@aglyn/tenant-data-admin 1.0.0-beta.218 → 1.0.0-beta.220

package/src/lib/server/{stripe-account-mode.js → payment-provider-stripe-connect.js}

@@ -14,7 +14,17 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ /**
- * Whether a stored Connect linkage can actually take money HERE (AGL-2471).
+ * The Stripe Connect adapter behind the payment-provider contract
+ * (`payment-provider.ts`): a tenant's merchant account is a Stripe Connect
+ * account, charged and paid out through the platform's Stripe key.
+ *
+ * This module is the part that is Stripe's — which mode a key states, how the
+ * API is asked, which webhook events describe a connected account and where
+ * each one keeps the account id. What an event WRITES lives in the two modules
+ * it dispatches to, loaded only when such an event arrives, so the money doors
+ * that import the contract for its readiness rule load no Firebase.
+ *
+ * ## Whether a stored Connect linkage can actually take money HERE (AGL-2471)
  *
  * THE DEFECT. Production Firestore held three Connect linkages and all three
  * named TEST-mode accounts. One — `profiles/7AVEMtDa…`, `stripeAccountId:
@@ -49,20 +59,10 @@
  *      (above), so the account's mode IS the key's mode; the key's mode is
  *      then confirmed against the API via `resolvePlatformStripeMode`.
  *
- * WHY THE RULE IS ASYMMETRIC, AND NOT "REFUSE ANYTHING UNPROVEN". An absent
- * `stripeAccountLivemode` refuses only on a LIVE deployment. That is where
- * real money moves and where the defect was found, and a live deployment can
- * always re-establish the field: the merchant reconnects, or Stripe sends one
- * `account.updated`. Everywhere else — a test-key deployment, a developer
- * machine, a self-hosted install still in sandbox, the whole test suite — an
- * unverified linkage keeps the behaviour it had before, because no real money
- * can move there and Stripe enforces the mode boundary itself. Refusing
- * everywhere would have bought production nothing extra and broken every
- * non-production deployment.
- *
- * A PROVEN mismatch (`stripeAccountLivemode` recorded and disagreeing) is
- * refused in BOTH directions, because that costs nothing to detect and is
- * never right.
+ * The profile field is `stripeAccountLivemode`, and the rule that reads it —
+ * refused on a live deployment when absent, refused in both directions when
+ * it disagrees — is the contract's `merchantAccountReadiness`, which says why
+ * it is asymmetric.
  *
  * WHAT IS SNIFFED, AND WHY THAT ONE IS FAIR. The SECRET KEY states its own
  * mode — `sk_live_`, `sk_test_`, `rk_live_`, `rk_test_` — and that is a
@@ -78,7 +78,7 @@
  * and writes it into the production database. Nothing about that is going to
  * change — the split key is the right call — so the gate has to be the thing
  * that notices.
- */ /** Which Stripe world a key or an account belongs to. */ /**
+ */ /**
  * The mode a Stripe secret key states about itself, or `undefined` when the
  * string is not a Stripe secret key.
  *
@@ -120,43 +120,69 @@
     return fromKey;
 }
 /**
- * Decides whether a stored Connect linkage may be charged against.
- *
- * Order matters: the two refusals that existed before AGL-2471 are asked
- * first, so an unconnected or restricted merchant still gets the answer they
- * always got, and only a linkage that WOULD have passed reaches the mode
- * question.
- */ export function connectReadiness(input) {
-    const accountId = typeof input.accountId === 'string' ? input.accountId.trim() : '';
-    if (!accountId) return 'not-connected';
-    if (input.chargesEnabled !== true) return 'charges-disabled';
-    const platformMode = 'platformMode' in input ? input.platformMode : platformStripeMode();
-    // Three-valued on purpose, exactly as AGL-1997 reads `payoutsEnabled`: only
-    // a literal boolean is a recorded answer. A string `'true'` or a `1` is a
-    // field somebody else wrote, and inventing `true` from it would re-open the
-    // hole this closes.
-    if (typeof input.accountLivemode === 'boolean') {
-        // A PROVEN mismatch is refused in either direction. It costs nothing to
-        // detect and it is always wrong.
-        if (!platformMode) return 'ready';
-        return input.accountLivemode === (platformMode === 'live') ? 'ready' : 'mode-mismatch';
+ * A Stripe webhook event about a connected account, applied to the profiles in
+ * `collection` that store it — the contract's `applyAccountEvent`.
+ *
+ * Three events describe a connected account, and each keeps the account id
+ * somewhere different:
+ *
+ *  - `account.updated` — its readiness changed (AGL-1997). The object IS the
+ *    Account, and the EVENT carries `livemode` (AGL-2471): the Account object
+ *    has no such field, and the event's is what lets a linkage whose mode was
+ *    never recorded heal itself instead of staying refused forever.
+ *  - `payout.failed` / `transfer.failed` — money headed for the account never
+ *    landed. A payout is the connected account's balance failing to reach its
+ *    bank, so its account id is `event.account`: the Payout's own
+ *    `destination` names the BANK. A transfer is the platform's balance
+ *    failing to reach the connected account, a platform event whose
+ *    `destination` IS the account. Recorded and surfaced, never retried:
+ *    Stripe runs its own retry schedule, and a second transfer against an
+ *    account that has just refused one is how a duplicate lands.
+ *  - `payout.paid` — a later payout landed, which retires the warning the
+ *    failure left on the profile. The history is kept.
+ *
+ * Every other event answers `false` without loading anything. A write that
+ * fails throws, and the webhook's 500 earns the redelivery; every write
+ * mirrors current state or is keyed by Stripe's id, so a redelivery converges.
+ */ export async function applyStripeConnectAccountEvent(collection, delivered) {
+    const type = delivered == null ? void 0 : delivered.type;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const object = delivered == null ? void 0 : delivered.object;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const event = delivered == null ? void 0 : delivered.event;
+    if (type === 'account.updated') {
+        const { syncConnectAccountStatus } = await import("./payment-provider-stripe-connect-status.js");
+        await syncConnectAccountStatus(collection, object, event == null ? void 0 : event.livemode);
+        return true;
     }
-    return platformMode === 'live' ? 'mode-unverified' : 'ready';
-}
-/**
- * The form every money door calls: `true` only when the linkage may be
- * charged, with the two mode refusals reported to the server log.
- *
- * The log line is the part the shopper's generic 409 cannot carry. Before
- * this, a mode mismatch surfaced as a 502 from Stripe with nothing anywhere
- * naming the cause; the sale is still refused the same way, but now somebody
- * can find out why.
- */ export function connectLinkageIsReady(input, context) {
-    const readiness = connectReadiness(input);
-    if (readiness === 'mode-mismatch' || readiness === 'mode-unverified') {
-        console.error(`[AGL-2471] Refusing a charge against Connect account ` + `${String(input.accountId)}${(context == null ? void 0 : context.subject) ? ` (${context.subject})` : ''}: ${readiness}. The stored linkage is not verified for this ` + `deployment's Stripe mode; the merchant must re-onboard.`);
+    if (type === 'payout.failed' || type === 'transfer.failed') {
+        var _ref, _ref1, _ref2;
+        var _object_destination;
+        const failedAccountId = type === 'payout.failed' ? String((_ref = event == null ? void 0 : event.account) != null ? _ref : '') : String((_ref1 = (_ref2 = object == null ? void 0 : (_object_destination = object.destination) == null ? void 0 : _object_destination.id) != null ? _ref2 : object == null ? void 0 : object.destination) != null ? _ref1 : '');
+        const { recordConnectPayoutFailure } = await import("./payment-provider-stripe-connect-payouts.js");
+        await recordConnectPayoutFailure(collection, {
+            kind: type === 'payout.failed' ? 'payout' : 'transfer',
+            object,
+            accountId: failedAccountId,
+            livemode: event == null ? void 0 : event.livemode
+        });
+        return true;
+    }
+    if (type === 'payout.paid') {
+        var _ref3;
+        const { clearConnectPayoutFailure } = await import("./payment-provider-stripe-connect-payouts.js");
+        await clearConnectPayoutFailure(collection, String((_ref3 = event == null ? void 0 : event.account) != null ? _ref3 : ''));
+        return true;
     }
-    return readiness === 'ready';
+    return false;
 }
+/** The adapter the contract returns. */ export const STRIPE_CONNECT_PAYMENT_PROVIDER = {
+    id: 'stripe-connect',
+    // Called with no argument, so the key is read when asked — not when this
+    // module was first evaluated.
+    platformMode: ()=>platformStripeMode(),
+    resolvePlatformMode: ()=>resolvePlatformStripeMode(),
+    applyAccountEvent: applyStripeConnectAccountEvent
+};
 
-//# sourceMappingURL=stripe-account-mode.js.map
+//# sourceMappingURL=payment-provider-stripe-connect.js.map

package/src/lib/server/payment-provider-stripe-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-provider-stripe-connect.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PaymentMode, PaymentProvider, PaymentProviderEvent } from './payment-provider'\n\n/**\n * The Stripe Connect adapter behind the payment-provider contract\n * (`payment-provider.ts`): a tenant's merchant account is a Stripe Connect\n * account, charged and paid out through the platform's Stripe key.\n *\n * This module is the part that is Stripe's — which mode a key states, how the\n * API is asked, which webhook events describe a connected account and where\n * each one keeps the account id. What an event WRITES lives in the two modules\n * it dispatches to, loaded only when such an event arrives, so the money doors\n * that import the contract for its readiness rule load no Firebase.\n *\n * ## Whether a stored Connect linkage can actually take money HERE (AGL-2471)\n *\n * THE DEFECT. Production Firestore held three Connect linkages and all three\n * named TEST-mode accounts. One — `profiles/7AVEMtDa…`, `stripeAccountId:\n * acct_1TulDeRbL3B9Ioqz` — also carried `stripeChargesEnabled: true`, which\n * was the entire payments-readiness test every money door made:\n *\n *     if (!accountId || !ownerProfile.get('stripeChargesEnabled')) …\n *\n * So three storefronts presented as payments-ready, minted a LIVE Checkout\n * session with a TEST-mode `payment_intent_data[transfer_data][destination]`,\n * and were refused by Stripe as a generic 502 at the shopper's checkout. A\n * merchant told they are ready to take money, who silently cannot.\n *\n * WHY THE ACCOUNT ID IS NOT THE EVIDENCE. `acct_1TulDeRbL3B9Ioqz` is a real\n * production value naming a TEST account. Stripe's account ids carry no mode\n * marker — live and test ids are the same shape — so no amount of reading the\n * string can tell them apart. What DOES tell them apart is Stripe itself:\n * retrieving that id with the live key answers\n *\n *     400 The account acct_1TulDeRbL3B9Ioqz was a test account created with a\n *         testmode key, and therefore can only be used with testmode keys.\n *\n * The Account object, notably, has NO `livemode` field of its own (verified\n * against the live API: the payload carries `charges_enabled`,\n * `payouts_enabled`, `capabilities` and no `livemode`). So the mode is\n * recorded at the two moments Stripe does state it:\n *\n *   1. `account.updated` — the EVENT carries `livemode`, and it is Stripe's\n *      own statement about the account the event is describing;\n *   2. onboarding — the account was just created or retrieved successfully\n *      with the platform key, and Stripe hard-refuses cross-mode retrieval\n *      (above), so the account's mode IS the key's mode; the key's mode is\n *      then confirmed against the API via `resolvePlatformStripeMode`.\n *\n * The profile field is `stripeAccountLivemode`, and the rule that reads it —\n * refused on a live deployment when absent, refused in both directions when\n * it disagrees — is the contract's `merchantAccountReadiness`, which says why\n * it is asymmetric.\n *\n * WHAT IS SNIFFED, AND WHY THAT ONE IS FAIR. The SECRET KEY states its own\n * mode — `sk_live_`, `sk_test_`, `rk_live_`, `rk_test_` — and that is a\n * documented, stable Stripe invariant, unlike the account id. It is used only\n * to answer \"which mode is this deployment\", never \"which mode is this\n * account\", and even there `resolvePlatformStripeMode` prefers the API.\n *\n * HOW IT GOT THERE. A developer machine runs against PRODUCTION Firestore\n * (`FIREBASE_PROJECT_ID=aglyn-main` in every dev env file) while\n * `apps/console/.env.development.local` sets `STRIPE_SECRET_KEY` to the\n * `sk_test_` key by deliberate policy (AGL-1137: localhost must never touch\n * live Stripe). The connect route then creates a test-mode Express account\n * and writes it into the production database. Nothing about that is going to\n * change — the split key is the right call — so the gate has to be the thing\n * that notices.\n */\n\n/**\n * The mode a Stripe secret key states about itself, or `undefined` when the\n * string is not a Stripe secret key.\n *\n * Deliberately narrow: it matches `sk_`/`rk_` followed by `live`/`test`, and\n * refuses everything else rather than guessing. Handing it an `acct_…` id\n * returns `undefined` — the whole point is that account ids say nothing.\n */\nexport function platformStripeMode(\n  key: string | undefined = process.env.STRIPE_SECRET_KEY,\n): PaymentMode | undefined {\n  const match = /^[sr]k_(live|test)_/.exec(String(key ?? '').trim())\n  return match ? (match[1] as PaymentMode) : undefined\n}\n\n/**\n * The platform's mode, asked of Stripe and only then of the key.\n *\n * `GET /v1/balance` is a singleton that carries `livemode`, so it states the\n * mode of whatever key made the call — no object has to be created to find\n * out. The key prefix is the fallback for a restricted key that cannot read\n * balance; without it, a self-hosted install with a scoped key could not\n * finish onboarding at all.\n */\nexport async function resolvePlatformStripeMode(\n  key: string | undefined = process.env.STRIPE_SECRET_KEY,\n  fetchImpl: typeof fetch = fetch,\n): Promise<PaymentMode | undefined> {\n  const fromKey = platformStripeMode(key)\n  if (!key) return fromKey\n  try {\n    const response = await fetchImpl('https://api.stripe.com/v1/balance', {\n      method: 'GET',\n      headers: { Authorization: `Bearer ${key}` },\n    })\n    if (response.ok) {\n      const payload = await response.json()\n      if (typeof payload?.livemode === 'boolean') {\n        return payload.livemode ? 'live' : 'test'\n      }\n    }\n  } catch {\n    // Network or transport failure — fall through to the key, which is the\n    // same answer we would have recorded before this existed.\n  }\n  return fromKey\n}\n\n/**\n * A Stripe webhook event about a connected account, applied to the profiles in\n * `collection` that store it — the contract's `applyAccountEvent`.\n *\n * Three events describe a connected account, and each keeps the account id\n * somewhere different:\n *\n *  - `account.updated` — its readiness changed (AGL-1997). The object IS the\n *    Account, and the EVENT carries `livemode` (AGL-2471): the Account object\n *    has no such field, and the event's is what lets a linkage whose mode was\n *    never recorded heal itself instead of staying refused forever.\n *  - `payout.failed` / `transfer.failed` — money headed for the account never\n *    landed. A payout is the connected account's balance failing to reach its\n *    bank, so its account id is `event.account`: the Payout's own\n *    `destination` names the BANK. A transfer is the platform's balance\n *    failing to reach the connected account, a platform event whose\n *    `destination` IS the account. Recorded and surfaced, never retried:\n *    Stripe runs its own retry schedule, and a second transfer against an\n *    account that has just refused one is how a duplicate lands.\n *  - `payout.paid` — a later payout landed, which retires the warning the\n *    failure left on the profile. The history is kept.\n *\n * Every other event answers `false` without loading anything. A write that\n * fails throws, and the webhook's 500 earns the redelivery; every write\n * mirrors current state or is keyed by Stripe's id, so a redelivery converges.\n */\nexport async function applyStripeConnectAccountEvent(\n  collection: string,\n  delivered: PaymentProviderEvent,\n): Promise<boolean> {\n  const type = delivered?.type\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const object = delivered?.object as any\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const event = delivered?.event as any\n  if (type === 'account.updated') {\n    const { syncConnectAccountStatus } = await import(\n      './payment-provider-stripe-connect-status'\n    )\n    await syncConnectAccountStatus(collection, object, event?.livemode)\n    return true\n  }\n  if (type === 'payout.failed' || type === 'transfer.failed') {\n    const failedAccountId =\n      type === 'payout.failed'\n        ? String(event?.account ?? '')\n        : String(object?.destination?.id ?? object?.destination ?? '')\n    const { recordConnectPayoutFailure } = await import(\n      './payment-provider-stripe-connect-payouts'\n    )\n    await recordConnectPayoutFailure(collection, {\n      kind: type === 'payout.failed' ? 'payout' : 'transfer',\n      object,\n      accountId: failedAccountId,\n      livemode: event?.livemode,\n    })\n    return true\n  }\n  if (type === 'payout.paid') {\n    const { clearConnectPayoutFailure } = await import(\n      './payment-provider-stripe-connect-payouts'\n    )\n    await clearConnectPayoutFailure(collection, String(event?.account ?? ''))\n    return true\n  }\n  return false\n}\n\n/** The adapter the contract returns. */\nexport const STRIPE_CONNECT_PAYMENT_PROVIDER: PaymentProvider = {\n  id: 'stripe-connect',\n  // Called with no argument, so the key is read when asked — not when this\n  // module was first evaluated.\n  platformMode: () => platformStripeMode(),\n  resolvePlatformMode: () => resolvePlatformStripeMode(),\n  applyAccountEvent: applyStripeConnectAccountEvent,\n}\n"],"names":["platformStripeMode","key","process","env","STRIPE_SECRET_KEY","match","exec","String","trim","undefined","resolvePlatformStripeMode","fetchImpl","fetch","fromKey","response","method","headers","Authorization","ok","payload","json","livemode","applyStripeConnectAccountEvent","collection","delivered","type","object","event","syncConnectAccountStatus","failedAccountId","account","destination","id","recordConnectPayoutFailure","kind","accountId","clearConnectPayoutFailure","STRIPE_CONNECT_PAYMENT_PROVIDER","platformMode","resolvePlatformMode","applyAccountEvent"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiEC,GAED;;;;;;;CAOC,GACD,OAAO,SAASA,mBACdC,MAA0BC,QAAQC,GAAG,CAACC,iBAAiB;IAEvD,MAAMC,QAAQ,sBAAsBC,IAAI,CAACC,OAAON,cAAAA,MAAO,IAAIO,IAAI;IAC/D,OAAOH,QAASA,KAAK,CAAC,EAAE,GAAmBI;AAC7C;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,0BACpBT,MAA0BC,QAAQC,GAAG,CAACC,iBAAiB,EACvDO,YAA0BC,KAAK;IAE/B,MAAMC,UAAUb,mBAAmBC;IACnC,IAAI,CAACA,KAAK,OAAOY;IACjB,IAAI;QACF,MAAMC,WAAW,MAAMH,UAAU,qCAAqC;YACpEI,QAAQ;YACRC,SAAS;gBAAEC,eAAe,CAAC,OAAO,EAAEhB,KAAK;YAAC;QAC5C;QACA,IAAIa,SAASI,EAAE,EAAE;YACf,MAAMC,UAAU,MAAML,SAASM,IAAI;YACnC,IAAI,QAAOD,2BAAAA,QAASE,QAAQ,MAAK,WAAW;gBAC1C,OAAOF,QAAQE,QAAQ,GAAG,SAAS;YACrC;QACF;IACF,EAAE,eAAM;IACN,uEAAuE;IACvE,0DAA0D;IAC5D;IACA,OAAOR;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,eAAeS,+BACpBC,UAAkB,EAClBC,SAA+B;IAE/B,MAAMC,OAAOD,6BAAAA,UAAWC,IAAI;IAC5B,8DAA8D;IAC9D,MAAMC,SAASF,6BAAAA,UAAWE,MAAM;IAChC,8DAA8D;IAC9D,MAAMC,QAAQH,6BAAAA,UAAWG,KAAK;IAC9B,IAAIF,SAAS,mBAAmB;QAC9B,MAAM,EAAEG,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAC/C;QAEF,MAAMA,yBAAyBL,YAAYG,QAAQC,yBAAAA,MAAON,QAAQ;QAClE,OAAO;IACT;IACA,IAAII,SAAS,mBAAmBA,SAAS,mBAAmB;kBAI7CC;YAAAA;QAHb,MAAMG,kBACJJ,SAAS,kBACLlB,eAAOoB,yBAAAA,MAAOG,OAAO,mBAAI,MACzBvB,QAAOmB,iBAAAA,2BAAAA,sBAAAA,OAAQK,WAAW,qBAAnBL,oBAAqBM,EAAE,oBAAIN,0BAAAA,OAAQK,WAAW,YAA9CL,QAAkD;QAC/D,MAAM,EAAEO,0BAA0B,EAAE,GAAG,MAAM,MAAM,CACjD;QAEF,MAAMA,2BAA2BV,YAAY;YAC3CW,MAAMT,SAAS,kBAAkB,WAAW;YAC5CC;YACAS,WAAWN;YACXR,QAAQ,EAAEM,yBAAAA,MAAON,QAAQ;QAC3B;QACA,OAAO;IACT;IACA,IAAII,SAAS,eAAe;;QAC1B,MAAM,EAAEW,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAChD;QAEF,MAAMA,0BAA0Bb,YAAYhB,gBAAOoB,yBAAAA,MAAOG,OAAO,oBAAI;QACrE,OAAO;IACT;IACA,OAAO;AACT;AAEA,sCAAsC,GACtC,OAAO,MAAMO,kCAAmD;IAC9DL,IAAI;IACJ,yEAAyE;IACzE,8BAA8B;IAC9BM,cAAc,IAAMtC;IACpBuC,qBAAqB,IAAM7B;IAC3B8B,mBAAmBlB;AACrB,EAAC"}

package/src/lib/server/payment-provider.d.ts

@@ -0,0 +1,173 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The merchant's payment account — the one seam the payment vendor lives
+ * behind when a TENANT takes money.
+ *
+ * ## Which money this is, and which it is not
+ *
+ * Two different accounts move money on this platform and only one of them is
+ * here. The platform BILLS its customers — plans, add-ons, metered usage — on
+ * its own account; that rail is infrastructure (`org-billing.ts`, the billing
+ * webhook route, `api-idempotency.ts`, `stripe-deployment-mode.ts`) and names
+ * its vendor where it runs. A tenant SELLS — a storefront order, a booked
+ * appointment, a marketplace listing — into a connected merchant account of
+ * its own, and every plugin that takes money reaches that account through
+ * this contract: whether the account may be charged, which world (live or
+ * test) the platform charges in, and what the provider says when the account
+ * changes or a payout fails.
+ *
+ * Commerce's `PaymentProviderId` names the provider a CHECKOUT is created
+ * with. This is the other half: the account the checkout pays into.
+ *
+ * ## One adapter, compiled in, and no registry — by failure direction
+ *
+ * Stripe Connect is the only adapter
+ * (`payment-provider-stripe-connect.ts`), and {@link paymentProvider} returns
+ * it without consulting any registry, the way the domain driver's built-ins
+ * and the mail rail's are compiled into their libraries. A provider a plugin
+ * registered could be ABSENT where a door reads it — a declaration that threw
+ * part-way, a route bundle that evaluated the registry apart from boot's —
+ * and every answer an absent provider could give at a money door is wrong: a
+ * refusal takes every sale on every site down, and a default lets a checkout
+ * proceed against an account nobody checked. Compiled in, it cannot be
+ * absent, so neither can happen.
+ *
+ * It lives in this library rather than in a plugin because three plugins take
+ * money into the same account — a storefront, a calendar and the marketplace
+ * — and one plugin may not import another. A plugin that owned the adapter
+ * would make the other two's sales depend on its install and on its
+ * registration having run; the adapter itself sells nothing and holds no
+ * product, only the platform's own connected-account integration.
+ *
+ * A second adapter is one module beside the first and a selector here. There
+ * is no selector today because there is nothing to select: every plugin's
+ * checkout is created against the same vendor.
+ *
+ * ## The contract every adapter owes
+ *
+ * 1. **An account the provider did not describe is never ready.** Every
+ *    {@link MerchantAccountReadiness} other than `'ready'` refuses the charge,
+ *    and only a literal boolean is a recorded answer.
+ * 2. **Only what the provider stated is written.** An account event that
+ *    states nothing writes nothing, and a written record never invents a
+ *    `false` or a `true` from an absent field.
+ * 3. **Failures propagate.** {@link PaymentProvider.applyAccountEvent} runs
+ *    inside the platform's billing webhook, and a throw is what earns the
+ *    redelivery; every write it makes is idempotent so that redelivery
+ *    converges.
+ */
+/** Which world a platform credential or a merchant account charges in. */
+export type PaymentMode = 'live' | 'test';
+/**
+ * Why a stored merchant account may not be charged against. Every value
+ * other than `'ready'` is a refusal.
+ */
+export type MerchantAccountReadiness = 
+/** Charge away. */
+'ready'
+/** No merchant account is stored at all — the onboarding call to action. */
+ | 'not-connected'
+/** The provider will not let this account take charges. */
+ | 'charges-disabled'
+/**
+ * The account's mode was never recorded (AGL-2471) AND this deployment is
+ * LIVE. The onboarding route and the provider's account event both record
+ * it, so a genuine merchant self-heals on the next of either.
+ */
+ | 'mode-unverified'
+/** The account belongs to the OTHER world. The AGL-2471 defect. */
+ | 'mode-mismatch';
+export interface MerchantAccountReadinessInput {
+    /** The stored account id, whatever shape the document has. */
+    accountId?: unknown;
+    /** Whether the provider said the account may take charges. */
+    chargesEnabled?: unknown;
+    /** Whether the provider said the account is live — absent before AGL-2471. */
+    accountLivemode?: unknown;
+    /** Defaults to {@link PaymentProvider.platformMode}. */
+    platformMode?: PaymentMode | undefined;
+}
+/** One event the platform's billing webhook received, as the provider sent it. */
+export interface PaymentProviderEvent {
+    /** The provider's own name for the event. */
+    type: string;
+    /** The object the event describes. */
+    object: unknown;
+    /** The whole event as delivered. */
+    event: unknown;
+}
+export interface PaymentProvider {
+    /** Stable id, for log lines. Never a display name. */
+    readonly id: string;
+    /**
+     * The mode this deployment's platform credential states about itself, read
+     * without a network call; `undefined` when there is no credential or it
+     * states nothing.
+     */
+    platformMode(): PaymentMode | undefined;
+    /**
+     * The platform's mode, asked of the provider first and the credential
+     * second — what an onboarding route records against a merchant account it
+     * has just retrieved.
+     */
+    resolvePlatformMode(): Promise<PaymentMode | undefined>;
+    /**
+     * Applies an event about a connected merchant account — its readiness
+     * changed, a payout to it failed, a later payout landed — to the documents
+     * in `collection` that store it. A plugin passes the collection holding ITS
+     * merchant profiles; a non-matching account updates nothing.
+     *
+     * @returns `true` when the event was about a merchant account and has been
+     *   applied, so the caller's own sections have nothing to do with it;
+     *   `false` for every other event.
+     */
+    applyAccountEvent(collection: string, delivered: PaymentProviderEvent): Promise<boolean>;
+}
+/** The provider every merchant account on this deployment is held at. */
+export declare function paymentProvider(): PaymentProvider;
+/**
+ * Decides whether a stored merchant account may be charged against.
+ *
+ * Order matters: the two refusals that existed before AGL-2471 are asked
+ * first, so an unconnected or restricted merchant still gets the answer they
+ * always got, and only an account that WOULD have passed reaches the mode
+ * question.
+ *
+ * WHY THE MODE RULE IS ASYMMETRIC, AND NOT "REFUSE ANYTHING UNPROVEN". An
+ * unrecorded mode refuses only on a LIVE deployment. That is where real money
+ * moves, and a live deployment can always re-establish the field: the
+ * merchant reconnects, or the provider sends one account event. Everywhere
+ * else — a test deployment, a developer machine, a self-hosted install still
+ * in sandbox, the whole test suite — an unverified account keeps the
+ * behavior it had before, because no real money can move there and the
+ * provider enforces the mode boundary itself. A PROVEN mismatch is refused in
+ * both directions, because it costs nothing to detect and is never right.
+ */
+export declare function merchantAccountReadiness(input: MerchantAccountReadinessInput): MerchantAccountReadiness;
+/**
+ * The form every money door calls: `true` only when the account may be
+ * charged, with the two mode refusals reported to the server log.
+ *
+ * The log line is the part the shopper's generic 409 cannot carry. Before
+ * this, a mode mismatch surfaced as a 502 from the provider with nothing
+ * anywhere naming the cause; the sale is still refused the same way, but now
+ * somebody can find out why.
+ */
+export declare function merchantAccountIsReady(input: MerchantAccountReadinessInput, context?: {
+    subject?: string;
+}): boolean;

package/src/lib/server/payment-provider.js

@@ -0,0 +1,70 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { STRIPE_CONNECT_PAYMENT_PROVIDER } from "./payment-provider-stripe-connect.js";
+/** The provider every merchant account on this deployment is held at. */ export function paymentProvider() {
+    return STRIPE_CONNECT_PAYMENT_PROVIDER;
+}
+/**
+ * Decides whether a stored merchant account may be charged against.
+ *
+ * Order matters: the two refusals that existed before AGL-2471 are asked
+ * first, so an unconnected or restricted merchant still gets the answer they
+ * always got, and only an account that WOULD have passed reaches the mode
+ * question.
+ *
+ * WHY THE MODE RULE IS ASYMMETRIC, AND NOT "REFUSE ANYTHING UNPROVEN". An
+ * unrecorded mode refuses only on a LIVE deployment. That is where real money
+ * moves, and a live deployment can always re-establish the field: the
+ * merchant reconnects, or the provider sends one account event. Everywhere
+ * else — a test deployment, a developer machine, a self-hosted install still
+ * in sandbox, the whole test suite — an unverified account keeps the
+ * behavior it had before, because no real money can move there and the
+ * provider enforces the mode boundary itself. A PROVEN mismatch is refused in
+ * both directions, because it costs nothing to detect and is never right.
+ */ export function merchantAccountReadiness(input) {
+    const accountId = typeof input.accountId === 'string' ? input.accountId.trim() : '';
+    if (!accountId) return 'not-connected';
+    if (input.chargesEnabled !== true) return 'charges-disabled';
+    const platformMode = 'platformMode' in input ? input.platformMode : paymentProvider().platformMode();
+    // Three-valued on purpose, exactly as AGL-1997 reads `payoutsEnabled`: only
+    // a literal boolean is a recorded answer. A string `'true'` or a `1` is a
+    // field somebody else wrote, and inventing `true` from it would re-open the
+    // hole this closes.
+    if (typeof input.accountLivemode === 'boolean') {
+        // A PROVEN mismatch is refused in either direction. It costs nothing to
+        // detect and it is always wrong.
+        if (!platformMode) return 'ready';
+        return input.accountLivemode === (platformMode === 'live') ? 'ready' : 'mode-mismatch';
+    }
+    return platformMode === 'live' ? 'mode-unverified' : 'ready';
+}
+/**
+ * The form every money door calls: `true` only when the account may be
+ * charged, with the two mode refusals reported to the server log.
+ *
+ * The log line is the part the shopper's generic 409 cannot carry. Before
+ * this, a mode mismatch surfaced as a 502 from the provider with nothing
+ * anywhere naming the cause; the sale is still refused the same way, but now
+ * somebody can find out why.
+ */ export function merchantAccountIsReady(input, context) {
+    const readiness = merchantAccountReadiness(input);
+    if (readiness === 'mode-mismatch' || readiness === 'mode-unverified') {
+        console.error(`[AGL-2471] Refusing a charge against ${paymentProvider().id} account ` + `${String(input.accountId)}${(context == null ? void 0 : context.subject) ? ` (${context.subject})` : ''}: ${readiness}. The stored account is not verified for this ` + `deployment's payment mode; the merchant must re-onboard.`);
+    }
+    return readiness === 'ready';
+}
+
+//# sourceMappingURL=payment-provider.js.map

package/src/lib/server/payment-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-provider.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { STRIPE_CONNECT_PAYMENT_PROVIDER } from './payment-provider-stripe-connect'\n\n/**\n * The merchant's payment account — the one seam the payment vendor lives\n * behind when a TENANT takes money.\n *\n * ## Which money this is, and which it is not\n *\n * Two different accounts move money on this platform and only one of them is\n * here. The platform BILLS its customers — plans, add-ons, metered usage — on\n * its own account; that rail is infrastructure (`org-billing.ts`, the billing\n * webhook route, `api-idempotency.ts`, `stripe-deployment-mode.ts`) and names\n * its vendor where it runs. A tenant SELLS — a storefront order, a booked\n * appointment, a marketplace listing — into a connected merchant account of\n * its own, and every plugin that takes money reaches that account through\n * this contract: whether the account may be charged, which world (live or\n * test) the platform charges in, and what the provider says when the account\n * changes or a payout fails.\n *\n * Commerce's `PaymentProviderId` names the provider a CHECKOUT is created\n * with. This is the other half: the account the checkout pays into.\n *\n * ## One adapter, compiled in, and no registry — by failure direction\n *\n * Stripe Connect is the only adapter\n * (`payment-provider-stripe-connect.ts`), and {@link paymentProvider} returns\n * it without consulting any registry, the way the domain driver's built-ins\n * and the mail rail's are compiled into their libraries. A provider a plugin\n * registered could be ABSENT where a door reads it — a declaration that threw\n * part-way, a route bundle that evaluated the registry apart from boot's —\n * and every answer an absent provider could give at a money door is wrong: a\n * refusal takes every sale on every site down, and a default lets a checkout\n * proceed against an account nobody checked. Compiled in, it cannot be\n * absent, so neither can happen.\n *\n * It lives in this library rather than in a plugin because three plugins take\n * money into the same account — a storefront, a calendar and the marketplace\n * — and one plugin may not import another. A plugin that owned the adapter\n * would make the other two's sales depend on its install and on its\n * registration having run; the adapter itself sells nothing and holds no\n * product, only the platform's own connected-account integration.\n *\n * A second adapter is one module beside the first and a selector here. There\n * is no selector today because there is nothing to select: every plugin's\n * checkout is created against the same vendor.\n *\n * ## The contract every adapter owes\n *\n * 1. **An account the provider did not describe is never ready.** Every\n *    {@link MerchantAccountReadiness} other than `'ready'` refuses the charge,\n *    and only a literal boolean is a recorded answer.\n * 2. **Only what the provider stated is written.** An account event that\n *    states nothing writes nothing, and a written record never invents a\n *    `false` or a `true` from an absent field.\n * 3. **Failures propagate.** {@link PaymentProvider.applyAccountEvent} runs\n *    inside the platform's billing webhook, and a throw is what earns the\n *    redelivery; every write it makes is idempotent so that redelivery\n *    converges.\n */\n\n/** Which world a platform credential or a merchant account charges in. */\nexport type PaymentMode = 'live' | 'test'\n\n/**\n * Why a stored merchant account may not be charged against. Every value\n * other than `'ready'` is a refusal.\n */\nexport type MerchantAccountReadiness =\n  /** Charge away. */\n  | 'ready'\n  /** No merchant account is stored at all — the onboarding call to action. */\n  | 'not-connected'\n  /** The provider will not let this account take charges. */\n  | 'charges-disabled'\n  /**\n   * The account's mode was never recorded (AGL-2471) AND this deployment is\n   * LIVE. The onboarding route and the provider's account event both record\n   * it, so a genuine merchant self-heals on the next of either.\n   */\n  | 'mode-unverified'\n  /** The account belongs to the OTHER world. The AGL-2471 defect. */\n  | 'mode-mismatch'\n\nexport interface MerchantAccountReadinessInput {\n  /** The stored account id, whatever shape the document has. */\n  accountId?: unknown\n  /** Whether the provider said the account may take charges. */\n  chargesEnabled?: unknown\n  /** Whether the provider said the account is live — absent before AGL-2471. */\n  accountLivemode?: unknown\n  /** Defaults to {@link PaymentProvider.platformMode}. */\n  platformMode?: PaymentMode | undefined\n}\n\n/** One event the platform's billing webhook received, as the provider sent it. */\nexport interface PaymentProviderEvent {\n  /** The provider's own name for the event. */\n  type: string\n  /** The object the event describes. */\n  object: unknown\n  /** The whole event as delivered. */\n  event: unknown\n}\n\nexport interface PaymentProvider {\n  /** Stable id, for log lines. Never a display name. */\n  readonly id: string\n  /**\n   * The mode this deployment's platform credential states about itself, read\n   * without a network call; `undefined` when there is no credential or it\n   * states nothing.\n   */\n  platformMode(): PaymentMode | undefined\n  /**\n   * The platform's mode, asked of the provider first and the credential\n   * second — what an onboarding route records against a merchant account it\n   * has just retrieved.\n   */\n  resolvePlatformMode(): Promise<PaymentMode | undefined>\n  /**\n   * Applies an event about a connected merchant account — its readiness\n   * changed, a payout to it failed, a later payout landed — to the documents\n   * in `collection` that store it. A plugin passes the collection holding ITS\n   * merchant profiles; a non-matching account updates nothing.\n   *\n   * @returns `true` when the event was about a merchant account and has been\n   *   applied, so the caller's own sections have nothing to do with it;\n   *   `false` for every other event.\n   */\n  applyAccountEvent(\n    collection: string,\n    delivered: PaymentProviderEvent,\n  ): Promise<boolean>\n}\n\n/** The provider every merchant account on this deployment is held at. */\nexport function paymentProvider(): PaymentProvider {\n  return STRIPE_CONNECT_PAYMENT_PROVIDER\n}\n\n/**\n * Decides whether a stored merchant account may be charged against.\n *\n * Order matters: the two refusals that existed before AGL-2471 are asked\n * first, so an unconnected or restricted merchant still gets the answer they\n * always got, and only an account that WOULD have passed reaches the mode\n * question.\n *\n * WHY THE MODE RULE IS ASYMMETRIC, AND NOT \"REFUSE ANYTHING UNPROVEN\". An\n * unrecorded mode refuses only on a LIVE deployment. That is where real money\n * moves, and a live deployment can always re-establish the field: the\n * merchant reconnects, or the provider sends one account event. Everywhere\n * else — a test deployment, a developer machine, a self-hosted install still\n * in sandbox, the whole test suite — an unverified account keeps the\n * behavior it had before, because no real money can move there and the\n * provider enforces the mode boundary itself. A PROVEN mismatch is refused in\n * both directions, because it costs nothing to detect and is never right.\n */\nexport function merchantAccountReadiness(\n  input: MerchantAccountReadinessInput,\n): MerchantAccountReadiness {\n  const accountId =\n    typeof input.accountId === 'string' ? input.accountId.trim() : ''\n  if (!accountId) return 'not-connected'\n  if (input.chargesEnabled !== true) return 'charges-disabled'\n  const platformMode =\n    'platformMode' in input\n      ? input.platformMode\n      : paymentProvider().platformMode()\n  // Three-valued on purpose, exactly as AGL-1997 reads `payoutsEnabled`: only\n  // a literal boolean is a recorded answer. A string `'true'` or a `1` is a\n  // field somebody else wrote, and inventing `true` from it would re-open the\n  // hole this closes.\n  if (typeof input.accountLivemode === 'boolean') {\n    // A PROVEN mismatch is refused in either direction. It costs nothing to\n    // detect and it is always wrong.\n    if (!platformMode) return 'ready'\n    return input.accountLivemode === (platformMode === 'live')\n      ? 'ready'\n      : 'mode-mismatch'\n  }\n  return platformMode === 'live' ? 'mode-unverified' : 'ready'\n}\n\n/**\n * The form every money door calls: `true` only when the account may be\n * charged, with the two mode refusals reported to the server log.\n *\n * The log line is the part the shopper's generic 409 cannot carry. Before\n * this, a mode mismatch surfaced as a 502 from the provider with nothing\n * anywhere naming the cause; the sale is still refused the same way, but now\n * somebody can find out why.\n */\nexport function merchantAccountIsReady(\n  input: MerchantAccountReadinessInput,\n  context?: { subject?: string },\n): boolean {\n  const readiness = merchantAccountReadiness(input)\n  if (readiness === 'mode-mismatch' || readiness === 'mode-unverified') {\n    console.error(\n      `[AGL-2471] Refusing a charge against ${paymentProvider().id} account ` +\n        `${String(input.accountId)}${\n          context?.subject ? ` (${context.subject})` : ''\n        }: ${readiness}. The stored account is not verified for this ` +\n        `deployment's payment mode; the merchant must re-onboard.`,\n    )\n  }\n  return readiness === 'ready'\n}\n"],"names":["STRIPE_CONNECT_PAYMENT_PROVIDER","paymentProvider","merchantAccountReadiness","input","accountId","trim","chargesEnabled","platformMode","accountLivemode","merchantAccountIsReady","context","readiness","console","error","id","String","subject"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,+BAA+B,QAAQ,uCAAmC;AAuInF,uEAAuE,GACvE,OAAO,SAASC;IACd,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASE,yBACdC,KAAoC;IAEpC,MAAMC,YACJ,OAAOD,MAAMC,SAAS,KAAK,WAAWD,MAAMC,SAAS,CAACC,IAAI,KAAK;IACjE,IAAI,CAACD,WAAW,OAAO;IACvB,IAAID,MAAMG,cAAc,KAAK,MAAM,OAAO;IAC1C,MAAMC,eACJ,kBAAkBJ,QACdA,MAAMI,YAAY,GAClBN,kBAAkBM,YAAY;IACpC,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,oBAAoB;IACpB,IAAI,OAAOJ,MAAMK,eAAe,KAAK,WAAW;QAC9C,wEAAwE;QACxE,iCAAiC;QACjC,IAAI,CAACD,cAAc,OAAO;QAC1B,OAAOJ,MAAMK,eAAe,KAAMD,CAAAA,iBAAiB,MAAK,IACpD,UACA;IACN;IACA,OAAOA,iBAAiB,SAAS,oBAAoB;AACvD;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASE,uBACdN,KAAoC,EACpCO,OAA8B;IAE9B,MAAMC,YAAYT,yBAAyBC;IAC3C,IAAIQ,cAAc,mBAAmBA,cAAc,mBAAmB;QACpEC,QAAQC,KAAK,CACX,CAAC,qCAAqC,EAAEZ,kBAAkBa,EAAE,CAAC,SAAS,CAAC,GACrE,GAAGC,OAAOZ,MAAMC,SAAS,IACvBM,CAAAA,2BAAAA,QAASM,OAAO,IAAG,CAAC,EAAE,EAAEN,QAAQM,OAAO,CAAC,CAAC,CAAC,GAAG,GAC9C,EAAE,EAAEL,UAAU,8CAA8C,CAAC,GAC9D,CAAC,wDAAwD,CAAC;IAEhE;IACA,OAAOA,cAAc;AACvB"}

package/src/lib/server/payment-risk-record.d.ts

@@ -16,7 +16,7 @@
  */
 import { type PaymentRiskSignal, type PaymentRiskSignalKind } from '@aglyn/aglyn/app-utils/payment-risk';
 import type { AglynNotificationType } from '@aglyn/aglyn/app-utils/notifications';
-import type { RiskEventKind } from '@aglyn/shared-util-email/risk-notice-catalog';
+import { type RiskEventKind } from '@aglyn/shared-util-email/risk-notice-catalog';
 import type { RiskEventInput } from './risk-notice';
 /**
  * The notifier's shape: `notifyRiskEvent` from the admin barrel (AGL-3368),

package/src/lib/server/payment-risk-record.js

@@ -30,6 +30,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * Dependencies are passed in — the Firestore handle and the notifier — so a
  * plugin's spec that substitutes the admin barrel substitutes these too.
  *=========================================*/ import { addPaymentRiskSignal, PAYMENT_RISK_FIELD, settlePaymentRiskDispute } from "@aglyn/aglyn/app-utils/payment-risk";
+import { RISK_PAYMENT_EVENTS } from "@aglyn/shared-util-email/risk-notice-catalog";
 /** The risk notice each Stripe signal on a sale is told as. */ export const PAYMENT_RISK_NOTICE_KINDS = {
     'early-fraud-warning': 'sale-fraud-warning',
     'radar-review': 'sale-payment-review',
@@ -54,7 +55,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
         return true;
     });
     if (written && (input.hostId || input.orgId)) {
-        var _input_noticeKind, _input_orgId, _input_amount, _input_evidenceDueByMs;
+        var _input_noticeKind, _input_orgId, _input_amount, _RISK_PAYMENT_EVENTS_input_signal_kind, _input_evidenceDueByMs;
         await deps.notifyRisk({
             kind: (_input_noticeKind = input.noticeKind) != null ? _input_noticeKind : PAYMENT_RISK_NOTICE_KINDS[input.signal.kind],
             orgId: (_input_orgId = input.orgId) != null ? _input_orgId : null,
@@ -65,6 +66,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
             },
             occurredAtMs: input.signal.atMs,
             amount: (_input_amount = input.amount) != null ? _input_amount : null,
+            paymentEvent: (_RISK_PAYMENT_EVENTS_input_signal_kind = RISK_PAYMENT_EVENTS[input.signal.kind]) != null ? _RISK_PAYMENT_EVENTS_input_signal_kind : null,
             evidenceDueByMs: (_input_evidenceDueByMs = input.evidenceDueByMs) != null ? _input_evidenceDueByMs : null,
             dedupeKey: `sale:${input.signal.stripeObjectId}`,
             staffEvidence: input.signal.detail ? `Stripe says: ${input.signal.detail.replace(/_/g, ' ')}.` : null

package/src/lib/server/payment-risk-record.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-risk-record.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * STAMP A STRIPE FRAUD SIGNAL ON A MERCHANT'S RECORD (AGL-3360).\n *\n * The server half of `@aglyn/aglyn/app-utils/payment-risk`. A plugin that\n * finds its own record behind a charge — an order, a booking — hands the\n * document here, and this writes the `paymentRisk` field once per signal and\n * tells the site's managers and the workspace's owners once, through the\n * risk notice seam (AGL-3368). Any plugin that sells through Stripe uses\n * the same two calls; nothing about the record's kind is known here.\n *\n * NOTHING IS REFUNDED OR CANCELED. The merchant decides for their own\n * customer; the notification says so.\n *\n * Dependencies are passed in — the Firestore handle and the notifier — so a\n * plugin's spec that substitutes the admin barrel substitutes these too.\n *=========================================*/\n\nimport {\n  addPaymentRiskSignal,\n  PAYMENT_RISK_FIELD,\n  type PaymentRisk,\n  type PaymentRiskSignal,\n  type PaymentRiskSignalKind,\n  settlePaymentRiskDispute,\n} from '@aglyn/aglyn/app-utils/payment-risk'\nimport type { AglynNotificationType } from '@aglyn/aglyn/app-utils/notifications'\nimport type { RiskEventKind } from '@aglyn/shared-util-email/risk-notice-catalog'\nimport type { RiskEventInput } from './risk-notice'\n\n/**\n * The notifier's shape: `notifyRiskEvent` from the admin barrel (AGL-3368),\n * which tells the site's managers and the workspace's owners and admins what\n * arrived, what it means, and how to refund, keep or answer it.\n */\nexport type PaymentRiskNotifier = (input: RiskEventInput) => Promise<unknown>\n\n/** The risk notice each Stripe signal on a sale is told as. */\nexport const PAYMENT_RISK_NOTICE_KINDS: Record<PaymentRiskSignalKind, RiskEventKind> = {\n  'early-fraud-warning': 'sale-fraud-warning',\n  'radar-review': 'sale-payment-review',\n  dispute: 'sale-dispute',\n}\n\nexport interface RecordPaymentRiskInput {\n  ref: FirebaseFirestore.DocumentReference\n  signal: PaymentRiskSignal\n  /** The site whose managers are told. Empty tells only `orgId`'s owners. */\n  hostId: string\n  /**\n   * The workspace told when the record belongs to no site — a marketplace\n   * sale's publisher. Resolved from the site otherwise.\n   */\n  orgId?: string | null\n  /**\n   * The notice to send, when the record's owner cannot act the way a shop\n   * does on its own sale (a marketplace publisher cannot refund a charge the\n   * platform is merchant of record for). Defaults by signal kind.\n   */\n  noticeKind?: RiskEventKind\n  /** What the record is, as the merchant calls it: `Order 1042`, `Booking`. */\n  subjectLabel: string\n  /**\n   * The console path the notice's actions open, in the stored-notification\n   * shape (`/{hostId}/…`) — the order's own dialog, the Bookings page.\n   */\n  link: string\n  /**\n   * The plugin's own notification type. Kept for the record's callers; the\n   * notice itself is always a `system.riskNotice` now.\n   */\n  notificationType?: AglynNotificationType\n  /** `$56.00 USD`, when the plugin knows the amount. */\n  amount?: string | null\n  /** A dispute's evidence deadline, when the plugin knows it. */\n  evidenceDueByMs?: number | null\n  /**\n   * More fields to write in the same transaction, from the record as read —\n   * a plugin's own activity line (an order's timeline) rides here.\n   */\n  extraUpdate?: (data: Record<string, unknown>) => Record<string, unknown>\n}\n\n/**\n * Stamp `signal` on `input.ref` and notify, once. Returns true when this\n * delivery wrote it; false for a redelivery or a record that is gone.\n * Throws only when the write throws, which the webhook answers with a 500 and\n * Stripe's redelivery.\n */\nexport async function recordPaymentRiskOnRecord(\n  input: RecordPaymentRiskInput,\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notifyRisk: PaymentRiskNotifier\n  },\n): Promise<boolean> {\n  const written = await deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(input.ref)\n    if (!fresh.exists) return false\n    const data = (fresh.data() ?? {}) as Record<string, unknown>\n    const next = addPaymentRiskSignal(\n      data[PAYMENT_RISK_FIELD] as PaymentRisk | undefined,\n      input.signal,\n    )\n    if (!next) return false\n    transaction.update(input.ref, {\n      ...(input.extraUpdate ? input.extraUpdate(data) : {}),\n      [PAYMENT_RISK_FIELD]: next,\n    })\n    return true\n  })\n  if (written && (input.hostId || input.orgId)) {\n    await deps\n      .notifyRisk({\n        kind: input.noticeKind ?? PAYMENT_RISK_NOTICE_KINDS[input.signal.kind],\n        orgId: input.orgId ?? null,\n        hostId: input.hostId || null,\n        item: { label: input.subjectLabel, path: input.link },\n        occurredAtMs: input.signal.atMs,\n        amount: input.amount ?? null,\n        evidenceDueByMs: input.evidenceDueByMs ?? null,\n        dedupeKey: `sale:${input.signal.stripeObjectId}`,\n        staffEvidence: input.signal.detail\n          ? `Stripe says: ${input.signal.detail.replace(/_/g, ' ')}.`\n          : null,\n      })\n      .catch(() => undefined)\n  }\n  return written\n}\n\n/**\n * Record a dispute's outcome on the signal already stamped for it. Silent:\n * the plugin that owns money movement on a lost dispute says so itself.\n */\nexport async function settlePaymentRiskDisputeOnRecord(\n  ref: FirebaseFirestore.DocumentReference,\n  disputeId: string,\n  outcome: string,\n  deps: { firestore: FirebaseFirestore.Firestore },\n): Promise<boolean> {\n  return deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(ref)\n    if (!fresh.exists) return false\n    const next = settlePaymentRiskDispute(\n      fresh.get(PAYMENT_RISK_FIELD) as PaymentRisk | undefined,\n      disputeId,\n      outcome,\n    )\n    if (!next) return false\n    transaction.update(ref, { [PAYMENT_RISK_FIELD]: next })\n    return true\n  })\n}\n"],"names":["addPaymentRiskSignal","PAYMENT_RISK_FIELD","settlePaymentRiskDispute","PAYMENT_RISK_NOTICE_KINDS","dispute","recordPaymentRiskOnRecord","input","deps","written","firestore","runTransaction","transaction","fresh","get","ref","exists","data","next","signal","update","extraUpdate","hostId","orgId","notifyRisk","kind","noticeKind","item","label","subjectLabel","path","link","occurredAtMs","atMs","amount","evidenceDueByMs","dedupeKey","stripeObjectId","staffEvidence","detail","replace","catch","undefined","settlePaymentRiskDisputeOnRecord","disputeId","outcome"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;2CAe2C,GAE3C,SACEA,oBAAoB,EACpBC,kBAAkB,EAIlBC,wBAAwB,QACnB,sCAAqC;AAY5C,6DAA6D,GAC7D,OAAO,MAAMC,4BAA0E;IACrF,uBAAuB;IACvB,gBAAgB;IAChBC,SAAS;AACX,EAAC;AAyCD;;;;;CAKC,GACD,OAAO,eAAeC,0BACpBC,KAA6B,EAC7BC,IAGC;IAED,MAAMC,UAAU,MAAMD,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;YAG3CC;QAFd,MAAMA,QAAQ,MAAMD,YAAYE,GAAG,CAACP,MAAMQ,GAAG;QAC7C,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAMC,QAAQJ,cAAAA,MAAMI,IAAI,cAAVJ,cAAgB,CAAC;QAC/B,MAAMK,OAAOjB,qBACXgB,IAAI,CAACf,mBAAmB,EACxBK,MAAMY,MAAM;QAEd,IAAI,CAACD,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACb,MAAMQ,GAAG,EAAE,aACxBR,MAAMc,WAAW,GAAGd,MAAMc,WAAW,CAACJ,QAAQ,CAAC;YACnD,CAACf,mBAAmB,EAAEgB;;QAExB,OAAO;IACT;IACA,IAAIT,WAAYF,CAAAA,MAAMe,MAAM,IAAIf,MAAMgB,KAAK,AAAD,GAAI;YAGlChB,mBACCA,cAICA,eACSA;QARrB,MAAMC,KACHgB,UAAU,CAAC;YACVC,IAAI,GAAElB,oBAAAA,MAAMmB,UAAU,YAAhBnB,oBAAoBH,yBAAyB,CAACG,MAAMY,MAAM,CAACM,IAAI,CAAC;YACtEF,KAAK,GAAEhB,eAAAA,MAAMgB,KAAK,YAAXhB,eAAe;YACtBe,QAAQf,MAAMe,MAAM,IAAI;YACxBK,MAAM;gBAAEC,OAAOrB,MAAMsB,YAAY;gBAAEC,MAAMvB,MAAMwB,IAAI;YAAC;YACpDC,cAAczB,MAAMY,MAAM,CAACc,IAAI;YAC/BC,MAAM,GAAE3B,gBAAAA,MAAM2B,MAAM,YAAZ3B,gBAAgB;YACxB4B,eAAe,GAAE5B,yBAAAA,MAAM4B,eAAe,YAArB5B,yBAAyB;YAC1C6B,WAAW,CAAC,KAAK,EAAE7B,MAAMY,MAAM,CAACkB,cAAc,EAAE;YAChDC,eAAe/B,MAAMY,MAAM,CAACoB,MAAM,GAC9B,CAAC,aAAa,EAAEhC,MAAMY,MAAM,CAACoB,MAAM,CAACC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,GACzD;QACN,GACCC,KAAK,CAAC,IAAMC;IACjB;IACA,OAAOjC;AACT;AAEA;;;CAGC,GACD,OAAO,eAAekC,iCACpB5B,GAAwC,EACxC6B,SAAiB,EACjBC,OAAe,EACfrC,IAAgD;IAEhD,OAAOA,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;QAC1C,MAAMC,QAAQ,MAAMD,YAAYE,GAAG,CAACC;QACpC,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAME,OAAOf,yBACXU,MAAMC,GAAG,CAACZ,qBACV0C,WACAC;QAEF,IAAI,CAAC3B,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACL,KAAK;YAAE,CAACb,mBAAmB,EAAEgB;QAAK;QACrD,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-risk-record.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * STAMP A STRIPE FRAUD SIGNAL ON A MERCHANT'S RECORD (AGL-3360).\n *\n * The server half of `@aglyn/aglyn/app-utils/payment-risk`. A plugin that\n * finds its own record behind a charge — an order, a booking — hands the\n * document here, and this writes the `paymentRisk` field once per signal and\n * tells the site's managers and the workspace's owners once, through the\n * risk notice seam (AGL-3368). Any plugin that sells through Stripe uses\n * the same two calls; nothing about the record's kind is known here.\n *\n * NOTHING IS REFUNDED OR CANCELED. The merchant decides for their own\n * customer; the notification says so.\n *\n * Dependencies are passed in — the Firestore handle and the notifier — so a\n * plugin's spec that substitutes the admin barrel substitutes these too.\n *=========================================*/\n\nimport {\n  addPaymentRiskSignal,\n  PAYMENT_RISK_FIELD,\n  type PaymentRisk,\n  type PaymentRiskSignal,\n  type PaymentRiskSignalKind,\n  settlePaymentRiskDispute,\n} from '@aglyn/aglyn/app-utils/payment-risk'\nimport type { AglynNotificationType } from '@aglyn/aglyn/app-utils/notifications'\nimport {\n  RISK_PAYMENT_EVENTS,\n  type RiskEventKind,\n} from '@aglyn/shared-util-email/risk-notice-catalog'\nimport type { RiskEventInput } from './risk-notice'\n\n/**\n * The notifier's shape: `notifyRiskEvent` from the admin barrel (AGL-3368),\n * which tells the site's managers and the workspace's owners and admins what\n * arrived, what it means, and how to refund, keep or answer it.\n */\nexport type PaymentRiskNotifier = (input: RiskEventInput) => Promise<unknown>\n\n/** The risk notice each Stripe signal on a sale is told as. */\nexport const PAYMENT_RISK_NOTICE_KINDS: Record<PaymentRiskSignalKind, RiskEventKind> = {\n  'early-fraud-warning': 'sale-fraud-warning',\n  'radar-review': 'sale-payment-review',\n  dispute: 'sale-dispute',\n}\n\nexport interface RecordPaymentRiskInput {\n  ref: FirebaseFirestore.DocumentReference\n  signal: PaymentRiskSignal\n  /** The site whose managers are told. Empty tells only `orgId`'s owners. */\n  hostId: string\n  /**\n   * The workspace told when the record belongs to no site — a marketplace\n   * sale's publisher. Resolved from the site otherwise.\n   */\n  orgId?: string | null\n  /**\n   * The notice to send, when the record's owner cannot act the way a shop\n   * does on its own sale (a marketplace publisher cannot refund a charge the\n   * platform is merchant of record for). Defaults by signal kind.\n   */\n  noticeKind?: RiskEventKind\n  /** What the record is, as the merchant calls it: `Order 1042`, `Booking`. */\n  subjectLabel: string\n  /**\n   * The console path the notice's actions open, in the stored-notification\n   * shape (`/{hostId}/…`) — the order's own dialog, the Bookings page.\n   */\n  link: string\n  /**\n   * The plugin's own notification type. Kept for the record's callers; the\n   * notice itself is always a `system.riskNotice` now.\n   */\n  notificationType?: AglynNotificationType\n  /** `$56.00 USD`, when the plugin knows the amount. */\n  amount?: string | null\n  /** A dispute's evidence deadline, when the plugin knows it. */\n  evidenceDueByMs?: number | null\n  /**\n   * More fields to write in the same transaction, from the record as read —\n   * a plugin's own activity line (an order's timeline) rides here.\n   */\n  extraUpdate?: (data: Record<string, unknown>) => Record<string, unknown>\n}\n\n/**\n * Stamp `signal` on `input.ref` and notify, once. Returns true when this\n * delivery wrote it; false for a redelivery or a record that is gone.\n * Throws only when the write throws, which the webhook answers with a 500 and\n * Stripe's redelivery.\n */\nexport async function recordPaymentRiskOnRecord(\n  input: RecordPaymentRiskInput,\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notifyRisk: PaymentRiskNotifier\n  },\n): Promise<boolean> {\n  const written = await deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(input.ref)\n    if (!fresh.exists) return false\n    const data = (fresh.data() ?? {}) as Record<string, unknown>\n    const next = addPaymentRiskSignal(\n      data[PAYMENT_RISK_FIELD] as PaymentRisk | undefined,\n      input.signal,\n    )\n    if (!next) return false\n    transaction.update(input.ref, {\n      ...(input.extraUpdate ? input.extraUpdate(data) : {}),\n      [PAYMENT_RISK_FIELD]: next,\n    })\n    return true\n  })\n  if (written && (input.hostId || input.orgId)) {\n    await deps\n      .notifyRisk({\n        kind: input.noticeKind ?? PAYMENT_RISK_NOTICE_KINDS[input.signal.kind],\n        orgId: input.orgId ?? null,\n        hostId: input.hostId || null,\n        item: { label: input.subjectLabel, path: input.link },\n        occurredAtMs: input.signal.atMs,\n        amount: input.amount ?? null,\n        paymentEvent: RISK_PAYMENT_EVENTS[input.signal.kind] ?? null,\n        evidenceDueByMs: input.evidenceDueByMs ?? null,\n        dedupeKey: `sale:${input.signal.stripeObjectId}`,\n        staffEvidence: input.signal.detail\n          ? `Stripe says: ${input.signal.detail.replace(/_/g, ' ')}.`\n          : null,\n      })\n      .catch(() => undefined)\n  }\n  return written\n}\n\n/**\n * Record a dispute's outcome on the signal already stamped for it. Silent:\n * the plugin that owns money movement on a lost dispute says so itself.\n */\nexport async function settlePaymentRiskDisputeOnRecord(\n  ref: FirebaseFirestore.DocumentReference,\n  disputeId: string,\n  outcome: string,\n  deps: { firestore: FirebaseFirestore.Firestore },\n): Promise<boolean> {\n  return deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(ref)\n    if (!fresh.exists) return false\n    const next = settlePaymentRiskDispute(\n      fresh.get(PAYMENT_RISK_FIELD) as PaymentRisk | undefined,\n      disputeId,\n      outcome,\n    )\n    if (!next) return false\n    transaction.update(ref, { [PAYMENT_RISK_FIELD]: next })\n    return true\n  })\n}\n"],"names":["addPaymentRiskSignal","PAYMENT_RISK_FIELD","settlePaymentRiskDispute","RISK_PAYMENT_EVENTS","PAYMENT_RISK_NOTICE_KINDS","dispute","recordPaymentRiskOnRecord","input","deps","written","firestore","runTransaction","transaction","fresh","get","ref","exists","data","next","signal","update","extraUpdate","hostId","orgId","notifyRisk","kind","noticeKind","item","label","subjectLabel","path","link","occurredAtMs","atMs","amount","paymentEvent","evidenceDueByMs","dedupeKey","stripeObjectId","staffEvidence","detail","replace","catch","undefined","settlePaymentRiskDisputeOnRecord","disputeId","outcome"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;2CAe2C,GAE3C,SACEA,oBAAoB,EACpBC,kBAAkB,EAIlBC,wBAAwB,QACnB,sCAAqC;AAE5C,SACEC,mBAAmB,QAEd,+CAA8C;AAUrD,6DAA6D,GAC7D,OAAO,MAAMC,4BAA0E;IACrF,uBAAuB;IACvB,gBAAgB;IAChBC,SAAS;AACX,EAAC;AAyCD;;;;;CAKC,GACD,OAAO,eAAeC,0BACpBC,KAA6B,EAC7BC,IAGC;IAED,MAAMC,UAAU,MAAMD,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;YAG3CC;QAFd,MAAMA,QAAQ,MAAMD,YAAYE,GAAG,CAACP,MAAMQ,GAAG;QAC7C,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAMC,QAAQJ,cAAAA,MAAMI,IAAI,cAAVJ,cAAgB,CAAC;QAC/B,MAAMK,OAAOlB,qBACXiB,IAAI,CAAChB,mBAAmB,EACxBM,MAAMY,MAAM;QAEd,IAAI,CAACD,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACb,MAAMQ,GAAG,EAAE,aACxBR,MAAMc,WAAW,GAAGd,MAAMc,WAAW,CAACJ,QAAQ,CAAC;YACnD,CAAChB,mBAAmB,EAAEiB;;QAExB,OAAO;IACT;IACA,IAAIT,WAAYF,CAAAA,MAAMe,MAAM,IAAIf,MAAMgB,KAAK,AAAD,GAAI;YAGlChB,mBACCA,cAICA,eACMJ,wCACGI;QATrB,MAAMC,KACHgB,UAAU,CAAC;YACVC,IAAI,GAAElB,oBAAAA,MAAMmB,UAAU,YAAhBnB,oBAAoBH,yBAAyB,CAACG,MAAMY,MAAM,CAACM,IAAI,CAAC;YACtEF,KAAK,GAAEhB,eAAAA,MAAMgB,KAAK,YAAXhB,eAAe;YACtBe,QAAQf,MAAMe,MAAM,IAAI;YACxBK,MAAM;gBAAEC,OAAOrB,MAAMsB,YAAY;gBAAEC,MAAMvB,MAAMwB,IAAI;YAAC;YACpDC,cAAczB,MAAMY,MAAM,CAACc,IAAI;YAC/BC,MAAM,GAAE3B,gBAAAA,MAAM2B,MAAM,YAAZ3B,gBAAgB;YACxB4B,YAAY,GAAEhC,yCAAAA,mBAAmB,CAACI,MAAMY,MAAM,CAACM,IAAI,CAAC,YAAtCtB,yCAA0C;YACxDiC,eAAe,GAAE7B,yBAAAA,MAAM6B,eAAe,YAArB7B,yBAAyB;YAC1C8B,WAAW,CAAC,KAAK,EAAE9B,MAAMY,MAAM,CAACmB,cAAc,EAAE;YAChDC,eAAehC,MAAMY,MAAM,CAACqB,MAAM,GAC9B,CAAC,aAAa,EAAEjC,MAAMY,MAAM,CAACqB,MAAM,CAACC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,GACzD;QACN,GACCC,KAAK,CAAC,IAAMC;IACjB;IACA,OAAOlC;AACT;AAEA;;;CAGC,GACD,OAAO,eAAemC,iCACpB7B,GAAwC,EACxC8B,SAAiB,EACjBC,OAAe,EACftC,IAAgD;IAEhD,OAAOA,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;QAC1C,MAAMC,QAAQ,MAAMD,YAAYE,GAAG,CAACC;QACpC,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAME,OAAOhB,yBACXW,MAAMC,GAAG,CAACb,qBACV4C,WACAC;QAEF,IAAI,CAAC5B,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACL,KAAK;YAAE,CAACd,mBAAmB,EAAEiB;QAAK;QACrD,OAAO;IACT;AACF"}

package/src/lib/server/personal-data-export.js

@@ -118,7 +118,7 @@ const firestoreApp = ()=>firebaseAdmin.app().firestore();
             'org'
         ],
         exported: true,
-        note: 'Each site tree the org owns — screens, layouts, orders, form submissions. Secrets within are redacted, not omitted, so the export still says a webhook exists.'
+        note: 'Each site tree the org owns — pages, layouts, orders, form submissions. Secrets within are redacted, not omitted, so the export still says a webhook exists.'
     },
     {
         collection: 'hostIndex',