@aglyn/plugins-marketplace 1.2.0 → 1.3.0

package/src/lib/server/billing-webhook.js

@@ -27,6 +27,7 @@ import { paymentRiskEventFrom } from "@aglyn/aglyn/app-utils/payment-risk";
 import { recordPaymentRiskOnRecord } from "@aglyn/tenant-data-admin/server/payment-risk-record";
 import { firebaseAdmin, notifyRiskEvent, sendGa4Purchase, sendGa4Refund } from "@aglyn/tenant-data-admin";
 import { paymentProvider } from "@aglyn/tenant-data-admin/server/payment-provider";
+import { invoicePaymentIntentId, invoiceTaxCents, isMarketplaceInvoice } from "../model/marketplace-invoice.js";
 import { screenMarketplaceSale } from "./sale-risk.js";
 /** Stripe failures a redelivery can actually fix. */ function isTransientStripeStatus(status) {
     return status === 429 || status >= 500;
@@ -54,9 +55,7 @@ import { screenMarketplaceSale } from "./sale-risk.js";
  * Null when the session states no country. An unstated jurisdiction is COUNTED
  * by the return (`rowsMissingJurisdiction`) and never inferred: a jurisdiction
  * reconstructed after the fact is a guess handed to a tax authority as a fact.
- */ function buyerTaxJurisdiction(object) {
-    var _object_customer_details;
-    const address = object == null ? void 0 : (_object_customer_details = object.customer_details) == null ? void 0 : _object_customer_details.address;
+ */ function buyerTaxJurisdiction(address) {
     const country = typeof (address == null ? void 0 : address.country) === 'string' ? address.country.trim() : '';
     if (!country) return null;
     const state = typeof (address == null ? void 0 : address.state) === 'string' ? address.state.trim() : '';
@@ -93,6 +92,17 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     if (snapshot.get('reversedTransferCents') != null) return;
     const causeAmountCents = Math.round(Number((_ref1 = cause == null ? void 0 : cause.amountCents) != null ? _ref1 : 0));
     if (!(causeAmountCents > 0)) return;
+    // NOBODY WAS PAID (AGL-4049): a sale by the platform's own org. There is no
+    // transfer to pull back, and that is the sale working, so it settles here
+    // rather than landing in the recovery queue as a share that was lost.
+    if (snapshot.get('transferCents') === 0) {
+        await purchaseRef.set({
+            reversedTransferCents: 0
+        }, {
+            merge: true
+        });
+        return;
+    }
     const stripeKey = process.env.STRIPE_SECRET_KEY;
     if (!stripeKey) {
         console.error('Marketplace transfer reversal skipped: STRIPE_SECRET_KEY is not set (AGL-1554)');
@@ -340,8 +350,17 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     if (!(chargeAmountCents > 0) || !(refundedCents > 0)) return;
     const transferId = String((_ref2 = (_charge_body2 = charge.body) == null ? void 0 : _charge_body2.transfer) != null ? _ref2 : '');
     if (!transferId) {
-        // No destination transfer means no seller share to pull back — a
+        // No destination transfer means no seller share to pull back. A sale by
+        // the platform's own org has none by design (AGL-4049), and what the
+        // buyer had back is still recorded for the revenue report; any other
         // marketplace charge always has one, so this is a charge we do not own.
+        if (snapshot.get('transferCents') === 0) {
+            await purchaseRef.set({
+                partialRefundedCents: refundedCents
+            }, {
+                merge: true
+            });
+        }
         return;
     }
     const transfer = await stripeGet(`https://api.stripe.com/v1/transfers/${transferId}`, stripeKey);
@@ -675,6 +694,200 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     // exactly what the route's unattributed alert exists to catch.
     return true;
 }
+/**
+ * Writes one sale's purchase document, the buyer's entitlement, the seller
+ * ledger and the tax row, and everything that follows it: the GA hit, the
+ * sale's fraud screen and the drain of any refund that got here first.
+ *
+ * ONE function for both doors (AGL-4049), so a sale paid in the console and one
+ * paid at the hosted checkout are the same document, and `hasLivePurchase`,
+ * the seller ledger and the refund doors cannot tell them apart. Keyed by the
+ * object that paid, and idempotent: a redelivery changes nothing.
+ */ async function recordMarketplacePurchase(sale) {
+    const { recordId, metadata, grossCents, taxCents, jurisdiction, paymentIntentId, currency, stripeCustomerId, livemode } = sale;
+    // Sellers are orgs (AGL-652) — the ledger records which ORG earned it.
+    const { listingId, buyerUid, buyerOrgId, sellerOrgId, feeCents, transferCents } = metadata;
+    if (listingId && buyerUid && sellerOrgId) {
+        // The remittance-correct split (AGL-1544), read ONCE and used by both
+        // the ledger and the GA hit (AGL-1639) — the two must not be able to
+        // describe the same sale differently.
+        //
+        // `amount_total` is the tax-inclusive GROSS the buyer paid. Out of it:
+        // `taxCents` is what the PLATFORM owes the state (collected under the
+        // marketplace-provider registration, never ours), and `sellerCents` is
+        // the fixed transfer the seller's Connect account received (their
+        // share of the pre-tax price). What is left is what Aglyn keeps.
+        const sellerCents = Number(transferCents != null ? transferCents : 0);
+        const netCents = grossCents - taxCents - sellerCents;
+        const purchaseRef = firebaseAdmin.app().firestore().collection('marketplacePurchases').doc(recordId);
+        // `createdAt` is stamped ONCE (AGL-2109). Merging the write below fixed
+        // the erasure but introduced its own drift: `serverTimestamp()` on a
+        // redelivery would move a three-day-old sale to today, which is the
+        // field the seller ledger and every revenue period read. One read, on a
+        // path that already makes several Stripe round trips, buys a date that
+        // means what it says.
+        const alreadyRecorded = (await purchaseRef.get()).exists;
+        await purchaseRef.set(_extends({
+            listingId,
+            buyerUid
+        }, buyerOrgId ? {
+            buyerOrgId: String(buyerOrgId)
+        } : {}, {
+            sellerOrgId,
+            // Gross − tax − transfer = the platform fee, which feeCents also
+            // records independently from the rate resolved at checkout.
+            amountCents: grossCents,
+            feeCents: Number(feeCents != null ? feeCents : 0),
+            taxCents,
+            transferCents: sellerCents,
+            // The refund trail (AGL-1546): `charge.refunded` carries the
+            // payment intent, not the session — without this id a refund
+            // could never find the purchase it revokes.
+            paymentIntentId
+        }, alreadyRecorded ? {} : _extends({
+            createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+        }, jurisdiction ? {
+            customerAddress: jurisdiction
+        } : {}, {
+            // WHAT THE LICENSES TAB QUERIES BY (AGL-3321), explicit from
+            // the first record. A query cannot ask for an ABSENT field,
+            // so "not refunded" is `refundedAt == null` and "licenses no
+            // workspace in particular" is `buyerOrgId == null` — both
+            // only reach a document that carries the null. Here, in the
+            // first-record branch, and nowhere else: a redelivery landing
+            // after a refund must never write `refundedAt` back to null,
+            // which would hand the refunded buyer their install back.
+            refundedAt: null
+        }, buyerOrgId ? {} : {
+            buyerOrgId: null
+        })), // MERGED, like every other write on this path (AGL-2109). This one
+        // was a full document REPLACE, and the document it replaces is not
+        // only the sale: it is the buyer's ENTITLEMENT (`hasLivePurchase`
+        // reads `refundedAt`), the refund trail, the dispute trail, and the
+        // transfer-reversal SETTLE MARKER (`reversedTransferCents`, which
+        // `reverseMarketplaceSellerShare` short-circuits on so a publisher is
+        // never debited twice).
+        //
+        // Stripe redelivers `checkout.session.completed` for up to three days
+        // after any 500, and this endpoint 500s on purpose — for every
+        // transient Stripe failure raised in this file and for any throw from
+        // a sibling plugin handler that runs after this one
+        // (`runBillingWebhookHandlers` awaits them in sequence and lets a
+        // throw propagate). So the redelivery is expected traffic, not an
+        // exotic race. Landing after a refund it erased `refundedAt` — the
+        // refunded buyer silently got their install back — and erased
+        // `reversedTransferCents`, re-opening a second reversal against the
+        // publisher's Connect account.
+        //
+        // Merging is safe in the other direction too: every field written
+        // here is derived from the session event, so a redelivery restamps
+        // identical values.
+        {
+            merge: true
+        });
+        // Marketplace sales are real revenue and belong in the same GA
+        // `purchase` stream as subscriptions (AGL-1561), separated by
+        // `item_category` so plugin revenue and subscription revenue can be
+        // read apart or together.
+        //
+        // After the ledger write, and fire-and-forget: the ledger is what
+        // grants the install entitlement, and an analytics failure must never
+        // throw here — the route deletes its idempotency claim on any throw,
+        // which would make Stripe redeliver a purchase that already landed.
+        //
+        // `transaction_id` is the checkout session id — the same key the
+        // ledger doc uses — so GA de-duplicates a redelivery exactly as
+        // Firestore does.
+        // WHAT COUNTS AS REVENUE ON A MARKETPLACE SALE (AGL-1639)
+        //
+        // Our NET — the platform fee — and not the gross the buyer paid.
+        // Decided once here rather than inferred from whichever Stripe field
+        // was nearest, because the three candidates are genuinely different
+        // numbers:
+        //
+        //   gross incl. tax  reconciles with nothing we own
+        //   GMV ex-tax       what the SELLERS earned, not what we did
+        //   platform net     our books, our MRR, our balance     ← this one
+        //
+        // This is *our* GA property and every other number in it is ours;
+        // subscription `purchase` already reports what Aglyn was paid, and
+        // marketplace revenue has to mean the same thing or the combined
+        // total, ARPA and every revenue-based audience are nonsense. The two
+        // stay separable by `item_category`.
+        //
+        // Tax is excluded rather than folded in, and is deliberately NOT sent
+        // as GA4's `tax` param either: `value` is our fee, so a `tax` beside
+        // it would not be a component of it, and asserting in GA that Aglyn
+        // took this tax is exactly the question the publisher agreement's
+        // seller-of-record clause has open. The ledger doc above keeps the
+        // full split for anyone who needs it.
+        after(()=>sendGa4Purchase({
+                transactionId: recordId,
+                value: netCents / 100,
+                currency,
+                items: [
+                    {
+                        item_id: String(listingId),
+                        // The listing id, not the display name: a listing's name is
+                        // seller-authored free text and is not worth risking in a
+                        // dimension when the id already identifies it.
+                        item_name: String(listingId),
+                        item_category: 'marketplace',
+                        // GA expects the items to sum to `value`; one item, one price.
+                        price: netCents / 100,
+                        quantity: 1
+                    }
+                ],
+                clientId: metadata['ga_client_id'],
+                stripeCustomerId: stripeCustomerId || String(buyerUid)
+            }).catch(()=>undefined));
+        // The sale's fraud shape (AGL-3365): the publisher paying itself, one
+        // card buying for several workspaces, a brand-new publisher's large
+        // sale — and a young publisher's payouts held. Once per sale, after the
+        // response like the GA hit: it reads and files, and the sale it reads
+        // is already recorded. `screenMarketplaceSale` never throws.
+        if (!alreadyRecorded) {
+            after(()=>screenMarketplaceSale({
+                    purchaseRef,
+                    sessionId: recordId,
+                    buyerUid: String(buyerUid),
+                    buyerOrgId: buyerOrgId ? String(buyerOrgId) : null,
+                    sellerOrgId: String(sellerOrgId),
+                    amountCents: grossCents - taxCents,
+                    paymentIntentId,
+                    livemode
+                }, {
+                    stripeKey: process.env.STRIPE_SECRET_KEY,
+                    notifyRisk: notifyRiskEvent
+                }).catch(()=>undefined));
+        }
+        // A refund or a lost dispute that arrived before this document existed
+        // is applied NOW (AGL-2148) — revocation, GA and the transfer reversal,
+        // by the same function the refund door uses. Last on this path, and
+        // awaited: it can throw on a transient Stripe failure, which is exactly
+        // the redelivery this branch is already idempotent under.
+        await drainMarketplaceRefundOrphan(firebaseAdmin.app().firestore(), purchaseRef, paymentIntentId);
+    }
+}
+/**
+ * A paid marketplace invoice, recorded (AGL-4049). `amount_paid` is the
+ * tax-inclusive gross, as a session's `amount_total` is, and `customer_address`
+ * is the address Stripe computed the tax from, frozen at finalize.
+ */ export async function recordMarketplaceInvoicePurchase(invoice) {
+    var _ref, _ref1, _ref2, _ref3, _ref4;
+    const customer = invoice == null ? void 0 : invoice.customer;
+    await recordMarketplacePurchase({
+        recordId: String((_ref = invoice == null ? void 0 : invoice.id) != null ? _ref : ''),
+        metadata: (_ref1 = invoice == null ? void 0 : invoice.metadata) != null ? _ref1 : {},
+        grossCents: Number((_ref2 = invoice == null ? void 0 : invoice.amount_paid) != null ? _ref2 : 0),
+        taxCents: invoiceTaxCents(invoice),
+        jurisdiction: buyerTaxJurisdiction(invoice == null ? void 0 : invoice.customer_address),
+        paymentIntentId: invoicePaymentIntentId(invoice),
+        currency: String((_ref3 = invoice == null ? void 0 : invoice.currency) != null ? _ref3 : 'usd'),
+        stripeCustomerId: String(typeof customer === 'string' ? customer : (_ref4 = customer == null ? void 0 : customer.id) != null ? _ref4 : ''),
+        livemode: (invoice == null ? void 0 : invoice.livemode) === true
+    });
+}
 /**
  * Marketplace-purchase section of the platform Stripe webhook (AGL-46/418):
  * keyed by session id (idempotent on Stripe redelivery) — relocated
@@ -744,184 +957,29 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     // Marketplace purchases (AGL-46): keyed by session id (idempotent on
     // Stripe redelivery). Install gating and the seller ledger read these.
     if (type === 'checkout.session.completed' && (object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.type) === 'marketplace-purchase' && (object == null ? void 0 : object.payment_status) === 'paid') {
-        var _object_metadata1;
-        // Sellers are orgs (AGL-652) — the ledger records which ORG earned it.
-        const { listingId, buyerUid, buyerOrgId, sellerOrgId, feeCents, transferCents } = (_object_metadata1 = object.metadata) != null ? _object_metadata1 : {};
-        if (listingId && buyerUid && sellerOrgId) {
-            var _ref1, _ref2, _ref3, _ref4;
-            var _object_total_details;
-            // The remittance-correct split (AGL-1544), read ONCE and used by both
-            // the ledger and the GA hit (AGL-1639) — the two must not be able to
-            // describe the same sale differently.
-            //
-            // `amount_total` is the tax-inclusive GROSS the buyer paid. Out of it:
-            // `taxCents` is what the PLATFORM owes the state (collected under the
-            // marketplace-provider registration, never ours), and `sellerCents` is
-            // the fixed transfer the seller's Connect account received (their
-            // share of the pre-tax price). What is left is what Aglyn keeps.
-            const grossCents = Number((_ref1 = object == null ? void 0 : object.amount_total) != null ? _ref1 : 0);
-            const taxCents = Number((_ref2 = object == null ? void 0 : (_object_total_details = object.total_details) == null ? void 0 : _object_total_details.amount_tax) != null ? _ref2 : 0);
-            const sellerCents = Number(transferCents != null ? transferCents : 0);
-            const netCents = grossCents - taxCents - sellerCents;
-            // WHERE that tax is owed. Read from the session Stripe computed it
-            // from — see `buyerTaxJurisdiction`.
-            const jurisdiction = buyerTaxJurisdiction(object);
-            const purchaseRef = firebaseAdmin.app().firestore().collection('marketplacePurchases').doc(String(object.id));
-            // `createdAt` is stamped ONCE (AGL-2109). Merging the write below fixed
-            // the erasure but introduced its own drift: `serverTimestamp()` on a
-            // redelivery would move a three-day-old sale to today, which is the
-            // field the seller ledger and every revenue period read. One read, on a
-            // path that already makes several Stripe round trips, buys a date that
-            // means what it says.
-            const alreadyRecorded = (await purchaseRef.get()).exists;
-            await purchaseRef.set(_extends({
-                listingId,
-                buyerUid
-            }, buyerOrgId ? {
-                buyerOrgId: String(buyerOrgId)
-            } : {}, {
-                sellerOrgId,
-                // Gross − tax − transfer = the platform fee, which feeCents also
-                // records independently from the rate resolved at checkout.
-                amountCents: grossCents,
-                feeCents: Number(feeCents != null ? feeCents : 0),
-                taxCents,
-                transferCents: sellerCents,
-                // The refund trail (AGL-1546): `charge.refunded` carries the
-                // payment intent, not the session — without this id a refund
-                // could never find the purchase it revokes.
-                paymentIntentId: String((_ref3 = object == null ? void 0 : object.payment_intent) != null ? _ref3 : '')
-            }, alreadyRecorded ? {} : _extends({
-                createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
-            }, jurisdiction ? {
-                customerAddress: jurisdiction
-            } : {}, {
-                // WHAT THE LICENSES TAB QUERIES BY (AGL-3321), explicit from
-                // the first record. A query cannot ask for an ABSENT field,
-                // so "not refunded" is `refundedAt == null` and "licenses no
-                // workspace in particular" is `buyerOrgId == null` — both
-                // only reach a document that carries the null. Here, in the
-                // first-record branch, and nowhere else: a redelivery landing
-                // after a refund must never write `refundedAt` back to null,
-                // which would hand the refunded buyer their install back.
-                refundedAt: null
-            }, buyerOrgId ? {} : {
-                buyerOrgId: null
-            })), // MERGED, like every other write on this path (AGL-2109). This one
-            // was a full document REPLACE, and the document it replaces is not
-            // only the sale: it is the buyer's ENTITLEMENT (`hasLivePurchase`
-            // reads `refundedAt`), the refund trail, the dispute trail, and the
-            // transfer-reversal SETTLE MARKER (`reversedTransferCents`, which
-            // `reverseMarketplaceSellerShare` short-circuits on so a publisher is
-            // never debited twice).
-            //
-            // Stripe redelivers `checkout.session.completed` for up to three days
-            // after any 500, and this endpoint 500s on purpose — for every
-            // transient Stripe failure raised in this file and for any throw from
-            // a sibling plugin handler that runs after this one
-            // (`runBillingWebhookHandlers` awaits them in sequence and lets a
-            // throw propagate). So the redelivery is expected traffic, not an
-            // exotic race. Landing after a refund it erased `refundedAt` — the
-            // refunded buyer silently got their install back — and erased
-            // `reversedTransferCents`, re-opening a second reversal against the
-            // publisher's Connect account.
-            //
-            // Merging is safe in the other direction too: every field written
-            // here is derived from the session event, so a redelivery restamps
-            // identical values.
-            {
-                merge: true
-            });
-            // Marketplace sales are real revenue and belong in the same GA
-            // `purchase` stream as subscriptions (AGL-1561), separated by
-            // `item_category` so plugin revenue and subscription revenue can be
-            // read apart or together.
-            //
-            // After the ledger write, and fire-and-forget: the ledger is what
-            // grants the install entitlement, and an analytics failure must never
-            // throw here — the route deletes its idempotency claim on any throw,
-            // which would make Stripe redeliver a purchase that already landed.
-            //
-            // `transaction_id` is the checkout session id — the same key the
-            // ledger doc uses — so GA de-duplicates a redelivery exactly as
-            // Firestore does.
-            // WHAT COUNTS AS REVENUE ON A MARKETPLACE SALE (AGL-1639)
-            //
-            // Our NET — the platform fee — and not the gross the buyer paid.
-            // Decided once here rather than inferred from whichever Stripe field
-            // was nearest, because the three candidates are genuinely different
-            // numbers:
-            //
-            //   gross incl. tax  reconciles with nothing we own
-            //   GMV ex-tax       what the SELLERS earned, not what we did
-            //   platform net     our books, our MRR, our balance     ← this one
-            //
-            // This is *our* GA property and every other number in it is ours;
-            // subscription `purchase` already reports what Aglyn was paid, and
-            // marketplace revenue has to mean the same thing or the combined
-            // total, ARPA and every revenue-based audience are nonsense. The two
-            // stay separable by `item_category`.
-            //
-            // Tax is excluded rather than folded in, and is deliberately NOT sent
-            // as GA4's `tax` param either: `value` is our fee, so a `tax` beside
-            // it would not be a component of it, and asserting in GA that Aglyn
-            // took this tax is exactly the question the publisher agreement's
-            // seller-of-record clause has open. The ledger doc above keeps the
-            // full split for anyone who needs it.
-            after(()=>{
-                var _ref, _ref1;
-                var _object_metadata;
-                return sendGa4Purchase({
-                    transactionId: String(object.id),
-                    value: netCents / 100,
-                    currency: String((_ref = object == null ? void 0 : object.currency) != null ? _ref : 'usd'),
-                    items: [
-                        {
-                            item_id: String(listingId),
-                            // The listing id, not the display name: a listing's name is
-                            // seller-authored free text and is not worth risking in a
-                            // dimension when the id already identifies it.
-                            item_name: String(listingId),
-                            item_category: 'marketplace',
-                            // GA expects the items to sum to `value`; one item, one price.
-                            price: netCents / 100,
-                            quantity: 1
-                        }
-                    ],
-                    clientId: object == null ? void 0 : (_object_metadata = object.metadata) == null ? void 0 : _object_metadata.ga_client_id,
-                    stripeCustomerId: String((_ref1 = object == null ? void 0 : object.customer) != null ? _ref1 : '') || String(buyerUid)
-                }).catch(()=>undefined);
-            });
-            // The sale's fraud shape (AGL-3365): the publisher paying itself, one
-            // card buying for several workspaces, a brand-new publisher's large
-            // sale — and a young publisher's payouts held. Once per sale, after the
-            // response like the GA hit: it reads and files, and the sale it reads
-            // is already recorded. `screenMarketplaceSale` never throws.
-            if (!alreadyRecorded) {
-                after(()=>{
-                    var _ref;
-                    return screenMarketplaceSale({
-                        purchaseRef,
-                        sessionId: String(object.id),
-                        buyerUid: String(buyerUid),
-                        buyerOrgId: buyerOrgId ? String(buyerOrgId) : null,
-                        sellerOrgId: String(sellerOrgId),
-                        amountCents: grossCents - taxCents,
-                        paymentIntentId: String((_ref = object == null ? void 0 : object.payment_intent) != null ? _ref : ''),
-                        livemode: (event == null ? void 0 : event.livemode) === true
-                    }, {
-                        stripeKey: process.env.STRIPE_SECRET_KEY,
-                        notifyRisk: notifyRiskEvent
-                    }).catch(()=>undefined);
-                });
-            }
-            // A refund or a lost dispute that arrived before this document existed
-            // is applied NOW (AGL-2148) — revocation, GA and the transfer reversal,
-            // by the same function the refund door uses. Last on this path, and
-            // awaited: it can throw on a transient Stripe failure, which is exactly
-            // the redelivery this branch is already idempotent under.
-            await drainMarketplaceRefundOrphan(firebaseAdmin.app().firestore(), purchaseRef, String((_ref4 = object == null ? void 0 : object.payment_intent) != null ? _ref4 : ''));
-        }
+        var _object_metadata1, _ref1, _ref2, _ref3, _ref4, _ref5;
+        var _object_total_details, _object_customer_details;
+        // `amount_total` is the tax-inclusive GROSS the buyer paid. WHERE the tax
+        // is owed is read from the session Stripe computed it from — see
+        // `buyerTaxJurisdiction`.
+        await recordMarketplacePurchase({
+            recordId: String(object.id),
+            metadata: (_object_metadata1 = object.metadata) != null ? _object_metadata1 : {},
+            grossCents: Number((_ref1 = object == null ? void 0 : object.amount_total) != null ? _ref1 : 0),
+            taxCents: Number((_ref2 = object == null ? void 0 : (_object_total_details = object.total_details) == null ? void 0 : _object_total_details.amount_tax) != null ? _ref2 : 0),
+            jurisdiction: buyerTaxJurisdiction(object == null ? void 0 : (_object_customer_details = object.customer_details) == null ? void 0 : _object_customer_details.address),
+            paymentIntentId: String((_ref3 = object == null ? void 0 : object.payment_intent) != null ? _ref3 : ''),
+            currency: String((_ref4 = object == null ? void 0 : object.currency) != null ? _ref4 : 'usd'),
+            stripeCustomerId: String((_ref5 = object == null ? void 0 : object.customer) != null ? _ref5 : ''),
+            livemode: (event == null ? void 0 : event.livemode) === true
+        });
+    }
+    // The same purchase, paid in the console (AGL-4049). `pay.ts` has usually
+    // written it already; this is the record of every other way the invoice
+    // gets paid (the bank's step finishing after the tab closed, Billing's own
+    // Pay button), and it lands on the same document.
+    if (type === 'invoice.paid' && isMarketplaceInvoice(object)) {
+        await recordMarketplaceInvoicePurchase(object);
     }
     // Refund revocation (AGL-1546): a FULL refund un-buys the listing —
     // the install gate treats a purchase with `refundedAt` as absent. Only
@@ -931,10 +989,10 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     // values on the same doc. Requires the platform webhook endpoint to be
     // subscribed to `charge.refunded` (AGL-1549).
     if (type === 'charge.refunded' && (object == null ? void 0 : object.refunded) === true) {
-        var _ref5;
-        const paymentIntentId = String((_ref5 = object == null ? void 0 : object.payment_intent) != null ? _ref5 : '');
+        var _ref6;
+        const paymentIntentId = String((_ref6 = object == null ? void 0 : object.payment_intent) != null ? _ref6 : '');
         if (paymentIntentId) {
-            var _ref6, _ref7, _ref8, _ref9, _ref10;
+            var _ref7, _ref8, _ref9, _ref10, _ref11;
             var _object_metadata2;
             const firestore = firebaseAdmin.app().firestore();
             const purchases = await firestore.collection('marketplacePurchases').where('paymentIntentId', '==', paymentIntentId).limit(1).get();
@@ -945,12 +1003,12 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
                 kind: 'refund',
                 // `charge.refunded` carries the CHARGE, so the charge id is both the
                 // cause id and the chargeId — unchanged from AGL-1995.
-                id: String((_ref6 = object == null ? void 0 : object.id) != null ? _ref6 : ''),
+                id: String((_ref7 = object == null ? void 0 : object.id) != null ? _ref7 : ''),
                 paymentIntentId,
-                amountCents: Math.round(Number((_ref7 = object == null ? void 0 : object.amount_refunded) != null ? _ref7 : 0)),
-                chargeId: String((_ref8 = object == null ? void 0 : object.id) != null ? _ref8 : ''),
-                currency: String((_ref9 = object == null ? void 0 : object.currency) != null ? _ref9 : 'usd'),
-                stripeCustomerId: String((_ref10 = object == null ? void 0 : object.customer) != null ? _ref10 : '')
+                amountCents: Math.round(Number((_ref8 = object == null ? void 0 : object.amount_refunded) != null ? _ref8 : 0)),
+                chargeId: String((_ref9 = object == null ? void 0 : object.id) != null ? _ref9 : ''),
+                currency: String((_ref10 = object == null ? void 0 : object.currency) != null ? _ref10 : 'usd'),
+                stripeCustomerId: String((_ref11 = object == null ? void 0 : object.customer) != null ? _ref11 : '')
             };
             if (!purchases.empty) {
                 // The publisher's share comes back (AGL-1995), the entitlement is
@@ -993,28 +1051,28 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     // marketplace purchase, that join is already the proof, and demanding the
     // metadata as well would skip every charge predating the AGL-2148 stamp.
     if (type === 'charge.refunded' && (object == null ? void 0 : object.refunded) !== true && Math.round(Number((_ref = object == null ? void 0 : object.amount_refunded) != null ? _ref : 0)) > 0) {
-        var _ref11;
-        const paymentIntentId = String((_ref11 = object == null ? void 0 : object.payment_intent) != null ? _ref11 : '');
+        var _ref12;
+        const paymentIntentId = String((_ref12 = object == null ? void 0 : object.payment_intent) != null ? _ref12 : '');
         if (paymentIntentId) {
             var _object_metadata3;
             const firestore = firebaseAdmin.app().firestore();
             const purchases = await firestore.collection('marketplacePurchases').where('paymentIntentId', '==', paymentIntentId).limit(1).get();
             if (!purchases.empty) {
-                var _ref12;
-                await reverseMarketplacePartialRefundShare(purchases.docs[0].ref, String((_ref12 = object == null ? void 0 : object.id) != null ? _ref12 : ''));
+                var _ref13;
+                await reverseMarketplacePartialRefundShare(purchases.docs[0].ref, String((_ref13 = object == null ? void 0 : object.id) != null ? _ref13 : ''));
             } else if ((object == null ? void 0 : (_object_metadata3 = object.metadata) == null ? void 0 : _object_metadata3.type) === 'marketplace-purchase') {
-                var _ref13, _ref14, _ref15, _ref16, _ref17;
+                var _ref14, _ref15, _ref16, _ref17, _ref18;
                 // The AGL-2148 window, for partials. Parked with the charge on it so
                 // the drain can recompute the target from Stripe rather than trusting
                 // a number this event carried; the amount rides along for forensics.
                 await recordRefundOrphan(firestore, {
                     kind: 'partial-refund',
-                    id: String((_ref13 = object == null ? void 0 : object.id) != null ? _ref13 : ''),
+                    id: String((_ref14 = object == null ? void 0 : object.id) != null ? _ref14 : ''),
                     paymentIntentId,
-                    amountCents: Math.round(Number((_ref14 = object == null ? void 0 : object.amount_refunded) != null ? _ref14 : 0)),
-                    chargeId: String((_ref15 = object == null ? void 0 : object.id) != null ? _ref15 : ''),
-                    currency: String((_ref16 = object == null ? void 0 : object.currency) != null ? _ref16 : 'usd'),
-                    stripeCustomerId: String((_ref17 = object == null ? void 0 : object.customer) != null ? _ref17 : '')
+                    amountCents: Math.round(Number((_ref15 = object == null ? void 0 : object.amount_refunded) != null ? _ref15 : 0)),
+                    chargeId: String((_ref16 = object == null ? void 0 : object.id) != null ? _ref16 : ''),
+                    currency: String((_ref17 = object == null ? void 0 : object.currency) != null ? _ref17 : 'usd'),
+                    stripeCustomerId: String((_ref18 = object == null ? void 0 : object.customer) != null ? _ref18 : '')
                 });
             }
         }
@@ -1036,9 +1094,9 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
     // comes back by the AGL-1794 policy. `won` and `warning_closed` record
     // the outcome and move nothing.
     if (type === 'charge.dispute.created' || type === 'charge.dispute.closed') {
-        var _ref18, _ref19;
-        const disputeId = String((_ref18 = object == null ? void 0 : object.id) != null ? _ref18 : '');
-        const paymentIntentId = String((_ref19 = object == null ? void 0 : object.payment_intent) != null ? _ref19 : '');
+        var _ref19, _ref20;
+        const disputeId = String((_ref19 = object == null ? void 0 : object.id) != null ? _ref19 : '');
+        const paymentIntentId = String((_ref20 = object == null ? void 0 : object.payment_intent) != null ? _ref20 : '');
         // Reported to the route so it can tell "marketplace handled it" from
         // "nothing handled it" (AGL-2429). Left false by the guard below on
         // purpose: a dispute carrying no payment intent cannot be joined to a
@@ -1047,15 +1105,15 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
         // The publisher the disputed sale paid (AGL-3365), for the seller ledger.
         let sellerOrgId = '';
         if (disputeId && paymentIntentId) {
-            var _ref20;
+            var _ref21;
             const firestore = firebaseAdmin.app().firestore();
             const purchases = await firestore.collection('marketplacePurchases').where('paymentIntentId', '==', paymentIntentId).limit(1).get();
             if (!purchases.empty) {
-                var _purchase_get1, _ref21;
+                var _purchase_get1, _ref22;
                 claimed = true;
                 const purchase = purchases.docs[0];
                 sellerOrgId = String((_purchase_get1 = purchase.get('sellerOrgId')) != null ? _purchase_get1 : '');
-                const status = String((_ref21 = object == null ? void 0 : object.status) != null ? _ref21 : '');
+                const status = String((_ref22 = object == null ? void 0 : object.status) != null ? _ref22 : '');
                 if (type === 'charge.dispute.created') {
                     await purchase.ref.set({
                         disputeId,
@@ -1065,7 +1123,7 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
                         merge: true
                     });
                 } else if (status === 'lost') {
-                    var _ref22, _ref23, _ref24;
+                    var _ref23, _ref24, _ref25;
                     // Revoke, report, pull the seller's share back — the same three
                     // effects the refund door applies, through the same function
                     // (AGL-2148), so the two doors and the orphan drain cannot drift.
@@ -1074,9 +1132,9 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
                         kind: 'dispute',
                         id: disputeId,
                         paymentIntentId,
-                        amountCents: Math.round(Number((_ref22 = object == null ? void 0 : object.amount) != null ? _ref22 : 0)),
-                        chargeId: String((_ref23 = object == null ? void 0 : object.charge) != null ? _ref23 : ''),
-                        currency: String((_ref24 = object == null ? void 0 : object.currency) != null ? _ref24 : 'usd'),
+                        amountCents: Math.round(Number((_ref23 = object == null ? void 0 : object.amount) != null ? _ref23 : 0)),
+                        chargeId: String((_ref24 = object == null ? void 0 : object.charge) != null ? _ref24 : ''),
+                        currency: String((_ref25 = object == null ? void 0 : object.currency) != null ? _ref25 : 'usd'),
                         // A dispute event carries no Stripe customer; the GA hit falls
                         // back to the buyer uid on the purchase, as it always has.
                         stripeCustomerId: ''
@@ -1095,7 +1153,7 @@ async function reverseMarketplaceSellerShare(purchaseRef, cause) {
                         merge: true
                     });
                 }
-            } else if (type === 'charge.dispute.closed' && String((_ref20 = object == null ? void 0 : object.status) != null ? _ref20 : '') === 'lost') {
+            } else if (type === 'charge.dispute.closed' && String((_ref21 = object == null ? void 0 : object.status) != null ? _ref21 : '') === 'lost') {
                 // The refund branch's window, by the bank's door (AGL-2148): only a
                 // LOST closed dispute moves money, so only that state is worth
                 // parking. A `created` landing in the same window loses nothing but