitles",
+        "nameField": "title",
+        "where": [
+            {
+                "field": "pickable",
+                "equals": true
+            }
+        ],
+        "singular": "waiver",
+        "plural": "waivers",
+        "page": "the Waivers page"
     }
 ];
 /**
@@ -2354,6 +2383,16 @@ export const PUBLISHED_SITE_IMPACT = {
  * Every top-level plugin collection a workspace erasure sweeps by the field
  * naming the organization, declared by the plugin that owns it (AGL-3080).
  */ export const PLUGIN_ORG_KEYED_COLLECTIONS = [
+    {
+        "pluginId": "commerce",
+        "name": "posCellularReaders",
+        "orgField": "orgId"
+    },
+    {
+        "pluginId": "commerce",
+        "name": "posCellularCharges",
+        "orgField": "orgId"
+    },
     {
         "pluginId": "outreach",
         "name": "outreachMailboxCredentials",