@aglyn/aglyn 1.0.0-beta.147 → 1.0.0-beta.150

package/src/lib/app-utils/notifications.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/notifications.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ITimestamp } from '@aglyn/shared-util-timestamp'\n\n/**\n * In-app notifications (AGL-259): per-user docs at\n * `users/{uid}/notifications/{id}`, written by the Admin SDK (emitters in\n * the API routes + the `notifyAdmins` automation step) and read/marked by\n * their owner. Types follow the common SaaS taxonomy so the console can\n * icon/group them without a registry.\n */\nexport type AglynNotificationType =\n  | 'billing.invoice'\n  | 'billing.paymentFailed'\n  // Stripe gave up on a failed renewal and CANCELLED the subscription\n  // (AGL-1877). Distinct from `paymentFailed`, which announces one failed\n  // attempt inside a retry window the customer can still recover from; this\n  // one is the window having closed. Measured on the test account with a\n  // test clock: five attempts over 21.08 days, then\n  // `cancellation_details.reason: 'payment_failed'` — and until this existed\n  // the org went silently to Free at that moment, with the `past_due` banner\n  // disappearing at exactly the instant the consequence arrived.\n  | 'billing.subscriptionCanceled'\n  | 'billing.usage'\n  | 'team.invite'\n  | 'team.roleChanged'\n  | 'team.hostAccessGranted'\n  | 'content.formSubmission'\n  | 'content.booking'\n  | 'content.order'\n  | 'content.lowStock'\n  // A CRM task was assigned to the recipient by somebody else (AGL-2599).\n  // `content.` because it is the same kind of message as a form submission\n  // or a booking: a thing on the site that now needs this person's hands,\n  // not a change to their standing (`team.`) and not a platform notice\n  // (`system.`). Someone who has muted the operational stream has said they\n  // do not want to be told about work as it arrives, and a task is work.\n  | 'content.taskAssigned'\n  // A CRM task's reminder came due (AGL-2659): the hourly runner telling\n  // the assignee, at the task's own time, that the task is due. `content.`\n  // beside `taskAssigned` for the same reason it gives — work on the site,\n  // not standing — and so the one mute that stops \"work arriving\" stops\n  // \"work falling due\" with it. The mute governs the whole reminder, mail\n  // included, unlike the digest's: a reminder is one message about one\n  // task, and there is no schedule to keep separately from it.\n  | 'content.taskReminder'\n  // A contact, or a lead, became the recipient's to work (AGL-2618): a\n  // capture the assignment rules or the site's default owner routed to\n  // them, a lead somebody converted and handed to them, or an automation's\n  // \"assign an owner\" step — every server path that writes `ownerUid`\n  // except the recipient assigning themselves. Two types rather than one\n  // because the record the person opens differs: a lead is the site's own\n  // working record and a contact is the org's, and the link goes to the\n  // one they will actually work. `content.`, beside `taskAssigned`, for the\n  // same reason: work arriving, not standing changing.\n  | 'content.contactAssigned'\n  | 'content.leadAssigned'\n  // The morning's CRM digest (AGL-2619): what the recipient owes today —\n  // overdue and due-today tasks, and the leads nobody has worked. `content.`\n  // for the reason `taskAssigned` is: it is about work on the site, and the\n  // person who muted the operational stream has asked not to be told about\n  // work. The digest EMAIL is governed separately, by\n  // `crmDailyDigestEnabled`: the mute is a fact about the console feed and\n  // the digest switch is a fact about the digest.\n  | 'content.crmDailyDigest'\n  // The weekly insights (AGL-2915): what a site's figures showed that week,\n  // for a person who asked for them. `content.` beside the CRM digest, for the\n  // reason that one gives: it is about the site's work, and the operational\n  // mute governs the console notification while the person's own switch for\n  // the digest governs the digest.\n  | 'content.insightsDigest'\n  // Marketplace review verdicts (AGL-432/653).\n  | 'marketplace.review'\n  // Support desk, staff audience (AGL-850): a subscriber opened or replied to\n  // a ticket. Fanned out to staff-claim holders, not org members.\n  | 'support.ticketOpened'\n  | 'support.ticketReply'\n  | 'system.announcement'\n  // A live plugin version stopped passing the static verifier (AGL-1086).\n  // Staff audience: bytes we told workspaces were checked now fail checks\n  // that did not exist when they were approved.\n  //\n  // Deliberately NOT under `marketplace.` (AGL-1088). Category is the prefix,\n  // categories are mutable per user, and Marketplace is the category a staff\n  // member mutes to stop routine listing-review chatter — which would drop\n  // this alert as collateral. `system` is the bucket nobody mutes to reduce\n  // noise. The adminAudit record survives a mute either way; the timeliness\n  // does not, and timeliness is the whole point of the alert.\n  | 'system.pluginVerifierRegression'\n  // A sign-in method was removed from the user's own account because their\n  // organization turned on SSO enforcement (AGL-1129). `system.`, not\n  // `team.`, for the AGL-1088 reason above: `team` is the category someone\n  // mutes to stop routine roster chatter, and \"the way you sign in just\n  // changed\" is not chatter — the next sign-in fails without it.\n  | 'system.signInMethodRemoved'\n  // Documents in a scoped collection carrying no `visibleTo` (AGL-1478).\n  // Staff audience: the weekly dry run found resources that are invisible\n  // to every site-scoped read, which always means a creation path forgot\n  // the field. `system.` for the AGL-1088 reason above, and because the\n  // collection it names may be `marketplace`-adjacent or not.\n  | 'system.scopeDrift'\n  // An SSO domain that WAS DNS-proven has stopped answering with our\n  // challenge record, for three consecutive weekly sweeps (AGL-1210).\n  // Nothing has been turned off — sign-in for that domain still routes\n  // exactly as it did — and that is precisely why this has to be said out\n  // loud rather than left in a log.\n  //\n  // `system.`, not `team.`, for the AGL-1088 reason above and one of its\n  // own: the audience is the org's own admins, the subject is whether their\n  // people can still sign in, and it must reach them BEFORE anybody decides\n  // to revoke the routing. A category somebody mutes to quieten roster\n  // chatter is the wrong place for the one warning that precedes a lockout.\n  | 'system.ssoDomainUnverified'\n  // A site hit the per-month form-submission abuse ceiling and further\n  // submissions are being refused (AGL-1655). `system.`, not `content.`, for\n  // the AGL-1088 reason above and more sharply than any of them: `content` is\n  // literally the category a site owner mutes to stop routine form-submission\n  // chatter, and this is the one form notification that says the form has\n  // STOPPED accepting. Filing it under the muted bucket would guarantee it\n  // reaches nobody on exactly the sites busy enough to trip it.\n  | 'system.formSubmissionsPaused'\n  // A site reached the flat platform ceiling on member accounts or on lead\n  // records, so further ones are being refused (AGL-1529). `system.` for the\n  // same reason as `formSubmissionsPaused` directly above, and with the same\n  // sharpness: `content.` is the bucket an owner mutes to stop routine\n  // sign-up and lead chatter, and this is the one notification saying the\n  // sign-ups have STOPPED — muted exactly on the sites busy enough to trip it.\n  | 'system.visitorRecordsPaused'\n  // An outsider reported one of our sites for phishing, malware or CSAM\n  // (AGL-1964). `system` for the AGL-1088 reason and, again, more sharply\n  // than most: this notification goes to STAFF, not to a customer, and its\n  // subject is somebody else's site. There is no bucket a recipient could\n  // mute it into that would be honest — nobody has opted into being told a\n  // stranger is being phished through our platform, and nobody should be able\n  // to opt out of it either.\n  //\n  // Only the urgent categories raise one, and only on a first report. See the\n  // fan-out in apps/tenant/app/api/report-abuse/route.ts for why: a flood of\n  // alerts IS the flood, and the alert it would cost us is the phishing one.\n  | 'system.abuseReportUrgent'\n  // The §512(g) counter-notice (AGL-1983), and the one place the \"only urgent\n  // categories raise a notification\" restraint above is deliberately not\n  // applied. Every counter-notice carries a statutory deadline that is\n  // ALREADY RUNNING when it arrives — the clock counts from the subscriber's\n  // submission, not from our attention — so there is no low-value tail of\n  // these to drown out the important ones, and the one that goes unread is a\n  // customer locked out of their own work plus an unmet obligation under\n  // §512(g)(2)(A). Raised on first submission only, like the one above, so a\n  // resubmitting customer cannot re-alert.\n  | 'system.dmcaCounterNotice'\n  // A site crossed the per-month bandwidth abuse ceiling (AGL-2155). Two\n  // audiences share one type: staff, because an uncompensated free site\n  // serving six figures of page views is an incident; and the site's own\n  // managers, because on free the site is now serving a capped notice and\n  // nobody should learn that from a visitor.\n  //\n  // `system.`, not `billing.`, for the AGL-1088 reason and one specific to\n  // this meter: on the free plan there is no bill, so `billing` would be the\n  // one category where the message is literally never about money — and it is\n  // exactly the free-tier trip that changes what visitors see.\n  | 'system.bandwidthCeilingTripped'\n  // A free site crossed its PLAN's included bandwidth and is now serving the\n  // capped notice (AGL-2413). Distinct from the ceiling above on purpose: that\n  // one is an incident at 10x the band and goes to staff first; this one is an\n  // ordinary quota at 1x, concerns only the site's own managers, and its\n  // remedy is an upgrade rather than an investigation. Sending both under one\n  // type would tell an owner their traffic was being treated as suspected\n  // abuse when it is simply a successful free site.\n  | 'system.bandwidthCapEngaged'\n  // A Stripe billing webhook threw AFTER its handlers had begun (AGL-2157),\n  // so its side effects may be half applied and its idempotency claim is\n  // being HELD — Stripe will not retry it. Staff audience: this is the one\n  // failure on that route no automatic retry can make safe, because the\n  // handlers behind it are not all idempotent, and a human has to reconcile.\n  | 'system.billingWebhookHalfApplied'\n  // A card dispute arrived that NOTHING in the platform claimed (AGL-2429):\n  // no `platformRevenue` row, no storefront order, no marketplace purchase.\n  // Staff audience, and the reason it needs a type of its own is that its\n  // absence was the bug — the routine case (a storefront or marketplace\n  // chargeback, which the plugins own) and the fault case were the same\n  // silence from the route's side, so a dispute nobody handled looked\n  // exactly like one somebody did.\n  //\n  // `system.`, not `billing.`, for the AGL-1088 reason and one specific to\n  // this alert: `billing` is the category a recipient is most likely to have\n  // muted as routine invoice traffic, and this is the one message on that\n  // route where muting it means money moves with nobody looking.\n  | 'system.disputeUnattributed'\n\nexport interface AglynNotification {\n  $id?: string\n  type: AglynNotificationType\n  title: string\n  body?: string\n  /** Console path the notification opens (e.g. a host inbox). */\n  link?: string\n  orgId?: string\n  hostId?: string\n  createdAt?: ITimestamp\n  /** Set by the owner when read; unread while absent. */\n  readAt?: ITimestamp | null\n}\n\nexport const NOTIFICATION_TYPE_LABELS: Record<AglynNotificationType, string> =\n  {\n    'billing.invoice': 'Invoice available',\n    'billing.paymentFailed': 'Payment failed',\n    'billing.subscriptionCanceled': 'Subscription canceled',\n    'billing.usage': 'Usage threshold',\n    'team.invite': 'Team invite',\n    'team.roleChanged': 'Role changed',\n    'team.hostAccessGranted': 'Site access granted',\n    'content.formSubmission': 'Form submission',\n    'content.booking': 'New booking',\n    'content.order': 'New order',\n    'content.lowStock': 'Low stock',\n    'content.taskAssigned': 'Task assigned to you',\n    'content.taskReminder': 'Task reminder',\n    'content.contactAssigned': 'Contact assigned to you',\n    'content.leadAssigned': 'Lead assigned to you',\n    'content.crmDailyDigest': 'Daily CRM digest',\n    'content.insightsDigest': 'Weekly insights',\n    'marketplace.review': 'Listing review',\n\n    'support.ticketOpened': 'New support ticket',\n    'support.ticketReply': 'Support ticket reply',\n    'system.announcement': 'Announcement',\n    'system.pluginVerifierRegression': 'Plugin verifier regression',\n    'system.signInMethodRemoved': 'Sign-in method removed',\n    'system.scopeDrift': 'Resources missing a sharing scope',\n    'system.ssoDomainUnverified': 'SSO domain no longer proves ownership',\n    'system.formSubmissionsPaused': 'Form submissions paused',\n    'system.visitorRecordsPaused': 'Sign-ups or leads paused',\n    'system.abuseReportUrgent': 'Urgent abuse report',\n    'system.dmcaCounterNotice': 'DMCA counter-notice',\n    'system.bandwidthCeilingTripped': 'Bandwidth ceiling reached',\n    'system.bandwidthCapEngaged': 'Monthly traffic limit reached',\n    'system.billingWebhookHalfApplied': 'Billing webhook half applied',\n    'system.disputeUnattributed': 'Card dispute with no owner',\n  }\n\n/** Preference buckets (AGL-267): the prefix before the dot. */\nexport type NotificationCategory =\n  | 'billing'\n  | 'team'\n  | 'content'\n  | 'marketplace'\n  | 'support'\n  | 'system'\n\nexport const NOTIFICATION_CATEGORY_LABELS: Record<\n  NotificationCategory,\n  string\n> = {\n  billing: 'Billing',\n  team: 'Team & access',\n  content: 'Forms & bookings',\n  marketplace: 'Marketplace',\n  support: 'Support',\n  system: 'Product & system',\n}\n\nexport function notificationCategory(\n  type: AglynNotificationType | string,\n): NotificationCategory {\n  const prefix = String(type).split('.')[0]\n  return (\n    ['billing', 'team', 'content', 'marketplace', 'support', 'system'].includes(\n      prefix,\n    )\n      ? prefix\n      : 'system'\n  ) as NotificationCategory\n}\n\n/**\n * Per-user mute map stored at `users/{uid}.notificationPrefs`\n * (`{ [category]: false }` mutes); absent categories stay on.\n */\nexport function notificationMuted(\n  prefs: Record<string, boolean> | null | undefined,\n  type: AglynNotificationType | string,\n): boolean {\n  return prefs?.[notificationCategory(type)] === false\n}\n\n/**\n * The field on `users/{uid}` that holds a person's digest switches\n * (AGL-2619): `{ crmDaily: false }` turns the daily CRM digest off, and an\n * absent key leaves it on. Its own map rather than a key in\n * `notificationPrefs`, because that map is keyed by CATEGORY and read by\n * {@link notificationMuted} — a digest is a schedule a person keeps or\n * drops, not a bucket of types, and one switch governs both the console\n * notification and the email it travels with.\n */\nexport const DIGEST_PREFS_FIELD = 'digestPrefs'\n\nexport function crmDailyDigestEnabled(\n  prefs: Record<string, boolean> | null | undefined,\n): boolean {\n  return prefs?.['crmDaily'] !== false\n}\n\n/**\n * The field on `users/{uid}` naming the workspaces whose weekly insights a\n * person asked for (AGL-2915): `{ [orgId]: true }`. OPT-IN, unlike the CRM\n * digest — an absent key is off — because a weekly insight is generated, and a\n * generation spends the workspace's credits. The person turns it on beside the\n * answers themselves, where the plan, the release and their permission have\n * already been checked, and off again there or in Notifications; the weekly\n * sweep checks all three again before it spends anything.\n */\nexport const INSIGHT_DIGESTS_FIELD = 'insightDigests'\n\n/** Whether a person asked for a workspace's weekly insights. */\nexport function insightDigestSubscribed(\n  value: Record<string, boolean> | null | undefined,\n  orgId: string,\n): boolean {\n  return Boolean(orgId) && value?.[orgId] === true\n}\n"],"names":["NOTIFICATION_TYPE_LABELS","NOTIFICATION_CATEGORY_LABELS","billing","team","content","marketplace","support","system","notificationCategory","type","prefix","String","split","includes","notificationMuted","prefs","DIGEST_PREFS_FIELD","crmDailyDigestEnabled","INSIGHT_DIGESTS_FIELD","insightDigestSubscribed","value","orgId","Boolean"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GA2MD,OAAO,MAAMA,2BACX;IACE,mBAAmB;IACnB,yBAAyB;IACzB,gCAAgC;IAChC,iBAAiB;IACjB,eAAe;IACf,oBAAoB;IACpB,0BAA0B;IAC1B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,0BAA0B;IAC1B,sBAAsB;IAEtB,wBAAwB;IACxB,uBAAuB;IACvB,uBAAuB;IACvB,mCAAmC;IACnC,8BAA8B;IAC9B,qBAAqB;IACrB,8BAA8B;IAC9B,gCAAgC;IAChC,+BAA+B;IAC/B,4BAA4B;IAC5B,4BAA4B;IAC5B,kCAAkC;IAClC,8BAA8B;IAC9B,oCAAoC;IACpC,8BAA8B;AAChC,EAAC;AAWH,OAAO,MAAMC,+BAGT;IACFC,SAAS;IACTC,MAAM;IACNC,SAAS;IACTC,aAAa;IACbC,SAAS;IACTC,QAAQ;AACV,EAAC;AAED,OAAO,SAASC,qBACdC,IAAoC;IAEpC,MAAMC,SAASC,OAAOF,MAAMG,KAAK,CAAC,IAAI,CAAC,EAAE;IACzC,OACE;QAAC;QAAW;QAAQ;QAAW;QAAe;QAAW;KAAS,CAACC,QAAQ,CACzEH,UAEEA,SACA;AAER;AAEA;;;CAGC,GACD,OAAO,SAASI,kBACdC,KAAiD,EACjDN,IAAoC;IAEpC,OAAOM,CAAAA,yBAAAA,KAAO,CAACP,qBAAqBC,MAAM,MAAK;AACjD;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMO,qBAAqB,cAAa;AAE/C,OAAO,SAASC,sBACdF,KAAiD;IAEjD,OAAOA,CAAAA,yBAAAA,KAAO,CAAC,WAAW,MAAK;AACjC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMG,wBAAwB,iBAAgB;AAErD,8DAA8D,GAC9D,OAAO,SAASC,wBACdC,KAAiD,EACjDC,KAAa;IAEb,OAAOC,QAAQD,UAAUD,CAAAA,yBAAAA,KAAO,CAACC,MAAM,MAAK;AAC9C"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/notifications.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ITimestamp } from '@aglyn/shared-util-timestamp'\n\n/**\n * In-app notifications (AGL-259): per-user docs at\n * `users/{uid}/notifications/{id}`, written by the Admin SDK (emitters in\n * the API routes + the `notifyAdmins` automation step) and read/marked by\n * their owner. Types follow the common SaaS taxonomy so the console can\n * icon/group them without a registry.\n */\nexport type AglynNotificationType =\n  | 'billing.invoice'\n  | 'billing.paymentFailed'\n  // Stripe gave up on a failed renewal and CANCELLED the subscription\n  // (AGL-1877). Distinct from `paymentFailed`, which announces one failed\n  // attempt inside a retry window the customer can still recover from; this\n  // one is the window having closed. Measured on the test account with a\n  // test clock: five attempts over 21.08 days, then\n  // `cancellation_details.reason: 'payment_failed'` — and until this existed\n  // the org went silently to Free at that moment, with the `past_due` banner\n  // disappearing at exactly the instant the consequence arrived.\n  | 'billing.subscriptionCanceled'\n  | 'billing.usage'\n  | 'team.invite'\n  | 'team.roleChanged'\n  | 'team.hostAccessGranted'\n  | 'content.formSubmission'\n  | 'content.booking'\n  | 'content.order'\n  | 'content.lowStock'\n  // A CRM task was assigned to the recipient by somebody else (AGL-2599).\n  // `content.` because it is the same kind of message as a form submission\n  // or a booking: a thing on the site that now needs this person's hands,\n  // not a change to their standing (`team.`) and not a platform notice\n  // (`system.`). Someone who has muted the operational stream has said they\n  // do not want to be told about work as it arrives, and a task is work.\n  | 'content.taskAssigned'\n  // A CRM task's reminder came due (AGL-2659): the hourly runner telling\n  // the assignee, at the task's own time, that the task is due. `content.`\n  // beside `taskAssigned` for the same reason it gives — work on the site,\n  // not standing — and so the one mute that stops \"work arriving\" stops\n  // \"work falling due\" with it. The mute governs the whole reminder, mail\n  // included, unlike the digest's: a reminder is one message about one\n  // task, and there is no schedule to keep separately from it.\n  | 'content.taskReminder'\n  // A contact, or a lead, became the recipient's to work (AGL-2618): a\n  // capture the assignment rules or the site's default owner routed to\n  // them, a lead somebody converted and handed to them, or an automation's\n  // \"assign an owner\" step — every server path that writes `ownerUid`\n  // except the recipient assigning themselves. Two types rather than one\n  // because the record the person opens differs: a lead is the site's own\n  // working record and a contact is the org's, and the link goes to the\n  // one they will actually work. `content.`, beside `taskAssigned`, for the\n  // same reason: work arriving, not standing changing.\n  | 'content.contactAssigned'\n  | 'content.leadAssigned'\n  // The morning's CRM digest (AGL-2619): what the recipient owes today —\n  // overdue and due-today tasks, and the leads nobody has worked. `content.`\n  // for the reason `taskAssigned` is: it is about work on the site, and the\n  // person who muted the operational stream has asked not to be told about\n  // work. The digest EMAIL is governed separately, by\n  // `crmDailyDigestEnabled`: the mute is a fact about the console feed and\n  // the digest switch is a fact about the digest.\n  | 'content.crmDailyDigest'\n  // The weekly insights (AGL-2915): what a site's figures showed that week,\n  // for a person who asked for them. `content.` beside the CRM digest, for the\n  // reason that one gives: it is about the site's work, and the operational\n  // mute governs the console notification while the person's own switch for\n  // the digest governs the digest.\n  | 'content.insightsDigest'\n  // Marketplace review verdicts (AGL-432/653).\n  | 'marketplace.review'\n  // Support desk, staff audience (AGL-850): a subscriber opened or replied to\n  // a ticket. Fanned out to staff-claim holders, not org members.\n  | 'support.ticketOpened'\n  | 'support.ticketReply'\n  | 'system.announcement'\n  // A live plugin version stopped passing the static verifier (AGL-1086).\n  // Staff audience: bytes we told workspaces were checked now fail checks\n  // that did not exist when they were approved.\n  //\n  // Deliberately NOT under `marketplace.` (AGL-1088). Category is the prefix,\n  // categories are mutable per user, and Marketplace is the category a staff\n  // member mutes to stop routine listing-review chatter — which would drop\n  // this alert as collateral. `system` is the bucket nobody mutes to reduce\n  // noise. The adminAudit record survives a mute either way; the timeliness\n  // does not, and timeliness is the whole point of the alert.\n  | 'system.pluginVerifierRegression'\n  // A sign-in method was removed from the user's own account because their\n  // organization turned on SSO enforcement (AGL-1129). `system.`, not\n  // `team.`, for the AGL-1088 reason above: `team` is the category someone\n  // mutes to stop routine roster chatter, and \"the way you sign in just\n  // changed\" is not chatter — the next sign-in fails without it.\n  | 'system.signInMethodRemoved'\n  // Documents in a scoped collection carrying no `visibleTo` (AGL-1478).\n  // Staff audience: the weekly dry run found resources that are invisible\n  // to every site-scoped read, which always means a creation path forgot\n  // the field. `system.` for the AGL-1088 reason above, and because the\n  // collection it names may be `marketplace`-adjacent or not.\n  | 'system.scopeDrift'\n  // An SSO domain that WAS DNS-proven has stopped answering with our\n  // challenge record, for three consecutive weekly sweeps (AGL-1210).\n  // Nothing has been turned off — sign-in for that domain still routes\n  // exactly as it did — and that is precisely why this has to be said out\n  // loud rather than left in a log.\n  //\n  // `system.`, not `team.`, for the AGL-1088 reason above and one of its\n  // own: the audience is the org's own admins, the subject is whether their\n  // people can still sign in, and it must reach them BEFORE anybody decides\n  // to revoke the routing. A category somebody mutes to quieten roster\n  // chatter is the wrong place for the one warning that precedes a lockout.\n  | 'system.ssoDomainUnverified'\n  // A site hit the per-month form-submission abuse ceiling and further\n  // submissions are being refused (AGL-1655). `system.`, not `content.`, for\n  // the AGL-1088 reason above and more sharply than any of them: `content` is\n  // literally the category a site owner mutes to stop routine form-submission\n  // chatter, and this is the one form notification that says the form has\n  // STOPPED accepting. Filing it under the muted bucket would guarantee it\n  // reaches nobody on exactly the sites busy enough to trip it.\n  | 'system.formSubmissionsPaused'\n  // A site reached the flat platform ceiling on member accounts or on lead\n  // records, so further ones are being refused (AGL-1529). `system.` for the\n  // same reason as `formSubmissionsPaused` directly above, and with the same\n  // sharpness: `content.` is the bucket an owner mutes to stop routine\n  // sign-up and lead chatter, and this is the one notification saying the\n  // sign-ups have STOPPED — muted exactly on the sites busy enough to trip it.\n  | 'system.visitorRecordsPaused'\n  // An outsider reported one of our sites for phishing, malware or CSAM\n  // (AGL-1964). `system` for the AGL-1088 reason and, again, more sharply\n  // than most: this notification goes to STAFF, not to a customer, and its\n  // subject is somebody else's site. There is no bucket a recipient could\n  // mute it into that would be honest — nobody has opted into being told a\n  // stranger is being phished through our platform, and nobody should be able\n  // to opt out of it either.\n  //\n  // Only the urgent categories raise one, and only on a first report. See the\n  // fan-out in apps/tenant/app/api/report-abuse/route.ts for why: a flood of\n  // alerts IS the flood, and the alert it would cost us is the phishing one.\n  | 'system.abuseReportUrgent'\n  // The §512(g) counter-notice (AGL-1983), and the one place the \"only urgent\n  // categories raise a notification\" restraint above is deliberately not\n  // applied. Every counter-notice carries a statutory deadline that is\n  // ALREADY RUNNING when it arrives — the clock counts from the subscriber's\n  // submission, not from our attention — so there is no low-value tail of\n  // these to drown out the important ones, and the one that goes unread is a\n  // customer locked out of their own work plus an unmet obligation under\n  // §512(g)(2)(A). Raised on first submission only, like the one above, so a\n  // resubmitting customer cannot re-alert.\n  | 'system.dmcaCounterNotice'\n  // A site crossed the per-month bandwidth abuse ceiling (AGL-2155). Two\n  // audiences share one type: staff, because an uncompensated free site\n  // serving six figures of page views is an incident; and the site's own\n  // managers, because on free the site is now serving a capped notice and\n  // nobody should learn that from a visitor.\n  //\n  // `system.`, not `billing.`, for the AGL-1088 reason and one specific to\n  // this meter: on the free plan there is no bill, so `billing` would be the\n  // one category where the message is literally never about money — and it is\n  // exactly the free-tier trip that changes what visitors see.\n  | 'system.bandwidthCeilingTripped'\n  // A free site crossed its PLAN's included bandwidth and is now serving the\n  // capped notice (AGL-2413). Distinct from the ceiling above on purpose: that\n  // one is an incident at 10x the band and goes to staff first; this one is an\n  // ordinary quota at 1x, concerns only the site's own managers, and its\n  // remedy is an upgrade rather than an investigation. Sending both under one\n  // type would tell an owner their traffic was being treated as suspected\n  // abuse when it is simply a successful free site.\n  | 'system.bandwidthCapEngaged'\n  // A Stripe billing webhook threw AFTER its handlers had begun (AGL-2157),\n  // so its side effects may be half applied and its idempotency claim is\n  // being HELD — Stripe will not retry it. Staff audience: this is the one\n  // failure on that route no automatic retry can make safe, because the\n  // handlers behind it are not all idempotent, and a human has to reconcile.\n  | 'system.billingWebhookHalfApplied'\n  // A card dispute arrived that NOTHING in the platform claimed (AGL-2429):\n  // no `platformRevenue` row, no storefront order, no marketplace purchase.\n  // Staff audience, and the reason it needs a type of its own is that its\n  // absence was the bug — the routine case (a storefront or marketplace\n  // chargeback, which the plugins own) and the fault case were the same\n  // silence from the route's side, so a dispute nobody handled looked\n  // exactly like one somebody did.\n  //\n  // `system.`, not `billing.`, for the AGL-1088 reason and one specific to\n  // this alert: `billing` is the category a recipient is most likely to have\n  // muted as routine invoice traffic, and this is the one message on that\n  // route where muting it means money moves with nobody looking.\n  | 'system.disputeUnattributed'\n  // Somebody created an account, and somebody created a workspace\n  // (AGL-3225). Staff audience, and the only two types in the taxonomy whose\n  // subject is the platform's own growth rather than anybody's work.\n  //\n  // `staff.`, and NOT `system.`, and the AGL-1088 note above is the reason\n  // rather than an exception to it: `system` is the bucket nobody mutes to\n  // reduce noise, which is exactly what makes it the wrong home for the two\n  // routine, high-volume events in the product. A staff member must be able\n  // to stop hearing about every sign-up without also dropping the verifier\n  // regression and the unattributed dispute that share that bucket — and\n  // before this category existed, there was nowhere to put them where that\n  // was true.\n  //\n  // The category also tells the settings page who a row is for: `staff` is\n  // rendered only to claim holders, so no customer is shown a switch for\n  // notifications they could never receive.\n  | 'staff.userSignedUp'\n  | 'staff.orgCreated'\n\nexport interface AglynNotification {\n  $id?: string\n  type: AglynNotificationType\n  title: string\n  body?: string\n  /** Console path the notification opens (e.g. a host inbox). */\n  link?: string\n  orgId?: string\n  hostId?: string\n  createdAt?: ITimestamp\n  /** Set by the owner when read; unread while absent. */\n  readAt?: ITimestamp | null\n}\n\nexport const NOTIFICATION_TYPE_LABELS: Record<AglynNotificationType, string> =\n  {\n    'billing.invoice': 'Invoice available',\n    'billing.paymentFailed': 'Payment failed',\n    'billing.subscriptionCanceled': 'Subscription canceled',\n    'billing.usage': 'Usage threshold',\n    'team.invite': 'Team invite',\n    'team.roleChanged': 'Role changed',\n    'team.hostAccessGranted': 'Site access granted',\n    'content.formSubmission': 'Form submission',\n    'content.booking': 'New booking',\n    'content.order': 'New order',\n    'content.lowStock': 'Low stock',\n    'content.taskAssigned': 'Task assigned to you',\n    'content.taskReminder': 'Task reminder',\n    'content.contactAssigned': 'Contact assigned to you',\n    'content.leadAssigned': 'Lead assigned to you',\n    'content.crmDailyDigest': 'Daily CRM digest',\n    'content.insightsDigest': 'Weekly insights',\n    'marketplace.review': 'Listing review',\n\n    'support.ticketOpened': 'New support ticket',\n    'support.ticketReply': 'Support ticket reply',\n    'system.announcement': 'Announcement',\n    'system.pluginVerifierRegression': 'Plugin verifier regression',\n    'system.signInMethodRemoved': 'Sign-in method removed',\n    'system.scopeDrift': 'Resources missing a sharing scope',\n    'system.ssoDomainUnverified': 'SSO domain no longer proves ownership',\n    'system.formSubmissionsPaused': 'Form submissions paused',\n    'system.visitorRecordsPaused': 'Sign-ups or leads paused',\n    'system.abuseReportUrgent': 'Urgent abuse report',\n    'system.dmcaCounterNotice': 'DMCA counter-notice',\n    'system.bandwidthCeilingTripped': 'Bandwidth ceiling reached',\n    'system.bandwidthCapEngaged': 'Monthly traffic limit reached',\n    'system.billingWebhookHalfApplied': 'Billing webhook half applied',\n    'system.disputeUnattributed': 'Card dispute with no owner',\n    'staff.userSignedUp': 'New account',\n    'staff.orgCreated': 'New workspace',\n  }\n\n/** Preference buckets (AGL-267): the prefix before the dot. */\nexport type NotificationCategory =\n  | 'billing'\n  | 'team'\n  | 'content'\n  | 'marketplace'\n  | 'support'\n  | 'system'\n  // Staff-only, and shown only to staff (AGL-3225) — see\n  // {@link STAFF_NOTIFICATION_CATEGORIES}.\n  | 'staff'\n\nexport const NOTIFICATION_CATEGORY_LABELS: Record<\n  NotificationCategory,\n  string\n> = {\n  billing: 'Billing',\n  team: 'Team & access',\n  content: 'Forms & bookings',\n  marketplace: 'Marketplace',\n  support: 'Support',\n  system: 'Product & system',\n  staff: 'Platform growth',\n}\n\n/**\n * The categories only staff can receive (AGL-3225).\n *\n * The settings page hides these rows from everybody else, because a switch\n * for mail that can never arrive is a promise the product does not keep. It\n * is presentation only: `notifyStaff` is what decides the audience, and it\n * enumerates the `staff` claim rather than reading this.\n */\nexport const STAFF_NOTIFICATION_CATEGORIES: ReadonlySet<NotificationCategory> =\n  new Set<NotificationCategory>(['staff'])\n\nexport function notificationCategory(\n  type: AglynNotificationType | string,\n): NotificationCategory {\n  const prefix = String(type).split('.')[0]\n  return (\n    [\n      'billing',\n      'team',\n      'content',\n      'marketplace',\n      'support',\n      'system',\n      'staff',\n    ].includes(prefix)\n      ? prefix\n      : 'system'\n  ) as NotificationCategory\n}\n\n/**\n * Per-user mute map stored at `users/{uid}.notificationPrefs`\n * (`{ [category]: false }` mutes); absent categories stay on.\n */\nexport function notificationMuted(\n  prefs: Record<string, boolean> | null | undefined,\n  type: AglynNotificationType | string,\n): boolean {\n  return prefs?.[notificationCategory(type)] === false\n}\n\n/**\n * The field on `users/{uid}` that holds a person's digest switches\n * (AGL-2619): `{ crmDaily: false }` turns the daily CRM digest off, and an\n * absent key leaves it on. Its own map rather than a key in\n * `notificationPrefs`, because that map is keyed by CATEGORY and read by\n * {@link notificationMuted} — a digest is a schedule a person keeps or\n * drops, not a bucket of types, and one switch governs both the console\n * notification and the email it travels with.\n */\nexport const DIGEST_PREFS_FIELD = 'digestPrefs'\n\nexport function crmDailyDigestEnabled(\n  prefs: Record<string, boolean> | null | undefined,\n): boolean {\n  return prefs?.['crmDaily'] !== false\n}\n\n/**\n * The field on `users/{uid}` naming the workspaces whose weekly insights a\n * person asked for (AGL-2915): `{ [orgId]: true }`. OPT-IN, unlike the CRM\n * digest — an absent key is off — because a weekly insight is generated, and a\n * generation spends the workspace's credits. The person turns it on beside the\n * answers themselves, where the plan, the release and their permission have\n * already been checked, and off again there or in Notifications; the weekly\n * sweep checks all three again before it spends anything.\n */\nexport const INSIGHT_DIGESTS_FIELD = 'insightDigests'\n\n/** Whether a person asked for a workspace's weekly insights. */\nexport function insightDigestSubscribed(\n  value: Record<string, boolean> | null | undefined,\n  orgId: string,\n): boolean {\n  return Boolean(orgId) && value?.[orgId] === true\n}\n\n/**\n * The channels a notification can travel on (AGL-3223).\n *\n * `console` is the feed at `/manage/notifications` and the app-bar dropdown\n * that reads it — the only channel that existed. `email` is the message the\n * fan-out sends beside that doc when the recipient asked for one.\n */\nexport type NotificationChannel = 'console' | 'email'\n\n/**\n * One scope's answer for one category. **Tri-state on purpose**: `true` and\n * `false` decide, and an ABSENT key inherits from the scope above.\n *\n * Inheritance is the whole reason this is a partial rather than a pair of\n * booleans. A person who wants form submissions from one busy site and not\n * from the other five has to be able to say that about the one site without\n * restating their answer for every other category at every other scope — and\n * a two-valued leaf cannot express \"I have not said\", so every override would\n * have to be written out in full and would then stop tracking the account\n * default it was never meant to detach from.\n */\nexport interface NotificationChannelPrefs {\n  console?: boolean\n  email?: boolean\n}\n\nexport type NotificationCategoryPrefs = Partial<\n  Record<NotificationCategory, NotificationChannelPrefs>\n>\n\n/**\n * Per-scope, per-channel notification preferences (AGL-3223), stored at\n * `users/{uid}.notificationSettings`.\n *\n * Three layers, narrowest first when resolving: the SITE a notification\n * concerns, then the WORKSPACE, then the account. Anything none of them\n * answers falls to {@link NOTIFICATION_CHANNEL_DEFAULTS}.\n *\n * ON THE USER DOCUMENT, not on `orgs/{orgId}/members/{uid}`, and that is a\n * cost decision rather than a modelling preference. `notifyUsers` already\n * does exactly one `getAll` over the recipients' user docs to read their\n * category mutes, so every layer living here means per-site preferences are\n * read for free on the fan-out's hot path. The member row would add a read\n * per recipient per notification to answer a question the document already in\n * hand could have answered.\n */\nexport interface NotificationSettings {\n  account?: NotificationCategoryPrefs\n  /** Keyed by org id. */\n  orgs?: Record<string, NotificationCategoryPrefs>\n  /** Keyed by host id — a site's own answer, narrower than its workspace's. */\n  hosts?: Record<string, NotificationCategoryPrefs>\n}\n\nexport const NOTIFICATION_SETTINGS_FIELD = 'notificationSettings'\n\n/**\n * What a category does when nobody has said otherwise.\n *\n * Console on, email OFF, everywhere. Email defaults off because the inbox is\n * not ours to fill: the product already sends transactional mail nobody opted\n * into — welcome, verification, invites, dunning, usage alerts — and every one\n * of those leaves on the same domain a customer's password reset depends on.\n * Turning a busy site's form submissions into mail by default would put that\n * domain's reputation behind traffic the recipient never asked for.\n *\n * Exhaustive `Record` deliberately: a new {@link NotificationCategory} is a\n * compile error here until somebody decides what it does by default, which is\n * the one question a new category must not be able to ship without answering.\n */\nexport const NOTIFICATION_CHANNEL_DEFAULTS: Record<\n  NotificationCategory,\n  Record<NotificationChannel, boolean>\n> = {\n  billing: { console: true, email: false },\n  team: { console: true, email: false },\n  content: { console: true, email: false },\n  marketplace: { console: true, email: false },\n  support: { console: true, email: false },\n  system: { console: true, email: false },\n  // Console ON, because the complaint this answers is that staff never heard\n  // about a sign-up at all; email off, like everything else, because that is\n  // what the channel defaults to and a sign-up is not urgent enough to be the\n  // exception that starts filling inboxes by default.\n  staff: { console: true, email: false },\n}\n\n/**\n * The types that send their OWN email and must never be mailed again by the\n * generic channel (AGL-3224).\n *\n * Both digests compose a message the fan-out could not reproduce — a day's\n * owed tasks, a week's figures — and send it from their own route under their\n * own switch (`digestPrefs.crmDaily`, `insightDigests.{orgId}`). A recipient\n * who switches the `content` email channel on would otherwise receive the\n * digest twice: once as the digest, once as a one-line \"Daily CRM digest\"\n * notification saying that the digest happened.\n */\nexport const NOTIFICATION_SELF_SENT_EMAIL_TYPES: ReadonlySet<string> = new Set<\n  AglynNotificationType\n>(['content.crmDailyDigest', 'content.insightsDigest'])\n\n/**\n * Whether a channel is on for one notification, at its own scope.\n *\n * Resolution order, first answer wins: the notification's SITE, its\n * WORKSPACE, the account, then {@link NOTIFICATION_CHANNEL_DEFAULTS}. A scope\n * that holds no entry for the category, or an entry with the channel key\n * absent, does not answer — see {@link NotificationChannelPrefs}.\n *\n * `legacyPrefs` is the flat `notificationPrefs` mute map this replaces\n * (AGL-267), and it sits BELOW the account layer rather than beside it.\n * Nothing migrates it: a person who never opens the new settings page keeps\n * being governed by the mutes they set years ago, and the first thing they do\n * set on the account layer overrides the old map for that category without\n * disturbing the rest of it. It answers for `console` only, because the map\n * predates there being a second channel and reading a console mute as an\n * email preference would be inventing an answer its author never gave.\n */\nexport function notificationChannelEnabled(\n  settings: NotificationSettings | null | undefined,\n  channel: NotificationChannel,\n  type: AglynNotificationType | string,\n  scope?: { orgId?: string | null; hostId?: string | null },\n  legacyPrefs?: Record<string, boolean> | null,\n): boolean {\n  const category = notificationCategory(type)\n  const layers: Array<NotificationCategoryPrefs | undefined> = [\n    scope?.hostId ? settings?.hosts?.[scope.hostId] : undefined,\n    scope?.orgId ? settings?.orgs?.[scope.orgId] : undefined,\n    settings?.account,\n  ]\n  for (const layer of layers) {\n    const answer = layer?.[category]?.[channel]\n    if (typeof answer === 'boolean') return answer\n  }\n  if (channel === 'console' && notificationMuted(legacyPrefs, type)) return false\n  return NOTIFICATION_CHANNEL_DEFAULTS[category][channel]\n}\n\n/**\n * What one scope says, with no inheritance applied — what the settings page\n * renders as Inherit / On / Off, and `undefined` is Inherit.\n *\n * `scope` names the layer directly rather than being derived from a\n * notification, because the page edits a layer whether or not anything has\n * ever arrived from it.\n */\nexport function notificationScopePref(\n  settings: NotificationSettings | null | undefined,\n  scope: { kind: 'account' } | { kind: 'org' | 'host'; id: string },\n  category: NotificationCategory,\n  channel: NotificationChannel,\n): boolean | undefined {\n  const layer =\n    scope.kind === 'account'\n      ? settings?.account\n      : scope.kind === 'org'\n        ? settings?.orgs?.[scope.id]\n        : settings?.hosts?.[scope.id]\n  return layer?.[category]?.[channel]\n}\n\n/**\n * The scopes this person has said something different about — what the\n * settings page lists so an override is never somewhere you have to go\n * looking for.\n *\n * Returns ids, not names: the page holds the org and host rosters and this\n * module holds no lookups. An id with no name is still worth listing, because\n * a preference about a workspace somebody left is exactly the kind of\n * leftover that is invisible until it is listed.\n */\nexport function notificationOverriddenScopes(\n  settings: NotificationSettings | null | undefined,\n): { orgIds: string[]; hostIds: string[] } {\n  const named = (layers: Record<string, NotificationCategoryPrefs> | undefined) =>\n    Object.entries(layers ?? {})\n      .filter(([, prefs]) =>\n        Object.values(prefs ?? {}).some((channels) =>\n          Object.values(channels ?? {}).some(\n            (value) => typeof value === 'boolean',\n          ),\n        ),\n      )\n      .map(([id]) => id)\n      .sort()\n  return { orgIds: named(settings?.orgs), hostIds: named(settings?.hosts) }\n}\n"],"names":["NOTIFICATION_TYPE_LABELS","NOTIFICATION_CATEGORY_LABELS","billing","team","content","marketplace","support","system","staff","STAFF_NOTIFICATION_CATEGORIES","Set","notificationCategory","type","prefix","String","split","includes","notificationMuted","prefs","DIGEST_PREFS_FIELD","crmDailyDigestEnabled","INSIGHT_DIGESTS_FIELD","insightDigestSubscribed","value","orgId","Boolean","NOTIFICATION_SETTINGS_FIELD","NOTIFICATION_CHANNEL_DEFAULTS","console","email","NOTIFICATION_SELF_SENT_EMAIL_TYPES","notificationChannelEnabled","settings","channel","scope","legacyPrefs","category","layers","hostId","hosts","undefined","orgs","account","layer","answer","notificationScopePref","kind","id","notificationOverriddenScopes","named","Object","entries","filter","values","some","channels","map","sort","orgIds","hostIds"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GA6ND,OAAO,MAAMA,2BACX;IACE,mBAAmB;IACnB,yBAAyB;IACzB,gCAAgC;IAChC,iBAAiB;IACjB,eAAe;IACf,oBAAoB;IACpB,0BAA0B;IAC1B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,0BAA0B;IAC1B,sBAAsB;IAEtB,wBAAwB;IACxB,uBAAuB;IACvB,uBAAuB;IACvB,mCAAmC;IACnC,8BAA8B;IAC9B,qBAAqB;IACrB,8BAA8B;IAC9B,gCAAgC;IAChC,+BAA+B;IAC/B,4BAA4B;IAC5B,4BAA4B;IAC5B,kCAAkC;IAClC,8BAA8B;IAC9B,oCAAoC;IACpC,8BAA8B;IAC9B,sBAAsB;IACtB,oBAAoB;AACtB,EAAC;AAcH,OAAO,MAAMC,+BAGT;IACFC,SAAS;IACTC,MAAM;IACNC,SAAS;IACTC,aAAa;IACbC,SAAS;IACTC,QAAQ;IACRC,OAAO;AACT,EAAC;AAED;;;;;;;CAOC,GACD,OAAO,MAAMC,gCACX,IAAIC,IAA0B;IAAC;CAAQ,EAAC;AAE1C,OAAO,SAASC,qBACdC,IAAoC;IAEpC,MAAMC,SAASC,OAAOF,MAAMG,KAAK,CAAC,IAAI,CAAC,EAAE;IACzC,OACE;QACE;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAACC,QAAQ,CAACH,UACPA,SACA;AAER;AAEA;;;CAGC,GACD,OAAO,SAASI,kBACdC,KAAiD,EACjDN,IAAoC;IAEpC,OAAOM,CAAAA,yBAAAA,KAAO,CAACP,qBAAqBC,MAAM,MAAK;AACjD;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMO,qBAAqB,cAAa;AAE/C,OAAO,SAASC,sBACdF,KAAiD;IAEjD,OAAOA,CAAAA,yBAAAA,KAAO,CAAC,WAAW,MAAK;AACjC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMG,wBAAwB,iBAAgB;AAErD,8DAA8D,GAC9D,OAAO,SAASC,wBACdC,KAAiD,EACjDC,KAAa;IAEb,OAAOC,QAAQD,UAAUD,CAAAA,yBAAAA,KAAO,CAACC,MAAM,MAAK;AAC9C;AAwDA,OAAO,MAAME,8BAA8B,uBAAsB;AAEjE;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,gCAGT;IACFzB,SAAS;QAAE0B,SAAS;QAAMC,OAAO;IAAM;IACvC1B,MAAM;QAAEyB,SAAS;QAAMC,OAAO;IAAM;IACpCzB,SAAS;QAAEwB,SAAS;QAAMC,OAAO;IAAM;IACvCxB,aAAa;QAAEuB,SAAS;QAAMC,OAAO;IAAM;IAC3CvB,SAAS;QAAEsB,SAAS;QAAMC,OAAO;IAAM;IACvCtB,QAAQ;QAAEqB,SAAS;QAAMC,OAAO;IAAM;IACtC,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpDrB,OAAO;QAAEoB,SAAS;QAAMC,OAAO;IAAM;AACvC,EAAC;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,qCAA0D,IAAIpB,IAEzE;IAAC;IAA0B;CAAyB,EAAC;AAEvD;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASqB,2BACdC,QAAiD,EACjDC,OAA4B,EAC5BrB,IAAoC,EACpCsB,KAAyD,EACzDC,WAA4C;QAI1BH,iBACDA;IAHjB,MAAMI,WAAWzB,qBAAqBC;IACtC,MAAMyB,SAAuD;QAC3DH,CAAAA,yBAAAA,MAAOI,MAAM,IAAGN,6BAAAA,kBAAAA,SAAUO,KAAK,qBAAfP,eAAiB,CAACE,MAAMI,MAAM,CAAC,GAAGE;QAClDN,CAAAA,yBAAAA,MAAOV,KAAK,IAAGQ,6BAAAA,iBAAAA,SAAUS,IAAI,qBAAdT,cAAgB,CAACE,MAAMV,KAAK,CAAC,GAAGgB;QAC/CR,4BAAAA,SAAUU,OAAO;KAClB;IACD,KAAK,MAAMC,SAASN,OAAQ;YACXM;QAAf,MAAMC,SAASD,0BAAAA,kBAAAA,KAAO,CAACP,SAAS,qBAAjBO,eAAmB,CAACV,QAAQ;QAC3C,IAAI,OAAOW,WAAW,WAAW,OAAOA;IAC1C;IACA,IAAIX,YAAY,aAAahB,kBAAkBkB,aAAavB,OAAO,OAAO;IAC1E,OAAOe,6BAA6B,CAACS,SAAS,CAACH,QAAQ;AACzD;AAEA;;;;;;;CAOC,GACD,OAAO,SAASY,sBACdb,QAAiD,EACjDE,KAAiE,EACjEE,QAA8B,EAC9BH,OAA4B;QAMpBD,gBACAA,iBACDW;IANP,MAAMA,QACJT,MAAMY,IAAI,KAAK,YACXd,4BAAAA,SAAUU,OAAO,GACjBR,MAAMY,IAAI,KAAK,QACbd,6BAAAA,iBAAAA,SAAUS,IAAI,qBAAdT,cAAgB,CAACE,MAAMa,EAAE,CAAC,GAC1Bf,6BAAAA,kBAAAA,SAAUO,KAAK,qBAAfP,eAAiB,CAACE,MAAMa,EAAE,CAAC;IACnC,OAAOJ,0BAAAA,kBAAAA,KAAO,CAACP,SAAS,qBAAjBO,eAAmB,CAACV,QAAQ;AACrC;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASe,6BACdhB,QAAiD;IAEjD,MAAMiB,QAAQ,CAACZ,SACba,OAAOC,OAAO,CAACd,iBAAAA,SAAU,CAAC,GACvBe,MAAM,CAAC,CAAC,GAAGlC,MAAM,GAChBgC,OAAOG,MAAM,CAACnC,gBAAAA,QAAS,CAAC,GAAGoC,IAAI,CAAC,CAACC,WAC/BL,OAAOG,MAAM,CAACE,mBAAAA,WAAY,CAAC,GAAGD,IAAI,CAChC,CAAC/B,QAAU,OAAOA,UAAU,aAIjCiC,GAAG,CAAC,CAAC,CAACT,GAAG,GAAKA,IACdU,IAAI;IACT,OAAO;QAAEC,QAAQT,MAAMjB,4BAAAA,SAAUS,IAAI;QAAGkB,SAASV,MAAMjB,4BAAAA,SAAUO,KAAK;IAAE;AAC1E"}

package/src/lib/app-utils/page-header-help-context.d.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Lets a surface say where its header's help `?` should LAND — the third
+ * sibling of `PageHeaderActions` and `PageHeaderRecord`, which do the same
+ * for the header's controls and its heading.
+ *
+ * WHAT A PAGE OWES THE READER WHO CLICKS `?`. AGL-2200 is the issue that
+ * found this: `DashboardLayout` could only name a topic, so all seven
+ * Plugins/Marketplace pages opened the same "Plugins & Marketplace" tooltip
+ * and dropped the reader at the top of one long page. Naming a heading is
+ * what turns the affordance from "here is the manual" into an answer.
+ *
+ * WHY A CONTEXT AND NOT A DECLARATION, which is the difference from the two
+ * siblings' rationale. A surface's own help IS declarable — the nav item
+ * carries `header.docsTopic`, and a section could carry an anchor — but the
+ * pages that need this are the ENTITY pages beneath a surface that owns its
+ * subtree (`ConsoleNavItem.ownsSubtree`). Those have no declaration to hang
+ * one on: the set of ids is a property of the workspace's data, and what a
+ * listing's `?` should explain ("what the badges mean") is a different page
+ * of the docs from what the hub's explains ("install & upgrade"). A static
+ * list cannot say that, and a route that owns its own layout never had to.
+ *
+ * TWO STRINGS, and deliberately not the console's `DocsHelpTarget`. That type
+ * is keyed to the console's own registry, which a plugin may not import —
+ * plugins carry their own generated subset (`PLUGIN_DOCS`). The console
+ * resolves whatever arrives against its registry and falls back when it does
+ * not recognize it, exactly as it already does for `header.docsTopic`: a
+ * third-party plugin can name any string, and the alternative to a fallback
+ * is a help button that throws on hover (AGL-1074).
+ */
+export interface PageHeaderHelpValue {
+    /** Docs topic key. Resolved by the shell; an unknown one falls back. */
+    topic: string;
+    /** Heading anchor on that page, including the leading `#`. */
+    anchor?: string;
+}
+export interface PageHeaderHelpContextValue {
+    /**
+     * Points the header's help at a topic; `null` restores the route's own.
+     *
+     * Absent when no provider is mounted, so a surface rendered outside one —
+     * a test harness, a storybook mount — publishes nothing rather than
+     * throwing.
+     */
+    setHeaderHelp?: (help: PageHeaderHelpValue | null) => void;
+}
+export declare const PageHeaderHelpContext: import("react").Context<PageHeaderHelpContextValue>;
+/** Hook form of {@link PageHeaderHelpContext}. */
+export declare function usePageHeaderHelp(): PageHeaderHelpContextValue;
+export type PageHeaderHelpProps = PageHeaderHelpValue;
+/**
+ * Points the page header's help at this page's own docs, and renders nothing
+ * where it sits.
+ *
+ * THE SLOT IS EMPTIED ON UNMOUNT, which is what keeps one page's answer off
+ * the next one. Navigating from a listing back to the hub unmounts this
+ * publisher and the cleanup runs in the same commit the hub mounts in, so
+ * the `?` returns to the surface's declared topic rather than going on
+ * explaining badges.
+ *
+ * Published from PRIMITIVES rather than an object, deliberately: the effect's
+ * dependencies are the two strings, so a surface that re-renders while its
+ * data settles publishes once per actual change rather than once per render.
+ */
+export declare function PageHeaderHelp(props: PageHeaderHelpProps): null;
+export declare namespace PageHeaderHelp {
+    var displayName: string;
+}

package/src/lib/app-utils/page-header-help-context.js

@@ -0,0 +1,56 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // Same placement rationale as page-header-actions-context.ts: lives in
+// @aglyn/aglyn without a 'use client' banner so both the console app and
+// relocated feature plugins share one context module.
+import { createContext, useContext, useEffect } from "react";
+export const PageHeaderHelpContext = createContext({});
+PageHeaderHelpContext.displayName = 'PageHeaderHelpContext';
+/** Hook form of {@link PageHeaderHelpContext}. */ export function usePageHeaderHelp() {
+    return useContext(PageHeaderHelpContext);
+}
+/**
+ * Points the page header's help at this page's own docs, and renders nothing
+ * where it sits.
+ *
+ * THE SLOT IS EMPTIED ON UNMOUNT, which is what keeps one page's answer off
+ * the next one. Navigating from a listing back to the hub unmounts this
+ * publisher and the cleanup runs in the same commit the hub mounts in, so
+ * the `?` returns to the surface's declared topic rather than going on
+ * explaining badges.
+ *
+ * Published from PRIMITIVES rather than an object, deliberately: the effect's
+ * dependencies are the two strings, so a surface that re-renders while its
+ * data settles publishes once per actual change rather than once per render.
+ */ export function PageHeaderHelp(props) {
+    const { topic, anchor } = props;
+    const { setHeaderHelp } = usePageHeaderHelp();
+    useEffect(()=>{
+        setHeaderHelp == null ? void 0 : setHeaderHelp(topic ? {
+            topic,
+            anchor
+        } : null);
+        return ()=>setHeaderHelp == null ? void 0 : setHeaderHelp(null);
+    }, [
+        setHeaderHelp,
+        topic,
+        anchor
+    ]);
+    return null;
+}
+PageHeaderHelp.displayName = 'PageHeaderHelp';
+
+//# sourceMappingURL=page-header-help-context.js.map

package/src/lib/app-utils/page-header-help-context.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/page-header-help-context.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Same placement rationale as page-header-actions-context.ts: lives in\n// @aglyn/aglyn without a 'use client' banner so both the console app and\n// relocated feature plugins share one context module.\nimport { createContext, useContext, useEffect } from 'react'\n\n/**\n * Lets a surface say where its header's help `?` should LAND — the third\n * sibling of `PageHeaderActions` and `PageHeaderRecord`, which do the same\n * for the header's controls and its heading.\n *\n * WHAT A PAGE OWES THE READER WHO CLICKS `?`. AGL-2200 is the issue that\n * found this: `DashboardLayout` could only name a topic, so all seven\n * Plugins/Marketplace pages opened the same \"Plugins & Marketplace\" tooltip\n * and dropped the reader at the top of one long page. Naming a heading is\n * what turns the affordance from \"here is the manual\" into an answer.\n *\n * WHY A CONTEXT AND NOT A DECLARATION, which is the difference from the two\n * siblings' rationale. A surface's own help IS declarable — the nav item\n * carries `header.docsTopic`, and a section could carry an anchor — but the\n * pages that need this are the ENTITY pages beneath a surface that owns its\n * subtree (`ConsoleNavItem.ownsSubtree`). Those have no declaration to hang\n * one on: the set of ids is a property of the workspace's data, and what a\n * listing's `?` should explain (\"what the badges mean\") is a different page\n * of the docs from what the hub's explains (\"install & upgrade\"). A static\n * list cannot say that, and a route that owns its own layout never had to.\n *\n * TWO STRINGS, and deliberately not the console's `DocsHelpTarget`. That type\n * is keyed to the console's own registry, which a plugin may not import —\n * plugins carry their own generated subset (`PLUGIN_DOCS`). The console\n * resolves whatever arrives against its registry and falls back when it does\n * not recognize it, exactly as it already does for `header.docsTopic`: a\n * third-party plugin can name any string, and the alternative to a fallback\n * is a help button that throws on hover (AGL-1074).\n */\nexport interface PageHeaderHelpValue {\n  /** Docs topic key. Resolved by the shell; an unknown one falls back. */\n  topic: string\n  /** Heading anchor on that page, including the leading `#`. */\n  anchor?: string\n}\n\nexport interface PageHeaderHelpContextValue {\n  /**\n   * Points the header's help at a topic; `null` restores the route's own.\n   *\n   * Absent when no provider is mounted, so a surface rendered outside one —\n   * a test harness, a storybook mount — publishes nothing rather than\n   * throwing.\n   */\n  setHeaderHelp?: (help: PageHeaderHelpValue | null) => void\n}\n\nexport const PageHeaderHelpContext =\n  createContext<PageHeaderHelpContextValue>({})\nPageHeaderHelpContext.displayName = 'PageHeaderHelpContext'\n\n/** Hook form of {@link PageHeaderHelpContext}. */\nexport function usePageHeaderHelp(): PageHeaderHelpContextValue {\n  return useContext(PageHeaderHelpContext)\n}\n\nexport type PageHeaderHelpProps = PageHeaderHelpValue\n\n/**\n * Points the page header's help at this page's own docs, and renders nothing\n * where it sits.\n *\n * THE SLOT IS EMPTIED ON UNMOUNT, which is what keeps one page's answer off\n * the next one. Navigating from a listing back to the hub unmounts this\n * publisher and the cleanup runs in the same commit the hub mounts in, so\n * the `?` returns to the surface's declared topic rather than going on\n * explaining badges.\n *\n * Published from PRIMITIVES rather than an object, deliberately: the effect's\n * dependencies are the two strings, so a surface that re-renders while its\n * data settles publishes once per actual change rather than once per render.\n */\nexport function PageHeaderHelp(props: PageHeaderHelpProps): null {\n  const { topic, anchor } = props\n  const { setHeaderHelp } = usePageHeaderHelp()\n  useEffect(() => {\n    setHeaderHelp?.(topic ? { topic, anchor } : null)\n    return () => setHeaderHelp?.(null)\n  }, [setHeaderHelp, topic, anchor])\n  return null\n}\nPageHeaderHelp.displayName = 'PageHeaderHelp'\n"],"names":["createContext","useContext","useEffect","PageHeaderHelpContext","displayName","usePageHeaderHelp","PageHeaderHelp","props","topic","anchor","setHeaderHelp"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,uEAAuE;AACvE,yEAAyE;AACzE,sDAAsD;AACtD,SAASA,aAAa,EAAEC,UAAU,EAAEC,SAAS,QAAQ,QAAO;AAiD5D,OAAO,MAAMC,wBACXH,cAA0C,CAAC,GAAE;AAC/CG,sBAAsBC,WAAW,GAAG;AAEpC,gDAAgD,GAChD,OAAO,SAASC;IACd,OAAOJ,WAAWE;AACpB;AAIA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASG,eAAeC,KAA0B;IACvD,MAAM,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGF;IAC1B,MAAM,EAAEG,aAAa,EAAE,GAAGL;IAC1BH,UAAU;QACRQ,iCAAAA,cAAgBF,QAAQ;YAAEA;YAAOC;QAAO,IAAI;QAC5C,OAAO,IAAMC,iCAAAA,cAAgB;IAC/B,GAAG;QAACA;QAAeF;QAAOC;KAAO;IACjC,OAAO;AACT;AACAH,eAAeF,WAAW,GAAG"}

package/src/lib/app-utils/release-flags.js

@@ -102,10 +102,11 @@ import { PLATFORM_BRAND_NAME } from "./platform-brand.js";
         description: 'Marketplace browsing, publishing and plugin installs.',
         defaultEnabled: true,
         // AGL-1654: was 'nav-tab-marketplace', which matched no nav item, so
-        // `gateNavTabItems` never hid the tab. The org Marketplace tab is a
-        // console constant rather than a plugin nav item, so the id has to be
-        // kept in step with `org-nav-tabs.ts` by hand; the spec
-        // `release-flag-nav-tab-ids.spec.ts` is what holds it there.
+        // `gateNavTabItems` never hid the tab. The id is still held to a real
+        // declaration by `release-flag-nav-tab-ids.spec.ts` — but it is no longer
+        // held there BY HAND: AGL-3080 made the org Marketplace tab the
+        // marketplace plugin's own `orgNavItems` entry, so the tab and the
+        // surface behind it are one declaration that names this id once.
         //
         // The second half of that comment — "the page behind it carries no
         // `<FeatureGate>`" — was still true until AGL-2019 and is no longer.

package/src/lib/app-utils/release-flags.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/release-flags.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Release flags (AGL-227): platform-level \"is this feature launched\"\n * gating backed by Firebase Remote Config. A separate axis from plan\n * entitlements (`plan-entitlements.ts`) — entitlements ask whether the\n * tenant's PLAN includes a feature, release flags ask whether the feature\n * is released to the public at all (or partially, via percentage rollout).\n * Staff bypass release flags everywhere but see a flagged warning.\n */\n\n/** Remote Config parameter keys for release-gated features. */\nimport type { OrgPlan } from '../foundation'\nimport { PLAN_LABELS, SELF_SERVE_PLANS } from './plan-entitlements'\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\n\nexport type ReleaseFlagKey =\n  | 'release_crm'\n  | 'release_outreach'\n  | 'release_bookings'\n  | 'release_events'\n  | 'release_data_store'\n  | 'release_workflows'\n  | 'release_redirects'\n  | 'release_commerce_v2'\n  | 'release_member_accounts'\n  | 'release_marketplace'\n  | 'release_marketing'\n  | 'release_email'\n  | 'release_inbox'\n  | 'release_logic'\n  | 'release_addon_store'\n  | 'release_native_checkout'\n  | 'release_edit_bar'\n  | 'release_assist'\n  | 'release_video_uploads'\n  | 'release_video_delivery'\n  | 'release_ai_generative'\n\nexport interface ReleaseFlagDefinition {\n  key: ReleaseFlagKey\n  label: string\n  description: string\n  /**\n   * Fallback verdict when Remote Config is unreachable (offline, blocked,\n   * first paint before activate). MUST match the seeded value in\n   * cloud/firebase-remoteconfig.template.json so environments without a\n   * published template behave like the template intends.\n   */\n  defaultEnabled: boolean\n  /** Host dashboard tab id (host-nav-tabs.ts) this flag hides, if any. */\n  navTabId?: string\n}\n\n/**\n * The registry: one entry per gated feature. Adding a flag = add it here,\n * seed it in the Remote Config template, and (optionally) wrap the page in\n * `<FeatureGate>` — the staff admin editor and nav filtering pick it up\n * from this list.\n */\nexport const RELEASE_FLAGS: readonly ReleaseFlagDefinition[] = [\n  {\n    key: 'release_crm',\n    label: 'CRM',\n    description:\n      'The CRM: contacts, leads, companies, deals, tasks, reports and fields.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-contacts',\n  },\n  // Sequences (AGL-2974): the plugin's kill switch as well as its launch\n  // gate, like every first-party plugin's flag since AGL-422 — off, it is\n  // subtracted from the console loader and the API dispatcher for everyone\n  // but staff. OFF by default, because nothing behind it sends mail yet and\n  // no plan carries the `outreach` entitlement it also needs. The KEY stays\n  // `release_outreach`: it is persisted in Remote Config (AGL-3199).\n  {\n    key: 'release_outreach',\n    label: 'Sequences',\n    description:\n      'One-to-one, multi-step email sequences sent from a rep’s own ' +\n      'connected mailbox and logged in the CRM (AGL-2974). OFF by default ' +\n      'and staff preview only. An organization also needs the `outreach` ' +\n      'entitlement, which no plan carries, so a customer reaches it only ' +\n      'through a per-org entitlement override.',\n    defaultEnabled: false,\n    navTabId: 'nav-tab-org-outreach',\n  },\n  {\n    key: 'release_bookings',\n    label: 'Bookings',\n    description: 'Bookings & scheduling for host sites.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-bookings',\n  },\n  {\n    key: 'release_events',\n    label: 'Events',\n    description: 'Event calendar management (AGL-145 add-on surface).',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-events',\n  },\n  {\n    key: 'release_data_store',\n    label: 'Data store',\n    description: 'Datasets, models and dynamic data bindings.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-data',\n  },\n  {\n    key: 'release_workflows',\n    label: 'Automation',\n    description: 'Workflows, actions, webhooks and their run history.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-workflows',\n  },\n  {\n    key: 'release_redirects',\n    label: 'Redirects',\n    description: 'Redirect manager with usage analytics.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-redirects',\n  },\n  {\n    key: 'release_commerce_v2',\n    label: 'Commerce v2',\n    description:\n      'Full ecommerce wave: catalog/variants, cart + checkout, digital ' +\n      'goods, reservations, POS, and the repriced commerce tiers ' +\n      '(AGL-276..331).',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_member_accounts',\n    label: 'User Accounts',\n    description:\n      'Visitor accounts on published sites: the /signin, /signup and ' +\n      '/recover pages and the Members blocks (AGL-2486). Platform-wide ' +\n      'kill switch only — whether a given SITE serves those pages is the ' +\n      'per-site User Accounts toggle, which is off until a site opts in.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_marketplace',\n    label: 'Marketplace',\n    description: 'Marketplace browsing, publishing and plugin installs.',\n    defaultEnabled: true,\n    // AGL-1654: was 'nav-tab-marketplace', which matched no nav item, so\n    // `gateNavTabItems` never hid the tab. The org Marketplace tab is a\n    // console constant rather than a plugin nav item, so the id has to be\n    // kept in step with `org-nav-tabs.ts` by hand; the spec\n    // `release-flag-nav-tab-ids.spec.ts` is what holds it there.\n    //\n    // The second half of that comment — \"the page behind it carries no\n    // `<FeatureGate>`\" — was still true until AGL-2019 and is no longer.\n    // Flipping this flag off used to subtract the marketplace plugin from\n    // the loader and both API dispatchers while the page went on rendering\n    // in full, so the OFF state was itself broken and \"just turn the flag\n    // off\" was not an available answer for an operator who does not want a\n    // marketplace. The page is gated now, so off means off.\n    navTabId: 'nav-tab-org-marketplace',\n  },\n  // AGL-422: every first-party plugin is release-flagged — the flag now\n  // feeds the plugin LOADER (console, published sites, API dispatch), not\n  // just nav visibility, so staff can kill-switch a whole plugin platform-\n  // wide from the Feature Flags page.\n  {\n    key: 'release_marketing',\n    label: 'Marketing',\n    description: 'Overlays, campaigns at-a-glance, and A/B experiments.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-marketing',\n  },\n  {\n    key: 'release_email',\n    label: 'Email',\n    description: 'Designed emails, campaigns, and audience sending.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_inbox',\n    label: 'Inbox',\n    description: 'Form submissions, site members, and the lead inbox.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-inbox',\n  },\n  {\n    key: 'release_logic',\n    label: 'Logic',\n    description: 'Variables, no-code functions, and reference health.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-logic',\n  },\n  {\n    key: 'release_addon_store',\n    label: 'Add-on store',\n    description:\n      'Self-serve add-on purchases on the Billing page: seats, datasets, ' +\n      'extra sites, POS registers, Event Calendar (AGL-524..531).',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_native_checkout',\n    label: 'In-page checkout',\n    description:\n      'Pay without leaving the page, instead of a redirect to ' +\n      'checkout.stripe.com. TWO surfaces: the console plan checkout uses ' +\n      'embedded Checkout (AGL-1132), and a merchant storefront uses the ' +\n      'Payment Element on the merchant\\u2019s own domain (AGL-1944) \\u2014 ' +\n      'which is the half that costs conversions, since leaving the store ' +\n      'mid-purchase is where carts get abandoned. Both keep the webhook as ' +\n      'the only thing that fulfils. OFF by default: the redirect is the ' +\n      'proven path, and neither surface can be verified without putting a ' +\n      'real card through it. Also gated on a publishable key being set, ' +\n      'per surface \\u2014 so flipping this alone degrades to the redirect ' +\n      'rather than to a dead button.',\n    defaultEnabled: false,\n  },\n  // Released to every site 2026-09-16 (AGL-3041). Still the whole surface's\n  // kill switch, globally or for one org by override: off, the tenant slot\n  // renders nothing, both token mints refuse, and `/api/edit-context` turns\n  // away every token already issued.\n  {\n    key: 'release_edit_bar',\n    label: 'Site admin bar',\n    description:\n      'Admin bar on published sites: a signed-in editor jumps from a live ' +\n      'page into the besigner for the screen serving it. Released ' +\n      '2026-09-16 (AGL-3041) for every site; turning it off hides the bar ' +\n      'and revokes every outstanding edit token at the verify site.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_assist',\n    label: `${PLATFORM_BRAND_NAME} Assist`,\n    description:\n      'The in-console AI chat helper on every page (AGL-1860): docs-' +\n      'grounded answers with deep links, page-context guidance on Pro+. ' +\n      'OFF by default, and blocked on TWO published legal artifacts ' +\n      '(AGL-1909), neither of which is a repo file — both are live besigner ' +\n      'pages, so publication is what satisfies them: (1) the privacy-policy ' +\n      'disclosure for stored Q&A, because the data loop records every ' +\n      'exchange org-scoped under orgs/{orgId}/assistExchanges; and (2) the ' +\n      'Anthropic row on /legal/subprocessors, which was deliberately ' +\n      'REMOVED on 2026-08-13 (subprocessorsV2a-20260813) on the premise ' +\n      'that no production key existed — so the page is not merely ' +\n      'incomplete without it, it is affirmatively wrong. NOTE the real ' +\n      'trigger is ANTHROPIC_API_KEY, not this flag: /api/ai/assist (the ' +\n      'besigner copy assistant, AGL-89/130/169) carries no release flag at ' +\n      'all and sends customer site content to Anthropic on the key plus a ' +\n      'Pro entitlement alone. Setting the key in production therefore makes ' +\n      'Anthropic a subprocessor whether or not this flag is ever flipped.',\n    defaultEnabled: false,\n  },\n  // Ingress only, and with no staff preview on the server: a video a staff\n  // session uploads into a customer's library serves on that customer's pages\n  // like any other, so a grant goes to the org through its override.\n  // `apps/console/utils/server/video-uploads.ts` holds the gate.\n  {\n    key: 'release_video_uploads',\n    label: 'Video uploads',\n    description:\n      'New video in the media library, on every upload path (AGL-2830). ' +\n      'Off: refused with 403 video_uploads_paused, as DAM video delivery is ' +\n      'not yet metered or bounded per org (AGL-2810, AGL-2812). Images, ' +\n      'documents and stored videos are unaffected.',\n    defaultEnabled: false,\n  },\n  // Delivery, not ingress: this flag decides whether a video already in the\n  // library is COPIED to the configured delivery provider and served from it\n  // through a short-lived signed redirect (AGL-2824). Per org, with no staff\n  // preview on the server — a copy is customer data at the provider, so a\n  // grant goes to the org through its override. Off, or with no provider\n  // configured, every video serves from this platform exactly as before.\n  // `media-delivery.ts` in `tenant-data-admin` holds the gate.\n  {\n    key: 'release_video_delivery',\n    label: 'Video delivery',\n    description:\n      'Serves library video from a configured delivery provider through ' +\n      'short-lived signed redirects, and copies each video to it (AGL-2824). ' +\n      'OFF by default: video serves from this platform as before. Also ' +\n      \"needs the provider's settings.\",\n    defaultEnabled: false,\n  },\n  // The generative doors share one runtime with Assist (AGL-2903) but not\n  // its flag: `release_assist` answers questions, this builds things, and\n  // the two are sold, metered and disclosed separately. The server-side\n  // gate lives in `aiGateLadder` (404 when off, staff preview).\n  // Labeled for what it switches — the generative doors — and not with the\n  // add-on's own name, which is sold and live whether or not the doors are\n  // released: the docs name the add-on, and a flag wearing the same words\n  // reads as documented when it is not.\n  {\n    key: 'release_ai_generative',\n    label: `${PLATFORM_BRAND_NAME} AI generation`,\n    description:\n      'Generative building and automation behind the AI add-on ' +\n      '(AGL-2903): sections, pages and workflows written by a model from ' +\n      'a brief, on the shared Anthropic runtime. OFF by default and staff ' +\n      'preview only; every generative route answers 404 while it is off. ' +\n      'Turning it on sends customer briefs and site content to Anthropic ' +\n      'on the same ANTHROPIC_API_KEY and under the same subprocessor ' +\n      'disclosure as Assist (AGL-1909).',\n    defaultEnabled: false,\n  },\n]\n\nexport const RELEASE_FLAG_KEYS = RELEASE_FLAGS.map(\n  (definition) => definition.key,\n) as readonly ReleaseFlagKey[]\n\nexport function isReleaseFlagKey(value: string): value is ReleaseFlagKey {\n  return (RELEASE_FLAG_KEYS as readonly string[]).includes(value)\n}\n\nexport function getReleaseFlagDefinition(\n  key: ReleaseFlagKey,\n): ReleaseFlagDefinition {\n  const definition = RELEASE_FLAGS.find((entry) => entry.key === key)\n  if (!definition) throw new Error(`Unknown release flag: ${key}`)\n  return definition\n}\n\n/**\n * The JSON payload stored in each Remote Config parameter. `enabled: true`\n * turns the feature on for everyone; `enabled: false` with a positive\n * `rolloutPercent` enables it for that percentage of subjects (stable\n * per-tenant bucketing, GrowthBook-style); `plans` narrows either of those\n * to a set of tiers (AGL-2486).\n */\nexport interface ReleaseFlagValue {\n  enabled: boolean\n  /** 0–100; only consulted while `enabled` is false. */\n  rolloutPercent?: number\n  /**\n   * Plan/tier targeting (AGL-2486). The tiers this flag is being rolled out\n   * to, or ABSENT for \"every tier\".\n   *\n   * ABSENT AND EMPTY BOTH MEAN EVERY TIER, and that is load-bearing: every\n   * flag stored before this field existed parses to `undefined` here, and an\n   * operator who unticks every box has plainly not asked for a flag that\n   * reaches nobody. Reading an empty list as \"no tiers\" would dark-launch\n   * nothing while the console still said the flag was on — the inverted\n   * reading of this field is the whole hazard, so it is closed in the parser\n   * rather than left to each call site.\n   */\n  plans?: OrgPlan[]\n  /** Free-form staff note (\"waiting on AGL-199\", owner, etc.). */\n  note?: string\n}\n\nconst clampPercent = (value: unknown): number => {\n  const percent = typeof value === 'number' && Number.isFinite(value) ? value : 0\n  return Math.min(100, Math.max(0, Math.round(percent)))\n}\n\n/**\n * Every plan a flag may target, cheapest first — `SELF_SERVE_PLANS` then\n * `enterprise`, the same ladder `planGrantingFeature` walks and the same\n * order the plan grid renders. Derived, never re-typed: pricing v3 inserted\n * `scale` mid-ladder and added `agency`, and a second hand-written tier list\n * here would have missed both.\n */\nexport const RELEASE_FLAG_PLAN_LADDER: readonly OrgPlan[] = [\n  ...SELF_SERVE_PLANS,\n  'enterprise' as OrgPlan,\n]\n\nconst isOrgPlan = (value: unknown): value is OrgPlan =>\n  typeof value === 'string' &&\n  Object.prototype.hasOwnProperty.call(PLAN_LABELS, value)\n\n/**\n * The tiers on the ladder at or above `plan` — what the console's \"Pro and\n * above\" shortcut expands to before it is STORED as an explicit list.\n *\n * Deliberately a UI convenience and not a stored \"minimum plan\" mode: a\n * stored threshold would silently re-aim every live flag the day a tier is\n * inserted into the middle of the ladder (pricing v3 did exactly that with\n * `scale`). An explicit list means the audience of a published flag only\n * ever changes because a human changed it.\n */\nexport function releaseFlagPlansAtOrAbove(plan: OrgPlan): OrgPlan[] {\n  const index = RELEASE_FLAG_PLAN_LADDER.indexOf(plan)\n  return index < 0 ? [] : RELEASE_FLAG_PLAN_LADDER.slice(index)\n}\n\n/**\n * Sanitises whatever is stored at `plans`, in ladder order.\n *\n * Returns `undefined` — not `[]` — for \"no targeting declared\", so the\n * absence survives a round trip through the staff editor and cannot be\n * written back as a list that means something else. Unknown tier names are\n * dropped for the same reason `parseOrgReleaseFlagOverrides` drops unknown\n * keys: a renamed or retired tier must never gate anything. A list that\n * names ONLY unknown tiers collapses to `undefined` (every tier) rather than\n * to an empty list, because a typo must inherit, never silently target.\n */\nexport function parseReleaseFlagPlans(raw: unknown): OrgPlan[] | undefined {\n  if (!Array.isArray(raw)) return undefined\n  const named = new Set(raw.filter(isOrgPlan))\n  if (named.size === 0) return undefined\n  return RELEASE_FLAG_PLAN_LADDER.filter((plan) => named.has(plan))\n}\n\n/**\n * Parses a Remote Config parameter string into a `ReleaseFlagValue`.\n * Tolerant by design — the template is hand-editable in the Firebase\n * console, so plain \"true\"/\"false\" strings and malformed JSON must not\n * crash gating: anything unreadable falls back to the registry default.\n */\nexport function parseReleaseFlagValue(\n  raw: string | null | undefined,\n  fallbackEnabled: boolean,\n): ReleaseFlagValue {\n  const text = raw?.trim()\n  if (!text) return { enabled: fallbackEnabled }\n  if (text === 'true') return { enabled: true }\n  if (text === 'false') return { enabled: false }\n  try {\n    const parsed = JSON.parse(text)\n    if (typeof parsed === 'boolean') return { enabled: parsed }\n    if (parsed && typeof parsed === 'object') {\n      const plans = parseReleaseFlagPlans(parsed.plans)\n      return {\n        enabled: parsed.enabled === true,\n        rolloutPercent: clampPercent(parsed.rolloutPercent),\n        // Spread, so a flag stored before AGL-2486 has NO `plans` key at all\n        // rather than an explicit `undefined`. `JSON.stringify` drops both,\n        // but the two are not the same to `'plans' in value`, which is what\n        // the staff PUT uses to tell \"the operator cleared the targeting\"\n        // apart from \"this client never sent the field\".\n        ...(plans ? { plans } : {}),\n        note: typeof parsed.note === 'string' ? parsed.note : undefined,\n      }\n    }\n  } catch {\n    // fall through to the registry default\n  }\n  return { enabled: fallbackEnabled }\n}\n\n/**\n * The longest parameter description Remote Config will publish (AGL-3048).\n *\n * One description past it refuses the WHOLE publish with\n * `DESCRIPTION_EXCEEDS_MAXIMUM_SIZE`, which the staff flags route answered as\n * a 500. Registry descriptions are written for the staff flags page, and\n * several run far past the limit, so what the page shows and what a\n * parameter carries cannot always be the same text.\n *\n * Counted in UTF-8 BYTES. Remote Config states the limit in characters\n * without saying how it counts them, and a UTF-8 byte count is never smaller\n * than the code-point or UTF-16 count, so text within 256 bytes is within the\n * limit on every reading. The cost is a few characters of headroom on text\n * with typographic punctuation.\n */\nexport const REMOTE_CONFIG_DESCRIPTION_MAX_BYTES = 256\n\nfunction utf8ByteLength(text: string): number {\n  let bytes = 0\n  for (const character of text) {\n    const codePoint = character.codePointAt(0) ?? 0\n    bytes +=\n      codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4\n  }\n  return bytes\n}\n\n/** Whether Remote Config accepts `text` as a parameter description. */\nexport function fitsRemoteConfigDescription(text: string): boolean {\n  return utf8ByteLength(text) <= REMOTE_CONFIG_DESCRIPTION_MAX_BYTES\n}\n\nconst DESCRIPTION_ELLIPSIS = '…'\n\n/**\n * `text` cut to a length Remote Config accepts, at a word boundary, with an\n * ellipsis marking the cut. Text that already fits comes back unchanged.\n *\n * The cut takes whole code points, so a multi-byte character is never split.\n * It backs up to the last space when it lands inside a word (only a single\n * word longer than the whole budget is cut hard), and punctuation left\n * dangling before the ellipsis is dropped.\n */\nexport function clampRemoteConfigDescription(text: string): string {\n  if (fitsRemoteConfigDescription(text)) return text\n  const budget =\n    REMOTE_CONFIG_DESCRIPTION_MAX_BYTES - utf8ByteLength(DESCRIPTION_ELLIPSIS)\n  let kept = ''\n  let bytes = 0\n  for (const character of text) {\n    const size = utf8ByteLength(character)\n    if (bytes + size > budget) break\n    kept += character\n    bytes += size\n  }\n  const next = text.charAt(kept.length)\n  if (next && !/\\s/.test(next)) {\n    const lastSpace = kept.search(/\\s\\S*$/)\n    if (lastSpace > 0) kept = kept.slice(0, lastSpace)\n  }\n  return `${kept.replace(/[\\s.,;:(–—-]+$/, '')}${DESCRIPTION_ELLIPSIS}`\n}\n\n/**\n * The description to publish with a release flag's Remote Config parameter\n * (AGL-3048). Always one Remote Config accepts:\n *\n * 1. The registry description, when it fits, so the flags page and the\n *    parameter say the same thing.\n * 2. Otherwise the LIVE parameter's description, when it has one that fits.\n *    Remote Config has already accepted exactly that text, and someone chose\n *    it for the Firebase console. The first 250 characters of a longer\n *    paragraph would drop whatever the paragraph says last: for\n *    `release_assist`, the `/legal/subprocessors` precondition that its\n *    AGL-1909 suite wants in front of whoever reads the flag there. The full\n *    registry text stays on the staff flags page either way.\n * 3. Otherwise, as on a first publish with nothing live to keep, the\n *    registry description clamped at a word boundary.\n */\nexport function releaseFlagParameterDescription(\n  registryDescription: string,\n  liveDescription: string | null | undefined,\n): string {\n  if (fitsRemoteConfigDescription(registryDescription)) {\n    return registryDescription\n  }\n  if (\n    typeof liveDescription === 'string' &&\n    liveDescription.trim().length > 0 &&\n    fitsRemoteConfigDescription(liveDescription)\n  ) {\n    return liveDescription\n  }\n  return clampRemoteConfigDescription(registryDescription)\n}\n\n/**\n * FNV-1a 32-bit hash → 0–99 bucket. Deterministic so a subject keeps the\n * same rollout verdict across sessions and surfaces, and seeded with the\n * flag key so a subject doesn't land in the same bucket for every flag.\n */\nexport function releaseFlagBucket(flagKey: string, subjectId: string): number {\n  let hash = 0x811c9dc5\n  const seed = `${flagKey}:${subjectId}`\n  for (let index = 0; index < seed.length; index += 1) {\n    hash ^= seed.charCodeAt(index)\n    hash = Math.imul(hash, 0x01000193)\n  }\n  return (hash >>> 0) % 100\n}\n\n/**\n * The gating verdict for one subject.\n *\n * `subjectId` is the ORG ID, or nothing. A rollout is a cohort of\n * workspaces, so a whole workspace has to land on one side of the\n * percentage: every surface that asks about an org must ask with the same\n * string, or they answer differently about the same customer.\n *\n * This docstring used to sanction falling back to the uid, and the server\n * gates fell back to a hostId. Since a hostId, a uid and an orgId hash to\n * three different buckets, a mid-rollout flag could be on in the console\n * and off on the published site for one workspace — stable per subject, so\n * it never flickered, it just stayed wrong (AGL-1656).\n *\n * An empty subject only passes fully-enabled flags. That is the deliberate\n * cost: a request with no resolvable org never joins a partial rollout,\n * which is the conservative answer rather than a confidently wrong one.\n */\nexport function isReleaseFlagOn(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  /**\n   * The subject org's plan, when the caller knows it (AGL-2486). Optional so\n   * every pre-existing call site compiles and answers unchanged: a flag that\n   * declares no tier targeting never reads this.\n   */\n  plan?: OrgPlan | null,\n): boolean {\n  if (!releaseFlagTargetsPlan(value, plan)) return false\n  if (value.enabled) return true\n  const percent = clampPercent(value.rolloutPercent)\n  if (percent <= 0 || !subjectId) return false\n  if (percent >= 100) return true\n  return releaseFlagBucket(flagKey, subjectId) < percent\n}\n\n/**\n * Does this flag's tier targeting admit `plan`? (AGL-2486)\n *\n * THE SEMANTICS, because an operator who cannot predict the audience will\n * not stage a rollout at all:\n *\n *  - The tier list is a FILTER, applied before and independently of the\n *    percentage. The percentage then picks a cohort WITHIN the admitted\n *    tiers. \"Pro and above at 50%\" is therefore both \"half of the Pro+\n *    workspaces\" and \"the global 50% cohort, restricted to Pro+\" — the two\n *    readings name the same set, and they do so because\n *    {@link releaseFlagBucket} hashes `flagKey:orgId` and NOTHING ELSE.\n *  - Which is also why the bucket is stable. Adding, removing or reordering\n *    tiers cannot reshuffle the bucket, so an org already inside a 50%\n *    rollout keeps the feature when an unrelated tier joins the list. Had\n *    the plan been mixed into the hash — the obvious way to write this — a\n *    tier edit would have re-drawn the cohort under every customer already\n *    in it, and a plan change would have re-rolled the dice for one.\n *  - The filter binds the FULLY-ENABLED path too, not just the rollout.\n *    \"On, Enterprise + Agency\" is how a launch to the top of the ladder is\n *    expressed, and it is what was actually asked for. Untargeted flags are\n *    unaffected: no list means every tier, so `enabled` still means everyone.\n *  - An UNKNOWN plan fails a declared list. Same conservatism as a missing\n *    subject on a percentage rollout: a caller that cannot say which\n *    workspace it is asking about gets the safe answer rather than a\n *    confidently wrong one. A per-org staff override still wins over all of\n *    it — see {@link isReleaseFlagOnForOrg} — so a targeted flag can still be\n *    handed to one org off-ladder.\n */\nexport function releaseFlagTargetsPlan(\n  value: ReleaseFlagValue,\n  plan: OrgPlan | null | undefined,\n): boolean {\n  const plans = value.plans\n  // `!plans` would be the idiom here, but `strictNullChecks` is off repo-wide\n  // and an empty array is truthy — both \"absent\" and \"empty\" have to be named\n  // for the every-tier reading to actually hold.\n  if (plans == null || plans.length === 0) return true\n  if (!plan) return false\n  return plans.includes(plan)\n}\n\n/**\n * Per-org release-flag overrides (AGL-1635), stored on the org doc at\n * `releaseFlags`. A present key is a staff DECISION about one organization\n * and wins over both the Remote Config value and the rollout bucket; an\n * absent key inherits.\n *\n * A separate field from `entitlements.features` on purpose: those ask\n * whether the org's PLAN includes a feature, these ask whether a\n * not-yet-released feature is switched on for this one customer. Folding\n * them together would make \"granted by the deal\" and \"previewing an\n * unreleased build\" indistinguishable at the point a support question is\n * asked.\n *\n * Why the org doc and not a Remote Config condition: RC conditions are\n * template-global and would need one published condition per org, with a\n * template publish (a manual, separate deploy) for every grant.\n */\nexport type OrgReleaseFlagOverrides = Partial<Record<ReleaseFlagKey, boolean>>\n\n/**\n * Sanitises whatever is actually stored at `org.releaseFlags`.\n *\n * Tolerant for the same reason `parseReleaseFlagValue` is: this map is\n * hand-editable in the Firebase console and survives registry renames, so a\n * retired flag key or a non-boolean must be dropped rather than allowed to\n * gate anything. Unknown keys are discarded — a stale key can never grant a\n * flag that no longer exists, and a typo silently inherits instead of\n * silently forcing.\n */\nexport function parseOrgReleaseFlagOverrides(\n  raw: unknown,\n): OrgReleaseFlagOverrides {\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {}\n  const overrides: OrgReleaseFlagOverrides = {}\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof value === 'boolean' && isReleaseFlagKey(key)) {\n      overrides[key] = value\n    }\n  }\n  return overrides\n}\n\n/**\n * The gating verdict with a per-org override applied on top of\n * `isReleaseFlagOn`.\n *\n * The override is checked FIRST and short-circuits, so a forced-off flag\n * stays off for an org even while the flag is globally enabled — the\n * per-org kill switch is half the point, not just the per-org grant. Every\n * release-flag gate resolves through here so the console, the tenant\n * runtime and the API dispatchers cannot disagree about one org.\n */\nexport function isReleaseFlagOnForOrg(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  overrides: OrgReleaseFlagOverrides | null | undefined,\n  /**\n   * The org's plan, for tier targeting (AGL-2486). Checked only AFTER the\n   * override: a staff grant is a decision about one named customer and\n   * outranks the tier filter exactly as it already outranks the rollout\n   * bucket. That ordering is what lets a Free org preview a\n   * Business-targeted flag without widening the flag for every Free org.\n   *\n   * REQUIRED, and `null` has to be typed out. It was optional for one\n   * release and that cost a silent revenue bug: `report-usage` held the org\n   * document, dropped the argument, and every `plans`-declaring flag read\n   * OFF — so the contacts overage went uninvoiced for exactly the orgs\n   * entitled to reach the feature, with nothing thrown and nothing logged.\n   * An unknown tier still refuses, which is the correct conservatism; what\n   * cannot be allowed is a caller MANUFACTURING an unknown out of a tier it\n   * already has in hand. Spelling `null` makes that a statement rather than\n   * an omission, and makes the next call site that forgets fail to compile\n   * instead of failing to bill. `getOrgReleaseFlagTargeting` returns the\n   * plan beside the overrides from ONE document read precisely so that\n   * passing it costs nothing.\n   */\n  plan: OrgPlan | null,\n): boolean {\n  const override = overrides?.[flagKey]\n  if (typeof override === 'boolean') return override\n  return isReleaseFlagOn(flagKey, value, subjectId, plan)\n}\n"],"names":["PLAN_LABELS","SELF_SERVE_PLANS","PLATFORM_BRAND_NAME","RELEASE_FLAGS","key","label","description","defaultEnabled","navTabId","RELEASE_FLAG_KEYS","map","definition","isReleaseFlagKey","value","includes","getReleaseFlagDefinition","find","entry","Error","clampPercent","percent","Number","isFinite","Math","min","max","round","RELEASE_FLAG_PLAN_LADDER","isOrgPlan","Object","prototype","hasOwnProperty","call","releaseFlagPlansAtOrAbove","plan","index","indexOf","slice","parseReleaseFlagPlans","raw","Array","isArray","undefined","named","Set","filter","size","has","parseReleaseFlagValue","fallbackEnabled","text","trim","enabled","parsed","JSON","parse","plans","rolloutPercent","note","REMOTE_CONFIG_DESCRIPTION_MAX_BYTES","utf8ByteLength","bytes","character","codePoint","codePointAt","fitsRemoteConfigDescription","DESCRIPTION_ELLIPSIS","clampRemoteConfigDescription","budget","kept","next","charAt","length","test","lastSpace","search","replace","releaseFlagParameterDescription","registryDescription","liveDescription","releaseFlagBucket","flagKey","subjectId","hash","seed","charCodeAt","imul","isReleaseFlagOn","releaseFlagTargetsPlan","parseOrgReleaseFlagOverrides","overrides","entries","isReleaseFlagOnForOrg","override"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;CAOC,GAED,6DAA6D;AAE7D,SAASA,WAAW,EAAEC,gBAAgB,QAAQ,yBAAqB;AACnE,SAASC,mBAAmB,QAAQ,sBAAkB;AAwCtD;;;;;CAKC,GACD,OAAO,MAAMC,gBAAkD;IAC7D;QACEC,KAAK;QACLC,OAAO;QACPC,aACE;QACFC,gBAAgB;QAChBC,UAAU;IACZ;IACA,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE;QACEJ,KAAK;QACLC,OAAO;QACPC,aACE,kEACA,wEACA,uEACA,uEACA;QACFC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aACE,qEACA,+DACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,mEACA,qEACA,uEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChB,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,wDAAwD;QACxD,6DAA6D;QAC7D,EAAE;QACF,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,wDAAwD;QACxDC,UAAU;IACZ;IACA,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aACE,uEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,4DACA,uEACA,sEACA,yEACA,uEACA,yEACA,sEACA,wEACA,sEACA,wEACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,mCAAmC;IACnC;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,wEACA,gEACA,wEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO,GAAGH,oBAAoB,OAAO,CAAC;QACtCI,aACE,kEACA,sEACA,kEACA,0EACA,0EACA,oEACA,yEACA,mEACA,sEACA,gEACA,qEACA,sEACA,yEACA,wEACA,0EACA;QACFC,gBAAgB;IAClB;IACA,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,+DAA+D;IAC/D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,0EACA,sEACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,6DAA6D;IAC7D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,2EACA,qEACA;QACFC,gBAAgB;IAClB;IACA,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,8DAA8D;IAC9D,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,sCAAsC;IACtC;QACEH,KAAK;QACLC,OAAO,GAAGH,oBAAoB,cAAc,CAAC;QAC7CI,aACE,6DACA,uEACA,wEACA,uEACA,uEACA,mEACA;QACFC,gBAAgB;IAClB;CACD,CAAA;AAED,OAAO,MAAME,oBAAoBN,cAAcO,GAAG,CAChD,CAACC,aAAeA,WAAWP,GAAG,EACF;AAE9B,OAAO,SAASQ,iBAAiBC,KAAa;IAC5C,OAAO,AAACJ,kBAAwCK,QAAQ,CAACD;AAC3D;AAEA,OAAO,SAASE,yBACdX,GAAmB;IAEnB,MAAMO,aAAaR,cAAca,IAAI,CAAC,CAACC,QAAUA,MAAMb,GAAG,KAAKA;IAC/D,IAAI,CAACO,YAAY,MAAM,IAAIO,MAAM,CAAC,sBAAsB,EAAEd,KAAK;IAC/D,OAAOO;AACT;AA8BA,MAAMQ,eAAe,CAACN;IACpB,MAAMO,UAAU,OAAOP,UAAU,YAAYQ,OAAOC,QAAQ,CAACT,SAASA,QAAQ;IAC9E,OAAOU,KAAKC,GAAG,CAAC,KAAKD,KAAKE,GAAG,CAAC,GAAGF,KAAKG,KAAK,CAACN;AAC9C;AAEA;;;;;;CAMC,GACD,OAAO,MAAMO,2BAA+C;OACvD1B;IACH;CACD,CAAA;AAED,MAAM2B,YAAY,CAACf,QACjB,OAAOA,UAAU,YACjBgB,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAAChC,aAAaa;AAEpD;;;;;;;;;CASC,GACD,OAAO,SAASoB,0BAA0BC,IAAa;IACrD,MAAMC,QAAQR,yBAAyBS,OAAO,CAACF;IAC/C,OAAOC,QAAQ,IAAI,EAAE,GAAGR,yBAAyBU,KAAK,CAACF;AACzD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASG,sBAAsBC,GAAY;IAChD,IAAI,CAACC,MAAMC,OAAO,CAACF,MAAM,OAAOG;IAChC,MAAMC,QAAQ,IAAIC,IAAIL,IAAIM,MAAM,CAACjB;IACjC,IAAIe,MAAMG,IAAI,KAAK,GAAG,OAAOJ;IAC7B,OAAOf,yBAAyBkB,MAAM,CAAC,CAACX,OAASS,MAAMI,GAAG,CAACb;AAC7D;AAEA;;;;;CAKC,GACD,OAAO,SAASc,sBACdT,GAA8B,EAC9BU,eAAwB;IAExB,MAAMC,OAAOX,uBAAAA,IAAKY,IAAI;IACtB,IAAI,CAACD,MAAM,OAAO;QAAEE,SAASH;IAAgB;IAC7C,IAAIC,SAAS,QAAQ,OAAO;QAAEE,SAAS;IAAK;IAC5C,IAAIF,SAAS,SAAS,OAAO;QAAEE,SAAS;IAAM;IAC9C,IAAI;QACF,MAAMC,SAASC,KAAKC,KAAK,CAACL;QAC1B,IAAI,OAAOG,WAAW,WAAW,OAAO;YAAED,SAASC;QAAO;QAC1D,IAAIA,UAAU,OAAOA,WAAW,UAAU;YACxC,MAAMG,QAAQlB,sBAAsBe,OAAOG,KAAK;YAChD,OAAO;gBACLJ,SAASC,OAAOD,OAAO,KAAK;gBAC5BK,gBAAgBtC,aAAakC,OAAOI,cAAc;eAM9CD,QAAQ;gBAAEA;YAAM,IAAI,CAAC;gBACzBE,MAAM,OAAOL,OAAOK,IAAI,KAAK,WAAWL,OAAOK,IAAI,GAAGhB;;QAE1D;IACF,EAAE,eAAM;IACN,uCAAuC;IACzC;IACA,OAAO;QAAEU,SAASH;IAAgB;AACpC;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMU,sCAAsC,IAAG;AAEtD,SAASC,eAAeV,IAAY;IAClC,IAAIW,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;YACVY;QAAlB,MAAMC,aAAYD,yBAAAA,UAAUE,WAAW,CAAC,cAAtBF,yBAA4B;QAC9CD,SACEE,YAAY,OAAO,IAAIA,YAAY,QAAQ,IAAIA,YAAY,UAAU,IAAI;IAC7E;IACA,OAAOF;AACT;AAEA,qEAAqE,GACrE,OAAO,SAASI,4BAA4Bf,IAAY;IACtD,OAAOU,eAAeV,SAASS;AACjC;AAEA,MAAMO,uBAAuB;AAE7B;;;;;;;;CAQC,GACD,OAAO,SAASC,6BAA6BjB,IAAY;IACvD,IAAIe,4BAA4Bf,OAAO,OAAOA;IAC9C,MAAMkB,SACJT,sCAAsCC,eAAeM;IACvD,IAAIG,OAAO;IACX,IAAIR,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;QAC5B,MAAMJ,OAAOc,eAAeE;QAC5B,IAAID,QAAQf,OAAOsB,QAAQ;QAC3BC,QAAQP;QACRD,SAASf;IACX;IACA,MAAMwB,OAAOpB,KAAKqB,MAAM,CAACF,KAAKG,MAAM;IACpC,IAAIF,QAAQ,CAAC,KAAKG,IAAI,CAACH,OAAO;QAC5B,MAAMI,YAAYL,KAAKM,MAAM,CAAC;QAC9B,IAAID,YAAY,GAAGL,OAAOA,KAAKhC,KAAK,CAAC,GAAGqC;IAC1C;IACA,OAAO,GAAGL,KAAKO,OAAO,CAAC,kBAAkB,MAAMV,sBAAsB;AACvE;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASW,gCACdC,mBAA2B,EAC3BC,eAA0C;IAE1C,IAAId,4BAA4Ba,sBAAsB;QACpD,OAAOA;IACT;IACA,IACE,OAAOC,oBAAoB,YAC3BA,gBAAgB5B,IAAI,GAAGqB,MAAM,GAAG,KAChCP,4BAA4Bc,kBAC5B;QACA,OAAOA;IACT;IACA,OAAOZ,6BAA6BW;AACtC;AAEA;;;;CAIC,GACD,OAAO,SAASE,kBAAkBC,OAAe,EAAEC,SAAiB;IAClE,IAAIC,OAAO;IACX,MAAMC,OAAO,GAAGH,QAAQ,CAAC,EAAEC,WAAW;IACtC,IAAK,IAAI/C,QAAQ,GAAGA,QAAQiD,KAAKZ,MAAM,EAAErC,SAAS,EAAG;QACnDgD,QAAQC,KAAKC,UAAU,CAAClD;QACxBgD,OAAO5D,KAAK+D,IAAI,CAACH,MAAM;IACzB;IACA,OAAO,AAACA,CAAAA,SAAS,CAAA,IAAK;AACxB;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASI,gBACdN,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpC;;;;GAIC,GACDhD,IAAqB;IAErB,IAAI,CAACsD,uBAAuB3E,OAAOqB,OAAO,OAAO;IACjD,IAAIrB,MAAMuC,OAAO,EAAE,OAAO;IAC1B,MAAMhC,UAAUD,aAAaN,MAAM4C,cAAc;IACjD,IAAIrC,WAAW,KAAK,CAAC8D,WAAW,OAAO;IACvC,IAAI9D,WAAW,KAAK,OAAO;IAC3B,OAAO4D,kBAAkBC,SAASC,aAAa9D;AACjD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,SAASoE,uBACd3E,KAAuB,EACvBqB,IAAgC;IAEhC,MAAMsB,QAAQ3C,MAAM2C,KAAK;IACzB,4EAA4E;IAC5E,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAIA,SAAS,QAAQA,MAAMgB,MAAM,KAAK,GAAG,OAAO;IAChD,IAAI,CAACtC,MAAM,OAAO;IAClB,OAAOsB,MAAM1C,QAAQ,CAACoB;AACxB;AAqBA;;;;;;;;;CASC,GACD,OAAO,SAASuD,6BACdlD,GAAY;IAEZ,IAAI,CAACA,OAAO,OAAOA,QAAQ,YAAYC,MAAMC,OAAO,CAACF,MAAM,OAAO,CAAC;IACnE,MAAMmD,YAAqC,CAAC;IAC5C,KAAK,MAAM,CAACtF,KAAKS,MAAM,IAAIgB,OAAO8D,OAAO,CAACpD,KAAiC;QACzE,IAAI,OAAO1B,UAAU,aAAaD,iBAAiBR,MAAM;YACvDsF,SAAS,CAACtF,IAAI,GAAGS;QACnB;IACF;IACA,OAAO6E;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASE,sBACdX,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpCQ,SAAqD,EACrD;;;;;;;;;;;;;;;;;;;GAmBC,GACDxD,IAAoB;IAEpB,MAAM2D,WAAWH,6BAAAA,SAAW,CAACT,QAAQ;IACrC,IAAI,OAAOY,aAAa,WAAW,OAAOA;IAC1C,OAAON,gBAAgBN,SAASpE,OAAOqE,WAAWhD;AACpD"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/release-flags.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Release flags (AGL-227): platform-level \"is this feature launched\"\n * gating backed by Firebase Remote Config. A separate axis from plan\n * entitlements (`plan-entitlements.ts`) — entitlements ask whether the\n * tenant's PLAN includes a feature, release flags ask whether the feature\n * is released to the public at all (or partially, via percentage rollout).\n * Staff bypass release flags everywhere but see a flagged warning.\n */\n\n/** Remote Config parameter keys for release-gated features. */\nimport type { OrgPlan } from '../foundation'\nimport { PLAN_LABELS, SELF_SERVE_PLANS } from './plan-entitlements'\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\n\nexport type ReleaseFlagKey =\n  | 'release_crm'\n  | 'release_outreach'\n  | 'release_bookings'\n  | 'release_events'\n  | 'release_data_store'\n  | 'release_workflows'\n  | 'release_redirects'\n  | 'release_commerce_v2'\n  | 'release_member_accounts'\n  | 'release_marketplace'\n  | 'release_marketing'\n  | 'release_email'\n  | 'release_inbox'\n  | 'release_logic'\n  | 'release_addon_store'\n  | 'release_native_checkout'\n  | 'release_edit_bar'\n  | 'release_assist'\n  | 'release_video_uploads'\n  | 'release_video_delivery'\n  | 'release_ai_generative'\n\nexport interface ReleaseFlagDefinition {\n  key: ReleaseFlagKey\n  label: string\n  description: string\n  /**\n   * Fallback verdict when Remote Config is unreachable (offline, blocked,\n   * first paint before activate). MUST match the seeded value in\n   * cloud/firebase-remoteconfig.template.json so environments without a\n   * published template behave like the template intends.\n   */\n  defaultEnabled: boolean\n  /** Host dashboard tab id (host-nav-tabs.ts) this flag hides, if any. */\n  navTabId?: string\n}\n\n/**\n * The registry: one entry per gated feature. Adding a flag = add it here,\n * seed it in the Remote Config template, and (optionally) wrap the page in\n * `<FeatureGate>` — the staff admin editor and nav filtering pick it up\n * from this list.\n */\nexport const RELEASE_FLAGS: readonly ReleaseFlagDefinition[] = [\n  {\n    key: 'release_crm',\n    label: 'CRM',\n    description:\n      'The CRM: contacts, leads, companies, deals, tasks, reports and fields.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-contacts',\n  },\n  // Sequences (AGL-2974): the plugin's kill switch as well as its launch\n  // gate, like every first-party plugin's flag since AGL-422 — off, it is\n  // subtracted from the console loader and the API dispatcher for everyone\n  // but staff. OFF by default, because nothing behind it sends mail yet and\n  // no plan carries the `outreach` entitlement it also needs. The KEY stays\n  // `release_outreach`: it is persisted in Remote Config (AGL-3199).\n  {\n    key: 'release_outreach',\n    label: 'Sequences',\n    description:\n      'One-to-one, multi-step email sequences sent from a rep’s own ' +\n      'connected mailbox and logged in the CRM (AGL-2974). OFF by default ' +\n      'and staff preview only. An organization also needs the `outreach` ' +\n      'entitlement, which no plan carries, so a customer reaches it only ' +\n      'through a per-org entitlement override.',\n    defaultEnabled: false,\n    navTabId: 'nav-tab-org-outreach',\n  },\n  {\n    key: 'release_bookings',\n    label: 'Bookings',\n    description: 'Bookings & scheduling for host sites.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-bookings',\n  },\n  {\n    key: 'release_events',\n    label: 'Events',\n    description: 'Event calendar management (AGL-145 add-on surface).',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-events',\n  },\n  {\n    key: 'release_data_store',\n    label: 'Data store',\n    description: 'Datasets, models and dynamic data bindings.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-data',\n  },\n  {\n    key: 'release_workflows',\n    label: 'Automation',\n    description: 'Workflows, actions, webhooks and their run history.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-workflows',\n  },\n  {\n    key: 'release_redirects',\n    label: 'Redirects',\n    description: 'Redirect manager with usage analytics.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-redirects',\n  },\n  {\n    key: 'release_commerce_v2',\n    label: 'Commerce v2',\n    description:\n      'Full ecommerce wave: catalog/variants, cart + checkout, digital ' +\n      'goods, reservations, POS, and the repriced commerce tiers ' +\n      '(AGL-276..331).',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_member_accounts',\n    label: 'User Accounts',\n    description:\n      'Visitor accounts on published sites: the /signin, /signup and ' +\n      '/recover pages and the Members blocks (AGL-2486). Platform-wide ' +\n      'kill switch only — whether a given SITE serves those pages is the ' +\n      'per-site User Accounts toggle, which is off until a site opts in.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_marketplace',\n    label: 'Marketplace',\n    description: 'Marketplace browsing, publishing and plugin installs.',\n    defaultEnabled: true,\n    // AGL-1654: was 'nav-tab-marketplace', which matched no nav item, so\n    // `gateNavTabItems` never hid the tab. The id is still held to a real\n    // declaration by `release-flag-nav-tab-ids.spec.ts` — but it is no longer\n    // held there BY HAND: AGL-3080 made the org Marketplace tab the\n    // marketplace plugin's own `orgNavItems` entry, so the tab and the\n    // surface behind it are one declaration that names this id once.\n    //\n    // The second half of that comment — \"the page behind it carries no\n    // `<FeatureGate>`\" — was still true until AGL-2019 and is no longer.\n    // Flipping this flag off used to subtract the marketplace plugin from\n    // the loader and both API dispatchers while the page went on rendering\n    // in full, so the OFF state was itself broken and \"just turn the flag\n    // off\" was not an available answer for an operator who does not want a\n    // marketplace. The page is gated now, so off means off.\n    navTabId: 'nav-tab-org-marketplace',\n  },\n  // AGL-422: every first-party plugin is release-flagged — the flag now\n  // feeds the plugin LOADER (console, published sites, API dispatch), not\n  // just nav visibility, so staff can kill-switch a whole plugin platform-\n  // wide from the Feature Flags page.\n  {\n    key: 'release_marketing',\n    label: 'Marketing',\n    description: 'Overlays, campaigns at-a-glance, and A/B experiments.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-marketing',\n  },\n  {\n    key: 'release_email',\n    label: 'Email',\n    description: 'Designed emails, campaigns, and audience sending.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_inbox',\n    label: 'Inbox',\n    description: 'Form submissions, site members, and the lead inbox.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-inbox',\n  },\n  {\n    key: 'release_logic',\n    label: 'Logic',\n    description: 'Variables, no-code functions, and reference health.',\n    defaultEnabled: true,\n    navTabId: 'nav-tab-logic',\n  },\n  {\n    key: 'release_addon_store',\n    label: 'Add-on store',\n    description:\n      'Self-serve add-on purchases on the Billing page: seats, datasets, ' +\n      'extra sites, POS registers, Event Calendar (AGL-524..531).',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_native_checkout',\n    label: 'In-page checkout',\n    description:\n      'Pay without leaving the page, instead of a redirect to ' +\n      'checkout.stripe.com. TWO surfaces: the console plan checkout uses ' +\n      'embedded Checkout (AGL-1132), and a merchant storefront uses the ' +\n      'Payment Element on the merchant\\u2019s own domain (AGL-1944) \\u2014 ' +\n      'which is the half that costs conversions, since leaving the store ' +\n      'mid-purchase is where carts get abandoned. Both keep the webhook as ' +\n      'the only thing that fulfils. OFF by default: the redirect is the ' +\n      'proven path, and neither surface can be verified without putting a ' +\n      'real card through it. Also gated on a publishable key being set, ' +\n      'per surface \\u2014 so flipping this alone degrades to the redirect ' +\n      'rather than to a dead button.',\n    defaultEnabled: false,\n  },\n  // Released to every site 2026-09-16 (AGL-3041). Still the whole surface's\n  // kill switch, globally or for one org by override: off, the tenant slot\n  // renders nothing, both token mints refuse, and `/api/edit-context` turns\n  // away every token already issued.\n  {\n    key: 'release_edit_bar',\n    label: 'Site admin bar',\n    description:\n      'Admin bar on published sites: a signed-in editor jumps from a live ' +\n      'page into the besigner for the screen serving it. Released ' +\n      '2026-09-16 (AGL-3041) for every site; turning it off hides the bar ' +\n      'and revokes every outstanding edit token at the verify site.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_assist',\n    label: `${PLATFORM_BRAND_NAME} Assist`,\n    description:\n      'The in-console AI chat helper on every page (AGL-1860): docs-' +\n      'grounded answers with deep links, page-context guidance on Pro+. ' +\n      'OFF by default, and blocked on TWO published legal artifacts ' +\n      '(AGL-1909), neither of which is a repo file — both are live besigner ' +\n      'pages, so publication is what satisfies them: (1) the privacy-policy ' +\n      'disclosure for stored Q&A, because the data loop records every ' +\n      'exchange org-scoped under orgs/{orgId}/assistExchanges; and (2) the ' +\n      'Anthropic row on /legal/subprocessors, which was deliberately ' +\n      'REMOVED on 2026-08-13 (subprocessorsV2a-20260813) on the premise ' +\n      'that no production key existed — so the page is not merely ' +\n      'incomplete without it, it is affirmatively wrong. NOTE the real ' +\n      'trigger is ANTHROPIC_API_KEY, not this flag: /api/ai/assist (the ' +\n      'besigner copy assistant, AGL-89/130/169) carries no release flag at ' +\n      'all and sends customer site content to Anthropic on the key plus a ' +\n      'Pro entitlement alone. Setting the key in production therefore makes ' +\n      'Anthropic a subprocessor whether or not this flag is ever flipped.',\n    defaultEnabled: false,\n  },\n  // Ingress only, and with no staff preview on the server: a video a staff\n  // session uploads into a customer's library serves on that customer's pages\n  // like any other, so a grant goes to the org through its override.\n  // `apps/console/utils/server/video-uploads.ts` holds the gate.\n  {\n    key: 'release_video_uploads',\n    label: 'Video uploads',\n    description:\n      'New video in the media library, on every upload path (AGL-2830). ' +\n      'Off: refused with 403 video_uploads_paused, as DAM video delivery is ' +\n      'not yet metered or bounded per org (AGL-2810, AGL-2812). Images, ' +\n      'documents and stored videos are unaffected.',\n    defaultEnabled: false,\n  },\n  // Delivery, not ingress: this flag decides whether a video already in the\n  // library is COPIED to the configured delivery provider and served from it\n  // through a short-lived signed redirect (AGL-2824). Per org, with no staff\n  // preview on the server — a copy is customer data at the provider, so a\n  // grant goes to the org through its override. Off, or with no provider\n  // configured, every video serves from this platform exactly as before.\n  // `media-delivery.ts` in `tenant-data-admin` holds the gate.\n  {\n    key: 'release_video_delivery',\n    label: 'Video delivery',\n    description:\n      'Serves library video from a configured delivery provider through ' +\n      'short-lived signed redirects, and copies each video to it (AGL-2824). ' +\n      'OFF by default: video serves from this platform as before. Also ' +\n      \"needs the provider's settings.\",\n    defaultEnabled: false,\n  },\n  // The generative doors share one runtime with Assist (AGL-2903) but not\n  // its flag: `release_assist` answers questions, this builds things, and\n  // the two are sold, metered and disclosed separately. The server-side\n  // gate lives in `aiGateLadder` (404 when off, staff preview).\n  // Labeled for what it switches — the generative doors — and not with the\n  // add-on's own name, which is sold and live whether or not the doors are\n  // released: the docs name the add-on, and a flag wearing the same words\n  // reads as documented when it is not.\n  {\n    key: 'release_ai_generative',\n    label: `${PLATFORM_BRAND_NAME} AI generation`,\n    description:\n      'Generative building and automation behind the AI add-on ' +\n      '(AGL-2903): sections, pages and workflows written by a model from ' +\n      'a brief, on the shared Anthropic runtime. OFF by default and staff ' +\n      'preview only; every generative route answers 404 while it is off. ' +\n      'Turning it on sends customer briefs and site content to Anthropic ' +\n      'on the same ANTHROPIC_API_KEY and under the same subprocessor ' +\n      'disclosure as Assist (AGL-1909).',\n    defaultEnabled: false,\n  },\n]\n\nexport const RELEASE_FLAG_KEYS = RELEASE_FLAGS.map(\n  (definition) => definition.key,\n) as readonly ReleaseFlagKey[]\n\nexport function isReleaseFlagKey(value: string): value is ReleaseFlagKey {\n  return (RELEASE_FLAG_KEYS as readonly string[]).includes(value)\n}\n\nexport function getReleaseFlagDefinition(\n  key: ReleaseFlagKey,\n): ReleaseFlagDefinition {\n  const definition = RELEASE_FLAGS.find((entry) => entry.key === key)\n  if (!definition) throw new Error(`Unknown release flag: ${key}`)\n  return definition\n}\n\n/**\n * The JSON payload stored in each Remote Config parameter. `enabled: true`\n * turns the feature on for everyone; `enabled: false` with a positive\n * `rolloutPercent` enables it for that percentage of subjects (stable\n * per-tenant bucketing, GrowthBook-style); `plans` narrows either of those\n * to a set of tiers (AGL-2486).\n */\nexport interface ReleaseFlagValue {\n  enabled: boolean\n  /** 0–100; only consulted while `enabled` is false. */\n  rolloutPercent?: number\n  /**\n   * Plan/tier targeting (AGL-2486). The tiers this flag is being rolled out\n   * to, or ABSENT for \"every tier\".\n   *\n   * ABSENT AND EMPTY BOTH MEAN EVERY TIER, and that is load-bearing: every\n   * flag stored before this field existed parses to `undefined` here, and an\n   * operator who unticks every box has plainly not asked for a flag that\n   * reaches nobody. Reading an empty list as \"no tiers\" would dark-launch\n   * nothing while the console still said the flag was on — the inverted\n   * reading of this field is the whole hazard, so it is closed in the parser\n   * rather than left to each call site.\n   */\n  plans?: OrgPlan[]\n  /** Free-form staff note (\"waiting on AGL-199\", owner, etc.). */\n  note?: string\n}\n\nconst clampPercent = (value: unknown): number => {\n  const percent = typeof value === 'number' && Number.isFinite(value) ? value : 0\n  return Math.min(100, Math.max(0, Math.round(percent)))\n}\n\n/**\n * Every plan a flag may target, cheapest first — `SELF_SERVE_PLANS` then\n * `enterprise`, the same ladder `planGrantingFeature` walks and the same\n * order the plan grid renders. Derived, never re-typed: pricing v3 inserted\n * `scale` mid-ladder and added `agency`, and a second hand-written tier list\n * here would have missed both.\n */\nexport const RELEASE_FLAG_PLAN_LADDER: readonly OrgPlan[] = [\n  ...SELF_SERVE_PLANS,\n  'enterprise' as OrgPlan,\n]\n\nconst isOrgPlan = (value: unknown): value is OrgPlan =>\n  typeof value === 'string' &&\n  Object.prototype.hasOwnProperty.call(PLAN_LABELS, value)\n\n/**\n * The tiers on the ladder at or above `plan` — what the console's \"Pro and\n * above\" shortcut expands to before it is STORED as an explicit list.\n *\n * Deliberately a UI convenience and not a stored \"minimum plan\" mode: a\n * stored threshold would silently re-aim every live flag the day a tier is\n * inserted into the middle of the ladder (pricing v3 did exactly that with\n * `scale`). An explicit list means the audience of a published flag only\n * ever changes because a human changed it.\n */\nexport function releaseFlagPlansAtOrAbove(plan: OrgPlan): OrgPlan[] {\n  const index = RELEASE_FLAG_PLAN_LADDER.indexOf(plan)\n  return index < 0 ? [] : RELEASE_FLAG_PLAN_LADDER.slice(index)\n}\n\n/**\n * Sanitises whatever is stored at `plans`, in ladder order.\n *\n * Returns `undefined` — not `[]` — for \"no targeting declared\", so the\n * absence survives a round trip through the staff editor and cannot be\n * written back as a list that means something else. Unknown tier names are\n * dropped for the same reason `parseOrgReleaseFlagOverrides` drops unknown\n * keys: a renamed or retired tier must never gate anything. A list that\n * names ONLY unknown tiers collapses to `undefined` (every tier) rather than\n * to an empty list, because a typo must inherit, never silently target.\n */\nexport function parseReleaseFlagPlans(raw: unknown): OrgPlan[] | undefined {\n  if (!Array.isArray(raw)) return undefined\n  const named = new Set(raw.filter(isOrgPlan))\n  if (named.size === 0) return undefined\n  return RELEASE_FLAG_PLAN_LADDER.filter((plan) => named.has(plan))\n}\n\n/**\n * Parses a Remote Config parameter string into a `ReleaseFlagValue`.\n * Tolerant by design — the template is hand-editable in the Firebase\n * console, so plain \"true\"/\"false\" strings and malformed JSON must not\n * crash gating: anything unreadable falls back to the registry default.\n */\nexport function parseReleaseFlagValue(\n  raw: string | null | undefined,\n  fallbackEnabled: boolean,\n): ReleaseFlagValue {\n  const text = raw?.trim()\n  if (!text) return { enabled: fallbackEnabled }\n  if (text === 'true') return { enabled: true }\n  if (text === 'false') return { enabled: false }\n  try {\n    const parsed = JSON.parse(text)\n    if (typeof parsed === 'boolean') return { enabled: parsed }\n    if (parsed && typeof parsed === 'object') {\n      const plans = parseReleaseFlagPlans(parsed.plans)\n      return {\n        enabled: parsed.enabled === true,\n        rolloutPercent: clampPercent(parsed.rolloutPercent),\n        // Spread, so a flag stored before AGL-2486 has NO `plans` key at all\n        // rather than an explicit `undefined`. `JSON.stringify` drops both,\n        // but the two are not the same to `'plans' in value`, which is what\n        // the staff PUT uses to tell \"the operator cleared the targeting\"\n        // apart from \"this client never sent the field\".\n        ...(plans ? { plans } : {}),\n        note: typeof parsed.note === 'string' ? parsed.note : undefined,\n      }\n    }\n  } catch {\n    // fall through to the registry default\n  }\n  return { enabled: fallbackEnabled }\n}\n\n/**\n * The longest parameter description Remote Config will publish (AGL-3048).\n *\n * One description past it refuses the WHOLE publish with\n * `DESCRIPTION_EXCEEDS_MAXIMUM_SIZE`, which the staff flags route answered as\n * a 500. Registry descriptions are written for the staff flags page, and\n * several run far past the limit, so what the page shows and what a\n * parameter carries cannot always be the same text.\n *\n * Counted in UTF-8 BYTES. Remote Config states the limit in characters\n * without saying how it counts them, and a UTF-8 byte count is never smaller\n * than the code-point or UTF-16 count, so text within 256 bytes is within the\n * limit on every reading. The cost is a few characters of headroom on text\n * with typographic punctuation.\n */\nexport const REMOTE_CONFIG_DESCRIPTION_MAX_BYTES = 256\n\nfunction utf8ByteLength(text: string): number {\n  let bytes = 0\n  for (const character of text) {\n    const codePoint = character.codePointAt(0) ?? 0\n    bytes +=\n      codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4\n  }\n  return bytes\n}\n\n/** Whether Remote Config accepts `text` as a parameter description. */\nexport function fitsRemoteConfigDescription(text: string): boolean {\n  return utf8ByteLength(text) <= REMOTE_CONFIG_DESCRIPTION_MAX_BYTES\n}\n\nconst DESCRIPTION_ELLIPSIS = '…'\n\n/**\n * `text` cut to a length Remote Config accepts, at a word boundary, with an\n * ellipsis marking the cut. Text that already fits comes back unchanged.\n *\n * The cut takes whole code points, so a multi-byte character is never split.\n * It backs up to the last space when it lands inside a word (only a single\n * word longer than the whole budget is cut hard), and punctuation left\n * dangling before the ellipsis is dropped.\n */\nexport function clampRemoteConfigDescription(text: string): string {\n  if (fitsRemoteConfigDescription(text)) return text\n  const budget =\n    REMOTE_CONFIG_DESCRIPTION_MAX_BYTES - utf8ByteLength(DESCRIPTION_ELLIPSIS)\n  let kept = ''\n  let bytes = 0\n  for (const character of text) {\n    const size = utf8ByteLength(character)\n    if (bytes + size > budget) break\n    kept += character\n    bytes += size\n  }\n  const next = text.charAt(kept.length)\n  if (next && !/\\s/.test(next)) {\n    const lastSpace = kept.search(/\\s\\S*$/)\n    if (lastSpace > 0) kept = kept.slice(0, lastSpace)\n  }\n  return `${kept.replace(/[\\s.,;:(–—-]+$/, '')}${DESCRIPTION_ELLIPSIS}`\n}\n\n/**\n * The description to publish with a release flag's Remote Config parameter\n * (AGL-3048). Always one Remote Config accepts:\n *\n * 1. The registry description, when it fits, so the flags page and the\n *    parameter say the same thing.\n * 2. Otherwise the LIVE parameter's description, when it has one that fits.\n *    Remote Config has already accepted exactly that text, and someone chose\n *    it for the Firebase console. The first 250 characters of a longer\n *    paragraph would drop whatever the paragraph says last: for\n *    `release_assist`, the `/legal/subprocessors` precondition that its\n *    AGL-1909 suite wants in front of whoever reads the flag there. The full\n *    registry text stays on the staff flags page either way.\n * 3. Otherwise, as on a first publish with nothing live to keep, the\n *    registry description clamped at a word boundary.\n */\nexport function releaseFlagParameterDescription(\n  registryDescription: string,\n  liveDescription: string | null | undefined,\n): string {\n  if (fitsRemoteConfigDescription(registryDescription)) {\n    return registryDescription\n  }\n  if (\n    typeof liveDescription === 'string' &&\n    liveDescription.trim().length > 0 &&\n    fitsRemoteConfigDescription(liveDescription)\n  ) {\n    return liveDescription\n  }\n  return clampRemoteConfigDescription(registryDescription)\n}\n\n/**\n * FNV-1a 32-bit hash → 0–99 bucket. Deterministic so a subject keeps the\n * same rollout verdict across sessions and surfaces, and seeded with the\n * flag key so a subject doesn't land in the same bucket for every flag.\n */\nexport function releaseFlagBucket(flagKey: string, subjectId: string): number {\n  let hash = 0x811c9dc5\n  const seed = `${flagKey}:${subjectId}`\n  for (let index = 0; index < seed.length; index += 1) {\n    hash ^= seed.charCodeAt(index)\n    hash = Math.imul(hash, 0x01000193)\n  }\n  return (hash >>> 0) % 100\n}\n\n/**\n * The gating verdict for one subject.\n *\n * `subjectId` is the ORG ID, or nothing. A rollout is a cohort of\n * workspaces, so a whole workspace has to land on one side of the\n * percentage: every surface that asks about an org must ask with the same\n * string, or they answer differently about the same customer.\n *\n * This docstring used to sanction falling back to the uid, and the server\n * gates fell back to a hostId. Since a hostId, a uid and an orgId hash to\n * three different buckets, a mid-rollout flag could be on in the console\n * and off on the published site for one workspace — stable per subject, so\n * it never flickered, it just stayed wrong (AGL-1656).\n *\n * An empty subject only passes fully-enabled flags. That is the deliberate\n * cost: a request with no resolvable org never joins a partial rollout,\n * which is the conservative answer rather than a confidently wrong one.\n */\nexport function isReleaseFlagOn(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  /**\n   * The subject org's plan, when the caller knows it (AGL-2486). Optional so\n   * every pre-existing call site compiles and answers unchanged: a flag that\n   * declares no tier targeting never reads this.\n   */\n  plan?: OrgPlan | null,\n): boolean {\n  if (!releaseFlagTargetsPlan(value, plan)) return false\n  if (value.enabled) return true\n  const percent = clampPercent(value.rolloutPercent)\n  if (percent <= 0 || !subjectId) return false\n  if (percent >= 100) return true\n  return releaseFlagBucket(flagKey, subjectId) < percent\n}\n\n/**\n * Does this flag's tier targeting admit `plan`? (AGL-2486)\n *\n * THE SEMANTICS, because an operator who cannot predict the audience will\n * not stage a rollout at all:\n *\n *  - The tier list is a FILTER, applied before and independently of the\n *    percentage. The percentage then picks a cohort WITHIN the admitted\n *    tiers. \"Pro and above at 50%\" is therefore both \"half of the Pro+\n *    workspaces\" and \"the global 50% cohort, restricted to Pro+\" — the two\n *    readings name the same set, and they do so because\n *    {@link releaseFlagBucket} hashes `flagKey:orgId` and NOTHING ELSE.\n *  - Which is also why the bucket is stable. Adding, removing or reordering\n *    tiers cannot reshuffle the bucket, so an org already inside a 50%\n *    rollout keeps the feature when an unrelated tier joins the list. Had\n *    the plan been mixed into the hash — the obvious way to write this — a\n *    tier edit would have re-drawn the cohort under every customer already\n *    in it, and a plan change would have re-rolled the dice for one.\n *  - The filter binds the FULLY-ENABLED path too, not just the rollout.\n *    \"On, Enterprise + Agency\" is how a launch to the top of the ladder is\n *    expressed, and it is what was actually asked for. Untargeted flags are\n *    unaffected: no list means every tier, so `enabled` still means everyone.\n *  - An UNKNOWN plan fails a declared list. Same conservatism as a missing\n *    subject on a percentage rollout: a caller that cannot say which\n *    workspace it is asking about gets the safe answer rather than a\n *    confidently wrong one. A per-org staff override still wins over all of\n *    it — see {@link isReleaseFlagOnForOrg} — so a targeted flag can still be\n *    handed to one org off-ladder.\n */\nexport function releaseFlagTargetsPlan(\n  value: ReleaseFlagValue,\n  plan: OrgPlan | null | undefined,\n): boolean {\n  const plans = value.plans\n  // `!plans` would be the idiom here, but `strictNullChecks` is off repo-wide\n  // and an empty array is truthy — both \"absent\" and \"empty\" have to be named\n  // for the every-tier reading to actually hold.\n  if (plans == null || plans.length === 0) return true\n  if (!plan) return false\n  return plans.includes(plan)\n}\n\n/**\n * Per-org release-flag overrides (AGL-1635), stored on the org doc at\n * `releaseFlags`. A present key is a staff DECISION about one organization\n * and wins over both the Remote Config value and the rollout bucket; an\n * absent key inherits.\n *\n * A separate field from `entitlements.features` on purpose: those ask\n * whether the org's PLAN includes a feature, these ask whether a\n * not-yet-released feature is switched on for this one customer. Folding\n * them together would make \"granted by the deal\" and \"previewing an\n * unreleased build\" indistinguishable at the point a support question is\n * asked.\n *\n * Why the org doc and not a Remote Config condition: RC conditions are\n * template-global and would need one published condition per org, with a\n * template publish (a manual, separate deploy) for every grant.\n */\nexport type OrgReleaseFlagOverrides = Partial<Record<ReleaseFlagKey, boolean>>\n\n/**\n * Sanitises whatever is actually stored at `org.releaseFlags`.\n *\n * Tolerant for the same reason `parseReleaseFlagValue` is: this map is\n * hand-editable in the Firebase console and survives registry renames, so a\n * retired flag key or a non-boolean must be dropped rather than allowed to\n * gate anything. Unknown keys are discarded — a stale key can never grant a\n * flag that no longer exists, and a typo silently inherits instead of\n * silently forcing.\n */\nexport function parseOrgReleaseFlagOverrides(\n  raw: unknown,\n): OrgReleaseFlagOverrides {\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {}\n  const overrides: OrgReleaseFlagOverrides = {}\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof value === 'boolean' && isReleaseFlagKey(key)) {\n      overrides[key] = value\n    }\n  }\n  return overrides\n}\n\n/**\n * The gating verdict with a per-org override applied on top of\n * `isReleaseFlagOn`.\n *\n * The override is checked FIRST and short-circuits, so a forced-off flag\n * stays off for an org even while the flag is globally enabled — the\n * per-org kill switch is half the point, not just the per-org grant. Every\n * release-flag gate resolves through here so the console, the tenant\n * runtime and the API dispatchers cannot disagree about one org.\n */\nexport function isReleaseFlagOnForOrg(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  overrides: OrgReleaseFlagOverrides | null | undefined,\n  /**\n   * The org's plan, for tier targeting (AGL-2486). Checked only AFTER the\n   * override: a staff grant is a decision about one named customer and\n   * outranks the tier filter exactly as it already outranks the rollout\n   * bucket. That ordering is what lets a Free org preview a\n   * Business-targeted flag without widening the flag for every Free org.\n   *\n   * REQUIRED, and `null` has to be typed out. It was optional for one\n   * release and that cost a silent revenue bug: `report-usage` held the org\n   * document, dropped the argument, and every `plans`-declaring flag read\n   * OFF — so the contacts overage went uninvoiced for exactly the orgs\n   * entitled to reach the feature, with nothing thrown and nothing logged.\n   * An unknown tier still refuses, which is the correct conservatism; what\n   * cannot be allowed is a caller MANUFACTURING an unknown out of a tier it\n   * already has in hand. Spelling `null` makes that a statement rather than\n   * an omission, and makes the next call site that forgets fail to compile\n   * instead of failing to bill. `getOrgReleaseFlagTargeting` returns the\n   * plan beside the overrides from ONE document read precisely so that\n   * passing it costs nothing.\n   */\n  plan: OrgPlan | null,\n): boolean {\n  const override = overrides?.[flagKey]\n  if (typeof override === 'boolean') return override\n  return isReleaseFlagOn(flagKey, value, subjectId, plan)\n}\n"],"names":["PLAN_LABELS","SELF_SERVE_PLANS","PLATFORM_BRAND_NAME","RELEASE_FLAGS","key","label","description","defaultEnabled","navTabId","RELEASE_FLAG_KEYS","map","definition","isReleaseFlagKey","value","includes","getReleaseFlagDefinition","find","entry","Error","clampPercent","percent","Number","isFinite","Math","min","max","round","RELEASE_FLAG_PLAN_LADDER","isOrgPlan","Object","prototype","hasOwnProperty","call","releaseFlagPlansAtOrAbove","plan","index","indexOf","slice","parseReleaseFlagPlans","raw","Array","isArray","undefined","named","Set","filter","size","has","parseReleaseFlagValue","fallbackEnabled","text","trim","enabled","parsed","JSON","parse","plans","rolloutPercent","note","REMOTE_CONFIG_DESCRIPTION_MAX_BYTES","utf8ByteLength","bytes","character","codePoint","codePointAt","fitsRemoteConfigDescription","DESCRIPTION_ELLIPSIS","clampRemoteConfigDescription","budget","kept","next","charAt","length","test","lastSpace","search","replace","releaseFlagParameterDescription","registryDescription","liveDescription","releaseFlagBucket","flagKey","subjectId","hash","seed","charCodeAt","imul","isReleaseFlagOn","releaseFlagTargetsPlan","parseOrgReleaseFlagOverrides","overrides","entries","isReleaseFlagOnForOrg","override"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;CAOC,GAED,6DAA6D;AAE7D,SAASA,WAAW,EAAEC,gBAAgB,QAAQ,yBAAqB;AACnE,SAASC,mBAAmB,QAAQ,sBAAkB;AAwCtD;;;;;CAKC,GACD,OAAO,MAAMC,gBAAkD;IAC7D;QACEC,KAAK;QACLC,OAAO;QACPC,aACE;QACFC,gBAAgB;QAChBC,UAAU;IACZ;IACA,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE;QACEJ,KAAK;QACLC,OAAO;QACPC,aACE,kEACA,wEACA,uEACA,uEACA;QACFC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aACE,qEACA,+DACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,mEACA,qEACA,uEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChB,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,EAAE;QACF,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,wDAAwD;QACxDC,UAAU;IACZ;IACA,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aAAa;QACbC,gBAAgB;QAChBC,UAAU;IACZ;IACA;QACEJ,KAAK;QACLC,OAAO;QACPC,aACE,uEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,4DACA,uEACA,sEACA,yEACA,uEACA,yEACA,sEACA,wEACA,sEACA,wEACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,mCAAmC;IACnC;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,wEACA,gEACA,wEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO,GAAGH,oBAAoB,OAAO,CAAC;QACtCI,aACE,kEACA,sEACA,kEACA,0EACA,0EACA,oEACA,yEACA,mEACA,sEACA,gEACA,qEACA,sEACA,yEACA,wEACA,0EACA;QACFC,gBAAgB;IAClB;IACA,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,+DAA+D;IAC/D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,0EACA,sEACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,6DAA6D;IAC7D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,2EACA,qEACA;QACFC,gBAAgB;IAClB;IACA,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,8DAA8D;IAC9D,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,sCAAsC;IACtC;QACEH,KAAK;QACLC,OAAO,GAAGH,oBAAoB,cAAc,CAAC;QAC7CI,aACE,6DACA,uEACA,wEACA,uEACA,uEACA,mEACA;QACFC,gBAAgB;IAClB;CACD,CAAA;AAED,OAAO,MAAME,oBAAoBN,cAAcO,GAAG,CAChD,CAACC,aAAeA,WAAWP,GAAG,EACF;AAE9B,OAAO,SAASQ,iBAAiBC,KAAa;IAC5C,OAAO,AAACJ,kBAAwCK,QAAQ,CAACD;AAC3D;AAEA,OAAO,SAASE,yBACdX,GAAmB;IAEnB,MAAMO,aAAaR,cAAca,IAAI,CAAC,CAACC,QAAUA,MAAMb,GAAG,KAAKA;IAC/D,IAAI,CAACO,YAAY,MAAM,IAAIO,MAAM,CAAC,sBAAsB,EAAEd,KAAK;IAC/D,OAAOO;AACT;AA8BA,MAAMQ,eAAe,CAACN;IACpB,MAAMO,UAAU,OAAOP,UAAU,YAAYQ,OAAOC,QAAQ,CAACT,SAASA,QAAQ;IAC9E,OAAOU,KAAKC,GAAG,CAAC,KAAKD,KAAKE,GAAG,CAAC,GAAGF,KAAKG,KAAK,CAACN;AAC9C;AAEA;;;;;;CAMC,GACD,OAAO,MAAMO,2BAA+C;OACvD1B;IACH;CACD,CAAA;AAED,MAAM2B,YAAY,CAACf,QACjB,OAAOA,UAAU,YACjBgB,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAAChC,aAAaa;AAEpD;;;;;;;;;CASC,GACD,OAAO,SAASoB,0BAA0BC,IAAa;IACrD,MAAMC,QAAQR,yBAAyBS,OAAO,CAACF;IAC/C,OAAOC,QAAQ,IAAI,EAAE,GAAGR,yBAAyBU,KAAK,CAACF;AACzD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASG,sBAAsBC,GAAY;IAChD,IAAI,CAACC,MAAMC,OAAO,CAACF,MAAM,OAAOG;IAChC,MAAMC,QAAQ,IAAIC,IAAIL,IAAIM,MAAM,CAACjB;IACjC,IAAIe,MAAMG,IAAI,KAAK,GAAG,OAAOJ;IAC7B,OAAOf,yBAAyBkB,MAAM,CAAC,CAACX,OAASS,MAAMI,GAAG,CAACb;AAC7D;AAEA;;;;;CAKC,GACD,OAAO,SAASc,sBACdT,GAA8B,EAC9BU,eAAwB;IAExB,MAAMC,OAAOX,uBAAAA,IAAKY,IAAI;IACtB,IAAI,CAACD,MAAM,OAAO;QAAEE,SAASH;IAAgB;IAC7C,IAAIC,SAAS,QAAQ,OAAO;QAAEE,SAAS;IAAK;IAC5C,IAAIF,SAAS,SAAS,OAAO;QAAEE,SAAS;IAAM;IAC9C,IAAI;QACF,MAAMC,SAASC,KAAKC,KAAK,CAACL;QAC1B,IAAI,OAAOG,WAAW,WAAW,OAAO;YAAED,SAASC;QAAO;QAC1D,IAAIA,UAAU,OAAOA,WAAW,UAAU;YACxC,MAAMG,QAAQlB,sBAAsBe,OAAOG,KAAK;YAChD,OAAO;gBACLJ,SAASC,OAAOD,OAAO,KAAK;gBAC5BK,gBAAgBtC,aAAakC,OAAOI,cAAc;eAM9CD,QAAQ;gBAAEA;YAAM,IAAI,CAAC;gBACzBE,MAAM,OAAOL,OAAOK,IAAI,KAAK,WAAWL,OAAOK,IAAI,GAAGhB;;QAE1D;IACF,EAAE,eAAM;IACN,uCAAuC;IACzC;IACA,OAAO;QAAEU,SAASH;IAAgB;AACpC;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMU,sCAAsC,IAAG;AAEtD,SAASC,eAAeV,IAAY;IAClC,IAAIW,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;YACVY;QAAlB,MAAMC,aAAYD,yBAAAA,UAAUE,WAAW,CAAC,cAAtBF,yBAA4B;QAC9CD,SACEE,YAAY,OAAO,IAAIA,YAAY,QAAQ,IAAIA,YAAY,UAAU,IAAI;IAC7E;IACA,OAAOF;AACT;AAEA,qEAAqE,GACrE,OAAO,SAASI,4BAA4Bf,IAAY;IACtD,OAAOU,eAAeV,SAASS;AACjC;AAEA,MAAMO,uBAAuB;AAE7B;;;;;;;;CAQC,GACD,OAAO,SAASC,6BAA6BjB,IAAY;IACvD,IAAIe,4BAA4Bf,OAAO,OAAOA;IAC9C,MAAMkB,SACJT,sCAAsCC,eAAeM;IACvD,IAAIG,OAAO;IACX,IAAIR,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;QAC5B,MAAMJ,OAAOc,eAAeE;QAC5B,IAAID,QAAQf,OAAOsB,QAAQ;QAC3BC,QAAQP;QACRD,SAASf;IACX;IACA,MAAMwB,OAAOpB,KAAKqB,MAAM,CAACF,KAAKG,MAAM;IACpC,IAAIF,QAAQ,CAAC,KAAKG,IAAI,CAACH,OAAO;QAC5B,MAAMI,YAAYL,KAAKM,MAAM,CAAC;QAC9B,IAAID,YAAY,GAAGL,OAAOA,KAAKhC,KAAK,CAAC,GAAGqC;IAC1C;IACA,OAAO,GAAGL,KAAKO,OAAO,CAAC,kBAAkB,MAAMV,sBAAsB;AACvE;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASW,gCACdC,mBAA2B,EAC3BC,eAA0C;IAE1C,IAAId,4BAA4Ba,sBAAsB;QACpD,OAAOA;IACT;IACA,IACE,OAAOC,oBAAoB,YAC3BA,gBAAgB5B,IAAI,GAAGqB,MAAM,GAAG,KAChCP,4BAA4Bc,kBAC5B;QACA,OAAOA;IACT;IACA,OAAOZ,6BAA6BW;AACtC;AAEA;;;;CAIC,GACD,OAAO,SAASE,kBAAkBC,OAAe,EAAEC,SAAiB;IAClE,IAAIC,OAAO;IACX,MAAMC,OAAO,GAAGH,QAAQ,CAAC,EAAEC,WAAW;IACtC,IAAK,IAAI/C,QAAQ,GAAGA,QAAQiD,KAAKZ,MAAM,EAAErC,SAAS,EAAG;QACnDgD,QAAQC,KAAKC,UAAU,CAAClD;QACxBgD,OAAO5D,KAAK+D,IAAI,CAACH,MAAM;IACzB;IACA,OAAO,AAACA,CAAAA,SAAS,CAAA,IAAK;AACxB;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASI,gBACdN,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpC;;;;GAIC,GACDhD,IAAqB;IAErB,IAAI,CAACsD,uBAAuB3E,OAAOqB,OAAO,OAAO;IACjD,IAAIrB,MAAMuC,OAAO,EAAE,OAAO;IAC1B,MAAMhC,UAAUD,aAAaN,MAAM4C,cAAc;IACjD,IAAIrC,WAAW,KAAK,CAAC8D,WAAW,OAAO;IACvC,IAAI9D,WAAW,KAAK,OAAO;IAC3B,OAAO4D,kBAAkBC,SAASC,aAAa9D;AACjD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,SAASoE,uBACd3E,KAAuB,EACvBqB,IAAgC;IAEhC,MAAMsB,QAAQ3C,MAAM2C,KAAK;IACzB,4EAA4E;IAC5E,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAIA,SAAS,QAAQA,MAAMgB,MAAM,KAAK,GAAG,OAAO;IAChD,IAAI,CAACtC,MAAM,OAAO;IAClB,OAAOsB,MAAM1C,QAAQ,CAACoB;AACxB;AAqBA;;;;;;;;;CASC,GACD,OAAO,SAASuD,6BACdlD,GAAY;IAEZ,IAAI,CAACA,OAAO,OAAOA,QAAQ,YAAYC,MAAMC,OAAO,CAACF,MAAM,OAAO,CAAC;IACnE,MAAMmD,YAAqC,CAAC;IAC5C,KAAK,MAAM,CAACtF,KAAKS,MAAM,IAAIgB,OAAO8D,OAAO,CAACpD,KAAiC;QACzE,IAAI,OAAO1B,UAAU,aAAaD,iBAAiBR,MAAM;YACvDsF,SAAS,CAACtF,IAAI,GAAGS;QACnB;IACF;IACA,OAAO6E;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASE,sBACdX,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpCQ,SAAqD,EACrD;;;;;;;;;;;;;;;;;;;GAmBC,GACDxD,IAAoB;IAEpB,MAAM2D,WAAWH,6BAAAA,SAAW,CAACT,QAAQ;IACrC,IAAI,OAAOY,aAAa,WAAW,OAAOA;IAC1C,OAAON,gBAAgBN,SAASpE,OAAOqE,WAAWhD;AACpD"}