@odla-ai/chapter 0.42.4 → 0.43.0

package/dist/worker/index.js

@@ -1037,10 +1037,10 @@ function sharedRecordFromCrm(crm, record4, target, sourceId) {
   if (input[nameField] === void 0) input[nameField] = record4.name;
   return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record4.id }, type: record4.type, input } : { version: 1, type: record4.type, hubRecordId: record4.id, input };
 }
-async function upsertPerson(deps, opts) {
+async function upsertPerson(deps2, opts) {
   const email = opts.email.toLowerCase();
-  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const { crm_record } = await deps.db.query({ crm_record: { $: { where: { type: "person", primaryEmail: email }, limit: 1 } } });
+  const crmDeps3 = { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId };
+  const { crm_record } = await deps2.db.query({ crm_record: { $: { where: { type: "person", primaryEmail: email }, limit: 1 } } });
   const existing = crm_record?.[0];
   if (existing && typeof existing.id === "string") {
     await updateRecord(crmDeps3, { id: existing.id, input: opts.input });
@@ -1049,24 +1049,24 @@ async function upsertPerson(deps, opts) {
   const created = await createRecord(crmDeps3, { type: "person", input: opts.input, mutationId: opts.mutationId });
   return { recordId: created.id };
 }
-async function findSharedRecord(deps, record4, tag) {
+async function findSharedRecord(deps2, record4, tag) {
   const structured = await getRecordByOrigin(
-    { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId },
+    { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId },
     record4.sourceId,
     record4.sourceRecordId
   );
   if (structured) return structured;
-  const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
+  const mapped = await deps2.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
   const mappedId = mapped.crm_tag?.[0]?.recordId;
   if (typeof mappedId === "string") {
-    const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
+    const found = await deps2.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const def = deps.crm.type(record4.type);
+  const def = deps2.crm.type(record4.type);
   const emailField = def.emailField;
   if (emailField && typeof record4.input[emailField] === "string") {
     const primaryEmail = record4.input[emailField].toLowerCase();
-    const found = await deps.db.query({
+    const found = await deps2.db.query({
       crm_record: { $: { where: { type: record4.type, primaryEmail }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
@@ -1074,7 +1074,7 @@ async function findSharedRecord(deps, record4, tag) {
   const domain = record4.input.domain;
   const domainSlot = def.fields.domain?.slot;
   if (typeof domain === "string" && domainSlot) {
-    const found = await deps.db.query({
+    const found = await deps2.db.query({
       crm_record: { $: { where: { type: record4.type, [domainSlot]: domain }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
@@ -1082,14 +1082,14 @@ async function findSharedRecord(deps, record4, tag) {
   const nameField = def.nameField ?? "name";
   const name = record4.input[nameField];
   if (record4.type === "company" && typeof name === "string" && name.trim()) {
-    const found = await deps.db.query({
+    const found = await deps2.db.query({
       crm_record: { $: { where: { type: record4.type, name: name.trim() }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   return void 0;
 }
-async function projectSharedRecord(deps, shared, options = {}) {
+async function projectSharedRecord(deps2, shared, options = {}) {
   const record4 = normalizeSharedRecord(shared, options.sourceId);
   if (!record4.type.trim() || !record4.sourceId.trim() || !record4.sourceRecordId.trim()) {
     throw new Error("type, source site id, and source record id must be non-empty");
@@ -1098,8 +1098,8 @@ async function projectSharedRecord(deps, shared, options = {}) {
     throw new Error("signed sender does not match payload source");
   }
   const tag = networkSourceTag(record4.type, record4.sourceRecordId, record4.version === 2 ? record4.sourceId : void 0);
-  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const existing = await findSharedRecord(deps, record4, tag);
+  const crmDeps3 = { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId };
+  const existing = await findSharedRecord(deps2, record4, tag);
   let recordId;
   if (existing && typeof existing.id === "string") {
     await updateRecord(crmDeps3, { id: existing.id, input: record4.input });
@@ -1112,8 +1112,8 @@ async function projectSharedRecord(deps, shared, options = {}) {
       mutationId: `share-create:${tag}`
     });
   }
-  await deps.db.transact(
-    [{ t: "update", ns: "crm_tag", id: tag, attrs: { key: `${recordId}:${tag}`, recordId, tag, createdAt: deps.now() } }],
+  await deps2.db.transact(
+    [{ t: "update", ns: "crm_tag", id: tag, attrs: { key: `${recordId}:${tag}`, recordId, tag, createdAt: deps2.now() } }],
     { mutationId: `share-map:${tag}:${recordId}` }
   );
   await upsertRecordOrigin(crmDeps3, {
@@ -1125,7 +1125,7 @@ async function projectSharedRecord(deps, shared, options = {}) {
   });
   return { recordId };
 }
-async function projectApplicant(deps, applicant) {
+async function projectApplicant(deps2, applicant) {
   const base = sharedPersonInput({
     email: applicant.email,
     firstName: applicant.firstName,
@@ -1136,11 +1136,11 @@ async function projectApplicant(deps, applicant) {
   });
   const mutationId = `apply:${applicant.applicationId}`;
   const extra = applicant.extra ?? {};
-  if (Object.keys(extra).length === 0) return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+  if (Object.keys(extra).length === 0) return upsertPerson(deps2, { email: applicant.email, input: base, mutationId });
   try {
-    return await upsertPerson(deps, { email: applicant.email, input: { ...base, ...extra }, mutationId });
+    return await upsertPerson(deps2, { email: applicant.email, input: { ...base, ...extra }, mutationId });
   } catch {
-    return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+    return upsertPerson(deps2, { email: applicant.email, input: base, mutationId });
   }
 }
 
@@ -1178,12 +1178,12 @@ function billingColumns(app) {
   if (typeof app.renewalAt === "number") cols.renewalAt = app.renewalAt;
   return cols;
 }
-async function syncApplicationToCrm(deps, opts) {
+async function syncApplicationToCrm(deps2, opts) {
   const emailKey = str(opts.app.email).toLowerCase();
   if (!emailKey) return null;
-  const recordDeps = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const input = personInputFromApp(deps.chapter, opts.app);
-  const { crm_record } = await deps.db.query({
+  const recordDeps = { crm: deps2.crm, db: deps2.db, now: deps2.now, newId: deps2.newId };
+  const input = personInputFromApp(deps2.chapter, opts.app);
+  const { crm_record } = await deps2.db.query({
     crm_record: { $: { where: { type: "person", primaryEmail: emailKey }, limit: 1 } }
   });
   const existing = crm_record?.[0] ?? null;
@@ -1199,12 +1199,12 @@ async function syncApplicationToCrm(deps, opts) {
   if (existing && stage && existing.stage !== stage) {
     await setStage(recordDeps, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${stage}` }).catch(() => void 0);
   }
-  await deps.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
+  await deps2.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
   await linkIdentity(recordDeps, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
   return recordId;
 }
-async function backfillCrm(deps) {
-  const data = await deps.db.query({
+async function backfillCrm(deps2) {
+  const data = await deps2.db.query({
     applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } },
     $users: { $: { limit: 1e3 } }
   });
@@ -1216,7 +1216,7 @@ async function backfillCrm(deps) {
     if (!key || seen.has(key)) return;
     seen.add(key);
     try {
-      await syncApplicationToCrm(deps, { app, stage });
+      await syncApplicationToCrm(deps2, { app, stage });
       synced += 1;
     } catch (err) {
       errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
@@ -1268,13 +1268,13 @@ function planDelivery(input) {
 
 // src/notify.ts
 var EMAIL_TEMPLATE_NAMES = ["adminNotification", "paymentConfirmation", "prepEmail", "onboardingInvite"];
-async function sendTemplated(deps, input) {
-  const { emailLog } = await deps.db.query({ emailLog: { $: { where: { dedupeKey: input.dedupeKey } } } });
+async function sendTemplated(deps2, input) {
+  const { emailLog } = await deps2.db.query({ emailLog: { $: { where: { dedupeKey: input.dedupeKey } } } });
   const prior = Array.isArray(emailLog) ? emailLog : [];
   if (isAlreadySent(prior)) return { sent: true, reason: "already-sent" };
-  const cloudflareReady = Boolean(deps.sender && deps.from);
+  const cloudflareReady = Boolean(deps2.sender && deps2.from);
   const decision = planDelivery({
-    envName: deps.envName,
+    envName: deps2.envName,
     group: input.group,
     template: input.template,
     to: input.to,
@@ -1285,10 +1285,10 @@ async function sendTemplated(deps, input) {
   if (!decision.deliver) return { sent: false, reason: decision.reason };
   let error;
   let messageId;
-  if (decision.transport === "cloudflare" && deps.sender && deps.from) {
+  if (decision.transport === "cloudflare" && deps2.sender && deps2.from) {
     try {
-      const res = await deps.sender.send({
-        from: deps.from,
+      const res = await deps2.sender.send({
+        from: deps2.from,
         to: [decision.to],
         subject: decision.subject,
         text: decision.text,
@@ -1299,7 +1299,7 @@ async function sendTemplated(deps, input) {
       error = e instanceof Error ? e.message : String(e);
     }
   }
-  const id = deps.newId();
+  const id = deps2.newId();
   const row = {
     id,
     groupId: input.group.id,
@@ -1310,12 +1310,12 @@ async function sendTemplated(deps, input) {
     transport: decision.transport,
     redirected: decision.redirected,
     dedupeKey: input.dedupeKey,
-    sentAt: deps.now(),
+    sentAt: deps2.now(),
     ...input.applicationId ? { applicationId: input.applicationId } : {},
     ...messageId ? { messageId } : {},
     ...error ? { error } : {}
   };
-  await deps.db.transact([{ t: "update", ns: "emailLog", id, attrs: row }], error ? void 0 : { mutationId: `email:${input.dedupeKey}` });
+  await deps2.db.transact([{ t: "update", ns: "emailLog", id, attrs: row }], error ? void 0 : { mutationId: `email:${input.dedupeKey}` });
   return error ? { sent: false, reason: error } : { sent: true };
 }
 function emailGroupFrom(row) {
@@ -3802,6 +3802,7 @@ function findApplicationRef(obj) {
   const environment = candidates.map((metadata) => typeof metadata.odlaEnvironment === "string" ? metadata.odlaEnvironment : void 0).find(Boolean);
   const dataEnvironment = candidates.map((metadata) => typeof metadata.odlaDataEnvironment === "string" ? metadata.odlaDataEnvironment : void 0).find(Boolean);
   const runtime = candidates.map((metadata) => typeof metadata.odlaRuntime === "string" ? metadata.odlaRuntime : void 0).find(Boolean);
+  const chapterId = candidates.map((metadata) => typeof metadata.chapterId === "string" ? metadata.chapterId : void 0).find(Boolean);
   const customerId = typeof obj.customer === "string" ? obj.customer : void 0;
   return {
     ...applicationId ? { applicationId } : {},
@@ -3809,7 +3810,8 @@ function findApplicationRef(obj) {
     ...appId ? { appId } : {},
     ...environment ? { environment } : {},
     ...dataEnvironment ? { dataEnvironment } : {},
-    ...runtime ? { runtime } : {}
+    ...runtime ? { runtime } : {},
+    ...chapterId ? { chapterId } : {}
   };
 }
 function findGiftRef(obj) {
@@ -3825,13 +3827,15 @@ function findGiftRef(obj) {
   const environment = pickIdentity("odlaEnvironment");
   const dataEnvironment = pickIdentity("odlaDataEnvironment");
   const runtime = pickIdentity("odlaRuntime");
+  const chapterId = pickIdentity("chapterId");
   return {
     ...giftIntentId ? { giftIntentId } : {},
     providerObjectId: subscriptionId ?? String(obj.id ?? ""),
     ...appId ? { appId } : {},
     ...environment ? { environment } : {},
     ...dataEnvironment ? { dataEnvironment } : {},
-    ...runtime ? { runtime } : {}
+    ...runtime ? { runtime } : {},
+    ...chapterId ? { chapterId } : {}
   };
 }
 function normalizeWebhookEvent(event) {
@@ -3879,8 +3883,83 @@ function canceledPatch() {
   return { canceled: true };
 }
 
+// src/payment-notifications.ts
+var groupFor = async (db, app) => {
+  const result = await db.query({ groups: { $: { where: { id: String(app.groupId ?? "") }, limit: 1 } } });
+  return result.groups?.[0];
+};
+var deps = (db, env) => ({
+  db,
+  envName: env.ODLA_ENV,
+  sender: env.SEND_EMAIL,
+  from: env.EMAIL_FROM,
+  now: () => Date.now(),
+  newId: () => crypto.randomUUID()
+});
+async function notifyPaymentConfirmed(db, env, eventId, app) {
+  try {
+    if (typeof app.email !== "string" || !app.email) return;
+    const group = await groupFor(db, app);
+    if (!group) return;
+    await sendTemplated(deps(db, env), {
+      group: emailGroupFrom(group),
+      template: "paymentConfirmation",
+      to: app.email,
+      vars: { firstName: typeof app.firstName === "string" ? app.firstName : "" },
+      dedupeKey: `${eventId}:confirm`,
+      applicationId: String(app.id)
+    });
+  } catch {
+  }
+}
+async function notifyAdminOfPayment(db, env, eventId, app) {
+  try {
+    const group = await groupFor(db, app);
+    if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
+    const text4 = (value) => typeof value === "string" ? value : "";
+    await sendTemplated(deps(db, env), {
+      group: emailGroupFrom(group),
+      template: "adminNotification",
+      to: group.notificationEmail,
+      vars: {
+        firstName: text4(app.firstName),
+        lastName: text4(app.lastName),
+        email: text4(app.email),
+        phone: text4(app.phone),
+        state: text4(app.state)
+      },
+      dedupeKey: `${eventId}:admin`,
+      applicationId: String(app.id)
+    });
+  } catch {
+  }
+}
+
 // src/payments-stripe.ts
 import { stripeRequest, verifyStripeSignature as verifyStripeSignature2 } from "@odla-ai/stripe";
+
+// src/stripe-runtime.ts
+function stripeWebhookSecretName(runtime) {
+  if (!runtime) return "stripe_webhook_secret";
+  if (!/^[a-z0-9]{2,12}$/.test(runtime) || runtime === "prod" || runtime === "production") {
+    throw new Error("ODLA_RUNTIME is invalid");
+  }
+  return `stripe_webhook_secret__${runtime}`;
+}
+function stripeRuntimeIdentity(runtime) {
+  return runtime || "default";
+}
+function stripePartitionMetadata(input) {
+  return {
+    odlaAppId: input.appId,
+    odlaEnvironment: input.environment,
+    odlaDataEnvironment: input.environment,
+    odlaRuntime: stripeRuntimeIdentity(input.runtime),
+    chapterId: input.chapterId
+  };
+}
+
+// src/payments-stripe.ts
 async function stripeCall(sk, method, path, params, idempotencyKey) {
   return stripeRequest(
     { secretKey: sk },
@@ -3919,10 +3998,7 @@ function createStripeProvider(config) {
         applicationId: input.applicationId,
         groupId: input.groupId,
         email: input.email,
-        odlaAppId: input.appId,
-        odlaEnvironment: input.environment,
-        odlaDataEnvironment: input.environment,
-        ...input.runtime ? { odlaRuntime: input.runtime } : {}
+        ...stripePartitionMetadata(input)
       };
       let customerId = input.existingCustomerId;
       if (!customerId) {
@@ -3947,6 +4023,7 @@ function createStripeProvider(config) {
           "payment_settings[save_default_payment_method]": "on_subscription",
           "payment_settings[payment_method_types][0]": "card",
           "expand[0]": "latest_invoice.confirmation_secret",
+          "expand[1]": "latest_invoice.payment_intent",
           metadata: meta
         },
         // Hardening: one subscription per application, so a client
@@ -3954,6 +4031,19 @@ function createStripeProvider(config) {
         `sub:${input.applicationId}`
       );
       if (!sub.ok) fail("subscription create", sub);
+      const invoice = sub.body.latest_invoice;
+      const paymentIntent = invoice?.payment_intent;
+      const paymentIntentId = typeof paymentIntent === "string" ? paymentIntent : paymentIntent && typeof paymentIntent === "object" ? String(paymentIntent.id ?? "") : "";
+      if (paymentIntentId) {
+        const tagged = await stripeCall(
+          sk,
+          "POST",
+          `/v1/payment_intents/${encodeURIComponent(paymentIntentId)}`,
+          { metadata: meta },
+          `payment-partition:${input.applicationId}`
+        );
+        if (!tagged.ok) fail("payment intent metadata", tagged);
+      }
       const clientSecret2 = clientSecretOf(sub.body);
       if (!clientSecret2) fail("subscription confirmation-secret missing", sub);
       return { customerId, subscriptionId: String(sub.body.id), clientSecret: clientSecret2 };
@@ -4231,16 +4321,12 @@ var clientSecret = (value) => {
   const nested = confirmation?.client_secret ?? intent?.client_secret;
   return typeof nested === "string" && nested ? nested : null;
 };
-async function startGiftProviderCheckout(secretKey, intent, email, existingCustomerId, runtime) {
+async function startGiftProviderCheckout(secretKey, intent, email, existingCustomerId, runtime, appId = intent.chapterId) {
   const offer = intent.offerSnapshot;
   const metadata = {
     giftIntentId: intent.id,
-    chapterId: intent.chapterId,
     environment: intent.environment,
-    odlaAppId: intent.chapterId,
-    odlaEnvironment: intent.environment,
-    odlaDataEnvironment: intent.environment,
-    ...runtime ? { odlaRuntime: runtime } : {},
+    ...stripePartitionMetadata({ appId, chapterId: intent.chapterId, environment: intent.environment, runtime }),
     offerId: intent.offerId
   };
   let customerId = existingCustomerId;
@@ -4257,10 +4343,20 @@ async function startGiftProviderCheckout(secretKey, intent, email, existingCusto
       "payment_settings[save_default_payment_method]": "on_subscription",
       "payment_settings[payment_method_types][0]": "card",
       "expand[0]": "latest_invoice.confirmation_secret",
+      "expand[1]": "latest_invoice.payment_intent",
       metadata
     }, `gift-subscription:${intent.id}`);
     const secret2 = created2.ok ? clientSecret(created2.body) : null;
     if (!created2.ok || !secret2) throw new Error(`gift subscription create failed (${created2.status})`);
+    const invoice = created2.body.latest_invoice;
+    const paymentIntent = invoice?.payment_intent;
+    const paymentIntentId = typeof paymentIntent === "string" ? paymentIntent : paymentIntent && typeof paymentIntent === "object" ? String(paymentIntent.id ?? "") : "";
+    if (paymentIntentId) {
+      const tagged = await stripeCall(secretKey, "POST", `/v1/payment_intents/${encodeURIComponent(paymentIntentId)}`, {
+        metadata
+      }, `gift-payment-partition:${intent.id}`);
+      if (!tagged.ok) throw new Error(`gift payment intent metadata failed (${tagged.status})`);
+    }
     return { clientSecret: secret2, providerObjectId: String(created2.body.id), customerId };
   }
   const price = await stripeCall(secretKey, "GET", `/v1/prices/${encodeURIComponent(offer.stripePriceId)}`);
@@ -4319,7 +4415,8 @@ async function startGiftIntent(db, input) {
     stored,
     input.purchaserEmail,
     typeof stored.providerCustomerId === "string" ? stored.providerCustomerId : input.existingCustomerId,
-    input.runtime
+    input.runtime,
+    input.appId
   );
   await db.transact([{ t: "update", ns: "giftPurchaseIntents", id: input.id, attrs: {
     status: "checkout_ready",
@@ -4338,15 +4435,6 @@ async function startGiftIntent(db, input) {
   };
 }
 
-// src/stripe-runtime.ts
-function stripeWebhookSecretName(runtime) {
-  if (!runtime) return "stripe_webhook_secret";
-  if (!/^[a-z0-9]{2,12}$/.test(runtime) || runtime === "prod" || runtime === "production") {
-    throw new Error("ODLA_RUNTIME is invalid");
-  }
-  return `stripe_webhook_secret__${runtime}`;
-}
-
 // src/payments-route-support.ts
 var paymentErrorCode = (error) => error && typeof error === "object" && typeof error.code === "string" ? error.code : "unknown";
 function paymentLineItems(group) {
@@ -4355,59 +4443,100 @@ function paymentLineItems(group) {
   return { standardCents: standard, discountCents: discount, dueTodayCents: standard - discount };
 }
 
+// src/member-system-contract.ts
+function classifyMemberStripeEvent(identity, target, hasProvenLegacyLocalLink) {
+  const keys = ["appId", "environment", "dataEnvironment", "runtime", "chapterId"];
+  const supplied = keys.filter((key) => identity[key] !== void 0);
+  if (supplied.some((key) => identity[key] !== target[key])) return "ignore_sibling";
+  if (supplied.length === keys.length) return "apply";
+  return hasProvenLegacyLocalLink ? "apply_legacy" : "quarantine_unmatched";
+}
+
+// src/stripe-webhook-partition.ts
+var firstRow2 = async (db, ns, q) => {
+  const rows4 = (await db.query({ [ns]: { $: q } }))[ns];
+  return Array.isArray(rows4) ? rows4[0] : void 0;
+};
+var stripeEventDigest = async (rawBody) => {
+  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(rawBody));
+  return [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+var stripeEventIdentity = (event) => ({
+  ...event.appId ? { appId: event.appId } : {},
+  ...event.environment ? { environment: event.environment } : {},
+  ...event.dataEnvironment ? { dataEnvironment: event.dataEnvironment } : {},
+  ...event.runtime ? { runtime: event.runtime } : {},
+  ...event.chapterId ? { chapterId: event.chapterId } : {}
+});
+var stripeEventTarget = (env, ctx) => ({
+  appId: env.ODLA_APP_ID,
+  environment: env.ODLA_ENV,
+  dataEnvironment: env.ODLA_ENV,
+  runtime: stripeRuntimeIdentity(env.ODLA_RUNTIME),
+  chapterId: ctx.chapter.id
+});
+var receiptFor = (db, eventId) => firstRow2(db, "stripeEventReceipts", { where: { eventId }, limit: 1 });
+function reportStripePartition(level, eventId, event, disposition) {
+  console[level]("chapter stripe partition", JSON.stringify({
+    eventId,
+    kind: event.kind,
+    disposition,
+    ...stripeEventIdentity(event)
+  }));
+}
+async function storeStripeReceipt(db, input) {
+  const existing = await receiptFor(db, input.eventId);
+  if (existing) return existing.digest === input.digest ? "replayed" : "collision";
+  const id = `stripe-event:${input.eventId}`;
+  const write = await db.transact([{ t: "update", ns: "stripeEventReceipts", id, attrs: {
+    id,
+    eventId: input.eventId,
+    digest: input.digest,
+    disposition: input.disposition,
+    kind: input.event.kind,
+    matched: input.matched,
+    ...stripeEventIdentity(input.event),
+    receivedAt: Date.now()
+  } }], { mutationId: `stripe-receipt:${input.eventId}` });
+  if (!write.duplicate) return "stored";
+  const raced = await receiptFor(db, input.eventId);
+  return raced?.digest === input.digest ? "replayed" : "collision";
+}
+async function quarantineStripeEvent(db, eventId, digest, event) {
+  const disposition = "quarantine_unmatched";
+  const stored = await storeStripeReceipt(db, { eventId, digest, event, disposition, matched: false });
+  if (stored === "collision") {
+    reportStripePartition("error", eventId, event, "quarantine_collision");
+    return json({ ok: true, matched: false, collision: true });
+  }
+  reportStripePartition("warn", eventId, event, disposition);
+  return json({ ok: true, matched: false, disposition, ...stored === "replayed" ? { replayed: true } : {} });
+}
+async function replayedStripeReceipt(db, eventId, digest, event) {
+  const existing = await receiptFor(db, eventId);
+  if (!existing) return null;
+  if (existing.digest !== digest) {
+    reportStripePartition("error", eventId, event, "quarantine_collision");
+    return json({ ok: true, matched: false, collision: true });
+  }
+  return json({ ok: true, matched: existing.matched === true, replayed: true });
+}
+
 // src/worker-routes-payments.ts
-async function firstRow2(db, ns, q) {
+async function firstRow3(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
   const rows4 = res[ns];
   return Array.isArray(rows4) ? rows4[0] : void 0;
 }
 async function findApplication(db, event) {
   if ("applicationId" in event && event.applicationId) {
-    return firstRow2(db, "applications", { where: { id: event.applicationId }, limit: 1 });
+    return firstRow3(db, "applications", { where: { id: event.applicationId }, limit: 1 });
   }
   if ("customerId" in event && event.customerId) {
-    return firstRow2(db, "applications", { where: { stripeCustomerId: event.customerId }, order: { createdAt: "desc" }, limit: 1 });
+    return firstRow3(db, "applications", { where: { stripeCustomerId: event.customerId }, order: { createdAt: "desc" }, limit: 1 });
   }
   return void 0;
 }
-async function notifyPaymentConfirmed(db, env, eventId, app) {
-  try {
-    if (typeof app.email !== "string" || !app.email) return;
-    const group = await firstRow2(db, "groups", { where: { id: String(app.groupId ?? "") }, limit: 1 });
-    if (!group) return;
-    await sendTemplated(
-      { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      {
-        group: emailGroupFrom(group),
-        template: "paymentConfirmation",
-        to: app.email,
-        vars: { firstName: typeof app.firstName === "string" ? app.firstName : "" },
-        dedupeKey: `${eventId}:confirm`,
-        applicationId: String(app.id)
-      }
-    );
-  } catch {
-  }
-}
-async function notifyAdminOfPayment(db, env, eventId, app) {
-  try {
-    const group = await firstRow2(db, "groups", { where: { id: String(app.groupId ?? "") }, limit: 1 });
-    if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
-    const s = (v) => typeof v === "string" ? v : "";
-    await sendTemplated(
-      { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      {
-        group: emailGroupFrom(group),
-        template: "adminNotification",
-        to: group.notificationEmail,
-        vars: { firstName: s(app.firstName), lastName: s(app.lastName), email: s(app.email), phone: s(app.phone), state: s(app.state) },
-        dedupeKey: `${eventId}:admin`,
-        applicationId: String(app.id)
-      }
-    );
-  } catch {
-  }
-}
 function webhookPatch(event, status) {
   switch (event.kind) {
     case "first_payment":
@@ -4433,10 +4562,10 @@ async function startSubscription(req, env, ctx) {
   if (!applicationId) return json({ error: "applicationId required" }, 400);
   if (body.refundPolicyAck !== true) return json({ error: "refundPolicyAck required" }, 400);
   const db = ctx.makeDb(env);
-  const app = await firstRow2(db, "applications", { where: { id: applicationId }, limit: 1 });
+  const app = await firstRow3(db, "applications", { where: { id: applicationId }, limit: 1 });
   if (!app) return json({ error: "not found" }, 404);
   if (app.status !== "submitted") return json({ error: "already processed" }, 409);
-  const group = await firstRow2(db, "groups", { where: { id: String(app.groupId ?? ctx.chapter.id) }, limit: 1 });
+  const group = await firstRow3(db, "groups", { where: { id: String(app.groupId ?? ctx.chapter.id) }, limit: 1 });
   const secretKey = await getVaultSecret(db, "stripe_secret_key");
   if (!group || !secretKey) return json({ error: "payments not configured" }, 503);
   if (typeof app.giftOfferId === "string") {
@@ -4448,6 +4577,7 @@ async function startSubscription(req, env, ctx) {
     try {
       const started = await startGiftIntent(db, {
         id: typeof app.giftIntentId === "string" ? app.giftIntentId : `gift-intent:${applicationId}`,
+        appId: env.ODLA_APP_ID,
         chapterId: ctx.chapter.id,
         environment: env.ODLA_ENV,
         offer,
@@ -4483,8 +4613,9 @@ async function startSubscription(req, env, ctx) {
   try {
     result = await provider.createSubscription({
       appId: env.ODLA_APP_ID,
+      chapterId: ctx.chapter.id,
       environment: env.ODLA_ENV,
-      ...env.ODLA_RUNTIME ? { runtime: env.ODLA_RUNTIME } : {},
+      runtime: stripeRuntimeIdentity(env.ODLA_RUNTIME),
       applicationId,
       groupId: String(group.id),
       email: String(app.email ?? ""),
@@ -4503,7 +4634,7 @@ async function startSubscription(req, env, ctx) {
       attrs: {
         stripeCustomerId: result.customerId,
         stripeSubscriptionId: result.subscriptionId,
-        ...env.ODLA_RUNTIME ? { stripeRuntime: env.ODLA_RUNTIME } : {},
+        stripeRuntime: stripeRuntimeIdentity(env.ODLA_RUNTIME),
         refundPolicyAckAt: Date.now()
       }
     }
@@ -4519,27 +4650,41 @@ async function ingestWebhook(req, env, ctx) {
   if (!ingest.ok) return json({ error: "invalid signature" }, 400);
   const { eventId, event } = ingest;
   if (event.kind === "ignored") return json({ ok: true, ignored: event.type });
-  const identifiedEnvironment = event.appId !== void 0 || event.environment !== void 0 || event.dataEnvironment !== void 0 || event.runtime !== void 0;
-  const eventDataEnvironment = event.dataEnvironment ?? event.environment;
-  if (env.ODLA_APP_ID && identifiedEnvironment && (event.appId !== env.ODLA_APP_ID || eventDataEnvironment !== env.ODLA_ENV || event.runtime !== void 0 && event.runtime !== env.ODLA_RUNTIME)) {
-    return json({ ok: true, matched: false });
+  const digest = await stripeEventDigest(rawBody);
+  const identity = stripeEventIdentity(event);
+  const target = stripeEventTarget(env, ctx);
+  const preliminary = classifyMemberStripeEvent(identity, target, false);
+  if (preliminary === "ignore_sibling") {
+    reportStripePartition("warn", eventId, event, preliminary);
+    return json({ ok: true, matched: false, disposition: preliminary });
   }
   if (event.kind === "gift_paid" || event.kind === "gift_revoked") {
-    const intent = await firstRow2(db, "giftPurchaseIntents", { where: { id: event.giftIntentId }, limit: 1 });
-    if (!intent || intent.chapterId !== ctx.chapter.id || intent.environment !== env.ODLA_ENV) {
-      return json({ ok: true, matched: false });
-    }
-    if (event.runtime === void 0 && typeof intent.runtime === "string" && intent.runtime !== env.ODLA_RUNTIME) {
-      return json({ ok: true, matched: false });
+    const intent = await firstRow3(db, "giftPurchaseIntents", { where: { id: event.giftIntentId }, limit: 1 });
+    if (intent && typeof intent.runtime === "string" && intent.runtime !== target.runtime) {
+      reportStripePartition("warn", eventId, event, "ignore_sibling");
+      return json({ ok: true, matched: false, disposition: "ignore_sibling" });
+    }
+    const replay2 = await replayedStripeReceipt(db, eventId, digest, event);
+    if (replay2) return replay2;
+    const localIntent = Boolean(intent && intent.chapterId === ctx.chapter.id && intent.environment === env.ODLA_ENV && (typeof intent.runtime !== "string" || intent.runtime === target.runtime));
+    const disposition2 = classifyMemberStripeEvent(identity, target, localIntent);
+    if (!localIntent || disposition2 === "quarantine_unmatched") {
+      return quarantineStripeEvent(db, eventId, digest, event);
     }
     if (event.kind === "gift_paid") {
-      if (intent.providerObjectId !== event.providerObjectId) return json({ ok: true, matched: false });
-      if (intent.status === "refunded" || intent.status === "canceled") return json({ ok: true, matched: false });
+      if (intent.providerObjectId !== event.providerObjectId || intent.status === "refunded" || intent.status === "canceled") {
+        return quarantineStripeEvent(db, eventId, digest, event);
+      }
       try {
         const issued = await issueGiftClaim(db, intent, {
           eventId,
           objectId: event.providerObjectId
         }, Date.now());
+        const stored3 = await storeStripeReceipt(db, { eventId, digest, event, disposition: disposition2, matched: true });
+        if (stored3 === "collision") {
+          reportStripePartition("error", eventId, event, "quarantine_collision");
+          return json({ ok: true, matched: false, collision: true });
+        }
         return json({ ok: true, matched: true, claimId: issued.claimId });
       } catch {
         return json({ error: "gift issuance failed" }, 503);
@@ -4549,14 +4694,26 @@ async function ingestWebhook(req, env, ctx) {
       status: event.reason,
       updatedAt: Date.now()
     } }], { mutationId: `gift-revoked-intent:${eventId}` });
-    const claim = await firstRow2(db, "giftClaims", { where: { intentId: event.giftIntentId }, limit: 1 });
+    const claim = await firstRow3(db, "giftClaims", { where: { intentId: event.giftIntentId }, limit: 1 });
     if (claim) await revokeGiftClaim(db, claim, event.reason, Date.now());
+    const stored2 = await storeStripeReceipt(db, { eventId, digest, event, disposition: disposition2, matched: Boolean(claim) });
+    if (stored2 === "collision") {
+      reportStripePartition("error", eventId, event, "quarantine_collision");
+      return json({ ok: true, matched: false, collision: true });
+    }
     return json({ ok: true, matched: Boolean(claim) });
   }
   const app = await findApplication(db, event);
-  if (!app) return json({ ok: true, matched: false });
-  if (event.runtime === void 0 && typeof app.stripeRuntime === "string" && app.stripeRuntime !== env.ODLA_RUNTIME) {
-    return json({ ok: true, matched: false });
+  if (app && typeof app.stripeRuntime === "string" && app.stripeRuntime !== target.runtime) {
+    reportStripePartition("warn", eventId, event, "ignore_sibling");
+    return json({ ok: true, matched: false, disposition: "ignore_sibling" });
+  }
+  const replay = await replayedStripeReceipt(db, eventId, digest, event);
+  if (replay) return replay;
+  const localApplication = Boolean(app && (typeof app.stripeRuntime !== "string" || app.stripeRuntime === target.runtime));
+  const disposition = classifyMemberStripeEvent(identity, target, localApplication);
+  if (!localApplication || disposition === "quarantine_unmatched") {
+    return quarantineStripeEvent(db, eventId, digest, event);
   }
   const patch = webhookPatch(event, String(app.status ?? ""));
   let next = app;
@@ -4579,6 +4736,11 @@ async function ingestWebhook(req, env, ctx) {
       });
     }
   }
+  const stored = await storeStripeReceipt(db, { eventId, digest, event, disposition, matched: true });
+  if (stored === "collision") {
+    reportStripePartition("error", eventId, event, "quarantine_collision");
+    return json({ ok: true, matched: false, collision: true });
+  }
   return json({ ok: true });
 }
 var handlePayments = async (req, url, env, ctx) => {
@@ -4656,6 +4818,7 @@ var handleGifts = async (req, url, env, ctx) => {
     try {
       return json(await startGiftIntent(db, {
         id: `gift-intent:${ctx.chapter.id}:${purchaseId}`,
+        appId: env.ODLA_APP_ID,
         chapterId: ctx.chapter.id,
         environment: env.ODLA_ENV,
         offer,
@@ -5405,7 +5568,19 @@ var handleAdminRefund = async (req, url, env, ctx) => {
   const succeeded = (charges.body.data ?? []).filter((c) => c.status === "succeeded" && c.refunded !== true);
   const firstCharge = succeeded[succeeded.length - 1];
   if (!firstCharge) return json({ error: "no paid charge to refund" }, 409);
-  const refund = await stripeCall(sk, "POST", "/v1/refunds", { charge: String(firstCharge.id) });
+  const refund = await stripeCall(sk, "POST", "/v1/refunds", {
+    charge: String(firstCharge.id),
+    metadata: {
+      ...stripePartitionMetadata({
+        appId: env.ODLA_APP_ID,
+        chapterId: ctx.chapter.id,
+        environment: env.ODLA_ENV,
+        runtime: env.ODLA_RUNTIME
+      }),
+      applicationId: String(app.id),
+      groupId: String(app.groupId ?? ctx.chapter.id)
+    }
+  }, `refund:${String(app.id)}:${String(firstCharge.id)}`);
   if (!refund.ok) return json({ error: "refund failed upstream" }, 502);
   let subscriptionCanceled = false;
   if (ctx.chapter.operations.refund.cancelSubscription && subscriptionId) {
@@ -6076,8 +6251,8 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
       }
     };
     try {
-      const deps = { crm: ctx.chapter.crm, db };
-      const updated = hasFields ? await updateRecord3(deps, {
+      const deps2 = { crm: ctx.chapter.crm, db };
+      const updated = hasFields ? await updateRecord3(deps2, {
         id: record4.id,
         input: fields,
         mutationId: activityId,
@@ -6088,7 +6263,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
           authorId: `network:${verified.sender}`,
           meta: auditMeta
         }
-      }) : await setStage2(deps, {
+      }) : await setStage2(deps2, {
         id: record4.id,
         to: input.stage,
         authorId: `network:${verified.sender}`,