@aglyn/aglyn 1.0.0-beta.269 → 1.0.0-beta.271

package/src/lib/app-utils/release-flags.d.ts

@@ -29,7 +29,7 @@ import { type PluginReleaseFlagKey } from './plugin-release-flags.generated';
  * Every release flag: the ones plugins declare (compiled from
  * plugins.config.json, AGL-3080) and the platform's own below.
  */
-export type ReleaseFlagKey = PluginReleaseFlagKey | 'release_addon_store' | 'release_native_checkout' | 'release_edit_bar' | 'release_assist' | 'release_video_uploads' | 'release_video_delivery' | 'release_ai_generative' | 'release_crm_assist_whole_record' | 'release_ad_audience_sync';
+export type ReleaseFlagKey = PluginReleaseFlagKey | 'release_addon_store' | 'release_native_checkout' | 'release_edit_bar' | 'release_assist' | 'release_video_uploads' | 'release_video_delivery' | 'release_ai_generative' | 'release_crm_assist_whole_record' | 'release_ai_site_inspiration' | 'release_ad_audience_sync';
 export interface ReleaseFlagDefinition {
     key: ReleaseFlagKey;
     label: string;

package/src/lib/app-utils/release-flags.js

@@ -115,6 +115,16 @@ import { PLUGIN_RELEASE_FLAGS } from "./plugin-release-flags.generated.js";
         description: 'What AI assistance in the CRM (a record summary, next step or ' + 'email draft) sends the model provider (AGL-3520). OFF: the ' + 'disclosed fields, with addresses and numbers in typed text ' + 'replaced. ON: the whole record, contact details and custom fields ' + 'included. ON since 2026-10-05, after Privacy Policy section 2 and ' + 'the Subprocessors row were republished; see ' + 'docs/drafts/agl-3520-crm-assistance-whole-record-disclosure.md.',
         defaultEnabled: true
     },
+    // Per org, with no staff preview on the server: the site job reads the
+    // sites a person names only where the org's verdict is on, and the guided
+    // start asks for them by the same verdict. `model/ai-site-inspiration.ts`
+    // in the AI plugin holds the key.
+    {
+        key: 'release_ai_site_inspiration',
+        label: 'AI site start: sites you like',
+        description: 'The guided AI site start asks for sites the person likes (AGL-3975): ' + 'one on Free, three on a paid plan. The site job reads each home page ' + 'and two of its stylesheets through the SSRF-guarded fetch and keeps ' + 'signals only (section order, spacing, header, colors, type mood, ' + 'button and card shape, motion, and on a paid plan the features it ' + 'offers), never its words, images or logos. OFF by default: no field ' + 'is shown and no site is read.',
+        defaultEnabled: false
+    },
     // Platform-wide, never per org: the nightly job reads only the platform
     // value, because it is the operator's own marketing and no workspace's
     // feature. `apps/console/app/api/admin/ad-audience-sync/route.ts` holds the

package/src/lib/app-utils/release-flags.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/release-flags.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Release flags (AGL-227): platform-level \"is this feature launched\"\n * gating backed by Firebase Remote Config. A separate axis from plan\n * entitlements (`plan-entitlements.ts`) — entitlements ask whether the\n * tenant's PLAN includes a feature, release flags ask whether the feature\n * is released to the public at all (or partially, via percentage rollout).\n * Staff bypass release flags everywhere but see a flagged warning.\n */\n\n/** Remote Config parameter keys for release-gated features. */\nimport type { OrgPlan } from '../foundation'\nimport { PLAN_LABELS, SELF_SERVE_PLANS } from './plan-entitlements'\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\nimport {\n  PLUGIN_RELEASE_FLAGS,\n  type PluginReleaseFlagKey,\n} from './plugin-release-flags.generated'\n\n/**\n * Every release flag: the ones plugins declare (compiled from\n * plugins.config.json, AGL-3080) and the platform's own below.\n */\nexport type ReleaseFlagKey =\n  | PluginReleaseFlagKey\n  | 'release_addon_store'\n  | 'release_native_checkout'\n  | 'release_edit_bar'\n  | 'release_assist'\n  | 'release_video_uploads'\n  | 'release_video_delivery'\n  | 'release_ai_generative'\n  | 'release_crm_assist_whole_record'\n  | 'release_ad_audience_sync'\n\nexport interface ReleaseFlagDefinition {\n  key: ReleaseFlagKey\n  label: string\n  description: string\n  /**\n   * Fallback verdict when Remote Config is unreachable (offline, blocked,\n   * first paint before activate). MUST match the seeded value in\n   * cloud/firebase-remoteconfig.template.json so environments without a\n   * published template behave like the template intends.\n   */\n  defaultEnabled: boolean\n  /** Host dashboard tab id (host-nav-tabs.ts) this flag hides, if any. */\n  navTabId?: string\n}\n\n/** A release flag a plugin declares, as the generator compiles it. */\nexport type PluginReleaseFlagDefinition = ReleaseFlagDefinition & {\n  key: PluginReleaseFlagKey\n}\n\n/**\n * The platform's own release flags: features no plugin owns.\n *\n * Every first-party plugin is release-flagged too (AGL-422) — the flag feeds\n * the plugin LOADER (console, published sites, API dispatch), not just nav\n * visibility, so staff can kill-switch a whole plugin platform-wide from the\n * Feature Flags page. Those flags are the plugins' own: each is defined by\n * its catalog row's `releaseFlagDefinition` in plugins.config.json and\n * compiled into `PLUGIN_RELEASE_FLAGS`, so adding a plugin edits nothing\n * here.\n */\nconst PLATFORM_RELEASE_FLAGS: readonly ReleaseFlagDefinition[] = [\n  {\n    key: 'release_addon_store',\n    label: 'Add-on store',\n    description:\n      'Self-serve add-on purchases on the Billing page: seats, datasets, ' +\n      'extra sites, POS registers, Event Calendar (AGL-524..531).',\n    defaultEnabled: true,\n  },\n  // Released to every workspace 2026-10-06 (AGL-3606). Storefront-only since\n  // the console's plan checkout stopped rendering Stripe Checkout at all. Still\n  // the surface's kill switch, globally or per org: off, both storefront\n  // checkout routes return the hosted redirect again.\n  {\n    key: 'release_native_checkout',\n    label: 'In-page checkout',\n    description:\n      'Storefront shoppers pay on the merchant\\u2019s own site: the Payment ' +\n      'Element, email, shipping address and method, and a live total with ' +\n      'tax open in place under the Buy or Checkout button, styled with the ' +\n      'site theme, instead of a redirect to checkout.stripe.com (AGL-1944). ' +\n      'Released to every workspace 2026-10-06 (AGL-3606). The webhook is ' +\n      'still the only thing that fulfils. Also gated on ' +\n      'NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY, so a deployment without one keeps ' +\n      'the redirect; turning this off returns every storefront to the redirect.',\n    defaultEnabled: true,\n  },\n  // Released to every site 2026-09-16 (AGL-3041). Still the whole surface's\n  // kill switch, globally or for one org by override: off, the tenant slot\n  // renders nothing, both token mints refuse, and `/api/edit-context` turns\n  // away every token already issued.\n  {\n    key: 'release_edit_bar',\n    label: 'Site admin bar',\n    description:\n      'Admin bar on published sites: a signed-in editor jumps from a live ' +\n      'page straight into the Besigner to edit it. Released ' +\n      '2026-09-16 (AGL-3041) for every site; turning it off hides the bar ' +\n      'and revokes every outstanding edit token at the verify site.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_assist',\n    label: `${PLATFORM_BRAND_NAME} Assist`,\n    description:\n      'The in-console AI chat helper on every page (AGL-1860): docs-' +\n      'grounded answers with deep links, page-context guidance on Pro+. ' +\n      'ON in production, and gated on TWO published legal artifacts ' +\n      '(AGL-1909), neither of which is a repo file — both are live besigner ' +\n      'pages, so publication is what satisfies them: (1) the privacy-policy ' +\n      'disclosure for stored Q&A, because the data loop records every ' +\n      'exchange org-scoped under orgs/{orgId}/assistExchanges; and (2) the ' +\n      'Anthropic row on /legal/subprocessors, which was deliberately ' +\n      'REMOVED on 2026-08-13 (subprocessorsV2a-20260813) on the premise ' +\n      'that no production key existed — so the page is not merely ' +\n      'incomplete without it, it is affirmatively wrong. NOTE the real ' +\n      'trigger is ANTHROPIC_API_KEY, not this flag: /api/ai/assist (the ' +\n      'besigner copy assistant, AGL-89/130/169) carries no release flag at ' +\n      'all and sends customer site content to Anthropic on the key plus a ' +\n      'Pro entitlement alone. Setting the key in production therefore makes ' +\n      'Anthropic a subprocessor whether or not this flag is ever flipped.',\n    defaultEnabled: true,\n  },\n  // Ingress only, and with no staff preview on the server: a video a staff\n  // session uploads into a customer's library serves on that customer's pages\n  // like any other, so a grant goes to the org through its override.\n  // `apps/console/utils/server/video-uploads.ts` holds the gate.\n  {\n    key: 'release_video_uploads',\n    label: 'Video uploads',\n    description:\n      'New video in the media library, on every upload path (AGL-2830). ' +\n      'Off: refused with 403 video_uploads_paused, as DAM video delivery is ' +\n      'not yet metered or bounded per org (AGL-2810, AGL-2812). Images, ' +\n      'documents and stored videos are unaffected.',\n    defaultEnabled: false,\n  },\n  // Delivery, not ingress: this flag decides whether a video already in the\n  // library is COPIED to the configured delivery provider and served from it\n  // through a short-lived signed redirect (AGL-2824). Per org, with no staff\n  // preview on the server — a copy is customer data at the provider, so a\n  // grant goes to the org through its override. Off, or with no provider\n  // configured, every video serves from this platform exactly as before.\n  // `media-delivery.ts` in `tenant-data-admin` holds the gate.\n  {\n    key: 'release_video_delivery',\n    label: 'Video delivery',\n    description:\n      'Serves library video from a configured delivery provider through ' +\n      'short-lived signed redirects, and copies each video to it (AGL-2824). ' +\n      'OFF by default: video serves from this platform as before. Also ' +\n      \"needs the provider's settings.\",\n    defaultEnabled: false,\n  },\n  // The generative doors share one runtime with Assist (AGL-2903) but not\n  // its flag: `release_assist` answers questions, this builds things, and\n  // the two are sold, metered and disclosed separately. The server-side\n  // gate lives in `aiGateLadder` (404 when off, staff preview).\n  // Labeled for what it switches — the generative doors — and not with the\n  // add-on's own name, which is sold and live whether or not the doors are\n  // released: the docs name the add-on, and a flag wearing the same words\n  // reads as documented when it is not.\n  {\n    key: 'release_ai_generative',\n    label: `${PLATFORM_BRAND_NAME} AI generation`,\n    description:\n      'Generative building and automation behind the AI add-on ' +\n      '(AGL-2903): sections, pages and workflows written by a model from ' +\n      'a brief, on the shared Anthropic runtime. ON for every workspace ' +\n      'since 2026-09-29; every generative route answers 404 while it is ' +\n      'off. On, it sends customer briefs and site content to Anthropic ' +\n      'on the same ANTHROPIC_API_KEY and under the same subprocessor ' +\n      'disclosure as Assist (AGL-1909).',\n    defaultEnabled: true,\n  },\n  // What CRM assistance hands the model provider, not whether it runs:\n  // `release_ai_generative` opens the doors, this widens what a record sends\n  // through them. Per org, with no staff preview — the data is the customer's,\n  // and a staff session reading a customer's record must send what the\n  // published pages promise. The CRM's record-facts readers hold the gate.\n  {\n    key: 'release_crm_assist_whole_record',\n    label: 'CRM assistance: whole record',\n    description:\n      'What AI assistance in the CRM (a record summary, next step or ' +\n      'email draft) sends the model provider (AGL-3520). OFF: the ' +\n      'disclosed fields, with addresses and numbers in typed text ' +\n      'replaced. ON: the whole record, contact details and custom fields ' +\n      'included. ON since 2026-10-05, after Privacy Policy section 2 and ' +\n      'the Subprocessors row were republished; see ' +\n      'docs/drafts/agl-3520-crm-assistance-whole-record-disclosure.md.',\n    defaultEnabled: true,\n  },\n  // Platform-wide, never per org: the nightly job reads only the platform\n  // value, because it is the operator's own marketing and no workspace's\n  // feature. `apps/console/app/api/admin/ad-audience-sync/route.ts` holds the\n  // gate; a dry run reports the counts whichever way it is set.\n  {\n    key: 'release_ad_audience_sync',\n    label: 'Account-holder ad audiences',\n    description:\n      'Nightly sync of United States account holders, as SHA-256 hashed ' +\n      'email addresses, to the operator\\u2019s own Meta, Google and LinkedIn ' +\n      'customer-list audiences (AGL-3780). OFF by default: nothing is sent ' +\n      'until the Privacy Policy that discloses it is published.',\n    defaultEnabled: false,\n  },\n]\n\n/**\n * The registry: one entry per gated feature, the plugins' first. Adding a\n * platform flag = add it above, seed it in the Remote Config template, and\n * (optionally) wrap the page in `<FeatureGate>` — the staff admin editor and\n * nav filtering pick it up from this list.\n */\nexport const RELEASE_FLAGS: readonly ReleaseFlagDefinition[] = [\n  ...PLUGIN_RELEASE_FLAGS,\n  ...PLATFORM_RELEASE_FLAGS,\n]\n\nexport const RELEASE_FLAG_KEYS = RELEASE_FLAGS.map(\n  (definition) => definition.key,\n) as readonly ReleaseFlagKey[]\n\nexport function isReleaseFlagKey(value: string): value is ReleaseFlagKey {\n  return (RELEASE_FLAG_KEYS as readonly string[]).includes(value)\n}\n\nexport function getReleaseFlagDefinition(\n  key: ReleaseFlagKey,\n): ReleaseFlagDefinition {\n  const definition = RELEASE_FLAGS.find((entry) => entry.key === key)\n  if (!definition) throw new Error(`Unknown release flag: ${key}`)\n  return definition\n}\n\n/**\n * The JSON payload stored in each Remote Config parameter. `enabled: true`\n * turns the feature on for everyone; `enabled: false` with a positive\n * `rolloutPercent` enables it for that percentage of subjects (stable\n * per-tenant bucketing, GrowthBook-style); `plans` narrows either of those\n * to a set of tiers (AGL-2486).\n */\nexport interface ReleaseFlagValue {\n  enabled: boolean\n  /** 0–100; only consulted while `enabled` is false. */\n  rolloutPercent?: number\n  /**\n   * Plan/tier targeting (AGL-2486). The tiers this flag is being rolled out\n   * to, or ABSENT for \"every tier\".\n   *\n   * ABSENT AND EMPTY BOTH MEAN EVERY TIER, and that is load-bearing: every\n   * flag stored before this field existed parses to `undefined` here, and an\n   * operator who unticks every box has plainly not asked for a flag that\n   * reaches nobody. Reading an empty list as \"no tiers\" would dark-launch\n   * nothing while the console still said the flag was on — the inverted\n   * reading of this field is the whole hazard, so it is closed in the parser\n   * rather than left to each call site.\n   */\n  plans?: OrgPlan[]\n  /** Free-form staff note (\"waiting on AGL-199\", owner, etc.). */\n  note?: string\n}\n\nconst clampPercent = (value: unknown): number => {\n  const percent = typeof value === 'number' && Number.isFinite(value) ? value : 0\n  return Math.min(100, Math.max(0, Math.round(percent)))\n}\n\n/**\n * Every plan a flag may target, cheapest first — `SELF_SERVE_PLANS` then\n * `enterprise`, the same ladder `planGrantingFeature` walks and the same\n * order the plan grid renders. Derived, never re-typed: pricing v3 inserted\n * `scale` mid-ladder and added `agency`, and a second hand-written tier list\n * here would have missed both.\n */\nexport const RELEASE_FLAG_PLAN_LADDER: readonly OrgPlan[] = [\n  ...SELF_SERVE_PLANS,\n  'enterprise' as OrgPlan,\n]\n\nconst isOrgPlan = (value: unknown): value is OrgPlan =>\n  typeof value === 'string' &&\n  Object.prototype.hasOwnProperty.call(PLAN_LABELS, value)\n\n/**\n * The tiers on the ladder at or above `plan` — what the console's \"Pro and\n * above\" shortcut expands to before it is STORED as an explicit list.\n *\n * Deliberately a UI convenience and not a stored \"minimum plan\" mode: a\n * stored threshold would silently re-aim every live flag the day a tier is\n * inserted into the middle of the ladder (pricing v3 did exactly that with\n * `scale`). An explicit list means the audience of a published flag only\n * ever changes because a human changed it.\n */\nexport function releaseFlagPlansAtOrAbove(plan: OrgPlan): OrgPlan[] {\n  const index = RELEASE_FLAG_PLAN_LADDER.indexOf(plan)\n  return index < 0 ? [] : RELEASE_FLAG_PLAN_LADDER.slice(index)\n}\n\n/**\n * Sanitises whatever is stored at `plans`, in ladder order.\n *\n * Returns `undefined` — not `[]` — for \"no targeting declared\", so the\n * absence survives a round trip through the staff editor and cannot be\n * written back as a list that means something else. Unknown tier names are\n * dropped for the same reason `parseOrgReleaseFlagOverrides` drops unknown\n * keys: a renamed or retired tier must never gate anything. A list that\n * names ONLY unknown tiers collapses to `undefined` (every tier) rather than\n * to an empty list, because a typo must inherit, never silently target.\n */\nexport function parseReleaseFlagPlans(raw: unknown): OrgPlan[] | undefined {\n  if (!Array.isArray(raw)) return undefined\n  const named = new Set(raw.filter(isOrgPlan))\n  if (named.size === 0) return undefined\n  return RELEASE_FLAG_PLAN_LADDER.filter((plan) => named.has(plan))\n}\n\n/**\n * Parses a Remote Config parameter string into a `ReleaseFlagValue`.\n * Tolerant by design — the template is hand-editable in the Firebase\n * console, so plain \"true\"/\"false\" strings and malformed JSON must not\n * crash gating: anything unreadable falls back to the registry default.\n */\nexport function parseReleaseFlagValue(\n  raw: string | null | undefined,\n  fallbackEnabled: boolean,\n): ReleaseFlagValue {\n  const text = raw?.trim()\n  if (!text) return { enabled: fallbackEnabled }\n  if (text === 'true') return { enabled: true }\n  if (text === 'false') return { enabled: false }\n  try {\n    const parsed = JSON.parse(text)\n    if (typeof parsed === 'boolean') return { enabled: parsed }\n    if (parsed && typeof parsed === 'object') {\n      const plans = parseReleaseFlagPlans(parsed.plans)\n      return {\n        enabled: parsed.enabled === true,\n        rolloutPercent: clampPercent(parsed.rolloutPercent),\n        // Spread, so a flag stored before AGL-2486 has NO `plans` key at all\n        // rather than an explicit `undefined`. `JSON.stringify` drops both,\n        // but the two are not the same to `'plans' in value`, which is what\n        // the staff PUT uses to tell \"the operator cleared the targeting\"\n        // apart from \"this client never sent the field\".\n        ...(plans ? { plans } : {}),\n        note: typeof parsed.note === 'string' ? parsed.note : undefined,\n      }\n    }\n  } catch {\n    // fall through to the registry default\n  }\n  return { enabled: fallbackEnabled }\n}\n\n/**\n * The longest parameter description Remote Config will publish (AGL-3048).\n *\n * One description past it refuses the WHOLE publish with\n * `DESCRIPTION_EXCEEDS_MAXIMUM_SIZE`, which the staff flags route answered as\n * a 500. Registry descriptions are written for the staff flags page, and\n * several run far past the limit, so what the page shows and what a\n * parameter carries cannot always be the same text.\n *\n * Counted in UTF-8 BYTES. Remote Config states the limit in characters\n * without saying how it counts them, and a UTF-8 byte count is never smaller\n * than the code-point or UTF-16 count, so text within 256 bytes is within the\n * limit on every reading. The cost is a few characters of headroom on text\n * with typographic punctuation.\n */\nexport const REMOTE_CONFIG_DESCRIPTION_MAX_BYTES = 256\n\nfunction utf8ByteLength(text: string): number {\n  let bytes = 0\n  for (const character of text) {\n    const codePoint = character.codePointAt(0) ?? 0\n    bytes +=\n      codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4\n  }\n  return bytes\n}\n\n/** Whether Remote Config accepts `text` as a parameter description. */\nexport function fitsRemoteConfigDescription(text: string): boolean {\n  return utf8ByteLength(text) <= REMOTE_CONFIG_DESCRIPTION_MAX_BYTES\n}\n\nconst DESCRIPTION_ELLIPSIS = '…'\n\n/**\n * `text` cut to a length Remote Config accepts, at a word boundary, with an\n * ellipsis marking the cut. Text that already fits comes back unchanged.\n *\n * The cut takes whole code points, so a multi-byte character is never split.\n * It backs up to the last space when it lands inside a word (only a single\n * word longer than the whole budget is cut hard), and punctuation left\n * dangling before the ellipsis is dropped.\n */\nexport function clampRemoteConfigDescription(text: string): string {\n  if (fitsRemoteConfigDescription(text)) return text\n  const budget =\n    REMOTE_CONFIG_DESCRIPTION_MAX_BYTES - utf8ByteLength(DESCRIPTION_ELLIPSIS)\n  let kept = ''\n  let bytes = 0\n  for (const character of text) {\n    const size = utf8ByteLength(character)\n    if (bytes + size > budget) break\n    kept += character\n    bytes += size\n  }\n  const next = text.charAt(kept.length)\n  if (next && !/\\s/.test(next)) {\n    const lastSpace = kept.search(/\\s\\S*$/)\n    if (lastSpace > 0) kept = kept.slice(0, lastSpace)\n  }\n  return `${kept.replace(/[\\s.,;:(–—-]+$/, '')}${DESCRIPTION_ELLIPSIS}`\n}\n\n/**\n * The description to publish with a release flag's Remote Config parameter\n * (AGL-3048). Always one Remote Config accepts:\n *\n * 1. The registry description, when it fits, so the flags page and the\n *    parameter say the same thing.\n * 2. Otherwise the LIVE parameter's description, when it has one that fits.\n *    Remote Config has already accepted exactly that text, and someone chose\n *    it for the Firebase console. The first 250 characters of a longer\n *    paragraph would drop whatever the paragraph says last: for\n *    `release_assist`, the `/legal/subprocessors` precondition that its\n *    AGL-1909 suite wants in front of whoever reads the flag there. The full\n *    registry text stays on the staff flags page either way.\n * 3. Otherwise, as on a first publish with nothing live to keep, the\n *    registry description clamped at a word boundary.\n */\nexport function releaseFlagParameterDescription(\n  registryDescription: string,\n  liveDescription: string | null | undefined,\n): string {\n  if (fitsRemoteConfigDescription(registryDescription)) {\n    return registryDescription\n  }\n  if (\n    typeof liveDescription === 'string' &&\n    liveDescription.trim().length > 0 &&\n    fitsRemoteConfigDescription(liveDescription)\n  ) {\n    return liveDescription\n  }\n  return clampRemoteConfigDescription(registryDescription)\n}\n\n/**\n * FNV-1a 32-bit hash → 0–99 bucket. Deterministic so a subject keeps the\n * same rollout verdict across sessions and surfaces, and seeded with the\n * flag key so a subject doesn't land in the same bucket for every flag.\n */\nexport function releaseFlagBucket(flagKey: string, subjectId: string): number {\n  let hash = 0x811c9dc5\n  const seed = `${flagKey}:${subjectId}`\n  for (let index = 0; index < seed.length; index += 1) {\n    hash ^= seed.charCodeAt(index)\n    hash = Math.imul(hash, 0x01000193)\n  }\n  return (hash >>> 0) % 100\n}\n\n/**\n * The gating verdict for one subject.\n *\n * `subjectId` is the ORG ID, or nothing. A rollout is a cohort of\n * workspaces, so a whole workspace has to land on one side of the\n * percentage: every surface that asks about an org must ask with the same\n * string, or they answer differently about the same customer.\n *\n * This docstring used to sanction falling back to the uid, and the server\n * gates fell back to a hostId. Since a hostId, a uid and an orgId hash to\n * three different buckets, a mid-rollout flag could be on in the console\n * and off on the published site for one workspace — stable per subject, so\n * it never flickered, it just stayed wrong (AGL-1656).\n *\n * An empty subject only passes fully-enabled flags. That is the deliberate\n * cost: a request with no resolvable org never joins a partial rollout,\n * which is the conservative answer rather than a confidently wrong one.\n */\nexport function isReleaseFlagOn(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  /**\n   * The subject org's plan, when the caller knows it (AGL-2486). Optional so\n   * every pre-existing call site compiles and answers unchanged: a flag that\n   * declares no tier targeting never reads this.\n   */\n  plan?: OrgPlan | null,\n): boolean {\n  if (!releaseFlagTargetsPlan(value, plan)) return false\n  if (value.enabled) return true\n  const percent = clampPercent(value.rolloutPercent)\n  if (percent <= 0 || !subjectId) return false\n  if (percent >= 100) return true\n  return releaseFlagBucket(flagKey, subjectId) < percent\n}\n\n/**\n * Does this flag's tier targeting admit `plan`? (AGL-2486)\n *\n * THE SEMANTICS, because an operator who cannot predict the audience will\n * not stage a rollout at all:\n *\n *  - The tier list is a FILTER, applied before and independently of the\n *    percentage. The percentage then picks a cohort WITHIN the admitted\n *    tiers. \"Pro and above at 50%\" is therefore both \"half of the Pro+\n *    workspaces\" and \"the global 50% cohort, restricted to Pro+\" — the two\n *    readings name the same set, and they do so because\n *    {@link releaseFlagBucket} hashes `flagKey:orgId` and NOTHING ELSE.\n *  - Which is also why the bucket is stable. Adding, removing or reordering\n *    tiers cannot reshuffle the bucket, so an org already inside a 50%\n *    rollout keeps the feature when an unrelated tier joins the list. Had\n *    the plan been mixed into the hash — the obvious way to write this — a\n *    tier edit would have re-drawn the cohort under every customer already\n *    in it, and a plan change would have re-rolled the dice for one.\n *  - The filter binds the FULLY-ENABLED path too, not just the rollout.\n *    \"On, Enterprise + Agency\" is how a launch to the top of the ladder is\n *    expressed, and it is what was actually asked for. Untargeted flags are\n *    unaffected: no list means every tier, so `enabled` still means everyone.\n *  - An UNKNOWN plan fails a declared list. Same conservatism as a missing\n *    subject on a percentage rollout: a caller that cannot say which\n *    workspace it is asking about gets the safe answer rather than a\n *    confidently wrong one. A per-org staff override still wins over all of\n *    it — see {@link isReleaseFlagOnForOrg} — so a targeted flag can still be\n *    handed to one org off-ladder.\n */\nexport function releaseFlagTargetsPlan(\n  value: ReleaseFlagValue,\n  plan: OrgPlan | null | undefined,\n): boolean {\n  const plans = value.plans\n  // `!plans` would be the idiom here, but `strictNullChecks` is off repo-wide\n  // and an empty array is truthy — both \"absent\" and \"empty\" have to be named\n  // for the every-tier reading to actually hold.\n  if (plans == null || plans.length === 0) return true\n  if (!plan) return false\n  return plans.includes(plan)\n}\n\n/**\n * Per-org release-flag overrides (AGL-1635), stored on the org doc at\n * `releaseFlags`. A present key is a staff DECISION about one organization\n * and wins over both the Remote Config value and the rollout bucket; an\n * absent key inherits.\n *\n * A separate field from `entitlements.features` on purpose: those ask\n * whether the org's PLAN includes a feature, these ask whether a\n * not-yet-released feature is switched on for this one customer. Folding\n * them together would make \"granted by the deal\" and \"previewing an\n * unreleased build\" indistinguishable at the point a support question is\n * asked.\n *\n * Why the org doc and not a Remote Config condition: RC conditions are\n * template-global and would need one published condition per org, with a\n * template publish (a manual, separate deploy) for every grant.\n */\nexport type OrgReleaseFlagOverrides = Partial<Record<ReleaseFlagKey, boolean>>\n\n/**\n * Sanitises whatever is actually stored at `org.releaseFlags`.\n *\n * Tolerant for the same reason `parseReleaseFlagValue` is: this map is\n * hand-editable in the Firebase console and survives registry renames, so a\n * retired flag key or a non-boolean must be dropped rather than allowed to\n * gate anything. Unknown keys are discarded — a stale key can never grant a\n * flag that no longer exists, and a typo silently inherits instead of\n * silently forcing.\n */\nexport function parseOrgReleaseFlagOverrides(\n  raw: unknown,\n): OrgReleaseFlagOverrides {\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {}\n  const overrides: OrgReleaseFlagOverrides = {}\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof value === 'boolean' && isReleaseFlagKey(key)) {\n      overrides[key] = value\n    }\n  }\n  return overrides\n}\n\n/**\n * The gating verdict with a per-org override applied on top of\n * `isReleaseFlagOn`.\n *\n * The override is checked FIRST and short-circuits, so a forced-off flag\n * stays off for an org even while the flag is globally enabled — the\n * per-org kill switch is half the point, not just the per-org grant. Every\n * release-flag gate resolves through here so the console, the tenant\n * runtime and the API dispatchers cannot disagree about one org.\n */\nexport function isReleaseFlagOnForOrg(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  overrides: OrgReleaseFlagOverrides | null | undefined,\n  /**\n   * The org's plan, for tier targeting (AGL-2486). Checked only AFTER the\n   * override: a staff grant is a decision about one named customer and\n   * outranks the tier filter exactly as it already outranks the rollout\n   * bucket. That ordering is what lets a Free org preview a\n   * Business-targeted flag without widening the flag for every Free org.\n   *\n   * REQUIRED, and `null` has to be typed out. It was optional for one\n   * release and that cost a silent revenue bug: `report-usage` held the org\n   * document, dropped the argument, and every `plans`-declaring flag read\n   * OFF — so the contacts overage went uninvoiced for exactly the orgs\n   * entitled to reach the feature, with nothing thrown and nothing logged.\n   * An unknown tier still refuses, which is the correct conservatism; what\n   * cannot be allowed is a caller MANUFACTURING an unknown out of a tier it\n   * already has in hand. Spelling `null` makes that a statement rather than\n   * an omission, and makes the next call site that forgets fail to compile\n   * instead of failing to bill. `getOrgReleaseFlagTargeting` returns the\n   * plan beside the overrides from ONE document read precisely so that\n   * passing it costs nothing.\n   */\n  plan: OrgPlan | null,\n): boolean {\n  const override = overrides?.[flagKey]\n  if (typeof override === 'boolean') return override\n  return isReleaseFlagOn(flagKey, value, subjectId, plan)\n}\n"],"names":["PLAN_LABELS","SELF_SERVE_PLANS","PLATFORM_BRAND_NAME","PLUGIN_RELEASE_FLAGS","PLATFORM_RELEASE_FLAGS","key","label","description","defaultEnabled","RELEASE_FLAGS","RELEASE_FLAG_KEYS","map","definition","isReleaseFlagKey","value","includes","getReleaseFlagDefinition","find","entry","Error","clampPercent","percent","Number","isFinite","Math","min","max","round","RELEASE_FLAG_PLAN_LADDER","isOrgPlan","Object","prototype","hasOwnProperty","call","releaseFlagPlansAtOrAbove","plan","index","indexOf","slice","parseReleaseFlagPlans","raw","Array","isArray","undefined","named","Set","filter","size","has","parseReleaseFlagValue","fallbackEnabled","text","trim","enabled","parsed","JSON","parse","plans","rolloutPercent","note","REMOTE_CONFIG_DESCRIPTION_MAX_BYTES","utf8ByteLength","bytes","character","codePoint","codePointAt","fitsRemoteConfigDescription","DESCRIPTION_ELLIPSIS","clampRemoteConfigDescription","budget","kept","next","charAt","length","test","lastSpace","search","replace","releaseFlagParameterDescription","registryDescription","liveDescription","releaseFlagBucket","flagKey","subjectId","hash","seed","charCodeAt","imul","isReleaseFlagOn","releaseFlagTargetsPlan","parseOrgReleaseFlagOverrides","overrides","entries","isReleaseFlagOnForOrg","override"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;CAOC,GAED,6DAA6D;AAE7D,SAASA,WAAW,EAAEC,gBAAgB,QAAQ,yBAAqB;AACnE,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SACEC,oBAAoB,QAEf,sCAAkC;AAsCzC;;;;;;;;;;CAUC,GACD,MAAMC,yBAA2D;IAC/D;QACEC,KAAK;QACLC,OAAO;QACPC,aACE,uEACA;QACFC,gBAAgB;IAClB;IACA,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,oDAAoD;IACpD;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,0EACA,wEACA,yEACA,0EACA,uEACA,sDACA,2EACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,mCAAmC;IACnC;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,wEACA,0DACA,wEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO,GAAGJ,oBAAoB,OAAO,CAAC;QACtCK,aACE,kEACA,sEACA,kEACA,0EACA,0EACA,oEACA,yEACA,mEACA,sEACA,gEACA,qEACA,sEACA,yEACA,wEACA,0EACA;QACFC,gBAAgB;IAClB;IACA,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,+DAA+D;IAC/D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,0EACA,sEACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,6DAA6D;IAC7D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,2EACA,qEACA;QACFC,gBAAgB;IAClB;IACA,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,8DAA8D;IAC9D,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,sCAAsC;IACtC;QACEH,KAAK;QACLC,OAAO,GAAGJ,oBAAoB,cAAc,CAAC;QAC7CK,aACE,6DACA,uEACA,sEACA,sEACA,qEACA,mEACA;QACFC,gBAAgB;IAClB;IACA,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,yEAAyE;IACzE;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,mEACA,gEACA,gEACA,uEACA,uEACA,iDACA;QACFC,gBAAgB;IAClB;IACA,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,8DAA8D;IAC9D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,2EACA,yEACA;QACFC,gBAAgB;IAClB;CACD;AAED;;;;;CAKC,GACD,OAAO,MAAMC,gBAAkD;OAC1DN;OACAC;CACJ,CAAA;AAED,OAAO,MAAMM,oBAAoBD,cAAcE,GAAG,CAChD,CAACC,aAAeA,WAAWP,GAAG,EACF;AAE9B,OAAO,SAASQ,iBAAiBC,KAAa;IAC5C,OAAO,AAACJ,kBAAwCK,QAAQ,CAACD;AAC3D;AAEA,OAAO,SAASE,yBACdX,GAAmB;IAEnB,MAAMO,aAAaH,cAAcQ,IAAI,CAAC,CAACC,QAAUA,MAAMb,GAAG,KAAKA;IAC/D,IAAI,CAACO,YAAY,MAAM,IAAIO,MAAM,CAAC,sBAAsB,EAAEd,KAAK;IAC/D,OAAOO;AACT;AA8BA,MAAMQ,eAAe,CAACN;IACpB,MAAMO,UAAU,OAAOP,UAAU,YAAYQ,OAAOC,QAAQ,CAACT,SAASA,QAAQ;IAC9E,OAAOU,KAAKC,GAAG,CAAC,KAAKD,KAAKE,GAAG,CAAC,GAAGF,KAAKG,KAAK,CAACN;AAC9C;AAEA;;;;;;CAMC,GACD,OAAO,MAAMO,2BAA+C;OACvD3B;IACH;CACD,CAAA;AAED,MAAM4B,YAAY,CAACf,QACjB,OAAOA,UAAU,YACjBgB,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACjC,aAAac;AAEpD;;;;;;;;;CASC,GACD,OAAO,SAASoB,0BAA0BC,IAAa;IACrD,MAAMC,QAAQR,yBAAyBS,OAAO,CAACF;IAC/C,OAAOC,QAAQ,IAAI,EAAE,GAAGR,yBAAyBU,KAAK,CAACF;AACzD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASG,sBAAsBC,GAAY;IAChD,IAAI,CAACC,MAAMC,OAAO,CAACF,MAAM,OAAOG;IAChC,MAAMC,QAAQ,IAAIC,IAAIL,IAAIM,MAAM,CAACjB;IACjC,IAAIe,MAAMG,IAAI,KAAK,GAAG,OAAOJ;IAC7B,OAAOf,yBAAyBkB,MAAM,CAAC,CAACX,OAASS,MAAMI,GAAG,CAACb;AAC7D;AAEA;;;;;CAKC,GACD,OAAO,SAASc,sBACdT,GAA8B,EAC9BU,eAAwB;IAExB,MAAMC,OAAOX,uBAAAA,IAAKY,IAAI;IACtB,IAAI,CAACD,MAAM,OAAO;QAAEE,SAASH;IAAgB;IAC7C,IAAIC,SAAS,QAAQ,OAAO;QAAEE,SAAS;IAAK;IAC5C,IAAIF,SAAS,SAAS,OAAO;QAAEE,SAAS;IAAM;IAC9C,IAAI;QACF,MAAMC,SAASC,KAAKC,KAAK,CAACL;QAC1B,IAAI,OAAOG,WAAW,WAAW,OAAO;YAAED,SAASC;QAAO;QAC1D,IAAIA,UAAU,OAAOA,WAAW,UAAU;YACxC,MAAMG,QAAQlB,sBAAsBe,OAAOG,KAAK;YAChD,OAAO;gBACLJ,SAASC,OAAOD,OAAO,KAAK;gBAC5BK,gBAAgBtC,aAAakC,OAAOI,cAAc;eAM9CD,QAAQ;gBAAEA;YAAM,IAAI,CAAC;gBACzBE,MAAM,OAAOL,OAAOK,IAAI,KAAK,WAAWL,OAAOK,IAAI,GAAGhB;;QAE1D;IACF,EAAE,eAAM;IACN,uCAAuC;IACzC;IACA,OAAO;QAAEU,SAASH;IAAgB;AACpC;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMU,sCAAsC,IAAG;AAEtD,SAASC,eAAeV,IAAY;IAClC,IAAIW,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;YACVY;QAAlB,MAAMC,aAAYD,yBAAAA,UAAUE,WAAW,CAAC,cAAtBF,yBAA4B;QAC9CD,SACEE,YAAY,OAAO,IAAIA,YAAY,QAAQ,IAAIA,YAAY,UAAU,IAAI;IAC7E;IACA,OAAOF;AACT;AAEA,qEAAqE,GACrE,OAAO,SAASI,4BAA4Bf,IAAY;IACtD,OAAOU,eAAeV,SAASS;AACjC;AAEA,MAAMO,uBAAuB;AAE7B;;;;;;;;CAQC,GACD,OAAO,SAASC,6BAA6BjB,IAAY;IACvD,IAAIe,4BAA4Bf,OAAO,OAAOA;IAC9C,MAAMkB,SACJT,sCAAsCC,eAAeM;IACvD,IAAIG,OAAO;IACX,IAAIR,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;QAC5B,MAAMJ,OAAOc,eAAeE;QAC5B,IAAID,QAAQf,OAAOsB,QAAQ;QAC3BC,QAAQP;QACRD,SAASf;IACX;IACA,MAAMwB,OAAOpB,KAAKqB,MAAM,CAACF,KAAKG,MAAM;IACpC,IAAIF,QAAQ,CAAC,KAAKG,IAAI,CAACH,OAAO;QAC5B,MAAMI,YAAYL,KAAKM,MAAM,CAAC;QAC9B,IAAID,YAAY,GAAGL,OAAOA,KAAKhC,KAAK,CAAC,GAAGqC;IAC1C;IACA,OAAO,GAAGL,KAAKO,OAAO,CAAC,kBAAkB,MAAMV,sBAAsB;AACvE;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASW,gCACdC,mBAA2B,EAC3BC,eAA0C;IAE1C,IAAId,4BAA4Ba,sBAAsB;QACpD,OAAOA;IACT;IACA,IACE,OAAOC,oBAAoB,YAC3BA,gBAAgB5B,IAAI,GAAGqB,MAAM,GAAG,KAChCP,4BAA4Bc,kBAC5B;QACA,OAAOA;IACT;IACA,OAAOZ,6BAA6BW;AACtC;AAEA;;;;CAIC,GACD,OAAO,SAASE,kBAAkBC,OAAe,EAAEC,SAAiB;IAClE,IAAIC,OAAO;IACX,MAAMC,OAAO,GAAGH,QAAQ,CAAC,EAAEC,WAAW;IACtC,IAAK,IAAI/C,QAAQ,GAAGA,QAAQiD,KAAKZ,MAAM,EAAErC,SAAS,EAAG;QACnDgD,QAAQC,KAAKC,UAAU,CAAClD;QACxBgD,OAAO5D,KAAK+D,IAAI,CAACH,MAAM;IACzB;IACA,OAAO,AAACA,CAAAA,SAAS,CAAA,IAAK;AACxB;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASI,gBACdN,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpC;;;;GAIC,GACDhD,IAAqB;IAErB,IAAI,CAACsD,uBAAuB3E,OAAOqB,OAAO,OAAO;IACjD,IAAIrB,MAAMuC,OAAO,EAAE,OAAO;IAC1B,MAAMhC,UAAUD,aAAaN,MAAM4C,cAAc;IACjD,IAAIrC,WAAW,KAAK,CAAC8D,WAAW,OAAO;IACvC,IAAI9D,WAAW,KAAK,OAAO;IAC3B,OAAO4D,kBAAkBC,SAASC,aAAa9D;AACjD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,SAASoE,uBACd3E,KAAuB,EACvBqB,IAAgC;IAEhC,MAAMsB,QAAQ3C,MAAM2C,KAAK;IACzB,4EAA4E;IAC5E,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAIA,SAAS,QAAQA,MAAMgB,MAAM,KAAK,GAAG,OAAO;IAChD,IAAI,CAACtC,MAAM,OAAO;IAClB,OAAOsB,MAAM1C,QAAQ,CAACoB;AACxB;AAqBA;;;;;;;;;CASC,GACD,OAAO,SAASuD,6BACdlD,GAAY;IAEZ,IAAI,CAACA,OAAO,OAAOA,QAAQ,YAAYC,MAAMC,OAAO,CAACF,MAAM,OAAO,CAAC;IACnE,MAAMmD,YAAqC,CAAC;IAC5C,KAAK,MAAM,CAACtF,KAAKS,MAAM,IAAIgB,OAAO8D,OAAO,CAACpD,KAAiC;QACzE,IAAI,OAAO1B,UAAU,aAAaD,iBAAiBR,MAAM;YACvDsF,SAAS,CAACtF,IAAI,GAAGS;QACnB;IACF;IACA,OAAO6E;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASE,sBACdX,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpCQ,SAAqD,EACrD;;;;;;;;;;;;;;;;;;;GAmBC,GACDxD,IAAoB;IAEpB,MAAM2D,WAAWH,6BAAAA,SAAW,CAACT,QAAQ;IACrC,IAAI,OAAOY,aAAa,WAAW,OAAOA;IAC1C,OAAON,gBAAgBN,SAASpE,OAAOqE,WAAWhD;AACpD"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/release-flags.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Release flags (AGL-227): platform-level \"is this feature launched\"\n * gating backed by Firebase Remote Config. A separate axis from plan\n * entitlements (`plan-entitlements.ts`) — entitlements ask whether the\n * tenant's PLAN includes a feature, release flags ask whether the feature\n * is released to the public at all (or partially, via percentage rollout).\n * Staff bypass release flags everywhere but see a flagged warning.\n */\n\n/** Remote Config parameter keys for release-gated features. */\nimport type { OrgPlan } from '../foundation'\nimport { PLAN_LABELS, SELF_SERVE_PLANS } from './plan-entitlements'\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\nimport {\n  PLUGIN_RELEASE_FLAGS,\n  type PluginReleaseFlagKey,\n} from './plugin-release-flags.generated'\n\n/**\n * Every release flag: the ones plugins declare (compiled from\n * plugins.config.json, AGL-3080) and the platform's own below.\n */\nexport type ReleaseFlagKey =\n  | PluginReleaseFlagKey\n  | 'release_addon_store'\n  | 'release_native_checkout'\n  | 'release_edit_bar'\n  | 'release_assist'\n  | 'release_video_uploads'\n  | 'release_video_delivery'\n  | 'release_ai_generative'\n  | 'release_crm_assist_whole_record'\n  | 'release_ai_site_inspiration'\n  | 'release_ad_audience_sync'\n\nexport interface ReleaseFlagDefinition {\n  key: ReleaseFlagKey\n  label: string\n  description: string\n  /**\n   * Fallback verdict when Remote Config is unreachable (offline, blocked,\n   * first paint before activate). MUST match the seeded value in\n   * cloud/firebase-remoteconfig.template.json so environments without a\n   * published template behave like the template intends.\n   */\n  defaultEnabled: boolean\n  /** Host dashboard tab id (host-nav-tabs.ts) this flag hides, if any. */\n  navTabId?: string\n}\n\n/** A release flag a plugin declares, as the generator compiles it. */\nexport type PluginReleaseFlagDefinition = ReleaseFlagDefinition & {\n  key: PluginReleaseFlagKey\n}\n\n/**\n * The platform's own release flags: features no plugin owns.\n *\n * Every first-party plugin is release-flagged too (AGL-422) — the flag feeds\n * the plugin LOADER (console, published sites, API dispatch), not just nav\n * visibility, so staff can kill-switch a whole plugin platform-wide from the\n * Feature Flags page. Those flags are the plugins' own: each is defined by\n * its catalog row's `releaseFlagDefinition` in plugins.config.json and\n * compiled into `PLUGIN_RELEASE_FLAGS`, so adding a plugin edits nothing\n * here.\n */\nconst PLATFORM_RELEASE_FLAGS: readonly ReleaseFlagDefinition[] = [\n  {\n    key: 'release_addon_store',\n    label: 'Add-on store',\n    description:\n      'Self-serve add-on purchases on the Billing page: seats, datasets, ' +\n      'extra sites, POS registers, Event Calendar (AGL-524..531).',\n    defaultEnabled: true,\n  },\n  // Released to every workspace 2026-10-06 (AGL-3606). Storefront-only since\n  // the console's plan checkout stopped rendering Stripe Checkout at all. Still\n  // the surface's kill switch, globally or per org: off, both storefront\n  // checkout routes return the hosted redirect again.\n  {\n    key: 'release_native_checkout',\n    label: 'In-page checkout',\n    description:\n      'Storefront shoppers pay on the merchant\\u2019s own site: the Payment ' +\n      'Element, email, shipping address and method, and a live total with ' +\n      'tax open in place under the Buy or Checkout button, styled with the ' +\n      'site theme, instead of a redirect to checkout.stripe.com (AGL-1944). ' +\n      'Released to every workspace 2026-10-06 (AGL-3606). The webhook is ' +\n      'still the only thing that fulfils. Also gated on ' +\n      'NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY, so a deployment without one keeps ' +\n      'the redirect; turning this off returns every storefront to the redirect.',\n    defaultEnabled: true,\n  },\n  // Released to every site 2026-09-16 (AGL-3041). Still the whole surface's\n  // kill switch, globally or for one org by override: off, the tenant slot\n  // renders nothing, both token mints refuse, and `/api/edit-context` turns\n  // away every token already issued.\n  {\n    key: 'release_edit_bar',\n    label: 'Site admin bar',\n    description:\n      'Admin bar on published sites: a signed-in editor jumps from a live ' +\n      'page straight into the Besigner to edit it. Released ' +\n      '2026-09-16 (AGL-3041) for every site; turning it off hides the bar ' +\n      'and revokes every outstanding edit token at the verify site.',\n    defaultEnabled: true,\n  },\n  {\n    key: 'release_assist',\n    label: `${PLATFORM_BRAND_NAME} Assist`,\n    description:\n      'The in-console AI chat helper on every page (AGL-1860): docs-' +\n      'grounded answers with deep links, page-context guidance on Pro+. ' +\n      'ON in production, and gated on TWO published legal artifacts ' +\n      '(AGL-1909), neither of which is a repo file — both are live besigner ' +\n      'pages, so publication is what satisfies them: (1) the privacy-policy ' +\n      'disclosure for stored Q&A, because the data loop records every ' +\n      'exchange org-scoped under orgs/{orgId}/assistExchanges; and (2) the ' +\n      'Anthropic row on /legal/subprocessors, which was deliberately ' +\n      'REMOVED on 2026-08-13 (subprocessorsV2a-20260813) on the premise ' +\n      'that no production key existed — so the page is not merely ' +\n      'incomplete without it, it is affirmatively wrong. NOTE the real ' +\n      'trigger is ANTHROPIC_API_KEY, not this flag: /api/ai/assist (the ' +\n      'besigner copy assistant, AGL-89/130/169) carries no release flag at ' +\n      'all and sends customer site content to Anthropic on the key plus a ' +\n      'Pro entitlement alone. Setting the key in production therefore makes ' +\n      'Anthropic a subprocessor whether or not this flag is ever flipped.',\n    defaultEnabled: true,\n  },\n  // Ingress only, and with no staff preview on the server: a video a staff\n  // session uploads into a customer's library serves on that customer's pages\n  // like any other, so a grant goes to the org through its override.\n  // `apps/console/utils/server/video-uploads.ts` holds the gate.\n  {\n    key: 'release_video_uploads',\n    label: 'Video uploads',\n    description:\n      'New video in the media library, on every upload path (AGL-2830). ' +\n      'Off: refused with 403 video_uploads_paused, as DAM video delivery is ' +\n      'not yet metered or bounded per org (AGL-2810, AGL-2812). Images, ' +\n      'documents and stored videos are unaffected.',\n    defaultEnabled: false,\n  },\n  // Delivery, not ingress: this flag decides whether a video already in the\n  // library is COPIED to the configured delivery provider and served from it\n  // through a short-lived signed redirect (AGL-2824). Per org, with no staff\n  // preview on the server — a copy is customer data at the provider, so a\n  // grant goes to the org through its override. Off, or with no provider\n  // configured, every video serves from this platform exactly as before.\n  // `media-delivery.ts` in `tenant-data-admin` holds the gate.\n  {\n    key: 'release_video_delivery',\n    label: 'Video delivery',\n    description:\n      'Serves library video from a configured delivery provider through ' +\n      'short-lived signed redirects, and copies each video to it (AGL-2824). ' +\n      'OFF by default: video serves from this platform as before. Also ' +\n      \"needs the provider's settings.\",\n    defaultEnabled: false,\n  },\n  // The generative doors share one runtime with Assist (AGL-2903) but not\n  // its flag: `release_assist` answers questions, this builds things, and\n  // the two are sold, metered and disclosed separately. The server-side\n  // gate lives in `aiGateLadder` (404 when off, staff preview).\n  // Labeled for what it switches — the generative doors — and not with the\n  // add-on's own name, which is sold and live whether or not the doors are\n  // released: the docs name the add-on, and a flag wearing the same words\n  // reads as documented when it is not.\n  {\n    key: 'release_ai_generative',\n    label: `${PLATFORM_BRAND_NAME} AI generation`,\n    description:\n      'Generative building and automation behind the AI add-on ' +\n      '(AGL-2903): sections, pages and workflows written by a model from ' +\n      'a brief, on the shared Anthropic runtime. ON for every workspace ' +\n      'since 2026-09-29; every generative route answers 404 while it is ' +\n      'off. On, it sends customer briefs and site content to Anthropic ' +\n      'on the same ANTHROPIC_API_KEY and under the same subprocessor ' +\n      'disclosure as Assist (AGL-1909).',\n    defaultEnabled: true,\n  },\n  // What CRM assistance hands the model provider, not whether it runs:\n  // `release_ai_generative` opens the doors, this widens what a record sends\n  // through them. Per org, with no staff preview — the data is the customer's,\n  // and a staff session reading a customer's record must send what the\n  // published pages promise. The CRM's record-facts readers hold the gate.\n  {\n    key: 'release_crm_assist_whole_record',\n    label: 'CRM assistance: whole record',\n    description:\n      'What AI assistance in the CRM (a record summary, next step or ' +\n      'email draft) sends the model provider (AGL-3520). OFF: the ' +\n      'disclosed fields, with addresses and numbers in typed text ' +\n      'replaced. ON: the whole record, contact details and custom fields ' +\n      'included. ON since 2026-10-05, after Privacy Policy section 2 and ' +\n      'the Subprocessors row were republished; see ' +\n      'docs/drafts/agl-3520-crm-assistance-whole-record-disclosure.md.',\n    defaultEnabled: true,\n  },\n  // Per org, with no staff preview on the server: the site job reads the\n  // sites a person names only where the org's verdict is on, and the guided\n  // start asks for them by the same verdict. `model/ai-site-inspiration.ts`\n  // in the AI plugin holds the key.\n  {\n    key: 'release_ai_site_inspiration',\n    label: 'AI site start: sites you like',\n    description:\n      'The guided AI site start asks for sites the person likes (AGL-3975): ' +\n      'one on Free, three on a paid plan. The site job reads each home page ' +\n      'and two of its stylesheets through the SSRF-guarded fetch and keeps ' +\n      'signals only (section order, spacing, header, colors, type mood, ' +\n      'button and card shape, motion, and on a paid plan the features it ' +\n      'offers), never its words, images or logos. OFF by default: no field ' +\n      'is shown and no site is read.',\n    defaultEnabled: false,\n  },\n  // Platform-wide, never per org: the nightly job reads only the platform\n  // value, because it is the operator's own marketing and no workspace's\n  // feature. `apps/console/app/api/admin/ad-audience-sync/route.ts` holds the\n  // gate; a dry run reports the counts whichever way it is set.\n  {\n    key: 'release_ad_audience_sync',\n    label: 'Account-holder ad audiences',\n    description:\n      'Nightly sync of United States account holders, as SHA-256 hashed ' +\n      'email addresses, to the operator\\u2019s own Meta, Google and LinkedIn ' +\n      'customer-list audiences (AGL-3780). OFF by default: nothing is sent ' +\n      'until the Privacy Policy that discloses it is published.',\n    defaultEnabled: false,\n  },\n]\n\n/**\n * The registry: one entry per gated feature, the plugins' first. Adding a\n * platform flag = add it above, seed it in the Remote Config template, and\n * (optionally) wrap the page in `<FeatureGate>` — the staff admin editor and\n * nav filtering pick it up from this list.\n */\nexport const RELEASE_FLAGS: readonly ReleaseFlagDefinition[] = [\n  ...PLUGIN_RELEASE_FLAGS,\n  ...PLATFORM_RELEASE_FLAGS,\n]\n\nexport const RELEASE_FLAG_KEYS = RELEASE_FLAGS.map(\n  (definition) => definition.key,\n) as readonly ReleaseFlagKey[]\n\nexport function isReleaseFlagKey(value: string): value is ReleaseFlagKey {\n  return (RELEASE_FLAG_KEYS as readonly string[]).includes(value)\n}\n\nexport function getReleaseFlagDefinition(\n  key: ReleaseFlagKey,\n): ReleaseFlagDefinition {\n  const definition = RELEASE_FLAGS.find((entry) => entry.key === key)\n  if (!definition) throw new Error(`Unknown release flag: ${key}`)\n  return definition\n}\n\n/**\n * The JSON payload stored in each Remote Config parameter. `enabled: true`\n * turns the feature on for everyone; `enabled: false` with a positive\n * `rolloutPercent` enables it for that percentage of subjects (stable\n * per-tenant bucketing, GrowthBook-style); `plans` narrows either of those\n * to a set of tiers (AGL-2486).\n */\nexport interface ReleaseFlagValue {\n  enabled: boolean\n  /** 0–100; only consulted while `enabled` is false. */\n  rolloutPercent?: number\n  /**\n   * Plan/tier targeting (AGL-2486). The tiers this flag is being rolled out\n   * to, or ABSENT for \"every tier\".\n   *\n   * ABSENT AND EMPTY BOTH MEAN EVERY TIER, and that is load-bearing: every\n   * flag stored before this field existed parses to `undefined` here, and an\n   * operator who unticks every box has plainly not asked for a flag that\n   * reaches nobody. Reading an empty list as \"no tiers\" would dark-launch\n   * nothing while the console still said the flag was on — the inverted\n   * reading of this field is the whole hazard, so it is closed in the parser\n   * rather than left to each call site.\n   */\n  plans?: OrgPlan[]\n  /** Free-form staff note (\"waiting on AGL-199\", owner, etc.). */\n  note?: string\n}\n\nconst clampPercent = (value: unknown): number => {\n  const percent = typeof value === 'number' && Number.isFinite(value) ? value : 0\n  return Math.min(100, Math.max(0, Math.round(percent)))\n}\n\n/**\n * Every plan a flag may target, cheapest first — `SELF_SERVE_PLANS` then\n * `enterprise`, the same ladder `planGrantingFeature` walks and the same\n * order the plan grid renders. Derived, never re-typed: pricing v3 inserted\n * `scale` mid-ladder and added `agency`, and a second hand-written tier list\n * here would have missed both.\n */\nexport const RELEASE_FLAG_PLAN_LADDER: readonly OrgPlan[] = [\n  ...SELF_SERVE_PLANS,\n  'enterprise' as OrgPlan,\n]\n\nconst isOrgPlan = (value: unknown): value is OrgPlan =>\n  typeof value === 'string' &&\n  Object.prototype.hasOwnProperty.call(PLAN_LABELS, value)\n\n/**\n * The tiers on the ladder at or above `plan` — what the console's \"Pro and\n * above\" shortcut expands to before it is STORED as an explicit list.\n *\n * Deliberately a UI convenience and not a stored \"minimum plan\" mode: a\n * stored threshold would silently re-aim every live flag the day a tier is\n * inserted into the middle of the ladder (pricing v3 did exactly that with\n * `scale`). An explicit list means the audience of a published flag only\n * ever changes because a human changed it.\n */\nexport function releaseFlagPlansAtOrAbove(plan: OrgPlan): OrgPlan[] {\n  const index = RELEASE_FLAG_PLAN_LADDER.indexOf(plan)\n  return index < 0 ? [] : RELEASE_FLAG_PLAN_LADDER.slice(index)\n}\n\n/**\n * Sanitises whatever is stored at `plans`, in ladder order.\n *\n * Returns `undefined` — not `[]` — for \"no targeting declared\", so the\n * absence survives a round trip through the staff editor and cannot be\n * written back as a list that means something else. Unknown tier names are\n * dropped for the same reason `parseOrgReleaseFlagOverrides` drops unknown\n * keys: a renamed or retired tier must never gate anything. A list that\n * names ONLY unknown tiers collapses to `undefined` (every tier) rather than\n * to an empty list, because a typo must inherit, never silently target.\n */\nexport function parseReleaseFlagPlans(raw: unknown): OrgPlan[] | undefined {\n  if (!Array.isArray(raw)) return undefined\n  const named = new Set(raw.filter(isOrgPlan))\n  if (named.size === 0) return undefined\n  return RELEASE_FLAG_PLAN_LADDER.filter((plan) => named.has(plan))\n}\n\n/**\n * Parses a Remote Config parameter string into a `ReleaseFlagValue`.\n * Tolerant by design — the template is hand-editable in the Firebase\n * console, so plain \"true\"/\"false\" strings and malformed JSON must not\n * crash gating: anything unreadable falls back to the registry default.\n */\nexport function parseReleaseFlagValue(\n  raw: string | null | undefined,\n  fallbackEnabled: boolean,\n): ReleaseFlagValue {\n  const text = raw?.trim()\n  if (!text) return { enabled: fallbackEnabled }\n  if (text === 'true') return { enabled: true }\n  if (text === 'false') return { enabled: false }\n  try {\n    const parsed = JSON.parse(text)\n    if (typeof parsed === 'boolean') return { enabled: parsed }\n    if (parsed && typeof parsed === 'object') {\n      const plans = parseReleaseFlagPlans(parsed.plans)\n      return {\n        enabled: parsed.enabled === true,\n        rolloutPercent: clampPercent(parsed.rolloutPercent),\n        // Spread, so a flag stored before AGL-2486 has NO `plans` key at all\n        // rather than an explicit `undefined`. `JSON.stringify` drops both,\n        // but the two are not the same to `'plans' in value`, which is what\n        // the staff PUT uses to tell \"the operator cleared the targeting\"\n        // apart from \"this client never sent the field\".\n        ...(plans ? { plans } : {}),\n        note: typeof parsed.note === 'string' ? parsed.note : undefined,\n      }\n    }\n  } catch {\n    // fall through to the registry default\n  }\n  return { enabled: fallbackEnabled }\n}\n\n/**\n * The longest parameter description Remote Config will publish (AGL-3048).\n *\n * One description past it refuses the WHOLE publish with\n * `DESCRIPTION_EXCEEDS_MAXIMUM_SIZE`, which the staff flags route answered as\n * a 500. Registry descriptions are written for the staff flags page, and\n * several run far past the limit, so what the page shows and what a\n * parameter carries cannot always be the same text.\n *\n * Counted in UTF-8 BYTES. Remote Config states the limit in characters\n * without saying how it counts them, and a UTF-8 byte count is never smaller\n * than the code-point or UTF-16 count, so text within 256 bytes is within the\n * limit on every reading. The cost is a few characters of headroom on text\n * with typographic punctuation.\n */\nexport const REMOTE_CONFIG_DESCRIPTION_MAX_BYTES = 256\n\nfunction utf8ByteLength(text: string): number {\n  let bytes = 0\n  for (const character of text) {\n    const codePoint = character.codePointAt(0) ?? 0\n    bytes +=\n      codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4\n  }\n  return bytes\n}\n\n/** Whether Remote Config accepts `text` as a parameter description. */\nexport function fitsRemoteConfigDescription(text: string): boolean {\n  return utf8ByteLength(text) <= REMOTE_CONFIG_DESCRIPTION_MAX_BYTES\n}\n\nconst DESCRIPTION_ELLIPSIS = '…'\n\n/**\n * `text` cut to a length Remote Config accepts, at a word boundary, with an\n * ellipsis marking the cut. Text that already fits comes back unchanged.\n *\n * The cut takes whole code points, so a multi-byte character is never split.\n * It backs up to the last space when it lands inside a word (only a single\n * word longer than the whole budget is cut hard), and punctuation left\n * dangling before the ellipsis is dropped.\n */\nexport function clampRemoteConfigDescription(text: string): string {\n  if (fitsRemoteConfigDescription(text)) return text\n  const budget =\n    REMOTE_CONFIG_DESCRIPTION_MAX_BYTES - utf8ByteLength(DESCRIPTION_ELLIPSIS)\n  let kept = ''\n  let bytes = 0\n  for (const character of text) {\n    const size = utf8ByteLength(character)\n    if (bytes + size > budget) break\n    kept += character\n    bytes += size\n  }\n  const next = text.charAt(kept.length)\n  if (next && !/\\s/.test(next)) {\n    const lastSpace = kept.search(/\\s\\S*$/)\n    if (lastSpace > 0) kept = kept.slice(0, lastSpace)\n  }\n  return `${kept.replace(/[\\s.,;:(–—-]+$/, '')}${DESCRIPTION_ELLIPSIS}`\n}\n\n/**\n * The description to publish with a release flag's Remote Config parameter\n * (AGL-3048). Always one Remote Config accepts:\n *\n * 1. The registry description, when it fits, so the flags page and the\n *    parameter say the same thing.\n * 2. Otherwise the LIVE parameter's description, when it has one that fits.\n *    Remote Config has already accepted exactly that text, and someone chose\n *    it for the Firebase console. The first 250 characters of a longer\n *    paragraph would drop whatever the paragraph says last: for\n *    `release_assist`, the `/legal/subprocessors` precondition that its\n *    AGL-1909 suite wants in front of whoever reads the flag there. The full\n *    registry text stays on the staff flags page either way.\n * 3. Otherwise, as on a first publish with nothing live to keep, the\n *    registry description clamped at a word boundary.\n */\nexport function releaseFlagParameterDescription(\n  registryDescription: string,\n  liveDescription: string | null | undefined,\n): string {\n  if (fitsRemoteConfigDescription(registryDescription)) {\n    return registryDescription\n  }\n  if (\n    typeof liveDescription === 'string' &&\n    liveDescription.trim().length > 0 &&\n    fitsRemoteConfigDescription(liveDescription)\n  ) {\n    return liveDescription\n  }\n  return clampRemoteConfigDescription(registryDescription)\n}\n\n/**\n * FNV-1a 32-bit hash → 0–99 bucket. Deterministic so a subject keeps the\n * same rollout verdict across sessions and surfaces, and seeded with the\n * flag key so a subject doesn't land in the same bucket for every flag.\n */\nexport function releaseFlagBucket(flagKey: string, subjectId: string): number {\n  let hash = 0x811c9dc5\n  const seed = `${flagKey}:${subjectId}`\n  for (let index = 0; index < seed.length; index += 1) {\n    hash ^= seed.charCodeAt(index)\n    hash = Math.imul(hash, 0x01000193)\n  }\n  return (hash >>> 0) % 100\n}\n\n/**\n * The gating verdict for one subject.\n *\n * `subjectId` is the ORG ID, or nothing. A rollout is a cohort of\n * workspaces, so a whole workspace has to land on one side of the\n * percentage: every surface that asks about an org must ask with the same\n * string, or they answer differently about the same customer.\n *\n * This docstring used to sanction falling back to the uid, and the server\n * gates fell back to a hostId. Since a hostId, a uid and an orgId hash to\n * three different buckets, a mid-rollout flag could be on in the console\n * and off on the published site for one workspace — stable per subject, so\n * it never flickered, it just stayed wrong (AGL-1656).\n *\n * An empty subject only passes fully-enabled flags. That is the deliberate\n * cost: a request with no resolvable org never joins a partial rollout,\n * which is the conservative answer rather than a confidently wrong one.\n */\nexport function isReleaseFlagOn(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  /**\n   * The subject org's plan, when the caller knows it (AGL-2486). Optional so\n   * every pre-existing call site compiles and answers unchanged: a flag that\n   * declares no tier targeting never reads this.\n   */\n  plan?: OrgPlan | null,\n): boolean {\n  if (!releaseFlagTargetsPlan(value, plan)) return false\n  if (value.enabled) return true\n  const percent = clampPercent(value.rolloutPercent)\n  if (percent <= 0 || !subjectId) return false\n  if (percent >= 100) return true\n  return releaseFlagBucket(flagKey, subjectId) < percent\n}\n\n/**\n * Does this flag's tier targeting admit `plan`? (AGL-2486)\n *\n * THE SEMANTICS, because an operator who cannot predict the audience will\n * not stage a rollout at all:\n *\n *  - The tier list is a FILTER, applied before and independently of the\n *    percentage. The percentage then picks a cohort WITHIN the admitted\n *    tiers. \"Pro and above at 50%\" is therefore both \"half of the Pro+\n *    workspaces\" and \"the global 50% cohort, restricted to Pro+\" — the two\n *    readings name the same set, and they do so because\n *    {@link releaseFlagBucket} hashes `flagKey:orgId` and NOTHING ELSE.\n *  - Which is also why the bucket is stable. Adding, removing or reordering\n *    tiers cannot reshuffle the bucket, so an org already inside a 50%\n *    rollout keeps the feature when an unrelated tier joins the list. Had\n *    the plan been mixed into the hash — the obvious way to write this — a\n *    tier edit would have re-drawn the cohort under every customer already\n *    in it, and a plan change would have re-rolled the dice for one.\n *  - The filter binds the FULLY-ENABLED path too, not just the rollout.\n *    \"On, Enterprise + Agency\" is how a launch to the top of the ladder is\n *    expressed, and it is what was actually asked for. Untargeted flags are\n *    unaffected: no list means every tier, so `enabled` still means everyone.\n *  - An UNKNOWN plan fails a declared list. Same conservatism as a missing\n *    subject on a percentage rollout: a caller that cannot say which\n *    workspace it is asking about gets the safe answer rather than a\n *    confidently wrong one. A per-org staff override still wins over all of\n *    it — see {@link isReleaseFlagOnForOrg} — so a targeted flag can still be\n *    handed to one org off-ladder.\n */\nexport function releaseFlagTargetsPlan(\n  value: ReleaseFlagValue,\n  plan: OrgPlan | null | undefined,\n): boolean {\n  const plans = value.plans\n  // `!plans` would be the idiom here, but `strictNullChecks` is off repo-wide\n  // and an empty array is truthy — both \"absent\" and \"empty\" have to be named\n  // for the every-tier reading to actually hold.\n  if (plans == null || plans.length === 0) return true\n  if (!plan) return false\n  return plans.includes(plan)\n}\n\n/**\n * Per-org release-flag overrides (AGL-1635), stored on the org doc at\n * `releaseFlags`. A present key is a staff DECISION about one organization\n * and wins over both the Remote Config value and the rollout bucket; an\n * absent key inherits.\n *\n * A separate field from `entitlements.features` on purpose: those ask\n * whether the org's PLAN includes a feature, these ask whether a\n * not-yet-released feature is switched on for this one customer. Folding\n * them together would make \"granted by the deal\" and \"previewing an\n * unreleased build\" indistinguishable at the point a support question is\n * asked.\n *\n * Why the org doc and not a Remote Config condition: RC conditions are\n * template-global and would need one published condition per org, with a\n * template publish (a manual, separate deploy) for every grant.\n */\nexport type OrgReleaseFlagOverrides = Partial<Record<ReleaseFlagKey, boolean>>\n\n/**\n * Sanitises whatever is actually stored at `org.releaseFlags`.\n *\n * Tolerant for the same reason `parseReleaseFlagValue` is: this map is\n * hand-editable in the Firebase console and survives registry renames, so a\n * retired flag key or a non-boolean must be dropped rather than allowed to\n * gate anything. Unknown keys are discarded — a stale key can never grant a\n * flag that no longer exists, and a typo silently inherits instead of\n * silently forcing.\n */\nexport function parseOrgReleaseFlagOverrides(\n  raw: unknown,\n): OrgReleaseFlagOverrides {\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {}\n  const overrides: OrgReleaseFlagOverrides = {}\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof value === 'boolean' && isReleaseFlagKey(key)) {\n      overrides[key] = value\n    }\n  }\n  return overrides\n}\n\n/**\n * The gating verdict with a per-org override applied on top of\n * `isReleaseFlagOn`.\n *\n * The override is checked FIRST and short-circuits, so a forced-off flag\n * stays off for an org even while the flag is globally enabled — the\n * per-org kill switch is half the point, not just the per-org grant. Every\n * release-flag gate resolves through here so the console, the tenant\n * runtime and the API dispatchers cannot disagree about one org.\n */\nexport function isReleaseFlagOnForOrg(\n  flagKey: ReleaseFlagKey,\n  value: ReleaseFlagValue,\n  subjectId: string | null | undefined,\n  overrides: OrgReleaseFlagOverrides | null | undefined,\n  /**\n   * The org's plan, for tier targeting (AGL-2486). Checked only AFTER the\n   * override: a staff grant is a decision about one named customer and\n   * outranks the tier filter exactly as it already outranks the rollout\n   * bucket. That ordering is what lets a Free org preview a\n   * Business-targeted flag without widening the flag for every Free org.\n   *\n   * REQUIRED, and `null` has to be typed out. It was optional for one\n   * release and that cost a silent revenue bug: `report-usage` held the org\n   * document, dropped the argument, and every `plans`-declaring flag read\n   * OFF — so the contacts overage went uninvoiced for exactly the orgs\n   * entitled to reach the feature, with nothing thrown and nothing logged.\n   * An unknown tier still refuses, which is the correct conservatism; what\n   * cannot be allowed is a caller MANUFACTURING an unknown out of a tier it\n   * already has in hand. Spelling `null` makes that a statement rather than\n   * an omission, and makes the next call site that forgets fail to compile\n   * instead of failing to bill. `getOrgReleaseFlagTargeting` returns the\n   * plan beside the overrides from ONE document read precisely so that\n   * passing it costs nothing.\n   */\n  plan: OrgPlan | null,\n): boolean {\n  const override = overrides?.[flagKey]\n  if (typeof override === 'boolean') return override\n  return isReleaseFlagOn(flagKey, value, subjectId, plan)\n}\n"],"names":["PLAN_LABELS","SELF_SERVE_PLANS","PLATFORM_BRAND_NAME","PLUGIN_RELEASE_FLAGS","PLATFORM_RELEASE_FLAGS","key","label","description","defaultEnabled","RELEASE_FLAGS","RELEASE_FLAG_KEYS","map","definition","isReleaseFlagKey","value","includes","getReleaseFlagDefinition","find","entry","Error","clampPercent","percent","Number","isFinite","Math","min","max","round","RELEASE_FLAG_PLAN_LADDER","isOrgPlan","Object","prototype","hasOwnProperty","call","releaseFlagPlansAtOrAbove","plan","index","indexOf","slice","parseReleaseFlagPlans","raw","Array","isArray","undefined","named","Set","filter","size","has","parseReleaseFlagValue","fallbackEnabled","text","trim","enabled","parsed","JSON","parse","plans","rolloutPercent","note","REMOTE_CONFIG_DESCRIPTION_MAX_BYTES","utf8ByteLength","bytes","character","codePoint","codePointAt","fitsRemoteConfigDescription","DESCRIPTION_ELLIPSIS","clampRemoteConfigDescription","budget","kept","next","charAt","length","test","lastSpace","search","replace","releaseFlagParameterDescription","registryDescription","liveDescription","releaseFlagBucket","flagKey","subjectId","hash","seed","charCodeAt","imul","isReleaseFlagOn","releaseFlagTargetsPlan","parseOrgReleaseFlagOverrides","overrides","entries","isReleaseFlagOnForOrg","override"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;CAOC,GAED,6DAA6D;AAE7D,SAASA,WAAW,EAAEC,gBAAgB,QAAQ,yBAAqB;AACnE,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SACEC,oBAAoB,QAEf,sCAAkC;AAuCzC;;;;;;;;;;CAUC,GACD,MAAMC,yBAA2D;IAC/D;QACEC,KAAK;QACLC,OAAO;QACPC,aACE,uEACA;QACFC,gBAAgB;IAClB;IACA,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,oDAAoD;IACpD;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,0EACA,wEACA,yEACA,0EACA,uEACA,sDACA,2EACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,mCAAmC;IACnC;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,wEACA,0DACA,wEACA;QACFC,gBAAgB;IAClB;IACA;QACEH,KAAK;QACLC,OAAO,GAAGJ,oBAAoB,OAAO,CAAC;QACtCK,aACE,kEACA,sEACA,kEACA,0EACA,0EACA,oEACA,yEACA,mEACA,sEACA,gEACA,qEACA,sEACA,yEACA,wEACA,0EACA;QACFC,gBAAgB;IAClB;IACA,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,+DAA+D;IAC/D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,0EACA,sEACA;QACFC,gBAAgB;IAClB;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,6DAA6D;IAC7D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,2EACA,qEACA;QACFC,gBAAgB;IAClB;IACA,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,8DAA8D;IAC9D,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,sCAAsC;IACtC;QACEH,KAAK;QACLC,OAAO,GAAGJ,oBAAoB,cAAc,CAAC;QAC7CK,aACE,6DACA,uEACA,sEACA,sEACA,qEACA,mEACA;QACFC,gBAAgB;IAClB;IACA,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,yEAAyE;IACzE;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,mEACA,gEACA,gEACA,uEACA,uEACA,iDACA;QACFC,gBAAgB;IAClB;IACA,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,kCAAkC;IAClC;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,0EACA,0EACA,yEACA,sEACA,uEACA,yEACA;QACFC,gBAAgB;IAClB;IACA,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,8DAA8D;IAC9D;QACEH,KAAK;QACLC,OAAO;QACPC,aACE,sEACA,2EACA,yEACA;QACFC,gBAAgB;IAClB;CACD;AAED;;;;;CAKC,GACD,OAAO,MAAMC,gBAAkD;OAC1DN;OACAC;CACJ,CAAA;AAED,OAAO,MAAMM,oBAAoBD,cAAcE,GAAG,CAChD,CAACC,aAAeA,WAAWP,GAAG,EACF;AAE9B,OAAO,SAASQ,iBAAiBC,KAAa;IAC5C,OAAO,AAACJ,kBAAwCK,QAAQ,CAACD;AAC3D;AAEA,OAAO,SAASE,yBACdX,GAAmB;IAEnB,MAAMO,aAAaH,cAAcQ,IAAI,CAAC,CAACC,QAAUA,MAAMb,GAAG,KAAKA;IAC/D,IAAI,CAACO,YAAY,MAAM,IAAIO,MAAM,CAAC,sBAAsB,EAAEd,KAAK;IAC/D,OAAOO;AACT;AA8BA,MAAMQ,eAAe,CAACN;IACpB,MAAMO,UAAU,OAAOP,UAAU,YAAYQ,OAAOC,QAAQ,CAACT,SAASA,QAAQ;IAC9E,OAAOU,KAAKC,GAAG,CAAC,KAAKD,KAAKE,GAAG,CAAC,GAAGF,KAAKG,KAAK,CAACN;AAC9C;AAEA;;;;;;CAMC,GACD,OAAO,MAAMO,2BAA+C;OACvD3B;IACH;CACD,CAAA;AAED,MAAM4B,YAAY,CAACf,QACjB,OAAOA,UAAU,YACjBgB,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACjC,aAAac;AAEpD;;;;;;;;;CASC,GACD,OAAO,SAASoB,0BAA0BC,IAAa;IACrD,MAAMC,QAAQR,yBAAyBS,OAAO,CAACF;IAC/C,OAAOC,QAAQ,IAAI,EAAE,GAAGR,yBAAyBU,KAAK,CAACF;AACzD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASG,sBAAsBC,GAAY;IAChD,IAAI,CAACC,MAAMC,OAAO,CAACF,MAAM,OAAOG;IAChC,MAAMC,QAAQ,IAAIC,IAAIL,IAAIM,MAAM,CAACjB;IACjC,IAAIe,MAAMG,IAAI,KAAK,GAAG,OAAOJ;IAC7B,OAAOf,yBAAyBkB,MAAM,CAAC,CAACX,OAASS,MAAMI,GAAG,CAACb;AAC7D;AAEA;;;;;CAKC,GACD,OAAO,SAASc,sBACdT,GAA8B,EAC9BU,eAAwB;IAExB,MAAMC,OAAOX,uBAAAA,IAAKY,IAAI;IACtB,IAAI,CAACD,MAAM,OAAO;QAAEE,SAASH;IAAgB;IAC7C,IAAIC,SAAS,QAAQ,OAAO;QAAEE,SAAS;IAAK;IAC5C,IAAIF,SAAS,SAAS,OAAO;QAAEE,SAAS;IAAM;IAC9C,IAAI;QACF,MAAMC,SAASC,KAAKC,KAAK,CAACL;QAC1B,IAAI,OAAOG,WAAW,WAAW,OAAO;YAAED,SAASC;QAAO;QAC1D,IAAIA,UAAU,OAAOA,WAAW,UAAU;YACxC,MAAMG,QAAQlB,sBAAsBe,OAAOG,KAAK;YAChD,OAAO;gBACLJ,SAASC,OAAOD,OAAO,KAAK;gBAC5BK,gBAAgBtC,aAAakC,OAAOI,cAAc;eAM9CD,QAAQ;gBAAEA;YAAM,IAAI,CAAC;gBACzBE,MAAM,OAAOL,OAAOK,IAAI,KAAK,WAAWL,OAAOK,IAAI,GAAGhB;;QAE1D;IACF,EAAE,eAAM;IACN,uCAAuC;IACzC;IACA,OAAO;QAAEU,SAASH;IAAgB;AACpC;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMU,sCAAsC,IAAG;AAEtD,SAASC,eAAeV,IAAY;IAClC,IAAIW,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;YACVY;QAAlB,MAAMC,aAAYD,yBAAAA,UAAUE,WAAW,CAAC,cAAtBF,yBAA4B;QAC9CD,SACEE,YAAY,OAAO,IAAIA,YAAY,QAAQ,IAAIA,YAAY,UAAU,IAAI;IAC7E;IACA,OAAOF;AACT;AAEA,qEAAqE,GACrE,OAAO,SAASI,4BAA4Bf,IAAY;IACtD,OAAOU,eAAeV,SAASS;AACjC;AAEA,MAAMO,uBAAuB;AAE7B;;;;;;;;CAQC,GACD,OAAO,SAASC,6BAA6BjB,IAAY;IACvD,IAAIe,4BAA4Bf,OAAO,OAAOA;IAC9C,MAAMkB,SACJT,sCAAsCC,eAAeM;IACvD,IAAIG,OAAO;IACX,IAAIR,QAAQ;IACZ,KAAK,MAAMC,aAAaZ,KAAM;QAC5B,MAAMJ,OAAOc,eAAeE;QAC5B,IAAID,QAAQf,OAAOsB,QAAQ;QAC3BC,QAAQP;QACRD,SAASf;IACX;IACA,MAAMwB,OAAOpB,KAAKqB,MAAM,CAACF,KAAKG,MAAM;IACpC,IAAIF,QAAQ,CAAC,KAAKG,IAAI,CAACH,OAAO;QAC5B,MAAMI,YAAYL,KAAKM,MAAM,CAAC;QAC9B,IAAID,YAAY,GAAGL,OAAOA,KAAKhC,KAAK,CAAC,GAAGqC;IAC1C;IACA,OAAO,GAAGL,KAAKO,OAAO,CAAC,kBAAkB,MAAMV,sBAAsB;AACvE;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASW,gCACdC,mBAA2B,EAC3BC,eAA0C;IAE1C,IAAId,4BAA4Ba,sBAAsB;QACpD,OAAOA;IACT;IACA,IACE,OAAOC,oBAAoB,YAC3BA,gBAAgB5B,IAAI,GAAGqB,MAAM,GAAG,KAChCP,4BAA4Bc,kBAC5B;QACA,OAAOA;IACT;IACA,OAAOZ,6BAA6BW;AACtC;AAEA;;;;CAIC,GACD,OAAO,SAASE,kBAAkBC,OAAe,EAAEC,SAAiB;IAClE,IAAIC,OAAO;IACX,MAAMC,OAAO,GAAGH,QAAQ,CAAC,EAAEC,WAAW;IACtC,IAAK,IAAI/C,QAAQ,GAAGA,QAAQiD,KAAKZ,MAAM,EAAErC,SAAS,EAAG;QACnDgD,QAAQC,KAAKC,UAAU,CAAClD;QACxBgD,OAAO5D,KAAK+D,IAAI,CAACH,MAAM;IACzB;IACA,OAAO,AAACA,CAAAA,SAAS,CAAA,IAAK;AACxB;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASI,gBACdN,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpC;;;;GAIC,GACDhD,IAAqB;IAErB,IAAI,CAACsD,uBAAuB3E,OAAOqB,OAAO,OAAO;IACjD,IAAIrB,MAAMuC,OAAO,EAAE,OAAO;IAC1B,MAAMhC,UAAUD,aAAaN,MAAM4C,cAAc;IACjD,IAAIrC,WAAW,KAAK,CAAC8D,WAAW,OAAO;IACvC,IAAI9D,WAAW,KAAK,OAAO;IAC3B,OAAO4D,kBAAkBC,SAASC,aAAa9D;AACjD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,SAASoE,uBACd3E,KAAuB,EACvBqB,IAAgC;IAEhC,MAAMsB,QAAQ3C,MAAM2C,KAAK;IACzB,4EAA4E;IAC5E,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAIA,SAAS,QAAQA,MAAMgB,MAAM,KAAK,GAAG,OAAO;IAChD,IAAI,CAACtC,MAAM,OAAO;IAClB,OAAOsB,MAAM1C,QAAQ,CAACoB;AACxB;AAqBA;;;;;;;;;CASC,GACD,OAAO,SAASuD,6BACdlD,GAAY;IAEZ,IAAI,CAACA,OAAO,OAAOA,QAAQ,YAAYC,MAAMC,OAAO,CAACF,MAAM,OAAO,CAAC;IACnE,MAAMmD,YAAqC,CAAC;IAC5C,KAAK,MAAM,CAACtF,KAAKS,MAAM,IAAIgB,OAAO8D,OAAO,CAACpD,KAAiC;QACzE,IAAI,OAAO1B,UAAU,aAAaD,iBAAiBR,MAAM;YACvDsF,SAAS,CAACtF,IAAI,GAAGS;QACnB;IACF;IACA,OAAO6E;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASE,sBACdX,OAAuB,EACvBpE,KAAuB,EACvBqE,SAAoC,EACpCQ,SAAqD,EACrD;;;;;;;;;;;;;;;;;;;GAmBC,GACDxD,IAAoB;IAEpB,MAAM2D,WAAWH,6BAAAA,SAAW,CAACT,QAAQ;IACrC,IAAI,OAAOY,aAAa,WAAW,OAAOA;IAC1C,OAAON,gBAAgBN,SAASpE,OAAOqE,WAAWhD;AACpD"}

package/src/lib/app-utils/server.d.ts

@@ -101,6 +101,10 @@ export * from './visitor-record-ceiling';
 export * from './health-report';
 export * from './webhook-delivery';
 export * from './support-tiers';
+export * from './site-care';
+export * from './owner-approval-record';
+export * from './append-only-history';
+export * from './site-care-project';
 export * from './release-flags';
 export * from './operator-identity';
 export * from './lockdown';

package/src/lib/app-utils/server.js

@@ -208,6 +208,13 @@ export * from "./health-report.js";
 // `health-report`, whose billing verdict consumes the counts this produces.
 export * from "./webhook-delivery.js";
 export * from "./support-tiers.js";
+// Site Care requests (AGL-3959): the arithmetic, and the two modules any
+// staff-recorded, approval-gated charge reuses (AGL-3970).
+export * from "./site-care.js";
+export * from "./owner-approval-record.js";
+export * from "./append-only-history.js";
+// Site Care projects (AGL-3970): the flat quote, its split and its record.
+export * from "./site-care-project.js";
 export * from "./release-flags.js";
 // Who runs THIS deployment, and where its notices go (AGL-2016). Ordered
 // before the four surfaces that print it, all of which used to declare their

package/src/lib/app-utils/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Server-safe app-utils: every app-util EXCEPT the client-only React\n * contexts (see ./contexts). Nothing here calls `createContext` at module\n * scope, so this barrel — re-exported by `@aglyn/aglyn/server` — is safe to\n * import from tenant Server Components (AGL-405). The full `./index` barrel\n * re-adds the contexts for client consumers.\n */\nexport * from './binding-token-catalog'\nexport * from './binding-tokens'\nexport * from './breadcrumb-json-ld'\n// What a search listing holds and how long each field may be (AGL-2910):\n// the SEO editors and anything that proposes a value read one catalog.\nexport * from './seo-listing-fields'\n// `VideoObject` for the Video elements a page actually ships (AGL-2747).\n// Beside the other structured-data builders, and server-only like them: only\n// the route emits JSON-LD, and a crawler-facing block has no client caller.\nexport * from './video-object'\n// `FAQPage` for the FAQ section a page draws (AGL-3574): the same input, the\n// same reason, and server-only for the same one — only the route emits it.\nexport * from './faq-page'\nexport * from './collection-delete'\nexport * from './collection-entries'\nexport * from './collection-kind'\nexport * from './collection-slug'\nexport * from './content-authors'\n// NOT re-exported: `./local-business` and `./site-entity-json-ld` (AGL-3383).\n// This barrel is the whole namespace a realm bundle is handed and part of the\n// runtime a published page loads (`check:tenant-wire-weight`); the site\n// entity's JSON-LD and the LocalBusiness allow-list are read only by the\n// tenant page's server render and the console's Setup → SEO card, which import\n// them by path (`@aglyn/aglyn/app-utils/...`).\nexport * from './content-query-fields'\nexport * from './content-schema-type'\nexport * from './content-author-profile'\nexport * from './url-slug'\nexport * from './child-contract'\nexport * from './child-contract-compose'\n// The one reading of `restrictChildren`/`restrictParent`, shared by the\n// besigner's drop check and the AI plugin's node-tree validator (AGL-2905).\nexport * from './lineal-order'\n// What a portable node tree must satisfy before it lands on a canvas that did\n// not author it (AGL-2939): a tree installed from another workspace and a tree\n// a model generated both pass through it.\nexport * from './node-definition-sanitizer'\nexport * from './console-routes'\n// What a stored screen-link value means, with no React attached — the\n// where-used scan reads these on the server (AGL-703).\nexport * from './screen-link-value'\n// Which entries a page's links name (AGL-3118). The tenant render reads\n// exactly those entry documents, so the walk runs on the server.\nexport * from './link-references'\nexport * from './analytics-path-key'\nexport * from './contacts'\n// A lead's or a contact's email state (AGL-3245): the last verdict on its\n// address, in words a person can act on, mirrored from the senders' lists.\nexport * from './email-state'\n// A field whose choices an admin keeps (AGL-3510): standard values built in,\n// the organization's own beside them, and the judge every write asks. Pure,\n// and named for no plugin — a plugin's registry of picklists sits on top.\nexport * from './picklists'\n// The records that sit beside a contact — companies, pipelines, deals, tasks,\n// activities, field definitions (AGL-2595). Pure like `contacts`, and beside\n// it because `ContactFacet` names its lifecycle stage and custom-value types;\n// the scope stamp every CRM creator writes lives here too.\nexport * from './crm'\n// Email templates, snippets and the merge-field resolver (AGL-2658): the\n// letter a rep keeps under a name, and the one grammar the send route and\n// the dialog fill it in by. Pure like `crm`, and beside it because a\n// template is scoped the way a task is.\nexport * from './crm-email-templates'\n// A person's privacy erasure from one workspace (AGL-2623): the request's\n// shape and id, the marker a record carries while it waits, and the lists\n// the dialog and the docs share. Pure like `crm`; the sweep is server-side.\nexport * from './person-erasure'\n// A task's reminder at its own time (AGL-2659): which reminder a save\n// leaves, whether one is owed, and the words the notification and the mail\n// say. Pure like `crm`, read by the hourly route and by every writer of the\n// field.\n// Reading a received email (AGL-2657): the address in a header, the thread\n// a subject belongs to, the reply above the quoted history — and the domain\n// the platform receives mail on. Pure; every surface that reads mail it was\n// sent reads it this way.\nexport * from './email-text'\nexport * from './inbound-mail-domain'\n// A member's own addresses in a workspace (AGL-2975): the ones they have\n// confirmed count as theirs wherever the roster is asked who wrote a\n// message. Pure; the store and the confirmation link are server-side.\nexport * from './member-email-aliases'\n// The CSV cell grammar the exports write with (AGL-2621), and the target a\n// mapped column names for a custom field — named rather than starred, because\n// an importer built on this file exports the shared ceilings under its own\n// names.\nexport {\n  csvCell,\n  csvDocument,\n  customImportTarget,\n  customImportTargetKey,\n  importNoMailServerSentence,\n} from './csv-import'\nexport type {\n  ImportChunkResult,\n  ImportDroppedValue,\n  ImportSkippedRow,\n} from './csv-import'\n// What a VALUE under a custom contact field may be, and the coercion every\n// door applies to one (AGL-2601): a mapped form field, an API `custom` body,\n// and the carry-over that keeps a mapping across a publish. Pure like `crm`.\nexport * from './contact-custom-fields'\n// The consent JOIN (`docs/specs/email-overhaul.md` §3f). Pure, and it composes\n// `contacts` for the normalizer, so it sits directly beside it. No Node\n// builtin, which is what keeps it out of the `/server`-only group `person-key`\n// belongs to.\nexport * from './consent-groups'\nexport * from './marketing-consent'\n// A refusal kept after the record it was written on is deleted (AGL-3338),\n// read back through the same parser as the record's own.\nexport * from './retained-refusals'\n// The ENROLLMENT-time half of the same question, beside its reader for the\n// same reason: `marketing-consent` decides whether a recorded basis lets us\n// mail somebody, and this decides what basis putting them on a list may\n// record. Two enrollment surfaces import it — the Inbox assignment route and\n// the Emails console's audience card — and neither could import the other.\nexport * from './enrollment-basis'\n// Reading the FILE a merchant arrives with (`docs/specs/email-competitive-gaps.md`\n// G5/P4), directly after the policy it hands its addresses to: parsing and\n// mechanical screening only, so that an import asks the enrollment question\n// through the same module the one-address add path asks it through rather\n// than answering it a second way.\n// The dynamic-list rule (§3b/§3c), beside it for the same reasons: pure, and\n// it composes `contacts` for the segment vocabulary rather than restating it.\nexport * from './dynamic-list-rule'\n// The subscribable streams a recipient can leave one at a time\n// (`docs/specs/email-competitive-gaps.md` §1f). Pure, and read from all three\n// sides of the feature: the composer picks one, the send path signs it into\n// the unsubscribe link, and the unauthenticated preference page renders the\n// catalog. No Node builtin, so it stays out of the `/server`-only group.\nexport * from './subscription-topics'\nexport * from './compose-layout-nodes'\n// Layout properties applied through the chain (AGL-2893).\nexport * from './compose-layout-props'\n// A screen's per-page restyling of its layout's elements (AGL-3286).\nexport * from './layout-style-overrides'\nexport * from './document-landmark'\nexport * from './functions'\nexport * from './compose-reusable-components'\n// Where a reusable component is placed — pages or emails (AGL-3287).\nexport * from './reusable-component-kind'\nexport * from './compress'\nexport * from './merge-node-sx'\nexport * from './palette-sx'\nexport * from './scheme-sx'\n// An element pinned to one color scheme (AGL-3284).\nexport * from './element-color-scheme'\nexport * from './create-resource-uid'\nexport * from './decompress'\nexport * from './stored-nodes'\nexport * from './strip-undefined'\nexport * from './organizations'\nexport * from './org-permissions'\n// The AI verdict on either membership axis (AGL-2927). After both modules it\n// composes: the org catalog for org-wide members, the host role for site\n// collaborators.\nexport * from './host-permissions'\nexport * from './password-policy'\nexport * from './idp-profile'\nexport * from './onboarding-deep-link'\n// The platform team's ask that a workspace buy a plan (AGL-3466), beside the\n// plan intent its button carries into Billing.\nexport * from './upgrade-proposal'\n// Where an account came from (AGL-1731). Beside the plan intent because\n// they are the same hop — the marketing CTA's query string — and both are\n// remembered on `users/{uid}` across the verification wall.\nexport * from './utm-attribution'\n// What a record is filed under: the edge between a container a plugin keeps\n// (a campaign) and the forms, screens and contacts it gathers. Beside the\n// attribution above because the two answer opposite questions: attribution\n// records where somebody CAME from, this records what a merchant DECLARED\n// belongs together.\nexport * from './container-membership'\nexport * from './deployment-shape'\n// Which browser origins may complete a signed direct-to-GCS upload (AGL-1452).\n// GCS matches the origin list EXACTLY, so every serving console name needs its\n// own entry — the rule nobody could be expected to remember at attach time.\nexport * from './upload-cors'\n// The docs-help subset the first-party plugin consoles read (AGL-2213) — the\n// console's own registry lives in apps/console/constants and a lib cannot\n// import an app.\nexport * from './docs-help'\nexport * from './platform-brand'\nexport * from './plan-entitlements'\n// The free plan's bandwidth hard cap (AGL-1967/2070/2155). After\n// `plan-entitlements`, which owns the predicate it keys off.\nexport * from './bandwidth-cap'\n// Video and file delivery as bandwidth (AGL-3474), in the band's own units.\nexport * from './media-bandwidth'\n// The month every monthly counter is keyed by, and the boundary it lifts on.\nexport * from './utc-month'\nexport * from './forms'\n// What a form's DESIGN must still satisfy for its submissions to arrive.\n// After `forms`, whose field walk it reads the drawn fields with.\nexport * from './form-contract'\nexport * from './visitor-record-ceiling'\nexport * from './health-report'\n// Did a webhook delivery actually DO anything (AGL-1954)? After\n// `health-report`, whose billing verdict consumes the counts this produces.\nexport * from './webhook-delivery'\nexport * from './support-tiers'\nexport * from './release-flags'\n// Who runs THIS deployment, and where its notices go (AGL-2016). Ordered\n// before the four surfaces that print it, all of which used to declare their\n// own `support@aglyn.com` literal.\nexport * from './operator-identity'\nexport * from './lockdown'\nexport * from './media-quarantine'\nexport * from './media-takedown-reach'\nexport * from './upload-inspection'\nexport * from './abuse-report'\n// The other three quarters of §512 (AGL-1983): the put-back procedure that\n// answers a notice, and the strike ledger that conditions the safe harbour.\nexport * from './dmca-counter-notice'\nexport * from './repeat-infringer'\n// `addBusinessDays` briefly existed TWICE — once here in './support-tiers'\n// and once in './dmca-counter-notice' — and two `export *` made the name\n// ambiguous, TS2308'ing this barrel and every tsconfig that reads it. The\n// interleave was fixed twice in parallel: once by naming a winner here, and\n// once by deleting the second definition so './dmca-counter-notice' imports\n// this one. Only the deletion survives, so the disambiguating re-export that\n// stood on this line is gone with it — `export *` is unambiguous again.\n//\n// The concern that argued for keeping two copies is worth answering rather\n// than dropping: a later tweak to the SUPPORT SLA window must never silently\n// move the §512(g)(2)(C) put-back deadline. It cannot. This function embeds\n// no window — it is \"add N business days\", and N is the argument. The two\n// windows live in their own constants (`SUPPORT_*` there,\n// `COUNTER_NOTICE_*_BUSINESS_DAYS` in the DMCA module) and never meet. What\n// SHOULD stay shared is the day arithmetic itself: two copies of a weekend\n// rule are two chances to disagree about which day a deadline falls on.\nexport * from './org-override-reason'\nexport * from './host-tokens'\nexport * from './variables'\n// What happened on a site that an automation can start on: the platform's\n// own event and the ones plugins declare (AGL-3080).\nexport * from './host-events'\nexport * from './expand-repeatables'\nexport * from './org-roles'\nexport * from './markdown-lite'\nexport * from './notifications'\n// The operator alert registry (AGL-3377); OPERATOR_ALERT_NOTIFICATION_TYPES\n// lives here now, derived from it.\nexport * from './operator-alerts'\nexport * from './definition-canvas-tree'\nexport * from './ensure-canvas-root'\nexport * from './repair-canvas-nodes'\nexport * from './detect-template-placeholders'\nexport * from './guarded-version-save'\nexport * from './local-storage-budget'\nexport * from './measure-node-map'\nexport * from './resolve-named-tokens'\nexport * from './screen-route'\nexport * from './host-naming'\nexport * from './name-search'\nexport * from './artifact-list-keys'\nexport * from './name-match'\nexport * from './api-plugins'\nexport * from './plugin-api-rate-limit'\n// The same-origin gate on visitor-facing plugin writes (AGL-1880). After\n// `plugin-api-rate-limit`, whose `isMachinePluginApiPath` it reuses so the\n// two gates exempt exactly the same machine surfaces.\nexport * from './plugin-api-cross-origin'\n// What a published page does when a visitor does something (AGL-3080): the\n// platform's interaction vocabulary, which the workflows plugin builds its\n// automations on.\nexport * from './site-interactions'\nexport * from './element-animation'\nexport * from './attribution-guard'\nexport * from './node-interactions'\nexport * from './element-ui'\nexport * from './image-upload-types'\nexport * from './sanitize-svg'\nexport * from './media-folders'\nexport * from './media-metadata'\nexport * from './media-ref'\nexport * from './rendered-widths'\n// After `media-ref`, whose reference grammar it reads stored URLs with.\nexport * from './paid-media-source'\nexport * from './author-css'\n// The isomorphic HTML rule (AGL-1901), after the CSS one it depends on.\nexport * from './author-html'\nexport * from './csv'\nexport * from './csv-upload'\nexport * from './artifact-provenance'\nexport * from './repeat-query'\nexport * from './plugin-manifest'\n// After `plugin-manifest`, whose revocation predicates it asks the kill\n// question with, and after `media-ref`, whose grammar decides what counts as a\n// first-party image.\nexport * from './email-starter-policy'\nexport * from './safe-json-ld'\n// Agent readiness (AGL-2716): content negotiation, the Markdown rendering of a\n// page, `/llms.txt` and the per-site OpenAPI document. All pure, all server-safe.\nexport * from './accept-negotiation'\nexport * from './agent-api-catalog'\nexport * from './agent-openapi'\nexport * from './author-html-markdown'\nexport * from './llms-txt'\nexport * from './page-markdown'\nexport * from './request-geo'\nexport * from './request-ip'\nexport * from './search-indexing'\nexport * from './seo-title'\nexport * from './sitemap'\nexport * from './visitor-consent'\nexport * from './social-image'\nexport * from './scope-tokens'\nexport * from './org-billing-doc'\nexport * from './stripe-deployment-mode'\nexport * from './deferred-image'\n"],"names":["csvCell","csvDocument","customImportTarget","customImportTargetKey","importNoMailServerSentence"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GACD,cAAc,6BAAyB;AACvC,cAAc,sBAAkB;AAChC,cAAc,0BAAsB;AACpC,yEAAyE;AACzE,uEAAuE;AACvE,cAAc,0BAAsB;AACpC,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,cAAc,oBAAgB;AAC9B,6EAA6E;AAC7E,2EAA2E;AAC3E,cAAc,gBAAY;AAC1B,cAAc,yBAAqB;AACnC,cAAc,0BAAsB;AACpC,cAAc,uBAAmB;AACjC,cAAc,uBAAmB;AACjC,cAAc,uBAAmB;AACjC,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+EAA+E;AAC/E,+CAA+C;AAC/C,cAAc,4BAAwB;AACtC,cAAc,2BAAuB;AACrC,cAAc,8BAA0B;AACxC,cAAc,gBAAY;AAC1B,cAAc,sBAAkB;AAChC,cAAc,8BAA0B;AACxC,wEAAwE;AACxE,4EAA4E;AAC5E,cAAc,oBAAgB;AAC9B,8EAA8E;AAC9E,+EAA+E;AAC/E,0CAA0C;AAC1C,cAAc,iCAA6B;AAC3C,cAAc,sBAAkB;AAChC,sEAAsE;AACtE,uDAAuD;AACvD,cAAc,yBAAqB;AACnC,wEAAwE;AACxE,iEAAiE;AACjE,cAAc,uBAAmB;AACjC,cAAc,0BAAsB;AACpC,cAAc,gBAAY;AAC1B,0EAA0E;AAC1E,2EAA2E;AAC3E,cAAc,mBAAe;AAC7B,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,cAAc,iBAAa;AAC3B,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,2DAA2D;AAC3D,cAAc,WAAO;AACrB,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,wCAAwC;AACxC,cAAc,2BAAuB;AACrC,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,cAAc,sBAAkB;AAChC,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,SAAS;AACT,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,0BAA0B;AAC1B,cAAc,kBAAc;AAC5B,cAAc,2BAAuB;AACrC,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,cAAc,4BAAwB;AACtC,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,SAAS;AACT,SACEA,OAAO,EACPC,WAAW,EACXC,kBAAkB,EAClBC,qBAAqB,EACrBC,0BAA0B,QACrB,kBAAc;AAMrB,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,cAAc,6BAAyB;AACvC,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,cAAc;AACd,cAAc,sBAAkB;AAChC,cAAc,yBAAqB;AACnC,2EAA2E;AAC3E,yDAAyD;AACzD,cAAc,yBAAqB;AACnC,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,cAAc,wBAAoB;AAClC,mFAAmF;AACnF,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,kCAAkC;AAClC,6EAA6E;AAC7E,8EAA8E;AAC9E,cAAc,yBAAqB;AACnC,+DAA+D;AAC/D,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,cAAc,2BAAuB;AACrC,cAAc,4BAAwB;AACtC,0DAA0D;AAC1D,cAAc,4BAAwB;AACtC,qEAAqE;AACrE,cAAc,8BAA0B;AACxC,cAAc,yBAAqB;AACnC,cAAc,iBAAa;AAC3B,cAAc,mCAA+B;AAC7C,qEAAqE;AACrE,cAAc,+BAA2B;AACzC,cAAc,gBAAY;AAC1B,cAAc,qBAAiB;AAC/B,cAAc,kBAAc;AAC5B,cAAc,iBAAa;AAC3B,oDAAoD;AACpD,cAAc,4BAAwB;AACtC,cAAc,2BAAuB;AACrC,cAAc,kBAAc;AAC5B,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,cAAc,qBAAiB;AAC/B,cAAc,uBAAmB;AACjC,6EAA6E;AAC7E,yEAAyE;AACzE,iBAAiB;AACjB,cAAc,wBAAoB;AAClC,cAAc,uBAAmB;AACjC,cAAc,mBAAe;AAC7B,cAAc,4BAAwB;AACtC,6EAA6E;AAC7E,+CAA+C;AAC/C,cAAc,wBAAoB;AAClC,wEAAwE;AACxE,0EAA0E;AAC1E,4DAA4D;AAC5D,cAAc,uBAAmB;AACjC,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,oBAAoB;AACpB,cAAc,4BAAwB;AACtC,cAAc,wBAAoB;AAClC,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc,mBAAe;AAC7B,6EAA6E;AAC7E,0EAA0E;AAC1E,iBAAiB;AACjB,cAAc,iBAAa;AAC3B,cAAc,sBAAkB;AAChC,cAAc,yBAAqB;AACnC,iEAAiE;AACjE,6DAA6D;AAC7D,cAAc,qBAAiB;AAC/B,4EAA4E;AAC5E,cAAc,uBAAmB;AACjC,6EAA6E;AAC7E,cAAc,iBAAa;AAC3B,cAAc,aAAS;AACvB,yEAAyE;AACzE,kEAAkE;AAClE,cAAc,qBAAiB;AAC/B,cAAc,8BAA0B;AACxC,cAAc,qBAAiB;AAC/B,gEAAgE;AAChE,4EAA4E;AAC5E,cAAc,wBAAoB;AAClC,cAAc,qBAAiB;AAC/B,cAAc,qBAAiB;AAC/B,yEAAyE;AACzE,6EAA6E;AAC7E,mCAAmC;AACnC,cAAc,yBAAqB;AACnC,cAAc,gBAAY;AAC1B,cAAc,wBAAoB;AAClC,cAAc,4BAAwB;AACtC,cAAc,yBAAqB;AACnC,cAAc,oBAAgB;AAC9B,2EAA2E;AAC3E,4EAA4E;AAC5E,cAAc,2BAAuB;AACrC,cAAc,wBAAoB;AAClC,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,0DAA0D;AAC1D,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,cAAc,2BAAuB;AACrC,cAAc,mBAAe;AAC7B,cAAc,iBAAa;AAC3B,0EAA0E;AAC1E,qDAAqD;AACrD,cAAc,mBAAe;AAC7B,cAAc,0BAAsB;AACpC,cAAc,iBAAa;AAC3B,cAAc,qBAAiB;AAC/B,cAAc,qBAAiB;AAC/B,4EAA4E;AAC5E,mCAAmC;AACnC,cAAc,uBAAmB;AACjC,cAAc,8BAA0B;AACxC,cAAc,0BAAsB;AACpC,cAAc,2BAAuB;AACrC,cAAc,oCAAgC;AAC9C,cAAc,4BAAwB;AACtC,cAAc,4BAAwB;AACtC,cAAc,wBAAoB;AAClC,cAAc,4BAAwB;AACtC,cAAc,oBAAgB;AAC9B,cAAc,mBAAe;AAC7B,cAAc,mBAAe;AAC7B,cAAc,0BAAsB;AACpC,cAAc,kBAAc;AAC5B,cAAc,mBAAe;AAC7B,cAAc,6BAAyB;AACvC,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AACtD,cAAc,+BAA2B;AACzC,2EAA2E;AAC3E,2EAA2E;AAC3E,kBAAkB;AAClB,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,kBAAc;AAC5B,cAAc,0BAAsB;AACpC,cAAc,oBAAgB;AAC9B,cAAc,qBAAiB;AAC/B,cAAc,sBAAkB;AAChC,cAAc,iBAAa;AAC3B,cAAc,uBAAmB;AACjC,wEAAwE;AACxE,cAAc,yBAAqB;AACnC,cAAc,kBAAc;AAC5B,wEAAwE;AACxE,cAAc,mBAAe;AAC7B,cAAc,WAAO;AACrB,cAAc,kBAAc;AAC5B,cAAc,2BAAuB;AACrC,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,wEAAwE;AACxE,+EAA+E;AAC/E,qBAAqB;AACrB,cAAc,4BAAwB;AACtC,cAAc,oBAAgB;AAC9B,+EAA+E;AAC/E,kFAAkF;AAClF,cAAc,0BAAsB;AACpC,cAAc,yBAAqB;AACnC,cAAc,qBAAiB;AAC/B,cAAc,4BAAwB;AACtC,cAAc,gBAAY;AAC1B,cAAc,qBAAiB;AAC/B,cAAc,mBAAe;AAC7B,cAAc,kBAAc;AAC5B,cAAc,uBAAmB;AACjC,cAAc,iBAAa;AAC3B,cAAc,eAAW;AACzB,cAAc,uBAAmB;AACjC,cAAc,oBAAgB;AAC9B,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,cAAc,8BAA0B;AACxC,cAAc,sBAAkB"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Server-safe app-utils: every app-util EXCEPT the client-only React\n * contexts (see ./contexts). Nothing here calls `createContext` at module\n * scope, so this barrel — re-exported by `@aglyn/aglyn/server` — is safe to\n * import from tenant Server Components (AGL-405). The full `./index` barrel\n * re-adds the contexts for client consumers.\n */\nexport * from './binding-token-catalog'\nexport * from './binding-tokens'\nexport * from './breadcrumb-json-ld'\n// What a search listing holds and how long each field may be (AGL-2910):\n// the SEO editors and anything that proposes a value read one catalog.\nexport * from './seo-listing-fields'\n// `VideoObject` for the Video elements a page actually ships (AGL-2747).\n// Beside the other structured-data builders, and server-only like them: only\n// the route emits JSON-LD, and a crawler-facing block has no client caller.\nexport * from './video-object'\n// `FAQPage` for the FAQ section a page draws (AGL-3574): the same input, the\n// same reason, and server-only for the same one — only the route emits it.\nexport * from './faq-page'\nexport * from './collection-delete'\nexport * from './collection-entries'\nexport * from './collection-kind'\nexport * from './collection-slug'\nexport * from './content-authors'\n// NOT re-exported: `./local-business` and `./site-entity-json-ld` (AGL-3383).\n// This barrel is the whole namespace a realm bundle is handed and part of the\n// runtime a published page loads (`check:tenant-wire-weight`); the site\n// entity's JSON-LD and the LocalBusiness allow-list are read only by the\n// tenant page's server render and the console's Setup → SEO card, which import\n// them by path (`@aglyn/aglyn/app-utils/...`).\nexport * from './content-query-fields'\nexport * from './content-schema-type'\nexport * from './content-author-profile'\nexport * from './url-slug'\nexport * from './child-contract'\nexport * from './child-contract-compose'\n// The one reading of `restrictChildren`/`restrictParent`, shared by the\n// besigner's drop check and the AI plugin's node-tree validator (AGL-2905).\nexport * from './lineal-order'\n// What a portable node tree must satisfy before it lands on a canvas that did\n// not author it (AGL-2939): a tree installed from another workspace and a tree\n// a model generated both pass through it.\nexport * from './node-definition-sanitizer'\nexport * from './console-routes'\n// What a stored screen-link value means, with no React attached — the\n// where-used scan reads these on the server (AGL-703).\nexport * from './screen-link-value'\n// Which entries a page's links name (AGL-3118). The tenant render reads\n// exactly those entry documents, so the walk runs on the server.\nexport * from './link-references'\nexport * from './analytics-path-key'\nexport * from './contacts'\n// A lead's or a contact's email state (AGL-3245): the last verdict on its\n// address, in words a person can act on, mirrored from the senders' lists.\nexport * from './email-state'\n// A field whose choices an admin keeps (AGL-3510): standard values built in,\n// the organization's own beside them, and the judge every write asks. Pure,\n// and named for no plugin — a plugin's registry of picklists sits on top.\nexport * from './picklists'\n// The records that sit beside a contact — companies, pipelines, deals, tasks,\n// activities, field definitions (AGL-2595). Pure like `contacts`, and beside\n// it because `ContactFacet` names its lifecycle stage and custom-value types;\n// the scope stamp every CRM creator writes lives here too.\nexport * from './crm'\n// Email templates, snippets and the merge-field resolver (AGL-2658): the\n// letter a rep keeps under a name, and the one grammar the send route and\n// the dialog fill it in by. Pure like `crm`, and beside it because a\n// template is scoped the way a task is.\nexport * from './crm-email-templates'\n// A person's privacy erasure from one workspace (AGL-2623): the request's\n// shape and id, the marker a record carries while it waits, and the lists\n// the dialog and the docs share. Pure like `crm`; the sweep is server-side.\nexport * from './person-erasure'\n// A task's reminder at its own time (AGL-2659): which reminder a save\n// leaves, whether one is owed, and the words the notification and the mail\n// say. Pure like `crm`, read by the hourly route and by every writer of the\n// field.\n// Reading a received email (AGL-2657): the address in a header, the thread\n// a subject belongs to, the reply above the quoted history — and the domain\n// the platform receives mail on. Pure; every surface that reads mail it was\n// sent reads it this way.\nexport * from './email-text'\nexport * from './inbound-mail-domain'\n// A member's own addresses in a workspace (AGL-2975): the ones they have\n// confirmed count as theirs wherever the roster is asked who wrote a\n// message. Pure; the store and the confirmation link are server-side.\nexport * from './member-email-aliases'\n// The CSV cell grammar the exports write with (AGL-2621), and the target a\n// mapped column names for a custom field — named rather than starred, because\n// an importer built on this file exports the shared ceilings under its own\n// names.\nexport {\n  csvCell,\n  csvDocument,\n  customImportTarget,\n  customImportTargetKey,\n  importNoMailServerSentence,\n} from './csv-import'\nexport type {\n  ImportChunkResult,\n  ImportDroppedValue,\n  ImportSkippedRow,\n} from './csv-import'\n// What a VALUE under a custom contact field may be, and the coercion every\n// door applies to one (AGL-2601): a mapped form field, an API `custom` body,\n// and the carry-over that keeps a mapping across a publish. Pure like `crm`.\nexport * from './contact-custom-fields'\n// The consent JOIN (`docs/specs/email-overhaul.md` §3f). Pure, and it composes\n// `contacts` for the normalizer, so it sits directly beside it. No Node\n// builtin, which is what keeps it out of the `/server`-only group `person-key`\n// belongs to.\nexport * from './consent-groups'\nexport * from './marketing-consent'\n// A refusal kept after the record it was written on is deleted (AGL-3338),\n// read back through the same parser as the record's own.\nexport * from './retained-refusals'\n// The ENROLLMENT-time half of the same question, beside its reader for the\n// same reason: `marketing-consent` decides whether a recorded basis lets us\n// mail somebody, and this decides what basis putting them on a list may\n// record. Two enrollment surfaces import it — the Inbox assignment route and\n// the Emails console's audience card — and neither could import the other.\nexport * from './enrollment-basis'\n// Reading the FILE a merchant arrives with (`docs/specs/email-competitive-gaps.md`\n// G5/P4), directly after the policy it hands its addresses to: parsing and\n// mechanical screening only, so that an import asks the enrollment question\n// through the same module the one-address add path asks it through rather\n// than answering it a second way.\n// The dynamic-list rule (§3b/§3c), beside it for the same reasons: pure, and\n// it composes `contacts` for the segment vocabulary rather than restating it.\nexport * from './dynamic-list-rule'\n// The subscribable streams a recipient can leave one at a time\n// (`docs/specs/email-competitive-gaps.md` §1f). Pure, and read from all three\n// sides of the feature: the composer picks one, the send path signs it into\n// the unsubscribe link, and the unauthenticated preference page renders the\n// catalog. No Node builtin, so it stays out of the `/server`-only group.\nexport * from './subscription-topics'\nexport * from './compose-layout-nodes'\n// Layout properties applied through the chain (AGL-2893).\nexport * from './compose-layout-props'\n// A screen's per-page restyling of its layout's elements (AGL-3286).\nexport * from './layout-style-overrides'\nexport * from './document-landmark'\nexport * from './functions'\nexport * from './compose-reusable-components'\n// Where a reusable component is placed — pages or emails (AGL-3287).\nexport * from './reusable-component-kind'\nexport * from './compress'\nexport * from './merge-node-sx'\nexport * from './palette-sx'\nexport * from './scheme-sx'\n// An element pinned to one color scheme (AGL-3284).\nexport * from './element-color-scheme'\nexport * from './create-resource-uid'\nexport * from './decompress'\nexport * from './stored-nodes'\nexport * from './strip-undefined'\nexport * from './organizations'\nexport * from './org-permissions'\n// The AI verdict on either membership axis (AGL-2927). After both modules it\n// composes: the org catalog for org-wide members, the host role for site\n// collaborators.\nexport * from './host-permissions'\nexport * from './password-policy'\nexport * from './idp-profile'\nexport * from './onboarding-deep-link'\n// The platform team's ask that a workspace buy a plan (AGL-3466), beside the\n// plan intent its button carries into Billing.\nexport * from './upgrade-proposal'\n// Where an account came from (AGL-1731). Beside the plan intent because\n// they are the same hop — the marketing CTA's query string — and both are\n// remembered on `users/{uid}` across the verification wall.\nexport * from './utm-attribution'\n// What a record is filed under: the edge between a container a plugin keeps\n// (a campaign) and the forms, screens and contacts it gathers. Beside the\n// attribution above because the two answer opposite questions: attribution\n// records where somebody CAME from, this records what a merchant DECLARED\n// belongs together.\nexport * from './container-membership'\nexport * from './deployment-shape'\n// Which browser origins may complete a signed direct-to-GCS upload (AGL-1452).\n// GCS matches the origin list EXACTLY, so every serving console name needs its\n// own entry — the rule nobody could be expected to remember at attach time.\nexport * from './upload-cors'\n// The docs-help subset the first-party plugin consoles read (AGL-2213) — the\n// console's own registry lives in apps/console/constants and a lib cannot\n// import an app.\nexport * from './docs-help'\nexport * from './platform-brand'\nexport * from './plan-entitlements'\n// The free plan's bandwidth hard cap (AGL-1967/2070/2155). After\n// `plan-entitlements`, which owns the predicate it keys off.\nexport * from './bandwidth-cap'\n// Video and file delivery as bandwidth (AGL-3474), in the band's own units.\nexport * from './media-bandwidth'\n// The month every monthly counter is keyed by, and the boundary it lifts on.\nexport * from './utc-month'\nexport * from './forms'\n// What a form's DESIGN must still satisfy for its submissions to arrive.\n// After `forms`, whose field walk it reads the drawn fields with.\nexport * from './form-contract'\nexport * from './visitor-record-ceiling'\nexport * from './health-report'\n// Did a webhook delivery actually DO anything (AGL-1954)? After\n// `health-report`, whose billing verdict consumes the counts this produces.\nexport * from './webhook-delivery'\nexport * from './support-tiers'\n// Site Care requests (AGL-3959): the arithmetic, and the two modules any\n// staff-recorded, approval-gated charge reuses (AGL-3970).\nexport * from './site-care'\nexport * from './owner-approval-record'\nexport * from './append-only-history'\n// Site Care projects (AGL-3970): the flat quote, its split and its record.\nexport * from './site-care-project'\nexport * from './release-flags'\n// Who runs THIS deployment, and where its notices go (AGL-2016). Ordered\n// before the four surfaces that print it, all of which used to declare their\n// own `support@aglyn.com` literal.\nexport * from './operator-identity'\nexport * from './lockdown'\nexport * from './media-quarantine'\nexport * from './media-takedown-reach'\nexport * from './upload-inspection'\nexport * from './abuse-report'\n// The other three quarters of §512 (AGL-1983): the put-back procedure that\n// answers a notice, and the strike ledger that conditions the safe harbour.\nexport * from './dmca-counter-notice'\nexport * from './repeat-infringer'\n// `addBusinessDays` briefly existed TWICE — once here in './support-tiers'\n// and once in './dmca-counter-notice' — and two `export *` made the name\n// ambiguous, TS2308'ing this barrel and every tsconfig that reads it. The\n// interleave was fixed twice in parallel: once by naming a winner here, and\n// once by deleting the second definition so './dmca-counter-notice' imports\n// this one. Only the deletion survives, so the disambiguating re-export that\n// stood on this line is gone with it — `export *` is unambiguous again.\n//\n// The concern that argued for keeping two copies is worth answering rather\n// than dropping: a later tweak to the SUPPORT SLA window must never silently\n// move the §512(g)(2)(C) put-back deadline. It cannot. This function embeds\n// no window — it is \"add N business days\", and N is the argument. The two\n// windows live in their own constants (`SUPPORT_*` there,\n// `COUNTER_NOTICE_*_BUSINESS_DAYS` in the DMCA module) and never meet. What\n// SHOULD stay shared is the day arithmetic itself: two copies of a weekend\n// rule are two chances to disagree about which day a deadline falls on.\nexport * from './org-override-reason'\nexport * from './host-tokens'\nexport * from './variables'\n// What happened on a site that an automation can start on: the platform's\n// own event and the ones plugins declare (AGL-3080).\nexport * from './host-events'\nexport * from './expand-repeatables'\nexport * from './org-roles'\nexport * from './markdown-lite'\nexport * from './notifications'\n// The operator alert registry (AGL-3377); OPERATOR_ALERT_NOTIFICATION_TYPES\n// lives here now, derived from it.\nexport * from './operator-alerts'\nexport * from './definition-canvas-tree'\nexport * from './ensure-canvas-root'\nexport * from './repair-canvas-nodes'\nexport * from './detect-template-placeholders'\nexport * from './guarded-version-save'\nexport * from './local-storage-budget'\nexport * from './measure-node-map'\nexport * from './resolve-named-tokens'\nexport * from './screen-route'\nexport * from './host-naming'\nexport * from './name-search'\nexport * from './artifact-list-keys'\nexport * from './name-match'\nexport * from './api-plugins'\nexport * from './plugin-api-rate-limit'\n// The same-origin gate on visitor-facing plugin writes (AGL-1880). After\n// `plugin-api-rate-limit`, whose `isMachinePluginApiPath` it reuses so the\n// two gates exempt exactly the same machine surfaces.\nexport * from './plugin-api-cross-origin'\n// What a published page does when a visitor does something (AGL-3080): the\n// platform's interaction vocabulary, which the workflows plugin builds its\n// automations on.\nexport * from './site-interactions'\nexport * from './element-animation'\nexport * from './attribution-guard'\nexport * from './node-interactions'\nexport * from './element-ui'\nexport * from './image-upload-types'\nexport * from './sanitize-svg'\nexport * from './media-folders'\nexport * from './media-metadata'\nexport * from './media-ref'\nexport * from './rendered-widths'\n// After `media-ref`, whose reference grammar it reads stored URLs with.\nexport * from './paid-media-source'\nexport * from './author-css'\n// The isomorphic HTML rule (AGL-1901), after the CSS one it depends on.\nexport * from './author-html'\nexport * from './csv'\nexport * from './csv-upload'\nexport * from './artifact-provenance'\nexport * from './repeat-query'\nexport * from './plugin-manifest'\n// After `plugin-manifest`, whose revocation predicates it asks the kill\n// question with, and after `media-ref`, whose grammar decides what counts as a\n// first-party image.\nexport * from './email-starter-policy'\nexport * from './safe-json-ld'\n// Agent readiness (AGL-2716): content negotiation, the Markdown rendering of a\n// page, `/llms.txt` and the per-site OpenAPI document. All pure, all server-safe.\nexport * from './accept-negotiation'\nexport * from './agent-api-catalog'\nexport * from './agent-openapi'\nexport * from './author-html-markdown'\nexport * from './llms-txt'\nexport * from './page-markdown'\nexport * from './request-geo'\nexport * from './request-ip'\nexport * from './search-indexing'\nexport * from './seo-title'\nexport * from './sitemap'\nexport * from './visitor-consent'\nexport * from './social-image'\nexport * from './scope-tokens'\nexport * from './org-billing-doc'\nexport * from './stripe-deployment-mode'\nexport * from './deferred-image'\n"],"names":["csvCell","csvDocument","customImportTarget","customImportTargetKey","importNoMailServerSentence"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GACD,cAAc,6BAAyB;AACvC,cAAc,sBAAkB;AAChC,cAAc,0BAAsB;AACpC,yEAAyE;AACzE,uEAAuE;AACvE,cAAc,0BAAsB;AACpC,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,cAAc,oBAAgB;AAC9B,6EAA6E;AAC7E,2EAA2E;AAC3E,cAAc,gBAAY;AAC1B,cAAc,yBAAqB;AACnC,cAAc,0BAAsB;AACpC,cAAc,uBAAmB;AACjC,cAAc,uBAAmB;AACjC,cAAc,uBAAmB;AACjC,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,+EAA+E;AAC/E,+CAA+C;AAC/C,cAAc,4BAAwB;AACtC,cAAc,2BAAuB;AACrC,cAAc,8BAA0B;AACxC,cAAc,gBAAY;AAC1B,cAAc,sBAAkB;AAChC,cAAc,8BAA0B;AACxC,wEAAwE;AACxE,4EAA4E;AAC5E,cAAc,oBAAgB;AAC9B,8EAA8E;AAC9E,+EAA+E;AAC/E,0CAA0C;AAC1C,cAAc,iCAA6B;AAC3C,cAAc,sBAAkB;AAChC,sEAAsE;AACtE,uDAAuD;AACvD,cAAc,yBAAqB;AACnC,wEAAwE;AACxE,iEAAiE;AACjE,cAAc,uBAAmB;AACjC,cAAc,0BAAsB;AACpC,cAAc,gBAAY;AAC1B,0EAA0E;AAC1E,2EAA2E;AAC3E,cAAc,mBAAe;AAC7B,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,cAAc,iBAAa;AAC3B,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,2DAA2D;AAC3D,cAAc,WAAO;AACrB,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,wCAAwC;AACxC,cAAc,2BAAuB;AACrC,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,cAAc,sBAAkB;AAChC,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,SAAS;AACT,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,0BAA0B;AAC1B,cAAc,kBAAc;AAC5B,cAAc,2BAAuB;AACrC,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,cAAc,4BAAwB;AACtC,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,SAAS;AACT,SACEA,OAAO,EACPC,WAAW,EACXC,kBAAkB,EAClBC,qBAAqB,EACrBC,0BAA0B,QACrB,kBAAc;AAMrB,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,cAAc,6BAAyB;AACvC,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,cAAc;AACd,cAAc,sBAAkB;AAChC,cAAc,yBAAqB;AACnC,2EAA2E;AAC3E,yDAAyD;AACzD,cAAc,yBAAqB;AACnC,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,cAAc,wBAAoB;AAClC,mFAAmF;AACnF,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,kCAAkC;AAClC,6EAA6E;AAC7E,8EAA8E;AAC9E,cAAc,yBAAqB;AACnC,+DAA+D;AAC/D,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,cAAc,2BAAuB;AACrC,cAAc,4BAAwB;AACtC,0DAA0D;AAC1D,cAAc,4BAAwB;AACtC,qEAAqE;AACrE,cAAc,8BAA0B;AACxC,cAAc,yBAAqB;AACnC,cAAc,iBAAa;AAC3B,cAAc,mCAA+B;AAC7C,qEAAqE;AACrE,cAAc,+BAA2B;AACzC,cAAc,gBAAY;AAC1B,cAAc,qBAAiB;AAC/B,cAAc,kBAAc;AAC5B,cAAc,iBAAa;AAC3B,oDAAoD;AACpD,cAAc,4BAAwB;AACtC,cAAc,2BAAuB;AACrC,cAAc,kBAAc;AAC5B,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,cAAc,qBAAiB;AAC/B,cAAc,uBAAmB;AACjC,6EAA6E;AAC7E,yEAAyE;AACzE,iBAAiB;AACjB,cAAc,wBAAoB;AAClC,cAAc,uBAAmB;AACjC,cAAc,mBAAe;AAC7B,cAAc,4BAAwB;AACtC,6EAA6E;AAC7E,+CAA+C;AAC/C,cAAc,wBAAoB;AAClC,wEAAwE;AACxE,0EAA0E;AAC1E,4DAA4D;AAC5D,cAAc,uBAAmB;AACjC,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,oBAAoB;AACpB,cAAc,4BAAwB;AACtC,cAAc,wBAAoB;AAClC,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc,mBAAe;AAC7B,6EAA6E;AAC7E,0EAA0E;AAC1E,iBAAiB;AACjB,cAAc,iBAAa;AAC3B,cAAc,sBAAkB;AAChC,cAAc,yBAAqB;AACnC,iEAAiE;AACjE,6DAA6D;AAC7D,cAAc,qBAAiB;AAC/B,4EAA4E;AAC5E,cAAc,uBAAmB;AACjC,6EAA6E;AAC7E,cAAc,iBAAa;AAC3B,cAAc,aAAS;AACvB,yEAAyE;AACzE,kEAAkE;AAClE,cAAc,qBAAiB;AAC/B,cAAc,8BAA0B;AACxC,cAAc,qBAAiB;AAC/B,gEAAgE;AAChE,4EAA4E;AAC5E,cAAc,wBAAoB;AAClC,cAAc,qBAAiB;AAC/B,yEAAyE;AACzE,2DAA2D;AAC3D,cAAc,iBAAa;AAC3B,cAAc,6BAAyB;AACvC,cAAc,2BAAuB;AACrC,2EAA2E;AAC3E,cAAc,yBAAqB;AACnC,cAAc,qBAAiB;AAC/B,yEAAyE;AACzE,6EAA6E;AAC7E,mCAAmC;AACnC,cAAc,yBAAqB;AACnC,cAAc,gBAAY;AAC1B,cAAc,wBAAoB;AAClC,cAAc,4BAAwB;AACtC,cAAc,yBAAqB;AACnC,cAAc,oBAAgB;AAC9B,2EAA2E;AAC3E,4EAA4E;AAC5E,cAAc,2BAAuB;AACrC,cAAc,wBAAoB;AAClC,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,0DAA0D;AAC1D,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,cAAc,2BAAuB;AACrC,cAAc,mBAAe;AAC7B,cAAc,iBAAa;AAC3B,0EAA0E;AAC1E,qDAAqD;AACrD,cAAc,mBAAe;AAC7B,cAAc,0BAAsB;AACpC,cAAc,iBAAa;AAC3B,cAAc,qBAAiB;AAC/B,cAAc,qBAAiB;AAC/B,4EAA4E;AAC5E,mCAAmC;AACnC,cAAc,uBAAmB;AACjC,cAAc,8BAA0B;AACxC,cAAc,0BAAsB;AACpC,cAAc,2BAAuB;AACrC,cAAc,oCAAgC;AAC9C,cAAc,4BAAwB;AACtC,cAAc,4BAAwB;AACtC,cAAc,wBAAoB;AAClC,cAAc,4BAAwB;AACtC,cAAc,oBAAgB;AAC9B,cAAc,mBAAe;AAC7B,cAAc,mBAAe;AAC7B,cAAc,0BAAsB;AACpC,cAAc,kBAAc;AAC5B,cAAc,mBAAe;AAC7B,cAAc,6BAAyB;AACvC,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AACtD,cAAc,+BAA2B;AACzC,2EAA2E;AAC3E,2EAA2E;AAC3E,kBAAkB;AAClB,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,kBAAc;AAC5B,cAAc,0BAAsB;AACpC,cAAc,oBAAgB;AAC9B,cAAc,qBAAiB;AAC/B,cAAc,sBAAkB;AAChC,cAAc,iBAAa;AAC3B,cAAc,uBAAmB;AACjC,wEAAwE;AACxE,cAAc,yBAAqB;AACnC,cAAc,kBAAc;AAC5B,wEAAwE;AACxE,cAAc,mBAAe;AAC7B,cAAc,WAAO;AACrB,cAAc,kBAAc;AAC5B,cAAc,2BAAuB;AACrC,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,wEAAwE;AACxE,+EAA+E;AAC/E,qBAAqB;AACrB,cAAc,4BAAwB;AACtC,cAAc,oBAAgB;AAC9B,+EAA+E;AAC/E,kFAAkF;AAClF,cAAc,0BAAsB;AACpC,cAAc,yBAAqB;AACnC,cAAc,qBAAiB;AAC/B,cAAc,4BAAwB;AACtC,cAAc,gBAAY;AAC1B,cAAc,qBAAiB;AAC/B,cAAc,mBAAe;AAC7B,cAAc,kBAAc;AAC5B,cAAc,uBAAmB;AACjC,cAAc,iBAAa;AAC3B,cAAc,eAAW;AACzB,cAAc,uBAAmB;AACjC,cAAc,oBAAgB;AAC9B,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,cAAc,8BAA0B;AACxC,cAAc,sBAAkB"}

package/src/lib/app-utils/site-care-project.d.ts

@@ -0,0 +1,227 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type OwnerApprovalRecord } from './owner-approval-record';
+/**
+ * SITE CARE PROJECTS: THE ARITHMETIC AND THE RECORD (AGL-3970).
+ *
+ * Site Care covers changes to what a site already has. Work that adds
+ * something — a page, a form, a design, a campaign — is a PROJECT, billed as
+ * one flat quote from the staff "Charge for work" on the staff organization
+ * page, on a one-off Stripe invoice the owner pays from their phone. This
+ * module is everything about that which needs no Firestore and no Stripe:
+ * the quote, the split, where a project stands, and the sentences the owner
+ * reads. The server module (`@aglyn/tenant-data-admin/server/site-care-projects`),
+ * the staff card, the owner's Billing card and the reconciliation all read
+ * it, so they cannot disagree.
+ *
+ * ## The rules, from the Decision Log of 2026-10-19
+ *
+ * - The quote is the estimated hours × `SITE_CARE_EXTRA_HOUR_USD`, the
+ *   hours rounded UP to the whole hour, and never below the published
+ *   starting price of the project's kind. Staff may raise it, never lower
+ *   it. It is one number, given before work starts and fixed once given.
+ * - Priced above `SITE_CARE_PROJECT_SPLIT_ABOVE_USD`, it is billed half up
+ *   front and half at launch: two invoices from the same record. At or
+ *   below, in full up front.
+ * - Nothing is invoiced without the owner's recorded yes to THIS quote
+ *   (`owner-approval-record`): change the quote and the yes must be
+ *   recorded again.
+ * - Scope and price are edited, with a reason, only until the first invoice
+ *   is sent. After that a wrong invoice is voided, credited or refunded from
+ *   the record, and a new price is a new project.
+ */
+/** The kinds a project can be, each with its published starting price. */
+export declare const SITE_CARE_PROJECT_KINDS: readonly ["landingPage", "redesign", "brandKit", "other"];
+export type SiteCareProjectKind = (typeof SITE_CARE_PROJECT_KINDS)[number];
+/**
+ * The floor each kind's quote may not go below. `other` (a form, photos,
+ * copy, ads) has no published starting price, so its floor is the hourly
+ * rate alone: one hour at least.
+ */
+export declare const SITE_CARE_PROJECT_FLOOR_USD: Readonly<Record<SiteCareProjectKind, number>>;
+/** The kind as a picker labels it. */
+export declare const SITE_CARE_PROJECT_KIND_LABELS: Readonly<Record<SiteCareProjectKind, string>>;
+/** Every project line carries the code every live Aglyn product carries. */
+export declare const SITE_CARE_PROJECT_TAX_CODE = "txcd_10103001";
+/** The longest estimate a quote takes, in hours. */
+export declare const SITE_CARE_PROJECT_MAX_HOURS = 400;
+/** The highest price a quote takes, in whole dollars. */
+export declare const SITE_CARE_PROJECT_MAX_USD = 50000;
+export declare const SITE_CARE_PROJECT_TITLE_MAX = 120;
+export declare const SITE_CARE_PROJECT_SCOPE_LINES_MAX = 20;
+export declare const SITE_CARE_PROJECT_SCOPE_LINE_MAX = 200;
+/**
+ * How long the owner has to pay a sent invoice. Stripe requires a due date
+ * on an invoice it does not charge automatically; the pay link works from
+ * the moment it is sent.
+ */
+export declare const SITE_CARE_PROJECT_INVOICE_DAYS_UNTIL_DUE = 14;
+export type SiteCareProjectSplit = 'full' | 'half';
+/** Which invoice of a project: the whole price, or one of its halves. */
+export type SiteCareProjectInvoiceKind = 'full' | 'deposit' | 'final';
+/**
+ * Where one invoice stands, as the platform recorded it. `creating` is
+ * written BEFORE the Stripe calls, so a call that succeeded with no row
+ * behind it shows as `creating` — which the reconciliation reports and a
+ * retry settles under the same idempotency key.
+ */
+export type SiteCareProjectInvoiceStatus = 'creating' | 'failed' | 'open' | 'paid' | 'voided' | 'credited' | 'refunded';
+/** Where the project stands, derived from its record (never typed in). */
+export type SiteCareProjectStatus = 'quoted' | 'accepted' | 'invoiced' | 'deposit-paid' | 'launched' | 'paid' | 'refunded';
+export declare const SITE_CARE_PROJECT_STATUS_LABELS: Readonly<Record<SiteCareProjectStatus, string>>;
+export interface SiteCareProjectQuote {
+    kind: SiteCareProjectKind;
+    /** The hours staff estimated, as typed. */
+    estimatedHours: number;
+    /** The estimate rounded up to the whole hour. */
+    billedHours: number;
+    rateUsd: number;
+    floorUsd: number;
+    /** `max(billedHours × rate, floor)`: the least the quote may be. */
+    computedUsd: number;
+    /** The flat price: `computedUsd`, or more if staff rounded it up. */
+    priceUsd: number;
+    split: SiteCareProjectSplit;
+}
+export interface SiteCareProjectInvoice {
+    /** 1 for the first invoice the project raised; each later one is higher. */
+    seq: number;
+    kind: SiteCareProjectInvoiceKind;
+    status: SiteCareProjectInvoiceStatus;
+    /** Before tax, in cents. */
+    amountCents: number;
+    /** The line's description, exactly as it was sent. */
+    description: string;
+    /** The key every Stripe write for this invoice derives from. */
+    idempotencyKey: string;
+    invoiceId: string | null;
+    invoiceItemId: string | null;
+    number: string | null;
+    hostedInvoiceUrl: string | null;
+    /** The finalized total, tax included, in cents. */
+    totalCents: number;
+    amountPaidCents: number;
+    creditNoteId: string | null;
+    refundId: string | null;
+    error: string | null;
+    createdAtMs: number;
+    updatedAtMs: number;
+    paidAtMs: number | null;
+}
+/** The owner's yes to a quote: the shared record, pinned to the quote it agreed to. */
+export type SiteCareProjectAcceptance = OwnerApprovalRecord & {
+    /** The quote version the owner said yes to. */
+    quoteVersion: number;
+    priceUsd: number;
+};
+export interface SiteCareProject {
+    orgId: string;
+    title: string;
+    /** One line per deliverable, plain text. */
+    scope: string[];
+    quote: SiteCareProjectQuote;
+    /** 1 for the first quote; each edit is one higher. */
+    quoteVersion: number;
+    acceptance: SiteCareProjectAcceptance | null;
+    invoices: SiteCareProjectInvoice[];
+    invoiceSeq: number;
+    /** When the first invoice reached the owner; the quote is fixed from then. */
+    firstInvoiceSentAtMs: number | null;
+    launchedAtMs: number | null;
+    launchedByUid: string | null;
+    status: SiteCareProjectStatus;
+    createdAtMs: number;
+    createdByUid: string | null;
+    createdByEmail: string | null;
+    updatedAtMs: number;
+}
+export type SiteCareProjectResult<T> = ({
+    ok: true;
+} & T) | {
+    ok: false;
+    error: string;
+};
+/** A project with a price above the line is billed half and half. */
+export declare function siteCareProjectSplit(priceUsd: number): SiteCareProjectSplit;
+/** The estimate rounded up to the whole hour, ignoring float dust (2.0000001 is 2). */
+export declare function siteCareProjectBilledHours(estimatedHours: number): number;
+/**
+ * The quote from what staff typed: hours, a kind, and optionally a price
+ * above the computed one. A price below it is refused, never lowered to.
+ */
+export declare function siteCareProjectQuote(input: {
+    kind: unknown;
+    estimatedHours: unknown;
+    priceUsd?: unknown;
+}): SiteCareProjectResult<{
+    quote: SiteCareProjectQuote;
+}>;
+/** The invoices a quote is billed on, in order, with their amounts in cents. */
+export declare function siteCareProjectInvoicePlan(quote: Pick<SiteCareProjectQuote, 'priceUsd' | 'split'>): Array<{
+    kind: SiteCareProjectInvoiceKind;
+    amountCents: number;
+}>;
+/** The amount of one invoice of a quote, in cents. */
+export declare function siteCareProjectInvoiceAmount(quote: Pick<SiteCareProjectQuote, 'priceUsd' | 'split'>, kind: SiteCareProjectInvoiceKind): number;
+/** A trimmed title, or an error. */
+export declare function readSiteCareProjectTitle(raw: unknown): SiteCareProjectResult<{
+    title: string;
+}>;
+/**
+ * Scope lines from a list or from text with one deliverable per line: each
+ * trimmed, blanks dropped, bullets stripped, at least one.
+ */
+export declare function readSiteCareProjectScope(raw: unknown): SiteCareProjectResult<{
+    scope: string[];
+}>;
+/** A stored project read back with every field present, or null when it is not one. */
+export declare function readSiteCareProject(value: unknown): SiteCareProject | null;
+/** The newest invoice of a kind, whatever its status. */
+export declare function latestSiteCareProjectInvoice(project: Pick<SiteCareProject, 'invoices'>, kind: SiteCareProjectInvoiceKind): SiteCareProjectInvoice | null;
+/** Whether the owner's recorded yes is to the quote as it stands. */
+export declare function siteCareProjectAcceptanceIsCurrent(project: Pick<SiteCareProject, 'acceptance' | 'quoteVersion'>): boolean;
+/** Where a project stands, from its acceptance, invoices and launch. */
+export declare function siteCareProjectStatus(project: Pick<SiteCareProject, 'acceptance' | 'quoteVersion' | 'invoices' | 'launchedAtMs' | 'quote'>): SiteCareProjectStatus;
+/**
+ * Whether scope and price may still change: until the first invoice
+ * reaches the owner, and never while one is being made.
+ */
+export declare function siteCareProjectQuoteIsEditable(project: Pick<SiteCareProject, 'firstInvoiceSentAtMs' | 'invoices'>): boolean;
+/**
+ * The invoice the project may raise now, or why it may not. The first is
+ * raised on the owner's current yes; the balance of a half-and-half project
+ * only once it is launched and its deposit is paid.
+ */
+export declare function siteCareProjectNextInvoice(project: Pick<SiteCareProject, 'acceptance' | 'quoteVersion' | 'invoices' | 'launchedAtMs' | 'quote'>): SiteCareProjectResult<{
+    kind: SiteCareProjectInvoiceKind;
+    amountCents: number;
+}>;
+/** "deposit", "balance", "invoice": what an invoice is to the owner. */
+export declare function siteCareProjectInvoiceWords(kind: SiteCareProjectInvoiceKind): string;
+/** How the quote is billed, in one sentence the owner reads. */
+export declare function siteCareProjectSplitSentence(quote: Pick<SiteCareProjectQuote, 'priceUsd' | 'split'>): string;
+/** The Stripe line's description for one invoice of a project. */
+export declare function siteCareProjectInvoiceDescription(project: Pick<SiteCareProject, 'title' | 'quote'>, kind: SiteCareProjectInvoiceKind): string;
+/** The invoice's memo: what the price covers, one deliverable per line. */
+export declare function siteCareProjectInvoiceMemo(project: Pick<SiteCareProject, 'scope'>): string;
+/**
+ * The acceptance confirmation's one sentence, in the owner's words: what
+ * they agreed to, how and when.
+ */
+export declare function siteCareProjectAcceptanceSentence(record: Pick<OwnerApprovalRecord, 'channel' | 'approvedAtMs'>, project: Pick<SiteCareProject, 'title' | 'quote'>, formatDate: (ms: number) => string): string;
+/** What the owner sees for one invoice on Billing. */
+export declare function siteCareProjectInvoiceLine(invoice: SiteCareProjectInvoice): string;