@aglyn/tenant-data-admin 1.0.0-beta.200 → 1.0.0-beta.202

package/src/lib/server/payment-fraud-signal.d.ts

@@ -0,0 +1,156 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Which Stripe signal this is. */
+export type PaymentFraudSignalKind = 'early-fraud-warning' | 'radar-review' | 'dispute';
+/** The Stripe object type each signal arrives as, for the queue's text. */
+export declare const PAYMENT_FRAUD_SIGNAL_LABELS: Record<PaymentFraudSignalKind, string>;
+/** What the card's own checks said, when the charge could be read. */
+export interface PaymentFraudCardChecks {
+    cvcCheck: string | null;
+    addressPostalCodeCheck: string | null;
+    cardCountry: string | null;
+    riskLevel: string | null;
+    threeDSecure: string | null;
+}
+export interface PaymentFraudSignal {
+    kind: PaymentFraudSignalKind;
+    /** The EFW, review or dispute id: one row per signal, whatever redelivers. */
+    stripeObjectId: string;
+    chargeId: string | null;
+    paymentIntentId: string | null;
+    /** The workspace the charge billed, or null when it resolved to none. */
+    orgId: string | null;
+    /** Smallest currency unit, or null when nothing recorded the amount. */
+    amountCents: number | null;
+    currency: string;
+    /** `fraud_type`, the review's `reason`, the dispute's `reason`. */
+    detail: string;
+    checks: PaymentFraudCardChecks | null;
+    livemode: boolean;
+}
+/** The row id: hex, so the admin route's id pattern addresses it. */
+export declare function paymentFraudSignalReviewId(kind: PaymentFraudSignalKind, stripeObjectId: string): string;
+/** The staff-facing reference, beside the intake's `AR-` and the screen's `HS-`. */
+export declare function paymentFraudSignalReference(reviewId: string): string;
+/** Where staff act on the workspace's billing: its Subscription card. */
+export declare function staffSubscriptionCardPath(orgId: string): string;
+/** `$56.00 USD`, or a sentence saying the amount is not known. */
+export declare function formatSignalAmount(amountCents: number | null, currency: string): string;
+/**
+ * The one-line summary of a charge Stripe gives back, for a signal whose
+ * charge is not on a platform revenue row. A READ — the only Stripe call
+ * this module makes — and it answers null rather than throwing, because a
+ * fraud alert that fails for want of an amount is worse than one that says
+ * the amount is unknown.
+ */
+export declare function readStripeChargeForSignal(chargeId: string, options: {
+    secretKey: string | undefined;
+    fetchImpl?: typeof fetch;
+}): Promise<{
+    amountCents: number | null;
+    currency: string;
+    customerId: string | null;
+    checks: PaymentFraudCardChecks;
+    /**
+     * The connected account the charge paid (AGL-3360): a destination
+     * charge's `transfer_data.destination`. Every sale Aglyn takes for a site
+     * is a destination charge on the platform account — the facilitator
+     * model (AGL-1956) — so this is the seller. Null for a charge that paid
+     * only the platform, a workspace's own subscription.
+     */
+    sellerAccountId: string | null;
+} | null>;
+/** The row's prose: what arrived, about which workspace, and what to do. */
+export declare function describePaymentFraudSignal(signal: PaymentFraudSignal): string;
+/**
+ * File one signal and tell staff, once per signal.
+ *
+ * Idempotent on the Stripe object id: a redelivery bumps `reportCount` and
+ * leaves the row's status — which staff own from the moment they touch it —
+ * where it was. Throws only if the row write throws, which is the webhook's
+ * to answer; the notification never throws.
+ */
+export declare function recordPaymentFraudSignal(signal: PaymentFraudSignal, deps: {
+    firestore: FirebaseFirestore.Firestore;
+    notify: (payload: {
+        type: 'system.abuseReportUrgent';
+        title: string;
+        body: string;
+        link: string;
+    }) => Promise<void>;
+}): Promise<{
+    reviewId: string;
+    reference: string;
+    first: boolean;
+}>;
+export declare const SELLER_FRAUD_PATTERN: {
+    /** Distinct charges with an early fraud warning or a dispute. */
+    readonly minDistinctCharges: 3;
+    /** …within this window. */
+    readonly windowMs: number;
+    /** How long the ledger keeps an entry at all. */
+    readonly retainMs: number;
+};
+/** Admin-SDK only; no client rule opens it (default deny). */
+export declare const SELLER_FRAUD_LEDGER_COLLECTION = "paymentFraudLedger";
+export interface SellerFraudLedgerEntry {
+    kind: PaymentFraudSignalKind;
+    stripeObjectId: string;
+    chargeId: string | null;
+    amountCents: number | null;
+    currency: string;
+    detail: string;
+    /** The sites a plugin recognised the charge as belonging to. */
+    hostIds: string[];
+    atMs: number;
+}
+/** Whether a seller's ledger shows the pattern at `nowMs`. Pure. */
+export declare function sellerFraudPattern(entries: readonly SellerFraudLedgerEntry[], nowMs: number): {
+    matched: boolean;
+    chargeIds: string[];
+};
+/** The connected account's page in the Stripe Dashboard. */
+export declare function stripeConnectedAccountUrl(accountId: string, livemode: boolean): string;
+/**
+ * Keep one signal on a seller's charge, and file the pattern row when the
+ * ledger crosses the threshold. Idempotent on the Stripe object id: a
+ * redelivery changes nothing and files nothing.
+ */
+export declare function recordSellerFraudSignal(input: {
+    signal: PaymentFraudSignal;
+    sellerAccountId: string;
+    /** The sites a plugin recognised the charge as belonging to. */
+    hostIds: string[];
+    /** Workspaces owning those sites, for the row. */
+    orgIds: string[];
+}, deps: {
+    firestore: FirebaseFirestore.Firestore;
+    notify: (payload: {
+        type: 'system.abuseReportUrgent';
+        title: string;
+        body: string;
+        link: string;
+    }) => Promise<void>;
+    nowMs?: number;
+}): Promise<{
+    first: boolean;
+    matched: boolean;
+    filed: {
+        reviewId: string;
+        reference: string;
+    } | null;
+}>;

package/src/lib/server/payment-fraud-signal.js

@@ -0,0 +1,368 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * STRIPE'S FRAUD SIGNALS, INTO THE ABUSE QUEUE (AGL-3356).
+ *
+ * The 9/26 incident paid for Pro with a card whose CVC check came back
+ * unavailable and which never met 3-D Secure. Stripe had three ways to tell
+ * us about a card like that — an early fraud warning from the issuer, a
+ * Radar review, a dispute — and the platform webhook either did not
+ * subscribe to them or filed them where nobody triages abuse.
+ *
+ * Each signal now files an urgent row in the abuse queue that names the
+ * workspace, the charge and the amount, links the staff Subscription card
+ * on the org page (AGL-3359, where billing is canceled), and notifies staff
+ * once. NOTHING IS DONE TO THE MONEY OR THE SUBSCRIPTION: no refund, no
+ * cancel. An early fraud warning is not a chargeback, a review may clear, and
+ * a refund issued before staff look can be the wrong half of a dispute. The
+ * row is the prompt; staff decide.
+ *
+ * Dependencies are passed in rather than imported — the Firestore handle the
+ * webhook observes its writes through, and its staff notifier — so the
+ * webhook's "did this delivery do anything" ledger sees the write, and a spec
+ * substituting the admin barrel substitutes these too.
+ *=========================================*/ import { createHash } from "crypto";
+import { ABUSE_REPORT_COLLECTION } from "@aglyn/aglyn/app-utils/abuse-report";
+import { FieldValue } from "firebase-admin/firestore";
+const KIND_LABEL = {
+    'early-fraud-warning': 'Early fraud warning',
+    'radar-review': 'Radar review opened',
+    dispute: 'Card dispute opened'
+};
+/** The Stripe object type each signal arrives as, for the queue's text. */ export const PAYMENT_FRAUD_SIGNAL_LABELS = KIND_LABEL;
+/** The row id: hex, so the admin route's id pattern addresses it. */ export function paymentFraudSignalReviewId(kind, stripeObjectId) {
+    return createHash('sha256').update(`stripe-fraud:${kind}:${stripeObjectId}`).digest('hex').slice(0, 40);
+}
+/** The staff-facing reference, beside the intake's `AR-` and the screen's `HS-`. */ export function paymentFraudSignalReference(reviewId) {
+    return `PF-${reviewId.slice(0, 10).toUpperCase()}`;
+}
+/** Where staff act on the workspace's billing: its Subscription card. */ export function staffSubscriptionCardPath(orgId) {
+    return `/admin/orgs/${encodeURIComponent(orgId)}#subscription`;
+}
+/** `$56.00 USD`, or a sentence saying the amount is not known. */ export function formatSignalAmount(amountCents, currency) {
+    if (amountCents === null || !Number.isFinite(amountCents)) {
+        return 'amount not recorded';
+    }
+    return `${(amountCents / 100).toFixed(2)} ${String(currency || 'usd').toUpperCase()}`;
+}
+/**
+ * The one-line summary of a charge Stripe gives back, for a signal whose
+ * charge is not on a platform revenue row. A READ — the only Stripe call
+ * this module makes — and it answers null rather than throwing, because a
+ * fraud alert that fails for want of an amount is worse than one that says
+ * the amount is unknown.
+ */ export async function readStripeChargeForSignal(chargeId, options) {
+    if (!chargeId || !options.secretKey) return null;
+    try {
+        var _options_fetchImpl, _ref, _ref1;
+        var _charge_payment_method_details, _card_checks, _card_checks1, _charge_outcome, _card_three_d_secure, _charge_transfer_data;
+        const response = await ((_options_fetchImpl = options.fetchImpl) != null ? _options_fetchImpl : fetch)(`https://api.stripe.com/v1/charges/${encodeURIComponent(chargeId)}`, {
+            headers: {
+                Authorization: `Bearer ${options.secretKey}`
+            }
+        });
+        if (!response.ok) return null;
+        const charge = await response.json();
+        const card = (_ref = charge == null ? void 0 : (_charge_payment_method_details = charge['payment_method_details']) == null ? void 0 : _charge_payment_method_details['card']) != null ? _ref : {};
+        const text = (value)=>typeof value === 'string' && value ? value : null;
+        return {
+            amountCents: Number.isFinite(Number(charge == null ? void 0 : charge['amount'])) ? Number(charge['amount']) : null,
+            currency: String((_ref1 = charge == null ? void 0 : charge['currency']) != null ? _ref1 : 'usd'),
+            customerId: text(charge == null ? void 0 : charge['customer']),
+            checks: {
+                cvcCheck: text(card == null ? void 0 : (_card_checks = card['checks']) == null ? void 0 : _card_checks['cvc_check']),
+                addressPostalCodeCheck: text(card == null ? void 0 : (_card_checks1 = card['checks']) == null ? void 0 : _card_checks1['address_postal_code_check']),
+                cardCountry: text(card == null ? void 0 : card['country']),
+                riskLevel: text(charge == null ? void 0 : (_charge_outcome = charge['outcome']) == null ? void 0 : _charge_outcome['risk_level']),
+                threeDSecure: text(card == null ? void 0 : (_card_three_d_secure = card['three_d_secure']) == null ? void 0 : _card_three_d_secure['result'])
+            },
+            sellerAccountId: accountRef(charge == null ? void 0 : (_charge_transfer_data = charge['transfer_data']) == null ? void 0 : _charge_transfer_data['destination'])
+        };
+    } catch (unused) {
+        return null;
+    }
+}
+/** A Stripe account reference, expanded or not, as an id or null. */ function accountRef(value) {
+    var _ref;
+    const id = typeof value === 'string' ? value : String((_ref = value == null ? void 0 : value.id) != null ? _ref : '');
+    return id.startsWith('acct_') ? id : null;
+}
+/** The row's prose: what arrived, about which workspace, and what to do. */ export function describePaymentFraudSignal(signal) {
+    var _signal_orgId, _ref, _signal_chargeId;
+    const lines = [
+        `${KIND_LABEL[signal.kind]} from Stripe (${signal.stripeObjectId})` + (signal.livemode ? '' : ' — TEST MODE') + '.',
+        `Workspace: ${(_signal_orgId = signal.orgId) != null ? _signal_orgId : 'none — the charge did not resolve to a workspace subscription'}.`,
+        `Charge: ${(_ref = (_signal_chargeId = signal.chargeId) != null ? _signal_chargeId : signal.paymentIntentId) != null ? _ref : 'not named'} · ${formatSignalAmount(signal.amountCents, signal.currency)}.`
+    ];
+    if (signal.detail) lines.push(`Stripe says: ${signal.detail}.`);
+    const checks = signal.checks;
+    if (checks) {
+        var _checks_cvcCheck, _checks_addressPostalCodeCheck, _checks_cardCountry, _checks_threeDSecure, _checks_riskLevel;
+        lines.push(`Card: CVC ${(_checks_cvcCheck = checks.cvcCheck) != null ? _checks_cvcCheck : 'unknown'}, postal code ${(_checks_addressPostalCodeCheck = checks.addressPostalCodeCheck) != null ? _checks_addressPostalCodeCheck : 'unknown'}, ` + `issued in ${(_checks_cardCountry = checks.cardCountry) != null ? _checks_cardCountry : 'unknown'}, 3DS ${(_checks_threeDSecure = checks.threeDSecure) != null ? _checks_threeDSecure : 'not used'}, ` + `Radar risk ${(_checks_riskLevel = checks.riskLevel) != null ? _checks_riskLevel : 'unknown'}.`);
+    }
+    lines.push(signal.kind === 'radar-review' ? 'The payment waits in Stripe until the review is closed there.' : signal.kind === 'dispute' ? 'Answer the dispute in Stripe before its evidence deadline.' : 'An early fraud warning is not yet a chargeback; refunding now can avoid one.', 'Nothing has been refunded or canceled. Decide on the org’s Subscription card, lock the workspace if it is fraud, and close this row with what you did.');
+    return lines.join('\n').slice(0, 5000);
+}
+/**
+ * File one signal and tell staff, once per signal.
+ *
+ * Idempotent on the Stripe object id: a redelivery bumps `reportCount` and
+ * leaves the row's status — which staff own from the moment they touch it —
+ * where it was. Throws only if the row write throws, which is the webhook's
+ * to answer; the notification never throws.
+ */ export async function recordPaymentFraudSignal(signal, deps) {
+    const reviewId = paymentFraudSignalReviewId(signal.kind, signal.stripeObjectId);
+    const reference = paymentFraudSignalReference(reviewId);
+    const ref = deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId);
+    const first = !(await ref.get()).exists;
+    const subscriptionCard = signal.orgId ? staffSubscriptionCardPath(signal.orgId) : null;
+    await ref.set(_extends({
+        reference,
+        // "Phishing or fraud" — the queue's urgent fraud category.
+        category: 'phishing',
+        severity: 'urgent',
+        source: 'stripe-fraud-signal',
+        url: null,
+        reportedHostname: null,
+        hostId: null,
+        orgId: signal.orgId,
+        details: describePaymentFraudSignal(signal),
+        reporterEmail: null,
+        reporterName: null,
+        dmca: null,
+        reportCount: FieldValue.increment(1),
+        paymentSignal: {
+            kind: signal.kind,
+            stripeObjectId: signal.stripeObjectId,
+            chargeId: signal.chargeId,
+            paymentIntentId: signal.paymentIntentId,
+            amountCents: signal.amountCents,
+            currency: signal.currency,
+            detail: signal.detail,
+            checks: signal.checks,
+            livemode: signal.livemode,
+            subscriptionCard
+        },
+        updatedAt: FieldValue.serverTimestamp()
+    }, first ? {
+        status: 'open',
+        createdAt: FieldValue.serverTimestamp()
+    } : {}), {
+        merge: true
+    });
+    if (first) {
+        var _ref, _signal_chargeId;
+        await deps.notify({
+            type: 'system.abuseReportUrgent',
+            title: `${KIND_LABEL[signal.kind]} — ${formatSignalAmount(signal.amountCents, signal.currency)}`,
+            body: `${signal.orgId ? `Workspace ${signal.orgId}` : 'A charge that is not a workspace subscription'}, ` + `charge ${(_ref = (_signal_chargeId = signal.chargeId) != null ? _signal_chargeId : signal.paymentIntentId) != null ? _ref : 'not named'}. ` + `Nothing has been refunded or canceled. Reference ${reference}.`,
+            link: '/admin/abuse-reports'
+        }).catch(()=>undefined);
+    }
+    return {
+        reviewId,
+        reference,
+        first
+    };
+}
+/*==========================================
+ * THE SELLER PATTERN: WHEN THE MERCHANT MAY BE THE FRAUDSTER (AGL-3360).
+ *
+ * A site's own sales are destination charges on the platform account, so
+ * Stripe's fraud signals about a shopper's card arrive here too. One of them
+ * is the merchant's business — their customer, their order, their decision
+ * (`payment-risk-record.ts` puts it on the record and tells them). Staff are
+ * not paged for it.
+ *
+ * What IS staff's business is the shape a phishing actor leaves when they
+ * run stolen cards through a storefront of their own: several different
+ * charges on ONE connected account drawing issuer fraud reports or
+ * chargebacks in a short time. So every signal on a seller's charge is kept
+ * in a small per-account ledger, and one urgent abuse-queue row is filed when
+ *
+ *   ≥ 3 DISTINCT charges carry an early fraud warning or a dispute
+ *   within 7 days.
+ *
+ * Why those numbers. An early fraud warning is an issuer's report that the
+ * cardholder did not make the payment, and a dispute is a formal
+ * chargeback; a legitimate small merchant sees either rarely — card-network
+ * dispute monitoring starts near 0.9% of a month's transactions, single
+ * digits a MONTH for a shop doing hundreds of sales. One or two in a week is
+ * ordinary friendly fraud and must never page staff. Three separate charges
+ * in one week is a rate a real small shop does not produce, and is what a
+ * card tester or a stolen-card storefront produces within days. Counted by
+ * CHARGE, because a warning is routinely followed by a dispute on the same
+ * payment, and that is one bad payment, not two. Radar reviews are kept in
+ * the ledger for the row's prose but never counted: a review is Stripe's
+ * suspicion, not an issuer's report, and a busy shop can collect several
+ * that clear.
+ *
+ * One row per window: once filed, the account is not filed again until 7
+ * days have passed, so a burst is one row with everything in it rather than
+ * a row per signal. NOTHING IS DONE TO THE ACCOUNT OR THE MONEY: staff
+ * decide (lock the workspace, pause the account's payouts in Stripe).
+ *=========================================*/ export const SELLER_FRAUD_PATTERN = {
+    /** Distinct charges with an early fraud warning or a dispute. */ minDistinctCharges: 3,
+    /** …within this window. */ windowMs: 7 * 24 * 60 * 60 * 1000,
+    /** How long the ledger keeps an entry at all. */ retainMs: 30 * 24 * 60 * 60 * 1000
+};
+const WINDOW_DAYS = SELLER_FRAUD_PATTERN.windowMs / 86400000;
+/** Admin-SDK only; no client rule opens it (default deny). */ export const SELLER_FRAUD_LEDGER_COLLECTION = 'paymentFraudLedger';
+/** Whether a seller's ledger shows the pattern at `nowMs`. Pure. */ export function sellerFraudPattern(entries, nowMs) {
+    const since = nowMs - SELLER_FRAUD_PATTERN.windowMs;
+    const chargeIds = [
+        ...new Set(entries.filter((entry)=>(entry.kind === 'early-fraud-warning' || entry.kind === 'dispute') && entry.atMs >= since).map((entry)=>entry.chargeId || entry.stripeObjectId))
+    ];
+    return {
+        matched: chargeIds.length >= SELLER_FRAUD_PATTERN.minDistinctCharges,
+        chargeIds
+    };
+}
+/** The connected account's page in the Stripe Dashboard. */ export function stripeConnectedAccountUrl(accountId, livemode) {
+    return `https://dashboard.stripe.com/${livemode ? '' : 'test/'}connect/accounts/${encodeURIComponent(accountId)}`;
+}
+/**
+ * Keep one signal on a seller's charge, and file the pattern row when the
+ * ledger crosses the threshold. Idempotent on the Stripe object id: a
+ * redelivery changes nothing and files nothing.
+ */ export async function recordSellerFraudSignal(input, deps) {
+    var _deps_nowMs, _input_orgIds_, _hostIds_;
+    const nowMs = (_deps_nowMs = deps.nowMs) != null ? _deps_nowMs : Date.now();
+    const { signal, sellerAccountId } = input;
+    const ledgerRef = deps.firestore.collection(SELLER_FRAUD_LEDGER_COLLECTION).doc(sellerAccountId);
+    const outcome = await deps.firestore.runTransaction(async (transaction)=>{
+        var _fresh_get;
+        const fresh = await transaction.get(ledgerRef);
+        const stored = Array.isArray(fresh.get('entries')) ? fresh.get('entries') : [];
+        if (stored.some((entry)=>entry.stripeObjectId === signal.stripeObjectId)) {
+            return {
+                first: false,
+                matched: false,
+                fileAtMs: 0,
+                entries: stored
+            };
+        }
+        const entries = [
+            ...stored.filter((entry)=>entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.retainMs),
+            {
+                kind: signal.kind,
+                stripeObjectId: signal.stripeObjectId,
+                chargeId: signal.chargeId,
+                amountCents: signal.amountCents,
+                currency: signal.currency,
+                detail: signal.detail,
+                hostIds: input.hostIds,
+                atMs: nowMs
+            }
+        ];
+        const { matched } = sellerFraudPattern(entries, nowMs);
+        const lastFiledAtMs = Number((_fresh_get = fresh.get('lastFiledAtMs')) != null ? _fresh_get : 0);
+        const fileAtMs = matched && !(lastFiledAtMs && nowMs - lastFiledAtMs < SELLER_FRAUD_PATTERN.windowMs) ? nowMs : 0;
+        transaction.set(ledgerRef, _extends({
+            sellerAccountId,
+            entries,
+            livemode: signal.livemode,
+            updatedAtMs: nowMs
+        }, fileAtMs ? {
+            lastFiledAtMs: fileAtMs
+        } : {}), {
+            merge: true
+        });
+        return {
+            first: true,
+            matched,
+            fileAtMs,
+            entries
+        };
+    });
+    if (!outcome.fileAtMs) {
+        return {
+            first: outcome.first,
+            matched: outcome.matched,
+            filed: null
+        };
+    }
+    const { chargeIds } = sellerFraudPattern(outcome.entries, nowMs);
+    const inWindow = outcome.entries.filter((entry)=>entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.windowMs);
+    const reviewId = createHash('sha256').update(`stripe-seller-pattern:${sellerAccountId}:${outcome.fileAtMs}`).digest('hex').slice(0, 40);
+    const reference = paymentFraudSignalReference(reviewId);
+    const orgId = (_input_orgIds_ = input.orgIds[0]) != null ? _input_orgIds_ : null;
+    const hostIds = [
+        ...new Set(inWindow.flatMap((entry)=>{
+            var _entry_hostIds;
+            return (_entry_hostIds = entry.hostIds) != null ? _entry_hostIds : [];
+        }))
+    ];
+    const stripeUrl = stripeConnectedAccountUrl(sellerAccountId, signal.livemode);
+    const details = [
+        `${chargeIds.length} different charges paid to connected account ${sellerAccountId} drew an issuer fraud warning or a dispute within ${WINDOW_DAYS} days` + (signal.livemode ? '' : ' — TEST MODE') + '.',
+        `Workspace(s): ${input.orgIds.length ? input.orgIds.join(', ') : 'not resolved'}. Site(s): ${hostIds.length ? hostIds.join(', ') : 'not resolved'}.`,
+        ...inWindow.map((entry)=>{
+            var _entry_chargeId;
+            return `• ${KIND_LABEL[entry.kind]} ${entry.stripeObjectId} on ${(_entry_chargeId = entry.chargeId) != null ? _entry_chargeId : 'an unnamed charge'} · ${formatSignalAmount(entry.amountCents, entry.currency)}` + (entry.detail ? ` · ${entry.detail}` : '');
+        }),
+        'A shop taking stolen cards through its own storefront leaves this shape. Each merchant has already been shown the signal on its own order or booking.',
+        `Nothing has been refunded, canceled or paused. If this is the seller's fraud, lock the workspace and pause the account's payouts in Stripe (${stripeUrl}), then close this row with what you did.`
+    ].join('\n').slice(0, 5000);
+    await deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId).set({
+        reference,
+        // "Phishing or fraud" — the queue's urgent fraud category.
+        category: 'phishing',
+        severity: 'urgent',
+        source: 'stripe-seller-fraud-pattern',
+        url: null,
+        reportedHostname: null,
+        hostId: (_hostIds_ = hostIds[0]) != null ? _hostIds_ : null,
+        orgId,
+        details,
+        reporterEmail: null,
+        reporterName: null,
+        dmca: null,
+        reportCount: 1,
+        sellerPattern: {
+            sellerAccountId,
+            stripeAccountUrl: stripeUrl,
+            chargeIds,
+            orgIds: input.orgIds,
+            hostIds,
+            threshold: SELLER_FRAUD_PATTERN.minDistinctCharges,
+            windowDays: WINDOW_DAYS,
+            livemode: signal.livemode
+        },
+        status: 'open',
+        createdAt: FieldValue.serverTimestamp(),
+        updatedAt: FieldValue.serverTimestamp()
+    }, {
+        merge: true
+    });
+    await deps.notify({
+        type: 'system.abuseReportUrgent',
+        title: `Seller fraud pattern — ${chargeIds.length} charges on one account`,
+        body: `Connected account ${sellerAccountId}` + (orgId ? ` (workspace ${orgId})` : '') + ` drew fraud warnings or disputes on ${chargeIds.length} different charges in ${WINDOW_DAYS} days. ` + `Nothing has been refunded, canceled or paused. Reference ${reference}.`,
+        link: '/admin/abuse-reports'
+    }).catch(()=>undefined);
+    return {
+        first: true,
+        matched: true,
+        filed: {
+            reviewId,
+            reference
+        }
+    };
+}
+
+//# sourceMappingURL=payment-fraud-signal.js.map

package/src/lib/server/payment-fraud-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-fraud-signal.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * STRIPE'S FRAUD SIGNALS, INTO THE ABUSE QUEUE (AGL-3356).\n *\n * The 9/26 incident paid for Pro with a card whose CVC check came back\n * unavailable and which never met 3-D Secure. Stripe had three ways to tell\n * us about a card like that — an early fraud warning from the issuer, a\n * Radar review, a dispute — and the platform webhook either did not\n * subscribe to them or filed them where nobody triages abuse.\n *\n * Each signal now files an urgent row in the abuse queue that names the\n * workspace, the charge and the amount, links the staff Subscription card\n * on the org page (AGL-3359, where billing is canceled), and notifies staff\n * once. NOTHING IS DONE TO THE MONEY OR THE SUBSCRIPTION: no refund, no\n * cancel. An early fraud warning is not a chargeback, a review may clear, and\n * a refund issued before staff look can be the wrong half of a dispute. The\n * row is the prompt; staff decide.\n *\n * Dependencies are passed in rather than imported — the Firestore handle the\n * webhook observes its writes through, and its staff notifier — so the\n * webhook's \"did this delivery do anything\" ledger sees the write, and a spec\n * substituting the admin barrel substitutes these too.\n *=========================================*/\n\nimport { createHash } from 'crypto'\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport { FieldValue } from 'firebase-admin/firestore'\n\n/** Which Stripe signal this is. */\nexport type PaymentFraudSignalKind =\n  | 'early-fraud-warning'\n  | 'radar-review'\n  | 'dispute'\n\nconst KIND_LABEL: Record<PaymentFraudSignalKind, string> = {\n  'early-fraud-warning': 'Early fraud warning',\n  'radar-review': 'Radar review opened',\n  dispute: 'Card dispute opened',\n}\n\n/** The Stripe object type each signal arrives as, for the queue's text. */\nexport const PAYMENT_FRAUD_SIGNAL_LABELS = KIND_LABEL\n\n/** What the card's own checks said, when the charge could be read. */\nexport interface PaymentFraudCardChecks {\n  cvcCheck: string | null\n  addressPostalCodeCheck: string | null\n  cardCountry: string | null\n  riskLevel: string | null\n  threeDSecure: string | null\n}\n\nexport interface PaymentFraudSignal {\n  kind: PaymentFraudSignalKind\n  /** The EFW, review or dispute id: one row per signal, whatever redelivers. */\n  stripeObjectId: string\n  chargeId: string | null\n  paymentIntentId: string | null\n  /** The workspace the charge billed, or null when it resolved to none. */\n  orgId: string | null\n  /** Smallest currency unit, or null when nothing recorded the amount. */\n  amountCents: number | null\n  currency: string\n  /** `fraud_type`, the review's `reason`, the dispute's `reason`. */\n  detail: string\n  checks: PaymentFraudCardChecks | null\n  livemode: boolean\n}\n\n/** The row id: hex, so the admin route's id pattern addresses it. */\nexport function paymentFraudSignalReviewId(\n  kind: PaymentFraudSignalKind,\n  stripeObjectId: string,\n): string {\n  return createHash('sha256')\n    .update(`stripe-fraud:${kind}:${stripeObjectId}`)\n    .digest('hex')\n    .slice(0, 40)\n}\n\n/** The staff-facing reference, beside the intake's `AR-` and the screen's `HS-`. */\nexport function paymentFraudSignalReference(reviewId: string): string {\n  return `PF-${reviewId.slice(0, 10).toUpperCase()}`\n}\n\n/** Where staff act on the workspace's billing: its Subscription card. */\nexport function staffSubscriptionCardPath(orgId: string): string {\n  return `/admin/orgs/${encodeURIComponent(orgId)}#subscription`\n}\n\n/** `$56.00 USD`, or a sentence saying the amount is not known. */\nexport function formatSignalAmount(\n  amountCents: number | null,\n  currency: string,\n): string {\n  if (amountCents === null || !Number.isFinite(amountCents)) {\n    return 'amount not recorded'\n  }\n  return `${(amountCents / 100).toFixed(2)} ${String(currency || 'usd').toUpperCase()}`\n}\n\n/**\n * The one-line summary of a charge Stripe gives back, for a signal whose\n * charge is not on a platform revenue row. A READ — the only Stripe call\n * this module makes — and it answers null rather than throwing, because a\n * fraud alert that fails for want of an amount is worse than one that says\n * the amount is unknown.\n */\nexport async function readStripeChargeForSignal(\n  chargeId: string,\n  options: { secretKey: string | undefined; fetchImpl?: typeof fetch },\n): Promise<{\n  amountCents: number | null\n  currency: string\n  customerId: string | null\n  checks: PaymentFraudCardChecks\n  /**\n   * The connected account the charge paid (AGL-3360): a destination\n   * charge's `transfer_data.destination`. Every sale Aglyn takes for a site\n   * is a destination charge on the platform account — the facilitator\n   * model (AGL-1956) — so this is the seller. Null for a charge that paid\n   * only the platform, a workspace's own subscription.\n   */\n  sellerAccountId: string | null\n} | null> {\n  if (!chargeId || !options.secretKey) return null\n  try {\n    const response = await (options.fetchImpl ?? fetch)(\n      `https://api.stripe.com/v1/charges/${encodeURIComponent(chargeId)}`,\n      { headers: { Authorization: `Bearer ${options.secretKey}` } },\n    )\n    if (!response.ok) return null\n    const charge = (await response.json()) as Record<string, any>\n    const card = charge?.['payment_method_details']?.['card'] ?? {}\n    const text = (value: unknown) =>\n      typeof value === 'string' && value ? value : null\n    return {\n      amountCents: Number.isFinite(Number(charge?.['amount']))\n        ? Number(charge['amount'])\n        : null,\n      currency: String(charge?.['currency'] ?? 'usd'),\n      customerId: text(charge?.['customer']),\n      checks: {\n        cvcCheck: text(card?.['checks']?.['cvc_check']),\n        addressPostalCodeCheck: text(card?.['checks']?.['address_postal_code_check']),\n        cardCountry: text(card?.['country']),\n        riskLevel: text(charge?.['outcome']?.['risk_level']),\n        threeDSecure: text(card?.['three_d_secure']?.['result']),\n      },\n      sellerAccountId: accountRef(charge?.['transfer_data']?.['destination']),\n    }\n  } catch {\n    return null\n  }\n}\n\n/** A Stripe account reference, expanded or not, as an id or null. */\nfunction accountRef(value: unknown): string | null {\n  const id =\n    typeof value === 'string'\n      ? value\n      : String((value as { id?: unknown } | null)?.id ?? '')\n  return id.startsWith('acct_') ? id : null\n}\n\n/** The row's prose: what arrived, about which workspace, and what to do. */\nexport function describePaymentFraudSignal(signal: PaymentFraudSignal): string {\n  const lines = [\n    `${KIND_LABEL[signal.kind]} from Stripe (${signal.stripeObjectId})` +\n      (signal.livemode ? '' : ' — TEST MODE') +\n      '.',\n    `Workspace: ${signal.orgId ?? 'none — the charge did not resolve to a workspace subscription'}.`,\n    `Charge: ${signal.chargeId ?? signal.paymentIntentId ?? 'not named'} · ${formatSignalAmount(signal.amountCents, signal.currency)}.`,\n  ]\n  if (signal.detail) lines.push(`Stripe says: ${signal.detail}.`)\n  const checks = signal.checks\n  if (checks) {\n    lines.push(\n      `Card: CVC ${checks.cvcCheck ?? 'unknown'}, postal code ${checks.addressPostalCodeCheck ?? 'unknown'}, ` +\n        `issued in ${checks.cardCountry ?? 'unknown'}, 3DS ${checks.threeDSecure ?? 'not used'}, ` +\n        `Radar risk ${checks.riskLevel ?? 'unknown'}.`,\n    )\n  }\n  lines.push(\n    signal.kind === 'radar-review'\n      ? 'The payment waits in Stripe until the review is closed there.'\n      : signal.kind === 'dispute'\n        ? 'Answer the dispute in Stripe before its evidence deadline.'\n        : 'An early fraud warning is not yet a chargeback; refunding now can avoid one.',\n    'Nothing has been refunded or canceled. Decide on the org’s Subscription card, lock the workspace if it is fraud, and close this row with what you did.',\n  )\n  return lines.join('\\n').slice(0, 5000)\n}\n\n/**\n * File one signal and tell staff, once per signal.\n *\n * Idempotent on the Stripe object id: a redelivery bumps `reportCount` and\n * leaves the row's status — which staff own from the moment they touch it —\n * where it was. Throws only if the row write throws, which is the webhook's\n * to answer; the notification never throws.\n */\nexport async function recordPaymentFraudSignal(\n  signal: PaymentFraudSignal,\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notify: (payload: {\n      type: 'system.abuseReportUrgent'\n      title: string\n      body: string\n      link: string\n    }) => Promise<void>\n  },\n): Promise<{ reviewId: string; reference: string; first: boolean }> {\n  const reviewId = paymentFraudSignalReviewId(signal.kind, signal.stripeObjectId)\n  const reference = paymentFraudSignalReference(reviewId)\n  const ref = deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n  const first = !(await ref.get()).exists\n  const subscriptionCard = signal.orgId\n    ? staffSubscriptionCardPath(signal.orgId)\n    : null\n  await ref.set(\n    {\n      reference,\n      // \"Phishing or fraud\" — the queue's urgent fraud category.\n      category: 'phishing',\n      severity: 'urgent',\n      source: 'stripe-fraud-signal',\n      url: null,\n      reportedHostname: null,\n      hostId: null,\n      orgId: signal.orgId,\n      details: describePaymentFraudSignal(signal),\n      reporterEmail: null,\n      reporterName: null,\n      dmca: null,\n      reportCount: FieldValue.increment(1),\n      paymentSignal: {\n        kind: signal.kind,\n        stripeObjectId: signal.stripeObjectId,\n        chargeId: signal.chargeId,\n        paymentIntentId: signal.paymentIntentId,\n        amountCents: signal.amountCents,\n        currency: signal.currency,\n        detail: signal.detail,\n        checks: signal.checks,\n        livemode: signal.livemode,\n        subscriptionCard,\n      },\n      updatedAt: FieldValue.serverTimestamp(),\n      ...(first\n        ? { status: 'open', createdAt: FieldValue.serverTimestamp() }\n        : {}),\n    },\n    { merge: true },\n  )\n  if (first) {\n    await deps\n      .notify({\n        type: 'system.abuseReportUrgent',\n        title: `${KIND_LABEL[signal.kind]} — ${formatSignalAmount(signal.amountCents, signal.currency)}`,\n        body:\n          `${signal.orgId ? `Workspace ${signal.orgId}` : 'A charge that is not a workspace subscription'}, ` +\n          `charge ${signal.chargeId ?? signal.paymentIntentId ?? 'not named'}. ` +\n          `Nothing has been refunded or canceled. Reference ${reference}.`,\n        link: '/admin/abuse-reports',\n      })\n      .catch(() => undefined)\n  }\n  return { reviewId, reference, first }\n}\n\n/*==========================================\n * THE SELLER PATTERN: WHEN THE MERCHANT MAY BE THE FRAUDSTER (AGL-3360).\n *\n * A site's own sales are destination charges on the platform account, so\n * Stripe's fraud signals about a shopper's card arrive here too. One of them\n * is the merchant's business — their customer, their order, their decision\n * (`payment-risk-record.ts` puts it on the record and tells them). Staff are\n * not paged for it.\n *\n * What IS staff's business is the shape a phishing actor leaves when they\n * run stolen cards through a storefront of their own: several different\n * charges on ONE connected account drawing issuer fraud reports or\n * chargebacks in a short time. So every signal on a seller's charge is kept\n * in a small per-account ledger, and one urgent abuse-queue row is filed when\n *\n *   ≥ 3 DISTINCT charges carry an early fraud warning or a dispute\n *   within 7 days.\n *\n * Why those numbers. An early fraud warning is an issuer's report that the\n * cardholder did not make the payment, and a dispute is a formal\n * chargeback; a legitimate small merchant sees either rarely — card-network\n * dispute monitoring starts near 0.9% of a month's transactions, single\n * digits a MONTH for a shop doing hundreds of sales. One or two in a week is\n * ordinary friendly fraud and must never page staff. Three separate charges\n * in one week is a rate a real small shop does not produce, and is what a\n * card tester or a stolen-card storefront produces within days. Counted by\n * CHARGE, because a warning is routinely followed by a dispute on the same\n * payment, and that is one bad payment, not two. Radar reviews are kept in\n * the ledger for the row's prose but never counted: a review is Stripe's\n * suspicion, not an issuer's report, and a busy shop can collect several\n * that clear.\n *\n * One row per window: once filed, the account is not filed again until 7\n * days have passed, so a burst is one row with everything in it rather than\n * a row per signal. NOTHING IS DONE TO THE ACCOUNT OR THE MONEY: staff\n * decide (lock the workspace, pause the account's payouts in Stripe).\n *=========================================*/\n\nexport const SELLER_FRAUD_PATTERN = {\n  /** Distinct charges with an early fraud warning or a dispute. */\n  minDistinctCharges: 3,\n  /** …within this window. */\n  windowMs: 7 * 24 * 60 * 60 * 1000,\n  /** How long the ledger keeps an entry at all. */\n  retainMs: 30 * 24 * 60 * 60 * 1000,\n} as const\n\nconst WINDOW_DAYS = SELLER_FRAUD_PATTERN.windowMs / 86_400_000\n\n/** Admin-SDK only; no client rule opens it (default deny). */\nexport const SELLER_FRAUD_LEDGER_COLLECTION = 'paymentFraudLedger'\n\nexport interface SellerFraudLedgerEntry {\n  kind: PaymentFraudSignalKind\n  stripeObjectId: string\n  chargeId: string | null\n  amountCents: number | null\n  currency: string\n  detail: string\n  /** The sites a plugin recognised the charge as belonging to. */\n  hostIds: string[]\n  atMs: number\n}\n\n/** Whether a seller's ledger shows the pattern at `nowMs`. Pure. */\nexport function sellerFraudPattern(\n  entries: readonly SellerFraudLedgerEntry[],\n  nowMs: number,\n): { matched: boolean; chargeIds: string[] } {\n  const since = nowMs - SELLER_FRAUD_PATTERN.windowMs\n  const chargeIds = [\n    ...new Set(\n      entries\n        .filter(\n          (entry) =>\n            (entry.kind === 'early-fraud-warning' || entry.kind === 'dispute') &&\n            entry.atMs >= since,\n        )\n        .map((entry) => entry.chargeId || entry.stripeObjectId),\n    ),\n  ]\n  return {\n    matched: chargeIds.length >= SELLER_FRAUD_PATTERN.minDistinctCharges,\n    chargeIds,\n  }\n}\n\n/** The connected account's page in the Stripe Dashboard. */\nexport function stripeConnectedAccountUrl(\n  accountId: string,\n  livemode: boolean,\n): string {\n  return `https://dashboard.stripe.com/${livemode ? '' : 'test/'}connect/accounts/${encodeURIComponent(accountId)}`\n}\n\n/**\n * Keep one signal on a seller's charge, and file the pattern row when the\n * ledger crosses the threshold. Idempotent on the Stripe object id: a\n * redelivery changes nothing and files nothing.\n */\nexport async function recordSellerFraudSignal(\n  input: {\n    signal: PaymentFraudSignal\n    sellerAccountId: string\n    /** The sites a plugin recognised the charge as belonging to. */\n    hostIds: string[]\n    /** Workspaces owning those sites, for the row. */\n    orgIds: string[]\n  },\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notify: (payload: {\n      type: 'system.abuseReportUrgent'\n      title: string\n      body: string\n      link: string\n    }) => Promise<void>\n    nowMs?: number\n  },\n): Promise<{\n  first: boolean\n  matched: boolean\n  filed: { reviewId: string; reference: string } | null\n}> {\n  const nowMs = deps.nowMs ?? Date.now()\n  const { signal, sellerAccountId } = input\n  const ledgerRef = deps.firestore\n    .collection(SELLER_FRAUD_LEDGER_COLLECTION)\n    .doc(sellerAccountId)\n  const outcome = await deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(ledgerRef)\n    const stored = (\n      Array.isArray(fresh.get('entries')) ? fresh.get('entries') : []\n    ) as SellerFraudLedgerEntry[]\n    if (stored.some((entry) => entry.stripeObjectId === signal.stripeObjectId)) {\n      return { first: false, matched: false, fileAtMs: 0, entries: stored }\n    }\n    const entries: SellerFraudLedgerEntry[] = [\n      ...stored.filter(\n        (entry) => entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.retainMs,\n      ),\n      {\n        kind: signal.kind,\n        stripeObjectId: signal.stripeObjectId,\n        chargeId: signal.chargeId,\n        amountCents: signal.amountCents,\n        currency: signal.currency,\n        detail: signal.detail,\n        hostIds: input.hostIds,\n        atMs: nowMs,\n      },\n    ]\n    const { matched } = sellerFraudPattern(entries, nowMs)\n    const lastFiledAtMs = Number(fresh.get('lastFiledAtMs') ?? 0)\n    const fileAtMs =\n      matched &&\n      !(lastFiledAtMs && nowMs - lastFiledAtMs < SELLER_FRAUD_PATTERN.windowMs)\n        ? nowMs\n        : 0\n    transaction.set(\n      ledgerRef,\n      {\n        sellerAccountId,\n        entries,\n        livemode: signal.livemode,\n        updatedAtMs: nowMs,\n        ...(fileAtMs ? { lastFiledAtMs: fileAtMs } : {}),\n      },\n      { merge: true },\n    )\n    return { first: true, matched, fileAtMs, entries }\n  })\n  if (!outcome.fileAtMs) {\n    return { first: outcome.first, matched: outcome.matched, filed: null }\n  }\n\n  const { chargeIds } = sellerFraudPattern(outcome.entries, nowMs)\n  const inWindow = outcome.entries.filter(\n    (entry) => entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.windowMs,\n  )\n  const reviewId = createHash('sha256')\n    .update(`stripe-seller-pattern:${sellerAccountId}:${outcome.fileAtMs}`)\n    .digest('hex')\n    .slice(0, 40)\n  const reference = paymentFraudSignalReference(reviewId)\n  const orgId = input.orgIds[0] ?? null\n  const hostIds = [...new Set(inWindow.flatMap((entry) => entry.hostIds ?? []))]\n  const stripeUrl = stripeConnectedAccountUrl(sellerAccountId, signal.livemode)\n  const details = [\n    `${chargeIds.length} different charges paid to connected account ${sellerAccountId} drew an issuer fraud warning or a dispute within ${WINDOW_DAYS} days` +\n      (signal.livemode ? '' : ' — TEST MODE') +\n      '.',\n    `Workspace(s): ${input.orgIds.length ? input.orgIds.join(', ') : 'not resolved'}. Site(s): ${hostIds.length ? hostIds.join(', ') : 'not resolved'}.`,\n    ...inWindow.map(\n      (entry) =>\n        `• ${KIND_LABEL[entry.kind]} ${entry.stripeObjectId} on ${entry.chargeId ?? 'an unnamed charge'} · ${formatSignalAmount(entry.amountCents, entry.currency)}` +\n        (entry.detail ? ` · ${entry.detail}` : ''),\n    ),\n    'A shop taking stolen cards through its own storefront leaves this shape. Each merchant has already been shown the signal on its own order or booking.',\n    `Nothing has been refunded, canceled or paused. If this is the seller's fraud, lock the workspace and pause the account's payouts in Stripe (${stripeUrl}), then close this row with what you did.`,\n  ]\n    .join('\\n')\n    .slice(0, 5000)\n  await deps.firestore\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .set(\n      {\n        reference,\n        // \"Phishing or fraud\" — the queue's urgent fraud category.\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'stripe-seller-fraud-pattern',\n        url: null,\n        reportedHostname: null,\n        hostId: hostIds[0] ?? null,\n        orgId,\n        details,\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: 1,\n        sellerPattern: {\n          sellerAccountId,\n          stripeAccountUrl: stripeUrl,\n          chargeIds,\n          orgIds: input.orgIds,\n          hostIds,\n          threshold: SELLER_FRAUD_PATTERN.minDistinctCharges,\n          windowDays: WINDOW_DAYS,\n          livemode: signal.livemode,\n        },\n        status: 'open',\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n  await deps\n    .notify({\n      type: 'system.abuseReportUrgent',\n      title: `Seller fraud pattern — ${chargeIds.length} charges on one account`,\n      body:\n        `Connected account ${sellerAccountId}` +\n        (orgId ? ` (workspace ${orgId})` : '') +\n        ` drew fraud warnings or disputes on ${chargeIds.length} different charges in ${WINDOW_DAYS} days. ` +\n        `Nothing has been refunded, canceled or paused. Reference ${reference}.`,\n      link: '/admin/abuse-reports',\n    })\n    .catch(() => undefined)\n  return { first: true, matched: true, filed: { reviewId, reference } }\n}\n"],"names":["createHash","ABUSE_REPORT_COLLECTION","FieldValue","KIND_LABEL","dispute","PAYMENT_FRAUD_SIGNAL_LABELS","paymentFraudSignalReviewId","kind","stripeObjectId","update","digest","slice","paymentFraudSignalReference","reviewId","toUpperCase","staffSubscriptionCardPath","orgId","encodeURIComponent","formatSignalAmount","amountCents","currency","Number","isFinite","toFixed","String","readStripeChargeForSignal","chargeId","options","secretKey","charge","card","response","fetchImpl","fetch","headers","Authorization","ok","json","text","value","customerId","checks","cvcCheck","addressPostalCodeCheck","cardCountry","riskLevel","threeDSecure","sellerAccountId","accountRef","id","startsWith","describePaymentFraudSignal","signal","lines","livemode","paymentIntentId","detail","push","join","recordPaymentFraudSignal","deps","reference","ref","firestore","collection","doc","first","get","exists","subscriptionCard","set","category","severity","source","url","reportedHostname","hostId","details","reporterEmail","reporterName","dmca","reportCount","increment","paymentSignal","updatedAt","serverTimestamp","status","createdAt","merge","notify","type","title","body","link","catch","undefined","SELLER_FRAUD_PATTERN","minDistinctCharges","windowMs","retainMs","WINDOW_DAYS","SELLER_FRAUD_LEDGER_COLLECTION","sellerFraudPattern","entries","nowMs","since","chargeIds","Set","filter","entry","atMs","map","matched","length","stripeConnectedAccountUrl","accountId","recordSellerFraudSignal","input","hostIds","Date","now","ledgerRef","outcome","runTransaction","transaction","fresh","stored","Array","isArray","some","fileAtMs","lastFiledAtMs","updatedAtMs","filed","inWindow","orgIds","flatMap","stripeUrl","sellerPattern","stripeAccountUrl","threshold","windowDays"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;2CAqB2C,GAE3C,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,uBAAuB,QAAQ,sCAAqC;AAC7E,SAASC,UAAU,QAAQ,2BAA0B;AAQrD,MAAMC,aAAqD;IACzD,uBAAuB;IACvB,gBAAgB;IAChBC,SAAS;AACX;AAEA,yEAAyE,GACzE,OAAO,MAAMC,8BAA8BF,WAAU;AA4BrD,mEAAmE,GACnE,OAAO,SAASG,2BACdC,IAA4B,EAC5BC,cAAsB;IAEtB,OAAOR,WAAW,UACfS,MAAM,CAAC,CAAC,aAAa,EAAEF,KAAK,CAAC,EAAEC,gBAAgB,EAC/CE,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;AACd;AAEA,kFAAkF,GAClF,OAAO,SAASC,4BAA4BC,QAAgB;IAC1D,OAAO,CAAC,GAAG,EAAEA,SAASF,KAAK,CAAC,GAAG,IAAIG,WAAW,IAAI;AACpD;AAEA,uEAAuE,GACvE,OAAO,SAASC,0BAA0BC,KAAa;IACrD,OAAO,CAAC,YAAY,EAAEC,mBAAmBD,OAAO,aAAa,CAAC;AAChE;AAEA,gEAAgE,GAChE,OAAO,SAASE,mBACdC,WAA0B,EAC1BC,QAAgB;IAEhB,IAAID,gBAAgB,QAAQ,CAACE,OAAOC,QAAQ,CAACH,cAAc;QACzD,OAAO;IACT;IACA,OAAO,GAAG,AAACA,CAAAA,cAAc,GAAE,EAAGI,OAAO,CAAC,GAAG,CAAC,EAAEC,OAAOJ,YAAY,OAAON,WAAW,IAAI;AACvF;AAEA;;;;;;CAMC,GACD,OAAO,eAAeW,0BACpBC,QAAgB,EAChBC,OAAoE;IAepE,IAAI,CAACD,YAAY,CAACC,QAAQC,SAAS,EAAE,OAAO;IAC5C,IAAI;YACsBD;YAMXE,gCAUMC,cACcA,eAEbD,iBACGC,sBAEOD;QAtB9B,MAAME,WAAW,MAAM,EAACJ,qBAAAA,QAAQK,SAAS,YAAjBL,qBAAqBM,OAC3C,CAAC,kCAAkC,EAAEhB,mBAAmBS,WAAW,EACnE;YAAEQ,SAAS;gBAAEC,eAAe,CAAC,OAAO,EAAER,QAAQC,SAAS,EAAE;YAAC;QAAE;QAE9D,IAAI,CAACG,SAASK,EAAE,EAAE,OAAO;QACzB,MAAMP,SAAU,MAAME,SAASM,IAAI;QACnC,MAAMP,eAAOD,2BAAAA,iCAAAA,MAAQ,CAAC,yBAAyB,qBAAlCA,8BAAoC,CAAC,OAAO,mBAAI,CAAC;QAC9D,MAAMS,OAAO,CAACC,QACZ,OAAOA,UAAU,YAAYA,QAAQA,QAAQ;QAC/C,OAAO;YACLpB,aAAaE,OAAOC,QAAQ,CAACD,OAAOQ,0BAAAA,MAAQ,CAAC,SAAS,KAClDR,OAAOQ,MAAM,CAAC,SAAS,IACvB;YACJT,UAAUI,gBAAOK,0BAAAA,MAAQ,CAAC,WAAW,oBAAI;YACzCW,YAAYF,KAAKT,0BAAAA,MAAQ,CAAC,WAAW;YACrCY,QAAQ;gBACNC,UAAUJ,KAAKR,yBAAAA,eAAAA,IAAM,CAAC,SAAS,qBAAhBA,YAAkB,CAAC,YAAY;gBAC9Ca,wBAAwBL,KAAKR,yBAAAA,gBAAAA,IAAM,CAAC,SAAS,qBAAhBA,aAAkB,CAAC,4BAA4B;gBAC5Ec,aAAaN,KAAKR,wBAAAA,IAAM,CAAC,UAAU;gBACnCe,WAAWP,KAAKT,2BAAAA,kBAAAA,MAAQ,CAAC,UAAU,qBAAnBA,eAAqB,CAAC,aAAa;gBACnDiB,cAAcR,KAAKR,yBAAAA,uBAAAA,IAAM,CAAC,iBAAiB,qBAAxBA,oBAA0B,CAAC,SAAS;YACzD;YACAiB,iBAAiBC,WAAWnB,2BAAAA,wBAAAA,MAAQ,CAAC,gBAAgB,qBAAzBA,qBAA2B,CAAC,cAAc;QACxE;IACF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,mEAAmE,GACnE,SAASmB,WAAWT,KAAc;;IAChC,MAAMU,KACJ,OAAOV,UAAU,WACbA,QACAf,eAAQe,yBAAD,AAACA,MAAmCU,EAAE,mBAAI;IACvD,OAAOA,GAAGC,UAAU,CAAC,WAAWD,KAAK;AACvC;AAEA,0EAA0E,GAC1E,OAAO,SAASE,2BAA2BC,MAA0B;QAKnDA,eACHA,MAAAA;IALb,MAAMC,QAAQ;QACZ,GAAGlD,UAAU,CAACiD,OAAO7C,IAAI,CAAC,CAAC,cAAc,EAAE6C,OAAO5C,cAAc,CAAC,CAAC,CAAC,GAChE4C,CAAAA,OAAOE,QAAQ,GAAG,KAAK,cAAa,IACrC;QACF,CAAC,WAAW,GAAEF,gBAAAA,OAAOpC,KAAK,YAAZoC,gBAAgB,gEAAgE,CAAC,CAAC;QAChG,CAAC,QAAQ,GAAEA,QAAAA,mBAAAA,OAAO1B,QAAQ,YAAf0B,mBAAmBA,OAAOG,eAAe,YAAzCH,OAA6C,YAAY,GAAG,EAAElC,mBAAmBkC,OAAOjC,WAAW,EAAEiC,OAAOhC,QAAQ,EAAE,CAAC,CAAC;KACpI;IACD,IAAIgC,OAAOI,MAAM,EAAEH,MAAMI,IAAI,CAAC,CAAC,aAAa,EAAEL,OAAOI,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAMf,SAASW,OAAOX,MAAM;IAC5B,IAAIA,QAAQ;YAEKA,kBAA6CA,gCAC3CA,qBAAwCA,sBACvCA;QAHlBY,MAAMI,IAAI,CACR,CAAC,UAAU,GAAEhB,mBAAAA,OAAOC,QAAQ,YAAfD,mBAAmB,UAAU,cAAc,GAAEA,iCAAAA,OAAOE,sBAAsB,YAA7BF,iCAAiC,UAAU,EAAE,CAAC,GACtG,CAAC,UAAU,GAAEA,sBAAAA,OAAOG,WAAW,YAAlBH,sBAAsB,UAAU,MAAM,GAAEA,uBAAAA,OAAOK,YAAY,YAAnBL,uBAAuB,WAAW,EAAE,CAAC,GAC1F,CAAC,WAAW,GAAEA,oBAAAA,OAAOI,SAAS,YAAhBJ,oBAAoB,UAAU,CAAC,CAAC;IAEpD;IACAY,MAAMI,IAAI,CACRL,OAAO7C,IAAI,KAAK,iBACZ,kEACA6C,OAAO7C,IAAI,KAAK,YACd,+DACA,gFACN;IAEF,OAAO8C,MAAMK,IAAI,CAAC,MAAM/C,KAAK,CAAC,GAAG;AACnC;AAEA;;;;;;;CAOC,GACD,OAAO,eAAegD,yBACpBP,MAA0B,EAC1BQ,IAQC;IAED,MAAM/C,WAAWP,2BAA2B8C,OAAO7C,IAAI,EAAE6C,OAAO5C,cAAc;IAC9E,MAAMqD,YAAYjD,4BAA4BC;IAC9C,MAAMiD,MAAMF,KAAKG,SAAS,CAACC,UAAU,CAAC/D,yBAAyBgE,GAAG,CAACpD;IACnE,MAAMqD,QAAQ,CAAC,AAAC,CAAA,MAAMJ,IAAIK,GAAG,EAAC,EAAGC,MAAM;IACvC,MAAMC,mBAAmBjB,OAAOpC,KAAK,GACjCD,0BAA0BqC,OAAOpC,KAAK,IACtC;IACJ,MAAM8C,IAAIQ,GAAG,CACX;QACET;QACA,2DAA2D;QAC3DU,UAAU;QACVC,UAAU;QACVC,QAAQ;QACRC,KAAK;QACLC,kBAAkB;QAClBC,QAAQ;QACR5D,OAAOoC,OAAOpC,KAAK;QACnB6D,SAAS1B,2BAA2BC;QACpC0B,eAAe;QACfC,cAAc;QACdC,MAAM;QACNC,aAAa/E,WAAWgF,SAAS,CAAC;QAClCC,eAAe;YACb5E,MAAM6C,OAAO7C,IAAI;YACjBC,gBAAgB4C,OAAO5C,cAAc;YACrCkB,UAAU0B,OAAO1B,QAAQ;YACzB6B,iBAAiBH,OAAOG,eAAe;YACvCpC,aAAaiC,OAAOjC,WAAW;YAC/BC,UAAUgC,OAAOhC,QAAQ;YACzBoC,QAAQJ,OAAOI,MAAM;YACrBf,QAAQW,OAAOX,MAAM;YACrBa,UAAUF,OAAOE,QAAQ;YACzBe;QACF;QACAe,WAAWlF,WAAWmF,eAAe;OACjCnB,QACA;QAAEoB,QAAQ;QAAQC,WAAWrF,WAAWmF,eAAe;IAAG,IAC1D,CAAC,IAEP;QAAEG,OAAO;IAAK;IAEhB,IAAItB,OAAO;YAOOd,MAAAA;QANhB,MAAMQ,KACH6B,MAAM,CAAC;YACNC,MAAM;YACNC,OAAO,GAAGxF,UAAU,CAACiD,OAAO7C,IAAI,CAAC,CAAC,GAAG,EAAEW,mBAAmBkC,OAAOjC,WAAW,EAAEiC,OAAOhC,QAAQ,GAAG;YAChGwE,MACE,GAAGxC,OAAOpC,KAAK,GAAG,CAAC,UAAU,EAAEoC,OAAOpC,KAAK,EAAE,GAAG,gDAAgD,EAAE,CAAC,GACnG,CAAC,OAAO,GAAEoC,QAAAA,mBAAAA,OAAO1B,QAAQ,YAAf0B,mBAAmBA,OAAOG,eAAe,YAAzCH,OAA6C,YAAY,EAAE,CAAC,GACtE,CAAC,iDAAiD,EAAES,UAAU,CAAC,CAAC;YAClEgC,MAAM;QACR,GACCC,KAAK,CAAC,IAAMC;IACjB;IACA,OAAO;QAAElF;QAAUgD;QAAWK;IAAM;AACtC;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAoC2C,GAE3C,OAAO,MAAM8B,uBAAuB;IAClC,+DAA+D,GAC/DC,oBAAoB;IACpB,yBAAyB,GACzBC,UAAU,IAAI,KAAK,KAAK,KAAK;IAC7B,+CAA+C,GAC/CC,UAAU,KAAK,KAAK,KAAK,KAAK;AAChC,EAAU;AAEV,MAAMC,cAAcJ,qBAAqBE,QAAQ,GAAG;AAEpD,4DAA4D,GAC5D,OAAO,MAAMG,iCAAiC,qBAAoB;AAclE,kEAAkE,GAClE,OAAO,SAASC,mBACdC,OAA0C,EAC1CC,KAAa;IAEb,MAAMC,QAAQD,QAAQR,qBAAqBE,QAAQ;IACnD,MAAMQ,YAAY;WACb,IAAIC,IACLJ,QACGK,MAAM,CACL,CAACC,QACC,AAACA,CAAAA,MAAMtG,IAAI,KAAK,yBAAyBsG,MAAMtG,IAAI,KAAK,SAAQ,KAChEsG,MAAMC,IAAI,IAAIL,OAEjBM,GAAG,CAAC,CAACF,QAAUA,MAAMnF,QAAQ,IAAImF,MAAMrG,cAAc;KAE3D;IACD,OAAO;QACLwG,SAASN,UAAUO,MAAM,IAAIjB,qBAAqBC,kBAAkB;QACpES;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASQ,0BACdC,SAAiB,EACjB7D,QAAiB;IAEjB,OAAO,CAAC,6BAA6B,EAAEA,WAAW,KAAK,QAAQ,iBAAiB,EAAErC,mBAAmBkG,YAAY;AACnH;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpBC,KAOC,EACDzD,IASC;QAMaA,aA6DAyD,gBA8BAC;IA3Fd,MAAMd,SAAQ5C,cAAAA,KAAK4C,KAAK,YAAV5C,cAAc2D,KAAKC,GAAG;IACpC,MAAM,EAAEpE,MAAM,EAAEL,eAAe,EAAE,GAAGsE;IACpC,MAAMI,YAAY7D,KAAKG,SAAS,CAC7BC,UAAU,CAACqC,gCACXpC,GAAG,CAAClB;IACP,MAAM2E,UAAU,MAAM9D,KAAKG,SAAS,CAAC4D,cAAc,CAAC,OAAOC;YAwB5BC;QAvB7B,MAAMA,QAAQ,MAAMD,YAAYzD,GAAG,CAACsD;QACpC,MAAMK,SACJC,MAAMC,OAAO,CAACH,MAAM1D,GAAG,CAAC,cAAc0D,MAAM1D,GAAG,CAAC,aAAa,EAAE;QAEjE,IAAI2D,OAAOG,IAAI,CAAC,CAACpB,QAAUA,MAAMrG,cAAc,KAAK4C,OAAO5C,cAAc,GAAG;YAC1E,OAAO;gBAAE0D,OAAO;gBAAO8C,SAAS;gBAAOkB,UAAU;gBAAG3B,SAASuB;YAAO;QACtE;QACA,MAAMvB,UAAoC;eACrCuB,OAAOlB,MAAM,CACd,CAACC,QAAUA,MAAMC,IAAI,IAAIN,QAAQR,qBAAqBG,QAAQ;YAEhE;gBACE5F,MAAM6C,OAAO7C,IAAI;gBACjBC,gBAAgB4C,OAAO5C,cAAc;gBACrCkB,UAAU0B,OAAO1B,QAAQ;gBACzBP,aAAaiC,OAAOjC,WAAW;gBAC/BC,UAAUgC,OAAOhC,QAAQ;gBACzBoC,QAAQJ,OAAOI,MAAM;gBACrB8D,SAASD,MAAMC,OAAO;gBACtBR,MAAMN;YACR;SACD;QACD,MAAM,EAAEQ,OAAO,EAAE,GAAGV,mBAAmBC,SAASC;QAChD,MAAM2B,gBAAgB9G,QAAOwG,aAAAA,MAAM1D,GAAG,CAAC,4BAAV0D,aAA8B;QAC3D,MAAMK,WACJlB,WACA,CAAEmB,CAAAA,iBAAiB3B,QAAQ2B,gBAAgBnC,qBAAqBE,QAAQ,AAAD,IACnEM,QACA;QACNoB,YAAYtD,GAAG,CACbmD,WACA;YACE1E;YACAwD;YACAjD,UAAUF,OAAOE,QAAQ;YACzB8E,aAAa5B;WACT0B,WAAW;YAAEC,eAAeD;QAAS,IAAI,CAAC,IAEhD;YAAE1C,OAAO;QAAK;QAEhB,OAAO;YAAEtB,OAAO;YAAM8C;YAASkB;YAAU3B;QAAQ;IACnD;IACA,IAAI,CAACmB,QAAQQ,QAAQ,EAAE;QACrB,OAAO;YAAEhE,OAAOwD,QAAQxD,KAAK;YAAE8C,SAASU,QAAQV,OAAO;YAAEqB,OAAO;QAAK;IACvE;IAEA,MAAM,EAAE3B,SAAS,EAAE,GAAGJ,mBAAmBoB,QAAQnB,OAAO,EAAEC;IAC1D,MAAM8B,WAAWZ,QAAQnB,OAAO,CAACK,MAAM,CACrC,CAACC,QAAUA,MAAMC,IAAI,IAAIN,QAAQR,qBAAqBE,QAAQ;IAEhE,MAAMrF,WAAWb,WAAW,UACzBS,MAAM,CAAC,CAAC,sBAAsB,EAAEsC,gBAAgB,CAAC,EAAE2E,QAAQQ,QAAQ,EAAE,EACrExH,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;IACZ,MAAMkD,YAAYjD,4BAA4BC;IAC9C,MAAMG,SAAQqG,iBAAAA,MAAMkB,MAAM,CAAC,EAAE,YAAflB,iBAAmB;IACjC,MAAMC,UAAU;WAAI,IAAIX,IAAI2B,SAASE,OAAO,CAAC,CAAC3B;gBAAUA;oBAAAA,iBAAAA,MAAMS,OAAO,YAAbT,iBAAiB,EAAE;;KAAG;IAC9E,MAAM4B,YAAYvB,0BAA0BnE,iBAAiBK,OAAOE,QAAQ;IAC5E,MAAMuB,UAAU;QACd,GAAG6B,UAAUO,MAAM,CAAC,6CAA6C,EAAElE,gBAAgB,kDAAkD,EAAEqD,YAAY,KAAK,CAAC,GACtJhD,CAAAA,OAAOE,QAAQ,GAAG,KAAK,cAAa,IACrC;QACF,CAAC,cAAc,EAAE+D,MAAMkB,MAAM,CAACtB,MAAM,GAAGI,MAAMkB,MAAM,CAAC7E,IAAI,CAAC,QAAQ,eAAe,WAAW,EAAE4D,QAAQL,MAAM,GAAGK,QAAQ5D,IAAI,CAAC,QAAQ,eAAe,CAAC,CAAC;WACjJ4E,SAASvB,GAAG,CACb,CAACF;gBAC2DA;mBAA1D,CAAC,EAAE,EAAE1G,UAAU,CAAC0G,MAAMtG,IAAI,CAAC,CAAC,CAAC,EAAEsG,MAAMrG,cAAc,CAAC,IAAI,GAAEqG,kBAAAA,MAAMnF,QAAQ,YAAdmF,kBAAkB,oBAAoB,GAAG,EAAE3F,mBAAmB2F,MAAM1F,WAAW,EAAE0F,MAAMzF,QAAQ,GAAG,GAC3JyF,CAAAA,MAAMrD,MAAM,GAAG,CAAC,GAAG,EAAEqD,MAAMrD,MAAM,EAAE,GAAG,EAAC;;QAE5C;QACA,CAAC,4IAA4I,EAAEiF,UAAU,yCAAyC,CAAC;KACpM,CACE/E,IAAI,CAAC,MACL/C,KAAK,CAAC,GAAG;IACZ,MAAMiD,KAAKG,SAAS,CACjBC,UAAU,CAAC/D,yBACXgE,GAAG,CAACpD,UACJyD,GAAG,CACF;QACET;QACA,2DAA2D;QAC3DU,UAAU;QACVC,UAAU;QACVC,QAAQ;QACRC,KAAK;QACLC,kBAAkB;QAClBC,MAAM,GAAE0C,YAAAA,OAAO,CAAC,EAAE,YAAVA,YAAc;QACtBtG;QACA6D;QACAC,eAAe;QACfC,cAAc;QACdC,MAAM;QACNC,aAAa;QACbyD,eAAe;YACb3F;YACA4F,kBAAkBF;YAClB/B;YACA6B,QAAQlB,MAAMkB,MAAM;YACpBjB;YACAsB,WAAW5C,qBAAqBC,kBAAkB;YAClD4C,YAAYzC;YACZ9C,UAAUF,OAAOE,QAAQ;QAC3B;QACAgC,QAAQ;QACRC,WAAWrF,WAAWmF,eAAe;QACrCD,WAAWlF,WAAWmF,eAAe;IACvC,GACA;QAAEG,OAAO;IAAK;IAElB,MAAM5B,KACH6B,MAAM,CAAC;QACNC,MAAM;QACNC,OAAO,CAAC,uBAAuB,EAAEe,UAAUO,MAAM,CAAC,uBAAuB,CAAC;QAC1ErB,MACE,CAAC,kBAAkB,EAAE7C,iBAAiB,GACrC/B,CAAAA,QAAQ,CAAC,YAAY,EAAEA,MAAM,CAAC,CAAC,GAAG,EAAC,IACpC,CAAC,oCAAoC,EAAE0F,UAAUO,MAAM,CAAC,sBAAsB,EAAEb,YAAY,OAAO,CAAC,GACpG,CAAC,yDAAyD,EAAEvC,UAAU,CAAC,CAAC;QAC1EgC,MAAM;IACR,GACCC,KAAK,CAAC,IAAMC;IACf,OAAO;QAAE7B,OAAO;QAAM8C,SAAS;QAAMqB,OAAO;YAAExH;YAAUgD;QAAU;IAAE;AACtE"}