@aglyn/tenant-data-admin 1.0.0-beta.201 → 1.0.0-beta.202

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.201",
+  "version": "1.0.0-beta.202",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.201",
-    "@aglyn/shared-util-email": "1.0.0-beta.201",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.201",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.201",
-    "@aglyn/shared-util-http": "1.0.0-beta.201",
-    "@aglyn/shared-util-tools": "1.0.0-beta.201",
+    "@aglyn/aglyn": "1.0.0-beta.202",
+    "@aglyn/shared-util-email": "1.0.0-beta.202",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.202",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.202",
+    "@aglyn/shared-util-http": "1.0.0-beta.202",
+    "@aglyn/shared-util-tools": "1.0.0-beta.202",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
     "sharp": "^0.35.3",

package/src/lib/server/card-payment-velocity.d.ts

@@ -0,0 +1,85 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { notifyHostManagers, notifyStaff } from './notifications';
+export interface CardPaymentVelocityOptions {
+    /** Dispatcher path, for the staff row. */
+    path: string;
+    /** The site the payment is for; `''` when none resolved (still counted). */
+    hostId: string;
+    /** The workspace owning it, when the dispatcher read one. */
+    orgId?: string | null;
+    /** True for a workspace younger than the screen's young-workspace age. */
+    young?: boolean;
+    /** Read for its client-address headers. */
+    request: {
+        headers?: {
+            get?: (name: string) => unknown;
+        };
+    };
+    nowMs?: number;
+    /** Injectable for tests; defaults to the Admin SDK's Firestore. */
+    firestore?: unknown;
+    /** Injectable for tests; defaults to `notifyStaff`. */
+    notify?: typeof notifyStaff;
+    /** Injectable for tests; defaults to `notifyHostManagers`. */
+    notifyManagers?: typeof notifyHostManagers;
+}
+/** The abuse-queue row id for a site's alarm on one day. Hex, like every row. */
+export declare function cardPaymentAlarmReviewId(hostId: string, day: string): string;
+/**
+ * Tell staff and the site's managers, once per site per day, that its payment
+ * doors crossed the card-testing alarm (AGL-3363). The one notifier for this
+ * kind of signal, so a shared risk-notice seam can take it over whole.
+ *
+ * The merchant's sentence names the outcome and what to do, never the rule
+ * or its numbers: a merchant who is the card tester must not learn how to
+ * pace under it. Never throws.
+ */
+export declare function notifyCardTestingVelocity(input: {
+    hostId: string;
+    orgId: string | null;
+    reference: string;
+}, deps: {
+    notifyStaff: typeof notifyStaff;
+    notifyManagers: typeof notifyHostManagers;
+}): Promise<void>;
+/**
+ * File (or count) the day's alarm row for a site whose payment doors crossed
+ * the site counter, and tell staff the first time. Never throws: an alarm
+ * that fails must not turn a shopper's checkout into a 500.
+ */
+export declare function recordCardPaymentAlarm(input: {
+    hostId: string;
+    orgId: string | null;
+    path: string;
+    young: boolean;
+    nowMs: number;
+    firestore: any;
+    notify: typeof notifyStaff;
+    notifyManagers: typeof notifyHostManagers;
+}): Promise<{
+    reviewId: string;
+    first: boolean;
+} | null>;
+/** Forget which alarms this process filed. */
+export declare function resetCardPaymentAlarmsForTests(): void;
+/**
+ * Count one opened card payment and return a 429 once a visitor's or an
+ * address's window is spent. See the policy module for the three counters.
+ */
+export declare function cardPaymentVelocityRefusal(options: CardPaymentVelocityOptions): Promise<Response | null>;
+export default cardPaymentVelocityRefusal;

package/src/lib/server/card-payment-velocity.js

@@ -0,0 +1,202 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * CARD-TESTING VELOCITY, THE DURABLE HALF (AGL-3363).
+ *
+ * The policy — the three counters, their numbers and why — is
+ * `@aglyn/aglyn/app-utils/card-payment-velocity`. This counts them in the
+ * shared durable store (`consumeRateLimit`) and answers the dispatcher the
+ * way the visitor-write limiter beside it does: a `Response` to return, or
+ * null to carry on. The tenant dispatcher calls it for a route registered
+ * with `{ cardPayment: true }`, so every plugin's payment door meets it by
+ * declaring itself, and none carries its own copy.
+ *
+ * The site counter refuses nothing. Crossing it files ONE urgent row per
+ * site per day in the abuse queue (`source: 'payment-velocity'`), beside the
+ * seller-pattern row, and tells staff once.
+ *=========================================*/ import { createHash } from "crypto";
+import { ABUSE_REPORT_COLLECTION } from "@aglyn/aglyn/app-utils/abuse-report";
+import { CARD_PAYMENT_VELOCITY, cardPaymentAddressKey, cardPaymentAlarmDay, cardPaymentSiteKey, cardPaymentVisitorKey } from "@aglyn/aglyn/app-utils/card-payment-velocity";
+import { NO_CLIENT_ADDRESS_BUCKET, readClientIp } from "@aglyn/aglyn/app-utils/request-ip";
+import { FieldValue } from "firebase-admin/firestore";
+import firebaseAdmin from "./firebase-admin.js";
+import { notifyHostManagers, notifyStaff } from "./notifications.js";
+import { consumeRateLimit } from "./rate-limit-store.js";
+function clientIp(request) {
+    var _readClientIp;
+    const headers = request == null ? void 0 : request.headers;
+    if (typeof (headers == null ? void 0 : headers.get) !== 'function') return NO_CLIENT_ADDRESS_BUCKET;
+    return (_readClientIp = readClientIp(headers)) != null ? _readClientIp : NO_CLIENT_ADDRESS_BUCKET;
+}
+function refusal(resetMs, nowMs) {
+    // The same bare 429 as the visitor-write limiter: no remaining-count
+    // headers for a stranger to pace a script by.
+    return Response.json({
+        error: 'Too many payment attempts. Please wait a few minutes and try again.'
+    }, {
+        status: 429,
+        headers: {
+            'Retry-After': String(Math.max(1, Math.ceil((resetMs - nowMs) / 1000)))
+        }
+    });
+}
+/** The abuse-queue row id for a site's alarm on one day. Hex, like every row. */ export function cardPaymentAlarmReviewId(hostId, day) {
+    return createHash('sha256').update(`payment-velocity:${hostId}:${day}`).digest('hex').slice(0, 40);
+}
+/**
+ * Tell staff and the site's managers, once per site per day, that its payment
+ * doors crossed the card-testing alarm (AGL-3363). The one notifier for this
+ * kind of signal, so a shared risk-notice seam can take it over whole.
+ *
+ * The merchant's sentence names the outcome and what to do, never the rule
+ * or its numbers: a merchant who is the card tester must not learn how to
+ * pace under it. Never throws.
+ */ export async function notifyCardTestingVelocity(input, deps) {
+    await Promise.all([
+        deps.notifyStaff({
+            type: 'system.abuseReportUrgent',
+            title: `Card-testing velocity — site ${input.hostId}`,
+            body: 'An unusual number of card payments opened on one site' + (input.orgId ? ` (workspace ${input.orgId})` : '') + '. Nothing has been refused site-wide or refunded. Check the site and its ' + 'recent orders; if it is card testing, lock the workspace and pause the ' + `connected account's payouts. Reference ${input.reference}.`,
+            link: '/admin/abuse-reports'
+        }).catch(()=>undefined),
+        deps.notifyManagers(input.hostId, {
+            type: 'content.order',
+            title: 'Unusual checkout activity on your site',
+            body: 'Your checkout saw an unusual burst of payment attempts, which can be ' + 'someone testing stolen cards. Checkout is still open; repeated attempts ' + 'from one source are being slowed. Review recent orders before you ' + 'fulfill them, and refund any you do not recognize. If this was a launch ' + `or sale, no action is needed. Questions: contact support with reference ${input.reference}.`,
+            link: `/${input.hostId}/orders`
+        }).catch(()=>undefined)
+    ]);
+}
+/**
+ * File (or count) the day's alarm row for a site whose payment doors crossed
+ * the site counter, and tell staff the first time. Never throws: an alarm
+ * that fails must not turn a shopper's checkout into a 500.
+ */ export async function recordCardPaymentAlarm(input) {
+    try {
+        const day = cardPaymentAlarmDay(input.nowMs);
+        const reviewId = cardPaymentAlarmReviewId(input.hostId, day);
+        const reference = `PV-${reviewId.slice(0, 10).toUpperCase()}`;
+        const ref = input.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId);
+        const first = !(await ref.get()).exists;
+        const window = CARD_PAYMENT_VELOCITY.perSite;
+        const minutes = Math.round(window.windowMs / 60000);
+        await ref.set(_extends({
+            reference,
+            // "Phishing or fraud" — the queue's urgent fraud category.
+            category: 'phishing',
+            severity: 'urgent',
+            source: 'payment-velocity',
+            url: null,
+            reportedHostname: null,
+            hostId: input.hostId,
+            orgId: input.orgId,
+            details: [
+                `Site ${input.hostId} opened more than ${window.limit} card payments in ${minutes} minutes (first overage through ${input.path}).`,
+                input.young ? 'The workspace is young. Each address on this site is held to the tighter per-visitor limit.' : 'Each address is held to the per-visitor limit; nothing site-wide was refused.',
+                'A script testing stolen cards leaves this shape, from one address or many; so does a merchant testing cards through their own shop, and so does a busy launch.',
+                'Nothing has been refunded, canceled or paused. Look at the site and its orders; if it is card testing, lock the workspace and pause the connected account\'s payouts in Stripe, then close this row with what you did.'
+            ].join('\n'),
+            reporterEmail: null,
+            reporterName: null,
+            dmca: null,
+            reportCount: FieldValue.increment(1),
+            paymentVelocity: {
+                hostId: input.hostId,
+                orgId: input.orgId,
+                day,
+                threshold: window.limit,
+                windowMinutes: minutes,
+                young: input.young
+            },
+            updatedAt: FieldValue.serverTimestamp()
+        }, first ? {
+            status: 'open',
+            createdAt: FieldValue.serverTimestamp()
+        } : {}), {
+            merge: true
+        });
+        if (first) {
+            await notifyCardTestingVelocity({
+                hostId: input.hostId,
+                orgId: input.orgId,
+                reference
+            }, {
+                notifyStaff: input.notify,
+                notifyManagers: input.notifyManagers
+            });
+        }
+        return {
+            reviewId,
+            first
+        };
+    } catch (error) {
+        console.error('[card-payment-velocity] alarm row failed', error);
+        return null;
+    }
+}
+/** The (site, day) alarms this process has filed. */ const filedAlarms = new Set();
+/** Forget which alarms this process filed. */ export function resetCardPaymentAlarmsForTests() {
+    filedAlarms.clear();
+}
+/**
+ * Count one opened card payment and return a 429 once a visitor's or an
+ * address's window is spent. See the policy module for the three counters.
+ */ export async function cardPaymentVelocityRefusal(options) {
+    var _options_nowMs;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const ip = clientIp(options.request);
+    const visitorWindow = options.young ? CARD_PAYMENT_VELOCITY.perVisitorYoung : CARD_PAYMENT_VELOCITY.perVisitor;
+    const count = (key, window)=>consumeRateLimit(key, {
+            limit: window.limit,
+            windowMs: window.windowMs,
+            now: nowMs,
+            firestore: options.firestore
+        });
+    const siteKey = cardPaymentSiteKey(options.hostId);
+    const [visitor, address, site] = await Promise.all([
+        count(cardPaymentVisitorKey(options.hostId, ip), visitorWindow),
+        count(cardPaymentAddressKey(ip), CARD_PAYMENT_VELOCITY.perAddress),
+        siteKey ? count(siteKey, CARD_PAYMENT_VELOCITY.perSite) : Promise.resolve(null)
+    ]);
+    // The site counter's overage files the day's alarm. Each process files a
+    // (site, day) once — an attack is thousands of overages, and one row that
+    // says so is the whole message; the row id makes a second process's filing
+    // count on the same row rather than add one.
+    const day = cardPaymentAlarmDay(nowMs);
+    const filedKey = `${options.hostId}:${day}`;
+    if (site && !site.allowed && !site.contended && options.hostId && !filedAlarms.has(filedKey)) {
+        var _options_firestore, _options_orgId, _options_notify, _options_notifyManagers;
+        filedAlarms.add(filedKey);
+        const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+        await recordCardPaymentAlarm({
+            hostId: options.hostId,
+            orgId: (_options_orgId = options.orgId) != null ? _options_orgId : null,
+            path: options.path,
+            young: options.young === true,
+            nowMs,
+            firestore,
+            notify: (_options_notify = options.notify) != null ? _options_notify : notifyStaff,
+            notifyManagers: (_options_notifyManagers = options.notifyManagers) != null ? _options_notifyManagers : notifyHostManagers
+        });
+    }
+    if (!visitor.allowed) return refusal(visitor.resetMs, nowMs);
+    if (!address.allowed) return refusal(address.resetMs, nowMs);
+    return null;
+}
+export default cardPaymentVelocityRefusal;
+
+//# sourceMappingURL=card-payment-velocity.js.map

package/src/lib/server/card-payment-velocity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/card-payment-velocity.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * CARD-TESTING VELOCITY, THE DURABLE HALF (AGL-3363).\n *\n * The policy — the three counters, their numbers and why — is\n * `@aglyn/aglyn/app-utils/card-payment-velocity`. This counts them in the\n * shared durable store (`consumeRateLimit`) and answers the dispatcher the\n * way the visitor-write limiter beside it does: a `Response` to return, or\n * null to carry on. The tenant dispatcher calls it for a route registered\n * with `{ cardPayment: true }`, so every plugin's payment door meets it by\n * declaring itself, and none carries its own copy.\n *\n * The site counter refuses nothing. Crossing it files ONE urgent row per\n * site per day in the abuse queue (`source: 'payment-velocity'`), beside the\n * seller-pattern row, and tells staff once.\n *=========================================*/\n\nimport { createHash } from 'crypto'\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport {\n  CARD_PAYMENT_VELOCITY,\n  cardPaymentAddressKey,\n  cardPaymentAlarmDay,\n  cardPaymentSiteKey,\n  cardPaymentVisitorKey,\n} from '@aglyn/aglyn/app-utils/card-payment-velocity'\nimport {\n  NO_CLIENT_ADDRESS_BUCKET,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { notifyHostManagers, notifyStaff } from './notifications'\nimport { consumeRateLimit } from './rate-limit-store'\n\nexport interface CardPaymentVelocityOptions {\n  /** Dispatcher path, for the staff row. */\n  path: string\n  /** The site the payment is for; `''` when none resolved (still counted). */\n  hostId: string\n  /** The workspace owning it, when the dispatcher read one. */\n  orgId?: string | null\n  /** True for a workspace younger than the screen's young-workspace age. */\n  young?: boolean\n  /** Read for its client-address headers. */\n  request: { headers?: { get?: (name: string) => unknown } }\n  nowMs?: number\n  /** Injectable for tests; defaults to the Admin SDK's Firestore. */\n  firestore?: unknown\n  /** Injectable for tests; defaults to `notifyStaff`. */\n  notify?: typeof notifyStaff\n  /** Injectable for tests; defaults to `notifyHostManagers`. */\n  notifyManagers?: typeof notifyHostManagers\n}\n\nfunction clientIp(request: CardPaymentVelocityOptions['request']): string {\n  const headers = request?.headers\n  if (typeof headers?.get !== 'function') return NO_CLIENT_ADDRESS_BUCKET\n  return (\n    readClientIp(headers as { get(name: string): string | null }) ??\n    NO_CLIENT_ADDRESS_BUCKET\n  )\n}\n\nfunction refusal(resetMs: number, nowMs: number): Response {\n  // The same bare 429 as the visitor-write limiter: no remaining-count\n  // headers for a stranger to pace a script by.\n  return Response.json(\n    { error: 'Too many payment attempts. Please wait a few minutes and try again.' },\n    {\n      status: 429,\n      headers: {\n        'Retry-After': String(Math.max(1, Math.ceil((resetMs - nowMs) / 1000))),\n      },\n    },\n  )\n}\n\n/** The abuse-queue row id for a site's alarm on one day. Hex, like every row. */\nexport function cardPaymentAlarmReviewId(hostId: string, day: string): string {\n  return createHash('sha256')\n    .update(`payment-velocity:${hostId}:${day}`)\n    .digest('hex')\n    .slice(0, 40)\n}\n\n/**\n * Tell staff and the site's managers, once per site per day, that its payment\n * doors crossed the card-testing alarm (AGL-3363). The one notifier for this\n * kind of signal, so a shared risk-notice seam can take it over whole.\n *\n * The merchant's sentence names the outcome and what to do, never the rule\n * or its numbers: a merchant who is the card tester must not learn how to\n * pace under it. Never throws.\n */\nexport async function notifyCardTestingVelocity(\n  input: { hostId: string; orgId: string | null; reference: string },\n  deps: {\n    notifyStaff: typeof notifyStaff\n    notifyManagers: typeof notifyHostManagers\n  },\n): Promise<void> {\n  await Promise.all([\n    deps\n      .notifyStaff({\n        type: 'system.abuseReportUrgent',\n        title: `Card-testing velocity — site ${input.hostId}`,\n        body:\n          'An unusual number of card payments opened on one site' +\n          (input.orgId ? ` (workspace ${input.orgId})` : '') +\n          '. Nothing has been refused site-wide or refunded. Check the site and its ' +\n          'recent orders; if it is card testing, lock the workspace and pause the ' +\n          `connected account's payouts. Reference ${input.reference}.`,\n        link: '/admin/abuse-reports',\n      })\n      .catch(() => undefined),\n    deps\n      .notifyManagers(input.hostId, {\n        type: 'content.order',\n        title: 'Unusual checkout activity on your site',\n        body:\n          'Your checkout saw an unusual burst of payment attempts, which can be ' +\n          'someone testing stolen cards. Checkout is still open; repeated attempts ' +\n          'from one source are being slowed. Review recent orders before you ' +\n          'fulfill them, and refund any you do not recognize. If this was a launch ' +\n          `or sale, no action is needed. Questions: contact support with reference ${input.reference}.`,\n        link: `/${input.hostId}/orders`,\n      })\n      .catch(() => undefined),\n  ])\n}\n\n/**\n * File (or count) the day's alarm row for a site whose payment doors crossed\n * the site counter, and tell staff the first time. Never throws: an alarm\n * that fails must not turn a shopper's checkout into a 500.\n */\nexport async function recordCardPaymentAlarm(input: {\n  hostId: string\n  orgId: string | null\n  path: string\n  young: boolean\n  nowMs: number\n  firestore: any\n  notify: typeof notifyStaff\n  notifyManagers: typeof notifyHostManagers\n}): Promise<{ reviewId: string; first: boolean } | null> {\n  try {\n    const day = cardPaymentAlarmDay(input.nowMs)\n    const reviewId = cardPaymentAlarmReviewId(input.hostId, day)\n    const reference = `PV-${reviewId.slice(0, 10).toUpperCase()}`\n    const ref = input.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const first = !(await ref.get()).exists\n    const window = CARD_PAYMENT_VELOCITY.perSite\n    const minutes = Math.round(window.windowMs / 60_000)\n    await ref.set(\n      {\n        reference,\n        // \"Phishing or fraud\" — the queue's urgent fraud category.\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'payment-velocity',\n        url: null,\n        reportedHostname: null,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          `Site ${input.hostId} opened more than ${window.limit} card payments in ${minutes} minutes (first overage through ${input.path}).`,\n          input.young\n            ? 'The workspace is young. Each address on this site is held to the tighter per-visitor limit.'\n            : 'Each address is held to the per-visitor limit; nothing site-wide was refused.',\n          'A script testing stolen cards leaves this shape, from one address or many; so does a merchant testing cards through their own shop, and so does a busy launch.',\n          'Nothing has been refunded, canceled or paused. Look at the site and its orders; if it is card testing, lock the workspace and pause the connected account\\'s payouts in Stripe, then close this row with what you did.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: FieldValue.increment(1),\n        paymentVelocity: {\n          hostId: input.hostId,\n          orgId: input.orgId,\n          day,\n          threshold: window.limit,\n          windowMinutes: minutes,\n          young: input.young,\n        },\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first\n          ? { status: 'open', createdAt: FieldValue.serverTimestamp() }\n          : {}),\n      },\n      { merge: true },\n    )\n    if (first) {\n      await notifyCardTestingVelocity(\n        { hostId: input.hostId, orgId: input.orgId, reference },\n        { notifyStaff: input.notify, notifyManagers: input.notifyManagers },\n      )\n    }\n    return { reviewId, first }\n  } catch (error) {\n    console.error('[card-payment-velocity] alarm row failed', error)\n    return null\n  }\n}\n\n/** The (site, day) alarms this process has filed. */\nconst filedAlarms = new Set<string>()\n\n/** Forget which alarms this process filed. */\nexport function resetCardPaymentAlarmsForTests(): void {\n  filedAlarms.clear()\n}\n\n/**\n * Count one opened card payment and return a 429 once a visitor's or an\n * address's window is spent. See the policy module for the three counters.\n */\nexport async function cardPaymentVelocityRefusal(\n  options: CardPaymentVelocityOptions,\n): Promise<Response | null> {\n  const nowMs = options.nowMs ?? Date.now()\n  const ip = clientIp(options.request)\n  const visitorWindow = options.young\n    ? CARD_PAYMENT_VELOCITY.perVisitorYoung\n    : CARD_PAYMENT_VELOCITY.perVisitor\n  const count = (key: string, window: { limit: number; windowMs: number }) =>\n    consumeRateLimit(key, {\n      limit: window.limit,\n      windowMs: window.windowMs,\n      now: nowMs,\n      firestore: options.firestore,\n    })\n\n  const siteKey = cardPaymentSiteKey(options.hostId)\n  const [visitor, address, site] = await Promise.all([\n    count(cardPaymentVisitorKey(options.hostId, ip), visitorWindow),\n    count(cardPaymentAddressKey(ip), CARD_PAYMENT_VELOCITY.perAddress),\n    siteKey ? count(siteKey, CARD_PAYMENT_VELOCITY.perSite) : Promise.resolve(null),\n  ])\n\n  // The site counter's overage files the day's alarm. Each process files a\n  // (site, day) once — an attack is thousands of overages, and one row that\n  // says so is the whole message; the row id makes a second process's filing\n  // count on the same row rather than add one.\n  const day = cardPaymentAlarmDay(nowMs)\n  const filedKey = `${options.hostId}:${day}`\n  if (site && !site.allowed && !site.contended && options.hostId && !filedAlarms.has(filedKey)) {\n    filedAlarms.add(filedKey)\n    const firestore =\n      (options.firestore as any) ?? firebaseAdmin.app().firestore()\n    await recordCardPaymentAlarm({\n      hostId: options.hostId,\n      orgId: options.orgId ?? null,\n      path: options.path,\n      young: options.young === true,\n      nowMs,\n      firestore,\n      notify: options.notify ?? notifyStaff,\n      notifyManagers: options.notifyManagers ?? notifyHostManagers,\n    })\n  }\n\n  if (!visitor.allowed) return refusal(visitor.resetMs, nowMs)\n  if (!address.allowed) return refusal(address.resetMs, nowMs)\n  return null\n}\n\nexport default cardPaymentVelocityRefusal\n"],"names":["createHash","ABUSE_REPORT_COLLECTION","CARD_PAYMENT_VELOCITY","cardPaymentAddressKey","cardPaymentAlarmDay","cardPaymentSiteKey","cardPaymentVisitorKey","NO_CLIENT_ADDRESS_BUCKET","readClientIp","FieldValue","firebaseAdmin","notifyHostManagers","notifyStaff","consumeRateLimit","clientIp","request","headers","get","refusal","resetMs","nowMs","Response","json","error","status","String","Math","max","ceil","cardPaymentAlarmReviewId","hostId","day","update","digest","slice","notifyCardTestingVelocity","input","deps","Promise","all","type","title","body","orgId","reference","link","catch","undefined","notifyManagers","recordCardPaymentAlarm","reviewId","toUpperCase","ref","firestore","collection","doc","first","exists","window","perSite","minutes","round","windowMs","set","category","severity","source","url","reportedHostname","details","limit","path","young","join","reporterEmail","reporterName","dmca","reportCount","increment","paymentVelocity","threshold","windowMinutes","updatedAt","serverTimestamp","createdAt","merge","notify","console","filedAlarms","Set","resetCardPaymentAlarmsForTests","clear","cardPaymentVelocityRefusal","options","Date","now","ip","visitorWindow","perVisitorYoung","perVisitor","count","key","siteKey","visitor","address","site","perAddress","resolve","filedKey","allowed","contended","has","add","app"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;2CAc2C,GAE3C,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,uBAAuB,QAAQ,sCAAqC;AAC7E,SACEC,qBAAqB,EACrBC,qBAAqB,EACrBC,mBAAmB,EACnBC,kBAAkB,EAClBC,qBAAqB,QAChB,+CAA8C;AACrD,SACEC,wBAAwB,EACxBC,YAAY,QACP,oCAAmC;AAC1C,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,kBAAkB,EAAEC,WAAW,QAAQ,qBAAiB;AACjE,SAASC,gBAAgB,QAAQ,wBAAoB;AAsBrD,SAASC,SAASC,OAA8C;QAI5DP;IAHF,MAAMQ,UAAUD,2BAAAA,QAASC,OAAO;IAChC,IAAI,QAAOA,2BAAAA,QAASC,GAAG,MAAK,YAAY,OAAOV;IAC/C,QACEC,gBAAAA,aAAaQ,oBAAbR,gBACAD;AAEJ;AAEA,SAASW,QAAQC,OAAe,EAAEC,KAAa;IAC7C,qEAAqE;IACrE,8CAA8C;IAC9C,OAAOC,SAASC,IAAI,CAClB;QAAEC,OAAO;IAAsE,GAC/E;QACEC,QAAQ;QACRR,SAAS;YACP,eAAeS,OAAOC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACT,CAAAA,UAAUC,KAAI,IAAK;QAClE;IACF;AAEJ;AAEA,+EAA+E,GAC/E,OAAO,SAASS,yBAAyBC,MAAc,EAAEC,GAAW;IAClE,OAAO/B,WAAW,UACfgC,MAAM,CAAC,CAAC,iBAAiB,EAAEF,OAAO,CAAC,EAAEC,KAAK,EAC1CE,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;AACd;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,0BACpBC,KAAkE,EAClEC,IAGC;IAED,MAAMC,QAAQC,GAAG,CAAC;QAChBF,KACGzB,WAAW,CAAC;YACX4B,MAAM;YACNC,OAAO,CAAC,6BAA6B,EAAEL,MAAMN,MAAM,EAAE;YACrDY,MACE,0DACCN,CAAAA,MAAMO,KAAK,GAAG,CAAC,YAAY,EAAEP,MAAMO,KAAK,CAAC,CAAC,CAAC,GAAG,EAAC,IAChD,8EACA,4EACA,CAAC,uCAAuC,EAAEP,MAAMQ,SAAS,CAAC,CAAC,CAAC;YAC9DC,MAAM;QACR,GACCC,KAAK,CAAC,IAAMC;QACfV,KACGW,cAAc,CAACZ,MAAMN,MAAM,EAAE;YAC5BU,MAAM;YACNC,OAAO;YACPC,MACE,0EACA,6EACA,uEACA,6EACA,CAAC,wEAAwE,EAAEN,MAAMQ,SAAS,CAAC,CAAC,CAAC;YAC/FC,MAAM,CAAC,CAAC,EAAET,MAAMN,MAAM,CAAC,OAAO,CAAC;QACjC,GACCgB,KAAK,CAAC,IAAMC;KAChB;AACH;AAEA;;;;CAIC,GACD,OAAO,eAAeE,uBAAuBb,KAS5C;IACC,IAAI;QACF,MAAML,MAAM3B,oBAAoBgC,MAAMhB,KAAK;QAC3C,MAAM8B,WAAWrB,yBAAyBO,MAAMN,MAAM,EAAEC;QACxD,MAAMa,YAAY,CAAC,GAAG,EAAEM,SAAShB,KAAK,CAAC,GAAG,IAAIiB,WAAW,IAAI;QAC7D,MAAMC,MAAMhB,MAAMiB,SAAS,CAACC,UAAU,CAACrD,yBAAyBsD,GAAG,CAACL;QACpE,MAAMM,QAAQ,CAAC,AAAC,CAAA,MAAMJ,IAAInC,GAAG,EAAC,EAAGwC,MAAM;QACvC,MAAMC,SAASxD,sBAAsByD,OAAO;QAC5C,MAAMC,UAAUlC,KAAKmC,KAAK,CAACH,OAAOI,QAAQ,GAAG;QAC7C,MAAMV,IAAIW,GAAG,CACX;YACEnB;YACA,2DAA2D;YAC3DoB,UAAU;YACVC,UAAU;YACVC,QAAQ;YACRC,KAAK;YACLC,kBAAkB;YAClBtC,QAAQM,MAAMN,MAAM;YACpBa,OAAOP,MAAMO,KAAK;YAClB0B,SAAS;gBACP,CAAC,KAAK,EAAEjC,MAAMN,MAAM,CAAC,kBAAkB,EAAE4B,OAAOY,KAAK,CAAC,kBAAkB,EAAEV,QAAQ,gCAAgC,EAAExB,MAAMmC,IAAI,CAAC,EAAE,CAAC;gBAClInC,MAAMoC,KAAK,GACP,gGACA;gBACJ;gBACA;aACD,CAACC,IAAI,CAAC;YACPC,eAAe;YACfC,cAAc;YACdC,MAAM;YACNC,aAAapE,WAAWqE,SAAS,CAAC;YAClCC,iBAAiB;gBACfjD,QAAQM,MAAMN,MAAM;gBACpBa,OAAOP,MAAMO,KAAK;gBAClBZ;gBACAiD,WAAWtB,OAAOY,KAAK;gBACvBW,eAAerB;gBACfY,OAAOpC,MAAMoC,KAAK;YACpB;YACAU,WAAWzE,WAAW0E,eAAe;WACjC3B,QACA;YAAEhC,QAAQ;YAAQ4D,WAAW3E,WAAW0E,eAAe;QAAG,IAC1D,CAAC,IAEP;YAAEE,OAAO;QAAK;QAEhB,IAAI7B,OAAO;YACT,MAAMrB,0BACJ;gBAAEL,QAAQM,MAAMN,MAAM;gBAAEa,OAAOP,MAAMO,KAAK;gBAAEC;YAAU,GACtD;gBAAEhC,aAAawB,MAAMkD,MAAM;gBAAEtC,gBAAgBZ,MAAMY,cAAc;YAAC;QAEtE;QACA,OAAO;YAAEE;YAAUM;QAAM;IAC3B,EAAE,OAAOjC,OAAO;QACdgE,QAAQhE,KAAK,CAAC,4CAA4CA;QAC1D,OAAO;IACT;AACF;AAEA,mDAAmD,GACnD,MAAMiE,cAAc,IAAIC;AAExB,4CAA4C,GAC5C,OAAO,SAASC;IACdF,YAAYG,KAAK;AACnB;AAEA;;;CAGC,GACD,OAAO,eAAeC,2BACpBC,OAAmC;QAErBA;IAAd,MAAMzE,SAAQyE,iBAAAA,QAAQzE,KAAK,YAAbyE,iBAAiBC,KAAKC,GAAG;IACvC,MAAMC,KAAKlF,SAAS+E,QAAQ9E,OAAO;IACnC,MAAMkF,gBAAgBJ,QAAQrB,KAAK,GAC/BtE,sBAAsBgG,eAAe,GACrChG,sBAAsBiG,UAAU;IACpC,MAAMC,QAAQ,CAACC,KAAa3C,SAC1B7C,iBAAiBwF,KAAK;YACpB/B,OAAOZ,OAAOY,KAAK;YACnBR,UAAUJ,OAAOI,QAAQ;YACzBiC,KAAK3E;YACLiC,WAAWwC,QAAQxC,SAAS;QAC9B;IAEF,MAAMiD,UAAUjG,mBAAmBwF,QAAQ/D,MAAM;IACjD,MAAM,CAACyE,SAASC,SAASC,KAAK,GAAG,MAAMnE,QAAQC,GAAG,CAAC;QACjD6D,MAAM9F,sBAAsBuF,QAAQ/D,MAAM,EAAEkE,KAAKC;QACjDG,MAAMjG,sBAAsB6F,KAAK9F,sBAAsBwG,UAAU;QACjEJ,UAAUF,MAAME,SAASpG,sBAAsByD,OAAO,IAAIrB,QAAQqE,OAAO,CAAC;KAC3E;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,6CAA6C;IAC7C,MAAM5E,MAAM3B,oBAAoBgB;IAChC,MAAMwF,WAAW,GAAGf,QAAQ/D,MAAM,CAAC,CAAC,EAAEC,KAAK;IAC3C,IAAI0E,QAAQ,CAACA,KAAKI,OAAO,IAAI,CAACJ,KAAKK,SAAS,IAAIjB,QAAQ/D,MAAM,IAAI,CAAC0D,YAAYuB,GAAG,CAACH,WAAW;YAGzFf,oBAGMA,gBAKCA,iBACQA;QAXlBL,YAAYwB,GAAG,CAACJ;QAChB,MAAMvD,aACHwC,qBAAAA,QAAQxC,SAAS,YAAjBwC,qBAA6BnF,cAAcuG,GAAG,GAAG5D,SAAS;QAC7D,MAAMJ,uBAAuB;YAC3BnB,QAAQ+D,QAAQ/D,MAAM;YACtBa,KAAK,GAAEkD,iBAAAA,QAAQlD,KAAK,YAAbkD,iBAAiB;YACxBtB,MAAMsB,QAAQtB,IAAI;YAClBC,OAAOqB,QAAQrB,KAAK,KAAK;YACzBpD;YACAiC;YACAiC,MAAM,GAAEO,kBAAAA,QAAQP,MAAM,YAAdO,kBAAkBjF;YAC1BoC,cAAc,GAAE6C,0BAAAA,QAAQ7C,cAAc,YAAtB6C,0BAA0BlF;QAC5C;IACF;IAEA,IAAI,CAAC4F,QAAQM,OAAO,EAAE,OAAO3F,QAAQqF,QAAQpF,OAAO,EAAEC;IACtD,IAAI,CAACoF,QAAQK,OAAO,EAAE,OAAO3F,QAAQsF,QAAQrF,OAAO,EAAEC;IACtD,OAAO;AACT;AAEA,eAAewE,2BAA0B"}

package/src/lib/server/configured-url-fetch.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { resolvePublicIp } from './serve-plugin-fetch';
+/** Why a configured URL was not called. */
+export type ConfiguredUrlRefusal = 'malformed' | 'not-https' | 'credentials' | 'port' | 'lookalike' | 'private-address';
+/** The checks that need no network: shape, scheme, port, credentials, brand. */
+export declare function configuredUrlRefusal(url: unknown): ConfiguredUrlRefusal | null;
+/** What the merchant is told a refusal means, in their words. */
+export declare function describeConfiguredUrlRefusal(refusal: ConfiguredUrlRefusal): string;
+export type ConfiguredUrlFetchResult = 
+/** Called: the status it answered. The body is discarded. */
+{
+    ok: true;
+    status: number;
+} | {
+    ok: false;
+    refusal: ConfiguredUrlRefusal;
+    host: string;
+};
+/**
+ * Call `url` under the rules above and answer its status; the body is
+ * discarded, because a notification's receiver answers with a status and
+ * nothing a caller should read. Never follows a redirect. Throws only what
+ * `fetch` throws (a timeout, a reset), for the caller to retry.
+ */
+export declare function fetchConfiguredPublicUrl(url: string, init: Omit<RequestInit, 'redirect'>, deps?: {
+    resolve?: typeof resolvePublicIp;
+}): Promise<ConfiguredUrlFetchResult>;

package/src/lib/server/configured-url-fetch.js

@@ -0,0 +1,118 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * A SERVER CALL TO A URL A TENANT TYPED (AGL-3363).
+ *
+ * Some features call an address the merchant configured, from the
+ * platform's own servers: a dropship supplier's order webhook is the first.
+ * That address is author data, so it gets the checks the plugin fetch proxy
+ * (`serve-plugin-fetch.ts`, AGL-515/1881) gives a plugin's declared origin,
+ * through the same two primitives, rather than a bare `fetch`:
+ *
+ * - https only, on the default port, with no credentials in the authority;
+ * - a host that wears a brand it is not (`lookalikeBrandForHost`) is refused
+ *   for every workspace, the phishing screen's strong tier;
+ * - the name must resolve to PUBLIC addresses only, and the connection is
+ *   pinned to the address that was checked (`resolvePublicIp` +
+ *   `createPinnedDispatcher`), so a name cannot be rebound to the cloud
+ *   metadata endpoint or a private range between the check and the connect;
+ * - a redirect is not followed (`redirect: 'manual'`): a 3xx is the answer,
+ *   which a caller that wants a 2xx treats as a failure.
+ *
+ * This sits beside the plugin fetch proxy and is not it: that one proxies a
+ * browser's request to an allowlisted origin and streams the reply; this is
+ * a server's own call with no allowlist but the rules above.
+ *=========================================*/ import { lookalikeBrandForHost } from "@aglyn/shared-util-email/outbound-phishing-screen";
+import { createPinnedDispatcher, resolvePublicIp } from "./serve-plugin-fetch.js";
+/** The checks that need no network: shape, scheme, port, credentials, brand. */ export function configuredUrlRefusal(url) {
+    let parsed;
+    try {
+        parsed = new URL(String(url != null ? url : ''));
+    } catch (unused) {
+        return 'malformed';
+    }
+    if (parsed.protocol !== 'https:') return 'not-https';
+    if (parsed.username || parsed.password) return 'credentials';
+    if (parsed.port && parsed.port !== '443') return 'port';
+    if (lookalikeBrandForHost(parsed.hostname)) return 'lookalike';
+    return null;
+}
+/** What the merchant is told a refusal means, in their words. */ export function describeConfiguredUrlRefusal(refusal) {
+    switch(refusal){
+        case 'malformed':
+            return 'the address is not a valid web address';
+        case 'not-https':
+            return 'the address must start with https://';
+        case 'credentials':
+            return 'the address must not contain a user name or password';
+        case 'port':
+            return 'the address must use the standard https port';
+        case 'lookalike':
+            return 'the address looks like another company’s website';
+        case 'private-address':
+            return 'the address does not lead to a public server';
+    }
+}
+/**
+ * Call `url` under the rules above and answer its status; the body is
+ * discarded, because a notification's receiver answers with a status and
+ * nothing a caller should read. Never follows a redirect. Throws only what
+ * `fetch` throws (a timeout, a reset), for the caller to retry.
+ */ export async function fetchConfiguredPublicUrl(url, init, deps = {}) {
+    var _deps_resolve;
+    const refusal = configuredUrlRefusal(url);
+    let host;
+    try {
+        host = new URL(url).hostname;
+    } catch (unused) {
+        host = '';
+    }
+    if (refusal) return {
+        ok: false,
+        refusal,
+        host
+    };
+    const pinned = await ((_deps_resolve = deps.resolve) != null ? _deps_resolve : resolvePublicIp)(host);
+    if (!pinned) return {
+        ok: false,
+        refusal: 'private-address',
+        host
+    };
+    const dispatcher = createPinnedDispatcher(pinned);
+    try {
+        var _response_status;
+        var _response_body;
+        // `dispatcher` is undici's, which the global fetch honors; spread from a
+        // variable so the DOM `RequestInit` type does not reject the field.
+        const pinnedInit = _extends({}, init, {
+            redirect: 'manual',
+            dispatcher
+        });
+        const response = await fetch(url, pinnedInit);
+        // Released before the dispatcher closes: `close` waits for requests in
+        // flight, and an unread body is one.
+        await ((_response_body = response.body) == null ? void 0 : _response_body.cancel().catch(()=>undefined));
+        return {
+            ok: true,
+            status: Number((_response_status = response.status) != null ? _response_status : 0)
+        };
+    } finally{
+        await dispatcher.close().catch(()=>undefined);
+    }
+}
+
+//# sourceMappingURL=configured-url-fetch.js.map

package/src/lib/server/configured-url-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/configured-url-fetch.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * A SERVER CALL TO A URL A TENANT TYPED (AGL-3363).\n *\n * Some features call an address the merchant configured, from the\n * platform's own servers: a dropship supplier's order webhook is the first.\n * That address is author data, so it gets the checks the plugin fetch proxy\n * (`serve-plugin-fetch.ts`, AGL-515/1881) gives a plugin's declared origin,\n * through the same two primitives, rather than a bare `fetch`:\n *\n * - https only, on the default port, with no credentials in the authority;\n * - a host that wears a brand it is not (`lookalikeBrandForHost`) is refused\n *   for every workspace, the phishing screen's strong tier;\n * - the name must resolve to PUBLIC addresses only, and the connection is\n *   pinned to the address that was checked (`resolvePublicIp` +\n *   `createPinnedDispatcher`), so a name cannot be rebound to the cloud\n *   metadata endpoint or a private range between the check and the connect;\n * - a redirect is not followed (`redirect: 'manual'`): a 3xx is the answer,\n *   which a caller that wants a 2xx treats as a failure.\n *\n * This sits beside the plugin fetch proxy and is not it: that one proxies a\n * browser's request to an allowlisted origin and streams the reply; this is\n * a server's own call with no allowlist but the rules above.\n *=========================================*/\n\nimport { lookalikeBrandForHost } from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport { createPinnedDispatcher, resolvePublicIp } from './serve-plugin-fetch'\n\n/** Why a configured URL was not called. */\nexport type ConfiguredUrlRefusal =\n  | 'malformed'\n  | 'not-https'\n  | 'credentials'\n  | 'port'\n  | 'lookalike'\n  | 'private-address'\n\n/** The checks that need no network: shape, scheme, port, credentials, brand. */\nexport function configuredUrlRefusal(url: unknown): ConfiguredUrlRefusal | null {\n  let parsed: URL\n  try {\n    parsed = new URL(String(url ?? ''))\n  } catch {\n    return 'malformed'\n  }\n  if (parsed.protocol !== 'https:') return 'not-https'\n  if (parsed.username || parsed.password) return 'credentials'\n  if (parsed.port && parsed.port !== '443') return 'port'\n  if (lookalikeBrandForHost(parsed.hostname)) return 'lookalike'\n  return null\n}\n\n/** What the merchant is told a refusal means, in their words. */\nexport function describeConfiguredUrlRefusal(refusal: ConfiguredUrlRefusal): string {\n  switch (refusal) {\n    case 'malformed':\n      return 'the address is not a valid web address'\n    case 'not-https':\n      return 'the address must start with https://'\n    case 'credentials':\n      return 'the address must not contain a user name or password'\n    case 'port':\n      return 'the address must use the standard https port'\n    case 'lookalike':\n      return 'the address looks like another company’s website'\n    case 'private-address':\n      return 'the address does not lead to a public server'\n  }\n}\n\nexport type ConfiguredUrlFetchResult =\n  /** Called: the status it answered. The body is discarded. */\n  | { ok: true; status: number }\n  | { ok: false; refusal: ConfiguredUrlRefusal; host: string }\n\n/**\n * Call `url` under the rules above and answer its status; the body is\n * discarded, because a notification's receiver answers with a status and\n * nothing a caller should read. Never follows a redirect. Throws only what\n * `fetch` throws (a timeout, a reset), for the caller to retry.\n */\nexport async function fetchConfiguredPublicUrl(\n  url: string,\n  init: Omit<RequestInit, 'redirect'>,\n  deps: { resolve?: typeof resolvePublicIp } = {},\n): Promise<ConfiguredUrlFetchResult> {\n  const refusal = configuredUrlRefusal(url)\n  let host: string\n  try {\n    host = new URL(url).hostname\n  } catch {\n    host = ''\n  }\n  if (refusal) return { ok: false, refusal, host }\n  const pinned = await (deps.resolve ?? resolvePublicIp)(host)\n  if (!pinned) return { ok: false, refusal: 'private-address', host }\n  const dispatcher = createPinnedDispatcher(pinned)\n  try {\n    // `dispatcher` is undici's, which the global fetch honors; spread from a\n    // variable so the DOM `RequestInit` type does not reject the field.\n    const pinnedInit = { ...init, redirect: 'manual' as const, dispatcher }\n    const response = await fetch(url, pinnedInit as RequestInit)\n    // Released before the dispatcher closes: `close` waits for requests in\n    // flight, and an unread body is one.\n    await response.body?.cancel().catch(() => undefined)\n    return { ok: true, status: Number(response.status ?? 0) }\n  } finally {\n    await dispatcher.close().catch(() => undefined)\n  }\n}\n"],"names":["lookalikeBrandForHost","createPinnedDispatcher","resolvePublicIp","configuredUrlRefusal","url","parsed","URL","String","protocol","username","password","port","hostname","describeConfiguredUrlRefusal","refusal","fetchConfiguredPublicUrl","init","deps","host","ok","pinned","resolve","dispatcher","response","pinnedInit","redirect","fetch","body","cancel","catch","undefined","status","Number","close"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;2CAsB2C,GAE3C,SAASA,qBAAqB,QAAQ,oDAAmD;AACzF,SAASC,sBAAsB,EAAEC,eAAe,QAAQ,0BAAsB;AAW9E,8EAA8E,GAC9E,OAAO,SAASC,qBAAqBC,GAAY;IAC/C,IAAIC;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIC,OAAOH,cAAAA,MAAO;IACjC,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAIC,OAAOG,QAAQ,KAAK,UAAU,OAAO;IACzC,IAAIH,OAAOI,QAAQ,IAAIJ,OAAOK,QAAQ,EAAE,OAAO;IAC/C,IAAIL,OAAOM,IAAI,IAAIN,OAAOM,IAAI,KAAK,OAAO,OAAO;IACjD,IAAIX,sBAAsBK,OAAOO,QAAQ,GAAG,OAAO;IACnD,OAAO;AACT;AAEA,+DAA+D,GAC/D,OAAO,SAASC,6BAA6BC,OAA6B;IACxE,OAAQA;QACN,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;QACT,KAAK;YACH,OAAO;IACX;AACF;AAOA;;;;;CAKC,GACD,OAAO,eAAeC,yBACpBX,GAAW,EACXY,IAAmC,EACnCC,OAA6C,CAAC,CAAC;QAUzBA;IARtB,MAAMH,UAAUX,qBAAqBC;IACrC,IAAIc;IACJ,IAAI;QACFA,OAAO,IAAIZ,IAAIF,KAAKQ,QAAQ;IAC9B,EAAE,eAAM;QACNM,OAAO;IACT;IACA,IAAIJ,SAAS,OAAO;QAAEK,IAAI;QAAOL;QAASI;IAAK;IAC/C,MAAME,SAAS,MAAM,EAACH,gBAAAA,KAAKI,OAAO,YAAZJ,gBAAgBf,iBAAiBgB;IACvD,IAAI,CAACE,QAAQ,OAAO;QAAED,IAAI;QAAOL,SAAS;QAAmBI;IAAK;IAClE,MAAMI,aAAarB,uBAAuBmB;IAC1C,IAAI;YAQgCG;YAD5BA;QANN,yEAAyE;QACzE,oEAAoE;QACpE,MAAMC,aAAa,aAAKR;YAAMS,UAAU;YAAmBH;;QAC3D,MAAMC,WAAW,MAAMG,MAAMtB,KAAKoB;QAClC,uEAAuE;QACvE,qCAAqC;QACrC,QAAMD,iBAAAA,SAASI,IAAI,qBAAbJ,eAAeK,MAAM,GAAGC,KAAK,CAAC,IAAMC;QAC1C,OAAO;YAAEX,IAAI;YAAMY,QAAQC,QAAOT,mBAAAA,SAASQ,MAAM,YAAfR,mBAAmB;QAAG;IAC1D,SAAU;QACR,MAAMD,WAAWW,KAAK,GAAGJ,KAAK,CAAC,IAAMC;IACvC;AACF"}

package/src/lib/server/hosted-page-review.d.ts

@@ -64,7 +64,11 @@ export declare function recordServedPageVersion(hostId: string, screenId: string
  *
  * - `site` — a custom domain a site is served on (the attach route);
  * - `sending` — a custom domain a workspace sends email as, when it is
- *   added and again when it verifies (`sending-domains.ts`).
+ *   added and again when it verifies (`sending-domains.ts`);
+ * - `link` — a link a merchant configured that a buyer or a server would
+ *   follow: a product's paid download or video hotlink, a supplier's order
+ *   webhook (AGL-3363). The link itself is refused where it is followed; this
+ *   files it, and tells the site's managers once ({@link notifyLookalikeLink}).
  *
  * Not refused, because the domain is the merchant's own registration and
  * the platform cannot tell a brand's own agency attaching `paypal-promo.com`
@@ -79,11 +83,27 @@ export declare function recordServedPageVersion(hostId: string, screenId: string
  * Never throws: the write it rides on has already happened.
  */
 export declare function flagLookalikeDomain(input: {
-    kind: 'site' | 'sending';
+    kind: 'site' | 'sending' | 'link';
     hostId: string | null;
     orgId: string | null;
     domain: string;
+    /** For a `link`: where it was configured, as staff read it. */
+    where?: string;
 }): Promise<'flagged' | 'clean' | 'failed'>;
+/**
+ * Tell staff and the site's managers, once per (site, domain), that a link
+ * the merchant configured was refused because it wears another brand's name
+ * (AGL-3363). The one notifier for this kind of signal, so a shared
+ * risk-notice seam can take it over whole. The merchant is told what was
+ * refused and how to fix it; never how the check works. Never throws.
+ */
+export declare function notifyLookalikeLink(input: {
+    hostId: string | null;
+    domain: string;
+    label: string;
+    where: string;
+    reference: string;
+}): Promise<void>;
 /** A site's custom domain, through {@link flagLookalikeDomain}. */
 export declare function flagLookalikeCustomDomain(input: {
     hostId: string;