@aglyn/plugins-commerce 1.0.0-beta.202 → 1.0.0-beta.203

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/plugins-commerce",
-  "version": "1.0.0-beta.202",
+  "version": "1.0.0-beta.203",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,18 +25,18 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.202",
-    "@aglyn/shared-data-mdi": "1.0.0-beta.202",
-    "@aglyn/shared-ui-jsx": "1.0.0-beta.202",
-    "@aglyn/shared-ui-next": "1.0.0-beta.202",
-    "@aglyn/shared-ui-snackstack": "1.0.0-beta.202",
-    "@aglyn/shared-util-email": "1.0.0-beta.202",
-    "@aglyn/shared-util-http": "1.0.0-beta.202",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.202",
-    "@aglyn/shared-util-tools": "1.0.0-beta.202",
-    "@aglyn/tenant-data-admin": "1.0.0-beta.202",
-    "@aglyn/tenant-feature-instance": "1.0.0-beta.202",
-    "@aglyn/tenant-runtime": "1.0.0-beta.202",
+    "@aglyn/aglyn": "1.0.0-beta.203",
+    "@aglyn/shared-data-mdi": "1.0.0-beta.203",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.203",
+    "@aglyn/shared-ui-next": "1.0.0-beta.203",
+    "@aglyn/shared-ui-snackstack": "1.0.0-beta.203",
+    "@aglyn/shared-util-email": "1.0.0-beta.203",
+    "@aglyn/shared-util-http": "1.0.0-beta.203",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.203",
+    "@aglyn/shared-util-tools": "1.0.0-beta.203",
+    "@aglyn/tenant-data-admin": "1.0.0-beta.203",
+    "@aglyn/tenant-feature-instance": "1.0.0-beta.203",
+    "@aglyn/tenant-runtime": "1.0.0-beta.203",
     "@stripe/react-stripe-js": "^3.10.0",
     "@stripe/stripe-js": "^5.10.0",
     "@swc/helpers": "0.5.23",

package/src/lib/model/commerce-gift-cards.d.ts

@@ -61,9 +61,11 @@ export interface GiftCardHold {
 }
 /**
  * Why a card cannot be redeemed for now (AGL-3363): the payment that bought
- * it drew an issuer's early fraud warning, a Radar review, or a dispute.
+ * it drew an issuer's early fraud warning, a Radar review, or a dispute; or
+ * part of it was refunded outside the console and the refund could not be
+ * matched to the order's lines (`refund-review`).
  */
-export type GiftCardFreezeReason = 'early-fraud-warning' | 'radar-review' | 'dispute';
+export type GiftCardFreezeReason = 'early-fraud-warning' | 'radar-review' | 'dispute' | 'refund-review';
 /** Why a card's balance was taken back rather than spent. */
 export type GiftCardVoidReason = 'refund' | 'dispute-lost';
 /** `hosts/{hostId}/giftCards/{code}` doc, as far as redemption cares. */

package/src/lib/model/commerce-gift-cards.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/model/commerce-gift-cards.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Gift-card hold arithmetic (AGL-2449).\n *\n * A gift card is CASH, and until this module existed it was the one limited\n * resource in the order path with no reserve at all. `cart-checkout.ts` read\n * `balanceCents` with a plain `.get()`, minted a Stripe coupon for that much,\n * and the webhook decremented the card minutes later with a bare\n * `FieldValue.increment(-N)`. The increment is atomic, so nothing was ever\n * LOST — but nothing ever CHECKED either, so two checkouts entering the same\n * code both read $50, both got $50 off, and the card settled at `-$50`. The\n * merchant shipped $100 of goods against a $50 card, and the outstanding\n * liability total went negative — the exact corruption `redeemExistingOrRecord`\n * already reasons about for a DELETED card, arriving through a live one.\n *\n * The stock fix (AGL-2320) could not be copied here: stock is decremented after\n * the money has moved and therefore cannot refuse, so it locks and reports the\n * shortfall. A gift card is applied BEFORE Stripe is contacted, so this door can\n * still say no — and refusing is the only thing that actually keeps the money.\n *\n * So the balance is HELD at checkout and SETTLED at the webhook, both in one\n * transaction against one document. Holds live in a map on the card itself\n * keyed by Stripe session id, which is what keeps this to a single-document\n * transaction: no fan-out, no second collection, no index.\n *\n * ## Why holds expire rather than being swept\n *\n * An abandoned checkout must not stand a customer's money off indefinitely, and\n * a sweep job is the wrong instrument: `process-abandoned.ts` is the only\n * existing sweep and it returns 501 when SMTP is unconfigured, so a\n * release that depended on it would not run at all for a self-hosted store with\n * no mail transport. Instead every hold carries `expiresAtMs` and EVERY read\n * prunes, so the release is a consequence of the next read rather than of a job\n * that may never run. A card nobody touches again holds nothing that matters,\n * because nobody is reading it either.\n *\n * The TTL matches Stripe's Checkout Session lifetime rather than something\n * shorter. A hold that lapsed while its session was still payable would reopen\n * the very window this closes — the shopper pays a session whose hold has\n * evaporated and the balance is spent twice again.\n */\n\n/** One in-flight claim on a card's balance, keyed by Stripe session id. */\nexport interface GiftCardHold {\n  cents: number\n  expiresAtMs: number\n}\n\n/**\n * Why a card cannot be redeemed for now (AGL-3363): the payment that bought\n * it drew an issuer's early fraud warning, a Radar review, or a dispute.\n */\nexport type GiftCardFreezeReason = 'early-fraud-warning' | 'radar-review' | 'dispute'\n\n/** Why a card's balance was taken back rather than spent. */\nexport type GiftCardVoidReason = 'refund' | 'dispute-lost'\n\n/** `hosts/{hostId}/giftCards/{code}` doc, as far as redemption cares. */\nexport interface HostGiftCard {\n  balanceCents?: number\n  /** Session id → hold. Absent on every card issued before AGL-2449. */\n  holds?: Record<string, GiftCardHold>\n  voidedAtMs?: number\n  voidedReason?: GiftCardVoidReason\n  /** Set while the purchase is under a fraud signal; nothing can redeem it. */\n  frozenAtMs?: number\n  frozenReason?: GiftCardFreezeReason\n}\n\n/*==========================================\n * GIFT CARDS ARE A CASH-OUT (AGL-3363).\n *\n * Buying store credit with a stolen card and spending it before the\n * chargeback lands is the standard way to turn card data into goods. Three\n * rules, all shared by every door that sells or redeems a card:\n *\n * 1. A PURCHASE HAS A CEILING. One checkout may buy at most\n *    {@link GIFT_CARD_PURCHASE_LIMITS} of gift cards — lower while the\n *    workspace is young, when a stolen-card storefront is likeliest — and\n *    one visitor may buy gift cards only so many times a day. A real shop's\n *    holiday order ($100 cards for a team) sits well inside both.\n * 2. A SIGNAL FREEZES. An early fraud warning, a Radar review or a dispute\n *    on the purchase freezes every card it issued (`frozenAtMs`): its balance\n *    stays, and nothing can redeem it until the merchant releases it or the\n *    dispute is won.\n * 3. A REVERSAL VOIDS. A refund of the purchase, or a lost dispute, zeroes\n *    what is left on its cards — the same zeroing the console's Void button\n *    does, never a delete (AGL-1767).\n *=========================================*/\n\nexport const GIFT_CARD_PURCHASE_LIMITS = {\n  /** Gift-card value one checkout may buy. */\n  perOrderCents: 500_000,\n  /** …while the workspace is young (`isYoungWorkspace`). */\n  perOrderCentsYoung: 50_000,\n  /** Checkouts buying gift cards, per visitor address per day. */\n  perVisitorDaily: 5,\n  /** …while the workspace is young. */\n  perVisitorDailyYoung: 2,\n} as const\n\n/** The refusal a checkout gives past the per-order ceiling, or null. */\nexport function giftCardPurchaseRefusal(input: {\n  giftCardCents: number\n  young: boolean\n}): string | null {\n  const ceiling = input.young\n    ? GIFT_CARD_PURCHASE_LIMITS.perOrderCentsYoung\n    : GIFT_CARD_PURCHASE_LIMITS.perOrderCents\n  if (!(input.giftCardCents > ceiling)) return null\n  // The ceiling is not named: a shopper who is testing it must not be told\n  // where it is. A real buyer of a large gift order is sent to the shop.\n  return (\n    'This order has more in gift cards than can be bought in one online ' +\n    'checkout. Please contact the shop to complete it.'\n  )\n}\n\n/** Is the card frozen by a fraud signal on the payment that bought it? */\nexport function isGiftCardFrozen(card: HostGiftCard | undefined): boolean {\n  return Number(card?.frozenAtMs) > 0\n}\n\n/**\n * Stripe Checkout Sessions expire 24h after creation, so a hold outlives any\n * session that can still be paid. See the module docblock for why a shorter\n * TTL is not the safer choice it looks like.\n */\nexport const GIFT_CARD_HOLD_TTL_MS = 24 * 60 * 60 * 1000\n\n/** One money figure off an untrusted document, as whole non-negative cents. */\nfunction cents(value: unknown): number {\n  const number = Math.round(Number(value))\n  return Number.isFinite(number) && number > 0 ? number : 0\n}\n\n/**\n * The card's holds with the lapsed ones dropped.\n *\n * Total, not a filter over a trusted shape: a hold whose `expiresAtMs` is\n * absent or non-numeric is treated as EXPIRED rather than eternal, so a\n * malformed row releases the money instead of stranding it. The one direction\n * that cannot be wrong is the one that keeps a customer from spending their own\n * balance forever.\n */\nexport function pruneGiftCardHolds(\n  holds: Record<string, GiftCardHold> | undefined,\n  nowMs: number,\n): Record<string, GiftCardHold> {\n  const live: Record<string, GiftCardHold> = {}\n  for (const [sessionId, hold] of Object.entries(holds ?? {})) {\n    const expiresAtMs = Number(hold?.expiresAtMs)\n    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) continue\n    const amount = cents(hold?.cents)\n    if (amount > 0) live[sessionId] = { cents: amount, expiresAtMs }\n  }\n  return live\n}\n\n/**\n * What a NEW checkout may apply: the balance less every hold still standing.\n *\n * Never negative. A card whose holds already exceed its balance (possible only\n * on a card voided mid-flight, where the console zeroes `balanceCents` while\n * holds stand) reads as empty rather than as a debt to be collected.\n */\nexport function giftCardAvailableCents(\n  card: HostGiftCard | undefined,\n  nowMs: number,\n): number {\n  // A frozen card offers nothing to a NEW checkout (AGL-3363). Settlement of\n  // a hold placed before the freeze is left alone: that shopper has paid.\n  if (isGiftCardFrozen(card)) return 0\n  const held = Object.values(pruneGiftCardHolds(card?.holds, nowMs)).reduce(\n    (sum, hold) => sum + hold.cents,\n    0,\n  )\n  return Math.max(0, cents(card?.balanceCents) - held)\n}\n\n/**\n * What settling `sessionId` should actually take off the card.\n *\n * Capped at the live balance, not at the hold, and that is the point of the\n * function. The hold is what this session RESERVED; the balance is what the\n * card can still give up. They diverge when the card was voided or hand-adjusted\n * between the hold and the payment, and in that window paying out the hold would\n * drive the balance negative — reintroducing the corrupted liability aggregate\n * from the other side.\n *\n * A session with no hold settles ZERO. That is the redelivery case (the first\n * delivery consumed it) and the pre-AGL-2449 case (a session that predates\n * holds), and both must be no-ops rather than a second decrement.\n */\nexport function giftCardSettlementCents(\n  card: HostGiftCard | undefined,\n  sessionId: string,\n  // Deliberately unused, and kept so this reads as the sibling of\n  // `giftCardAvailableCents` at every call site. The asymmetry IS the rule\n  // below: availability is a question about now, settlement is not.\n  _nowMs: number,\n): number {\n  // NOT pruned: a hold that lapsed while its session sat unpaid is still owed\n  // once that session is paid. Expiry governs what a NEW checkout may claim,\n  // never whether a completed payment is honoured — dropping it here would take\n  // the discount from the shopper and give nothing back to the merchant.\n  const hold = (card?.holds ?? {})[sessionId]\n  return Math.min(cents(hold?.cents), cents(card?.balanceCents))\n}\n"],"names":["GIFT_CARD_PURCHASE_LIMITS","perOrderCents","perOrderCentsYoung","perVisitorDaily","perVisitorDailyYoung","giftCardPurchaseRefusal","input","ceiling","young","giftCardCents","isGiftCardFrozen","card","Number","frozenAtMs","GIFT_CARD_HOLD_TTL_MS","cents","value","number","Math","round","isFinite","pruneGiftCardHolds","holds","nowMs","live","sessionId","hold","Object","entries","expiresAtMs","amount","giftCardAvailableCents","held","values","reduce","sum","max","balanceCents","giftCardSettlementCents","_nowMs","min"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GAED,yEAAyE,GA2BzE;;;;;;;;;;;;;;;;;;;2CAmB2C,GAE3C,OAAO,MAAMA,4BAA4B;IACvC,0CAA0C,GAC1CC,eAAe;IACf,wDAAwD,GACxDC,oBAAoB;IACpB,8DAA8D,GAC9DC,iBAAiB;IACjB,mCAAmC,GACnCC,sBAAsB;AACxB,EAAU;AAEV,sEAAsE,GACtE,OAAO,SAASC,wBAAwBC,KAGvC;IACC,MAAMC,UAAUD,MAAME,KAAK,GACvBR,0BAA0BE,kBAAkB,GAC5CF,0BAA0BC,aAAa;IAC3C,IAAI,CAAEK,CAAAA,MAAMG,aAAa,GAAGF,OAAM,GAAI,OAAO;IAC7C,yEAAyE;IACzE,uEAAuE;IACvE,OACE,wEACA;AAEJ;AAEA,wEAAwE,GACxE,OAAO,SAASG,iBAAiBC,IAA8B;IAC7D,OAAOC,OAAOD,wBAAAA,KAAME,UAAU,IAAI;AACpC;AAEA;;;;CAIC,GACD,OAAO,MAAMC,wBAAwB,KAAK,KAAK,KAAK,KAAI;AAExD,6EAA6E,GAC7E,SAASC,MAAMC,KAAc;IAC3B,MAAMC,SAASC,KAAKC,KAAK,CAACP,OAAOI;IACjC,OAAOJ,OAAOQ,QAAQ,CAACH,WAAWA,SAAS,IAAIA,SAAS;AAC1D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASI,mBACdC,KAA+C,EAC/CC,KAAa;IAEb,MAAMC,OAAqC,CAAC;IAC5C,KAAK,MAAM,CAACC,WAAWC,KAAK,IAAIC,OAAOC,OAAO,CAACN,gBAAAA,QAAS,CAAC,GAAI;QAC3D,MAAMO,cAAcjB,OAAOc,wBAAAA,KAAMG,WAAW;QAC5C,IAAI,CAACjB,OAAOQ,QAAQ,CAACS,gBAAgBA,eAAeN,OAAO;QAC3D,MAAMO,SAASf,MAAMW,wBAAAA,KAAMX,KAAK;QAChC,IAAIe,SAAS,GAAGN,IAAI,CAACC,UAAU,GAAG;YAAEV,OAAOe;YAAQD;QAAY;IACjE;IACA,OAAOL;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASO,uBACdpB,IAA8B,EAC9BY,KAAa;IAEb,2EAA2E;IAC3E,wEAAwE;IACxE,IAAIb,iBAAiBC,OAAO,OAAO;IACnC,MAAMqB,OAAOL,OAAOM,MAAM,CAACZ,mBAAmBV,wBAAAA,KAAMW,KAAK,EAAEC,QAAQW,MAAM,CACvE,CAACC,KAAKT,OAASS,MAAMT,KAAKX,KAAK,EAC/B;IAEF,OAAOG,KAAKkB,GAAG,CAAC,GAAGrB,MAAMJ,wBAAAA,KAAM0B,YAAY,IAAIL;AACjD;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASM,wBACd3B,IAA8B,EAC9Bc,SAAiB,EACjB,gEAAgE;AAChE,yEAAyE;AACzE,kEAAkE;AAClEc,MAAc;;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,MAAMb,OAAO,SAACf,wBAAAA,KAAMW,KAAK,mBAAI,CAAC,EAAE,CAACG,UAAU;IAC3C,OAAOP,KAAKsB,GAAG,CAACzB,MAAMW,wBAAAA,KAAMX,KAAK,GAAGA,MAAMJ,wBAAAA,KAAM0B,YAAY;AAC9D"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/model/commerce-gift-cards.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Gift-card hold arithmetic (AGL-2449).\n *\n * A gift card is CASH, and until this module existed it was the one limited\n * resource in the order path with no reserve at all. `cart-checkout.ts` read\n * `balanceCents` with a plain `.get()`, minted a Stripe coupon for that much,\n * and the webhook decremented the card minutes later with a bare\n * `FieldValue.increment(-N)`. The increment is atomic, so nothing was ever\n * LOST — but nothing ever CHECKED either, so two checkouts entering the same\n * code both read $50, both got $50 off, and the card settled at `-$50`. The\n * merchant shipped $100 of goods against a $50 card, and the outstanding\n * liability total went negative — the exact corruption `redeemExistingOrRecord`\n * already reasons about for a DELETED card, arriving through a live one.\n *\n * The stock fix (AGL-2320) could not be copied here: stock is decremented after\n * the money has moved and therefore cannot refuse, so it locks and reports the\n * shortfall. A gift card is applied BEFORE Stripe is contacted, so this door can\n * still say no — and refusing is the only thing that actually keeps the money.\n *\n * So the balance is HELD at checkout and SETTLED at the webhook, both in one\n * transaction against one document. Holds live in a map on the card itself\n * keyed by Stripe session id, which is what keeps this to a single-document\n * transaction: no fan-out, no second collection, no index.\n *\n * ## Why holds expire rather than being swept\n *\n * An abandoned checkout must not stand a customer's money off indefinitely, and\n * a sweep job is the wrong instrument: `process-abandoned.ts` is the only\n * existing sweep and it returns 501 when SMTP is unconfigured, so a\n * release that depended on it would not run at all for a self-hosted store with\n * no mail transport. Instead every hold carries `expiresAtMs` and EVERY read\n * prunes, so the release is a consequence of the next read rather than of a job\n * that may never run. A card nobody touches again holds nothing that matters,\n * because nobody is reading it either.\n *\n * The TTL matches Stripe's Checkout Session lifetime rather than something\n * shorter. A hold that lapsed while its session was still payable would reopen\n * the very window this closes — the shopper pays a session whose hold has\n * evaporated and the balance is spent twice again.\n */\n\n/** One in-flight claim on a card's balance, keyed by Stripe session id. */\nexport interface GiftCardHold {\n  cents: number\n  expiresAtMs: number\n}\n\n/**\n * Why a card cannot be redeemed for now (AGL-3363): the payment that bought\n * it drew an issuer's early fraud warning, a Radar review, or a dispute; or\n * part of it was refunded outside the console and the refund could not be\n * matched to the order's lines (`refund-review`).\n */\nexport type GiftCardFreezeReason =\n  | 'early-fraud-warning'\n  | 'radar-review'\n  | 'dispute'\n  | 'refund-review'\n\n/** Why a card's balance was taken back rather than spent. */\nexport type GiftCardVoidReason = 'refund' | 'dispute-lost'\n\n/** `hosts/{hostId}/giftCards/{code}` doc, as far as redemption cares. */\nexport interface HostGiftCard {\n  balanceCents?: number\n  /** Session id → hold. Absent on every card issued before AGL-2449. */\n  holds?: Record<string, GiftCardHold>\n  voidedAtMs?: number\n  voidedReason?: GiftCardVoidReason\n  /** Set while the purchase is under a fraud signal; nothing can redeem it. */\n  frozenAtMs?: number\n  frozenReason?: GiftCardFreezeReason\n}\n\n/*==========================================\n * GIFT CARDS ARE A CASH-OUT (AGL-3363).\n *\n * Buying store credit with a stolen card and spending it before the\n * chargeback lands is the standard way to turn card data into goods. Three\n * rules, all shared by every door that sells or redeems a card:\n *\n * 1. A PURCHASE HAS A CEILING. One checkout may buy at most\n *    {@link GIFT_CARD_PURCHASE_LIMITS} of gift cards — lower while the\n *    workspace is young, when a stolen-card storefront is likeliest — and\n *    one visitor may buy gift cards only so many times a day. A real shop's\n *    holiday order ($100 cards for a team) sits well inside both.\n * 2. A SIGNAL FREEZES. An early fraud warning, a Radar review or a dispute\n *    on the purchase freezes every card it issued (`frozenAtMs`): its balance\n *    stays, and nothing can redeem it until the merchant releases it or the\n *    dispute is won.\n * 3. A REVERSAL VOIDS. A refund of the purchase, or a lost dispute, zeroes\n *    what is left on its cards — the same zeroing the console's Void button\n *    does, never a delete (AGL-1767).\n *=========================================*/\n\nexport const GIFT_CARD_PURCHASE_LIMITS = {\n  /** Gift-card value one checkout may buy. */\n  perOrderCents: 500_000,\n  /** …while the workspace is young (`isYoungWorkspace`). */\n  perOrderCentsYoung: 50_000,\n  /** Checkouts buying gift cards, per visitor address per day. */\n  perVisitorDaily: 5,\n  /** …while the workspace is young. */\n  perVisitorDailyYoung: 2,\n} as const\n\n/** The refusal a checkout gives past the per-order ceiling, or null. */\nexport function giftCardPurchaseRefusal(input: {\n  giftCardCents: number\n  young: boolean\n}): string | null {\n  const ceiling = input.young\n    ? GIFT_CARD_PURCHASE_LIMITS.perOrderCentsYoung\n    : GIFT_CARD_PURCHASE_LIMITS.perOrderCents\n  if (!(input.giftCardCents > ceiling)) return null\n  // The ceiling is not named: a shopper who is testing it must not be told\n  // where it is. A real buyer of a large gift order is sent to the shop.\n  return (\n    'This order has more in gift cards than can be bought in one online ' +\n    'checkout. Please contact the shop to complete it.'\n  )\n}\n\n/** Is the card frozen by a fraud signal on the payment that bought it? */\nexport function isGiftCardFrozen(card: HostGiftCard | undefined): boolean {\n  return Number(card?.frozenAtMs) > 0\n}\n\n/**\n * Stripe Checkout Sessions expire 24h after creation, so a hold outlives any\n * session that can still be paid. See the module docblock for why a shorter\n * TTL is not the safer choice it looks like.\n */\nexport const GIFT_CARD_HOLD_TTL_MS = 24 * 60 * 60 * 1000\n\n/** One money figure off an untrusted document, as whole non-negative cents. */\nfunction cents(value: unknown): number {\n  const number = Math.round(Number(value))\n  return Number.isFinite(number) && number > 0 ? number : 0\n}\n\n/**\n * The card's holds with the lapsed ones dropped.\n *\n * Total, not a filter over a trusted shape: a hold whose `expiresAtMs` is\n * absent or non-numeric is treated as EXPIRED rather than eternal, so a\n * malformed row releases the money instead of stranding it. The one direction\n * that cannot be wrong is the one that keeps a customer from spending their own\n * balance forever.\n */\nexport function pruneGiftCardHolds(\n  holds: Record<string, GiftCardHold> | undefined,\n  nowMs: number,\n): Record<string, GiftCardHold> {\n  const live: Record<string, GiftCardHold> = {}\n  for (const [sessionId, hold] of Object.entries(holds ?? {})) {\n    const expiresAtMs = Number(hold?.expiresAtMs)\n    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) continue\n    const amount = cents(hold?.cents)\n    if (amount > 0) live[sessionId] = { cents: amount, expiresAtMs }\n  }\n  return live\n}\n\n/**\n * What a NEW checkout may apply: the balance less every hold still standing.\n *\n * Never negative. A card whose holds already exceed its balance (possible only\n * on a card voided mid-flight, where the console zeroes `balanceCents` while\n * holds stand) reads as empty rather than as a debt to be collected.\n */\nexport function giftCardAvailableCents(\n  card: HostGiftCard | undefined,\n  nowMs: number,\n): number {\n  // A frozen card offers nothing to a NEW checkout (AGL-3363). Settlement of\n  // a hold placed before the freeze is left alone: that shopper has paid.\n  if (isGiftCardFrozen(card)) return 0\n  const held = Object.values(pruneGiftCardHolds(card?.holds, nowMs)).reduce(\n    (sum, hold) => sum + hold.cents,\n    0,\n  )\n  return Math.max(0, cents(card?.balanceCents) - held)\n}\n\n/**\n * What settling `sessionId` should actually take off the card.\n *\n * Capped at the live balance, not at the hold, and that is the point of the\n * function. The hold is what this session RESERVED; the balance is what the\n * card can still give up. They diverge when the card was voided or hand-adjusted\n * between the hold and the payment, and in that window paying out the hold would\n * drive the balance negative — reintroducing the corrupted liability aggregate\n * from the other side.\n *\n * A session with no hold settles ZERO. That is the redelivery case (the first\n * delivery consumed it) and the pre-AGL-2449 case (a session that predates\n * holds), and both must be no-ops rather than a second decrement.\n */\nexport function giftCardSettlementCents(\n  card: HostGiftCard | undefined,\n  sessionId: string,\n  // Deliberately unused, and kept so this reads as the sibling of\n  // `giftCardAvailableCents` at every call site. The asymmetry IS the rule\n  // below: availability is a question about now, settlement is not.\n  _nowMs: number,\n): number {\n  // NOT pruned: a hold that lapsed while its session sat unpaid is still owed\n  // once that session is paid. Expiry governs what a NEW checkout may claim,\n  // never whether a completed payment is honoured — dropping it here would take\n  // the discount from the shopper and give nothing back to the merchant.\n  const hold = (card?.holds ?? {})[sessionId]\n  return Math.min(cents(hold?.cents), cents(card?.balanceCents))\n}\n"],"names":["GIFT_CARD_PURCHASE_LIMITS","perOrderCents","perOrderCentsYoung","perVisitorDaily","perVisitorDailyYoung","giftCardPurchaseRefusal","input","ceiling","young","giftCardCents","isGiftCardFrozen","card","Number","frozenAtMs","GIFT_CARD_HOLD_TTL_MS","cents","value","number","Math","round","isFinite","pruneGiftCardHolds","holds","nowMs","live","sessionId","hold","Object","entries","expiresAtMs","amount","giftCardAvailableCents","held","values","reduce","sum","max","balanceCents","giftCardSettlementCents","_nowMs","min"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GAED,yEAAyE,GAiCzE;;;;;;;;;;;;;;;;;;;2CAmB2C,GAE3C,OAAO,MAAMA,4BAA4B;IACvC,0CAA0C,GAC1CC,eAAe;IACf,wDAAwD,GACxDC,oBAAoB;IACpB,8DAA8D,GAC9DC,iBAAiB;IACjB,mCAAmC,GACnCC,sBAAsB;AACxB,EAAU;AAEV,sEAAsE,GACtE,OAAO,SAASC,wBAAwBC,KAGvC;IACC,MAAMC,UAAUD,MAAME,KAAK,GACvBR,0BAA0BE,kBAAkB,GAC5CF,0BAA0BC,aAAa;IAC3C,IAAI,CAAEK,CAAAA,MAAMG,aAAa,GAAGF,OAAM,GAAI,OAAO;IAC7C,yEAAyE;IACzE,uEAAuE;IACvE,OACE,wEACA;AAEJ;AAEA,wEAAwE,GACxE,OAAO,SAASG,iBAAiBC,IAA8B;IAC7D,OAAOC,OAAOD,wBAAAA,KAAME,UAAU,IAAI;AACpC;AAEA;;;;CAIC,GACD,OAAO,MAAMC,wBAAwB,KAAK,KAAK,KAAK,KAAI;AAExD,6EAA6E,GAC7E,SAASC,MAAMC,KAAc;IAC3B,MAAMC,SAASC,KAAKC,KAAK,CAACP,OAAOI;IACjC,OAAOJ,OAAOQ,QAAQ,CAACH,WAAWA,SAAS,IAAIA,SAAS;AAC1D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASI,mBACdC,KAA+C,EAC/CC,KAAa;IAEb,MAAMC,OAAqC,CAAC;IAC5C,KAAK,MAAM,CAACC,WAAWC,KAAK,IAAIC,OAAOC,OAAO,CAACN,gBAAAA,QAAS,CAAC,GAAI;QAC3D,MAAMO,cAAcjB,OAAOc,wBAAAA,KAAMG,WAAW;QAC5C,IAAI,CAACjB,OAAOQ,QAAQ,CAACS,gBAAgBA,eAAeN,OAAO;QAC3D,MAAMO,SAASf,MAAMW,wBAAAA,KAAMX,KAAK;QAChC,IAAIe,SAAS,GAAGN,IAAI,CAACC,UAAU,GAAG;YAAEV,OAAOe;YAAQD;QAAY;IACjE;IACA,OAAOL;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASO,uBACdpB,IAA8B,EAC9BY,KAAa;IAEb,2EAA2E;IAC3E,wEAAwE;IACxE,IAAIb,iBAAiBC,OAAO,OAAO;IACnC,MAAMqB,OAAOL,OAAOM,MAAM,CAACZ,mBAAmBV,wBAAAA,KAAMW,KAAK,EAAEC,QAAQW,MAAM,CACvE,CAACC,KAAKT,OAASS,MAAMT,KAAKX,KAAK,EAC/B;IAEF,OAAOG,KAAKkB,GAAG,CAAC,GAAGrB,MAAMJ,wBAAAA,KAAM0B,YAAY,IAAIL;AACjD;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASM,wBACd3B,IAA8B,EAC9Bc,SAAiB,EACjB,gEAAgE;AAChE,yEAAyE;AACzE,kEAAkE;AAClEc,MAAc;;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,MAAMb,OAAO,SAACf,wBAAAA,KAAMW,KAAK,mBAAI,CAAC,EAAE,CAACG,UAAU;IAC3C,OAAOP,KAAKsB,GAAG,CAACzB,MAAMW,wBAAAA,KAAMX,KAAK,GAAGA,MAAMJ,wBAAAA,KAAM0B,YAAY;AAC9D"}

package/src/lib/server/billing-webhook.js

@@ -27,7 +27,8 @@ import { recordContactRefund } from "./contact-refund.js";
 import { reverseEmailAttributedRevenue } from "@aglyn/tenant-data-admin/server/email-revenue-attribution";
 import { paymentRiskEventFrom } from "@aglyn/aglyn/app-utils/payment-risk";
 import { recordPaymentRiskOnRecord } from "@aglyn/tenant-data-admin/server/payment-risk-record";
-import { applyGiftCardRiskToOrder, notifyGiftCardHold } from "./gift-card-risk.js";
+import { isTransientStripeStatus, reverseDestinationTransfer } from "@aglyn/tenant-data-admin/server/stripe-transfer-reversal";
+import { applyExternalRefundToGiftCards, applyGiftCardRiskToOrder, notifyGiftCardHold } from "./gift-card-risk.js";
 import { mintDownloadToken, tokenSigningSecret } from "./download.js";
 import { alertLowStockCrossing } from "./low-stock.js";
 import { decrementVariantStock } from "./reserve-stock.js";
@@ -306,6 +307,46 @@ async function findOrderForDispute(paymentIntentId) {
         evidenceDueByMs: dueBy * 1000
     } : {});
 }
+/**
+ * Record, once, the part of `charge.amount_refunded` the order does not
+ * already account for (AGL-3363): the console's own refunds are reserved in
+ * `refundedCents` before Stripe is asked, and earlier Dashboard refunds are
+ * in `externalRefundedCents`. Returns the new amount and the order's lines,
+ * or null when there is nothing new — a console refund's own event, or a
+ * redelivery. One transaction, so two deliveries cannot both count it.
+ */ async function recordExternalRefund(orderRef, charge) {
+    var _ref;
+    const stripeRefundedCents = Math.max(0, Math.round(Number((_ref = charge == null ? void 0 : charge.amount_refunded) != null ? _ref : 0)));
+    if (!(stripeRefundedCents > 0)) return null;
+    return firebaseAdmin.app().firestore().runTransaction(async (transaction)=>{
+        var _fresh_data, _order_refundedCents, _data_externalRefundedCents, _order_lineItems;
+        const fresh = await transaction.get(orderRef);
+        if (!fresh.exists) return null;
+        const data = (_fresh_data = fresh.data()) != null ? _fresh_data : {};
+        const order = CommerceModel.liftLegacyOrder(data);
+        const consoleCents = Math.max(0, Number((_order_refundedCents = order.refundedCents) != null ? _order_refundedCents : 0));
+        const externalCents = Math.max(0, Number((_data_externalRefundedCents = data['externalRefundedCents']) != null ? _data_externalRefundedCents : 0));
+        const newCents = stripeRefundedCents - consoleCents - externalCents;
+        if (!(newCents > 0)) return null;
+        transaction.set(orderRef, {
+            externalRefundedCents: externalCents + newCents,
+            timeline: CommerceModel.appendOrderEvent(order, 'refund', `$${(newCents / 100).toFixed(2)} refunded outside the dashboard (in Stripe)`)
+        }, {
+            merge: true
+        });
+        return {
+            newCents,
+            fullyRefunded: (charge == null ? void 0 : charge.refunded) === true,
+            lines: ((_order_lineItems = order.lineItems) != null ? _order_lineItems : []).map((line)=>{
+                var _line_productId, _line_unitAmountCents, _line_quantity;
+                return {
+                    productId: String((_line_productId = line.productId) != null ? _line_productId : ''),
+                    totalCents: Math.round(Number((_line_unitAmountCents = line.unitAmountCents) != null ? _line_unitAmountCents : 0)) * Math.max(1, Math.round(Number((_line_quantity = line.quantity) != null ? _line_quantity : 1)))
+                };
+            })
+        };
+    });
+}
 /**
  * Apply a gift-card risk action to the cards an order issued (AGL-3363). The
  * order doc id is the Checkout Session id every issued card carries as its
@@ -596,9 +637,6 @@ async function findOrderForDispute(paymentIntentId) {
         link: `/${hostId}/products`
     });
 }
-/** Stripe failures a redelivery can actually fix. */ function isTransientStripeStatus(status) {
-    return status === 429 || status >= 500;
-}
 /** One authorized GET against the Stripe API, body parsed either way. */ async function stripeGet(url, stripeKey) {
     const response = await fetch(url, {
         headers: {
@@ -1390,8 +1428,7 @@ async function findOrderForDispute(paymentIntentId) {
  * notification is keyed on it, so a non-zero answer must mean "the write
  * happened HERE, and nobody has told the merchant yet".
  */ async function reverseSellerShare(orderRef, dispute) {
-    var _ref, _snapshot_data, _stored_reversedCents, _ref1, _ref2, _ref3, _ref4, _ref5, _ref6, _ref7, _ref8;
-    var _charge_body, _charge_body1, _transfer_body_reversals, _transfer_body, _transfer_body1, _transfer_body2;
+    var _ref, _snapshot_data, _stored_reversedCents, _ref1;
     const disputeId = String((_ref = dispute == null ? void 0 : dispute.id) != null ? _ref : '');
     if (!disputeId) return 0;
     const snapshot = await orderRef.get();
@@ -1448,103 +1485,42 @@ async function findOrderForDispute(paymentIntentId) {
             return true;
         });
     };
-    const chargeId = String((_ref1 = dispute == null ? void 0 : dispute.charge) != null ? _ref1 : '');
-    if (!chargeId) {
-        console.error('Dispute carries no charge; seller share not reversed', {
-            disputeId
-        });
-        await settle(0, null, 'Seller share not reversed — no charge on the dispute');
-        return 0;
-    }
-    const charge = await stripeGet(`https://api.stripe.com/v1/charges/${chargeId}`, stripeKey);
-    if (!charge.ok) {
-        var _charge_body2;
-        if (isTransientStripeStatus(charge.status)) {
-            throw new Error(`Stripe charge read failed (${charge.status}) for dispute ${disputeId}`);
+    // The Stripe half is the shared seam (AGL-3363): the booking deposit's lost
+    // dispute pulls back through the same function, so the two cannot drift.
+    const outcome = await reverseDestinationTransfer({
+        kind: 'dispute',
+        id: disputeId,
+        amountCents: principalCents,
+        chargeId: String((_ref1 = dispute == null ? void 0 : dispute.charge) != null ? _ref1 : ''),
+        metadata: {
+            orderId: orderRef.id
         }
-        console.error('Stripe refused the charge read; seller share not reversed', (_charge_body2 = charge.body) == null ? void 0 : _charge_body2.error);
-        await settle(0, null, 'Seller share not reversed — charge not found at Stripe');
-        return 0;
-    }
-    const transferId = String((_ref2 = (_charge_body = charge.body) == null ? void 0 : _charge_body.transfer) != null ? _ref2 : '');
-    const chargeAmountCents = Math.round(Number((_ref3 = (_charge_body1 = charge.body) == null ? void 0 : _charge_body1.amount) != null ? _ref3 : 0));
-    if (!transferId || !(chargeAmountCents > 0)) {
-        // An order from before destination charges, or a charge Stripe holds no
-        // transfer for. Logged, recorded, let go.
-        console.error('No transfer on the disputed charge; seller share not reversed', {
-            disputeId,
-            chargeId
-        });
-        await settle(0, null, 'Seller share not reversed — no transfer on the charge');
-        return 0;
-    }
-    const transfer = await stripeGet(`https://api.stripe.com/v1/transfers/${transferId}`, stripeKey);
-    if (!transfer.ok) {
-        var _transfer_body3;
-        if (isTransientStripeStatus(transfer.status)) {
-            throw new Error(`Stripe transfer read failed (${transfer.status}) for dispute ${disputeId}`);
-        }
-        console.error('Stripe refused the transfer read; seller share not reversed', (_transfer_body3 = transfer.body) == null ? void 0 : _transfer_body3.error);
-        await settle(0, null, 'Seller share not reversed — transfer not found at Stripe');
-        return 0;
-    }
-    // The crash window's backstop: the POST landed on a previous delivery and
-    // the record did not. Adopt what exists rather than creating a second one.
-    const existing = ((_ref4 = (_transfer_body = transfer.body) == null ? void 0 : (_transfer_body_reversals = _transfer_body.reversals) == null ? void 0 : _transfer_body_reversals.data) != null ? _ref4 : []).find((item)=>{
-        var _ref;
-        var _item_metadata;
-        return String((_ref = item == null ? void 0 : (_item_metadata = item.metadata) == null ? void 0 : _item_metadata.disputeId) != null ? _ref : '') === disputeId;
+    }, {
+        stripeKey
     });
-    if (existing) {
-        var _existing_amount, _existing_id;
-        const adoptedCents = Math.round(Number((_existing_amount = existing.amount) != null ? _existing_amount : 0));
-        // Announced on adoption too: the delivery that created this reversal died
-        // before recording it, so it died before notifying. The money left the
-        // connected account either way and the merchant has not been told yet.
-        const wrote = await settle(adoptedCents, String((_existing_id = existing.id) != null ? _existing_id : ''), `$${(adoptedCents / 100).toFixed(2)} seller share reversed for lost dispute`);
-        return wrote ? adoptedCents : 0;
-    }
-    const transferCents = Math.round(Number((_ref5 = (_transfer_body1 = transfer.body) == null ? void 0 : _transfer_body1.amount) != null ? _ref5 : 0));
-    const alreadyReversedCents = Math.round(Number((_ref6 = (_transfer_body2 = transfer.body) == null ? void 0 : _transfer_body2.amount_reversed) != null ? _ref6 : 0));
-    const remainingCents = Math.max(0, transferCents - alreadyReversedCents);
-    const shareCents = Math.min(chargeAmountCents > 0 ? Math.floor(principalCents * transferCents / chargeAmountCents) : 0, remainingCents);
-    if (!(shareCents > 0)) {
-        console.error('Transfer has nothing left to reverse; seller share not reversed', {
+    if (outcome.kind === 'skipped') return 0;
+    if (outcome.kind === 'not-reversed') {
+        console.error(outcome.reason === 'transfer-fully-reversed' ? 'Transfer has nothing left to reverse; seller share not reversed' : 'Seller share not reversed', {
             disputeId,
-            transferId,
-            transferCents,
-            alreadyReversedCents
+            reason: outcome.reason
         });
-        await settle(0, null, 'Seller share already reversed on the transfer — nothing left to pull back');
+        await settle(0, null, SELLER_SHARE_NOT_REVERSED_NOTE[outcome.reason]);
         return 0;
     }
-    const params = new URLSearchParams({
-        amount: String(shareCents),
-        'metadata[disputeId]': disputeId,
-        'metadata[orderId]': orderRef.id
-    });
-    const response = await fetch(`https://api.stripe.com/v1/transfers/${transferId}/reversals`, {
-        method: 'POST',
-        headers: {
-            Authorization: `Bearer ${stripeKey}`,
-            'Content-Type': 'application/x-www-form-urlencoded',
-            'Idempotency-Key': `dispute-reversal-${disputeId}`
-        },
-        body: params.toString()
-    });
-    const reversal = await response.json().catch(()=>null);
-    if (!response.ok) {
-        if (isTransientStripeStatus(response.status)) {
-            throw new Error(`Stripe transfer reversal failed (${response.status}) for dispute ${disputeId}`);
-        }
-        console.error('Stripe refused the transfer reversal', reversal == null ? void 0 : reversal.error);
-        await settle(0, null, 'Seller share not reversed — Stripe refused the reversal');
-        return 0;
-    }
-    const reversedTransferCents = Math.round(Number((_ref7 = reversal == null ? void 0 : reversal.amount) != null ? _ref7 : shareCents));
-    const wrote = await settle(reversedTransferCents, String((_ref8 = reversal == null ? void 0 : reversal.id) != null ? _ref8 : ''), `$${(reversedTransferCents / 100).toFixed(2)} seller share reversed for lost dispute`);
-    return wrote ? reversedTransferCents : 0;
+    // Announced on adoption too: the delivery that created an adopted reversal
+    // died before recording it, so it died before notifying. The money left the
+    // connected account either way and the merchant has not been told yet.
+    const wrote = await settle(outcome.cents, outcome.reversalId, `$${(outcome.cents / 100).toFixed(2)} seller share reversed for lost dispute`);
+    return wrote ? outcome.cents : 0;
 }
+/** The order timeline's words for each final reason nothing was pulled back. */ const SELLER_SHARE_NOT_REVERSED_NOTE = {
+    'no-charge-on-cause': 'Seller share not reversed — no charge on the dispute',
+    'charge-read-refused': 'Seller share not reversed — charge not found at Stripe',
+    'no-transfer-on-charge': 'Seller share not reversed — no transfer on the charge',
+    'transfer-read-refused': 'Seller share not reversed — transfer not found at Stripe',
+    'transfer-fully-reversed': 'Seller share already reversed on the transfer — nothing left to pull back',
+    'reversal-refused': 'Seller share not reversed — Stripe refused the reversal'
+};
 /**
  * Commerce sections of the platform Stripe webhook (AGL-418): relocated
  * verbatim from the console route — subscriptions sync, reservations,
@@ -3911,6 +3887,48 @@ async function findOrderForDispute(paymentIntentId) {
             }
         }
     }
+    // A refund made OUTSIDE the console (AGL-3363) — in the Stripe Dashboard.
+    // `refund.ts` reserves `refundedCents` on the order before it asks Stripe,
+    // so by the time its own `charge.refunded` arrives the order already counts
+    // it; whatever Stripe has refunded beyond the order's count, and beyond the
+    // Dashboard refunds already recorded here, is new. The order's gift cards
+    // then follow the in-console rules (`applyExternalRefundToGiftCards`), and
+    // the refund is written on the order's timeline. Nothing else is moved: a
+    // Dashboard refund is staff's act, and they chose its transfer reversal.
+    if (type === 'charge.refunded') {
+        var _ref83, _ref84;
+        var _object_payment_intent, _snapshot_ref_parent_parent;
+        const paymentIntentId = typeof (object == null ? void 0 : object.payment_intent) === 'string' ? object.payment_intent : String((_ref83 = object == null ? void 0 : (_object_payment_intent = object.payment_intent) == null ? void 0 : _object_payment_intent.id) != null ? _ref83 : '');
+        const lookup = paymentIntentId ? await findOrderForDispute(paymentIntentId) : {
+            kind: 'not-ours'
+        };
+        if (lookup.kind !== 'order') return;
+        const snapshot = lookup.snapshot;
+        const hostId = String((_ref84 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref84 : '');
+        const external = await recordExternalRefund(snapshot.ref, object);
+        if (external && hostId && snapshot.ref.parent.parent) {
+            const outcome = await applyExternalRefundToGiftCards({
+                firestore: firebaseAdmin.app().firestore(),
+                hostRef: snapshot.ref.parent.parent,
+                orderId: snapshot.id,
+                lines: external.lines,
+                refundCents: external.newCents,
+                fullyRefunded: external.fullyRefunded
+            });
+            if (outcome.kind === 'frozen-for-review') {
+                await notifyGiftCardHold({
+                    hostId,
+                    orderLabel: `Order ${snapshot.id}`,
+                    cards: outcome.cards,
+                    reason: 'refund-review'
+                }, notifyHostManagers);
+            }
+        }
+        return {
+            claimed: true,
+            hostId
+        };
+    }
     // Fraud signals on a store's sale (AGL-3360): an issuer's early fraud
     // warning and a Radar review. The merchant decides what to do for their
     // own customer, so the signal lands on the ORDER — a timeline line and the
@@ -3922,14 +3940,14 @@ async function findOrderForDispute(paymentIntentId) {
     // merchant; both report the site so the seller's fraud ledger can name it.
     const risk = paymentRiskEventFrom(type, object);
     if (risk && risk.signal.kind !== 'dispute') {
-        var _ref83, _snapshot_data;
-        var _snapshot_ref_parent_parent;
+        var _ref85, _snapshot_data;
+        var _snapshot_ref_parent_parent1;
         const lookup = risk.paymentIntentId ? await findOrderForDispute(risk.paymentIntentId) : {
             kind: 'not-ours'
         };
         if (lookup.kind !== 'order') return;
         const snapshot = lookup.snapshot;
-        const hostId = String((_ref83 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref83 : '');
+        const hostId = String((_ref85 = (_snapshot_ref_parent_parent1 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent1.id) != null ? _ref85 : '');
         const order = CommerceModel.liftLegacyOrder((_snapshot_data = snapshot.data()) != null ? _snapshot_data : {});
         await recordPaymentRiskOnRecord({
             ref: snapshot.ref,
@@ -3987,8 +4005,8 @@ async function findOrderForDispute(paymentIntentId) {
     // finds). AGL-1554 will add its own `closed` branch for the marketplace
     // side; the two coexist because each self-selects by finding its own record.
     if (type === 'charge.dispute.created' || type === 'charge.dispute.closed') {
-        var _dispute_payment_intent, _ref84;
-        var _snapshot_ref_parent_parent1;
+        var _dispute_payment_intent, _ref86;
+        var _snapshot_ref_parent_parent2;
         const dispute = object != null ? object : {};
         const paymentIntentId = String((_dispute_payment_intent = dispute.payment_intent) != null ? _dispute_payment_intent : '');
         const lookup = paymentIntentId ? await findOrderForDispute(paymentIntentId) : {
@@ -4013,9 +4031,9 @@ async function findOrderForDispute(paymentIntentId) {
         const claimed = lookup.kind === 'order' || lookup.kind === 'unresolved';
         const snapshot = lookup.kind === 'order' ? lookup.snapshot : null;
         if (snapshot) {
-            var _ref85;
-            var _snapshot_ref_parent_parent2;
-            const hostId = String((_ref85 = (_snapshot_ref_parent_parent2 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent2.id) != null ? _ref85 : '');
+            var _ref87;
+            var _snapshot_ref_parent_parent3;
+            const hostId = String((_ref87 = (_snapshot_ref_parent_parent3 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent3.id) != null ? _ref87 : '');
             if (type === 'charge.dispute.created') {
                 // A chargeback's gift cards are frozen while it is open (AGL-3363).
                 await notifyGiftCardHold({
@@ -4042,11 +4060,11 @@ async function findOrderForDispute(paymentIntentId) {
                     });
                 }
             } else {
-                var _ref86, _ref87;
+                var _ref88, _ref89;
                 // Lost: the money went back, so the cards it bought are voided. Won
                 // (or closed on a warning): the dispute's freeze lifts; a freeze a
                 // fraud warning or review put on stays for the merchant (AGL-3363).
-                await applyOrderGiftCardRisk(snapshot, String((_ref86 = dispute == null ? void 0 : dispute.status) != null ? _ref86 : '') === 'lost' ? {
+                await applyOrderGiftCardRisk(snapshot, String((_ref88 = dispute == null ? void 0 : dispute.status) != null ? _ref88 : '') === 'lost' ? {
                     kind: 'void',
                     reason: 'dispute-lost'
                 } : {
@@ -4110,7 +4128,7 @@ async function findOrderForDispute(paymentIntentId) {
                 // transiently-failed reversal gets its retry — and gated inside on
                 // the order's own `reversedTransferCents` marker, so it runs at most
                 // once per dispute however many times Stripe delivers.
-                if (String((_ref87 = dispute == null ? void 0 : dispute.status) != null ? _ref87 : '') === 'lost') {
+                if (String((_ref89 = dispute == null ? void 0 : dispute.status) != null ? _ref89 : '') === 'lost') {
                     const pulledBackCents = await reverseSellerShare(snapshot.ref, dispute);
                     // The merchant-experience half of the AGL-1794 decision, and not an
                     // optional extra: the reversal takes money out of the connected
@@ -4140,7 +4158,7 @@ async function findOrderForDispute(paymentIntentId) {
         return _extends({
             claimed
         }, snapshot ? {
-            hostId: String((_ref84 = (_snapshot_ref_parent_parent1 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent1.id) != null ? _ref84 : '')
+            hostId: String((_ref86 = (_snapshot_ref_parent_parent2 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent2.id) != null ? _ref86 : '')
         } : {});
     }
 };