@aglyn/plugins-email 1.0.0-beta.143

package/src/lib/model/sending-domain-status.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** The four states a record can be stored in. */
+export type SendingDomainStatusId = 'requested' | 'records-issued' | 'verified' | 'failed';
+export interface SendingDomainStateView {
+    /** Two or three words, for a chip. */
+    label: string;
+    color: 'default' | 'info' | 'success' | 'warning' | 'error';
+    severity: 'info' | 'success' | 'warning' | 'error';
+    /** What is true, and what to do about it, in the customer's terms. */
+    text: string;
+    /** Whether mail can leave on this domain right now. */
+    sending: boolean;
+}
+/**
+ * One stored state, described.
+ *
+ * `pendingProvider` splits `requested` in two, and the split matters: both
+ * are "no records yet", but one is a deployment that cannot issue signing
+ * keys at all and the other is a claim whose issuing call has not happened or
+ * did not succeed. Telling a customer to publish records that do not exist is
+ * the failure the whole `records-issued` gate is arranged against, and saying
+ * "your DNS is wrong" to an operator whose credential is missing points the
+ * sentence at the wrong person entirely.
+ */
+export declare function describeSendingDomain(input: {
+    status: SendingDomainStatusId;
+    /** Set when this deployment has no credential that can issue a key. */
+    pendingProvider?: boolean;
+    /** A short code from the provider driver's fixed vocabulary. */
+    issueError?: string | null;
+    /** Record keys the last conclusive lookup did not see. */
+    missing?: readonly string[] | null;
+}): SendingDomainStateView;
+/**
+ * THE FIFTH SITUATION, and the one that is not a status.
+ *
+ * Held in the surface's own state after a check that nobody answered, and
+ * rendered NEXT TO the stored state rather than in place of it. The record is
+ * untouched, the previous conclusion still stands, and the only honest thing
+ * to say is that the question could not be asked.
+ */
+export declare const INCONCLUSIVE_CHECK: {
+    label: string;
+    color: "default";
+    severity: "info";
+    text: string;
+};
+/**
+ * WHAT REMOVING ONE SENDING DOMAIN DOES TO THE SITE USING IT.
+ *
+ * Here for the reason {@link describeSendingDomain} is: the domain's own page
+ * and the row menu on the list both ask to remove the same record, and two
+ * confirmations describing one action differently is how a merchant comes to
+ * dismiss the harsher one as boilerplate.
+ *
+ * ## Three answers, because releasing a claim does three different things
+ *
+ * `resolveHostSendingIdentity` reads WHOSE name a selection is from the domain
+ * itself, so what a removal costs depends on which of the three the site is
+ * standing on:
+ *
+ *   - a domain the CUSTOMER owns, currently in use. It stops sending
+ *     altogether, receipts included. That is deliberate rather than a gap: the
+ *     customer published records saying what their recipients would see, and
+ *     falling back to any other address would contradict them.
+ *   - a domain WE set up, currently in use. It drops to the shared pool, so
+ *     all of its mail carries on, on an address whose reputation is shared.
+ *   - a domain nothing is sending as. The claim and the key go; no mail moves.
+ *
+ * Printing the harshest of the three for all of them would be the surface
+ * warning about a consequence that is not going to happen, which is the same
+ * failure as printing the gentlest.
+ */
+export declare function describeSendingDomainRemoval(input: {
+    domain: string;
+    /** The domain this site currently sends as, as the route reported it. */
+    selected?: string | null;
+    /** The site's own platform-provisioned domain, or `''` when it has none. */
+    platformDomain?: string | null;
+}): {
+    title: string;
+    description: string;
+    confirmationText: string;
+};

package/src/lib/model/sending-domain-status.js

@@ -0,0 +1,196 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHAT EACH SENDING-DOMAIN STATE LOOKS LIKE, said once.
+ *
+ * The list and the domain's own page both render a state, and they must not
+ * describe the same record differently — a chip saying Verified beside a page
+ * saying Not published is the kind of disagreement that makes a customer stop
+ * believing either. One module, read twice.
+ *
+ * ## THE DISTINCTION THIS FILE EXISTS FOR
+ *
+ * `inconclusive` is not `failed`, and it is not a stored status either.
+ *
+ * A stored status is the conclusion of a lookup that got answers.
+ * `inconclusive` is what happens when NOBODY ANSWERED — a resolver outage, a
+ * timeout, a zone that is temporarily unreachable. It is evidence of nothing,
+ * so `verifySendingDomain` writes only the check time and leaves the status
+ * exactly where it was, and the route answers `503` rather than `200 with
+ * verified: false`.
+ *
+ * Rendering it as a failure would be the most expensive mistake this surface
+ * could make. A customer whose DNS is perfect would be told their records are
+ * missing, and would go and edit a zone that has nothing wrong with it —
+ * possibly breaking the records that were already right. So it is modeled
+ * here as a SEPARATE, TRANSIENT layer that sits beside the stored status
+ * without replacing it: {@link describeSendingDomain} keeps reporting
+ * `records-issued` or `verified`, and {@link INCONCLUSIVE_CHECK} is what the
+ * surface adds next to it.
+ *
+ * ## THE OTHER DISTINCTION: A CLAIM THAT IS WAITING IS NOT A CLAIM THAT FAILED
+ *
+ * A dedicated platform subdomain is claimed when a merchant asks for one, and
+ * the claim is filled only if the mail provider's account-wide domain
+ * allowance has room. When it does not, the claim is refused before any call
+ * is made and `at-capacity` is stored where a provider refusal would go.
+ *
+ * The record cannot tell those two apart — both leave a `requested` domain
+ * with a reason and no key — but the reader has to, because the sentences
+ * point at different people. A provider refusal is a fault to retry; this is a
+ * queue, nothing is broken, and the retry does not move it until we have
+ * bought more allowance. Describing it as a failed key request would tell a
+ * merchant their sending setup is broken when the only thing that happened is
+ * that they are waiting for something they were never promised outright.
+ */ import { SENDING_DOMAIN_AT_CAPACITY } from "@aglyn/shared-util-email";
+/**
+ * One stored state, described.
+ *
+ * `pendingProvider` splits `requested` in two, and the split matters: both
+ * are "no records yet", but one is a deployment that cannot issue signing
+ * keys at all and the other is a claim whose issuing call has not happened or
+ * did not succeed. Telling a customer to publish records that do not exist is
+ * the failure the whole `records-issued` gate is arranged against, and saying
+ * "your DNS is wrong" to an operator whose credential is missing points the
+ * sentence at the wrong person entirely.
+ */ export function describeSendingDomain(input) {
+    switch(input == null ? void 0 : input.status){
+        case 'verified':
+            return {
+                label: 'Verified',
+                color: 'success',
+                severity: 'success',
+                text: 'Every required record is published and we can see it. Mail from ' + 'this site can leave on this domain, signed as you.',
+                sending: true
+            };
+        case 'records-issued':
+            return {
+                label: 'Publish the records',
+                color: 'info',
+                severity: 'info',
+                text: 'The records below are yours to add at whoever hosts your DNS. ' + 'They usually take a few minutes to spread, sometimes longer — ' + 'add them, then press Check DNS. Nothing sends on this domain ' + 'until they are live.',
+                sending: false
+            };
+        case 'failed':
+            var _input_missing;
+            return {
+                label: 'Records not found',
+                color: 'error',
+                severity: 'warning',
+                text: (input == null ? void 0 : (_input_missing = input.missing) == null ? void 0 : _input_missing.length) ? `We looked, and these records are not published yet: ` + `${input.missing.join(', ')}. Add them exactly as shown below ` + `and check again.` : 'We looked, and the required records are not published yet. Add ' + 'them exactly as shown below and check again.',
+                sending: false
+            };
+        default:
+            var _ref;
+            /*
+       * `requested`: claimed, with nothing to publish.
+       *
+       * An empty records table would read as our bug — which, from the
+       * customer's side, it is — so this says so in words instead. The
+       * distinction below is between a deployment that cannot issue keys and
+       * one whose attempt failed, because those are two different people's
+       * problems and only one of them is the customer's.
+       */ /*
+       * WAITING FOR ROOM, and it is neither of those two.
+       *
+       * Read FIRST, because it arrives in the same field a provider refusal
+       * does and the generic branch would otherwise print "the mail provider
+       * did not issue a signing key" about a call that was never made.
+       *
+       * Three things this has to say and the failure copy gets all three
+       * wrong: nothing is broken, nothing at a registrar is involved, and the
+       * site's account email is still going out on the shared address. It
+       * names the retry anyway — the button is on the screen either way, and
+       * a state that says nothing about the one control beside it invites the
+       * reader to assume it will help.
+       */ if (String((_ref = input == null ? void 0 : input.issueError) != null ? _ref : '') === SENDING_DOMAIN_AT_CAPACITY) {
+                return {
+                    label: 'Waiting for room',
+                    color: 'warning',
+                    severity: 'info',
+                    text: 'This domain has been asked for and is waiting. We are at our ' + 'mail provider’s limit on sending domains, so it has not been ' + 'created yet — nothing here is broken and nothing at your DNS ' + 'host is involved. This site keeps sending its receipts and ' + 'account email on the shared address meanwhile; campaigns wait ' + 'with the domain. Request records will keep answering the same ' + 'way until we have room, and a domain you own instead of this ' + 'one is never held this way.',
+                    sending: false
+                };
+            }
+            if ((input == null ? void 0 : input.pendingProvider) !== false && !(input == null ? void 0 : input.issueError)) {
+                return {
+                    label: 'Waiting on a signing key',
+                    color: 'warning',
+                    severity: 'info',
+                    text: 'This domain is claimed, but no signing key has been issued for ' + 'it yet, so there is nothing to publish. This one is on us, not ' + 'on your DNS — nothing you can change at your registrar will ' + 'move it. Press Request records to try again.',
+                    sending: false
+                };
+            }
+            return {
+                label: 'Key request failed',
+                color: 'error',
+                severity: 'error',
+                text: `The mail provider did not issue a signing key for this domain ` + `(${input.issueError}). The claim is kept, so retrying costs ` + `nothing and creates no second domain — press Request records. If ` + `it keeps failing, this is ours to fix, not your DNS.`,
+                sending: false
+            };
+    }
+}
+/**
+ * THE FIFTH SITUATION, and the one that is not a status.
+ *
+ * Held in the surface's own state after a check that nobody answered, and
+ * rendered NEXT TO the stored state rather than in place of it. The record is
+ * untouched, the previous conclusion still stands, and the only honest thing
+ * to say is that the question could not be asked.
+ */ export const INCONCLUSIVE_CHECK = {
+    label: 'DNS unreachable',
+    color: 'default',
+    severity: 'info',
+    text: 'We could not reach DNS to run that check, so nothing has changed — not ' + 'the records, and not this domain’s state. This is our lookup failing, ' + 'not a problem with your zone. Try again in a few minutes.'
+};
+/**
+ * WHAT REMOVING ONE SENDING DOMAIN DOES TO THE SITE USING IT.
+ *
+ * Here for the reason {@link describeSendingDomain} is: the domain's own page
+ * and the row menu on the list both ask to remove the same record, and two
+ * confirmations describing one action differently is how a merchant comes to
+ * dismiss the harsher one as boilerplate.
+ *
+ * ## Three answers, because releasing a claim does three different things
+ *
+ * `resolveHostSendingIdentity` reads WHOSE name a selection is from the domain
+ * itself, so what a removal costs depends on which of the three the site is
+ * standing on:
+ *
+ *   - a domain the CUSTOMER owns, currently in use. It stops sending
+ *     altogether, receipts included. That is deliberate rather than a gap: the
+ *     customer published records saying what their recipients would see, and
+ *     falling back to any other address would contradict them.
+ *   - a domain WE set up, currently in use. It drops to the shared pool, so
+ *     all of its mail carries on, on an address whose reputation is shared.
+ *   - a domain nothing is sending as. The claim and the key go; no mail moves.
+ *
+ * Printing the harshest of the three for all of them would be the surface
+ * warning about a consequence that is not going to happen, which is the same
+ * failure as printing the gentlest.
+ */ export function describeSendingDomainRemoval(input) {
+    var _ref, _ref1, _ref2;
+    const domain = String((_ref = input == null ? void 0 : input.domain) != null ? _ref : '');
+    const inUse = Boolean(domain) && String((_ref1 = input == null ? void 0 : input.selected) != null ? _ref1 : '') === domain;
+    const ours = Boolean(domain) && String((_ref2 = input == null ? void 0 : input.platformDomain) != null ? _ref2 : '') === domain;
+    return {
+        title: `Remove ${domain}?`,
+        description: !inUse ? 'The claim and the signing key are dropped. The DNS records stay in ' + 'your zone — nothing is changed at your registrar — and you can add ' + 'the domain again later, which issues a new key.' : ours ? `This site is currently sending as ${domain}. Removing it moves ` + 'all of this site’s email back to the shared address, whose ' + 'delivery reputation is pooled with the other sites on it — so ' + 'campaigns there are held to tighter complaint and bounce limits. ' + 'Nothing in your own DNS is involved — we published these records ' + 'and we remove them.' : `This site is currently sending as ${domain}. Removing the domain ` + 'does not move it onto another address — not the one this site is ' + 'issued, and not the shared address. It stops this site sending at ' + 'all, receipts included, until you choose another identity. The ' + 'DNS records stay in your zone; nothing is changed at your ' + 'registrar.',
+        confirmationText: 'Remove domain'
+    };
+}
+
+//# sourceMappingURL=sending-domain-status.js.map

package/src/lib/model/sending-domain-status.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/model/sending-domain-status.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHAT EACH SENDING-DOMAIN STATE LOOKS LIKE, said once.\n *\n * The list and the domain's own page both render a state, and they must not\n * describe the same record differently — a chip saying Verified beside a page\n * saying Not published is the kind of disagreement that makes a customer stop\n * believing either. One module, read twice.\n *\n * ## THE DISTINCTION THIS FILE EXISTS FOR\n *\n * `inconclusive` is not `failed`, and it is not a stored status either.\n *\n * A stored status is the conclusion of a lookup that got answers.\n * `inconclusive` is what happens when NOBODY ANSWERED — a resolver outage, a\n * timeout, a zone that is temporarily unreachable. It is evidence of nothing,\n * so `verifySendingDomain` writes only the check time and leaves the status\n * exactly where it was, and the route answers `503` rather than `200 with\n * verified: false`.\n *\n * Rendering it as a failure would be the most expensive mistake this surface\n * could make. A customer whose DNS is perfect would be told their records are\n * missing, and would go and edit a zone that has nothing wrong with it —\n * possibly breaking the records that were already right. So it is modeled\n * here as a SEPARATE, TRANSIENT layer that sits beside the stored status\n * without replacing it: {@link describeSendingDomain} keeps reporting\n * `records-issued` or `verified`, and {@link INCONCLUSIVE_CHECK} is what the\n * surface adds next to it.\n *\n * ## THE OTHER DISTINCTION: A CLAIM THAT IS WAITING IS NOT A CLAIM THAT FAILED\n *\n * A dedicated platform subdomain is claimed when a merchant asks for one, and\n * the claim is filled only if the mail provider's account-wide domain\n * allowance has room. When it does not, the claim is refused before any call\n * is made and `at-capacity` is stored where a provider refusal would go.\n *\n * The record cannot tell those two apart — both leave a `requested` domain\n * with a reason and no key — but the reader has to, because the sentences\n * point at different people. A provider refusal is a fault to retry; this is a\n * queue, nothing is broken, and the retry does not move it until we have\n * bought more allowance. Describing it as a failed key request would tell a\n * merchant their sending setup is broken when the only thing that happened is\n * that they are waiting for something they were never promised outright.\n */\n\nimport { SENDING_DOMAIN_AT_CAPACITY } from '@aglyn/shared-util-email'\n\n/** The four states a record can be stored in. */\nexport type SendingDomainStatusId =\n  | 'requested'\n  | 'records-issued'\n  | 'verified'\n  | 'failed'\n\nexport interface SendingDomainStateView {\n  /** Two or three words, for a chip. */\n  label: string\n  color: 'default' | 'info' | 'success' | 'warning' | 'error'\n  severity: 'info' | 'success' | 'warning' | 'error'\n  /** What is true, and what to do about it, in the customer's terms. */\n  text: string\n  /** Whether mail can leave on this domain right now. */\n  sending: boolean\n}\n\n/**\n * One stored state, described.\n *\n * `pendingProvider` splits `requested` in two, and the split matters: both\n * are \"no records yet\", but one is a deployment that cannot issue signing\n * keys at all and the other is a claim whose issuing call has not happened or\n * did not succeed. Telling a customer to publish records that do not exist is\n * the failure the whole `records-issued` gate is arranged against, and saying\n * \"your DNS is wrong\" to an operator whose credential is missing points the\n * sentence at the wrong person entirely.\n */\nexport function describeSendingDomain(input: {\n  status: SendingDomainStatusId\n  /** Set when this deployment has no credential that can issue a key. */\n  pendingProvider?: boolean\n  /** A short code from the provider driver's fixed vocabulary. */\n  issueError?: string | null\n  /** Record keys the last conclusive lookup did not see. */\n  missing?: readonly string[] | null\n}): SendingDomainStateView {\n  switch (input?.status) {\n    case 'verified':\n      return {\n        label: 'Verified',\n        color: 'success',\n        severity: 'success',\n        text:\n          'Every required record is published and we can see it. Mail from ' +\n          'this site can leave on this domain, signed as you.',\n        sending: true,\n      }\n    case 'records-issued':\n      return {\n        label: 'Publish the records',\n        color: 'info',\n        severity: 'info',\n        text:\n          'The records below are yours to add at whoever hosts your DNS. ' +\n          'They usually take a few minutes to spread, sometimes longer — ' +\n          'add them, then press Check DNS. Nothing sends on this domain ' +\n          'until they are live.',\n        sending: false,\n      }\n    case 'failed':\n      return {\n        label: 'Records not found',\n        color: 'error',\n        severity: 'warning',\n        text: input?.missing?.length\n          ? `We looked, and these records are not published yet: ` +\n            `${input.missing.join(', ')}. Add them exactly as shown below ` +\n            `and check again.`\n          : 'We looked, and the required records are not published yet. Add ' +\n            'them exactly as shown below and check again.',\n        sending: false,\n      }\n    default:\n      /*\n       * `requested`: claimed, with nothing to publish.\n       *\n       * An empty records table would read as our bug — which, from the\n       * customer's side, it is — so this says so in words instead. The\n       * distinction below is between a deployment that cannot issue keys and\n       * one whose attempt failed, because those are two different people's\n       * problems and only one of them is the customer's.\n       */\n      /*\n       * WAITING FOR ROOM, and it is neither of those two.\n       *\n       * Read FIRST, because it arrives in the same field a provider refusal\n       * does and the generic branch would otherwise print \"the mail provider\n       * did not issue a signing key\" about a call that was never made.\n       *\n       * Three things this has to say and the failure copy gets all three\n       * wrong: nothing is broken, nothing at a registrar is involved, and the\n       * site's account email is still going out on the shared address. It\n       * names the retry anyway — the button is on the screen either way, and\n       * a state that says nothing about the one control beside it invites the\n       * reader to assume it will help.\n       */\n      if (String(input?.issueError ?? '') === SENDING_DOMAIN_AT_CAPACITY) {\n        return {\n          label: 'Waiting for room',\n          color: 'warning',\n          severity: 'info',\n          text:\n            'This domain has been asked for and is waiting. We are at our ' +\n            'mail provider’s limit on sending domains, so it has not been ' +\n            'created yet — nothing here is broken and nothing at your DNS ' +\n            'host is involved. This site keeps sending its receipts and ' +\n            'account email on the shared address meanwhile; campaigns wait ' +\n            'with the domain. Request records will keep answering the same ' +\n            'way until we have room, and a domain you own instead of this ' +\n            'one is never held this way.',\n          sending: false,\n        }\n      }\n      if (input?.pendingProvider !== false && !input?.issueError) {\n        return {\n          label: 'Waiting on a signing key',\n          color: 'warning',\n          severity: 'info',\n          text:\n            'This domain is claimed, but no signing key has been issued for ' +\n            'it yet, so there is nothing to publish. This one is on us, not ' +\n            'on your DNS — nothing you can change at your registrar will ' +\n            'move it. Press Request records to try again.',\n          sending: false,\n        }\n      }\n      return {\n        label: 'Key request failed',\n        color: 'error',\n        severity: 'error',\n        text:\n          `The mail provider did not issue a signing key for this domain ` +\n          `(${input.issueError}). The claim is kept, so retrying costs ` +\n          `nothing and creates no second domain — press Request records. If ` +\n          `it keeps failing, this is ours to fix, not your DNS.`,\n        sending: false,\n      }\n  }\n}\n\n/**\n * THE FIFTH SITUATION, and the one that is not a status.\n *\n * Held in the surface's own state after a check that nobody answered, and\n * rendered NEXT TO the stored state rather than in place of it. The record is\n * untouched, the previous conclusion still stands, and the only honest thing\n * to say is that the question could not be asked.\n */\nexport const INCONCLUSIVE_CHECK = {\n  label: 'DNS unreachable',\n  color: 'default' as const,\n  severity: 'info' as const,\n  text:\n    'We could not reach DNS to run that check, so nothing has changed — not ' +\n    'the records, and not this domain’s state. This is our lookup failing, ' +\n    'not a problem with your zone. Try again in a few minutes.',\n}\n\n/**\n * WHAT REMOVING ONE SENDING DOMAIN DOES TO THE SITE USING IT.\n *\n * Here for the reason {@link describeSendingDomain} is: the domain's own page\n * and the row menu on the list both ask to remove the same record, and two\n * confirmations describing one action differently is how a merchant comes to\n * dismiss the harsher one as boilerplate.\n *\n * ## Three answers, because releasing a claim does three different things\n *\n * `resolveHostSendingIdentity` reads WHOSE name a selection is from the domain\n * itself, so what a removal costs depends on which of the three the site is\n * standing on:\n *\n *   - a domain the CUSTOMER owns, currently in use. It stops sending\n *     altogether, receipts included. That is deliberate rather than a gap: the\n *     customer published records saying what their recipients would see, and\n *     falling back to any other address would contradict them.\n *   - a domain WE set up, currently in use. It drops to the shared pool, so\n *     all of its mail carries on, on an address whose reputation is shared.\n *   - a domain nothing is sending as. The claim and the key go; no mail moves.\n *\n * Printing the harshest of the three for all of them would be the surface\n * warning about a consequence that is not going to happen, which is the same\n * failure as printing the gentlest.\n */\nexport function describeSendingDomainRemoval(input: {\n  domain: string\n  /** The domain this site currently sends as, as the route reported it. */\n  selected?: string | null\n  /** The site's own platform-provisioned domain, or `''` when it has none. */\n  platformDomain?: string | null\n}): { title: string; description: string; confirmationText: string } {\n  const domain = String(input?.domain ?? '')\n  const inUse = Boolean(domain) && String(input?.selected ?? '') === domain\n  const ours = Boolean(domain) && String(input?.platformDomain ?? '') === domain\n\n  return {\n    title: `Remove ${domain}?`,\n    description: !inUse\n      ? 'The claim and the signing key are dropped. The DNS records stay in ' +\n        'your zone — nothing is changed at your registrar — and you can add ' +\n        'the domain again later, which issues a new key.'\n      : ours\n        ? `This site is currently sending as ${domain}. Removing it moves ` +\n          'all of this site’s email back to the shared address, whose ' +\n          'delivery reputation is pooled with the other sites on it — so ' +\n          'campaigns there are held to tighter complaint and bounce limits. ' +\n          'Nothing in your own DNS is involved — we published these records ' +\n          'and we remove them.'\n        : `This site is currently sending as ${domain}. Removing the domain ` +\n          'does not move it onto another address — not the one this site is ' +\n          'issued, and not the shared address. It stops this site sending at ' +\n          'all, receipts included, until you choose another identity. The ' +\n          'DNS records stay in your zone; nothing is changed at your ' +\n          'registrar.',\n    confirmationText: 'Remove domain',\n  }\n}\n"],"names":["SENDING_DOMAIN_AT_CAPACITY","describeSendingDomain","input","status","label","color","severity","text","sending","missing","length","join","String","issueError","pendingProvider","INCONCLUSIVE_CHECK","describeSendingDomainRemoval","domain","inUse","Boolean","selected","ours","platformDomain","title","description","confirmationText"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CC,GAED,SAASA,0BAA0B,QAAQ,2BAA0B;AAoBrE;;;;;;;;;;CAUC,GACD,OAAO,SAASC,sBAAsBC,KAQrC;IACC,OAAQA,yBAAAA,MAAOC,MAAM;QACnB,KAAK;YACH,OAAO;gBACLC,OAAO;gBACPC,OAAO;gBACPC,UAAU;gBACVC,MACE,qEACA;gBACFC,SAAS;YACX;QACF,KAAK;YACH,OAAO;gBACLJ,OAAO;gBACPC,OAAO;gBACPC,UAAU;gBACVC,MACE,mEACA,mEACA,kEACA;gBACFC,SAAS;YACX;QACF,KAAK;gBAKKN;YAJR,OAAO;gBACLE,OAAO;gBACPC,OAAO;gBACPC,UAAU;gBACVC,MAAML,CAAAA,0BAAAA,iBAAAA,MAAOO,OAAO,qBAAdP,eAAgBQ,MAAM,IACxB,CAAC,oDAAoD,CAAC,GACtD,GAAGR,MAAMO,OAAO,CAACE,IAAI,CAAC,MAAM,kCAAkC,CAAC,GAC/D,CAAC,gBAAgB,CAAC,GAClB,oEACA;gBACJH,SAAS;YACX;QACF;;YACE;;;;;;;;OAQC,GACD;;;;;;;;;;;;;OAaC,GACD,IAAII,eAAOV,yBAAAA,MAAOW,UAAU,mBAAI,QAAQb,4BAA4B;gBAClE,OAAO;oBACLI,OAAO;oBACPC,OAAO;oBACPC,UAAU;oBACVC,MACE,kEACA,kEACA,kEACA,gEACA,mEACA,mEACA,kEACA;oBACFC,SAAS;gBACX;YACF;YACA,IAAIN,CAAAA,yBAAAA,MAAOY,eAAe,MAAK,SAAS,EAACZ,yBAAAA,MAAOW,UAAU,GAAE;gBAC1D,OAAO;oBACLT,OAAO;oBACPC,OAAO;oBACPC,UAAU;oBACVC,MACE,oEACA,oEACA,iEACA;oBACFC,SAAS;gBACX;YACF;YACA,OAAO;gBACLJ,OAAO;gBACPC,OAAO;gBACPC,UAAU;gBACVC,MACE,CAAC,8DAA8D,CAAC,GAChE,CAAC,CAAC,EAAEL,MAAMW,UAAU,CAAC,wCAAwC,CAAC,GAC9D,CAAC,iEAAiE,CAAC,GACnE,CAAC,oDAAoD,CAAC;gBACxDL,SAAS;YACX;IACJ;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,MAAMO,qBAAqB;IAChCX,OAAO;IACPC,OAAO;IACPC,UAAU;IACVC,MACE,4EACA,2EACA;AACJ,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,SAASS,6BAA6Bd,KAM5C;;IACC,MAAMe,SAASL,eAAOV,yBAAAA,MAAOe,MAAM,mBAAI;IACvC,MAAMC,QAAQC,QAAQF,WAAWL,gBAAOV,yBAAAA,MAAOkB,QAAQ,oBAAI,QAAQH;IACnE,MAAMI,OAAOF,QAAQF,WAAWL,gBAAOV,yBAAAA,MAAOoB,cAAc,oBAAI,QAAQL;IAExE,OAAO;QACLM,OAAO,CAAC,OAAO,EAAEN,OAAO,CAAC,CAAC;QAC1BO,aAAa,CAACN,QACV,wEACA,wEACA,oDACAG,OACE,CAAC,kCAAkC,EAAEJ,OAAO,oBAAoB,CAAC,GACjE,gEACA,mEACA,sEACA,sEACA,wBACA,CAAC,kCAAkC,EAAEA,OAAO,sBAAsB,CAAC,GACnE,sEACA,uEACA,oEACA,+DACA;QACNQ,kBAAkB;IACpB;AACF"}

package/src/lib/model/template-provenance.d.ts

@@ -0,0 +1,113 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHOSE TEMPLATE IS THIS, AND IS IT STILL ANY GOOD.
+ *
+ * An email template is a besigner document, and the org reading it is not
+ * necessarily the org that wrote it: a template can be installed from a
+ * marketplace listing, in which case its content is versioned by somebody
+ * else and can be updated, rejected or withdrawn by a party outside this
+ * workspace. A surface that assumes every template is locally authored and
+ * permanently valid reads an installed one as if the org owned it.
+ *
+ * ## Provenance is not re-derived here
+ *
+ * {@link resolveProvenance} in core is the ONE reader of where an installed
+ * artifact came from, and it already tolerates every shape the install routes
+ * have written. This module asks it and adds nothing to it; a second reading
+ * of `installedFrom` would be a second answer to the same question.
+ *
+ * ## Standing is a fact about the LISTING, not about the install
+ *
+ * Whether a publisher has withdrawn a template, or had it rejected on
+ * re-review, is recorded on the marketplace listing. This page does not read
+ * listings — that would be a marketplace read on every template opened, for a
+ * fact that is usually "fine" — so an installed template's standing is
+ * `unread` unless the install path stamped an answer onto the document.
+ *
+ * `unread` is deliberately not `ok`. The difference is the whole reason this
+ * type has four states rather than a boolean: "we checked and it is fine" and
+ * "we did not check" lead a reader to the same action only when they are
+ * lucky, and a template that was killed upstream is exactly the unlucky case.
+ *
+ * ## Today every installed template reads `unread`, and that is not a bug
+ *
+ * Nothing writes `installedFrom.standing`. The install stamps
+ * `installedFrom.assurance` — whether that VERSION carried a review verdict —
+ * which is a different fact and is knowable at install time. Standing is not:
+ * a publisher withdraws or is killed AFTER somebody installed, so recording it
+ * needs a later read or a fan-out write that does not exist.
+ *
+ * What actually protects a tenant is the SEND: `loadEmailTemplate` consults
+ * the marketplace revocation record and refuses to mail from a killed
+ * template. This badge is the softer, earlier warning, and until something
+ * computes standing it correctly declines to claim one. Do not go looking for
+ * the writer — there is none yet.
+ */
+import { type ResolvedProvenance } from '@aglyn/aglyn/app-utils/marketplace-provenance';
+/** Where a template's content comes from. */
+export type TemplateOrigin = 'local' | 'installed';
+/**
+ * How this template stands with whoever publishes it.
+ *
+ * The three non-`local` values are read from what the install path stamped;
+ * none of them is computed here, because computing any of them means reading
+ * the listing.
+ */
+export type TemplateStanding = 
+/** Authored in this org. There is no publisher to stand with. */
+'local'
+/** Installed, and the publisher's current standing has not been read. */
+ | 'unread'
+/** Installed, and recorded as still offered by its publisher. */
+ | 'offered'
+/** Installed, and recorded as withdrawn, killed or rejected upstream. */
+ | 'withdrawn';
+export interface TemplateProvenance {
+    origin: TemplateOrigin;
+    standing: TemplateStanding;
+    /** The core resolver's answer, verbatim. Null for a local template. */
+    installed: ResolvedProvenance | null;
+    /**
+     * One line for the reader, or null when there is nothing worth saying.
+     *
+     * A local template gets `null`: "you wrote this" is the default assumption
+     * and repeating it on every page is noise. Everything else says what is
+     * known and, where it matters, what is not.
+     */
+    note: string | null;
+    /**
+     * This template should not be sent without checking with its publisher
+     * first. Only ever true for `withdrawn`, and the surface renders it as a
+     * warning rather than hiding the template: a message already scheduled
+     * against it is a fact the reader has to be able to see.
+     */
+    warn: boolean;
+}
+/**
+ * Reads a template screen document's provenance and standing.
+ *
+ * Takes the document rather than ids so it costs nothing: everything here is
+ * already on the screen document the detail page reads to render anything at
+ * all. A template with no install stamp is local, which is the correct
+ * reading — every template predating the marketplace was authored here.
+ */
+export declare function templateProvenance(screen: (Record<string, unknown> & {
+    installedFrom?: (Record<string, unknown> & {
+        standing?: unknown;
+    }) | null;
+}) | null | undefined): TemplateProvenance;

package/src/lib/model/template-provenance.js

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHOSE TEMPLATE IS THIS, AND IS IT STILL ANY GOOD.
+ *
+ * An email template is a besigner document, and the org reading it is not
+ * necessarily the org that wrote it: a template can be installed from a
+ * marketplace listing, in which case its content is versioned by somebody
+ * else and can be updated, rejected or withdrawn by a party outside this
+ * workspace. A surface that assumes every template is locally authored and
+ * permanently valid reads an installed one as if the org owned it.
+ *
+ * ## Provenance is not re-derived here
+ *
+ * {@link resolveProvenance} in core is the ONE reader of where an installed
+ * artifact came from, and it already tolerates every shape the install routes
+ * have written. This module asks it and adds nothing to it; a second reading
+ * of `installedFrom` would be a second answer to the same question.
+ *
+ * ## Standing is a fact about the LISTING, not about the install
+ *
+ * Whether a publisher has withdrawn a template, or had it rejected on
+ * re-review, is recorded on the marketplace listing. This page does not read
+ * listings — that would be a marketplace read on every template opened, for a
+ * fact that is usually "fine" — so an installed template's standing is
+ * `unread` unless the install path stamped an answer onto the document.
+ *
+ * `unread` is deliberately not `ok`. The difference is the whole reason this
+ * type has four states rather than a boolean: "we checked and it is fine" and
+ * "we did not check" lead a reader to the same action only when they are
+ * lucky, and a template that was killed upstream is exactly the unlucky case.
+ *
+ * ## Today every installed template reads `unread`, and that is not a bug
+ *
+ * Nothing writes `installedFrom.standing`. The install stamps
+ * `installedFrom.assurance` — whether that VERSION carried a review verdict —
+ * which is a different fact and is knowable at install time. Standing is not:
+ * a publisher withdraws or is killed AFTER somebody installed, so recording it
+ * needs a later read or a fan-out write that does not exist.
+ *
+ * What actually protects a tenant is the SEND: `loadEmailTemplate` consults
+ * the marketplace revocation record and refuses to mail from a killed
+ * template. This badge is the softer, earlier warning, and until something
+ * computes standing it correctly declines to claim one. Do not go looking for
+ * the writer — there is none yet.
+ */ /*
+ * The MODULE, not the barrel. `@aglyn/aglyn` re-exports the app-utils index,
+ * which reaches `enabled-plugins-context` and therefore React — and this
+ * model is imported by `email-events.ts`, which runs in the plugin API route's
+ * SERVER graph. Through the barrel that is a client-only module pulled into a
+ * server bundle, which `app-router-graph.spec.ts` refuses.
+ */ import { resolveProvenance } from "@aglyn/aglyn/app-utils/marketplace-provenance";
+/** The stamped standing values this reads, mapped to the states above. */ const STAMPED_STANDING = {
+    offered: 'offered',
+    listed: 'offered',
+    verified: 'offered',
+    withdrawn: 'withdrawn',
+    rejected: 'withdrawn',
+    killed: 'withdrawn',
+    revoked: 'withdrawn'
+};
+/**
+ * Reads a template screen document's provenance and standing.
+ *
+ * Takes the document rather than ids so it costs nothing: everything here is
+ * already on the screen document the detail page reads to render anything at
+ * all. A template with no install stamp is local, which is the correct
+ * reading — every template predating the marketplace was authored here.
+ */ export function templateProvenance(screen) {
+    var _ref, _STAMPED_STANDING_stamped;
+    var _screen_installedFrom;
+    const installed = resolveProvenance(screen, 'emailTemplate');
+    if (installed.state === 'unknown' || !installed.listingId) {
+        return {
+            origin: 'local',
+            standing: 'local',
+            installed: null,
+            note: null,
+            warn: false
+        };
+    }
+    const stamped = String((_ref = screen == null ? void 0 : (_screen_installedFrom = screen.installedFrom) == null ? void 0 : _screen_installedFrom.standing) != null ? _ref : '');
+    const standing = (_STAMPED_STANDING_stamped = STAMPED_STANDING[stamped]) != null ? _STAMPED_STANDING_stamped : 'unread';
+    const version = installed.version ? ` version ${installed.version}` : '';
+    return {
+        origin: 'installed',
+        standing,
+        installed,
+        note: standing === 'withdrawn' ? `Installed from a marketplace listing${version}, which its ` + 'publisher no longer offers. It still sends exactly as it is here, ' + 'but it will not receive updates and cannot be reinstalled.' : standing === 'offered' ? `Installed from a marketplace listing${version}. Its content is ` + 'versioned by its publisher, so an update can change what this ' + 'template looks like.' : `Installed from a marketplace listing${version}. Whether its ` + 'publisher still offers it has not been checked here — this page ' + 'reads the template, not the listing.',
+        warn: standing === 'withdrawn'
+    };
+}
+
+//# sourceMappingURL=template-provenance.js.map

package/src/lib/model/template-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/model/template-provenance.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHOSE TEMPLATE IS THIS, AND IS IT STILL ANY GOOD.\n *\n * An email template is a besigner document, and the org reading it is not\n * necessarily the org that wrote it: a template can be installed from a\n * marketplace listing, in which case its content is versioned by somebody\n * else and can be updated, rejected or withdrawn by a party outside this\n * workspace. A surface that assumes every template is locally authored and\n * permanently valid reads an installed one as if the org owned it.\n *\n * ## Provenance is not re-derived here\n *\n * {@link resolveProvenance} in core is the ONE reader of where an installed\n * artifact came from, and it already tolerates every shape the install routes\n * have written. This module asks it and adds nothing to it; a second reading\n * of `installedFrom` would be a second answer to the same question.\n *\n * ## Standing is a fact about the LISTING, not about the install\n *\n * Whether a publisher has withdrawn a template, or had it rejected on\n * re-review, is recorded on the marketplace listing. This page does not read\n * listings — that would be a marketplace read on every template opened, for a\n * fact that is usually \"fine\" — so an installed template's standing is\n * `unread` unless the install path stamped an answer onto the document.\n *\n * `unread` is deliberately not `ok`. The difference is the whole reason this\n * type has four states rather than a boolean: \"we checked and it is fine\" and\n * \"we did not check\" lead a reader to the same action only when they are\n * lucky, and a template that was killed upstream is exactly the unlucky case.\n *\n * ## Today every installed template reads `unread`, and that is not a bug\n *\n * Nothing writes `installedFrom.standing`. The install stamps\n * `installedFrom.assurance` — whether that VERSION carried a review verdict —\n * which is a different fact and is knowable at install time. Standing is not:\n * a publisher withdraws or is killed AFTER somebody installed, so recording it\n * needs a later read or a fan-out write that does not exist.\n *\n * What actually protects a tenant is the SEND: `loadEmailTemplate` consults\n * the marketplace revocation record and refuses to mail from a killed\n * template. This badge is the softer, earlier warning, and until something\n * computes standing it correctly declines to claim one. Do not go looking for\n * the writer — there is none yet.\n */\n\n/*\n * The MODULE, not the barrel. `@aglyn/aglyn` re-exports the app-utils index,\n * which reaches `enabled-plugins-context` and therefore React — and this\n * model is imported by `email-events.ts`, which runs in the plugin API route's\n * SERVER graph. Through the barrel that is a client-only module pulled into a\n * server bundle, which `app-router-graph.spec.ts` refuses.\n */\nimport {\n  resolveProvenance,\n  type ResolvedProvenance,\n} from '@aglyn/aglyn/app-utils/marketplace-provenance'\n\n/** Where a template's content comes from. */\nexport type TemplateOrigin = 'local' | 'installed'\n\n/**\n * How this template stands with whoever publishes it.\n *\n * The three non-`local` values are read from what the install path stamped;\n * none of them is computed here, because computing any of them means reading\n * the listing.\n */\nexport type TemplateStanding =\n  /** Authored in this org. There is no publisher to stand with. */\n  | 'local'\n  /** Installed, and the publisher's current standing has not been read. */\n  | 'unread'\n  /** Installed, and recorded as still offered by its publisher. */\n  | 'offered'\n  /** Installed, and recorded as withdrawn, killed or rejected upstream. */\n  | 'withdrawn'\n\nexport interface TemplateProvenance {\n  origin: TemplateOrigin\n  standing: TemplateStanding\n  /** The core resolver's answer, verbatim. Null for a local template. */\n  installed: ResolvedProvenance | null\n  /**\n   * One line for the reader, or null when there is nothing worth saying.\n   *\n   * A local template gets `null`: \"you wrote this\" is the default assumption\n   * and repeating it on every page is noise. Everything else says what is\n   * known and, where it matters, what is not.\n   */\n  note: string | null\n  /**\n   * This template should not be sent without checking with its publisher\n   * first. Only ever true for `withdrawn`, and the surface renders it as a\n   * warning rather than hiding the template: a message already scheduled\n   * against it is a fact the reader has to be able to see.\n   */\n  warn: boolean\n}\n\n/** The stamped standing values this reads, mapped to the states above. */\nconst STAMPED_STANDING: Record<string, TemplateStanding> = {\n  offered: 'offered',\n  listed: 'offered',\n  verified: 'offered',\n  withdrawn: 'withdrawn',\n  rejected: 'withdrawn',\n  killed: 'withdrawn',\n  revoked: 'withdrawn',\n}\n\n/**\n * Reads a template screen document's provenance and standing.\n *\n * Takes the document rather than ids so it costs nothing: everything here is\n * already on the screen document the detail page reads to render anything at\n * all. A template with no install stamp is local, which is the correct\n * reading — every template predating the marketplace was authored here.\n */\nexport function templateProvenance(\n  screen:\n    | (Record<string, unknown> & {\n        /*\n         * The install stamp, as a bag of fields with ONE of them named.\n         *\n         * `Record<string, unknown>` on the inner shape as well as the outer,\n         * and it is load-bearing rather than decorative: a type whose every\n         * property is optional is a WEAK type, and TypeScript refuses an\n         * argument that shares none of its properties. `installedFrom` as\n         * written by the install path carries `listingId`, `version`,\n         * `sha256`, `artifactType` and `publisherOrgId` and — since nothing\n         * writes it yet — never `standing`, so a real stamp had no property\n         * in common with `{ standing?: unknown }` and was rejected at the\n         * call site while being exactly what this function reads.\n         */\n        installedFrom?: (Record<string, unknown> & { standing?: unknown }) | null\n      })\n    | null\n    | undefined,\n): TemplateProvenance {\n  const installed = resolveProvenance(screen as any, 'emailTemplate')\n  if (installed.state === 'unknown' || !installed.listingId) {\n    return {\n      origin: 'local',\n      standing: 'local',\n      installed: null,\n      note: null,\n      warn: false,\n    }\n  }\n\n  const stamped = String(screen?.installedFrom?.standing ?? '')\n  const standing: TemplateStanding = STAMPED_STANDING[stamped] ?? 'unread'\n  const version = installed.version ? ` version ${installed.version}` : ''\n  return {\n    origin: 'installed',\n    standing,\n    installed,\n    note:\n      standing === 'withdrawn'\n        ? `Installed from a marketplace listing${version}, which its ` +\n          'publisher no longer offers. It still sends exactly as it is here, ' +\n          'but it will not receive updates and cannot be reinstalled.'\n        : standing === 'offered'\n          ? `Installed from a marketplace listing${version}. Its content is ` +\n            'versioned by its publisher, so an update can change what this ' +\n            'template looks like.'\n          : `Installed from a marketplace listing${version}. Whether its ` +\n            'publisher still offers it has not been checked here — this page ' +\n            'reads the template, not the listing.',\n    warn: standing === 'withdrawn',\n  }\n}\n"],"names":["resolveProvenance","STAMPED_STANDING","offered","listed","verified","withdrawn","rejected","killed","revoked","templateProvenance","screen","installed","state","listingId","origin","standing","note","warn","stamped","String","installedFrom","version"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GAED;;;;;;CAMC,GACD,SACEA,iBAAiB,QAEZ,gDAA+C;AA4CtD,wEAAwE,GACxE,MAAMC,mBAAqD;IACzDC,SAAS;IACTC,QAAQ;IACRC,UAAU;IACVC,WAAW;IACXC,UAAU;IACVC,QAAQ;IACRC,SAAS;AACX;AAEA;;;;;;;CAOC,GACD,OAAO,SAASC,mBACdC,MAkBa;cAcsBT;QADZS;IAXvB,MAAMC,YAAYX,kBAAkBU,QAAe;IACnD,IAAIC,UAAUC,KAAK,KAAK,aAAa,CAACD,UAAUE,SAAS,EAAE;QACzD,OAAO;YACLC,QAAQ;YACRC,UAAU;YACVJ,WAAW;YACXK,MAAM;YACNC,MAAM;QACR;IACF;IAEA,MAAMC,UAAUC,eAAOT,2BAAAA,wBAAAA,OAAQU,aAAa,qBAArBV,sBAAuBK,QAAQ,mBAAI;IAC1D,MAAMA,YAA6Bd,4BAAAA,gBAAgB,CAACiB,QAAQ,YAAzBjB,4BAA6B;IAChE,MAAMoB,UAAUV,UAAUU,OAAO,GAAG,CAAC,SAAS,EAAEV,UAAUU,OAAO,EAAE,GAAG;IACtE,OAAO;QACLP,QAAQ;QACRC;QACAJ;QACAK,MACED,aAAa,cACT,CAAC,oCAAoC,EAAEM,QAAQ,YAAY,CAAC,GAC5D,uEACA,+DACAN,aAAa,YACX,CAAC,oCAAoC,EAAEM,QAAQ,iBAAiB,CAAC,GACjE,mEACA,yBACA,CAAC,oCAAoC,EAAEA,QAAQ,cAAc,CAAC,GAC9D,qEACA;QACRJ,MAAMF,aAAa;IACrB;AACF"}