@pithy-sh/payments 0.1.0

package/src/rails/paddle/portal.ts

@@ -0,0 +1,130 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { z } from "zod";
+import { PaymentsProviderUnavailableError } from "../../error/errors";
+import type { PaymentsPaddleCredentials } from "../../secret/registry";
+import type { PortalHandoff, PortalSessionInput, PortalSubscriptionLinks } from "../contract";
+import { type PaddleEnvironment, type PaddleHttpFetch, paddleHttpFetch, paddleJson } from "./api";
+
+/**
+ * The customer portal — where a Paddle subscriber changes a card or cancels, under Paddle's own rules.
+ *
+ * ## The links are 24-hour bearer credentials, not the single-use tokens the issue describes
+ *
+ * `POST /customers/{ctm_…}/portal-sessions` returns `urls.general.overview` plus, per subscription,
+ * `cancel_subscription` and `update_subscription_payment_method`. The issue calls those "single-use,
+ * short-lived". Live, the overview URL carries `token=pga_<JWT>` whose `iat` and `exp` are 86400 seconds
+ * apart, with scopes including `customer.subscription.update`, `customer.customer.update` and
+ * `customer.transaction.create`. It is a day of control over that customer's billing.
+ *
+ * So "never cached or persisted" has to mean more than not writing them to a table: never logged, never
+ * in an audit payload, and never a redirect target something downstream could read out of a `Referer`.
+ * Nothing in this module returns them anywhere but to the caller, and the route emits an audit row naming
+ * the customer and not one URL.
+ *
+ * ## The caller never names the customer, and never names a subscription
+ *
+ * `providerAccountId` comes from the provider-account map, keyed on the authenticated caller.
+ * `subscriptionIds` comes from that caller's own purchase rows. The `/portal` route takes no body at all,
+ * which is the request contract that makes this safe: either field there would let anyone mint
+ * authenticated cancel links against somebody else's subscription.
+ *
+ * ## There is no return URL, and config refuses one
+ *
+ * Paddle's portal takes no return parameter. {@link PortalSessionInput.returnUrl} is optional precisely so
+ * a rail can decline it in the type rather than accept one and silently drop it, and `paddle.portalReturnUrl`
+ * is refused by config rather than accepted and ignored — a URL an adopter wrote that nothing reads is a
+ * lie in a file they trust.
+ */
+
+/** What creating a portal session needs: the credentials, the account, and the transport. */
+export interface PaddlePortalOptions {
+  /** The rail's credentials. Only `apiKey` is used here, and it needs `customer_portal_session.write`. */
+  credentials: PaymentsPaddleCredentials;
+  /** Which Paddle account to reach. */
+  environment: PaddleEnvironment;
+  /** The HTTP seam. Defaults to the runtime's `fetch`. */
+  transport?: PaddleHttpFetch;
+}
+
+/**
+ * Paddle asks for at most 25 subscription ids. More than that is not a shape this rail produces — one
+ * caller with 26 live subscriptions is not a case worth failing a portal open over — so the list is
+ * truncated with the newest kept rather than the request being refused.
+ */
+const MAX_PORTAL_SUBSCRIPTIONS = 25;
+
+/** A created portal session, narrowed to the URLs it carries. */
+const PaddlePortalSession = z
+  .object({
+    urls: z
+      .object({
+        general: z
+          .object({ overview: z.string().min(1).describe("The portal's overview page for this customer.") })
+          .loose()
+          .describe("The account-wide links."),
+        subscriptions: z
+          .array(
+            z
+              .object({
+                id: z.string().min(1).describe("The subscription these links act on."),
+                cancel_subscription: z.string().min(1).describe("Where this subscription is canceled."),
+                update_subscription_payment_method: z
+                  .string()
+                  .min(1)
+                  .describe("Where this subscription's payment method is changed."),
+              })
+              .loose(),
+          )
+          .optional()
+          .describe("Per-subscription deep links, one entry per id asked for."),
+      })
+      .loose(),
+  })
+  .loose()
+  .describe("A Paddle customer portal session — an overview page, and the deep links asked for.");
+
+/** Create a portal session for one customer, and return where they manage their billing. */
+export async function createPaddlePortalSession(
+  input: PortalSessionInput,
+  options: PaddlePortalOptions,
+): Promise<PortalHandoff> {
+  const ids = (input.subscriptionIds ?? []).slice(0, MAX_PORTAL_SUBSCRIPTIONS);
+
+  const answer = await paddleJson(
+    options.transport ?? paddleHttpFetch,
+    `/customers/${encodeURIComponent(input.providerAccountId)}/portal-sessions`,
+    {
+      what: "a customer portal session",
+      apiKey: options.credentials.apiKey,
+      environment: options.environment,
+      // An empty body rather than no body: this is a POST that creates a session, and Paddle answers the
+      // account-wide overview with no `subscription_ids` at all.
+      body: ids.length === 0 ? {} : { subscription_ids: ids },
+    },
+  );
+
+  const parsed = PaddlePortalSession.safeParse(answer?.data);
+  if (!parsed.success) {
+    // Paddle created a session and did not say where to send the browser. A redirect to an absent URL is
+    // worse than a refusal the caller can retry. This is also what an API key missing
+    // `customer_portal_session.write` looks like from here — `pithy doctor` names that permission.
+    throw new PaymentsProviderUnavailableError({
+      detail: `Paddle returned a portal session for customer ${input.providerAccountId} with no authenticated URLs. Check that the API key carries \`customer_portal_session.write\`.`,
+    });
+  }
+
+  const subscriptions: PortalSubscriptionLinks[] = (parsed.data.urls.subscriptions ?? []).map((entry) => ({
+    subscriptionId: entry.id,
+    cancel: entry.cancel_subscription,
+    updatePaymentMethod: entry.update_subscription_payment_method,
+  }));
+
+  return {
+    url: parsed.data.urls.general.overview,
+    // Omitted rather than empty, so a screen's `subscriptions === undefined` reads as "this rail does not
+    // do deep links" and an empty array reads as "it does, and this caller has none".
+    ...(ids.length === 0 ? {} : { subscriptions }),
+  };
+}

package/src/rails/paddle/rail.ts

@@ -0,0 +1,219 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { CreatedDiscount, DiscountTerms, SubscriptionPricing } from "../../data/discount";
+import type { PaymentsPurchase } from "../../data/purchase";
+import type { RefundRequest, SubscriptionChangeQuote, SubscriptionStanding } from "../../data/subscription";
+import type { PaymentsPaddleCredentials } from "../../secret/registry";
+import type {
+  CheckoutHandoff,
+  CheckoutRail,
+  CheckoutSessionInput,
+  DiscountRail,
+  ListedDiscount,
+  PaymentsRailProvider,
+  PortalHandoff,
+  PortalSessionInput,
+  PricingRail,
+  RailRequestContext,
+  RefundRail,
+  RefundRequestInput,
+  SubscriptionCancelInput,
+  SubscriptionChangeInput,
+  SubscriptionRail,
+  UnboundProviderEvent,
+  VerifiedNotification,
+  VerifiedPurchase,
+  WebhookDelivery,
+} from "../contract";
+import { type PaddleEnvironment, type PaddleHttpFetch, paddleHttpFetch } from "./api";
+import { createPaddleCheckoutSession } from "./checkout";
+import { createPaddleDiscount, listPaddleDiscounts } from "./discounts";
+import { PaddleEvent } from "./objects";
+import { createPaddlePortalSession } from "./portal";
+import { PADDLE_ADJUSTMENTS_INCLUDE, readTransaction } from "./read";
+import { readPaddlePricing, refreshPaddlePurchase } from "./refresh";
+import { requestPaddleRefunds } from "./refund";
+import {
+  cancelPaddleSubscription,
+  changePaddlePlan,
+  keepPaddleSubscription,
+  previewPaddleChange,
+  readPaddleStanding,
+} from "./subscription";
+import { verifyPaddleTransaction } from "./verify";
+import { parsePaddleNotification, readPaddleEvent } from "./webhook";
+
+/**
+ * The Paddle rail as one provider object — the fifth, and the second merchant of record.
+ *
+ * Like Stripe and Lemon Squeezy this rail *initiates* purchases, so it implements {@link CheckoutRail}.
+ * Unlike Lemon Squeezy it also implements `verify`, and that is not a nicety: `dev` is not publicly
+ * routable, so a dev checkout's webhooks land at `staging`, and a submitted `txn_…` checked against a
+ * proven ownership stamp is what makes local development work at all. See `verify.ts`.
+ *
+ * It is also the first rail to implement {@link SubscriptionRail} — read a subscription's standing, quote a
+ * plan change, make one, cancel, and withdraw a cancellation. That is a third interface rather than three
+ * more methods on the shared contract for {@link CheckoutRail}'s reason: an Apple or Google subscription is
+ * changed inside the store's own UI, on the device, and a rail forced to declare `changePlan` would declare a
+ * method that cannot be written. `subscription.ts` holds the five, and every rule they enforce came out of
+ * sandbox recordings rather than the documentation (#465).
+ *
+ * It implements {@link RefundRail} too, and that is a *sixth* interface rather than a sixth subscription verb.
+ * The two abilities are independent in both directions — Play refunds from the server and changes no plan from
+ * it, Apple's only refund endpoint is a lookup — and `isSubscriptionRail` ANDs its methods, so widening it
+ * would have de-narrowed every rail already shipping the five. `refund.ts` holds it.
+ *
+ * Built per request from credentials the caller resolved through the secrets store, rather than reading
+ * them itself. That keeps the rail a pure function of its inputs and keeps the secret read at the point of
+ * need.
+ *
+ * **Merchant of record.** Paddle is the seller on the customer's statement. It calculates and remits sales
+ * tax and VAT worldwide, issues the invoices, runs dunning, and absorbs the chargebacks. The one place
+ * that shows in this package is that a refund can arrive with no local write preceding it — Paddle issues
+ * them on its own account.
+ */
+
+/** How the Paddle rail is varied. */
+export interface PaddleRailOptions {
+  /** Which Paddle account this deployment sells through — sandbox or production. */
+  environment: PaddleEnvironment;
+  /** The publishable client token a browser initializes Paddle.js with. */
+  clientToken: string;
+  /** Whether checkout opens as an overlay, inline, or on Paddle's own hosted page. */
+  checkout: "overlay" | "inline" | "hosted";
+  /** How many seconds either side of now a delivery may be dated. Undefined uses the rail's 300. */
+  freshnessSeconds?: number;
+  /**
+   * The currency this project's Paddle catalog prices in, when the project declared one.
+   *
+   * Only used to refuse a fixed discount in another currency before it reaches Paddle — see
+   * `discounts.ts` for why that refusal has to happen at creation rather than at redemption.
+   */
+  storeCurrency?: string;
+  /** The HTTP seam Paddle's API is reached through. Defaults to the runtime's `fetch`. */
+  transport?: PaddleHttpFetch;
+}
+
+/** The Paddle rail. */
+export function paddleRail(
+  credentials: PaymentsPaddleCredentials,
+  options: PaddleRailOptions,
+): PaymentsRailProvider & CheckoutRail & DiscountRail & PricingRail & SubscriptionRail & RefundRail {
+  const transport = options.transport ?? paddleHttpFetch;
+  const base = { credentials, environment: options.environment, transport };
+
+  return {
+    rail: "paddle",
+
+    async verify(receipt: string, context: RailRequestContext): Promise<VerifiedPurchase> {
+      // `return await`, not `return`. Returning a promise from an async function makes this frame *adopt*
+      // the rejection rather than raising it, and workerd then reports the adopted promise as an unhandled
+      // rejection even though Hono's `onError` answers the request correctly.
+      return await verifyPaddleTransaction(receipt, { ...base, deployment: context.deployment, now: context.now });
+    },
+
+    async parseNotification(delivery: WebhookDelivery, context: RailRequestContext): Promise<VerifiedNotification> {
+      return await parsePaddleNotification(delivery, {
+        credentials,
+        environment: options.environment,
+        now: context.now,
+        deployment: context.deployment,
+        freshnessSeconds: options.freshnessSeconds,
+        // An adjustment says how much came off and never what the original was, so "full refund" is a
+        // comparison the parser cannot make without this read. The rail owns the transport, so the rail
+        // supplies it — and it is the one read that asks for `include=adjustments`, which is the one read
+        // that needs the key to carry `adjustment.read`.
+        readTransaction: (id) => readTransaction(id, base, PADDLE_ADJUSTMENTS_INCLUDE),
+      });
+    },
+
+    async replay(
+      payload: Record<string, unknown>,
+      context: RailRequestContext,
+    ): Promise<VerifiedNotification | undefined> {
+      // The recorded body is a Paddle event as the stream and the webhook both deliver it, so the map is the
+      // same one both paths already use. The signature is not re-checked and could not be: it covers a header
+      // this table never stored, and the row's authenticity was established when it was written.
+      const parsed = PaddleEvent.safeParse(payload);
+      if (!parsed.success) return undefined;
+      return await readPaddleEvent(parsed.data, {
+        credentials,
+        environment: options.environment,
+        now: context.now,
+        deployment: context.deployment,
+        readTransaction: (id) => readTransaction(id, base, PADDLE_ADJUSTMENTS_INCLUDE),
+      });
+    },
+
+    async refresh(purchase: PaymentsPurchase, context: RailRequestContext): Promise<UnboundProviderEvent | undefined> {
+      return await refreshPaddlePurchase(purchase, { ...base, now: context.now });
+    },
+
+    async createCheckoutSession(input: CheckoutSessionInput, context: RailRequestContext): Promise<CheckoutHandoff> {
+      return await createPaddleCheckoutSession(input, {
+        credentials,
+        environment: options.environment,
+        clientToken: options.clientToken,
+        checkout: options.checkout,
+        deployment: context.deployment,
+        transport,
+      });
+    },
+
+    async createPortalSession(input: PortalSessionInput): Promise<PortalHandoff> {
+      return await createPaddlePortalSession(input, { credentials, environment: options.environment, transport });
+    },
+
+    async readPricing(
+      purchase: PaymentsPurchase,
+      context: RailRequestContext,
+    ): Promise<SubscriptionPricing | undefined> {
+      return await readPaddlePricing(purchase, { ...base, now: context.now });
+    },
+
+    async listDiscounts(): Promise<readonly ListedDiscount[]> {
+      return await listPaddleDiscounts({
+        credentials,
+        environment: options.environment,
+        storeCurrency: options.storeCurrency,
+        transport,
+      });
+    },
+
+    async createDiscount(terms: DiscountTerms): Promise<CreatedDiscount> {
+      return await createPaddleDiscount(terms, {
+        credentials,
+        environment: options.environment,
+        storeCurrency: options.storeCurrency,
+        transport,
+      });
+    },
+
+    async readStanding(purchase: PaymentsPurchase): Promise<SubscriptionStanding | undefined> {
+      return await readPaddleStanding(purchase, base);
+    },
+
+    async previewChange(input: SubscriptionChangeInput, context: RailRequestContext): Promise<SubscriptionChangeQuote> {
+      // The one method here that reads the context's locale: its answer is the only one carrying money a
+      // person reads. See `RailRequestContext.locale`.
+      return await previewPaddleChange(input, base, context.locale);
+    },
+
+    async changePlan(input: SubscriptionChangeInput): Promise<SubscriptionStanding> {
+      return await changePaddlePlan(input, base);
+    },
+
+    async cancelSubscription(input: SubscriptionCancelInput): Promise<SubscriptionStanding> {
+      return await cancelPaddleSubscription(input, base);
+    },
+
+    async keepSubscription(purchase: PaymentsPurchase): Promise<SubscriptionStanding> {
+      return await keepPaddleSubscription(purchase, base);
+    },
+
+    async requestRefunds(input: RefundRequestInput): Promise<RefundRequest> {
+      return await requestPaddleRefunds(input, base);
+    },
+  };
+}

package/src/rails/paddle/read.ts

@@ -0,0 +1,108 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { PaymentsPaddleCredentials } from "../../secret/registry";
+import { type PaddleEnvironment, type PaddleHttpFetch, paddleJson } from "./api";
+import { PaddleSubscription, PaddleTransaction } from "./objects";
+
+/**
+ * The reads this rail makes of Paddle: a transaction, and a subscription.
+ *
+ * Both return `undefined` rather than throwing on an absent object, because two callers with different
+ * needs share them. The webhook parser reads a transaction to learn whether a refund covers its whole
+ * total; the reconciliation pass reads one to find out what a purchase looks like now. For the first, an
+ * absent transaction is a delivery this deployment cannot project; for the second it is the contract's
+ * documented "the store no longer knows this purchase". Neither is a failure of the rail.
+ *
+ * A store that cannot be *reached* throws `payments/provider_unavailable`, which is what tells the
+ * reconciliation Workflow to fail the step and retry, and what makes the webhook guard answer non-2xx so
+ * Paddle redelivers.
+ */
+
+/** What a read needs: the credentials, which account, and the transport. */
+export interface PaddleReadOptions {
+  /** The rail's credentials. The API key is read at the point of need and never cached. */
+  credentials: PaymentsPaddleCredentials;
+  /** Which Paddle account to reach. */
+  environment: PaddleEnvironment;
+  /** The HTTP seam. */
+  transport: PaddleHttpFetch;
+}
+
+/** The include the adjustment map needs, named once so a call site cannot spell it differently. */
+export const PADDLE_ADJUSTMENTS_INCLUDE: readonly string[] = ["adjustments"];
+
+/**
+ * The permission each include this rail asks for demands of the key, so a refusal names what to grant.
+ *
+ * Paddle's permissions reference: *"Your key needs read permission for any entity added via the `include`
+ * parameter"*, and a key without it gets `forbidden` (403). The OpenAPI spec says the same thing in
+ * machine-readable form — `x-enum-permissions: {adjustments: ['adjustment.read']}` on this very query
+ * parameter. A 403 whose message says only "Paddle refused" sends an operator to check the key itself,
+ * which is the one thing that is not wrong.
+ */
+const INCLUDE_PERMISSIONS: Readonly<Record<string, string>> = { adjustments: "adjustment.read" };
+
+/**
+ * The transaction with this id, or `undefined` when Paddle has none.
+ *
+ * **An `include` is a permission demand, so it is asked for only by the caller that needs it.** Three of
+ * this rail's four transaction reads — receipt verification, reconciliation, and the sweep's own
+ * projection — want a status, a total and a `custom_data` stamp, all of which are on the transaction
+ * itself. Only the adjustment map needs the array, because an adjustment says how much came off and never
+ * what the original was: Paddle raises one adjustment per refund, so a transaction refunded in two goes
+ * carries two, and only their sum tells a full refund from a partial one.
+ *
+ * An earlier build sent `include=adjustments` on every read and its docstring claimed *"a key without
+ * adjustment-read permission simply gets no array back rather than a refusal"*. Paddle's own reference
+ * says the opposite — see {@link INCLUDE_PERMISSIONS} — so that build made `adjustment.read` a
+ * requirement of checking out, on a rail whose documentation tells adopters to scope keys narrowly. The
+ * adopter documentation now states the requirement where it is real, and the refusal names it.
+ */
+export async function readTransaction(
+  id: string,
+  options: PaddleReadOptions,
+  include?: readonly string[],
+): Promise<PaddleTransaction | undefined> {
+  const asked = include === undefined || include.length === 0 ? undefined : include.join(",");
+  const needs = (include ?? [])
+    .map((entity) => INCLUDE_PERMISSIONS[entity])
+    .filter((permission): permission is string => permission !== undefined);
+  const answer = await paddleJson(options.transport, `/transactions/${encodeURIComponent(id)}`, {
+    what:
+      asked === undefined
+        ? `transaction ${id}`
+        : `transaction ${id} with include=${asked}${needs.length === 0 ? "" : ` (this key needs the ${needs.join(" and ")} permission)`}`,
+    apiKey: options.credentials.apiKey,
+    environment: options.environment,
+    query: asked === undefined ? undefined : [["include", asked]],
+    absentOn404: true,
+  });
+  if (answer === undefined) return undefined;
+  const parsed = PaddleTransaction.safeParse(answer.data);
+  return parsed.success ? parsed.data : undefined;
+}
+
+/**
+ * The subscription with this id, or `undefined` when Paddle has none.
+ *
+ * `include=next_transaction,recurring_transaction_details` is asked for by the pricing read, which needs
+ * what the next invoice comes to and what it becomes once a discount lapses. It costs nothing on the
+ * paths that ignore it, and asking twice would be two round trips for one question.
+ */
+export async function readSubscription(
+  id: string,
+  options: PaddleReadOptions,
+  include?: readonly string[],
+): Promise<PaddleSubscription | undefined> {
+  const answer = await paddleJson(options.transport, `/subscriptions/${encodeURIComponent(id)}`, {
+    what: `subscription ${id}`,
+    apiKey: options.credentials.apiKey,
+    environment: options.environment,
+    query: include === undefined || include.length === 0 ? undefined : [["include", include.join(",")]],
+    absentOn404: true,
+  });
+  if (answer === undefined) return undefined;
+  const parsed = PaddleSubscription.safeParse(answer.data);
+  return parsed.success ? parsed.data : undefined;
+}

package/src/rails/paddle/recorded.ts

@@ -0,0 +1,83 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { PaddleEvent } from "./objects";
+
+/**
+ * What of a Paddle event this build writes down — the control that keeps a live client token out of D1.
+ *
+ * ## The hazard
+ *
+ * Paddle's notification destinations and its `/events` stream are **account-wide**. A destination
+ * subscribed to `*`, or a sweep whose query filter is not honored, carries `api_key.*`,
+ * `client_token.*`, `product.*`, `price.*` and `discount.*` alongside the events this package acts on.
+ * Verified against the assigned sandbox's own stream: it carries `api_key.created` and
+ * `client_token.created`, and while Paddle redacts the api key's `key`, **it does not redact the client
+ * token's `token`.**
+ *
+ * `PaddleEvent` is `.loose()` and its `data` is `z.record(z.string(), z.unknown())`, so nothing in the
+ * schema narrows an unknown event's body. Storing the delivery whole therefore persists a live credential
+ * into `pithy_payments_webhook_events` — a table an operator greps, an export copies, and a backup keeps.
+ *
+ * ## Why the control is here rather than in the query
+ *
+ * The sweep does ask Paddle for only the types below, and that filter is worth having. But a query
+ * parameter is a *request*: it is honored by someone else's service, on someone else's release cadence,
+ * and it does not exist at all on the webhook path, where the subscribed-event list is set in Paddle's
+ * dashboard by a human. An allowlist on what is **recorded** is a control this package owns and can prove.
+ *
+ * So: a type on this list is recorded whole, because its body is a transaction, a subscription or an
+ * adjustment and that body is the replay source. A type not on this list is recorded as its **envelope
+ * only** — id, type, and when — which keeps the row that makes the event id idempotent and drops the body
+ * this build was never going to read.
+ */
+
+/**
+ * Every event type recorded in full. Exactly the types the event map in `webhook.ts` acts on.
+ *
+ * Written out rather than derived from that module's sets on purpose: a list computed from the thing it is
+ * meant to constrain cannot constrain it. `recorded.test.ts` cross-checks the two declarations against
+ * each other in both directions, so adding a case to the map without adding its type here fails, and so
+ * does the reverse.
+ */
+export const PADDLE_RECORDED_EVENT_TYPES: ReadonlySet<string> = new Set([
+  "transaction.created",
+  "transaction.ready",
+  "transaction.paid",
+  "transaction.completed",
+  "transaction.payment_failed",
+  "transaction.past_due",
+  "transaction.canceled",
+  "transaction.updated",
+  "transaction.revised",
+  "transaction.billed",
+  "subscription.created",
+  "subscription.activated",
+  "subscription.resumed",
+  "subscription.trialing",
+  "subscription.past_due",
+  "subscription.paused",
+  "subscription.canceled",
+  "subscription.updated",
+  "subscription.imported",
+  "adjustment.created",
+  "adjustment.updated",
+]);
+
+/**
+ * What to store for this event: the whole delivery, or the envelope alone.
+ *
+ * The envelope keeps `event_id` — which is the whole point of the row, since `UNIQUE (rail,
+ * providerEventId)` is what makes a redelivery recognized rather than reprocessed — plus the type and the
+ * time, so an operator can still see that an event arrived and what it was. Everything else is dropped,
+ * including any top-level key `.loose()` let through, because a key this build cannot name is a key it
+ * cannot vouch for.
+ */
+export function recordedPayload(event: PaddleEvent): Record<string, unknown> {
+  if (PADDLE_RECORDED_EVENT_TYPES.has(event.event_type)) return { ...event };
+  return {
+    event_id: event.event_id,
+    event_type: event.event_type,
+    occurred_at: event.occurred_at,
+  };
+}