@ttt-productions/ttt-core 0.79.47 → 0.79.49

package/dist/doc-schemas/payments.js.map

@@ -1 +1 @@
-{"version":3,"file":"payments.js","sourceRoot":"","sources":["../../src/doc-schemas/payments.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,sDAAsD;AACtD,gFAAgF;AAChF,uBAAuB;AAEvB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,kGAAkG;AAClG,+FAA+F;AAC/F,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sDAAsD;IAC1E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,8CAA8C;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sDAAsD;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,oEAAoE;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ;IAC9B,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,uBAAuB;IACzE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,uBAAuB;IACrF,8EAA8E;IAC9E,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,4FAA4F;AAC5F,8CAA8C;AAC9C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qDAAqD;IAC5F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,iCAAiC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,mCAAmC;IACrE,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,0FAA0F;AAC1F,8FAA8F;AAC9F,+FAA+F;AAC/F,4FAA4F;AAC5F,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,6FAA6F;AAC7F,4FAA4F;AAC5F,wFAAwF;AACxF,gGAAgG;AAChG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,sGAAsG;AACtG,sGAAsG;AACtG,yFAAyF;AACzF,uDAAuD;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,6BAA6B;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,iGAAiG;AACjG,gGAAgG;AAChG,sGAAsG;AACtG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,2BAA2B;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["// Payment / pledge Firestore document SCHEMAS — the public-safe pledge ledger and its\n// server-only companions: provider refs (Stripe IDs), the idempotency sentinel, the\n// independent integrity trail, and the paid-event quarantine queue. Types inferred via\n// z.infer. Money data lives here, never in social.ts.\n// See ttt-prod docs/design/donation-payment-system.md (the design owner for the\n// pledge/Stripe flow).\n\nimport { z } from 'zod';\n\n// pledgePayments/{pledgePaymentId} — public-safe canonical money record. One doc per completed\n// pledge; never deleted/archived. No Stripe IDs, no supporter message. Auth-readable; server-only\n// writes. netAmount = max(0, amount - refundedAmount - disputeLostAmount) is the sum() target.\n// At launch refundedAmount/disputeLostAmount are 0 so netAmount === amount.\n// (functions/src/payments/runProcessStripePledgeEvent.ts)\nexport const PledgePaymentSchema = z.object({\n  pledgePaymentId: z.string(),\n  userId: z.string(),\n  amount: z.number(), // gross cents charged (Stripe-confirmed amount_total)\n  refundedAmount: z.number(), // cumulative refunded cents; LAUNCH default 0\n  disputeLostAmount: z.number(), // cents withdrawn on a lost dispute; LAUNCH default 0\n  netAmount: z.number(), // max(0, amount - refundedAmount - disputeLostAmount); sum() target\n  currency: z.string(), // \"usd\"\n  paymentInstrument: z.literal('card'),\n  status: z.literal('completed'),\n  refundState: z.enum(['none', 'partial', 'full']), // LAUNCH always 'none'\n  disputeState: z.enum(['none', 'underReview', 'won', 'lost']), // LAUNCH always 'none'\n  // NO ageAttestedAt here: age-attestation evidence is server-only and lives on\n  // PledgePaymentProviderRefSchema. This doc is auth-readable by every signed-in member.\n  createdAt: z.number(),\n  updatedAt: z.number(),\n});\nexport type PledgePayment = z.infer<typeof PledgePaymentSchema>;\n\n// pledgePaymentProviderRefs/{pledgePaymentId} — server-only Stripe references for reconciliation\n// and (post-launch) refund/dispute lookup, PLUS the age-attestation consent evidence. Rule is\n// permanently `if false` (Admin SDK only) so no Stripe IDs ever sit on an auth-readable doc. One\n// doc per pledge (singular). refundIds/disputeId are refund-ready, defaulted ([] / null) at\n// launch — zero migration when handlers ship.\n// (functions/src/payments/runProcessStripePledgeEvent.ts)\nexport const PledgePaymentProviderRefSchema = z.object({\n  pledgePaymentId: z.string(),\n  userId: z.string(),\n  stripeSessionId: z.string(),\n  paymentIntentId: z.string(),\n  latestChargeId: z.string().nullable(), // resolved when known; null at launch if not fetched\n  refundIds: z.array(z.string()), // post-launch; LAUNCH default []\n  disputeId: z.string().nullable(), // post-launch; LAUNCH default null\n  // Server timestamp (ms) of the checkout's 18+/public-disclosure attestation, stamped at session\n  // creation and carried through Stripe metadata. A paid session missing it is quarantined. It is\n  // fraud-evidence plumbing, not transparency data, so it rides THIS server-only doc and never the\n  // member-readable pledgePayments ledger (docs/design/donation-payment-system.md § Data model).\n  ageAttestedAt: z.number(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n});\nexport type PledgePaymentProviderRef = z.infer<typeof PledgePaymentProviderRefSchema>;\n\n// pledgePaymentTotals/summary — the stored running-totals singleton behind every \"total raised\"\n// surface. Incremented via FieldValue.increment INSIDE the Stripe webhook's pledge-record\n// transaction (same commit as the pledgePayments doc — the two can never drift on a completed\n// pledge); refund/dispute paths decrement when those handlers ship. Auth-readable, server-only\n// writes. An idempotent recompute script rebuilds/verifies it from pledgePayments for drift\n// repair. Shape mirrors the PledgePaymentTotals view-model + updatedAt.\nexport const PledgePaymentTotalsDocSchema = z.object({\n  netRaised: z.number(),\n  grossRaised: z.number(),\n  totalRefunded: z.number(),\n  pledgeCount: z.number(),\n  updatedAt: z.number(),\n});\nexport type PledgePaymentTotalsDoc = z.infer<typeof PledgePaymentTotalsDocSchema>;\n\n// processedStripeEvents/{stripeEventId} — idempotency sentinel, one doc per processed Stripe\n// event.id, kept forever. Checked + written in the same transaction as the side effect so a\n// redelivered event (completion, expiry, failure, or quarantine) produces no duplicate.\n// pledgePaymentId is set only when the event created a pledge. (runProcessStripePledgeEvent.ts)\nexport const ProcessedStripeEventSchema = z.object({\n  eventId: z.string(),\n  eventType: z.string(),\n  processedAt: z.number(),\n  pledgePaymentId: z.string().nullable(),\n});\nexport type ProcessedStripeEvent = z.infer<typeof ProcessedStripeEventSchema>;\n\n// pledgePaymentLedgerEvents/{ledgerId} — independent integrity record from the onPledgePaymentWritten\n// trigger (mirrors stakeShareAuditEvents). before/after are raw doc snapshots (null on create/delete)\n// kept as permissive bags so a malformed/anomalous write is still captured forensically.\n// (functions/src/audit/runPledgePaymentLedgerAudit.ts)\nexport const PledgePaymentLedgerEventSchema = z.object({\n  ledgerId: z.string(),\n  pledgePaymentId: z.string(),\n  subtype: z.string(), // e.g. 'created' | 'anomaly'\n  reason: z.string(),\n  before: z.record(z.string(), z.unknown()).nullable(),\n  after: z.record(z.string(), z.unknown()).nullable(),\n  source: z.literal('firestore-trigger'),\n  createdAt: z.number(),\n});\nexport type PledgePaymentLedgerEvent = z.infer<typeof PledgePaymentLedgerEventSchema>;\n\n// paymentWebhookQuarantine/{stripeEventId} — admin-readable repair queue for paid-but-malformed\n// events (e.g. missing metadata) that must NOT make Stripe retry. Redaction rule: never store raw\n// payloads, card/billing data, customer email, addresses, or receipt URLs — IDs + a short redacted\n// rawSafeSummary only. (functions/src/payments/runProcessStripePledgeEvent.ts)\nexport const PaymentWebhookQuarantineSchema = z.object({\n  eventId: z.string(),\n  eventType: z.string(),\n  livemode: z.boolean(),\n  reason: z.string(),\n  recoverable: z.boolean(),\n  stripeObjectIds: z.object({\n    sessionId: z.string().optional(),\n    paymentIntentId: z.string().optional(),\n    chargeId: z.string().optional(),\n  }),\n  pledgePaymentId: z.string().optional(),\n  userId: z.string().optional(),\n  amount: z.number().optional(),\n  currency: z.string().optional(),\n  rawSafeSummary: z.string(),\n  status: z.enum(['open', 'resolved', 'ignored']),\n  adminTaskId: z.string().optional(),\n  createdAt: z.number(),\n  resolvedAt: z.number().optional(),\n  resolvedBy: z.string().optional(),\n  resolutionNote: z.string().optional(),\n});\nexport type PaymentWebhookQuarantine = z.infer<typeof PaymentWebhookQuarantineSchema>;\n\n// pledgeRefundRequests/{requestId} — user-initiated pledge refund request (post-launch handler).\n// Lifecycle: requested → (admin approves) initiated → completed, or requested → (admin) denied.\n// NO Stripe ids on this doc — the refund id lands on pledgePaymentProviderRefs.refundIds. Server-only\n// writes. Timestamps are epoch-millis numbers (this repo never uses Firestore Timestamps).\nexport const PledgeRefundRequestSchema = z.object({\n  pledgePaymentId: z.string(),\n  userId: z.string(),\n  amount: z.number(),\n  status: z.enum(['requested', 'initiated', 'denied', 'completed']),\n  reason: z.string().optional(), // the requester's stated reason\n  denialReason: z.string().optional(), // set when an admin denies\n  resolvedBy: z.string().optional(), // admin uid who approved/denied\n  requestedAt: z.number(),\n  resolvedAt: z.number().optional(),\n  completedAt: z.number().optional(),\n});\nexport type PledgeRefundRequest = z.infer<typeof PledgeRefundRequestSchema>;\n"]}
+{"version":3,"file":"payments.js","sourceRoot":"","sources":["../../src/doc-schemas/payments.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,sDAAsD;AACtD,gFAAgF;AAChF,uBAAuB;AAEvB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAE1E,+FAA+F;AAC/F,kGAAkG;AAClG,+FAA+F;AAC/F,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sDAAsD;IAC1E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,8CAA8C;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,sDAAsD;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,oEAAoE;IAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ;IAC9B,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,uBAAuB;IACzE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,uBAAuB;IACrF,8EAA8E;IAC9E,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,4FAA4F;AAC5F,8CAA8C;AAC9C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qDAAqD;IAC5F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,iCAAiC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,mCAAmC;IACrE,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,iFAAiF;IACjF,iBAAiB,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,0FAA0F;AAC1F,8FAA8F;AAC9F,+FAA+F;AAC/F,4FAA4F;AAC5F,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,6FAA6F;AAC7F,4FAA4F;AAC5F,wFAAwF;AACxF,gGAAgG;AAChG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,sGAAsG;AACtG,sGAAsG;AACtG,yFAAyF;AACzF,uDAAuD;AACvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,6BAA6B;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,iGAAiG;AACjG,gGAAgG;AAChG,sGAAsG;AACtG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,2BAA2B;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gCAAgC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["// Payment / pledge Firestore document SCHEMAS — the public-safe pledge ledger and its\n// server-only companions: provider refs (Stripe IDs), the idempotency sentinel, the\n// independent integrity trail, and the paid-event quarantine queue. Types inferred via\n// z.infer. Money data lives here, never in social.ts.\n// See ttt-prod docs/design/donation-payment-system.md (the design owner for the\n// pledge/Stripe flow).\n\nimport { z } from 'zod';\nimport { LegalReviewNoticeReceiptSchema } from './legal-review-notice.js';\n\n// pledgePayments/{pledgePaymentId} — public-safe canonical money record. One doc per completed\n// pledge; never deleted/archived. No Stripe IDs, no supporter message. Auth-readable; server-only\n// writes. netAmount = max(0, amount - refundedAmount - disputeLostAmount) is the sum() target.\n// At launch refundedAmount/disputeLostAmount are 0 so netAmount === amount.\n// (functions/src/payments/runProcessStripePledgeEvent.ts)\nexport const PledgePaymentSchema = z.object({\n  pledgePaymentId: z.string(),\n  userId: z.string(),\n  amount: z.number(), // gross cents charged (Stripe-confirmed amount_total)\n  refundedAmount: z.number(), // cumulative refunded cents; LAUNCH default 0\n  disputeLostAmount: z.number(), // cents withdrawn on a lost dispute; LAUNCH default 0\n  netAmount: z.number(), // max(0, amount - refundedAmount - disputeLostAmount); sum() target\n  currency: z.string(), // \"usd\"\n  paymentInstrument: z.literal('card'),\n  status: z.literal('completed'),\n  refundState: z.enum(['none', 'partial', 'full']), // LAUNCH always 'none'\n  disputeState: z.enum(['none', 'underReview', 'won', 'lost']), // LAUNCH always 'none'\n  // NO ageAttestedAt here: age-attestation evidence is server-only and lives on\n  // PledgePaymentProviderRefSchema. This doc is auth-readable by every signed-in member.\n  createdAt: z.number(),\n  updatedAt: z.number(),\n});\nexport type PledgePayment = z.infer<typeof PledgePaymentSchema>;\n\n// pledgePaymentProviderRefs/{pledgePaymentId} — server-only Stripe references for reconciliation\n// and (post-launch) refund/dispute lookup, PLUS the age-attestation consent evidence. Rule is\n// permanently `if false` (Admin SDK only) so no Stripe IDs ever sit on an auth-readable doc. One\n// doc per pledge (singular). refundIds/disputeId are refund-ready, defaulted ([] / null) at\n// launch — zero migration when handlers ship.\n// (functions/src/payments/runProcessStripePledgeEvent.ts)\nexport const PledgePaymentProviderRefSchema = z.object({\n  pledgePaymentId: z.string(),\n  userId: z.string(),\n  stripeSessionId: z.string(),\n  paymentIntentId: z.string(),\n  latestChargeId: z.string().nullable(), // resolved when known; null at launch if not fetched\n  refundIds: z.array(z.string()), // post-launch; LAUNCH default []\n  disputeId: z.string().nullable(), // post-launch; LAUNCH default null\n  // Server timestamp (ms) of the checkout's 18+/public-disclosure attestation, stamped at session\n  // creation and carried through Stripe metadata. A paid session missing it is quarantined. It is\n  // fraud-evidence plumbing, not transparency data, so it rides THIS server-only doc and never the\n  // member-readable pledgePayments ledger (docs/design/donation-payment-system.md § Data model).\n  ageAttestedAt: z.number(),\n  // The founder legal-review notice acknowledgment given at checkout (its own required checkbox\n  // on every pledge while the notice is active): the revision and server time, stamped at session\n  // creation and carried through the Stripe metadata like `ageAttestedAt`. Absent when the notice\n  // was off. Evidence, not transparency data — it rides this server-only doc only.\n  legalReviewNotice: LegalReviewNoticeReceiptSchema.optional(),\n  createdAt: z.number(),\n  updatedAt: z.number(),\n});\nexport type PledgePaymentProviderRef = z.infer<typeof PledgePaymentProviderRefSchema>;\n\n// pledgePaymentTotals/summary — the stored running-totals singleton behind every \"total raised\"\n// surface. Incremented via FieldValue.increment INSIDE the Stripe webhook's pledge-record\n// transaction (same commit as the pledgePayments doc — the two can never drift on a completed\n// pledge); refund/dispute paths decrement when those handlers ship. Auth-readable, server-only\n// writes. An idempotent recompute script rebuilds/verifies it from pledgePayments for drift\n// repair. Shape mirrors the PledgePaymentTotals view-model + updatedAt.\nexport const PledgePaymentTotalsDocSchema = z.object({\n  netRaised: z.number(),\n  grossRaised: z.number(),\n  totalRefunded: z.number(),\n  pledgeCount: z.number(),\n  updatedAt: z.number(),\n});\nexport type PledgePaymentTotalsDoc = z.infer<typeof PledgePaymentTotalsDocSchema>;\n\n// processedStripeEvents/{stripeEventId} — idempotency sentinel, one doc per processed Stripe\n// event.id, kept forever. Checked + written in the same transaction as the side effect so a\n// redelivered event (completion, expiry, failure, or quarantine) produces no duplicate.\n// pledgePaymentId is set only when the event created a pledge. (runProcessStripePledgeEvent.ts)\nexport const ProcessedStripeEventSchema = z.object({\n  eventId: z.string(),\n  eventType: z.string(),\n  processedAt: z.number(),\n  pledgePaymentId: z.string().nullable(),\n});\nexport type ProcessedStripeEvent = z.infer<typeof ProcessedStripeEventSchema>;\n\n// pledgePaymentLedgerEvents/{ledgerId} — independent integrity record from the onPledgePaymentWritten\n// trigger (mirrors stakeShareAuditEvents). before/after are raw doc snapshots (null on create/delete)\n// kept as permissive bags so a malformed/anomalous write is still captured forensically.\n// (functions/src/audit/runPledgePaymentLedgerAudit.ts)\nexport const PledgePaymentLedgerEventSchema = z.object({\n  ledgerId: z.string(),\n  pledgePaymentId: z.string(),\n  subtype: z.string(), // e.g. 'created' | 'anomaly'\n  reason: z.string(),\n  before: z.record(z.string(), z.unknown()).nullable(),\n  after: z.record(z.string(), z.unknown()).nullable(),\n  source: z.literal('firestore-trigger'),\n  createdAt: z.number(),\n});\nexport type PledgePaymentLedgerEvent = z.infer<typeof PledgePaymentLedgerEventSchema>;\n\n// paymentWebhookQuarantine/{stripeEventId} — admin-readable repair queue for paid-but-malformed\n// events (e.g. missing metadata) that must NOT make Stripe retry. Redaction rule: never store raw\n// payloads, card/billing data, customer email, addresses, or receipt URLs — IDs + a short redacted\n// rawSafeSummary only. (functions/src/payments/runProcessStripePledgeEvent.ts)\nexport const PaymentWebhookQuarantineSchema = z.object({\n  eventId: z.string(),\n  eventType: z.string(),\n  livemode: z.boolean(),\n  reason: z.string(),\n  recoverable: z.boolean(),\n  stripeObjectIds: z.object({\n    sessionId: z.string().optional(),\n    paymentIntentId: z.string().optional(),\n    chargeId: z.string().optional(),\n  }),\n  pledgePaymentId: z.string().optional(),\n  userId: z.string().optional(),\n  amount: z.number().optional(),\n  currency: z.string().optional(),\n  rawSafeSummary: z.string(),\n  status: z.enum(['open', 'resolved', 'ignored']),\n  adminTaskId: z.string().optional(),\n  createdAt: z.number(),\n  resolvedAt: z.number().optional(),\n  resolvedBy: z.string().optional(),\n  resolutionNote: z.string().optional(),\n});\nexport type PaymentWebhookQuarantine = z.infer<typeof PaymentWebhookQuarantineSchema>;\n\n// pledgeRefundRequests/{requestId} — user-initiated pledge refund request (post-launch handler).\n// Lifecycle: requested → (admin approves) initiated → completed, or requested → (admin) denied.\n// NO Stripe ids on this doc — the refund id lands on pledgePaymentProviderRefs.refundIds. Server-only\n// writes. Timestamps are epoch-millis numbers (this repo never uses Firestore Timestamps).\nexport const PledgeRefundRequestSchema = z.object({\n  pledgePaymentId: z.string(),\n  userId: z.string(),\n  amount: z.number(),\n  status: z.enum(['requested', 'initiated', 'denied', 'completed']),\n  reason: z.string().optional(), // the requester's stated reason\n  denialReason: z.string().optional(), // set when an admin denies\n  resolvedBy: z.string().optional(), // admin uid who approved/denied\n  requestedAt: z.number(),\n  resolvedAt: z.number().optional(),\n  completedAt: z.number().optional(),\n});\nexport type PledgeRefundRequest = z.infer<typeof PledgeRefundRequestSchema>;\n"]}