@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/dmca-counter-notice.d.ts

@@ -0,0 +1,185 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Firestore collection holding counter-notices. Staff-read, Admin-SDK-written. */
+export declare const DMCA_COUNTER_NOTICE_COLLECTION = "dmcaCounterNotices";
+/**
+ * Business days from receipt to automatic restoration.
+ *
+ * Inside §512(g)(2)(C)'s 10-to-14 window with room for holidays at both ends.
+ * See the module comment for why the middle of the window is the safe target
+ * for a weekend-only counter.
+ */
+export declare const COUNTER_NOTICE_RESTORE_BUSINESS_DAYS = 12;
+/** The statutory floor, kept for the record we show staff and the complainant. */
+export declare const COUNTER_NOTICE_MIN_BUSINESS_DAYS = 10;
+/** The statutory ceiling. Restoration later than this is its own violation. */
+export declare const COUNTER_NOTICE_MAX_BUSINESS_DAYS = 14;
+/** Maximum characters of subscriber prose stored. */
+export declare const COUNTER_NOTICE_MAX_DETAILS = 5000;
+/** Maximum length of a contact field. */
+export declare const COUNTER_NOTICE_MAX_CONTACT = 254;
+/** Maximum length of the postal address — a jurisdiction fact, not free text. */
+export declare const COUNTER_NOTICE_MAX_ADDRESS = 1000;
+/**
+ * The workflow states a counter-notice moves through.
+ *
+ * `received` → `forwarded` is the §512(g)(2)(A) obligation discharged, and it
+ * is the transition that starts the clock in the record. `restored` is the
+ * put-back having happened; `withdrawn` is the subscriber taking it back;
+ * `suitFiled` is the one lawful reason NOT to restore — the complainant told
+ * us they went to court, and the material stays down.
+ *
+ * `rejected` exists for a submission that is not a counter-notice at all
+ * (blank statutory elements survive validation only as a malformed row, and a
+ * mis-filed support question does not belong in a legal queue). It is
+ * deliberately NOT a merits judgement, and the staff surface says so.
+ */
+export declare const COUNTER_NOTICE_STATUSES: readonly ["received", "forwarded", "restored", "suitFiled", "withdrawn", "rejected"];
+export type CounterNoticeStatus = (typeof COUNTER_NOTICE_STATUSES)[number];
+export declare function isCounterNoticeStatus(value: unknown): value is CounterNoticeStatus;
+/**
+ * The statuses that mean this counter-notice will NOT lead to a restoration.
+ *
+ * Named rather than open-coded because two different places have to agree
+ * about it: the clock (which must not keep counting toward a put-back that is
+ * never coming) and the strike ledger (which must not go on suppressing a
+ * strike the subscriber withdrew).
+ */
+export declare const COUNTER_NOTICE_TERMINAL_STATUSES: readonly CounterNoticeStatus[];
+/**
+ * The §512(g)(3) elements, after validation.
+ *
+ * Each field is one of the statute's four subparagraphs, and the names say
+ * which. Collecting them as prose next to a tick-box is the ordinary web-form
+ * rendering of a sworn document — the same shape `AbuseReportDmcaAffirmations`
+ * takes for the notice on the other side.
+ */
+export interface CounterNoticeInput {
+    /** (A) Typed name standing as the electronic signature. */
+    signature: string;
+    /**
+     * (B) Identification of the material removed and where it appeared before
+     * removal. The URL is captured separately so staff can act on it directly.
+     */
+    material: string;
+    /** (B) The location the material appeared at, normalized to an http(s) URL. */
+    url: string;
+    /** Hostname of {@link url}, so the row can be joined to a host. */
+    reportedHostname: string;
+    /**
+     * Our own reference for the notice being answered (`AR-…`), when the
+     * subscriber has it. Optional: a subscriber who lost the email must still be
+     * able to file, and staff can match on the URL.
+     */
+    reference: string | null;
+    /** (D) Subscriber's legal name. */
+    name: string;
+    /** (D) Subscriber's postal address — the address that fixes the district. */
+    address: string;
+    /** (D) Subscriber's telephone number. */
+    phone: string;
+    /** Reply address. Not statutory, but the channel the procedure runs on. */
+    email: string;
+    /**
+     * (C) "Under penalty of perjury, I have a good faith belief the material was
+     * removed as a result of mistake or misidentification."
+     */
+    goodFaithMistake: boolean;
+    /**
+     * (D) Consent to the jurisdiction of the Federal District Court for the
+     * district of the given address — or, for a subscriber outside the United
+     * States, any district in which we may be found.
+     */
+    consentJurisdiction: boolean;
+    /** (D) Agreement to accept service of process from the complainant. */
+    acceptService: boolean;
+}
+export interface CounterNoticeValidationFailure {
+    ok: false;
+    /** Stable machine code, for tests and for the form to highlight a field. */
+    code: string;
+    /** Sentence shown to the subscriber. */
+    message: string;
+}
+export interface CounterNoticeValidationSuccess {
+    ok: true;
+    value: CounterNoticeInput;
+}
+export type CounterNoticeValidation = CounterNoticeValidationSuccess | CounterNoticeValidationFailure;
+/** `AR-XXXXXXXXXX` as minted by the abuse intake, or `null`. */
+export declare function normalizeNoticeReference(value: unknown): string | null;
+/**
+ * Validate and normalize a submitted counter-notice.
+ *
+ * Accepts the shape of BOTH a JSON body and a urlencoded no-JS form post.
+ *
+ * Unlike {@link validateAbuseReport}, the bar here is deliberately HIGH, and
+ * for the opposite reason to the one that keeps the notice bar low. A missing
+ * field on an abuse report costs us a report; a missing element on a
+ * counter-notice makes the document legally ineffective, so accepting it
+ * would be worse than refusing it — we would owe the complainant a forward
+ * and the subscriber a restoration on the strength of a paper that does not
+ * do what it has to do. Refusing tells the subscriber what to add while they
+ * are still in front of the form.
+ *
+ * The `normalizeUrl` dependency is injected rather than imported so this
+ * module does not reach across into the notice side for one function; the
+ * route hands it `normalizeReportedUrl`, which already refuses `javascript:`
+ * and `data:` for the stored-XSS reason recorded there.
+ */
+export declare function validateCounterNotice(payload: Record<string, unknown>, normalizeUrl: (value: unknown) => string | null, hostnameOf: (url: string) => string): CounterNoticeValidation;
+/** The three instants §512(g)(2)(C) defines, relative to receipt. */
+export interface CounterNoticeClock {
+    /** When we received the counter-notice. The statute counts from here. */
+    receivedAtMs: number;
+    /** The statutory floor — restoring before this is too early. */
+    earliestMs: number;
+    /** When we will actually restore access. */
+    restoreAtMs: number;
+    /** The statutory ceiling — restoring after this is too late. */
+    latestMs: number;
+}
+/**
+ * The put-back schedule for a counter-notice received at `receivedAtMs`.
+ *
+ * Returns all three boundaries rather than just the one we act on, because
+ * the other two are what let a staff surface — and, later, an argument —
+ * show that the instant we chose sits inside the window the statute drew,
+ * instead of asserting it.
+ */
+export declare function counterNoticeClock(receivedAtMs: number): CounterNoticeClock;
+/**
+ * Is this counter-notice still heading for a restoration?
+ *
+ * `false` for the three terminal statuses — the complainant went to court,
+ * the subscriber withdrew, or the submission was not a counter-notice. A
+ * `restored` row is also done: the put-back already happened, and a scheduler
+ * that kept acting on it would re-lift a suspension staff may have re-imposed
+ * for an entirely different reason.
+ *
+ * Returns a plain `boolean`, NOT a `status is CounterNoticeStatus` predicate,
+ * and the distinction is not cosmetic. This answers a question about a SUBSET
+ * of the statuses — `restored` is a perfectly valid `CounterNoticeStatus` and
+ * still gets `false` — so a type predicate here would be a lie the compiler
+ * believes: narrowing on it would hand a caller a type that includes the very
+ * values the function just rejected. `strictNullChecks` is off repo-wide,
+ * which already makes boolean-discriminant narrowing unreliable in this
+ * codebase; a predicate that is wrong even when narrowing DOES fire is worse
+ * than none. Callers ask this as a question and branch on the answer.
+ */
+export declare function counterNoticeAwaitsRestoration(status: unknown): boolean;
+export default validateCounterNotice;

package/src/lib/app-utils/dmca-counter-notice.js

@@ -0,0 +1,277 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * DMCA COUNTER-NOTICE — the put-back half of §512 (AGL-1983).
+ *
+ * AGL-1964 built the intake, so we can RECEIVE a copyright notice; AGL-1965
+ * made a host-scope takedown actually stick in Firestore rules, so we can
+ * ENFORCE one. Those two together are the dangerous shape: we could take a
+ * customer's site down and had no lawful way to put it back. §512(g) is the
+ * procedure that closes it, and it is also the thing that shields us from
+ * being sued by our own customer for the takedown we performed on somebody
+ * else's say-so.
+ *
+ * ## The clock is the feature
+ *
+ * §512(g)(2) is not "accept a form". It is a sequence with a deadline in it:
+ *
+ *  (A) promptly send the complainant a copy of the counter-notice and tell
+ *      them the material goes back up;
+ *  (B) put it back **not less than 10 nor more than 14 business days** after
+ *      receiving the counter-notice, UNLESS the complainant first tells us
+ *      they have filed an action seeking a court order.
+ *
+ * A counter-notice route that recorded a submission and left restoration to
+ * whoever next reads the queue is not that procedure — it is a form that
+ * makes us feel compliant while a customer stays locked out. So the artefact
+ * this module produces is a **scheduled reversal**: {@link counterNoticeClock}
+ * computes the two boundaries, and the caller stamps the restore instant onto
+ * the suspension's own `suspendedUntilMs` so the lock lifts itself.
+ *
+ * That is why AGL-1981 had to be fixed in the same pass. Until it was,
+ * `suspendedUntilMs` was honoured by the server-side lockdown helpers and
+ * ignored by Firestore rules — so a "restored" site would have come back,
+ * served traffic, and refused every client write, which is the whole
+ * authoring experience. Scheduling a restoration onto a mechanism that never
+ * fires is theatre, and it would have been indistinguishable from working
+ * right up until a customer tried to edit.
+ *
+ * ## Why 12 business days and not 10
+ *
+ * The statute gives a WINDOW, not an instant, and the window is the slack
+ * that makes an honest implementation possible. Counting business days by
+ * skipping weekends alone is simple and testable, but it treats a federal
+ * holiday as a working day — so a weekend-only count of 10 can land on fewer
+ * than 10 true business days, which is the one direction that is unlawful
+ * (restoring too early denies the complainant days the statute gives them).
+ *
+ * Rather than carry a holiday calendar that would need maintaining every
+ * year — and would be wrong for a year nobody updated — we target the middle
+ * of the window. A weekend-only count is always an OVER-estimate of true
+ * business days elapsed, never an under-estimate: holidays only ever remove
+ * working days. So:
+ *
+ *  - 12 weekend-only business days is at most 12 true business days, which is
+ *    inside the 14-day ceiling however the holidays fall;
+ *  - it is at least 10 true business days unless three or more federal
+ *    holidays fall inside one ~17-calendar-day span, which no pair of US
+ *    federal holidays is close enough to produce (the tightest is Dec 25 /
+ *    Jan 1, which is two).
+ *
+ * So the arithmetic satisfies both bounds without knowing what day
+ * Thanksgiving is. {@link COUNTER_NOTICE_RESTORE_BUSINESS_DAYS} carries the
+ * number and this reasoning travels with it.
+ *
+ * ## What this module refuses to decide
+ *
+ * Nothing here adjudicates. It does not judge whether the counter-notice is
+ * truthful, and it must not: §512's whole design is that the provider is a
+ * conduit that follows a procedure, and a provider who starts weighing the
+ * merits is a provider making itself a party. It records what was sworn, by
+ * whom, when, and what that obliges us to do next.
+ */ /**
+ * The weekend-skipping day arithmetic, borrowed from the support-SLA clock
+ * rather than restated.
+ *
+ * `support-tiers.ts` already needed exactly this — UTC, Saturday and Sunday
+ * skipped, holidays deliberately unknown — and carries the same reasoning
+ * about why a half-right holiday calendar is worse than none. Two copies of a
+ * date rule are two chances to disagree about which day a deadline falls on,
+ * and this one decides when a customer's site comes back.
+ */ import { addBusinessDays } from "./support-tiers.js";
+/** Firestore collection holding counter-notices. Staff-read, Admin-SDK-written. */ export const DMCA_COUNTER_NOTICE_COLLECTION = 'dmcaCounterNotices';
+/**
+ * Business days from receipt to automatic restoration.
+ *
+ * Inside §512(g)(2)(C)'s 10-to-14 window with room for holidays at both ends.
+ * See the module comment for why the middle of the window is the safe target
+ * for a weekend-only counter.
+ */ export const COUNTER_NOTICE_RESTORE_BUSINESS_DAYS = 12;
+/** The statutory floor, kept for the record we show staff and the complainant. */ export const COUNTER_NOTICE_MIN_BUSINESS_DAYS = 10;
+/** The statutory ceiling. Restoration later than this is its own violation. */ export const COUNTER_NOTICE_MAX_BUSINESS_DAYS = 14;
+/** Maximum characters of subscriber prose stored. */ export const COUNTER_NOTICE_MAX_DETAILS = 5000;
+/** Maximum length of a contact field. */ export const COUNTER_NOTICE_MAX_CONTACT = 254;
+/** Maximum length of the postal address — a jurisdiction fact, not free text. */ export const COUNTER_NOTICE_MAX_ADDRESS = 1000;
+/**
+ * The workflow states a counter-notice moves through.
+ *
+ * `received` → `forwarded` is the §512(g)(2)(A) obligation discharged, and it
+ * is the transition that starts the clock in the record. `restored` is the
+ * put-back having happened; `withdrawn` is the subscriber taking it back;
+ * `suitFiled` is the one lawful reason NOT to restore — the complainant told
+ * us they went to court, and the material stays down.
+ *
+ * `rejected` exists for a submission that is not a counter-notice at all
+ * (blank statutory elements survive validation only as a malformed row, and a
+ * mis-filed support question does not belong in a legal queue). It is
+ * deliberately NOT a merits judgement, and the staff surface says so.
+ */ export const COUNTER_NOTICE_STATUSES = [
+    'received',
+    'forwarded',
+    'restored',
+    'suitFiled',
+    'withdrawn',
+    'rejected'
+];
+export function isCounterNoticeStatus(value) {
+    return typeof value === 'string' && COUNTER_NOTICE_STATUSES.includes(value);
+}
+/**
+ * The statuses that mean this counter-notice will NOT lead to a restoration.
+ *
+ * Named rather than open-coded because two different places have to agree
+ * about it: the clock (which must not keep counting toward a put-back that is
+ * never coming) and the strike ledger (which must not go on suppressing a
+ * strike the subscriber withdrew).
+ */ export const COUNTER_NOTICE_TERMINAL_STATUSES = [
+    'suitFiled',
+    'withdrawn',
+    'rejected'
+];
+const fail = (code, message)=>({
+        ok: false,
+        code,
+        message
+    });
+const text = (value, max)=>typeof value === 'string' ? value.trim().slice(0, max) : '';
+/**
+ * Truthy checkbox, matching {@link validateAbuseReport}'s reading exactly.
+ *
+ * A no-JavaScript HTML form sends `on` for a ticked box and omits the field
+ * entirely when unticked; a JSON client sends `true`. The two must mean the
+ * same thing, or a sworn statement would depend on how the subscriber's
+ * browser is configured — and here the stakes are higher than on the notice
+ * side, because the person filing this one is our own locked-out customer.
+ */ const checked = (value)=>value === true || value === 'on' || value === 'true' || value === '1' || value === 'yes';
+/** `AR-XXXXXXXXXX` as minted by the abuse intake, or `null`. */ export function normalizeNoticeReference(value) {
+    const raw = text(value, 64).toUpperCase();
+    if (!raw) return null;
+    const match = /^(?:AR-)?([A-F0-9]{4,40})$/.exec(raw);
+    return match ? `AR-${match[1]}` : null;
+}
+/**
+ * Validate and normalize a submitted counter-notice.
+ *
+ * Accepts the shape of BOTH a JSON body and a urlencoded no-JS form post.
+ *
+ * Unlike {@link validateAbuseReport}, the bar here is deliberately HIGH, and
+ * for the opposite reason to the one that keeps the notice bar low. A missing
+ * field on an abuse report costs us a report; a missing element on a
+ * counter-notice makes the document legally ineffective, so accepting it
+ * would be worse than refusing it — we would owe the complainant a forward
+ * and the subscriber a restoration on the strength of a paper that does not
+ * do what it has to do. Refusing tells the subscriber what to add while they
+ * are still in front of the form.
+ *
+ * The `normalizeUrl` dependency is injected rather than imported so this
+ * module does not reach across into the notice side for one function; the
+ * route hands it `normalizeReportedUrl`, which already refuses `javascript:`
+ * and `data:` for the stored-XSS reason recorded there.
+ */ export function validateCounterNotice(payload, normalizeUrl, hostnameOf) {
+    const url = normalizeUrl(payload['url']);
+    if (!url) {
+        return fail('url', 'Enter the full web address the removed material appeared at, starting with https://.');
+    }
+    const material = text(payload['material'], COUNTER_NOTICE_MAX_DETAILS);
+    if (material.length < 10) {
+        return fail('material', 'Describe the material that was removed and where it was on your site.');
+    }
+    const name = text(payload['name'], COUNTER_NOTICE_MAX_CONTACT);
+    if (!name) {
+        return fail('name', 'Enter your full legal name.');
+    }
+    const address = text(payload['address'], COUNTER_NOTICE_MAX_ADDRESS);
+    if (address.length < 10) {
+        return fail('address', 'Enter your full postal address — the law requires it, and it decides which court would hear a dispute.');
+    }
+    const phone = text(payload['phone'], COUNTER_NOTICE_MAX_CONTACT);
+    if (!phone) {
+        return fail('phone', 'Enter a telephone number the complainant can reach you on.');
+    }
+    const email = text(payload['email'], COUNTER_NOTICE_MAX_CONTACT);
+    if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        return fail('email', 'Enter an email address we can reply to.');
+    }
+    const signature = text(payload['signature'], COUNTER_NOTICE_MAX_CONTACT);
+    if (!signature) {
+        return fail('signature', 'Type your full legal name — it stands as your electronic signature.');
+    }
+    if (!checked(payload['goodFaithMistake'])) {
+        return fail('goodFaithMistake', 'A counter-notice needs the statement, under penalty of perjury, that the material was removed by mistake or misidentification.');
+    }
+    if (!checked(payload['consentJurisdiction'])) {
+        return fail('consentJurisdiction', 'A counter-notice needs your consent to the jurisdiction of the Federal District Court for your address.');
+    }
+    if (!checked(payload['acceptService'])) {
+        return fail('acceptService', 'A counter-notice needs your agreement to accept service of process from the person who complained.');
+    }
+    return {
+        ok: true,
+        value: {
+            signature,
+            material,
+            url,
+            reportedHostname: hostnameOf(url),
+            reference: normalizeNoticeReference(payload['reference']),
+            name,
+            address,
+            phone,
+            email,
+            goodFaithMistake: true,
+            consentJurisdiction: true,
+            acceptService: true
+        }
+    };
+}
+/**
+ * The put-back schedule for a counter-notice received at `receivedAtMs`.
+ *
+ * Returns all three boundaries rather than just the one we act on, because
+ * the other two are what let a staff surface — and, later, an argument —
+ * show that the instant we chose sits inside the window the statute drew,
+ * instead of asserting it.
+ */ export function counterNoticeClock(receivedAtMs) {
+    return {
+        receivedAtMs,
+        earliestMs: addBusinessDays(receivedAtMs, COUNTER_NOTICE_MIN_BUSINESS_DAYS),
+        restoreAtMs: addBusinessDays(receivedAtMs, COUNTER_NOTICE_RESTORE_BUSINESS_DAYS),
+        latestMs: addBusinessDays(receivedAtMs, COUNTER_NOTICE_MAX_BUSINESS_DAYS)
+    };
+}
+/**
+ * Is this counter-notice still heading for a restoration?
+ *
+ * `false` for the three terminal statuses — the complainant went to court,
+ * the subscriber withdrew, or the submission was not a counter-notice. A
+ * `restored` row is also done: the put-back already happened, and a scheduler
+ * that kept acting on it would re-lift a suspension staff may have re-imposed
+ * for an entirely different reason.
+ *
+ * Returns a plain `boolean`, NOT a `status is CounterNoticeStatus` predicate,
+ * and the distinction is not cosmetic. This answers a question about a SUBSET
+ * of the statuses — `restored` is a perfectly valid `CounterNoticeStatus` and
+ * still gets `false` — so a type predicate here would be a lie the compiler
+ * believes: narrowing on it would hand a caller a type that includes the very
+ * values the function just rejected. `strictNullChecks` is off repo-wide,
+ * which already makes boolean-discriminant narrowing unreliable in this
+ * codebase; a predicate that is wrong even when narrowing DOES fire is worse
+ * than none. Callers ask this as a question and branch on the answer.
+ */ export function counterNoticeAwaitsRestoration(status) {
+    return isCounterNoticeStatus(status) && status !== 'restored' && !COUNTER_NOTICE_TERMINAL_STATUSES.includes(status);
+}
+export default validateCounterNotice;
+
+//# sourceMappingURL=dmca-counter-notice.js.map

package/src/lib/app-utils/dmca-counter-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/dmca-counter-notice.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * DMCA COUNTER-NOTICE — the put-back half of §512 (AGL-1983).\n *\n * AGL-1964 built the intake, so we can RECEIVE a copyright notice; AGL-1965\n * made a host-scope takedown actually stick in Firestore rules, so we can\n * ENFORCE one. Those two together are the dangerous shape: we could take a\n * customer's site down and had no lawful way to put it back. §512(g) is the\n * procedure that closes it, and it is also the thing that shields us from\n * being sued by our own customer for the takedown we performed on somebody\n * else's say-so.\n *\n * ## The clock is the feature\n *\n * §512(g)(2) is not \"accept a form\". It is a sequence with a deadline in it:\n *\n *  (A) promptly send the complainant a copy of the counter-notice and tell\n *      them the material goes back up;\n *  (B) put it back **not less than 10 nor more than 14 business days** after\n *      receiving the counter-notice, UNLESS the complainant first tells us\n *      they have filed an action seeking a court order.\n *\n * A counter-notice route that recorded a submission and left restoration to\n * whoever next reads the queue is not that procedure — it is a form that\n * makes us feel compliant while a customer stays locked out. So the artefact\n * this module produces is a **scheduled reversal**: {@link counterNoticeClock}\n * computes the two boundaries, and the caller stamps the restore instant onto\n * the suspension's own `suspendedUntilMs` so the lock lifts itself.\n *\n * That is why AGL-1981 had to be fixed in the same pass. Until it was,\n * `suspendedUntilMs` was honoured by the server-side lockdown helpers and\n * ignored by Firestore rules — so a \"restored\" site would have come back,\n * served traffic, and refused every client write, which is the whole\n * authoring experience. Scheduling a restoration onto a mechanism that never\n * fires is theatre, and it would have been indistinguishable from working\n * right up until a customer tried to edit.\n *\n * ## Why 12 business days and not 10\n *\n * The statute gives a WINDOW, not an instant, and the window is the slack\n * that makes an honest implementation possible. Counting business days by\n * skipping weekends alone is simple and testable, but it treats a federal\n * holiday as a working day — so a weekend-only count of 10 can land on fewer\n * than 10 true business days, which is the one direction that is unlawful\n * (restoring too early denies the complainant days the statute gives them).\n *\n * Rather than carry a holiday calendar that would need maintaining every\n * year — and would be wrong for a year nobody updated — we target the middle\n * of the window. A weekend-only count is always an OVER-estimate of true\n * business days elapsed, never an under-estimate: holidays only ever remove\n * working days. So:\n *\n *  - 12 weekend-only business days is at most 12 true business days, which is\n *    inside the 14-day ceiling however the holidays fall;\n *  - it is at least 10 true business days unless three or more federal\n *    holidays fall inside one ~17-calendar-day span, which no pair of US\n *    federal holidays is close enough to produce (the tightest is Dec 25 /\n *    Jan 1, which is two).\n *\n * So the arithmetic satisfies both bounds without knowing what day\n * Thanksgiving is. {@link COUNTER_NOTICE_RESTORE_BUSINESS_DAYS} carries the\n * number and this reasoning travels with it.\n *\n * ## What this module refuses to decide\n *\n * Nothing here adjudicates. It does not judge whether the counter-notice is\n * truthful, and it must not: §512's whole design is that the provider is a\n * conduit that follows a procedure, and a provider who starts weighing the\n * merits is a provider making itself a party. It records what was sworn, by\n * whom, when, and what that obliges us to do next.\n */\n\n/**\n * The weekend-skipping day arithmetic, borrowed from the support-SLA clock\n * rather than restated.\n *\n * `support-tiers.ts` already needed exactly this — UTC, Saturday and Sunday\n * skipped, holidays deliberately unknown — and carries the same reasoning\n * about why a half-right holiday calendar is worse than none. Two copies of a\n * date rule are two chances to disagree about which day a deadline falls on,\n * and this one decides when a customer's site comes back.\n */\nimport { addBusinessDays } from './support-tiers'\n\n/** Firestore collection holding counter-notices. Staff-read, Admin-SDK-written. */\nexport const DMCA_COUNTER_NOTICE_COLLECTION = 'dmcaCounterNotices'\n\n/**\n * Business days from receipt to automatic restoration.\n *\n * Inside §512(g)(2)(C)'s 10-to-14 window with room for holidays at both ends.\n * See the module comment for why the middle of the window is the safe target\n * for a weekend-only counter.\n */\nexport const COUNTER_NOTICE_RESTORE_BUSINESS_DAYS = 12\n\n/** The statutory floor, kept for the record we show staff and the complainant. */\nexport const COUNTER_NOTICE_MIN_BUSINESS_DAYS = 10\n/** The statutory ceiling. Restoration later than this is its own violation. */\nexport const COUNTER_NOTICE_MAX_BUSINESS_DAYS = 14\n\n/** Maximum characters of subscriber prose stored. */\nexport const COUNTER_NOTICE_MAX_DETAILS = 5000\n/** Maximum length of a contact field. */\nexport const COUNTER_NOTICE_MAX_CONTACT = 254\n/** Maximum length of the postal address — a jurisdiction fact, not free text. */\nexport const COUNTER_NOTICE_MAX_ADDRESS = 1000\n\n/**\n * The workflow states a counter-notice moves through.\n *\n * `received` → `forwarded` is the §512(g)(2)(A) obligation discharged, and it\n * is the transition that starts the clock in the record. `restored` is the\n * put-back having happened; `withdrawn` is the subscriber taking it back;\n * `suitFiled` is the one lawful reason NOT to restore — the complainant told\n * us they went to court, and the material stays down.\n *\n * `rejected` exists for a submission that is not a counter-notice at all\n * (blank statutory elements survive validation only as a malformed row, and a\n * mis-filed support question does not belong in a legal queue). It is\n * deliberately NOT a merits judgement, and the staff surface says so.\n */\nexport const COUNTER_NOTICE_STATUSES = [\n  'received',\n  'forwarded',\n  'restored',\n  'suitFiled',\n  'withdrawn',\n  'rejected',\n] as const\nexport type CounterNoticeStatus = (typeof COUNTER_NOTICE_STATUSES)[number]\n\nexport function isCounterNoticeStatus(\n  value: unknown,\n): value is CounterNoticeStatus {\n  return (\n    typeof value === 'string' &&\n    (COUNTER_NOTICE_STATUSES as readonly string[]).includes(value)\n  )\n}\n\n/**\n * The statuses that mean this counter-notice will NOT lead to a restoration.\n *\n * Named rather than open-coded because two different places have to agree\n * about it: the clock (which must not keep counting toward a put-back that is\n * never coming) and the strike ledger (which must not go on suppressing a\n * strike the subscriber withdrew).\n */\nexport const COUNTER_NOTICE_TERMINAL_STATUSES: readonly CounterNoticeStatus[] = [\n  'suitFiled',\n  'withdrawn',\n  'rejected',\n]\n\n/**\n * The §512(g)(3) elements, after validation.\n *\n * Each field is one of the statute's four subparagraphs, and the names say\n * which. Collecting them as prose next to a tick-box is the ordinary web-form\n * rendering of a sworn document — the same shape `AbuseReportDmcaAffirmations`\n * takes for the notice on the other side.\n */\nexport interface CounterNoticeInput {\n  /** (A) Typed name standing as the electronic signature. */\n  signature: string\n  /**\n   * (B) Identification of the material removed and where it appeared before\n   * removal. The URL is captured separately so staff can act on it directly.\n   */\n  material: string\n  /** (B) The location the material appeared at, normalized to an http(s) URL. */\n  url: string\n  /** Hostname of {@link url}, so the row can be joined to a host. */\n  reportedHostname: string\n  /**\n   * Our own reference for the notice being answered (`AR-…`), when the\n   * subscriber has it. Optional: a subscriber who lost the email must still be\n   * able to file, and staff can match on the URL.\n   */\n  reference: string | null\n  /** (D) Subscriber's legal name. */\n  name: string\n  /** (D) Subscriber's postal address — the address that fixes the district. */\n  address: string\n  /** (D) Subscriber's telephone number. */\n  phone: string\n  /** Reply address. Not statutory, but the channel the procedure runs on. */\n  email: string\n  /**\n   * (C) \"Under penalty of perjury, I have a good faith belief the material was\n   * removed as a result of mistake or misidentification.\"\n   */\n  goodFaithMistake: boolean\n  /**\n   * (D) Consent to the jurisdiction of the Federal District Court for the\n   * district of the given address — or, for a subscriber outside the United\n   * States, any district in which we may be found.\n   */\n  consentJurisdiction: boolean\n  /** (D) Agreement to accept service of process from the complainant. */\n  acceptService: boolean\n}\n\nexport interface CounterNoticeValidationFailure {\n  ok: false\n  /** Stable machine code, for tests and for the form to highlight a field. */\n  code: string\n  /** Sentence shown to the subscriber. */\n  message: string\n}\n\nexport interface CounterNoticeValidationSuccess {\n  ok: true\n  value: CounterNoticeInput\n}\n\nexport type CounterNoticeValidation =\n  | CounterNoticeValidationSuccess\n  | CounterNoticeValidationFailure\n\nconst fail = (\n  code: string,\n  message: string,\n): CounterNoticeValidationFailure => ({ ok: false, code, message })\n\nconst text = (value: unknown, max: number): string =>\n  typeof value === 'string' ? value.trim().slice(0, max) : ''\n\n/**\n * Truthy checkbox, matching {@link validateAbuseReport}'s reading exactly.\n *\n * A no-JavaScript HTML form sends `on` for a ticked box and omits the field\n * entirely when unticked; a JSON client sends `true`. The two must mean the\n * same thing, or a sworn statement would depend on how the subscriber's\n * browser is configured — and here the stakes are higher than on the notice\n * side, because the person filing this one is our own locked-out customer.\n */\nconst checked = (value: unknown): boolean =>\n  value === true ||\n  value === 'on' ||\n  value === 'true' ||\n  value === '1' ||\n  value === 'yes'\n\n/** `AR-XXXXXXXXXX` as minted by the abuse intake, or `null`. */\nexport function normalizeNoticeReference(value: unknown): string | null {\n  const raw = text(value, 64).toUpperCase()\n  if (!raw) return null\n  const match = /^(?:AR-)?([A-F0-9]{4,40})$/.exec(raw)\n  return match ? `AR-${match[1]}` : null\n}\n\n/**\n * Validate and normalize a submitted counter-notice.\n *\n * Accepts the shape of BOTH a JSON body and a urlencoded no-JS form post.\n *\n * Unlike {@link validateAbuseReport}, the bar here is deliberately HIGH, and\n * for the opposite reason to the one that keeps the notice bar low. A missing\n * field on an abuse report costs us a report; a missing element on a\n * counter-notice makes the document legally ineffective, so accepting it\n * would be worse than refusing it — we would owe the complainant a forward\n * and the subscriber a restoration on the strength of a paper that does not\n * do what it has to do. Refusing tells the subscriber what to add while they\n * are still in front of the form.\n *\n * The `normalizeUrl` dependency is injected rather than imported so this\n * module does not reach across into the notice side for one function; the\n * route hands it `normalizeReportedUrl`, which already refuses `javascript:`\n * and `data:` for the stored-XSS reason recorded there.\n */\nexport function validateCounterNotice(\n  payload: Record<string, unknown>,\n  normalizeUrl: (value: unknown) => string | null,\n  hostnameOf: (url: string) => string,\n): CounterNoticeValidation {\n  const url = normalizeUrl(payload['url'])\n  if (!url) {\n    return fail(\n      'url',\n      'Enter the full web address the removed material appeared at, starting with https://.',\n    )\n  }\n\n  const material = text(payload['material'], COUNTER_NOTICE_MAX_DETAILS)\n  if (material.length < 10) {\n    return fail(\n      'material',\n      'Describe the material that was removed and where it was on your site.',\n    )\n  }\n\n  const name = text(payload['name'], COUNTER_NOTICE_MAX_CONTACT)\n  if (!name) {\n    return fail('name', 'Enter your full legal name.')\n  }\n\n  const address = text(payload['address'], COUNTER_NOTICE_MAX_ADDRESS)\n  if (address.length < 10) {\n    return fail(\n      'address',\n      'Enter your full postal address — the law requires it, and it decides which court would hear a dispute.',\n    )\n  }\n\n  const phone = text(payload['phone'], COUNTER_NOTICE_MAX_CONTACT)\n  if (!phone) {\n    return fail('phone', 'Enter a telephone number the complainant can reach you on.')\n  }\n\n  const email = text(payload['email'], COUNTER_NOTICE_MAX_CONTACT)\n  if (!email || !/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    return fail('email', 'Enter an email address we can reply to.')\n  }\n\n  const signature = text(payload['signature'], COUNTER_NOTICE_MAX_CONTACT)\n  if (!signature) {\n    return fail(\n      'signature',\n      'Type your full legal name — it stands as your electronic signature.',\n    )\n  }\n\n  if (!checked(payload['goodFaithMistake'])) {\n    return fail(\n      'goodFaithMistake',\n      'A counter-notice needs the statement, under penalty of perjury, that the material was removed by mistake or misidentification.',\n    )\n  }\n  if (!checked(payload['consentJurisdiction'])) {\n    return fail(\n      'consentJurisdiction',\n      'A counter-notice needs your consent to the jurisdiction of the Federal District Court for your address.',\n    )\n  }\n  if (!checked(payload['acceptService'])) {\n    return fail(\n      'acceptService',\n      'A counter-notice needs your agreement to accept service of process from the person who complained.',\n    )\n  }\n\n  return {\n    ok: true,\n    value: {\n      signature,\n      material,\n      url,\n      reportedHostname: hostnameOf(url),\n      reference: normalizeNoticeReference(payload['reference']),\n      name,\n      address,\n      phone,\n      email,\n      goodFaithMistake: true,\n      consentJurisdiction: true,\n      acceptService: true,\n    },\n  }\n}\n\n/** The three instants §512(g)(2)(C) defines, relative to receipt. */\nexport interface CounterNoticeClock {\n  /** When we received the counter-notice. The statute counts from here. */\n  receivedAtMs: number\n  /** The statutory floor — restoring before this is too early. */\n  earliestMs: number\n  /** When we will actually restore access. */\n  restoreAtMs: number\n  /** The statutory ceiling — restoring after this is too late. */\n  latestMs: number\n}\n\n/**\n * The put-back schedule for a counter-notice received at `receivedAtMs`.\n *\n * Returns all three boundaries rather than just the one we act on, because\n * the other two are what let a staff surface — and, later, an argument —\n * show that the instant we chose sits inside the window the statute drew,\n * instead of asserting it.\n */\nexport function counterNoticeClock(receivedAtMs: number): CounterNoticeClock {\n  return {\n    receivedAtMs,\n    earliestMs: addBusinessDays(receivedAtMs, COUNTER_NOTICE_MIN_BUSINESS_DAYS),\n    restoreAtMs: addBusinessDays(\n      receivedAtMs,\n      COUNTER_NOTICE_RESTORE_BUSINESS_DAYS,\n    ),\n    latestMs: addBusinessDays(receivedAtMs, COUNTER_NOTICE_MAX_BUSINESS_DAYS),\n  }\n}\n\n/**\n * Is this counter-notice still heading for a restoration?\n *\n * `false` for the three terminal statuses — the complainant went to court,\n * the subscriber withdrew, or the submission was not a counter-notice. A\n * `restored` row is also done: the put-back already happened, and a scheduler\n * that kept acting on it would re-lift a suspension staff may have re-imposed\n * for an entirely different reason.\n *\n * Returns a plain `boolean`, NOT a `status is CounterNoticeStatus` predicate,\n * and the distinction is not cosmetic. This answers a question about a SUBSET\n * of the statuses — `restored` is a perfectly valid `CounterNoticeStatus` and\n * still gets `false` — so a type predicate here would be a lie the compiler\n * believes: narrowing on it would hand a caller a type that includes the very\n * values the function just rejected. `strictNullChecks` is off repo-wide,\n * which already makes boolean-discriminant narrowing unreliable in this\n * codebase; a predicate that is wrong even when narrowing DOES fire is worse\n * than none. Callers ask this as a question and branch on the answer.\n */\nexport function counterNoticeAwaitsRestoration(status: unknown): boolean {\n  return (\n    isCounterNoticeStatus(status) &&\n    status !== 'restored' &&\n    !COUNTER_NOTICE_TERMINAL_STATUSES.includes(status)\n  )\n}\n\nexport default validateCounterNotice\n"],"names":["addBusinessDays","DMCA_COUNTER_NOTICE_COLLECTION","COUNTER_NOTICE_RESTORE_BUSINESS_DAYS","COUNTER_NOTICE_MIN_BUSINESS_DAYS","COUNTER_NOTICE_MAX_BUSINESS_DAYS","COUNTER_NOTICE_MAX_DETAILS","COUNTER_NOTICE_MAX_CONTACT","COUNTER_NOTICE_MAX_ADDRESS","COUNTER_NOTICE_STATUSES","isCounterNoticeStatus","value","includes","COUNTER_NOTICE_TERMINAL_STATUSES","fail","code","message","ok","text","max","trim","slice","checked","normalizeNoticeReference","raw","toUpperCase","match","exec","validateCounterNotice","payload","normalizeUrl","hostnameOf","url","material","length","name","address","phone","email","test","signature","reportedHostname","reference","goodFaithMistake","consentJurisdiction","acceptService","counterNoticeClock","receivedAtMs","earliestMs","restoreAtMs","latestMs","counterNoticeAwaitsRestoration","status"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEC,GAED;;;;;;;;;CASC,GACD,SAASA,eAAe,QAAQ,qBAAiB;AAEjD,iFAAiF,GACjF,OAAO,MAAMC,iCAAiC,qBAAoB;AAElE;;;;;;CAMC,GACD,OAAO,MAAMC,uCAAuC,GAAE;AAEtD,gFAAgF,GAChF,OAAO,MAAMC,mCAAmC,GAAE;AAClD,6EAA6E,GAC7E,OAAO,MAAMC,mCAAmC,GAAE;AAElD,mDAAmD,GACnD,OAAO,MAAMC,6BAA6B,KAAI;AAC9C,uCAAuC,GACvC,OAAO,MAAMC,6BAA6B,IAAG;AAC7C,+EAA+E,GAC/E,OAAO,MAAMC,6BAA6B,KAAI;AAE9C;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,0BAA0B;IACrC;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AAGV,OAAO,SAASC,sBACdC,KAAc;IAEd,OACE,OAAOA,UAAU,YACjB,AAACF,wBAA8CG,QAAQ,CAACD;AAE5D;AAEA;;;;;;;CAOC,GACD,OAAO,MAAME,mCAAmE;IAC9E;IACA;IACA;CACD,CAAA;AAoED,MAAMC,OAAO,CACXC,MACAC,UACoC,CAAA;QAAEC,IAAI;QAAOF;QAAMC;IAAQ,CAAA;AAEjE,MAAME,OAAO,CAACP,OAAgBQ,MAC5B,OAAOR,UAAU,WAAWA,MAAMS,IAAI,GAAGC,KAAK,CAAC,GAAGF,OAAO;AAE3D;;;;;;;;CAQC,GACD,MAAMG,UAAU,CAACX,QACfA,UAAU,QACVA,UAAU,QACVA,UAAU,UACVA,UAAU,OACVA,UAAU;AAEZ,8DAA8D,GAC9D,OAAO,SAASY,yBAAyBZ,KAAc;IACrD,MAAMa,MAAMN,KAAKP,OAAO,IAAIc,WAAW;IACvC,IAAI,CAACD,KAAK,OAAO;IACjB,MAAME,QAAQ,6BAA6BC,IAAI,CAACH;IAChD,OAAOE,QAAQ,CAAC,GAAG,EAAEA,KAAK,CAAC,EAAE,EAAE,GAAG;AACpC;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASE,sBACdC,OAAgC,EAChCC,YAA+C,EAC/CC,UAAmC;IAEnC,MAAMC,MAAMF,aAAaD,OAAO,CAAC,MAAM;IACvC,IAAI,CAACG,KAAK;QACR,OAAOlB,KACL,OACA;IAEJ;IAEA,MAAMmB,WAAWf,KAAKW,OAAO,CAAC,WAAW,EAAEvB;IAC3C,IAAI2B,SAASC,MAAM,GAAG,IAAI;QACxB,OAAOpB,KACL,YACA;IAEJ;IAEA,MAAMqB,OAAOjB,KAAKW,OAAO,CAAC,OAAO,EAAEtB;IACnC,IAAI,CAAC4B,MAAM;QACT,OAAOrB,KAAK,QAAQ;IACtB;IAEA,MAAMsB,UAAUlB,KAAKW,OAAO,CAAC,UAAU,EAAErB;IACzC,IAAI4B,QAAQF,MAAM,GAAG,IAAI;QACvB,OAAOpB,KACL,WACA;IAEJ;IAEA,MAAMuB,QAAQnB,KAAKW,OAAO,CAAC,QAAQ,EAAEtB;IACrC,IAAI,CAAC8B,OAAO;QACV,OAAOvB,KAAK,SAAS;IACvB;IAEA,MAAMwB,QAAQpB,KAAKW,OAAO,CAAC,QAAQ,EAAEtB;IACrC,IAAI,CAAC+B,SAAS,CAAC,6BAA6BC,IAAI,CAACD,QAAQ;QACvD,OAAOxB,KAAK,SAAS;IACvB;IAEA,MAAM0B,YAAYtB,KAAKW,OAAO,CAAC,YAAY,EAAEtB;IAC7C,IAAI,CAACiC,WAAW;QACd,OAAO1B,KACL,aACA;IAEJ;IAEA,IAAI,CAACQ,QAAQO,OAAO,CAAC,mBAAmB,GAAG;QACzC,OAAOf,KACL,oBACA;IAEJ;IACA,IAAI,CAACQ,QAAQO,OAAO,CAAC,sBAAsB,GAAG;QAC5C,OAAOf,KACL,uBACA;IAEJ;IACA,IAAI,CAACQ,QAAQO,OAAO,CAAC,gBAAgB,GAAG;QACtC,OAAOf,KACL,iBACA;IAEJ;IAEA,OAAO;QACLG,IAAI;QACJN,OAAO;YACL6B;YACAP;YACAD;YACAS,kBAAkBV,WAAWC;YAC7BU,WAAWnB,yBAAyBM,OAAO,CAAC,YAAY;YACxDM;YACAC;YACAC;YACAC;YACAK,kBAAkB;YAClBC,qBAAqB;YACrBC,eAAe;QACjB;IACF;AACF;AAcA;;;;;;;CAOC,GACD,OAAO,SAASC,mBAAmBC,YAAoB;IACrD,OAAO;QACLA;QACAC,YAAY/C,gBAAgB8C,cAAc3C;QAC1C6C,aAAahD,gBACX8C,cACA5C;QAEF+C,UAAUjD,gBAAgB8C,cAAc1C;IAC1C;AACF;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAAS8C,+BAA+BC,MAAe;IAC5D,OACE1C,sBAAsB0C,WACtBA,WAAW,cACX,CAACvC,iCAAiCD,QAAQ,CAACwC;AAE/C;AAEA,eAAexB,sBAAqB"}