create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/services/dunning-policy.ts

@@ -1,294 +0,0 @@
-/**
- * @file dunning-policy.ts
- * @description The per-tenant dunning grace policy (#6034 §§ D4, D5) — one
- * function that resolves how many days a `past_due`/`unpaid` subscription
- * keeps access before a subsequent `canceled` revokes it, plus the two
- * read-side predicates that decide whether a subscriber has lost access or
- * merely needs to act.
- *
- * NOT marked `oss: false` (§ D1) — `routes/webhooks/stripe.ts`, this file's
- * only caller, deliberately left `commerce.ownedFiles`
- * (`packages/create-ailk/src/module-architecture.ts:1818-1846`) so a keyless
- * scaffold still carries and registers it; gating happens at CALL time on the
- * commerce claim already settled at `stripe.ts:174` (NFR-3), not at file
- * presence.
- *
- * The policy blob lives in `SiteSetting` (`database/config/schema.prisma:15`)
- * — a model with NO reader anywhere in the tree before this file (§ 1.7) and
- * a globally-`@unique` `key` column with no `siteId` column of its own. Per-
- * tenant scoping therefore lives in the key STRING:
- * `commerce.dunning_policy:<siteId>` — never an unsuffixed fallback, which
- * would let one site's policy silently govern another's money.
- *
- * The read never throws (AC-3) — see the resolution table on
- * `dunningPolicyFor` below, which mirrors `listing-config.ts`'s
- * absent/malformed → documented-default contract for the same reason: an
- * anonymous webhook delivery must not 500 because an operator (or nothing at
- * all) wrote a bad policy row.
- */
-
-import { logger } from "@working-theory/observability";
-import { z } from "zod";
-
-import { isModuleEnabled } from "../config/modules.js";
-import { prisma } from "../lib/prisma.js";
-import { resolveWorkspaceIdForAlias } from "../lib/site.js";
-
-/** The lifecycle values this record persists. A narrower set than
- * `SubscriptionLifecycleStatus` (`@working-theory/stripe-client`): `trialing`
- * never persists on its own — an arriving `active` OR `trialing` status is
- * always rewritten to a recorded `status: "active"` (#6034 § D7's clean-
- * recovery contract), so the record's own vocabulary only ever needs three
- * members. */
-export type DunningRecordedStatus = "past_due" | "active" | "canceled";
-
-/** One subscription's recorded dunning state (#6034 § D2). */
-export interface DunningEntry {
-  status: DunningRecordedStatus;
-  accessState: "granted" | "revoked";
-  /** ISO-8601, or `null` before the subscription has ever failed. Set once,
-   * on first entry into a failing state, and never moved while it stays
-   * failing (§ D5) — re-arming on every retry would slide the grace window
-   * forward with every Stripe attempt and it would never expire. */
-  dunningArmedAt: string | null;
-  /** ISO-8601, or `null` while nothing has scheduled a revocation. Present
-   * (possibly in the future) the instant a `canceled` event is recorded —
-   * the read-side lazily evaluates it rather than any scheduler waking up to
-   * flip the row (§ D5 — NFR-7 forbids one). */
-  accessRevokesAt: string | null;
-  /** Stripe `event.created`, seconds — the ordering watermark § D6's
-   * admission rule compares incoming events against. */
-  lastEventAt: number;
-  /** The durable twin of the in-process `hasSeen` map (§ D6 rule 1) — a
-   * replay of the SAME event id is a no-op even after a process restart. */
-  lastEventId: string;
-}
-
-/** The whole `UserData` blob for the reserved
- * `commerce.subscription_dunning` key — one row per subscriber, keyed by
- * Stripe subscription id because one customer can hold more than one
- * subscription (§ D2 — the map is what stops a second subscription's
- * `active` clobbering the first's `past_due`). */
-export interface DunningRecord {
-  v: 1;
-  subscriptions: Record<string, DunningEntry>;
-}
-
-/** The reserved `UserData` key this record lives at (§ D12 — refused on
- * `GET`/`PUT`/`DELETE /v1/user/data/:key`; the subject of the access
- * decision may not read, write or erase it). */
-export const DUNNING_USER_DATA_KEY = "commerce.subscription_dunning";
-
-/** The map is capped so a per-event read-and-rewrite of the whole blob
- * doesn't grow with a customer's entire subscription history (§ D2, § 9
- * SEC-08). Eviction is oldest-first by `lastEventAt`, skipping any entry
- * that is not yet terminal-and-settled (`status: "active"` with
- * `accessState: "granted"`) — an entry still being dunned is never evicted
- * out from under an in-flight decision. */
-export const DUNNING_MAX_SUBSCRIPTIONS = 50;
-
-export interface DunningPolicy {
-  graceDays: number;
-}
-
-/** 14 days — chosen because Stripe's Smart Retries schedule runs up to
- * roughly three weeks and the grace clock starts at the FIRST failure, not
- * at cancellation (§ D5). A shorter default would have the platform cut a
- * buyer off while Stripe is still actively recovering the payment. */
-export const DUNNING_POLICY_DEFAULTS: DunningPolicy = { graceDays: 14 };
-
-/** A tenant may not configure a grace window longer than this. Clamped, not
- * rejected — an operator's out-of-range number is a mistake to correct, not
- * grounds to fall back to a platform default that may be MORE permissive
- * than what they wrote (`listing-config.ts:55-62`'s disposition). */
-export const DUNNING_GRACE_DAYS_MAX = 90;
-
-/** Validated shape of the `SiteSetting.value` blob. Accepts any object with
- * unknown extra keys (`.passthrough()`) so the "is this a JSON object at
- * all" check is separated from the fine-grained `graceDays` validation below
- * — zod v4's own `z.number()` already refuses `NaN`/`Infinity` outright,
- * which would collapse the resolution table's distinct `malformed` and
- * `non_finite` outcomes into one, so `graceDays` is read as `unknown` here
- * and narrowed by hand. Deliberately NOT promoted to
- * `@working-theory/validation` (§ D4) — one consumer, no cross-package
- * reader; promoting it now would widen the published surface for nothing. */
-const DunningPolicyBlobSchema = z.object({}).passthrough();
-
-/** Logged once per process, the first time a `multi-tenant` deployment reads
- * the policy (§ D4) — an operator should learn that one grace window governs
- * every seller from a log line, not from a wrongful revocation. Process
- * restart re-arms it, mirroring `enrichment-shim.ts`'s pro-sentinel flag. */
-let deploymentWidePolicyWarned = false;
-
-/**
- * Resolve `siteId`'s dunning grace policy. Never throws (AC-3) — every
- * branch below resolves to a value, logged at the level the § D4 resolution
- * table specifies:
- *
- *   no row                                   → default, info  "no_policy_row"
- *   not a JSON object                        → default, error "malformed"
- *   `graceDays` absent / wrong type           → default, error "malformed"
- *   `graceDays` non-finite (e.g. `1e999`)     → default, error "non_finite"
- *   `graceDays` negative and finite           → clamp 0,  error "clamped_low"
- *   `graceDays` finite and > the ceiling      → clamp max, error "clamped_high"
- *   `graceDays` non-integer (e.g. `7.5`)      → floored,  warn  "floored"
- *   the query itself throws                  → default, error "read_failed"
- *   a valid integer in `[0, DUNNING_GRACE_DAYS_MAX]` → that value, no log
- *
- * `siteId` is a PARAMETER, never read via `currentSiteId()` inside this
- * function (§ D4) — a later per-seller resolution is then a caller change
- * only, no signature churn.
- */
-export async function dunningPolicyFor(siteId: string): Promise<DunningPolicy> {
-  // #6374 D3 — the key is built from the UNRESOLVED `siteId` parameter, and
-  // that is deliberate, not an oversight. `site_settings` never had a
-  // `site_id` column, so the site alias was embedded in the key STRING
-  // (`commerce.dunning_policy:default`); the migration's backfill leaves
-  // every `key` verbatim. Rebuilding it from the RESOLVED workspace id would
-  // match no row and hand every seller the built-in default policy —
-  // silently, which is the failure mode this whole function's log table
-  // exists to make visible.
-  const key = `commerce.dunning_policy:${siteId}`;
-
-  if (isModuleEnabled("multi-tenant") && !deploymentWidePolicyWarned) {
-    deploymentWidePolicyWarned = true;
-    logger.warn(
-      { key, outcome: "deployment_wide_policy" },
-      "[dunning-policy] this deployment's grace policy is shared by every seller — the multi-tenant module is enabled but the policy key carries no per-seller resolution yet",
-    );
-  }
-
-  // #6374 D3 — `site_settings` is now keyed by (workspace_id, key): `key`
-  // alone is no longer unique, because two sellers may each hold a
-  // `feature_flags` row. The WORKSPACE half is resolved from the alias here;
-  // the KEY half keeps its embedded alias (see the note above). An alias
-  // that resolves to nothing takes the same branch a missing row already
-  // takes — the built-in default policy — rather than throwing on a
-  // payment-webhook path.
-  const workspaceId = await resolveWorkspaceIdForAlias(siteId);
-  if (workspaceId === null) {
-    logger.info(
-      { siteId, key, outcome: "no_policy_row" },
-      "[dunning-policy] site alias resolves to no workspace — using the platform default",
-    );
-    return DUNNING_POLICY_DEFAULTS;
-  }
-
-  let row: { value: unknown } | null;
-  try {
-    row = await prisma.siteSetting.findUnique({
-      where: { workspaceId_key: { workspaceId, key } },
-      select: { value: true },
-    });
-  } catch (err) {
-    logger.error(
-      {
-        siteId,
-        key,
-        outcome: "read_failed",
-        errName: err instanceof Error ? err.name : "UnknownError",
-      },
-      "[dunning-policy] policy read failed — using the platform default",
-    );
-    return DUNNING_POLICY_DEFAULTS;
-  }
-
-  if (!row) {
-    logger.info(
-      { siteId, key, outcome: "no_policy_row" },
-      "[dunning-policy] no policy row — using the platform default",
-    );
-    return DUNNING_POLICY_DEFAULTS;
-  }
-
-  const parsed = DunningPolicyBlobSchema.safeParse(row.value);
-  if (!parsed.success) {
-    logger.error(
-      { siteId, key, outcome: "malformed" },
-      "[dunning-policy] stored policy is not a JSON object — using the platform default",
-    );
-    return DUNNING_POLICY_DEFAULTS;
-  }
-
-  const graceDaysRaw: unknown = (parsed.data as Record<string, unknown>)[
-    "graceDays"
-  ];
-  if (typeof graceDaysRaw !== "number") {
-    logger.error(
-      { siteId, key, outcome: "malformed" },
-      "[dunning-policy] stored graceDays is missing or not a number — using the platform default",
-    );
-    return DUNNING_POLICY_DEFAULTS;
-  }
-
-  // `Number.isFinite` covers both the reachable `1e999 → Infinity` overflow
-  // AND `NaN`, which cannot arrive from `jsonb` in the first place (there is
-  // no `NaN` literal in JSON) — one guard, both cases (§ 9 SEC-10).
-  if (!Number.isFinite(graceDaysRaw)) {
-    logger.error(
-      { siteId, key, outcome: "non_finite" },
-      "[dunning-policy] stored graceDays is not finite — using the platform default",
-    );
-    return DUNNING_POLICY_DEFAULTS;
-  }
-
-  if (graceDaysRaw < 0) {
-    logger.error(
-      { siteId, key, outcome: "clamped_low", stored: graceDaysRaw },
-      "[dunning-policy] stored graceDays is negative — clamped to 0",
-    );
-    return { graceDays: 0 };
-  }
-
-  if (graceDaysRaw > DUNNING_GRACE_DAYS_MAX) {
-    logger.error(
-      { siteId, key, outcome: "clamped_high", stored: graceDaysRaw },
-      "[dunning-policy] stored graceDays exceeds the ceiling — clamped",
-    );
-    return { graceDays: DUNNING_GRACE_DAYS_MAX };
-  }
-
-  if (!Number.isInteger(graceDaysRaw)) {
-    const floored = Math.floor(graceDaysRaw);
-    logger.warn(
-      { siteId, key, outcome: "floored", stored: graceDaysRaw },
-      "[dunning-policy] stored graceDays is not an integer — floored",
-    );
-    return { graceDays: floored };
-  }
-
-  return { graceDays: graceDaysRaw };
-}
-
-/**
- * Access is gone for this subscription: either already stamped `revoked`, or
- * the lazily-evaluated `accessRevokesAt` instant has passed. No scheduler
- * flips this — every reader evaluates it fresh (§ D5, NFR-7).
- */
-export function isSubscriberRevoked(
-  entry: DunningEntry,
-  now: number = Date.now(),
-): boolean {
-  return (
-    entry.accessState === "revoked" ||
-    (entry.accessRevokesAt !== null && now >= Date.parse(entry.accessRevokesAt))
-  );
-}
-
-/**
- * The buyer must act — #6038's banner predicate (§ D5), exported so #6038
- * CALLS it rather than re-deriving it. Deliberately WIDER than
- * `status === "past_due"`: a subscription cancelled with its grace window
- * still open carries `status: "canceled"`, `accessState: "granted"` — a
- * buyer about to lose access who has not been told. Both cases are covered
- * here; neither alone is (§ 9 SEC-09).
- */
-export function isSubscriberActionRequired(
-  entry: DunningEntry,
-  now: number = Date.now(),
-): boolean {
-  return (
-    !isSubscriberRevoked(entry, now) &&
-    (entry.status === "past_due" || entry.accessRevokesAt !== null)
-  );
-}

package/templates/apps/api/src/services/enrichment-shim.ts

@@ -1,53 +0,0 @@
-/**
- * @file enrichment-shim.ts
- * @description License-gated lead enrichment stub.
- *
- * Today: checkLicense()-gated branch — log a deduped sentinel for pro tier, return
- * lead unchanged. Phase 3: real enrichment replaces this file; the call site
- * (B6 lead-routing pipeline) stays stable.
- *
- * ADR 0008: license key is never logged raw — only the SHA-256 hash prefix
- * (first 8 chars) appears in log output.
- * ADR 0009 §D3: service-layer placement at apps/api/src/services/.
- * ADR 0014: license is a JWT verified locally; tier read via `result.tier`.
- */
-
-import { createHash } from "crypto";
-
-import { checkLicense } from "@working-theory/license";
-import { logger } from "@working-theory/observability";
-// TODO(#214): swap to canonical Lead from @working-theory/validation when B1 lands.
-import type { CreateLead as Lead } from "@working-theory/validation";
-
-// Routes the once-per-process Pro sentinel through @working-theory/observability so it
-// shares the redact + entropy pipeline (S17). The signature stays unchanged.
-
-type EnrichedLead = Lead & { _enrichedAt?: string }; // type union shape; today equals Lead
-
-// Module-scoped sentinel flag — one log per process lifecycle. Process restart re-arms it.
-let proSentinelLogged = false;
-
-function hashPrefix(key: string): string {
-  return createHash("sha256").update(key).digest("hex").substring(0, 8);
-}
-
-export async function enrichLead(lead: Lead): Promise<EnrichedLead | Lead> {
-  let result;
-  try {
-    result = await checkLicense();
-  } catch {
-    return lead;
-  }
-
-  if (result.tier === "pro" && !proSentinelLogged) {
-    const key = process.env["AILK_LICENSE_KEY"];
-    const prefix = key ? hashPrefix(key) : "no-key";
-    logger.info(
-      { licensePrefix: prefix },
-      "[enrichment-shim] Pro server processing not yet operational — falling back to OSS path",
-    );
-    proSentinelLogged = true;
-  }
-
-  return lead;
-}

package/templates/apps/api/src/services/entitlements.ts

@@ -1,338 +0,0 @@
-/**
- * Per-Organization entitlement resolver (org-scoped billing, #3601).
- *
- * The TENANT-layer entitlement answer: "what is this Organization entitled to?"
- * — distinct from the DEPLOYMENT/operator license layer (`require-paid-tier` →
- * `checkLicense()`, "does this deployment hold the paid module"). The two
- * layers compose; neither is folded into the other (spec D6).
- *
- * ADR-0009 D3: this is cross-namespace service-layer assembly (it reads the
- * auth-namespace Organization billing record), so it lives in
- * `apps/api/src/services/` — NOT in `@working-theory/license`, which stays
- * JWT-pure / DB-free (only the `Entitlements` TYPE lives there; spec D4).
- *
- * Keyed on the Organization; members inherit (no per-user billing read). This
- * foundation fills `features` + `limits.static` (tier + seat count) and returns
- * `limits.metered` as the reserved empty shape FEAT-047 (#3679) fills — this
- * spec builds NO metering engine (spec D5).
- *
- * #9067 D5 — the Billing tab's plan card also reads here: the licence expiry,
- * the Organization's one open plan Checkout, and the customer's billing
- * summary. That summary is the one Stripe read this resolver makes, through
- * `lib/stripe.ts`.
- */
-import { checkLicense, type Entitlements } from "@working-theory/license";
-import { logger } from "@working-theory/observability";
-import {
-  MAGNET_KIND_MIN_RANK,
-  orgBillingDetailsSchema,
-  planRank,
-  type FlowConfig,
-  type OrgBillingDetails,
-} from "@working-theory/validation";
-
-import { prisma } from "../lib/prisma.js";
-import { readCustomerBillingSummary } from "../lib/stripe.js";
-
-/**
- * Feature flags unlocked per tier. Free unlocks none; every paid tier unlocks
- * the Pro v1 feature set (mirrors `ProFeature` in `@working-theory/license`).
- * A flat projection, matching AILK's flat billing shape (spec D1) — the richer
- * per-plan allowance model is FEAT-047's, not this foundation's.
- */
-const PAID_FEATURES: readonly string[] = [
-  "lead-destinations",
-  "lead-provenance",
-  "schema-pack-registry",
-  "onboard-site",
-];
-
-function featuresForTier(tier: string): readonly string[] {
-  return tier === "free" ? [] : PAID_FEATURES;
-}
-
-/**
- * Resolve the entitlements for one Organization. An unknown / un-billed org
- * (no row, or defaulted columns) resolves to the free-tier baseline
- * (`seats: 1`, `tier: "free"`, no features) — safe-by-default.
- *
- * `limits.metered` is returned as the reserved empty `MeteredLimits` (`{}`);
- * FEAT-047 (#3679) fills it when it ports the metering engine.
- */
-export async function resolveEntitlements(
-  organizationId: string,
-): Promise<Entitlements> {
-  const org = await prisma.organization.findUnique({
-    where: { id: organizationId },
-    select: { tier: true, seatCount: true },
-  });
-
-  const tier = org?.tier ?? "free";
-  const seats = org?.seatCount ?? 1;
-
-  return {
-    features: featuresForTier(tier),
-    limits: {
-      static: { seats, tier },
-      // RESERVED — FEAT-047 (#3679) fills the metered side; empty here.
-      metered: {},
-    },
-  };
-}
-
-/**
- * #6287 — the org's plan RANK (never the deployment-wide `checkLicense()`),
- * for the magnet routes' server-side plan gate. Composes `resolveEntitlements`
- * above + `planRank` (`@working-theory/validation`, the same table the
- * Admin's own UI-only gate reads) and NEVER throws: any failure (a DB
- * error, or a tier string `planRank` doesn't recognize) collapses to
- * `undefined` — the caller's fail-closed signal for a gated kind (spec D
- * "the plan-rank resolver never throws").
- */
-export async function resolveOrgPlanRank(
-  organizationId: string,
-): Promise<number | undefined> {
-  try {
-    const entitlements = await resolveEntitlements(organizationId);
-    return planRank(entitlements.limits.static.tier);
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * #6305 — the minimum plan rank a GATED-SHAPE config requires, independent
- * of the `kind` label the caller chose. Derived from `MAGNET_KIND_MIN_RANK`
- * (never hand-duplicated) as the lowest non-zero rank in that table: today
- * that is the same Pro-tier rank every gated kind already requires, so a
- * gated-shape config on an ungated kind is refused exactly as a gated-kind
- * refusal would be (#6305 AC-1).
- */
-export const GATED_FLOW_SHAPE_MIN_RANK = Math.min(
-  ...Object.values(MAGNET_KIND_MIN_RANK).filter((rank) => rank > 0),
-);
-
-/**
- * #6305 — whether a `FlowConfig` carries the shape the flow runtime actually
- * branches on for gated (recommending-mode) behavior, regardless of which
- * `kind` label the row carries. This is the SAME predicate family
- * `deriveFlowKind`-style logic elsewhere in this codebase reads
- * (`mode === "recommending"`, or the presence of `deliverables` / `offers` /
- * `scoring`) — the label and the capability it confers can no longer diverge.
- */
-export function configHasGatedShape(config: FlowConfig | undefined): boolean {
-  if (!config) return false;
-  return (
-    config.mode === "recommending" ||
-    config.deliverables !== undefined ||
-    config.offers !== undefined ||
-    config.scoring !== undefined
-  );
-}
-
-/**
- * The org's Stripe billing-customer identity (#3701 — the apps/api
- * predecessor to the org-billing UI, #3697).
- *
- * `billingCustomerId` is the RAW Stripe customer id — a server-side-only
- * value. Callers (the `/v1/billing` route family) must never return it to the
- * client: the read route projects it to a boolean `hasBillingCustomer`
- * presence flag (spec D2), and the portal route uses it only as an input to
- * `createBillingPortalSession`, never in a response body or log line.
- */
-export interface OrgBillingIdentity {
-  /** Raw Stripe customer id (`cus_xxx`), or `null` when the org has none yet. */
-  billingCustomerId: string | null;
-}
-
-/**
- * Reads the org's Stripe billing-customer id by explicit organization id.
- * Touches only the `Organization.billingCustomerId` field — the sanctioned
- * tenant-scope exception for this file (architecture.yaml § Tenant-scope
- * boundary, #3601): no un-scoped tenant/content enumeration.
- *
- * An unknown org resolves to `{ billingCustomerId: null }` — safe-by-default,
- * mirroring `resolveEntitlements`'s un-billed-org handling.
- */
-export async function getOrgBillingIdentity(
-  organizationId: string,
-): Promise<OrgBillingIdentity> {
-  const org = await prisma.organization.findUnique({
-    where: { id: organizationId },
-    select: { billingCustomerId: true },
-  });
-
-  return { billingCustomerId: org?.billingCustomerId ?? null };
-}
-
-/**
- * Whether ANY Organization row carries the given Stripe customer id (#6038
- * D3.2, closes SA-4). Touches only `Organization.billingCustomerId` by
- * explicit value — the same sanctioned-exception shape as
- * `getOrgBillingIdentity` above (by id) and `resolveEntitlements` (by id),
- * never an un-scoped tenant/content query.
- *
- * Exists because no code in this repo stamps `metadata.organizationId` onto
- * a Stripe customer, so every `customer.created` takes the `User` branch
- * (`webhooks/stripe.ts`'s `upsertBillingIdentity`) and a single `cus_…` can
- * end up projected onto BOTH a `User` row and an `Organization` row. A
- * caller resolving "the caller's own portal" from `User.billingCustomerId`
- * alone would then risk opening the ORGANIZATION's billing record instead —
- * this is the collision check that refuses that case.
- */
-export async function isBillingCustomerAnOrganization(
-  billingCustomerId: string,
-): Promise<boolean> {
-  const org = await prisma.organization.findFirst({
-    where: { billingCustomerId },
-    select: { id: true },
-  });
-  return org !== null;
-}
-
-/**
- * #9067 D5 — the deployment licence's expiry, as an ISO string, or `null`
- * for a keyless, expired or invalid licence. The trial state's date
- * (C2). Never throws: a failed read is `null`.
- */
-export async function resolveLicenseExpiresAt(): Promise<string | null> {
-  try {
-    const license = await checkLicense();
-    return license.expiresAt?.toISOString() ?? null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * #9067 D13 — the one plan Checkout this Organization has open, or `null`.
- * Server-side only: the session id is never served. An unknown
- * Organization reads `null`.
- */
-export async function readOrgPlanCheckoutSession(
-  organizationId: string,
-): Promise<string | null> {
-  const org = await prisma.organization.findUnique({
-    where: { id: organizationId },
-    select: { planCheckoutSessionId: true },
-  });
-  return org?.planCheckoutSessionId ?? null;
-}
-
-/**
- * #9067 D3 step 9b — record the plan Checkout the route just opened, as one
- * compare-and-set: only while the column still holds `expected` and no
- * customer is bound. Answers whether one row moved; throws on a database
- * error.
- */
-export async function setOrgPlanCheckoutSession(
-  organizationId: string,
-  expected: string | null,
-  next: string,
-): Promise<boolean> {
-  const { count } = await prisma.organization.updateMany({
-    where: { id: organizationId, planCheckoutSessionId: expected, billingCustomerId: null },
-    data: { planCheckoutSessionId: next },
-  });
-  return count === 1;
-}
-
-/**
- * #9067 7b (code review) — bind the Organization to the customer a COMPLETED
- * plan Checkout created, when the webhook's bind never landed (a lost event,
- * a database error the webhook swallowed). The same guarded compare-and-set
- * the webhook runs: only while the column still holds `sessionId` and no
- * customer is bound, and it clears the session. Answers whether one row
- * moved; throws on a database error.
- */
-export async function bindOrgPlanCheckout(
-  organizationId: string,
-  sessionId: string,
-  customerId: string,
-): Promise<boolean> {
-  const { count } = await prisma.organization.updateMany({
-    where: { id: organizationId, planCheckoutSessionId: sessionId, billingCustomerId: null },
-    data: { billingProvider: "stripe", billingCustomerId: customerId, planCheckoutSessionId: null },
-  });
-  return count === 1;
-}
-
-/** How long one customer's summary is reused, a failure included (#9067 NFR-1). */
-export const ORG_BILLING_SUMMARY_TTL_MS = 60_000;
-/** The most customers held at once; the oldest entry is evicted at the cap. */
-export const ORG_BILLING_SUMMARY_CACHE_MAX = 2_000;
-/** The longest one summary read may take before the keys are left absent (NFR-2). */
-export const ORG_BILLING_SUMMARY_TIMEOUT_MS = 3_000;
-
-type OrgBillingSummaryKeys = Partial<Pick<OrgBillingDetails, "renewsAt" | "sites" | "paymentMethod">>;
-
-/** Per customer: the settled keys and when they expire. Insertion order is age. */
-const orgBillingSummaryCache = new Map<string, { keys: OrgBillingSummaryKeys; expiresAt: number }>();
-/** Per customer: the one read in flight, joined by every concurrent miss. */
-const orgBillingSummaryInFlight = new Map<string, Promise<OrgBillingSummaryKeys>>();
-
-/**
- * #9067 D5 — the Organization customer's renewal date, site count and card,
- * from the cache when fresh, else one read shared by every concurrent caller
- * of the same customer. The member read's wrapper (`services/subscription.ts`),
- * rebuilt here because importing it would be a cycle. A throw or a timeout
- * answers `{}` (every key absent) and is cached like a success; a value
- * outside `orgBillingDetailsSchema`'s bounds is `null`.
- */
-export async function readOrgBillingSummary(customerId: string): Promise<OrgBillingSummaryKeys> {
-  const cached = orgBillingSummaryCache.get(customerId);
-  if (cached && cached.expiresAt > Date.now()) return cached.keys;
-  const pending = orgBillingSummaryInFlight.get(customerId);
-  if (pending) return pending;
-
-  const read = settleOrgBillingSummary(customerId).then((keys) => {
-    orgBillingSummaryCache.delete(customerId);
-    if (orgBillingSummaryCache.size >= ORG_BILLING_SUMMARY_CACHE_MAX) {
-      const oldest = orgBillingSummaryCache.keys().next().value;
-      if (oldest !== undefined) orgBillingSummaryCache.delete(oldest);
-    }
-    orgBillingSummaryCache.set(customerId, {
-      keys,
-      expiresAt: Date.now() + ORG_BILLING_SUMMARY_TTL_MS,
-    });
-    return keys;
-  });
-  // Cleared however the read ends, so a rejection is never served forever.
-  void read.finally(() => orgBillingSummaryInFlight.delete(customerId)).catch(() => undefined);
-  orgBillingSummaryInFlight.set(customerId, read);
-  return read;
-}
-
-async function settleOrgBillingSummary(customerId: string): Promise<OrgBillingSummaryKeys> {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  try {
-    const timedOut = new Promise<"timeout">((resolve) => {
-      timer = setTimeout(() => resolve("timeout"), ORG_BILLING_SUMMARY_TIMEOUT_MS);
-    });
-    const summary = await Promise.race([readCustomerBillingSummary(customerId), timedOut]);
-    if (summary === "timeout") throw new Error("timeout");
-    const { shape } = orgBillingDetailsSchema;
-    const renewsAt = shape.renewsAt.safeParse(summary.renewsAt);
-    const sites = shape.sites.safeParse(summary.sites);
-    const paymentMethod = shape.paymentMethod.safeParse(summary.paymentMethod);
-    return {
-      renewsAt: renewsAt.success ? (renewsAt.data ?? null) : null,
-      sites: sites.success ? (sites.data ?? null) : null,
-      paymentMethod: paymentMethod.success ? (paymentMethod.data ?? null) : null,
-    };
-  } catch {
-    logger.warn(
-      { route: "billing", outcome: "summary_unavailable" },
-      "[billing] organization billing summary unavailable",
-    );
-    return {};
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-/** Test seam: forget every cached and in-flight Organization summary. */
-export function __resetOrgBillingSummaryCache(): void {
-  orgBillingSummaryCache.clear();
-  orgBillingSummaryInFlight.clear();
-}