@aglyn/plugins-commerce 1.0.0-beta.199 → 1.0.0-beta.201

package/src/lib/server/billing-webhook.js

@@ -25,9 +25,12 @@ import { recordContactRefund } from "./contact-refund.js";
 // specs in this library mock `@aglyn/tenant-data-admin` wholesale, and a
 // permissive stub would turn a reversal that never happened green.
 import { reverseEmailAttributedRevenue } from "@aglyn/tenant-data-admin/server/email-revenue-attribution";
+import { paymentRiskEventFrom } from "@aglyn/aglyn/app-utils/payment-risk";
+import { recordPaymentRiskOnRecord } from "@aglyn/tenant-data-admin/server/payment-risk-record";
 import { mintDownloadToken, tokenSigningSecret } from "./download.js";
 import { alertLowStockCrossing } from "./low-stock.js";
 import { decrementVariantStock } from "./reserve-stock.js";
+import { giftCardSearchTokens } from "../model/gift-card-search.js";
 import { releaseStockHold } from "./stock-hold.js";
 import { releasePromotionHold, settlePromotionSlot } from "./promotion-hold.js";
 import { flagOrderRestock } from "./restock-flag.js";
@@ -326,7 +329,7 @@ async function findOrderForDispute(paymentIntentId) {
  */ async function recordDisputeOpened(snapshot, dispute) {
     const record = disputeFromEvent(dispute);
     const opened = await firebaseAdmin.app().firestore().runTransaction(async (transaction)=>{
-        var _fresh_data;
+        var _fresh_data, _fresh_data1;
         var _order_dispute;
         const fresh = await transaction.get(snapshot.ref);
         if (!fresh.exists) return false;
@@ -347,10 +350,12 @@ async function findOrderForDispute(paymentIntentId) {
         // the same charge and does replace it.
         if (((_order_dispute = order.dispute) == null ? void 0 : _order_dispute.id) === record.id) return false;
         const amount = `$${(record.amountCents / 100).toFixed(2)}`;
-        transaction.update(snapshot.ref, {
+        transaction.update(snapshot.ref, _extends({}, CommerceModel.orderListFields(_extends({}, (_fresh_data1 = fresh.data()) != null ? _fresh_data1 : {}, {
+            dispute: record
+        }), snapshot.id), {
             dispute: record,
             timeline: CommerceModel.appendOrderEvent(order, 'dispute', `Chargeback opened for ${amount}` + (record.reason ? ` (${record.reason.replace(/_/g, ' ')})` : '') + (record.evidenceDueByMs ? ` — evidence due ${new Date(record.evidenceDueByMs).toISOString().slice(0, 10)}` : ''), record.openedAtMs)
-        });
+        }));
         return true;
     });
     return {
@@ -407,7 +412,7 @@ async function findOrderForDispute(paymentIntentId) {
     const outcome = String((_ref = dispute == null ? void 0 : dispute.status) != null ? _ref : '');
     const lost = outcome === 'lost';
     return firebaseAdmin.app().firestore().runTransaction(async (transaction)=>{
-        var _fresh_data, _ref, _order_amountCents, _order_refundedCents;
+        var _fresh_data, _ref, _order_amountCents, _order_refundedCents, _fresh_data1;
         var _order_totals;
         const idle = {
             recorded: false,
@@ -430,19 +435,24 @@ async function findOrderForDispute(paymentIntentId) {
         const closedTheOrder = fullyReversed && CommerceModel.canTransitionOrder(order.status, 'refunded');
         const closedAtMs = Date.now();
         const amount = `$${(reversedCents / 100).toFixed(2)}`;
-        transaction.update(snapshot.ref, _extends({}, reversedCents > 0 ? {
+        const settled = _extends({}, event, (stored == null ? void 0 : stored.id) === event.id && stored.openedAtMs ? {
+            openedAtMs: stored.openedAtMs
+        } : {}, {
+            status: outcome,
+            outcome,
+            closedAtMs,
+            reversedCents
+        });
+        transaction.update(snapshot.ref, _extends({}, CommerceModel.orderListFields(_extends({}, (_fresh_data1 = fresh.data()) != null ? _fresh_data1 : {}, closedTheOrder ? {
+            status: 'refunded'
+        } : {}, {
+            dispute: settled
+        }), snapshot.id), reversedCents > 0 ? {
             refundedCents: reversedTotal
         } : {}, closedTheOrder ? {
             status: 'refunded'
         } : {}, {
-            dispute: _extends({}, event, (stored == null ? void 0 : stored.id) === event.id && stored.openedAtMs ? {
-                openedAtMs: stored.openedAtMs
-            } : {}, {
-                status: outcome,
-                outcome,
-                closedAtMs,
-                reversedCents
-            }),
+            dispute: settled,
             timeline: CommerceModel.appendOrderEvent(order, 'dispute', lost ? `${amount} charged back (dispute lost)` + (closedTheOrder ? ' (full)' : '') : `Dispute ${outcome.replace(/_/g, ' ')} — no money reversed`, closedAtMs)
         }));
         return {
@@ -1394,7 +1404,7 @@ async function findOrderForDispute(paymentIntentId) {
    * this far. A notification is not idempotent by any doc key of its own.
    */ const settle = async (reversedTransferCents, transferReversalId, note)=>{
         return firebaseAdmin.app().firestore().runTransaction(async (transaction)=>{
-            var _fresh_data;
+            var _fresh_data, _fresh_data1;
             const fresh = await transaction.get(orderRef);
             if (!fresh.exists) return false;
             const current = CommerceModel.liftLegacyOrder((_fresh_data = fresh.data()) != null ? _fresh_data : {});
@@ -1402,15 +1412,18 @@ async function findOrderForDispute(paymentIntentId) {
             if ((record == null ? void 0 : record.id) !== disputeId || record.reversedTransferCents != null) {
                 return false;
             }
-            transaction.update(orderRef, {
-                // Written whole, the field's own rule — see `OrderDispute`.
-                dispute: _extends({}, record, {
-                    reversedTransferCents
-                }, transferReversalId ? {
-                    transferReversalId
-                } : {}),
+            // Written whole, the field's own rule — see `OrderDispute`.
+            const dispute = _extends({}, record, {
+                reversedTransferCents
+            }, transferReversalId ? {
+                transferReversalId
+            } : {});
+            transaction.update(orderRef, _extends({}, CommerceModel.orderListFields(_extends({}, (_fresh_data1 = fresh.data()) != null ? _fresh_data1 : {}, {
+                dispute
+            }), orderRef.id), {
+                dispute,
                 timeline: CommerceModel.appendOrderEvent(current, 'dispute', note)
-            });
+            }));
             return true;
         });
     };
@@ -2215,7 +2228,8 @@ async function findOrderForDispute(paymentIntentId) {
                     }, {
                         merge: true
                     });
-                    transaction.set(orderRef, _extends({
+                    // With the fields the orders list queries by (AGL-3321).
+                    transaction.set(orderRef, CommerceModel.withOrderListFields(orderRef.id, _extends({
                         number: orderNumber,
                         status: 'paid',
                         channel: 'subscription',
@@ -2256,7 +2270,7 @@ async function findOrderForDispute(paymentIntentId) {
                         feeCents: Number((_invoiceTotals_feeCents = invoiceTotals.feeCents) != null ? _invoiceTotals_feeCents : 0),
                         createdAtMs: paidAtMs,
                         createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
-                    }));
+                    })));
                 }
                 return true;
             });
@@ -2579,7 +2593,10 @@ async function findOrderForDispute(paymentIntentId) {
                         fromName: (await brandFor(hostId)).fromName,
                         sendingIdentity: await hostSendingIdentity(String(hostId)),
                         audience: 'tenant',
-                        context: 'reservation confirmation'
+                        context: 'reservation confirmation',
+                        // Owed to the recipient by their own booking: the phishing
+                        // screen's soft rules never hold it (AGL-3356).
+                        owedFor: 'booking'
                     }));
                     // Cost meter (AGL-1438). Transactional: the guest has paid, and a
                     // confirmation a quota refused reads as a failed reservation.
@@ -2681,7 +2698,8 @@ async function findOrderForDispute(paymentIntentId) {
                 const totals = CommerceModel.computeCheckoutSessionTotals(lineItems, object, {
                     feeCents: Number(feeCents != null ? feeCents : 0)
                 });
-                transaction.set(orderRef, _extends({
+                // With the fields the orders list queries by (AGL-3321).
+                transaction.set(orderRef, CommerceModel.withOrderListFields(orderRef.id, _extends({
                     number,
                     status: 'paid',
                     channel: 'online',
@@ -2735,7 +2753,7 @@ async function findOrderForDispute(paymentIntentId) {
                     feeCents: Number(feeCents != null ? feeCents : 0),
                     createdAtMs: Date.now(),
                     createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
-                }));
+                })));
                 return true;
             });
             // Redelivery/replay guard (AGL-498): only fulfil when the order was
@@ -2855,7 +2873,10 @@ async function findOrderForDispute(paymentIntentId) {
                     fromName: (await brandFor(hostId)).fromName,
                     sendingIdentity: await hostSendingIdentity(String(hostId)),
                     audience: 'tenant',
-                    context: 'cart receipt'
+                    context: 'cart receipt',
+                    // Owed to the recipient by their own order: the phishing
+                    // screen's soft rules never hold it (AGL-3356).
+                    owedFor: 'order'
                 }));
                 // Cost meter (AGL-1438). Transactional: a dropped receipt looks to
                 // the buyer like an order that did not go through.
@@ -3042,8 +3063,8 @@ async function findOrderForDispute(paymentIntentId) {
                 const lineProduct = productsById.get(line.productId);
                 if (!(lineProduct == null ? void 0 : lineProduct.giftCard)) continue;
                 for(let unit = 0; unit < line.quantity; unit += 1){
-                    var _ref53;
-                    var _object_customer_details12, _object_customer_details13;
+                    var _ref53, _ref54;
+                    var _object_customer_details12, _object_customer_details13, _object_customer_details14;
                     const code = `GC-${createHmac('sha256', String(object.id)).update(`${line.productId}:${unit}:${Date.now()}`).digest('hex').slice(0, 12).toUpperCase()}`;
                     // THE EMAIL IS GATED ON THE WRITE (AGL-2161). This `.set()` used
                     // to `.catch(() => undefined)` and fall straight through to the
@@ -3063,6 +3084,8 @@ async function findOrderForDispute(paymentIntentId) {
                         balanceCents: line.unitAmountCents,
                         recipientEmail: (_ref53 = object == null ? void 0 : (_object_customer_details12 = object.customer_details) == null ? void 0 : _object_customer_details12.email) != null ? _ref53 : null,
                         orderId: String(object.id),
+                        // What the console's Gift cards search asks (AGL-3321).
+                        searchTokens: giftCardSearchTokens(code, (_ref54 = object == null ? void 0 : (_object_customer_details13 = object.customer_details) == null ? void 0 : _object_customer_details13.email) != null ? _ref54 : null),
                         createdAtMs: Date.now()
                     }).then(()=>true).catch((error)=>{
                         console.error('Gift card issuance failed', hostId, code, error);
@@ -3088,9 +3111,9 @@ async function findOrderForDispute(paymentIntentId) {
                         });
                         continue;
                     }
-                    const giftTo = object == null ? void 0 : (_object_customer_details13 = object.customer_details) == null ? void 0 : _object_customer_details13.email;
+                    const giftTo = object == null ? void 0 : (_object_customer_details14 = object.customer_details) == null ? void 0 : _object_customer_details14.email;
                     if (giftTo) {
-                        var _ref54;
+                        var _ref55;
                         const giftValue = `$${(line.unitAmountCents / 100).toFixed(2)}`;
                         const fallbackText = `Gift card code: ${code}\n` + `Value: ${giftValue}\n\n` + 'Enter it at checkout to apply the balance.';
                         // Site-owner-designed template when published (AGL-771).
@@ -3100,7 +3123,7 @@ async function findOrderForDispute(paymentIntentId) {
                         });
                         await sendEmail(_extends({
                             to: giftTo,
-                            subject: (_ref54 = designed == null ? void 0 : designed.subject) != null ? _ref54 : 'Your gift card',
+                            subject: (_ref55 = designed == null ? void 0 : designed.subject) != null ? _ref55 : 'Your gift card',
                             text: (designed == null ? void 0 : designed.text) || fallbackText
                         }, (designed == null ? void 0 : designed.html) ? {
                             html: designed.html
@@ -3108,7 +3131,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'gift card'
+                            context: 'gift card',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         }));
                         // Cost meter (AGL-1438). Transactional: this email IS the
                         // purchased goods.
@@ -3118,12 +3144,12 @@ async function findOrderForDispute(paymentIntentId) {
             }
             // Discounts engine redemptions (AGL-305).
             if ((_object_metadata22 = object.metadata) == null ? void 0 : _object_metadata22.discountId) {
-                var _ref55;
+                var _ref56;
                 var _object_metadata26;
                 await settleRedemption({
                     firestore,
                     ref: hostRef.collection('discounts').doc(String(object.metadata.discountId)),
-                    holdKey: String((_ref55 = (_object_metadata26 = object.metadata) == null ? void 0 : _object_metadata26.discountHoldKey) != null ? _ref55 : ''),
+                    holdKey: String((_ref56 = (_object_metadata26 = object.metadata) == null ? void 0 : _object_metadata26.discountHoldKey) != null ? _ref56 : ''),
                     orderRef,
                     label: `discount ${object.metadata.discountId}`,
                     detail: `Discount ${object.metadata.discountId} was applied to this ` + 'order but no longer exists, so the redemption is uncounted ' + 'against its limit.'
@@ -3137,7 +3163,7 @@ async function findOrderForDispute(paymentIntentId) {
         var _object_metadata27;
         const { hostId, orderId, productId } = (_object_metadata27 = object.metadata) != null ? _object_metadata27 : {};
         if (hostId && orderId) {
-            var _ref56, _ref57, _ref58;
+            var _ref57, _ref58, _ref59;
             var _object_total_details, _object_total_details1;
             const firestore = firebaseAdmin.app().firestore();
             const hostRef = firestore.collection('hosts').doc(String(hostId));
@@ -3176,7 +3202,7 @@ async function findOrderForDispute(paymentIntentId) {
             //
             // The whole map is written rather than one field of it, so a
             // `merge`-set's nested-map merge and a plain replace agree.
-            const shippingCents = Math.max(0, Math.round(Number((_ref56 = object == null ? void 0 : (_object_total_details = object.total_details) == null ? void 0 : _object_total_details.amount_shipping) != null ? _ref56 : 0) || 0));
+            const shippingCents = Math.max(0, Math.round(Number((_ref57 = object == null ? void 0 : (_object_total_details = object.total_details) == null ? void 0 : _object_total_details.amount_shipping) != null ? _ref57 : 0) || 0));
             // Tax joins shipping in the fold (AGL-1953). `draft-order.ts` now
             // declares tax — a Stripe Tax Rate for a `manual` store, whose figure
             // it already froze into `totals`, or `automatic_tax` for a `stripe`
@@ -3189,8 +3215,8 @@ async function findOrderForDispute(paymentIntentId) {
             // `amount_tax` 0 here (its own figure stays on the order, and its
             // AGL-1953 witness is metadata, not this field), and a draft composed
             // by a store with no tax reports 0 too.
-            const stripeTaxCents = Math.max(0, Math.round(Number((_ref57 = object == null ? void 0 : (_object_total_details1 = object.total_details) == null ? void 0 : _object_total_details1.amount_tax) != null ? _ref57 : 0) || 0));
-            const chargedTotalCents = Number((_ref58 = object == null ? void 0 : object.amount_total) != null ? _ref58 : NaN);
+            const stripeTaxCents = Math.max(0, Math.round(Number((_ref58 = object == null ? void 0 : (_object_total_details1 = object.total_details) == null ? void 0 : _object_total_details1.amount_tax) != null ? _ref58 : 0) || 0));
+            const chargedTotalCents = Number((_ref59 = object == null ? void 0 : object.amount_total) != null ? _ref59 : NaN);
             // `shipping_details` ONLY, unlike the cart branch's
             // `?? customer_details` fallback: that address is the BILLING one, and
             // a card sale rung up at a register completes here too — it must not
@@ -3203,8 +3229,8 @@ async function findOrderForDispute(paymentIntentId) {
             // the transaction commits.
             let paidAfterCancel = false;
             const flipped = await firestore.runTransaction(async (transaction)=>{
-                var _snapshot_data, _ref, _ref1, _ref2, _ref3, _lifted_totals, _ref4, _shipTo_name, _shipTo_address_line1, _shipTo_address_line2, _shipTo_address_city, _shipTo_address_state, _shipTo_address_postal_code, _shipTo_address_country;
-                var _object_metadata, _object_customer_details, _lifted_totals1;
+                var _snapshot_data, _snapshot_data1, _ref, _ref1, _ref2, _ref3, _ref4, _ref5, _lifted_totals, _ref6, _shipTo_name, _shipTo_address_line1, _shipTo_address_line2, _shipTo_address_city, _shipTo_address_state, _shipTo_address_postal_code, _shipTo_address_country;
+                var _object_customer_details, _object_metadata, _object_customer_details1, _lifted_totals1;
                 const snapshot = await transaction.get(orderRef);
                 if (!snapshot.exists) return false;
                 const lifted = CommerceModel.liftLegacyOrder((_snapshot_data = snapshot.data()) != null ? _snapshot_data : {});
@@ -3241,7 +3267,10 @@ async function findOrderForDispute(paymentIntentId) {
                     return false;
                 }
                 paidOrder = lifted;
-                transaction.set(orderRef, _extends({
+                transaction.set(orderRef, _extends({}, CommerceModel.orderListFields(_extends({}, (_snapshot_data1 = snapshot.data()) != null ? _snapshot_data1 : {}, {
+                    status: 'paid',
+                    customerEmail: (_ref = (_ref1 = object == null ? void 0 : (_object_customer_details = object.customer_details) == null ? void 0 : _object_customer_details.email) != null ? _ref1 : lifted.customerEmail) != null ? _ref : null
+                }), orderRef.id), {
                     status: 'paid',
                     // WHICH TAX THIS ORDER CARRIED (AGL-2451), resolved from the
                     // session that actually charged it rather than from the draft's
@@ -3258,9 +3287,9 @@ async function findOrderForDispute(paymentIntentId) {
                     // record that any of the charge was tax (AGL-1953). Without it
                     // every register card sale would stamp `none` beside an order
                     // plainly carrying tax.
-                    taxMode: storefrontTaxModeOf(object, Number((_ref = object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.taxCents) != null ? _ref : 0)),
-                    paymentIntentId: String((_ref1 = object == null ? void 0 : object.payment_intent) != null ? _ref1 : '') || null,
-                    customerEmail: (_ref2 = (_ref3 = object == null ? void 0 : (_object_customer_details = object.customer_details) == null ? void 0 : _object_customer_details.email) != null ? _ref3 : lifted.customerEmail) != null ? _ref2 : null,
+                    taxMode: storefrontTaxModeOf(object, Number((_ref2 = object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.taxCents) != null ? _ref2 : 0)),
+                    paymentIntentId: String((_ref3 = object == null ? void 0 : object.payment_intent) != null ? _ref3 : '') || null,
+                    customerEmail: (_ref4 = (_ref5 = object == null ? void 0 : (_object_customer_details1 = object.customer_details) == null ? void 0 : _object_customer_details1.email) != null ? _ref5 : lifted.customerEmail) != null ? _ref4 : null,
                     timeline: CommerceModel.appendOrderEvent(lifted, 'paid')
                 }, shippingCents > 0 || stripeTaxCents > 0 ? {
                     totals: _extends({}, (_lifted_totals = lifted.totals) != null ? _lifted_totals : {}, shippingCents > 0 ? {
@@ -3271,7 +3300,7 @@ async function findOrderForDispute(paymentIntentId) {
                         // Stripe's own figure, for the AGL-1698 reason: the
                         // frozen total is what the draft was priced at, and only
                         // `amount_total` is the money that moved.
-                        totalCents: Number.isFinite(chargedTotalCents) ? chargedTotalCents : Number((_ref4 = (_lifted_totals1 = lifted.totals) == null ? void 0 : _lifted_totals1.totalCents) != null ? _ref4 : 0) + shippingCents
+                        totalCents: Number.isFinite(chargedTotalCents) ? chargedTotalCents : Number((_ref6 = (_lifted_totals1 = lifted.totals) == null ? void 0 : _lifted_totals1.totalCents) != null ? _ref6 : 0) + shippingCents
                     })
                 } : {}, (shipTo == null ? void 0 : shipTo.address) ? {
                     shippingAddress: {
@@ -3301,8 +3330,8 @@ async function findOrderForDispute(paymentIntentId) {
                 });
             }
             if (flipped) {
-                var _ref59, _ref60;
-                var _object_metadata28, _object_customer_details14;
+                var _ref60, _ref61;
+                var _object_metadata28, _object_customer_details15;
                 const order = paidOrder;
                 // Discounts engine redemptions (AGL-305), for this branch's BOTH
                 // tenants: a console draft order and a POS card sale, which carry the
@@ -3317,12 +3346,12 @@ async function findOrderForDispute(paymentIntentId) {
                 // the hold existed, which Stripe's at-least-once delivery would run
                 // twice. The transition is what makes it once.
                 if ((_object_metadata28 = object.metadata) == null ? void 0 : _object_metadata28.discountId) {
-                    var _ref61;
+                    var _ref62;
                     var _object_metadata29;
                     await settleRedemption({
                         firestore,
                         ref: hostRef.collection('discounts').doc(String(object.metadata.discountId)),
-                        holdKey: String((_ref61 = (_object_metadata29 = object.metadata) == null ? void 0 : _object_metadata29.discountHoldKey) != null ? _ref61 : ''),
+                        holdKey: String((_ref62 = (_object_metadata29 = object.metadata) == null ? void 0 : _object_metadata29.discountHoldKey) != null ? _ref62 : ''),
                         orderRef,
                         label: `discount ${object.metadata.discountId}`,
                         detail: `Discount ${object.metadata.discountId} was applied to this ` + 'order but no longer exists, so the redemption is uncounted ' + 'against its limit.'
@@ -3345,15 +3374,15 @@ async function findOrderForDispute(paymentIntentId) {
                 // figure the draft was priced at, and the two agree by construction,
                 // but only one of them is the money that moved. Stored totals remain
                 // the fallback for a session shape that reports no total.
-                const draftEmail = (_ref59 = (_ref60 = object == null ? void 0 : (_object_customer_details14 = object.customer_details) == null ? void 0 : _object_customer_details14.email) != null ? _ref60 : order.customerEmail) != null ? _ref59 : null;
+                const draftEmail = (_ref60 = (_ref61 = object == null ? void 0 : (_object_customer_details15 = object.customer_details) == null ? void 0 : _object_customer_details15.email) != null ? _ref61 : order.customerEmail) != null ? _ref60 : null;
                 if (draftEmail) {
-                    var _ref62, _ref63, _ref64;
-                    var _order_totals, _object_customer_details15;
-                    const chargedCents = Number((_ref62 = object == null ? void 0 : object.amount_total) != null ? _ref62 : 0) || Number((_ref63 = (_order_totals = order.totals) == null ? void 0 : _order_totals.totalCents) != null ? _ref63 : 0);
+                    var _ref63, _ref64, _ref65;
+                    var _order_totals, _object_customer_details16;
+                    const chargedCents = Number((_ref63 = object == null ? void 0 : object.amount_total) != null ? _ref63 : 0) || Number((_ref64 = (_order_totals = order.totals) == null ? void 0 : _order_totals.totalCents) != null ? _ref64 : 0);
                     await captureHostContact(_extends({
                         hostId: String(hostId),
                         email: draftEmail,
-                        name: (_ref64 = object == null ? void 0 : (_object_customer_details15 = object.customer_details) == null ? void 0 : _object_customer_details15.name) != null ? _ref64 : undefined,
+                        name: (_ref65 = object == null ? void 0 : (_object_customer_details16 = object.customer_details) == null ? void 0 : _object_customer_details16.name) != null ? _ref65 : undefined,
                         source: 'order',
                         initialLifecycleStage: 'customer'
                     }, chargedCents > 0 ? {
@@ -3366,15 +3395,15 @@ async function findOrderForDispute(paymentIntentId) {
                     }));
                 }
                 if (productId) {
-                    var _productSnapshot_data, _ref65, _ref66;
+                    var _productSnapshot_data, _ref66, _ref67;
                     var _object_metadata30, _lifted_variants_, _order_lineItems_, _order_lineItems;
                     const productRef = hostRef.collection('products').doc(String(productId));
                     const productSnapshot = await productRef.get();
                     const lifted = CommerceModel.liftLegacyProduct((_productSnapshot_data = productSnapshot.data()) != null ? _productSnapshot_data : {
                         name: 'Product'
                     });
-                    const soldVariantId = String((_ref65 = (_object_metadata30 = object.metadata) == null ? void 0 : _object_metadata30.variantId) != null ? _ref65 : '') || ((_lifted_variants_ = lifted.variants[0]) == null ? void 0 : _lifted_variants_.id);
-                    const quantity = (_ref66 = (_order_lineItems = order.lineItems) == null ? void 0 : (_order_lineItems_ = _order_lineItems[0]) == null ? void 0 : _order_lineItems_.quantity) != null ? _ref66 : 1;
+                    const soldVariantId = String((_ref66 = (_object_metadata30 = object.metadata) == null ? void 0 : _object_metadata30.variantId) != null ? _ref66 : '') || ((_lifted_variants_ = lifted.variants[0]) == null ? void 0 : _lifted_variants_.id);
+                    const quantity = (_ref67 = (_order_lineItems = order.lineItems) == null ? void 0 : (_order_lineItems_ = _order_lineItems[0]) == null ? void 0 : _order_lineItems_.quantity) != null ? _ref67 : 1;
                     if (soldVariantId) {
                         // Atomic since AGL-2320.
                         const moved = await decrementVariantStock({
@@ -3426,10 +3455,10 @@ async function findOrderForDispute(paymentIntentId) {
                     // would decrement it twice.
                     const paidProducts = new Map();
                     for (const line of (_order_lineItems1 = order.lineItems) != null ? _order_lineItems1 : []){
-                        var _ref67, _ref68, _line_variantId1;
+                        var _ref68, _ref69, _line_variantId1;
                         var _lineProduct_variants_;
-                        const lineProductId = String((_ref67 = line == null ? void 0 : line.productId) != null ? _ref67 : '');
-                        const soldQty = Math.round(Number((_ref68 = line == null ? void 0 : line.quantity) != null ? _ref68 : 0));
+                        const lineProductId = String((_ref68 = line == null ? void 0 : line.productId) != null ? _ref68 : '');
+                        const soldQty = Math.round(Number((_ref69 = line == null ? void 0 : line.quantity) != null ? _ref69 : 0));
                         if (!lineProductId || !(soldQty > 0)) continue;
                         // Firestore reserves `__…__` ids and `.doc()` throws
                         // synchronously on one; a corrupt line must not fail the
@@ -3492,8 +3521,8 @@ async function findOrderForDispute(paymentIntentId) {
         var _object_metadata31;
         const { hostId, productId, feeCents, couponCode } = (_object_metadata31 = object.metadata) != null ? _object_metadata31 : {};
         if (hostId && productId) {
-            var _ref69, _productForSnapshot_get1, _productForSnapshot_data1, _ref70, _ref71, _ref72, _ref73, _ref74, _ref75, _ref76;
-            var _object_metadata32, _buyNowLineItems_, _object_customer_details16, _object_customer_details17, _object_customer_details18, _object_metadata33;
+            var _ref70, _productForSnapshot_get1, _productForSnapshot_data1, _ref71, _ref72, _ref73, _ref74, _ref75, _ref76, _ref77;
+            var _object_metadata32, _buyNowLineItems_, _object_customer_details17, _object_customer_details18, _object_customer_details19, _object_metadata33;
             const firestore = firebaseAdmin.app().firestore();
             const hostRef = firestore.collection('hosts').doc(String(hostId));
             // Orders v1 (AGL-283): line-item snapshot + totals + timeline with
@@ -3503,7 +3532,7 @@ async function findOrderForDispute(paymentIntentId) {
             // is bounded to Stripe's at-least-once edge).
             const orderRef = hostRef.collection('orders').doc(String(object.id));
             const counterRef = hostRef.collection('counters').doc('orders');
-            const amountCents = Number((_ref69 = object == null ? void 0 : object.amount_total) != null ? _ref69 : 0);
+            const amountCents = Number((_ref70 = object == null ? void 0 : object.amount_total) != null ? _ref70 : 0);
             const productForSnapshot = await hostRef.collection('products').doc(String(productId)).get();
             const snapshotName = String((_productForSnapshot_get1 = productForSnapshot.get('name')) != null ? _productForSnapshot_get1 : 'Product');
             // AGL-1711: the line item and totals used to be fabricated from
@@ -3516,7 +3545,7 @@ async function findOrderForDispute(paymentIntentId) {
                 name: snapshotName
             });
             const soldVariant = ((_object_metadata32 = object.metadata) == null ? void 0 : _object_metadata32.variantId) ? liftedForSnapshot.variants.find((item)=>item.id === String(object.metadata.variantId)) : liftedForSnapshot.variants[0];
-            const variantOptions = Object.values((_ref70 = soldVariant == null ? void 0 : soldVariant.options) != null ? _ref70 : {});
+            const variantOptions = Object.values((_ref71 = soldVariant == null ? void 0 : soldVariant.options) != null ? _ref71 : {});
             const { lineItems: buyNowLineItems, totals: buyNowTotals } = CommerceModel.computeBuyNowOrder(object, _extends({
                 name: snapshotName
             }, variantOptions.length ? {
@@ -3528,7 +3557,7 @@ async function findOrderForDispute(paymentIntentId) {
             } : {}, liftedForSnapshot.supplierId ? {
                 supplierId: liftedForSnapshot.supplierId
             } : {}));
-            const soldQuantity = (_ref71 = (_buyNowLineItems_ = buyNowLineItems[0]) == null ? void 0 : _buyNowLineItems_.quantity) != null ? _ref71 : 1;
+            const soldQuantity = (_ref72 = (_buyNowLineItems_ = buyNowLineItems[0]) == null ? void 0 : _buyNowLineItems_.quantity) != null ? _ref72 : 1;
             const created = await firestore.runTransaction(async (transaction)=>{
                 var _counter_get, _ref, _ref1, _ref2, _ref3;
                 var _object_metadata, _object_customer_details, _object_customer_details1;
@@ -3543,7 +3572,8 @@ async function findOrderForDispute(paymentIntentId) {
                 }, {
                     merge: true
                 });
-                transaction.set(orderRef, _extends({
+                // With the fields the orders list queries by (AGL-3321).
+                transaction.set(orderRef, CommerceModel.withOrderListFields(orderRef.id, _extends({
                     number,
                     status: 'paid',
                     channel: 'online',
@@ -3577,7 +3607,7 @@ async function findOrderForDispute(paymentIntentId) {
                     couponCode
                 } : {}, {
                     createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
-                }));
+                })));
                 return true;
             });
             // Redelivery guard (AGL-498): skip the notification + fulfilment side
@@ -3587,8 +3617,8 @@ async function findOrderForDispute(paymentIntentId) {
             // in the bell, not just the owner's email.
             void notifyHostManagers(String(hostId), _extends({
                 type: 'content.order',
-                title: `New order — $${(Number((_ref72 = object == null ? void 0 : object.amount_total) != null ? _ref72 : 0) / 100).toFixed(2)}`
-            }, (object == null ? void 0 : (_object_customer_details16 = object.customer_details) == null ? void 0 : _object_customer_details16.email) ? {
+                title: `New order — $${(Number((_ref73 = object == null ? void 0 : object.amount_total) != null ? _ref73 : 0) / 100).toFixed(2)}`
+            }, (object == null ? void 0 : (_object_customer_details17 = object.customer_details) == null ? void 0 : _object_customer_details17.email) ? {
                 body: `From ${object.customer_details.email}`
             } : {}, {
                 link: `/${hostId}/products`
@@ -3679,7 +3709,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'dropship supplier notice'
+                            context: 'dropship supplier notice',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         });
                         // Cost meter (AGL-1438). Transactional: without it the order is
                         // never fulfilled.
@@ -3692,14 +3725,14 @@ async function findOrderForDispute(paymentIntentId) {
             // Contacts ingestion (AGL-197): buyers become contacts.
             await captureHostContact({
                 hostId: String(hostId),
-                email: object == null ? void 0 : (_object_customer_details17 = object.customer_details) == null ? void 0 : _object_customer_details17.email,
-                name: (_ref73 = object == null ? void 0 : (_object_customer_details18 = object.customer_details) == null ? void 0 : _object_customer_details18.name) != null ? _ref73 : undefined,
+                email: object == null ? void 0 : (_object_customer_details18 = object.customer_details) == null ? void 0 : _object_customer_details18.email,
+                name: (_ref74 = object == null ? void 0 : (_object_customer_details19 = object.customer_details) == null ? void 0 : _object_customer_details19.name) != null ? _ref74 : undefined,
                 source: 'order',
                 initialLifecycleStage: 'customer',
-                purchaseCents: Number((_ref74 = object == null ? void 0 : object.amount_total) != null ? _ref74 : 0),
+                purchaseCents: Number((_ref75 = object == null ? void 0 : object.amount_total) != null ? _ref75 : 0),
                 interaction: {
                     refId: String(object.id),
-                    summary: `Placed an order ($${(Number((_ref75 = object == null ? void 0 : object.amount_total) != null ? _ref75 : 0) / 100).toFixed(2)})`
+                    summary: `Placed an order ($${(Number((_ref76 = object == null ? void 0 : object.amount_total) != null ? _ref76 : 0) / 100).toFixed(2)})`
                 }
             });
             const productRef = hostRef.collection('products').doc(String(productId));
@@ -3717,12 +3750,12 @@ async function findOrderForDispute(paymentIntentId) {
             // serialize; the snapshot above is still read, for the product NAME on
             // the receipt below, and no longer decides any count.
             {
-                var _productSnapshot_data2, _ref77;
+                var _productSnapshot_data2, _ref78;
                 var _object_metadata34, _lifted_variants_1;
                 const lifted = CommerceModel.liftLegacyProduct((_productSnapshot_data2 = productSnapshot.data()) != null ? _productSnapshot_data2 : {
                     name: 'Product'
                 });
-                const soldVariantId = String((_ref77 = (_object_metadata34 = object.metadata) == null ? void 0 : _object_metadata34.variantId) != null ? _ref77 : '') || ((_lifted_variants_1 = lifted.variants[0]) == null ? void 0 : _lifted_variants_1.id);
+                const soldVariantId = String((_ref78 = (_object_metadata34 = object.metadata) == null ? void 0 : _object_metadata34.variantId) != null ? _ref78 : '') || ((_lifted_variants_1 = lifted.variants[0]) == null ? void 0 : _lifted_variants_1.id);
                 if (soldVariantId) {
                     // AGL-1711: `-1` regardless of how many units were bought, so a
                     // 3-unit buy-now sale decremented stock by one and the difference
@@ -3753,14 +3786,14 @@ async function findOrderForDispute(paymentIntentId) {
             // Settlement, the same way round and for the same reason as the cart
             // branch above (AGL-2356): the decrement lands first, then the
             // reservation is dropped.
-            await releaseStockHold(hostRef, String((_ref76 = (_object_metadata33 = object.metadata) == null ? void 0 : _object_metadata33.stockHoldKey) != null ? _ref76 : ''));
+            await releaseStockHold(hostRef, String((_ref77 = (_object_metadata33 = object.metadata) == null ? void 0 : _object_metadata33.stockHoldKey) != null ? _ref77 : ''));
             if (couponCode) {
-                var _ref78;
+                var _ref79;
                 var _object_metadata35;
                 await settleRedemption({
                     firestore,
                     ref: hostRef.collection('coupons').doc(String(couponCode)),
-                    holdKey: String((_ref78 = (_object_metadata35 = object.metadata) == null ? void 0 : _object_metadata35.couponHoldKey) != null ? _ref78 : ''),
+                    holdKey: String((_ref79 = (_object_metadata35 = object.metadata) == null ? void 0 : _object_metadata35.couponHoldKey) != null ? _ref79 : ''),
                     orderRef,
                     label: `coupon ${couponCode}`,
                     detail: `Coupon ${couponCode} was applied to this order but no longer ` + 'exists, so the redemption is uncounted against its limit.'
@@ -3769,14 +3802,14 @@ async function findOrderForDispute(paymentIntentId) {
             // Receipt + seller notification (AGL-96): env-gated like every
             // other outbound email; failures never fail the webhook.
             if (isEmailConfigured()) {
-                var _productSnapshot_get, _ref79;
-                var _object_customer_details19, _org, _this3;
+                var _productSnapshot_get, _ref80;
+                var _object_customer_details20, _org, _this3;
                 const productName = String((_productSnapshot_get = productSnapshot.get('name')) != null ? _productSnapshot_get : 'your purchase');
-                const amount = (Number((_ref79 = object == null ? void 0 : object.amount_total) != null ? _ref79 : 0) / 100).toFixed(2);
-                const buyerEmail = object == null ? void 0 : (_object_customer_details19 = object.customer_details) == null ? void 0 : _object_customer_details19.email;
+                const amount = (Number((_ref80 = object == null ? void 0 : object.amount_total) != null ? _ref80 : 0) / 100).toFixed(2);
+                const buyerEmail = object == null ? void 0 : (_object_customer_details20 = object.customer_details) == null ? void 0 : _object_customer_details20.email;
                 const orderTotal = `$${amount}`;
                 if (buyerEmail) {
-                    var _ref80;
+                    var _ref81;
                     const fallbackText = `Thanks for your purchase!\n\n${productName} — $${amount}` + `\nOrder reference: ${object.id}`;
                     // Site-owner-designed template when published (AGL-771).
                     const designed = await renderHostEmailWithTokens(firebaseAdmin.app().firestore(), String(hostId), 'order-receipt', {
@@ -3786,7 +3819,7 @@ async function findOrderForDispute(paymentIntentId) {
                     });
                     await sendEmail(_extends({
                         to: String(buyerEmail),
-                        subject: (_ref80 = designed == null ? void 0 : designed.subject) != null ? _ref80 : `Receipt: ${productName}`,
+                        subject: (_ref81 = designed == null ? void 0 : designed.subject) != null ? _ref81 : `Receipt: ${productName}`,
                         text: (designed == null ? void 0 : designed.text) || fallbackText
                     }, (designed == null ? void 0 : designed.html) ? {
                         html: designed.html
@@ -3794,7 +3827,10 @@ async function findOrderForDispute(paymentIntentId) {
                         fromName: (await brandFor(hostId)).fromName,
                         sendingIdentity: await hostSendingIdentity(String(hostId)),
                         audience: 'tenant',
-                        context: 'receipt'
+                        context: 'receipt',
+                        // Owed to the recipient by their own order: the phishing
+                        // screen's soft rules never hold it (AGL-3356).
+                        owedFor: 'order'
                     }));
                     // Cost meter (AGL-1438). Transactional, as the cart receipt above.
                     await meterHostEmail(String(hostId));
@@ -3817,7 +3853,7 @@ async function findOrderForDispute(paymentIntentId) {
                     // SSO.
                     const seller = (_this4 = await findUserByUidAcrossPools(sellerUid).catch(()=>null)) == null ? void 0 : _this4.record;
                     if (seller == null ? void 0 : seller.email) {
-                        var _hostSnapshot_get, _ref81;
+                        var _hostSnapshot_get, _ref82;
                         const siteName = String((_hostSnapshot_get = hostSnapshot.get('displayName')) != null ? _hostSnapshot_get : hostId);
                         const fallbackText = `You made a sale on ${siteName}!\n\n${productName} — $${amount}` + (buyerEmail ? `\nBuyer: ${buyerEmail}` : '') + `\nOrder reference: ${object.id}`;
                         // Site-owner-designed template when published (AGL-771).
@@ -3830,7 +3866,7 @@ async function findOrderForDispute(paymentIntentId) {
                         });
                         await sendEmail(_extends({
                             to: seller.email,
-                            subject: (_ref81 = designed == null ? void 0 : designed.subject) != null ? _ref81 : `New order: ${productName}`,
+                            subject: (_ref82 = designed == null ? void 0 : designed.subject) != null ? _ref82 : `New order: ${productName}`,
                             text: (designed == null ? void 0 : designed.text) || fallbackText
                         }, (designed == null ? void 0 : designed.html) ? {
                             html: designed.html
@@ -3838,7 +3874,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'seller order notice'
+                            context: 'seller order notice',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         }));
                         // Cost meter (AGL-1438). Transactional: the seller learns about
                         // the order here.
@@ -3848,6 +3887,45 @@ async function findOrderForDispute(paymentIntentId) {
             }
         }
     }
+    // Fraud signals on a store's sale (AGL-3360): an issuer's early fraud
+    // warning and a Radar review. The merchant decides what to do for their
+    // own customer, so the signal lands on the ORDER — a timeline line and the
+    // shared `paymentRisk` chip — and the site's managers are told once.
+    // Nothing is refunded or canceled. Found by the same payment-intent join a
+    // dispute uses; a signal on anything else is not commerce's and stays
+    // silent here (the platform route and the other plugins answer it).
+    // Disputes keep their own branch below, which has always told the
+    // merchant; both report the site so the seller's fraud ledger can name it.
+    const risk = paymentRiskEventFrom(type, object);
+    if (risk && risk.signal.kind !== 'dispute') {
+        var _ref83, _snapshot_data;
+        var _snapshot_ref_parent_parent;
+        const lookup = risk.paymentIntentId ? await findOrderForDispute(risk.paymentIntentId) : {
+            kind: 'not-ours'
+        };
+        if (lookup.kind !== 'order') return;
+        const snapshot = lookup.snapshot;
+        const hostId = String((_ref83 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref83 : '');
+        const order = CommerceModel.liftLegacyOrder((_snapshot_data = snapshot.data()) != null ? _snapshot_data : {});
+        await recordPaymentRiskOnRecord({
+            ref: snapshot.ref,
+            signal: risk.signal,
+            hostId,
+            subjectLabel: `Order ${CommerceModel.formatOrderNumber(order, snapshot.id)}`,
+            link: `/${hostId}/orders`,
+            notificationType: 'content.order',
+            extraUpdate: (data)=>({
+                    timeline: CommerceModel.appendOrderEvent(CommerceModel.liftLegacyOrder(data), risk.signal.kind === 'early-fraud-warning' ? 'fraud-warning' : 'payment-review', risk.signal.kind === 'early-fraud-warning' ? 'The card issuer reported this payment as possibly fraudulent' + (risk.signal.detail ? ` (${risk.signal.detail.replace(/_/g, ' ')})` : '') : 'Stripe Radar is holding this payment for review', risk.signal.atMs)
+                })
+        }, {
+            firestore: firebaseAdmin.app().firestore(),
+            notify: notifyHostManagers
+        });
+        return {
+            claimed: true,
+            hostId
+        };
+    }
     // Card disputes against a merchant's store (AGL-1787).
     //
     // Commerce subscribed no `charge.dispute.*` event at all, so a shopper
@@ -3873,7 +3951,8 @@ async function findOrderForDispute(paymentIntentId) {
     // finds). AGL-1554 will add its own `closed` branch for the marketplace
     // side; the two coexist because each self-selects by finding its own record.
     if (type === 'charge.dispute.created' || type === 'charge.dispute.closed') {
-        var _dispute_payment_intent;
+        var _dispute_payment_intent, _ref84;
+        var _snapshot_ref_parent_parent1;
         const dispute = object != null ? object : {};
         const paymentIntentId = String((_dispute_payment_intent = dispute.payment_intent) != null ? _dispute_payment_intent : '');
         const lookup = paymentIntentId ? await findOrderForDispute(paymentIntentId) : {
@@ -3898,9 +3977,9 @@ async function findOrderForDispute(paymentIntentId) {
         const claimed = lookup.kind === 'order' || lookup.kind === 'unresolved';
         const snapshot = lookup.kind === 'order' ? lookup.snapshot : null;
         if (snapshot) {
-            var _ref82;
-            var _snapshot_ref_parent_parent;
-            const hostId = String((_ref82 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref82 : '');
+            var _ref85;
+            var _snapshot_ref_parent_parent2;
+            const hostId = String((_ref85 = (_snapshot_ref_parent_parent2 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent2.id) != null ? _ref85 : '');
             if (type === 'charge.dispute.created') {
                 const { opened, record } = await recordDisputeOpened(snapshot, dispute);
                 if (opened && hostId) {
@@ -3917,7 +3996,7 @@ async function findOrderForDispute(paymentIntentId) {
                     });
                 }
             } else {
-                var _ref83;
+                var _ref86;
                 const settled = await recordDisputeClosed(snapshot, dispute);
                 if (settled.recorded && hostId) {
                     await notifyHostManagers(hostId, {
@@ -3975,7 +4054,7 @@ async function findOrderForDispute(paymentIntentId) {
                 // transiently-failed reversal gets its retry — and gated inside on
                 // the order's own `reversedTransferCents` marker, so it runs at most
                 // once per dispute however many times Stripe delivers.
-                if (String((_ref83 = dispute == null ? void 0 : dispute.status) != null ? _ref83 : '') === 'lost') {
+                if (String((_ref86 = dispute == null ? void 0 : dispute.status) != null ? _ref86 : '') === 'lost') {
                     const pulledBackCents = await reverseSellerShare(snapshot.ref, dispute);
                     // The merchant-experience half of the AGL-1794 decision, and not an
                     // optional extra: the reversal takes money out of the connected
@@ -4002,9 +4081,11 @@ async function findOrderForDispute(paymentIntentId) {
                 }
             }
         }
-        return {
+        return _extends({
             claimed
-        };
+        }, snapshot ? {
+            hostId: String((_ref84 = (_snapshot_ref_parent_parent1 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent1.id) != null ? _ref84 : '')
+        } : {});
     }
 };