@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/visitor-record-ceiling.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/visitor-record-ceiling.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Flat platform ceilings on the two host subcollections an ANONYMOUS VISITOR\n * can create documents in (AGL-1529).\n *\n * ## What this is\n *\n * A platform-wide ceiling, and deliberately NOT a plan dimension — so\n * \"unlimited member accounts on every plan\" stays true, because an abuse\n * control is not something we sell. The same instrument is already in place\n * twice: AGL-1655 for forms and AGL-2155 for bandwidth.\n *\n * ## Why it is not a plan dimension, and must never become one\n *\n * AGL-889 decided member accounts are UNLIMITED on every plan as a PRICING\n * matter, and `/pricing` says so. A cap that varied by plan would make that\n * sentence false the moment it shipped. So there is no `OrgEntitlements` key\n * here, no `PLAN_ENTITLEMENTS` row, no band and nothing to re-price: every\n * plan, free through enterprise, gets the same number, and the number exists\n * only to answer the question `checkFormSubmissionAbuseCeiling`'s docblock\n * poses — *\"is this still a customer's traffic at all?\"* A plan gate asks\n * whether the customer bought this; this asks whether a customer is involved.\n *\n * ## The hole this closes\n *\n * `hosts/{hostId}/siteMembers` and `hosts/{hostId}/leads` were bounded by\n * NOTHING. Both are written on behalf of anonymous visitors on a public site\n * (`membershipRegisterHandler`, the two bookings lead paths), and the only\n * bound was `visitorWriteRateLimitRefusal` — keyed on (host, IP), fails soft,\n * and bounds the RATE rather than the TOTAL. That is verbatim the sentence\n * AGL-2265 used as its reason for adding the free-workspace ceiling, and the\n * shape AGL-2266 closed for `actions` and `entries`: unbounded Firestore\n * documents behind a $0 subscription.\n *\n * ## Why the shape here is the FLAT family, not the MULTIPLE family\n *\n * The two ceilings named as precedent — `FORM_ABUSE_CEILING_*` and\n * `BANDWIDTH_ABUSE_CEILING_*` — are both `max(floor, included × 10)`. They\n * can be, because forms and bandwidth each have an *included band* on the\n * price list to multiply. Members and leads have no included band by\n * construction (that is the whole point of AGL-889), so there is nothing to\n * multiply and a multiple would have to invent a plan dimension to have an\n * operand — the exact thing the decision forbids.\n *\n * The repo already has the family for that case, and those same docblocks\n * point at it: `WEBHOOK_MAX_PER_HOST` (AGL-1360), `NON_PAGE_SCREEN_MAX_PER_HOST`\n * (AGL-1399), `ACTIONS_MAX_PER_HOST` / `ENTRIES_MAX_PER_COLLECTION` (AGL-2266),\n * `AUTHORS_MAX_PER_HOST` (AGL-2486) — *\"a flat PLATFORM cap with no\n * `OrgEntitlements` key, no variation by plan, and nothing on the price list\n * to explain.\"* So the two named precedents supply the POSTURE (containment,\n * not capacity; a trip is an incident, not a quota; the refusal must be\n * visible to the host and opaque to the visitor) and the flat family supplies\n * the SHAPE. They do not disagree; they answer different halves.\n *\n * ## A TOTAL, not a monthly count — the one place the posture differs\n *\n * `FORM_ABUSE_CEILING` and `BANDWIDTH_ABUSE_CEILING` both count a month and\n * therefore self-clear at the month boundary with nobody doing anything. These\n * count LIVE DOCUMENTS, which do not. The refusal counters below are still\n * month-keyed — that is a rate of refusals, and it is what the owner's notice\n * reports — but the ceiling itself is cleared by deleting members or leads (or\n * by support raising it), and the owner's notice must not promise a date. A\n * notice that said \"accepting again on 1 September\" would be a promise the\n * platform does not keep.\n */\n\n/**\n * How many member accounts one site may hold (AGL-1529). the figure.\n *\n * Sized to the busiest plausible membership site rather than to today's data,\n * which is the only property a flat ceiling needs. A site member is a human\n * who chose a password on ONE site; 50,000 of them is a large membership\n * roster — larger than anything on the platform and larger than anything the\n * beta will produce — while a script wants millions and reaches this in an\n * afternoon. Every account past it is refused, none is billed, and none of\n * it changes what any plan includes.\n *\n * Counted as LIVE documents, so removing a member in the inbox frees the\n * slot. Counting tombstones would be AGL-1173's bug one collection over.\n */\nexport const SITE_MEMBERS_MAX_PER_HOST = 50_000\n\n/**\n * How many lead records one site may hold (AGL-1529).\n *\n * **Deliberately NOT the same number as {@link SITE_MEMBERS_MAX_PER_HOST}**,\n * and the reason changed when leads were deduped.\n *\n * A lead used to be APPEND-ONLY, keyed by nothing: every sign-up wrote one\n * and so did every booking, so one returning customer legitimately produced\n * many rows. 4× was sized to keep the MEMBER ceiling the binding one on the\n * path they share, rather than refusing a record on a site doing nothing\n * wrong. Since `docs/specs/reusable-forms.md` §4 a lead is one document per\n * person per host, keyed on `personKey`, so leads and members now count the\n * same population and that arithmetic no longer applies.\n *\n * **The number stays where it is.** Lowering it because the collection stopped\n * growing per event would convert a safety margin into a plan limit, which\n * `docs/DECISION_LOG.md` forbids — the 2026-08-23 entry made this ceiling a\n * flat platform abuse control precisely so \"unlimited leads on every plan\"\n * stays literally true. What the headroom now buys is a ceiling that is very\n * unlikely to trip at all, which is the right shape for a control that\n * refuses a person: 200,000 lead rows at ~200 bytes is ~40 MB, which is a\n * number, and unbounded is not.\n *\n * ⚠️ It must stay ABOVE {@link SITE_MEMBERS_MAX_PER_HOST}. A site member is\n * also a lead, so an equal or lower lead ceiling would refuse the side effect\n * of a sign-up the member ceiling had just allowed.\n */\nexport const LEADS_MAX_PER_HOST = 200_000\n\n/**\n * Refusal code carried by the sign-up 429 (AGL-1529).\n *\n * The dispatcher's per-(host, IP) rate limiter answers 429 too, so the STATUS\n * discriminates nothing — this code is the whole discriminator, and one means\n * \"slow down\" while the other means \"this site is not taking new accounts\".\n * Shared rather than restated so producer and consumer cannot drift, exactly\n * as `FORM_ABUSE_CEILING_CODE` is.\n */\nexport const SITE_MEMBER_CEILING_CODE = 'site-member-ceiling'\n\n/**\n * The visitor's sentence, under the three rules `FORM_UNAVAILABLE_MESSAGE`\n * established (AGL-1666) and for the identical reason: the person reading it\n * is a stranger to the site and NOT our customer.\n *\n *  1. **It does not blame them.** They filled the form in correctly. Nothing\n *     about their address, their password or their retry is the reason.\n *  2. **It does not explain.** \"Unusual volume\", \"this site is at its member\n *     limit\", or anything naming Aglyn, tells a stranger something about the\n *     site owner's account that the owner never chose to publish — and names\n *     a platform the visitor did not come here to hear about.\n *  3. **It does not sound successful.** It says, in as many words, that the\n *     account was not created, so nobody walks away believing they have one\n *     and waiting for an email that is never coming.\n */\nexport const SITE_MEMBER_UNAVAILABLE_MESSAGE =\n  'This site isn’t accepting new accounts right now, so your account was ' +\n  'not created. Please try again later.'\n\n/** The verdict every enforcement point below asks for. */\nexport interface VisitorRecordCeilingResult {\n  /** True once the live document count has REACHED the ceiling. */\n  exceeded: boolean\n  /** The ceiling that was compared against. Always a finite integer. */\n  ceiling: number\n  /** The count that was compared, floored at 0. */\n  used: number\n}\n\n/**\n * Is this site at a flat visitor-record ceiling?\n *\n * The ceiling is an explicit argument rather than read from a table, so the\n * suite can re-drive the SAME usage against a ceiling one higher and require\n * it to succeed — the causation leg of `free-tier-caps-refuse.spec.ts`, which\n * is the only thing that distinguishes \"refused by THIS cap\" from \"refuses\n * everything\". No production caller passes anything but the two constants\n * above; {@link checkSiteMemberCeiling} and {@link checkLeadCeiling} bind them.\n *\n * `strictNullChecks` is OFF repo-wide, so both inputs are normalised rather\n * than trusted, and the two directions are deliberately NOT symmetric:\n *\n *  - `used` folds a missing/NaN count to 0, matching `checkBandwidthAbuseCeiling`.\n *    An unreadable count must not refuse a site; the count is read inside a\n *    transaction that throws rather than returning nothing, so this is a\n *    belt, not a path.\n *  - `ceiling` folds a missing/NaN ceiling to 0, and a ceiling of 0 REFUSES\n *    EVERYTHING. `0` is a legitimate ceiling meaning \"none allowed\" and must\n *    never read as unlimited — the `if (!count)` trap this repo keeps being\n *    bitten by, in the argument that decides the refusal.\n */\nexport function checkVisitorRecordCeiling(\n  used: number,\n  ceiling: number,\n): VisitorRecordCeilingResult {\n  const resolvedCeiling = Math.max(0, Math.floor(Number(ceiling) || 0))\n  const resolvedUsed = Math.max(0, Math.floor(Number(used) || 0))\n  return {\n    exceeded: resolvedUsed >= resolvedCeiling,\n    ceiling: resolvedCeiling,\n    used: resolvedUsed,\n  }\n}\n\n/** {@link checkVisitorRecordCeiling} bound to {@link SITE_MEMBERS_MAX_PER_HOST}. */\nexport function checkSiteMemberCeiling(\n  used: number,\n): VisitorRecordCeilingResult {\n  return checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n}\n\n/** {@link checkVisitorRecordCeiling} bound to {@link LEADS_MAX_PER_HOST}. */\nexport function checkLeadCeiling(used: number): VisitorRecordCeilingResult {\n  return checkVisitorRecordCeiling(used, LEADS_MAX_PER_HOST)\n}\n\n/** Which collection a trip belongs to — the counter id and the notice differ. */\nexport type VisitorRecordKind = 'siteMembers' | 'leads'\n\n/**\n * `hosts/{hostId}/counters/{…}` — the durable, client-unwritable record of a\n * trip, in the same counters-document shape `formSubmissionsRefused` uses\n * (AGL-1367/1655). Named through a function so the writer in\n * `@aglyn/tenant-data-admin` and the reader in the inbox console page cannot\n * spell it two different ways.\n */\nexport function visitorRecordRefusedCounterId(kind: VisitorRecordKind): string {\n  return kind === 'leads' ? 'leadsRefused' : 'siteMembersRefused'\n}\n\n/** What the site's owner is shown. Shaped like `FormsPausedOwnerNotice`. */\nexport interface VisitorRecordsPausedNotice {\n  title: string\n  /** What happened, how many, and what actually clears it. */\n  message: string\n}\n\n/**\n * The owner's notice — the half deliberately withheld from the visitor.\n *\n * Two `{title, message}` lines rather than `LockdownRefusalNotice`'s three:\n * there is **no `until`**, and its absence is the point. The form and\n * bandwidth ceilings count a month and genuinely do lift on the 1st, so their\n * notices name a date. This ceiling counts live documents, so no date lifts\n * it — deleting records does, or support raising it does. Borrowing the third\n * line for symmetry would print a date that means nothing.\n *\n * Returns `null` below one refusal, the same rule as\n * `formSubmissionsPausedNotice` and for the same reason: the counter document\n * persists from its first trip forever, and \"0 refused\" on every later month\n * trains the owner to ignore the row that will one day be real.\n */\nexport function visitorRecordsPausedNotice(input: {\n  kind: VisitorRecordKind\n  /** Refusals recorded for the month being displayed. */\n  refused: number\n  /** The ceiling that was crossed, from the counter document. */\n  ceiling?: number\n}): VisitorRecordsPausedNotice | null {\n  const refused = Math.floor(Number(input.refused) || 0)\n  if (refused < 1) return null\n  const ceiling =\n    typeof input.ceiling === 'number' && Number.isFinite(input.ceiling)\n      ? Math.floor(input.ceiling)\n      : undefined\n  const leads = input.kind === 'leads'\n  const noun = leads ? 'lead' : 'sign-up'\n  return {\n    title: leads\n      ? 'Lead capture is paused'\n      : 'New member sign-ups are paused',\n    message:\n      `${refused.toLocaleString()} ${noun}${refused === 1 ? '' : 's'} on ` +\n      `this site ${refused === 1 ? 'has' : 'have'} been refused this month` +\n      (ceiling\n        ? ` after it reached ${ceiling.toLocaleString()} ` +\n          `${leads ? 'leads' : 'member accounts'}`\n        : '') +\n      '. Refused records are not stored and are not billed. This is a ' +\n      'platform safety limit, not part of your plan — every plan includes ' +\n      `unlimited ${leads ? 'leads' : 'member accounts'}. Removing ` +\n      `${leads ? 'leads' : 'members'} below the limit starts acceptance ` +\n      'again immediately; if this is real traffic, contact support and we ' +\n      'will raise it.',\n  }\n}\n"],"names":["SITE_MEMBERS_MAX_PER_HOST","LEADS_MAX_PER_HOST","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","checkVisitorRecordCeiling","used","ceiling","resolvedCeiling","Math","max","floor","Number","resolvedUsed","exceeded","checkSiteMemberCeiling","checkLeadCeiling","visitorRecordRefusedCounterId","kind","visitorRecordsPausedNotice","input","refused","isFinite","undefined","leads","noun","title","message","toLocaleString"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+DC,GAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,4BAA4B,MAAM;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAMC,qBAAqB,OAAO;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,2BAA2B,sBAAqB;AAE7D;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,kCACX,2EACA,uCAAsC;AAYxC;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASC,0BACdC,IAAY,EACZC,OAAe;IAEf,MAAMC,kBAAkBC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAOL,YAAY;IAClE,MAAMM,eAAeJ,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAON,SAAS;IAC5D,OAAO;QACLQ,UAAUD,gBAAgBL;QAC1BD,SAASC;QACTF,MAAMO;IACR;AACF;AAEA,kFAAkF,GAClF,OAAO,SAASE,uBACdT,IAAY;IAEZ,OAAOD,0BAA0BC,MAAML;AACzC;AAEA,2EAA2E,GAC3E,OAAO,SAASe,iBAAiBV,IAAY;IAC3C,OAAOD,0BAA0BC,MAAMJ;AACzC;AAKA;;;;;;CAMC,GACD,OAAO,SAASe,8BAA8BC,IAAuB;IACnE,OAAOA,SAAS,UAAU,iBAAiB;AAC7C;AASA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,2BAA2BC,KAM1C;IACC,MAAMC,UAAUZ,KAAKE,KAAK,CAACC,OAAOQ,MAAMC,OAAO,KAAK;IACpD,IAAIA,UAAU,GAAG,OAAO;IACxB,MAAMd,UACJ,OAAOa,MAAMb,OAAO,KAAK,YAAYK,OAAOU,QAAQ,CAACF,MAAMb,OAAO,IAC9DE,KAAKE,KAAK,CAACS,MAAMb,OAAO,IACxBgB;IACN,MAAMC,QAAQJ,MAAMF,IAAI,KAAK;IAC7B,MAAMO,OAAOD,QAAQ,SAAS;IAC9B,OAAO;QACLE,OAAOF,QACH,2BACA;QACJG,SACE,GAAGN,QAAQO,cAAc,GAAG,CAAC,EAAEH,OAAOJ,YAAY,IAAI,KAAK,IAAI,IAAI,CAAC,GACpE,CAAC,UAAU,EAAEA,YAAY,IAAI,QAAQ,OAAO,wBAAwB,CAAC,GACpEd,CAAAA,UACG,CAAC,kBAAkB,EAAEA,QAAQqB,cAAc,GAAG,CAAC,CAAC,GAChD,GAAGJ,QAAQ,UAAU,mBAAmB,GACxC,EAAC,IACL,oEACA,wEACA,CAAC,UAAU,EAAEA,QAAQ,UAAU,kBAAkB,WAAW,CAAC,GAC7D,GAAGA,QAAQ,UAAU,UAAU,mCAAmC,CAAC,GACnE,wEACA;IACJ;AACF"}

package/src/lib/app-utils/web-vitals-rum.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export interface WebVitalsReportingOptions {
+    /**
+     * Which product surface produced the measurement — `site` for a tenant
+     * published page, `console` for the console. Same axis as the link-click
+     * listener's `surface`.
+     */
+    surface: string;
+    /**
+     * Whether this visitor's consent currently permits analytics.
+     *
+     * Optional, and ABSENT MEANS ALLOWED — on a tenant page the absence of
+     * `window.gtag` is already the gate, because the tag only loads for a
+     * visitor who granted (AGL-1498), and a self-hosted surface answers to its
+     * operator's own configuration.
+     *
+     * The console needs it because its gate has a different shape. Firebase
+     * injects gtag.js and a page cannot unload a script, so a visitor who
+     * WITHDRAWS mid-session leaves `window.gtag` resident — and this module
+     * calls it directly rather than through `deliver()`, so the console's
+     * refusing transport does not cover it. Re-read on every delivery rather
+     * than captured at install, since the whole point is that the answer
+     * changes within one document.
+     */
+    allowed?: () => boolean;
+}
+/**
+ * Start reporting Core Web Vitals for this page load. Safe to call from
+ * render (installs once, touches no render output, never throws) — the same
+ * contract as `installLinkClickTracking`, and it is mounted beside it.
+ *
+ * The library loads via dynamic `import()`: an async chunk off the critical
+ * path of the surface whose performance is being measured. If the chunk
+ * fails to load there is simply no measurement — never an error.
+ */
+export declare function installWebVitalsReporting(options: WebVitalsReportingOptions): void;
+/** Test seam — forgets the install, the held metrics and the tag watcher. */
+export declare function resetWebVitalsReporting(): void;

package/src/lib/app-utils/web-vitals-rum.js

@@ -0,0 +1,278 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { sanitizeEventParams } from "./analytics-events.js";
+// The reader the consent sweep already uses to find which GA properties this
+// page has resident, reused rather than a second scan of the same document —
+// it is format-checked and it sees a tag that arrived through GTM as well as
+// one we mounted ourselves.
+import { residentGaMeasurementIds } from "./visitor-consent.js";
+/**
+ * Real-user Core Web Vitals → GA4 events (AGL-1642).
+ *
+ * Until this module there was no field performance telemetry of any kind in
+ * the repo, and the cost was concrete: AGL-1538 recorded a tenant hydration
+ * stall of 30s+ that could never be quantified, and the hydration window is
+ * also an ATTRIBUTION hole — a signup CTA clicked before gtag hydrates
+ * crosses to the console with no `_gl` linker, deleting the acquisition
+ * source. "How long does hydration take for real visitors" was unanswerable.
+ *
+ * ## Why `web-vitals` → GA4, not Speed Insights or Firebase Performance
+ *
+ * The GA4 property (`G-YW5PG16YTM`) is already consolidated across every
+ * first-party surface, already consent-gated correctly per surface, and
+ * already carries the funnel these numbers need to sit beside — slow LCP on
+ * the pricing page matters BECAUSE of what it does to `begin_checkout`.
+ * Sending CWV there adds zero new subprocessors, zero spend, and one ~2KB
+ * lazy chunk; `web-vitals` is Google's own library and is ALREADY in
+ * `node_modules` as a dependency of `@firebase/performance`. Vercel Speed
+ * Insights would add a vendor surface and a paid tier; Firebase Performance
+ * is the weakest web product of the three and puts a second SDK on the
+ * tenant's critical path (see AGL-1642 for the full comparison).
+ *
+ * ## Event shape — GA's own `web_vitals` pattern
+ *
+ * One event per metric, named by the metric (`LCP`, `CLS`, `INP`, `TTFB`),
+ * exactly as web.dev's "send to Google Analytics" snippet shapes them:
+ *
+ * - `value: delta` — GA sums event `value`, and summing DELTAS is what makes
+ *   per-page totals right when a metric reports more than once;
+ * - `metric_id` — web-vitals' per-pageview id, the deduplication/grouping key
+ *   (needs dimension registration to report on — AGL-1637);
+ * - `metric_value` / `metric_delta` — the current value and its change;
+ * - `metric_rating` — `good` / `needs-improvement` / `poor`, the one
+ *   dimension that makes a report readable without percentile math;
+ * - `surface` — same param the link-click listener sends: GA's Hostname
+ *   dimension separates domains, `surface` separates product surfaces.
+ *
+ * ## Consent — the same gate as every other tenant event, plus one nuance
+ *
+ * Delivery is `window.gtag`, which on a tenant site exists only once a
+ * granting consent state has loaded it (AGL-1498). No gtag, no hit.
+ *
+ * The nuance is TIMING, not posture. TTFB reports the moment the reporter
+ * installs, and both gtag mounts load late by design — `afterInteractive` on
+ * the tenant, Firebase's runtime injection on the console — so "no gtag YET"
+ * is the normal state for the first metrics of every pageview, granting
+ * visitors included. Dropping on first miss would silently discard TTFB (and
+ * often LCP) on every surface, which reads in GA exactly like fast pages.
+ * So a metric that finds no tag is held IN MEMORY and re-offered briefly
+ * (~60s at 500ms); if the tag never arrives it is discarded, unsent.
+ *
+ * That is not the queue `analytics-events.ts` forbids, and the distinction
+ * is worth stating: the forbidden queue replays a visitor's pre-consent
+ * BEHAVIOUR (pageviews, clicks — the record consent exists to prevent) after
+ * a later grant. These are timings of the page's own load, sitting in the
+ * browser's performance timeline regardless; and a tag that loads on a late
+ * same-pageview grant reports its own `page_view` for this page at that
+ * moment — the vitals that then flush describe the exact pageview the tag
+ * itself just reported. A visitor who never grants still produces nothing:
+ * no tag ever appears, the buffer dies with the page, unsent.
+ *
+ * ## Why installing early still measures the whole page
+ *
+ * `web-vitals` reads buffered `PerformanceObserver` entries, so registration
+ * order does not truncate the metrics; and CLS/INP/LCP report at
+ * interaction/page-hide time anyway. The library itself is loaded with a
+ * dynamic `import()` so the tenant's critical path pays nothing for it.
+ *
+ * The console's `traffic_type: 'internal'` stamp (AGL-1582) rides these hits
+ * unchanged: Firebase's `setDefaultEventParameters` issues a global
+ * `gtag('set', …)`, which applies to every later event on the page —
+ * including these direct `window.gtag` calls (verified against the SDK's
+ * `wrapGtag`, not assumed).
+ */ /** The four metrics worth a GA event, per web.dev's GA4 guidance. */ const METRIC_HANDLER_NAMES = [
+    'onCLS',
+    'onINP',
+    'onLCP',
+    'onTTFB'
+];
+/** How long a metric waits for a tag before being discarded, unsent. */ const TAG_WAIT_INTERVAL_MS = 500;
+const TAG_WAIT_MAX_TRIES = 120;
+let installed = false;
+let consentGate = null;
+let pending = [];
+let watcher = null;
+let watcherTries = 0;
+/** The consent verdict, with no gate registered reading as "allowed". */ function consentAllows() {
+    if (consentGate === null) return true;
+    try {
+        return consentGate() === true;
+    } catch (unused) {
+        // A gate that throws cannot be read as consent — storage can throw in
+        // private mode, and "we could not tell" resolves to no.
+        return false;
+    }
+}
+function residentGtag() {
+    if (typeof window === 'undefined') return null;
+    const gtag = window.gtag;
+    return typeof gtag === 'function' ? gtag : null;
+}
+/**
+ * Send one metric event to the MEASUREMENT properties only (AGL-2710).
+ *
+ * A gtag event with no `send_to` goes to every destination the loader has
+ * configured, and on a surface that also runs Google Ads that includes the
+ * ads account. This module's whole subject is "Core Web Vitals → GA4", and an
+ * ads destination has nothing to do with a layout shift: measured on
+ * `aglyn.com`, one such event attempted seven requests to
+ * `googleads.g.doubleclick.net` and `google.com/{pagead,rmkt,ccm}` — per
+ * metric, per pageview, four metrics deep — and Google Ads has no report that
+ * reads any of them. Naming the GA4 ids drops all seven and leaves the GA hit
+ * exactly as it was.
+ *
+ * The ids are read at DELIVERY time, from the page, through the reader the
+ * consent sweep already uses: the tag routinely arrives after the first
+ * metric, and what has to be addressed is whatever gtag is configured for now
+ * — which on a customer site is their own property and not ours.
+ *
+ * No ids found means no `send_to` and the event goes wherever it went before.
+ * That is the fail-open side on purpose: a tag that arrived through GTM with
+ * an id this reader never saw would otherwise be handed an empty destination
+ * list, and losing the measurement is a worse outcome than an ads account
+ * receiving a metric it ignores.
+ */ function sendMetricEvent(gtag, name, params) {
+    try {
+        const destinations = residentGaMeasurementIds();
+        gtag('event', name, destinations.length ? _extends({}, params, {
+            send_to: destinations
+        }) : params);
+    } catch (unused) {
+    // Analytics never breaks the page.
+    }
+}
+function flushPending(gtag) {
+    const held = pending;
+    pending = [];
+    for (const event of held){
+        sendMetricEvent(gtag, event.name, event.params);
+    }
+}
+function stopWatcher() {
+    if (watcher !== null) {
+        clearInterval(watcher);
+        watcher = null;
+    }
+    watcherTries = 0;
+}
+/**
+ * Offer one metric to the tag, or hold it while the tag is still loading.
+ * See the module comment for why holding briefly is not the forbidden queue.
+ */ function deliverMetricEvent(name, params) {
+    // Checked HERE rather than at install, and before anything is held: a
+    // withdrawal mid-session has to drop what is already waiting as well as what
+    // comes next, or the held metrics simply arrive later against a visitor who
+    // has said no.
+    if (!consentAllows()) {
+        pending = [];
+        stopWatcher();
+        return;
+    }
+    const gtag = residentGtag();
+    if (gtag) {
+        // Anything held arrived before this one; keep GA's receive order honest.
+        if (pending.length) flushPending(gtag);
+        stopWatcher();
+        sendMetricEvent(gtag, name, params);
+        return;
+    }
+    pending.push({
+        name,
+        params
+    });
+    if (watcher !== null) return;
+    watcherTries = 0;
+    watcher = setInterval(()=>{
+        watcherTries += 1;
+        // The visitor can refuse while the tag is still being waited for, which is
+        // exactly the prior-consent case: no tag yet, metrics held, and a Decline
+        // click that must empty the hold rather than let it flush later.
+        if (!consentAllows()) {
+            pending = [];
+            stopWatcher();
+            return;
+        }
+        const resident = residentGtag();
+        if (resident) {
+            flushPending(resident);
+            stopWatcher();
+            return;
+        }
+        if (watcherTries >= TAG_WAIT_MAX_TRIES) {
+            // The tag never came — an ungranted visitor, an ad blocker, or a site
+            // with no analytics configured. Dropped, permanently, like every other
+            // consentless event.
+            pending = [];
+            stopWatcher();
+        }
+    }, TAG_WAIT_INTERVAL_MS);
+}
+function reportMetric(metric, surface) {
+    // The same sanitizer every payload passes (AGL-1561) — these values are
+    // library-generated and carry nothing identifying, but the guarantee should
+    // hold because the sanitizer ran, not because this caller was careful.
+    const params = sanitizeEventParams(_extends({
+        // GA sums event `value`; summing DELTAS keeps a twice-reported metric's
+        // page total correct. web.dev's canonical GA4 mapping.
+        value: metric.delta,
+        metric_id: metric.id,
+        metric_value: metric.value,
+        metric_delta: metric.delta
+    }, metric.rating ? {
+        metric_rating: metric.rating
+    } : {}, {
+        surface
+    }));
+    deliverMetricEvent(metric.name, params);
+}
+/**
+ * Start reporting Core Web Vitals for this page load. Safe to call from
+ * render (installs once, touches no render output, never throws) — the same
+ * contract as `installLinkClickTracking`, and it is mounted beside it.
+ *
+ * The library loads via dynamic `import()`: an async chunk off the critical
+ * path of the surface whose performance is being measured. If the chunk
+ * fails to load there is simply no measurement — never an error.
+ */ export function installWebVitalsReporting(options) {
+    var _options_allowed;
+    if (typeof window === 'undefined') return;
+    if (installed) return;
+    installed = true;
+    consentGate = (_options_allowed = options.allowed) != null ? _options_allowed : null;
+    const surface = options.surface;
+    import("web-vitals").then((vitals)=>{
+        for (const handlerName of METRIC_HANDLER_NAMES){
+            const register = vitals[handlerName];
+            if (typeof register !== 'function') continue;
+            try {
+                register((metric)=>reportMetric(metric, surface));
+            } catch (unused) {
+            // One broken observer must not take the others down.
+            }
+        }
+    }).catch(()=>{
+    // No chunk, no measurement — analytics never breaks the page.
+    });
+}
+/** Test seam — forgets the install, the held metrics and the tag watcher. */ export function resetWebVitalsReporting() {
+    installed = false;
+    consentGate = null;
+    pending = [];
+    stopWatcher();
+}
+
+//# sourceMappingURL=web-vitals-rum.js.map

package/src/lib/app-utils/web-vitals-rum.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/web-vitals-rum.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { sanitizeEventParams } from './analytics-events'\n// The reader the consent sweep already uses to find which GA properties this\n// page has resident, reused rather than a second scan of the same document —\n// it is format-checked and it sees a tag that arrived through GTM as well as\n// one we mounted ourselves.\nimport { residentGaMeasurementIds } from './visitor-consent'\n\n/**\n * Real-user Core Web Vitals → GA4 events (AGL-1642).\n *\n * Until this module there was no field performance telemetry of any kind in\n * the repo, and the cost was concrete: AGL-1538 recorded a tenant hydration\n * stall of 30s+ that could never be quantified, and the hydration window is\n * also an ATTRIBUTION hole — a signup CTA clicked before gtag hydrates\n * crosses to the console with no `_gl` linker, deleting the acquisition\n * source. \"How long does hydration take for real visitors\" was unanswerable.\n *\n * ## Why `web-vitals` → GA4, not Speed Insights or Firebase Performance\n *\n * The GA4 property (`G-YW5PG16YTM`) is already consolidated across every\n * first-party surface, already consent-gated correctly per surface, and\n * already carries the funnel these numbers need to sit beside — slow LCP on\n * the pricing page matters BECAUSE of what it does to `begin_checkout`.\n * Sending CWV there adds zero new subprocessors, zero spend, and one ~2KB\n * lazy chunk; `web-vitals` is Google's own library and is ALREADY in\n * `node_modules` as a dependency of `@firebase/performance`. Vercel Speed\n * Insights would add a vendor surface and a paid tier; Firebase Performance\n * is the weakest web product of the three and puts a second SDK on the\n * tenant's critical path (see AGL-1642 for the full comparison).\n *\n * ## Event shape — GA's own `web_vitals` pattern\n *\n * One event per metric, named by the metric (`LCP`, `CLS`, `INP`, `TTFB`),\n * exactly as web.dev's \"send to Google Analytics\" snippet shapes them:\n *\n * - `value: delta` — GA sums event `value`, and summing DELTAS is what makes\n *   per-page totals right when a metric reports more than once;\n * - `metric_id` — web-vitals' per-pageview id, the deduplication/grouping key\n *   (needs dimension registration to report on — AGL-1637);\n * - `metric_value` / `metric_delta` — the current value and its change;\n * - `metric_rating` — `good` / `needs-improvement` / `poor`, the one\n *   dimension that makes a report readable without percentile math;\n * - `surface` — same param the link-click listener sends: GA's Hostname\n *   dimension separates domains, `surface` separates product surfaces.\n *\n * ## Consent — the same gate as every other tenant event, plus one nuance\n *\n * Delivery is `window.gtag`, which on a tenant site exists only once a\n * granting consent state has loaded it (AGL-1498). No gtag, no hit.\n *\n * The nuance is TIMING, not posture. TTFB reports the moment the reporter\n * installs, and both gtag mounts load late by design — `afterInteractive` on\n * the tenant, Firebase's runtime injection on the console — so \"no gtag YET\"\n * is the normal state for the first metrics of every pageview, granting\n * visitors included. Dropping on first miss would silently discard TTFB (and\n * often LCP) on every surface, which reads in GA exactly like fast pages.\n * So a metric that finds no tag is held IN MEMORY and re-offered briefly\n * (~60s at 500ms); if the tag never arrives it is discarded, unsent.\n *\n * That is not the queue `analytics-events.ts` forbids, and the distinction\n * is worth stating: the forbidden queue replays a visitor's pre-consent\n * BEHAVIOUR (pageviews, clicks — the record consent exists to prevent) after\n * a later grant. These are timings of the page's own load, sitting in the\n * browser's performance timeline regardless; and a tag that loads on a late\n * same-pageview grant reports its own `page_view` for this page at that\n * moment — the vitals that then flush describe the exact pageview the tag\n * itself just reported. A visitor who never grants still produces nothing:\n * no tag ever appears, the buffer dies with the page, unsent.\n *\n * ## Why installing early still measures the whole page\n *\n * `web-vitals` reads buffered `PerformanceObserver` entries, so registration\n * order does not truncate the metrics; and CLS/INP/LCP report at\n * interaction/page-hide time anyway. The library itself is loaded with a\n * dynamic `import()` so the tenant's critical path pays nothing for it.\n *\n * The console's `traffic_type: 'internal'` stamp (AGL-1582) rides these hits\n * unchanged: Firebase's `setDefaultEventParameters` issues a global\n * `gtag('set', …)`, which applies to every later event on the page —\n * including these direct `window.gtag` calls (verified against the SDK's\n * `wrapGtag`, not assumed).\n */\n\n/** The four metrics worth a GA event, per web.dev's GA4 guidance. */\nconst METRIC_HANDLER_NAMES = ['onCLS', 'onINP', 'onLCP', 'onTTFB'] as const\n\n/** How long a metric waits for a tag before being discarded, unsent. */\nconst TAG_WAIT_INTERVAL_MS = 500\nconst TAG_WAIT_MAX_TRIES = 120\n\n/** Shape of the web-vitals metric object this module consumes. */\ninterface ReportedMetric {\n  name: string\n  id: string\n  value: number\n  delta: number\n  rating?: string\n}\n\nexport interface WebVitalsReportingOptions {\n  /**\n   * Which product surface produced the measurement — `site` for a tenant\n   * published page, `console` for the console. Same axis as the link-click\n   * listener's `surface`.\n   */\n  surface: string\n  /**\n   * Whether this visitor's consent currently permits analytics.\n   *\n   * Optional, and ABSENT MEANS ALLOWED — on a tenant page the absence of\n   * `window.gtag` is already the gate, because the tag only loads for a\n   * visitor who granted (AGL-1498), and a self-hosted surface answers to its\n   * operator's own configuration.\n   *\n   * The console needs it because its gate has a different shape. Firebase\n   * injects gtag.js and a page cannot unload a script, so a visitor who\n   * WITHDRAWS mid-session leaves `window.gtag` resident — and this module\n   * calls it directly rather than through `deliver()`, so the console's\n   * refusing transport does not cover it. Re-read on every delivery rather\n   * than captured at install, since the whole point is that the answer\n   * changes within one document.\n   */\n  allowed?: () => boolean\n}\n\nlet installed = false\nlet consentGate: (() => boolean) | null = null\nlet pending: Array<{ name: string; params: Record<string, unknown> }> = []\nlet watcher: ReturnType<typeof setInterval> | null = null\nlet watcherTries = 0\n\n/** The consent verdict, with no gate registered reading as \"allowed\". */\nfunction consentAllows(): boolean {\n  if (consentGate === null) return true\n  try {\n    return consentGate() === true\n  } catch {\n    // A gate that throws cannot be read as consent — storage can throw in\n    // private mode, and \"we could not tell\" resolves to no.\n    return false\n  }\n}\n\nfunction residentGtag(): ((...args: unknown[]) => void) | null {\n  if (typeof window === 'undefined') return null\n  const gtag = (window as unknown as { gtag?: unknown }).gtag\n  return typeof gtag === 'function'\n    ? (gtag as (...args: unknown[]) => void)\n    : null\n}\n\n/**\n * Send one metric event to the MEASUREMENT properties only (AGL-2710).\n *\n * A gtag event with no `send_to` goes to every destination the loader has\n * configured, and on a surface that also runs Google Ads that includes the\n * ads account. This module's whole subject is \"Core Web Vitals → GA4\", and an\n * ads destination has nothing to do with a layout shift: measured on\n * `aglyn.com`, one such event attempted seven requests to\n * `googleads.g.doubleclick.net` and `google.com/{pagead,rmkt,ccm}` — per\n * metric, per pageview, four metrics deep — and Google Ads has no report that\n * reads any of them. Naming the GA4 ids drops all seven and leaves the GA hit\n * exactly as it was.\n *\n * The ids are read at DELIVERY time, from the page, through the reader the\n * consent sweep already uses: the tag routinely arrives after the first\n * metric, and what has to be addressed is whatever gtag is configured for now\n * — which on a customer site is their own property and not ours.\n *\n * No ids found means no `send_to` and the event goes wherever it went before.\n * That is the fail-open side on purpose: a tag that arrived through GTM with\n * an id this reader never saw would otherwise be handed an empty destination\n * list, and losing the measurement is a worse outcome than an ads account\n * receiving a metric it ignores.\n */\nfunction sendMetricEvent(\n  gtag: (...args: unknown[]) => void,\n  name: string,\n  params: Record<string, unknown>,\n): void {\n  try {\n    const destinations = residentGaMeasurementIds()\n    gtag(\n      'event',\n      name,\n      destinations.length ? { ...params, send_to: destinations } : params,\n    )\n  } catch {\n    // Analytics never breaks the page.\n  }\n}\n\nfunction flushPending(gtag: (...args: unknown[]) => void): void {\n  const held = pending\n  pending = []\n  for (const event of held) {\n    sendMetricEvent(gtag, event.name, event.params)\n  }\n}\n\nfunction stopWatcher(): void {\n  if (watcher !== null) {\n    clearInterval(watcher)\n    watcher = null\n  }\n  watcherTries = 0\n}\n\n/**\n * Offer one metric to the tag, or hold it while the tag is still loading.\n * See the module comment for why holding briefly is not the forbidden queue.\n */\nfunction deliverMetricEvent(\n  name: string,\n  params: Record<string, unknown>,\n): void {\n  // Checked HERE rather than at install, and before anything is held: a\n  // withdrawal mid-session has to drop what is already waiting as well as what\n  // comes next, or the held metrics simply arrive later against a visitor who\n  // has said no.\n  if (!consentAllows()) {\n    pending = []\n    stopWatcher()\n    return\n  }\n  const gtag = residentGtag()\n  if (gtag) {\n    // Anything held arrived before this one; keep GA's receive order honest.\n    if (pending.length) flushPending(gtag)\n    stopWatcher()\n    sendMetricEvent(gtag, name, params)\n    return\n  }\n  pending.push({ name, params })\n  if (watcher !== null) return\n  watcherTries = 0\n  watcher = setInterval(() => {\n    watcherTries += 1\n    // The visitor can refuse while the tag is still being waited for, which is\n    // exactly the prior-consent case: no tag yet, metrics held, and a Decline\n    // click that must empty the hold rather than let it flush later.\n    if (!consentAllows()) {\n      pending = []\n      stopWatcher()\n      return\n    }\n    const resident = residentGtag()\n    if (resident) {\n      flushPending(resident)\n      stopWatcher()\n      return\n    }\n    if (watcherTries >= TAG_WAIT_MAX_TRIES) {\n      // The tag never came — an ungranted visitor, an ad blocker, or a site\n      // with no analytics configured. Dropped, permanently, like every other\n      // consentless event.\n      pending = []\n      stopWatcher()\n    }\n  }, TAG_WAIT_INTERVAL_MS)\n}\n\nfunction reportMetric(metric: ReportedMetric, surface: string): void {\n  // The same sanitizer every payload passes (AGL-1561) — these values are\n  // library-generated and carry nothing identifying, but the guarantee should\n  // hold because the sanitizer ran, not because this caller was careful.\n  const params = sanitizeEventParams({\n    // GA sums event `value`; summing DELTAS keeps a twice-reported metric's\n    // page total correct. web.dev's canonical GA4 mapping.\n    value: metric.delta,\n    metric_id: metric.id,\n    metric_value: metric.value,\n    metric_delta: metric.delta,\n    ...(metric.rating ? { metric_rating: metric.rating } : {}),\n    surface,\n  })\n  deliverMetricEvent(metric.name, params)\n}\n\n/**\n * Start reporting Core Web Vitals for this page load. Safe to call from\n * render (installs once, touches no render output, never throws) — the same\n * contract as `installLinkClickTracking`, and it is mounted beside it.\n *\n * The library loads via dynamic `import()`: an async chunk off the critical\n * path of the surface whose performance is being measured. If the chunk\n * fails to load there is simply no measurement — never an error.\n */\nexport function installWebVitalsReporting(\n  options: WebVitalsReportingOptions,\n): void {\n  if (typeof window === 'undefined') return\n  if (installed) return\n  installed = true\n  consentGate = options.allowed ?? null\n  const surface = options.surface\n  import('web-vitals')\n    .then((vitals) => {\n      for (const handlerName of METRIC_HANDLER_NAMES) {\n        const register = (\n          vitals as unknown as Record<\n            string,\n            ((callback: (metric: ReportedMetric) => void) => void) | undefined\n          >\n        )[handlerName]\n        if (typeof register !== 'function') continue\n        try {\n          register((metric) => reportMetric(metric, surface))\n        } catch {\n          // One broken observer must not take the others down.\n        }\n      }\n    })\n    .catch(() => {\n      // No chunk, no measurement — analytics never breaks the page.\n    })\n}\n\n/** Test seam — forgets the install, the held metrics and the tag watcher. */\nexport function resetWebVitalsReporting(): void {\n  installed = false\n  consentGate = null\n  pending = []\n  stopWatcher()\n}\n"],"names":["sanitizeEventParams","residentGaMeasurementIds","METRIC_HANDLER_NAMES","TAG_WAIT_INTERVAL_MS","TAG_WAIT_MAX_TRIES","installed","consentGate","pending","watcher","watcherTries","consentAllows","residentGtag","window","gtag","sendMetricEvent","name","params","destinations","length","send_to","flushPending","held","event","stopWatcher","clearInterval","deliverMetricEvent","push","setInterval","resident","reportMetric","metric","surface","value","delta","metric_id","id","metric_value","metric_delta","rating","metric_rating","installWebVitalsReporting","options","allowed","then","vitals","handlerName","register","catch","resetWebVitalsReporting"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,mBAAmB,QAAQ,wBAAoB;AACxD,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,4BAA4B;AAC5B,SAASC,wBAAwB,QAAQ,uBAAmB;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EC,GAED,mEAAmE,GACnE,MAAMC,uBAAuB;IAAC;IAAS;IAAS;IAAS;CAAS;AAElE,sEAAsE,GACtE,MAAMC,uBAAuB;AAC7B,MAAMC,qBAAqB;AAqC3B,IAAIC,YAAY;AAChB,IAAIC,cAAsC;AAC1C,IAAIC,UAAoE,EAAE;AAC1E,IAAIC,UAAiD;AACrD,IAAIC,eAAe;AAEnB,uEAAuE,GACvE,SAASC;IACP,IAAIJ,gBAAgB,MAAM,OAAO;IACjC,IAAI;QACF,OAAOA,kBAAkB;IAC3B,EAAE,eAAM;QACN,sEAAsE;QACtE,wDAAwD;QACxD,OAAO;IACT;AACF;AAEA,SAASK;IACP,IAAI,OAAOC,WAAW,aAAa,OAAO;IAC1C,MAAMC,OAAO,AAACD,OAAyCC,IAAI;IAC3D,OAAO,OAAOA,SAAS,aAClBA,OACD;AACN;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,SAASC,gBACPD,IAAkC,EAClCE,IAAY,EACZC,MAA+B;IAE/B,IAAI;QACF,MAAMC,eAAehB;QACrBY,KACE,SACAE,MACAE,aAAaC,MAAM,GAAG,aAAKF;YAAQG,SAASF;aAAiBD;IAEjE,EAAE,eAAM;IACN,mCAAmC;IACrC;AACF;AAEA,SAASI,aAAaP,IAAkC;IACtD,MAAMQ,OAAOd;IACbA,UAAU,EAAE;IACZ,KAAK,MAAMe,SAASD,KAAM;QACxBP,gBAAgBD,MAAMS,MAAMP,IAAI,EAAEO,MAAMN,MAAM;IAChD;AACF;AAEA,SAASO;IACP,IAAIf,YAAY,MAAM;QACpBgB,cAAchB;QACdA,UAAU;IACZ;IACAC,eAAe;AACjB;AAEA;;;CAGC,GACD,SAASgB,mBACPV,IAAY,EACZC,MAA+B;IAE/B,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,eAAe;IACf,IAAI,CAACN,iBAAiB;QACpBH,UAAU,EAAE;QACZgB;QACA;IACF;IACA,MAAMV,OAAOF;IACb,IAAIE,MAAM;QACR,yEAAyE;QACzE,IAAIN,QAAQW,MAAM,EAAEE,aAAaP;QACjCU;QACAT,gBAAgBD,MAAME,MAAMC;QAC5B;IACF;IACAT,QAAQmB,IAAI,CAAC;QAAEX;QAAMC;IAAO;IAC5B,IAAIR,YAAY,MAAM;IACtBC,eAAe;IACfD,UAAUmB,YAAY;QACpBlB,gBAAgB;QAChB,2EAA2E;QAC3E,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,CAACC,iBAAiB;YACpBH,UAAU,EAAE;YACZgB;YACA;QACF;QACA,MAAMK,WAAWjB;QACjB,IAAIiB,UAAU;YACZR,aAAaQ;YACbL;YACA;QACF;QACA,IAAId,gBAAgBL,oBAAoB;YACtC,sEAAsE;YACtE,uEAAuE;YACvE,qBAAqB;YACrBG,UAAU,EAAE;YACZgB;QACF;IACF,GAAGpB;AACL;AAEA,SAAS0B,aAAaC,MAAsB,EAAEC,OAAe;IAC3D,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,MAAMf,SAAShB,oBAAoB;QACjC,wEAAwE;QACxE,uDAAuD;QACvDgC,OAAOF,OAAOG,KAAK;QACnBC,WAAWJ,OAAOK,EAAE;QACpBC,cAAcN,OAAOE,KAAK;QAC1BK,cAAcP,OAAOG,KAAK;OACtBH,OAAOQ,MAAM,GAAG;QAAEC,eAAeT,OAAOQ,MAAM;IAAC,IAAI,CAAC;QACxDP;;IAEFN,mBAAmBK,OAAOf,IAAI,EAAEC;AAClC;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASwB,0BACdC,OAAkC;QAKpBA;IAHd,IAAI,OAAO7B,WAAW,aAAa;IACnC,IAAIP,WAAW;IACfA,YAAY;IACZC,eAAcmC,mBAAAA,QAAQC,OAAO,YAAfD,mBAAmB;IACjC,MAAMV,UAAUU,QAAQV,OAAO;IAC/B,MAAM,CAAC,cACJY,IAAI,CAAC,CAACC;QACL,KAAK,MAAMC,eAAe3C,qBAAsB;YAC9C,MAAM4C,WAAW,AACfF,MAID,CAACC,YAAY;YACd,IAAI,OAAOC,aAAa,YAAY;YACpC,IAAI;gBACFA,SAAS,CAAChB,SAAWD,aAAaC,QAAQC;YAC5C,EAAE,eAAM;YACN,qDAAqD;YACvD;QACF;IACF,GACCgB,KAAK,CAAC;IACL,8DAA8D;IAChE;AACJ;AAEA,2EAA2E,GAC3E,OAAO,SAASC;IACd3C,YAAY;IACZC,cAAc;IACdC,UAAU,EAAE;IACZgB;AACF"}