@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/abuse-report.d.ts

@@ -0,0 +1,193 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Firestore collection holding intake rows. Staff-read, Admin-SDK-written. */
+export declare const ABUSE_REPORT_COLLECTION = "abuseReports";
+/**
+ * The contact address printed on the form — the OPERATOR's, resolved from
+ * configuration (AGL-2016).
+ *
+ * This was `export const ABUSE_REPORT_CONTACT_EMAIL = 'support@aglyn.com'`,
+ * and the docblock justifying it called itself *"the single place to change"*.
+ * It was the single place to change for **Aglyn**; for every other deployment
+ * it was the single place a third party's DMCA notice got misaddressed to us.
+ * The form it renders on is public and unauthenticated and ships with every
+ * install, so the literal made a self-hoster publish an intake pointing at a
+ * desk that cannot see, let alone remove, the content being reported.
+ *
+ * The original reasoning is preserved because it still governs **Aglyn's**
+ * configured value: `support@` and NOT `abuse@`, because AGL-1973 records
+ * that `abuse@aglyn.com` is not confirmed to deliver and AGL-1577 records
+ * that Gmail default routing accepts mail for non-existent `@aglyn.com`
+ * addresses with bounce suppression on. A published address that silently
+ * drops mail is worse than publishing none. That is now a statement about
+ * what we put in `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, not about what the
+ * software hardcodes.
+ *
+ * DMCA notices prefer the legal mailbox when the operator has configured a
+ * separate one; see {@link operatorContactLine}.
+ */
+export declare function abuseReportContactEmail(kind?: 'support' | 'legal'): string | null;
+/** Maximum characters of reporter prose stored. */
+export declare const ABUSE_REPORT_MAX_DETAILS = 5000;
+/** Maximum length of the reported URL. */
+export declare const ABUSE_REPORT_MAX_URL = 2048;
+/** Maximum length of a reporter's email/name. */
+export declare const ABUSE_REPORT_MAX_CONTACT = 254;
+export type AbuseReportSeverity = 'urgent' | 'high' | 'normal';
+export interface AbuseReportCategoryDefinition {
+    /** Stored discriminator. */
+    id: string;
+    /** What the reporter sees. */
+    label: string;
+    /** One line of help under the label. */
+    hint: string;
+    /**
+     * How fast a human must look. `urgent` categories are the ones where the
+     * cost of a slow response is borne by someone who is not our customer.
+     */
+    severity: AbuseReportSeverity;
+}
+/**
+ * The reportable categories.
+ *
+ * Ordered by how much damage an hour of delay does, because the order is what
+ * a panicking reporter actually reads. Phishing and CSAM lead: both have a
+ * victim who is not our customer, and both are the categories whose
+ * unanswered report becomes a `*.aglyn.app` domain block.
+ *
+ * `csam` is `urgent` and is deliberately NOT given a self-service lever
+ * anywhere in the product — it is a report-to-NCMEC-and-preserve obligation,
+ * not a takedown button, and the runbook says so.
+ *
+ * ## The `csam` hint says nothing about authorities (AGL-2045)
+ *
+ * It used to read *"Reported to the authorities and handled outside the normal
+ * queue."* The second clause was true — `urgent` really does jump the queue and
+ * fire a staff notification. The first was not: there is no CyberTipline
+ * submission path, no report generation, no preservation handling and no
+ * runbook step behind it, as `staff-console/abuse-reports.md` concedes in its
+ * own limits list.
+ *
+ * That is worse than simply lacking the mechanism, because the sentence is
+ * load-bearing on somebody else's decision. A person who has just found this
+ * material and reads that it has been "reported to the authorities" may
+ * reasonably stop there — so the claim can *replace* a real CyberTipline
+ * report rather than supplement one. It also ships to every self-hoster, each
+ * of whom makes the same promise on their own public form with even less
+ * behind it, and it sits opposite a live statutory duty (18 U.S.C. §2258A)
+ * that attaches to the provider on actual knowledge.
+ *
+ * So the hint now describes only the handling — which is real and is the same
+ * on every deployment — and sends the reporter to NCMEC themselves. Naming the
+ * CyberTipline is not a promise about the operator; it is the one instruction
+ * that survives being read by somebody who then closes the tab.
+ *
+ * Whether Aglyn should *build* the mechanism and make an authorities claim
+ * true is open on AGL-2045. If it is ever built, the claim must
+ * render from its own explicit configuration — never inferred — exactly as
+ * AGL-2016 gated the DMCA designation.
+ */
+export declare const ABUSE_REPORT_CATEGORIES: readonly AbuseReportCategoryDefinition[];
+/** Look a category up, or `null` for an unrecognised id. */
+export declare function abuseReportCategory(id: unknown): AbuseReportCategoryDefinition | null;
+/** The workflow states a report moves through. */
+export declare const ABUSE_REPORT_STATUSES: readonly ["open", "reviewing", "actioned", "dismissed"];
+export type AbuseReportStatus = (typeof ABUSE_REPORT_STATUSES)[number];
+export declare function isAbuseReportStatus(value: unknown): value is AbuseReportStatus;
+/** What a reporter submitted, after validation. */
+export interface AbuseReportInput {
+    category: string;
+    severity: AbuseReportSeverity;
+    /** The reported page, normalized to an absolute http(s) URL. */
+    url: string;
+    /** Host id resolved from `url`, when it resolves to one. */
+    reportedHostname: string;
+    details: string;
+    reporterEmail: string | null;
+    reporterName: string | null;
+    /** DMCA-only, all four required together. See {@link validateAbuseReport}. */
+    dmca: AbuseReportDmcaAffirmations | null;
+}
+/**
+ * The statutory shape of a DMCA notice.
+ *
+ * 17 U.S.C. §512(c)(3) requires a takedown notice to carry, among other
+ * things, an identification of the work, a good-faith statement, a statement
+ * under penalty of perjury that the reporter is authorised, and a physical or
+ * electronic signature. Collecting them as free text next to a tick-box is
+ * the ordinary web form of that.
+ *
+ * Two consequences the form has to honour, and does:
+ *
+ *  - **A DMCA notice needs a real identity.** The other categories accept an
+ *    anonymous report because a phishing site is phishing whoever reports it;
+ *    a copyright claim is a legal assertion by a named party, so
+ *    `reporterEmail` and `signature` are REQUIRED for `dmca` and optional for
+ *    everything else. That is why the anonymity rule is per-category and not
+ *    global.
+ *  - **We must not pretend to adjudicate.** Nothing here decides whether the
+ *    claim is good. It records what was asserted, under whose name, at what
+ *    time, which is exactly what the safe harbour asks a service provider to
+ *    keep.
+ */
+export interface AbuseReportDmcaAffirmations {
+    /** Identification of the copyrighted work being infringed. */
+    work: string;
+    /** Typed name standing as the electronic signature. */
+    signature: string;
+    /** "I have a good faith belief the use is not authorised." */
+    goodFaith: boolean;
+    /** "Under penalty of perjury, I am authorised to act for the owner." */
+    underPenalty: boolean;
+}
+export interface AbuseReportValidationFailure {
+    ok: false;
+    /** Stable machine code, for tests and for the form to highlight a field. */
+    code: string;
+    /** Sentence shown to the reporter. Never blames them for our shape. */
+    message: string;
+}
+export interface AbuseReportValidationSuccess {
+    ok: true;
+    value: AbuseReportInput;
+}
+export type AbuseReportValidation = AbuseReportValidationSuccess | AbuseReportValidationFailure;
+/**
+ * Normalize a reported URL.
+ *
+ * Returns `null` for anything that is not an absolute http(s) URL. The scheme
+ * allow-list is the point: a report is rendered in a staff console, and a
+ * `javascript:` or `data:` "URL" stored here would be a stored-XSS delivery
+ * mechanism aimed at the one browser session that can suspend any site on the
+ * platform. Refusing at the boundary is cheaper than trusting every renderer.
+ */
+export declare function normalizeReportedUrl(value: unknown): string | null;
+/** The hostname of a normalized URL, lowercased, or `''`. */
+export declare function reportedHostname(url: string): string;
+/**
+ * Validate and normalize a submitted report.
+ *
+ * Accepts the shape of BOTH a JSON body and a urlencoded no-JS form post, so
+ * the caller can hand it either without a translation step.
+ *
+ * The bar for a valid report is deliberately low — a URL, a category and a
+ * sentence — because every field added is a reporter lost, and the whole
+ * point of AGL-1964 is that the report arrives at all. DMCA is the one
+ * exception, and only because the statute sets the shape rather than us.
+ */
+export declare function validateAbuseReport(payload: Record<string, unknown>): AbuseReportValidation;
+export default validateAbuseReport;

package/src/lib/app-utils/abuse-report.js

@@ -0,0 +1,321 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * ABUSE REPORT INTAKE (AGL-1964) — the missing input to a mature response
+ * system.
+ *
+ * Aglyn's takedown tooling is good: five lockdown scopes with a staff UI, 38
+ * `lockdownRefusal()` sites, media quarantine by content digest, an audit
+ * trail, read-only mode. Every one of those is a lever an operator pulls
+ * AFTER learning there is a problem. Nothing anywhere let an outsider tell us
+ * there was one — no report route, no form, no affordance on a published
+ * site.
+ *
+ * ## Why that is the launch risk rather than a nicety
+ *
+ * From Sept 1 anyone can sign up and have arbitrary content live on
+ * `{sub}.aglyn.app` within minutes. When one of those is used for phishing,
+ * the finder is a bank's fraud team, a browser vendor, or Safe Browsing —
+ * none of whom are customers, none of whom can open a support ticket (that
+ * route is 401 + paid-plan gated), and all of whom have a next step if they
+ * cannot reach us: a **domain-level block on `*.aglyn.app`**, which takes
+ * every legitimate customer site down with it. The cheapest possible
+ * mitigation is a reachable form. This is that form's shared core.
+ *
+ * ## The intake is a QUEUE, not an email address, and that is deliberate
+ *
+ * The published Acceptable Use Policy names `abuse@aglyn.com`, and the
+ * Copyright/DMCA Policy names `dmca@aglyn.com`. AGL-1973 records that neither
+ * mailbox is confirmed to exist — the Drive open-items list has only
+ * `noreply@` and `info@` live — and AGL-1577 records that Gmail default
+ * routing **accepts mail for non-existent @aglyn.com addresses with bounce
+ * suppression on and no delivery recipient configured**. Those two facts
+ * together mean a report sent to `abuse@` may be accepted and silently
+ * discarded, with the reporter believing they told us.
+ *
+ * A published address that drops mail is worse than publishing none, because
+ * it converts a reachable problem into an invisible one. So the primary
+ * intake writes a Firestore document a staff surface reads, where delivery is
+ * a database write we control rather than a routing rule we have not read.
+ * The form is the thing to publish; the mailbox is a nice-to-have once
+ * AGL-1973 confirms it.
+ *
+ * ## Categories carry the response, not just a label
+ *
+ * {@link ABUSE_REPORT_CATEGORIES} maps onto the levers that already exist:
+ * every category's `severity` says how fast a human must look, and `dmca`
+ * alone opens the statutory fields. The reason codes deliberately reuse the
+ * media-quarantine vocabulary (`abuse`, `dmca`, `malware`) so a report can be
+ * actioned into a quarantine or a lockdown without a translation table.
+ */ import { operatorContactLine } from "./operator-identity.js";
+/** Firestore collection holding intake rows. Staff-read, Admin-SDK-written. */ export const ABUSE_REPORT_COLLECTION = 'abuseReports';
+/**
+ * The contact address printed on the form — the OPERATOR's, resolved from
+ * configuration (AGL-2016).
+ *
+ * This was `export const ABUSE_REPORT_CONTACT_EMAIL = 'support@aglyn.com'`,
+ * and the docblock justifying it called itself *"the single place to change"*.
+ * It was the single place to change for **Aglyn**; for every other deployment
+ * it was the single place a third party's DMCA notice got misaddressed to us.
+ * The form it renders on is public and unauthenticated and ships with every
+ * install, so the literal made a self-hoster publish an intake pointing at a
+ * desk that cannot see, let alone remove, the content being reported.
+ *
+ * The original reasoning is preserved because it still governs **Aglyn's**
+ * configured value: `support@` and NOT `abuse@`, because AGL-1973 records
+ * that `abuse@aglyn.com` is not confirmed to deliver and AGL-1577 records
+ * that Gmail default routing accepts mail for non-existent `@aglyn.com`
+ * addresses with bounce suppression on. A published address that silently
+ * drops mail is worse than publishing none. That is now a statement about
+ * what we put in `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, not about what the
+ * software hardcodes.
+ *
+ * DMCA notices prefer the legal mailbox when the operator has configured a
+ * separate one; see {@link operatorContactLine}.
+ */ export function abuseReportContactEmail(kind = 'support') {
+    return operatorContactLine(kind).address;
+}
+/** Maximum characters of reporter prose stored. */ export const ABUSE_REPORT_MAX_DETAILS = 5000;
+/** Maximum length of the reported URL. */ export const ABUSE_REPORT_MAX_URL = 2048;
+/** Maximum length of a reporter's email/name. */ export const ABUSE_REPORT_MAX_CONTACT = 254;
+/**
+ * The reportable categories.
+ *
+ * Ordered by how much damage an hour of delay does, because the order is what
+ * a panicking reporter actually reads. Phishing and CSAM lead: both have a
+ * victim who is not our customer, and both are the categories whose
+ * unanswered report becomes a `*.aglyn.app` domain block.
+ *
+ * `csam` is `urgent` and is deliberately NOT given a self-service lever
+ * anywhere in the product — it is a report-to-NCMEC-and-preserve obligation,
+ * not a takedown button, and the runbook says so.
+ *
+ * ## The `csam` hint says nothing about authorities (AGL-2045)
+ *
+ * It used to read *"Reported to the authorities and handled outside the normal
+ * queue."* The second clause was true — `urgent` really does jump the queue and
+ * fire a staff notification. The first was not: there is no CyberTipline
+ * submission path, no report generation, no preservation handling and no
+ * runbook step behind it, as `staff-console/abuse-reports.md` concedes in its
+ * own limits list.
+ *
+ * That is worse than simply lacking the mechanism, because the sentence is
+ * load-bearing on somebody else's decision. A person who has just found this
+ * material and reads that it has been "reported to the authorities" may
+ * reasonably stop there — so the claim can *replace* a real CyberTipline
+ * report rather than supplement one. It also ships to every self-hoster, each
+ * of whom makes the same promise on their own public form with even less
+ * behind it, and it sits opposite a live statutory duty (18 U.S.C. §2258A)
+ * that attaches to the provider on actual knowledge.
+ *
+ * So the hint now describes only the handling — which is real and is the same
+ * on every deployment — and sends the reporter to NCMEC themselves. Naming the
+ * CyberTipline is not a promise about the operator; it is the one instruction
+ * that survives being read by somebody who then closes the tab.
+ *
+ * Whether Aglyn should *build* the mechanism and make an authorities claim
+ * true is open on AGL-2045. If it is ever built, the claim must
+ * render from its own explicit configuration — never inferred — exactly as
+ * AGL-2016 gated the DMCA designation.
+ */ export const ABUSE_REPORT_CATEGORIES = [
+    {
+        id: 'phishing',
+        label: 'Phishing or fraud',
+        hint: 'A page impersonating another business to steal logins, card numbers or personal details.',
+        severity: 'urgent'
+    },
+    {
+        id: 'csam',
+        label: 'Child sexual abuse material',
+        hint: 'Handled outside the normal queue and escalated to the operator immediately. Please also report it directly to NCMEC at report.cybertip.org — do not rely on this form alone.',
+        severity: 'urgent'
+    },
+    {
+        id: 'malware',
+        label: 'Malware or harmful downloads',
+        hint: 'A file or script that infects or attacks the visitor.',
+        severity: 'urgent'
+    },
+    {
+        id: 'dmca',
+        label: 'Copyright infringement (DMCA)',
+        hint: 'Your copyrighted work is published without permission. Needs the statutory statements below.',
+        severity: 'high'
+    },
+    {
+        id: 'impersonation',
+        label: 'Impersonation or trademark',
+        hint: 'The site pretends to be you, your business, or uses your mark.',
+        severity: 'high'
+    },
+    {
+        id: 'illegal',
+        label: 'Other illegal content',
+        hint: 'Content unlawful where it is published.',
+        severity: 'high'
+    },
+    {
+        id: 'spam',
+        label: 'Spam or deceptive content',
+        hint: 'Bulk junk, SEO doorways, or content unrelated to a real business.',
+        severity: 'normal'
+    },
+    {
+        id: 'other',
+        label: 'Something else',
+        hint: 'Anything that breaks the Acceptable Use Policy.',
+        severity: 'normal'
+    }
+];
+const CATEGORY_BY_ID = new Map(ABUSE_REPORT_CATEGORIES.map((entry)=>[
+        entry.id,
+        entry
+    ]));
+/** Look a category up, or `null` for an unrecognised id. */ export function abuseReportCategory(id) {
+    var _CATEGORY_BY_ID_get;
+    return typeof id === 'string' ? (_CATEGORY_BY_ID_get = CATEGORY_BY_ID.get(id)) != null ? _CATEGORY_BY_ID_get : null : null;
+}
+/** The workflow states a report moves through. */ export const ABUSE_REPORT_STATUSES = [
+    'open',
+    'reviewing',
+    'actioned',
+    'dismissed'
+];
+export function isAbuseReportStatus(value) {
+    return typeof value === 'string' && ABUSE_REPORT_STATUSES.includes(value);
+}
+const fail = (code, message)=>({
+        ok: false,
+        code,
+        message
+    });
+const text = (value, max)=>typeof value === 'string' ? value.trim().slice(0, max) : '';
+/**
+ * Is this a truthy checkbox value?
+ *
+ * A no-JavaScript HTML form sends `on` for a ticked box and sends the field
+ * NOT AT ALL when unticked; a JSON client sends `true`. Both have to mean the
+ * same thing or the statutory affirmations would depend on how the reporter's
+ * browser is configured — and the failure would be silent, refusing valid
+ * notices from the people least likely to have JS on.
+ */ const checked = (value)=>value === true || value === 'on' || value === 'true' || value === '1' || value === 'yes';
+/**
+ * Normalize a reported URL.
+ *
+ * Returns `null` for anything that is not an absolute http(s) URL. The scheme
+ * allow-list is the point: a report is rendered in a staff console, and a
+ * `javascript:` or `data:` "URL" stored here would be a stored-XSS delivery
+ * mechanism aimed at the one browser session that can suspend any site on the
+ * platform. Refusing at the boundary is cheaper than trusting every renderer.
+ */ export function normalizeReportedUrl(value) {
+    const raw = text(value, ABUSE_REPORT_MAX_URL);
+    if (!raw) return null;
+    // A reporter pasting a bare hostname is the common case; assume https
+    // rather than refusing them for a missing scheme.
+    const candidate = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(raw) ? raw : `https://${raw}`;
+    let parsed;
+    try {
+        parsed = new URL(candidate);
+    } catch (unused) {
+        return null;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null;
+    if (!parsed.hostname) return null;
+    return parsed.toString().slice(0, ABUSE_REPORT_MAX_URL);
+}
+/** The hostname of a normalized URL, lowercased, or `''`. */ export function reportedHostname(url) {
+    try {
+        return new URL(url).hostname.toLowerCase();
+    } catch (unused) {
+        return '';
+    }
+}
+/**
+ * Validate and normalize a submitted report.
+ *
+ * Accepts the shape of BOTH a JSON body and a urlencoded no-JS form post, so
+ * the caller can hand it either without a translation step.
+ *
+ * The bar for a valid report is deliberately low — a URL, a category and a
+ * sentence — because every field added is a reporter lost, and the whole
+ * point of AGL-1964 is that the report arrives at all. DMCA is the one
+ * exception, and only because the statute sets the shape rather than us.
+ */ export function validateAbuseReport(payload) {
+    const category = abuseReportCategory(payload['category']);
+    if (!category) {
+        return fail('category', 'Choose what kind of problem you are reporting.');
+    }
+    const url = normalizeReportedUrl(payload['url']);
+    if (!url) {
+        return fail('url', 'Enter the full web address of the page you are reporting, starting with https://.');
+    }
+    const details = text(payload['details'], ABUSE_REPORT_MAX_DETAILS);
+    if (details.length < 10) {
+        return fail('details', 'Tell us briefly what is wrong with the page — at least a sentence.');
+    }
+    const reporterEmail = text(payload['reporterEmail'], ABUSE_REPORT_MAX_CONTACT);
+    const reporterName = text(payload['reporterName'], ABUSE_REPORT_MAX_CONTACT);
+    // Shape only. Deliverability is not ours to assert, and a stricter pattern
+    // would reject valid addresses to buy nothing.
+    if (reporterEmail && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(reporterEmail)) {
+        return fail('reporterEmail', 'That email address does not look right.');
+    }
+    let dmca = null;
+    if (category.id === 'dmca') {
+        const work = text(payload['dmcaWork'], ABUSE_REPORT_MAX_DETAILS);
+        const signature = text(payload['dmcaSignature'], ABUSE_REPORT_MAX_CONTACT);
+        if (!work) {
+            return fail('dmcaWork', 'Identify the copyrighted work you say is being infringed.');
+        }
+        if (!signature) {
+            return fail('dmcaSignature', 'Type your full legal name — it stands as your electronic signature.');
+        }
+        if (!checked(payload['dmcaGoodFaith'])) {
+            return fail('dmcaGoodFaith', 'A copyright notice needs the good-faith statement.');
+        }
+        if (!checked(payload['dmcaUnderPenalty'])) {
+            return fail('dmcaUnderPenalty', 'A copyright notice needs the statement made under penalty of perjury.');
+        }
+        // A DMCA notice is a legal assertion by a named party, so unlike every
+        // other category it cannot be anonymous — we have to be able to forward
+        // it to the site owner and to accept a counter-notice.
+        if (!reporterEmail) {
+            return fail('reporterEmail', 'A copyright notice needs an email address we can reply to.');
+        }
+        dmca = {
+            work,
+            signature,
+            goodFaith: true,
+            underPenalty: true
+        };
+    }
+    return {
+        ok: true,
+        value: {
+            category: category.id,
+            severity: category.severity,
+            url,
+            reportedHostname: reportedHostname(url),
+            details,
+            reporterEmail: reporterEmail || null,
+            reporterName: reporterName || null,
+            dmca
+        }
+    };
+}
+export default validateAbuseReport;
+
+//# sourceMappingURL=abuse-report.js.map

package/src/lib/app-utils/abuse-report.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/abuse-report.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * ABUSE REPORT INTAKE (AGL-1964) — the missing input to a mature response\n * system.\n *\n * Aglyn's takedown tooling is good: five lockdown scopes with a staff UI, 38\n * `lockdownRefusal()` sites, media quarantine by content digest, an audit\n * trail, read-only mode. Every one of those is a lever an operator pulls\n * AFTER learning there is a problem. Nothing anywhere let an outsider tell us\n * there was one — no report route, no form, no affordance on a published\n * site.\n *\n * ## Why that is the launch risk rather than a nicety\n *\n * From Sept 1 anyone can sign up and have arbitrary content live on\n * `{sub}.aglyn.app` within minutes. When one of those is used for phishing,\n * the finder is a bank's fraud team, a browser vendor, or Safe Browsing —\n * none of whom are customers, none of whom can open a support ticket (that\n * route is 401 + paid-plan gated), and all of whom have a next step if they\n * cannot reach us: a **domain-level block on `*.aglyn.app`**, which takes\n * every legitimate customer site down with it. The cheapest possible\n * mitigation is a reachable form. This is that form's shared core.\n *\n * ## The intake is a QUEUE, not an email address, and that is deliberate\n *\n * The published Acceptable Use Policy names `abuse@aglyn.com`, and the\n * Copyright/DMCA Policy names `dmca@aglyn.com`. AGL-1973 records that neither\n * mailbox is confirmed to exist — the Drive open-items list has only\n * `noreply@` and `info@` live — and AGL-1577 records that Gmail default\n * routing **accepts mail for non-existent @aglyn.com addresses with bounce\n * suppression on and no delivery recipient configured**. Those two facts\n * together mean a report sent to `abuse@` may be accepted and silently\n * discarded, with the reporter believing they told us.\n *\n * A published address that drops mail is worse than publishing none, because\n * it converts a reachable problem into an invisible one. So the primary\n * intake writes a Firestore document a staff surface reads, where delivery is\n * a database write we control rather than a routing rule we have not read.\n * The form is the thing to publish; the mailbox is a nice-to-have once\n * AGL-1973 confirms it.\n *\n * ## Categories carry the response, not just a label\n *\n * {@link ABUSE_REPORT_CATEGORIES} maps onto the levers that already exist:\n * every category's `severity` says how fast a human must look, and `dmca`\n * alone opens the statutory fields. The reason codes deliberately reuse the\n * media-quarantine vocabulary (`abuse`, `dmca`, `malware`) so a report can be\n * actioned into a quarantine or a lockdown without a translation table.\n */\n\nimport { operatorContactLine } from './operator-identity'\n\n/** Firestore collection holding intake rows. Staff-read, Admin-SDK-written. */\nexport const ABUSE_REPORT_COLLECTION = 'abuseReports'\n\n/**\n * The contact address printed on the form — the OPERATOR's, resolved from\n * configuration (AGL-2016).\n *\n * This was `export const ABUSE_REPORT_CONTACT_EMAIL = 'support@aglyn.com'`,\n * and the docblock justifying it called itself *\"the single place to change\"*.\n * It was the single place to change for **Aglyn**; for every other deployment\n * it was the single place a third party's DMCA notice got misaddressed to us.\n * The form it renders on is public and unauthenticated and ships with every\n * install, so the literal made a self-hoster publish an intake pointing at a\n * desk that cannot see, let alone remove, the content being reported.\n *\n * The original reasoning is preserved because it still governs **Aglyn's**\n * configured value: `support@` and NOT `abuse@`, because AGL-1973 records\n * that `abuse@aglyn.com` is not confirmed to deliver and AGL-1577 records\n * that Gmail default routing accepts mail for non-existent `@aglyn.com`\n * addresses with bounce suppression on. A published address that silently\n * drops mail is worse than publishing none. That is now a statement about\n * what we put in `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, not about what the\n * software hardcodes.\n *\n * DMCA notices prefer the legal mailbox when the operator has configured a\n * separate one; see {@link operatorContactLine}.\n */\nexport function abuseReportContactEmail(\n  kind: 'support' | 'legal' = 'support',\n): string | null {\n  return operatorContactLine(kind).address\n}\n\n/** Maximum characters of reporter prose stored. */\nexport const ABUSE_REPORT_MAX_DETAILS = 5000\n/** Maximum length of the reported URL. */\nexport const ABUSE_REPORT_MAX_URL = 2048\n/** Maximum length of a reporter's email/name. */\nexport const ABUSE_REPORT_MAX_CONTACT = 254\n\nexport type AbuseReportSeverity = 'urgent' | 'high' | 'normal'\n\nexport interface AbuseReportCategoryDefinition {\n  /** Stored discriminator. */\n  id: string\n  /** What the reporter sees. */\n  label: string\n  /** One line of help under the label. */\n  hint: string\n  /**\n   * How fast a human must look. `urgent` categories are the ones where the\n   * cost of a slow response is borne by someone who is not our customer.\n   */\n  severity: AbuseReportSeverity\n}\n\n/**\n * The reportable categories.\n *\n * Ordered by how much damage an hour of delay does, because the order is what\n * a panicking reporter actually reads. Phishing and CSAM lead: both have a\n * victim who is not our customer, and both are the categories whose\n * unanswered report becomes a `*.aglyn.app` domain block.\n *\n * `csam` is `urgent` and is deliberately NOT given a self-service lever\n * anywhere in the product — it is a report-to-NCMEC-and-preserve obligation,\n * not a takedown button, and the runbook says so.\n *\n * ## The `csam` hint says nothing about authorities (AGL-2045)\n *\n * It used to read *\"Reported to the authorities and handled outside the normal\n * queue.\"* The second clause was true — `urgent` really does jump the queue and\n * fire a staff notification. The first was not: there is no CyberTipline\n * submission path, no report generation, no preservation handling and no\n * runbook step behind it, as `staff-console/abuse-reports.md` concedes in its\n * own limits list.\n *\n * That is worse than simply lacking the mechanism, because the sentence is\n * load-bearing on somebody else's decision. A person who has just found this\n * material and reads that it has been \"reported to the authorities\" may\n * reasonably stop there — so the claim can *replace* a real CyberTipline\n * report rather than supplement one. It also ships to every self-hoster, each\n * of whom makes the same promise on their own public form with even less\n * behind it, and it sits opposite a live statutory duty (18 U.S.C. §2258A)\n * that attaches to the provider on actual knowledge.\n *\n * So the hint now describes only the handling — which is real and is the same\n * on every deployment — and sends the reporter to NCMEC themselves. Naming the\n * CyberTipline is not a promise about the operator; it is the one instruction\n * that survives being read by somebody who then closes the tab.\n *\n * Whether Aglyn should *build* the mechanism and make an authorities claim\n * true is open on AGL-2045. If it is ever built, the claim must\n * render from its own explicit configuration — never inferred — exactly as\n * AGL-2016 gated the DMCA designation.\n */\nexport const ABUSE_REPORT_CATEGORIES: readonly AbuseReportCategoryDefinition[] =\n  [\n    {\n      id: 'phishing',\n      label: 'Phishing or fraud',\n      hint: 'A page impersonating another business to steal logins, card numbers or personal details.',\n      severity: 'urgent',\n    },\n    {\n      id: 'csam',\n      label: 'Child sexual abuse material',\n      hint: 'Handled outside the normal queue and escalated to the operator immediately. Please also report it directly to NCMEC at report.cybertip.org — do not rely on this form alone.',\n      severity: 'urgent',\n    },\n    {\n      id: 'malware',\n      label: 'Malware or harmful downloads',\n      hint: 'A file or script that infects or attacks the visitor.',\n      severity: 'urgent',\n    },\n    {\n      id: 'dmca',\n      label: 'Copyright infringement (DMCA)',\n      hint: 'Your copyrighted work is published without permission. Needs the statutory statements below.',\n      severity: 'high',\n    },\n    {\n      id: 'impersonation',\n      label: 'Impersonation or trademark',\n      hint: 'The site pretends to be you, your business, or uses your mark.',\n      severity: 'high',\n    },\n    {\n      id: 'illegal',\n      label: 'Other illegal content',\n      hint: 'Content unlawful where it is published.',\n      severity: 'high',\n    },\n    {\n      id: 'spam',\n      label: 'Spam or deceptive content',\n      hint: 'Bulk junk, SEO doorways, or content unrelated to a real business.',\n      severity: 'normal',\n    },\n    {\n      id: 'other',\n      label: 'Something else',\n      hint: 'Anything that breaks the Acceptable Use Policy.',\n      severity: 'normal',\n    },\n  ]\n\nconst CATEGORY_BY_ID = new Map(\n  ABUSE_REPORT_CATEGORIES.map((entry) => [entry.id, entry]),\n)\n\n/** Look a category up, or `null` for an unrecognised id. */\nexport function abuseReportCategory(\n  id: unknown,\n): AbuseReportCategoryDefinition | null {\n  return typeof id === 'string' ? (CATEGORY_BY_ID.get(id) ?? null) : null\n}\n\n/** The workflow states a report moves through. */\nexport const ABUSE_REPORT_STATUSES = [\n  'open',\n  'reviewing',\n  'actioned',\n  'dismissed',\n] as const\nexport type AbuseReportStatus = (typeof ABUSE_REPORT_STATUSES)[number]\n\nexport function isAbuseReportStatus(value: unknown): value is AbuseReportStatus {\n  return (\n    typeof value === 'string' &&\n    (ABUSE_REPORT_STATUSES as readonly string[]).includes(value)\n  )\n}\n\n/** What a reporter submitted, after validation. */\nexport interface AbuseReportInput {\n  category: string\n  severity: AbuseReportSeverity\n  /** The reported page, normalized to an absolute http(s) URL. */\n  url: string\n  /** Host id resolved from `url`, when it resolves to one. */\n  reportedHostname: string\n  details: string\n  reporterEmail: string | null\n  reporterName: string | null\n  /** DMCA-only, all four required together. See {@link validateAbuseReport}. */\n  dmca: AbuseReportDmcaAffirmations | null\n}\n\n/**\n * The statutory shape of a DMCA notice.\n *\n * 17 U.S.C. §512(c)(3) requires a takedown notice to carry, among other\n * things, an identification of the work, a good-faith statement, a statement\n * under penalty of perjury that the reporter is authorised, and a physical or\n * electronic signature. Collecting them as free text next to a tick-box is\n * the ordinary web form of that.\n *\n * Two consequences the form has to honour, and does:\n *\n *  - **A DMCA notice needs a real identity.** The other categories accept an\n *    anonymous report because a phishing site is phishing whoever reports it;\n *    a copyright claim is a legal assertion by a named party, so\n *    `reporterEmail` and `signature` are REQUIRED for `dmca` and optional for\n *    everything else. That is why the anonymity rule is per-category and not\n *    global.\n *  - **We must not pretend to adjudicate.** Nothing here decides whether the\n *    claim is good. It records what was asserted, under whose name, at what\n *    time, which is exactly what the safe harbour asks a service provider to\n *    keep.\n */\nexport interface AbuseReportDmcaAffirmations {\n  /** Identification of the copyrighted work being infringed. */\n  work: string\n  /** Typed name standing as the electronic signature. */\n  signature: string\n  /** \"I have a good faith belief the use is not authorised.\" */\n  goodFaith: boolean\n  /** \"Under penalty of perjury, I am authorised to act for the owner.\" */\n  underPenalty: boolean\n}\n\nexport interface AbuseReportValidationFailure {\n  ok: false\n  /** Stable machine code, for tests and for the form to highlight a field. */\n  code: string\n  /** Sentence shown to the reporter. Never blames them for our shape. */\n  message: string\n}\n\nexport interface AbuseReportValidationSuccess {\n  ok: true\n  value: AbuseReportInput\n}\n\nexport type AbuseReportValidation =\n  | AbuseReportValidationSuccess\n  | AbuseReportValidationFailure\n\nconst fail = (code: string, message: string): AbuseReportValidationFailure => ({\n  ok: false,\n  code,\n  message,\n})\n\nconst text = (value: unknown, max: number): string =>\n  typeof value === 'string' ? value.trim().slice(0, max) : ''\n\n/**\n * Is this a truthy checkbox value?\n *\n * A no-JavaScript HTML form sends `on` for a ticked box and sends the field\n * NOT AT ALL when unticked; a JSON client sends `true`. Both have to mean the\n * same thing or the statutory affirmations would depend on how the reporter's\n * browser is configured — and the failure would be silent, refusing valid\n * notices from the people least likely to have JS on.\n */\nconst checked = (value: unknown): boolean =>\n  value === true ||\n  value === 'on' ||\n  value === 'true' ||\n  value === '1' ||\n  value === 'yes'\n\n/**\n * Normalize a reported URL.\n *\n * Returns `null` for anything that is not an absolute http(s) URL. The scheme\n * allow-list is the point: a report is rendered in a staff console, and a\n * `javascript:` or `data:` \"URL\" stored here would be a stored-XSS delivery\n * mechanism aimed at the one browser session that can suspend any site on the\n * platform. Refusing at the boundary is cheaper than trusting every renderer.\n */\nexport function normalizeReportedUrl(value: unknown): string | null {\n  const raw = text(value, ABUSE_REPORT_MAX_URL)\n  if (!raw) return null\n  // A reporter pasting a bare hostname is the common case; assume https\n  // rather than refusing them for a missing scheme.\n  const candidate = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(raw) ? raw : `https://${raw}`\n  let parsed: URL\n  try {\n    parsed = new URL(candidate)\n  } catch {\n    return null\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null\n  if (!parsed.hostname) return null\n  return parsed.toString().slice(0, ABUSE_REPORT_MAX_URL)\n}\n\n/** The hostname of a normalized URL, lowercased, or `''`. */\nexport function reportedHostname(url: string): string {\n  try {\n    return new URL(url).hostname.toLowerCase()\n  } catch {\n    return ''\n  }\n}\n\n/**\n * Validate and normalize a submitted report.\n *\n * Accepts the shape of BOTH a JSON body and a urlencoded no-JS form post, so\n * the caller can hand it either without a translation step.\n *\n * The bar for a valid report is deliberately low — a URL, a category and a\n * sentence — because every field added is a reporter lost, and the whole\n * point of AGL-1964 is that the report arrives at all. DMCA is the one\n * exception, and only because the statute sets the shape rather than us.\n */\nexport function validateAbuseReport(\n  payload: Record<string, unknown>,\n): AbuseReportValidation {\n  const category = abuseReportCategory(payload['category'])\n  if (!category) {\n    return fail('category', 'Choose what kind of problem you are reporting.')\n  }\n\n  const url = normalizeReportedUrl(payload['url'])\n  if (!url) {\n    return fail(\n      'url',\n      'Enter the full web address of the page you are reporting, starting with https://.',\n    )\n  }\n\n  const details = text(payload['details'], ABUSE_REPORT_MAX_DETAILS)\n  if (details.length < 10) {\n    return fail(\n      'details',\n      'Tell us briefly what is wrong with the page — at least a sentence.',\n    )\n  }\n\n  const reporterEmail = text(payload['reporterEmail'], ABUSE_REPORT_MAX_CONTACT)\n  const reporterName = text(payload['reporterName'], ABUSE_REPORT_MAX_CONTACT)\n  // Shape only. Deliverability is not ours to assert, and a stricter pattern\n  // would reject valid addresses to buy nothing.\n  if (reporterEmail && !/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(reporterEmail)) {\n    return fail('reporterEmail', 'That email address does not look right.')\n  }\n\n  let dmca: AbuseReportDmcaAffirmations | null = null\n  if (category.id === 'dmca') {\n    const work = text(payload['dmcaWork'], ABUSE_REPORT_MAX_DETAILS)\n    const signature = text(payload['dmcaSignature'], ABUSE_REPORT_MAX_CONTACT)\n    if (!work) {\n      return fail(\n        'dmcaWork',\n        'Identify the copyrighted work you say is being infringed.',\n      )\n    }\n    if (!signature) {\n      return fail(\n        'dmcaSignature',\n        'Type your full legal name — it stands as your electronic signature.',\n      )\n    }\n    if (!checked(payload['dmcaGoodFaith'])) {\n      return fail(\n        'dmcaGoodFaith',\n        'A copyright notice needs the good-faith statement.',\n      )\n    }\n    if (!checked(payload['dmcaUnderPenalty'])) {\n      return fail(\n        'dmcaUnderPenalty',\n        'A copyright notice needs the statement made under penalty of perjury.',\n      )\n    }\n    // A DMCA notice is a legal assertion by a named party, so unlike every\n    // other category it cannot be anonymous — we have to be able to forward\n    // it to the site owner and to accept a counter-notice.\n    if (!reporterEmail) {\n      return fail(\n        'reporterEmail',\n        'A copyright notice needs an email address we can reply to.',\n      )\n    }\n    dmca = {\n      work,\n      signature,\n      goodFaith: true,\n      underPenalty: true,\n    }\n  }\n\n  return {\n    ok: true,\n    value: {\n      category: category.id,\n      severity: category.severity,\n      url,\n      reportedHostname: reportedHostname(url),\n      details,\n      reporterEmail: reporterEmail || null,\n      reporterName: reporterName || null,\n      dmca,\n    },\n  }\n}\n\nexport default validateAbuseReport\n"],"names":["operatorContactLine","ABUSE_REPORT_COLLECTION","abuseReportContactEmail","kind","address","ABUSE_REPORT_MAX_DETAILS","ABUSE_REPORT_MAX_URL","ABUSE_REPORT_MAX_CONTACT","ABUSE_REPORT_CATEGORIES","id","label","hint","severity","CATEGORY_BY_ID","Map","map","entry","abuseReportCategory","get","ABUSE_REPORT_STATUSES","isAbuseReportStatus","value","includes","fail","code","message","ok","text","max","trim","slice","checked","normalizeReportedUrl","raw","candidate","test","parsed","URL","protocol","hostname","toString","reportedHostname","url","toLowerCase","validateAbuseReport","payload","category","details","length","reporterEmail","reporterName","dmca","work","signature","goodFaith","underPenalty"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CC,GAED,SAASA,mBAAmB,QAAQ,yBAAqB;AAEzD,6EAA6E,GAC7E,OAAO,MAAMC,0BAA0B,eAAc;AAErD;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,SAASC,wBACdC,OAA4B,SAAS;IAErC,OAAOH,oBAAoBG,MAAMC,OAAO;AAC1C;AAEA,iDAAiD,GACjD,OAAO,MAAMC,2BAA2B,KAAI;AAC5C,wCAAwC,GACxC,OAAO,MAAMC,uBAAuB,KAAI;AACxC,+CAA+C,GAC/C,OAAO,MAAMC,2BAA2B,IAAG;AAkB3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GACD,OAAO,MAAMC,0BACX;IACE;QACEC,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;IACA;QACEH,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;IACA;QACEH,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;IACA;QACEH,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;IACA;QACEH,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;IACA;QACEH,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;IACA;QACEH,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;IACA;QACEH,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,UAAU;IACZ;CACD,CAAA;AAEH,MAAMC,iBAAiB,IAAIC,IACzBN,wBAAwBO,GAAG,CAAC,CAACC,QAAU;QAACA,MAAMP,EAAE;QAAEO;KAAM;AAG1D,0DAA0D,GAC1D,OAAO,SAASC,oBACdR,EAAW;QAEsBI;IAAjC,OAAO,OAAOJ,OAAO,YAAYI,sBAAAA,eAAeK,GAAG,CAACT,eAAnBI,sBAA0B,OAAQ;AACrE;AAEA,gDAAgD,GAChD,OAAO,MAAMM,wBAAwB;IACnC;IACA;IACA;IACA;CACD,CAAS;AAGV,OAAO,SAASC,oBAAoBC,KAAc;IAChD,OACE,OAAOA,UAAU,YACjB,AAACF,sBAA4CG,QAAQ,CAACD;AAE1D;AAmEA,MAAME,OAAO,CAACC,MAAcC,UAAmD,CAAA;QAC7EC,IAAI;QACJF;QACAC;IACF,CAAA;AAEA,MAAME,OAAO,CAACN,OAAgBO,MAC5B,OAAOP,UAAU,WAAWA,MAAMQ,IAAI,GAAGC,KAAK,CAAC,GAAGF,OAAO;AAE3D;;;;;;;;CAQC,GACD,MAAMG,UAAU,CAACV,QACfA,UAAU,QACVA,UAAU,QACVA,UAAU,UACVA,UAAU,OACVA,UAAU;AAEZ;;;;;;;;CAQC,GACD,OAAO,SAASW,qBAAqBX,KAAc;IACjD,MAAMY,MAAMN,KAAKN,OAAOf;IACxB,IAAI,CAAC2B,KAAK,OAAO;IACjB,sEAAsE;IACtE,kDAAkD;IAClD,MAAMC,YAAY,4BAA4BC,IAAI,CAACF,OAAOA,MAAM,CAAC,QAAQ,EAAEA,KAAK;IAChF,IAAIG;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIH;IACnB,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAIE,OAAOE,QAAQ,KAAK,WAAWF,OAAOE,QAAQ,KAAK,UAAU,OAAO;IACxE,IAAI,CAACF,OAAOG,QAAQ,EAAE,OAAO;IAC7B,OAAOH,OAAOI,QAAQ,GAAGV,KAAK,CAAC,GAAGxB;AACpC;AAEA,2DAA2D,GAC3D,OAAO,SAASmC,iBAAiBC,GAAW;IAC1C,IAAI;QACF,OAAO,IAAIL,IAAIK,KAAKH,QAAQ,CAACI,WAAW;IAC1C,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASC,oBACdC,OAAgC;IAEhC,MAAMC,WAAW7B,oBAAoB4B,OAAO,CAAC,WAAW;IACxD,IAAI,CAACC,UAAU;QACb,OAAOvB,KAAK,YAAY;IAC1B;IAEA,MAAMmB,MAAMV,qBAAqBa,OAAO,CAAC,MAAM;IAC/C,IAAI,CAACH,KAAK;QACR,OAAOnB,KACL,OACA;IAEJ;IAEA,MAAMwB,UAAUpB,KAAKkB,OAAO,CAAC,UAAU,EAAExC;IACzC,IAAI0C,QAAQC,MAAM,GAAG,IAAI;QACvB,OAAOzB,KACL,WACA;IAEJ;IAEA,MAAM0B,gBAAgBtB,KAAKkB,OAAO,CAAC,gBAAgB,EAAEtC;IACrD,MAAM2C,eAAevB,KAAKkB,OAAO,CAAC,eAAe,EAAEtC;IACnD,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI0C,iBAAiB,CAAC,6BAA6Bd,IAAI,CAACc,gBAAgB;QACtE,OAAO1B,KAAK,iBAAiB;IAC/B;IAEA,IAAI4B,OAA2C;IAC/C,IAAIL,SAASrC,EAAE,KAAK,QAAQ;QAC1B,MAAM2C,OAAOzB,KAAKkB,OAAO,CAAC,WAAW,EAAExC;QACvC,MAAMgD,YAAY1B,KAAKkB,OAAO,CAAC,gBAAgB,EAAEtC;QACjD,IAAI,CAAC6C,MAAM;YACT,OAAO7B,KACL,YACA;QAEJ;QACA,IAAI,CAAC8B,WAAW;YACd,OAAO9B,KACL,iBACA;QAEJ;QACA,IAAI,CAACQ,QAAQc,OAAO,CAAC,gBAAgB,GAAG;YACtC,OAAOtB,KACL,iBACA;QAEJ;QACA,IAAI,CAACQ,QAAQc,OAAO,CAAC,mBAAmB,GAAG;YACzC,OAAOtB,KACL,oBACA;QAEJ;QACA,uEAAuE;QACvE,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,CAAC0B,eAAe;YAClB,OAAO1B,KACL,iBACA;QAEJ;QACA4B,OAAO;YACLC;YACAC;YACAC,WAAW;YACXC,cAAc;QAChB;IACF;IAEA,OAAO;QACL7B,IAAI;QACJL,OAAO;YACLyB,UAAUA,SAASrC,EAAE;YACrBG,UAAUkC,SAASlC,QAAQ;YAC3B8B;YACAD,kBAAkBA,iBAAiBC;YACnCK;YACAE,eAAeA,iBAAiB;YAChCC,cAAcA,gBAAgB;YAC9BC;QACF;IACF;AACF;AAEA,eAAeP,oBAAmB"}