@aglyn/aglyn 1.0.0-beta.221 → 1.0.0-beta.222

package/src/lib/app-utils/transfer-resume-import.js

@@ -0,0 +1,128 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { Button, Menu, MenuItem, Stack, Typography } from "@mui/material";
+import { useState } from "react";
+import { useTransferLauncher } from "./transfer-launcher-context.js";
+/** "today", or the day an import was last touched. */ function touched(at) {
+    const day = new Date(at);
+    return day.toDateString() === new Date().toDateString() ? `today ${day.toLocaleTimeString(undefined, {
+        hour: 'numeric',
+        minute: '2-digit'
+    })}` : day.toLocaleDateString(undefined, {
+        month: 'short',
+        day: 'numeric'
+    });
+}
+/** What one unfinished import is called in the list. */ function nameOf(job) {
+    return job.fileName || job.label;
+}
+/**
+ * "Resume import" beside a surface's Import (AGL-3549): the imports the
+ * person started on this resource and left before anything was written —
+ * a tab closed mid-wizard — each reopened where it stopped
+ * (`openImport({ jobId })`) or discarded. Draws nothing outside the
+ * console shell, for a person who may not import here, or when there is
+ * nothing to resume. Every choice made in the wizard is kept with the job,
+ * so a resumed import opens on the step it was left at.
+ */ export function TransferResumeImport(props) {
+    const { target, title, onFinished } = props;
+    const launcher = useTransferLauncher();
+    const [anchor, setAnchor] = useState(null);
+    const [discarding, setDiscarding] = useState(null);
+    if (!(launcher == null ? void 0 : launcher.unfinished) || !launcher.can('import', target)) return null;
+    const jobs = launcher.unfinished(target);
+    if (!jobs.length) return null;
+    const resume = (job)=>{
+        setAnchor(null);
+        launcher.openImport(_extends({
+            resource: job.resource,
+            scope: target.scope
+        }, job.hostId ? {
+            hostId: job.hostId
+        } : {}, {
+            jobId: job.jobId
+        }, title ? {
+            title
+        } : {}, onFinished ? {
+            onFinished
+        } : {}));
+    };
+    const discard = async (event, job)=>{
+        event.stopPropagation();
+        setDiscarding(job.jobId);
+        try {
+            await (launcher.discard == null ? void 0 : launcher.discard.call(launcher, job.jobId));
+        } finally{
+            setDiscarding(null);
+        }
+    };
+    return /*#__PURE__*/ _jsxs(_Fragment, {
+        children: [
+            /*#__PURE__*/ _jsx(Button, {
+                size: "small",
+                "aria-haspopup": "menu",
+                onClick: (event)=>setAnchor(event.currentTarget),
+                children: jobs.length === 1 ? 'Resume import' : `Resume import (${jobs.length})`
+            }),
+            /*#__PURE__*/ _jsx(Menu, {
+                anchorEl: anchor,
+                open: Boolean(anchor),
+                onClose: ()=>setAnchor(null),
+                children: jobs.map((job)=>/*#__PURE__*/ _jsx(MenuItem, {
+                        onClick: ()=>resume(job),
+                        disabled: discarding === job.jobId,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            direction: "row",
+                            spacing: 2,
+                            sx: {
+                                alignItems: 'center',
+                                justifyContent: 'space-between',
+                                width: '100%'
+                            },
+                            children: [
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "body2",
+                                            children: nameOf(job)
+                                        }),
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: `Left ${touched(job.updatedAt)}`
+                                        })
+                                    ]
+                                }),
+                                /*#__PURE__*/ _jsx(Button, {
+                                    size: "small",
+                                    color: "error",
+                                    onClick: (event)=>void discard(event, job),
+                                    disabled: discarding === job.jobId,
+                                    children: 'Discard'
+                                })
+                            ]
+                        })
+                    }, job.jobId))
+            })
+        ]
+    });
+}
+TransferResumeImport.displayName = 'TransferResumeImport';
+export default TransferResumeImport;
+
+//# sourceMappingURL=transfer-resume-import.js.map

package/src/lib/app-utils/transfer-resume-import.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/transfer-resume-import.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Button, Menu, MenuItem, Stack, Typography } from '@mui/material'\nimport { useState, type MouseEvent } from 'react'\nimport {\n  useTransferLauncher,\n  type TransferAccessTarget,\n  type TransferUnfinishedImport,\n} from './transfer-launcher-context'\n\n/** \"today\", or the day an import was last touched. */\nfunction touched(at: number): string {\n  const day = new Date(at)\n  return day.toDateString() === new Date().toDateString()\n    ? `today ${day.toLocaleTimeString(undefined, { hour: 'numeric', minute: '2-digit' })}`\n    : day.toLocaleDateString(undefined, { month: 'short', day: 'numeric' })\n}\n\n/** What one unfinished import is called in the list. */\nfunction nameOf(job: TransferUnfinishedImport): string {\n  return job.fileName || job.label\n}\n\nexport interface TransferResumeImportProps {\n  /** The resource the surface imports into, and the site — as its Import button opens it. */\n  target: TransferAccessTarget\n  /** The wizard's title, as the surface's Import button sets it. */\n  title?: string\n  /** Called when the person leaves the resumed wizard from its results. */\n  onFinished?(): void\n}\n\n/**\n * \"Resume import\" beside a surface's Import (AGL-3549): the imports the\n * person started on this resource and left before anything was written —\n * a tab closed mid-wizard — each reopened where it stopped\n * (`openImport({ jobId })`) or discarded. Draws nothing outside the\n * console shell, for a person who may not import here, or when there is\n * nothing to resume. Every choice made in the wizard is kept with the job,\n * so a resumed import opens on the step it was left at.\n */\nexport function TransferResumeImport(props: TransferResumeImportProps) {\n  const { target, title, onFinished } = props\n  const launcher = useTransferLauncher()\n  const [anchor, setAnchor] = useState<HTMLElement | null>(null)\n  const [discarding, setDiscarding] = useState<string | null>(null)\n  if (!launcher?.unfinished || !launcher.can('import', target)) return null\n  const jobs = launcher.unfinished(target)\n  if (!jobs.length) return null\n\n  const resume = (job: TransferUnfinishedImport) => {\n    setAnchor(null)\n    launcher.openImport({\n      resource: job.resource,\n      scope: target.scope,\n      ...(job.hostId ? { hostId: job.hostId } : {}),\n      jobId: job.jobId,\n      ...(title ? { title } : {}),\n      ...(onFinished ? { onFinished } : {}),\n    })\n  }\n  const discard = async (event: MouseEvent, job: TransferUnfinishedImport) => {\n    event.stopPropagation()\n    setDiscarding(job.jobId)\n    try {\n      await launcher.discard?.(job.jobId)\n    } finally {\n      setDiscarding(null)\n    }\n  }\n\n  return (\n    <>\n      <Button\n        size=\"small\"\n        aria-haspopup=\"menu\"\n        onClick={(event) => setAnchor(event.currentTarget)}\n      >\n        {jobs.length === 1 ? 'Resume import' : `Resume import (${jobs.length})`}\n      </Button>\n      <Menu anchorEl={anchor} open={Boolean(anchor)} onClose={() => setAnchor(null)}>\n        {jobs.map((job) => (\n          <MenuItem key={job.jobId} onClick={() => resume(job)} disabled={discarding === job.jobId}>\n            <Stack direction=\"row\" spacing={2} sx={{ alignItems: 'center', justifyContent: 'space-between', width: '100%' }}>\n              <Stack>\n                <Typography variant=\"body2\">{nameOf(job)}</Typography>\n                <Typography variant=\"caption\" color=\"text.secondary\">\n                  {`Left ${touched(job.updatedAt)}`}\n                </Typography>\n              </Stack>\n              <Button size=\"small\" color=\"error\" onClick={(event) => void discard(event, job)} disabled={discarding === job.jobId}>\n                {'Discard'}\n              </Button>\n            </Stack>\n          </MenuItem>\n        ))}\n      </Menu>\n    </>\n  )\n}\nTransferResumeImport.displayName = 'TransferResumeImport'\n\nexport default TransferResumeImport\n"],"names":["Button","Menu","MenuItem","Stack","Typography","useState","useTransferLauncher","touched","at","day","Date","toDateString","toLocaleTimeString","undefined","hour","minute","toLocaleDateString","month","nameOf","job","fileName","label","TransferResumeImport","props","target","title","onFinished","launcher","anchor","setAnchor","discarding","setDiscarding","unfinished","can","jobs","length","resume","openImport","resource","scope","hostId","jobId","discard","event","stopPropagation","size","aria-haspopup","onClick","currentTarget","anchorEl","open","Boolean","onClose","map","disabled","direction","spacing","sx","alignItems","justifyContent","width","variant","color","updatedAt","displayName"],"mappings":";;AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,MAAM,EAAEC,IAAI,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,UAAU,QAAQ,gBAAe;AACzE,SAASC,QAAQ,QAAyB,QAAO;AACjD,SACEC,mBAAmB,QAGd,iCAA6B;AAEpC,oDAAoD,GACpD,SAASC,QAAQC,EAAU;IACzB,MAAMC,MAAM,IAAIC,KAAKF;IACrB,OAAOC,IAAIE,YAAY,OAAO,IAAID,OAAOC,YAAY,KACjD,CAAC,MAAM,EAAEF,IAAIG,kBAAkB,CAACC,WAAW;QAAEC,MAAM;QAAWC,QAAQ;IAAU,IAAI,GACpFN,IAAIO,kBAAkB,CAACH,WAAW;QAAEI,OAAO;QAASR,KAAK;IAAU;AACzE;AAEA,sDAAsD,GACtD,SAASS,OAAOC,GAA6B;IAC3C,OAAOA,IAAIC,QAAQ,IAAID,IAAIE,KAAK;AAClC;AAWA;;;;;;;;CAQC,GACD,OAAO,SAASC,qBAAqBC,KAAgC;IACnE,MAAM,EAAEC,MAAM,EAAEC,KAAK,EAAEC,UAAU,EAAE,GAAGH;IACtC,MAAMI,WAAWrB;IACjB,MAAM,CAACsB,QAAQC,UAAU,GAAGxB,SAA6B;IACzD,MAAM,CAACyB,YAAYC,cAAc,GAAG1B,SAAwB;IAC5D,IAAI,EAACsB,4BAAAA,SAAUK,UAAU,KAAI,CAACL,SAASM,GAAG,CAAC,UAAUT,SAAS,OAAO;IACrE,MAAMU,OAAOP,SAASK,UAAU,CAACR;IACjC,IAAI,CAACU,KAAKC,MAAM,EAAE,OAAO;IAEzB,MAAMC,SAAS,CAACjB;QACdU,UAAU;QACVF,SAASU,UAAU,CAAC;YAClBC,UAAUnB,IAAImB,QAAQ;YACtBC,OAAOf,OAAOe,KAAK;WACfpB,IAAIqB,MAAM,GAAG;YAAEA,QAAQrB,IAAIqB,MAAM;QAAC,IAAI,CAAC;YAC3CC,OAAOtB,IAAIsB,KAAK;WACZhB,QAAQ;YAAEA;QAAM,IAAI,CAAC,GACrBC,aAAa;YAAEA;QAAW,IAAI,CAAC;IAEvC;IACA,MAAMgB,UAAU,OAAOC,OAAmBxB;QACxCwB,MAAMC,eAAe;QACrBb,cAAcZ,IAAIsB,KAAK;QACvB,IAAI;YACF,OAAMd,SAASe,OAAO,oBAAhBf,SAASe,OAAO,MAAhBf,UAAmBR,IAAIsB,KAAK;QACpC,SAAU;YACRV,cAAc;QAChB;IACF;IAEA,qBACE;;0BACE,KAAC/B;gBACC6C,MAAK;gBACLC,iBAAc;gBACdC,SAAS,CAACJ,QAAUd,UAAUc,MAAMK,aAAa;0BAEhDd,KAAKC,MAAM,KAAK,IAAI,kBAAkB,CAAC,eAAe,EAAED,KAAKC,MAAM,CAAC,CAAC,CAAC;;0BAEzE,KAAClC;gBAAKgD,UAAUrB;gBAAQsB,MAAMC,QAAQvB;gBAASwB,SAAS,IAAMvB,UAAU;0BACrEK,KAAKmB,GAAG,CAAC,CAAClC,oBACT,KAACjB;wBAAyB6C,SAAS,IAAMX,OAAOjB;wBAAMmC,UAAUxB,eAAeX,IAAIsB,KAAK;kCACtF,cAAA,MAACtC;4BAAMoD,WAAU;4BAAMC,SAAS;4BAAGC,IAAI;gCAAEC,YAAY;gCAAUC,gBAAgB;gCAAiBC,OAAO;4BAAO;;8CAC5G,MAACzD;;sDACC,KAACC;4CAAWyD,SAAQ;sDAAS3C,OAAOC;;sDACpC,KAACf;4CAAWyD,SAAQ;4CAAUC,OAAM;sDACjC,CAAC,KAAK,EAAEvD,QAAQY,IAAI4C,SAAS,GAAG;;;;8CAGrC,KAAC/D;oCAAO6C,MAAK;oCAAQiB,OAAM;oCAAQf,SAAS,CAACJ,QAAU,KAAKD,QAAQC,OAAOxB;oCAAMmC,UAAUxB,eAAeX,IAAIsB,KAAK;8CAChH;;;;uBATQtB,IAAIsB,KAAK;;;;AAiBlC;AACAnB,qBAAqB0C,WAAW,GAAG;AAEnC,eAAe1C,qBAAoB"}

package/src/lib/app-utils/upgrade-proposal.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The platform team's request that a workspace move to a paid plan
+ * (AGL-3466), read in one place.
+ *
+ * A workspace staff build for a client is handed over first and sold second:
+ * the client joins, looks around on whatever the workspace already has, and
+ * only then is asked to upgrade. Staff record that ask as
+ * `orgs/{orgId}.upgradeProposal`; this module decides whether it still
+ * stands, what it may name, and where the button under it goes.
+ */
+import type { AglynOrgBilling, OrgPlan, OrgUpgradeProposal } from '../foundation/definitions/org-billing.types';
+import { type OnboardingPlanIntent } from './onboarding-deep-link';
+/** The longest staff note a proposal carries. */
+export declare const UPGRADE_PROPOSAL_NOTE_MAX = 500;
+/**
+ * The plans staff may propose: every tier a customer can buy themselves,
+ * less Free, which is not a purchase. Enterprise is quoted per deal, so it
+ * is never proposed through a checkout link.
+ */
+export declare const UPGRADE_PROPOSAL_PLANS: readonly OrgPlan[];
+export declare function isUpgradeProposalPlan(plan: unknown): plan is OrgPlan;
+/** A staff note as it is stored: trimmed, bounded, and absent when blank. */
+export declare function normalizeUpgradeProposalNote(note: unknown): string | undefined;
+/**
+ * The stored proposal, narrowed, or null when there is none worth showing.
+ *
+ * A proposal naming a plan this build cannot sell reads as none: a card whose
+ * button opens a checkout for an unknown tier is worse than no card.
+ */
+export declare function readUpgradeProposal(org: Partial<AglynOrgBilling> | null | undefined): OrgUpgradeProposal | null;
+/**
+ * The proposal the workspace should be shown: the stored one, while no
+ * subscription is live.
+ *
+ * `billingStatus` is the org document's mirror of the subscription status,
+ * readable by every member, so this answers from the document the console
+ * already holds. A live subscription means the workspace has bought a plan,
+ * which settles the question the proposal asked; `writeOrgBilling`'s caller
+ * clears the field then, and this hides it in the meantime.
+ */
+export declare function standingUpgradeProposal(org: Partial<AglynOrgBilling> | null | undefined): OrgUpgradeProposal | null;
+/** The plan intent a proposal carries into Billing: the plan, no interval. */
+export declare function upgradeProposalIntent(proposal: Pick<OrgUpgradeProposal, 'plan'>): OnboardingPlanIntent;
+/** Where the proposal's button goes: Billing, with the plan preselected. */
+export declare function upgradeProposalDestination(orgSlug: string, proposal: Pick<OrgUpgradeProposal, 'plan'>): string;
+/** "Acme's Aglyn team proposed the Starter plan". */
+export declare function upgradeProposalHeadline(proposal: Pick<OrgUpgradeProposal, 'plan'>, options: {
+    orgName?: string | null;
+    productName: string;
+}): string;

package/src/lib/app-utils/upgrade-proposal.js

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The platform team's request that a workspace move to a paid plan
+ * (AGL-3466), read in one place.
+ *
+ * A workspace staff build for a client is handed over first and sold second:
+ * the client joins, looks around on whatever the workspace already has, and
+ * only then is asked to upgrade. Staff record that ask as
+ * `orgs/{orgId}.upgradeProposal`; this module decides whether it still
+ * stands, what it may name, and where the button under it goes.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { onboardingDestination } from "./onboarding-deep-link.js";
+import { isLiveSubscriptionStatus } from "./org-billing-doc.js";
+import { PLAN_LABELS, SELF_SERVE_PLANS } from "./plan-entitlements.js";
+/** The longest staff note a proposal carries. */ export const UPGRADE_PROPOSAL_NOTE_MAX = 500;
+/**
+ * The plans staff may propose: every tier a customer can buy themselves,
+ * less Free, which is not a purchase. Enterprise is quoted per deal, so it
+ * is never proposed through a checkout link.
+ */ export const UPGRADE_PROPOSAL_PLANS = SELF_SERVE_PLANS.filter((plan)=>plan !== 'free');
+export function isUpgradeProposalPlan(plan) {
+    return typeof plan === 'string' && UPGRADE_PROPOSAL_PLANS.includes(plan);
+}
+/** A staff note as it is stored: trimmed, bounded, and absent when blank. */ export function normalizeUpgradeProposalNote(note) {
+    if (typeof note !== 'string') return undefined;
+    const trimmed = note.trim().slice(0, UPGRADE_PROPOSAL_NOTE_MAX);
+    return trimmed || undefined;
+}
+/**
+ * The stored proposal, narrowed, or null when there is none worth showing.
+ *
+ * A proposal naming a plan this build cannot sell reads as none: a card whose
+ * button opens a checkout for an unknown tier is worse than no card.
+ */ export function readUpgradeProposal(org) {
+    const raw = org == null ? void 0 : org.upgradeProposal;
+    if (!raw || typeof raw !== 'object' || !isUpgradeProposalPlan(raw.plan)) {
+        return null;
+    }
+    const note = normalizeUpgradeProposalNote(raw.note);
+    return _extends({
+        plan: raw.plan,
+        proposedBy: typeof raw.proposedBy === 'string' ? raw.proposedBy : '',
+        proposedAt: Number.isFinite(raw.proposedAt) ? Number(raw.proposedAt) : 0
+    }, note ? {
+        note
+    } : {});
+}
+/**
+ * The proposal the workspace should be shown: the stored one, while no
+ * subscription is live.
+ *
+ * `billingStatus` is the org document's mirror of the subscription status,
+ * readable by every member, so this answers from the document the console
+ * already holds. A live subscription means the workspace has bought a plan,
+ * which settles the question the proposal asked; `writeOrgBilling`'s caller
+ * clears the field then, and this hides it in the meantime.
+ */ export function standingUpgradeProposal(org) {
+    if (isLiveSubscriptionStatus(org == null ? void 0 : org.billingStatus)) return null;
+    return readUpgradeProposal(org);
+}
+/** The plan intent a proposal carries into Billing: the plan, no interval. */ export function upgradeProposalIntent(proposal) {
+    return {
+        plan: proposal.plan,
+        interval: 'month',
+        // The proposal names a plan, not a cadence, so the page keeps whatever
+        // its toggle says rather than being told "monthly".
+        intervalStated: false,
+        contactSales: false
+    };
+}
+/** Where the proposal's button goes: Billing, with the plan preselected. */ export function upgradeProposalDestination(orgSlug, proposal) {
+    return onboardingDestination(orgSlug, upgradeProposalIntent(proposal));
+}
+/** "Acme's Aglyn team proposed the Starter plan". */ export function upgradeProposalHeadline(proposal, options) {
+    var _options_orgName;
+    const workspace = (_options_orgName = options.orgName) == null ? void 0 : _options_orgName.trim();
+    const team = workspace ? `${workspace}'s ${options.productName} team` : `Your ${options.productName} team`;
+    return `${team} proposed the ${PLAN_LABELS[proposal.plan]} plan`;
+}
+
+//# sourceMappingURL=upgrade-proposal.js.map

package/src/lib/app-utils/upgrade-proposal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/upgrade-proposal.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The platform team's request that a workspace move to a paid plan\n * (AGL-3466), read in one place.\n *\n * A workspace staff build for a client is handed over first and sold second:\n * the client joins, looks around on whatever the workspace already has, and\n * only then is asked to upgrade. Staff record that ask as\n * `orgs/{orgId}.upgradeProposal`; this module decides whether it still\n * stands, what it may name, and where the button under it goes.\n */\n\nimport type {\n  AglynOrgBilling,\n  OrgPlan,\n  OrgUpgradeProposal,\n} from '../foundation/definitions/org-billing.types'\nimport {\n  onboardingDestination,\n  type OnboardingPlanIntent,\n} from './onboarding-deep-link'\nimport { isLiveSubscriptionStatus } from './org-billing-doc'\nimport { PLAN_LABELS, SELF_SERVE_PLANS } from './plan-entitlements'\n\n/** The longest staff note a proposal carries. */\nexport const UPGRADE_PROPOSAL_NOTE_MAX = 500\n\n/**\n * The plans staff may propose: every tier a customer can buy themselves,\n * less Free, which is not a purchase. Enterprise is quoted per deal, so it\n * is never proposed through a checkout link.\n */\nexport const UPGRADE_PROPOSAL_PLANS: readonly OrgPlan[] = SELF_SERVE_PLANS.filter(\n  (plan) => plan !== 'free',\n)\n\nexport function isUpgradeProposalPlan(plan: unknown): plan is OrgPlan {\n  return (\n    typeof plan === 'string' &&\n    (UPGRADE_PROPOSAL_PLANS as readonly string[]).includes(plan)\n  )\n}\n\n/** A staff note as it is stored: trimmed, bounded, and absent when blank. */\nexport function normalizeUpgradeProposalNote(note: unknown): string | undefined {\n  if (typeof note !== 'string') return undefined\n  const trimmed = note.trim().slice(0, UPGRADE_PROPOSAL_NOTE_MAX)\n  return trimmed || undefined\n}\n\n/**\n * The stored proposal, narrowed, or null when there is none worth showing.\n *\n * A proposal naming a plan this build cannot sell reads as none: a card whose\n * button opens a checkout for an unknown tier is worse than no card.\n */\nexport function readUpgradeProposal(\n  org: Partial<AglynOrgBilling> | null | undefined,\n): OrgUpgradeProposal | null {\n  const raw = org?.upgradeProposal as Partial<OrgUpgradeProposal> | null | undefined\n  if (!raw || typeof raw !== 'object' || !isUpgradeProposalPlan(raw.plan)) {\n    return null\n  }\n  const note = normalizeUpgradeProposalNote(raw.note)\n  return {\n    plan: raw.plan,\n    proposedBy: typeof raw.proposedBy === 'string' ? raw.proposedBy : '',\n    proposedAt: Number.isFinite(raw.proposedAt) ? Number(raw.proposedAt) : 0,\n    ...(note ? { note } : {}),\n  }\n}\n\n/**\n * The proposal the workspace should be shown: the stored one, while no\n * subscription is live.\n *\n * `billingStatus` is the org document's mirror of the subscription status,\n * readable by every member, so this answers from the document the console\n * already holds. A live subscription means the workspace has bought a plan,\n * which settles the question the proposal asked; `writeOrgBilling`'s caller\n * clears the field then, and this hides it in the meantime.\n */\nexport function standingUpgradeProposal(\n  org: Partial<AglynOrgBilling> | null | undefined,\n): OrgUpgradeProposal | null {\n  if (isLiveSubscriptionStatus(org?.billingStatus)) return null\n  return readUpgradeProposal(org)\n}\n\n/** The plan intent a proposal carries into Billing: the plan, no interval. */\nexport function upgradeProposalIntent(\n  proposal: Pick<OrgUpgradeProposal, 'plan'>,\n): OnboardingPlanIntent {\n  return {\n    plan: proposal.plan,\n    interval: 'month',\n    // The proposal names a plan, not a cadence, so the page keeps whatever\n    // its toggle says rather than being told \"monthly\".\n    intervalStated: false,\n    contactSales: false,\n  }\n}\n\n/** Where the proposal's button goes: Billing, with the plan preselected. */\nexport function upgradeProposalDestination(\n  orgSlug: string,\n  proposal: Pick<OrgUpgradeProposal, 'plan'>,\n): string {\n  return onboardingDestination(orgSlug, upgradeProposalIntent(proposal))\n}\n\n/** \"Acme's Aglyn team proposed the Starter plan\". */\nexport function upgradeProposalHeadline(\n  proposal: Pick<OrgUpgradeProposal, 'plan'>,\n  options: { orgName?: string | null; productName: string },\n): string {\n  const workspace = options.orgName?.trim()\n  const team = workspace\n    ? `${workspace}'s ${options.productName} team`\n    : `Your ${options.productName} team`\n  return `${team} proposed the ${PLAN_LABELS[proposal.plan]} plan`\n}\n"],"names":["onboardingDestination","isLiveSubscriptionStatus","PLAN_LABELS","SELF_SERVE_PLANS","UPGRADE_PROPOSAL_NOTE_MAX","UPGRADE_PROPOSAL_PLANS","filter","plan","isUpgradeProposalPlan","includes","normalizeUpgradeProposalNote","note","undefined","trimmed","trim","slice","readUpgradeProposal","org","raw","upgradeProposal","proposedBy","proposedAt","Number","isFinite","standingUpgradeProposal","billingStatus","upgradeProposalIntent","proposal","interval","intervalStated","contactSales","upgradeProposalDestination","orgSlug","upgradeProposalHeadline","options","workspace","orgName","team","productName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC;AAOD,SACEA,qBAAqB,QAEhB,4BAAwB;AAC/B,SAASC,wBAAwB,QAAQ,uBAAmB;AAC5D,SAASC,WAAW,EAAEC,gBAAgB,QAAQ,yBAAqB;AAEnE,+CAA+C,GAC/C,OAAO,MAAMC,4BAA4B,IAAG;AAE5C;;;;CAIC,GACD,OAAO,MAAMC,yBAA6CF,iBAAiBG,MAAM,CAC/E,CAACC,OAASA,SAAS,QACpB;AAED,OAAO,SAASC,sBAAsBD,IAAa;IACjD,OACE,OAAOA,SAAS,YAChB,AAACF,uBAA6CI,QAAQ,CAACF;AAE3D;AAEA,2EAA2E,GAC3E,OAAO,SAASG,6BAA6BC,IAAa;IACxD,IAAI,OAAOA,SAAS,UAAU,OAAOC;IACrC,MAAMC,UAAUF,KAAKG,IAAI,GAAGC,KAAK,CAAC,GAAGX;IACrC,OAAOS,WAAWD;AACpB;AAEA;;;;;CAKC,GACD,OAAO,SAASI,oBACdC,GAAgD;IAEhD,MAAMC,MAAMD,uBAAAA,IAAKE,eAAe;IAChC,IAAI,CAACD,OAAO,OAAOA,QAAQ,YAAY,CAACV,sBAAsBU,IAAIX,IAAI,GAAG;QACvE,OAAO;IACT;IACA,MAAMI,OAAOD,6BAA6BQ,IAAIP,IAAI;IAClD,OAAO;QACLJ,MAAMW,IAAIX,IAAI;QACda,YAAY,OAAOF,IAAIE,UAAU,KAAK,WAAWF,IAAIE,UAAU,GAAG;QAClEC,YAAYC,OAAOC,QAAQ,CAACL,IAAIG,UAAU,IAAIC,OAAOJ,IAAIG,UAAU,IAAI;OACnEV,OAAO;QAAEA;IAAK,IAAI,CAAC;AAE3B;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASa,wBACdP,GAAgD;IAEhD,IAAIhB,yBAAyBgB,uBAAAA,IAAKQ,aAAa,GAAG,OAAO;IACzD,OAAOT,oBAAoBC;AAC7B;AAEA,4EAA4E,GAC5E,OAAO,SAASS,sBACdC,QAA0C;IAE1C,OAAO;QACLpB,MAAMoB,SAASpB,IAAI;QACnBqB,UAAU;QACV,uEAAuE;QACvE,oDAAoD;QACpDC,gBAAgB;QAChBC,cAAc;IAChB;AACF;AAEA,0EAA0E,GAC1E,OAAO,SAASC,2BACdC,OAAe,EACfL,QAA0C;IAE1C,OAAO3B,sBAAsBgC,SAASN,sBAAsBC;AAC9D;AAEA,mDAAmD,GACnD,OAAO,SAASM,wBACdN,QAA0C,EAC1CO,OAAyD;QAEvCA;IAAlB,MAAMC,aAAYD,mBAAAA,QAAQE,OAAO,qBAAfF,iBAAiBpB,IAAI;IACvC,MAAMuB,OAAOF,YACT,GAAGA,UAAU,GAAG,EAAED,QAAQI,WAAW,CAAC,KAAK,CAAC,GAC5C,CAAC,KAAK,EAAEJ,QAAQI,WAAW,CAAC,KAAK,CAAC;IACtC,OAAO,GAAGD,KAAK,cAAc,EAAEnC,WAAW,CAACyB,SAASpB,IAAI,CAAC,CAAC,KAAK,CAAC;AAClE"}

package/src/lib/app-utils/utc-month.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE MONTH A MONTHLY COUNTER IS KEYED BY.
+ *
+ * Every counter the platform keeps per month — a door's refusals and catches,
+ * a site's visitor records, an organization's usage — is keyed by the UTC
+ * `YYYY-MM` of the moment it counts, and a reader that derived the key any
+ * other way would read zero on exactly the sites the counter is about. A
+ * monthly ceiling lifts at the boundary that key rolls over on, which is the
+ * one moment a notice may promise.
+ */
+/** The UTC `YYYY-MM` a monthly counter is keyed by. */
+export declare function utcMonthKey(now?: Date): string;
+/**
+ * 00:00 UTC on the first of next month: when a monthly counter's key rolls
+ * over, and with it when a monthly ceiling lifts.
+ */
+export declare function nextUtcMonthStart(now?: Date): Date;

package/src/lib/app-utils/utc-month.js

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE MONTH A MONTHLY COUNTER IS KEYED BY.
+ *
+ * Every counter the platform keeps per month — a door's refusals and catches,
+ * a site's visitor records, an organization's usage — is keyed by the UTC
+ * `YYYY-MM` of the moment it counts, and a reader that derived the key any
+ * other way would read zero on exactly the sites the counter is about. A
+ * monthly ceiling lifts at the boundary that key rolls over on, which is the
+ * one moment a notice may promise.
+ */ /** The UTC `YYYY-MM` a monthly counter is keyed by. */ export function utcMonthKey(now = new Date()) {
+    return now.toISOString().slice(0, 7);
+}
+/**
+ * 00:00 UTC on the first of next month: when a monthly counter's key rolls
+ * over, and with it when a monthly ceiling lifts.
+ */ export function nextUtcMonthStart(now = new Date()) {
+    return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1));
+}
+
+//# sourceMappingURL=utc-month.js.map

package/src/lib/app-utils/utc-month.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/utc-month.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE MONTH A MONTHLY COUNTER IS KEYED BY.\n *\n * Every counter the platform keeps per month — a door's refusals and catches,\n * a site's visitor records, an organization's usage — is keyed by the UTC\n * `YYYY-MM` of the moment it counts, and a reader that derived the key any\n * other way would read zero on exactly the sites the counter is about. A\n * monthly ceiling lifts at the boundary that key rolls over on, which is the\n * one moment a notice may promise.\n */\n\n/** The UTC `YYYY-MM` a monthly counter is keyed by. */\nexport function utcMonthKey(now: Date = new Date()): string {\n  return now.toISOString().slice(0, 7)\n}\n\n/**\n * 00:00 UTC on the first of next month: when a monthly counter's key rolls\n * over, and with it when a monthly ceiling lifts.\n */\nexport function nextUtcMonthStart(now: Date = new Date()): Date {\n  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1))\n}\n"],"names":["utcMonthKey","now","Date","toISOString","slice","nextUtcMonthStart","UTC","getUTCFullYear","getUTCMonth"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GAED,qDAAqD,GACrD,OAAO,SAASA,YAAYC,MAAY,IAAIC,MAAM;IAChD,OAAOD,IAAIE,WAAW,GAAGC,KAAK,CAAC,GAAG;AACpC;AAEA;;;CAGC,GACD,OAAO,SAASC,kBAAkBJ,MAAY,IAAIC,MAAM;IACtD,OAAO,IAAIA,KAAKA,KAAKI,GAAG,CAACL,IAAIM,cAAc,IAAIN,IAAIO,WAAW,KAAK,GAAG;AACxE"}

package/src/lib/app-utils/visitor-record-ceiling.d.ts

@@ -128,11 +128,11 @@ export declare const LEADS_MAX_PER_HOST = 200000;
  * discriminates nothing — this code is the whole discriminator, and one means
  * "slow down" while the other means "this site is not taking new accounts".
  * Shared rather than restated so producer and consumer cannot drift, exactly
- * as `FORM_ABUSE_CEILING_CODE` is.
+ * as the form door's `form-abuse-ceiling` is.
  */
 export declare const SITE_MEMBER_CEILING_CODE = "site-member-ceiling";
 /**
- * The visitor's sentence, under the three rules `FORM_UNAVAILABLE_MESSAGE`
+ * The visitor's sentence, under the three rules the form door's refusal
  * established (AGL-1666) and for the identical reason: the person reading it
  * is a stranger to the site and NOT our customer.
  *
@@ -225,7 +225,7 @@ export declare function visitorRecordCeilingAnnounced(counter: Record<string, un
  * pays a read for it.
  */
 export declare function visitorRecordAcceptFillsCeiling(used: number, ceiling: number): boolean;
-/** What the site's owner is shown. Shaped like `FormsPausedOwnerNotice`. */
+/** What the site's owner is shown. Shaped like `VisitorDoorPausedNotice`. */
 export interface VisitorRecordsPausedNotice {
     title: string;
     /** What happened, how many, and what actually clears it. */
@@ -242,7 +242,7 @@ export interface VisitorRecordsPausedNotice {
  * line for symmetry would print a date that means nothing.
  *
  * Returns `null` below one refusal, the same rule as
- * `formSubmissionsPausedNotice` and for the same reason: the counter document
+ * `visitorDoorPausedNotice` and for the same reason: the counter document
  * persists from its first trip forever, and "0 refused" on every later month
  * trains the owner to ignore the row that will one day be real.
  */

package/src/lib/app-utils/visitor-record-ceiling.js

@@ -124,10 +124,10 @@
  * discriminates nothing — this code is the whole discriminator, and one means
  * "slow down" while the other means "this site is not taking new accounts".
  * Shared rather than restated so producer and consumer cannot drift, exactly
- * as `FORM_ABUSE_CEILING_CODE` is.
+ * as the form door's `form-abuse-ceiling` is.
  */ export const SITE_MEMBER_CEILING_CODE = 'site-member-ceiling';
 /**
- * The visitor's sentence, under the three rules `FORM_UNAVAILABLE_MESSAGE`
+ * The visitor's sentence, under the three rules the form door's refusal
  * established (AGL-1666) and for the identical reason: the person reading it
  * is a stranger to the site and NOT our customer.
  *
@@ -191,7 +191,7 @@
  * been told about the crossing the site is in: when the notice went out, or
  * `null` once the site has been seen below the ceiling again (AGL-3442).
  */ export const VISITOR_RECORD_NOTICE_SENT_FIELD = 'noticeSentAtMs';
-/** A month key on the refusal counter — `submissionMonthKey`'s `YYYY-MM`. */ const REFUSAL_MONTH_KEY = /^\d{4}-\d{2}$/;
+/** A month key on the refusal counter — `utcMonthKey`'s `YYYY-MM`. */ const REFUSAL_MONTH_KEY = /^\d{4}-\d{2}$/;
 /**
  * Whether the managers have already been told this site is at the ceiling.
  *
@@ -236,7 +236,7 @@
  * line for symmetry would print a date that means nothing.
  *
  * Returns `null` below one refusal, the same rule as
- * `formSubmissionsPausedNotice` and for the same reason: the counter document
+ * `visitorDoorPausedNotice` and for the same reason: the counter document
  * persists from its first trip forever, and "0 refused" on every later month
  * trains the owner to ignore the row that will one day be real.
  */ export function visitorRecordsPausedNotice(input) {

package/src/lib/app-utils/visitor-record-ceiling.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/visitor-record-ceiling.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Flat platform ceilings on the two host subcollections an ANONYMOUS VISITOR\n * can create documents in (AGL-1529).\n *\n * ## What this is\n *\n * A platform-wide ceiling, and deliberately NOT a plan dimension — so\n * \"unlimited member accounts on every plan\" stays true, because an abuse\n * control is not something we sell. The same instrument is already in place\n * twice: AGL-1655 for forms and AGL-2155 for bandwidth.\n *\n * ## Why it is not a plan dimension, and must never become one\n *\n * AGL-889 decided member accounts are UNLIMITED on every plan as a PRICING\n * matter, and `/pricing` says so. A cap that varied by plan would make that\n * sentence false the moment it shipped. So there is no `OrgEntitlements` key\n * here, no `PLAN_ENTITLEMENTS` row, no band and nothing to re-price: every\n * plan, free through enterprise, gets the same number, and the number exists\n * only to answer the question `checkFormSubmissionAbuseCeiling`'s docblock\n * poses — *\"is this still a customer's traffic at all?\"* A plan gate asks\n * whether the customer bought this; this asks whether a customer is involved.\n *\n * ## The hole this closes\n *\n * `hosts/{hostId}/siteMembers` and `hosts/{hostId}/leads` were bounded by\n * NOTHING. Both are written on behalf of anonymous visitors on a public site\n * (`membershipRegisterHandler`, the two bookings lead paths), and the only\n * bound was `visitorWriteRateLimitRefusal` — keyed on (host, IP), fails soft,\n * and bounds the RATE rather than the TOTAL. That is verbatim the sentence\n * AGL-2265 used as its reason for adding the free-workspace ceiling, and the\n * shape AGL-2266 closed for `actions` and `entries`: unbounded Firestore\n * documents behind a $0 subscription.\n *\n * ## Why the shape here is the FLAT family, not the MULTIPLE family\n *\n * The two ceilings named as precedent — `FORM_ABUSE_CEILING_*` and\n * `BANDWIDTH_ABUSE_CEILING_*` — are both `max(floor, included × 10)`. They\n * can be, because forms and bandwidth each have an *included band* on the\n * price list to multiply. Members and leads have no included band by\n * construction (that is the whole point of AGL-889), so there is nothing to\n * multiply and a multiple would have to invent a plan dimension to have an\n * operand — the exact thing the decision forbids.\n *\n * The repo already has the family for that case, and those same docblocks\n * point at it: `WEBHOOK_MAX_PER_HOST` (AGL-1360), `NON_PAGE_SCREEN_MAX_PER_HOST`\n * (AGL-1399), `ACTIONS_MAX_PER_HOST` / `ENTRIES_MAX_PER_COLLECTION` (AGL-2266),\n * `AUTHORS_MAX_PER_HOST` (AGL-2486) — *\"a flat PLATFORM cap with no\n * `OrgEntitlements` key, no variation by plan, and nothing on the price list\n * to explain.\"* So the two named precedents supply the POSTURE (containment,\n * not capacity; a trip is an incident, not a quota; the refusal must be\n * visible to the host and opaque to the visitor) and the flat family supplies\n * the SHAPE. They do not disagree; they answer different halves.\n *\n * ## A TOTAL, not a monthly count — the one place the posture differs\n *\n * `FORM_ABUSE_CEILING` and `BANDWIDTH_ABUSE_CEILING` both count a month and\n * therefore self-clear at the month boundary with nobody doing anything. These\n * count LIVE DOCUMENTS, which do not. The refusal counters below are still\n * month-keyed — that is a rate of refusals, and it is what the owner's notice\n * reports — but the ceiling itself is cleared by deleting members or leads (or\n * by support raising it), and the owner's notice must not promise a date. A\n * notice that said \"accepting again on 1 September\" would be a promise the\n * platform does not keep.\n */\n\n/**\n * How many member accounts one site may hold (AGL-1529). the figure.\n *\n * Sized to the busiest plausible membership site rather than to today's data,\n * which is the only property a flat ceiling needs. A site member is a human\n * who chose a password on ONE site; 50,000 of them is a large membership\n * roster — larger than anything on the platform and larger than anything the\n * beta will produce — while a script wants millions and reaches this in an\n * afternoon. Every account past it is refused, none is billed, and none of\n * it changes what any plan includes.\n *\n * Counted as LIVE documents, so removing a member in the inbox frees the\n * slot. Counting tombstones would be AGL-1173's bug one collection over.\n */\nexport const SITE_MEMBERS_MAX_PER_HOST = 50_000\n\n/**\n * How many lead records one site may hold (AGL-1529).\n *\n * **Deliberately NOT the same number as {@link SITE_MEMBERS_MAX_PER_HOST}**,\n * and the reason changed when leads were deduped.\n *\n * A lead used to be APPEND-ONLY, keyed by nothing: every sign-up wrote one\n * and so did every booking, so one returning customer legitimately produced\n * many rows. 4× was sized to keep the MEMBER ceiling the binding one on the\n * path they share, rather than refusing a record on a site doing nothing\n * wrong. Since `docs/specs/reusable-forms.md` §4 a lead is one document per\n * person per host, keyed on `personKey`, so leads and members now count the\n * same population and that arithmetic no longer applies.\n *\n * **The number stays where it is.** Lowering it because the collection stopped\n * growing per event would convert a safety margin into a plan limit, which\n * `docs/DECISION_LOG.md` forbids — the 2026-08-23 entry made this ceiling a\n * flat platform abuse control precisely so \"unlimited leads on every plan\"\n * stays literally true. What the headroom now buys is a ceiling that is very\n * unlikely to trip at all, which is the right shape for a control that\n * refuses a person: 200,000 lead rows at ~200 bytes is ~40 MB, which is a\n * number, and unbounded is not.\n *\n * ⚠️ It must stay ABOVE {@link SITE_MEMBERS_MAX_PER_HOST}. A site member is\n * also a lead, so an equal or lower lead ceiling would refuse the side effect\n * of a sign-up the member ceiling had just allowed.\n */\nexport const LEADS_MAX_PER_HOST = 200_000\n\n/**\n * Refusal code carried by the sign-up 429 (AGL-1529).\n *\n * The dispatcher's per-(host, IP) rate limiter answers 429 too, so the STATUS\n * discriminates nothing — this code is the whole discriminator, and one means\n * \"slow down\" while the other means \"this site is not taking new accounts\".\n * Shared rather than restated so producer and consumer cannot drift, exactly\n * as `FORM_ABUSE_CEILING_CODE` is.\n */\nexport const SITE_MEMBER_CEILING_CODE = 'site-member-ceiling'\n\n/**\n * The visitor's sentence, under the three rules `FORM_UNAVAILABLE_MESSAGE`\n * established (AGL-1666) and for the identical reason: the person reading it\n * is a stranger to the site and NOT our customer.\n *\n *  1. **It does not blame them.** They filled the form in correctly. Nothing\n *     about their address, their password or their retry is the reason.\n *  2. **It does not explain.** \"Unusual volume\", \"this site is at its member\n *     limit\", or anything naming Aglyn, tells a stranger something about the\n *     site owner's account that the owner never chose to publish — and names\n *     a platform the visitor did not come here to hear about.\n *  3. **It does not sound successful.** It says, in as many words, that the\n *     account was not created, so nobody walks away believing they have one\n *     and waiting for an email that is never coming.\n */\nexport const SITE_MEMBER_UNAVAILABLE_MESSAGE =\n  'This site isn’t accepting new accounts right now, so your account was ' +\n  'not created. Please try again later.'\n\n/** The verdict every enforcement point below asks for. */\nexport interface VisitorRecordCeilingResult {\n  /** True once the live document count has REACHED the ceiling. */\n  exceeded: boolean\n  /** The ceiling that was compared against. Always a finite integer. */\n  ceiling: number\n  /** The count that was compared, floored at 0. */\n  used: number\n}\n\n/**\n * Is this site at a flat visitor-record ceiling?\n *\n * The ceiling is an explicit argument rather than read from a table, so the\n * suite can re-drive the SAME usage against a ceiling one higher and require\n * it to succeed — the causation leg of `free-tier-caps-refuse.spec.ts`, which\n * is the only thing that distinguishes \"refused by THIS cap\" from \"refuses\n * everything\". No production caller passes anything but the two constants\n * above; {@link checkSiteMemberCeiling} and {@link checkLeadCeiling} bind them.\n *\n * `strictNullChecks` is OFF repo-wide, so both inputs are normalised rather\n * than trusted, and the two directions are deliberately NOT symmetric:\n *\n *  - `used` folds a missing/NaN count to 0, matching `checkBandwidthAbuseCeiling`.\n *    An unreadable count must not refuse a site; the count is read inside a\n *    transaction that throws rather than returning nothing, so this is a\n *    belt, not a path.\n *  - `ceiling` folds a missing/NaN ceiling to 0, and a ceiling of 0 REFUSES\n *    EVERYTHING. `0` is a legitimate ceiling meaning \"none allowed\" and must\n *    never read as unlimited — the `if (!count)` trap this repo keeps being\n *    bitten by, in the argument that decides the refusal.\n */\nexport function checkVisitorRecordCeiling(\n  used: number,\n  ceiling: number,\n): VisitorRecordCeilingResult {\n  const resolvedCeiling = Math.max(0, Math.floor(Number(ceiling) || 0))\n  const resolvedUsed = Math.max(0, Math.floor(Number(used) || 0))\n  return {\n    exceeded: resolvedUsed >= resolvedCeiling,\n    ceiling: resolvedCeiling,\n    used: resolvedUsed,\n  }\n}\n\n/** {@link checkVisitorRecordCeiling} bound to {@link SITE_MEMBERS_MAX_PER_HOST}. */\nexport function checkSiteMemberCeiling(\n  used: number,\n): VisitorRecordCeilingResult {\n  return checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n}\n\n/** {@link checkVisitorRecordCeiling} bound to {@link LEADS_MAX_PER_HOST}. */\nexport function checkLeadCeiling(used: number): VisitorRecordCeilingResult {\n  return checkVisitorRecordCeiling(used, LEADS_MAX_PER_HOST)\n}\n\n/** Which collection a trip belongs to — the counter id and the notice differ. */\nexport type VisitorRecordKind = 'siteMembers' | 'leads'\n\n/**\n * `hosts/{hostId}/counters/{…}` — the durable, client-unwritable record of a\n * trip, in the same counters-document shape `formSubmissionsRefused` uses\n * (AGL-1367/1655). Named through a function so the writer in\n * `@aglyn/tenant-data-admin` and the reader in the inbox console page cannot\n * spell it two different ways.\n */\nexport function visitorRecordRefusedCounterId(kind: VisitorRecordKind): string {\n  return kind === 'leads' ? 'leadsRefused' : 'siteMembersRefused'\n}\n\n/**\n * The field on the refusal counter that says whether the site's managers have\n * been told about the crossing the site is in: when the notice went out, or\n * `null` once the site has been seen below the ceiling again (AGL-3442).\n */\nexport const VISITOR_RECORD_NOTICE_SENT_FIELD = 'noticeSentAtMs'\n\n/** A month key on the refusal counter — `submissionMonthKey`'s `YYYY-MM`. */\nconst REFUSAL_MONTH_KEY = /^\\d{4}-\\d{2}$/\n\n/**\n * Whether the managers have already been told this site is at the ceiling.\n *\n * The notice goes out once per CROSSING (AGL-3442): on the first refusal after\n * the site reaches the ceiling, never again while it stays there, and again\n * only after it has been seen below the ceiling and reached it once more. A\n * site can sit at this ceiling for months, and a notice every month would be\n * an alarm about a state nobody needs telling about twice.\n *\n * A counter written before {@link VISITOR_RECORD_NOTICE_SENT_FIELD} existed\n * does not carry it. Its writer sent the notice on the first refusal of each\n * month, so any month with a refusal is a month the notice went out, and such\n * a counter reads as announced. Otherwise every site already at its ceiling\n * would be notified again on its next refusal.\n */\nexport function visitorRecordCeilingAnnounced(\n  counter: Record<string, unknown> | null | undefined,\n): boolean {\n  if (!counter) return false\n  const sent = counter[VISITOR_RECORD_NOTICE_SENT_FIELD]\n  if (sent === null) return false\n  if (sent !== undefined) return true\n  return Object.entries(counter).some(\n    ([key, value]) => REFUSAL_MONTH_KEY.test(key) && Number(value) > 0,\n  )\n}\n\n/**\n * Whether accepting one more record, with `used` already held, takes the\n * site's last free slot under `ceiling`.\n *\n * Every new record is judged against the ceiling one at a time, so a site that\n * dropped below the ceiling can only reach it again through this accept. That\n * makes it the one accept where the notice is re-armed, and the only one that\n * pays a read for it.\n */\nexport function visitorRecordAcceptFillsCeiling(\n  used: number,\n  ceiling: number,\n): boolean {\n  const resolvedUsed = Math.max(0, Math.floor(Number(used) || 0))\n  return checkVisitorRecordCeiling(resolvedUsed + 1, ceiling).exceeded\n}\n\n/** What the site's owner is shown. Shaped like `FormsPausedOwnerNotice`. */\nexport interface VisitorRecordsPausedNotice {\n  title: string\n  /** What happened, how many, and what actually clears it. */\n  message: string\n}\n\n/**\n * The owner's notice — the half deliberately withheld from the visitor.\n *\n * Two `{title, message}` lines rather than `LockdownRefusalNotice`'s three:\n * there is **no `until`**, and its absence is the point. The form and\n * bandwidth ceilings count a month and genuinely do lift on the 1st, so their\n * notices name a date. This ceiling counts live documents, so no date lifts\n * it — deleting records does, or support raising it does. Borrowing the third\n * line for symmetry would print a date that means nothing.\n *\n * Returns `null` below one refusal, the same rule as\n * `formSubmissionsPausedNotice` and for the same reason: the counter document\n * persists from its first trip forever, and \"0 refused\" on every later month\n * trains the owner to ignore the row that will one day be real.\n */\nexport function visitorRecordsPausedNotice(input: {\n  kind: VisitorRecordKind\n  /** Refusals recorded for the month being displayed. */\n  refused: number\n  /** The ceiling that was crossed, from the counter document. */\n  ceiling?: number\n}): VisitorRecordsPausedNotice | null {\n  const refused = Math.floor(Number(input.refused) || 0)\n  if (refused < 1) return null\n  const ceiling =\n    typeof input.ceiling === 'number' && Number.isFinite(input.ceiling)\n      ? Math.floor(input.ceiling)\n      : undefined\n  const leads = input.kind === 'leads'\n  const noun = leads ? 'lead' : 'sign-up'\n  return {\n    title: leads\n      ? 'Lead capture is paused'\n      : 'New member sign-ups are paused',\n    message:\n      `${refused.toLocaleString()} ${noun}${refused === 1 ? '' : 's'} on ` +\n      `this site ${refused === 1 ? 'has' : 'have'} been refused this month` +\n      (ceiling\n        ? ` after it reached ${ceiling.toLocaleString()} ` +\n          `${leads ? 'leads' : 'member accounts'}`\n        : '') +\n      '. Refused records are not stored and are not billed. This is a ' +\n      'platform safety limit, not part of your plan — every plan includes ' +\n      `unlimited ${leads ? 'leads' : 'member accounts'}. Removing ` +\n      `${leads ? 'leads' : 'members'} below the limit starts acceptance ` +\n      'again immediately; if this is real traffic, contact support and we ' +\n      'will raise it.',\n  }\n}\n"],"names":["SITE_MEMBERS_MAX_PER_HOST","LEADS_MAX_PER_HOST","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","checkVisitorRecordCeiling","used","ceiling","resolvedCeiling","Math","max","floor","Number","resolvedUsed","exceeded","checkSiteMemberCeiling","checkLeadCeiling","visitorRecordRefusedCounterId","kind","VISITOR_RECORD_NOTICE_SENT_FIELD","REFUSAL_MONTH_KEY","visitorRecordCeilingAnnounced","counter","sent","undefined","Object","entries","some","key","value","test","visitorRecordAcceptFillsCeiling","visitorRecordsPausedNotice","input","refused","isFinite","leads","noun","title","message","toLocaleString"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+DC,GAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,4BAA4B,MAAM;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAMC,qBAAqB,OAAO;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,2BAA2B,sBAAqB;AAE7D;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,kCACX,2EACA,uCAAsC;AAYxC;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASC,0BACdC,IAAY,EACZC,OAAe;IAEf,MAAMC,kBAAkBC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAOL,YAAY;IAClE,MAAMM,eAAeJ,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAON,SAAS;IAC5D,OAAO;QACLQ,UAAUD,gBAAgBL;QAC1BD,SAASC;QACTF,MAAMO;IACR;AACF;AAEA,kFAAkF,GAClF,OAAO,SAASE,uBACdT,IAAY;IAEZ,OAAOD,0BAA0BC,MAAML;AACzC;AAEA,2EAA2E,GAC3E,OAAO,SAASe,iBAAiBV,IAAY;IAC3C,OAAOD,0BAA0BC,MAAMJ;AACzC;AAKA;;;;;;CAMC,GACD,OAAO,SAASe,8BAA8BC,IAAuB;IACnE,OAAOA,SAAS,UAAU,iBAAiB;AAC7C;AAEA;;;;CAIC,GACD,OAAO,MAAMC,mCAAmC,iBAAgB;AAEhE,2EAA2E,GAC3E,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,8BACdC,OAAmD;IAEnD,IAAI,CAACA,SAAS,OAAO;IACrB,MAAMC,OAAOD,OAAO,CAACH,iCAAiC;IACtD,IAAII,SAAS,MAAM,OAAO;IAC1B,IAAIA,SAASC,WAAW,OAAO;IAC/B,OAAOC,OAAOC,OAAO,CAACJ,SAASK,IAAI,CACjC,CAAC,CAACC,KAAKC,MAAM,GAAKT,kBAAkBU,IAAI,CAACF,QAAQhB,OAAOiB,SAAS;AAErE;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASE,gCACdzB,IAAY,EACZC,OAAe;IAEf,MAAMM,eAAeJ,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAON,SAAS;IAC5D,OAAOD,0BAA0BQ,eAAe,GAAGN,SAASO,QAAQ;AACtE;AASA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASkB,2BAA2BC,KAM1C;IACC,MAAMC,UAAUzB,KAAKE,KAAK,CAACC,OAAOqB,MAAMC,OAAO,KAAK;IACpD,IAAIA,UAAU,GAAG,OAAO;IACxB,MAAM3B,UACJ,OAAO0B,MAAM1B,OAAO,KAAK,YAAYK,OAAOuB,QAAQ,CAACF,MAAM1B,OAAO,IAC9DE,KAAKE,KAAK,CAACsB,MAAM1B,OAAO,IACxBiB;IACN,MAAMY,QAAQH,MAAMf,IAAI,KAAK;IAC7B,MAAMmB,OAAOD,QAAQ,SAAS;IAC9B,OAAO;QACLE,OAAOF,QACH,2BACA;QACJG,SACE,GAAGL,QAAQM,cAAc,GAAG,CAAC,EAAEH,OAAOH,YAAY,IAAI,KAAK,IAAI,IAAI,CAAC,GACpE,CAAC,UAAU,EAAEA,YAAY,IAAI,QAAQ,OAAO,wBAAwB,CAAC,GACpE3B,CAAAA,UACG,CAAC,kBAAkB,EAAEA,QAAQiC,cAAc,GAAG,CAAC,CAAC,GAChD,GAAGJ,QAAQ,UAAU,mBAAmB,GACxC,EAAC,IACL,oEACA,wEACA,CAAC,UAAU,EAAEA,QAAQ,UAAU,kBAAkB,WAAW,CAAC,GAC7D,GAAGA,QAAQ,UAAU,UAAU,mCAAmC,CAAC,GACnE,wEACA;IACJ;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/visitor-record-ceiling.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Flat platform ceilings on the two host subcollections an ANONYMOUS VISITOR\n * can create documents in (AGL-1529).\n *\n * ## What this is\n *\n * A platform-wide ceiling, and deliberately NOT a plan dimension — so\n * \"unlimited member accounts on every plan\" stays true, because an abuse\n * control is not something we sell. The same instrument is already in place\n * twice: AGL-1655 for forms and AGL-2155 for bandwidth.\n *\n * ## Why it is not a plan dimension, and must never become one\n *\n * AGL-889 decided member accounts are UNLIMITED on every plan as a PRICING\n * matter, and `/pricing` says so. A cap that varied by plan would make that\n * sentence false the moment it shipped. So there is no `OrgEntitlements` key\n * here, no `PLAN_ENTITLEMENTS` row, no band and nothing to re-price: every\n * plan, free through enterprise, gets the same number, and the number exists\n * only to answer the question `checkFormSubmissionAbuseCeiling`'s docblock\n * poses — *\"is this still a customer's traffic at all?\"* A plan gate asks\n * whether the customer bought this; this asks whether a customer is involved.\n *\n * ## The hole this closes\n *\n * `hosts/{hostId}/siteMembers` and `hosts/{hostId}/leads` were bounded by\n * NOTHING. Both are written on behalf of anonymous visitors on a public site\n * (`membershipRegisterHandler`, the two bookings lead paths), and the only\n * bound was `visitorWriteRateLimitRefusal` — keyed on (host, IP), fails soft,\n * and bounds the RATE rather than the TOTAL. That is verbatim the sentence\n * AGL-2265 used as its reason for adding the free-workspace ceiling, and the\n * shape AGL-2266 closed for `actions` and `entries`: unbounded Firestore\n * documents behind a $0 subscription.\n *\n * ## Why the shape here is the FLAT family, not the MULTIPLE family\n *\n * The two ceilings named as precedent — `FORM_ABUSE_CEILING_*` and\n * `BANDWIDTH_ABUSE_CEILING_*` — are both `max(floor, included × 10)`. They\n * can be, because forms and bandwidth each have an *included band* on the\n * price list to multiply. Members and leads have no included band by\n * construction (that is the whole point of AGL-889), so there is nothing to\n * multiply and a multiple would have to invent a plan dimension to have an\n * operand — the exact thing the decision forbids.\n *\n * The repo already has the family for that case, and those same docblocks\n * point at it: `WEBHOOK_MAX_PER_HOST` (AGL-1360), `NON_PAGE_SCREEN_MAX_PER_HOST`\n * (AGL-1399), `ACTIONS_MAX_PER_HOST` / `ENTRIES_MAX_PER_COLLECTION` (AGL-2266),\n * `AUTHORS_MAX_PER_HOST` (AGL-2486) — *\"a flat PLATFORM cap with no\n * `OrgEntitlements` key, no variation by plan, and nothing on the price list\n * to explain.\"* So the two named precedents supply the POSTURE (containment,\n * not capacity; a trip is an incident, not a quota; the refusal must be\n * visible to the host and opaque to the visitor) and the flat family supplies\n * the SHAPE. They do not disagree; they answer different halves.\n *\n * ## A TOTAL, not a monthly count — the one place the posture differs\n *\n * `FORM_ABUSE_CEILING` and `BANDWIDTH_ABUSE_CEILING` both count a month and\n * therefore self-clear at the month boundary with nobody doing anything. These\n * count LIVE DOCUMENTS, which do not. The refusal counters below are still\n * month-keyed — that is a rate of refusals, and it is what the owner's notice\n * reports — but the ceiling itself is cleared by deleting members or leads (or\n * by support raising it), and the owner's notice must not promise a date. A\n * notice that said \"accepting again on 1 September\" would be a promise the\n * platform does not keep.\n */\n\n/**\n * How many member accounts one site may hold (AGL-1529). the figure.\n *\n * Sized to the busiest plausible membership site rather than to today's data,\n * which is the only property a flat ceiling needs. A site member is a human\n * who chose a password on ONE site; 50,000 of them is a large membership\n * roster — larger than anything on the platform and larger than anything the\n * beta will produce — while a script wants millions and reaches this in an\n * afternoon. Every account past it is refused, none is billed, and none of\n * it changes what any plan includes.\n *\n * Counted as LIVE documents, so removing a member in the inbox frees the\n * slot. Counting tombstones would be AGL-1173's bug one collection over.\n */\nexport const SITE_MEMBERS_MAX_PER_HOST = 50_000\n\n/**\n * How many lead records one site may hold (AGL-1529).\n *\n * **Deliberately NOT the same number as {@link SITE_MEMBERS_MAX_PER_HOST}**,\n * and the reason changed when leads were deduped.\n *\n * A lead used to be APPEND-ONLY, keyed by nothing: every sign-up wrote one\n * and so did every booking, so one returning customer legitimately produced\n * many rows. 4× was sized to keep the MEMBER ceiling the binding one on the\n * path they share, rather than refusing a record on a site doing nothing\n * wrong. Since `docs/specs/reusable-forms.md` §4 a lead is one document per\n * person per host, keyed on `personKey`, so leads and members now count the\n * same population and that arithmetic no longer applies.\n *\n * **The number stays where it is.** Lowering it because the collection stopped\n * growing per event would convert a safety margin into a plan limit, which\n * `docs/DECISION_LOG.md` forbids — the 2026-08-23 entry made this ceiling a\n * flat platform abuse control precisely so \"unlimited leads on every plan\"\n * stays literally true. What the headroom now buys is a ceiling that is very\n * unlikely to trip at all, which is the right shape for a control that\n * refuses a person: 200,000 lead rows at ~200 bytes is ~40 MB, which is a\n * number, and unbounded is not.\n *\n * ⚠️ It must stay ABOVE {@link SITE_MEMBERS_MAX_PER_HOST}. A site member is\n * also a lead, so an equal or lower lead ceiling would refuse the side effect\n * of a sign-up the member ceiling had just allowed.\n */\nexport const LEADS_MAX_PER_HOST = 200_000\n\n/**\n * Refusal code carried by the sign-up 429 (AGL-1529).\n *\n * The dispatcher's per-(host, IP) rate limiter answers 429 too, so the STATUS\n * discriminates nothing — this code is the whole discriminator, and one means\n * \"slow down\" while the other means \"this site is not taking new accounts\".\n * Shared rather than restated so producer and consumer cannot drift, exactly\n * as the form door's `form-abuse-ceiling` is.\n */\nexport const SITE_MEMBER_CEILING_CODE = 'site-member-ceiling'\n\n/**\n * The visitor's sentence, under the three rules the form door's refusal\n * established (AGL-1666) and for the identical reason: the person reading it\n * is a stranger to the site and NOT our customer.\n *\n *  1. **It does not blame them.** They filled the form in correctly. Nothing\n *     about their address, their password or their retry is the reason.\n *  2. **It does not explain.** \"Unusual volume\", \"this site is at its member\n *     limit\", or anything naming Aglyn, tells a stranger something about the\n *     site owner's account that the owner never chose to publish — and names\n *     a platform the visitor did not come here to hear about.\n *  3. **It does not sound successful.** It says, in as many words, that the\n *     account was not created, so nobody walks away believing they have one\n *     and waiting for an email that is never coming.\n */\nexport const SITE_MEMBER_UNAVAILABLE_MESSAGE =\n  'This site isn’t accepting new accounts right now, so your account was ' +\n  'not created. Please try again later.'\n\n/** The verdict every enforcement point below asks for. */\nexport interface VisitorRecordCeilingResult {\n  /** True once the live document count has REACHED the ceiling. */\n  exceeded: boolean\n  /** The ceiling that was compared against. Always a finite integer. */\n  ceiling: number\n  /** The count that was compared, floored at 0. */\n  used: number\n}\n\n/**\n * Is this site at a flat visitor-record ceiling?\n *\n * The ceiling is an explicit argument rather than read from a table, so the\n * suite can re-drive the SAME usage against a ceiling one higher and require\n * it to succeed — the causation leg of `free-tier-caps-refuse.spec.ts`, which\n * is the only thing that distinguishes \"refused by THIS cap\" from \"refuses\n * everything\". No production caller passes anything but the two constants\n * above; {@link checkSiteMemberCeiling} and {@link checkLeadCeiling} bind them.\n *\n * `strictNullChecks` is OFF repo-wide, so both inputs are normalised rather\n * than trusted, and the two directions are deliberately NOT symmetric:\n *\n *  - `used` folds a missing/NaN count to 0, matching `checkBandwidthAbuseCeiling`.\n *    An unreadable count must not refuse a site; the count is read inside a\n *    transaction that throws rather than returning nothing, so this is a\n *    belt, not a path.\n *  - `ceiling` folds a missing/NaN ceiling to 0, and a ceiling of 0 REFUSES\n *    EVERYTHING. `0` is a legitimate ceiling meaning \"none allowed\" and must\n *    never read as unlimited — the `if (!count)` trap this repo keeps being\n *    bitten by, in the argument that decides the refusal.\n */\nexport function checkVisitorRecordCeiling(\n  used: number,\n  ceiling: number,\n): VisitorRecordCeilingResult {\n  const resolvedCeiling = Math.max(0, Math.floor(Number(ceiling) || 0))\n  const resolvedUsed = Math.max(0, Math.floor(Number(used) || 0))\n  return {\n    exceeded: resolvedUsed >= resolvedCeiling,\n    ceiling: resolvedCeiling,\n    used: resolvedUsed,\n  }\n}\n\n/** {@link checkVisitorRecordCeiling} bound to {@link SITE_MEMBERS_MAX_PER_HOST}. */\nexport function checkSiteMemberCeiling(\n  used: number,\n): VisitorRecordCeilingResult {\n  return checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n}\n\n/** {@link checkVisitorRecordCeiling} bound to {@link LEADS_MAX_PER_HOST}. */\nexport function checkLeadCeiling(used: number): VisitorRecordCeilingResult {\n  return checkVisitorRecordCeiling(used, LEADS_MAX_PER_HOST)\n}\n\n/** Which collection a trip belongs to — the counter id and the notice differ. */\nexport type VisitorRecordKind = 'siteMembers' | 'leads'\n\n/**\n * `hosts/{hostId}/counters/{…}` — the durable, client-unwritable record of a\n * trip, in the same counters-document shape `formSubmissionsRefused` uses\n * (AGL-1367/1655). Named through a function so the writer in\n * `@aglyn/tenant-data-admin` and the reader in the inbox console page cannot\n * spell it two different ways.\n */\nexport function visitorRecordRefusedCounterId(kind: VisitorRecordKind): string {\n  return kind === 'leads' ? 'leadsRefused' : 'siteMembersRefused'\n}\n\n/**\n * The field on the refusal counter that says whether the site's managers have\n * been told about the crossing the site is in: when the notice went out, or\n * `null` once the site has been seen below the ceiling again (AGL-3442).\n */\nexport const VISITOR_RECORD_NOTICE_SENT_FIELD = 'noticeSentAtMs'\n\n/** A month key on the refusal counter — `utcMonthKey`'s `YYYY-MM`. */\nconst REFUSAL_MONTH_KEY = /^\\d{4}-\\d{2}$/\n\n/**\n * Whether the managers have already been told this site is at the ceiling.\n *\n * The notice goes out once per CROSSING (AGL-3442): on the first refusal after\n * the site reaches the ceiling, never again while it stays there, and again\n * only after it has been seen below the ceiling and reached it once more. A\n * site can sit at this ceiling for months, and a notice every month would be\n * an alarm about a state nobody needs telling about twice.\n *\n * A counter written before {@link VISITOR_RECORD_NOTICE_SENT_FIELD} existed\n * does not carry it. Its writer sent the notice on the first refusal of each\n * month, so any month with a refusal is a month the notice went out, and such\n * a counter reads as announced. Otherwise every site already at its ceiling\n * would be notified again on its next refusal.\n */\nexport function visitorRecordCeilingAnnounced(\n  counter: Record<string, unknown> | null | undefined,\n): boolean {\n  if (!counter) return false\n  const sent = counter[VISITOR_RECORD_NOTICE_SENT_FIELD]\n  if (sent === null) return false\n  if (sent !== undefined) return true\n  return Object.entries(counter).some(\n    ([key, value]) => REFUSAL_MONTH_KEY.test(key) && Number(value) > 0,\n  )\n}\n\n/**\n * Whether accepting one more record, with `used` already held, takes the\n * site's last free slot under `ceiling`.\n *\n * Every new record is judged against the ceiling one at a time, so a site that\n * dropped below the ceiling can only reach it again through this accept. That\n * makes it the one accept where the notice is re-armed, and the only one that\n * pays a read for it.\n */\nexport function visitorRecordAcceptFillsCeiling(\n  used: number,\n  ceiling: number,\n): boolean {\n  const resolvedUsed = Math.max(0, Math.floor(Number(used) || 0))\n  return checkVisitorRecordCeiling(resolvedUsed + 1, ceiling).exceeded\n}\n\n/** What the site's owner is shown. Shaped like `VisitorDoorPausedNotice`. */\nexport interface VisitorRecordsPausedNotice {\n  title: string\n  /** What happened, how many, and what actually clears it. */\n  message: string\n}\n\n/**\n * The owner's notice — the half deliberately withheld from the visitor.\n *\n * Two `{title, message}` lines rather than `LockdownRefusalNotice`'s three:\n * there is **no `until`**, and its absence is the point. The form and\n * bandwidth ceilings count a month and genuinely do lift on the 1st, so their\n * notices name a date. This ceiling counts live documents, so no date lifts\n * it — deleting records does, or support raising it does. Borrowing the third\n * line for symmetry would print a date that means nothing.\n *\n * Returns `null` below one refusal, the same rule as\n * `visitorDoorPausedNotice` and for the same reason: the counter document\n * persists from its first trip forever, and \"0 refused\" on every later month\n * trains the owner to ignore the row that will one day be real.\n */\nexport function visitorRecordsPausedNotice(input: {\n  kind: VisitorRecordKind\n  /** Refusals recorded for the month being displayed. */\n  refused: number\n  /** The ceiling that was crossed, from the counter document. */\n  ceiling?: number\n}): VisitorRecordsPausedNotice | null {\n  const refused = Math.floor(Number(input.refused) || 0)\n  if (refused < 1) return null\n  const ceiling =\n    typeof input.ceiling === 'number' && Number.isFinite(input.ceiling)\n      ? Math.floor(input.ceiling)\n      : undefined\n  const leads = input.kind === 'leads'\n  const noun = leads ? 'lead' : 'sign-up'\n  return {\n    title: leads\n      ? 'Lead capture is paused'\n      : 'New member sign-ups are paused',\n    message:\n      `${refused.toLocaleString()} ${noun}${refused === 1 ? '' : 's'} on ` +\n      `this site ${refused === 1 ? 'has' : 'have'} been refused this month` +\n      (ceiling\n        ? ` after it reached ${ceiling.toLocaleString()} ` +\n          `${leads ? 'leads' : 'member accounts'}`\n        : '') +\n      '. Refused records are not stored and are not billed. This is a ' +\n      'platform safety limit, not part of your plan — every plan includes ' +\n      `unlimited ${leads ? 'leads' : 'member accounts'}. Removing ` +\n      `${leads ? 'leads' : 'members'} below the limit starts acceptance ` +\n      'again immediately; if this is real traffic, contact support and we ' +\n      'will raise it.',\n  }\n}\n"],"names":["SITE_MEMBERS_MAX_PER_HOST","LEADS_MAX_PER_HOST","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","checkVisitorRecordCeiling","used","ceiling","resolvedCeiling","Math","max","floor","Number","resolvedUsed","exceeded","checkSiteMemberCeiling","checkLeadCeiling","visitorRecordRefusedCounterId","kind","VISITOR_RECORD_NOTICE_SENT_FIELD","REFUSAL_MONTH_KEY","visitorRecordCeilingAnnounced","counter","sent","undefined","Object","entries","some","key","value","test","visitorRecordAcceptFillsCeiling","visitorRecordsPausedNotice","input","refused","isFinite","leads","noun","title","message","toLocaleString"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+DC,GAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,4BAA4B,MAAM;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAMC,qBAAqB,OAAO;AAEzC;;;;;;;;CAQC,GACD,OAAO,MAAMC,2BAA2B,sBAAqB;AAE7D;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,kCACX,2EACA,uCAAsC;AAYxC;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASC,0BACdC,IAAY,EACZC,OAAe;IAEf,MAAMC,kBAAkBC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAOL,YAAY;IAClE,MAAMM,eAAeJ,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAON,SAAS;IAC5D,OAAO;QACLQ,UAAUD,gBAAgBL;QAC1BD,SAASC;QACTF,MAAMO;IACR;AACF;AAEA,kFAAkF,GAClF,OAAO,SAASE,uBACdT,IAAY;IAEZ,OAAOD,0BAA0BC,MAAML;AACzC;AAEA,2EAA2E,GAC3E,OAAO,SAASe,iBAAiBV,IAAY;IAC3C,OAAOD,0BAA0BC,MAAMJ;AACzC;AAKA;;;;;;CAMC,GACD,OAAO,SAASe,8BAA8BC,IAAuB;IACnE,OAAOA,SAAS,UAAU,iBAAiB;AAC7C;AAEA;;;;CAIC,GACD,OAAO,MAAMC,mCAAmC,iBAAgB;AAEhE,oEAAoE,GACpE,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,8BACdC,OAAmD;IAEnD,IAAI,CAACA,SAAS,OAAO;IACrB,MAAMC,OAAOD,OAAO,CAACH,iCAAiC;IACtD,IAAII,SAAS,MAAM,OAAO;IAC1B,IAAIA,SAASC,WAAW,OAAO;IAC/B,OAAOC,OAAOC,OAAO,CAACJ,SAASK,IAAI,CACjC,CAAC,CAACC,KAAKC,MAAM,GAAKT,kBAAkBU,IAAI,CAACF,QAAQhB,OAAOiB,SAAS;AAErE;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASE,gCACdzB,IAAY,EACZC,OAAe;IAEf,MAAMM,eAAeJ,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,OAAON,SAAS;IAC5D,OAAOD,0BAA0BQ,eAAe,GAAGN,SAASO,QAAQ;AACtE;AASA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASkB,2BAA2BC,KAM1C;IACC,MAAMC,UAAUzB,KAAKE,KAAK,CAACC,OAAOqB,MAAMC,OAAO,KAAK;IACpD,IAAIA,UAAU,GAAG,OAAO;IACxB,MAAM3B,UACJ,OAAO0B,MAAM1B,OAAO,KAAK,YAAYK,OAAOuB,QAAQ,CAACF,MAAM1B,OAAO,IAC9DE,KAAKE,KAAK,CAACsB,MAAM1B,OAAO,IACxBiB;IACN,MAAMY,QAAQH,MAAMf,IAAI,KAAK;IAC7B,MAAMmB,OAAOD,QAAQ,SAAS;IAC9B,OAAO;QACLE,OAAOF,QACH,2BACA;QACJG,SACE,GAAGL,QAAQM,cAAc,GAAG,CAAC,EAAEH,OAAOH,YAAY,IAAI,KAAK,IAAI,IAAI,CAAC,GACpE,CAAC,UAAU,EAAEA,YAAY,IAAI,QAAQ,OAAO,wBAAwB,CAAC,GACpE3B,CAAAA,UACG,CAAC,kBAAkB,EAAEA,QAAQiC,cAAc,GAAG,CAAC,CAAC,GAChD,GAAGJ,QAAQ,UAAU,mBAAmB,GACxC,EAAC,IACL,oEACA,wEACA,CAAC,UAAU,EAAEA,QAAQ,UAAU,kBAAkB,WAAW,CAAC,GAC7D,GAAGA,QAAQ,UAAU,UAAU,mCAAmC,CAAC,GACnE,wEACA;IACJ;AACF"}