@aglyn/plugins-marketplace 1.0.0-beta.201 → 1.0.0-beta.202

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/plugins-marketplace",
-  "version": "1.0.0-beta.201",
+  "version": "1.0.0-beta.202",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,19 +25,19 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.201",
-    "@aglyn/aglyn-markdown-editor": "1.0.0-beta.201",
-    "@aglyn/shared-data-enums": "1.0.0-beta.201",
-    "@aglyn/shared-data-mdi": "1.0.0-beta.201",
-    "@aglyn/shared-ui-jsx": "1.0.0-beta.201",
-    "@aglyn/shared-ui-next": "1.0.0-beta.201",
-    "@aglyn/shared-ui-snackstack": "1.0.0-beta.201",
-    "@aglyn/shared-util-email": "1.0.0-beta.201",
-    "@aglyn/shared-util-http": "1.0.0-beta.201",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.201",
-    "@aglyn/tenant-data-admin": "1.0.0-beta.201",
-    "@aglyn/tenant-feature-instance": "1.0.0-beta.201",
-    "@aglyn/tenant-runtime": "1.0.0-beta.201",
+    "@aglyn/aglyn": "1.0.0-beta.202",
+    "@aglyn/aglyn-markdown-editor": "1.0.0-beta.202",
+    "@aglyn/shared-data-enums": "1.0.0-beta.202",
+    "@aglyn/shared-data-mdi": "1.0.0-beta.202",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.202",
+    "@aglyn/shared-ui-next": "1.0.0-beta.202",
+    "@aglyn/shared-ui-snackstack": "1.0.0-beta.202",
+    "@aglyn/shared-util-email": "1.0.0-beta.202",
+    "@aglyn/shared-util-http": "1.0.0-beta.202",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.202",
+    "@aglyn/tenant-data-admin": "1.0.0-beta.202",
+    "@aglyn/tenant-feature-instance": "1.0.0-beta.202",
+    "@aglyn/tenant-runtime": "1.0.0-beta.202",
     "@swc/helpers": "0.5.23"
   },
   "peerDependencies": {

package/src/lib/model/publisher-risk.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** A publisher workspace younger than this many days is in the tier. */
+export declare const YOUNG_PUBLISHER_DAYS = 30;
+/** How long a young publisher's payouts sit in its account. */
+export declare const YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS = 14;
+/** A young publisher's single sale at or above this files a staff signal. */
+export declare const YOUNG_PUBLISHER_REVIEW_SALE_CENTS = 10000;
+/**
+ * Is a publisher workspace of this age (days) in the young tier? `null` — a
+ * creation date that cannot be read — is an existing customer, as the
+ * phishing screen reads it, and is not young.
+ */
+export declare function isYoungPublisher(ageDays: number | null | undefined): boolean;
+/**
+ * The payout delay a publisher's account should carry: a number of days, or
+ * `null` for the account's standard (minimum) schedule.
+ */
+export declare function publisherPayoutDelayDays(ageDays: number | null | undefined): number | null;
+/** One reason a sale looks like the publisher paying itself or cashing out cards. */
+export type SaleRiskSignal = {
+    code: 'young-publisher-large-sale';
+    ageDays: number;
+    amountCents: number;
+} | {
+    /** The buyer and the publisher share a member (a uid in both workspaces). */
+    code: 'shared-member';
+    uids: string[];
+} | {
+    /**
+     * The card that paid was used by ANOTHER buyer workspace to buy from
+     * the same publisher — one card, several buyers, one seller.
+     */
+    code: 'card-reused-across-buyers';
+    otherBuyerOrgIds: string[];
+};
+/** One line per signal, in the words staff read on the row. */
+export declare function describeSaleRiskSignals(signals: readonly SaleRiskSignal[]): string[];

package/src/lib/model/publisher-risk.js

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * A YOUNG PUBLISHER'S RISK TIER (AGL-3365).
+ *
+ * The 9/26 actor signed up, paid for a plan on a card that never met 3-D
+ * Secure, and within days was sending lures. On the marketplace the same
+ * actor has one more move: publish a listing, buy it with stolen cards, and
+ * cash the sales out through the payouts the platform sends the publisher.
+ *
+ * Every marketplace sale is a destination charge — the funds settle on the
+ * platform and the publisher's share moves to its connected account at the
+ * charge — so the lever the platform keeps is the connected account's PAYOUT
+ * SCHEDULE: how long a share sits in the account before it leaves Stripe. A
+ * share still in the account can be reversed when a card turns out stolen
+ * (the refund and dispute doors already reverse it); a share already paid
+ * out to a bank cannot.
+ *
+ * So a publisher workspace in its first {@link YOUNG_PUBLISHER_DAYS} days has
+ * its payouts held {@link YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS} days, which
+ * outlasts the window in which issuers send early fraud warnings on most
+ * stolen-card charges, and a single sale of
+ * {@link YOUNG_PUBLISHER_REVIEW_SALE_CENTS} or more to one files a staff
+ * signal while the money can still be reversed. A publisher that ages out of
+ * the tier returns to the account's standard schedule on its next sale or its
+ * next visit to the payout settings.
+ *
+ * Age alone, as the phishing screen's tier is: payment history is what the
+ * actor bought.
+ *=========================================*/ /** A publisher workspace younger than this many days is in the tier. */ export const YOUNG_PUBLISHER_DAYS = 30;
+/** How long a young publisher's payouts sit in its account. */ export const YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS = 14;
+/** A young publisher's single sale at or above this files a staff signal. */ export const YOUNG_PUBLISHER_REVIEW_SALE_CENTS = 10000;
+/**
+ * Is a publisher workspace of this age (days) in the young tier? `null` — a
+ * creation date that cannot be read — is an existing customer, as the
+ * phishing screen reads it, and is not young.
+ */ export function isYoungPublisher(ageDays) {
+    return typeof ageDays === 'number' && Number.isFinite(ageDays) && ageDays < YOUNG_PUBLISHER_DAYS;
+}
+/**
+ * The payout delay a publisher's account should carry: a number of days, or
+ * `null` for the account's standard (minimum) schedule.
+ */ export function publisherPayoutDelayDays(ageDays) {
+    return isYoungPublisher(ageDays) ? YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS : null;
+}
+/** One line per signal, in the words staff read on the row. */ export function describeSaleRiskSignals(signals) {
+    return signals.map((signal)=>{
+        switch(signal.code){
+            case 'young-publisher-large-sale':
+                return `The publisher's workspace is ${signal.ageDays} day(s) old and this one sale was ` + `$${(signal.amountCents / 100).toFixed(2)}.`;
+            case 'shared-member':
+                return `The buying and publishing workspaces share ${signal.uids.length} member(s): ` + `${signal.uids.join(', ')}.`;
+            case 'card-reused-across-buyers':
+                return 'The same card also bought from this publisher for other workspace(s): ' + `${signal.otherBuyerOrgIds.join(', ')}.`;
+            default:
+                return 'Sale risk signal.';
+        }
+    });
+}
+
+//# sourceMappingURL=publisher-risk.js.map

package/src/lib/model/publisher-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/model/publisher-risk.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * A YOUNG PUBLISHER'S RISK TIER (AGL-3365).\n *\n * The 9/26 actor signed up, paid for a plan on a card that never met 3-D\n * Secure, and within days was sending lures. On the marketplace the same\n * actor has one more move: publish a listing, buy it with stolen cards, and\n * cash the sales out through the payouts the platform sends the publisher.\n *\n * Every marketplace sale is a destination charge — the funds settle on the\n * platform and the publisher's share moves to its connected account at the\n * charge — so the lever the platform keeps is the connected account's PAYOUT\n * SCHEDULE: how long a share sits in the account before it leaves Stripe. A\n * share still in the account can be reversed when a card turns out stolen\n * (the refund and dispute doors already reverse it); a share already paid\n * out to a bank cannot.\n *\n * So a publisher workspace in its first {@link YOUNG_PUBLISHER_DAYS} days has\n * its payouts held {@link YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS} days, which\n * outlasts the window in which issuers send early fraud warnings on most\n * stolen-card charges, and a single sale of\n * {@link YOUNG_PUBLISHER_REVIEW_SALE_CENTS} or more to one files a staff\n * signal while the money can still be reversed. A publisher that ages out of\n * the tier returns to the account's standard schedule on its next sale or its\n * next visit to the payout settings.\n *\n * Age alone, as the phishing screen's tier is: payment history is what the\n * actor bought.\n *=========================================*/\n\n/** A publisher workspace younger than this many days is in the tier. */\nexport const YOUNG_PUBLISHER_DAYS = 30\n\n/** How long a young publisher's payouts sit in its account. */\nexport const YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS = 14\n\n/** A young publisher's single sale at or above this files a staff signal. */\nexport const YOUNG_PUBLISHER_REVIEW_SALE_CENTS = 10_000\n\n/**\n * Is a publisher workspace of this age (days) in the young tier? `null` — a\n * creation date that cannot be read — is an existing customer, as the\n * phishing screen reads it, and is not young.\n */\nexport function isYoungPublisher(ageDays: number | null | undefined): boolean {\n  return (\n    typeof ageDays === 'number' &&\n    Number.isFinite(ageDays) &&\n    ageDays < YOUNG_PUBLISHER_DAYS\n  )\n}\n\n/**\n * The payout delay a publisher's account should carry: a number of days, or\n * `null` for the account's standard (minimum) schedule.\n */\nexport function publisherPayoutDelayDays(\n  ageDays: number | null | undefined,\n): number | null {\n  return isYoungPublisher(ageDays) ? YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS : null\n}\n\n/** One reason a sale looks like the publisher paying itself or cashing out cards. */\nexport type SaleRiskSignal =\n  | {\n      code: 'young-publisher-large-sale'\n      ageDays: number\n      amountCents: number\n    }\n  | {\n      /** The buyer and the publisher share a member (a uid in both workspaces). */\n      code: 'shared-member'\n      uids: string[]\n    }\n  | {\n      /**\n       * The card that paid was used by ANOTHER buyer workspace to buy from\n       * the same publisher — one card, several buyers, one seller.\n       */\n      code: 'card-reused-across-buyers'\n      otherBuyerOrgIds: string[]\n    }\n\n/** One line per signal, in the words staff read on the row. */\nexport function describeSaleRiskSignals(\n  signals: readonly SaleRiskSignal[],\n): string[] {\n  return signals.map((signal) => {\n    switch (signal.code) {\n      case 'young-publisher-large-sale':\n        return (\n          `The publisher's workspace is ${signal.ageDays} day(s) old and this one sale was ` +\n          `$${(signal.amountCents / 100).toFixed(2)}.`\n        )\n      case 'shared-member':\n        return (\n          `The buying and publishing workspaces share ${signal.uids.length} member(s): ` +\n          `${signal.uids.join(', ')}.`\n        )\n      case 'card-reused-across-buyers':\n        return (\n          'The same card also bought from this publisher for other workspace(s): ' +\n          `${signal.otherBuyerOrgIds.join(', ')}.`\n        )\n      default:\n        return 'Sale risk signal.'\n    }\n  })\n}\n"],"names":["YOUNG_PUBLISHER_DAYS","YOUNG_PUBLISHER_PAYOUT_DELAY_DAYS","YOUNG_PUBLISHER_REVIEW_SALE_CENTS","isYoungPublisher","ageDays","Number","isFinite","publisherPayoutDelayDays","describeSaleRiskSignals","signals","map","signal","code","amountCents","toFixed","uids","length","join","otherBuyerOrgIds"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA2B2C,GAE3C,sEAAsE,GACtE,OAAO,MAAMA,uBAAuB,GAAE;AAEtC,6DAA6D,GAC7D,OAAO,MAAMC,oCAAoC,GAAE;AAEnD,2EAA2E,GAC3E,OAAO,MAAMC,oCAAoC,MAAM;AAEvD;;;;CAIC,GACD,OAAO,SAASC,iBAAiBC,OAAkC;IACjE,OACE,OAAOA,YAAY,YACnBC,OAAOC,QAAQ,CAACF,YAChBA,UAAUJ;AAEd;AAEA;;;CAGC,GACD,OAAO,SAASO,yBACdH,OAAkC;IAElC,OAAOD,iBAAiBC,WAAWH,oCAAoC;AACzE;AAuBA,6DAA6D,GAC7D,OAAO,SAASO,wBACdC,OAAkC;IAElC,OAAOA,QAAQC,GAAG,CAAC,CAACC;QAClB,OAAQA,OAAOC,IAAI;YACjB,KAAK;gBACH,OACE,CAAC,6BAA6B,EAAED,OAAOP,OAAO,CAAC,kCAAkC,CAAC,GAClF,CAAC,CAAC,EAAE,AAACO,CAAAA,OAAOE,WAAW,GAAG,GAAE,EAAGC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEhD,KAAK;gBACH,OACE,CAAC,2CAA2C,EAAEH,OAAOI,IAAI,CAACC,MAAM,CAAC,YAAY,CAAC,GAC9E,GAAGL,OAAOI,IAAI,CAACE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhC,KAAK;gBACH,OACE,2EACA,GAAGN,OAAOO,gBAAgB,CAACD,IAAI,CAAC,MAAM,CAAC,CAAC;YAE5C;gBACE,OAAO;QACX;IACF;AACF"}

package/src/lib/server/billing-webhook.js

@@ -23,7 +23,10 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
 // the surviving half of "four server events ship to nothing" now that the
 // Measurement Protocol credentials have landed (2026-08-17).
 import { after } from "next/server";
-import { firebaseAdmin, sendGa4Purchase, sendGa4Refund, clearConnectPayoutFailure, recordConnectPayoutFailure, syncConnectAccountStatus } from "@aglyn/tenant-data-admin";
+import { paymentRiskEventFrom } from "@aglyn/aglyn/app-utils/payment-risk";
+import { recordPaymentRiskOnRecord } from "@aglyn/tenant-data-admin/server/payment-risk-record";
+import { firebaseAdmin, notifyStaff, sendGa4Purchase, sendGa4Refund, clearConnectPayoutFailure, recordConnectPayoutFailure, syncConnectAccountStatus } from "@aglyn/tenant-data-admin";
+import { screenMarketplaceSale } from "./sale-risk.js";
 /** Stripe failures a redelivery can actually fix. */ function isTransientStripeStatus(status) {
     return status === 429 || status >= 500;
 }
@@ -707,6 +710,43 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     // Recorded and surfaced, never retried: Stripe runs its own retry schedule
     // and a second transfer against an account that just refused one is how a
     // duplicate lands.
+    // A CARD FRAUD SIGNAL ON A MARKETPLACE SALE (AGL-3365).
+    //
+    // An issuer's early fraud warning or a Radar review, landing on a charge
+    // that paid a publisher. The purchase carries the signal (the same
+    // `paymentRisk` field an order or booking carries), and the claim names the
+    // PUBLISHER's workspace, so the platform route counts it on the seller's
+    // ledger against the org that was paid — never the buyer's workspace,
+    // whose card it may have been. Nobody is notified per signal: the
+    // publisher cannot refund a charge the platform is merchant of record for,
+    // and staff hear through the seller pattern and the sale-risk row.
+    // Disputes keep their own section below, which claims them the same way.
+    if (type === 'radar.early_fraud_warning.created' || type === 'review.opened') {
+        var _purchase_get;
+        const risk = paymentRiskEventFrom(type, object);
+        if (!(risk == null ? void 0 : risk.paymentIntentId)) return;
+        const firestore = firebaseAdmin.app().firestore();
+        const purchases = await firestore.collection('marketplacePurchases').where('paymentIntentId', '==', risk.paymentIntentId).limit(1).get();
+        if (purchases.empty) return;
+        const purchase = purchases.docs[0];
+        await recordPaymentRiskOnRecord({
+            ref: purchase.ref,
+            signal: risk.signal,
+            hostId: '',
+            subjectLabel: 'Marketplace sale',
+            link: '/admin/abuse-reports',
+            notificationType: 'marketplace.review'
+        }, {
+            firestore,
+            notify: async ()=>undefined
+        });
+        const sellerOrgId = String((_purchase_get = purchase.get('sellerOrgId')) != null ? _purchase_get : '');
+        return _extends({
+            claimed: true
+        }, sellerOrgId ? {
+            orgId: sellerOrgId
+        } : {});
+    }
     if (type === 'payout.failed' || type === 'transfer.failed') {
         var _ref1, _ref2, _ref3;
         var _object_destination;
@@ -879,6 +919,29 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
                     stripeCustomerId: String((_ref1 = object == null ? void 0 : object.customer) != null ? _ref1 : '') || String(buyerUid)
                 }).catch(()=>undefined);
             });
+            // The sale's fraud shape (AGL-3365): the publisher paying itself, one
+            // card buying for several workspaces, a brand-new publisher's large
+            // sale — and a young publisher's payouts held. Once per sale, after the
+            // response like the GA hit: it reads and files, and the sale it reads
+            // is already recorded. `screenMarketplaceSale` never throws.
+            if (!alreadyRecorded) {
+                after(()=>{
+                    var _ref;
+                    return screenMarketplaceSale({
+                        purchaseRef,
+                        sessionId: String(object.id),
+                        buyerUid: String(buyerUid),
+                        buyerOrgId: buyerOrgId ? String(buyerOrgId) : null,
+                        sellerOrgId: String(sellerOrgId),
+                        amountCents: grossCents - taxCents,
+                        paymentIntentId: String((_ref = object == null ? void 0 : object.payment_intent) != null ? _ref : ''),
+                        livemode: (event == null ? void 0 : event.livemode) === true
+                    }, {
+                        stripeKey: process.env.STRIPE_SECRET_KEY,
+                        notify: notifyStaff
+                    }).catch(()=>undefined);
+                });
+            }
             // A refund or a lost dispute that arrived before this document existed
             // is applied NOW (AGL-2148) — revocation, GA and the transfer reversal,
             // by the same function the refund door uses. Last on this path, and
@@ -1008,14 +1071,17 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
         // purpose: a dispute carrying no payment intent cannot be joined to a
         // purchase, which is a fault, not a routine miss.
         let claimed = false;
+        // The publisher the disputed sale paid (AGL-3365), for the seller ledger.
+        let sellerOrgId = '';
         if (disputeId && paymentIntentId) {
             var _ref24;
             const firestore = firebaseAdmin.app().firestore();
             const purchases = await firestore.collection('marketplacePurchases').where('paymentIntentId', '==', paymentIntentId).limit(1).get();
             if (!purchases.empty) {
-                var _ref25;
+                var _purchase_get1, _ref25;
                 claimed = true;
                 const purchase = purchases.docs[0];
+                sellerOrgId = String((_purchase_get1 = purchase.get('sellerOrgId')) != null ? _purchase_get1 : '');
                 const status = String((_ref25 = object == null ? void 0 : object.status) != null ? _ref25 : '');
                 if (type === 'charge.dispute.created') {
                     await purchase.ref.set({
@@ -1065,9 +1131,11 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
                 claimed = await recordDisputeOrphanIfMarketplace(firestore, object, paymentIntentId);
             }
         }
-        return {
+        return _extends({
             claimed
-        };
+        }, claimed && sellerOrgId ? {
+            orgId: sellerOrgId
+        } : {});
     }
 };