@aglyn/plugins-email 1.0.0-beta.143

package/src/lib/server-list-gate.d.ts

@@ -0,0 +1,183 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE GATE IN FRONT OF EVERY LIST ENROLLMENT THE CONSOLE MAKES.
+ *
+ * Who is allowed to change a list's membership, and what is true about each
+ * address they name. Three route modules ask it — the audience card's add and
+ * preview, the filter search, and the file importer — and they ask this one
+ * copy of it.
+ *
+ * ## Why it is a module of its own
+ *
+ * It began inside `server-console.ts`, beside its first two callers, and that
+ * was right while there were two. The importer made three, and an importer is
+ * exactly the surface where a second, laxer idea of "may this person be
+ * enrolled" is most tempting: a file is bulk, bulk is slow, and skipping the
+ * per-address consent read is the obvious saving. A bulk path that reached the
+ * membership without the suppression check and the attestation would be a way
+ * to enroll precisely the people the one-at-a-time path refuses, which is the
+ * defect class `docs/specs/email-competitive-gaps.md` has a closed P1 entry
+ * for.
+ *
+ * Sharing the gate is also what stops the cheaper failure: two modules that
+ * merely agree today, with nothing in either one saying the other exists.
+ *
+ * ## What it decides, and what it deliberately does not
+ *
+ * {@link resolveAddresses} answers the questions that are FACTS about a
+ * person — a stored refusal, a suppression on either list, an opt-in already
+ * on record, a line that is not an address. It never consults an attestation,
+ * because an attestation is a fact about the operator and folding it in here
+ * would make the preview's numbers move as the box was ticked. The basis is
+ * decided once, at the write, by `assignmentBasis`.
+ */
+import { type AssignmentRefusal, type ConsentGroup, type MarketingConsentRecord, type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * The most addresses one request may name.
+ *
+ * A ceiling on the WRITE, not on the audience. It bounds the work one request
+ * does — the resolution below is a handful of reads per address — and it can
+ * never refuse a person already enrolled or make room by removing one, which
+ * is the difference between a batch size and a capacity limit. Nothing in the
+ * product caps list membership: `contactsPerHost` is the audience band and it
+ * is metered against CONTACTS, in `upsert-contact.ts`, and enrolling somebody
+ * on a list writes no contact. If a membership ceiling is ever introduced,
+ * this function is where it refuses, because this is where something is
+ * added.
+ */
+export declare const LIST_MEMBER_BATCH_MAX = 100;
+/** Everything a list-membership route needs, or the refusal to send back. */
+export type ListContext = {
+    ok: true;
+    uid: string;
+    hostId: string;
+    orgId: string;
+    listRef: FirebaseFirestore.DocumentReference;
+    listName: string;
+} | {
+    ok: false;
+    status: number;
+    body: Record<string, unknown>;
+};
+/**
+ * Who is asking, and about which list.
+ *
+ * ## Two gates, not one — the same two the Inbox assignment route applies
+ *
+ * A host role is necessary and NOT sufficient. Lists live at
+ * `orgs/{orgId}/lists` and their members are contacts, so the rules put both
+ * behind `isOrgWideMember()`. An editor invited to ONE site is an org member
+ * with `allHosts: false`, and gating an org-wide write on the host role alone
+ * would let a single-site collaborator enroll people into an audience every
+ * other site in the org can mail — and, through the preview, read the consent
+ * record of any address they care to type. The Admin SDK evaluates no rules,
+ * so this route is the enforcement rather than an echo of it.
+ *
+ * The plugin's own gates sit above this and are the dispatcher's: a workspace
+ * that has switched the email plugin off, or a site it is disabled for, or a
+ * release flag that has not reached this org, all 404 before a handler runs.
+ */
+export declare function resolveListContext(req: Parameters<PluginApiHandler>[0]): Promise<ListContext>;
+/** What would happen to one address, and why. */
+export interface AddressVerdict {
+    /** Exactly what the operator typed, so a bad line can be pointed at. */
+    input: string;
+    /** The normalized address, or `null` when there is not one. */
+    email: string | null;
+    /**
+     * Why this address can never go on the list, or `null`.
+     *
+     * A HARD refusal only — a stored `declined`, either suppression list, or a
+     * line that is not an address. `no-basis` is deliberately NOT one of them:
+     * "you have not said you have permission yet" is an unanswered question,
+     * not a refusal, and reporting it as one would list the very people an
+     * attestation is about to admit under the heading of people it cannot.
+     * That distinction is {@link requiresAttestation}.
+     */
+    refusal: AssignmentRefusal | null;
+    /** True when only an attestation stands between this address and the list. */
+    requiresAttestation: boolean;
+    /** One sentence of consent facts, in the merchant's terms. */
+    summary: string;
+}
+/** The whole answer, per address and in totals. */
+export interface AddressResolution {
+    verdicts: AddressVerdict[];
+    /** Addresses a stored opt-in already covers — no attestation needed. */
+    optedIn: number;
+    /** Addresses that need the operator to state they have permission. */
+    needAttestation: number;
+    /** Addresses nothing can enroll, whatever the operator says. */
+    refused: number;
+}
+/**
+ * The resolution plus the consent records it was computed from.
+ *
+ * The records ride along so the write path can derive the basis it STORES
+ * from the same read the verdicts were built on. Re-reading them would be a
+ * second answer to "what does this person's record say", between which a
+ * concurrent edit fits — and the operator would have attested against the
+ * first one.
+ */
+export interface ResolvedBatch extends AddressResolution {
+    stored: Map<string, MarketingConsentRecord>;
+    /**
+     * The consent group the resolution was made against, so the WRITE records
+     * a basis for exactly the controller the verdicts were computed for.
+     *
+     * Returned rather than re-resolved by the caller for the same reason
+     * `stored` is: two resolutions of the same question are two answers a
+     * concurrent edit can fit between, and the operator attested against the
+     * first one.
+     */
+    group: ConsentGroup;
+}
+/**
+ * Every address, normalized, deduplicated and put through the policy.
+ *
+ * ## Deduplicated on the NORMALIZED address, and reported once
+ *
+ * A pasted column routinely names the same person twice with different
+ * casing, and `enrollListMember` keys the membership from the normalized
+ * address, so two lines would be one row. Counting them twice would tell the
+ * operator they are attesting for more people than they are.
+ *
+ * ## An unusable line is REPORTED, never dropped
+ *
+ * A paste that silently discarded its malformed lines would tell an operator
+ * that 100 addresses went on the list when 94 did, and the six they never
+ * hear about are the six they typed wrong. Every input line comes back with a
+ * verdict, including the ones that are not addresses at all.
+ *
+ * ## Suppression is attributed, and costs nothing when there is none
+ *
+ * `filterSendableForHost` answers both lists in one pass and fails CLOSED, so
+ * it is asked first; only the addresses it refused are put through the
+ * platform half again to find out WHICH list holds them. In the ordinary case
+ * that second call is never made.
+ */
+export declare function resolveAddresses(input: {
+    hostId: string;
+    inputs: readonly string[];
+}): Promise<ResolvedBatch>;
+/** The addresses named by one request, or the refusal to send back. */
+export declare function readAddresses(req: Parameters<PluginApiHandler>[0]): {
+    emails: string[];
+} | {
+    error: string;
+};

package/src/lib/server-list-gate.js

@@ -0,0 +1,365 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE GATE IN FRONT OF EVERY LIST ENROLLMENT THE CONSOLE MAKES.
+ *
+ * Who is allowed to change a list's membership, and what is true about each
+ * address they name. Three route modules ask it — the audience card's add and
+ * preview, the filter search, and the file importer — and they ask this one
+ * copy of it.
+ *
+ * ## Why it is a module of its own
+ *
+ * It began inside `server-console.ts`, beside its first two callers, and that
+ * was right while there were two. The importer made three, and an importer is
+ * exactly the surface where a second, laxer idea of "may this person be
+ * enrolled" is most tempting: a file is bulk, bulk is slow, and skipping the
+ * per-address consent read is the obvious saving. A bulk path that reached the
+ * membership without the suppression check and the attestation would be a way
+ * to enroll precisely the people the one-at-a-time path refuses, which is the
+ * defect class `docs/specs/email-competitive-gaps.md` has a closed P1 entry
+ * for.
+ *
+ * Sharing the gate is also what stops the cheaper failure: two modules that
+ * merely agree today, with nothing in either one saying the other exists.
+ *
+ * ## What it decides, and what it deliberately does not
+ *
+ * {@link resolveAddresses} answers the questions that are FACTS about a
+ * person — a stored refusal, a suppression on either list, an opt-in already
+ * on record, a line that is not an address. It never consults an attestation,
+ * because an attestation is a fact about the operator and folding it in here
+ * would make the preview's numbers move as the box was ticked. The basis is
+ * decided once, at the write, by `assignmentBasis`.
+ */ import { ASSIGNMENT_REFUSAL_MESSAGES, assignmentReadout, isOrgWideMember, normalizeContactEmail, readMarketingBasis } from "@aglyn/aglyn/server";
+import { consentGroupForSite, filterSendableForHost, filterSuppressedEmails, firebaseAdmin, getOrgForHost, orgDataCollectionForHost, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+/**
+ * The most addresses one request may name.
+ *
+ * A ceiling on the WRITE, not on the audience. It bounds the work one request
+ * does — the resolution below is a handful of reads per address — and it can
+ * never refuse a person already enrolled or make room by removing one, which
+ * is the difference between a batch size and a capacity limit. Nothing in the
+ * product caps list membership: `contactsPerHost` is the audience band and it
+ * is metered against CONTACTS, in `upsert-contact.ts`, and enrolling somebody
+ * on a list writes no contact. If a membership ceiling is ever introduced,
+ * this function is where it refuses, because this is where something is
+ * added.
+ */ export const LIST_MEMBER_BATCH_MAX = 100;
+/** How many contact addresses one `in` query may carry. */ const CONTACT_LOOKUP_CHUNK = 30;
+/**
+ * Who is asking, and about which list.
+ *
+ * ## Two gates, not one — the same two the Inbox assignment route applies
+ *
+ * A host role is necessary and NOT sufficient. Lists live at
+ * `orgs/{orgId}/lists` and their members are contacts, so the rules put both
+ * behind `isOrgWideMember()`. An editor invited to ONE site is an org member
+ * with `allHosts: false`, and gating an org-wide write on the host role alone
+ * would let a single-site collaborator enroll people into an audience every
+ * other site in the org can mail — and, through the preview, read the consent
+ * record of any address they care to type. The Admin SDK evaluates no rules,
+ * so this route is the enforcement rather than an echo of it.
+ *
+ * The plugin's own gates sit above this and are the dispatcher's: a workspace
+ * that has switched the email plugin off, or a site it is disabled for, or a
+ * release flag that has not reached this org, all 404 before a handler runs.
+ */ export async function resolveListContext(req) {
+    var _ref, _ref1, _req_headers_authorization, _hostSnapshot_get, _ref2, _listSnapshot_get;
+    var _req_body, _req_body1, _this;
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const listId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.listId) != null ? _ref1 : '');
+    if (!hostId || !listId) {
+        return {
+            ok: false,
+            status: 400,
+            body: {
+                error: 'Missing hostId or listId'
+            }
+        };
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) {
+        return {
+            ok: false,
+            status: 401,
+            body: {
+                error: 'Unauthenticated'
+            }
+        };
+    }
+    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+    const firestore = firebaseAdmin.app().firestore();
+    const hostSnapshot = await firestore.collection('hosts').doc(hostId).get();
+    if (!hostSnapshot.exists) {
+        return {
+            ok: false,
+            status: 404,
+            body: {
+                error: 'Unknown site'
+            }
+        };
+    }
+    const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+    if (memberRole !== 'admin' && memberRole !== 'editor') {
+        return {
+            ok: false,
+            status: 403,
+            body: {
+                error: 'Not a site admin or editor'
+            }
+        };
+    }
+    const orgId = String((_ref2 = (_this = await getOrgForHost(hostId).catch(()=>null)) == null ? void 0 : _this.orgId) != null ? _ref2 : '');
+    if (!orgId) {
+        return {
+            ok: false,
+            status: 404,
+            body: {
+                error: 'This site has no organization, so it has no lists.'
+            }
+        };
+    }
+    const membership = await resolveOrgMembership(decoded.uid, orgId).catch(()=>null);
+    const member = membership == null ? void 0 : membership.member;
+    const orgWideWriter = isOrgWideMember(member) && ((member == null ? void 0 : member.role) === 'owner' || (member == null ? void 0 : member.role) === 'admin' || (member == null ? void 0 : member.role) === 'editor') && (member == null ? void 0 : member.orgSuspended) !== true;
+    if (!orgWideWriter) {
+        return {
+            ok: false,
+            status: 403,
+            body: {
+                error: 'Marketing lists belong to the whole organization, so changing who ' + 'is on one needs organization-wide access rather than access to ' + 'this site.'
+            }
+        };
+    }
+    const listRef = firestore.collection('orgs').doc(orgId).collection('lists').doc(listId);
+    const listSnapshot = await listRef.get();
+    // A stale or mistyped id must not CREATE a list: a campaign's `list`
+    // audience would then read a list nobody set up.
+    if (!listSnapshot.exists) {
+        return {
+            ok: false,
+            status: 404,
+            body: {
+                error: 'Unknown list'
+            }
+        };
+    }
+    return {
+        ok: true,
+        uid: decoded.uid,
+        hostId,
+        orgId,
+        listRef,
+        listName: String((_listSnapshot_get = listSnapshot.get('name')) != null ? _listSnapshot_get : listId)
+    };
+}
+/**
+ * Every address, normalized, deduplicated and put through the policy.
+ *
+ * ## Deduplicated on the NORMALIZED address, and reported once
+ *
+ * A pasted column routinely names the same person twice with different
+ * casing, and `enrollListMember` keys the membership from the normalized
+ * address, so two lines would be one row. Counting them twice would tell the
+ * operator they are attesting for more people than they are.
+ *
+ * ## An unusable line is REPORTED, never dropped
+ *
+ * A paste that silently discarded its malformed lines would tell an operator
+ * that 100 addresses went on the list when 94 did, and the six they never
+ * hear about are the six they typed wrong. Every input line comes back with a
+ * verdict, including the ones that are not addresses at all.
+ *
+ * ## Suppression is attributed, and costs nothing when there is none
+ *
+ * `filterSendableForHost` answers both lists in one pass and fails CLOSED, so
+ * it is asked first; only the addresses it refused are put through the
+ * platform half again to find out WHICH list holds them. In the ordinary case
+ * that second call is never made.
+ */ export async function resolveAddresses(input) {
+    const seen = new Set();
+    const rows = [];
+    for (const raw of input.inputs){
+        const email = normalizeContactEmail(raw);
+        if (email && seen.has(email)) continue;
+        if (email) seen.add(email);
+        rows.push({
+            input: String(raw != null ? raw : '').trim(),
+            email
+        });
+    }
+    const addresses = rows.map((row)=>row.email).filter((email)=>Boolean(email));
+    /*
+   * The group first, because every answer below is about a CONTROLLER and
+   * not about a site: a business running three sites as one sender enrolls
+   * into all three at once, and an agency's client — which declared no group
+   * — resolves to itself.
+   */ const group = await consentGroupForSite(input.hostId);
+    const [suppression, stored] = await Promise.all([
+        suppressionFor(input.hostId, addresses),
+        storedConsentFor(input.hostId, group, addresses)
+    ]);
+    const unrecorded = readMarketingBasis(null, group);
+    const verdicts = rows.map((row)=>{
+        var _stored_get, _suppression_get, _suppression_get1;
+        if (!row.email) {
+            return {
+                input: row.input,
+                email: null,
+                refusal: 'unroutable-address',
+                requiresAttestation: false,
+                summary: ASSIGNMENT_REFUSAL_MESSAGES['unroutable-address']
+            };
+        }
+        const record = (_stored_get = stored.get(row.email)) != null ? _stored_get : unrecorded;
+        const readout = assignmentReadout({
+            stored: record,
+            suppression: (_suppression_get = suppression.get(row.email)) != null ? _suppression_get : null
+        });
+        return {
+            input: row.input,
+            email: row.email,
+            /*
+       * Straight off the readout, with no attestation in the question.
+       *
+       * `assignmentReadout` answers what is TRUE about this person — a stored
+       * refusal, a suppression, an opt-in, or nothing on record — and none of
+       * those changes because the operator did or did not tick a box. Feeding
+       * the flag in here would make the preview's answer depend on it, so the
+       * count the operator stands behind would move as they answered. The
+       * basis itself is decided once, at the write, by `assignmentBasis`.
+       */ refusal: readout.enrollable ? null : (_suppression_get1 = suppression.get(row.email)) != null ? _suppression_get1 : 'declined',
+            requiresAttestation: readout.requiresAttestation,
+            summary: readout.summary
+        };
+    });
+    return {
+        verdicts,
+        stored,
+        group,
+        optedIn: verdicts.filter((verdict)=>!verdict.refusal && !verdict.requiresAttestation).length,
+        needAttestation: verdicts.filter((verdict)=>verdict.requiresAttestation).length,
+        refused: verdicts.filter((verdict)=>verdict.refusal && !verdict.requiresAttestation).length
+    };
+}
+/**
+ * Which of these addresses is suppressed, and by which list.
+ *
+ * Composed from the shipped helpers rather than reading the two collections
+ * here: normalization, de-duplication and the fail-closed posture live in
+ * `email-suppression.ts`, and a second copy of them is a second set of rules
+ * for the enrollment check and the send-time check to disagree about — which
+ * is exactly the disagreement `an-enrollment-is-not-a-license-to-send.spec.ts`
+ * exists to stop.
+ */ async function suppressionFor(hostId, addresses) {
+    const refusals = new Map();
+    if (!addresses.length) return refusals;
+    const sendable = new Set(await filterSendableForHost(hostId, addresses));
+    const blocked = addresses.filter((email)=>!sendable.has(email));
+    if (!blocked.length) return refusals;
+    // Only the blocked ones, and only to say WHICH list. Survivors of the
+    // platform half are held by this site's own list.
+    const platformSendable = new Set(await filterSuppressedEmails(blocked));
+    for (const email of blocked){
+        refusals.set(email, platformSendable.has(email) ? 'suppressed-host' : 'suppressed-platform');
+    }
+    return refusals;
+}
+/**
+ * The stored consent facts for these addresses, off the org's contacts.
+ *
+ * Read UNSCOPED, deliberately, exactly as the Inbox route reads it:
+ * `scopedToHost` narrows an org collection to what one site may see, and a
+ * refusal filtered out by that narrowing is a refusal this route would then
+ * step over — the failure mode is enrolling somebody who said no. It is safe
+ * because the caller has already been proved an org-wide member, which is the
+ * tier the rules grant the whole org's contacts to.
+ *
+ * ## A refusal wins over an opt-in when the CRM holds both
+ *
+ * Nothing guarantees one contact per address — the collection is keyed by
+ * resource id, not by email — so two records for one person can disagree.
+ * Taking whichever the query happened to answer first would make the outcome
+ * depend on document order. A recorded refusal is the answer whenever one
+ * exists, which is the same precedence `assignmentBasis` applies within a
+ * single record.
+ *
+ * A failed read falls to `declined` for the whole batch, for the reason the
+ * Inbox route states: a read that throws can neither say the person consented
+ * nor that they refused, and the direction that costs a retry is the one that
+ * does not enroll somebody whose stored refusal we simply failed to see.
+ */ async function storedConsentFor(hostId, group, addresses) {
+    const found = new Map();
+    if (!addresses.length) return found;
+    try {
+        const contacts = await orgDataCollectionForHost(hostId, 'contacts');
+        const chunks = [];
+        for(let at = 0; at < addresses.length; at += CONTACT_LOOKUP_CHUNK){
+            chunks.push(addresses.slice(at, at + CONTACT_LOOKUP_CHUNK));
+        }
+        const snapshots = await Promise.all(chunks.map((chunk)=>contacts.where('email', 'in', chunk).get()));
+        for (const snapshot of snapshots){
+            for (const doc of snapshot.docs){
+                const email = normalizeContactEmail(doc.get('email'));
+                if (!email) continue;
+                const record = readMarketingBasis(doc.data(), group);
+                const already = found.get(email);
+                if ((already == null ? void 0 : already.basis) === 'declined') continue;
+                if (already && record.basis !== 'declined') continue;
+                found.set(email, record);
+            }
+        }
+        return found;
+    } catch (error) {
+        console.error('[email] consent lookup failed', error);
+        const refused = _extends({}, readMarketingBasis(null, group), {
+            basis: 'declined',
+            // Attributed to nobody: this is what a failed read falls back to, not a
+            // refusal anybody recorded.
+            assertedBy: null,
+            source: null,
+            basisAtMs: null,
+            capturedAtMs: null
+        });
+        return new Map(addresses.map((email)=>[
+                email,
+                refused
+            ]));
+    }
+}
+/** The addresses named by one request, or the refusal to send back. */ export function readAddresses(req) {
+    const body = req.body;
+    const raw = Array.isArray(body == null ? void 0 : body.emails) ? body.emails : (body == null ? void 0 : body.email) === undefined ? [] : [
+        body.email
+    ];
+    const emails = raw.map((value)=>String(value != null ? value : '').trim()).filter((value)=>value.length > 0);
+    if (!emails.length) return {
+        error: 'No addresses'
+    };
+    if (emails.length > LIST_MEMBER_BATCH_MAX) {
+        return {
+            error: `${emails.length} addresses is more than one go can take. Add up to ` + `${LIST_MEMBER_BATCH_MAX} at a time.`
+        };
+    }
+    return {
+        emails
+    };
+}
+
+//# sourceMappingURL=server-list-gate.js.map

package/src/lib/server-list-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-list-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE GATE IN FRONT OF EVERY LIST ENROLLMENT THE CONSOLE MAKES.\n *\n * Who is allowed to change a list's membership, and what is true about each\n * address they name. Three route modules ask it — the audience card's add and\n * preview, the filter search, and the file importer — and they ask this one\n * copy of it.\n *\n * ## Why it is a module of its own\n *\n * It began inside `server-console.ts`, beside its first two callers, and that\n * was right while there were two. The importer made three, and an importer is\n * exactly the surface where a second, laxer idea of \"may this person be\n * enrolled\" is most tempting: a file is bulk, bulk is slow, and skipping the\n * per-address consent read is the obvious saving. A bulk path that reached the\n * membership without the suppression check and the attestation would be a way\n * to enroll precisely the people the one-at-a-time path refuses, which is the\n * defect class `docs/specs/email-competitive-gaps.md` has a closed P1 entry\n * for.\n *\n * Sharing the gate is also what stops the cheaper failure: two modules that\n * merely agree today, with nothing in either one saying the other exists.\n *\n * ## What it decides, and what it deliberately does not\n *\n * {@link resolveAddresses} answers the questions that are FACTS about a\n * person — a stored refusal, a suppression on either list, an opt-in already\n * on record, a line that is not an address. It never consults an attestation,\n * because an attestation is a fact about the operator and folding it in here\n * would make the preview's numbers move as the box was ticked. The basis is\n * decided once, at the write, by `assignmentBasis`.\n */\n\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentReadout,\n  isOrgWideMember,\n  normalizeContactEmail,\n  readMarketingBasis,\n  type AddressRefusal,\n  type AssignmentRefusal,\n  type ConsentGroup,\n  type MarketingConsentRecord,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  filterSendableForHost,\n  filterSuppressedEmails,\n  firebaseAdmin,\n  getOrgForHost,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\n\n/**\n * The most addresses one request may name.\n *\n * A ceiling on the WRITE, not on the audience. It bounds the work one request\n * does — the resolution below is a handful of reads per address — and it can\n * never refuse a person already enrolled or make room by removing one, which\n * is the difference between a batch size and a capacity limit. Nothing in the\n * product caps list membership: `contactsPerHost` is the audience band and it\n * is metered against CONTACTS, in `upsert-contact.ts`, and enrolling somebody\n * on a list writes no contact. If a membership ceiling is ever introduced,\n * this function is where it refuses, because this is where something is\n * added.\n */\nexport const LIST_MEMBER_BATCH_MAX = 100\n\n/** How many contact addresses one `in` query may carry. */\nconst CONTACT_LOOKUP_CHUNK = 30\n\n/** Everything a list-membership route needs, or the refusal to send back. */\nexport type ListContext =\n  | {\n      ok: true\n      uid: string\n      hostId: string\n      orgId: string\n      listRef: FirebaseFirestore.DocumentReference\n      listName: string\n    }\n  | { ok: false; status: number; body: Record<string, unknown> }\n\n/**\n * Who is asking, and about which list.\n *\n * ## Two gates, not one — the same two the Inbox assignment route applies\n *\n * A host role is necessary and NOT sufficient. Lists live at\n * `orgs/{orgId}/lists` and their members are contacts, so the rules put both\n * behind `isOrgWideMember()`. An editor invited to ONE site is an org member\n * with `allHosts: false`, and gating an org-wide write on the host role alone\n * would let a single-site collaborator enroll people into an audience every\n * other site in the org can mail — and, through the preview, read the consent\n * record of any address they care to type. The Admin SDK evaluates no rules,\n * so this route is the enforcement rather than an echo of it.\n *\n * The plugin's own gates sit above this and are the dispatcher's: a workspace\n * that has switched the email plugin off, or a site it is disabled for, or a\n * release flag that has not reached this org, all 404 before a handler runs.\n */\nexport async function resolveListContext(\n  req: Parameters<PluginApiHandler>[0],\n): Promise<ListContext> {\n  const hostId = String(req.body?.hostId ?? '')\n  const listId = String(req.body?.listId ?? '')\n  if (!hostId || !listId) {\n    return {\n      ok: false,\n      status: 400,\n      body: { error: 'Missing hostId or listId' },\n    }\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    return { ok: false, status: 401, body: { error: 'Unauthenticated' } }\n  }\n\n  const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  const firestore = firebaseAdmin.app().firestore()\n  const hostSnapshot = await firestore.collection('hosts').doc(hostId).get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, body: { error: 'Unknown site' } }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return {\n      ok: false,\n      status: 403,\n      body: { error: 'Not a site admin or editor' },\n    }\n  }\n\n  const orgId = String(\n    (await getOrgForHost(hostId).catch(() => null))?.orgId ?? '',\n  )\n  if (!orgId) {\n    return {\n      ok: false,\n      status: 404,\n      body: { error: 'This site has no organization, so it has no lists.' },\n    }\n  }\n  const membership = await resolveOrgMembership(decoded.uid, orgId).catch(\n    () => null,\n  )\n  const member = membership?.member\n  const orgWideWriter =\n    isOrgWideMember(member) &&\n    (member?.role === 'owner' ||\n      member?.role === 'admin' ||\n      member?.role === 'editor') &&\n    (member as { orgSuspended?: boolean } | undefined)?.orgSuspended !== true\n  if (!orgWideWriter) {\n    return {\n      ok: false,\n      status: 403,\n      body: {\n        error:\n          'Marketing lists belong to the whole organization, so changing who ' +\n          'is on one needs organization-wide access rather than access to ' +\n          'this site.',\n      },\n    }\n  }\n\n  const listRef = firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection('lists')\n    .doc(listId)\n  const listSnapshot = await listRef.get()\n  // A stale or mistyped id must not CREATE a list: a campaign's `list`\n  // audience would then read a list nobody set up.\n  if (!listSnapshot.exists) {\n    return { ok: false, status: 404, body: { error: 'Unknown list' } }\n  }\n\n  return {\n    ok: true,\n    uid: decoded.uid,\n    hostId,\n    orgId,\n    listRef,\n    listName: String(listSnapshot.get('name') ?? listId),\n  }\n}\n\n/** What would happen to one address, and why. */\nexport interface AddressVerdict {\n  /** Exactly what the operator typed, so a bad line can be pointed at. */\n  input: string\n  /** The normalized address, or `null` when there is not one. */\n  email: string | null\n  /**\n   * Why this address can never go on the list, or `null`.\n   *\n   * A HARD refusal only — a stored `declined`, either suppression list, or a\n   * line that is not an address. `no-basis` is deliberately NOT one of them:\n   * \"you have not said you have permission yet\" is an unanswered question,\n   * not a refusal, and reporting it as one would list the very people an\n   * attestation is about to admit under the heading of people it cannot.\n   * That distinction is {@link requiresAttestation}.\n   */\n  refusal: AssignmentRefusal | null\n  /** True when only an attestation stands between this address and the list. */\n  requiresAttestation: boolean\n  /** One sentence of consent facts, in the merchant's terms. */\n  summary: string\n}\n\n/** The whole answer, per address and in totals. */\nexport interface AddressResolution {\n  verdicts: AddressVerdict[]\n  /** Addresses a stored opt-in already covers — no attestation needed. */\n  optedIn: number\n  /** Addresses that need the operator to state they have permission. */\n  needAttestation: number\n  /** Addresses nothing can enroll, whatever the operator says. */\n  refused: number\n}\n\n/**\n * The resolution plus the consent records it was computed from.\n *\n * The records ride along so the write path can derive the basis it STORES\n * from the same read the verdicts were built on. Re-reading them would be a\n * second answer to \"what does this person's record say\", between which a\n * concurrent edit fits — and the operator would have attested against the\n * first one.\n */\nexport interface ResolvedBatch extends AddressResolution {\n  stored: Map<string, MarketingConsentRecord>\n  /**\n   * The consent group the resolution was made against, so the WRITE records\n   * a basis for exactly the controller the verdicts were computed for.\n   *\n   * Returned rather than re-resolved by the caller for the same reason\n   * `stored` is: two resolutions of the same question are two answers a\n   * concurrent edit can fit between, and the operator attested against the\n   * first one.\n   */\n  group: ConsentGroup\n}\n\n/**\n * Every address, normalized, deduplicated and put through the policy.\n *\n * ## Deduplicated on the NORMALIZED address, and reported once\n *\n * A pasted column routinely names the same person twice with different\n * casing, and `enrollListMember` keys the membership from the normalized\n * address, so two lines would be one row. Counting them twice would tell the\n * operator they are attesting for more people than they are.\n *\n * ## An unusable line is REPORTED, never dropped\n *\n * A paste that silently discarded its malformed lines would tell an operator\n * that 100 addresses went on the list when 94 did, and the six they never\n * hear about are the six they typed wrong. Every input line comes back with a\n * verdict, including the ones that are not addresses at all.\n *\n * ## Suppression is attributed, and costs nothing when there is none\n *\n * `filterSendableForHost` answers both lists in one pass and fails CLOSED, so\n * it is asked first; only the addresses it refused are put through the\n * platform half again to find out WHICH list holds them. In the ordinary case\n * that second call is never made.\n */\nexport async function resolveAddresses(input: {\n  hostId: string\n  inputs: readonly string[]\n}): Promise<ResolvedBatch> {\n  const seen = new Set<string>()\n  const rows: Array<{ input: string; email: string | null }> = []\n  for (const raw of input.inputs) {\n    const email = normalizeContactEmail(raw)\n    if (email && seen.has(email)) continue\n    if (email) seen.add(email)\n    rows.push({ input: String(raw ?? '').trim(), email })\n  }\n\n  const addresses = rows\n    .map((row) => row.email)\n    .filter((email): email is string => Boolean(email))\n\n  /*\n   * The group first, because every answer below is about a CONTROLLER and\n   * not about a site: a business running three sites as one sender enrolls\n   * into all three at once, and an agency's client — which declared no group\n   * — resolves to itself.\n   */\n  const group = await consentGroupForSite(input.hostId)\n  const [suppression, stored] = await Promise.all([\n    suppressionFor(input.hostId, addresses),\n    storedConsentFor(input.hostId, group, addresses),\n  ])\n\n  const unrecorded: MarketingConsentRecord = readMarketingBasis(null, group)\n  const verdicts = rows.map((row): AddressVerdict => {\n    if (!row.email) {\n      return {\n        input: row.input,\n        email: null,\n        refusal: 'unroutable-address',\n        requiresAttestation: false,\n        summary: ASSIGNMENT_REFUSAL_MESSAGES['unroutable-address'],\n      }\n    }\n    const record = stored.get(row.email) ?? unrecorded\n    const readout = assignmentReadout({\n      stored: record,\n      suppression: suppression.get(row.email) ?? null,\n    })\n    return {\n      input: row.input,\n      email: row.email,\n      /*\n       * Straight off the readout, with no attestation in the question.\n       *\n       * `assignmentReadout` answers what is TRUE about this person — a stored\n       * refusal, a suppression, an opt-in, or nothing on record — and none of\n       * those changes because the operator did or did not tick a box. Feeding\n       * the flag in here would make the preview's answer depend on it, so the\n       * count the operator stands behind would move as they answered. The\n       * basis itself is decided once, at the write, by `assignmentBasis`.\n       */\n      refusal: readout.enrollable\n        ? null\n        : (suppression.get(row.email) ?? 'declined'),\n      requiresAttestation: readout.requiresAttestation,\n      summary: readout.summary,\n    }\n  })\n\n  return {\n    verdicts,\n    stored,\n    group,\n    optedIn: verdicts.filter(\n      (verdict) => !verdict.refusal && !verdict.requiresAttestation,\n    ).length,\n    needAttestation: verdicts.filter((verdict) => verdict.requiresAttestation)\n      .length,\n    refused: verdicts.filter(\n      (verdict) => verdict.refusal && !verdict.requiresAttestation,\n    ).length,\n  }\n}\n\n/**\n * Which of these addresses is suppressed, and by which list.\n *\n * Composed from the shipped helpers rather than reading the two collections\n * here: normalization, de-duplication and the fail-closed posture live in\n * `email-suppression.ts`, and a second copy of them is a second set of rules\n * for the enrollment check and the send-time check to disagree about — which\n * is exactly the disagreement `an-enrollment-is-not-a-license-to-send.spec.ts`\n * exists to stop.\n */\nasync function suppressionFor(\n  hostId: string,\n  addresses: readonly string[],\n): Promise<Map<string, AddressRefusal>> {\n  const refusals = new Map<string, AddressRefusal>()\n  if (!addresses.length) return refusals\n  const sendable = new Set(await filterSendableForHost(hostId, addresses))\n  const blocked = addresses.filter((email) => !sendable.has(email))\n  if (!blocked.length) return refusals\n  // Only the blocked ones, and only to say WHICH list. Survivors of the\n  // platform half are held by this site's own list.\n  const platformSendable = new Set(await filterSuppressedEmails(blocked))\n  for (const email of blocked) {\n    refusals.set(\n      email,\n      platformSendable.has(email) ? 'suppressed-host' : 'suppressed-platform',\n    )\n  }\n  return refusals\n}\n\n/**\n * The stored consent facts for these addresses, off the org's contacts.\n *\n * Read UNSCOPED, deliberately, exactly as the Inbox route reads it:\n * `scopedToHost` narrows an org collection to what one site may see, and a\n * refusal filtered out by that narrowing is a refusal this route would then\n * step over — the failure mode is enrolling somebody who said no. It is safe\n * because the caller has already been proved an org-wide member, which is the\n * tier the rules grant the whole org's contacts to.\n *\n * ## A refusal wins over an opt-in when the CRM holds both\n *\n * Nothing guarantees one contact per address — the collection is keyed by\n * resource id, not by email — so two records for one person can disagree.\n * Taking whichever the query happened to answer first would make the outcome\n * depend on document order. A recorded refusal is the answer whenever one\n * exists, which is the same precedence `assignmentBasis` applies within a\n * single record.\n *\n * A failed read falls to `declined` for the whole batch, for the reason the\n * Inbox route states: a read that throws can neither say the person consented\n * nor that they refused, and the direction that costs a retry is the one that\n * does not enroll somebody whose stored refusal we simply failed to see.\n */\nasync function storedConsentFor(\n  hostId: string,\n  group: ConsentGroup,\n  addresses: readonly string[],\n): Promise<Map<string, MarketingConsentRecord>> {\n  const found = new Map<string, MarketingConsentRecord>()\n  if (!addresses.length) return found\n  try {\n    const contacts = await orgDataCollectionForHost(hostId, 'contacts')\n    const chunks: string[][] = []\n    for (let at = 0; at < addresses.length; at += CONTACT_LOOKUP_CHUNK) {\n      chunks.push(addresses.slice(at, at + CONTACT_LOOKUP_CHUNK))\n    }\n    const snapshots = await Promise.all(\n      chunks.map((chunk) => contacts.where('email', 'in', chunk).get()),\n    )\n    for (const snapshot of snapshots) {\n      for (const doc of snapshot.docs) {\n        const email = normalizeContactEmail(doc.get('email'))\n        if (!email) continue\n        const record = readMarketingBasis(\n          doc.data() as Record<string, unknown>,\n          group,\n        )\n        const already = found.get(email)\n        if (already?.basis === 'declined') continue\n        if (already && record.basis !== 'declined') continue\n        found.set(email, record)\n      }\n    }\n    return found\n  } catch (error) {\n    console.error('[email] consent lookup failed', error)\n    const refused: MarketingConsentRecord = {\n      ...readMarketingBasis(null, group),\n      basis: 'declined',\n      // Attributed to nobody: this is what a failed read falls back to, not a\n      // refusal anybody recorded.\n      assertedBy: null,\n      source: null,\n      basisAtMs: null,\n      capturedAtMs: null,\n    }\n    return new Map(addresses.map((email) => [email, refused]))\n  }\n}\n\n/** The addresses named by one request, or the refusal to send back. */\nexport function readAddresses(\n  req: Parameters<PluginApiHandler>[0],\n): { emails: string[] } | { error: string } {\n  const body = req.body as { emails?: unknown; email?: unknown } | undefined\n  const raw = Array.isArray(body?.emails)\n    ? body.emails\n    : body?.email === undefined\n      ? []\n      : [body.email]\n  const emails = raw\n    .map((value) => String(value ?? '').trim())\n    .filter((value) => value.length > 0)\n  if (!emails.length) return { error: 'No addresses' }\n  if (emails.length > LIST_MEMBER_BATCH_MAX) {\n    return {\n      error:\n        `${emails.length} addresses is more than one go can take. Add up to ` +\n        `${LIST_MEMBER_BATCH_MAX} at a time.`,\n    }\n  }\n  return { emails }\n}\n"],"names":["ASSIGNMENT_REFUSAL_MESSAGES","assignmentReadout","isOrgWideMember","normalizeContactEmail","readMarketingBasis","consentGroupForSite","filterSendableForHost","filterSuppressedEmails","firebaseAdmin","getOrgForHost","orgDataCollectionForHost","resolveOrgMembership","LIST_MEMBER_BATCH_MAX","CONTACT_LOOKUP_CHUNK","resolveListContext","req","hostSnapshot","listSnapshot","hostId","String","body","listId","ok","status","error","authorization","headers","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","firestore","collection","doc","get","exists","memberRole","uid","orgId","catch","membership","member","orgWideWriter","role","orgSuspended","listRef","listName","resolveAddresses","input","seen","Set","rows","raw","inputs","email","has","add","push","trim","addresses","map","row","filter","Boolean","group","suppression","stored","Promise","all","suppressionFor","storedConsentFor","unrecorded","verdicts","refusal","requiresAttestation","summary","record","readout","enrollable","optedIn","verdict","needAttestation","refused","refusals","Map","sendable","blocked","platformSendable","set","found","contacts","chunks","at","snapshots","chunk","where","snapshot","docs","data","already","basis","console","assertedBy","source","basisAtMs","capturedAtMs","readAddresses","Array","isArray","emails","value"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,SACEA,2BAA2B,EAC3BC,iBAAiB,EACjBC,eAAe,EACfC,qBAAqB,EACrBC,kBAAkB,QAMb,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,qBAAqB,EACrBC,sBAAsB,EACtBC,aAAa,EACbC,aAAa,EACbC,wBAAwB,EACxBC,oBAAoB,QACf,2BAA0B;AAEjC;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,wBAAwB,IAAG;AAExC,yDAAyD,GACzD,MAAMC,uBAAuB;AAc7B;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeC,mBACpBC,GAAoC;qBAYPA,4BAcTC,0BA4DDC;QApFGF,WACAA,YAiCnB;IAlCH,MAAMG,SAASC,gBAAOJ,YAAAA,IAAIK,IAAI,qBAARL,UAAUG,MAAM,mBAAI;IAC1C,MAAMG,SAASF,iBAAOJ,aAAAA,IAAIK,IAAI,qBAARL,WAAUM,MAAM,oBAAI;IAC1C,IAAI,CAACH,UAAU,CAACG,QAAQ;QACtB,OAAO;YACLC,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAA2B;QAC5C;IACF;IAEA,MAAMC,gBAAgBN,QAAOJ,6BAAAA,IAAIW,OAAO,CAACD,aAAa,YAAzBV,6BAA6B;IAC1D,MAAMY,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZ,OAAO;YAAEL,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAkB;QAAE;IACtE;IAEA,MAAMQ,UAAU,MAAMxB,cAAcyB,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;IAC/D,MAAMS,YAAY5B,cAAcyB,GAAG,GAAGG,SAAS;IAC/C,MAAMpB,eAAe,MAAMoB,UAAUC,UAAU,CAAC,SAASC,GAAG,CAACpB,QAAQqB,GAAG;IACxE,IAAI,CAACvB,aAAawB,MAAM,EAAE;QACxB,OAAO;YAAElB,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAe;QAAE;IACnE;IACA,MAAMiB,aAAa,EAACzB,oBAAAA,aAAauB,GAAG,CAAC,0BAAjBvB,oBAAmC,CAAC,EAAE,CAACgB,QAAQU,GAAG,CAAC;IACvE,IAAID,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YACLnB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAA6B;QAC9C;IACF;IAEA,MAAMmB,QAAQxB,iBACX,QAAA,MAAMV,cAAcS,QAAQ0B,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDD,KAAK,oBAAI;IAE5D,IAAI,CAACA,OAAO;QACV,OAAO;YACLrB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAAqD;QACtE;IACF;IACA,MAAMqB,aAAa,MAAMlC,qBAAqBqB,QAAQU,GAAG,EAAEC,OAAOC,KAAK,CACrE,IAAM;IAER,MAAME,SAASD,8BAAAA,WAAYC,MAAM;IACjC,MAAMC,gBACJ7C,gBAAgB4C,WACfA,CAAAA,CAAAA,0BAAAA,OAAQE,IAAI,MAAK,WAChBF,CAAAA,0BAAAA,OAAQE,IAAI,MAAK,WACjBF,CAAAA,0BAAAA,OAAQE,IAAI,MAAK,QAAO,KAC1B,CAACF,0BAAD,AAACA,OAAmDG,YAAY,MAAK;IACvE,IAAI,CAACF,eAAe;QAClB,OAAO;YACLzB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBACJI,OACE,uEACA,oEACA;YACJ;QACF;IACF;IAEA,MAAM0B,UAAUd,UACbC,UAAU,CAAC,QACXC,GAAG,CAACK,OACJN,UAAU,CAAC,SACXC,GAAG,CAACjB;IACP,MAAMJ,eAAe,MAAMiC,QAAQX,GAAG;IACtC,qEAAqE;IACrE,iDAAiD;IACjD,IAAI,CAACtB,aAAauB,MAAM,EAAE;QACxB,OAAO;YAAElB,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAe;QAAE;IACnE;IAEA,OAAO;QACLF,IAAI;QACJoB,KAAKV,QAAQU,GAAG;QAChBxB;QACAyB;QACAO;QACAC,UAAUhC,QAAOF,oBAAAA,aAAasB,GAAG,CAAC,mBAAjBtB,oBAA4BI;IAC/C;AACF;AA2DA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAe+B,iBAAiBC,KAGtC;IACC,MAAMC,OAAO,IAAIC;IACjB,MAAMC,OAAuD,EAAE;IAC/D,KAAK,MAAMC,OAAOJ,MAAMK,MAAM,CAAE;QAC9B,MAAMC,QAAQxD,sBAAsBsD;QACpC,IAAIE,SAASL,KAAKM,GAAG,CAACD,QAAQ;QAC9B,IAAIA,OAAOL,KAAKO,GAAG,CAACF;QACpBH,KAAKM,IAAI,CAAC;YAAET,OAAOlC,OAAOsC,cAAAA,MAAO,IAAIM,IAAI;YAAIJ;QAAM;IACrD;IAEA,MAAMK,YAAYR,KACfS,GAAG,CAAC,CAACC,MAAQA,IAAIP,KAAK,EACtBQ,MAAM,CAAC,CAACR,QAA2BS,QAAQT;IAE9C;;;;;GAKC,GACD,MAAMU,QAAQ,MAAMhE,oBAAoBgD,MAAMnC,MAAM;IACpD,MAAM,CAACoD,aAAaC,OAAO,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC9CC,eAAerB,MAAMnC,MAAM,EAAE8C;QAC7BW,iBAAiBtB,MAAMnC,MAAM,EAAEmD,OAAOL;KACvC;IAED,MAAMY,aAAqCxE,mBAAmB,MAAMiE;IACpE,MAAMQ,WAAWrB,KAAKS,GAAG,CAAC,CAACC;YAUVK,aAGAD,kBAiBRA;QA7BP,IAAI,CAACJ,IAAIP,KAAK,EAAE;YACd,OAAO;gBACLN,OAAOa,IAAIb,KAAK;gBAChBM,OAAO;gBACPmB,SAAS;gBACTC,qBAAqB;gBACrBC,SAAShF,2BAA2B,CAAC,qBAAqB;YAC5D;QACF;QACA,MAAMiF,UAASV,cAAAA,OAAOhC,GAAG,CAAC2B,IAAIP,KAAK,aAApBY,cAAyBK;QACxC,MAAMM,UAAUjF,kBAAkB;YAChCsE,QAAQU;YACRX,WAAW,GAAEA,mBAAAA,YAAY/B,GAAG,CAAC2B,IAAIP,KAAK,aAAzBW,mBAA8B;QAC7C;QACA,OAAO;YACLjB,OAAOa,IAAIb,KAAK;YAChBM,OAAOO,IAAIP,KAAK;YAChB;;;;;;;;;OASC,GACDmB,SAASI,QAAQC,UAAU,GACvB,QACCb,oBAAAA,YAAY/B,GAAG,CAAC2B,IAAIP,KAAK,aAAzBW,oBAA8B;YACnCS,qBAAqBG,QAAQH,mBAAmB;YAChDC,SAASE,QAAQF,OAAO;QAC1B;IACF;IAEA,OAAO;QACLH;QACAN;QACAF;QACAe,SAASP,SAASV,MAAM,CACtB,CAACkB,UAAY,CAACA,QAAQP,OAAO,IAAI,CAACO,QAAQN,mBAAmB,EAC7DjD,MAAM;QACRwD,iBAAiBT,SAASV,MAAM,CAAC,CAACkB,UAAYA,QAAQN,mBAAmB,EACtEjD,MAAM;QACTyD,SAASV,SAASV,MAAM,CACtB,CAACkB,UAAYA,QAAQP,OAAO,IAAI,CAACO,QAAQN,mBAAmB,EAC5DjD,MAAM;IACV;AACF;AAEA;;;;;;;;;CASC,GACD,eAAe4C,eACbxD,MAAc,EACd8C,SAA4B;IAE5B,MAAMwB,WAAW,IAAIC;IACrB,IAAI,CAACzB,UAAUlC,MAAM,EAAE,OAAO0D;IAC9B,MAAME,WAAW,IAAInC,IAAI,MAAMjD,sBAAsBY,QAAQ8C;IAC7D,MAAM2B,UAAU3B,UAAUG,MAAM,CAAC,CAACR,QAAU,CAAC+B,SAAS9B,GAAG,CAACD;IAC1D,IAAI,CAACgC,QAAQ7D,MAAM,EAAE,OAAO0D;IAC5B,sEAAsE;IACtE,kDAAkD;IAClD,MAAMI,mBAAmB,IAAIrC,IAAI,MAAMhD,uBAAuBoF;IAC9D,KAAK,MAAMhC,SAASgC,QAAS;QAC3BH,SAASK,GAAG,CACVlC,OACAiC,iBAAiBhC,GAAG,CAACD,SAAS,oBAAoB;IAEtD;IACA,OAAO6B;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,eAAeb,iBACbzD,MAAc,EACdmD,KAAmB,EACnBL,SAA4B;IAE5B,MAAM8B,QAAQ,IAAIL;IAClB,IAAI,CAACzB,UAAUlC,MAAM,EAAE,OAAOgE;IAC9B,IAAI;QACF,MAAMC,WAAW,MAAMrF,yBAAyBQ,QAAQ;QACxD,MAAM8E,SAAqB,EAAE;QAC7B,IAAK,IAAIC,KAAK,GAAGA,KAAKjC,UAAUlC,MAAM,EAAEmE,MAAMpF,qBAAsB;YAClEmF,OAAOlC,IAAI,CAACE,UAAUnC,KAAK,CAACoE,IAAIA,KAAKpF;QACvC;QACA,MAAMqF,YAAY,MAAM1B,QAAQC,GAAG,CACjCuB,OAAO/B,GAAG,CAAC,CAACkC,QAAUJ,SAASK,KAAK,CAAC,SAAS,MAAMD,OAAO5D,GAAG;QAEhE,KAAK,MAAM8D,YAAYH,UAAW;YAChC,KAAK,MAAM5D,OAAO+D,SAASC,IAAI,CAAE;gBAC/B,MAAM3C,QAAQxD,sBAAsBmC,IAAIC,GAAG,CAAC;gBAC5C,IAAI,CAACoB,OAAO;gBACZ,MAAMsB,SAAS7E,mBACbkC,IAAIiE,IAAI,IACRlC;gBAEF,MAAMmC,UAAUV,MAAMvD,GAAG,CAACoB;gBAC1B,IAAI6C,CAAAA,2BAAAA,QAASC,KAAK,MAAK,YAAY;gBACnC,IAAID,WAAWvB,OAAOwB,KAAK,KAAK,YAAY;gBAC5CX,MAAMD,GAAG,CAAClC,OAAOsB;YACnB;QACF;QACA,OAAOa;IACT,EAAE,OAAOtE,OAAO;QACdkF,QAAQlF,KAAK,CAAC,iCAAiCA;QAC/C,MAAM+D,UAAkC,aACnCnF,mBAAmB,MAAMiE;YAC5BoC,OAAO;YACP,wEAAwE;YACxE,4BAA4B;YAC5BE,YAAY;YACZC,QAAQ;YACRC,WAAW;YACXC,cAAc;;QAEhB,OAAO,IAAIrB,IAAIzB,UAAUC,GAAG,CAAC,CAACN,QAAU;gBAACA;gBAAO4B;aAAQ;IAC1D;AACF;AAEA,qEAAqE,GACrE,OAAO,SAASwB,cACdhG,GAAoC;IAEpC,MAAMK,OAAOL,IAAIK,IAAI;IACrB,MAAMqC,MAAMuD,MAAMC,OAAO,CAAC7F,wBAAAA,KAAM8F,MAAM,IAClC9F,KAAK8F,MAAM,GACX9F,CAAAA,wBAAAA,KAAMuC,KAAK,MAAK5B,YACd,EAAE,GACF;QAACX,KAAKuC,KAAK;KAAC;IAClB,MAAMuD,SAASzD,IACZQ,GAAG,CAAC,CAACkD,QAAUhG,OAAOgG,gBAAAA,QAAS,IAAIpD,IAAI,IACvCI,MAAM,CAAC,CAACgD,QAAUA,MAAMrF,MAAM,GAAG;IACpC,IAAI,CAACoF,OAAOpF,MAAM,EAAE,OAAO;QAAEN,OAAO;IAAe;IACnD,IAAI0F,OAAOpF,MAAM,GAAGlB,uBAAuB;QACzC,OAAO;YACLY,OACE,GAAG0F,OAAOpF,MAAM,CAAC,mDAAmD,CAAC,GACrE,GAAGlB,sBAAsB,WAAW,CAAC;QACzC;IACF;IACA,OAAO;QAAEsG;IAAO;AAClB"}