@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/ga4-measurement-protocol.js

@@ -0,0 +1,558 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { sanitizeEventParams } from "@aglyn/aglyn/app-utils/analytics-events";
+// One definition for a pair of strings that has to agree with a setting in the
+// GA UI nothing here can typecheck against (AGL-1582/AGL-2064). Four surfaces
+// stamp them now — the console, the tenant runtime, the docs site, and this
+// one — and a second spelling would read as a different dimension in GA, so
+// the filter would catch three of them and look like it was working.
+import { INTERNAL_TRAFFIC_PARAM, INTERNAL_TRAFFIC_VALUE } from "@aglyn/aglyn/app-utils/internal-traffic";
+/**
+ * Server-to-server GA4 delivery via the Measurement Protocol (AGL-1561) —
+ * `purchase`, and the one activation event no browser can witness.
+ *
+ * ## Why revenue is sent from the server and nothing else is
+ *
+ * The obvious alternative is a client-side `purchase` on the post-checkout
+ * return page. It is simpler, and it is wrong for money:
+ *
+ * - **The return page is not reached reliably.** Stripe redirects back after
+ *   payment, and a customer who closes the tab, loses signal, or gets a bank
+ *   3DS interstitial that lands somewhere else has still paid us. Their
+ *   revenue would simply never appear.
+ * - **Ad blockers drop it**, and they are over-represented in exactly the
+ *   developer audience Aglyn sells to. Under-reported revenue is worse than
+ *   no revenue reporting, because it looks like data.
+ * - **`?status=success` carries no amount and no session id** (verified: the
+ *   hosted checkout return URL sets only `status`, and nothing in the app
+ *   reads it), so a client event could not state what was actually charged.
+ *   It would also re-fire on a refresh or a back-navigation.
+ * - The authoritative amount, currency and transaction id already exist,
+ *   server-side, in the Stripe webhook — the same place the subscription
+ *   mirror is written. Reporting revenue from anywhere else means reporting
+ *   a second, weaker version of a number we already hold.
+ *
+ * `begin_checkout` stays client-side, because intent genuinely is a browser
+ * event and its loss to an ad blocker costs a funnel step, not a dollar.
+ *
+ * ## The second sender: `site_published` from a scheduled publish (AGL-1589)
+ *
+ * Everything above argues for keeping the server-side surface as small as
+ * possible, and {@link sendGa4SitePublished} is the one other event that has
+ * no browser to fire it: a SCHEDULED publish is applied by a cron beat (or by
+ * an ISR regeneration) at a moment when the author is asleep. Until AGL-1589
+ * that path could not make a page reachable at all, so it was not an
+ * activation and nothing was sent; now that it registers the routing entry, a
+ * scheduled FIRST publish is a route going live and `publishScreenRoute`'s
+ * client-side `site_published` — the headline activation metric — would miss
+ * it. It is sent HERE for the same reason revenue is: the alternative is not
+ * a weaker event, it is no event.
+ *
+ * The rest of the activation funnel stays client-side. This is not a general
+ * server-side analytics channel and should not become one.
+ *
+ * ## The `client_id` problem, stated plainly
+ *
+ * The Measurement Protocol REQUIRES a `client_id`, and a server has no way to
+ * know the browser's. Whatever is supplied decides whether the purchase joins
+ * the user's existing GA session — and therefore whether revenue can be
+ * attributed to the campaign that produced it, which is the entire point of
+ * the exercise.
+ *
+ * So the browser's real `client_id` is captured when checkout STARTS and
+ * carried on the Stripe object's metadata (`ga_client_id`), and read back
+ * here. When it is present, the purchase lands on the same GA user and
+ * session as the marketing click that produced it.
+ *
+ * When it is absent — an older checkout session, a customer whose consent or
+ * ad blocker meant gtag never ran, or a subscription renewal months later
+ * with no browser involved at all — {@link sendGa4Purchase} falls back to a
+ * synthesized id derived from the Stripe customer. That records the revenue
+ * correctly but attributes it to a synthetic, sessionless user: the money is
+ * right, the channel is unknown. This is a deliberate trade (revenue truth
+ * beats attribution completeness) and NOT a silent one — the fallback is
+ * counted in the returned result so it can be alarmed on if it ever becomes
+ * the common case.
+ *
+ * ## Failure posture
+ *
+ * Fire-and-forget, swallowing everything. The webhook route claims each
+ * Stripe event in a `stripeEvents` doc BEFORE running handlers and deletes
+ * the claim on any throw, so a thrown error here would un-claim the event and
+ * make Stripe redeliver it — turning a missing analytics hit into a repeated
+ * billing side effect. Analytics must never be able to do that.
+ */ const GA4_ENDPOINT = 'https://www.google-analytics.com/mp/collect';
+const SEND_TIMEOUT_MS = 3000;
+/**
+ * A stable, opaque stand-in for a browser client id.
+ *
+ * GA expects the `<random>.<timestamp>` shape. Determinism matters more than
+ * realism: the same `seed` must map to the same synthetic user every time, or
+ * one paying customer becomes a crowd of one-purchase strangers and ARPA is
+ * nonsense. Derived by a cheap non-cryptographic hash — this is a bucketing
+ * key, not a secret, and the seed it comes from never leaves this function.
+ *
+ * The seed is whatever identifies the actor the events belong to on the
+ * surface doing the sending: the Stripe customer for revenue, the host id for
+ * a scheduled publish (AGL-1589). Both are opaque to GA — only the hash is
+ * ever transmitted.
+ */ export function synthesizeClientId(seed) {
+    let hash = 0;
+    for(let i = 0; i < seed.length; i += 1){
+        hash = hash * 31 + seed.charCodeAt(i) >>> 0;
+    }
+    // Fixed second component: a real timestamp would make the id move between
+    // renewals, which is precisely what determinism is here to prevent.
+    return `${hash}.1000000000`;
+}
+/**
+ * Absent config is the normal state on self-hosted deployments and in
+ * development — not an error, and not worth a log line per event.
+ *
+ * ⚠️ It is NO LONGER the state of our own production deployments, and this
+ * comment saying otherwise is how that fact got lost twice (AGL-2327).
+ * `GA4_MEASUREMENT_ID` and `GA4_API_SECRET` are present on the production
+ * deployments of `aglyn-console`, `aglyn-tenant` AND `aglyn-docs` since
+ * **2026-08-17 12:15 UTC** — verified against `GET /v13/deployments/{id}`,
+ * which returns the env key list a running lambda actually has, with an older
+ * deployment as a negative control. `vercel env ls` and the project's own env
+ * list cannot answer this question; only the deployment can.
+ *
+ * So a server-side event missing from GA4 today is **not** explained by
+ * credentials, and must not be written off as "the transport is dead". A
+ * 2026-08-19 smoke pass reached exactly that conclusion off the stale version
+ * of this note, four days after the flip landed. Look at dimension
+ * registration (AGL-1637 item 3) and at how the beacon is SCHEDULED
+ * (AGL-2346/AGL-2327 — a bare `void` in a route handler never runs) instead.
+ *
+ * See docs/ANALYTICS.md §"Environment variables".
+ */ function ga4Credentials() {
+    const measurementId = process.env.GA4_MEASUREMENT_ID || '';
+    const apiSecret = process.env.GA4_API_SECRET || '';
+    if (!measurementId || !apiSecret) return null;
+    return {
+        measurementId,
+        apiSecret
+    };
+}
+/**
+ * POST one already-sanitized event. Never throws — see the module comment on
+ * failure posture; the callers run inside a Stripe webhook claim and inside a
+ * publish executor, and in both a throw would have a side effect far worse
+ * than a missing analytics hit.
+ */ async function postGa4Event(options) {
+    const { credentials, eventName, params, clientId, userId, log } = options;
+    // Only ever ADDED, never set to `false`. GA4's internal-traffic filter
+    // matches on the parameter being present with this value; a `traffic_type:
+    // 'external'` on every real hit would be a second dimension nobody filters
+    // on, and one bad `internal` computation away from erasing paying customers
+    // from every report — which a data filter cannot undo.
+    const stamped = options.internal ? _extends({}, params, {
+        [INTERNAL_TRAFFIC_PARAM]: INTERNAL_TRAFFIC_VALUE
+    }) : params;
+    try {
+        const response = await fetch(`${GA4_ENDPOINT}?measurement_id=${encodeURIComponent(credentials.measurementId)}&api_secret=${encodeURIComponent(credentials.apiSecret)}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(_extends({
+                client_id: clientId
+            }, userId ? {
+                user_id: userId
+            } : {}, {
+                // Keeps THIS path out of ads personalization, and it is the only
+                // thing that does. The property runs Google Signals and ads
+                // personalization ON in every region, so a server event sent without
+                // this flag would join the advertising audiences the browser tags
+                // build — carrying a `client_id` that may be synthesized from a
+                // Stripe customer id, which is a stronger identifier than any cookie
+                // the browser path has. A per-hit assertion rather than a property
+                // setting, so no dashboard change can quietly opt these events in.
+                non_personalized_ads: true,
+                events: [
+                    {
+                        name: eventName,
+                        params: stamped
+                    }
+                ]
+            })),
+            signal: AbortSignal.timeout(SEND_TIMEOUT_MS)
+        });
+        if (!response.ok) {
+            console.warn(JSON.stringify(_extends({}, log, {
+                status: response.status
+            })));
+            return {
+                sent: false,
+                reason: `http-${response.status}`
+            };
+        }
+        return {
+            sent: true
+        };
+    } catch (error) {
+        console.warn(JSON.stringify(_extends({}, log, {
+            error: error instanceof Error ? error.message : 'unknown'
+        })));
+        return {
+            sent: false,
+            reason: 'network'
+        };
+    }
+}
+/**
+ * Send one `purchase` to GA4. Never throws.
+ *
+ * Returns a result rather than void so the caller can log the fallback rate;
+ * nothing about the return value should change billing behaviour.
+ */ export async function sendGa4Purchase(input) {
+    const credentials = ga4Credentials();
+    if (!credentials) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'not-configured'
+        };
+    }
+    const clientId = input.clientId || (input.stripeCustomerId ? synthesizeClientId(input.stripeCustomerId) : '');
+    if (!clientId) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'no-client-id'
+        };
+    }
+    const synthesizedClientId = !input.clientId;
+    // The same sanitizer the browser path uses, applied again here. The inputs
+    // are Stripe-derived rather than hand-written, and a Stripe product name is
+    // one `metadata` edit away from carrying a customer's name.
+    const params = sanitizeEventParams(_extends({
+        transaction_id: input.transactionId,
+        currency: String(input.currency || 'USD').toUpperCase(),
+        value: input.value
+    }, input.billingInterval ? {
+        billing_interval: input.billingInterval
+    } : {}, {
+        items: input.items
+    }));
+    // Swallows everything — see the module comment: a throw here would un-claim
+    // the Stripe event and cause a redelivery.
+    const result = await postGa4Event({
+        credentials,
+        eventName: 'purchase',
+        params,
+        clientId,
+        userId: input.userId,
+        log: {
+            tag: 'AGL-1561:ga4-purchase',
+            transactionId: input.transactionId
+        },
+        internal: input.internal
+    });
+    return _extends({}, result, {
+        synthesizedClientId
+    });
+}
+/**
+ * Send one GA4 `refund` — revenue that came back (AGL-1850). Never throws.
+ *
+ * Both `purchase` senders were one-directional, so GA revenue could only
+ * ever go UP: a refunded invoice or marketplace sale stayed on the books
+ * forever, drifting GA away from Stripe by exactly the refund volume. GA4's
+ * native `refund` event is built for this — sent with the ORIGINAL
+ * purchase's `transaction_id`, GA nets the two against each other in every
+ * revenue report.
+ *
+ * `transaction_id` is therefore the one field that carries the whole
+ * mechanism: the invoice id for a subscription refund, the checkout session
+ * id for a marketplace one — whatever the matching `purchase` reported,
+ * never the refund's own charge or event id.
+ *
+ * `value` is what actually came back, in the SAME accounting the purchase
+ * used. For a subscription that is `amount_refunded` (the purchase reported
+ * `amount_paid`, all ours); for a marketplace sale it is the platform-net
+ * share (the purchase reported our net per AGL-1639, so refunding the gross
+ * would net MORE than the sale ever reported). The caller owns that
+ * arithmetic because the caller holds the ledger; this sender ships whatever
+ * number it is handed.
+ *
+ * Same claiming rules as `purchase` (the caller discriminates, this module
+ * transmits), same client-id capture-or-synthesize fallback, same
+ * fire-and-forget posture — a throw would un-claim the Stripe event.
+ */ export async function sendGa4Refund(input) {
+    const credentials = ga4Credentials();
+    if (!credentials) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'not-configured'
+        };
+    }
+    const clientId = input.clientId || (input.stripeCustomerId ? synthesizeClientId(input.stripeCustomerId) : '');
+    if (!clientId) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'no-client-id'
+        };
+    }
+    const synthesizedClientId = !input.clientId;
+    const params = sanitizeEventParams(_extends({
+        transaction_id: input.transactionId,
+        currency: String(input.currency || 'USD').toUpperCase(),
+        value: input.value
+    }, input.billingInterval ? {
+        billing_interval: input.billingInterval
+    } : {}, {
+        items: input.items
+    }));
+    const result = await postGa4Event({
+        credentials,
+        eventName: 'refund',
+        params,
+        clientId,
+        userId: input.userId,
+        log: {
+            tag: 'AGL-1850:ga4-refund',
+            transactionId: input.transactionId
+        },
+        internal: input.internal
+    });
+    return _extends({}, result, {
+        synthesizedClientId
+    });
+}
+/**
+ * Send one `subscription_cancelled` — the churn half of the funnel
+ * (AGL-1851). Never throws.
+ *
+ * Every event instruments the way INTO revenue and nothing the way out, so
+ * GA could not answer churn rate, plan-tier churn mix or tenure at
+ * cancellation. Sent server-side for the same reason `purchase` is: a
+ * subscription ends with no browser present — portal cancellations at
+ * period end, dunning exhaustion, staff action — so a client event is not a
+ * weaker option, it is no option.
+ *
+ * A CUSTOM name, deliberately. GA4's only subscription-cancel vocabulary
+ * (`app_store_subscription_cancel`) is reserved for app-store data sources
+ * and a web hit wearing it is dropped, which is silence, not pollution —
+ * the worse failure. The params need dimension registration to report on
+ * (AGL-1637): `plan` — the plan being LEFT, never the `free` the org mirror
+ * writes; `billing_interval` — the churn half of the AGL-1640 annual-mix
+ * metric; `tenure_days` — whole days from the subscription's `created` to
+ * when it actually ended, the "how long do they stay" number.
+ */ export async function sendGa4SubscriptionCancelled(input) {
+    const credentials = ga4Credentials();
+    if (!credentials) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'not-configured'
+        };
+    }
+    const clientId = input.clientId || (input.stripeCustomerId ? synthesizeClientId(input.stripeCustomerId) : '');
+    if (!clientId) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'no-client-id'
+        };
+    }
+    const synthesizedClientId = !input.clientId;
+    const params = sanitizeEventParams(_extends({
+        plan: input.plan
+    }, input.billingInterval ? {
+        billing_interval: input.billingInterval
+    } : {}, {
+        // The sanitizer drops `undefined`, which keeps "not determined" distinct
+        // from a real zero-day tenure.
+        tenure_days: input.tenureDays
+    }));
+    const result = await postGa4Event({
+        credentials,
+        eventName: 'subscription_cancelled',
+        params,
+        clientId,
+        userId: input.userId,
+        log: {
+            tag: 'AGL-1851:ga4-subscription-cancelled'
+        },
+        internal: input.internal
+    });
+    return _extends({}, result, {
+        synthesizedClientId
+    });
+}
+/**
+ * Send one `site_published` for a route that went live with no browser
+ * involved (AGL-1589). Never throws.
+ *
+ * ## Why this is allowed to be a synthetic user
+ *
+ * The client id is derived from the HOST — the site whose route went live —
+ * and not from the author, because the author is not present: a scheduled
+ * publish is applied by the cron beat minutes or hours after anybody clicked
+ * anything, and the browser that wrote the schedule is long gone. There is no
+ * session to join and nothing to attribute.
+ *
+ * Deriving it from the host rather than randomly is what keeps the metric
+ * honest in the one direction it can be dishonest. "% who publish a site"
+ * counts USERS, so a random id per publish would let one site scheduling ten
+ * publishes look like ten activated customers — the same inflation
+ * `publishScreenRoute` avoids by firing only when a route goes live. One host
+ * is one synthetic user, forever, however many of its screens go live on a
+ * timer.
+ *
+ * ## One param, deliberately
+ *
+ * `first_publish` and nothing else, matching the browser event (AGL-1588).
+ * The host id is a resource identifier bought for nothing, and the rest of the
+ * metric is answered by the event alone; the id is used only as the hash seed
+ * and never transmitted.
+ *
+ * The caller decides `first_publish` from the routing map it read before
+ * registering the entry, through the same `isFirstPublishedRoute` the console
+ * uses — a dimension is only worth registering if every sender means the same
+ * thing by it, and this sender is the one nobody can watch happen.
+ */ export async function sendGa4SitePublished(input) {
+    const credentials = ga4Credentials();
+    if (!credentials) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'not-configured'
+        };
+    }
+    if (!input.hostId) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'no-client-id'
+        };
+    }
+    const result = await postGa4Event({
+        credentials,
+        eventName: 'site_published',
+        // Sanitized like every other payload even though it carries one boolean —
+        // the guarantee should hold because the sanitizer ran, not because the
+        // author of this call happened to pass nothing identifying. It also drops
+        // `first_publish` when it is undefined, which is how "not determined"
+        // stays distinct from `false`.
+        params: sanitizeEventParams({
+            first_publish: input.firstPublish
+        }),
+        clientId: synthesizeClientId(input.hostId),
+        log: {
+            tag: 'AGL-1589:ga4-site-published'
+        },
+        internal: input.internal
+    });
+    // Always synthetic here: there is no browser client id to have missed.
+    return _extends({}, result, {
+        synthesizedClientId: true
+    });
+}
+/**
+ * Send one `stripe_connected` for an account that became able to take
+ * payments with no browser present (AGL-1580). Never throws.
+ *
+ * ## Why this needs a server sender at all
+ *
+ * There are two client-side emitters for this event — the commerce payments
+ * card and the marketplace seller panel — and both are gated the same way:
+ *
+ *     if (!chargesEnabled) trackEvent('stripe_connected')
+ *
+ * where `chargesEnabled` is the state read from the merchant's profile BEFORE
+ * the connect request. The gate is right in intent: the connect handler is a
+ * re-entrant create-or-resume that answers `chargesEnabled: true` on every
+ * later visit, so a bare event there would count one merchant once per click
+ * forever.
+ *
+ * What defeats it is AGL-1997. Stripe emits `account.updated` the moment
+ * hosted onboarding completes — while the merchant is still on Stripe's
+ * domain, before the `return_url` bounces them back — and
+ * {@link syncConnectAccountStatus} mirrors `charges_enabled` onto the profile
+ * from that webhook. So by the time the merchant lands back in the console
+ * the flag they are supposed to transition FROM already reads `true`, the
+ * client guard is false, and the event never fires. It is not a race that
+ * usually goes the wrong way; the webhook wins by an entire page load.
+ *
+ * ## The two senders cannot double-count
+ *
+ * Both key off the SAME stored flag, from opposite sides of it:
+ *
+ * - merchant clicks first → the connect route writes `true` → the later
+ *   `account.updated` sees no transition → only the CLIENT event fires;
+ * - webhook lands first → the transition is here → the merchant's later click
+ *   reads a pre-state of `true` → only the SERVER event fires.
+ *
+ * Exactly one of the two guards can be open for a given account, which is why
+ * this is added alongside the client emitters rather than replacing them —
+ * a deployment with no Connect webhook destination (the self-host default)
+ * still reports through the browser.
+ *
+ * ## One synthetic user per connected account
+ *
+ * The client id is hashed from the Stripe account id for the reason
+ * {@link sendGa4SitePublished} hashes the host: "% who connect Stripe" counts
+ * MERCHANTS, and a random id per hit would let one account that reconnects
+ * look like several activated customers. The account id is the hash seed and
+ * is never transmitted.
+ *
+ * ## No parameters, deliberately
+ *
+ * `stripe_connected` is declared as `Record<string, never>` in the client
+ * event contract, and a server sender that invented a param would create a
+ * dimension only half the hits carry.
+ */ export async function sendGa4StripeConnected(input) {
+    const credentials = ga4Credentials();
+    if (!credentials) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'not-configured'
+        };
+    }
+    if (!input.accountId) {
+        return {
+            sent: false,
+            synthesizedClientId: false,
+            reason: 'no-client-id'
+        };
+    }
+    const result = await postGa4Event({
+        credentials,
+        eventName: 'stripe_connected',
+        // Sanitized despite being empty, so the guarantee holds because the
+        // sanitizer ran rather than because this call site happened to pass
+        // nothing.
+        params: sanitizeEventParams({}),
+        clientId: synthesizeClientId(input.accountId),
+        log: {
+            tag: 'AGL-1580:ga4-stripe-connected'
+        },
+        internal: input.internal
+    });
+    // Always synthetic here: there is no browser client id to have missed.
+    return _extends({}, result, {
+        synthesizedClientId: true
+    });
+}
+
+//# sourceMappingURL=ga4-measurement-protocol.js.map

package/src/lib/server/ga4-measurement-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/ga4-measurement-protocol.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { sanitizeEventParams } from '@aglyn/aglyn/app-utils/analytics-events'\n// One definition for a pair of strings that has to agree with a setting in the\n// GA UI nothing here can typecheck against (AGL-1582/AGL-2064). Four surfaces\n// stamp them now — the console, the tenant runtime, the docs site, and this\n// one — and a second spelling would read as a different dimension in GA, so\n// the filter would catch three of them and look like it was working.\nimport {\n  INTERNAL_TRAFFIC_PARAM,\n  INTERNAL_TRAFFIC_VALUE,\n} from '@aglyn/aglyn/app-utils/internal-traffic'\n\n/**\n * Server-to-server GA4 delivery via the Measurement Protocol (AGL-1561) —\n * `purchase`, and the one activation event no browser can witness.\n *\n * ## Why revenue is sent from the server and nothing else is\n *\n * The obvious alternative is a client-side `purchase` on the post-checkout\n * return page. It is simpler, and it is wrong for money:\n *\n * - **The return page is not reached reliably.** Stripe redirects back after\n *   payment, and a customer who closes the tab, loses signal, or gets a bank\n *   3DS interstitial that lands somewhere else has still paid us. Their\n *   revenue would simply never appear.\n * - **Ad blockers drop it**, and they are over-represented in exactly the\n *   developer audience Aglyn sells to. Under-reported revenue is worse than\n *   no revenue reporting, because it looks like data.\n * - **`?status=success` carries no amount and no session id** (verified: the\n *   hosted checkout return URL sets only `status`, and nothing in the app\n *   reads it), so a client event could not state what was actually charged.\n *   It would also re-fire on a refresh or a back-navigation.\n * - The authoritative amount, currency and transaction id already exist,\n *   server-side, in the Stripe webhook — the same place the subscription\n *   mirror is written. Reporting revenue from anywhere else means reporting\n *   a second, weaker version of a number we already hold.\n *\n * `begin_checkout` stays client-side, because intent genuinely is a browser\n * event and its loss to an ad blocker costs a funnel step, not a dollar.\n *\n * ## The second sender: `site_published` from a scheduled publish (AGL-1589)\n *\n * Everything above argues for keeping the server-side surface as small as\n * possible, and {@link sendGa4SitePublished} is the one other event that has\n * no browser to fire it: a SCHEDULED publish is applied by a cron beat (or by\n * an ISR regeneration) at a moment when the author is asleep. Until AGL-1589\n * that path could not make a page reachable at all, so it was not an\n * activation and nothing was sent; now that it registers the routing entry, a\n * scheduled FIRST publish is a route going live and `publishScreenRoute`'s\n * client-side `site_published` — the headline activation metric — would miss\n * it. It is sent HERE for the same reason revenue is: the alternative is not\n * a weaker event, it is no event.\n *\n * The rest of the activation funnel stays client-side. This is not a general\n * server-side analytics channel and should not become one.\n *\n * ## The `client_id` problem, stated plainly\n *\n * The Measurement Protocol REQUIRES a `client_id`, and a server has no way to\n * know the browser's. Whatever is supplied decides whether the purchase joins\n * the user's existing GA session — and therefore whether revenue can be\n * attributed to the campaign that produced it, which is the entire point of\n * the exercise.\n *\n * So the browser's real `client_id` is captured when checkout STARTS and\n * carried on the Stripe object's metadata (`ga_client_id`), and read back\n * here. When it is present, the purchase lands on the same GA user and\n * session as the marketing click that produced it.\n *\n * When it is absent — an older checkout session, a customer whose consent or\n * ad blocker meant gtag never ran, or a subscription renewal months later\n * with no browser involved at all — {@link sendGa4Purchase} falls back to a\n * synthesized id derived from the Stripe customer. That records the revenue\n * correctly but attributes it to a synthetic, sessionless user: the money is\n * right, the channel is unknown. This is a deliberate trade (revenue truth\n * beats attribution completeness) and NOT a silent one — the fallback is\n * counted in the returned result so it can be alarmed on if it ever becomes\n * the common case.\n *\n * ## Failure posture\n *\n * Fire-and-forget, swallowing everything. The webhook route claims each\n * Stripe event in a `stripeEvents` doc BEFORE running handlers and deletes\n * the claim on any throw, so a thrown error here would un-claim the event and\n * make Stripe redeliver it — turning a missing analytics hit into a repeated\n * billing side effect. Analytics must never be able to do that.\n */\n\nconst GA4_ENDPOINT = 'https://www.google-analytics.com/mp/collect'\nconst SEND_TIMEOUT_MS = 3000\n\nexport interface Ga4PurchaseItem {\n  item_id: string\n  item_name: string\n  item_category?: string\n  price?: number\n  quantity?: number\n}\n\nexport interface Ga4PurchaseInput {\n  /** Stripe object id — invoice or checkout session. GA de-duplicates on it. */\n  transactionId: string\n  /** Whole currency units, NOT cents. */\n  value: number\n  /** ISO 4217, upper-cased by the caller or here. */\n  currency: string\n  items: Ga4PurchaseItem[]\n  billingInterval?: 'monthly' | 'annual'\n  /**\n   * The browser's GA `client_id`, captured at checkout start and carried on\n   * Stripe metadata. Absent for renewals and for customers whose gtag never\n   * ran; see the module comment.\n   */\n  clientId?: string | null\n  /** Opaque Firebase uid. The one identifier GA is allowed to hold. */\n  userId?: string | null\n  /** Stripe customer id — used ONLY to synthesize a fallback client id. */\n  stripeCustomerId?: string | null\n\n  /**\n   * Whether this transaction is OURS — a staff or rehearsal purchase — rather\n   * than a customer's (AGL-1582). Carried from the browser that started\n   * checkout on Stripe metadata, the same way `clientId` is.\n   *\n   * Opt-in only, never inferred: wrongly flagging a real customer erases their\n   * revenue from every report, and a GA4 data filter is not retroactive.\n   */\n  internal?: boolean\n}\n\nexport interface Ga4SendResult {\n  sent: boolean\n  /** True when no real browser client id was available. */\n  synthesizedClientId: boolean\n  reason?: string\n}\n\n/**\n * A stable, opaque stand-in for a browser client id.\n *\n * GA expects the `<random>.<timestamp>` shape. Determinism matters more than\n * realism: the same `seed` must map to the same synthetic user every time, or\n * one paying customer becomes a crowd of one-purchase strangers and ARPA is\n * nonsense. Derived by a cheap non-cryptographic hash — this is a bucketing\n * key, not a secret, and the seed it comes from never leaves this function.\n *\n * The seed is whatever identifies the actor the events belong to on the\n * surface doing the sending: the Stripe customer for revenue, the host id for\n * a scheduled publish (AGL-1589). Both are opaque to GA — only the hash is\n * ever transmitted.\n */\nexport function synthesizeClientId(seed: string): string {\n  let hash = 0\n  for (let i = 0; i < seed.length; i += 1) {\n    hash = (hash * 31 + seed.charCodeAt(i)) >>> 0\n  }\n  // Fixed second component: a real timestamp would make the id move between\n  // renewals, which is precisely what determinism is here to prevent.\n  return `${hash}.1000000000`\n}\n\ninterface Ga4Credentials {\n  measurementId: string\n  apiSecret: string\n}\n\n/**\n * Absent config is the normal state on self-hosted deployments and in\n * development — not an error, and not worth a log line per event.\n *\n * ⚠️ It is NO LONGER the state of our own production deployments, and this\n * comment saying otherwise is how that fact got lost twice (AGL-2327).\n * `GA4_MEASUREMENT_ID` and `GA4_API_SECRET` are present on the production\n * deployments of `aglyn-console`, `aglyn-tenant` AND `aglyn-docs` since\n * **2026-08-17 12:15 UTC** — verified against `GET /v13/deployments/{id}`,\n * which returns the env key list a running lambda actually has, with an older\n * deployment as a negative control. `vercel env ls` and the project's own env\n * list cannot answer this question; only the deployment can.\n *\n * So a server-side event missing from GA4 today is **not** explained by\n * credentials, and must not be written off as \"the transport is dead\". A\n * 2026-08-19 smoke pass reached exactly that conclusion off the stale version\n * of this note, four days after the flip landed. Look at dimension\n * registration (AGL-1637 item 3) and at how the beacon is SCHEDULED\n * (AGL-2346/AGL-2327 — a bare `void` in a route handler never runs) instead.\n *\n * See docs/ANALYTICS.md §\"Environment variables\".\n */\nfunction ga4Credentials(): Ga4Credentials | null {\n  const measurementId = process.env.GA4_MEASUREMENT_ID || ''\n  const apiSecret = process.env.GA4_API_SECRET || ''\n  if (!measurementId || !apiSecret) return null\n  return { measurementId, apiSecret }\n}\n\n/**\n * POST one already-sanitized event. Never throws — see the module comment on\n * failure posture; the callers run inside a Stripe webhook claim and inside a\n * publish executor, and in both a throw would have a side effect far worse\n * than a missing analytics hit.\n */\nasync function postGa4Event(options: {\n  credentials: Ga4Credentials\n  eventName: string\n  params: Record<string, unknown>\n  clientId: string\n  userId?: string | null\n  /** Structured-log fields for the two failure lines (tag + subject). */\n  log: Record<string, unknown>\n  /**\n   * Whether this hit is OURS rather than a customer's (AGL-1582).\n   *\n   * Applied here, centrally, rather than by each sender: a fifth sender added\n   * later would otherwise be unstamped by default, and \"unstamped by default\"\n   * is how our own rehearsal revenue ends up in the real reports.\n   */\n  internal?: boolean\n}): Promise<{ sent: boolean; reason?: string }> {\n  const { credentials, eventName, params, clientId, userId, log } = options\n  // Only ever ADDED, never set to `false`. GA4's internal-traffic filter\n  // matches on the parameter being present with this value; a `traffic_type:\n  // 'external'` on every real hit would be a second dimension nobody filters\n  // on, and one bad `internal` computation away from erasing paying customers\n  // from every report — which a data filter cannot undo.\n  const stamped = options.internal\n    ? { ...params, [INTERNAL_TRAFFIC_PARAM]: INTERNAL_TRAFFIC_VALUE }\n    : params\n  try {\n    const response = await fetch(\n      `${GA4_ENDPOINT}?measurement_id=${encodeURIComponent(\n        credentials.measurementId,\n      )}&api_secret=${encodeURIComponent(credentials.apiSecret)}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          client_id: clientId,\n          // Opaque uid only — it is what stitches this event to the\n          // console's client-side events, which set the same user_id.\n          ...(userId ? { user_id: userId } : {}),\n          // Keeps THIS path out of ads personalization, and it is the only\n          // thing that does. The property runs Google Signals and ads\n          // personalization ON in every region, so a server event sent without\n          // this flag would join the advertising audiences the browser tags\n          // build — carrying a `client_id` that may be synthesized from a\n          // Stripe customer id, which is a stronger identifier than any cookie\n          // the browser path has. A per-hit assertion rather than a property\n          // setting, so no dashboard change can quietly opt these events in.\n          non_personalized_ads: true,\n          events: [{ name: eventName, params: stamped }],\n        }),\n        signal: AbortSignal.timeout(SEND_TIMEOUT_MS),\n      },\n    )\n    if (!response.ok) {\n      console.warn(JSON.stringify({ ...log, status: response.status }))\n      return { sent: false, reason: `http-${response.status}` }\n    }\n    return { sent: true }\n  } catch (error) {\n    console.warn(\n      JSON.stringify({\n        ...log,\n        error: error instanceof Error ? error.message : 'unknown',\n      }),\n    )\n    return { sent: false, reason: 'network' }\n  }\n}\n\n/**\n * Send one `purchase` to GA4. Never throws.\n *\n * Returns a result rather than void so the caller can log the fallback rate;\n * nothing about the return value should change billing behaviour.\n */\nexport async function sendGa4Purchase(\n  input: Ga4PurchaseInput,\n): Promise<Ga4SendResult> {\n  const credentials = ga4Credentials()\n  if (!credentials) {\n    return { sent: false, synthesizedClientId: false, reason: 'not-configured' }\n  }\n  const clientId =\n    input.clientId ||\n    (input.stripeCustomerId ? synthesizeClientId(input.stripeCustomerId) : '')\n  if (!clientId) {\n    return { sent: false, synthesizedClientId: false, reason: 'no-client-id' }\n  }\n  const synthesizedClientId = !input.clientId\n\n  // The same sanitizer the browser path uses, applied again here. The inputs\n  // are Stripe-derived rather than hand-written, and a Stripe product name is\n  // one `metadata` edit away from carrying a customer's name.\n  const params = sanitizeEventParams({\n    transaction_id: input.transactionId,\n    currency: String(input.currency || 'USD').toUpperCase(),\n    value: input.value,\n    ...(input.billingInterval\n      ? { billing_interval: input.billingInterval }\n      : {}),\n    items: input.items,\n  })\n\n  // Swallows everything — see the module comment: a throw here would un-claim\n  // the Stripe event and cause a redelivery.\n  const result = await postGa4Event({\n    credentials,\n    eventName: 'purchase',\n    params,\n    clientId,\n    userId: input.userId,\n    log: {\n      tag: 'AGL-1561:ga4-purchase',\n      transactionId: input.transactionId,\n    },\n    internal: input.internal,\n  })\n  return { ...result, synthesizedClientId }\n}\n\n/**\n * Send one GA4 `refund` — revenue that came back (AGL-1850). Never throws.\n *\n * Both `purchase` senders were one-directional, so GA revenue could only\n * ever go UP: a refunded invoice or marketplace sale stayed on the books\n * forever, drifting GA away from Stripe by exactly the refund volume. GA4's\n * native `refund` event is built for this — sent with the ORIGINAL\n * purchase's `transaction_id`, GA nets the two against each other in every\n * revenue report.\n *\n * `transaction_id` is therefore the one field that carries the whole\n * mechanism: the invoice id for a subscription refund, the checkout session\n * id for a marketplace one — whatever the matching `purchase` reported,\n * never the refund's own charge or event id.\n *\n * `value` is what actually came back, in the SAME accounting the purchase\n * used. For a subscription that is `amount_refunded` (the purchase reported\n * `amount_paid`, all ours); for a marketplace sale it is the platform-net\n * share (the purchase reported our net per AGL-1639, so refunding the gross\n * would net MORE than the sale ever reported). The caller owns that\n * arithmetic because the caller holds the ledger; this sender ships whatever\n * number it is handed.\n *\n * Same claiming rules as `purchase` (the caller discriminates, this module\n * transmits), same client-id capture-or-synthesize fallback, same\n * fire-and-forget posture — a throw would un-claim the Stripe event.\n */\nexport async function sendGa4Refund(\n  input: Ga4PurchaseInput,\n): Promise<Ga4SendResult> {\n  const credentials = ga4Credentials()\n  if (!credentials) {\n    return { sent: false, synthesizedClientId: false, reason: 'not-configured' }\n  }\n  const clientId =\n    input.clientId ||\n    (input.stripeCustomerId ? synthesizeClientId(input.stripeCustomerId) : '')\n  if (!clientId) {\n    return { sent: false, synthesizedClientId: false, reason: 'no-client-id' }\n  }\n  const synthesizedClientId = !input.clientId\n  const params = sanitizeEventParams({\n    transaction_id: input.transactionId,\n    currency: String(input.currency || 'USD').toUpperCase(),\n    value: input.value,\n    ...(input.billingInterval\n      ? { billing_interval: input.billingInterval }\n      : {}),\n    items: input.items,\n  })\n  const result = await postGa4Event({\n    credentials,\n    eventName: 'refund',\n    params,\n    clientId,\n    userId: input.userId,\n    log: {\n      tag: 'AGL-1850:ga4-refund',\n      transactionId: input.transactionId,\n    },\n    internal: input.internal,\n  })\n  return { ...result, synthesizedClientId }\n}\n\n/**\n * Send one `subscription_cancelled` — the churn half of the funnel\n * (AGL-1851). Never throws.\n *\n * Every event instruments the way INTO revenue and nothing the way out, so\n * GA could not answer churn rate, plan-tier churn mix or tenure at\n * cancellation. Sent server-side for the same reason `purchase` is: a\n * subscription ends with no browser present — portal cancellations at\n * period end, dunning exhaustion, staff action — so a client event is not a\n * weaker option, it is no option.\n *\n * A CUSTOM name, deliberately. GA4's only subscription-cancel vocabulary\n * (`app_store_subscription_cancel`) is reserved for app-store data sources\n * and a web hit wearing it is dropped, which is silence, not pollution —\n * the worse failure. The params need dimension registration to report on\n * (AGL-1637): `plan` — the plan being LEFT, never the `free` the org mirror\n * writes; `billing_interval` — the churn half of the AGL-1640 annual-mix\n * metric; `tenure_days` — whole days from the subscription's `created` to\n * when it actually ended, the \"how long do they stay\" number.\n */\nexport async function sendGa4SubscriptionCancelled(input: {\n  /** The plan tier the org is LEAVING (metadata/price-derived, not `free`). */\n  plan: string\n  /** `monthly` | `annual`, when the subscription's price interval said. */\n  billingInterval?: 'monthly' | 'annual'\n  /** Whole days the subscription lived; omitted when timestamps are absent. */\n  tenureDays?: number\n  /** Same capture-or-synthesize contract as `purchase`. */\n  clientId?: string | null\n  userId?: string | null\n  stripeCustomerId?: string | null\n  /** Ours rather than a customer's (AGL-1582) — see `Ga4PurchaseInput`. */\n  internal?: boolean\n}): Promise<Ga4SendResult> {\n  const credentials = ga4Credentials()\n  if (!credentials) {\n    return { sent: false, synthesizedClientId: false, reason: 'not-configured' }\n  }\n  const clientId =\n    input.clientId ||\n    (input.stripeCustomerId ? synthesizeClientId(input.stripeCustomerId) : '')\n  if (!clientId) {\n    return { sent: false, synthesizedClientId: false, reason: 'no-client-id' }\n  }\n  const synthesizedClientId = !input.clientId\n  const params = sanitizeEventParams({\n    plan: input.plan,\n    ...(input.billingInterval\n      ? { billing_interval: input.billingInterval }\n      : {}),\n    // The sanitizer drops `undefined`, which keeps \"not determined\" distinct\n    // from a real zero-day tenure.\n    tenure_days: input.tenureDays,\n  })\n  const result = await postGa4Event({\n    credentials,\n    eventName: 'subscription_cancelled',\n    params,\n    clientId,\n    userId: input.userId,\n    log: { tag: 'AGL-1851:ga4-subscription-cancelled' },\n    internal: input.internal,\n  })\n  return { ...result, synthesizedClientId }\n}\n\n/**\n * Send one `site_published` for a route that went live with no browser\n * involved (AGL-1589). Never throws.\n *\n * ## Why this is allowed to be a synthetic user\n *\n * The client id is derived from the HOST — the site whose route went live —\n * and not from the author, because the author is not present: a scheduled\n * publish is applied by the cron beat minutes or hours after anybody clicked\n * anything, and the browser that wrote the schedule is long gone. There is no\n * session to join and nothing to attribute.\n *\n * Deriving it from the host rather than randomly is what keeps the metric\n * honest in the one direction it can be dishonest. \"% who publish a site\"\n * counts USERS, so a random id per publish would let one site scheduling ten\n * publishes look like ten activated customers — the same inflation\n * `publishScreenRoute` avoids by firing only when a route goes live. One host\n * is one synthetic user, forever, however many of its screens go live on a\n * timer.\n *\n * ## One param, deliberately\n *\n * `first_publish` and nothing else, matching the browser event (AGL-1588).\n * The host id is a resource identifier bought for nothing, and the rest of the\n * metric is answered by the event alone; the id is used only as the hash seed\n * and never transmitted.\n *\n * The caller decides `first_publish` from the routing map it read before\n * registering the entry, through the same `isFirstPublishedRoute` the console\n * uses — a dimension is only worth registering if every sender means the same\n * thing by it, and this sender is the one nobody can watch happen.\n */\nexport async function sendGa4SitePublished(input: {\n  /** Host uid the route went live on — hashed into a client id, never sent. */\n  hostId: string\n  /**\n   * Whether the host had no live route at all before this one. Omit when it\n   * genuinely cannot be determined — the param is optional and an absent\n   * breakdown value beats an invented one.\n   */\n  firstPublish?: boolean\n  /**\n   * Ours rather than a customer's (AGL-1582). A scheduled publish of our own\n   * marketing site or a demo host is an activation event for nobody, and\n   * `site_published` is the headline activation metric.\n   */\n  internal?: boolean\n}): Promise<Ga4SendResult> {\n  const credentials = ga4Credentials()\n  if (!credentials) {\n    return { sent: false, synthesizedClientId: false, reason: 'not-configured' }\n  }\n  if (!input.hostId) {\n    return { sent: false, synthesizedClientId: false, reason: 'no-client-id' }\n  }\n  const result = await postGa4Event({\n    credentials,\n    eventName: 'site_published',\n    // Sanitized like every other payload even though it carries one boolean —\n    // the guarantee should hold because the sanitizer ran, not because the\n    // author of this call happened to pass nothing identifying. It also drops\n    // `first_publish` when it is undefined, which is how \"not determined\"\n    // stays distinct from `false`.\n    params: sanitizeEventParams({ first_publish: input.firstPublish }),\n    clientId: synthesizeClientId(input.hostId),\n    log: { tag: 'AGL-1589:ga4-site-published' },\n    internal: input.internal,\n  })\n  // Always synthetic here: there is no browser client id to have missed.\n  return { ...result, synthesizedClientId: true }\n}\n\n/**\n * Send one `stripe_connected` for an account that became able to take\n * payments with no browser present (AGL-1580). Never throws.\n *\n * ## Why this needs a server sender at all\n *\n * There are two client-side emitters for this event — the commerce payments\n * card and the marketplace seller panel — and both are gated the same way:\n *\n *     if (!chargesEnabled) trackEvent('stripe_connected')\n *\n * where `chargesEnabled` is the state read from the merchant's profile BEFORE\n * the connect request. The gate is right in intent: the connect handler is a\n * re-entrant create-or-resume that answers `chargesEnabled: true` on every\n * later visit, so a bare event there would count one merchant once per click\n * forever.\n *\n * What defeats it is AGL-1997. Stripe emits `account.updated` the moment\n * hosted onboarding completes — while the merchant is still on Stripe's\n * domain, before the `return_url` bounces them back — and\n * {@link syncConnectAccountStatus} mirrors `charges_enabled` onto the profile\n * from that webhook. So by the time the merchant lands back in the console\n * the flag they are supposed to transition FROM already reads `true`, the\n * client guard is false, and the event never fires. It is not a race that\n * usually goes the wrong way; the webhook wins by an entire page load.\n *\n * ## The two senders cannot double-count\n *\n * Both key off the SAME stored flag, from opposite sides of it:\n *\n * - merchant clicks first → the connect route writes `true` → the later\n *   `account.updated` sees no transition → only the CLIENT event fires;\n * - webhook lands first → the transition is here → the merchant's later click\n *   reads a pre-state of `true` → only the SERVER event fires.\n *\n * Exactly one of the two guards can be open for a given account, which is why\n * this is added alongside the client emitters rather than replacing them —\n * a deployment with no Connect webhook destination (the self-host default)\n * still reports through the browser.\n *\n * ## One synthetic user per connected account\n *\n * The client id is hashed from the Stripe account id for the reason\n * {@link sendGa4SitePublished} hashes the host: \"% who connect Stripe\" counts\n * MERCHANTS, and a random id per hit would let one account that reconnects\n * look like several activated customers. The account id is the hash seed and\n * is never transmitted.\n *\n * ## No parameters, deliberately\n *\n * `stripe_connected` is declared as `Record<string, never>` in the client\n * event contract, and a server sender that invented a param would create a\n * dimension only half the hits carry.\n */\nexport async function sendGa4StripeConnected(input: {\n  /** Stripe account id — hashed into a client id, never sent. */\n  accountId: string\n  /**\n   * Ours rather than a customer's (AGL-1582). Omitted by the webhook caller\n   * for the same reason the publish executor omits it: no server-side signal\n   * distinguishes our own connected account from a customer's, and guessing\n   * would stamp real merchants as internal — which a data filter then\n   * permanently discards.\n   */\n  internal?: boolean\n}): Promise<Ga4SendResult> {\n  const credentials = ga4Credentials()\n  if (!credentials) {\n    return { sent: false, synthesizedClientId: false, reason: 'not-configured' }\n  }\n  if (!input.accountId) {\n    return { sent: false, synthesizedClientId: false, reason: 'no-client-id' }\n  }\n  const result = await postGa4Event({\n    credentials,\n    eventName: 'stripe_connected',\n    // Sanitized despite being empty, so the guarantee holds because the\n    // sanitizer ran rather than because this call site happened to pass\n    // nothing.\n    params: sanitizeEventParams({}),\n    clientId: synthesizeClientId(input.accountId),\n    log: { tag: 'AGL-1580:ga4-stripe-connected' },\n    internal: input.internal,\n  })\n  // Always synthetic here: there is no browser client id to have missed.\n  return { ...result, synthesizedClientId: true }\n}\n"],"names":["sanitizeEventParams","INTERNAL_TRAFFIC_PARAM","INTERNAL_TRAFFIC_VALUE","GA4_ENDPOINT","SEND_TIMEOUT_MS","synthesizeClientId","seed","hash","i","length","charCodeAt","ga4Credentials","measurementId","process","env","GA4_MEASUREMENT_ID","apiSecret","GA4_API_SECRET","postGa4Event","options","credentials","eventName","params","clientId","userId","log","stamped","internal","response","fetch","encodeURIComponent","method","headers","body","JSON","stringify","client_id","user_id","non_personalized_ads","events","name","signal","AbortSignal","timeout","ok","console","warn","status","sent","reason","error","Error","message","sendGa4Purchase","input","synthesizedClientId","stripeCustomerId","transaction_id","transactionId","currency","String","toUpperCase","value","billingInterval","billing_interval","items","result","tag","sendGa4Refund","sendGa4SubscriptionCancelled","plan","tenure_days","tenureDays","sendGa4SitePublished","hostId","first_publish","firstPublish","sendGa4StripeConnected","accountId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,mBAAmB,QAAQ,0CAAyC;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,qEAAqE;AACrE,SACEC,sBAAsB,EACtBC,sBAAsB,QACjB,0CAAyC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EC,GAED,MAAMC,eAAe;AACrB,MAAMC,kBAAkB;AAgDxB;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,mBAAmBC,IAAY;IAC7C,IAAIC,OAAO;IACX,IAAK,IAAIC,IAAI,GAAGA,IAAIF,KAAKG,MAAM,EAAED,KAAK,EAAG;QACvCD,OAAO,AAACA,OAAO,KAAKD,KAAKI,UAAU,CAACF,OAAQ;IAC9C;IACA,0EAA0E;IAC1E,oEAAoE;IACpE,OAAO,GAAGD,KAAK,WAAW,CAAC;AAC7B;AAOA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAASI;IACP,MAAMC,gBAAgBC,QAAQC,GAAG,CAACC,kBAAkB,IAAI;IACxD,MAAMC,YAAYH,QAAQC,GAAG,CAACG,cAAc,IAAI;IAChD,IAAI,CAACL,iBAAiB,CAACI,WAAW,OAAO;IACzC,OAAO;QAAEJ;QAAeI;IAAU;AACpC;AAEA;;;;;CAKC,GACD,eAAeE,aAAaC,OAgB3B;IACC,MAAM,EAAEC,WAAW,EAAEC,SAAS,EAAEC,MAAM,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,GAAG,EAAE,GAAGN;IAClE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,MAAMO,UAAUP,QAAQQ,QAAQ,GAC5B,aAAKL;QAAQ,CAACrB,uBAAuB,EAAEC;SACvCoB;IACJ,IAAI;QACF,MAAMM,WAAW,MAAMC,MACrB,GAAG1B,aAAa,gBAAgB,EAAE2B,mBAChCV,YAAYR,aAAa,EACzB,YAAY,EAAEkB,mBAAmBV,YAAYJ,SAAS,GAAG,EAC3D;YACEe,QAAQ;YACRC,SAAS;gBAAE,gBAAgB;YAAmB;YAC9CC,MAAMC,KAAKC,SAAS,CAAC;gBACnBC,WAAWb;eAGPC,SAAS;gBAAEa,SAASb;YAAO,IAAI,CAAC;gBACpC,iEAAiE;gBACjE,4DAA4D;gBAC5D,qEAAqE;gBACrE,kEAAkE;gBAClE,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,mEAAmE;gBACnEc,sBAAsB;gBACtBC,QAAQ;oBAAC;wBAAEC,MAAMnB;wBAAWC,QAAQI;oBAAQ;iBAAE;;YAEhDe,QAAQC,YAAYC,OAAO,CAACvC;QAC9B;QAEF,IAAI,CAACwB,SAASgB,EAAE,EAAE;YAChBC,QAAQC,IAAI,CAACZ,KAAKC,SAAS,CAAC,aAAKV;gBAAKsB,QAAQnB,SAASmB,MAAM;;YAC7D,OAAO;gBAAEC,MAAM;gBAAOC,QAAQ,CAAC,KAAK,EAAErB,SAASmB,MAAM,EAAE;YAAC;QAC1D;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB,EAAE,OAAOE,OAAO;QACdL,QAAQC,IAAI,CACVZ,KAAKC,SAAS,CAAC,aACVV;YACHyB,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAG;;QAGpD,OAAO;YAAEJ,MAAM;YAAOC,QAAQ;QAAU;IAC1C;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeI,gBACpBC,KAAuB;IAEvB,MAAMlC,cAAcT;IACpB,IAAI,CAACS,aAAa;QAChB,OAAO;YAAE4B,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAiB;IAC7E;IACA,MAAM1B,WACJ+B,MAAM/B,QAAQ,IACb+B,CAAAA,MAAME,gBAAgB,GAAGnD,mBAAmBiD,MAAME,gBAAgB,IAAI,EAAC;IAC1E,IAAI,CAACjC,UAAU;QACb,OAAO;YAAEyB,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAe;IAC3E;IACA,MAAMM,sBAAsB,CAACD,MAAM/B,QAAQ;IAE3C,2EAA2E;IAC3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAMD,SAAStB,oBAAoB;QACjCyD,gBAAgBH,MAAMI,aAAa;QACnCC,UAAUC,OAAON,MAAMK,QAAQ,IAAI,OAAOE,WAAW;QACrDC,OAAOR,MAAMQ,KAAK;OACdR,MAAMS,eAAe,GACrB;QAAEC,kBAAkBV,MAAMS,eAAe;IAAC,IAC1C,CAAC;QACLE,OAAOX,MAAMW,KAAK;;IAGpB,4EAA4E;IAC5E,2CAA2C;IAC3C,MAAMC,SAAS,MAAMhD,aAAa;QAChCE;QACAC,WAAW;QACXC;QACAC;QACAC,QAAQ8B,MAAM9B,MAAM;QACpBC,KAAK;YACH0C,KAAK;YACLT,eAAeJ,MAAMI,aAAa;QACpC;QACA/B,UAAU2B,MAAM3B,QAAQ;IAC1B;IACA,OAAO,aAAKuC;QAAQX;;AACtB;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,eAAea,cACpBd,KAAuB;IAEvB,MAAMlC,cAAcT;IACpB,IAAI,CAACS,aAAa;QAChB,OAAO;YAAE4B,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAiB;IAC7E;IACA,MAAM1B,WACJ+B,MAAM/B,QAAQ,IACb+B,CAAAA,MAAME,gBAAgB,GAAGnD,mBAAmBiD,MAAME,gBAAgB,IAAI,EAAC;IAC1E,IAAI,CAACjC,UAAU;QACb,OAAO;YAAEyB,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAe;IAC3E;IACA,MAAMM,sBAAsB,CAACD,MAAM/B,QAAQ;IAC3C,MAAMD,SAAStB,oBAAoB;QACjCyD,gBAAgBH,MAAMI,aAAa;QACnCC,UAAUC,OAAON,MAAMK,QAAQ,IAAI,OAAOE,WAAW;QACrDC,OAAOR,MAAMQ,KAAK;OACdR,MAAMS,eAAe,GACrB;QAAEC,kBAAkBV,MAAMS,eAAe;IAAC,IAC1C,CAAC;QACLE,OAAOX,MAAMW,KAAK;;IAEpB,MAAMC,SAAS,MAAMhD,aAAa;QAChCE;QACAC,WAAW;QACXC;QACAC;QACAC,QAAQ8B,MAAM9B,MAAM;QACpBC,KAAK;YACH0C,KAAK;YACLT,eAAeJ,MAAMI,aAAa;QACpC;QACA/B,UAAU2B,MAAM3B,QAAQ;IAC1B;IACA,OAAO,aAAKuC;QAAQX;;AACtB;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,eAAec,6BAA6Bf,KAalD;IACC,MAAMlC,cAAcT;IACpB,IAAI,CAACS,aAAa;QAChB,OAAO;YAAE4B,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAiB;IAC7E;IACA,MAAM1B,WACJ+B,MAAM/B,QAAQ,IACb+B,CAAAA,MAAME,gBAAgB,GAAGnD,mBAAmBiD,MAAME,gBAAgB,IAAI,EAAC;IAC1E,IAAI,CAACjC,UAAU;QACb,OAAO;YAAEyB,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAe;IAC3E;IACA,MAAMM,sBAAsB,CAACD,MAAM/B,QAAQ;IAC3C,MAAMD,SAAStB,oBAAoB;QACjCsE,MAAMhB,MAAMgB,IAAI;OACZhB,MAAMS,eAAe,GACrB;QAAEC,kBAAkBV,MAAMS,eAAe;IAAC,IAC1C,CAAC;QACL,yEAAyE;QACzE,+BAA+B;QAC/BQ,aAAajB,MAAMkB,UAAU;;IAE/B,MAAMN,SAAS,MAAMhD,aAAa;QAChCE;QACAC,WAAW;QACXC;QACAC;QACAC,QAAQ8B,MAAM9B,MAAM;QACpBC,KAAK;YAAE0C,KAAK;QAAsC;QAClDxC,UAAU2B,MAAM3B,QAAQ;IAC1B;IACA,OAAO,aAAKuC;QAAQX;;AACtB;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,eAAekB,qBAAqBnB,KAe1C;IACC,MAAMlC,cAAcT;IACpB,IAAI,CAACS,aAAa;QAChB,OAAO;YAAE4B,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAiB;IAC7E;IACA,IAAI,CAACK,MAAMoB,MAAM,EAAE;QACjB,OAAO;YAAE1B,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAe;IAC3E;IACA,MAAMiB,SAAS,MAAMhD,aAAa;QAChCE;QACAC,WAAW;QACX,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,+BAA+B;QAC/BC,QAAQtB,oBAAoB;YAAE2E,eAAerB,MAAMsB,YAAY;QAAC;QAChErD,UAAUlB,mBAAmBiD,MAAMoB,MAAM;QACzCjD,KAAK;YAAE0C,KAAK;QAA8B;QAC1CxC,UAAU2B,MAAM3B,QAAQ;IAC1B;IACA,uEAAuE;IACvE,OAAO,aAAKuC;QAAQX,qBAAqB;;AAC3C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDC,GACD,OAAO,eAAesB,uBAAuBvB,KAW5C;IACC,MAAMlC,cAAcT;IACpB,IAAI,CAACS,aAAa;QAChB,OAAO;YAAE4B,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAiB;IAC7E;IACA,IAAI,CAACK,MAAMwB,SAAS,EAAE;QACpB,OAAO;YAAE9B,MAAM;YAAOO,qBAAqB;YAAON,QAAQ;QAAe;IAC3E;IACA,MAAMiB,SAAS,MAAMhD,aAAa;QAChCE;QACAC,WAAW;QACX,oEAAoE;QACpE,oEAAoE;QACpE,WAAW;QACXC,QAAQtB,oBAAoB,CAAC;QAC7BuB,UAAUlB,mBAAmBiD,MAAMwB,SAAS;QAC5CrD,KAAK;YAAE0C,KAAK;QAAgC;QAC5CxC,UAAU2B,MAAM3B,QAAQ;IAC1B;IACA,uEAAuE;IACvE,OAAO,aAAKuC;QAAQX,qBAAqB;;AAC3C"}