@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/member-email-aliases.d.ts

@@ -0,0 +1,180 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A MEMBER'S OWN ADDRESSES (AGL-2975): the pure half.
+ *
+ * A member signs in with one address and may write from others — a Gmail
+ * send-as alias on an outbound domain, a role mailbox their client lets them
+ * send as. Anything that asks "did one of our own people write this?" by the
+ * sign-in address alone answers no for every one of those messages. This
+ * module is what such a reader needs instead: the addresses a member has
+ * added in a workspace, which of them the member has CONFIRMED, and which
+ * member an address belongs to.
+ *
+ * ## Confirmed, or nothing
+ *
+ * An address a member merely typed is a claim. Treating it as theirs would
+ * let a typo — or a prospect's address pasted into the wrong field — decide
+ * whose timeline a stranger's mail lands on. So an address counts only once
+ * a confirmation link sent TO it was opened by the member who added it, and
+ * every reader here that answers "whose is this" reads confirmed addresses
+ * and nothing else. `verifiedAtMs` is written by the server alone; the
+ * rules deny the whole collection to every client.
+ *
+ * ## Org-scoped, beside the roster
+ *
+ * `orgs/{orgId}/memberEmailAliases/{uid}` — one document per member who has
+ * added an address, keyed like the roster row it belongs to. Kept OFF the
+ * roster row on purpose: `orgs/{orgId}/members/{uid}` is the permissions
+ * document every rules evaluation reads, it is readable by every org-wide
+ * member, and a write that lands on it while the member is being removed
+ * can conjure a membership back into existence (AGL-1766). An address
+ * somebody has not yet confirmed is not the team's business, and a stray
+ * write here grants nothing: every reader intersects it with the roster.
+ *
+ * ## Normalized the way member addresses are
+ *
+ * Trimmed and lower-cased by `normalizeContactEmail`, the function every
+ * member address and every message address is compared through, so an
+ * alias typed `Avery@Example.ORG ` matches a From of `avery@example.org`. Plus
+ * addressing is NOT folded, for the reason `account-emails.ts` gives:
+ * `a+b@x.com` is another mailbox almost everywhere but Gmail, so
+ * `avery+news@example.org` is a different address from a confirmed
+ * `avery@example.org`, exactly as it is from a sign-in address of that name.
+ */
+/** The collection under an org that holds each member's added addresses. */
+export declare const MEMBER_EMAIL_ALIASES_COLLECTION = "memberEmailAliases";
+/**
+ * How many addresses one member may add in one workspace, unconfirmed
+ * ones included. Each costs a confirmation email, and the point is "the
+ * address my outreach leaves from", not address collecting — the same
+ * ceiling `MAX_ACCOUNT_EMAILS` puts on an account.
+ */
+export declare const MEMBER_EMAIL_ALIASES_MAX = 5;
+/** How long a confirmation link works: a day, as an account address's does. */
+export declare const MEMBER_EMAIL_ALIAS_CONFIRM_TTL_MS: number;
+/** The query parameter a confirmation link carries its token in. */
+export declare const MEMBER_EMAIL_ALIAS_CONFIRM_PARAM = "confirmEmailAlias";
+/**
+ * The console route a member manages their addresses through. One spelling
+ * for the route file's readers and every card that calls it.
+ */
+export declare const MEMBER_EMAIL_ALIASES_ROUTE = "/api/orgs/members/email-aliases";
+/** One address a member added. */
+export interface MemberEmailAlias {
+    /** Normalized — see the module comment. */
+    address: string;
+    /**
+     * When the member added it. A confirmation link names this instant, so
+     * removing the address and adding it again retires every link sent for
+     * the earlier one.
+     */
+    addedAtMs: number;
+    /**
+     * When the member who added it opened a confirmation link. Absent until
+     * then, and an address without it is never treated as theirs.
+     */
+    verifiedAtMs?: number;
+}
+/** `orgs/{orgId}/memberEmailAliases/{uid}`. */
+export interface MemberEmailAliasesDocument {
+    uid: string;
+    aliases: MemberEmailAlias[];
+    updatedAtMs: number;
+}
+/** A stored or typed address, normalized, or `null` when it is not one. */
+export declare function normalizeMemberEmailAlias(input: unknown): string | null;
+/**
+ * The addresses a stored document holds, read defensively: an entry that is
+ * not an address is skipped, a repeated address keeps its first entry, and
+ * the list is bounded by {@link MEMBER_EMAIL_ALIASES_MAX}, so no reader walks
+ * more than the writer could ever have stored.
+ */
+export declare function readMemberEmailAliases(document: unknown): MemberEmailAlias[];
+/** Whether the member who added the address has confirmed it. */
+export declare function isVerifiedMemberEmailAlias(alias: Pick<MemberEmailAlias, 'verifiedAtMs'> | null | undefined): boolean;
+/**
+ * The CONFIRMED addresses a stored document holds — the only answer any
+ * reader deciding "whose address is this" may use.
+ */
+export declare function verifiedMemberEmailAliases(document: unknown): string[];
+/** One member, as a reader of their addresses needs them. */
+export interface MemberAddresses {
+    /** The address they sign in with, as their roster row carries it. */
+    email?: string | null;
+    /**
+     * The addresses they have confirmed — {@link verifiedMemberEmailAliases}.
+     * An unconfirmed address never belongs here.
+     */
+    verifiedAliases?: readonly string[];
+}
+/**
+ * Every address that is this member's — the sign-in address first, then
+ * each confirmed alias — normalized, each once.
+ */
+export declare function memberEmailAddresses(member: MemberAddresses | null | undefined): string[];
+/**
+ * The member an address belongs to, or `null`.
+ *
+ * A sign-in address decides first: one account signs in with it, so it
+ * names one person. Otherwise the member who confirmed it as an alias —
+ * when exactly one did. Two members who each confirmed a shared mailbox
+ * both own it, and naming either as the author of its mail would be a
+ * guess, so the answer is nobody in particular. Whether the address is
+ * the TEAM's is a different question, which {@link memberEmailAddresses}
+ * over the whole roster answers yes to either way.
+ */
+export declare function findMemberByEmailAddress<T extends MemberAddresses>(members: readonly T[], address: unknown): T | null;
+/** Why an address could not be added. */
+export type MemberEmailAliasAddRefusal = 'invalid-address' | 'sign-in-address' | 'reserved-domain' | 'already-confirmed' | 'limit-reached';
+export type MemberEmailAliasAddVerdict = {
+    ok: true;
+    address: string;
+    /**
+     * The unconfirmed entry already holding the address, or `null` when it
+     * is new. Adding an address again is how a member asks for another
+     * link, so an unconfirmed duplicate is not a refusal.
+     */
+    existing: MemberEmailAlias | null;
+} | {
+    ok: false;
+    refusal: MemberEmailAliasAddRefusal;
+    message: string;
+};
+/**
+ * May this member add this address? Pure, so the card that greys out the
+ * field and the route that refuses the write give one answer.
+ *
+ * `reservedDomains` are domains the deployment itself receives mail at —
+ * the capture domain — whose addresses are the platform's, and a
+ * confirmation email sent to one would only be read back by the platform.
+ */
+export declare function evaluateMemberEmailAliasAdd(input: {
+    address: unknown;
+    signInEmail?: string | null;
+    aliases: readonly MemberEmailAlias[];
+    reservedDomains?: readonly string[];
+}): MemberEmailAliasAddVerdict;
+/** One address as the management route answers it. */
+export interface MemberEmailAliasRow {
+    address: string;
+    addedAtMs: number;
+    verified: boolean;
+    verifiedAtMs: number | null;
+}
+/** The rows the management route answers with, in the order they were added. */
+export declare function memberEmailAliasRows(aliases: readonly MemberEmailAlias[]): MemberEmailAliasRow[];

package/src/lib/app-utils/member-email-aliases.js

@@ -0,0 +1,217 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { ACCOUNT_EMAIL_MAX_LENGTH, ACCOUNT_EMAIL_PATTERN } from "./account-emails.js";
+import { normalizeContactEmail } from "./contacts.js";
+/**
+ * A MEMBER'S OWN ADDRESSES (AGL-2975): the pure half.
+ *
+ * A member signs in with one address and may write from others — a Gmail
+ * send-as alias on an outbound domain, a role mailbox their client lets them
+ * send as. Anything that asks "did one of our own people write this?" by the
+ * sign-in address alone answers no for every one of those messages. This
+ * module is what such a reader needs instead: the addresses a member has
+ * added in a workspace, which of them the member has CONFIRMED, and which
+ * member an address belongs to.
+ *
+ * ## Confirmed, or nothing
+ *
+ * An address a member merely typed is a claim. Treating it as theirs would
+ * let a typo — or a prospect's address pasted into the wrong field — decide
+ * whose timeline a stranger's mail lands on. So an address counts only once
+ * a confirmation link sent TO it was opened by the member who added it, and
+ * every reader here that answers "whose is this" reads confirmed addresses
+ * and nothing else. `verifiedAtMs` is written by the server alone; the
+ * rules deny the whole collection to every client.
+ *
+ * ## Org-scoped, beside the roster
+ *
+ * `orgs/{orgId}/memberEmailAliases/{uid}` — one document per member who has
+ * added an address, keyed like the roster row it belongs to. Kept OFF the
+ * roster row on purpose: `orgs/{orgId}/members/{uid}` is the permissions
+ * document every rules evaluation reads, it is readable by every org-wide
+ * member, and a write that lands on it while the member is being removed
+ * can conjure a membership back into existence (AGL-1766). An address
+ * somebody has not yet confirmed is not the team's business, and a stray
+ * write here grants nothing: every reader intersects it with the roster.
+ *
+ * ## Normalized the way member addresses are
+ *
+ * Trimmed and lower-cased by `normalizeContactEmail`, the function every
+ * member address and every message address is compared through, so an
+ * alias typed `Avery@Example.ORG ` matches a From of `avery@example.org`. Plus
+ * addressing is NOT folded, for the reason `account-emails.ts` gives:
+ * `a+b@x.com` is another mailbox almost everywhere but Gmail, so
+ * `avery+news@example.org` is a different address from a confirmed
+ * `avery@example.org`, exactly as it is from a sign-in address of that name.
+ */ /** The collection under an org that holds each member's added addresses. */ export const MEMBER_EMAIL_ALIASES_COLLECTION = 'memberEmailAliases';
+/**
+ * How many addresses one member may add in one workspace, unconfirmed
+ * ones included. Each costs a confirmation email, and the point is "the
+ * address my outreach leaves from", not address collecting — the same
+ * ceiling `MAX_ACCOUNT_EMAILS` puts on an account.
+ */ export const MEMBER_EMAIL_ALIASES_MAX = 5;
+/** How long a confirmation link works: a day, as an account address's does. */ export const MEMBER_EMAIL_ALIAS_CONFIRM_TTL_MS = 24 * 60 * 60 * 1000;
+/** The query parameter a confirmation link carries its token in. */ export const MEMBER_EMAIL_ALIAS_CONFIRM_PARAM = 'confirmEmailAlias';
+/**
+ * The console route a member manages their addresses through. One spelling
+ * for the route file's readers and every card that calls it.
+ */ export const MEMBER_EMAIL_ALIASES_ROUTE = '/api/orgs/members/email-aliases';
+/** A stored or typed address, normalized, or `null` when it is not one. */ export function normalizeMemberEmailAlias(input) {
+    return normalizeContactEmail(input);
+}
+const positiveMs = (value)=>typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null;
+/**
+ * The addresses a stored document holds, read defensively: an entry that is
+ * not an address is skipped, a repeated address keeps its first entry, and
+ * the list is bounded by {@link MEMBER_EMAIL_ALIASES_MAX}, so no reader walks
+ * more than the writer could ever have stored.
+ */ export function readMemberEmailAliases(document) {
+    const raw = document == null ? void 0 : document.aliases;
+    if (!Array.isArray(raw)) return [];
+    const seen = new Set();
+    const aliases = [];
+    for (const entry of raw){
+        if (aliases.length >= MEMBER_EMAIL_ALIASES_MAX) break;
+        const record = entry != null ? entry : {};
+        const address = normalizeMemberEmailAlias(record['address']);
+        const addedAtMs = positiveMs(record['addedAtMs']);
+        if (!address || addedAtMs === null || seen.has(address)) continue;
+        seen.add(address);
+        const verifiedAtMs = positiveMs(record['verifiedAtMs']);
+        aliases.push(_extends({
+            address,
+            addedAtMs
+        }, verifiedAtMs !== null ? {
+            verifiedAtMs
+        } : {}));
+    }
+    return aliases;
+}
+/** Whether the member who added the address has confirmed it. */ export function isVerifiedMemberEmailAlias(alias) {
+    return positiveMs(alias == null ? void 0 : alias.verifiedAtMs) !== null;
+}
+/**
+ * The CONFIRMED addresses a stored document holds — the only answer any
+ * reader deciding "whose address is this" may use.
+ */ export function verifiedMemberEmailAliases(document) {
+    return readMemberEmailAliases(document).filter(isVerifiedMemberEmailAlias).map((alias)=>alias.address);
+}
+/**
+ * Every address that is this member's — the sign-in address first, then
+ * each confirmed alias — normalized, each once.
+ */ export function memberEmailAddresses(member) {
+    var _ref;
+    const addresses = [];
+    const add = (value)=>{
+        const address = normalizeMemberEmailAlias(value);
+        if (address && !addresses.includes(address)) addresses.push(address);
+    };
+    add(member == null ? void 0 : member.email);
+    for (const alias of (_ref = member == null ? void 0 : member.verifiedAliases) != null ? _ref : [])add(alias);
+    return addresses;
+}
+/**
+ * The member an address belongs to, or `null`.
+ *
+ * A sign-in address decides first: one account signs in with it, so it
+ * names one person. Otherwise the member who confirmed it as an alias —
+ * when exactly one did. Two members who each confirmed a shared mailbox
+ * both own it, and naming either as the author of its mail would be a
+ * guess, so the answer is nobody in particular. Whether the address is
+ * the TEAM's is a different question, which {@link memberEmailAddresses}
+ * over the whole roster answers yes to either way.
+ */ export function findMemberByEmailAddress(members, address) {
+    const wanted = normalizeMemberEmailAlias(address);
+    if (!wanted) return null;
+    const bySignIn = members.find((member)=>normalizeMemberEmailAlias(member.email) === wanted);
+    if (bySignIn) return bySignIn;
+    const holders = members.filter((member)=>{
+        var _member_verifiedAliases;
+        return ((_member_verifiedAliases = member.verifiedAliases) != null ? _member_verifiedAliases : []).some((alias)=>normalizeMemberEmailAlias(alias) === wanted);
+    });
+    return holders.length === 1 ? holders[0] : null;
+}
+/**
+ * May this member add this address? Pure, so the card that greys out the
+ * field and the route that refuses the write give one answer.
+ *
+ * `reservedDomains` are domains the deployment itself receives mail at —
+ * the capture domain — whose addresses are the platform's, and a
+ * confirmation email sent to one would only be read back by the platform.
+ */ export function evaluateMemberEmailAliasAdd(input) {
+    var _input_reservedDomains, _input_aliases_find;
+    // Stored only when it is a mailbox address in the narrower shape an
+    // account address must have: the address is mailed a link and printed in
+    // the console, so a string the loose comparison pattern admits — quotes,
+    // angle brackets, commas — is refused here rather than carried around.
+    const address = normalizeMemberEmailAlias(input.address);
+    if (!address || address.length > ACCOUNT_EMAIL_MAX_LENGTH || !ACCOUNT_EMAIL_PATTERN.test(address)) {
+        return {
+            ok: false,
+            refusal: 'invalid-address',
+            message: 'Enter a valid email address.'
+        };
+    }
+    if (address === normalizeMemberEmailAlias(input.signInEmail)) {
+        return {
+            ok: false,
+            refusal: 'sign-in-address',
+            message: 'That is the address you sign in with, which already counts as yours.'
+        };
+    }
+    const domain = address.slice(address.lastIndexOf('@') + 1);
+    const reserved = ((_input_reservedDomains = input.reservedDomains) != null ? _input_reservedDomains : []).map((value)=>String(value).trim().toLowerCase());
+    if (reserved.includes(domain)) {
+        return {
+            ok: false,
+            refusal: 'reserved-domain',
+            message: 'Addresses at that domain belong to the platform and cannot be added.'
+        };
+    }
+    const existing = (_input_aliases_find = input.aliases.find((alias)=>alias.address === address)) != null ? _input_aliases_find : null;
+    if (existing && isVerifiedMemberEmailAlias(existing)) {
+        return {
+            ok: false,
+            refusal: 'already-confirmed',
+            message: 'That address is already confirmed.'
+        };
+    }
+    if (!existing && input.aliases.length >= MEMBER_EMAIL_ALIASES_MAX) {
+        return {
+            ok: false,
+            refusal: 'limit-reached',
+            message: `You can add up to ${MEMBER_EMAIL_ALIASES_MAX} addresses. Remove one before adding another.`
+        };
+    }
+    return {
+        ok: true,
+        address,
+        existing
+    };
+}
+/** The rows the management route answers with, in the order they were added. */ export function memberEmailAliasRows(aliases) {
+    return [
+        ...aliases
+    ].sort((a, b)=>a.addedAtMs - b.addedAtMs).map((alias)=>({
+            address: alias.address,
+            addedAtMs: alias.addedAtMs,
+            verified: isVerifiedMemberEmailAlias(alias),
+            verifiedAtMs: positiveMs(alias.verifiedAtMs)
+        }));
+}
+
+//# sourceMappingURL=member-email-aliases.js.map

package/src/lib/app-utils/member-email-aliases.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/member-email-aliases.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ACCOUNT_EMAIL_MAX_LENGTH, ACCOUNT_EMAIL_PATTERN } from './account-emails'\nimport { normalizeContactEmail } from './contacts'\n\n/**\n * A MEMBER'S OWN ADDRESSES (AGL-2975): the pure half.\n *\n * A member signs in with one address and may write from others — a Gmail\n * send-as alias on an outbound domain, a role mailbox their client lets them\n * send as. Anything that asks \"did one of our own people write this?\" by the\n * sign-in address alone answers no for every one of those messages. This\n * module is what such a reader needs instead: the addresses a member has\n * added in a workspace, which of them the member has CONFIRMED, and which\n * member an address belongs to.\n *\n * ## Confirmed, or nothing\n *\n * An address a member merely typed is a claim. Treating it as theirs would\n * let a typo — or a prospect's address pasted into the wrong field — decide\n * whose timeline a stranger's mail lands on. So an address counts only once\n * a confirmation link sent TO it was opened by the member who added it, and\n * every reader here that answers \"whose is this\" reads confirmed addresses\n * and nothing else. `verifiedAtMs` is written by the server alone; the\n * rules deny the whole collection to every client.\n *\n * ## Org-scoped, beside the roster\n *\n * `orgs/{orgId}/memberEmailAliases/{uid}` — one document per member who has\n * added an address, keyed like the roster row it belongs to. Kept OFF the\n * roster row on purpose: `orgs/{orgId}/members/{uid}` is the permissions\n * document every rules evaluation reads, it is readable by every org-wide\n * member, and a write that lands on it while the member is being removed\n * can conjure a membership back into existence (AGL-1766). An address\n * somebody has not yet confirmed is not the team's business, and a stray\n * write here grants nothing: every reader intersects it with the roster.\n *\n * ## Normalized the way member addresses are\n *\n * Trimmed and lower-cased by `normalizeContactEmail`, the function every\n * member address and every message address is compared through, so an\n * alias typed `Avery@Example.ORG ` matches a From of `avery@example.org`. Plus\n * addressing is NOT folded, for the reason `account-emails.ts` gives:\n * `a+b@x.com` is another mailbox almost everywhere but Gmail, so\n * `avery+news@example.org` is a different address from a confirmed\n * `avery@example.org`, exactly as it is from a sign-in address of that name.\n */\n\n/** The collection under an org that holds each member's added addresses. */\nexport const MEMBER_EMAIL_ALIASES_COLLECTION = 'memberEmailAliases'\n\n/**\n * How many addresses one member may add in one workspace, unconfirmed\n * ones included. Each costs a confirmation email, and the point is \"the\n * address my outreach leaves from\", not address collecting — the same\n * ceiling `MAX_ACCOUNT_EMAILS` puts on an account.\n */\nexport const MEMBER_EMAIL_ALIASES_MAX = 5\n\n/** How long a confirmation link works: a day, as an account address's does. */\nexport const MEMBER_EMAIL_ALIAS_CONFIRM_TTL_MS = 24 * 60 * 60 * 1000\n\n/** The query parameter a confirmation link carries its token in. */\nexport const MEMBER_EMAIL_ALIAS_CONFIRM_PARAM = 'confirmEmailAlias'\n\n/**\n * The console route a member manages their addresses through. One spelling\n * for the route file's readers and every card that calls it.\n */\nexport const MEMBER_EMAIL_ALIASES_ROUTE = '/api/orgs/members/email-aliases'\n\n/** One address a member added. */\nexport interface MemberEmailAlias {\n  /** Normalized — see the module comment. */\n  address: string\n  /**\n   * When the member added it. A confirmation link names this instant, so\n   * removing the address and adding it again retires every link sent for\n   * the earlier one.\n   */\n  addedAtMs: number\n  /**\n   * When the member who added it opened a confirmation link. Absent until\n   * then, and an address without it is never treated as theirs.\n   */\n  verifiedAtMs?: number\n}\n\n/** `orgs/{orgId}/memberEmailAliases/{uid}`. */\nexport interface MemberEmailAliasesDocument {\n  uid: string\n  aliases: MemberEmailAlias[]\n  updatedAtMs: number\n}\n\n/** A stored or typed address, normalized, or `null` when it is not one. */\nexport function normalizeMemberEmailAlias(input: unknown): string | null {\n  return normalizeContactEmail(input)\n}\n\nconst positiveMs = (value: unknown): number | null =>\n  typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null\n\n/**\n * The addresses a stored document holds, read defensively: an entry that is\n * not an address is skipped, a repeated address keeps its first entry, and\n * the list is bounded by {@link MEMBER_EMAIL_ALIASES_MAX}, so no reader walks\n * more than the writer could ever have stored.\n */\nexport function readMemberEmailAliases(document: unknown): MemberEmailAlias[] {\n  const raw = (document as { aliases?: unknown } | null | undefined)?.aliases\n  if (!Array.isArray(raw)) return []\n  const seen = new Set<string>()\n  const aliases: MemberEmailAlias[] = []\n  for (const entry of raw) {\n    if (aliases.length >= MEMBER_EMAIL_ALIASES_MAX) break\n    const record = (entry ?? {}) as Record<string, unknown>\n    const address = normalizeMemberEmailAlias(record['address'])\n    const addedAtMs = positiveMs(record['addedAtMs'])\n    if (!address || addedAtMs === null || seen.has(address)) continue\n    seen.add(address)\n    const verifiedAtMs = positiveMs(record['verifiedAtMs'])\n    aliases.push({ address, addedAtMs, ...(verifiedAtMs !== null ? { verifiedAtMs } : {}) })\n  }\n  return aliases\n}\n\n/** Whether the member who added the address has confirmed it. */\nexport function isVerifiedMemberEmailAlias(\n  alias: Pick<MemberEmailAlias, 'verifiedAtMs'> | null | undefined,\n): boolean {\n  return positiveMs(alias?.verifiedAtMs) !== null\n}\n\n/**\n * The CONFIRMED addresses a stored document holds — the only answer any\n * reader deciding \"whose address is this\" may use.\n */\nexport function verifiedMemberEmailAliases(document: unknown): string[] {\n  return readMemberEmailAliases(document)\n    .filter(isVerifiedMemberEmailAlias)\n    .map((alias) => alias.address)\n}\n\n/** One member, as a reader of their addresses needs them. */\nexport interface MemberAddresses {\n  /** The address they sign in with, as their roster row carries it. */\n  email?: string | null\n  /**\n   * The addresses they have confirmed — {@link verifiedMemberEmailAliases}.\n   * An unconfirmed address never belongs here.\n   */\n  verifiedAliases?: readonly string[]\n}\n\n/**\n * Every address that is this member's — the sign-in address first, then\n * each confirmed alias — normalized, each once.\n */\nexport function memberEmailAddresses(member: MemberAddresses | null | undefined): string[] {\n  const addresses: string[] = []\n  const add = (value: unknown) => {\n    const address = normalizeMemberEmailAlias(value)\n    if (address && !addresses.includes(address)) addresses.push(address)\n  }\n  add(member?.email)\n  for (const alias of member?.verifiedAliases ?? []) add(alias)\n  return addresses\n}\n\n/**\n * The member an address belongs to, or `null`.\n *\n * A sign-in address decides first: one account signs in with it, so it\n * names one person. Otherwise the member who confirmed it as an alias —\n * when exactly one did. Two members who each confirmed a shared mailbox\n * both own it, and naming either as the author of its mail would be a\n * guess, so the answer is nobody in particular. Whether the address is\n * the TEAM's is a different question, which {@link memberEmailAddresses}\n * over the whole roster answers yes to either way.\n */\nexport function findMemberByEmailAddress<T extends MemberAddresses>(\n  members: readonly T[],\n  address: unknown,\n): T | null {\n  const wanted = normalizeMemberEmailAlias(address)\n  if (!wanted) return null\n  const bySignIn = members.find((member) => normalizeMemberEmailAlias(member.email) === wanted)\n  if (bySignIn) return bySignIn\n  const holders = members.filter((member) =>\n    (member.verifiedAliases ?? []).some((alias) => normalizeMemberEmailAlias(alias) === wanted),\n  )\n  return holders.length === 1 ? holders[0] : null\n}\n\n/** Why an address could not be added. */\nexport type MemberEmailAliasAddRefusal =\n  | 'invalid-address'\n  | 'sign-in-address'\n  | 'reserved-domain'\n  | 'already-confirmed'\n  | 'limit-reached'\n\nexport type MemberEmailAliasAddVerdict =\n  | {\n      ok: true\n      address: string\n      /**\n       * The unconfirmed entry already holding the address, or `null` when it\n       * is new. Adding an address again is how a member asks for another\n       * link, so an unconfirmed duplicate is not a refusal.\n       */\n      existing: MemberEmailAlias | null\n    }\n  | { ok: false; refusal: MemberEmailAliasAddRefusal; message: string }\n\n/**\n * May this member add this address? Pure, so the card that greys out the\n * field and the route that refuses the write give one answer.\n *\n * `reservedDomains` are domains the deployment itself receives mail at —\n * the capture domain — whose addresses are the platform's, and a\n * confirmation email sent to one would only be read back by the platform.\n */\nexport function evaluateMemberEmailAliasAdd(input: {\n  address: unknown\n  signInEmail?: string | null\n  aliases: readonly MemberEmailAlias[]\n  reservedDomains?: readonly string[]\n}): MemberEmailAliasAddVerdict {\n  // Stored only when it is a mailbox address in the narrower shape an\n  // account address must have: the address is mailed a link and printed in\n  // the console, so a string the loose comparison pattern admits — quotes,\n  // angle brackets, commas — is refused here rather than carried around.\n  const address = normalizeMemberEmailAlias(input.address)\n  if (!address || address.length > ACCOUNT_EMAIL_MAX_LENGTH || !ACCOUNT_EMAIL_PATTERN.test(address)) {\n    return { ok: false, refusal: 'invalid-address', message: 'Enter a valid email address.' }\n  }\n  if (address === normalizeMemberEmailAlias(input.signInEmail)) {\n    return {\n      ok: false,\n      refusal: 'sign-in-address',\n      message: 'That is the address you sign in with, which already counts as yours.',\n    }\n  }\n  const domain = address.slice(address.lastIndexOf('@') + 1)\n  const reserved = (input.reservedDomains ?? []).map((value) => String(value).trim().toLowerCase())\n  if (reserved.includes(domain)) {\n    return {\n      ok: false,\n      refusal: 'reserved-domain',\n      message: 'Addresses at that domain belong to the platform and cannot be added.',\n    }\n  }\n  const existing = input.aliases.find((alias) => alias.address === address) ?? null\n  if (existing && isVerifiedMemberEmailAlias(existing)) {\n    return { ok: false, refusal: 'already-confirmed', message: 'That address is already confirmed.' }\n  }\n  if (!existing && input.aliases.length >= MEMBER_EMAIL_ALIASES_MAX) {\n    return {\n      ok: false,\n      refusal: 'limit-reached',\n      message: `You can add up to ${MEMBER_EMAIL_ALIASES_MAX} addresses. Remove one before adding another.`,\n    }\n  }\n  return { ok: true, address, existing }\n}\n\n/** One address as the management route answers it. */\nexport interface MemberEmailAliasRow {\n  address: string\n  addedAtMs: number\n  verified: boolean\n  verifiedAtMs: number | null\n}\n\n/** The rows the management route answers with, in the order they were added. */\nexport function memberEmailAliasRows(aliases: readonly MemberEmailAlias[]): MemberEmailAliasRow[] {\n  return [...aliases]\n    .sort((a, b) => a.addedAtMs - b.addedAtMs)\n    .map((alias) => ({\n      address: alias.address,\n      addedAtMs: alias.addedAtMs,\n      verified: isVerifiedMemberEmailAlias(alias),\n      verifiedAtMs: positiveMs(alias.verifiedAtMs),\n    }))\n}\n"],"names":["ACCOUNT_EMAIL_MAX_LENGTH","ACCOUNT_EMAIL_PATTERN","normalizeContactEmail","MEMBER_EMAIL_ALIASES_COLLECTION","MEMBER_EMAIL_ALIASES_MAX","MEMBER_EMAIL_ALIAS_CONFIRM_TTL_MS","MEMBER_EMAIL_ALIAS_CONFIRM_PARAM","MEMBER_EMAIL_ALIASES_ROUTE","normalizeMemberEmailAlias","input","positiveMs","value","Number","isFinite","readMemberEmailAliases","document","raw","aliases","Array","isArray","seen","Set","entry","length","record","address","addedAtMs","has","add","verifiedAtMs","push","isVerifiedMemberEmailAlias","alias","verifiedMemberEmailAliases","filter","map","memberEmailAddresses","member","addresses","includes","email","verifiedAliases","findMemberByEmailAddress","members","wanted","bySignIn","find","holders","some","evaluateMemberEmailAliasAdd","test","ok","refusal","message","signInEmail","domain","slice","lastIndexOf","reserved","reservedDomains","String","trim","toLowerCase","existing","memberEmailAliasRows","sort","a","b","verified"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,wBAAwB,EAAEC,qBAAqB,QAAQ,sBAAkB;AAClF,SAASC,qBAAqB,QAAQ,gBAAY;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GAED,0EAA0E,GAC1E,OAAO,MAAMC,kCAAkC,qBAAoB;AAEnE;;;;;CAKC,GACD,OAAO,MAAMC,2BAA2B,EAAC;AAEzC,6EAA6E,GAC7E,OAAO,MAAMC,oCAAoC,KAAK,KAAK,KAAK,KAAI;AAEpE,kEAAkE,GAClE,OAAO,MAAMC,mCAAmC,oBAAmB;AAEnE;;;CAGC,GACD,OAAO,MAAMC,6BAA6B,kCAAiC;AA0B3E,yEAAyE,GACzE,OAAO,SAASC,0BAA0BC,KAAc;IACtD,OAAOP,sBAAsBO;AAC/B;AAEA,MAAMC,aAAa,CAACC,QAClB,OAAOA,UAAU,YAAYC,OAAOC,QAAQ,CAACF,UAAUA,QAAQ,IAAIA,QAAQ;AAE7E;;;;;CAKC,GACD,OAAO,SAASG,uBAAuBC,QAAiB;IACtD,MAAMC,MAAOD,4BAAD,AAACA,SAAuDE,OAAO;IAC3E,IAAI,CAACC,MAAMC,OAAO,CAACH,MAAM,OAAO,EAAE;IAClC,MAAMI,OAAO,IAAIC;IACjB,MAAMJ,UAA8B,EAAE;IACtC,KAAK,MAAMK,SAASN,IAAK;QACvB,IAAIC,QAAQM,MAAM,IAAInB,0BAA0B;QAChD,MAAMoB,SAAUF,gBAAAA,QAAS,CAAC;QAC1B,MAAMG,UAAUjB,0BAA0BgB,MAAM,CAAC,UAAU;QAC3D,MAAME,YAAYhB,WAAWc,MAAM,CAAC,YAAY;QAChD,IAAI,CAACC,WAAWC,cAAc,QAAQN,KAAKO,GAAG,CAACF,UAAU;QACzDL,KAAKQ,GAAG,CAACH;QACT,MAAMI,eAAenB,WAAWc,MAAM,CAAC,eAAe;QACtDP,QAAQa,IAAI,CAAC;YAAEL;YAASC;WAAeG,iBAAiB,OAAO;YAAEA;QAAa,IAAI,CAAC;IACrF;IACA,OAAOZ;AACT;AAEA,+DAA+D,GAC/D,OAAO,SAASc,2BACdC,KAAgE;IAEhE,OAAOtB,WAAWsB,yBAAAA,MAAOH,YAAY,MAAM;AAC7C;AAEA;;;CAGC,GACD,OAAO,SAASI,2BAA2BlB,QAAiB;IAC1D,OAAOD,uBAAuBC,UAC3BmB,MAAM,CAACH,4BACPI,GAAG,CAAC,CAACH,QAAUA,MAAMP,OAAO;AACjC;AAaA;;;CAGC,GACD,OAAO,SAASW,qBAAqBC,MAA0C;;IAC7E,MAAMC,YAAsB,EAAE;IAC9B,MAAMV,MAAM,CAACjB;QACX,MAAMc,UAAUjB,0BAA0BG;QAC1C,IAAIc,WAAW,CAACa,UAAUC,QAAQ,CAACd,UAAUa,UAAUR,IAAI,CAACL;IAC9D;IACAG,IAAIS,0BAAAA,OAAQG,KAAK;IACjB,KAAK,MAAMR,iBAASK,0BAAAA,OAAQI,eAAe,mBAAI,EAAE,CAAEb,IAAII;IACvD,OAAOM;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASI,yBACdC,OAAqB,EACrBlB,OAAgB;IAEhB,MAAMmB,SAASpC,0BAA0BiB;IACzC,IAAI,CAACmB,QAAQ,OAAO;IACpB,MAAMC,WAAWF,QAAQG,IAAI,CAAC,CAACT,SAAW7B,0BAA0B6B,OAAOG,KAAK,MAAMI;IACtF,IAAIC,UAAU,OAAOA;IACrB,MAAME,UAAUJ,QAAQT,MAAM,CAAC,CAACG;YAC7BA;eAAD,EAACA,0BAAAA,OAAOI,eAAe,YAAtBJ,0BAA0B,EAAE,EAAEW,IAAI,CAAC,CAAChB,QAAUxB,0BAA0BwB,WAAWY;;IAEtF,OAAOG,QAAQxB,MAAM,KAAK,IAAIwB,OAAO,CAAC,EAAE,GAAG;AAC7C;AAuBA;;;;;;;CAOC,GACD,OAAO,SAASE,4BAA4BxC,KAK3C;QAiBmBA,wBAQDA;IAxBjB,oEAAoE;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,MAAMgB,UAAUjB,0BAA0BC,MAAMgB,OAAO;IACvD,IAAI,CAACA,WAAWA,QAAQF,MAAM,GAAGvB,4BAA4B,CAACC,sBAAsBiD,IAAI,CAACzB,UAAU;QACjG,OAAO;YAAE0B,IAAI;YAAOC,SAAS;YAAmBC,SAAS;QAA+B;IAC1F;IACA,IAAI5B,YAAYjB,0BAA0BC,MAAM6C,WAAW,GAAG;QAC5D,OAAO;YACLH,IAAI;YACJC,SAAS;YACTC,SAAS;QACX;IACF;IACA,MAAME,SAAS9B,QAAQ+B,KAAK,CAAC/B,QAAQgC,WAAW,CAAC,OAAO;IACxD,MAAMC,WAAW,EAACjD,yBAAAA,MAAMkD,eAAe,YAArBlD,yBAAyB,EAAE,EAAE0B,GAAG,CAAC,CAACxB,QAAUiD,OAAOjD,OAAOkD,IAAI,GAAGC,WAAW;IAC9F,IAAIJ,SAASnB,QAAQ,CAACgB,SAAS;QAC7B,OAAO;YACLJ,IAAI;YACJC,SAAS;YACTC,SAAS;QACX;IACF;IACA,MAAMU,YAAWtD,sBAAAA,MAAMQ,OAAO,CAAC6B,IAAI,CAAC,CAACd,QAAUA,MAAMP,OAAO,KAAKA,oBAAhDhB,sBAA4D;IAC7E,IAAIsD,YAAYhC,2BAA2BgC,WAAW;QACpD,OAAO;YAAEZ,IAAI;YAAOC,SAAS;YAAqBC,SAAS;QAAqC;IAClG;IACA,IAAI,CAACU,YAAYtD,MAAMQ,OAAO,CAACM,MAAM,IAAInB,0BAA0B;QACjE,OAAO;YACL+C,IAAI;YACJC,SAAS;YACTC,SAAS,CAAC,kBAAkB,EAAEjD,yBAAyB,6CAA6C,CAAC;QACvG;IACF;IACA,OAAO;QAAE+C,IAAI;QAAM1B;QAASsC;IAAS;AACvC;AAUA,8EAA8E,GAC9E,OAAO,SAASC,qBAAqB/C,OAAoC;IACvE,OAAO;WAAIA;KAAQ,CAChBgD,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAExC,SAAS,GAAGyC,EAAEzC,SAAS,EACxCS,GAAG,CAAC,CAACH,QAAW,CAAA;YACfP,SAASO,MAAMP,OAAO;YACtBC,WAAWM,MAAMN,SAAS;YAC1B0C,UAAUrC,2BAA2BC;YACrCH,cAAcnB,WAAWsB,MAAMH,YAAY;QAC7C,CAAA;AACJ"}

package/src/lib/app-utils/merge-node-sx.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Merges an sx-shaped override over a base sx record with REAL merge
+ * semantics — the compose point for a component instance's root style
+ * overrides (AGL-1306): the component root's own sx is the base, the
+ * instance's `styleOverrides.root` is the override, and the grafted root
+ * renders the merged result on every surface (canvas, Preview, tenant
+ * SSR) because the graft itself calls this.
+ *
+ * Property-level behaviour (see {@link mergeSxProperty}):
+ *
+ * - A plain property replaces exactly the leaf it names; the base's
+ *   other properties survive.
+ * - Responsive breakpoint objects merge with mobile-first cascade
+ *   semantics via `mergeSchemeValue` — a partial `{ md: … }` override
+ *   keeps the base's values below `md` instead of silently dropping
+ *   them.
+ * - The `@scheme dark` slice is a plain record of style properties, so
+ *   it merges key-by-key: overriding one dark colour keeps the base
+ *   slice's siblings. A base-scope override does NOT erase the base's
+ *   dark slice — the slice is a more specific selector of the same
+ *   stylesheet, exactly as it behaves within a single node's sx.
+ * - Nested selector records (`&:hover`, `@media …`) merge key-by-key
+ *   for the same reason.
+ *
+ * Non-record forms degrade honestly: when either side is an array, a
+ * function, or a scalar there is no record to merge into, so the pair
+ * composes in MUI's array form (later entries win per property at style
+ * resolution). Inputs are never mutated.
+ */
+export declare function mergeNodeSx(base: unknown, override: unknown): unknown;
+export default mergeNodeSx;

package/src/lib/app-utils/merge-node-sx.js

@@ -0,0 +1,123 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // Subpath, NOT the `@aglyn/shared-data-enums` barrel (AGL-2486). That barrel
+// re-exports `lib/firebase-auth`, which imports `AuthErrorCodes` from
+// `firebase/auth` as a VALUE — so a styling helper on the node-render path
+// dragged the Firebase auth graph into the client bundle of every published
+// customer page. This module and `palette-sx` were the only two edges from
+// `@aglyn/aglyn` to that barrel; pointing both at the file they actually want
+// measured -48,643 B GZIPPED off the `/[host]/[scheme]/[[...slug]]` route's client
+// chunks (694,808 -> 646,165 B gz, Turbopack production build).
+import { expandSxAliases } from "@aglyn/shared-data-enums/sx-property-aliases";
+import { isResponsiveSxObject, mergeSchemeValue } from "./scheme-sx.js";
+const isPlainObject = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+/**
+ * Merges one sx PROPERTY value over another, following the two house
+ * rules this codebase already enforces elsewhere:
+ *
+ * - `mergeThemeOptions` (host-theme): an override replaces the LEAF it
+ *   names, never the whole record — so two plain objects (a `&:hover`
+ *   block, a `@media` block) merge key-by-key rather than the override
+ *   clobbering the base's siblings.
+ * - `mergeSchemeValue` (scheme-sx): responsive breakpoint objects merge
+ *   with real mobile-first cascade semantics — a `{ md: … }` override
+ *   keeps the base's xs–sm values, and a plain override applies at every
+ *   width.
+ *
+ * Everything else (scalars, arrays, theme callbacks) is a leaf: the
+ * override replaces it.
+ */ function mergeSxProperty(base, override) {
+    if (override === undefined) return base;
+    if (base === undefined) return override;
+    if (isResponsiveSxObject(base) || isResponsiveSxObject(override)) {
+        return mergeSchemeValue(base, override);
+    }
+    if (isPlainObject(base) && isPlainObject(override)) {
+        const merged = _extends({}, base);
+        for (const [key, value] of Object.entries(override)){
+            const next = mergeSxProperty(base[key], value);
+            if (next === undefined) delete merged[key];
+            else merged[key] = next;
+        }
+        return merged;
+    }
+    return override;
+}
+/**
+ * Merges an sx-shaped override over a base sx record with REAL merge
+ * semantics — the compose point for a component instance's root style
+ * overrides (AGL-1306): the component root's own sx is the base, the
+ * instance's `styleOverrides.root` is the override, and the grafted root
+ * renders the merged result on every surface (canvas, Preview, tenant
+ * SSR) because the graft itself calls this.
+ *
+ * Property-level behaviour (see {@link mergeSxProperty}):
+ *
+ * - A plain property replaces exactly the leaf it names; the base's
+ *   other properties survive.
+ * - Responsive breakpoint objects merge with mobile-first cascade
+ *   semantics via `mergeSchemeValue` — a partial `{ md: … }` override
+ *   keeps the base's values below `md` instead of silently dropping
+ *   them.
+ * - The `@scheme dark` slice is a plain record of style properties, so
+ *   it merges key-by-key: overriding one dark colour keeps the base
+ *   slice's siblings. A base-scope override does NOT erase the base's
+ *   dark slice — the slice is a more specific selector of the same
+ *   stylesheet, exactly as it behaves within a single node's sx.
+ * - Nested selector records (`&:hover`, `@media …`) merge key-by-key
+ *   for the same reason.
+ *
+ * Non-record forms degrade honestly: when either side is an array, a
+ * function, or a scalar there is no record to merge into, so the pair
+ * composes in MUI's array form (later entries win per property at style
+ * resolution). Inputs are never mutated.
+ */ export function mergeNodeSx(base, override) {
+    if (override === null || override === undefined) return base;
+    if (isPlainObject(override) && Object.keys(override).length === 0) {
+        return base;
+    }
+    if (base === null || base === undefined) return override;
+    if (!isPlainObject(base) || !isPlainObject(override)) {
+        return [
+            base,
+            override
+        ].flat();
+    }
+    // Both sides speak ONE spelling before the key-level merge (AGL-2209).
+    // `py` and `paddingTop` are different keys, so without this an instance
+    // override never REPLACES an aliased definition value — it lands beside
+    // it, and a Padding Top override on a node whose definition says `py: 8`
+    // moves the top edge while the bottom silently keeps the component's 8.
+    // Semantics-preserving and identity-returning: an sx with no alias is the
+    // same object, so a corpus that never used one pays a key scan.
+    const canonicalBase = expandSxAliases(base, {
+        deep: true
+    });
+    const canonicalOverride = expandSxAliases(override, {
+        deep: true
+    });
+    const merged = _extends({}, canonicalBase);
+    for (const [key, value] of Object.entries(canonicalOverride)){
+        const next = mergeSxProperty(canonicalBase[key], value);
+        if (next === undefined) delete merged[key];
+        else merged[key] = next;
+    }
+    return merged;
+}
+export default mergeNodeSx;
+
+//# sourceMappingURL=merge-node-sx.js.map

package/src/lib/app-utils/merge-node-sx.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/merge-node-sx.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Subpath, NOT the `@aglyn/shared-data-enums` barrel (AGL-2486). That barrel\n// re-exports `lib/firebase-auth`, which imports `AuthErrorCodes` from\n// `firebase/auth` as a VALUE — so a styling helper on the node-render path\n// dragged the Firebase auth graph into the client bundle of every published\n// customer page. This module and `palette-sx` were the only two edges from\n// `@aglyn/aglyn` to that barrel; pointing both at the file they actually want\n// measured -48,643 B GZIPPED off the `/[host]/[scheme]/[[...slug]]` route's client\n// chunks (694,808 -> 646,165 B gz, Turbopack production build).\nimport { expandSxAliases } from '@aglyn/shared-data-enums/sx-property-aliases'\nimport {\n  isResponsiveSxObject,\n  mergeSchemeValue,\n} from './scheme-sx'\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\n/**\n * Merges one sx PROPERTY value over another, following the two house\n * rules this codebase already enforces elsewhere:\n *\n * - `mergeThemeOptions` (host-theme): an override replaces the LEAF it\n *   names, never the whole record — so two plain objects (a `&:hover`\n *   block, a `@media` block) merge key-by-key rather than the override\n *   clobbering the base's siblings.\n * - `mergeSchemeValue` (scheme-sx): responsive breakpoint objects merge\n *   with real mobile-first cascade semantics — a `{ md: … }` override\n *   keeps the base's xs–sm values, and a plain override applies at every\n *   width.\n *\n * Everything else (scalars, arrays, theme callbacks) is a leaf: the\n * override replaces it.\n */\nfunction mergeSxProperty(base: unknown, override: unknown): unknown {\n  if (override === undefined) return base\n  if (base === undefined) return override\n  if (isResponsiveSxObject(base) || isResponsiveSxObject(override)) {\n    return mergeSchemeValue(base, override)\n  }\n  if (isPlainObject(base) && isPlainObject(override)) {\n    const merged: Record<string, unknown> = { ...base }\n    for (const [key, value] of Object.entries(override)) {\n      const next = mergeSxProperty(base[key], value)\n      if (next === undefined) delete merged[key]\n      else merged[key] = next\n    }\n    return merged\n  }\n  return override\n}\n\n/**\n * Merges an sx-shaped override over a base sx record with REAL merge\n * semantics — the compose point for a component instance's root style\n * overrides (AGL-1306): the component root's own sx is the base, the\n * instance's `styleOverrides.root` is the override, and the grafted root\n * renders the merged result on every surface (canvas, Preview, tenant\n * SSR) because the graft itself calls this.\n *\n * Property-level behaviour (see {@link mergeSxProperty}):\n *\n * - A plain property replaces exactly the leaf it names; the base's\n *   other properties survive.\n * - Responsive breakpoint objects merge with mobile-first cascade\n *   semantics via `mergeSchemeValue` — a partial `{ md: … }` override\n *   keeps the base's values below `md` instead of silently dropping\n *   them.\n * - The `@scheme dark` slice is a plain record of style properties, so\n *   it merges key-by-key: overriding one dark colour keeps the base\n *   slice's siblings. A base-scope override does NOT erase the base's\n *   dark slice — the slice is a more specific selector of the same\n *   stylesheet, exactly as it behaves within a single node's sx.\n * - Nested selector records (`&:hover`, `@media …`) merge key-by-key\n *   for the same reason.\n *\n * Non-record forms degrade honestly: when either side is an array, a\n * function, or a scalar there is no record to merge into, so the pair\n * composes in MUI's array form (later entries win per property at style\n * resolution). Inputs are never mutated.\n */\nexport function mergeNodeSx(base: unknown, override: unknown): unknown {\n  if (override === null || override === undefined) return base\n  if (isPlainObject(override) && Object.keys(override).length === 0) {\n    return base\n  }\n  if (base === null || base === undefined) return override\n  if (!isPlainObject(base) || !isPlainObject(override)) {\n    return [base, override].flat()\n  }\n  // Both sides speak ONE spelling before the key-level merge (AGL-2209).\n  // `py` and `paddingTop` are different keys, so without this an instance\n  // override never REPLACES an aliased definition value — it lands beside\n  // it, and a Padding Top override on a node whose definition says `py: 8`\n  // moves the top edge while the bottom silently keeps the component's 8.\n  // Semantics-preserving and identity-returning: an sx with no alias is the\n  // same object, so a corpus that never used one pays a key scan.\n  const canonicalBase = expandSxAliases(base, { deep: true })\n  const canonicalOverride = expandSxAliases(override, { deep: true })\n  const merged: Record<string, unknown> = { ...canonicalBase }\n  for (const [key, value] of Object.entries(canonicalOverride)) {\n    const next = mergeSxProperty(canonicalBase[key], value)\n    if (next === undefined) delete merged[key]\n    else merged[key] = next\n  }\n  return merged\n}\n\nexport default mergeNodeSx\n"],"names":["expandSxAliases","isResponsiveSxObject","mergeSchemeValue","isPlainObject","value","Array","isArray","mergeSxProperty","base","override","undefined","merged","key","Object","entries","next","mergeNodeSx","keys","length","flat","canonicalBase","deep","canonicalOverride"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,6EAA6E;AAC7E,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,mFAAmF;AACnF,gEAAgE;AAChE,SAASA,eAAe,QAAQ,+CAA8C;AAC9E,SACEC,oBAAoB,EACpBC,gBAAgB,QACX,iBAAa;AAEpB,MAAMC,gBAAgB,CAACC,QACrB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACC,MAAMC,OAAO,CAACF;AAEhE;;;;;;;;;;;;;;;CAeC,GACD,SAASG,gBAAgBC,IAAa,EAAEC,QAAiB;IACvD,IAAIA,aAAaC,WAAW,OAAOF;IACnC,IAAIA,SAASE,WAAW,OAAOD;IAC/B,IAAIR,qBAAqBO,SAASP,qBAAqBQ,WAAW;QAChE,OAAOP,iBAAiBM,MAAMC;IAChC;IACA,IAAIN,cAAcK,SAASL,cAAcM,WAAW;QAClD,MAAME,SAAkC,aAAKH;QAC7C,KAAK,MAAM,CAACI,KAAKR,MAAM,IAAIS,OAAOC,OAAO,CAACL,UAAW;YACnD,MAAMM,OAAOR,gBAAgBC,IAAI,CAACI,IAAI,EAAER;YACxC,IAAIW,SAASL,WAAW,OAAOC,MAAM,CAACC,IAAI;iBACrCD,MAAM,CAACC,IAAI,GAAGG;QACrB;QACA,OAAOJ;IACT;IACA,OAAOF;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,SAASO,YAAYR,IAAa,EAAEC,QAAiB;IAC1D,IAAIA,aAAa,QAAQA,aAAaC,WAAW,OAAOF;IACxD,IAAIL,cAAcM,aAAaI,OAAOI,IAAI,CAACR,UAAUS,MAAM,KAAK,GAAG;QACjE,OAAOV;IACT;IACA,IAAIA,SAAS,QAAQA,SAASE,WAAW,OAAOD;IAChD,IAAI,CAACN,cAAcK,SAAS,CAACL,cAAcM,WAAW;QACpD,OAAO;YAACD;YAAMC;SAAS,CAACU,IAAI;IAC9B;IACA,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAMC,gBAAgBpB,gBAAgBQ,MAAM;QAAEa,MAAM;IAAK;IACzD,MAAMC,oBAAoBtB,gBAAgBS,UAAU;QAAEY,MAAM;IAAK;IACjE,MAAMV,SAAkC,aAAKS;IAC7C,KAAK,MAAM,CAACR,KAAKR,MAAM,IAAIS,OAAOC,OAAO,CAACQ,mBAAoB;QAC5D,MAAMP,OAAOR,gBAAgBa,aAAa,CAACR,IAAI,EAAER;QACjD,IAAIW,SAASL,WAAW,OAAOC,MAAM,CAACC,IAAI;aACrCD,MAAM,CAACC,IAAI,GAAGG;IACrB;IACA,OAAOJ;AACT;AAEA,eAAeK,YAAW"}