@aglyn/tenant-data-admin 1.0.0-beta.202 → 1.0.0-beta.204

package/src/lib/server/stripe-transfer-reversal.js

@@ -0,0 +1,177 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * A SELLER'S SHARE OF A DESTINATION CHARGE, PULLED BACK (AGL-1794, AGL-3363).
+ *
+ * Every tenant sale is a destination charge on the platform account, so a
+ * lost dispute debits the PLATFORM's balance while the seller keeps the
+ * transfer. The AGL-1794 policy: the seller returns their share by a
+ * `transfers/{id}/reversals` call; the platform keeps Stripe's dispute fee.
+ * This is the Stripe half of that, written once. It started as the commerce
+ * webhook's `reverseSellerShare`; the booking deposit's lost dispute uses it
+ * too (AGL-3363), so the two cannot drift. Each caller keeps its own record
+ * and its own settle marker — this module touches no Firestore.
+ *
+ * PROPORTIONAL, NEVER MORE: `cause × transfer.amount ÷ charge.amount`,
+ * FLOORED, capped at what the transfer has left (`amount − amount_reversed`).
+ * No `refund_application_fee`: on a chargeback the platform keeps its
+ * commission, a policy switch the AGL-1794 note says not to flip here.
+ *
+ * IDEMPOTENT at Stripe twice over: a reversal already on the transfer carrying
+ * this cause's id in its metadata is ADOPTED rather than repeated (the crash
+ * window between the POST and the caller's record), and the POST carries an
+ * `Idempotency-Key` derived from the cause, so a racing delivery gets Stripe's
+ * stored answer.
+ *
+ * TRANSIENT failures (a network reject, 429, 5xx) THROW, so the webhook's
+ * redelivery is the retry. DEFINITIVE ones answer `not-reversed` with a
+ * reason, for the caller to settle and record; no redelivery fixes them.
+ *=========================================*/ /** Why nothing was pulled back, when the answer is final. */ /** Stripe failures a redelivery can actually fix. */ export function isTransientStripeStatus(status) {
+    return status === 429 || status >= 500;
+}
+async function stripeGet(url, stripeKey, fetchImpl) {
+    const response = await fetchImpl(url, {
+        headers: {
+            Authorization: `Bearer ${stripeKey}`
+        }
+    });
+    const body = await response.json().catch(()=>null);
+    return {
+        ok: response.ok,
+        status: response.status,
+        body
+    };
+}
+/** The metadata key a cause's reversal is stamped and found by. */ export function transferReversalMetadataKey(kind) {
+    return kind === 'dispute' ? 'disputeId' : 'refundId';
+}
+/**
+ * Pull the seller's proportional share of `cause` back from the charge's
+ * transfer. See the module header for the rules.
+ */ export async function reverseDestinationTransfer(cause, deps = {}) {
+    var _deps_stripeKey, _deps_fetchImpl, _cause_id, _cause_chargeId, _ref, _ref1, _ref2, _ref3, _ref4, _cause_amountCents, _cause_metadata, _ref5, _ref6;
+    var _charge_body, _charge_body1, _transfer_body_reversals, _transfer_body, _transfer_body1, _transfer_body2;
+    const stripeKey = (_deps_stripeKey = deps.stripeKey) != null ? _deps_stripeKey : process.env.STRIPE_SECRET_KEY;
+    if (!stripeKey) return {
+        kind: 'skipped',
+        reason: 'no-stripe-key'
+    };
+    const fetchImpl = (_deps_fetchImpl = deps.fetchImpl) != null ? _deps_fetchImpl : fetch;
+    const causeId = String((_cause_id = cause.id) != null ? _cause_id : '');
+    const metadataKey = transferReversalMetadataKey(cause.kind);
+    const label = `${cause.kind} ${causeId}`;
+    const chargeId = String((_cause_chargeId = cause.chargeId) != null ? _cause_chargeId : '');
+    if (!chargeId) return {
+        kind: 'not-reversed',
+        reason: 'no-charge-on-cause'
+    };
+    const charge = await stripeGet(`https://api.stripe.com/v1/charges/${chargeId}`, stripeKey, fetchImpl);
+    if (!charge.ok) {
+        var _charge_body2;
+        if (isTransientStripeStatus(charge.status)) {
+            throw new Error(`Stripe charge read failed (${charge.status}) for ${label}`);
+        }
+        console.error('Stripe refused the charge read', (_charge_body2 = charge.body) == null ? void 0 : _charge_body2.error);
+        return {
+            kind: 'not-reversed',
+            reason: 'charge-read-refused'
+        };
+    }
+    const transferId = String((_ref = (_charge_body = charge.body) == null ? void 0 : _charge_body.transfer) != null ? _ref : '');
+    const chargeAmountCents = Math.round(Number((_ref1 = (_charge_body1 = charge.body) == null ? void 0 : _charge_body1.amount) != null ? _ref1 : 0));
+    if (!transferId || !(chargeAmountCents > 0)) {
+        return {
+            kind: 'not-reversed',
+            reason: 'no-transfer-on-charge'
+        };
+    }
+    const transfer = await stripeGet(`https://api.stripe.com/v1/transfers/${transferId}`, stripeKey, fetchImpl);
+    if (!transfer.ok) {
+        var _transfer_body3;
+        if (isTransientStripeStatus(transfer.status)) {
+            throw new Error(`Stripe transfer read failed (${transfer.status}) for ${label}`);
+        }
+        console.error('Stripe refused the transfer read', (_transfer_body3 = transfer.body) == null ? void 0 : _transfer_body3.error);
+        return {
+            kind: 'not-reversed',
+            reason: 'transfer-read-refused'
+        };
+    }
+    // The crash window's backstop: the POST landed on a previous delivery and
+    // the caller's record did not. Adopt it rather than creating a second one.
+    const existing = ((_ref2 = (_transfer_body = transfer.body) == null ? void 0 : (_transfer_body_reversals = _transfer_body.reversals) == null ? void 0 : _transfer_body_reversals.data) != null ? _ref2 : []).find((item)=>{
+        var _ref;
+        var _item_metadata;
+        return String((_ref = item == null ? void 0 : (_item_metadata = item.metadata) == null ? void 0 : _item_metadata[metadataKey]) != null ? _ref : '') === causeId;
+    });
+    if (existing) {
+        var _existing_amount, _existing_id;
+        return {
+            kind: 'reversed',
+            cents: Math.round(Number((_existing_amount = existing.amount) != null ? _existing_amount : 0)),
+            reversalId: String((_existing_id = existing.id) != null ? _existing_id : ''),
+            adopted: true
+        };
+    }
+    const transferCents = Math.round(Number((_ref3 = (_transfer_body1 = transfer.body) == null ? void 0 : _transfer_body1.amount) != null ? _ref3 : 0));
+    const alreadyReversedCents = Math.round(Number((_ref4 = (_transfer_body2 = transfer.body) == null ? void 0 : _transfer_body2.amount_reversed) != null ? _ref4 : 0));
+    const remainingCents = Math.max(0, transferCents - alreadyReversedCents);
+    const causeCents = Math.round(Number((_cause_amountCents = cause.amountCents) != null ? _cause_amountCents : 0));
+    const shareCents = Math.min(Math.floor(causeCents * transferCents / chargeAmountCents), remainingCents);
+    if (!(shareCents > 0)) {
+        return {
+            kind: 'not-reversed',
+            reason: 'transfer-fully-reversed',
+            owedCents: 0
+        };
+    }
+    const params = new URLSearchParams({
+        amount: String(shareCents),
+        [`metadata[${metadataKey}]`]: causeId
+    });
+    for (const [key, value] of Object.entries((_cause_metadata = cause.metadata) != null ? _cause_metadata : {})){
+        params.set(`metadata[${key}]`, value);
+    }
+    const response = await fetchImpl(`https://api.stripe.com/v1/transfers/${transferId}/reversals`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${stripeKey}`,
+            'Content-Type': 'application/x-www-form-urlencoded',
+            'Idempotency-Key': `${cause.kind}-reversal-${causeId}`
+        },
+        body: params.toString()
+    });
+    const reversal = await response.json().catch(()=>null);
+    if (!response.ok) {
+        if (isTransientStripeStatus(response.status)) {
+            throw new Error(`Stripe transfer reversal failed (${response.status}) for ${label}`);
+        }
+        console.error('Stripe refused the transfer reversal', reversal == null ? void 0 : reversal.error);
+        return {
+            kind: 'not-reversed',
+            reason: 'reversal-refused',
+            owedCents: shareCents
+        };
+    }
+    return {
+        kind: 'reversed',
+        cents: Math.round(Number((_ref5 = reversal == null ? void 0 : reversal.amount) != null ? _ref5 : shareCents)),
+        reversalId: String((_ref6 = reversal == null ? void 0 : reversal.id) != null ? _ref6 : ''),
+        adopted: false
+    };
+}
+
+//# sourceMappingURL=stripe-transfer-reversal.js.map

package/src/lib/server/stripe-transfer-reversal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/stripe-transfer-reversal.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * A SELLER'S SHARE OF A DESTINATION CHARGE, PULLED BACK (AGL-1794, AGL-3363).\n *\n * Every tenant sale is a destination charge on the platform account, so a\n * lost dispute debits the PLATFORM's balance while the seller keeps the\n * transfer. The AGL-1794 policy: the seller returns their share by a\n * `transfers/{id}/reversals` call; the platform keeps Stripe's dispute fee.\n * This is the Stripe half of that, written once. It started as the commerce\n * webhook's `reverseSellerShare`; the booking deposit's lost dispute uses it\n * too (AGL-3363), so the two cannot drift. Each caller keeps its own record\n * and its own settle marker — this module touches no Firestore.\n *\n * PROPORTIONAL, NEVER MORE: `cause × transfer.amount ÷ charge.amount`,\n * FLOORED, capped at what the transfer has left (`amount − amount_reversed`).\n * No `refund_application_fee`: on a chargeback the platform keeps its\n * commission, a policy switch the AGL-1794 note says not to flip here.\n *\n * IDEMPOTENT at Stripe twice over: a reversal already on the transfer carrying\n * this cause's id in its metadata is ADOPTED rather than repeated (the crash\n * window between the POST and the caller's record), and the POST carries an\n * `Idempotency-Key` derived from the cause, so a racing delivery gets Stripe's\n * stored answer.\n *\n * TRANSIENT failures (a network reject, 429, 5xx) THROW, so the webhook's\n * redelivery is the retry. DEFINITIVE ones answer `not-reversed` with a\n * reason, for the caller to settle and record; no redelivery fixes them.\n *=========================================*/\n\n/** Why nothing was pulled back, when the answer is final. */\nexport type TransferReversalFailure =\n  | 'no-charge-on-cause'\n  | 'charge-read-refused'\n  | 'no-transfer-on-charge'\n  | 'transfer-read-refused'\n  | 'transfer-fully-reversed'\n  | 'reversal-refused'\n\nexport type TransferReversalOutcome =\n  /** Pulled back now, or found already pulled back and adopted. */\n  | { kind: 'reversed'; cents: number; reversalId: string; adopted: boolean }\n  /** Final: settle it and record why. `owedCents` when the share was known. */\n  | { kind: 'not-reversed'; reason: TransferReversalFailure; owedCents?: number }\n  /** Nothing was attempted and nothing should be settled: retry later. */\n  | { kind: 'skipped'; reason: 'no-stripe-key' }\n\nexport interface TransferReversalCause {\n  /** Which door: decides the metadata key and the idempotency key. */\n  kind: 'dispute' | 'refund'\n  /** The dispute's or refund's Stripe id. */\n  id: string\n  /** Cents going back to the cardholder. */\n  amountCents: number\n  /** The charge whose transfer is pulled back. */\n  chargeId: string\n  /** More metadata for the reversal: the caller's record id. */\n  metadata?: Record<string, string>\n}\n\n/** Stripe failures a redelivery can actually fix. */\nexport function isTransientStripeStatus(status: number): boolean {\n  return status === 429 || status >= 500\n}\n\ntype FetchLike = typeof fetch\n\nasync function stripeGet(\n  url: string,\n  stripeKey: string,\n  fetchImpl: FetchLike,\n): Promise<{ ok: boolean; status: number; body: any }> {\n  const response = await fetchImpl(url, {\n    headers: { Authorization: `Bearer ${stripeKey}` },\n  })\n  const body = await response.json().catch(() => null)\n  return { ok: response.ok, status: response.status, body }\n}\n\n/** The metadata key a cause's reversal is stamped and found by. */\nexport function transferReversalMetadataKey(kind: TransferReversalCause['kind']): string {\n  return kind === 'dispute' ? 'disputeId' : 'refundId'\n}\n\n/**\n * Pull the seller's proportional share of `cause` back from the charge's\n * transfer. See the module header for the rules.\n */\nexport async function reverseDestinationTransfer(\n  cause: TransferReversalCause,\n  deps: { stripeKey?: string; fetchImpl?: FetchLike } = {},\n): Promise<TransferReversalOutcome> {\n  const stripeKey = deps.stripeKey ?? process.env.STRIPE_SECRET_KEY\n  if (!stripeKey) return { kind: 'skipped', reason: 'no-stripe-key' }\n  const fetchImpl = deps.fetchImpl ?? fetch\n  const causeId = String(cause.id ?? '')\n  const metadataKey = transferReversalMetadataKey(cause.kind)\n  const label = `${cause.kind} ${causeId}`\n\n  const chargeId = String(cause.chargeId ?? '')\n  if (!chargeId) return { kind: 'not-reversed', reason: 'no-charge-on-cause' }\n  const charge = await stripeGet(\n    `https://api.stripe.com/v1/charges/${chargeId}`,\n    stripeKey,\n    fetchImpl,\n  )\n  if (!charge.ok) {\n    if (isTransientStripeStatus(charge.status)) {\n      throw new Error(`Stripe charge read failed (${charge.status}) for ${label}`)\n    }\n    console.error('Stripe refused the charge read', charge.body?.error)\n    return { kind: 'not-reversed', reason: 'charge-read-refused' }\n  }\n  const transferId = String(charge.body?.transfer ?? '')\n  const chargeAmountCents = Math.round(Number(charge.body?.amount ?? 0))\n  if (!transferId || !(chargeAmountCents > 0)) {\n    return { kind: 'not-reversed', reason: 'no-transfer-on-charge' }\n  }\n  const transfer = await stripeGet(\n    `https://api.stripe.com/v1/transfers/${transferId}`,\n    stripeKey,\n    fetchImpl,\n  )\n  if (!transfer.ok) {\n    if (isTransientStripeStatus(transfer.status)) {\n      throw new Error(`Stripe transfer read failed (${transfer.status}) for ${label}`)\n    }\n    console.error('Stripe refused the transfer read', transfer.body?.error)\n    return { kind: 'not-reversed', reason: 'transfer-read-refused' }\n  }\n  // The crash window's backstop: the POST landed on a previous delivery and\n  // the caller's record did not. Adopt it rather than creating a second one.\n  const existing = ((transfer.body?.reversals?.data ?? []) as any[]).find(\n    (item) => String(item?.metadata?.[metadataKey] ?? '') === causeId,\n  )\n  if (existing) {\n    return {\n      kind: 'reversed',\n      cents: Math.round(Number(existing.amount ?? 0)),\n      reversalId: String(existing.id ?? ''),\n      adopted: true,\n    }\n  }\n  const transferCents = Math.round(Number(transfer.body?.amount ?? 0))\n  const alreadyReversedCents = Math.round(Number(transfer.body?.amount_reversed ?? 0))\n  const remainingCents = Math.max(0, transferCents - alreadyReversedCents)\n  const causeCents = Math.round(Number(cause.amountCents ?? 0))\n  const shareCents = Math.min(\n    Math.floor((causeCents * transferCents) / chargeAmountCents),\n    remainingCents,\n  )\n  if (!(shareCents > 0)) {\n    return { kind: 'not-reversed', reason: 'transfer-fully-reversed', owedCents: 0 }\n  }\n  const params = new URLSearchParams({\n    amount: String(shareCents),\n    [`metadata[${metadataKey}]`]: causeId,\n  })\n  for (const [key, value] of Object.entries(cause.metadata ?? {})) {\n    params.set(`metadata[${key}]`, value)\n  }\n  const response = await fetchImpl(\n    `https://api.stripe.com/v1/transfers/${transferId}/reversals`,\n    {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${stripeKey}`,\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'Idempotency-Key': `${cause.kind}-reversal-${causeId}`,\n      },\n      body: params.toString(),\n    },\n  )\n  const reversal = await response.json().catch(() => null)\n  if (!response.ok) {\n    if (isTransientStripeStatus(response.status)) {\n      throw new Error(`Stripe transfer reversal failed (${response.status}) for ${label}`)\n    }\n    console.error('Stripe refused the transfer reversal', reversal?.error)\n    return { kind: 'not-reversed', reason: 'reversal-refused', owedCents: shareCents }\n  }\n  return {\n    kind: 'reversed',\n    cents: Math.round(Number(reversal?.amount ?? shareCents)),\n    reversalId: String(reversal?.id ?? ''),\n    adopted: false,\n  }\n}\n"],"names":["isTransientStripeStatus","status","stripeGet","url","stripeKey","fetchImpl","response","headers","Authorization","body","json","catch","ok","transferReversalMetadataKey","kind","reverseDestinationTransfer","cause","deps","charge","transfer","process","env","STRIPE_SECRET_KEY","reason","fetch","causeId","String","id","metadataKey","label","chargeId","Error","console","error","transferId","chargeAmountCents","Math","round","Number","amount","existing","reversals","data","find","item","metadata","cents","reversalId","adopted","transferCents","alreadyReversedCents","amount_reversed","remainingCents","max","causeCents","amountCents","shareCents","min","floor","owedCents","params","URLSearchParams","key","value","Object","entries","set","method","toString","reversal"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;2CA0B2C,GAE3C,2DAA2D,GA8B3D,mDAAmD,GACnD,OAAO,SAASA,wBAAwBC,MAAc;IACpD,OAAOA,WAAW,OAAOA,UAAU;AACrC;AAIA,eAAeC,UACbC,GAAW,EACXC,SAAiB,EACjBC,SAAoB;IAEpB,MAAMC,WAAW,MAAMD,UAAUF,KAAK;QACpCI,SAAS;YAAEC,eAAe,CAAC,OAAO,EAAEJ,WAAW;QAAC;IAClD;IACA,MAAMK,OAAO,MAAMH,SAASI,IAAI,GAAGC,KAAK,CAAC,IAAM;IAC/C,OAAO;QAAEC,IAAIN,SAASM,EAAE;QAAEX,QAAQK,SAASL,MAAM;QAAEQ;IAAK;AAC1D;AAEA,iEAAiE,GACjE,OAAO,SAASI,4BAA4BC,IAAmC;IAC7E,OAAOA,SAAS,YAAY,cAAc;AAC5C;AAEA;;;CAGC,GACD,OAAO,eAAeC,2BACpBC,KAA4B,EAC5BC,OAAsD,CAAC,CAAC;QAEtCA,iBAEAA,iBACKD,WAICA,mDA+CaA,oBAYKA;QA7ChBE,cACkBA,eAkBzBC,0BAAAA,gBAWqBA,iBACOA;IApD/C,MAAMf,aAAYa,kBAAAA,KAAKb,SAAS,YAAda,kBAAkBG,QAAQC,GAAG,CAACC,iBAAiB;IACjE,IAAI,CAAClB,WAAW,OAAO;QAAEU,MAAM;QAAWS,QAAQ;IAAgB;IAClE,MAAMlB,aAAYY,kBAAAA,KAAKZ,SAAS,YAAdY,kBAAkBO;IACpC,MAAMC,UAAUC,QAAOV,YAAAA,MAAMW,EAAE,YAARX,YAAY;IACnC,MAAMY,cAAcf,4BAA4BG,MAAMF,IAAI;IAC1D,MAAMe,QAAQ,GAAGb,MAAMF,IAAI,CAAC,CAAC,EAAEW,SAAS;IAExC,MAAMK,WAAWJ,QAAOV,kBAAAA,MAAMc,QAAQ,YAAdd,kBAAkB;IAC1C,IAAI,CAACc,UAAU,OAAO;QAAEhB,MAAM;QAAgBS,QAAQ;IAAqB;IAC3E,MAAML,SAAS,MAAMhB,UACnB,CAAC,kCAAkC,EAAE4B,UAAU,EAC/C1B,WACAC;IAEF,IAAI,CAACa,OAAON,EAAE,EAAE;YAIkCM;QAHhD,IAAIlB,wBAAwBkB,OAAOjB,MAAM,GAAG;YAC1C,MAAM,IAAI8B,MAAM,CAAC,2BAA2B,EAAEb,OAAOjB,MAAM,CAAC,MAAM,EAAE4B,OAAO;QAC7E;QACAG,QAAQC,KAAK,CAAC,mCAAkCf,gBAAAA,OAAOT,IAAI,qBAAXS,cAAae,KAAK;QAClE,OAAO;YAAEnB,MAAM;YAAgBS,QAAQ;QAAsB;IAC/D;IACA,MAAMW,aAAaR,gBAAOR,eAAAA,OAAOT,IAAI,qBAAXS,aAAaC,QAAQ,mBAAI;IACnD,MAAMgB,oBAAoBC,KAAKC,KAAK,CAACC,iBAAOpB,gBAAAA,OAAOT,IAAI,qBAAXS,cAAaqB,MAAM,oBAAI;IACnE,IAAI,CAACL,cAAc,CAAEC,CAAAA,oBAAoB,CAAA,GAAI;QAC3C,OAAO;YAAErB,MAAM;YAAgBS,QAAQ;QAAwB;IACjE;IACA,MAAMJ,WAAW,MAAMjB,UACrB,CAAC,oCAAoC,EAAEgC,YAAY,EACnD9B,WACAC;IAEF,IAAI,CAACc,SAASP,EAAE,EAAE;YAIkCO;QAHlD,IAAInB,wBAAwBmB,SAASlB,MAAM,GAAG;YAC5C,MAAM,IAAI8B,MAAM,CAAC,6BAA6B,EAAEZ,SAASlB,MAAM,CAAC,MAAM,EAAE4B,OAAO;QACjF;QACAG,QAAQC,KAAK,CAAC,qCAAoCd,kBAAAA,SAASV,IAAI,qBAAbU,gBAAec,KAAK;QACtE,OAAO;YAAEnB,MAAM;YAAgBS,QAAQ;QAAwB;IACjE;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAMiB,WAAW,WAAErB,iBAAAA,SAASV,IAAI,sBAAbU,2BAAAA,eAAesB,SAAS,qBAAxBtB,yBAA0BuB,IAAI,oBAAI,EAAE,EAAYC,IAAI,CACrE,CAACC;;YAAgBA;eAAPlB,eAAOkB,yBAAAA,iBAAAA,KAAMC,QAAQ,qBAAdD,cAAgB,CAAChB,YAAY,mBAAI,QAAQH;;IAE5D,IAAIe,UAAU;YAGeA,kBACNA;QAHrB,OAAO;YACL1B,MAAM;YACNgC,OAAOV,KAAKC,KAAK,CAACC,QAAOE,mBAAAA,SAASD,MAAM,YAAfC,mBAAmB;YAC5CO,YAAYrB,QAAOc,eAAAA,SAASb,EAAE,YAAXa,eAAe;YAClCQ,SAAS;QACX;IACF;IACA,MAAMC,gBAAgBb,KAAKC,KAAK,CAACC,iBAAOnB,kBAAAA,SAASV,IAAI,qBAAbU,gBAAeoB,MAAM,oBAAI;IACjE,MAAMW,uBAAuBd,KAAKC,KAAK,CAACC,iBAAOnB,kBAAAA,SAASV,IAAI,qBAAbU,gBAAegC,eAAe,oBAAI;IACjF,MAAMC,iBAAiBhB,KAAKiB,GAAG,CAAC,GAAGJ,gBAAgBC;IACnD,MAAMI,aAAalB,KAAKC,KAAK,CAACC,QAAOtB,qBAAAA,MAAMuC,WAAW,YAAjBvC,qBAAqB;IAC1D,MAAMwC,aAAapB,KAAKqB,GAAG,CACzBrB,KAAKsB,KAAK,CAAC,AAACJ,aAAaL,gBAAiBd,oBAC1CiB;IAEF,IAAI,CAAEI,CAAAA,aAAa,CAAA,GAAI;QACrB,OAAO;YAAE1C,MAAM;YAAgBS,QAAQ;YAA2BoC,WAAW;QAAE;IACjF;IACA,MAAMC,SAAS,IAAIC,gBAAgB;QACjCtB,QAAQb,OAAO8B;QACf,CAAC,CAAC,SAAS,EAAE5B,YAAY,CAAC,CAAC,CAAC,EAAEH;IAChC;IACA,KAAK,MAAM,CAACqC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,EAACjD,kBAAAA,MAAM6B,QAAQ,YAAd7B,kBAAkB,CAAC,GAAI;QAC/D4C,OAAOM,GAAG,CAAC,CAAC,SAAS,EAAEJ,IAAI,CAAC,CAAC,EAAEC;IACjC;IACA,MAAMzD,WAAW,MAAMD,UACrB,CAAC,oCAAoC,EAAE6B,WAAW,UAAU,CAAC,EAC7D;QACEiC,QAAQ;QACR5D,SAAS;YACPC,eAAe,CAAC,OAAO,EAAEJ,WAAW;YACpC,gBAAgB;YAChB,mBAAmB,GAAGY,MAAMF,IAAI,CAAC,UAAU,EAAEW,SAAS;QACxD;QACAhB,MAAMmD,OAAOQ,QAAQ;IACvB;IAEF,MAAMC,WAAW,MAAM/D,SAASI,IAAI,GAAGC,KAAK,CAAC,IAAM;IACnD,IAAI,CAACL,SAASM,EAAE,EAAE;QAChB,IAAIZ,wBAAwBM,SAASL,MAAM,GAAG;YAC5C,MAAM,IAAI8B,MAAM,CAAC,iCAAiC,EAAEzB,SAASL,MAAM,CAAC,MAAM,EAAE4B,OAAO;QACrF;QACAG,QAAQC,KAAK,CAAC,wCAAwCoC,4BAAAA,SAAUpC,KAAK;QACrE,OAAO;YAAEnB,MAAM;YAAgBS,QAAQ;YAAoBoC,WAAWH;QAAW;IACnF;IACA,OAAO;QACL1C,MAAM;QACNgC,OAAOV,KAAKC,KAAK,CAACC,gBAAO+B,4BAAAA,SAAU9B,MAAM,oBAAIiB;QAC7CT,YAAYrB,gBAAO2C,4BAAAA,SAAU1C,EAAE,oBAAI;QACnCqB,SAAS;IACX;AACF"}

package/src/lib/server/test-firestore.js

@@ -101,6 +101,7 @@ export function fakeFirestore(seed = {}) {
                     }),
                 // Ordering and limits are not what these specs are about; the queue
                 // read just needs to return everything it stored.
+                where: ()=>api,
                 orderBy: ()=>api,
                 limit: ()=>api,
                 get: async ()=>({

package/src/lib/server/test-firestore.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/test-firestore.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Firestore stand-in for specs that span MORE THAN ONE COLLECTION\n * (AGL-1592). Test-only; deliberately not exported from the barrel.\n *\n * The one-collection fakes elsewhere in this directory return the same\n * document whatever collection name they are handed, which is fine when the\n * code under test touches one document and actively misleading when it does\n * not: the phone opt-out path reads `users/{uid}` and `contactSuppressions/{n}`\n * and the whole point is that they are different records. A fake that conflated\n * them would pass while the real thing wrote the marker on top of the\n * suppression.\n *\n * `FieldValue.delete()` is honoured for real, because \"the field is gone\" and\n * \"the field holds a sentinel object\" are different states and only the first\n * one makes `seedUserProfile`'s blank check fire.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\n\nconst DELETE = FieldValue.delete()\n\nexport interface FakeFirestore {\n  /**\n   * Every document in a collection, keyed by id.\n   *\n   * A SUBcollection is addressed by its full path — `hosts/host-1/suppressions`\n   * — which is also how it is seeded.\n   */\n  docs: (collection: string) => Record<string, any>\n  collection: (name: string) => any\n  /**\n   * Several documents in one round trip, the shape the real `getAll` has:\n   * the results come back POSITIONALLY, one per reference, so a caller that\n   * zips them back against its own input list gets what it asked for.\n   */\n  getAll: (...refs: any[]) => Promise<any[]>\n  /**\n   * A transaction, real enough for a read-then-write body.\n   *\n   * Reads pass straight through and writes are held until the body resolves,\n   * which is the property the code under test depends on: a writer that\n   * decides what to store FROM what it read must not observe its own\n   * half-finished write. It does not model contention or retries — nothing in\n   * this repo's transaction bodies branches on a retry, and a fake that\n   * pretended to would be asserting the fake.\n   */\n  runTransaction: <T>(body: (transaction: any) => Promise<T>) => Promise<T>\n}\n\nexport function fakeFirestore(\n  seed: Record<string, Record<string, any>> = {},\n): FakeFirestore {\n  const store: Record<string, Record<string, any>> = JSON.parse(\n    JSON.stringify(seed),\n  )\n\n  const snapshotFor = (collection: string, id: string) => {\n    const data = store[collection]?.[id]\n    return {\n      id,\n      exists: data !== undefined,\n      get: (field: string) => data?.[field],\n      data: () => data,\n    }\n  }\n\n  const fake: FakeFirestore = {\n    docs: (collection: string) => store[collection] ?? {},\n    getAll: async (...refs: any[]) =>\n      refs.map((ref) => snapshotFor(ref.collectionPath, ref.id)),\n    async runTransaction<T>(body: (transaction: any) => Promise<T>): Promise<T> {\n      const pending: Array<() => Promise<void>> = []\n      const transaction = {\n        get: (ref: any) => ref.get(),\n        set: (ref: any, data: Record<string, any>, options?: { merge?: boolean }) => {\n          pending.push(() => ref.set(data, options))\n          return transaction\n        },\n      }\n      const result = await body(transaction)\n      for (const write of pending) await write()\n      return result\n    },\n    collection(name: string) {\n      store[name] = store[name] ?? {}\n      const api: any = {\n        doc: (id: string) => ({\n          id,\n          /**\n           * Which collection this reference came from, so `getAll` can resolve\n           * a bare reference the way the real client does.\n           */\n          collectionPath: name,\n          /**\n           * A subcollection is a collection at the joined path, so the fake\n           * stays one flat map. Nesting matters here because a per-site list\n           * lives under the site — a fake that returned the same documents for\n           * `hosts/a/suppressions` and `hosts/b/suppressions` would certify a\n           * sender that leaks one site's unsubscribes into another's.\n           */\n          collection: (sub: string) => fake.collection(`${name}/${id}/${sub}`),\n          get: async () => snapshotFor(name, id),\n          set: async (data: Record<string, any>, options?: { merge?: boolean }) => {\n            const base = options?.merge ? (store[name][id] ?? {}) : {}\n            const next: Record<string, any> = { ...base }\n            for (const [key, value] of Object.entries(data)) {\n              // A real delete, not a stored sentinel — see the header.\n              if (value && typeof value === 'object' && DELETE.isEqual(value as any)) {\n                delete next[key]\n                continue\n              }\n              // Server timestamps arrive as sentinels too. Freeze them into\n              // something a spec can assert on and a date can be read from.\n              next[key] =\n                value && typeof value === 'object' && typeof (value as any).isEqual === 'function'\n                  ? { seconds: Math.floor(Date.now() / 1000) }\n                  : value\n            }\n            store[name][id] = next\n          },\n        }),\n        // Ordering and limits are not what these specs are about; the queue\n        // read just needs to return everything it stored.\n        orderBy: () => api,\n        limit: () => api,\n        get: async () => ({\n          docs: Object.keys(store[name]).map((id) => snapshotFor(name, id)),\n        }),\n        add: async (data: Record<string, any>) => {\n          const id = `auto-${Object.keys(store[name]).length + 1}`\n          store[name][id] = data\n          return { id }\n        },\n      }\n      return api\n    },\n  }\n  return fake\n}\n\nexport default fakeFirestore\n"],"names":["FieldValue","DELETE","delete","fakeFirestore","seed","store","JSON","parse","stringify","snapshotFor","collection","id","data","exists","undefined","get","field","fake","docs","getAll","refs","map","ref","collectionPath","runTransaction","body","pending","transaction","set","options","push","result","write","name","api","doc","sub","base","merge","next","key","value","Object","entries","isEqual","seconds","Math","floor","Date","now","orderBy","limit","keys","add","length"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AAErD,MAAMC,SAASD,WAAWE,MAAM;AA8BhC,OAAO,SAASC,cACdC,OAA4C,CAAC,CAAC;IAE9C,MAAMC,QAA6CC,KAAKC,KAAK,CAC3DD,KAAKE,SAAS,CAACJ;IAGjB,MAAMK,cAAc,CAACC,YAAoBC;YAC1BN;QAAb,MAAMO,QAAOP,oBAAAA,KAAK,CAACK,WAAW,qBAAjBL,iBAAmB,CAACM,GAAG;QACpC,OAAO;YACLA;YACAE,QAAQD,SAASE;YACjBC,KAAK,CAACC,QAAkBJ,wBAAAA,IAAM,CAACI,MAAM;YACrCJ,MAAM,IAAMA;QACd;IACF;IAEA,MAAMK,OAAsB;QAC1BC,MAAM,CAACR;gBAAuBL;oBAAAA,oBAAAA,KAAK,CAACK,WAAW,YAAjBL,oBAAqB,CAAC;;QACpDc,QAAQ,OAAO,GAAGC,OAChBA,KAAKC,GAAG,CAAC,CAACC,MAAQb,YAAYa,IAAIC,cAAc,EAAED,IAAIX,EAAE;QAC1D,MAAMa,gBAAkBC,IAAsC;YAC5D,MAAMC,UAAsC,EAAE;YAC9C,MAAMC,cAAc;gBAClBZ,KAAK,CAACO,MAAaA,IAAIP,GAAG;gBAC1Ba,KAAK,CAACN,KAAUV,MAA2BiB;oBACzCH,QAAQI,IAAI,CAAC,IAAMR,IAAIM,GAAG,CAAChB,MAAMiB;oBACjC,OAAOF;gBACT;YACF;YACA,MAAMI,SAAS,MAAMN,KAAKE;YAC1B,KAAK,MAAMK,SAASN,QAAS,MAAMM;YACnC,OAAOD;QACT;QACArB,YAAWuB,IAAY;gBACP5B;YAAdA,KAAK,CAAC4B,KAAK,IAAG5B,cAAAA,KAAK,CAAC4B,KAAK,YAAX5B,cAAe,CAAC;YAC9B,MAAM6B,MAAW;gBACfC,KAAK,CAACxB,KAAgB,CAAA;wBACpBA;wBACA;;;WAGC,GACDY,gBAAgBU;wBAChB;;;;;;WAMC,GACDvB,YAAY,CAAC0B,MAAgBnB,KAAKP,UAAU,CAAC,GAAGuB,KAAK,CAAC,EAAEtB,GAAG,CAAC,EAAEyB,KAAK;wBACnErB,KAAK,UAAYN,YAAYwB,MAAMtB;wBACnCiB,KAAK,OAAOhB,MAA2BiB;gCACNxB;4BAA/B,MAAMgC,OAAOR,CAAAA,2BAAAA,QAASS,KAAK,KAAIjC,iBAAAA,KAAK,CAAC4B,KAAK,CAACtB,GAAG,YAAfN,iBAAmB,CAAC,IAAK,CAAC;4BACzD,MAAMkC,OAA4B,aAAKF;4BACvC,KAAK,MAAM,CAACG,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAAC/B,MAAO;gCAC/C,yDAAyD;gCACzD,IAAI6B,SAAS,OAAOA,UAAU,YAAYxC,OAAO2C,OAAO,CAACH,QAAe;oCACtE,OAAOF,IAAI,CAACC,IAAI;oCAChB;gCACF;gCACA,8DAA8D;gCAC9D,8DAA8D;gCAC9DD,IAAI,CAACC,IAAI,GACPC,SAAS,OAAOA,UAAU,YAAY,OAAO,AAACA,MAAcG,OAAO,KAAK,aACpE;oCAAEC,SAASC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;gCAAM,IACzCR;4BACR;4BACApC,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAG4B;wBACpB;oBACF,CAAA;gBACA,oEAAoE;gBACpE,kDAAkD;gBAClDW,SAAS,IAAMhB;gBACfiB,OAAO,IAAMjB;gBACbnB,KAAK,UAAa,CAAA;wBAChBG,MAAMwB,OAAOU,IAAI,CAAC/C,KAAK,CAAC4B,KAAK,EAAEZ,GAAG,CAAC,CAACV,KAAOF,YAAYwB,MAAMtB;oBAC/D,CAAA;gBACA0C,KAAK,OAAOzC;oBACV,MAAMD,KAAK,CAAC,KAAK,EAAE+B,OAAOU,IAAI,CAAC/C,KAAK,CAAC4B,KAAK,EAAEqB,MAAM,GAAG,GAAG;oBACxDjD,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAGC;oBAClB,OAAO;wBAAED;oBAAG;gBACd;YACF;YACA,OAAOuB;QACT;IACF;IACA,OAAOjB;AACT;AAEA,eAAed,cAAa"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/test-firestore.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Firestore stand-in for specs that span MORE THAN ONE COLLECTION\n * (AGL-1592). Test-only; deliberately not exported from the barrel.\n *\n * The one-collection fakes elsewhere in this directory return the same\n * document whatever collection name they are handed, which is fine when the\n * code under test touches one document and actively misleading when it does\n * not: the phone opt-out path reads `users/{uid}` and `contactSuppressions/{n}`\n * and the whole point is that they are different records. A fake that conflated\n * them would pass while the real thing wrote the marker on top of the\n * suppression.\n *\n * `FieldValue.delete()` is honoured for real, because \"the field is gone\" and\n * \"the field holds a sentinel object\" are different states and only the first\n * one makes `seedUserProfile`'s blank check fire.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\n\nconst DELETE = FieldValue.delete()\n\nexport interface FakeFirestore {\n  /**\n   * Every document in a collection, keyed by id.\n   *\n   * A SUBcollection is addressed by its full path — `hosts/host-1/suppressions`\n   * — which is also how it is seeded.\n   */\n  docs: (collection: string) => Record<string, any>\n  collection: (name: string) => any\n  /**\n   * Several documents in one round trip, the shape the real `getAll` has:\n   * the results come back POSITIONALLY, one per reference, so a caller that\n   * zips them back against its own input list gets what it asked for.\n   */\n  getAll: (...refs: any[]) => Promise<any[]>\n  /**\n   * A transaction, real enough for a read-then-write body.\n   *\n   * Reads pass straight through and writes are held until the body resolves,\n   * which is the property the code under test depends on: a writer that\n   * decides what to store FROM what it read must not observe its own\n   * half-finished write. It does not model contention or retries — nothing in\n   * this repo's transaction bodies branches on a retry, and a fake that\n   * pretended to would be asserting the fake.\n   */\n  runTransaction: <T>(body: (transaction: any) => Promise<T>) => Promise<T>\n}\n\nexport function fakeFirestore(\n  seed: Record<string, Record<string, any>> = {},\n): FakeFirestore {\n  const store: Record<string, Record<string, any>> = JSON.parse(\n    JSON.stringify(seed),\n  )\n\n  const snapshotFor = (collection: string, id: string) => {\n    const data = store[collection]?.[id]\n    return {\n      id,\n      exists: data !== undefined,\n      get: (field: string) => data?.[field],\n      data: () => data,\n    }\n  }\n\n  const fake: FakeFirestore = {\n    docs: (collection: string) => store[collection] ?? {},\n    getAll: async (...refs: any[]) =>\n      refs.map((ref) => snapshotFor(ref.collectionPath, ref.id)),\n    async runTransaction<T>(body: (transaction: any) => Promise<T>): Promise<T> {\n      const pending: Array<() => Promise<void>> = []\n      const transaction = {\n        get: (ref: any) => ref.get(),\n        set: (ref: any, data: Record<string, any>, options?: { merge?: boolean }) => {\n          pending.push(() => ref.set(data, options))\n          return transaction\n        },\n      }\n      const result = await body(transaction)\n      for (const write of pending) await write()\n      return result\n    },\n    collection(name: string) {\n      store[name] = store[name] ?? {}\n      const api: any = {\n        doc: (id: string) => ({\n          id,\n          /**\n           * Which collection this reference came from, so `getAll` can resolve\n           * a bare reference the way the real client does.\n           */\n          collectionPath: name,\n          /**\n           * A subcollection is a collection at the joined path, so the fake\n           * stays one flat map. Nesting matters here because a per-site list\n           * lives under the site — a fake that returned the same documents for\n           * `hosts/a/suppressions` and `hosts/b/suppressions` would certify a\n           * sender that leaks one site's unsubscribes into another's.\n           */\n          collection: (sub: string) => fake.collection(`${name}/${id}/${sub}`),\n          get: async () => snapshotFor(name, id),\n          set: async (data: Record<string, any>, options?: { merge?: boolean }) => {\n            const base = options?.merge ? (store[name][id] ?? {}) : {}\n            const next: Record<string, any> = { ...base }\n            for (const [key, value] of Object.entries(data)) {\n              // A real delete, not a stored sentinel — see the header.\n              if (value && typeof value === 'object' && DELETE.isEqual(value as any)) {\n                delete next[key]\n                continue\n              }\n              // Server timestamps arrive as sentinels too. Freeze them into\n              // something a spec can assert on and a date can be read from.\n              next[key] =\n                value && typeof value === 'object' && typeof (value as any).isEqual === 'function'\n                  ? { seconds: Math.floor(Date.now() / 1000) }\n                  : value\n            }\n            store[name][id] = next\n          },\n        }),\n        // Ordering and limits are not what these specs are about; the queue\n        // read just needs to return everything it stored.\n        where: () => api,\n        orderBy: () => api,\n        limit: () => api,\n        get: async () => ({\n          docs: Object.keys(store[name]).map((id) => snapshotFor(name, id)),\n        }),\n        add: async (data: Record<string, any>) => {\n          const id = `auto-${Object.keys(store[name]).length + 1}`\n          store[name][id] = data\n          return { id }\n        },\n      }\n      return api\n    },\n  }\n  return fake\n}\n\nexport default fakeFirestore\n"],"names":["FieldValue","DELETE","delete","fakeFirestore","seed","store","JSON","parse","stringify","snapshotFor","collection","id","data","exists","undefined","get","field","fake","docs","getAll","refs","map","ref","collectionPath","runTransaction","body","pending","transaction","set","options","push","result","write","name","api","doc","sub","base","merge","next","key","value","Object","entries","isEqual","seconds","Math","floor","Date","now","where","orderBy","limit","keys","add","length"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AAErD,MAAMC,SAASD,WAAWE,MAAM;AA8BhC,OAAO,SAASC,cACdC,OAA4C,CAAC,CAAC;IAE9C,MAAMC,QAA6CC,KAAKC,KAAK,CAC3DD,KAAKE,SAAS,CAACJ;IAGjB,MAAMK,cAAc,CAACC,YAAoBC;YAC1BN;QAAb,MAAMO,QAAOP,oBAAAA,KAAK,CAACK,WAAW,qBAAjBL,iBAAmB,CAACM,GAAG;QACpC,OAAO;YACLA;YACAE,QAAQD,SAASE;YACjBC,KAAK,CAACC,QAAkBJ,wBAAAA,IAAM,CAACI,MAAM;YACrCJ,MAAM,IAAMA;QACd;IACF;IAEA,MAAMK,OAAsB;QAC1BC,MAAM,CAACR;gBAAuBL;oBAAAA,oBAAAA,KAAK,CAACK,WAAW,YAAjBL,oBAAqB,CAAC;;QACpDc,QAAQ,OAAO,GAAGC,OAChBA,KAAKC,GAAG,CAAC,CAACC,MAAQb,YAAYa,IAAIC,cAAc,EAAED,IAAIX,EAAE;QAC1D,MAAMa,gBAAkBC,IAAsC;YAC5D,MAAMC,UAAsC,EAAE;YAC9C,MAAMC,cAAc;gBAClBZ,KAAK,CAACO,MAAaA,IAAIP,GAAG;gBAC1Ba,KAAK,CAACN,KAAUV,MAA2BiB;oBACzCH,QAAQI,IAAI,CAAC,IAAMR,IAAIM,GAAG,CAAChB,MAAMiB;oBACjC,OAAOF;gBACT;YACF;YACA,MAAMI,SAAS,MAAMN,KAAKE;YAC1B,KAAK,MAAMK,SAASN,QAAS,MAAMM;YACnC,OAAOD;QACT;QACArB,YAAWuB,IAAY;gBACP5B;YAAdA,KAAK,CAAC4B,KAAK,IAAG5B,cAAAA,KAAK,CAAC4B,KAAK,YAAX5B,cAAe,CAAC;YAC9B,MAAM6B,MAAW;gBACfC,KAAK,CAACxB,KAAgB,CAAA;wBACpBA;wBACA;;;WAGC,GACDY,gBAAgBU;wBAChB;;;;;;WAMC,GACDvB,YAAY,CAAC0B,MAAgBnB,KAAKP,UAAU,CAAC,GAAGuB,KAAK,CAAC,EAAEtB,GAAG,CAAC,EAAEyB,KAAK;wBACnErB,KAAK,UAAYN,YAAYwB,MAAMtB;wBACnCiB,KAAK,OAAOhB,MAA2BiB;gCACNxB;4BAA/B,MAAMgC,OAAOR,CAAAA,2BAAAA,QAASS,KAAK,KAAIjC,iBAAAA,KAAK,CAAC4B,KAAK,CAACtB,GAAG,YAAfN,iBAAmB,CAAC,IAAK,CAAC;4BACzD,MAAMkC,OAA4B,aAAKF;4BACvC,KAAK,MAAM,CAACG,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAAC/B,MAAO;gCAC/C,yDAAyD;gCACzD,IAAI6B,SAAS,OAAOA,UAAU,YAAYxC,OAAO2C,OAAO,CAACH,QAAe;oCACtE,OAAOF,IAAI,CAACC,IAAI;oCAChB;gCACF;gCACA,8DAA8D;gCAC9D,8DAA8D;gCAC9DD,IAAI,CAACC,IAAI,GACPC,SAAS,OAAOA,UAAU,YAAY,OAAO,AAACA,MAAcG,OAAO,KAAK,aACpE;oCAAEC,SAASC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;gCAAM,IACzCR;4BACR;4BACApC,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAG4B;wBACpB;oBACF,CAAA;gBACA,oEAAoE;gBACpE,kDAAkD;gBAClDW,OAAO,IAAMhB;gBACbiB,SAAS,IAAMjB;gBACfkB,OAAO,IAAMlB;gBACbnB,KAAK,UAAa,CAAA;wBAChBG,MAAMwB,OAAOW,IAAI,CAAChD,KAAK,CAAC4B,KAAK,EAAEZ,GAAG,CAAC,CAACV,KAAOF,YAAYwB,MAAMtB;oBAC/D,CAAA;gBACA2C,KAAK,OAAO1C;oBACV,MAAMD,KAAK,CAAC,KAAK,EAAE+B,OAAOW,IAAI,CAAChD,KAAK,CAAC4B,KAAK,EAAEsB,MAAM,GAAG,GAAG;oBACxDlD,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAGC;oBAClB,OAAO;wBAAED;oBAAG;gBACd;YACF;YACA,OAAOuB;QACT;IACF;IACA,OAAOjB;AACT;AAEA,eAAed,cAAa"}

package/src/lib/server/upsert-contact.js

@@ -20,6 +20,7 @@ import { firebaseAdmin } from "./firebase-admin.js";
 import { countCrmRecords, restampCrmListFieldsAt } from "./crm-records.js";
 import { attributeOrderToEmail } from "./email-revenue-attribution.js";
 import { hostRefusesCaptureForErasure } from "./email-suppression.js";
+import { scheduleCapturedEmailCheck } from "./capture-email-check.js";
 import { attributeCampaignConversion } from "./campaign-conversion-attribution.js";
 import { nameSearchFields } from "@aglyn/aglyn/app-utils/name-search";
 import { consentGroupForGrant } from "@aglyn/aglyn/app-utils/consent-groups";
@@ -117,8 +118,8 @@ import { consentGroupForSite, getOrgForHost, orgDataCollectionForHost } from "./
 }
 export async function upsertHostContact(options) {
     try {
-        var _options_interaction_atMs, _options_campaignIds, _ref, _contactsRef_parent, _ref1, _ref2;
-        var _options_facet, _orgBilling_org;
+        var _options_interaction_atMs, _options_campaignIds, _ref, _contactsRef_parent, _ref1, _ref2, _ref3;
+        var _options_facet, _orgBilling_org, _contactsRef_parent1;
         const email = normalizeContactEmail(options.email);
         if (!email) return {
             refused: 'invalid-email'
@@ -246,7 +247,8 @@ export async function upsertHostContact(options) {
      * read once and needs no backfill.
      *=========================================*/ const docSnapshot = await findContactByEmail(contactsRef, email);
         if (docSnapshot) {
-            var _facet_name, _profile_lifecycleStage;
+            var _facet_name, _profile_lifecycleStage, _ref4;
+            var _contactsRef_parent2;
             /*
        * MERGED INTO THIS GROUP'S FACET, not into the top of the document.
        *
@@ -365,6 +367,13 @@ export async function upsertHostContact(options) {
             // The merged facet, name and scope are what the Contacts list
             // searches and filters by (AGL-3321): restamped from the stored row.
             await restampCrmListFieldsAt(docSnapshot.ref, 'contacts');
+            // The address's domain, checked after the response (AGL-3328).
+            scheduleCapturedEmailCheck({
+                orgId: (_ref4 = (_contactsRef_parent2 = contactsRef.parent) == null ? void 0 : _contactsRef_parent2.id) != null ? _ref4 : null,
+                hostId: options.hostId,
+                email,
+                predicted: docSnapshot.get('emailStatus') === 'undeliverable'
+            });
             return {
                 contactId: docSnapshot.id,
                 created: false
@@ -556,6 +565,13 @@ export async function upsertHostContact(options) {
                 console.error('upsertHostContact onCreated failed', error);
             });
         }
+        // A new person's address, checked after the response (AGL-3328): a
+        // domain that takes no mail reads "Would bounce" on the record.
+        scheduleCapturedEmailCheck({
+            orgId: (_ref3 = (_contactsRef_parent1 = contactsRef.parent) == null ? void 0 : _contactsRef_parent1.id) != null ? _ref3 : null,
+            hostId: options.hostId,
+            email
+        });
         return {
             contactId: created.id,
             created: true