@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/org-billing.js

@@ -0,0 +1,236 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { deploymentLivemode } from "@aglyn/aglyn/app-utils/stripe-deployment-mode";
+import { ORG_BILLING_DOC_ID, ORG_BILLING_SUBCOLLECTION, STRIPE_CUSTOMER_ID_TEST_FIELD, STRIPE_CUSTOMER_INDEX_COLLECTION, hasInlineOrgBilling, orgBillingStatusFrom, pickOrgBillingFields } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "./firebase-admin.js";
+/**
+ * Server-side accessors for the manager-gated billing document (AGL-1028).
+ *
+ * Every server surface that used to read `orgs/{orgId}.stripeCustomerId` /
+ * `.subscription` / `.seatAddons` goes through here instead. All of them are
+ * Admin SDK, so rules never applied to them — this is a path change, not a
+ * permission change. The permission change is entirely in the rules, where the
+ * new subcollection is gated on `canManageOrg()`.
+ */ const db = ()=>firebaseAdmin.app().firestore();
+/**
+ * Which PHYSICAL field holds this deployment's Stripe customer id (AGL-2486).
+ *
+ * Live keeps `stripeCustomerId`, so live behaviour is byte-identical to before
+ * this existed and no stored document needs migrating. Test mode gets its own
+ * slot, which starts empty on every org — the first test-mode checkout mints a
+ * fresh test customer instead of sending a live `cus_…` to a `sk_test` key and
+ * taking a 502.
+ *
+ * Read at call time rather than at module load: a spec flips
+ * `process.env.STRIPE_SECRET_KEY` between cases, and a cached verdict would
+ * make the second case answer for the first.
+ */ function customerIdField() {
+    return deploymentLivemode() ? 'stripeCustomerId' : STRIPE_CUSTOMER_ID_TEST_FIELD;
+}
+/**
+ * Collapse a stored billing document to the logical shape callers expect.
+ *
+ * `stripeCustomerId` on the RESULT always means "the customer id for the mode
+ * this deployment spends in". The test id never leaks out under its physical
+ * name, and — the part that matters — test mode does NOT fall back to the live
+ * id when its own slot is empty. That fallback is precisely the bug: it is what
+ * sent `cus_UuQjDdd1oxPMNH` to a `sk_test` key.
+ */ function projectBillingMode(doc) {
+    const stored = _extends({}, doc != null ? doc : {});
+    const testId = stored[STRIPE_CUSTOMER_ID_TEST_FIELD];
+    // The physical twin never reaches a caller in either mode: every reader
+    // treats `stripeCustomerId` as THE customer, so a second field carrying a
+    // second answer is exactly the ambiguity this fix removes.
+    delete stored[STRIPE_CUSTOMER_ID_TEST_FIELD];
+    if (deploymentLivemode()) return stored;
+    // No `??` fallback to the live id. That fallback IS the bug.
+    stored['stripeCustomerId'] = testId != null ? testId : null;
+    return stored;
+}
+/** `orgs/{orgId}/billing/stripe`. */ export function orgBillingRef(orgId) {
+    return db().collection('orgs').doc(orgId).collection(ORG_BILLING_SUBCOLLECTION).doc(ORG_BILLING_DOC_ID);
+}
+/**
+ * Reads an org's commercial keys, falling back to the org doc.
+ *
+ * The fallback is what makes the migration safe to land in pieces: a reader
+ * repointed here keeps working against an org that has not been backfilled
+ * yet, and keeps working if the backfill missed one. It stops being reachable
+ * only when the inline fields are finally deleted from the org doc — which is
+ * the LAST step, taken once production has been observed reading from the new
+ * location.
+ *
+ * Without it, the failure mode is silent and expensive: a missing billing doc
+ * reads as `undefined`, which every caller downstream interprets as "no
+ * subscription", i.e. a paying workspace rendered as Free.
+ */ export async function readOrgBilling(orgId) {
+    if (!orgId) return {};
+    return projectBillingMode(await readStoredOrgBilling(orgId));
+}
+/**
+ * The STORED document, before any mode projection — both physical ids intact.
+ *
+ * Private on purpose: a caller holding this holds two answers to "which
+ * customer", which is the ambiguity `projectBillingMode` exists to remove. It
+ * is factored out only so the mode census below reads the very same bytes
+ * `readOrgBilling` reads, org-doc fallback included. Two separate reads would
+ * be two chances to diverge, and the census exists precisely to explain what
+ * `readOrgBilling` returned.
+ */ async function readStoredOrgBilling(orgId) {
+    const billingSnapshot = await orgBillingRef(orgId).get();
+    if (billingSnapshot.exists) {
+        var _billingSnapshot_data;
+        return (_billingSnapshot_data = billingSnapshot.data()) != null ? _billingSnapshot_data : {};
+    }
+    const orgSnapshot = await db().collection('orgs').doc(orgId).get();
+    // The legacy inline fields predate mode-keying entirely, so anything found
+    // there is a LIVE id by construction — the org doc was last written by a
+    // `sk_live_` deployment. Projected by the caller all the same, so a
+    // test-mode read of an un-backfilled org gets no customer rather than a live
+    // one.
+    return pickOrgBillingFields(orgSnapshot.data());
+}
+/**
+ * Which Stripe MODES this org has a stored customer for (AGL-2486, follow-up).
+ *
+ * `readOrgBilling` answering `stripeCustomerId: null` has two completely
+ * different meanings — "this workspace has never been billed" and "this
+ * workspace's customer lives in the other Stripe world and THIS deployment
+ * cannot see it" — and every surface downstream rendered them as the same
+ * sentence, "No invoices yet." That is the swallowed-query-as-measured-zero
+ * shape: nothing looks wrong, and the wrong reading is the reassuring one.
+ *
+ * The fix is NOT to fall back to the other mode's id — that fallback is the
+ * original bug, and it stays deleted. It is to let a caller say which of the
+ * two silences it is looking at.
+ *
+ * Returns BOOLEANS, never ids. A test-mode surface asking this question must
+ * not come away holding a live `cus_…`: it would have no legitimate use for
+ * one, and putting it in a JSON response would publish a live customer id to
+ * every browser on a test deployment.
+ */ export async function readOrgBillingCustomerModes(orgId) {
+    if (!orgId) return {
+        live: false,
+        test: false
+    };
+    const stored = await readStoredOrgBilling(orgId);
+    // A stored `null` (the webhook's "Stripe says this is gone") and an empty
+    // string are both absences, so presence is a non-empty STRING — not `in`,
+    // and not truthiness on an unknown.
+    const present = (value)=>typeof value === 'string' && value.length > 0;
+    return {
+        live: present(stored['stripeCustomerId']),
+        test: present(stored[STRIPE_CUSTOMER_ID_TEST_FIELD])
+    };
+}
+/**
+ * Writes the commercial keys to the billing doc, and onto the org doc the
+ * entitlement inputs that stay there.
+ *
+ * Three writes, one batch:
+ *
+ * 1. the billing doc itself, `merge: true` to match what the org-doc write did;
+ * 2. the org doc, merged, with what entitlement resolution reads there:
+ *    `billingStatus`, so the AGL-275 dunning banner keeps working for
+ *    non-managers who can no longer read `subscription`; and `seatAddons`,
+ *    which never moved (`ORG_BILLING_MOVED_KEYS`), whenever the patch carries
+ *    the add-on quantities;
+ * 3. the `stripeCustomers` reverse index, so the webhook can still resolve an
+ *    org from a Stripe customer id without a query.
+ *
+ * `writeInline` mirrored the keys back onto the org doc as well. It was on
+ * during the migration so a rollback lost nothing, and is now OFF: writing them
+ * inline is what the whole issue exists to stop, and leaving it on would let the
+ * next Stripe webhook silently re-add the fields minutes after they were
+ * deleted, re-opening the exposure with nothing to show for it.
+ *
+ * The option survives for a deliberate one-off rollback, and nothing passes it.
+ *
+ * The READ fallback in `readOrgBilling` deliberately stays. It costs one get on
+ * a doc that no longer exists, and it is the only thing standing between an org
+ * the backfill somehow missed and a paying workspace rendering as Free.
+ */ export async function writeOrgBilling(orgId, patch, options = {}) {
+    if (!orgId) return;
+    const { writeInline = false } = options;
+    const fields = pickOrgBillingFields(patch);
+    // The logical key becomes the mode's PHYSICAL key (AGL-2486). A test-mode
+    // write therefore cannot overwrite the live customer id — which it silently
+    // did before this, destroying the live linkage on the first completed test
+    // checkout.
+    const field = customerIdField();
+    if (field !== 'stripeCustomerId' && 'stripeCustomerId' in fields) {
+        fields[field] = fields['stripeCustomerId'];
+        delete fields['stripeCustomerId'];
+    }
+    const batch = db().batch();
+    const orgRef = db().collection('orgs').doc(orgId);
+    batch.set(orgBillingRef(orgId), fields, {
+        merge: true
+    });
+    // The status mirror is derived, so it is only written when this patch
+    // actually carries a subscription — otherwise a partial update (a seat-addon
+    // change, say) would blank the banner's input.
+    const orgPatch = writeInline ? _extends({}, fields) : {};
+    if (patch.subscription !== undefined) {
+        orgPatch['billingStatus'] = orgBillingStatusFrom(patch);
+    }
+    // The add-on quantities are what grants and removes an add-on, and the org
+    // doc is the only place they are read from: a subscription sync that wrote
+    // them nowhere would charge for an add-on bought at checkout without
+    // granting it, and leave a removed one in place. Merged with the rest of
+    // this patch, so the explicit zeros of a sync converge while a key the
+    // subscription items do not name survives.
+    if (patch.seatAddons !== undefined) {
+        orgPatch['seatAddons'] = patch.seatAddons;
+    }
+    if (Object.keys(orgPatch).length) batch.set(orgRef, orgPatch, {
+        merge: true
+    });
+    // Off the PHYSICAL field, so a test-mode write indexes its own customer.
+    // The index needs no mode-keying of its own: it is keyed by the customer id,
+    // and Stripe ids are unique across modes, so the live and test entries are
+    // two documents that both resolve to this org.
+    const customerId = fields[field];
+    if (typeof customerId === 'string' && customerId) {
+        batch.set(db().collection(STRIPE_CUSTOMER_INDEX_COLLECTION).doc(customerId), {
+            orgId,
+            updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+        }, {
+            merge: true
+        });
+    }
+    await batch.commit();
+}
+/**
+ * Resolves an org id from a Stripe customer id.
+ *
+ * Prefers the reverse index; falls back to the legacy `where('stripeCustomerId')`
+ * query on `orgs` for customers whose index entry has not been written yet.
+ * The fallback disappears with the inline fields.
+ */ export async function findOrgIdByStripeCustomer(customerId) {
+    var _ref;
+    var _legacy_docs_;
+    if (!customerId) return null;
+    const indexed = await db().collection(STRIPE_CUSTOMER_INDEX_COLLECTION).doc(customerId).get();
+    const mapped = indexed.get('orgId');
+    if (typeof mapped === 'string' && mapped) return mapped;
+    const legacy = await db().collection('orgs').where('stripeCustomerId', '==', customerId).limit(1).get();
+    return (_ref = (_legacy_docs_ = legacy.docs[0]) == null ? void 0 : _legacy_docs_.id) != null ? _ref : null;
+}
+/** Re-exported so callers do not need a second import to test migration state. */ export { hasInlineOrgBilling };
+
+//# sourceMappingURL=org-billing.js.map

package/src/lib/server/org-billing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/org-billing.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { deploymentLivemode } from '@aglyn/aglyn/app-utils/stripe-deployment-mode'\nimport {\n  ORG_BILLING_DOC_ID,\n  ORG_BILLING_SUBCOLLECTION,\n  STRIPE_CUSTOMER_ID_TEST_FIELD,\n  STRIPE_CUSTOMER_INDEX_COLLECTION,\n  hasInlineOrgBilling,\n  orgBillingStatusFrom,\n  pickOrgBillingFields,\n  type OrgBillingDoc,\n  type OrgInlineBilling,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from './firebase-admin'\n\n/**\n * Server-side accessors for the manager-gated billing document (AGL-1028).\n *\n * Every server surface that used to read `orgs/{orgId}.stripeCustomerId` /\n * `.subscription` / `.seatAddons` goes through here instead. All of them are\n * Admin SDK, so rules never applied to them — this is a path change, not a\n * permission change. The permission change is entirely in the rules, where the\n * new subcollection is gated on `canManageOrg()`.\n */\n\nconst db = () => firebaseAdmin.app().firestore()\n\n/**\n * Which PHYSICAL field holds this deployment's Stripe customer id (AGL-2486).\n *\n * Live keeps `stripeCustomerId`, so live behaviour is byte-identical to before\n * this existed and no stored document needs migrating. Test mode gets its own\n * slot, which starts empty on every org — the first test-mode checkout mints a\n * fresh test customer instead of sending a live `cus_…` to a `sk_test` key and\n * taking a 502.\n *\n * Read at call time rather than at module load: a spec flips\n * `process.env.STRIPE_SECRET_KEY` between cases, and a cached verdict would\n * make the second case answer for the first.\n */\nfunction customerIdField(): 'stripeCustomerId' | typeof STRIPE_CUSTOMER_ID_TEST_FIELD {\n  return deploymentLivemode() ? 'stripeCustomerId' : STRIPE_CUSTOMER_ID_TEST_FIELD\n}\n\n/**\n * Collapse a stored billing document to the logical shape callers expect.\n *\n * `stripeCustomerId` on the RESULT always means \"the customer id for the mode\n * this deployment spends in\". The test id never leaks out under its physical\n * name, and — the part that matters — test mode does NOT fall back to the live\n * id when its own slot is empty. That fallback is precisely the bug: it is what\n * sent `cus_UuQjDdd1oxPMNH` to a `sk_test` key.\n */\nfunction projectBillingMode(doc: OrgBillingDoc): OrgBillingDoc {\n  const stored = { ...(doc ?? {}) } as Record<string, unknown>\n  const testId = stored[STRIPE_CUSTOMER_ID_TEST_FIELD]\n  // The physical twin never reaches a caller in either mode: every reader\n  // treats `stripeCustomerId` as THE customer, so a second field carrying a\n  // second answer is exactly the ambiguity this fix removes.\n  delete stored[STRIPE_CUSTOMER_ID_TEST_FIELD]\n  if (deploymentLivemode()) return stored as OrgBillingDoc\n  // No `??` fallback to the live id. That fallback IS the bug.\n  stored['stripeCustomerId'] = (testId ?? null) as string | null\n  return stored as OrgBillingDoc\n}\n\n/** `orgs/{orgId}/billing/stripe`. */\nexport function orgBillingRef(orgId: string) {\n  return db()\n    .collection('orgs')\n    .doc(orgId)\n    .collection(ORG_BILLING_SUBCOLLECTION)\n    .doc(ORG_BILLING_DOC_ID)\n}\n\n/**\n * Reads an org's commercial keys, falling back to the org doc.\n *\n * The fallback is what makes the migration safe to land in pieces: a reader\n * repointed here keeps working against an org that has not been backfilled\n * yet, and keeps working if the backfill missed one. It stops being reachable\n * only when the inline fields are finally deleted from the org doc — which is\n * the LAST step, taken once production has been observed reading from the new\n * location.\n *\n * Without it, the failure mode is silent and expensive: a missing billing doc\n * reads as `undefined`, which every caller downstream interprets as \"no\n * subscription\", i.e. a paying workspace rendered as Free.\n */\nexport async function readOrgBilling(orgId: string): Promise<OrgBillingDoc> {\n  if (!orgId) return {}\n  return projectBillingMode(await readStoredOrgBilling(orgId))\n}\n\n/**\n * The STORED document, before any mode projection — both physical ids intact.\n *\n * Private on purpose: a caller holding this holds two answers to \"which\n * customer\", which is the ambiguity `projectBillingMode` exists to remove. It\n * is factored out only so the mode census below reads the very same bytes\n * `readOrgBilling` reads, org-doc fallback included. Two separate reads would\n * be two chances to diverge, and the census exists precisely to explain what\n * `readOrgBilling` returned.\n */\nasync function readStoredOrgBilling(orgId: string): Promise<OrgBillingDoc> {\n  const billingSnapshot = await orgBillingRef(orgId).get()\n  if (billingSnapshot.exists) {\n    return (billingSnapshot.data() ?? {}) as OrgBillingDoc\n  }\n  const orgSnapshot = await db().collection('orgs').doc(orgId).get()\n  // The legacy inline fields predate mode-keying entirely, so anything found\n  // there is a LIVE id by construction — the org doc was last written by a\n  // `sk_live_` deployment. Projected by the caller all the same, so a\n  // test-mode read of an un-backfilled org gets no customer rather than a live\n  // one.\n  return pickOrgBillingFields(orgSnapshot.data() as never) as OrgBillingDoc\n}\n\n/**\n * Which Stripe MODES this org has a stored customer for (AGL-2486, follow-up).\n *\n * `readOrgBilling` answering `stripeCustomerId: null` has two completely\n * different meanings — \"this workspace has never been billed\" and \"this\n * workspace's customer lives in the other Stripe world and THIS deployment\n * cannot see it\" — and every surface downstream rendered them as the same\n * sentence, \"No invoices yet.\" That is the swallowed-query-as-measured-zero\n * shape: nothing looks wrong, and the wrong reading is the reassuring one.\n *\n * The fix is NOT to fall back to the other mode's id — that fallback is the\n * original bug, and it stays deleted. It is to let a caller say which of the\n * two silences it is looking at.\n *\n * Returns BOOLEANS, never ids. A test-mode surface asking this question must\n * not come away holding a live `cus_…`: it would have no legitimate use for\n * one, and putting it in a JSON response would publish a live customer id to\n * every browser on a test deployment.\n */\nexport async function readOrgBillingCustomerModes(\n  orgId: string,\n): Promise<{ live: boolean; test: boolean }> {\n  if (!orgId) return { live: false, test: false }\n  const stored = (await readStoredOrgBilling(orgId)) as Record<string, unknown>\n  // A stored `null` (the webhook's \"Stripe says this is gone\") and an empty\n  // string are both absences, so presence is a non-empty STRING — not `in`,\n  // and not truthiness on an unknown.\n  const present = (value: unknown) => typeof value === 'string' && value.length > 0\n  return {\n    live: present(stored['stripeCustomerId']),\n    test: present(stored[STRIPE_CUSTOMER_ID_TEST_FIELD]),\n  }\n}\n\n/**\n * Writes the commercial keys to the billing doc, and onto the org doc the\n * entitlement inputs that stay there.\n *\n * Three writes, one batch:\n *\n * 1. the billing doc itself, `merge: true` to match what the org-doc write did;\n * 2. the org doc, merged, with what entitlement resolution reads there:\n *    `billingStatus`, so the AGL-275 dunning banner keeps working for\n *    non-managers who can no longer read `subscription`; and `seatAddons`,\n *    which never moved (`ORG_BILLING_MOVED_KEYS`), whenever the patch carries\n *    the add-on quantities;\n * 3. the `stripeCustomers` reverse index, so the webhook can still resolve an\n *    org from a Stripe customer id without a query.\n *\n * `writeInline` mirrored the keys back onto the org doc as well. It was on\n * during the migration so a rollback lost nothing, and is now OFF: writing them\n * inline is what the whole issue exists to stop, and leaving it on would let the\n * next Stripe webhook silently re-add the fields minutes after they were\n * deleted, re-opening the exposure with nothing to show for it.\n *\n * The option survives for a deliberate one-off rollback, and nothing passes it.\n *\n * The READ fallback in `readOrgBilling` deliberately stays. It costs one get on\n * a doc that no longer exists, and it is the only thing standing between an org\n * the backfill somehow missed and a paying workspace rendering as Free.\n */\nexport async function writeOrgBilling(\n  orgId: string,\n  patch: Partial<OrgBillingDoc> & Pick<OrgInlineBilling, 'seatAddons'>,\n  options: { writeInline?: boolean } = {},\n): Promise<void> {\n  if (!orgId) return\n  const { writeInline = false } = options\n  const fields = pickOrgBillingFields(patch as never) as Record<string, unknown>\n  // The logical key becomes the mode's PHYSICAL key (AGL-2486). A test-mode\n  // write therefore cannot overwrite the live customer id — which it silently\n  // did before this, destroying the live linkage on the first completed test\n  // checkout.\n  const field = customerIdField()\n  if (field !== 'stripeCustomerId' && 'stripeCustomerId' in fields) {\n    fields[field] = fields['stripeCustomerId']\n    delete fields['stripeCustomerId']\n  }\n  const batch = db().batch()\n  const orgRef = db().collection('orgs').doc(orgId)\n\n  batch.set(orgBillingRef(orgId), fields, { merge: true })\n\n  // The status mirror is derived, so it is only written when this patch\n  // actually carries a subscription — otherwise a partial update (a seat-addon\n  // change, say) would blank the banner's input.\n  const orgPatch: Record<string, unknown> = writeInline ? { ...fields } : {}\n  if (patch.subscription !== undefined) {\n    orgPatch['billingStatus'] = orgBillingStatusFrom(patch)\n  }\n  // The add-on quantities are what grants and removes an add-on, and the org\n  // doc is the only place they are read from: a subscription sync that wrote\n  // them nowhere would charge for an add-on bought at checkout without\n  // granting it, and leave a removed one in place. Merged with the rest of\n  // this patch, so the explicit zeros of a sync converge while a key the\n  // subscription items do not name survives.\n  if (patch.seatAddons !== undefined) {\n    orgPatch['seatAddons'] = patch.seatAddons\n  }\n  if (Object.keys(orgPatch).length) batch.set(orgRef, orgPatch, { merge: true })\n\n  // Off the PHYSICAL field, so a test-mode write indexes its own customer.\n  // The index needs no mode-keying of its own: it is keyed by the customer id,\n  // and Stripe ids are unique across modes, so the live and test entries are\n  // two documents that both resolve to this org.\n  const customerId = fields[field]\n  if (typeof customerId === 'string' && customerId) {\n    batch.set(\n      db().collection(STRIPE_CUSTOMER_INDEX_COLLECTION).doc(customerId),\n      { orgId, updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp() },\n      { merge: true },\n    )\n  }\n\n  await batch.commit()\n}\n\n/**\n * Resolves an org id from a Stripe customer id.\n *\n * Prefers the reverse index; falls back to the legacy `where('stripeCustomerId')`\n * query on `orgs` for customers whose index entry has not been written yet.\n * The fallback disappears with the inline fields.\n */\nexport async function findOrgIdByStripeCustomer(\n  customerId: string,\n): Promise<string | null> {\n  if (!customerId) return null\n  const indexed = await db()\n    .collection(STRIPE_CUSTOMER_INDEX_COLLECTION)\n    .doc(customerId)\n    .get()\n  const mapped = indexed.get('orgId')\n  if (typeof mapped === 'string' && mapped) return mapped\n  const legacy = await db()\n    .collection('orgs')\n    .where('stripeCustomerId', '==', customerId)\n    .limit(1)\n    .get()\n  return legacy.docs[0]?.id ?? null\n}\n\n/** Re-exported so callers do not need a second import to test migration state. */\nexport { hasInlineOrgBilling }\n"],"names":["deploymentLivemode","ORG_BILLING_DOC_ID","ORG_BILLING_SUBCOLLECTION","STRIPE_CUSTOMER_ID_TEST_FIELD","STRIPE_CUSTOMER_INDEX_COLLECTION","hasInlineOrgBilling","orgBillingStatusFrom","pickOrgBillingFields","firebaseAdmin","db","app","firestore","customerIdField","projectBillingMode","doc","stored","testId","orgBillingRef","orgId","collection","readOrgBilling","readStoredOrgBilling","billingSnapshot","get","exists","data","orgSnapshot","readOrgBillingCustomerModes","live","test","present","value","length","writeOrgBilling","patch","options","writeInline","fields","field","batch","orgRef","set","merge","orgPatch","subscription","undefined","seatAddons","Object","keys","customerId","updatedAt","FieldValue","serverTimestamp","commit","findOrgIdByStripeCustomer","legacy","indexed","mapped","where","limit","docs","id"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kBAAkB,QAAQ,gDAA+C;AAClF,SACEC,kBAAkB,EAClBC,yBAAyB,EACzBC,6BAA6B,EAC7BC,gCAAgC,EAChCC,mBAAmB,EACnBC,oBAAoB,EACpBC,oBAAoB,QAGf,sBAAqB;AAC5B,SAASC,aAAa,QAAQ,sBAAkB;AAEhD;;;;;;;;CAQC,GAED,MAAMC,KAAK,IAAMD,cAAcE,GAAG,GAAGC,SAAS;AAE9C;;;;;;;;;;;;CAYC,GACD,SAASC;IACP,OAAOZ,uBAAuB,qBAAqBG;AACrD;AAEA;;;;;;;;CAQC,GACD,SAASU,mBAAmBC,GAAkB;IAC5C,MAAMC,SAAS,aAAMD,cAAAA,MAAO,CAAC;IAC7B,MAAME,SAASD,MAAM,CAACZ,8BAA8B;IACpD,wEAAwE;IACxE,0EAA0E;IAC1E,2DAA2D;IAC3D,OAAOY,MAAM,CAACZ,8BAA8B;IAC5C,IAAIH,sBAAsB,OAAOe;IACjC,6DAA6D;IAC7DA,MAAM,CAAC,mBAAmB,GAAIC,iBAAAA,SAAU;IACxC,OAAOD;AACT;AAEA,mCAAmC,GACnC,OAAO,SAASE,cAAcC,KAAa;IACzC,OAAOT,KACJU,UAAU,CAAC,QACXL,GAAG,CAACI,OACJC,UAAU,CAACjB,2BACXY,GAAG,CAACb;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAemB,eAAeF,KAAa;IAChD,IAAI,CAACA,OAAO,OAAO,CAAC;IACpB,OAAOL,mBAAmB,MAAMQ,qBAAqBH;AACvD;AAEA;;;;;;;;;CASC,GACD,eAAeG,qBAAqBH,KAAa;IAC/C,MAAMI,kBAAkB,MAAML,cAAcC,OAAOK,GAAG;IACtD,IAAID,gBAAgBE,MAAM,EAAE;YAClBF;QAAR,QAAQA,wBAAAA,gBAAgBG,IAAI,cAApBH,wBAA0B,CAAC;IACrC;IACA,MAAMI,cAAc,MAAMjB,KAAKU,UAAU,CAAC,QAAQL,GAAG,CAACI,OAAOK,GAAG;IAChE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,6EAA6E;IAC7E,OAAO;IACP,OAAOhB,qBAAqBmB,YAAYD,IAAI;AAC9C;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeE,4BACpBT,KAAa;IAEb,IAAI,CAACA,OAAO,OAAO;QAAEU,MAAM;QAAOC,MAAM;IAAM;IAC9C,MAAMd,SAAU,MAAMM,qBAAqBH;IAC3C,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,MAAMY,UAAU,CAACC,QAAmB,OAAOA,UAAU,YAAYA,MAAMC,MAAM,GAAG;IAChF,OAAO;QACLJ,MAAME,QAAQf,MAAM,CAAC,mBAAmB;QACxCc,MAAMC,QAAQf,MAAM,CAACZ,8BAA8B;IACrD;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,eAAe8B,gBACpBf,KAAa,EACbgB,KAAoE,EACpEC,UAAqC,CAAC,CAAC;IAEvC,IAAI,CAACjB,OAAO;IACZ,MAAM,EAAEkB,cAAc,KAAK,EAAE,GAAGD;IAChC,MAAME,SAAS9B,qBAAqB2B;IACpC,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,YAAY;IACZ,MAAMI,QAAQ1B;IACd,IAAI0B,UAAU,sBAAsB,sBAAsBD,QAAQ;QAChEA,MAAM,CAACC,MAAM,GAAGD,MAAM,CAAC,mBAAmB;QAC1C,OAAOA,MAAM,CAAC,mBAAmB;IACnC;IACA,MAAME,QAAQ9B,KAAK8B,KAAK;IACxB,MAAMC,SAAS/B,KAAKU,UAAU,CAAC,QAAQL,GAAG,CAACI;IAE3CqB,MAAME,GAAG,CAACxB,cAAcC,QAAQmB,QAAQ;QAAEK,OAAO;IAAK;IAEtD,sEAAsE;IACtE,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAMC,WAAoCP,cAAc,aAAKC,UAAW,CAAC;IACzE,IAAIH,MAAMU,YAAY,KAAKC,WAAW;QACpCF,QAAQ,CAAC,gBAAgB,GAAGrC,qBAAqB4B;IACnD;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,2CAA2C;IAC3C,IAAIA,MAAMY,UAAU,KAAKD,WAAW;QAClCF,QAAQ,CAAC,aAAa,GAAGT,MAAMY,UAAU;IAC3C;IACA,IAAIC,OAAOC,IAAI,CAACL,UAAUX,MAAM,EAAEO,MAAME,GAAG,CAACD,QAAQG,UAAU;QAAED,OAAO;IAAK;IAE5E,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,+CAA+C;IAC/C,MAAMO,aAAaZ,MAAM,CAACC,MAAM;IAChC,IAAI,OAAOW,eAAe,YAAYA,YAAY;QAChDV,MAAME,GAAG,CACPhC,KAAKU,UAAU,CAACf,kCAAkCU,GAAG,CAACmC,aACtD;YAAE/B;YAAOgC,WAAW1C,cAAcG,SAAS,CAACwC,UAAU,CAACC,eAAe;QAAG,GACzE;YAAEV,OAAO;QAAK;IAElB;IAEA,MAAMH,MAAMc,MAAM;AACpB;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,0BACpBL,UAAkB;;QAcXM;IAZP,IAAI,CAACN,YAAY,OAAO;IACxB,MAAMO,UAAU,MAAM/C,KACnBU,UAAU,CAACf,kCACXU,GAAG,CAACmC,YACJ1B,GAAG;IACN,MAAMkC,SAASD,QAAQjC,GAAG,CAAC;IAC3B,IAAI,OAAOkC,WAAW,YAAYA,QAAQ,OAAOA;IACjD,MAAMF,SAAS,MAAM9C,KAClBU,UAAU,CAAC,QACXuC,KAAK,CAAC,oBAAoB,MAAMT,YAChCU,KAAK,CAAC,GACNpC,GAAG;IACN,gBAAOgC,gBAAAA,OAAOK,IAAI,CAAC,EAAE,qBAAdL,cAAgBM,EAAE,mBAAI;AAC/B;AAEA,gFAAgF,GAChF,SAASxD,mBAAmB,GAAE"}