@aglyn/tenant-data-admin 1.0.0-beta.199 → 1.0.0-beta.201

package/src/lib/server/payment-risk-record.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PaymentRiskSignal } from '@aglyn/aglyn/app-utils/payment-risk';
+import type { AglynNotificationType } from '@aglyn/aglyn/app-utils/notifications';
+/** The notifier's shape: `notifyHostManagers` from the admin barrel. */
+export type PaymentRiskNotifier = (hostId: string, payload: {
+    type: AglynNotificationType;
+    title: string;
+    body: string;
+    link: string;
+}) => Promise<void>;
+export interface RecordPaymentRiskInput {
+    ref: FirebaseFirestore.DocumentReference;
+    signal: PaymentRiskSignal;
+    /** The site whose managers are told. Empty tells nobody. */
+    hostId: string;
+    /** What the record is, as the merchant calls it: `Order 1042`, `Booking`. */
+    subjectLabel: string;
+    /** The console path the notification opens. */
+    link: string;
+    /** The plugin's own notification type: `content.order`, `content.booking`. */
+    notificationType: AglynNotificationType;
+    /**
+     * More fields to write in the same transaction, from the record as read —
+     * a plugin's own activity line (an order's timeline) rides here.
+     */
+    extraUpdate?: (data: Record<string, unknown>) => Record<string, unknown>;
+}
+/**
+ * Stamp `signal` on `input.ref` and notify, once. Returns true when this
+ * delivery wrote it; false for a redelivery or a record that is gone.
+ * Throws only when the write throws, which the webhook answers with a 500 and
+ * Stripe's redelivery.
+ */
+export declare function recordPaymentRiskOnRecord(input: RecordPaymentRiskInput, deps: {
+    firestore: FirebaseFirestore.Firestore;
+    notify: PaymentRiskNotifier;
+}): Promise<boolean>;
+/**
+ * Record a dispute's outcome on the signal already stamped for it. Silent:
+ * the plugin that owns money movement on a lost dispute says so itself.
+ */
+export declare function settlePaymentRiskDisputeOnRecord(ref: FirebaseFirestore.DocumentReference, disputeId: string, outcome: string, deps: {
+    firestore: FirebaseFirestore.Firestore;
+}): Promise<boolean>;

package/src/lib/server/payment-risk-record.js

@@ -0,0 +1,76 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * STAMP A STRIPE FRAUD SIGNAL ON A MERCHANT'S RECORD (AGL-3360).
+ *
+ * The server half of `@aglyn/aglyn/app-utils/payment-risk`. A plugin that
+ * finds its own record behind a charge — an order, a booking — hands the
+ * document here, and this writes the `paymentRisk` field once per signal and
+ * tells the site's managers once. Any plugin that sells through Stripe uses
+ * the same two calls; nothing about the record's kind is known here.
+ *
+ * NOTHING IS REFUNDED OR CANCELED. The merchant decides for their own
+ * customer; the notification says so.
+ *
+ * Dependencies are passed in — the Firestore handle and the notifier — so a
+ * plugin's spec that substitutes the admin barrel substitutes these too.
+ *=========================================*/ import { addPaymentRiskSignal, NOTHING_MOVED, PAYMENT_RISK_FIELD, paymentRiskAdvice, paymentRiskTitle, settlePaymentRiskDispute } from "@aglyn/aglyn/app-utils/payment-risk";
+/**
+ * Stamp `signal` on `input.ref` and notify, once. Returns true when this
+ * delivery wrote it; false for a redelivery or a record that is gone.
+ * Throws only when the write throws, which the webhook answers with a 500 and
+ * Stripe's redelivery.
+ */ export async function recordPaymentRiskOnRecord(input, deps) {
+    const written = await deps.firestore.runTransaction(async (transaction)=>{
+        var _fresh_data;
+        const fresh = await transaction.get(input.ref);
+        if (!fresh.exists) return false;
+        const data = (_fresh_data = fresh.data()) != null ? _fresh_data : {};
+        const next = addPaymentRiskSignal(data[PAYMENT_RISK_FIELD], input.signal);
+        if (!next) return false;
+        transaction.update(input.ref, _extends({}, input.extraUpdate ? input.extraUpdate(data) : {}, {
+            [PAYMENT_RISK_FIELD]: next
+        }));
+        return true;
+    });
+    if (written && input.hostId) {
+        await deps.notify(input.hostId, {
+            type: input.notificationType,
+            title: paymentRiskTitle(input.signal.kind),
+            body: `${input.subjectLabel}. ${paymentRiskAdvice(input.signal.kind)}` + (input.signal.detail ? ` Stripe says: ${input.signal.detail.replace(/_/g, ' ')}.` : '') + ` ${NOTHING_MOVED}`,
+            link: input.link
+        }).catch(()=>undefined);
+    }
+    return written;
+}
+/**
+ * Record a dispute's outcome on the signal already stamped for it. Silent:
+ * the plugin that owns money movement on a lost dispute says so itself.
+ */ export async function settlePaymentRiskDisputeOnRecord(ref, disputeId, outcome, deps) {
+    return deps.firestore.runTransaction(async (transaction)=>{
+        const fresh = await transaction.get(ref);
+        if (!fresh.exists) return false;
+        const next = settlePaymentRiskDispute(fresh.get(PAYMENT_RISK_FIELD), disputeId, outcome);
+        if (!next) return false;
+        transaction.update(ref, {
+            [PAYMENT_RISK_FIELD]: next
+        });
+        return true;
+    });
+}
+
+//# sourceMappingURL=payment-risk-record.js.map

package/src/lib/server/payment-risk-record.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-risk-record.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * STAMP A STRIPE FRAUD SIGNAL ON A MERCHANT'S RECORD (AGL-3360).\n *\n * The server half of `@aglyn/aglyn/app-utils/payment-risk`. A plugin that\n * finds its own record behind a charge — an order, a booking — hands the\n * document here, and this writes the `paymentRisk` field once per signal and\n * tells the site's managers once. Any plugin that sells through Stripe uses\n * the same two calls; nothing about the record's kind is known here.\n *\n * NOTHING IS REFUNDED OR CANCELED. The merchant decides for their own\n * customer; the notification says so.\n *\n * Dependencies are passed in — the Firestore handle and the notifier — so a\n * plugin's spec that substitutes the admin barrel substitutes these too.\n *=========================================*/\n\nimport {\n  addPaymentRiskSignal,\n  NOTHING_MOVED,\n  PAYMENT_RISK_FIELD,\n  type PaymentRisk,\n  type PaymentRiskSignal,\n  paymentRiskAdvice,\n  paymentRiskTitle,\n  settlePaymentRiskDispute,\n} from '@aglyn/aglyn/app-utils/payment-risk'\nimport type { AglynNotificationType } from '@aglyn/aglyn/app-utils/notifications'\n\n/** The notifier's shape: `notifyHostManagers` from the admin barrel. */\nexport type PaymentRiskNotifier = (\n  hostId: string,\n  payload: {\n    type: AglynNotificationType\n    title: string\n    body: string\n    link: string\n  },\n) => Promise<void>\n\nexport interface RecordPaymentRiskInput {\n  ref: FirebaseFirestore.DocumentReference\n  signal: PaymentRiskSignal\n  /** The site whose managers are told. Empty tells nobody. */\n  hostId: string\n  /** What the record is, as the merchant calls it: `Order 1042`, `Booking`. */\n  subjectLabel: string\n  /** The console path the notification opens. */\n  link: string\n  /** The plugin's own notification type: `content.order`, `content.booking`. */\n  notificationType: AglynNotificationType\n  /**\n   * More fields to write in the same transaction, from the record as read —\n   * a plugin's own activity line (an order's timeline) rides here.\n   */\n  extraUpdate?: (data: Record<string, unknown>) => Record<string, unknown>\n}\n\n/**\n * Stamp `signal` on `input.ref` and notify, once. Returns true when this\n * delivery wrote it; false for a redelivery or a record that is gone.\n * Throws only when the write throws, which the webhook answers with a 500 and\n * Stripe's redelivery.\n */\nexport async function recordPaymentRiskOnRecord(\n  input: RecordPaymentRiskInput,\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notify: PaymentRiskNotifier\n  },\n): Promise<boolean> {\n  const written = await deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(input.ref)\n    if (!fresh.exists) return false\n    const data = (fresh.data() ?? {}) as Record<string, unknown>\n    const next = addPaymentRiskSignal(\n      data[PAYMENT_RISK_FIELD] as PaymentRisk | undefined,\n      input.signal,\n    )\n    if (!next) return false\n    transaction.update(input.ref, {\n      ...(input.extraUpdate ? input.extraUpdate(data) : {}),\n      [PAYMENT_RISK_FIELD]: next,\n    })\n    return true\n  })\n  if (written && input.hostId) {\n    await deps\n      .notify(input.hostId, {\n        type: input.notificationType,\n        title: paymentRiskTitle(input.signal.kind),\n        body:\n          `${input.subjectLabel}. ${paymentRiskAdvice(input.signal.kind)}` +\n          (input.signal.detail\n            ? ` Stripe says: ${input.signal.detail.replace(/_/g, ' ')}.`\n            : '') +\n          ` ${NOTHING_MOVED}`,\n        link: input.link,\n      })\n      .catch(() => undefined)\n  }\n  return written\n}\n\n/**\n * Record a dispute's outcome on the signal already stamped for it. Silent:\n * the plugin that owns money movement on a lost dispute says so itself.\n */\nexport async function settlePaymentRiskDisputeOnRecord(\n  ref: FirebaseFirestore.DocumentReference,\n  disputeId: string,\n  outcome: string,\n  deps: { firestore: FirebaseFirestore.Firestore },\n): Promise<boolean> {\n  return deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(ref)\n    if (!fresh.exists) return false\n    const next = settlePaymentRiskDispute(\n      fresh.get(PAYMENT_RISK_FIELD) as PaymentRisk | undefined,\n      disputeId,\n      outcome,\n    )\n    if (!next) return false\n    transaction.update(ref, { [PAYMENT_RISK_FIELD]: next })\n    return true\n  })\n}\n"],"names":["addPaymentRiskSignal","NOTHING_MOVED","PAYMENT_RISK_FIELD","paymentRiskAdvice","paymentRiskTitle","settlePaymentRiskDispute","recordPaymentRiskOnRecord","input","deps","written","firestore","runTransaction","transaction","fresh","get","ref","exists","data","next","signal","update","extraUpdate","hostId","notify","type","notificationType","title","kind","body","subjectLabel","detail","replace","link","catch","undefined","settlePaymentRiskDisputeOnRecord","disputeId","outcome"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;2CAc2C,GAE3C,SACEA,oBAAoB,EACpBC,aAAa,EACbC,kBAAkB,EAGlBC,iBAAiB,EACjBC,gBAAgB,EAChBC,wBAAwB,QACnB,sCAAqC;AAgC5C;;;;;CAKC,GACD,OAAO,eAAeC,0BACpBC,KAA6B,EAC7BC,IAGC;IAED,MAAMC,UAAU,MAAMD,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;YAG3CC;QAFd,MAAMA,QAAQ,MAAMD,YAAYE,GAAG,CAACP,MAAMQ,GAAG;QAC7C,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAMC,QAAQJ,cAAAA,MAAMI,IAAI,cAAVJ,cAAgB,CAAC;QAC/B,MAAMK,OAAOlB,qBACXiB,IAAI,CAACf,mBAAmB,EACxBK,MAAMY,MAAM;QAEd,IAAI,CAACD,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACb,MAAMQ,GAAG,EAAE,aACxBR,MAAMc,WAAW,GAAGd,MAAMc,WAAW,CAACJ,QAAQ,CAAC;YACnD,CAACf,mBAAmB,EAAEgB;;QAExB,OAAO;IACT;IACA,IAAIT,WAAWF,MAAMe,MAAM,EAAE;QAC3B,MAAMd,KACHe,MAAM,CAAChB,MAAMe,MAAM,EAAE;YACpBE,MAAMjB,MAAMkB,gBAAgB;YAC5BC,OAAOtB,iBAAiBG,MAAMY,MAAM,CAACQ,IAAI;YACzCC,MACE,GAAGrB,MAAMsB,YAAY,CAAC,EAAE,EAAE1B,kBAAkBI,MAAMY,MAAM,CAACQ,IAAI,GAAG,GAC/DpB,CAAAA,MAAMY,MAAM,CAACW,MAAM,GAChB,CAAC,cAAc,EAAEvB,MAAMY,MAAM,CAACW,MAAM,CAACC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,GAC1D,EAAC,IACL,CAAC,CAAC,EAAE9B,eAAe;YACrB+B,MAAMzB,MAAMyB,IAAI;QAClB,GACCC,KAAK,CAAC,IAAMC;IACjB;IACA,OAAOzB;AACT;AAEA;;;CAGC,GACD,OAAO,eAAe0B,iCACpBpB,GAAwC,EACxCqB,SAAiB,EACjBC,OAAe,EACf7B,IAAgD;IAEhD,OAAOA,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;QAC1C,MAAMC,QAAQ,MAAMD,YAAYE,GAAG,CAACC;QACpC,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAME,OAAOb,yBACXQ,MAAMC,GAAG,CAACZ,qBACVkC,WACAC;QAEF,IAAI,CAACnB,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACL,KAAK;YAAE,CAACb,mBAAmB,EAAEgB;QAAK;QACrD,OAAO;IACT;AACF"}

package/src/lib/server/replay-erasures.js

@@ -16,6 +16,7 @@
  */ import { FieldValue, Timestamp } from "firebase-admin/firestore";
 import { firebaseAdmin } from "./firebase-admin.js";
 import { eraseOrg, eraseUser } from "./erase.js";
+import { addAdminAudit } from "./admin-audit-write.js";
 /**
  * How long `adminAudit` rows stay queryable before `/api/admin/audit-archive`
  * moves them to Storage. A replay window older than this cannot be answered
@@ -187,7 +188,7 @@ import { eraseOrg, eraseUser } from "./erase.js";
     // a real run only: a plan did not replay anything, and an audit row saying
     // it did is the mistake this shape has to make impossible.
     if (!dryRun) {
-        await firestore.collection('adminAudit').add({
+        await addAdminAudit(firestore, {
             actorUid,
             action: 'erasures.replayed',
             target: `restore/${new Date(sinceMs).toISOString()}`,

package/src/lib/server/replay-erasures.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/replay-erasures.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { FieldValue, Timestamp } from 'firebase-admin/firestore'\nimport { firebaseAdmin } from './firebase-admin'\nimport { eraseOrg, eraseUser } from './erase'\n\n/**\n * How long `adminAudit` rows stay queryable before `/api/admin/audit-archive`\n * moves them to Storage. A replay window older than this cannot be answered\n * from Firestore at all, which is the one failure mode that must not look\n * like \"nothing to replay\".\n */\nexport const AUDIT_HOT_WINDOW_MS = 90 * 24 * 60 * 60 * 1000\n\n/** What happened to one erasure that had to be re-applied. */\nexport interface ReplayedErasure {\n  kind: 'org' | 'user'\n  /** The org id or uid the original erasure destroyed. */\n  id: string\n  /**\n   * - `replayed` — it had come back and has been erased again.\n   * - `absent` — nothing was resurrected; the restore did not reach it.\n   * - `blocked` — it came back and could NOT be erased again. The reason is\n   *   on `detail`, and this is the outcome a human has to act on.\n   */\n  outcome: 'replayed' | 'absent' | 'blocked'\n  detail?: string\n}\n\nexport interface ReplayErasuresResult {\n  /** Snapshot instant the restore was taken from — the replay's lower bound. */\n  sinceMs: number\n  /** True when nothing was written: a plan, not a replay. */\n  dryRun: boolean\n  /**\n   * Set when the answer cannot be trusted. Today the only value is\n   * `'audit-window'`: `sinceMs` predates the hot `adminAudit` window, so rows\n   * naming erasures inside the restored span may already be in the Storage\n   * archive and this run cannot see them. **An empty list under this warning\n   * is not evidence that there was nothing to replay.**\n   */\n  incomplete?: 'audit-window'\n  /** Audit rows examined. */\n  examined: number\n  entries: ReplayedErasure[]\n  /** Convenience for the exit code — any `blocked` entry, or `incomplete`. */\n  ok: boolean\n}\n\n/**\n * Re-apply every erasure a restore resurrected (AGL-1975).\n *\n * Live DPA §11 promises, in terms: *\"a deletion instruction survives any\n * restoration — data deleted at Customer's instruction and later restored from\n * a backup will be deleted again.\"* Nothing implemented it. This does.\n *\n * **The reason it is needed is specific, not theoretical.** A Firestore import\n * is **merge-by-id, not replace** (`docs/DISASTER_RECOVERY.md` Procedures C\n * and D both say so), so importing a pre-erasure export into `(default)`\n * silently reinstates every document an erasure deleted — the whole org tree,\n * the profile, the support threads — alongside the recovery it was actually\n * run for. It happens during an incident, when nobody is reading a DPA, and\n * nothing anywhere says it happened.\n *\n * **It calls `eraseOrg`/`eraseUser` and implements no cascade of its own.**\n * That is the AGL-1481 rule and this is exactly the shape it was written for:\n * a replay tool with its own copy of the sweep list would be a second\n * implementation of a cascade delete, and the last one drifted within a week —\n * so a replay would faithfully re-erase the six collections somebody\n * remembered and quietly leave the four they did not.\n *\n * ## The two things that make a naive replay fail\n *\n *   1. **`eraseOrg` refuses without a live request.** It re-reads\n *      `erasureRequestedAt` and the 7-day hold, deliberately, so a stale or\n *      cancelled request can never delete. A restored org may carry no request\n *      at all: if the customer asked AFTER the snapshot was taken, the\n *      resurrected document predates the ask. The audit row is what closes\n *      that — `after.requestedAt` records which request the original run\n *      fulfilled — so the request is reinstated at its original instant before\n *      the erasure is re-run. The hold is satisfied by construction: that\n *      instant is in the past by at least the hold, or the first erasure would\n *      not have executed either.\n *   2. **`eraseUser` refuses an org owner.** A restore can bring back both a\n *      person and the workspace they owned, and `userErasureBlockers` then\n *      correctly refuses to cascade. That is reported as `blocked`, never\n *      forced: cascading here would delete a workspace as a side effect of\n *      replaying a personal-account erasure, which is precisely the consent\n *      boundary `eraseUser` exists to hold. Erase the org first — usually it\n *      has its own audit row in the same list — and run this again.\n *\n * ## Why the audit window is a first-class result and not a log line\n *\n * The rows this reads are hot for 90 days before the archiver moves them to\n * Storage. That comfortably covers the 7-day PITR window and the ≤7-day usable\n * managed backup. It does **not** cover a 90-day-old GCS export, where the\n * erasure record and the export can age out within days of each other. A\n * replay over a window that old returns an empty list for two\n * indistinguishable reasons — nothing was erased, or nothing is left to read —\n * so it says `incomplete: 'audit-window'` and reports `ok: false`. An empty\n * list is not the same as a clean bill, and this is the one place that\n * distinction decides whether a published promise was kept.\n *\n * The query is a range on `at` alone, with the action filtered in memory\n * rather than in the query. `where('action','in',[…]).where('at','>=',…)`\n * needs a composite index that does not exist, and an erasure replay is not\n * where anybody should discover a `FAILED_PRECONDITION` — a single-field range\n * is auto-indexed everywhere, including a freshly restored database whose\n * composite indexes are still building.\n */\nexport async function replayErasuresSince(options: {\n  /** The instant the restored snapshot was taken. */\n  sinceMs: number\n  /** Report what WOULD be re-erased and change nothing. Default true. */\n  dryRun?: boolean\n  /** Who is answerable, for the new audit rows. */\n  actorUid?: string\n  now?: number\n}): Promise<ReplayErasuresResult> {\n  const {\n    sinceMs,\n    dryRun = true,\n    actorUid = 'script:replay-erasures',\n    now = Date.now(),\n  } = options\n  const firestore = firebaseAdmin.app().firestore()\n\n  const incomplete =\n    now - sinceMs > AUDIT_HOT_WINDOW_MS ? ('audit-window' as const) : undefined\n\n  const rows = await firestore\n    .collection('adminAudit')\n    .where('at', '>=', Timestamp.fromMillis(sinceMs))\n    .orderBy('at', 'asc')\n    .get()\n\n  const entries: ReplayedErasure[] = []\n  for (const row of rows.docs) {\n    const action = row.get('action') as string | undefined\n    if (action !== 'org.erased' && action !== 'user.erased') continue\n    const target = String(row.get('target') ?? '')\n    const kind = action === 'org.erased' ? 'org' : 'user'\n    const id = target.split('/')[1] ?? ''\n    if (!id) continue\n\n    if (kind === 'org') {\n      const orgRef = firestore.collection('orgs').doc(id)\n      const org = await orgRef.get()\n      if (!org.exists) {\n        entries.push({ kind, id, outcome: 'absent' })\n        continue\n      }\n      // Which request the original run fulfilled. Without it a restored org\n      // that was never asked to be erased before the snapshot is refused with\n      // `no-request` — the erasure would silently not replay.\n      const requestedAt = Number(row.get('after')?.requestedAt ?? 0)\n      if (dryRun) {\n        entries.push({\n          kind,\n          id,\n          outcome: 'replayed',\n          detail: 'would re-erase (plan)',\n        })\n        continue\n      }\n      if (requestedAt) {\n        await orgRef.set(\n          { erasureRequestedAt: Timestamp.fromMillis(requestedAt) },\n          { merge: true },\n        )\n      }\n      const result = await eraseOrg(id, { actorUid })\n      entries.push(\n        result.ok\n          ? { kind, id, outcome: 'replayed' }\n          : { kind, id, outcome: 'blocked', detail: result.skippedReason },\n      )\n      continue\n    }\n\n    // A person. `profiles/{uid}` is checked as well as `users/{uid}`: the\n    // public identity is a separate top-level document (AGL-1970), so a\n    // restore can bring it back on its own.\n    const [user, profile] = await Promise.all([\n      firestore.collection('users').doc(id).get(),\n      firestore.collection('profiles').doc(id).get(),\n    ])\n    if (!user.exists && !profile.exists) {\n      entries.push({ kind, id, outcome: 'absent' })\n      continue\n    }\n    if (dryRun) {\n      entries.push({\n        kind,\n        id,\n        outcome: 'replayed',\n        detail: 'would re-erase (plan)',\n      })\n      continue\n    }\n    const result = await eraseUser(id)\n    entries.push(\n      result.ok\n        ? { kind, id, outcome: 'replayed' }\n        : {\n            kind,\n            id,\n            outcome: 'blocked',\n            // `owns-orgs` is the one a human has to act on: erase the\n            // workspace first, then run this again.\n            detail:\n              result.skippedReason === 'owns-orgs'\n                ? `owns-orgs (${(result.blockers ?? [])\n                    .map((blocker) => blocker.orgId)\n                    .join(', ')})`\n                : result.skippedReason,\n          },\n    )\n  }\n\n  const blocked = entries.some((entry) => entry.outcome === 'blocked')\n\n  // A record that the promise was kept — or that it could not be. Written on\n  // a real run only: a plan did not replay anything, and an audit row saying\n  // it did is the mistake this shape has to make impossible.\n  if (!dryRun) {\n    await firestore\n      .collection('adminAudit')\n      .add({\n        actorUid,\n        action: 'erasures.replayed',\n        target: `restore/${new Date(sinceMs).toISOString()}`,\n        before: { examined: rows.size },\n        after: {\n          sinceMs,\n          incomplete: incomplete ?? null,\n          replayed: entries.filter((e) => e.outcome === 'replayed').length,\n          absent: entries.filter((e) => e.outcome === 'absent').length,\n          blocked: entries.filter((e) => e.outcome === 'blocked').length,\n        },\n        at: FieldValue.serverTimestamp(),\n      })\n      .catch(() => undefined)\n  }\n\n  return {\n    sinceMs,\n    dryRun,\n    incomplete,\n    examined: rows.size,\n    entries,\n    ok: !blocked && !incomplete,\n  }\n}\n"],"names":["FieldValue","Timestamp","firebaseAdmin","eraseOrg","eraseUser","AUDIT_HOT_WINDOW_MS","replayErasuresSince","options","sinceMs","dryRun","actorUid","now","Date","firestore","app","incomplete","undefined","rows","collection","where","fromMillis","orderBy","get","entries","row","docs","target","result","action","String","kind","id","split","orgRef","doc","org","exists","push","outcome","requestedAt","Number","detail","set","erasureRequestedAt","merge","ok","skippedReason","user","profile","Promise","all","blockers","map","blocker","orgId","join","blocked","some","entry","add","toISOString","before","examined","size","after","replayed","filter","e","length","absent","at","serverTimestamp","catch"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,SAAS,QAAQ,2BAA0B;AAChE,SAASC,aAAa,QAAQ,sBAAkB;AAChD,SAASC,QAAQ,EAAEC,SAAS,QAAQ,aAAS;AAE7C;;;;;CAKC,GACD,OAAO,MAAMC,sBAAsB,KAAK,KAAK,KAAK,KAAK,KAAI;AAqC3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DC,GACD,OAAO,eAAeC,oBAAoBC,OAQzC;IACC,MAAM,EACJC,OAAO,EACPC,SAAS,IAAI,EACbC,WAAW,wBAAwB,EACnCC,MAAMC,KAAKD,GAAG,EAAE,EACjB,GAAGJ;IACJ,MAAMM,YAAYX,cAAcY,GAAG,GAAGD,SAAS;IAE/C,MAAME,aACJJ,MAAMH,UAAUH,sBAAuB,iBAA2BW;IAEpE,MAAMC,OAAO,MAAMJ,UAChBK,UAAU,CAAC,cACXC,KAAK,CAAC,MAAM,MAAMlB,UAAUmB,UAAU,CAACZ,UACvCa,OAAO,CAAC,MAAM,OACdC,GAAG;IAEN,MAAMC,UAA6B,EAAE;IACrC,KAAK,MAAMC,OAAOP,KAAKQ,IAAI,CAAE;YAGLD,UAEXE,gBAsEkBC;QA1E7B,MAAMC,SAASJ,IAAIF,GAAG,CAAC;QACvB,IAAIM,WAAW,gBAAgBA,WAAW,eAAe;QACzD,MAAMF,SAASG,QAAOL,WAAAA,IAAIF,GAAG,CAAC,qBAARE,WAAqB;QAC3C,MAAMM,OAAOF,WAAW,eAAe,QAAQ;QAC/C,MAAMG,MAAKL,iBAAAA,OAAOM,KAAK,CAAC,IAAI,CAAC,EAAE,YAApBN,iBAAwB;QACnC,IAAI,CAACK,IAAI;QAET,IAAID,SAAS,OAAO;;gBAUSN;YAT3B,MAAMS,SAASpB,UAAUK,UAAU,CAAC,QAAQgB,GAAG,CAACH;YAChD,MAAMI,MAAM,MAAMF,OAAOX,GAAG;YAC5B,IAAI,CAACa,IAAIC,MAAM,EAAE;gBACfb,QAAQc,IAAI,CAAC;oBAAEP;oBAAMC;oBAAIO,SAAS;gBAAS;gBAC3C;YACF;YACA,sEAAsE;YACtE,wEAAwE;YACxE,wDAAwD;YACxD,MAAMC,cAAcC,gBAAOhB,YAAAA,IAAIF,GAAG,CAAC,6BAARE,UAAkBe,WAAW,mBAAI;YAC5D,IAAI9B,QAAQ;gBACVc,QAAQc,IAAI,CAAC;oBACXP;oBACAC;oBACAO,SAAS;oBACTG,QAAQ;gBACV;gBACA;YACF;YACA,IAAIF,aAAa;gBACf,MAAMN,OAAOS,GAAG,CACd;oBAAEC,oBAAoB1C,UAAUmB,UAAU,CAACmB;gBAAa,GACxD;oBAAEK,OAAO;gBAAK;YAElB;YACA,MAAMjB,SAAS,MAAMxB,SAAS4B,IAAI;gBAAErB;YAAS;YAC7Ca,QAAQc,IAAI,CACVV,OAAOkB,EAAE,GACL;gBAAEf;gBAAMC;gBAAIO,SAAS;YAAW,IAChC;gBAAER;gBAAMC;gBAAIO,SAAS;gBAAWG,QAAQd,OAAOmB,aAAa;YAAC;YAEnE;QACF;QAEA,sEAAsE;QACtE,oEAAoE;QACpE,wCAAwC;QACxC,MAAM,CAACC,MAAMC,QAAQ,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACxCrC,UAAUK,UAAU,CAAC,SAASgB,GAAG,CAACH,IAAIT,GAAG;YACzCT,UAAUK,UAAU,CAAC,YAAYgB,GAAG,CAACH,IAAIT,GAAG;SAC7C;QACD,IAAI,CAACyB,KAAKX,MAAM,IAAI,CAACY,QAAQZ,MAAM,EAAE;YACnCb,QAAQc,IAAI,CAAC;gBAAEP;gBAAMC;gBAAIO,SAAS;YAAS;YAC3C;QACF;QACA,IAAI7B,QAAQ;YACVc,QAAQc,IAAI,CAAC;gBACXP;gBACAC;gBACAO,SAAS;gBACTG,QAAQ;YACV;YACA;QACF;QACA,MAAMd,SAAS,MAAMvB,UAAU2B;QAC/BR,QAAQc,IAAI,CACVV,OAAOkB,EAAE,GACL;YAAEf;YAAMC;YAAIO,SAAS;QAAW,IAChC;YACER;YACAC;YACAO,SAAS;YACT,0DAA0D;YAC1D,wCAAwC;YACxCG,QACEd,OAAOmB,aAAa,KAAK,cACrB,CAAC,WAAW,EAAE,EAACnB,mBAAAA,OAAOwB,QAAQ,YAAfxB,mBAAmB,EAAE,EACjCyB,GAAG,CAAC,CAACC,UAAYA,QAAQC,KAAK,EAC9BC,IAAI,CAAC,MAAM,CAAC,CAAC,GAChB5B,OAAOmB,aAAa;QAC5B;IAER;IAEA,MAAMU,UAAUjC,QAAQkC,IAAI,CAAC,CAACC,QAAUA,MAAMpB,OAAO,KAAK;IAE1D,2EAA2E;IAC3E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,CAAC7B,QAAQ;QACX,MAAMI,UACHK,UAAU,CAAC,cACXyC,GAAG,CAAC;YACHjD;YACAkB,QAAQ;YACRF,QAAQ,CAAC,QAAQ,EAAE,IAAId,KAAKJ,SAASoD,WAAW,IAAI;YACpDC,QAAQ;gBAAEC,UAAU7C,KAAK8C,IAAI;YAAC;YAC9BC,OAAO;gBACLxD;gBACAO,UAAU,EAAEA,qBAAAA,aAAc;gBAC1BkD,UAAU1C,QAAQ2C,MAAM,CAAC,CAACC,IAAMA,EAAE7B,OAAO,KAAK,YAAY8B,MAAM;gBAChEC,QAAQ9C,QAAQ2C,MAAM,CAAC,CAACC,IAAMA,EAAE7B,OAAO,KAAK,UAAU8B,MAAM;gBAC5DZ,SAASjC,QAAQ2C,MAAM,CAAC,CAACC,IAAMA,EAAE7B,OAAO,KAAK,WAAW8B,MAAM;YAChE;YACAE,IAAItE,WAAWuE,eAAe;QAChC,GACCC,KAAK,CAAC,IAAMxD;IACjB;IAEA,OAAO;QACLR;QACAC;QACAM;QACA+C,UAAU7C,KAAK8C,IAAI;QACnBxC;QACAsB,IAAI,CAACW,WAAW,CAACzC;IACnB;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/replay-erasures.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { FieldValue, Timestamp } from 'firebase-admin/firestore'\nimport { firebaseAdmin } from './firebase-admin'\nimport { eraseOrg, eraseUser } from './erase'\nimport { addAdminAudit } from './admin-audit-write'\n\n/**\n * How long `adminAudit` rows stay queryable before `/api/admin/audit-archive`\n * moves them to Storage. A replay window older than this cannot be answered\n * from Firestore at all, which is the one failure mode that must not look\n * like \"nothing to replay\".\n */\nexport const AUDIT_HOT_WINDOW_MS = 90 * 24 * 60 * 60 * 1000\n\n/** What happened to one erasure that had to be re-applied. */\nexport interface ReplayedErasure {\n  kind: 'org' | 'user'\n  /** The org id or uid the original erasure destroyed. */\n  id: string\n  /**\n   * - `replayed` — it had come back and has been erased again.\n   * - `absent` — nothing was resurrected; the restore did not reach it.\n   * - `blocked` — it came back and could NOT be erased again. The reason is\n   *   on `detail`, and this is the outcome a human has to act on.\n   */\n  outcome: 'replayed' | 'absent' | 'blocked'\n  detail?: string\n}\n\nexport interface ReplayErasuresResult {\n  /** Snapshot instant the restore was taken from — the replay's lower bound. */\n  sinceMs: number\n  /** True when nothing was written: a plan, not a replay. */\n  dryRun: boolean\n  /**\n   * Set when the answer cannot be trusted. Today the only value is\n   * `'audit-window'`: `sinceMs` predates the hot `adminAudit` window, so rows\n   * naming erasures inside the restored span may already be in the Storage\n   * archive and this run cannot see them. **An empty list under this warning\n   * is not evidence that there was nothing to replay.**\n   */\n  incomplete?: 'audit-window'\n  /** Audit rows examined. */\n  examined: number\n  entries: ReplayedErasure[]\n  /** Convenience for the exit code — any `blocked` entry, or `incomplete`. */\n  ok: boolean\n}\n\n/**\n * Re-apply every erasure a restore resurrected (AGL-1975).\n *\n * Live DPA §11 promises, in terms: *\"a deletion instruction survives any\n * restoration — data deleted at Customer's instruction and later restored from\n * a backup will be deleted again.\"* Nothing implemented it. This does.\n *\n * **The reason it is needed is specific, not theoretical.** A Firestore import\n * is **merge-by-id, not replace** (`docs/DISASTER_RECOVERY.md` Procedures C\n * and D both say so), so importing a pre-erasure export into `(default)`\n * silently reinstates every document an erasure deleted — the whole org tree,\n * the profile, the support threads — alongside the recovery it was actually\n * run for. It happens during an incident, when nobody is reading a DPA, and\n * nothing anywhere says it happened.\n *\n * **It calls `eraseOrg`/`eraseUser` and implements no cascade of its own.**\n * That is the AGL-1481 rule and this is exactly the shape it was written for:\n * a replay tool with its own copy of the sweep list would be a second\n * implementation of a cascade delete, and the last one drifted within a week —\n * so a replay would faithfully re-erase the six collections somebody\n * remembered and quietly leave the four they did not.\n *\n * ## The two things that make a naive replay fail\n *\n *   1. **`eraseOrg` refuses without a live request.** It re-reads\n *      `erasureRequestedAt` and the 7-day hold, deliberately, so a stale or\n *      cancelled request can never delete. A restored org may carry no request\n *      at all: if the customer asked AFTER the snapshot was taken, the\n *      resurrected document predates the ask. The audit row is what closes\n *      that — `after.requestedAt` records which request the original run\n *      fulfilled — so the request is reinstated at its original instant before\n *      the erasure is re-run. The hold is satisfied by construction: that\n *      instant is in the past by at least the hold, or the first erasure would\n *      not have executed either.\n *   2. **`eraseUser` refuses an org owner.** A restore can bring back both a\n *      person and the workspace they owned, and `userErasureBlockers` then\n *      correctly refuses to cascade. That is reported as `blocked`, never\n *      forced: cascading here would delete a workspace as a side effect of\n *      replaying a personal-account erasure, which is precisely the consent\n *      boundary `eraseUser` exists to hold. Erase the org first — usually it\n *      has its own audit row in the same list — and run this again.\n *\n * ## Why the audit window is a first-class result and not a log line\n *\n * The rows this reads are hot for 90 days before the archiver moves them to\n * Storage. That comfortably covers the 7-day PITR window and the ≤7-day usable\n * managed backup. It does **not** cover a 90-day-old GCS export, where the\n * erasure record and the export can age out within days of each other. A\n * replay over a window that old returns an empty list for two\n * indistinguishable reasons — nothing was erased, or nothing is left to read —\n * so it says `incomplete: 'audit-window'` and reports `ok: false`. An empty\n * list is not the same as a clean bill, and this is the one place that\n * distinction decides whether a published promise was kept.\n *\n * The query is a range on `at` alone, with the action filtered in memory\n * rather than in the query. `where('action','in',[…]).where('at','>=',…)`\n * needs a composite index that does not exist, and an erasure replay is not\n * where anybody should discover a `FAILED_PRECONDITION` — a single-field range\n * is auto-indexed everywhere, including a freshly restored database whose\n * composite indexes are still building.\n */\nexport async function replayErasuresSince(options: {\n  /** The instant the restored snapshot was taken. */\n  sinceMs: number\n  /** Report what WOULD be re-erased and change nothing. Default true. */\n  dryRun?: boolean\n  /** Who is answerable, for the new audit rows. */\n  actorUid?: string\n  now?: number\n}): Promise<ReplayErasuresResult> {\n  const {\n    sinceMs,\n    dryRun = true,\n    actorUid = 'script:replay-erasures',\n    now = Date.now(),\n  } = options\n  const firestore = firebaseAdmin.app().firestore()\n\n  const incomplete =\n    now - sinceMs > AUDIT_HOT_WINDOW_MS ? ('audit-window' as const) : undefined\n\n  const rows = await firestore\n    .collection('adminAudit')\n    .where('at', '>=', Timestamp.fromMillis(sinceMs))\n    .orderBy('at', 'asc')\n    .get()\n\n  const entries: ReplayedErasure[] = []\n  for (const row of rows.docs) {\n    const action = row.get('action') as string | undefined\n    if (action !== 'org.erased' && action !== 'user.erased') continue\n    const target = String(row.get('target') ?? '')\n    const kind = action === 'org.erased' ? 'org' : 'user'\n    const id = target.split('/')[1] ?? ''\n    if (!id) continue\n\n    if (kind === 'org') {\n      const orgRef = firestore.collection('orgs').doc(id)\n      const org = await orgRef.get()\n      if (!org.exists) {\n        entries.push({ kind, id, outcome: 'absent' })\n        continue\n      }\n      // Which request the original run fulfilled. Without it a restored org\n      // that was never asked to be erased before the snapshot is refused with\n      // `no-request` — the erasure would silently not replay.\n      const requestedAt = Number(row.get('after')?.requestedAt ?? 0)\n      if (dryRun) {\n        entries.push({\n          kind,\n          id,\n          outcome: 'replayed',\n          detail: 'would re-erase (plan)',\n        })\n        continue\n      }\n      if (requestedAt) {\n        await orgRef.set(\n          { erasureRequestedAt: Timestamp.fromMillis(requestedAt) },\n          { merge: true },\n        )\n      }\n      const result = await eraseOrg(id, { actorUid })\n      entries.push(\n        result.ok\n          ? { kind, id, outcome: 'replayed' }\n          : { kind, id, outcome: 'blocked', detail: result.skippedReason },\n      )\n      continue\n    }\n\n    // A person. `profiles/{uid}` is checked as well as `users/{uid}`: the\n    // public identity is a separate top-level document (AGL-1970), so a\n    // restore can bring it back on its own.\n    const [user, profile] = await Promise.all([\n      firestore.collection('users').doc(id).get(),\n      firestore.collection('profiles').doc(id).get(),\n    ])\n    if (!user.exists && !profile.exists) {\n      entries.push({ kind, id, outcome: 'absent' })\n      continue\n    }\n    if (dryRun) {\n      entries.push({\n        kind,\n        id,\n        outcome: 'replayed',\n        detail: 'would re-erase (plan)',\n      })\n      continue\n    }\n    const result = await eraseUser(id)\n    entries.push(\n      result.ok\n        ? { kind, id, outcome: 'replayed' }\n        : {\n            kind,\n            id,\n            outcome: 'blocked',\n            // `owns-orgs` is the one a human has to act on: erase the\n            // workspace first, then run this again.\n            detail:\n              result.skippedReason === 'owns-orgs'\n                ? `owns-orgs (${(result.blockers ?? [])\n                    .map((blocker) => blocker.orgId)\n                    .join(', ')})`\n                : result.skippedReason,\n          },\n    )\n  }\n\n  const blocked = entries.some((entry) => entry.outcome === 'blocked')\n\n  // A record that the promise was kept — or that it could not be. Written on\n  // a real run only: a plan did not replay anything, and an audit row saying\n  // it did is the mistake this shape has to make impossible.\n  if (!dryRun) {\n    await addAdminAudit(firestore, {\n      actorUid,\n      action: 'erasures.replayed',\n      target: `restore/${new Date(sinceMs).toISOString()}`,\n      before: { examined: rows.size },\n      after: {\n        sinceMs,\n        incomplete: incomplete ?? null,\n        replayed: entries.filter((e) => e.outcome === 'replayed').length,\n        absent: entries.filter((e) => e.outcome === 'absent').length,\n        blocked: entries.filter((e) => e.outcome === 'blocked').length,\n      },\n      at: FieldValue.serverTimestamp(),\n    })\n      .catch(() => undefined)\n  }\n\n  return {\n    sinceMs,\n    dryRun,\n    incomplete,\n    examined: rows.size,\n    entries,\n    ok: !blocked && !incomplete,\n  }\n}\n"],"names":["FieldValue","Timestamp","firebaseAdmin","eraseOrg","eraseUser","addAdminAudit","AUDIT_HOT_WINDOW_MS","replayErasuresSince","options","sinceMs","dryRun","actorUid","now","Date","firestore","app","incomplete","undefined","rows","collection","where","fromMillis","orderBy","get","entries","row","docs","target","result","action","String","kind","id","split","orgRef","doc","org","exists","push","outcome","requestedAt","Number","detail","set","erasureRequestedAt","merge","ok","skippedReason","user","profile","Promise","all","blockers","map","blocker","orgId","join","blocked","some","entry","toISOString","before","examined","size","after","replayed","filter","e","length","absent","at","serverTimestamp","catch"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,SAAS,QAAQ,2BAA0B;AAChE,SAASC,aAAa,QAAQ,sBAAkB;AAChD,SAASC,QAAQ,EAAEC,SAAS,QAAQ,aAAS;AAC7C,SAASC,aAAa,QAAQ,yBAAqB;AAEnD;;;;;CAKC,GACD,OAAO,MAAMC,sBAAsB,KAAK,KAAK,KAAK,KAAK,KAAI;AAqC3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DC,GACD,OAAO,eAAeC,oBAAoBC,OAQzC;IACC,MAAM,EACJC,OAAO,EACPC,SAAS,IAAI,EACbC,WAAW,wBAAwB,EACnCC,MAAMC,KAAKD,GAAG,EAAE,EACjB,GAAGJ;IACJ,MAAMM,YAAYZ,cAAca,GAAG,GAAGD,SAAS;IAE/C,MAAME,aACJJ,MAAMH,UAAUH,sBAAuB,iBAA2BW;IAEpE,MAAMC,OAAO,MAAMJ,UAChBK,UAAU,CAAC,cACXC,KAAK,CAAC,MAAM,MAAMnB,UAAUoB,UAAU,CAACZ,UACvCa,OAAO,CAAC,MAAM,OACdC,GAAG;IAEN,MAAMC,UAA6B,EAAE;IACrC,KAAK,MAAMC,OAAOP,KAAKQ,IAAI,CAAE;YAGLD,UAEXE,gBAsEkBC;QA1E7B,MAAMC,SAASJ,IAAIF,GAAG,CAAC;QACvB,IAAIM,WAAW,gBAAgBA,WAAW,eAAe;QACzD,MAAMF,SAASG,QAAOL,WAAAA,IAAIF,GAAG,CAAC,qBAARE,WAAqB;QAC3C,MAAMM,OAAOF,WAAW,eAAe,QAAQ;QAC/C,MAAMG,MAAKL,iBAAAA,OAAOM,KAAK,CAAC,IAAI,CAAC,EAAE,YAApBN,iBAAwB;QACnC,IAAI,CAACK,IAAI;QAET,IAAID,SAAS,OAAO;;gBAUSN;YAT3B,MAAMS,SAASpB,UAAUK,UAAU,CAAC,QAAQgB,GAAG,CAACH;YAChD,MAAMI,MAAM,MAAMF,OAAOX,GAAG;YAC5B,IAAI,CAACa,IAAIC,MAAM,EAAE;gBACfb,QAAQc,IAAI,CAAC;oBAAEP;oBAAMC;oBAAIO,SAAS;gBAAS;gBAC3C;YACF;YACA,sEAAsE;YACtE,wEAAwE;YACxE,wDAAwD;YACxD,MAAMC,cAAcC,gBAAOhB,YAAAA,IAAIF,GAAG,CAAC,6BAARE,UAAkBe,WAAW,mBAAI;YAC5D,IAAI9B,QAAQ;gBACVc,QAAQc,IAAI,CAAC;oBACXP;oBACAC;oBACAO,SAAS;oBACTG,QAAQ;gBACV;gBACA;YACF;YACA,IAAIF,aAAa;gBACf,MAAMN,OAAOS,GAAG,CACd;oBAAEC,oBAAoB3C,UAAUoB,UAAU,CAACmB;gBAAa,GACxD;oBAAEK,OAAO;gBAAK;YAElB;YACA,MAAMjB,SAAS,MAAMzB,SAAS6B,IAAI;gBAAErB;YAAS;YAC7Ca,QAAQc,IAAI,CACVV,OAAOkB,EAAE,GACL;gBAAEf;gBAAMC;gBAAIO,SAAS;YAAW,IAChC;gBAAER;gBAAMC;gBAAIO,SAAS;gBAAWG,QAAQd,OAAOmB,aAAa;YAAC;YAEnE;QACF;QAEA,sEAAsE;QACtE,oEAAoE;QACpE,wCAAwC;QACxC,MAAM,CAACC,MAAMC,QAAQ,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACxCrC,UAAUK,UAAU,CAAC,SAASgB,GAAG,CAACH,IAAIT,GAAG;YACzCT,UAAUK,UAAU,CAAC,YAAYgB,GAAG,CAACH,IAAIT,GAAG;SAC7C;QACD,IAAI,CAACyB,KAAKX,MAAM,IAAI,CAACY,QAAQZ,MAAM,EAAE;YACnCb,QAAQc,IAAI,CAAC;gBAAEP;gBAAMC;gBAAIO,SAAS;YAAS;YAC3C;QACF;QACA,IAAI7B,QAAQ;YACVc,QAAQc,IAAI,CAAC;gBACXP;gBACAC;gBACAO,SAAS;gBACTG,QAAQ;YACV;YACA;QACF;QACA,MAAMd,SAAS,MAAMxB,UAAU4B;QAC/BR,QAAQc,IAAI,CACVV,OAAOkB,EAAE,GACL;YAAEf;YAAMC;YAAIO,SAAS;QAAW,IAChC;YACER;YACAC;YACAO,SAAS;YACT,0DAA0D;YAC1D,wCAAwC;YACxCG,QACEd,OAAOmB,aAAa,KAAK,cACrB,CAAC,WAAW,EAAE,EAACnB,mBAAAA,OAAOwB,QAAQ,YAAfxB,mBAAmB,EAAE,EACjCyB,GAAG,CAAC,CAACC,UAAYA,QAAQC,KAAK,EAC9BC,IAAI,CAAC,MAAM,CAAC,CAAC,GAChB5B,OAAOmB,aAAa;QAC5B;IAER;IAEA,MAAMU,UAAUjC,QAAQkC,IAAI,CAAC,CAACC,QAAUA,MAAMpB,OAAO,KAAK;IAE1D,2EAA2E;IAC3E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,CAAC7B,QAAQ;QACX,MAAML,cAAcS,WAAW;YAC7BH;YACAkB,QAAQ;YACRF,QAAQ,CAAC,QAAQ,EAAE,IAAId,KAAKJ,SAASmD,WAAW,IAAI;YACpDC,QAAQ;gBAAEC,UAAU5C,KAAK6C,IAAI;YAAC;YAC9BC,OAAO;gBACLvD;gBACAO,UAAU,EAAEA,qBAAAA,aAAc;gBAC1BiD,UAAUzC,QAAQ0C,MAAM,CAAC,CAACC,IAAMA,EAAE5B,OAAO,KAAK,YAAY6B,MAAM;gBAChEC,QAAQ7C,QAAQ0C,MAAM,CAAC,CAACC,IAAMA,EAAE5B,OAAO,KAAK,UAAU6B,MAAM;gBAC5DX,SAASjC,QAAQ0C,MAAM,CAAC,CAACC,IAAMA,EAAE5B,OAAO,KAAK,WAAW6B,MAAM;YAChE;YACAE,IAAItE,WAAWuE,eAAe;QAChC,GACGC,KAAK,CAAC,IAAMvD;IACjB;IAEA,OAAO;QACLR;QACAC;QACAM;QACA8C,UAAU5C,KAAK6C,IAAI;QACnBvC;QACAsB,IAAI,CAACW,WAAW,CAACzC;IACnB;AACF"}

package/src/lib/server/sending-domains.d.ts

@@ -360,5 +360,11 @@ export declare function resolveHostSendingIdentity(options: {
  * declares a cache has also declared how long it may be trusted.
  */
 export declare function hostSendingIdentity(hostId: string | null | undefined, cache?: Map<string, SendingIdentityVerdict>): Promise<SendingIdentityVerdict>;
+/**
+ * The verdict a suspended site's mail gets: a refusal, whatever identity the
+ * site would otherwise have sent on. `sendEmail` reads it and answers
+ * `suspended` without calling the provider.
+ */
+export declare function suspendedSendingIdentity(scope: string | null | undefined): SendingIdentityVerdict;
 /** The record keys a surface highlights as outstanding. */
 export declare function outstandingSendingRecords(record: SendingDomainRecord): SendingDnsRecord[];

package/src/lib/server/sending-domains.js

@@ -65,9 +65,16 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * stopped there refuses sends, which is the correct behavior for a domain that
  * has no signing key.
  */ import { assessDmarc, assessSendingRecords, isPlatformSendingDomain, isSharedSendingDomain, normalizeLocalPart, normalizeSendingDomain, resolveSendingIdentity, safeProviderDetail, SENDING_SUBDOMAIN, sendingDnsRecords, sendingTrackingHost, sendingDomainRequiredRecords, sendingRecordKey, sharedTenantSendingFrom, validateSendingDomain } from "@aglyn/shared-util-email";
+import { lockdownMode } from "@aglyn/aglyn/server";
 import firebaseAdmin from "./firebase-admin.js";
 import { lookupCaa, lookupMx, lookupTxt } from "./dns-probe.js";
 import { getOrgForHost } from "./organizations.js";
+import { getSiteLockdown } from "./tenant-write-lockdown.js";
+// Also INSTALLS the outbound phishing screen's review store on `sendEmail`
+// (AGL-3356): every sender whose identity comes from `hostSendingIdentity`
+// has therefore installed the gate the workspace stamped below is read by.
+import { sendingWorkspaceFor } from "./outbound-send-review.js";
+import { flagLookalikeDomain } from "./hosted-page-review.js";
 const firestore = ()=>firebaseAdmin.app().firestore();
 /** Subcollection under the owning org. */ export const SENDING_DOMAINS_COLLECTION = 'sendingDomains';
 const domainRef = (orgId, domain)=>firestore().collection('orgs').doc(orgId).collection(SENDING_DOMAINS_COLLECTION).doc(domain);
@@ -150,6 +157,15 @@ const domainRef = (orgId, domain)=>firestore().collection('orgs').doc(orgId).col
     await ref.set(record, {
         merge: true
     });
+    // A domain that wears a brand (`paypa1.com`) goes to staff in the abuse
+    // queue the moment it is claimed — flagged, not refused (AGL-3362). Mail
+    // from it is held at the send seam whatever staff decide. Never throws.
+    await flagLookalikeDomain({
+        kind: 'sending',
+        hostId: null,
+        orgId: options.orgId,
+        domain
+    });
     return {
         record,
         error: null,
@@ -489,6 +505,17 @@ export async function listSendingDomains(orgId) {
     }), {
         merge: true
     });
+    // Again on verification, the moment it can actually send (AGL-3362): a
+    // claim added before this check existed is caught here. One row per
+    // domain, so this counts rather than re-alerts.
+    if (verified) {
+        await flagLookalikeDomain({
+            kind: 'sending',
+            hostId: null,
+            orgId,
+            domain
+        });
+    }
     return {
         record: readSendingDomainRecord(await ref.get()),
         missing: verdict.missing,
@@ -643,7 +670,7 @@ export async function listSendingDomains(orgId) {
  * a site sending on a domain that no longer authenticates. A caller that
  * declares a cache has also declared how long it may be trusted.
  */ export async function hostSendingIdentity(hostId, cache) {
-    var _ref, _ref1, _ref2, _ref3;
+    var _ref, _snapshot_data, _ref1, _ref2, _ref3, _ref4, _ref5, _ref6, _snapshot_data1;
     const id = String(hostId != null ? hostId : '').trim();
     if (!id) {
         /*
@@ -663,16 +690,81 @@ export async function listSendingDomains(orgId) {
     if (hit) return hit;
     const snapshot = await firestore().collection('hosts').doc(id).get().catch(()=>null);
     const owner = await getOrgForHost(id).catch(()=>null);
-    const verdict = await resolveHostSendingIdentity({
-        orgId: (_ref = owner == null ? void 0 : owner.orgId) != null ? _ref : null,
-        selectedDomain: (_ref1 = snapshot == null ? void 0 : snapshot.get('sendingDomain')) != null ? _ref1 : '',
-        selectedLocalPart: (_ref2 = snapshot == null ? void 0 : snapshot.get('sendingLocalPart')) != null ? _ref2 : '',
+    /*
+   * A SUSPENDED SITE SENDS NOTHING (AGL-3356).
+   *
+   * This is the door every tenant sender but the campaign core uses, so it
+   * is where one check covers them all — workflow and automation steps, the
+   * CRM's one-off mail, inbox replies, member posts, receipts, reminders.
+   * Refusing here rather than at each caller is the same argument this
+   * function's own docblock makes about identities: nineteen call sites
+   * asked to remember produce a twentieth that does not, and the incident
+   * behind this was exactly that — a locked workspace whose workflow could
+   * still mail for it.
+   *
+   * FULL locks only. A read-only lock is a maintenance window whose point
+   * is that the site keeps serving and earning, and a receipt for an order
+   * taken before it began must still arrive. Staff suspensions for abuse,
+   * fraud and billing are full locks, which is the case this closes.
+   *
+   * The documents read above are handed to the verdict, so the check costs
+   * the TTL-cached platform read and nothing else. It inherits the
+   * verdict's fail-open posture and its takedown ratchet.
+   */ const lock = await getSiteLockdown(id, Date.now(), {
+        org: (_ref = owner == null ? void 0 : owner.org) != null ? _ref : null,
+        host: (snapshot == null ? void 0 : snapshot.exists) ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : null : null
+    });
+    if (lock && lockdownMode(lock) === 'full') {
+        const suspended = suspendedSendingIdentity(lock.scope);
+        cache == null ? void 0 : cache.set(id, suspended);
+        return suspended;
+    }
+    const resolved = await resolveHostSendingIdentity({
+        orgId: (_ref1 = owner == null ? void 0 : owner.orgId) != null ? _ref1 : null,
+        selectedDomain: (_ref2 = snapshot == null ? void 0 : snapshot.get('sendingDomain')) != null ? _ref2 : '',
+        selectedLocalPart: (_ref3 = snapshot == null ? void 0 : snapshot.get('sendingLocalPart')) != null ? _ref3 : '',
         hostId: id,
-        poolMember: (_ref3 = snapshot == null ? void 0 : snapshot.get('sendingPoolMember')) != null ? _ref3 : ''
+        poolMember: (_ref4 = snapshot == null ? void 0 : snapshot.get('sendingPoolMember')) != null ? _ref4 : ''
+    });
+    /*
+   * THE WORKSPACE, STAMPED FOR THE PHISHING SCREEN (AGL-3356).
+   *
+   * `sendEmail` screens every tenant message whose identity carries this,
+   * so stamping it here is what puts CRM mail, inbox replies, newsletters,
+   * member posts, sweeps, flow steps and receipts behind one screen without
+   * any of them passing anything. Built from the two documents read above:
+   * the screen costs no read of its own.
+   */ const verdict = _extends({}, resolved, {
+        workspace: sendingWorkspaceFor({
+            hostId: id,
+            orgId: (_ref5 = owner == null ? void 0 : owner.orgId) != null ? _ref5 : null,
+            org: (_ref6 = owner == null ? void 0 : owner.org) != null ? _ref6 : null,
+            host: (snapshot == null ? void 0 : snapshot.exists) ? (_snapshot_data1 = snapshot.data()) != null ? _snapshot_data1 : null : null
+        })
     });
     cache == null ? void 0 : cache.set(id, verdict);
     return verdict;
 }
+/**
+ * The verdict a suspended site's mail gets: a refusal, whatever identity the
+ * site would otherwise have sent on. `sendEmail` reads it and answers
+ * `suspended` without calling the provider.
+ */ export function suspendedSendingIdentity(scope) {
+    const what = scope === 'platform' ? 'Sending is paused platform-wide' : scope === 'org' ? 'This workspace is suspended' : 'This site is suspended';
+    const message = `${what}, so no email is sent on its behalf until the suspension is lifted.`;
+    return {
+        from: null,
+        source: null,
+        domain: null,
+        summary: message,
+        refusal: {
+            code: 'workspace-suspended',
+            domain: null,
+            message,
+            missing: []
+        }
+    };
+}
 /** The record keys a surface highlights as outstanding. */ export function outstandingSendingRecords(record) {
     var _ref;
     const missing = new Set((_ref = record == null ? void 0 : record.lastMissing) != null ? _ref : []);