@aglyn/aglyn 1.0.0-beta.143

package/src/lib/foundation/definitions/contact.types.js

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * ONE postal address shape (AGL-1133).
+ *
+ * The failure this prevents is not "there is no address field" — it is a phone
+ * number stored three ways in three collections. So every place that grows an
+ * address stores this, and the Stripe mapping is a field rename in one file
+ * rather than in each caller.
+ *
+ * NOTE ON `state`: the issue specified `region`. Using it would have created a
+ * THIRD spelling — Stripe's customer address uses `state`, and the commerce
+ * plugin's `OrderAddress` already uses `state` too. A canonical type whose
+ * whole purpose is to stop variants should not open with a new variant, so
+ * this matches the two shapes it has to interoperate with.
+ */ /** Every field of a postal address, absent or blank. */ export function isBlankAddress(address) {
+    if (!address) return true;
+    return ![
+        'line1',
+        'line2',
+        'city',
+        'state',
+        'postalCode',
+        'country'
+    ].some((key)=>{
+        var _address_key;
+        return String((_address_key = address[key]) != null ? _address_key : '').trim();
+    });
+}
+/**
+ * Trim, drop empties, and uppercase the country code.
+ *
+ * Returns `null` for an address with nothing in it, so a cleared form stores
+ * an absent field rather than an object full of empty strings — which would
+ * read as "has an address" to every `if (address)` in the codebase.
+ */ export function normalizeAddress(address) {
+    if (!address) return null;
+    const clean = (value)=>String(value != null ? value : '').trim();
+    const next = {};
+    const line1 = clean(address.line1);
+    const line2 = clean(address.line2);
+    const city = clean(address.city);
+    const state = clean(address.state);
+    const postalCode = clean(address.postalCode);
+    const country = clean(address.country).toUpperCase();
+    if (line1) next.line1 = line1;
+    if (line2) next.line2 = line2;
+    if (city) next.city = city;
+    if (state) next.state = state;
+    if (postalCode) next.postalCode = postalCode;
+    // Only a real alpha-2 shape is stored; anything else is a typed country
+    // name and is worse than absent, because Stripe would reject the customer
+    // update and take the rest of the address down with it.
+    if (/^[A-Z]{2}$/.test(country)) next.country = country;
+    return isBlankAddress(next) ? null : next;
+}
+/**
+ * Best-effort E.164 (`+15125550123`).
+ *
+ * Measured on production 2026-07-30: the one populated profile stored a bare
+ * ten-digit US number with no country code — `5550107788` in the examples
+ * below, standing in for the value actually measured. That is unusable for SMS
+ * or for a Stripe customer, and it is what "phone already exists but is stored
+ * unnormalized" in AGL-1133 refers to.
+ *
+ * `defaultCountry` only applies to a number with NO country code of its own,
+ * and only US/CA (+1) are inferred — guessing a country for a bare national
+ * number anywhere else silently invents a different subscriber.
+ *
+ * @returns E.164, or `null` when the input cannot be normalized confidently.
+ *          Never a partially-cleaned string: a half-normalized phone is the
+ *          same bug in a new format.
+ */ export function normalizePhone(input, defaultCountry = 'US') {
+    const raw = String(input != null ? input : '').trim();
+    if (!raw) return null;
+    // A leading + is the user telling us the country; keep it and just strip
+    // the punctuation humans put in numbers.
+    if (raw.startsWith('+')) {
+        const digits = raw.slice(1).replace(/\D/g, '');
+        // E.164 allows at most 15 digits, and a country code is at least 1 —
+        // 8 is below any real international number and signals a typo.
+        return digits.length >= 8 && digits.length <= 15 ? `+${digits}` : null;
+    }
+    const digits = raw.replace(/\D/g, '');
+    if (!digits) return null;
+    const inferable = defaultCountry === 'US' || defaultCountry === 'CA';
+    if (!inferable) return null;
+    // 10 digits is NANP without the country code; 11 starting with 1 is with it.
+    if (digits.length === 10) return `+1${digits}`;
+    if (digits.length === 11 && digits.startsWith('1')) return `+${digits}`;
+    return null;
+}
+
+//# sourceMappingURL=contact.types.js.map

package/src/lib/foundation/definitions/contact.types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/aglyn/src/lib/foundation/definitions/contact.types.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * ONE postal address shape (AGL-1133).\n *\n * The failure this prevents is not \"there is no address field\" — it is a phone\n * number stored three ways in three collections. So every place that grows an\n * address stores this, and the Stripe mapping is a field rename in one file\n * rather than in each caller.\n *\n * NOTE ON `state`: the issue specified `region`. Using it would have created a\n * THIRD spelling — Stripe's customer address uses `state`, and the commerce\n * plugin's `OrderAddress` already uses `state` too. A canonical type whose\n * whole purpose is to stop variants should not open with a new variant, so\n * this matches the two shapes it has to interoperate with.\n */\nexport interface AglynPostalAddress {\n  line1?: string\n  line2?: string\n  city?: string\n  /** State, province, prefecture or county. Stripe calls this `state`. */\n  state?: string\n  postalCode?: string\n  /**\n   * ISO-3166-1 alpha-2, uppercase (`US`, `GB`, `DE`).\n   *\n   * Two letters because that is what Stripe Tax and every address validator\n   * expect; a free-text country name cannot be used to compute tax.\n   */\n  country?: string\n}\n\n/** Every field of a postal address, absent or blank. */\nexport function isBlankAddress(\n  address: AglynPostalAddress | null | undefined,\n): boolean {\n  if (!address) return true\n  return !(\n    ['line1', 'line2', 'city', 'state', 'postalCode', 'country'] as const\n  ).some((key) => String(address[key] ?? '').trim())\n}\n\n/**\n * Trim, drop empties, and uppercase the country code.\n *\n * Returns `null` for an address with nothing in it, so a cleared form stores\n * an absent field rather than an object full of empty strings — which would\n * read as \"has an address\" to every `if (address)` in the codebase.\n */\nexport function normalizeAddress(\n  address: AglynPostalAddress | null | undefined,\n): AglynPostalAddress | null {\n  if (!address) return null\n  const clean = (value: unknown) => String(value ?? '').trim()\n  const next: AglynPostalAddress = {}\n  const line1 = clean(address.line1)\n  const line2 = clean(address.line2)\n  const city = clean(address.city)\n  const state = clean(address.state)\n  const postalCode = clean(address.postalCode)\n  const country = clean(address.country).toUpperCase()\n  if (line1) next.line1 = line1\n  if (line2) next.line2 = line2\n  if (city) next.city = city\n  if (state) next.state = state\n  if (postalCode) next.postalCode = postalCode\n  // Only a real alpha-2 shape is stored; anything else is a typed country\n  // name and is worse than absent, because Stripe would reject the customer\n  // update and take the rest of the address down with it.\n  if (/^[A-Z]{2}$/.test(country)) next.country = country\n  return isBlankAddress(next) ? null : next\n}\n\n/**\n * Best-effort E.164 (`+15125550123`).\n *\n * Measured on production 2026-07-30: the one populated profile stored a bare\n * ten-digit US number with no country code — `5550107788` in the examples\n * below, standing in for the value actually measured. That is unusable for SMS\n * or for a Stripe customer, and it is what \"phone already exists but is stored\n * unnormalized\" in AGL-1133 refers to.\n *\n * `defaultCountry` only applies to a number with NO country code of its own,\n * and only US/CA (+1) are inferred — guessing a country for a bare national\n * number anywhere else silently invents a different subscriber.\n *\n * @returns E.164, or `null` when the input cannot be normalized confidently.\n *          Never a partially-cleaned string: a half-normalized phone is the\n *          same bug in a new format.\n */\nexport function normalizePhone(\n  input: string | null | undefined,\n  defaultCountry = 'US',\n): string | null {\n  const raw = String(input ?? '').trim()\n  if (!raw) return null\n  // A leading + is the user telling us the country; keep it and just strip\n  // the punctuation humans put in numbers.\n  if (raw.startsWith('+')) {\n    const digits = raw.slice(1).replace(/\\D/g, '')\n    // E.164 allows at most 15 digits, and a country code is at least 1 —\n    // 8 is below any real international number and signals a typo.\n    return digits.length >= 8 && digits.length <= 15 ? `+${digits}` : null\n  }\n  const digits = raw.replace(/\\D/g, '')\n  if (!digits) return null\n  const inferable = defaultCountry === 'US' || defaultCountry === 'CA'\n  if (!inferable) return null\n  // 10 digits is NANP without the country code; 11 starting with 1 is with it.\n  if (digits.length === 10) return `+1${digits}`\n  if (digits.length === 11 && digits.startsWith('1')) return `+${digits}`\n  return null\n}\n"],"names":["isBlankAddress","address","some","key","String","trim","normalizeAddress","clean","value","next","line1","line2","city","state","postalCode","country","toUpperCase","test","normalizePhone","input","defaultCountry","raw","startsWith","digits","slice","replace","length","inferable"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;CAaC,GAiBD,sDAAsD,GACtD,OAAO,SAASA,eACdC,OAA8C;IAE9C,IAAI,CAACA,SAAS,OAAO;IACrB,OAAO,CAAC,AACN;QAAC;QAAS;QAAS;QAAQ;QAAS;QAAc;KAAU,CAC5DC,IAAI,CAAC,CAACC;YAAeF;eAAPG,QAAOH,eAAAA,OAAO,CAACE,IAAI,YAAZF,eAAgB,IAAII,IAAI;;AACjD;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,iBACdL,OAA8C;IAE9C,IAAI,CAACA,SAAS,OAAO;IACrB,MAAMM,QAAQ,CAACC,QAAmBJ,OAAOI,gBAAAA,QAAS,IAAIH,IAAI;IAC1D,MAAMI,OAA2B,CAAC;IAClC,MAAMC,QAAQH,MAAMN,QAAQS,KAAK;IACjC,MAAMC,QAAQJ,MAAMN,QAAQU,KAAK;IACjC,MAAMC,OAAOL,MAAMN,QAAQW,IAAI;IAC/B,MAAMC,QAAQN,MAAMN,QAAQY,KAAK;IACjC,MAAMC,aAAaP,MAAMN,QAAQa,UAAU;IAC3C,MAAMC,UAAUR,MAAMN,QAAQc,OAAO,EAAEC,WAAW;IAClD,IAAIN,OAAOD,KAAKC,KAAK,GAAGA;IACxB,IAAIC,OAAOF,KAAKE,KAAK,GAAGA;IACxB,IAAIC,MAAMH,KAAKG,IAAI,GAAGA;IACtB,IAAIC,OAAOJ,KAAKI,KAAK,GAAGA;IACxB,IAAIC,YAAYL,KAAKK,UAAU,GAAGA;IAClC,wEAAwE;IACxE,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,aAAaG,IAAI,CAACF,UAAUN,KAAKM,OAAO,GAAGA;IAC/C,OAAOf,eAAeS,QAAQ,OAAOA;AACvC;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASS,eACdC,KAAgC,EAChCC,iBAAiB,IAAI;IAErB,MAAMC,MAAMjB,OAAOe,gBAAAA,QAAS,IAAId,IAAI;IACpC,IAAI,CAACgB,KAAK,OAAO;IACjB,yEAAyE;IACzE,yCAAyC;IACzC,IAAIA,IAAIC,UAAU,CAAC,MAAM;QACvB,MAAMC,SAASF,IAAIG,KAAK,CAAC,GAAGC,OAAO,CAAC,OAAO;QAC3C,qEAAqE;QACrE,+DAA+D;QAC/D,OAAOF,OAAOG,MAAM,IAAI,KAAKH,OAAOG,MAAM,IAAI,KAAK,CAAC,CAAC,EAAEH,QAAQ,GAAG;IACpE;IACA,MAAMA,SAASF,IAAII,OAAO,CAAC,OAAO;IAClC,IAAI,CAACF,QAAQ,OAAO;IACpB,MAAMI,YAAYP,mBAAmB,QAAQA,mBAAmB;IAChE,IAAI,CAACO,WAAW,OAAO;IACvB,6EAA6E;IAC7E,IAAIJ,OAAOG,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,EAAEH,QAAQ;IAC9C,IAAIA,OAAOG,MAAM,KAAK,MAAMH,OAAOD,UAAU,CAAC,MAAM,OAAO,CAAC,CAAC,EAAEC,QAAQ;IACvE,OAAO;AACT"}

package/src/lib/foundation/definitions/host-content-collections.d.ts

@@ -0,0 +1,137 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Which host subcollections the media usage scan reads (AGL-1867).
+ *
+ * ## Why this exists, and why it is shaped the way it is
+ *
+ * `scanMediaReferences` answers "what uses this asset" immediately before an
+ * author deletes it, and every way it can be wrong points at "unused". AGL-1413
+ * closed the screen/layout/component/host-field half. AGL-1867 closed emails.
+ * What was left was plugin-owned content: a commerce product carries `imageUrl`
+ * and `mediaUrls`, so a product photo used nowhere else reported as unused, and
+ * the panel said so with a straight face.
+ *
+ * An earlier pass at this issue concluded the gap could not be closed by hand,
+ * because closing it looked like classifying fifty-odd collection names as
+ * media-bearing or not — "a large list of guesses dressed as decisions, and the
+ * first stale entry is where the next hole hides". That reasoning was right
+ * about the hazard and wrong about the shape of the fix. The classification it
+ * feared is only necessary if the default is NOT to scan. So the default here
+ * is inverted:
+ *
+ * **Every host subcollection is scanned unless it is named below with a
+ * reason it is not.**
+ *
+ * That turns the open question from "does this carry media?" — which needs a
+ * judgement about a schema nobody wrote down — into "is scanning this wasteful
+ * or wrong?", which is answerable from the collection's own volume and who
+ * writes it. It also puts the failure on the safe side: a collection nobody has
+ * thought about is READ, so a plugin shipping a new media-bearing collection is
+ * covered the day it lands rather than the day somebody remembers it.
+ *
+ * ## What keeps the list from rotting
+ *
+ * `host-content-media-coverage.spec.ts` sweeps `apps/**` and `libs/**` for host
+ * subcollection names — the same derived sweep
+ * `host-subcollection-write-deny-coverage.spec.ts` uses, for the same reason —
+ * and asserts {@link PLUGIN_CONTENT_COLLECTIONS} is EXACTLY that sweep minus
+ * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. A new
+ * collection fails the build with a one-line decision to make, and the default
+ * answer — add it to the scanned list — is also the safe one.
+ *
+ * ## The plugin boundary was NOT crossed to do this
+ *
+ * Worth stating, because "read plugin data into a first-party corpus" sounds
+ * like it should be. It is not, and the reason is that "plugin" means two
+ * disjoint things:
+ *
+ *  - a SANDBOXED marketplace plugin runs in an iframe on a separate origin and
+ *    has no Firestore access at all — `plugin-bridge.ts` is the whole protocol
+ *    and its guest verbs are `ready`, `resize`, `event`, `fetch-request` and
+ *    `error`, with `parseGuestMessage` rejecting anything else. It owns no
+ *    documents, so there is nothing here to reach into.
+ *  - a FIRST-PARTY feature plugin under `libs/plugins/*` is compiled into the
+ *    apps and writes ORDINARY host subcollections with the ordinary SDKs. Those
+ *    documents already sit under the same `hosts/{hostId}` rules as a screen,
+ *    are already read by first-party console pages, and are already covered by
+ *    the same scope check the scan runs before it reads anything.
+ *
+ * So the corpus grows to include documents the caller could already read
+ * through the console, under an authorization decision that has not changed.
+ * Nothing in the sandbox boundary is bypassed, because no sandboxed guest owns
+ * any of this.
+ */
+/**
+ * Host subcollections the media scan reads through its own dedicated machinery.
+ *
+ * Not "excluded" — covered, by a pass that knows their shape. Screens, layouts,
+ * components and email templates each hang a node tree off
+ * `…/versions/{versionId}` and get the published-version and history passes;
+ * `collections` is walked one level deeper, into `…/entries`.
+ */
+export declare const CORE_CONTENT_COLLECTIONS: readonly ["screens", "layouts", "components", "emailTemplates", "collections"];
+/**
+ * Host subcollections deliberately NOT read by the media scan, and why.
+ *
+ * Every entry has to answer one of two questions: what would scanning it cost,
+ * or what would scanning it get wrong. "It probably has no images in it" is not
+ * an accepted reason — that is the guess this file is arranged to avoid making.
+ */
+export declare const MEDIA_SCAN_EXCLUDED: Record<string, string>;
+/**
+ * Host subcollections the media scan reads generically.
+ *
+ * Generically: no per-collection field list and no per-collection decoder.
+ * Each document is flattened by `documentHaystack` — which decodes `nodes` and
+ * `elements` through `decodeStoredNodes` first, so a plugin that adopts the
+ * compressed storage form is covered without touching this file — and the
+ * matching field's dotted path is recovered by walking the document. A field
+ * list here would be the same staleness trap `referencingFieldPath` was written
+ * to avoid one level down.
+ *
+ * MUST equal the repo-wide host subcollection sweep minus
+ * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. The guard
+ * spec asserts exactly that, in both directions, so this list can neither miss
+ * a new collection nor keep naming a deleted one.
+ */
+export declare const PLUGIN_CONTENT_COLLECTIONS: readonly ["actions", "authors", "campaigns", "coupons", "discounts", "events", "experiments", "forms", "functions", "installs", "locations", "memberPosts", "overlays", "pluginSettings", "productCategories", "products", "redirects", "resources", "reviews", "services", "settings", "siteMembers", "suppliers", "templates", "variables", "webhooks", "workflows"];
+export type PluginContentCollection = (typeof PLUGIN_CONTENT_COLLECTIONS)[number];
+/**
+ * Console page slug a plugin-content reference row deep-links to.
+ *
+ * Optional on purpose, and deliberately not required for a collection to be
+ * scanned. A row with no destination still renders — as text rather than a
+ * link — and that is strictly better than the row not existing, which is the
+ * bug this issue is about. Requiring a slug would have made the deep link a
+ * precondition for coverage and quietly re-created the hole for every
+ * collection nobody had got round to routing.
+ *
+ * Keyed by collection, valued with the `[pluginSlug]` segment of
+ * `Route.HOST_PLUGIN`.
+ */
+export declare const PLUGIN_CONTENT_ROUTE_SLUG: Partial<Record<PluginContentCollection, string>>;
+/**
+ * What to call one of these in a reference row.
+ *
+ * Derived from the collection name rather than declared, so a newly scanned
+ * collection gets a readable label without a second list to keep in step —
+ * `productCategories` reads as "Product category". Singularised with the two
+ * rules English spells consistently enough to be worth automating; anything
+ * else keeps its name, which is a cosmetic miss rather than a coverage one.
+ */
+export declare function hostContentCollectionLabel(collection: string): string;

package/src/lib/foundation/definitions/host-content-collections.js

@@ -0,0 +1,219 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Which host subcollections the media usage scan reads (AGL-1867).
+ *
+ * ## Why this exists, and why it is shaped the way it is
+ *
+ * `scanMediaReferences` answers "what uses this asset" immediately before an
+ * author deletes it, and every way it can be wrong points at "unused". AGL-1413
+ * closed the screen/layout/component/host-field half. AGL-1867 closed emails.
+ * What was left was plugin-owned content: a commerce product carries `imageUrl`
+ * and `mediaUrls`, so a product photo used nowhere else reported as unused, and
+ * the panel said so with a straight face.
+ *
+ * An earlier pass at this issue concluded the gap could not be closed by hand,
+ * because closing it looked like classifying fifty-odd collection names as
+ * media-bearing or not — "a large list of guesses dressed as decisions, and the
+ * first stale entry is where the next hole hides". That reasoning was right
+ * about the hazard and wrong about the shape of the fix. The classification it
+ * feared is only necessary if the default is NOT to scan. So the default here
+ * is inverted:
+ *
+ * **Every host subcollection is scanned unless it is named below with a
+ * reason it is not.**
+ *
+ * That turns the open question from "does this carry media?" — which needs a
+ * judgement about a schema nobody wrote down — into "is scanning this wasteful
+ * or wrong?", which is answerable from the collection's own volume and who
+ * writes it. It also puts the failure on the safe side: a collection nobody has
+ * thought about is READ, so a plugin shipping a new media-bearing collection is
+ * covered the day it lands rather than the day somebody remembers it.
+ *
+ * ## What keeps the list from rotting
+ *
+ * `host-content-media-coverage.spec.ts` sweeps `apps/**` and `libs/**` for host
+ * subcollection names — the same derived sweep
+ * `host-subcollection-write-deny-coverage.spec.ts` uses, for the same reason —
+ * and asserts {@link PLUGIN_CONTENT_COLLECTIONS} is EXACTLY that sweep minus
+ * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. A new
+ * collection fails the build with a one-line decision to make, and the default
+ * answer — add it to the scanned list — is also the safe one.
+ *
+ * ## The plugin boundary was NOT crossed to do this
+ *
+ * Worth stating, because "read plugin data into a first-party corpus" sounds
+ * like it should be. It is not, and the reason is that "plugin" means two
+ * disjoint things:
+ *
+ *  - a SANDBOXED marketplace plugin runs in an iframe on a separate origin and
+ *    has no Firestore access at all — `plugin-bridge.ts` is the whole protocol
+ *    and its guest verbs are `ready`, `resize`, `event`, `fetch-request` and
+ *    `error`, with `parseGuestMessage` rejecting anything else. It owns no
+ *    documents, so there is nothing here to reach into.
+ *  - a FIRST-PARTY feature plugin under `libs/plugins/*` is compiled into the
+ *    apps and writes ORDINARY host subcollections with the ordinary SDKs. Those
+ *    documents already sit under the same `hosts/{hostId}` rules as a screen,
+ *    are already read by first-party console pages, and are already covered by
+ *    the same scope check the scan runs before it reads anything.
+ *
+ * So the corpus grows to include documents the caller could already read
+ * through the console, under an authorization decision that has not changed.
+ * Nothing in the sandbox boundary is bypassed, because no sandboxed guest owns
+ * any of this.
+ */ /**
+ * Host subcollections the media scan reads through its own dedicated machinery.
+ *
+ * Not "excluded" — covered, by a pass that knows their shape. Screens, layouts,
+ * components and email templates each hang a node tree off
+ * `…/versions/{versionId}` and get the published-version and history passes;
+ * `collections` is walked one level deeper, into `…/entries`.
+ */ export const CORE_CONTENT_COLLECTIONS = [
+    'screens',
+    'layouts',
+    'components',
+    'emailTemplates',
+    'collections'
+];
+/**
+ * Host subcollections deliberately NOT read by the media scan, and why.
+ *
+ * Every entry has to answer one of two questions: what would scanning it cost,
+ * or what would scanning it get wrong. "It probably has no images in it" is not
+ * an accepted reason — that is the guess this file is arranged to avoid making.
+ */ export const MEDIA_SCAN_EXCLUDED = {
+    // ── Scanning these would be WRONG, not merely expensive ────────────────
+    media: 'The library itself. The asset under audit IS a document in here, and its ' + 'own record holds its own url, cdnPath and storage path — every needle ' + 'the scan carries. Reading this collection would report every asset as ' + 'referencing itself, which turns a deletion-safety control into noise ' + 'that nobody reads.',
+    mediaFolders: 'Folder records: a name, a parent pointer and a scope. A folder never ' + 'holds an asset reference, and it is not a dependent either — deleting a ' + 'file does not break the folder it sat in.',
+    emailCampaigns: 'The campaign CONTAINER — a name, a date window, the list ids it is ' + 'aimed at and a topic. Distinct from `campaigns`, which holds the sends ' + 'and IS scanned because a send carries the copy that went out. A ' + 'container carries no copy and no asset reference: the design a send ' + 'renders is a screen, and the screen is where the picker writes.',
+    // ── Machine-written telemetry: unbounded, and no author picks into it ──
+    analytics: 'Per-day traffic rollups written by the tenant collector. One document ' + 'per day per site forever, no author-editable field, and no surface that ' + 'can pick an asset into one.',
+    screenAnalytics: 'Per-screen traffic history behind the Pro+ panel, written by the same ' + 'collector on the same unbounded per-day cadence.',
+    counters: 'Quota and usage counters, server-owned (AGL-1367) and denied to client ' + 'writes outright. Numbers, not content.',
+    activity: 'The site activity feed — an append-only audit log the console writes a ' + 'row into on every change. Unbounded by design, and a row that quotes an ' + 'asset id is a record that somebody touched it, not a place it is used.',
+    // ── Transaction and ledger rows: unbounded, and a SNAPSHOT is not a use ─
+    orders: 'Completed orders. Line items COPY a product\'s `imageUrl` at purchase ' + 'time, so these would match — and matching would be the wrong answer: an ' + 'order is an immutable record of what was sold, deleting the asset ' + 'changes nothing about it, and no author can edit one. A busy store also ' + 'holds more of these than the whole read budget.',
+    carts: 'Live and abandoned carts, with the same copied line-item image and the ' + 'same reasoning, at higher volume — one document per shopper session.',
+    checkouts: 'In-flight checkout sessions. Transient buyer state carrying the same ' + 'line-item snapshot as `carts`.',
+    formSubmissions: 'Visitor form submissions. Unbounded, PII-heavy, and a file attached to ' + 'one is the visitor\'s upload — not a library asset an author picked, and ' + 'not something deleting a library asset would break.',
+    leads: 'Captured leads, on the same footing as `formSubmissions`: visitor-' + 'submitted, unbounded, and never a place an author places an asset.',
+    bookings: 'Booking records — a customer, a time and a service pointer. The service ' + 'holds the imagery and IS scanned; a booking is the transaction against ' + 'it.',
+    campaignAttributions: 'One row per conversion — a form submission, a lead, a contact or a ' + 'booking — recording which campaign the visitor arrived from. Written ' + 'only by the Admin SDK, and the whole record is three sanitized UTM ' + 'strings capped at a hundred characters: there is no field an asset ' + 'could occupy and no surface that could pick one into it. Unbounded on ' + 'the same footing as the conversions it credits.',
+    reservations: 'POS and booking holds. Short-lived transaction rows pointing at a ' + 'resource that is itself scanned.',
+    stockHolds: 'Inventory holds taken during checkout. Machine-written, short-lived, ' + 'and a quantity rather than content.',
+    subscriptions: 'Site membership subscriptions: a plan pointer, a status and Stripe ' + 'ids. Server-written from the billing webhook.',
+    registers: 'POS register allocations — a count against the register add-on, read by ' + 'billing (AGL-1775). No content field at all.',
+    giftCards: 'Gift card balances and redemption history. Money, not content.',
+    licenseKeys: 'Digital-product license keys issued at fulfilment: a code, an order ' + 'pointer and a revocation flag.',
+    inventoryAdjustments: 'The append-only stock adjustment ledger (AGL-2269). One row per manual ' + 'stock edit and per cancellation release, unbounded over a store\'s life.',
+    inventoryReconciliation: 'Reconciliation runs comparing counted stock against recorded stock. ' + 'Machine-written totals.',
+    restockAlerts: 'Back-in-stock requests: an email address and a product pointer, written ' + 'by visitors.',
+    suppressions: 'Unsubscribes, bounces and spam complaints. Email addresses and a ' + 'reason.',
+    stripeTaxRates: 'Cached Stripe tax rate ids, written by the tax sync. Vendor ids.',
+    members: 'The ORG-facing member roster mirrored onto the site, server-owned ' + '(AGL-1367). A member\'s photo is their own account photo, uploaded ' + 'through /api/account/photo and stored outside any site\'s library, so it ' + 'is not an asset this scan can be asked about.'
+};
+/**
+ * Host subcollections the media scan reads generically.
+ *
+ * Generically: no per-collection field list and no per-collection decoder.
+ * Each document is flattened by `documentHaystack` — which decodes `nodes` and
+ * `elements` through `decodeStoredNodes` first, so a plugin that adopts the
+ * compressed storage form is covered without touching this file — and the
+ * matching field's dotted path is recovered by walking the document. A field
+ * list here would be the same staleness trap `referencingFieldPath` was written
+ * to avoid one level down.
+ *
+ * MUST equal the repo-wide host subcollection sweep minus
+ * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. The guard
+ * spec asserts exactly that, in both directions, so this list can neither miss
+ * a new collection nor keep naming a deleted one.
+ */ export const PLUGIN_CONTENT_COLLECTIONS = [
+    'actions',
+    'authors',
+    'campaigns',
+    'coupons',
+    'discounts',
+    'events',
+    'experiments',
+    'forms',
+    'functions',
+    'installs',
+    'locations',
+    'memberPosts',
+    'overlays',
+    'pluginSettings',
+    'productCategories',
+    'products',
+    'redirects',
+    'resources',
+    'reviews',
+    'services',
+    'settings',
+    'siteMembers',
+    'suppliers',
+    'templates',
+    'variables',
+    'webhooks',
+    'workflows'
+];
+/**
+ * Console page slug a plugin-content reference row deep-links to.
+ *
+ * Optional on purpose, and deliberately not required for a collection to be
+ * scanned. A row with no destination still renders — as text rather than a
+ * link — and that is strictly better than the row not existing, which is the
+ * bug this issue is about. Requiring a slug would have made the deep link a
+ * precondition for coverage and quietly re-created the hole for every
+ * collection nobody had got round to routing.
+ *
+ * Keyed by collection, valued with the `[pluginSlug]` segment of
+ * `Route.HOST_PLUGIN`.
+ */ export const PLUGIN_CONTENT_ROUTE_SLUG = {
+    products: 'products',
+    productCategories: 'products',
+    suppliers: 'products',
+    locations: 'products',
+    coupons: 'products',
+    discounts: 'products',
+    reviews: 'products',
+    memberPosts: 'products',
+    events: 'events',
+    services: 'bookings',
+    resources: 'bookings',
+    redirects: 'redirects',
+    campaigns: 'marketing',
+    experiments: 'marketing',
+    workflows: 'workflows',
+    webhooks: 'workflows',
+    functions: 'logic',
+    variables: 'logic',
+    actions: 'logic'
+};
+/**
+ * What to call one of these in a reference row.
+ *
+ * Derived from the collection name rather than declared, so a newly scanned
+ * collection gets a readable label without a second list to keep in step —
+ * `productCategories` reads as "Product category". Singularised with the two
+ * rules English spells consistently enough to be worth automating; anything
+ * else keeps its name, which is a cosmetic miss rather than a coverage one.
+ */ export function hostContentCollectionLabel(collection) {
+    const singular = /ies$/.test(collection) ? collection.replace(/ies$/, 'y') : /(ss|s)$/.test(collection) ? collection.replace(/s$/, '') : collection;
+    const spaced = singular.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase();
+    return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+
+//# sourceMappingURL=host-content-collections.js.map

package/src/lib/foundation/definitions/host-content-collections.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/aglyn/src/lib/foundation/definitions/host-content-collections.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Which host subcollections the media usage scan reads (AGL-1867).\n *\n * ## Why this exists, and why it is shaped the way it is\n *\n * `scanMediaReferences` answers \"what uses this asset\" immediately before an\n * author deletes it, and every way it can be wrong points at \"unused\". AGL-1413\n * closed the screen/layout/component/host-field half. AGL-1867 closed emails.\n * What was left was plugin-owned content: a commerce product carries `imageUrl`\n * and `mediaUrls`, so a product photo used nowhere else reported as unused, and\n * the panel said so with a straight face.\n *\n * An earlier pass at this issue concluded the gap could not be closed by hand,\n * because closing it looked like classifying fifty-odd collection names as\n * media-bearing or not — \"a large list of guesses dressed as decisions, and the\n * first stale entry is where the next hole hides\". That reasoning was right\n * about the hazard and wrong about the shape of the fix. The classification it\n * feared is only necessary if the default is NOT to scan. So the default here\n * is inverted:\n *\n * **Every host subcollection is scanned unless it is named below with a\n * reason it is not.**\n *\n * That turns the open question from \"does this carry media?\" — which needs a\n * judgement about a schema nobody wrote down — into \"is scanning this wasteful\n * or wrong?\", which is answerable from the collection's own volume and who\n * writes it. It also puts the failure on the safe side: a collection nobody has\n * thought about is READ, so a plugin shipping a new media-bearing collection is\n * covered the day it lands rather than the day somebody remembers it.\n *\n * ## What keeps the list from rotting\n *\n * `host-content-media-coverage.spec.ts` sweeps `apps/**` and `libs/**` for host\n * subcollection names — the same derived sweep\n * `host-subcollection-write-deny-coverage.spec.ts` uses, for the same reason —\n * and asserts {@link PLUGIN_CONTENT_COLLECTIONS} is EXACTLY that sweep minus\n * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. A new\n * collection fails the build with a one-line decision to make, and the default\n * answer — add it to the scanned list — is also the safe one.\n *\n * ## The plugin boundary was NOT crossed to do this\n *\n * Worth stating, because \"read plugin data into a first-party corpus\" sounds\n * like it should be. It is not, and the reason is that \"plugin\" means two\n * disjoint things:\n *\n *  - a SANDBOXED marketplace plugin runs in an iframe on a separate origin and\n *    has no Firestore access at all — `plugin-bridge.ts` is the whole protocol\n *    and its guest verbs are `ready`, `resize`, `event`, `fetch-request` and\n *    `error`, with `parseGuestMessage` rejecting anything else. It owns no\n *    documents, so there is nothing here to reach into.\n *  - a FIRST-PARTY feature plugin under `libs/plugins/*` is compiled into the\n *    apps and writes ORDINARY host subcollections with the ordinary SDKs. Those\n *    documents already sit under the same `hosts/{hostId}` rules as a screen,\n *    are already read by first-party console pages, and are already covered by\n *    the same scope check the scan runs before it reads anything.\n *\n * So the corpus grows to include documents the caller could already read\n * through the console, under an authorization decision that has not changed.\n * Nothing in the sandbox boundary is bypassed, because no sandboxed guest owns\n * any of this.\n */\n\n/**\n * Host subcollections the media scan reads through its own dedicated machinery.\n *\n * Not \"excluded\" — covered, by a pass that knows their shape. Screens, layouts,\n * components and email templates each hang a node tree off\n * `…/versions/{versionId}` and get the published-version and history passes;\n * `collections` is walked one level deeper, into `…/entries`.\n */\nexport const CORE_CONTENT_COLLECTIONS = [\n  'screens',\n  'layouts',\n  'components',\n  'emailTemplates',\n  'collections',\n] as const\n\n/**\n * Host subcollections deliberately NOT read by the media scan, and why.\n *\n * Every entry has to answer one of two questions: what would scanning it cost,\n * or what would scanning it get wrong. \"It probably has no images in it\" is not\n * an accepted reason — that is the guess this file is arranged to avoid making.\n */\nexport const MEDIA_SCAN_EXCLUDED: Record<string, string> = {\n  // ── Scanning these would be WRONG, not merely expensive ────────────────\n  media:\n    'The library itself. The asset under audit IS a document in here, and its ' +\n    'own record holds its own url, cdnPath and storage path — every needle ' +\n    'the scan carries. Reading this collection would report every asset as ' +\n    'referencing itself, which turns a deletion-safety control into noise ' +\n    'that nobody reads.',\n  mediaFolders:\n    'Folder records: a name, a parent pointer and a scope. A folder never ' +\n    'holds an asset reference, and it is not a dependent either — deleting a ' +\n    'file does not break the folder it sat in.',\n  emailCampaigns:\n    'The campaign CONTAINER — a name, a date window, the list ids it is ' +\n    'aimed at and a topic. Distinct from `campaigns`, which holds the sends ' +\n    'and IS scanned because a send carries the copy that went out. A ' +\n    'container carries no copy and no asset reference: the design a send ' +\n    'renders is a screen, and the screen is where the picker writes.',\n\n  // ── Machine-written telemetry: unbounded, and no author picks into it ──\n  analytics:\n    'Per-day traffic rollups written by the tenant collector. One document ' +\n    'per day per site forever, no author-editable field, and no surface that ' +\n    'can pick an asset into one.',\n  screenAnalytics:\n    'Per-screen traffic history behind the Pro+ panel, written by the same ' +\n    'collector on the same unbounded per-day cadence.',\n  counters:\n    'Quota and usage counters, server-owned (AGL-1367) and denied to client ' +\n    'writes outright. Numbers, not content.',\n  activity:\n    'The site activity feed — an append-only audit log the console writes a ' +\n    'row into on every change. Unbounded by design, and a row that quotes an ' +\n    'asset id is a record that somebody touched it, not a place it is used.',\n\n  // ── Transaction and ledger rows: unbounded, and a SNAPSHOT is not a use ─\n  orders:\n    'Completed orders. Line items COPY a product\\'s `imageUrl` at purchase ' +\n    'time, so these would match — and matching would be the wrong answer: an ' +\n    'order is an immutable record of what was sold, deleting the asset ' +\n    'changes nothing about it, and no author can edit one. A busy store also ' +\n    'holds more of these than the whole read budget.',\n  carts:\n    'Live and abandoned carts, with the same copied line-item image and the ' +\n    'same reasoning, at higher volume — one document per shopper session.',\n  checkouts:\n    'In-flight checkout sessions. Transient buyer state carrying the same ' +\n    'line-item snapshot as `carts`.',\n  formSubmissions:\n    'Visitor form submissions. Unbounded, PII-heavy, and a file attached to ' +\n    'one is the visitor\\'s upload — not a library asset an author picked, and ' +\n    'not something deleting a library asset would break.',\n  leads:\n    'Captured leads, on the same footing as `formSubmissions`: visitor-' +\n    'submitted, unbounded, and never a place an author places an asset.',\n  bookings:\n    'Booking records — a customer, a time and a service pointer. The service ' +\n    'holds the imagery and IS scanned; a booking is the transaction against ' +\n    'it.',\n  campaignAttributions:\n    'One row per conversion — a form submission, a lead, a contact or a ' +\n    'booking — recording which campaign the visitor arrived from. Written ' +\n    'only by the Admin SDK, and the whole record is three sanitized UTM ' +\n    'strings capped at a hundred characters: there is no field an asset ' +\n    'could occupy and no surface that could pick one into it. Unbounded on ' +\n    'the same footing as the conversions it credits.',\n  reservations:\n    'POS and booking holds. Short-lived transaction rows pointing at a ' +\n    'resource that is itself scanned.',\n  stockHolds:\n    'Inventory holds taken during checkout. Machine-written, short-lived, ' +\n    'and a quantity rather than content.',\n  subscriptions:\n    'Site membership subscriptions: a plan pointer, a status and Stripe ' +\n    'ids. Server-written from the billing webhook.',\n  registers:\n    'POS register allocations — a count against the register add-on, read by ' +\n    'billing (AGL-1775). No content field at all.',\n  giftCards:\n    'Gift card balances and redemption history. Money, not content.',\n  licenseKeys:\n    'Digital-product license keys issued at fulfilment: a code, an order ' +\n    'pointer and a revocation flag.',\n  inventoryAdjustments:\n    'The append-only stock adjustment ledger (AGL-2269). One row per manual ' +\n    'stock edit and per cancellation release, unbounded over a store\\'s life.',\n  inventoryReconciliation:\n    'Reconciliation runs comparing counted stock against recorded stock. ' +\n    'Machine-written totals.',\n  restockAlerts:\n    'Back-in-stock requests: an email address and a product pointer, written ' +\n    'by visitors.',\n  suppressions:\n    'Unsubscribes, bounces and spam complaints. Email addresses and a ' +\n    'reason.',\n  stripeTaxRates:\n    'Cached Stripe tax rate ids, written by the tax sync. Vendor ids.',\n  members:\n    'The ORG-facing member roster mirrored onto the site, server-owned ' +\n    '(AGL-1367). A member\\'s photo is their own account photo, uploaded ' +\n    'through /api/account/photo and stored outside any site\\'s library, so it ' +\n    'is not an asset this scan can be asked about.',\n}\n\n/**\n * Host subcollections the media scan reads generically.\n *\n * Generically: no per-collection field list and no per-collection decoder.\n * Each document is flattened by `documentHaystack` — which decodes `nodes` and\n * `elements` through `decodeStoredNodes` first, so a plugin that adopts the\n * compressed storage form is covered without touching this file — and the\n * matching field's dotted path is recovered by walking the document. A field\n * list here would be the same staleness trap `referencingFieldPath` was written\n * to avoid one level down.\n *\n * MUST equal the repo-wide host subcollection sweep minus\n * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. The guard\n * spec asserts exactly that, in both directions, so this list can neither miss\n * a new collection nor keep naming a deleted one.\n */\nexport const PLUGIN_CONTENT_COLLECTIONS = [\n  'actions',\n  'authors',\n  'campaigns',\n  'coupons',\n  'discounts',\n  'events',\n  'experiments',\n  'forms',\n  'functions',\n  'installs',\n  'locations',\n  'memberPosts',\n  'overlays',\n  'pluginSettings',\n  'productCategories',\n  'products',\n  'redirects',\n  'resources',\n  'reviews',\n  'services',\n  'settings',\n  'siteMembers',\n  'suppliers',\n  'templates',\n  'variables',\n  'webhooks',\n  'workflows',\n] as const\n\nexport type PluginContentCollection =\n  (typeof PLUGIN_CONTENT_COLLECTIONS)[number]\n\n/**\n * Console page slug a plugin-content reference row deep-links to.\n *\n * Optional on purpose, and deliberately not required for a collection to be\n * scanned. A row with no destination still renders — as text rather than a\n * link — and that is strictly better than the row not existing, which is the\n * bug this issue is about. Requiring a slug would have made the deep link a\n * precondition for coverage and quietly re-created the hole for every\n * collection nobody had got round to routing.\n *\n * Keyed by collection, valued with the `[pluginSlug]` segment of\n * `Route.HOST_PLUGIN`.\n */\nexport const PLUGIN_CONTENT_ROUTE_SLUG: Partial<\n  Record<PluginContentCollection, string>\n> = {\n  products: 'products',\n  productCategories: 'products',\n  suppliers: 'products',\n  locations: 'products',\n  coupons: 'products',\n  discounts: 'products',\n  reviews: 'products',\n  memberPosts: 'products',\n  events: 'events',\n  services: 'bookings',\n  resources: 'bookings',\n  redirects: 'redirects',\n  campaigns: 'marketing',\n  experiments: 'marketing',\n  workflows: 'workflows',\n  webhooks: 'workflows',\n  functions: 'logic',\n  variables: 'logic',\n  actions: 'logic',\n}\n\n/**\n * What to call one of these in a reference row.\n *\n * Derived from the collection name rather than declared, so a newly scanned\n * collection gets a readable label without a second list to keep in step —\n * `productCategories` reads as \"Product category\". Singularised with the two\n * rules English spells consistently enough to be worth automating; anything\n * else keeps its name, which is a cosmetic miss rather than a coverage one.\n */\nexport function hostContentCollectionLabel(collection: string): string {\n  const singular = /ies$/.test(collection)\n    ? collection.replace(/ies$/, 'y')\n    : /(ss|s)$/.test(collection)\n      ? collection.replace(/s$/, '')\n      : collection\n  const spaced = singular.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase()\n  return spaced.charAt(0).toUpperCase() + spaced.slice(1)\n}\n"],"names":["CORE_CONTENT_COLLECTIONS","MEDIA_SCAN_EXCLUDED","media","mediaFolders","emailCampaigns","analytics","screenAnalytics","counters","activity","orders","carts","checkouts","formSubmissions","leads","bookings","campaignAttributions","reservations","stockHolds","subscriptions","registers","giftCards","licenseKeys","inventoryAdjustments","inventoryReconciliation","restockAlerts","suppressions","stripeTaxRates","members","PLUGIN_CONTENT_COLLECTIONS","PLUGIN_CONTENT_ROUTE_SLUG","products","productCategories","suppliers","locations","coupons","discounts","reviews","memberPosts","events","services","resources","redirects","campaigns","experiments","workflows","webhooks","functions","variables","actions","hostContentCollectionLabel","collection","singular","test","replace","spaced","toLowerCase","charAt","toUpperCase","slice"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DC,GAED;;;;;;;CAOC,GACD,OAAO,MAAMA,2BAA2B;IACtC;IACA;IACA;IACA;IACA;CACD,CAAS;AAEV;;;;;;CAMC,GACD,OAAO,MAAMC,sBAA8C;IACzD,0EAA0E;IAC1EC,OACE,8EACA,2EACA,2EACA,0EACA;IACFC,cACE,0EACA,6EACA;IACFC,gBACE,wEACA,4EACA,qEACA,yEACA;IAEF,0EAA0E;IAC1EC,WACE,2EACA,6EACA;IACFC,iBACE,2EACA;IACFC,UACE,4EACA;IACFC,UACE,4EACA,6EACA;IAEF,2EAA2E;IAC3EC,QACE,2EACA,6EACA,uEACA,6EACA;IACFC,OACE,4EACA;IACFC,WACE,0EACA;IACFC,iBACE,4EACA,8EACA;IACFC,OACE,uEACA;IACFC,UACE,6EACA,4EACA;IACFC,sBACE,wEACA,0EACA,wEACA,wEACA,2EACA;IACFC,cACE,uEACA;IACFC,YACE,0EACA;IACFC,eACE,wEACA;IACFC,WACE,6EACA;IACFC,WACE;IACFC,aACE,yEACA;IACFC,sBACE,4EACA;IACFC,yBACE,yEACA;IACFC,eACE,6EACA;IACFC,cACE,sEACA;IACFC,gBACE;IACFC,SACE,uEACA,wEACA,8EACA;AACJ,EAAC;AAED;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,6BAA6B;IACxC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AAKV;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,4BAET;IACFC,UAAU;IACVC,mBAAmB;IACnBC,WAAW;IACXC,WAAW;IACXC,SAAS;IACTC,WAAW;IACXC,SAAS;IACTC,aAAa;IACbC,QAAQ;IACRC,UAAU;IACVC,WAAW;IACXC,WAAW;IACXC,WAAW;IACXC,aAAa;IACbC,WAAW;IACXC,UAAU;IACVC,WAAW;IACXC,WAAW;IACXC,SAAS;AACX,EAAC;AAED;;;;;;;;CAQC,GACD,OAAO,SAASC,2BAA2BC,UAAkB;IAC3D,MAAMC,WAAW,OAAOC,IAAI,CAACF,cACzBA,WAAWG,OAAO,CAAC,QAAQ,OAC3B,UAAUD,IAAI,CAACF,cACbA,WAAWG,OAAO,CAAC,MAAM,MACzBH;IACN,MAAMI,SAASH,SAASE,OAAO,CAAC,sBAAsB,SAASE,WAAW;IAC1E,OAAOD,OAAOE,MAAM,CAAC,GAAGC,WAAW,KAAKH,OAAOI,KAAK,CAAC;AACvD"}