create-ailk 0.21.0 → 0.23.0

package/templates/apps/api/src/lib/consent-store.ts

@@ -63,6 +63,8 @@ const UNVERIFIED_SOURCES: ReadonlySet<ConsentSource> = new Set([
   "api",
   "cookie_banner",
   "legacy",
+  // #8765 D13, C10: the payer at a Stripe Checkout is not a signed-in user.
+  "checkout",
 ]);
 
 /** Whether a row from `source` is unconfirmed by the client (D4). */
@@ -176,6 +178,32 @@ export async function anySourceConsentRows(
     ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC`;
 }
 
+/**
+ * Whether this Person already holds the `checkout` row of one Checkout
+ * Session for one purpose (#8765 D14, NFR7) — the webhook's replay check.
+ * Filters on `(workspace_id, person_id, purpose_id)` first, so the existing
+ * `(workspace_id, person_id, purpose_id, created_at)` index serves it
+ * (SEC-8765-N).
+ */
+export async function personHasCheckoutGrant(
+  workspaceId: string,
+  personId: string,
+  purposeId: string,
+  sessionId: string,
+  db: ConsentReadClient = prisma,
+): Promise<boolean> {
+  const rows = await db.$queryRaw<Array<{ found: number }>>`
+    SELECT 1 AS "found"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND g."person_id" = ${personId}
+      AND g."purpose_id" = ${purposeId}
+      AND g."source" = 'checkout'
+      AND g."source_ref" = ${sessionId}
+    LIMIT 1`;
+  return rows.length > 0;
+}
+
 /**
  * A Person's OWN reading, per registry purpose (D4). The member's screens and
  * the sign-up prompt read only this.

package/templates/apps/api/src/lib/error-serializer.ts

@@ -16,6 +16,7 @@
  *   - Leaves replies that handlers already committed (explicit status + body)
  *     untouched
  */
+import { idRegex } from "@working-theory/ids";
 import type { FastifyError, FastifyInstance } from "fastify";
 
 const GENERIC_INTERNAL_BODY = { error: "internal_error" } as const;
@@ -30,16 +31,82 @@ const GENERIC_INTERNAL_BODY = { error: "internal_error" } as const;
  * EVERY route. Logging the raw target would write that credential into the
  * API's own log the moment anything went wrong, which is precisely when logs
  * get read, copied into tickets, and shipped to third parties.
- *
- * The path itself is kept: it is what makes the line useful, and a route
- * parameter like `:id` is an identifier rather than a secret. The matching
- * strip lives on the Fastify logger's own `req` serializer in `server.ts`.
  */
 function pathWithoutQuery(url: string): string {
   const queryAt = url.indexOf("?");
   return queryAt === -1 ? url : url.slice(0, queryAt);
 }
 
+/**
+ * #6084 D14 — `GET /v1/checkout/sessions/:id` puts its credential in the
+ * PATH, so a `cs_…`-shaped segment is truncated to its first 8 characters
+ * plus `…` (a path SEGMENT rule, never a substring replace, so it cannot
+ * corrupt an unrelated URL). #6216 D11 adds the same arm for `lead_…`
+ * segments and #8438 SEC-8438-10 for `person_…` segments, which would
+ * otherwise put a full id beside `remoteAddress`.
+ */
+const SESSION_ID_LOG_SEGMENT = /^cs_[A-Za-z0-9_]+$/;
+const LEAD_ID_LOG_SEGMENT = idRegex("lead");
+const PERSON_ID_LOG_SEGMENT = idRegex("person");
+
+/**
+ * #8932 D10 (contract W9) — a webhook connection token is the per-connection
+ * receiver's routing credential (`/v1/webhooks/<provider>/:connectionToken`).
+ * Every segment after the provider is replaced by one literal
+ * `:connectionToken`, keeping no prefix — unlike the id arms above — and
+ * empty segments are dropped first, so a trailing slash, a double slash or a
+ * mis-pasted extra segment cannot carry the token past the rule.
+ */
+const CONNECTION_TOKEN_PLACEHOLDER = ":connectionToken";
+
+/** A segment as the router matches it: percent-decoded, or raw when it does not decode. */
+function decodedSegment(segment: string): string {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+
+function redactConnectionToken(path: string): string | null {
+  // Compared DECODED: the router decodes before it matches, so
+  // `/v1/%77ebhooks/stripe/<token>` reaches the token route and must be
+  // redacted like its plain spelling.
+  const segments = path
+    .split("/")
+    .filter((segment) => segment.length > 0)
+    .map(decodedSegment);
+  if (segments.length < 4 || segments[0] !== "v1" || segments[1] !== "webhooks") {
+    return null;
+  }
+  return `/${segments.slice(0, 3).join("/")}/${CONNECTION_TOKEN_PLACEHOLDER}`;
+}
+
+/**
+ * The ONE path redactor for a log line (#8932 D10): the query string dropped,
+ * a webhook connection token replaced whole, and every `cs_…`, `lead_…` and
+ * `person_…` segment truncated. The Fastify request serializer (`server.ts`)
+ * and this handler's three `path:` fields both call it, so a 429, 413, 415 or
+ * 5xx on a token route logs the same redacted path its request line does.
+ * A route parameter that is an identifier rather than a secret — `:id` — is
+ * kept: it is what makes the line useful.
+ */
+export function redactLogPath(url: string): string {
+  const path = pathWithoutQuery(url);
+  const tokenless = redactConnectionToken(path);
+  if (tokenless !== null) return tokenless;
+  return path
+    .split("/")
+    .map((segment) =>
+      SESSION_ID_LOG_SEGMENT.test(segment) ||
+      LEAD_ID_LOG_SEGMENT.test(segment) ||
+      PERSON_ID_LOG_SEGMENT.test(segment)
+        ? `${segment.slice(0, 8)}…`
+        : segment,
+    )
+    .join("/");
+}
+
 export function registerErrorSerializer(server: FastifyInstance): void {
   server.setErrorHandler(async (err: FastifyError, request, reply) => {
     // Validation errors (Fastify's schema validator) — keep structured detail.
@@ -49,7 +116,7 @@ export function registerErrorSerializer(server: FastifyInstance): void {
       request.log.warn(
         {
           method: request.method,
-          path: pathWithoutQuery(request.url),
+          path: redactLogPath(request.url),
           validation: err.validation,
         },
         "request validation failed",
@@ -68,7 +135,7 @@ export function registerErrorSerializer(server: FastifyInstance): void {
       request.log.info(
         {
           method: request.method,
-          path: pathWithoutQuery(request.url),
+          path: redactLogPath(request.url),
           statusCode: status,
           errName: err.name,
         },
@@ -83,7 +150,7 @@ export function registerErrorSerializer(server: FastifyInstance): void {
     request.log.error(
       {
         method: request.method,
-        path: pathWithoutQuery(request.url),
+        path: redactLogPath(request.url),
         errName: err.name,
         errMessage: err.message,
         errStack: err.stack,

package/templates/apps/api/src/lib/flow-completion-store.ts

@@ -0,0 +1,136 @@
+/**
+ * A magnet's completion setting — its data boundary (#8757, spec
+ * docs/specs/8757-a-per-magnet-completion-setting-spec.md D3).
+ *
+ * `flow_definitions.completion` / `checkout_offering` are new columns, and
+ * `lib/tenant-db.ts` — the magnet routes' only other data path — stays closed
+ * under the parallel contract with #8746 (D7), so the two columns get this
+ * named boundary of their own. Every statement is scoped by a server-resolved
+ * `workspaceId` (a tenant's, or the public lead route's resolved workspace):
+ *
+ *   - `completionsFor`       — one `findMany` by workspace AND id list;
+ *   - `setCompletion`        — one `updateMany` by id AND workspace, writing
+ *                              exactly the two columns;
+ *   - `liveCompletionBySlug` — one `findFirst` of a LIVE magnet by workspace
+ *                              AND slug (its pair, title and config — the
+ *                              config for a declared `completionEmail`);
+ *   - `inviteSendCounts`     — two `lead.count`s for the invite email's caps
+ *                              (D6), by workspace AND `flow:<slug>` source.
+ *
+ * No list without an id set, no other model, no read by any other key.
+ * Base tree (SEC-8757-D): no `oss: false` marker and no `MODULE_SLICES`
+ * entry, because the never-gate lead route imports it. `architecture.yaml`
+ * lists this file under the tenant-scope rule's `paths_scoped` with exactly
+ * these four call sites' counts, so a further access fails the lint.
+ */
+import {
+  FLOW_COMPLETION_DEFAULT,
+  flowCompletionSettingSchema,
+  type FlowCompletionSetting,
+} from "@working-theory/validation";
+
+import { prisma } from "./prisma.js";
+
+const DEFAULT_SETTING: FlowCompletionSetting = {
+  completion: FLOW_COMPLETION_DEFAULT,
+  checkoutOffering: null,
+};
+
+/**
+ * A stored pair as the vocabulary reads it. The database's CHECKs make every
+ * stored pair valid; a row that carries neither column (a test fixture, or a
+ * read before the migration) reads as the default, as `customersEnabled` does.
+ */
+function toSetting(row: { completion?: unknown; checkoutOffering?: unknown }) {
+  const parsed = flowCompletionSettingSchema.safeParse({
+    completion: row.completion,
+    checkoutOffering: row.checkoutOffering ?? null,
+  });
+  return parsed.success ? parsed.data : DEFAULT_SETTING;
+}
+
+/** The setting of each of `ids` in `workspaceId`. An id absent from the map reads as `lead`. */
+export async function completionsFor(
+  workspaceId: string,
+  ids: readonly string[],
+): Promise<Map<string, FlowCompletionSetting>> {
+  const out = new Map<string, FlowCompletionSetting>();
+  if (ids.length === 0) return out;
+  const rows = await prisma.flowDefinition.findMany({
+    where: { workspaceId, id: { in: [...ids] } },
+    select: { id: true, completion: true, checkoutOffering: true },
+  });
+  for (const row of rows) out.set(row.id, toSetting(row));
+  return out;
+}
+
+/** `completionsFor`'s answer for one id. */
+export function completionOf(
+  settings: Map<string, FlowCompletionSetting>,
+  id: string,
+): FlowCompletionSetting {
+  return settings.get(id) ?? DEFAULT_SETTING;
+}
+
+/** Write the pair onto magnet `id` of `workspaceId`; nothing else on the row. */
+export async function setCompletion(
+  workspaceId: string,
+  id: string,
+  setting: FlowCompletionSetting,
+): Promise<"set" | "not_found"> {
+  const result = await prisma.flowDefinition.updateMany({
+    where: { id, workspaceId },
+    data: { completion: setting.completion, checkoutOffering: setting.checkoutOffering },
+  });
+  return result.count > 0 ? "set" : "not_found";
+}
+
+export type LiveCompletion = FlowCompletionSetting & {
+  title: string;
+  /** The stored config, unparsed — the invite email reads its `completionEmail`. */
+  config: unknown;
+};
+
+/** The LIVE magnet at `slug` in `workspaceId`: its setting, title and config, or `null`. */
+export async function liveCompletionBySlug(
+  workspaceId: string,
+  slug: string,
+): Promise<LiveCompletion | null> {
+  const row = await prisma.flowDefinition.findFirst({
+    where: { workspaceId, slug, status: "live" },
+    select: { title: true, config: true, completion: true, checkoutOffering: true },
+  });
+  return row === null ? null : { ...toSetting(row), title: row.title, config: row.config };
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const HOUR_MS = 60 * 60 * 1000;
+
+/**
+ * D6's two caps, counted in the database so they hold across instances and
+ * against a spoofed `x-forwarded-for`: this magnet's leads for `email`
+ * (case-insensitively) over the last day, and all of its leads over the last
+ * hour. Both include the lead the caller just wrote.
+ */
+export async function inviteSendCounts(
+  workspaceId: string,
+  slug: string,
+  email: string,
+  now: Date,
+): Promise<{ recipientDay: number; siteHour: number }> {
+  const source = `flow:${slug}`;
+  const [recipientDay, siteHour] = await Promise.all([
+    prisma.lead.count({
+      where: {
+        workspaceId,
+        source,
+        email: { equals: email, mode: "insensitive" },
+        createdAt: { gte: new Date(now.getTime() - DAY_MS) },
+      },
+    }),
+    prisma.lead.count({
+      where: { workspaceId, source, createdAt: { gte: new Date(now.getTime() - HOUR_MS) } },
+    }),
+  ]);
+  return { recipientDay, siteHour };
+}

package/templates/apps/api/src/lib/hub-sign-in-store.ts

@@ -102,6 +102,38 @@ export async function findClientByClientId(
   });
 }
 
+/** What the hub's sign-in page may show about a spoke (#8790 D2). */
+export interface SignInClientInfo {
+  clientId: string;
+  /** The spoke's display name from the registry. */
+  name: string;
+  /** The origin of the client's first registered redirect URI. */
+  origin: string;
+}
+
+/**
+ * The public shape of one spoke's sign-in client, or `null` when the client
+ * is missing, disabled, or its spoke is revoked (#8790 D2). Only the
+ * registry decides what a sign-in page may name — never a query parameter.
+ */
+export async function findSignInClientInfo(
+  clientId: string,
+): Promise<SignInClientInfo | null> {
+  const client = await findClientByClientId(clientId);
+  if (client === null || !client.enabled) return null;
+  const spoke = await findSpokeById(clientId);
+  if (spoke === null || spoke.revokedAt !== null) return null;
+  const first = client.redirectUris[0];
+  if (first === undefined) return null;
+  let origin: string;
+  try {
+    origin = new URL(first).origin;
+  } catch {
+    return null;
+  }
+  return { clientId, name: spoke.name, origin };
+}
+
 /**
  * Create or update a spoke's sign-in client (the operator CLI). Re-running
  * rotates the secret: `clientSecret` is replaced by the new digest, so the
@@ -161,7 +193,10 @@ export function canonicalRedirectUri(raw: string): string | null {
 
 export type RegisterSignInClientResult =
   | { ok: true; spokeId: string; secret: string }
-  | { ok: false; reason: "invalid-redirect-uri" | "spoke-not-found" | "spoke-revoked" };
+  | {
+      ok: false;
+      reason: "invalid-redirect-uri" | "spoke-not-found" | "spoke-revoked";
+    };
 
 /**
  * The operator CLI's `sign-in-client` (D3): refuse an invalid callback, an
@@ -173,7 +208,8 @@ export async function registerSignInClient(params: {
   redirectUri: string;
 }): Promise<RegisterSignInClientResult> {
   const redirectUri = canonicalRedirectUri(params.redirectUri);
-  if (redirectUri === null) return { ok: false, reason: "invalid-redirect-uri" };
+  if (redirectUri === null)
+    return { ok: false, reason: "invalid-redirect-uri" };
 
   const spoke = await findSpokeById(params.spokeId);
   if (!spoke) return { ok: false, reason: "spoke-not-found" };

package/templates/apps/api/src/lib/proposal-paid-store.ts

@@ -8,13 +8,15 @@
  * every scaffold without the member slice (the #5677 failure). Its one piece
  * write therefore lives here, in the base tree, importing only `prisma.ts`.
  *
- * Two statements and no others, both scoped by a workspace id AND a piece id
+ * Three statements and no others, all scoped by a workspace id AND a piece id
  * taken from a Stripe-signed `checkout.session.completed` event's metadata —
  * written by this server when it opened the session (`ailk_proposal`,
  * `ailk_workspace`; `services/proposal-payments.ts`), never settable by the
- * payer: a guarded `updateMany` that stamps an unpaid proposal paid, and a
- * `findFirst` by the same pair reading back which session paid it. No list,
- * no other model, no read by any other key; never called by a route.
+ * payer: a guarded `updateMany` that stamps an unpaid proposal paid, a
+ * `findFirst` by the same pair reading back which session paid it, and a
+ * `findFirst` by the same pair reading the proposal's Person — the subject of
+ * the checkout's terms grant (#8765 D14). No list, no other model, no read by
+ * any other key; never called by a route.
  * `architecture.yaml` names this file as a tenant-scope exclusion with that
  * reason.
  */
@@ -47,3 +49,18 @@ export async function stampProposalPaid(
   if (row === null) return "not_found";
   return row.paidSessionId === sessionId ? "replay" : "already_paid";
 }
+
+/**
+ * The proposal's Person (#8765 D14), or `null` when no proposal of that id
+ * is in that workspace.
+ */
+export async function proposalPersonId(
+  workspaceId: string,
+  pieceId: string,
+): Promise<string | null> {
+  const row = await prisma.piece.findFirst({
+    where: { id: pieceId, workspaceId, kind: "proposal" },
+    select: { personId: true },
+  });
+  return row?.personId ?? null;
+}

package/templates/apps/api/src/lib/stripe.ts

@@ -8,11 +8,14 @@
  * '@working-theory/stripe-client' — single chokepoint for AILK-internal ergonomics
  * (logger context, request-id propagation) without touching every consumer.
  */
+import { logger } from "@working-theory/observability";
 import {
   admitLiveRestrictedKey,
   assertSandboxKey,
+  createStripeClientForKey,
   getStripeClient,
   StripeConfigError,
+  type StripeConnectionMode,
 } from "@working-theory/stripe-client";
 
 export {
@@ -26,24 +29,37 @@ export {
   // Both are on main (#6850, #6862); #8450 is the narrowing this guarded —
   // `assertAdmittedStripeKey` below. This export itself stays sandbox-only.
   assertSandboxKey,
+  // The plan checkout's mode assertion and terms-box failure (#9067 D3 step 9).
+  CheckoutModeMismatchError,
+  // The Organization connection's key classifier (#8906, #8907 D4).
+  classifyStripeKey,
   createAdHocPrice,
   createBillingPortalSession,
   createCheckoutSession,
+  // The Offerings checkout's per-client calls (#8931 D6), on the connection's client.
+  createCheckoutSessionForPrice,
   createPaymentLink,
   createQuotedCheckoutSession,
+  expireCheckoutSessionWith,
+  findActivePriceByLookupKey,
   getStripeClient,
+  // Working Theory's own absolute policies for the plan checkout's terms box (#9067 D3 step 9).
+  PLATFORM_TERMS_OF_SERVICE,
   // Checkout session read (#6084 D9) — re-exported through this sole
   // Stripe-touching chokepoint, same as every other Stripe call here.
   retrieveCheckoutSession,
   STRIPE_API_VERSION,
   StripeConfigError,
   StripeWebhookSignatureError,
+  TermsOfServiceUrlMissingError,
   toSubscriptionLifecycleStatus,
   // Signed-in Checkout (#6866 D8) — a pinned customer Stripe rejects.
   UnknownCustomerError,
   UnknownProductCodeError,
   UnknownSessionError,
   verifyWebhookSignature,
+  // The per-Organization webhook's verify (#8932 D3): the row's secret, no env key.
+  verifyWebhookSignatureKeyless,
   WEBHOOK_TOLERANCE_SECONDS,
 } from "@working-theory/stripe-client";
 
@@ -55,6 +71,7 @@ export type {
   CreateBillingPortalSessionOutput,
   CreatePaymentLinkInput,
   CreatePaymentLinkOutput,
+  CreateCheckoutSessionForPriceInput,
   CreateCheckoutSessionInput,
   CreateCheckoutSessionOutput,
   CreateCheckoutSessionParams,
@@ -64,6 +81,8 @@ export type {
   RetrieveCheckoutSessionOutput,
   Stripe,
   StripeCheckoutSession,
+  StripeConnectionMode,
+  StripeKeyClass,
   StripeWebhookEvent,
 } from "@working-theory/stripe-client";
 
@@ -81,9 +100,10 @@ let liveKeyAdmitted = false;
  * rule, with one fail-closed delta (PR #8470 security review R-1): on Vercel
  * (`VERCEL` set) a missing `VERCEL_ENV` is not production, because
  * `vercel.json` sets `NODE_ENV=production` in every environment, Preview
- * included.
+ * included. Exported for the Organization connection's go-live check and
+ * its live-row guard (#8907 D3, D8 step 6); the body is unchanged.
  */
-function isProductionBuild(): boolean {
+export function isProductionBuild(): boolean {
   if (process.env.VERCEL_ENV !== undefined) {
     return process.env.VERCEL_ENV === "production";
   }
@@ -145,6 +165,35 @@ export function assertAdmittedStripeKey(key: string): void {
   assertSandboxKey(key);
 }
 
+/**
+ * A fresh Stripe client from ONE Organization's own key (#8907 D12, #8906
+ * F-T1 to F-T3), or `null` when the factory refuses it: the factory's only
+ * caller, so `productionBuild` is always the strict predicate above and never
+ * a caller's boolean. It reads and sets no process flag — `stripeKeyMode()`
+ * is untouched — so one process holds a live Organization and a test one
+ * (contract K6, K7). A refusal logs `{ organizationId, reason }` only.
+ * `architecture.yaml` confines its callers to exact paths.
+ */
+export function stripeClientForConnection(input: {
+  organizationId: string;
+  key: string;
+  mode: StripeConnectionMode;
+  liveAt: Date | null;
+}): ReturnType<typeof createStripeClientForKey> {
+  return createStripeClientForKey({
+    organizationId: input.organizationId,
+    key: input.key,
+    mode: input.mode,
+    liveAt: input.liveAt,
+    productionBuild: isProductionBuild(),
+    log: (refusal) =>
+      logger.warn(
+        { organizationId: refusal.organizationId, reason: refusal.reason },
+        "[stripe] connection key refused for its mode",
+      ),
+  });
+}
+
 /** The key class this process admitted at boot: `"live"` only after `admitApiStripeKey()` did. */
 export function stripeKeyMode(): "test" | "live" {
   return liveKeyAdmitted ? "live" : "test";
@@ -165,14 +214,22 @@ export async function expireCheckoutSession(stripeSessionId: string): Promise<vo
   await getStripeClient().checkout.sessions.expire(stripeSessionId);
 }
 
-/** #8171 D7 — what the Billing page shows: the plan's name and the card on file. */
+/**
+ * #8171 D7 — what the Billing page shows: the plan's name and the card on
+ * file. #9067 D6 adds the renewal date and the site count, read from the
+ * same subscription.
+ */
 export type CustomerBillingSummary = {
   planName: string | null;
   paymentMethod: { brand: string; last4: string; expMonth: number; expYear: number } | null;
+  renewsAt: string | null;
+  sites: number | null;
 };
 
 /** A subscription status that still names the customer's plan (#8171 C10). */
 const CURRENT_SUBSCRIPTION_STATUSES = new Set(["active", "trialing", "past_due", "unpaid"]);
+/** A subscription status that renews at its period end (#9067 C3). */
+const RENEWING_SUBSCRIPTION_STATUSES = new Set(["active", "trialing", "past_due"]);
 const PLAN_NAME_MAX = 200;
 
 /**
@@ -224,7 +281,20 @@ export async function readCustomerBillingSummary(
           ?.default_payment_method ?? null;
   }
 
-  return { planName, paymentMethod: cardOf(method) };
+  // #9067 C3, D6 — under `dahlia` the period end lives on the item, and a
+  // subscription set to cancel names no renewal.
+  const item = current?.items.data[0];
+  const renews =
+    current !== undefined &&
+    RENEWING_SUBSCRIPTION_STATUSES.has(current.status) &&
+    current.cancel_at_period_end !== true &&
+    current.cancel_at == null &&
+    typeof item?.current_period_end === "number";
+  const renewsAt = renews ? new Date(item.current_period_end * 1000).toISOString() : null;
+  const quantity = item?.quantity;
+  const sites = typeof quantity === "number" && Number.isInteger(quantity) && quantity >= 1 ? quantity : null;
+
+  return { planName, paymentMethod: cardOf(method), renewsAt, sites };
 }
 
 /** A `card` payment method's presentation fields, or `null` for anything else. */

package/templates/apps/api/src/lib/webhook-idempotency.ts

@@ -82,11 +82,75 @@ export function markSeen(eventId: string, nowMs: number = Date.now()): void {
   }
 }
 
+// ─── Per-Organization store (#8932 D8, contract W10) ─────────────────────────
+//
+// The per-Organization endpoint (`POST /v1/webhooks/stripe/:connectionToken`)
+// dedupes in its OWN map, keyed `<organizationId>:<eventId>`, so neither
+// endpoint's dedup can swallow the other's event (SEC-8879-1) and two
+// Organizations sharing one Stripe account never collide (an Organization id
+// holds no `:`). Same TTL, soft cap and sweep rules as the legacy pair above;
+// the legacy `hasSeen`/`markSeen` never read it. Correctness rests on the
+// lead's database key, not on this map.
+
+const orgStore = new Map<string, Entry>();
+let orgInsertsSinceLastSweep = 0;
+
+function orgKey(organizationId: string, eventId: string): string {
+  return `${organizationId}:${eventId}`;
+}
+
+function sweepOrgExpired(nowMs: number): void {
+  for (const [key, entry] of orgStore) {
+    if (nowMs - entry.insertedAtMs >= IDEMPOTENCY_TTL_MS) {
+      orgStore.delete(key);
+    }
+  }
+  orgInsertsSinceLastSweep = 0;
+}
+
+/** `hasSeen`'s twin for one Organization's endpoint. */
+export function hasSeenForOrganization(
+  organizationId: string,
+  eventId: string,
+  nowMs: number = Date.now(),
+): boolean {
+  const key = orgKey(organizationId, eventId);
+  const entry = orgStore.get(key);
+  if (!entry) return false;
+  if (nowMs - entry.insertedAtMs >= IDEMPOTENCY_TTL_MS) {
+    orgStore.delete(key);
+    return false;
+  }
+  return true;
+}
+
+/** `markSeen`'s twin for one Organization's endpoint. */
+export function markSeenForOrganization(
+  organizationId: string,
+  eventId: string,
+  nowMs: number = Date.now(),
+): void {
+  const key = orgKey(organizationId, eventId);
+  if (!orgStore.has(key)) {
+    orgStore.set(key, { insertedAtMs: nowMs });
+  }
+
+  orgInsertsSinceLastSweep += 1;
+  if (
+    orgStore.size > SOFT_CAP ||
+    orgInsertsSinceLastSweep >= SWEEP_INTERVAL_INSERTS
+  ) {
+    sweepOrgExpired(nowMs);
+  }
+}
+
 /**
- * Test-only reset. Clears all dedup state between test cases so they do not
- * interfere with each other.
+ * Test-only reset. Clears all dedup state — both stores — between test cases
+ * so they do not interfere with each other.
  */
 export function __resetIdempotencyStore(): void {
   store.clear();
   insertsSinceLastSweep = 0;
+  orgStore.clear();
+  orgInsertsSinceLastSweep = 0;
 }