@aglyn/tenant-data-admin 1.0.0-beta.222 → 1.0.0-beta.223

package/src/lib/server/payment-fraud-signal.d.ts

@@ -35,7 +35,7 @@ export interface PaymentFraudCardChecks {
 }
 export interface PaymentFraudSignal {
     kind: PaymentFraudSignalKind;
-    /** The EFW, review or dispute id: one row per signal, whatever redelivers. */
+    /** The EFW, review or dispute id: one entry per signal, whatever redelivers. */
     stripeObjectId: string;
     chargeId: string | null;
     paymentIntentId: string | null;
@@ -49,8 +49,25 @@ export interface PaymentFraudSignal {
     checks: PaymentFraudCardChecks | null;
     livemode: boolean;
 }
-/** The row id: hex, so the admin route's id pattern addresses it. */
-export declare function paymentFraudSignalReviewId(kind: PaymentFraudSignalKind, stripeObjectId: string): string;
+/**
+ * The row id: one per CHARGE (AGL-3490), so every signal about one payment
+ * lands on the same row. The payment intent stands in for a signal that
+ * names no charge, and the signal itself for one that names neither. Hex,
+ * so the admin route's id pattern addresses it.
+ */
+export declare function paymentFraudSignalReviewId(signal: Pick<PaymentFraudSignal, 'kind' | 'stripeObjectId' | 'chargeId' | 'paymentIntentId'>): string;
+/** One signal as the row's history keeps it (AGL-3490). */
+export interface PaymentFraudSignalEntry {
+    kind: PaymentFraudSignalKind;
+    stripeObjectId: string;
+    detail: string;
+    atMs: number;
+    /**
+     * The row's status when this signal arrived, if staff had already closed
+     * it — `actioned` or `dismissed` — else null.
+     */
+    arrivedAfter: string | null;
+}
 /** The staff-facing reference, beside the intake's `AR-` and the screen's `HS-`. */
 export declare function paymentFraudSignalReference(reviewId: string): string;
 /** Where staff act on the workspace's billing: its Subscription card. */
@@ -92,23 +109,46 @@ export declare function readStripeChargeForSignal(chargeId: string, options: {
      */
     sellerAccountId: string | null;
 } | null>;
-/** The row's prose: what arrived, about which workspace, and what to do. */
-export declare function describePaymentFraudSignal(signal: PaymentFraudSignal): string;
 /**
- * File one signal and tell staff, once per signal.
+ * The row's prose: what arrived, about which workspace, and what to do.
  *
- * Idempotent on the Stripe object id: a redelivery bumps `reportCount` and
- * leaves the row's status — which staff own from the moment they touch it —
- * where it was. Throws only if the row write throws, which is the webhook's
+ * `history` is every signal on the charge, this one last; `closed` is what
+ * staff had decided before it arrived, if anything. The closing line says
+ * what THIS ALERT did — nothing to the money or the subscription — and
+ * never claims nothing was done at all: by the time a late warning lands,
+ * staff may have canceled, locked and accepted the chargeback (AGL-3490).
+ */
+export declare function describePaymentFraudSignal(signal: PaymentFraudSignal, context?: {
+    history?: readonly PaymentFraudSignalEntry[];
+    closed?: {
+        status: string;
+        resolution: string | null;
+    } | null;
+    reopened?: boolean;
+}): string;
+/**
+ * File one signal on its charge's row, and tell the owners and staff once
+ * per charge (AGL-3490).
+ *
+ * The first signal on a charge opens the row. A later one — a different
+ * Stripe object about the same payment — is added to `paymentSignals`, and
+ * `paymentSignal` becomes it, so the row's Stripe link follows a dispute.
+ * The status is staff's from the moment they touch it and is left alone,
+ * except that a dispute on a DISMISSED row reopens it and notifies again. A
+ * redelivery of a signal already on the row adds nothing. Read and written
+ * in one transaction, so a warning and a dispute arriving together still
+ * make one row. Throws only if the row write throws, which is the webhook's
  * to answer; the notification never throws.
  */
 export declare function recordPaymentFraudSignal(signal: PaymentFraudSignal, deps: {
     firestore: FirebaseFirestore.Firestore;
     notifyRisk: RiskNotifier;
+    nowMs?: number;
 }): Promise<{
     reviewId: string;
     reference: string;
     first: boolean;
+    reopened: boolean;
 }>;
 export declare const SELLER_FRAUD_PATTERN: {
     /** Distinct charges with an early fraud warning or a dispute. */

package/src/lib/server/payment-fraud-signal.js

@@ -31,6 +31,19 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * a refund issued before staff look can be the wrong half of a dispute. The
  * row is the prompt; staff decide.
  *
+ * ONE ROW PER CHARGE (AGL-3490). The three signals are separate Stripe
+ * objects about the same payment, and one fraudulent charge routinely draws
+ * two of them — a warning and then a dispute, in either order: the issuer's
+ * fraud report reached Stripe a day AFTER the 9/26 charge's chargeback had
+ * been accepted. Keyed by signal, each one opened its own urgent row and told
+ * the owners and staff again. So the row is keyed by the charge, and a later
+ * signal joins it: added to `paymentSignals`, never a second row or a second
+ * notice. A row staff have closed stays closed — the later signal is written
+ * onto it, beside what they decided — with one exception: a DISPUTE on a row
+ * staff DISMISSED reopens it and tells them, because the bank now says the
+ * cardholder did not make the payment staff judged genuine, and the evidence
+ * deadline is running.
+ *
  * Dependencies are passed in rather than imported — the Firestore handle the
  * webhook observes its writes through, and its staff notifier — so the
  * webhook's "did this delivery do anything" ledger sees the write, and a spec
@@ -45,9 +58,20 @@ const KIND_LABEL = {
     dispute: 'Card dispute opened'
 };
 /** The Stripe object type each signal arrives as, for the queue's text. */ export const PAYMENT_FRAUD_SIGNAL_LABELS = KIND_LABEL;
-/** The row id: hex, so the admin route's id pattern addresses it. */ export function paymentFraudSignalReviewId(kind, stripeObjectId) {
-    return createHash('sha256').update(`stripe-fraud:${kind}:${stripeObjectId}`).digest('hex').slice(0, 40);
+/**
+ * The row id: one per CHARGE (AGL-3490), so every signal about one payment
+ * lands on the same row. The payment intent stands in for a signal that
+ * names no charge, and the signal itself for one that names neither. Hex,
+ * so the admin route's id pattern addresses it.
+ */ export function paymentFraudSignalReviewId(signal) {
+    const payment = signal.chargeId || signal.paymentIntentId;
+    return createHash('sha256').update(payment ? `stripe-fraud:payment:${payment}` : `stripe-fraud:${signal.kind}:${signal.stripeObjectId}`).digest('hex').slice(0, 40);
 }
+/** The row's history is a short list; a charge draws at most a few signals. */ const SIGNAL_HISTORY_MAX = 10;
+/** The statuses that mean staff have decided the row. */ const CLOSED_STATUSES = new Set([
+    'actioned',
+    'dismissed'
+]);
 /** The staff-facing reference, beside the intake's `AR-` and the screen's `HS-`. */ export function paymentFraudSignalReference(reviewId) {
     return `PF-${reviewId.slice(0, 10).toUpperCase()}`;
 }
@@ -113,8 +137,17 @@ const KIND_LABEL = {
     const id = typeof value === 'string' ? value : String((_ref = value == null ? void 0 : value.id) != null ? _ref : '');
     return id.startsWith('acct_') ? id : null;
 }
-/** The row's prose: what arrived, about which workspace, and what to do. */ export function describePaymentFraudSignal(signal) {
-    var _signal_orgId, _ref, _signal_chargeId;
+/**
+ * The row's prose: what arrived, about which workspace, and what to do.
+ *
+ * `history` is every signal on the charge, this one last; `closed` is what
+ * staff had decided before it arrived, if anything. The closing line says
+ * what THIS ALERT did — nothing to the money or the subscription — and
+ * never claims nothing was done at all: by the time a late warning lands,
+ * staff may have canceled, locked and accepted the chargeback (AGL-3490).
+ */ export function describePaymentFraudSignal(signal, context = {}) {
+    var _signal_orgId, _ref, _signal_chargeId, _context_history;
+    var _context_closed;
     const lines = [
         `${KIND_LABEL[signal.kind]} from Stripe (${signal.stripeObjectId})` + (signal.livemode ? '' : ' — TEST MODE') + '.',
         `Workspace: ${(_signal_orgId = signal.orgId) != null ? _signal_orgId : 'none — the charge did not resolve to a workspace subscription'}.`,
@@ -126,57 +159,167 @@ const KIND_LABEL = {
         var _checks_cvcCheck, _checks_addressPostalCodeCheck, _checks_cardCountry, _checks_threeDSecure, _checks_riskLevel;
         lines.push(`Card: CVC ${(_checks_cvcCheck = checks.cvcCheck) != null ? _checks_cvcCheck : 'unknown'}, postal code ${(_checks_addressPostalCodeCheck = checks.addressPostalCodeCheck) != null ? _checks_addressPostalCodeCheck : 'unknown'}, ` + `issued in ${(_checks_cardCountry = checks.cardCountry) != null ? _checks_cardCountry : 'unknown'}, 3DS ${(_checks_threeDSecure = checks.threeDSecure) != null ? _checks_threeDSecure : 'not used'}, ` + `Radar risk ${(_checks_riskLevel = checks.riskLevel) != null ? _checks_riskLevel : 'unknown'}.`);
     }
-    lines.push(signal.kind === 'radar-review' ? 'The payment waits in Stripe until the review is closed there.' : signal.kind === 'dispute' ? 'Answer the dispute in Stripe before its evidence deadline.' : 'An early fraud warning is not yet a chargeback; refunding now can avoid one.', 'Nothing has been refunded or canceled. Decide on the org’s Subscription card, lock the workspace if it is fraud, and close this row with what you did.');
+    const history = (_context_history = context.history) != null ? _context_history : [];
+    if (history.length > 1) {
+        lines.push(`Every signal on this charge, oldest first: ${history.map((entry)=>`${KIND_LABEL[entry.kind]} (${entry.stripeObjectId}` + (entry.arrivedAfter ? `, after the row was ${entry.arrivedAfter}` : '') + ')').join('; ')}.`);
+    }
+    const resolution = ((_context_closed = context.closed) == null ? void 0 : _context_closed.resolution) ? `: “${context.closed.resolution}”` : '.';
+    if (context.reopened && context.closed) {
+        lines.push(`REOPENED. Staff had dismissed this row${resolution} The cardholder’s bank has now disputed the payment. Answer or accept the dispute in Stripe before its evidence deadline, then close this row again with what you did.`);
+    } else if (context.closed) {
+        lines.push(`This signal arrived after the row was closed as ${context.closed.status}${resolution} The row stays closed and nobody was notified again. Reopen it only if that decision no longer holds.`);
+    } else {
+        lines.push(signal.kind === 'radar-review' ? 'The payment waits in Stripe until the review is closed there.' : signal.kind === 'dispute' ? 'Answer the dispute in Stripe before its evidence deadline.' : 'An early fraud warning is not yet a chargeback; refunding now can avoid one.', 'This alert refunded and canceled nothing. Decide on the org’s Subscription card, lock the workspace if it is fraud, and close this row with what you did.');
+    }
     return lines.join('\n').slice(0, 5000);
 }
+/** The history a stored row carries, oldest first. */ function signalHistoryOf(row, fallbackAtMs) {
+    var _row_paymentSignal, _ref, _ref1, _ref2;
+    if (!row) return [];
+    const kinds = Object.keys(KIND_LABEL);
+    const stored = Array.isArray(row['paymentSignals']) ? row['paymentSignals'] : [];
+    const entries = stored.flatMap((value)=>{
+        var _entry_kind, _entry_stripeObjectId, _entry_detail;
+        const entry = value != null ? value : {};
+        const kind = String((_entry_kind = entry['kind']) != null ? _entry_kind : '');
+        const stripeObjectId = String((_entry_stripeObjectId = entry['stripeObjectId']) != null ? _entry_stripeObjectId : '');
+        if (!kinds.includes(kind) || !stripeObjectId) return [];
+        return [
+            {
+                kind: kind,
+                stripeObjectId,
+                detail: String((_entry_detail = entry['detail']) != null ? _entry_detail : ''),
+                atMs: Number(entry['atMs']) || 0,
+                arrivedAfter: typeof entry['arrivedAfter'] === 'string' ? entry['arrivedAfter'] : null
+            }
+        ];
+    });
+    if (entries.length) return entries;
+    // A row filed before the history existed carries its one signal as
+    // `paymentSignal`, which is where a redelivery of it is recognised.
+    const only = (_row_paymentSignal = row['paymentSignal']) != null ? _row_paymentSignal : null;
+    const kind = String((_ref = only == null ? void 0 : only['kind']) != null ? _ref : '');
+    const stripeObjectId = String((_ref1 = only == null ? void 0 : only['stripeObjectId']) != null ? _ref1 : '');
+    return kinds.includes(kind) && stripeObjectId ? [
+        {
+            kind: kind,
+            stripeObjectId,
+            detail: String((_ref2 = only == null ? void 0 : only['detail']) != null ? _ref2 : ''),
+            atMs: fallbackAtMs,
+            arrivedAfter: null
+        }
+    ] : [];
+}
 /**
- * File one signal and tell staff, once per signal.
+ * File one signal on its charge's row, and tell the owners and staff once
+ * per charge (AGL-3490).
  *
- * Idempotent on the Stripe object id: a redelivery bumps `reportCount` and
- * leaves the row's status — which staff own from the moment they touch it —
- * where it was. Throws only if the row write throws, which is the webhook's
+ * The first signal on a charge opens the row. A later one — a different
+ * Stripe object about the same payment — is added to `paymentSignals`, and
+ * `paymentSignal` becomes it, so the row's Stripe link follows a dispute.
+ * The status is staff's from the moment they touch it and is left alone,
+ * except that a dispute on a DISMISSED row reopens it and notifies again. A
+ * redelivery of a signal already on the row adds nothing. Read and written
+ * in one transaction, so a warning and a dispute arriving together still
+ * make one row. Throws only if the row write throws, which is the webhook's
  * to answer; the notification never throws.
  */ export async function recordPaymentFraudSignal(signal, deps) {
-    const reviewId = paymentFraudSignalReviewId(signal.kind, signal.stripeObjectId);
+    var _deps_nowMs;
+    const reviewId = paymentFraudSignalReviewId(signal);
     const reference = paymentFraudSignalReference(reviewId);
     const ref = deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId);
-    const first = !(await ref.get()).exists;
-    const subscriptionCard = signal.orgId ? staffSubscriptionCardPath(signal.orgId) : null;
-    await ref.set(_extends({
-        reference,
-        // "Phishing or fraud" — the queue's urgent fraud category.
-        category: 'phishing',
-        severity: 'urgent',
-        source: 'stripe-fraud-signal',
-        url: null,
-        reportedHostname: null,
-        hostId: null,
-        orgId: signal.orgId,
-        details: describePaymentFraudSignal(signal),
-        reporterEmail: null,
-        reporterName: null,
-        dmca: null,
-        reportCount: FieldValue.increment(1),
-        paymentSignal: {
-            kind: signal.kind,
-            stripeObjectId: signal.stripeObjectId,
-            chargeId: signal.chargeId,
-            paymentIntentId: signal.paymentIntentId,
-            amountCents: signal.amountCents,
-            currency: signal.currency,
-            detail: signal.detail,
-            checks: signal.checks,
-            livemode: signal.livemode,
-            subscriptionCard
-        },
-        updatedAt: FieldValue.serverTimestamp()
-    }, first ? {
-        status: 'open',
-        createdAt: FieldValue.serverTimestamp()
-    } : {}), {
-        merge: true
+    const atMs = (_deps_nowMs = deps.nowMs) != null ? _deps_nowMs : Date.now();
+    const { first, reopened } = await deps.firestore.runTransaction(async (transaction)=>{
+        var _snapshot_data, _existing_status, _ref, _signal_orgId, _signal_amountCents, _signal_checks, _ref1;
+        const snapshot = await transaction.get(ref);
+        const existing = snapshot.exists ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {} : null;
+        const history = signalHistoryOf(existing, atMs);
+        if (existing && history.some((entry)=>entry.stripeObjectId === signal.stripeObjectId)) {
+            transaction.set(ref, {
+                updatedAt: FieldValue.serverTimestamp()
+            }, {
+                merge: true
+            });
+            return {
+                first: false,
+                reopened: false
+            };
+        }
+        const status = existing ? String((_existing_status = existing['status']) != null ? _existing_status : 'open') : 'open';
+        const wasClosed = CLOSED_STATUSES.has(status);
+        const reopen = status === 'dismissed' && signal.kind === 'dispute';
+        const resolution = typeof (existing == null ? void 0 : existing['resolution']) === 'string' && existing['resolution'].trim() ? existing['resolution'].trim() : null;
+        const nextHistory = [
+            ...history,
+            {
+                kind: signal.kind,
+                stripeObjectId: signal.stripeObjectId,
+                detail: signal.detail,
+                atMs,
+                arrivedAfter: wasClosed ? status : null
+            }
+        ].slice(-SIGNAL_HISTORY_MAX);
+        // A later signal whose charge read failed keeps what the first one
+        // learned rather than erasing it.
+        const previous = (_ref = existing == null ? void 0 : existing['paymentSignal']) != null ? _ref : null;
+        const orgId = (_signal_orgId = signal.orgId) != null ? _signal_orgId : typeof (existing == null ? void 0 : existing['orgId']) === 'string' ? existing['orgId'] : null;
+        const merged = _extends({}, signal, {
+            orgId,
+            amountCents: (_signal_amountCents = signal.amountCents) != null ? _signal_amountCents : typeof (previous == null ? void 0 : previous['amountCents']) === 'number' ? previous['amountCents'] : null,
+            checks: (_signal_checks = signal.checks) != null ? _signal_checks : (_ref1 = previous == null ? void 0 : previous['checks']) != null ? _ref1 : null
+        });
+        transaction.set(ref, _extends({
+            reference,
+            // "Phishing or fraud" — the queue's urgent fraud category.
+            category: 'phishing',
+            severity: 'urgent',
+            source: 'stripe-fraud-signal',
+            url: null,
+            reportedHostname: null,
+            hostId: null,
+            orgId,
+            details: describePaymentFraudSignal(merged, {
+                history: nextHistory,
+                closed: wasClosed ? {
+                    status,
+                    resolution
+                } : null,
+                reopened: reopen
+            }),
+            reporterEmail: null,
+            reporterName: null,
+            dmca: null,
+            reportCount: nextHistory.length,
+            paymentSignals: nextHistory,
+            paymentSignal: {
+                kind: merged.kind,
+                stripeObjectId: merged.stripeObjectId,
+                chargeId: merged.chargeId,
+                paymentIntentId: merged.paymentIntentId,
+                amountCents: merged.amountCents,
+                currency: merged.currency,
+                detail: merged.detail,
+                checks: merged.checks,
+                livemode: merged.livemode,
+                subscriptionCard: orgId ? staffSubscriptionCardPath(orgId) : null
+            },
+            updatedAt: FieldValue.serverTimestamp()
+        }, existing ? {} : {
+            status: 'open',
+            createdAt: FieldValue.serverTimestamp()
+        }, reopen ? {
+            status: 'open',
+            reopenedAt: FieldValue.serverTimestamp(),
+            resolvedAt: null
+        } : {}), {
+            merge: true
+        });
+        return {
+            first: !existing,
+            reopened: reopen
+        };
     });
-    if (first) {
+    if (first || reopened) {
         var _RISK_PAYMENT_EVENTS_signal_kind, _ref, _signal_chargeId;
         // The workspace's owners are told their subscription payment was
         // flagged and how to confirm it; staff get the row with the evidence.
@@ -194,13 +337,14 @@ const KIND_LABEL = {
             // a fraud check. The notice says which.
             paymentEvent: (_RISK_PAYMENT_EVENTS_signal_kind = RISK_PAYMENT_EVENTS[signal.kind]) != null ? _RISK_PAYMENT_EVENTS_signal_kind : null,
             stripeUrl: stripeSignalDashboardUrl(signal),
-            staffEvidence: `${KIND_LABEL[signal.kind]} (${signal.stripeObjectId}) on charge ` + `${(_ref = (_signal_chargeId = signal.chargeId) != null ? _signal_chargeId : signal.paymentIntentId) != null ? _ref : 'not named'}` + (signal.detail ? `; Stripe says: ${signal.detail}` : '') + (signal.livemode ? '' : ' — TEST MODE') + '.'
+            staffEvidence: `${KIND_LABEL[signal.kind]} (${signal.stripeObjectId}) on charge ` + `${(_ref = (_signal_chargeId = signal.chargeId) != null ? _signal_chargeId : signal.paymentIntentId) != null ? _ref : 'not named'}` + (signal.detail ? `; Stripe says: ${signal.detail}` : '') + (signal.livemode ? '' : ' — TEST MODE') + (reopened ? '; reopened a row staff had dismissed' : '') + '.'
         }).catch(()=>undefined);
     }
     return {
         reviewId,
         reference,
-        first
+        first,
+        reopened
     };
 }
 /*==========================================

package/src/lib/server/payment-fraud-signal.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-fraud-signal.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * STRIPE'S FRAUD SIGNALS, INTO THE ABUSE QUEUE (AGL-3356).\n *\n * The 9/26 incident paid for Pro with a card whose CVC check came back\n * unavailable and which never met 3-D Secure. Stripe had three ways to tell\n * us about a card like that — an early fraud warning from the issuer, a\n * Radar review, a dispute — and the platform webhook either did not\n * subscribe to them or filed them where nobody triages abuse.\n *\n * Each signal now files an urgent row in the abuse queue that names the\n * workspace, the charge and the amount, links the staff Subscription card\n * on the org page (AGL-3359, where billing is canceled), and notifies staff\n * once. NOTHING IS DONE TO THE MONEY OR THE SUBSCRIPTION: no refund, no\n * cancel. An early fraud warning is not a chargeback, a review may clear, and\n * a refund issued before staff look can be the wrong half of a dispute. The\n * row is the prompt; staff decide.\n *\n * Dependencies are passed in rather than imported — the Firestore handle the\n * webhook observes its writes through, and its staff notifier — so the\n * webhook's \"did this delivery do anything\" ledger sees the write, and a spec\n * substituting the admin barrel substitutes these too.\n *=========================================*/\n\nimport { createHash } from 'crypto'\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport { RISK_PAYMENT_EVENTS } from '@aglyn/shared-util-email/risk-notice-catalog'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport type { RiskEventInput } from './risk-notice'\n\n/**\n * The seam every signal here tells people through (AGL-3368): the owners\n * and admins of the workspace, and staff. Passed in, like the Firestore\n * handle, so the webhook's spec substitutes it with the barrel.\n */\nexport type RiskNotifier = (input: RiskEventInput) => Promise<unknown>\n\n/** Which Stripe signal this is. */\nexport type PaymentFraudSignalKind =\n  | 'early-fraud-warning'\n  | 'radar-review'\n  | 'dispute'\n\nconst KIND_LABEL: Record<PaymentFraudSignalKind, string> = {\n  'early-fraud-warning': 'Early fraud warning',\n  'radar-review': 'Radar review opened',\n  dispute: 'Card dispute opened',\n}\n\n/** The Stripe object type each signal arrives as, for the queue's text. */\nexport const PAYMENT_FRAUD_SIGNAL_LABELS = KIND_LABEL\n\n/** What the card's own checks said, when the charge could be read. */\nexport interface PaymentFraudCardChecks {\n  cvcCheck: string | null\n  addressPostalCodeCheck: string | null\n  cardCountry: string | null\n  riskLevel: string | null\n  threeDSecure: string | null\n}\n\nexport interface PaymentFraudSignal {\n  kind: PaymentFraudSignalKind\n  /** The EFW, review or dispute id: one row per signal, whatever redelivers. */\n  stripeObjectId: string\n  chargeId: string | null\n  paymentIntentId: string | null\n  /** The workspace the charge billed, or null when it resolved to none. */\n  orgId: string | null\n  /** Smallest currency unit, or null when nothing recorded the amount. */\n  amountCents: number | null\n  currency: string\n  /** `fraud_type`, the review's `reason`, the dispute's `reason`. */\n  detail: string\n  checks: PaymentFraudCardChecks | null\n  livemode: boolean\n}\n\n/** The row id: hex, so the admin route's id pattern addresses it. */\nexport function paymentFraudSignalReviewId(\n  kind: PaymentFraudSignalKind,\n  stripeObjectId: string,\n): string {\n  return createHash('sha256')\n    .update(`stripe-fraud:${kind}:${stripeObjectId}`)\n    .digest('hex')\n    .slice(0, 40)\n}\n\n/** The staff-facing reference, beside the intake's `AR-` and the screen's `HS-`. */\nexport function paymentFraudSignalReference(reviewId: string): string {\n  return `PF-${reviewId.slice(0, 10).toUpperCase()}`\n}\n\n/** Where staff act on the workspace's billing: its Subscription card. */\nexport function staffSubscriptionCardPath(orgId: string): string {\n  return `/admin/orgs/${encodeURIComponent(orgId)}#subscription`\n}\n\n/**\n * The Stripe Dashboard page for a signal: the dispute itself, else the\n * payment it is about.\n */\nexport function stripeSignalDashboardUrl(signal: {\n  kind: PaymentFraudSignalKind\n  stripeObjectId: string\n  chargeId: string | null\n  paymentIntentId: string | null\n  livemode: boolean\n}): string | null {\n  const base = `https://dashboard.stripe.com/${signal.livemode ? '' : 'test/'}`\n  if (signal.kind === 'dispute' && signal.stripeObjectId) {\n    return `${base}disputes/${encodeURIComponent(signal.stripeObjectId)}`\n  }\n  const payment = signal.paymentIntentId || signal.chargeId\n  return payment ? `${base}payments/${encodeURIComponent(payment)}` : null\n}\n\n/** `$56.00 USD`, or a sentence saying the amount is not known. */\nexport function formatSignalAmount(\n  amountCents: number | null,\n  currency: string,\n): string {\n  if (amountCents === null || !Number.isFinite(amountCents)) {\n    return 'amount not recorded'\n  }\n  return `${(amountCents / 100).toFixed(2)} ${String(currency || 'usd').toUpperCase()}`\n}\n\n/**\n * The one-line summary of a charge Stripe gives back, for a signal whose\n * charge is not on a platform revenue row. A READ — the only Stripe call\n * this module makes — and it answers null rather than throwing, because a\n * fraud alert that fails for want of an amount is worse than one that says\n * the amount is unknown.\n */\nexport async function readStripeChargeForSignal(\n  chargeId: string,\n  options: { secretKey: string | undefined; fetchImpl?: typeof fetch },\n): Promise<{\n  amountCents: number | null\n  currency: string\n  customerId: string | null\n  checks: PaymentFraudCardChecks\n  /**\n   * The connected account the charge paid (AGL-3360): a destination\n   * charge's `transfer_data.destination`. Every sale Aglyn takes for a site\n   * is a destination charge on the platform account — the facilitator\n   * model (AGL-1956) — so this is the seller. Null for a charge that paid\n   * only the platform, a workspace's own subscription.\n   */\n  sellerAccountId: string | null\n} | null> {\n  if (!chargeId || !options.secretKey) return null\n  try {\n    const response = await (options.fetchImpl ?? fetch)(\n      `https://api.stripe.com/v1/charges/${encodeURIComponent(chargeId)}`,\n      { headers: { Authorization: `Bearer ${options.secretKey}` } },\n    )\n    if (!response.ok) return null\n    const charge = (await response.json()) as Record<string, any>\n    const card = charge?.['payment_method_details']?.['card'] ?? {}\n    const text = (value: unknown) =>\n      typeof value === 'string' && value ? value : null\n    return {\n      amountCents: Number.isFinite(Number(charge?.['amount']))\n        ? Number(charge['amount'])\n        : null,\n      currency: String(charge?.['currency'] ?? 'usd'),\n      customerId: text(charge?.['customer']),\n      checks: {\n        cvcCheck: text(card?.['checks']?.['cvc_check']),\n        addressPostalCodeCheck: text(card?.['checks']?.['address_postal_code_check']),\n        cardCountry: text(card?.['country']),\n        riskLevel: text(charge?.['outcome']?.['risk_level']),\n        threeDSecure: text(card?.['three_d_secure']?.['result']),\n      },\n      sellerAccountId: accountRef(charge?.['transfer_data']?.['destination']),\n    }\n  } catch {\n    return null\n  }\n}\n\n/** A Stripe account reference, expanded or not, as an id or null. */\nfunction accountRef(value: unknown): string | null {\n  const id =\n    typeof value === 'string'\n      ? value\n      : String((value as { id?: unknown } | null)?.id ?? '')\n  return id.startsWith('acct_') ? id : null\n}\n\n/** The row's prose: what arrived, about which workspace, and what to do. */\nexport function describePaymentFraudSignal(signal: PaymentFraudSignal): string {\n  const lines = [\n    `${KIND_LABEL[signal.kind]} from Stripe (${signal.stripeObjectId})` +\n      (signal.livemode ? '' : ' — TEST MODE') +\n      '.',\n    `Workspace: ${signal.orgId ?? 'none — the charge did not resolve to a workspace subscription'}.`,\n    `Charge: ${signal.chargeId ?? signal.paymentIntentId ?? 'not named'} · ${formatSignalAmount(signal.amountCents, signal.currency)}.`,\n  ]\n  if (signal.detail) lines.push(`Stripe says: ${signal.detail}.`)\n  const checks = signal.checks\n  if (checks) {\n    lines.push(\n      `Card: CVC ${checks.cvcCheck ?? 'unknown'}, postal code ${checks.addressPostalCodeCheck ?? 'unknown'}, ` +\n        `issued in ${checks.cardCountry ?? 'unknown'}, 3DS ${checks.threeDSecure ?? 'not used'}, ` +\n        `Radar risk ${checks.riskLevel ?? 'unknown'}.`,\n    )\n  }\n  lines.push(\n    signal.kind === 'radar-review'\n      ? 'The payment waits in Stripe until the review is closed there.'\n      : signal.kind === 'dispute'\n        ? 'Answer the dispute in Stripe before its evidence deadline.'\n        : 'An early fraud warning is not yet a chargeback; refunding now can avoid one.',\n    'Nothing has been refunded or canceled. Decide on the org’s Subscription card, lock the workspace if it is fraud, and close this row with what you did.',\n  )\n  return lines.join('\\n').slice(0, 5000)\n}\n\n/**\n * File one signal and tell staff, once per signal.\n *\n * Idempotent on the Stripe object id: a redelivery bumps `reportCount` and\n * leaves the row's status — which staff own from the moment they touch it —\n * where it was. Throws only if the row write throws, which is the webhook's\n * to answer; the notification never throws.\n */\nexport async function recordPaymentFraudSignal(\n  signal: PaymentFraudSignal,\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notifyRisk: RiskNotifier\n  },\n): Promise<{ reviewId: string; reference: string; first: boolean }> {\n  const reviewId = paymentFraudSignalReviewId(signal.kind, signal.stripeObjectId)\n  const reference = paymentFraudSignalReference(reviewId)\n  const ref = deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n  const first = !(await ref.get()).exists\n  const subscriptionCard = signal.orgId\n    ? staffSubscriptionCardPath(signal.orgId)\n    : null\n  await ref.set(\n    {\n      reference,\n      // \"Phishing or fraud\" — the queue's urgent fraud category.\n      category: 'phishing',\n      severity: 'urgent',\n      source: 'stripe-fraud-signal',\n      url: null,\n      reportedHostname: null,\n      hostId: null,\n      orgId: signal.orgId,\n      details: describePaymentFraudSignal(signal),\n      reporterEmail: null,\n      reporterName: null,\n      dmca: null,\n      reportCount: FieldValue.increment(1),\n      paymentSignal: {\n        kind: signal.kind,\n        stripeObjectId: signal.stripeObjectId,\n        chargeId: signal.chargeId,\n        paymentIntentId: signal.paymentIntentId,\n        amountCents: signal.amountCents,\n        currency: signal.currency,\n        detail: signal.detail,\n        checks: signal.checks,\n        livemode: signal.livemode,\n        subscriptionCard,\n      },\n      updatedAt: FieldValue.serverTimestamp(),\n      ...(first\n        ? { status: 'open', createdAt: FieldValue.serverTimestamp() }\n        : {}),\n    },\n    { merge: true },\n  )\n  if (first) {\n    // The workspace's owners are told their subscription payment was\n    // flagged and how to confirm it; staff get the row with the evidence.\n    await deps\n      .notifyRisk({\n        kind: 'billing-payment-flagged',\n        orgId: signal.orgId,\n        reviewId,\n        reference,\n        item: { label: 'your subscription payment', path: '/org/billing/invoices' },\n        amount: formatSignalAmount(signal.amountCents, signal.currency),\n        // A dispute is the bank's, already opened; a warning or a review is\n        // a fraud check. The notice says which.\n        paymentEvent: RISK_PAYMENT_EVENTS[signal.kind] ?? null,\n        stripeUrl: stripeSignalDashboardUrl(signal),\n        staffEvidence:\n          `${KIND_LABEL[signal.kind]} (${signal.stripeObjectId}) on charge ` +\n          `${signal.chargeId ?? signal.paymentIntentId ?? 'not named'}` +\n          (signal.detail ? `; Stripe says: ${signal.detail}` : '') +\n          (signal.livemode ? '' : ' — TEST MODE') +\n          '.',\n      })\n      .catch(() => undefined)\n  }\n  return { reviewId, reference, first }\n}\n\n/*==========================================\n * THE SELLER PATTERN: WHEN THE MERCHANT MAY BE THE FRAUDSTER (AGL-3360).\n *\n * A site's own sales are destination charges on the platform account, so\n * Stripe's fraud signals about a shopper's card arrive here too. One of them\n * is the merchant's business — their customer, their order, their decision\n * (`payment-risk-record.ts` puts it on the record and tells them). Staff are\n * not paged for it.\n *\n * What IS staff's business is the shape a phishing actor leaves when they\n * run stolen cards through a storefront of their own: several different\n * charges on ONE connected account drawing issuer fraud reports or\n * chargebacks in a short time. So every signal on a seller's charge is kept\n * in a small per-account ledger, and one urgent abuse-queue row is filed when\n *\n *   ≥ 3 DISTINCT charges carry an early fraud warning or a dispute\n *   within 7 days.\n *\n * Why those numbers. An early fraud warning is an issuer's report that the\n * cardholder did not make the payment, and a dispute is a formal\n * chargeback; a legitimate small merchant sees either rarely — card-network\n * dispute monitoring starts near 0.9% of a month's transactions, single\n * digits a MONTH for a shop doing hundreds of sales. One or two in a week is\n * ordinary friendly fraud and must never page staff. Three separate charges\n * in one week is a rate a real small shop does not produce, and is what a\n * card tester or a stolen-card storefront produces within days. Counted by\n * CHARGE, because a warning is routinely followed by a dispute on the same\n * payment, and that is one bad payment, not two. Radar reviews are kept in\n * the ledger for the row's prose but never counted: a review is Stripe's\n * suspicion, not an issuer's report, and a busy shop can collect several\n * that clear.\n *\n * One row per window: once filed, the account is not filed again until 7\n * days have passed, so a burst is one row with everything in it rather than\n * a row per signal. NOTHING IS DONE TO THE ACCOUNT OR THE MONEY: staff\n * decide (lock the workspace, pause the account's payouts in Stripe).\n *=========================================*/\n\nexport const SELLER_FRAUD_PATTERN = {\n  /** Distinct charges with an early fraud warning or a dispute. */\n  minDistinctCharges: 3,\n  /** …within this window. */\n  windowMs: 7 * 24 * 60 * 60 * 1000,\n  /** How long the ledger keeps an entry at all. */\n  retainMs: 30 * 24 * 60 * 60 * 1000,\n} as const\n\nconst WINDOW_DAYS = SELLER_FRAUD_PATTERN.windowMs / 86_400_000\n\n/** Admin-SDK only; no client rule opens it (default deny). */\nexport const SELLER_FRAUD_LEDGER_COLLECTION = 'paymentFraudLedger'\n\nexport interface SellerFraudLedgerEntry {\n  kind: PaymentFraudSignalKind\n  stripeObjectId: string\n  chargeId: string | null\n  amountCents: number | null\n  currency: string\n  detail: string\n  /** The sites a plugin recognised the charge as belonging to. */\n  hostIds: string[]\n  atMs: number\n}\n\n/** Whether a seller's ledger shows the pattern at `nowMs`. Pure. */\nexport function sellerFraudPattern(\n  entries: readonly SellerFraudLedgerEntry[],\n  nowMs: number,\n): { matched: boolean; chargeIds: string[] } {\n  const since = nowMs - SELLER_FRAUD_PATTERN.windowMs\n  const chargeIds = [\n    ...new Set(\n      entries\n        .filter(\n          (entry) =>\n            (entry.kind === 'early-fraud-warning' || entry.kind === 'dispute') &&\n            entry.atMs >= since,\n        )\n        .map((entry) => entry.chargeId || entry.stripeObjectId),\n    ),\n  ]\n  return {\n    matched: chargeIds.length >= SELLER_FRAUD_PATTERN.minDistinctCharges,\n    chargeIds,\n  }\n}\n\n/** The connected account's page in the Stripe Dashboard. */\nexport function stripeConnectedAccountUrl(\n  accountId: string,\n  livemode: boolean,\n): string {\n  return `https://dashboard.stripe.com/${livemode ? '' : 'test/'}connect/accounts/${encodeURIComponent(accountId)}`\n}\n\n/**\n * Keep one signal on a seller's charge, and file the pattern row when the\n * ledger crosses the threshold. Idempotent on the Stripe object id: a\n * redelivery changes nothing and files nothing.\n */\nexport async function recordSellerFraudSignal(\n  input: {\n    signal: PaymentFraudSignal\n    sellerAccountId: string\n    /** The sites a plugin recognised the charge as belonging to. */\n    hostIds: string[]\n    /** Workspaces owning those sites, for the row. */\n    orgIds: string[]\n  },\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notifyRisk: RiskNotifier\n    nowMs?: number\n  },\n): Promise<{\n  first: boolean\n  matched: boolean\n  filed: { reviewId: string; reference: string } | null\n}> {\n  const nowMs = deps.nowMs ?? Date.now()\n  const { signal, sellerAccountId } = input\n  const ledgerRef = deps.firestore\n    .collection(SELLER_FRAUD_LEDGER_COLLECTION)\n    .doc(sellerAccountId)\n  const outcome = await deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(ledgerRef)\n    const stored = (\n      Array.isArray(fresh.get('entries')) ? fresh.get('entries') : []\n    ) as SellerFraudLedgerEntry[]\n    if (stored.some((entry) => entry.stripeObjectId === signal.stripeObjectId)) {\n      return { first: false, matched: false, fileAtMs: 0, entries: stored }\n    }\n    const entries: SellerFraudLedgerEntry[] = [\n      ...stored.filter(\n        (entry) => entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.retainMs,\n      ),\n      {\n        kind: signal.kind,\n        stripeObjectId: signal.stripeObjectId,\n        chargeId: signal.chargeId,\n        amountCents: signal.amountCents,\n        currency: signal.currency,\n        detail: signal.detail,\n        hostIds: input.hostIds,\n        atMs: nowMs,\n      },\n    ]\n    const { matched } = sellerFraudPattern(entries, nowMs)\n    const lastFiledAtMs = Number(fresh.get('lastFiledAtMs') ?? 0)\n    const fileAtMs =\n      matched &&\n      !(lastFiledAtMs && nowMs - lastFiledAtMs < SELLER_FRAUD_PATTERN.windowMs)\n        ? nowMs\n        : 0\n    transaction.set(\n      ledgerRef,\n      {\n        sellerAccountId,\n        entries,\n        livemode: signal.livemode,\n        updatedAtMs: nowMs,\n        ...(fileAtMs ? { lastFiledAtMs: fileAtMs } : {}),\n      },\n      { merge: true },\n    )\n    return { first: true, matched, fileAtMs, entries }\n  })\n  if (!outcome.fileAtMs) {\n    return { first: outcome.first, matched: outcome.matched, filed: null }\n  }\n\n  const { chargeIds } = sellerFraudPattern(outcome.entries, nowMs)\n  const inWindow = outcome.entries.filter(\n    (entry) => entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.windowMs,\n  )\n  const reviewId = createHash('sha256')\n    .update(`stripe-seller-pattern:${sellerAccountId}:${outcome.fileAtMs}`)\n    .digest('hex')\n    .slice(0, 40)\n  const reference = paymentFraudSignalReference(reviewId)\n  const orgId = input.orgIds[0] ?? null\n  const hostIds = [...new Set(inWindow.flatMap((entry) => entry.hostIds ?? []))]\n  const stripeUrl = stripeConnectedAccountUrl(sellerAccountId, signal.livemode)\n  const details = [\n    `${chargeIds.length} different charges paid to connected account ${sellerAccountId} drew an issuer fraud warning or a dispute within ${WINDOW_DAYS} days` +\n      (signal.livemode ? '' : ' — TEST MODE') +\n      '.',\n    `Workspace(s): ${input.orgIds.length ? input.orgIds.join(', ') : 'not resolved'}. Site(s): ${hostIds.length ? hostIds.join(', ') : 'not resolved'}.`,\n    ...inWindow.map(\n      (entry) =>\n        `• ${KIND_LABEL[entry.kind]} ${entry.stripeObjectId} on ${entry.chargeId ?? 'an unnamed charge'} · ${formatSignalAmount(entry.amountCents, entry.currency)}` +\n        (entry.detail ? ` · ${entry.detail}` : ''),\n    ),\n    'A shop taking stolen cards through its own storefront leaves this shape. Each merchant has already been shown the signal on its own order or booking.',\n    `Nothing has been refunded, canceled or paused. If this is the seller's fraud, lock the workspace and pause the account's payouts in Stripe (${stripeUrl}), then close this row with what you did.`,\n  ]\n    .join('\\n')\n    .slice(0, 5000)\n  await deps.firestore\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .set(\n      {\n        reference,\n        // \"Phishing or fraud\" — the queue's urgent fraud category.\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'stripe-seller-fraud-pattern',\n        url: null,\n        reportedHostname: null,\n        hostId: hostIds[0] ?? null,\n        orgId,\n        details,\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: 1,\n        sellerPattern: {\n          sellerAccountId,\n          stripeAccountUrl: stripeUrl,\n          chargeIds,\n          orgIds: input.orgIds,\n          hostIds,\n          threshold: SELLER_FRAUD_PATTERN.minDistinctCharges,\n          windowDays: WINDOW_DAYS,\n          livemode: signal.livemode,\n        },\n        status: 'open',\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n  // Staff get the pattern with its numbers; the owners get a plain \"we are\n  // reviewing recent payments\" with the way to talk to us, never the count\n  // or the window that opened the review.\n  await deps\n    .notifyRisk({\n      kind: 'seller-review',\n      orgId,\n      hostId: hostIds[0] ?? null,\n      reviewId,\n      reference,\n      item: { label: 'recent card payments on your store', path: '/org/settings/holds' },\n      stripeUrl,\n      staffEvidence:\n        `Connected account ${sellerAccountId} drew fraud warnings or disputes on ` +\n        `${chargeIds.length} different charges in ${WINDOW_DAYS} days` +\n        (signal.livemode ? '' : ' — TEST MODE') +\n        '.',\n    })\n    .catch(() => undefined)\n  return { first: true, matched: true, filed: { reviewId, reference } }\n}\n"],"names":["createHash","ABUSE_REPORT_COLLECTION","RISK_PAYMENT_EVENTS","FieldValue","KIND_LABEL","dispute","PAYMENT_FRAUD_SIGNAL_LABELS","paymentFraudSignalReviewId","kind","stripeObjectId","update","digest","slice","paymentFraudSignalReference","reviewId","toUpperCase","staffSubscriptionCardPath","orgId","encodeURIComponent","stripeSignalDashboardUrl","signal","base","livemode","payment","paymentIntentId","chargeId","formatSignalAmount","amountCents","currency","Number","isFinite","toFixed","String","readStripeChargeForSignal","options","secretKey","charge","card","response","fetchImpl","fetch","headers","Authorization","ok","json","text","value","customerId","checks","cvcCheck","addressPostalCodeCheck","cardCountry","riskLevel","threeDSecure","sellerAccountId","accountRef","id","startsWith","describePaymentFraudSignal","lines","detail","push","join","recordPaymentFraudSignal","deps","reference","ref","firestore","collection","doc","first","get","exists","subscriptionCard","set","category","severity","source","url","reportedHostname","hostId","details","reporterEmail","reporterName","dmca","reportCount","increment","paymentSignal","updatedAt","serverTimestamp","status","createdAt","merge","notifyRisk","item","label","path","amount","paymentEvent","stripeUrl","staffEvidence","catch","undefined","SELLER_FRAUD_PATTERN","minDistinctCharges","windowMs","retainMs","WINDOW_DAYS","SELLER_FRAUD_LEDGER_COLLECTION","sellerFraudPattern","entries","nowMs","since","chargeIds","Set","filter","entry","atMs","map","matched","length","stripeConnectedAccountUrl","accountId","recordSellerFraudSignal","input","hostIds","Date","now","ledgerRef","outcome","runTransaction","transaction","fresh","stored","Array","isArray","some","fileAtMs","lastFiledAtMs","updatedAtMs","filed","inWindow","orgIds","flatMap","sellerPattern","stripeAccountUrl","threshold","windowDays"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;2CAqB2C,GAE3C,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,uBAAuB,QAAQ,sCAAqC;AAC7E,SAASC,mBAAmB,QAAQ,+CAA8C;AAClF,SAASC,UAAU,QAAQ,2BAA0B;AAgBrD,MAAMC,aAAqD;IACzD,uBAAuB;IACvB,gBAAgB;IAChBC,SAAS;AACX;AAEA,yEAAyE,GACzE,OAAO,MAAMC,8BAA8BF,WAAU;AA4BrD,mEAAmE,GACnE,OAAO,SAASG,2BACdC,IAA4B,EAC5BC,cAAsB;IAEtB,OAAOT,WAAW,UACfU,MAAM,CAAC,CAAC,aAAa,EAAEF,KAAK,CAAC,EAAEC,gBAAgB,EAC/CE,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;AACd;AAEA,kFAAkF,GAClF,OAAO,SAASC,4BAA4BC,QAAgB;IAC1D,OAAO,CAAC,GAAG,EAAEA,SAASF,KAAK,CAAC,GAAG,IAAIG,WAAW,IAAI;AACpD;AAEA,uEAAuE,GACvE,OAAO,SAASC,0BAA0BC,KAAa;IACrD,OAAO,CAAC,YAAY,EAAEC,mBAAmBD,OAAO,aAAa,CAAC;AAChE;AAEA;;;CAGC,GACD,OAAO,SAASE,yBAAyBC,MAMxC;IACC,MAAMC,OAAO,CAAC,6BAA6B,EAAED,OAAOE,QAAQ,GAAG,KAAK,SAAS;IAC7E,IAAIF,OAAOZ,IAAI,KAAK,aAAaY,OAAOX,cAAc,EAAE;QACtD,OAAO,GAAGY,KAAK,SAAS,EAAEH,mBAAmBE,OAAOX,cAAc,GAAG;IACvE;IACA,MAAMc,UAAUH,OAAOI,eAAe,IAAIJ,OAAOK,QAAQ;IACzD,OAAOF,UAAU,GAAGF,KAAK,SAAS,EAAEH,mBAAmBK,UAAU,GAAG;AACtE;AAEA,gEAAgE,GAChE,OAAO,SAASG,mBACdC,WAA0B,EAC1BC,QAAgB;IAEhB,IAAID,gBAAgB,QAAQ,CAACE,OAAOC,QAAQ,CAACH,cAAc;QACzD,OAAO;IACT;IACA,OAAO,GAAG,AAACA,CAAAA,cAAc,GAAE,EAAGI,OAAO,CAAC,GAAG,CAAC,EAAEC,OAAOJ,YAAY,OAAOb,WAAW,IAAI;AACvF;AAEA;;;;;;CAMC,GACD,OAAO,eAAekB,0BACpBR,QAAgB,EAChBS,OAAoE;IAepE,IAAI,CAACT,YAAY,CAACS,QAAQC,SAAS,EAAE,OAAO;IAC5C,IAAI;YACsBD;YAMXE,gCAUMC,cACcA,eAEbD,iBACGC,sBAEOD;QAtB9B,MAAME,WAAW,MAAM,EAACJ,qBAAAA,QAAQK,SAAS,YAAjBL,qBAAqBM,OAC3C,CAAC,kCAAkC,EAAEtB,mBAAmBO,WAAW,EACnE;YAAEgB,SAAS;gBAAEC,eAAe,CAAC,OAAO,EAAER,QAAQC,SAAS,EAAE;YAAC;QAAE;QAE9D,IAAI,CAACG,SAASK,EAAE,EAAE,OAAO;QACzB,MAAMP,SAAU,MAAME,SAASM,IAAI;QACnC,MAAMP,eAAOD,2BAAAA,iCAAAA,MAAQ,CAAC,yBAAyB,qBAAlCA,8BAAoC,CAAC,OAAO,mBAAI,CAAC;QAC9D,MAAMS,OAAO,CAACC,QACZ,OAAOA,UAAU,YAAYA,QAAQA,QAAQ;QAC/C,OAAO;YACLnB,aAAaE,OAAOC,QAAQ,CAACD,OAAOO,0BAAAA,MAAQ,CAAC,SAAS,KAClDP,OAAOO,MAAM,CAAC,SAAS,IACvB;YACJR,UAAUI,gBAAOI,0BAAAA,MAAQ,CAAC,WAAW,oBAAI;YACzCW,YAAYF,KAAKT,0BAAAA,MAAQ,CAAC,WAAW;YACrCY,QAAQ;gBACNC,UAAUJ,KAAKR,yBAAAA,eAAAA,IAAM,CAAC,SAAS,qBAAhBA,YAAkB,CAAC,YAAY;gBAC9Ca,wBAAwBL,KAAKR,yBAAAA,gBAAAA,IAAM,CAAC,SAAS,qBAAhBA,aAAkB,CAAC,4BAA4B;gBAC5Ec,aAAaN,KAAKR,wBAAAA,IAAM,CAAC,UAAU;gBACnCe,WAAWP,KAAKT,2BAAAA,kBAAAA,MAAQ,CAAC,UAAU,qBAAnBA,eAAqB,CAAC,aAAa;gBACnDiB,cAAcR,KAAKR,yBAAAA,uBAAAA,IAAM,CAAC,iBAAiB,qBAAxBA,oBAA0B,CAAC,SAAS;YACzD;YACAiB,iBAAiBC,WAAWnB,2BAAAA,wBAAAA,MAAQ,CAAC,gBAAgB,qBAAzBA,qBAA2B,CAAC,cAAc;QACxE;IACF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,mEAAmE,GACnE,SAASmB,WAAWT,KAAc;;IAChC,MAAMU,KACJ,OAAOV,UAAU,WACbA,QACAd,eAAQc,yBAAD,AAACA,MAAmCU,EAAE,mBAAI;IACvD,OAAOA,GAAGC,UAAU,CAAC,WAAWD,KAAK;AACvC;AAEA,0EAA0E,GAC1E,OAAO,SAASE,2BAA2BtC,MAA0B;QAKnDA,eACHA,MAAAA;IALb,MAAMuC,QAAQ;QACZ,GAAGvD,UAAU,CAACgB,OAAOZ,IAAI,CAAC,CAAC,cAAc,EAAEY,OAAOX,cAAc,CAAC,CAAC,CAAC,GAChEW,CAAAA,OAAOE,QAAQ,GAAG,KAAK,cAAa,IACrC;QACF,CAAC,WAAW,GAAEF,gBAAAA,OAAOH,KAAK,YAAZG,gBAAgB,gEAAgE,CAAC,CAAC;QAChG,CAAC,QAAQ,GAAEA,QAAAA,mBAAAA,OAAOK,QAAQ,YAAfL,mBAAmBA,OAAOI,eAAe,YAAzCJ,OAA6C,YAAY,GAAG,EAAEM,mBAAmBN,OAAOO,WAAW,EAAEP,OAAOQ,QAAQ,EAAE,CAAC,CAAC;KACpI;IACD,IAAIR,OAAOwC,MAAM,EAAED,MAAME,IAAI,CAAC,CAAC,aAAa,EAAEzC,OAAOwC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAMZ,SAAS5B,OAAO4B,MAAM;IAC5B,IAAIA,QAAQ;YAEKA,kBAA6CA,gCAC3CA,qBAAwCA,sBACvCA;QAHlBW,MAAME,IAAI,CACR,CAAC,UAAU,GAAEb,mBAAAA,OAAOC,QAAQ,YAAfD,mBAAmB,UAAU,cAAc,GAAEA,iCAAAA,OAAOE,sBAAsB,YAA7BF,iCAAiC,UAAU,EAAE,CAAC,GACtG,CAAC,UAAU,GAAEA,sBAAAA,OAAOG,WAAW,YAAlBH,sBAAsB,UAAU,MAAM,GAAEA,uBAAAA,OAAOK,YAAY,YAAnBL,uBAAuB,WAAW,EAAE,CAAC,GAC1F,CAAC,WAAW,GAAEA,oBAAAA,OAAOI,SAAS,YAAhBJ,oBAAoB,UAAU,CAAC,CAAC;IAEpD;IACAW,MAAME,IAAI,CACRzC,OAAOZ,IAAI,KAAK,iBACZ,kEACAY,OAAOZ,IAAI,KAAK,YACd,+DACA,gFACN;IAEF,OAAOmD,MAAMG,IAAI,CAAC,MAAMlD,KAAK,CAAC,GAAG;AACnC;AAEA;;;;;;;CAOC,GACD,OAAO,eAAemD,yBACpB3C,MAA0B,EAC1B4C,IAGC;IAED,MAAMlD,WAAWP,2BAA2Ba,OAAOZ,IAAI,EAAEY,OAAOX,cAAc;IAC9E,MAAMwD,YAAYpD,4BAA4BC;IAC9C,MAAMoD,MAAMF,KAAKG,SAAS,CAACC,UAAU,CAACnE,yBAAyBoE,GAAG,CAACvD;IACnE,MAAMwD,QAAQ,CAAC,AAAC,CAAA,MAAMJ,IAAIK,GAAG,EAAC,EAAGC,MAAM;IACvC,MAAMC,mBAAmBrD,OAAOH,KAAK,GACjCD,0BAA0BI,OAAOH,KAAK,IACtC;IACJ,MAAMiD,IAAIQ,GAAG,CACX;QACET;QACA,2DAA2D;QAC3DU,UAAU;QACVC,UAAU;QACVC,QAAQ;QACRC,KAAK;QACLC,kBAAkB;QAClBC,QAAQ;QACR/D,OAAOG,OAAOH,KAAK;QACnBgE,SAASvB,2BAA2BtC;QACpC8D,eAAe;QACfC,cAAc;QACdC,MAAM;QACNC,aAAalF,WAAWmF,SAAS,CAAC;QAClCC,eAAe;YACb/E,MAAMY,OAAOZ,IAAI;YACjBC,gBAAgBW,OAAOX,cAAc;YACrCgB,UAAUL,OAAOK,QAAQ;YACzBD,iBAAiBJ,OAAOI,eAAe;YACvCG,aAAaP,OAAOO,WAAW;YAC/BC,UAAUR,OAAOQ,QAAQ;YACzBgC,QAAQxC,OAAOwC,MAAM;YACrBZ,QAAQ5B,OAAO4B,MAAM;YACrB1B,UAAUF,OAAOE,QAAQ;YACzBmD;QACF;QACAe,WAAWrF,WAAWsF,eAAe;OACjCnB,QACA;QAAEoB,QAAQ;QAAQC,WAAWxF,WAAWsF,eAAe;IAAG,IAC1D,CAAC,IAEP;QAAEG,OAAO;IAAK;IAEhB,IAAItB,OAAO;YAaSpE,kCAITkB,MAAAA;QAhBT,iEAAiE;QACjE,sEAAsE;QACtE,MAAM4C,KACH6B,UAAU,CAAC;YACVrF,MAAM;YACNS,OAAOG,OAAOH,KAAK;YACnBH;YACAmD;YACA6B,MAAM;gBAAEC,OAAO;gBAA6BC,MAAM;YAAwB;YAC1EC,QAAQvE,mBAAmBN,OAAOO,WAAW,EAAEP,OAAOQ,QAAQ;YAC9D,oEAAoE;YACpE,wCAAwC;YACxCsE,YAAY,GAAEhG,mCAAAA,mBAAmB,CAACkB,OAAOZ,IAAI,CAAC,YAAhCN,mCAAoC;YAClDiG,WAAWhF,yBAAyBC;YACpCgF,eACE,GAAGhG,UAAU,CAACgB,OAAOZ,IAAI,CAAC,CAAC,EAAE,EAAEY,OAAOX,cAAc,CAAC,YAAY,CAAC,GAClE,IAAGW,QAAAA,mBAAAA,OAAOK,QAAQ,YAAfL,mBAAmBA,OAAOI,eAAe,YAAzCJ,OAA6C,aAAa,GAC5DA,CAAAA,OAAOwC,MAAM,GAAG,CAAC,eAAe,EAAExC,OAAOwC,MAAM,EAAE,GAAG,EAAC,IACrDxC,CAAAA,OAAOE,QAAQ,GAAG,KAAK,cAAa,IACrC;QACJ,GACC+E,KAAK,CAAC,IAAMC;IACjB;IACA,OAAO;QAAExF;QAAUmD;QAAWK;IAAM;AACtC;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAoC2C,GAE3C,OAAO,MAAMiC,uBAAuB;IAClC,+DAA+D,GAC/DC,oBAAoB;IACpB,yBAAyB,GACzBC,UAAU,IAAI,KAAK,KAAK,KAAK;IAC7B,+CAA+C,GAC/CC,UAAU,KAAK,KAAK,KAAK,KAAK;AAChC,EAAU;AAEV,MAAMC,cAAcJ,qBAAqBE,QAAQ,GAAG;AAEpD,4DAA4D,GAC5D,OAAO,MAAMG,iCAAiC,qBAAoB;AAclE,kEAAkE,GAClE,OAAO,SAASC,mBACdC,OAA0C,EAC1CC,KAAa;IAEb,MAAMC,QAAQD,QAAQR,qBAAqBE,QAAQ;IACnD,MAAMQ,YAAY;WACb,IAAIC,IACLJ,QACGK,MAAM,CACL,CAACC,QACC,AAACA,CAAAA,MAAM5G,IAAI,KAAK,yBAAyB4G,MAAM5G,IAAI,KAAK,SAAQ,KAChE4G,MAAMC,IAAI,IAAIL,OAEjBM,GAAG,CAAC,CAACF,QAAUA,MAAM3F,QAAQ,IAAI2F,MAAM3G,cAAc;KAE3D;IACD,OAAO;QACL8G,SAASN,UAAUO,MAAM,IAAIjB,qBAAqBC,kBAAkB;QACpES;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASQ,0BACdC,SAAiB,EACjBpG,QAAiB;IAEjB,OAAO,CAAC,6BAA6B,EAAEA,WAAW,KAAK,QAAQ,iBAAiB,EAAEJ,mBAAmBwG,YAAY;AACnH;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpBC,KAOC,EACD5D,IAIC;QAMaA,aA6DA4D,gBA8BAC,WA8BFA;IAzHZ,MAAMd,SAAQ/C,cAAAA,KAAK+C,KAAK,YAAV/C,cAAc8D,KAAKC,GAAG;IACpC,MAAM,EAAE3G,MAAM,EAAEkC,eAAe,EAAE,GAAGsE;IACpC,MAAMI,YAAYhE,KAAKG,SAAS,CAC7BC,UAAU,CAACwC,gCACXvC,GAAG,CAACf;IACP,MAAM2E,UAAU,MAAMjE,KAAKG,SAAS,CAAC+D,cAAc,CAAC,OAAOC;YAwB5BC;QAvB7B,MAAMA,QAAQ,MAAMD,YAAY5D,GAAG,CAACyD;QACpC,MAAMK,SACJC,MAAMC,OAAO,CAACH,MAAM7D,GAAG,CAAC,cAAc6D,MAAM7D,GAAG,CAAC,aAAa,EAAE;QAEjE,IAAI8D,OAAOG,IAAI,CAAC,CAACpB,QAAUA,MAAM3G,cAAc,KAAKW,OAAOX,cAAc,GAAG;YAC1E,OAAO;gBAAE6D,OAAO;gBAAOiD,SAAS;gBAAOkB,UAAU;gBAAG3B,SAASuB;YAAO;QACtE;QACA,MAAMvB,UAAoC;eACrCuB,OAAOlB,MAAM,CACd,CAACC,QAAUA,MAAMC,IAAI,IAAIN,QAAQR,qBAAqBG,QAAQ;YAEhE;gBACElG,MAAMY,OAAOZ,IAAI;gBACjBC,gBAAgBW,OAAOX,cAAc;gBACrCgB,UAAUL,OAAOK,QAAQ;gBACzBE,aAAaP,OAAOO,WAAW;gBAC/BC,UAAUR,OAAOQ,QAAQ;gBACzBgC,QAAQxC,OAAOwC,MAAM;gBACrBiE,SAASD,MAAMC,OAAO;gBACtBR,MAAMN;YACR;SACD;QACD,MAAM,EAAEQ,OAAO,EAAE,GAAGV,mBAAmBC,SAASC;QAChD,MAAM2B,gBAAgB7G,QAAOuG,aAAAA,MAAM7D,GAAG,CAAC,4BAAV6D,aAA8B;QAC3D,MAAMK,WACJlB,WACA,CAAEmB,CAAAA,iBAAiB3B,QAAQ2B,gBAAgBnC,qBAAqBE,QAAQ,AAAD,IACnEM,QACA;QACNoB,YAAYzD,GAAG,CACbsD,WACA;YACE1E;YACAwD;YACAxF,UAAUF,OAAOE,QAAQ;YACzBqH,aAAa5B;WACT0B,WAAW;YAAEC,eAAeD;QAAS,IAAI,CAAC,IAEhD;YAAE7C,OAAO;QAAK;QAEhB,OAAO;YAAEtB,OAAO;YAAMiD;YAASkB;YAAU3B;QAAQ;IACnD;IACA,IAAI,CAACmB,QAAQQ,QAAQ,EAAE;QACrB,OAAO;YAAEnE,OAAO2D,QAAQ3D,KAAK;YAAEiD,SAASU,QAAQV,OAAO;YAAEqB,OAAO;QAAK;IACvE;IAEA,MAAM,EAAE3B,SAAS,EAAE,GAAGJ,mBAAmBoB,QAAQnB,OAAO,EAAEC;IAC1D,MAAM8B,WAAWZ,QAAQnB,OAAO,CAACK,MAAM,CACrC,CAACC,QAAUA,MAAMC,IAAI,IAAIN,QAAQR,qBAAqBE,QAAQ;IAEhE,MAAM3F,WAAWd,WAAW,UACzBU,MAAM,CAAC,CAAC,sBAAsB,EAAE4C,gBAAgB,CAAC,EAAE2E,QAAQQ,QAAQ,EAAE,EACrE9H,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;IACZ,MAAMqD,YAAYpD,4BAA4BC;IAC9C,MAAMG,SAAQ2G,iBAAAA,MAAMkB,MAAM,CAAC,EAAE,YAAflB,iBAAmB;IACjC,MAAMC,UAAU;WAAI,IAAIX,IAAI2B,SAASE,OAAO,CAAC,CAAC3B;gBAAUA;oBAAAA,iBAAAA,MAAMS,OAAO,YAAbT,iBAAiB,EAAE;;KAAG;IAC9E,MAAMjB,YAAYsB,0BAA0BnE,iBAAiBlC,OAAOE,QAAQ;IAC5E,MAAM2D,UAAU;QACd,GAAGgC,UAAUO,MAAM,CAAC,6CAA6C,EAAElE,gBAAgB,kDAAkD,EAAEqD,YAAY,KAAK,CAAC,GACtJvF,CAAAA,OAAOE,QAAQ,GAAG,KAAK,cAAa,IACrC;QACF,CAAC,cAAc,EAAEsG,MAAMkB,MAAM,CAACtB,MAAM,GAAGI,MAAMkB,MAAM,CAAChF,IAAI,CAAC,QAAQ,eAAe,WAAW,EAAE+D,QAAQL,MAAM,GAAGK,QAAQ/D,IAAI,CAAC,QAAQ,eAAe,CAAC,CAAC;WACjJ+E,SAASvB,GAAG,CACb,CAACF;gBAC2DA;mBAA1D,CAAC,EAAE,EAAEhH,UAAU,CAACgH,MAAM5G,IAAI,CAAC,CAAC,CAAC,EAAE4G,MAAM3G,cAAc,CAAC,IAAI,GAAE2G,kBAAAA,MAAM3F,QAAQ,YAAd2F,kBAAkB,oBAAoB,GAAG,EAAE1F,mBAAmB0F,MAAMzF,WAAW,EAAEyF,MAAMxF,QAAQ,GAAG,GAC3JwF,CAAAA,MAAMxD,MAAM,GAAG,CAAC,GAAG,EAAEwD,MAAMxD,MAAM,EAAE,GAAG,EAAC;;QAE5C;QACA,CAAC,4IAA4I,EAAEuC,UAAU,yCAAyC,CAAC;KACpM,CACErC,IAAI,CAAC,MACLlD,KAAK,CAAC,GAAG;IACZ,MAAMoD,KAAKG,SAAS,CACjBC,UAAU,CAACnE,yBACXoE,GAAG,CAACvD,UACJ4D,GAAG,CACF;QACET;QACA,2DAA2D;QAC3DU,UAAU;QACVC,UAAU;QACVC,QAAQ;QACRC,KAAK;QACLC,kBAAkB;QAClBC,MAAM,GAAE6C,YAAAA,OAAO,CAAC,EAAE,YAAVA,YAAc;QACtB5G;QACAgE;QACAC,eAAe;QACfC,cAAc;QACdC,MAAM;QACNC,aAAa;QACb2D,eAAe;YACb1F;YACA2F,kBAAkB9C;YAClBc;YACA6B,QAAQlB,MAAMkB,MAAM;YACpBjB;YACAqB,WAAW3C,qBAAqBC,kBAAkB;YAClD2C,YAAYxC;YACZrF,UAAUF,OAAOE,QAAQ;QAC3B;QACAoE,QAAQ;QACRC,WAAWxF,WAAWsF,eAAe;QACrCD,WAAWrF,WAAWsF,eAAe;IACvC,GACA;QAAEG,OAAO;IAAK;IAElB,yEAAyE;IACzE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM5B,KACH6B,UAAU,CAAC;QACVrF,MAAM;QACNS;QACA+D,MAAM,GAAE6C,aAAAA,OAAO,CAAC,EAAE,YAAVA,aAAc;QACtB/G;QACAmD;QACA6B,MAAM;YAAEC,OAAO;YAAsCC,MAAM;QAAsB;QACjFG;QACAC,eACE,CAAC,kBAAkB,EAAE9C,gBAAgB,oCAAoC,CAAC,GAC1E,GAAG2D,UAAUO,MAAM,CAAC,sBAAsB,EAAEb,YAAY,KAAK,CAAC,GAC7DvF,CAAAA,OAAOE,QAAQ,GAAG,KAAK,cAAa,IACrC;IACJ,GACC+E,KAAK,CAAC,IAAMC;IACf,OAAO;QAAEhC,OAAO;QAAMiD,SAAS;QAAMqB,OAAO;YAAE9H;YAAUmD;QAAU;IAAE;AACtE"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-fraud-signal.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * STRIPE'S FRAUD SIGNALS, INTO THE ABUSE QUEUE (AGL-3356).\n *\n * The 9/26 incident paid for Pro with a card whose CVC check came back\n * unavailable and which never met 3-D Secure. Stripe had three ways to tell\n * us about a card like that — an early fraud warning from the issuer, a\n * Radar review, a dispute — and the platform webhook either did not\n * subscribe to them or filed them where nobody triages abuse.\n *\n * Each signal now files an urgent row in the abuse queue that names the\n * workspace, the charge and the amount, links the staff Subscription card\n * on the org page (AGL-3359, where billing is canceled), and notifies staff\n * once. NOTHING IS DONE TO THE MONEY OR THE SUBSCRIPTION: no refund, no\n * cancel. An early fraud warning is not a chargeback, a review may clear, and\n * a refund issued before staff look can be the wrong half of a dispute. The\n * row is the prompt; staff decide.\n *\n * ONE ROW PER CHARGE (AGL-3490). The three signals are separate Stripe\n * objects about the same payment, and one fraudulent charge routinely draws\n * two of them — a warning and then a dispute, in either order: the issuer's\n * fraud report reached Stripe a day AFTER the 9/26 charge's chargeback had\n * been accepted. Keyed by signal, each one opened its own urgent row and told\n * the owners and staff again. So the row is keyed by the charge, and a later\n * signal joins it: added to `paymentSignals`, never a second row or a second\n * notice. A row staff have closed stays closed — the later signal is written\n * onto it, beside what they decided — with one exception: a DISPUTE on a row\n * staff DISMISSED reopens it and tells them, because the bank now says the\n * cardholder did not make the payment staff judged genuine, and the evidence\n * deadline is running.\n *\n * Dependencies are passed in rather than imported — the Firestore handle the\n * webhook observes its writes through, and its staff notifier — so the\n * webhook's \"did this delivery do anything\" ledger sees the write, and a spec\n * substituting the admin barrel substitutes these too.\n *=========================================*/\n\nimport { createHash } from 'crypto'\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport { RISK_PAYMENT_EVENTS } from '@aglyn/shared-util-email/risk-notice-catalog'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport type { RiskEventInput } from './risk-notice'\n\n/**\n * The seam every signal here tells people through (AGL-3368): the owners\n * and admins of the workspace, and staff. Passed in, like the Firestore\n * handle, so the webhook's spec substitutes it with the barrel.\n */\nexport type RiskNotifier = (input: RiskEventInput) => Promise<unknown>\n\n/** Which Stripe signal this is. */\nexport type PaymentFraudSignalKind =\n  | 'early-fraud-warning'\n  | 'radar-review'\n  | 'dispute'\n\nconst KIND_LABEL: Record<PaymentFraudSignalKind, string> = {\n  'early-fraud-warning': 'Early fraud warning',\n  'radar-review': 'Radar review opened',\n  dispute: 'Card dispute opened',\n}\n\n/** The Stripe object type each signal arrives as, for the queue's text. */\nexport const PAYMENT_FRAUD_SIGNAL_LABELS = KIND_LABEL\n\n/** What the card's own checks said, when the charge could be read. */\nexport interface PaymentFraudCardChecks {\n  cvcCheck: string | null\n  addressPostalCodeCheck: string | null\n  cardCountry: string | null\n  riskLevel: string | null\n  threeDSecure: string | null\n}\n\nexport interface PaymentFraudSignal {\n  kind: PaymentFraudSignalKind\n  /** The EFW, review or dispute id: one entry per signal, whatever redelivers. */\n  stripeObjectId: string\n  chargeId: string | null\n  paymentIntentId: string | null\n  /** The workspace the charge billed, or null when it resolved to none. */\n  orgId: string | null\n  /** Smallest currency unit, or null when nothing recorded the amount. */\n  amountCents: number | null\n  currency: string\n  /** `fraud_type`, the review's `reason`, the dispute's `reason`. */\n  detail: string\n  checks: PaymentFraudCardChecks | null\n  livemode: boolean\n}\n\n/**\n * The row id: one per CHARGE (AGL-3490), so every signal about one payment\n * lands on the same row. The payment intent stands in for a signal that\n * names no charge, and the signal itself for one that names neither. Hex,\n * so the admin route's id pattern addresses it.\n */\nexport function paymentFraudSignalReviewId(\n  signal: Pick<\n    PaymentFraudSignal,\n    'kind' | 'stripeObjectId' | 'chargeId' | 'paymentIntentId'\n  >,\n): string {\n  const payment = signal.chargeId || signal.paymentIntentId\n  return createHash('sha256')\n    .update(\n      payment\n        ? `stripe-fraud:payment:${payment}`\n        : `stripe-fraud:${signal.kind}:${signal.stripeObjectId}`,\n    )\n    .digest('hex')\n    .slice(0, 40)\n}\n\n/** One signal as the row's history keeps it (AGL-3490). */\nexport interface PaymentFraudSignalEntry {\n  kind: PaymentFraudSignalKind\n  stripeObjectId: string\n  detail: string\n  atMs: number\n  /**\n   * The row's status when this signal arrived, if staff had already closed\n   * it — `actioned` or `dismissed` — else null.\n   */\n  arrivedAfter: string | null\n}\n\n/** The row's history is a short list; a charge draws at most a few signals. */\nconst SIGNAL_HISTORY_MAX = 10\n\n/** The statuses that mean staff have decided the row. */\nconst CLOSED_STATUSES: ReadonlySet<string> = new Set(['actioned', 'dismissed'])\n\n/** The staff-facing reference, beside the intake's `AR-` and the screen's `HS-`. */\nexport function paymentFraudSignalReference(reviewId: string): string {\n  return `PF-${reviewId.slice(0, 10).toUpperCase()}`\n}\n\n/** Where staff act on the workspace's billing: its Subscription card. */\nexport function staffSubscriptionCardPath(orgId: string): string {\n  return `/admin/orgs/${encodeURIComponent(orgId)}#subscription`\n}\n\n/**\n * The Stripe Dashboard page for a signal: the dispute itself, else the\n * payment it is about.\n */\nexport function stripeSignalDashboardUrl(signal: {\n  kind: PaymentFraudSignalKind\n  stripeObjectId: string\n  chargeId: string | null\n  paymentIntentId: string | null\n  livemode: boolean\n}): string | null {\n  const base = `https://dashboard.stripe.com/${signal.livemode ? '' : 'test/'}`\n  if (signal.kind === 'dispute' && signal.stripeObjectId) {\n    return `${base}disputes/${encodeURIComponent(signal.stripeObjectId)}`\n  }\n  const payment = signal.paymentIntentId || signal.chargeId\n  return payment ? `${base}payments/${encodeURIComponent(payment)}` : null\n}\n\n/** `$56.00 USD`, or a sentence saying the amount is not known. */\nexport function formatSignalAmount(\n  amountCents: number | null,\n  currency: string,\n): string {\n  if (amountCents === null || !Number.isFinite(amountCents)) {\n    return 'amount not recorded'\n  }\n  return `${(amountCents / 100).toFixed(2)} ${String(currency || 'usd').toUpperCase()}`\n}\n\n/**\n * The one-line summary of a charge Stripe gives back, for a signal whose\n * charge is not on a platform revenue row. A READ — the only Stripe call\n * this module makes — and it answers null rather than throwing, because a\n * fraud alert that fails for want of an amount is worse than one that says\n * the amount is unknown.\n */\nexport async function readStripeChargeForSignal(\n  chargeId: string,\n  options: { secretKey: string | undefined; fetchImpl?: typeof fetch },\n): Promise<{\n  amountCents: number | null\n  currency: string\n  customerId: string | null\n  checks: PaymentFraudCardChecks\n  /**\n   * The connected account the charge paid (AGL-3360): a destination\n   * charge's `transfer_data.destination`. Every sale Aglyn takes for a site\n   * is a destination charge on the platform account — the facilitator\n   * model (AGL-1956) — so this is the seller. Null for a charge that paid\n   * only the platform, a workspace's own subscription.\n   */\n  sellerAccountId: string | null\n} | null> {\n  if (!chargeId || !options.secretKey) return null\n  try {\n    const response = await (options.fetchImpl ?? fetch)(\n      `https://api.stripe.com/v1/charges/${encodeURIComponent(chargeId)}`,\n      { headers: { Authorization: `Bearer ${options.secretKey}` } },\n    )\n    if (!response.ok) return null\n    const charge = (await response.json()) as Record<string, any>\n    const card = charge?.['payment_method_details']?.['card'] ?? {}\n    const text = (value: unknown) =>\n      typeof value === 'string' && value ? value : null\n    return {\n      amountCents: Number.isFinite(Number(charge?.['amount']))\n        ? Number(charge['amount'])\n        : null,\n      currency: String(charge?.['currency'] ?? 'usd'),\n      customerId: text(charge?.['customer']),\n      checks: {\n        cvcCheck: text(card?.['checks']?.['cvc_check']),\n        addressPostalCodeCheck: text(card?.['checks']?.['address_postal_code_check']),\n        cardCountry: text(card?.['country']),\n        riskLevel: text(charge?.['outcome']?.['risk_level']),\n        threeDSecure: text(card?.['three_d_secure']?.['result']),\n      },\n      sellerAccountId: accountRef(charge?.['transfer_data']?.['destination']),\n    }\n  } catch {\n    return null\n  }\n}\n\n/** A Stripe account reference, expanded or not, as an id or null. */\nfunction accountRef(value: unknown): string | null {\n  const id =\n    typeof value === 'string'\n      ? value\n      : String((value as { id?: unknown } | null)?.id ?? '')\n  return id.startsWith('acct_') ? id : null\n}\n\n/**\n * The row's prose: what arrived, about which workspace, and what to do.\n *\n * `history` is every signal on the charge, this one last; `closed` is what\n * staff had decided before it arrived, if anything. The closing line says\n * what THIS ALERT did — nothing to the money or the subscription — and\n * never claims nothing was done at all: by the time a late warning lands,\n * staff may have canceled, locked and accepted the chargeback (AGL-3490).\n */\nexport function describePaymentFraudSignal(\n  signal: PaymentFraudSignal,\n  context: {\n    history?: readonly PaymentFraudSignalEntry[]\n    closed?: { status: string; resolution: string | null } | null\n    reopened?: boolean\n  } = {},\n): string {\n  const lines = [\n    `${KIND_LABEL[signal.kind]} from Stripe (${signal.stripeObjectId})` +\n      (signal.livemode ? '' : ' — TEST MODE') +\n      '.',\n    `Workspace: ${signal.orgId ?? 'none — the charge did not resolve to a workspace subscription'}.`,\n    `Charge: ${signal.chargeId ?? signal.paymentIntentId ?? 'not named'} · ${formatSignalAmount(signal.amountCents, signal.currency)}.`,\n  ]\n  if (signal.detail) lines.push(`Stripe says: ${signal.detail}.`)\n  const checks = signal.checks\n  if (checks) {\n    lines.push(\n      `Card: CVC ${checks.cvcCheck ?? 'unknown'}, postal code ${checks.addressPostalCodeCheck ?? 'unknown'}, ` +\n        `issued in ${checks.cardCountry ?? 'unknown'}, 3DS ${checks.threeDSecure ?? 'not used'}, ` +\n        `Radar risk ${checks.riskLevel ?? 'unknown'}.`,\n    )\n  }\n  const history = context.history ?? []\n  if (history.length > 1) {\n    lines.push(\n      `Every signal on this charge, oldest first: ${history\n        .map(\n          (entry) =>\n            `${KIND_LABEL[entry.kind]} (${entry.stripeObjectId}` +\n            (entry.arrivedAfter ? `, after the row was ${entry.arrivedAfter}` : '') +\n            ')',\n        )\n        .join('; ')}.`,\n    )\n  }\n  const resolution = context.closed?.resolution\n    ? `: “${context.closed.resolution}”`\n    : '.'\n  if (context.reopened && context.closed) {\n    lines.push(\n      `REOPENED. Staff had dismissed this row${resolution} The cardholder’s bank has now disputed the payment. Answer or accept the dispute in Stripe before its evidence deadline, then close this row again with what you did.`,\n    )\n  } else if (context.closed) {\n    lines.push(\n      `This signal arrived after the row was closed as ${context.closed.status}${resolution} The row stays closed and nobody was notified again. Reopen it only if that decision no longer holds.`,\n    )\n  } else {\n    lines.push(\n      signal.kind === 'radar-review'\n        ? 'The payment waits in Stripe until the review is closed there.'\n        : signal.kind === 'dispute'\n          ? 'Answer the dispute in Stripe before its evidence deadline.'\n          : 'An early fraud warning is not yet a chargeback; refunding now can avoid one.',\n      'This alert refunded and canceled nothing. Decide on the org’s Subscription card, lock the workspace if it is fraud, and close this row with what you did.',\n    )\n  }\n  return lines.join('\\n').slice(0, 5000)\n}\n\n/** The history a stored row carries, oldest first. */\nfunction signalHistoryOf(\n  row: Record<string, unknown> | null,\n  fallbackAtMs: number,\n): PaymentFraudSignalEntry[] {\n  if (!row) return []\n  const kinds = Object.keys(KIND_LABEL)\n  const stored = Array.isArray(row['paymentSignals']) ? row['paymentSignals'] : []\n  const entries = stored.flatMap((value): PaymentFraudSignalEntry[] => {\n    const entry = (value ?? {}) as Record<string, unknown>\n    const kind = String(entry['kind'] ?? '')\n    const stripeObjectId = String(entry['stripeObjectId'] ?? '')\n    if (!kinds.includes(kind) || !stripeObjectId) return []\n    return [\n      {\n        kind: kind as PaymentFraudSignalKind,\n        stripeObjectId,\n        detail: String(entry['detail'] ?? ''),\n        atMs: Number(entry['atMs']) || 0,\n        arrivedAfter:\n          typeof entry['arrivedAfter'] === 'string' ? entry['arrivedAfter'] : null,\n      },\n    ]\n  })\n  if (entries.length) return entries\n  // A row filed before the history existed carries its one signal as\n  // `paymentSignal`, which is where a redelivery of it is recognised.\n  const only = (row['paymentSignal'] ?? null) as Record<string, unknown> | null\n  const kind = String(only?.['kind'] ?? '')\n  const stripeObjectId = String(only?.['stripeObjectId'] ?? '')\n  return kinds.includes(kind) && stripeObjectId\n    ? [\n        {\n          kind: kind as PaymentFraudSignalKind,\n          stripeObjectId,\n          detail: String(only?.['detail'] ?? ''),\n          atMs: fallbackAtMs,\n          arrivedAfter: null,\n        },\n      ]\n    : []\n}\n\n/**\n * File one signal on its charge's row, and tell the owners and staff once\n * per charge (AGL-3490).\n *\n * The first signal on a charge opens the row. A later one — a different\n * Stripe object about the same payment — is added to `paymentSignals`, and\n * `paymentSignal` becomes it, so the row's Stripe link follows a dispute.\n * The status is staff's from the moment they touch it and is left alone,\n * except that a dispute on a DISMISSED row reopens it and notifies again. A\n * redelivery of a signal already on the row adds nothing. Read and written\n * in one transaction, so a warning and a dispute arriving together still\n * make one row. Throws only if the row write throws, which is the webhook's\n * to answer; the notification never throws.\n */\nexport async function recordPaymentFraudSignal(\n  signal: PaymentFraudSignal,\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notifyRisk: RiskNotifier\n    nowMs?: number\n  },\n): Promise<{\n  reviewId: string\n  reference: string\n  first: boolean\n  reopened: boolean\n}> {\n  const reviewId = paymentFraudSignalReviewId(signal)\n  const reference = paymentFraudSignalReference(reviewId)\n  const ref = deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n  const atMs = deps.nowMs ?? Date.now()\n  const { first, reopened } = await deps.firestore.runTransaction(\n    async (transaction) => {\n      const snapshot = await transaction.get(ref)\n      const existing = snapshot.exists\n        ? ((snapshot.data() ?? {}) as Record<string, unknown>)\n        : null\n      const history = signalHistoryOf(existing, atMs)\n      if (\n        existing &&\n        history.some((entry) => entry.stripeObjectId === signal.stripeObjectId)\n      ) {\n        transaction.set(\n          ref,\n          { updatedAt: FieldValue.serverTimestamp() },\n          { merge: true },\n        )\n        return { first: false, reopened: false }\n      }\n      const status = existing ? String(existing['status'] ?? 'open') : 'open'\n      const wasClosed = CLOSED_STATUSES.has(status)\n      const reopen = status === 'dismissed' && signal.kind === 'dispute'\n      const resolution =\n        typeof existing?.['resolution'] === 'string' &&\n        existing['resolution'].trim()\n          ? existing['resolution'].trim()\n          : null\n      const nextHistory = [\n        ...history,\n        {\n          kind: signal.kind,\n          stripeObjectId: signal.stripeObjectId,\n          detail: signal.detail,\n          atMs,\n          arrivedAfter: wasClosed ? status : null,\n        },\n      ].slice(-SIGNAL_HISTORY_MAX)\n      // A later signal whose charge read failed keeps what the first one\n      // learned rather than erasing it.\n      const previous = (existing?.['paymentSignal'] ?? null) as Record<\n        string,\n        unknown\n      > | null\n      const orgId =\n        signal.orgId ??\n        (typeof existing?.['orgId'] === 'string' ? existing['orgId'] : null)\n      const merged: PaymentFraudSignal = {\n        ...signal,\n        orgId,\n        amountCents:\n          signal.amountCents ??\n          (typeof previous?.['amountCents'] === 'number'\n            ? previous['amountCents']\n            : null),\n        checks:\n          signal.checks ??\n          ((previous?.['checks'] ?? null) as PaymentFraudCardChecks | null),\n      }\n      transaction.set(\n        ref,\n        {\n          reference,\n          // \"Phishing or fraud\" — the queue's urgent fraud category.\n          category: 'phishing',\n          severity: 'urgent',\n          source: 'stripe-fraud-signal',\n          url: null,\n          reportedHostname: null,\n          hostId: null,\n          orgId,\n          details: describePaymentFraudSignal(merged, {\n            history: nextHistory,\n            closed: wasClosed ? { status, resolution } : null,\n            reopened: reopen,\n          }),\n          reporterEmail: null,\n          reporterName: null,\n          dmca: null,\n          reportCount: nextHistory.length,\n          paymentSignals: nextHistory,\n          paymentSignal: {\n            kind: merged.kind,\n            stripeObjectId: merged.stripeObjectId,\n            chargeId: merged.chargeId,\n            paymentIntentId: merged.paymentIntentId,\n            amountCents: merged.amountCents,\n            currency: merged.currency,\n            detail: merged.detail,\n            checks: merged.checks,\n            livemode: merged.livemode,\n            subscriptionCard: orgId ? staffSubscriptionCardPath(orgId) : null,\n          },\n          updatedAt: FieldValue.serverTimestamp(),\n          ...(existing\n            ? {}\n            : { status: 'open', createdAt: FieldValue.serverTimestamp() }),\n          ...(reopen\n            ? {\n                status: 'open',\n                reopenedAt: FieldValue.serverTimestamp(),\n                resolvedAt: null,\n              }\n            : {}),\n        },\n        { merge: true },\n      )\n      return { first: !existing, reopened: reopen }\n    },\n  )\n  if (first || reopened) {\n    // The workspace's owners are told their subscription payment was\n    // flagged and how to confirm it; staff get the row with the evidence.\n    await deps\n      .notifyRisk({\n        kind: 'billing-payment-flagged',\n        orgId: signal.orgId,\n        reviewId,\n        reference,\n        item: { label: 'your subscription payment', path: '/org/billing/invoices' },\n        amount: formatSignalAmount(signal.amountCents, signal.currency),\n        // A dispute is the bank's, already opened; a warning or a review is\n        // a fraud check. The notice says which.\n        paymentEvent: RISK_PAYMENT_EVENTS[signal.kind] ?? null,\n        stripeUrl: stripeSignalDashboardUrl(signal),\n        staffEvidence:\n          `${KIND_LABEL[signal.kind]} (${signal.stripeObjectId}) on charge ` +\n          `${signal.chargeId ?? signal.paymentIntentId ?? 'not named'}` +\n          (signal.detail ? `; Stripe says: ${signal.detail}` : '') +\n          (signal.livemode ? '' : ' — TEST MODE') +\n          (reopened ? '; reopened a row staff had dismissed' : '') +\n          '.',\n      })\n      .catch(() => undefined)\n  }\n  return { reviewId, reference, first, reopened }\n}\n\n/*==========================================\n * THE SELLER PATTERN: WHEN THE MERCHANT MAY BE THE FRAUDSTER (AGL-3360).\n *\n * A site's own sales are destination charges on the platform account, so\n * Stripe's fraud signals about a shopper's card arrive here too. One of them\n * is the merchant's business — their customer, their order, their decision\n * (`payment-risk-record.ts` puts it on the record and tells them). Staff are\n * not paged for it.\n *\n * What IS staff's business is the shape a phishing actor leaves when they\n * run stolen cards through a storefront of their own: several different\n * charges on ONE connected account drawing issuer fraud reports or\n * chargebacks in a short time. So every signal on a seller's charge is kept\n * in a small per-account ledger, and one urgent abuse-queue row is filed when\n *\n *   ≥ 3 DISTINCT charges carry an early fraud warning or a dispute\n *   within 7 days.\n *\n * Why those numbers. An early fraud warning is an issuer's report that the\n * cardholder did not make the payment, and a dispute is a formal\n * chargeback; a legitimate small merchant sees either rarely — card-network\n * dispute monitoring starts near 0.9% of a month's transactions, single\n * digits a MONTH for a shop doing hundreds of sales. One or two in a week is\n * ordinary friendly fraud and must never page staff. Three separate charges\n * in one week is a rate a real small shop does not produce, and is what a\n * card tester or a stolen-card storefront produces within days. Counted by\n * CHARGE, because a warning is routinely followed by a dispute on the same\n * payment, and that is one bad payment, not two. Radar reviews are kept in\n * the ledger for the row's prose but never counted: a review is Stripe's\n * suspicion, not an issuer's report, and a busy shop can collect several\n * that clear.\n *\n * One row per window: once filed, the account is not filed again until 7\n * days have passed, so a burst is one row with everything in it rather than\n * a row per signal. NOTHING IS DONE TO THE ACCOUNT OR THE MONEY: staff\n * decide (lock the workspace, pause the account's payouts in Stripe).\n *=========================================*/\n\nexport const SELLER_FRAUD_PATTERN = {\n  /** Distinct charges with an early fraud warning or a dispute. */\n  minDistinctCharges: 3,\n  /** …within this window. */\n  windowMs: 7 * 24 * 60 * 60 * 1000,\n  /** How long the ledger keeps an entry at all. */\n  retainMs: 30 * 24 * 60 * 60 * 1000,\n} as const\n\nconst WINDOW_DAYS = SELLER_FRAUD_PATTERN.windowMs / 86_400_000\n\n/** Admin-SDK only; no client rule opens it (default deny). */\nexport const SELLER_FRAUD_LEDGER_COLLECTION = 'paymentFraudLedger'\n\nexport interface SellerFraudLedgerEntry {\n  kind: PaymentFraudSignalKind\n  stripeObjectId: string\n  chargeId: string | null\n  amountCents: number | null\n  currency: string\n  detail: string\n  /** The sites a plugin recognised the charge as belonging to. */\n  hostIds: string[]\n  atMs: number\n}\n\n/** Whether a seller's ledger shows the pattern at `nowMs`. Pure. */\nexport function sellerFraudPattern(\n  entries: readonly SellerFraudLedgerEntry[],\n  nowMs: number,\n): { matched: boolean; chargeIds: string[] } {\n  const since = nowMs - SELLER_FRAUD_PATTERN.windowMs\n  const chargeIds = [\n    ...new Set(\n      entries\n        .filter(\n          (entry) =>\n            (entry.kind === 'early-fraud-warning' || entry.kind === 'dispute') &&\n            entry.atMs >= since,\n        )\n        .map((entry) => entry.chargeId || entry.stripeObjectId),\n    ),\n  ]\n  return {\n    matched: chargeIds.length >= SELLER_FRAUD_PATTERN.minDistinctCharges,\n    chargeIds,\n  }\n}\n\n/** The connected account's page in the Stripe Dashboard. */\nexport function stripeConnectedAccountUrl(\n  accountId: string,\n  livemode: boolean,\n): string {\n  return `https://dashboard.stripe.com/${livemode ? '' : 'test/'}connect/accounts/${encodeURIComponent(accountId)}`\n}\n\n/**\n * Keep one signal on a seller's charge, and file the pattern row when the\n * ledger crosses the threshold. Idempotent on the Stripe object id: a\n * redelivery changes nothing and files nothing.\n */\nexport async function recordSellerFraudSignal(\n  input: {\n    signal: PaymentFraudSignal\n    sellerAccountId: string\n    /** The sites a plugin recognised the charge as belonging to. */\n    hostIds: string[]\n    /** Workspaces owning those sites, for the row. */\n    orgIds: string[]\n  },\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notifyRisk: RiskNotifier\n    nowMs?: number\n  },\n): Promise<{\n  first: boolean\n  matched: boolean\n  filed: { reviewId: string; reference: string } | null\n}> {\n  const nowMs = deps.nowMs ?? Date.now()\n  const { signal, sellerAccountId } = input\n  const ledgerRef = deps.firestore\n    .collection(SELLER_FRAUD_LEDGER_COLLECTION)\n    .doc(sellerAccountId)\n  const outcome = await deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(ledgerRef)\n    const stored = (\n      Array.isArray(fresh.get('entries')) ? fresh.get('entries') : []\n    ) as SellerFraudLedgerEntry[]\n    if (stored.some((entry) => entry.stripeObjectId === signal.stripeObjectId)) {\n      return { first: false, matched: false, fileAtMs: 0, entries: stored }\n    }\n    const entries: SellerFraudLedgerEntry[] = [\n      ...stored.filter(\n        (entry) => entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.retainMs,\n      ),\n      {\n        kind: signal.kind,\n        stripeObjectId: signal.stripeObjectId,\n        chargeId: signal.chargeId,\n        amountCents: signal.amountCents,\n        currency: signal.currency,\n        detail: signal.detail,\n        hostIds: input.hostIds,\n        atMs: nowMs,\n      },\n    ]\n    const { matched } = sellerFraudPattern(entries, nowMs)\n    const lastFiledAtMs = Number(fresh.get('lastFiledAtMs') ?? 0)\n    const fileAtMs =\n      matched &&\n      !(lastFiledAtMs && nowMs - lastFiledAtMs < SELLER_FRAUD_PATTERN.windowMs)\n        ? nowMs\n        : 0\n    transaction.set(\n      ledgerRef,\n      {\n        sellerAccountId,\n        entries,\n        livemode: signal.livemode,\n        updatedAtMs: nowMs,\n        ...(fileAtMs ? { lastFiledAtMs: fileAtMs } : {}),\n      },\n      { merge: true },\n    )\n    return { first: true, matched, fileAtMs, entries }\n  })\n  if (!outcome.fileAtMs) {\n    return { first: outcome.first, matched: outcome.matched, filed: null }\n  }\n\n  const { chargeIds } = sellerFraudPattern(outcome.entries, nowMs)\n  const inWindow = outcome.entries.filter(\n    (entry) => entry.atMs >= nowMs - SELLER_FRAUD_PATTERN.windowMs,\n  )\n  const reviewId = createHash('sha256')\n    .update(`stripe-seller-pattern:${sellerAccountId}:${outcome.fileAtMs}`)\n    .digest('hex')\n    .slice(0, 40)\n  const reference = paymentFraudSignalReference(reviewId)\n  const orgId = input.orgIds[0] ?? null\n  const hostIds = [...new Set(inWindow.flatMap((entry) => entry.hostIds ?? []))]\n  const stripeUrl = stripeConnectedAccountUrl(sellerAccountId, signal.livemode)\n  const details = [\n    `${chargeIds.length} different charges paid to connected account ${sellerAccountId} drew an issuer fraud warning or a dispute within ${WINDOW_DAYS} days` +\n      (signal.livemode ? '' : ' — TEST MODE') +\n      '.',\n    `Workspace(s): ${input.orgIds.length ? input.orgIds.join(', ') : 'not resolved'}. Site(s): ${hostIds.length ? hostIds.join(', ') : 'not resolved'}.`,\n    ...inWindow.map(\n      (entry) =>\n        `• ${KIND_LABEL[entry.kind]} ${entry.stripeObjectId} on ${entry.chargeId ?? 'an unnamed charge'} · ${formatSignalAmount(entry.amountCents, entry.currency)}` +\n        (entry.detail ? ` · ${entry.detail}` : ''),\n    ),\n    'A shop taking stolen cards through its own storefront leaves this shape. Each merchant has already been shown the signal on its own order or booking.',\n    `Nothing has been refunded, canceled or paused. If this is the seller's fraud, lock the workspace and pause the account's payouts in Stripe (${stripeUrl}), then close this row with what you did.`,\n  ]\n    .join('\\n')\n    .slice(0, 5000)\n  await deps.firestore\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .set(\n      {\n        reference,\n        // \"Phishing or fraud\" — the queue's urgent fraud category.\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'stripe-seller-fraud-pattern',\n        url: null,\n        reportedHostname: null,\n        hostId: hostIds[0] ?? null,\n        orgId,\n        details,\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: 1,\n        sellerPattern: {\n          sellerAccountId,\n          stripeAccountUrl: stripeUrl,\n          chargeIds,\n          orgIds: input.orgIds,\n          hostIds,\n          threshold: SELLER_FRAUD_PATTERN.minDistinctCharges,\n          windowDays: WINDOW_DAYS,\n          livemode: signal.livemode,\n        },\n        status: 'open',\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n  // Staff get the pattern with its numbers; the owners get a plain \"we are\n  // reviewing recent payments\" with the way to talk to us, never the count\n  // or the window that opened the review.\n  await deps\n    .notifyRisk({\n      kind: 'seller-review',\n      orgId,\n      hostId: hostIds[0] ?? null,\n      reviewId,\n      reference,\n      item: { label: 'recent card payments on your store', path: '/org/settings/holds' },\n      stripeUrl,\n      staffEvidence:\n        `Connected account ${sellerAccountId} drew fraud warnings or disputes on ` +\n        `${chargeIds.length} different charges in ${WINDOW_DAYS} days` +\n        (signal.livemode ? '' : ' — TEST MODE') +\n        '.',\n    })\n    .catch(() => undefined)\n  return { first: true, matched: true, filed: { reviewId, reference } }\n}\n"],"names":["createHash","ABUSE_REPORT_COLLECTION","RISK_PAYMENT_EVENTS","FieldValue","KIND_LABEL","dispute","PAYMENT_FRAUD_SIGNAL_LABELS","paymentFraudSignalReviewId","signal","payment","chargeId","paymentIntentId","update","kind","stripeObjectId","digest","slice","SIGNAL_HISTORY_MAX","CLOSED_STATUSES","Set","paymentFraudSignalReference","reviewId","toUpperCase","staffSubscriptionCardPath","orgId","encodeURIComponent","stripeSignalDashboardUrl","base","livemode","formatSignalAmount","amountCents","currency","Number","isFinite","toFixed","String","readStripeChargeForSignal","options","secretKey","charge","card","response","fetchImpl","fetch","headers","Authorization","ok","json","text","value","customerId","checks","cvcCheck","addressPostalCodeCheck","cardCountry","riskLevel","threeDSecure","sellerAccountId","accountRef","id","startsWith","describePaymentFraudSignal","context","lines","detail","push","history","length","map","entry","arrivedAfter","join","resolution","closed","reopened","status","signalHistoryOf","row","fallbackAtMs","kinds","Object","keys","stored","Array","isArray","entries","flatMap","includes","atMs","only","recordPaymentFraudSignal","deps","reference","ref","firestore","collection","doc","nowMs","Date","now","first","runTransaction","transaction","snapshot","existing","get","exists","data","some","set","updatedAt","serverTimestamp","merge","wasClosed","has","reopen","trim","nextHistory","previous","merged","category","severity","source","url","reportedHostname","hostId","details","reporterEmail","reporterName","dmca","reportCount","paymentSignals","paymentSignal","subscriptionCard","createdAt","reopenedAt","resolvedAt","notifyRisk","item","label","path","amount","paymentEvent","stripeUrl","staffEvidence","catch","undefined","SELLER_FRAUD_PATTERN","minDistinctCharges","windowMs","retainMs","WINDOW_DAYS","SELLER_FRAUD_LEDGER_COLLECTION","sellerFraudPattern","since","chargeIds","filter","matched","stripeConnectedAccountUrl","accountId","recordSellerFraudSignal","input","hostIds","ledgerRef","outcome","fresh","fileAtMs","lastFiledAtMs","updatedAtMs","filed","inWindow","orgIds","sellerPattern","stripeAccountUrl","threshold","windowDays"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAkC2C,GAE3C,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,uBAAuB,QAAQ,sCAAqC;AAC7E,SAASC,mBAAmB,QAAQ,+CAA8C;AAClF,SAASC,UAAU,QAAQ,2BAA0B;AAgBrD,MAAMC,aAAqD;IACzD,uBAAuB;IACvB,gBAAgB;IAChBC,SAAS;AACX;AAEA,yEAAyE,GACzE,OAAO,MAAMC,8BAA8BF,WAAU;AA4BrD;;;;;CAKC,GACD,OAAO,SAASG,2BACdC,MAGC;IAED,MAAMC,UAAUD,OAAOE,QAAQ,IAAIF,OAAOG,eAAe;IACzD,OAAOX,WAAW,UACfY,MAAM,CACLH,UACI,CAAC,qBAAqB,EAAEA,SAAS,GACjC,CAAC,aAAa,EAAED,OAAOK,IAAI,CAAC,CAAC,EAAEL,OAAOM,cAAc,EAAE,EAE3DC,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;AACd;AAeA,6EAA6E,GAC7E,MAAMC,qBAAqB;AAE3B,uDAAuD,GACvD,MAAMC,kBAAuC,IAAIC,IAAI;IAAC;IAAY;CAAY;AAE9E,kFAAkF,GAClF,OAAO,SAASC,4BAA4BC,QAAgB;IAC1D,OAAO,CAAC,GAAG,EAAEA,SAASL,KAAK,CAAC,GAAG,IAAIM,WAAW,IAAI;AACpD;AAEA,uEAAuE,GACvE,OAAO,SAASC,0BAA0BC,KAAa;IACrD,OAAO,CAAC,YAAY,EAAEC,mBAAmBD,OAAO,aAAa,CAAC;AAChE;AAEA;;;CAGC,GACD,OAAO,SAASE,yBAAyBlB,MAMxC;IACC,MAAMmB,OAAO,CAAC,6BAA6B,EAAEnB,OAAOoB,QAAQ,GAAG,KAAK,SAAS;IAC7E,IAAIpB,OAAOK,IAAI,KAAK,aAAaL,OAAOM,cAAc,EAAE;QACtD,OAAO,GAAGa,KAAK,SAAS,EAAEF,mBAAmBjB,OAAOM,cAAc,GAAG;IACvE;IACA,MAAML,UAAUD,OAAOG,eAAe,IAAIH,OAAOE,QAAQ;IACzD,OAAOD,UAAU,GAAGkB,KAAK,SAAS,EAAEF,mBAAmBhB,UAAU,GAAG;AACtE;AAEA,gEAAgE,GAChE,OAAO,SAASoB,mBACdC,WAA0B,EAC1BC,QAAgB;IAEhB,IAAID,gBAAgB,QAAQ,CAACE,OAAOC,QAAQ,CAACH,cAAc;QACzD,OAAO;IACT;IACA,OAAO,GAAG,AAACA,CAAAA,cAAc,GAAE,EAAGI,OAAO,CAAC,GAAG,CAAC,EAAEC,OAAOJ,YAAY,OAAOT,WAAW,IAAI;AACvF;AAEA;;;;;;CAMC,GACD,OAAO,eAAec,0BACpB1B,QAAgB,EAChB2B,OAAoE;IAepE,IAAI,CAAC3B,YAAY,CAAC2B,QAAQC,SAAS,EAAE,OAAO;IAC5C,IAAI;YACsBD;YAMXE,gCAUMC,cACcA,eAEbD,iBACGC,sBAEOD;QAtB9B,MAAME,WAAW,MAAM,EAACJ,qBAAAA,QAAQK,SAAS,YAAjBL,qBAAqBM,OAC3C,CAAC,kCAAkC,EAAElB,mBAAmBf,WAAW,EACnE;YAAEkC,SAAS;gBAAEC,eAAe,CAAC,OAAO,EAAER,QAAQC,SAAS,EAAE;YAAC;QAAE;QAE9D,IAAI,CAACG,SAASK,EAAE,EAAE,OAAO;QACzB,MAAMP,SAAU,MAAME,SAASM,IAAI;QACnC,MAAMP,eAAOD,2BAAAA,iCAAAA,MAAQ,CAAC,yBAAyB,qBAAlCA,8BAAoC,CAAC,OAAO,mBAAI,CAAC;QAC9D,MAAMS,OAAO,CAACC,QACZ,OAAOA,UAAU,YAAYA,QAAQA,QAAQ;QAC/C,OAAO;YACLnB,aAAaE,OAAOC,QAAQ,CAACD,OAAOO,0BAAAA,MAAQ,CAAC,SAAS,KAClDP,OAAOO,MAAM,CAAC,SAAS,IACvB;YACJR,UAAUI,gBAAOI,0BAAAA,MAAQ,CAAC,WAAW,oBAAI;YACzCW,YAAYF,KAAKT,0BAAAA,MAAQ,CAAC,WAAW;YACrCY,QAAQ;gBACNC,UAAUJ,KAAKR,yBAAAA,eAAAA,IAAM,CAAC,SAAS,qBAAhBA,YAAkB,CAAC,YAAY;gBAC9Ca,wBAAwBL,KAAKR,yBAAAA,gBAAAA,IAAM,CAAC,SAAS,qBAAhBA,aAAkB,CAAC,4BAA4B;gBAC5Ec,aAAaN,KAAKR,wBAAAA,IAAM,CAAC,UAAU;gBACnCe,WAAWP,KAAKT,2BAAAA,kBAAAA,MAAQ,CAAC,UAAU,qBAAnBA,eAAqB,CAAC,aAAa;gBACnDiB,cAAcR,KAAKR,yBAAAA,uBAAAA,IAAM,CAAC,iBAAiB,qBAAxBA,oBAA0B,CAAC,SAAS;YACzD;YACAiB,iBAAiBC,WAAWnB,2BAAAA,wBAAAA,MAAQ,CAAC,gBAAgB,qBAAzBA,qBAA2B,CAAC,cAAc;QACxE;IACF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,mEAAmE,GACnE,SAASmB,WAAWT,KAAc;;IAChC,MAAMU,KACJ,OAAOV,UAAU,WACbA,QACAd,eAAQc,yBAAD,AAACA,MAAmCU,EAAE,mBAAI;IACvD,OAAOA,GAAGC,UAAU,CAAC,WAAWD,KAAK;AACvC;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASE,2BACdrD,MAA0B,EAC1BsD,UAII,CAAC,CAAC;QAMUtD,eACHA,MAAAA,kBAWGsD;QAaGA;IA7BnB,MAAMC,QAAQ;QACZ,GAAG3D,UAAU,CAACI,OAAOK,IAAI,CAAC,CAAC,cAAc,EAAEL,OAAOM,cAAc,CAAC,CAAC,CAAC,GAChEN,CAAAA,OAAOoB,QAAQ,GAAG,KAAK,cAAa,IACrC;QACF,CAAC,WAAW,GAAEpB,gBAAAA,OAAOgB,KAAK,YAAZhB,gBAAgB,gEAAgE,CAAC,CAAC;QAChG,CAAC,QAAQ,GAAEA,QAAAA,mBAAAA,OAAOE,QAAQ,YAAfF,mBAAmBA,OAAOG,eAAe,YAAzCH,OAA6C,YAAY,GAAG,EAAEqB,mBAAmBrB,OAAOsB,WAAW,EAAEtB,OAAOuB,QAAQ,EAAE,CAAC,CAAC;KACpI;IACD,IAAIvB,OAAOwD,MAAM,EAAED,MAAME,IAAI,CAAC,CAAC,aAAa,EAAEzD,OAAOwD,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAMb,SAAS3C,OAAO2C,MAAM;IAC5B,IAAIA,QAAQ;YAEKA,kBAA6CA,gCAC3CA,qBAAwCA,sBACvCA;QAHlBY,MAAME,IAAI,CACR,CAAC,UAAU,GAAEd,mBAAAA,OAAOC,QAAQ,YAAfD,mBAAmB,UAAU,cAAc,GAAEA,iCAAAA,OAAOE,sBAAsB,YAA7BF,iCAAiC,UAAU,EAAE,CAAC,GACtG,CAAC,UAAU,GAAEA,sBAAAA,OAAOG,WAAW,YAAlBH,sBAAsB,UAAU,MAAM,GAAEA,uBAAAA,OAAOK,YAAY,YAAnBL,uBAAuB,WAAW,EAAE,CAAC,GAC1F,CAAC,WAAW,GAAEA,oBAAAA,OAAOI,SAAS,YAAhBJ,oBAAoB,UAAU,CAAC,CAAC;IAEpD;IACA,MAAMe,WAAUJ,mBAAAA,QAAQI,OAAO,YAAfJ,mBAAmB,EAAE;IACrC,IAAII,QAAQC,MAAM,GAAG,GAAG;QACtBJ,MAAME,IAAI,CACR,CAAC,2CAA2C,EAAEC,QAC3CE,GAAG,CACF,CAACC,QACC,GAAGjE,UAAU,CAACiE,MAAMxD,IAAI,CAAC,CAAC,EAAE,EAAEwD,MAAMvD,cAAc,EAAE,GACnDuD,CAAAA,MAAMC,YAAY,GAAG,CAAC,oBAAoB,EAAED,MAAMC,YAAY,EAAE,GAAG,EAAC,IACrE,KAEHC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpB;IACA,MAAMC,aAAaV,EAAAA,kBAAAA,QAAQW,MAAM,qBAAdX,gBAAgBU,UAAU,IACzC,CAAC,GAAG,EAAEV,QAAQW,MAAM,CAACD,UAAU,CAAC,CAAC,CAAC,GAClC;IACJ,IAAIV,QAAQY,QAAQ,IAAIZ,QAAQW,MAAM,EAAE;QACtCV,MAAME,IAAI,CACR,CAAC,sCAAsC,EAAEO,WAAW,sKAAsK,CAAC;IAE/N,OAAO,IAAIV,QAAQW,MAAM,EAAE;QACzBV,MAAME,IAAI,CACR,CAAC,gDAAgD,EAAEH,QAAQW,MAAM,CAACE,MAAM,GAAGH,WAAW,qGAAqG,CAAC;IAEhM,OAAO;QACLT,MAAME,IAAI,CACRzD,OAAOK,IAAI,KAAK,iBACZ,kEACAL,OAAOK,IAAI,KAAK,YACd,+DACA,gFACN;IAEJ;IACA,OAAOkD,MAAMQ,IAAI,CAAC,MAAMvD,KAAK,CAAC,GAAG;AACnC;AAEA,oDAAoD,GACpD,SAAS4D,gBACPC,GAAmC,EACnCC,YAAoB;QAwBND;IAtBd,IAAI,CAACA,KAAK,OAAO,EAAE;IACnB,MAAME,QAAQC,OAAOC,IAAI,CAAC7E;IAC1B,MAAM8E,SAASC,MAAMC,OAAO,CAACP,GAAG,CAAC,iBAAiB,IAAIA,GAAG,CAAC,iBAAiB,GAAG,EAAE;IAChF,MAAMQ,UAAUH,OAAOI,OAAO,CAAC,CAACrC;YAEVoB,aACUA,uBAMXA;QARnB,MAAMA,QAASpB,gBAAAA,QAAS,CAAC;QACzB,MAAMpC,OAAOsB,QAAOkC,cAAAA,KAAK,CAAC,OAAO,YAAbA,cAAiB;QACrC,MAAMvD,iBAAiBqB,QAAOkC,wBAAAA,KAAK,CAAC,iBAAiB,YAAvBA,wBAA2B;QACzD,IAAI,CAACU,MAAMQ,QAAQ,CAAC1E,SAAS,CAACC,gBAAgB,OAAO,EAAE;QACvD,OAAO;YACL;gBACED,MAAMA;gBACNC;gBACAkD,QAAQ7B,QAAOkC,gBAAAA,KAAK,CAAC,SAAS,YAAfA,gBAAmB;gBAClCmB,MAAMxD,OAAOqC,KAAK,CAAC,OAAO,KAAK;gBAC/BC,cACE,OAAOD,KAAK,CAAC,eAAe,KAAK,WAAWA,KAAK,CAAC,eAAe,GAAG;YACxE;SACD;IACH;IACA,IAAIgB,QAAQlB,MAAM,EAAE,OAAOkB;IAC3B,mEAAmE;IACnE,oEAAoE;IACpE,MAAMI,QAAQZ,qBAAAA,GAAG,CAAC,gBAAgB,YAApBA,qBAAwB;IACtC,MAAMhE,OAAOsB,eAAOsD,wBAAAA,IAAM,CAAC,OAAO,mBAAI;IACtC,MAAM3E,iBAAiBqB,gBAAOsD,wBAAAA,IAAM,CAAC,iBAAiB,oBAAI;IAC1D,OAAOV,MAAMQ,QAAQ,CAAC1E,SAASC,iBAC3B;QACE;YACED,MAAMA;YACNC;YACAkD,QAAQ7B,gBAAOsD,wBAAAA,IAAM,CAAC,SAAS,oBAAI;YACnCD,MAAMV;YACNR,cAAc;QAChB;KACD,GACD,EAAE;AACR;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAeoB,yBACpBlF,MAA0B,EAC1BmF,IAIC;QAUYA;IAHb,MAAMtE,WAAWd,2BAA2BC;IAC5C,MAAMoF,YAAYxE,4BAA4BC;IAC9C,MAAMwE,MAAMF,KAAKG,SAAS,CAACC,UAAU,CAAC9F,yBAAyB+F,GAAG,CAAC3E;IACnE,MAAMmE,QAAOG,cAAAA,KAAKM,KAAK,YAAVN,cAAcO,KAAKC,GAAG;IACnC,MAAM,EAAEC,KAAK,EAAE1B,QAAQ,EAAE,GAAG,MAAMiB,KAAKG,SAAS,CAACO,cAAc,CAC7D,OAAOC;YAGCC,gBAc2BC,wBAyB/BhG,eAMEA,qBAKAA;QApDJ,MAAM+F,WAAW,MAAMD,YAAYG,GAAG,CAACZ;QACvC,MAAMW,WAAWD,SAASG,MAAM,IAC1BH,iBAAAA,SAASI,IAAI,cAAbJ,iBAAmB,CAAC,IACtB;QACJ,MAAMrC,UAAUU,gBAAgB4B,UAAUhB;QAC1C,IACEgB,YACAtC,QAAQ0C,IAAI,CAAC,CAACvC,QAAUA,MAAMvD,cAAc,KAAKN,OAAOM,cAAc,GACtE;YACAwF,YAAYO,GAAG,CACbhB,KACA;gBAAEiB,WAAW3G,WAAW4G,eAAe;YAAG,GAC1C;gBAAEC,OAAO;YAAK;YAEhB,OAAO;gBAAEZ,OAAO;gBAAO1B,UAAU;YAAM;QACzC;QACA,MAAMC,SAAS6B,WAAWrE,QAAOqE,mBAAAA,QAAQ,CAAC,SAAS,YAAlBA,mBAAsB,UAAU;QACjE,MAAMS,YAAY/F,gBAAgBgG,GAAG,CAACvC;QACtC,MAAMwC,SAASxC,WAAW,eAAenE,OAAOK,IAAI,KAAK;QACzD,MAAM2D,aACJ,QAAOgC,4BAAAA,QAAU,CAAC,aAAa,MAAK,YACpCA,QAAQ,CAAC,aAAa,CAACY,IAAI,KACvBZ,QAAQ,CAAC,aAAa,CAACY,IAAI,KAC3B;QACN,MAAMC,cAAc;eACfnD;YACH;gBACErD,MAAML,OAAOK,IAAI;gBACjBC,gBAAgBN,OAAOM,cAAc;gBACrCkD,QAAQxD,OAAOwD,MAAM;gBACrBwB;gBACAlB,cAAc2C,YAAYtC,SAAS;YACrC;SACD,CAAC3D,KAAK,CAAC,CAACC;QACT,mEAAmE;QACnE,kCAAkC;QAClC,MAAMqG,mBAAYd,4BAAAA,QAAU,CAAC,gBAAgB,mBAAI;QAIjD,MAAMhF,SACJhB,gBAAAA,OAAOgB,KAAK,YAAZhB,gBACC,QAAOgG,4BAAAA,QAAU,CAAC,QAAQ,MAAK,WAAWA,QAAQ,CAAC,QAAQ,GAAG;QACjE,MAAMe,SAA6B,aAC9B/G;YACHgB;YACAM,WAAW,GACTtB,sBAAAA,OAAOsB,WAAW,YAAlBtB,sBACC,QAAO8G,4BAAAA,QAAU,CAAC,cAAc,MAAK,WAClCA,QAAQ,CAAC,cAAc,GACvB;YACNnE,MAAM,GACJ3C,iBAAAA,OAAO2C,MAAM,YAAb3C,0BACE8G,4BAAAA,QAAU,CAAC,SAAS,oBAAI;;QAE9BhB,YAAYO,GAAG,CACbhB,KACA;YACED;YACA,2DAA2D;YAC3D4B,UAAU;YACVC,UAAU;YACVC,QAAQ;YACRC,KAAK;YACLC,kBAAkB;YAClBC,QAAQ;YACRrG;YACAsG,SAASjE,2BAA2B0D,QAAQ;gBAC1CrD,SAASmD;gBACT5C,QAAQwC,YAAY;oBAAEtC;oBAAQH;gBAAW,IAAI;gBAC7CE,UAAUyC;YACZ;YACAY,eAAe;YACfC,cAAc;YACdC,MAAM;YACNC,aAAab,YAAYlD,MAAM;YAC/BgE,gBAAgBd;YAChBe,eAAe;gBACbvH,MAAM0G,OAAO1G,IAAI;gBACjBC,gBAAgByG,OAAOzG,cAAc;gBACrCJ,UAAU6G,OAAO7G,QAAQ;gBACzBC,iBAAiB4G,OAAO5G,eAAe;gBACvCmB,aAAayF,OAAOzF,WAAW;gBAC/BC,UAAUwF,OAAOxF,QAAQ;gBACzBiC,QAAQuD,OAAOvD,MAAM;gBACrBb,QAAQoE,OAAOpE,MAAM;gBACrBvB,UAAU2F,OAAO3F,QAAQ;gBACzByG,kBAAkB7G,QAAQD,0BAA0BC,SAAS;YAC/D;YACAsF,WAAW3G,WAAW4G,eAAe;WACjCP,WACA,CAAC,IACD;YAAE7B,QAAQ;YAAQ2D,WAAWnI,WAAW4G,eAAe;QAAG,GAC1DI,SACA;YACExC,QAAQ;YACR4D,YAAYpI,WAAW4G,eAAe;YACtCyB,YAAY;QACd,IACA,CAAC,IAEP;YAAExB,OAAO;QAAK;QAEhB,OAAO;YAAEZ,OAAO,CAACI;YAAU9B,UAAUyC;QAAO;IAC9C;IAEF,IAAIf,SAAS1B,UAAU;YAaHxE,kCAITM,MAAAA;QAhBT,iEAAiE;QACjE,sEAAsE;QACtE,MAAMmF,KACH8C,UAAU,CAAC;YACV5H,MAAM;YACNW,OAAOhB,OAAOgB,KAAK;YACnBH;YACAuE;YACA8C,MAAM;gBAAEC,OAAO;gBAA6BC,MAAM;YAAwB;YAC1EC,QAAQhH,mBAAmBrB,OAAOsB,WAAW,EAAEtB,OAAOuB,QAAQ;YAC9D,oEAAoE;YACpE,wCAAwC;YACxC+G,YAAY,GAAE5I,mCAAAA,mBAAmB,CAACM,OAAOK,IAAI,CAAC,YAAhCX,mCAAoC;YAClD6I,WAAWrH,yBAAyBlB;YACpCwI,eACE,GAAG5I,UAAU,CAACI,OAAOK,IAAI,CAAC,CAAC,EAAE,EAAEL,OAAOM,cAAc,CAAC,YAAY,CAAC,GAClE,IAAGN,QAAAA,mBAAAA,OAAOE,QAAQ,YAAfF,mBAAmBA,OAAOG,eAAe,YAAzCH,OAA6C,aAAa,GAC5DA,CAAAA,OAAOwD,MAAM,GAAG,CAAC,eAAe,EAAExD,OAAOwD,MAAM,EAAE,GAAG,EAAC,IACrDxD,CAAAA,OAAOoB,QAAQ,GAAG,KAAK,cAAa,IACpC8C,CAAAA,WAAW,yCAAyC,EAAC,IACtD;QACJ,GACCuE,KAAK,CAAC,IAAMC;IACjB;IACA,OAAO;QAAE7H;QAAUuE;QAAWQ;QAAO1B;IAAS;AAChD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAoC2C,GAE3C,OAAO,MAAMyE,uBAAuB;IAClC,+DAA+D,GAC/DC,oBAAoB;IACpB,yBAAyB,GACzBC,UAAU,IAAI,KAAK,KAAK,KAAK;IAC7B,+CAA+C,GAC/CC,UAAU,KAAK,KAAK,KAAK,KAAK;AAChC,EAAU;AAEV,MAAMC,cAAcJ,qBAAqBE,QAAQ,GAAG;AAEpD,4DAA4D,GAC5D,OAAO,MAAMG,iCAAiC,qBAAoB;AAclE,kEAAkE,GAClE,OAAO,SAASC,mBACdpE,OAA0C,EAC1CY,KAAa;IAEb,MAAMyD,QAAQzD,QAAQkD,qBAAqBE,QAAQ;IACnD,MAAMM,YAAY;WACb,IAAIxI,IACLkE,QACGuE,MAAM,CACL,CAACvF,QACC,AAACA,CAAAA,MAAMxD,IAAI,KAAK,yBAAyBwD,MAAMxD,IAAI,KAAK,SAAQ,KAChEwD,MAAMmB,IAAI,IAAIkE,OAEjBtF,GAAG,CAAC,CAACC,QAAUA,MAAM3D,QAAQ,IAAI2D,MAAMvD,cAAc;KAE3D;IACD,OAAO;QACL+I,SAASF,UAAUxF,MAAM,IAAIgF,qBAAqBC,kBAAkB;QACpEO;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASG,0BACdC,SAAiB,EACjBnI,QAAiB;IAEjB,OAAO,CAAC,6BAA6B,EAAEA,WAAW,KAAK,QAAQ,iBAAiB,EAAEH,mBAAmBsI,YAAY;AACnH;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpBC,KAOC,EACDtE,IAIC;QAMaA,aA6DAsE,gBA8BAC,WA8BFA;IAzHZ,MAAMjE,SAAQN,cAAAA,KAAKM,KAAK,YAAVN,cAAcO,KAAKC,GAAG;IACpC,MAAM,EAAE3F,MAAM,EAAEiD,eAAe,EAAE,GAAGwG;IACpC,MAAME,YAAYxE,KAAKG,SAAS,CAC7BC,UAAU,CAACyD,gCACXxD,GAAG,CAACvC;IACP,MAAM2G,UAAU,MAAMzE,KAAKG,SAAS,CAACO,cAAc,CAAC,OAAOC;YAwB5B+D;QAvB7B,MAAMA,QAAQ,MAAM/D,YAAYG,GAAG,CAAC0D;QACpC,MAAMjF,SACJC,MAAMC,OAAO,CAACiF,MAAM5D,GAAG,CAAC,cAAc4D,MAAM5D,GAAG,CAAC,aAAa,EAAE;QAEjE,IAAIvB,OAAO0B,IAAI,CAAC,CAACvC,QAAUA,MAAMvD,cAAc,KAAKN,OAAOM,cAAc,GAAG;YAC1E,OAAO;gBAAEsF,OAAO;gBAAOyD,SAAS;gBAAOS,UAAU;gBAAGjF,SAASH;YAAO;QACtE;QACA,MAAMG,UAAoC;eACrCH,OAAO0E,MAAM,CACd,CAACvF,QAAUA,MAAMmB,IAAI,IAAIS,QAAQkD,qBAAqBG,QAAQ;YAEhE;gBACEzI,MAAML,OAAOK,IAAI;gBACjBC,gBAAgBN,OAAOM,cAAc;gBACrCJ,UAAUF,OAAOE,QAAQ;gBACzBoB,aAAatB,OAAOsB,WAAW;gBAC/BC,UAAUvB,OAAOuB,QAAQ;gBACzBiC,QAAQxD,OAAOwD,MAAM;gBACrBkG,SAASD,MAAMC,OAAO;gBACtB1E,MAAMS;YACR;SACD;QACD,MAAM,EAAE4D,OAAO,EAAE,GAAGJ,mBAAmBpE,SAASY;QAChD,MAAMsE,gBAAgBvI,QAAOqI,aAAAA,MAAM5D,GAAG,CAAC,4BAAV4D,aAA8B;QAC3D,MAAMC,WACJT,WACA,CAAEU,CAAAA,iBAAiBtE,QAAQsE,gBAAgBpB,qBAAqBE,QAAQ,AAAD,IACnEpD,QACA;QACNK,YAAYO,GAAG,CACbsD,WACA;YACE1G;YACA4B;YACAzD,UAAUpB,OAAOoB,QAAQ;YACzB4I,aAAavE;WACTqE,WAAW;YAAEC,eAAeD;QAAS,IAAI,CAAC,IAEhD;YAAEtD,OAAO;QAAK;QAEhB,OAAO;YAAEZ,OAAO;YAAMyD;YAASS;YAAUjF;QAAQ;IACnD;IACA,IAAI,CAAC+E,QAAQE,QAAQ,EAAE;QACrB,OAAO;YAAElE,OAAOgE,QAAQhE,KAAK;YAAEyD,SAASO,QAAQP,OAAO;YAAEY,OAAO;QAAK;IACvE;IAEA,MAAM,EAAEd,SAAS,EAAE,GAAGF,mBAAmBW,QAAQ/E,OAAO,EAAEY;IAC1D,MAAMyE,WAAWN,QAAQ/E,OAAO,CAACuE,MAAM,CACrC,CAACvF,QAAUA,MAAMmB,IAAI,IAAIS,QAAQkD,qBAAqBE,QAAQ;IAEhE,MAAMhI,WAAWrB,WAAW,UACzBY,MAAM,CAAC,CAAC,sBAAsB,EAAE6C,gBAAgB,CAAC,EAAE2G,QAAQE,QAAQ,EAAE,EACrEvJ,MAAM,CAAC,OACPC,KAAK,CAAC,GAAG;IACZ,MAAM4E,YAAYxE,4BAA4BC;IAC9C,MAAMG,SAAQyI,iBAAAA,MAAMU,MAAM,CAAC,EAAE,YAAfV,iBAAmB;IACjC,MAAMC,UAAU;WAAI,IAAI/I,IAAIuJ,SAASpF,OAAO,CAAC,CAACjB;gBAAUA;oBAAAA,iBAAAA,MAAM6F,OAAO,YAAb7F,iBAAiB,EAAE;;KAAG;IAC9E,MAAM0E,YAAYe,0BAA0BrG,iBAAiBjD,OAAOoB,QAAQ;IAC5E,MAAMkG,UAAU;QACd,GAAG6B,UAAUxF,MAAM,CAAC,6CAA6C,EAAEV,gBAAgB,kDAAkD,EAAE8F,YAAY,KAAK,CAAC,GACtJ/I,CAAAA,OAAOoB,QAAQ,GAAG,KAAK,cAAa,IACrC;QACF,CAAC,cAAc,EAAEqI,MAAMU,MAAM,CAACxG,MAAM,GAAG8F,MAAMU,MAAM,CAACpG,IAAI,CAAC,QAAQ,eAAe,WAAW,EAAE2F,QAAQ/F,MAAM,GAAG+F,QAAQ3F,IAAI,CAAC,QAAQ,eAAe,CAAC,CAAC;WACjJmG,SAAStG,GAAG,CACb,CAACC;gBAC2DA;mBAA1D,CAAC,EAAE,EAAEjE,UAAU,CAACiE,MAAMxD,IAAI,CAAC,CAAC,CAAC,EAAEwD,MAAMvD,cAAc,CAAC,IAAI,GAAEuD,kBAAAA,MAAM3D,QAAQ,YAAd2D,kBAAkB,oBAAoB,GAAG,EAAExC,mBAAmBwC,MAAMvC,WAAW,EAAEuC,MAAMtC,QAAQ,GAAG,GAC3JsC,CAAAA,MAAML,MAAM,GAAG,CAAC,GAAG,EAAEK,MAAML,MAAM,EAAE,GAAG,EAAC;;QAE5C;QACA,CAAC,4IAA4I,EAAE+E,UAAU,yCAAyC,CAAC;KACpM,CACExE,IAAI,CAAC,MACLvD,KAAK,CAAC,GAAG;IACZ,MAAM2E,KAAKG,SAAS,CACjBC,UAAU,CAAC9F,yBACX+F,GAAG,CAAC3E,UACJwF,GAAG,CACF;QACEjB;QACA,2DAA2D;QAC3D4B,UAAU;QACVC,UAAU;QACVC,QAAQ;QACRC,KAAK;QACLC,kBAAkB;QAClBC,MAAM,GAAEqC,YAAAA,OAAO,CAAC,EAAE,YAAVA,YAAc;QACtB1I;QACAsG;QACAC,eAAe;QACfC,cAAc;QACdC,MAAM;QACNC,aAAa;QACb0C,eAAe;YACbnH;YACAoH,kBAAkB9B;YAClBY;YACAgB,QAAQV,MAAMU,MAAM;YACpBT;YACAY,WAAW3B,qBAAqBC,kBAAkB;YAClD2B,YAAYxB;YACZ3H,UAAUpB,OAAOoB,QAAQ;QAC3B;QACA+C,QAAQ;QACR2D,WAAWnI,WAAW4G,eAAe;QACrCD,WAAW3G,WAAW4G,eAAe;IACvC,GACA;QAAEC,OAAO;IAAK;IAElB,yEAAyE;IACzE,yEAAyE;IACzE,wCAAwC;IACxC,MAAMrB,KACH8C,UAAU,CAAC;QACV5H,MAAM;QACNW;QACAqG,MAAM,GAAEqC,aAAAA,OAAO,CAAC,EAAE,YAAVA,aAAc;QACtB7I;QACAuE;QACA8C,MAAM;YAAEC,OAAO;YAAsCC,MAAM;QAAsB;QACjFG;QACAC,eACE,CAAC,kBAAkB,EAAEvF,gBAAgB,oCAAoC,CAAC,GAC1E,GAAGkG,UAAUxF,MAAM,CAAC,sBAAsB,EAAEoF,YAAY,KAAK,CAAC,GAC7D/I,CAAAA,OAAOoB,QAAQ,GAAG,KAAK,cAAa,IACrC;IACJ,GACCqH,KAAK,CAAC,IAAMC;IACf,OAAO;QAAE9C,OAAO;QAAMyD,SAAS;QAAMY,OAAO;YAAEpJ;YAAUuE;QAAU;IAAE;AACtE"}