@aglyn/plugins-email 1.0.0-beta.250 → 1.0.0-beta.252

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/plugins-email",
-  "version": "1.0.0-beta.250",
+  "version": "1.0.0-beta.252",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,21 +25,21 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.250",
-    "@aglyn/shared-data-enums": "1.0.0-beta.250",
-    "@aglyn/shared-data-mdi": "1.0.0-beta.250",
-    "@aglyn/shared-data-types": "1.0.0-beta.250",
-    "@aglyn/shared-ui-jsx": "1.0.0-beta.250",
-    "@aglyn/shared-ui-jsx-forms": "1.0.0-beta.250",
-    "@aglyn/shared-ui-next": "1.0.0-beta.250",
-    "@aglyn/shared-ui-snackstack": "1.0.0-beta.250",
-    "@aglyn/shared-ui-theme": "1.0.0-beta.250",
-    "@aglyn/shared-util-email": "1.0.0-beta.250",
-    "@aglyn/shared-util-http": "1.0.0-beta.250",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.250",
-    "@aglyn/shared-util-tools": "1.0.0-beta.250",
-    "@aglyn/tenant-data-admin": "1.0.0-beta.250",
-    "@aglyn/tenant-feature-instance": "1.0.0-beta.250",
+    "@aglyn/aglyn": "1.0.0-beta.252",
+    "@aglyn/shared-data-enums": "1.0.0-beta.252",
+    "@aglyn/shared-data-mdi": "1.0.0-beta.252",
+    "@aglyn/shared-data-types": "1.0.0-beta.252",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.252",
+    "@aglyn/shared-ui-jsx-forms": "1.0.0-beta.252",
+    "@aglyn/shared-ui-next": "1.0.0-beta.252",
+    "@aglyn/shared-ui-snackstack": "1.0.0-beta.252",
+    "@aglyn/shared-ui-theme": "1.0.0-beta.252",
+    "@aglyn/shared-util-email": "1.0.0-beta.252",
+    "@aglyn/shared-util-http": "1.0.0-beta.252",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.252",
+    "@aglyn/shared-util-tools": "1.0.0-beta.252",
+    "@aglyn/tenant-data-admin": "1.0.0-beta.252",
+    "@aglyn/tenant-feature-instance": "1.0.0-beta.252",
     "@swc/helpers": "0.5.23"
   },
   "peerDependencies": {

package/src/lib/components/list-members-panel.d.ts

@@ -41,7 +41,7 @@
  * Those are different acts with different records, and a console that let them
  * blur is a console where "remove" is quietly relied on as an unsubscribe.
  */
-import { type ConsentGroup, type DynamicListRule } from '@aglyn/aglyn';
+import { type ConsentGroup, type DynamicListRule, type MarketingConsentRecord } from '@aglyn/aglyn';
 export interface ListMembersPanelProps {
     hostId: string;
     /**
@@ -102,6 +102,83 @@ export interface ListMembersFilter {
         }>;
     };
 }
+/**
+ * One member row, as stored.
+ *
+ * The consent fields are deliberately NOT enumerated here. They live one level
+ * down, in an entry per site under `marketingConsentByHost`, and a row type
+ * that named them at the top would be an invitation to read them there — which
+ * is exactly what this table did while `enrollListMember` wrote them nested,
+ * so every membership on every list reported "No basis on record" while the
+ * send path mailed the same people on a basis it could see perfectly well. The
+ * index signature is what {@link readMarketingBasis} takes; it is the only
+ * reader of those fields on this surface.
+ */
+interface MemberRow {
+    $id: string;
+    email?: string;
+    name?: string;
+    source?: string;
+    via?: 'manual' | 'rule';
+    addedAt?: {
+        toDate?: () => Date;
+    };
+    [field: string]: unknown;
+}
+/**
+ * How the basis reads on screen, for the group this console is viewed as.
+ *
+ * ## Read through `readMarketingBasis`, never off the row
+ *
+ * This picked `marketingConsent`, `marketingConsentBasis` and
+ * `marketingConsentAtMs` off the top of the membership document, which is
+ * where `enrollListMember` used to put them. They now live in an entry per
+ * site under `marketingConsentByHost`, because a basis runs to the brand it
+ * was given to rather than to the account that holds the row. Nothing here
+ * moved with them, so every top-level read answered `undefined` and every
+ * member of every list — including people carrying a perfectly good attested
+ * basis — was reported as having no basis on record, on the one screen an
+ * operator consults before mailing them. `performCampaignSend` reads the same
+ * documents through the function below and mailed them, correctly, at the same
+ * time.
+ *
+ * The fix is not a second field name. It is that the send path's reader is the
+ * only reader: a surface that parses the stored shape itself agrees with the
+ * sender only until the shape moves, and it moves without anybody thinking to
+ * look here.
+ *
+ * ## Five states, because the model carries five
+ *
+ * An attestation and an opt-in are not the same fact — one is a person's own
+ * decision, the other a claim an account made on their behalf — and a table
+ * rendering both as a tick is the conflation `list-members.ts` stores the
+ * basis to prevent. The three that are not a grant are not one state either.
+ * Absence is not refusal, and neither of them is "opted in, to somebody else
+ * in this account": that third one is a person the sender deliberately leaves
+ * alone, and an operator who cannot see why reads it as the product having
+ * lost their subscriber.
+ */
+type ConsentKey = 'opted-out' | 'attested' | 'opted-in' | 'other-site' | 'no-site' | 'none';
+/**
+ * A rule-enrolled member's basis as their CONTACT records it, as
+ * `email/list-member-consent` answers it.
+ *
+ * A row a list rule wrote never holds a basis of its own — matching a rule is
+ * not an opt-in — so `performCampaignSend` reads those people's contacts, and
+ * this column shows what it reads. Fetched, because the browser may not read
+ * the org's contacts by address.
+ */
+export interface ContactBasis {
+    basis: MarketingConsentRecord['basis'];
+    assertedBy: MarketingConsentRecord['assertedBy'];
+    basisAtMs: number | null;
+    otherGrant: MarketingConsentRecord['otherGrant'];
+}
+export declare function consentLabel(member: MemberRow, group: ConsentGroup, fromContact?: ContactBasis | null): {
+    key: ConsentKey;
+    label: string;
+    color: 'default' | 'warning' | 'error';
+};
 /** Free text — a paste, a typed address, commas or newlines — to addresses. */
 export declare function splitAddresses(value: string): string[];
 export declare function ListMembersPanel(props: ListMembersPanelProps): import("react").JSX.Element;

package/src/lib/components/list-members-panel.js

@@ -77,8 +77,12 @@ import { useListQuery } from "@aglyn/tenant-feature-instance/hooks/use-list-quer
 import { useListColumnSort } from "@aglyn/shared-ui-jsx/hooks/use-list-column-sort";
 import { authorizedFetch } from "@aglyn/shared-util-http/authorized-token";
 import { LIST_MEMBER_FILTER_HEADERS, LIST_MEMBER_FILTER_OPTIONS, LIST_MEMBER_QUERY } from "../constants/list-queries.js";
-function consentLabel(member, group) {
-    const record = readMarketingBasis(member, group);
+/** The key a member row and the consent route both use for an address. */ const memberAddress = (member)=>typeof member.email === 'string' ? member.email.trim().toLowerCase() : '';
+export function consentLabel(member, group, fromContact) {
+    const own = readMarketingBasis(member, group);
+    // The contact answers only where the row itself is silent and a rule put it
+    // there — the same overlay the send applies.
+    const record = fromContact && member.via === 'rule' && own.basis === 'unrecorded' ? fromContact : own;
     const when = record.basisAtMs ? ` · ${new Date(record.basisAtMs).toLocaleDateString()}` : '';
     if (record.basis === 'declined') {
         return {
@@ -192,10 +196,15 @@ export function ListMembersPanel(props) {
         ],
         idField: '$id'
     });
+    /** Rule members' contact bases, by address — see {@link ContactBasis}. */ const [contactConsent, setContactConsent] = useState({});
+    const labelFor = useCallback((row)=>consentLabel(row, consentGroup, contactConsent[memberAddress(row)]), [
+        consentGroup,
+        contactConsent
+    ]);
     const pageSorts = useMemo(()=>({
-            consent: (row)=>consentLabel(row, consentGroup).label
+            consent: (row)=>labelFor(row).label
         }), [
-        consentGroup
+        labelFor
     ]);
     const columnSort = useListColumnSort({
         sorts: LIST_MEMBER_QUERY.sorts,
@@ -283,6 +292,37 @@ export function ListMembersPanel(props) {
         hostId,
         listId
     ]);
+    /*
+   * The page's rule rows that say nothing about consent themselves, asked of
+   * their contacts once per page. Rows already answered are not asked again;
+   * a refused or failed read leaves the row's own label, which is the honest
+   * fallback — it is what the row records.
+   */ const unansweredRuleRows = members.filter((row)=>row.via === 'rule' && consentLabel(row, consentGroup).key === 'none' && !(memberAddress(row) in contactConsent)).map(memberAddress).filter(Boolean);
+    const unansweredKey = unansweredRuleRows.join('\n');
+    useEffect(()=>{
+        if (!unansweredKey || !user) return;
+        let current = true;
+        const asked = unansweredKey.split('\n');
+        void post('list-member-consent', {
+            emails: asked
+        }).then(({ ok, payload })=>{
+            var _ref, _answered_email;
+            if (!current || !ok) return;
+            const answered = (_ref = payload == null ? void 0 : payload.consent) != null ? _ref : {};
+            // Every address asked is settled — `null` where the route had nothing
+            // to add — so a page is asked about once.
+            const settled = {};
+            for (const email of asked)settled[email] = (_answered_email = answered[email]) != null ? _answered_email : null;
+            setContactConsent((before)=>_extends({}, before, settled));
+        }).catch(()=>undefined);
+        return ()=>{
+            current = false;
+        };
+    }, [
+        unansweredKey,
+        user,
+        post
+    ]);
     const handlePreview = useCallback(async ()=>{
         if (busy || !addresses.length) return;
         setBusy(true);
@@ -518,9 +558,9 @@ export function ListMembersPanel(props) {
             field: 'consent',
             headerName: 'Consent',
             width: 190,
-            valueGetter: (_value, row)=>consentLabel(row, consentGroup).label,
+            valueGetter: (_value, row)=>labelFor(row).label,
             renderCell: ({ row })=>{
-                const consent = consentLabel(row, consentGroup);
+                const consent = labelFor(row);
                 return /*#__PURE__*/ _jsx(Chip, {
                     size: "small",
                     variant: "outlined",

package/src/lib/components/list-members-panel.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/components/list-members-panel.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\n/**\n * Who is on one list, and the three things you can do about it.\n *\n * The audience card could create a list and delete a list. It could not show\n * you a single name on one. This panel is the rest of it: read the membership,\n * add somebody, take somebody off. The list's own settings — its name, and the\n * rule behind a dynamic one — belong to the edit route, because they are\n * facts about the LIST rather than about who is on it.\n *\n * ## It mounts only on a list's own page\n *\n * The audience detail route renders this for the ONE list being read. A\n * membership listener per row would open one per list on the audiences table,\n * on a surface where most visits are to read the list of lists — the\n * read-on-mount shape `emails-console-read-cost.spec.tsx` meters. Nothing here\n * reads anything until a list is opened, and the add form reads nothing until\n * an address is typed.\n *\n * ## Whether somebody may be ADDED is the server's answer, always\n *\n * Every sentence about an address being typed in is `email/list-members-preview`\n * answering from that person's actual record and both suppression lists. This\n * component decides none of it. A screen that decided for itself would be a\n * second copy of the rule on the one surface whose job is to tell the operator\n * the truth about what is about to happen — including, and especially, that\n * the product knows nothing about this person's permission.\n *\n * ## The membership table reads consent through the SEND-TIME reader\n *\n * The `Consent` column answers the same question `performCampaignSend` asks of\n * the same document, so it asks it with the same function —\n * {@link readMarketingBasis}, against the consent group this console is being\n * viewed as. A column that picked the fields out of the row itself is a second\n * reader of a stored shape, and the two only agree until the shape moves.\n *\n * ## Removing is not suppressing, and the screen says so\n *\n * Taking somebody off a list is the operator changing their mind about an\n * audience. It is not the person asking to stop being mailed, it does not stop\n * another list reaching them, and it writes nothing to the suppression list.\n * Those are different acts with different records, and a console that let them\n * blur is a console where \"remove\" is quietly relied on as an unsubscribe.\n */\n\nimport {\n  readMarketingBasis,\n  type ConsentGroup,\n  type DynamicListRule,\n} from '@aglyn/aglyn'\nimport { mdiAccountRemoveOutline } from '@aglyn/shared-data-mdi'\nimport { MdiIcon, useConfirmationContext } from '@aglyn/shared-ui-jsx'\nimport ListFilterChips from '@aglyn/shared-ui-jsx/components/list-filter-chips.component'\nimport { ListPagination } from '@aglyn/shared-ui-jsx/components/list-pagination.component'\nimport ListQueryNotices, {\n  listQueryRefusals,\n} from '@aglyn/shared-ui-jsx/components/list-query-notices.component'\nimport {\n  ListRowActions,\n  ListTable,\n  listActionsColumn,\n} from '@aglyn/shared-ui-jsx/components/list-table.component'\nimport { listFilterGridColumns } from '@aglyn/shared-ui-jsx/const/list-grid-filter'\nimport { TABLE_ROW_HEIGHT } from '@aglyn/shared-ui-jsx/const/table-pagination'\nimport { useListGridFilter } from '@aglyn/shared-ui-jsx/hooks/use-list-grid-filter'\nimport { useSnackbar } from '@aglyn/shared-ui-snackstack'\nimport {\n  Alert,\n  Box,\n  Button,\n  Checkbox,\n  Chip,\n  FormControlLabel,\n  Stack,\n  TextField,\n  Typography,\n} from '@mui/material'\nimport type { GridColDef } from '@mui/x-data-grid'\nimport { collection, deleteDoc, doc } from 'firebase/firestore'\nimport { useCallback, useEffect, useMemo, useState } from 'react'\nimport { useFirestore, useUser } from '@aglyn/tenant-feature-instance'\nimport { useListQuery } from '@aglyn/tenant-feature-instance/hooks/use-list-query'\nimport { useListColumnSort } from '@aglyn/shared-ui-jsx/hooks/use-list-column-sort'\nimport type { ListQuerySort } from '@aglyn/shared-ui-jsx/const/list-query-plan'\nimport { authorizedFetch } from '@aglyn/shared-util-http/authorized-token'\nimport {\n  LIST_MEMBER_FILTER_HEADERS,\n  LIST_MEMBER_FILTER_OPTIONS,\n  LIST_MEMBER_QUERY,\n} from '../constants/list-queries'\n\nexport interface ListMembersPanelProps {\n  hostId: string\n  /**\n   * The controller this membership is being read AS — the declared group of\n   * sites that are one sender, or this site alone.\n   *\n   * Required and undefaulted, for the reason {@link readMarketingBasis} makes\n   * it required: a basis runs to a brand, so a surface that has not said which\n   * brand is asking cannot report one. Defaulting to the group of one here\n   * would compile and would then answer a declared group's questions with a\n   * single site's facts — reporting a sibling's refusal as no record at all,\n   * and a pooled grant as another brand's.\n   */\n  consentGroup: ConsentGroup\n  /** `['orgs', orgId]` — the resolved org scope the card already holds. */\n  scope: readonly [string, string]\n  listId: string\n  listName: string\n  /**\n   * Called after a membership is added or removed.\n   *\n   * The audience page's subscriber total is a server aggregate, taken once.\n   * Left alone it would go on reporting the figure from before the add — a\n   * stale total directly above a live table that disagrees with it, which\n   * reads as the add having failed. The page re-takes the aggregate on this\n   * signal and at no other time, so nothing is re-counted while somebody is\n   * only reading.\n   */\n  onMembershipChanged?: () => void\n  /**\n   * The list's saved filters, when it has any and its membership is FIXED.\n   *\n   * Present, the panel offers to find the people they select and add them —\n   * the same act as typing addresses, with the search doing the typing. Absent\n   * (a live list, or one with no filters saved), the add form is the address\n   * box alone: a live list's membership is the sweep's to decide, and offering\n   * to add its own matches by hand would produce hand-added copies of rows the\n   * sweep already owns.\n   */\n  findRule?: DynamicListRule | null\n  /** The same filters in sentences, so the button says what it will find. */\n  ruleSummary?: readonly string[]\n  /**\n   * Told what the table is filtered to — `null` when it is not — so the\n   * card's Export can offer \"the current filter\": the predicates this\n   * table's own query is asking, which the export reads with the same query.\n   */\n  onFilterChange?: (filter: ListMembersFilter | null) => void\n}\n\n/** The member table's filter, as the export dialog offers it. */\nexport interface ListMembersFilter {\n  label: string\n  value: { filters: ReadonlyArray<{ path: string; op: string; value: unknown }> }\n}\n\n/**\n * One member row, as stored.\n *\n * The consent fields are deliberately NOT enumerated here. They live one level\n * down, in an entry per site under `marketingConsentByHost`, and a row type\n * that named them at the top would be an invitation to read them there — which\n * is exactly what this table did while `enrollListMember` wrote them nested,\n * so every membership on every list reported \"No basis on record\" while the\n * send path mailed the same people on a basis it could see perfectly well. The\n * index signature is what {@link readMarketingBasis} takes; it is the only\n * reader of those fields on this surface.\n */\ninterface MemberRow {\n  $id: string\n  email?: string\n  name?: string\n  source?: string\n  via?: 'manual' | 'rule'\n  addedAt?: { toDate?: () => Date }\n  [field: string]: unknown\n}\n\n/** What `email/list-members-preview` answers for one address. */\ninterface AddressVerdict {\n  input: string\n  email: string | null\n  refusal: string | null\n  requiresAttestation: boolean\n  summary: string\n}\n\ninterface Preview {\n  verdicts: AddressVerdict[]\n  optedIn: number\n  needAttestation: number\n  refused: number\n}\n\n/** What a filter search found, as `email/list-rule-preview` reports it. */\ninterface FoundPeople extends Preview {\n  /** People the filters matched — NOT the length of `emails`. */\n  matched: number\n  /** `emails` is one batch of a larger match. */\n  truncated: boolean\n  /** False when the scan hit its budget, so `matched` is itself a floor. */\n  complete: boolean\n  emails: string[]\n}\n\n/** What one address's outcome was, after the add. */\ninterface AddResult {\n  input: string\n  email: string | null\n  enrolled: boolean\n  error?: string\n}\n\n/**\n * How the basis reads on screen, for the group this console is viewed as.\n *\n * ## Read through `readMarketingBasis`, never off the row\n *\n * This picked `marketingConsent`, `marketingConsentBasis` and\n * `marketingConsentAtMs` off the top of the membership document, which is\n * where `enrollListMember` used to put them. They now live in an entry per\n * site under `marketingConsentByHost`, because a basis runs to the brand it\n * was given to rather than to the account that holds the row. Nothing here\n * moved with them, so every top-level read answered `undefined` and every\n * member of every list — including people carrying a perfectly good attested\n * basis — was reported as having no basis on record, on the one screen an\n * operator consults before mailing them. `performCampaignSend` reads the same\n * documents through the function below and mailed them, correctly, at the same\n * time.\n *\n * The fix is not a second field name. It is that the send path's reader is the\n * only reader: a surface that parses the stored shape itself agrees with the\n * sender only until the shape moves, and it moves without anybody thinking to\n * look here.\n *\n * ## Five states, because the model carries five\n *\n * An attestation and an opt-in are not the same fact — one is a person's own\n * decision, the other a claim an account made on their behalf — and a table\n * rendering both as a tick is the conflation `list-members.ts` stores the\n * basis to prevent. The three that are not a grant are not one state either.\n * Absence is not refusal, and neither of them is \"opted in, to somebody else\n * in this account\": that third one is a person the sender deliberately leaves\n * alone, and an operator who cannot see why reads it as the product having\n * lost their subscriber.\n */\ntype ConsentKey =\n  | 'opted-out'\n  | 'attested'\n  | 'opted-in'\n  | 'other-site'\n  | 'no-site'\n  | 'none'\n\nfunction consentLabel(\n  member: MemberRow,\n  group: ConsentGroup,\n): { key: ConsentKey; label: string; color: 'default' | 'warning' | 'error' } {\n  const record = readMarketingBasis(member as Record<string, unknown>, group)\n  const when = record.basisAtMs\n    ? ` · ${new Date(record.basisAtMs).toLocaleDateString()}`\n    : ''\n  if (record.basis === 'declined') {\n    return { key: 'opted-out', label: `Opted out${when}`, color: 'error' }\n  }\n  if (record.basis === 'granted') {\n    /*\n     * `assertedBy` rather than the stored basis field, because there are two\n     * ways a record says an operator asserted it — a membership's\n     * `marketingConsentBasis`, and the provenance object a backfill writes —\n     * and the reader has already resolved both into this one answer.\n     */\n    return record.assertedBy === 'operator'\n      ? { key: 'attested', label: `Attested by your team${when}`, color: 'warning' }\n      : { key: 'opted-in', label: `Opted in${when}`, color: 'default' }\n  }\n  /*\n   * A grant this site may not use. Reported rather than folded into \"no\n   * basis\" because the two are different situations with different answers:\n   * nobody has ever asked this person, versus somebody asked them on behalf\n   * of another brand in this account and this brand may not borrow it.\n   */\n  if (record.otherGrant === 'other-host') {\n    return { key: 'other-site', label: 'Opted in to another site', color: 'warning' }\n  }\n  if (record.otherGrant === 'unscoped') {\n    return { key: 'no-site', label: 'Opted in — no site recorded', color: 'warning' }\n  }\n  return { key: 'none', label: 'No basis on record', color: 'default' }\n}\n\n/** How a member got here, by the words the column draws. */\nconst VIA_LABELS: Readonly<Record<'rule' | 'manual', string>> = {\n  rule: 'Rule',\n  manual: 'Added',\n}\n/** The How filter's choices are picked, so the panel shows a select. */\nconst MEMBER_SELECT_FIELDS = ['via']\n/** The page-sorted header, for its notice (AGL-3680). */\nconst MEMBER_SORT_HEADERS = { consent: 'Consent' }\n\n/** How a row reads `via`: a row that predates the field was added by hand. */\nconst viaOf = (member: MemberRow): 'rule' | 'manual' =>\n  member.via === 'rule' ? 'rule' : 'manual'\n\n/** Free text — a paste, a typed address, commas or newlines — to addresses. */\nexport function splitAddresses(value: string): string[] {\n  return value\n    .split(/[\\s,;]+/)\n    .map((entry) => entry.trim())\n    // A pasted mail-client line is `Name <a@b.co>`; keep the address part.\n    .map((entry) => entry.replace(/^.*<|>.*$/g, ''))\n    .filter(Boolean)\n}\n\nexport function ListMembersPanel(props: ListMembersPanelProps) {\n  const {\n    hostId,\n    consentGroup,\n    scope,\n    listId,\n    listName,\n    onMembershipChanged,\n    findRule,\n    ruleSummary,\n  } = props\n  const firestore = useFirestore()\n  const { data: user } = useUser()\n  const { enqueueSnackbar } = useSnackbar()\n  const { confirm } = useConfirmationContext()\n\n  /*\n   * Ordered by DOCUMENT ID and paged, not capped and re-sorted here.\n   *\n   * `__name__` rather than `addedAt`, which is the column a reader would\n   * assume: `orderBy` FILTERS as well as sorts, so a document missing the\n   * field is not in the result at all — and `addedAt` is stamped only when a\n   * membership is CREATED, so every row written under the two legacy ids\n   * `list-members.ts` still adopts predates it. Ordering on it would drop the\n   * oldest members from their own list, silently, which is the failure that\n   * turned an audience into a random sample (AGL-2501). The id is the one key\n   * every row has, so it stays the default. The Joined header asks for\n   * `addedAt` only since the writer stamps it on every row it touches and\n   * `backfill-list-member-sort-fields.mjs` on the rest (AGL-3680).\n   *\n   * Every filter and search word is a predicate on the same query\n   * (AGL-3321) — see `LIST_MEMBER_QUERY` — so a page is a page of the\n   * matches.\n   */\n  const gridFilter = useListGridFilter({ selectFields: MEMBER_SELECT_FIELDS })\n  /*\n   * EVERY HEADER SORTS (AGL-3680). Address, Name, Joined and How order the\n   * QUERY — `enrollListMember` stamps each on every row, null where there is\n   * none, so no order drops a member — each `alone`: under a filter or the\n   * search the list keeps its id order and says so. Consent is read per\n   * viewing consent group, so it sorts the page on screen.\n   */\n  const [askedSort, setAskedSort] = useState<ListQuerySort | null>(null)\n  const {\n    rows: members,\n    hasMore,\n    page,\n    setPage,\n    pageSize,\n    setPageSize,\n    plan,\n  } = useListQuery<MemberRow>({\n    collection: collection(firestore, scope[0], scope[1], 'lists', listId, 'members'),\n    declaration: LIST_MEMBER_QUERY,\n    request: {\n      clauses: gridFilter.clauses,\n      search: gridFilter.searchWords,\n      sort: askedSort,\n    },\n    deps: [firestore, scope[0], scope[1], listId],\n    idField: '$id',\n  })\n  const pageSorts = useMemo(\n    () => ({ consent: (row: MemberRow) => consentLabel(row, consentGroup).label }),\n    [consentGroup],\n  )\n  const columnSort = useListColumnSort<MemberRow>({\n    sorts: LIST_MEMBER_QUERY.sorts,\n    sort: askedSort,\n    onSortChange: setAskedSort,\n    orderBy: plan.orderBy,\n    rows: members,\n    pageSorts,\n    headers: MEMBER_SORT_HEADERS,\n  })\n  const filtering =\n    gridFilter.clauses.length > 0 || gridFilter.searchWords.some((word) => word.trim())\n  const { onFilterChange } = props\n  const filterKey = filtering ? JSON.stringify(plan.filters) : ''\n  useEffect(() => {\n    if (!onFilterChange) return\n    onFilterChange(\n      filterKey\n        ? {\n            label: 'Members matching the table’s filters',\n            value: { filters: JSON.parse(filterKey) },\n          }\n        : null,\n    )\n  }, [filterKey, onFilterChange])\n  const refusals = useMemo(\n    () =>\n      listQueryRefusals(plan.refused, {\n        fields: LIST_MEMBER_QUERY.fields,\n        headers: LIST_MEMBER_FILTER_HEADERS,\n        options: LIST_MEMBER_FILTER_OPTIONS,\n      }),\n    [plan.refused],\n  )\n\n  const [addInput, setAddInput] = useState('')\n  const [addName, setAddName] = useState('')\n  const [preview, setPreview] = useState<Preview | null>(null)\n  const [attested, setAttested] = useState(false)\n  const [results, setResults] = useState<AddResult[] | null>(null)\n  const [busy, setBusy] = useState(false)\n  /*\n   * The addresses a SEARCH found, when the operator ran one.\n   *\n   * A second way to fill the same candidate set, not a second way to add. Once\n   * this holds addresses, everything below it — the consent readout, the\n   * attestation, the Add button — is the code the typed path already used, so\n   * there is exactly one place in this component where somebody is put on a\n   * list and exactly one gate in front of it.\n   */\n  const [found, setFound] = useState<FoundPeople | null>(null)\n\n  const addresses = found ? found.emails : splitAddresses(addInput)\n\n  /*\n   * Any edit to the box invalidates the answer.\n   *\n   * A preview belongs to the exact addresses it was run for. Leaving a stale\n   * one on screen would show a count, and an attestation checkbox, for a set\n   * the operator has since changed — so the number they stand behind would\n   * not be the number that acts. Typing also abandons a search: the two are\n   * alternative ways of naming a candidate set, and holding both at once\n   * would leave the Add button acting on whichever the code happened to\n   * prefer.\n   */\n  useEffect(() => {\n    setPreview(null)\n    setAttested(false)\n    setResults(null)\n    setFound(null)\n  }, [addInput])\n\n  const post = useCallback(\n    async (route: string, body: Record<string, unknown>) => {\n      const response = await authorizedFetch(user, `/api/email/${route}`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ hostId, listId, ...body }),\n      })\n      const payload = await response.json().catch(() => ({}))\n      return { ok: response.ok, payload }\n    },\n    [user, hostId, listId],\n  )\n\n  const handlePreview = useCallback(async () => {\n    if (busy || !addresses.length) return\n    setBusy(true)\n    try {\n      const { ok, payload } = await post('list-members-preview', {\n        emails: addresses,\n      })\n      if (!ok) {\n        return void enqueueSnackbar(\n          payload?.error ?? 'The addresses could not be checked.',\n          { variant: 'warning', allowDuplicate: true },\n        )\n      }\n      setPreview(payload as Preview)\n    } catch {\n      enqueueSnackbar('The addresses could not be checked.', {\n        variant: 'warning',\n        allowDuplicate: true,\n      })\n    } finally {\n      setBusy(false)\n    }\n  }, [busy, addresses, post, enqueueSnackbar])\n\n  const handleFind = useCallback(async () => {\n    if (busy || !findRule) return\n    setBusy(true)\n    try {\n      const { ok, payload } = await post('list-rule-preview', {\n        rule: findRule,\n      })\n      if (!ok) {\n        return void enqueueSnackbar(\n          payload?.error ?? 'The audience could not be worked out.',\n          { variant: 'warning', allowDuplicate: true },\n        )\n      }\n      /*\n       * The verdicts come back from the SAME resolution the typed path runs,\n       * so what lands in `preview` here is the same object the consent\n       * readout below already knows how to draw. A search that returned its\n       * own shaped summary would be a second consent readout, and the second\n       * one is the one nobody reviews.\n       */\n      setFound(payload as FoundPeople)\n      setPreview(payload as Preview)\n      setAttested(false)\n      setResults(null)\n      if (!Number(payload?.matched ?? 0)) {\n        enqueueSnackbar('These filters match nobody', {\n          variant: 'info',\n          persist: false,\n        })\n      }\n    } catch {\n      enqueueSnackbar('The audience could not be worked out.', {\n        variant: 'warning',\n        allowDuplicate: true,\n      })\n    } finally {\n      setBusy(false)\n    }\n  }, [busy, findRule, post, enqueueSnackbar])\n\n  const handleAdd = useCallback(async () => {\n    if (busy || !preview) return\n    setBusy(true)\n    try {\n      const { ok, payload } = await post('list-members-add', {\n        emails: addresses,\n        ...(addresses.length === 1 && addName.trim()\n          ? { name: addName.trim() }\n          : {}),\n        // The operator's assertion, not a basis they named: the server\n        // derives a pass-through from each person's own record, and this flag\n        // can only ever add the attributable kind.\n        attestConsent: attested,\n      })\n      if (!ok) {\n        return void enqueueSnackbar(\n          payload?.error ?? 'Nobody was added to the list',\n          { variant: 'warning', allowDuplicate: true },\n        )\n      }\n      const added = Number(payload?.added ?? 0)\n      setResults((payload?.results ?? []) as AddResult[])\n      setPreview(null)\n      if (added) {\n        setAddInput('')\n        setAddName('')\n        setFound(null)\n        onMembershipChanged?.()\n      }\n      enqueueSnackbar(\n        added === 1 ? 'One person added' : `${added} people added`,\n        { variant: added ? 'success' : 'warning', persist: false },\n      )\n    } catch {\n      enqueueSnackbar('Nobody was added to the list', {\n        variant: 'warning',\n        allowDuplicate: true,\n      })\n    } finally {\n      setBusy(false)\n    }\n  }, [\n    busy,\n    preview,\n    addresses,\n    addName,\n    attested,\n    post,\n    enqueueSnackbar,\n    onMembershipChanged,\n  ])\n\n  const handleRemove = useCallback(\n    async (member: MemberRow) => {\n      const accepted = await confirm({\n        title: 'Remove from this list?',\n        description:\n          `${member.email ?? 'This person'} stops being part of \"${listName}\" ` +\n          'and campaigns to this list stop reaching them. This is NOT an ' +\n          'unsubscribe: it does not add them to your suppression list, and ' +\n          'any other list they are on still reaches them. If they asked to ' +\n          'stop hearing from you, suppress the address instead.',\n        confirmationText: 'Remove',\n        confirmationButtonProps: { color: 'error' },\n      })\n        // `confirm` resolves with no value and REJECTS on cancel, so gating on\n        // the resolved value alone would make this always proceed (AGL-950).\n        .then(() => true)\n        .catch(() => false)\n      if (!accepted) return\n      try {\n        await deleteDoc(\n          doc(\n            firestore,\n            scope[0],\n            scope[1],\n            'lists',\n            listId,\n            'members',\n            member.$id,\n          ),\n        )\n        onMembershipChanged?.()\n        enqueueSnackbar('Removed from the list', {\n          variant: 'success',\n          persist: false,\n        })\n      } catch (error) {\n        console.error(error)\n        enqueueSnackbar('They were not removed', { variant: 'error' })\n      }\n    },\n    [\n      confirm,\n      listName,\n      firestore,\n      scope,\n      listId,\n      enqueueSnackbar,\n      onMembershipChanged,\n    ],\n  )\n\n  const enrollable = preview\n    ? preview.optedIn + preview.needAttestation\n    : 0\n\n  const columns: GridColDef[] = [\n    {\n      field: 'email',\n      headerName: 'Address',\n      flex: 1,\n      minWidth: 220,\n      valueGetter: (_value, row) => row.email ?? '—',\n    },\n    {\n      field: 'name',\n      headerName: 'Name',\n      flex: 1,\n      minWidth: 160,\n      valueGetter: (_value, row) => row.name ?? '—',\n    },\n    {\n      field: 'addedAt',\n      headerName: 'Joined',\n      width: 120,\n      // Sorted on the instant, drawn as a local date.\n      valueGetter: (_value, row) => row.addedAt?.toDate?.()?.getTime?.() ?? 0,\n      renderCell: ({ row }) =>\n        row.addedAt?.toDate ? row.addedAt.toDate().toLocaleDateString() : '—',\n    },\n    {\n      field: 'via',\n      headerName: 'How',\n      width: 200,\n      valueGetter: (_value, row) => viaOf(row),\n      /*\n        `via` says whether a rule put them here or a person did, which is what\n        decides whether they LEAVE on their own: the materializer reconciles its\n        own rows away and never touches a manual one. `source` is the finer\n        provenance underneath it.\n       */\n      renderCell: ({ row }) => (\n        <Stack direction=\"row\" spacing={1} sx={{ alignItems: 'center', minWidth: 0 }}>\n          <Chip size=\"small\" variant=\"outlined\" label={VIA_LABELS[viaOf(row)]} />\n          {row.source ? (\n            <Typography variant=\"caption\" color=\"text.secondary\" noWrap>\n              {row.source}\n            </Typography>\n          ) : null}\n        </Stack>\n      ),\n    },\n    {\n      field: 'consent',\n      headerName: 'Consent',\n      width: 190,\n      valueGetter: (_value, row) => consentLabel(row, consentGroup).label,\n      renderCell: ({ row }) => {\n        const consent = consentLabel(row, consentGroup)\n        return (\n          <Chip\n            size=\"small\"\n            variant=\"outlined\"\n            color={consent.color}\n            label={consent.label}\n          />\n        )\n      },\n    },\n    /*\n      A SUBSCRIBER HAS NO PAGE of their own here, so the row opens nothing —\n      but taking somebody off an audience is the one act performed on one, and\n      it belongs in the trailing cluster with every other list's actions rather\n      than as a red text button sitting in the row.\n     */\n    listActionsColumn(\n      (row) => (\n        <ListRowActions\n          label={String(row.email ?? row.$id)}\n          items={[\n            {\n              key: 'remove',\n              label: 'Remove from this list',\n              icon: <MdiIcon path={mdiAccountRemoveOutline.path} size={0.8} />,\n              destructive: true,\n              onClick: () => void handleRemove(row),\n            },\n          ]}\n        />\n      ),\n      { width: 72 },\n    ),\n  ]\n\n  return (\n    <Stack spacing={2} sx={{ py: 2 }}>\n      {/*\n        FINDING people, for a list whose membership is fixed.\n        The filters are the same ones a live list is swept by; here they run\n        once, on request, and what they find is offered for adding rather than\n        enrolled. The count and the consent readout arrive together, because\n        the second is the thing that decides how much of the first can act.\n       */}\n      {findRule ? (\n        <Stack\n          spacing={1}\n          sx={{ border: 1, borderColor: 'divider', borderRadius: 1, p: 1.5 }}\n        >\n          <Typography variant=\"overline\" color=\"text.secondary\">\n            {'Find people'}\n          </Typography>\n          {(ruleSummary ?? []).map((clause) => (\n            <Typography key={clause} variant=\"body2\">\n              {clause}\n            </Typography>\n          ))}\n          <Box>\n            <Button\n              size=\"small\"\n              variant=\"outlined\"\n              disabled={busy}\n              onClick={() => void handleFind()}\n            >\n              {busy ? 'Searching…' : 'Find matching people'}\n            </Button>\n          </Box>\n          {found ? (\n            <Alert severity={found.matched ? 'info' : 'warning'}>\n              {(found.matched === 1\n                ? '1 person matches'\n                : `${found.matched.toLocaleString()} people match`) +\n                (found.truncated\n                  ? ` — this batch covers the first ${found.emails.length}. ` +\n                    'Add them, then search again for the rest.'\n                  : '') +\n                (found.complete\n                  ? ''\n                  : ' The search stopped at its read budget, so this is at ' +\n                    'least that many rather than exactly.')}\n            </Alert>\n          ) : null}\n          <Typography variant=\"caption\" color=\"text.secondary\">\n            {'Whoever you add stays on this list. It does not keep growing — ' +\n              'change the membership to live on the edit page if you want ' +\n              'new matches enrolled automatically.'}\n          </Typography>\n        </Stack>\n      ) : null}\n\n      <Typography variant=\"body2\" color=\"text.secondary\">\n        {'Add someone by typing their address, or paste a column of them. ' +\n          'Every address is checked against their consent record and both ' +\n          'suppression lists before anyone is added.'}\n      </Typography>\n\n      <Stack direction=\"row\" spacing={1} useFlexGap sx={{ flexWrap: 'wrap' }}>\n        <TextField\n          size=\"small\"\n          label=\"Email addresses\"\n          placeholder=\"someone@example.com\"\n          multiline\n          minRows={1}\n          maxRows={6}\n          value={addInput}\n          onChange={(event) => setAddInput(event.target.value)}\n          helperText={\n            addresses.length > 1\n              ? `${addresses.length} addresses`\n              : 'One address, or paste many'\n          }\n          sx={{ flexGrow: 1, minWidth: 260 }}\n        />\n        {addresses.length > 1 ? null : (\n          <TextField\n            size=\"small\"\n            label=\"Name\"\n            value={addName}\n            onChange={(event) => setAddName(event.target.value)}\n            sx={{ minWidth: 180 }}\n          />\n        )}\n        <Box>\n          <Button\n            size=\"small\"\n            variant=\"outlined\"\n            disabled={busy || !addresses.length || Boolean(preview)}\n            onClick={() => void handlePreview()}\n          >\n            {busy ? 'Checking…' : 'Check'}\n          </Button>\n        </Box>\n      </Stack>\n\n      {/*\n        The count, in front of the operator, BEFORE the attestation control\n        exists. One assertion covers the batch, so the number it covers has to\n        be on screen when it is given — an attestation offered above an\n        unexamined paste is a signature on a blank page.\n       */}\n      {preview ? (\n        <Stack spacing={1}>\n          <Alert severity={enrollable ? 'info' : 'warning'}>\n            {[\n              preview.optedIn\n                ? `${preview.optedIn} already opted in`\n                : '',\n              preview.needAttestation\n                ? `${preview.needAttestation} with no opt-in on record`\n                : '',\n              preview.refused\n                ? `${preview.refused} cannot be added at all`\n                : '',\n            ]\n              .filter(Boolean)\n              .join(' · ')}\n          </Alert>\n          {/*\n            The HARD refusals only. An address that merely needs the\n            attestation is not a refusal — listing it here would put the very\n            people the checkbox below is about under a heading that says they\n            cannot be added.\n           */}\n          {preview.verdicts\n            .filter((verdict) => verdict.refusal)\n            .map((verdict) => (\n              <Typography\n                key={verdict.input}\n                variant=\"caption\"\n                color=\"text.secondary\"\n              >\n                {`${verdict.input} — ${verdict.summary}`}\n              </Typography>\n            ))}\n          {preview.needAttestation ? (\n            <FormControlLabel\n              control={\n                <Checkbox\n                  checked={attested}\n                  onChange={(event) => setAttested(event.target.checked)}\n                />\n              }\n              label={\n                <Typography variant=\"body2\">\n                  {`I have permission to send marketing email to the ` +\n                    `${preview.needAttestation} ` +\n                    `${preview.needAttestation === 1 ? 'person' : 'people'} ` +\n                    'above with no opt-in on record. This is recorded against ' +\n                    'my account, with the date.'}\n                </Typography>\n              }\n            />\n          ) : null}\n          <Box>\n            <Button\n              size=\"small\"\n              variant=\"contained\"\n              disabled={\n                busy ||\n                !enrollable ||\n                (preview.needAttestation > 0 && !attested)\n              }\n              onClick={() => void handleAdd()}\n            >\n              {busy ? 'Adding…' : `Add ${enrollable}`}\n            </Button>\n          </Box>\n        </Stack>\n      ) : null}\n\n      {/*\n        What actually happened, per address. A batch where one address was\n        suppressed and forty were fine is not a failure, and a bare count would\n        leave the operator to work out which of their lines is missing.\n       */}\n      {results?.length ? (\n        <Stack spacing={0.5}>\n          {results\n            .filter((result) => !result.enrolled)\n            .map((result) => (\n              <Typography\n                key={result.input}\n                variant=\"caption\"\n                color=\"text.secondary\"\n              >\n                {`${result.input} — not added. ${result.error ?? ''}`}\n              </Typography>\n            ))}\n        </Stack>\n      ) : null}\n\n      {members.length === 0 && !hasMore && !filtering ? (\n        <Typography variant=\"body2\" color=\"text.secondary\">\n          {'Nobody is on this list yet.'}\n        </Typography>\n      ) : (\n        <>\n          <ListFilterChips\n            fields={LIST_MEMBER_QUERY.fields}\n            headers={LIST_MEMBER_FILTER_HEADERS}\n            clauses={gridFilter.clauses}\n            onChange={gridFilter.setClauses}\n            options={LIST_MEMBER_FILTER_OPTIONS}\n          />\n          <ListQueryNotices\n            refused={refusals}\n            notices={[...plan.notices, ...columnSort.notices]}\n          />\n          <ListTable\n            aria-label={`Members of ${listName}`}\n            rows={columnSort.rows}\n            columnSort={columnSort}\n            columns={listFilterGridColumns(\n              columns,\n              LIST_MEMBER_QUERY.fields,\n              LIST_MEMBER_FILTER_OPTIONS,\n              LIST_MEMBER_FILTER_HEADERS,\n            )}\n            rowHeight={TABLE_ROW_HEIGHT}\n            // Paged by the footer below, so the grid must not also slice.\n            hideFooter\n            // The panel, the search and the headers go to the query (Consent\n            // sorts the page, and says so); the grid itself sorts nothing.\n            filterMode=\"server\"\n            filterModel={gridFilter.filterModel}\n            onFilterModelChange={gridFilter.onFilterModelChange}\n            quickFilter\n            noRowsLabel=\"No members match these filters\"\n          />\n          <ListPagination\n            page={page}\n            pageSize={pageSize}\n            rowCount={members.length}\n            hasMore={hasMore}\n            onPageChange={setPage}\n            onPageSizeChange={setPageSize}\n          />\n        </>\n      )}\n\n      {/*\n        What the column MEANS, and what to do about the one state an operator\n        can act on. \"No basis on record\" is a fact about this site's records,\n        not a refusal and not a dead end — the remedy is the add form above,\n        which merges onto the membership that is already here rather than\n        creating a second one. Whether a basis-less member is actually mailed\n        is the org's consent policy to decide and is deliberately not claimed\n        here: this surface does not hold that setting, and a caption that\n        guessed it would be wrong for every org on the other mode.\n       */}\n      <Typography variant=\"caption\" color=\"text.secondary\">\n        {'\"No basis on record\" means nobody has recorded this person\\'s ' +\n          'permission for this site — it is not a refusal. To record one, put ' +\n          'their address in the box above and state that you have their ' +\n          'permission; the statement is kept against your account, with the ' +\n          'date.'}\n      </Typography>\n\n      <Typography variant=\"caption\" color=\"text.secondary\">\n        {'Removing someone from a list is not an unsubscribe. It does not add ' +\n          'them to your suppression list, and it does not stop any other list ' +\n          'reaching them. If somebody asked you to stop, suppress the address.'}\n      </Typography>\n    </Stack>\n  )\n}\nListMembersPanel.displayName = 'ListMembersPanel'\n\nexport default ListMembersPanel\n"],"names":["readMarketingBasis","mdiAccountRemoveOutline","MdiIcon","useConfirmationContext","ListFilterChips","ListPagination","ListQueryNotices","listQueryRefusals","ListRowActions","ListTable","listActionsColumn","listFilterGridColumns","TABLE_ROW_HEIGHT","useListGridFilter","useSnackbar","Alert","Box","Button","Checkbox","Chip","FormControlLabel","Stack","TextField","Typography","collection","deleteDoc","doc","useCallback","useEffect","useMemo","useState","useFirestore","useUser","useListQuery","useListColumnSort","authorizedFetch","LIST_MEMBER_FILTER_HEADERS","LIST_MEMBER_FILTER_OPTIONS","LIST_MEMBER_QUERY","consentLabel","member","group","record","when","basisAtMs","Date","toLocaleDateString","basis","key","label","color","assertedBy","otherGrant","VIA_LABELS","rule","manual","MEMBER_SELECT_FIELDS","MEMBER_SORT_HEADERS","consent","viaOf","via","splitAddresses","value","split","map","entry","trim","replace","filter","Boolean","ListMembersPanel","props","hostId","consentGroup","scope","listId","listName","onMembershipChanged","findRule","ruleSummary","firestore","data","user","enqueueSnackbar","confirm","gridFilter","selectFields","askedSort","setAskedSort","rows","members","hasMore","page","setPage","pageSize","setPageSize","plan","declaration","request","clauses","search","searchWords","sort","deps","idField","pageSorts","row","columnSort","sorts","onSortChange","orderBy","headers","filtering","length","some","word","onFilterChange","filterKey","JSON","stringify","filters","parse","refusals","refused","fields","options","addInput","setAddInput","addName","setAddName","preview","setPreview","attested","setAttested","results","setResults","busy","setBusy","found","setFound","addresses","emails","post","route","body","response","method","payload","json","catch","ok","handlePreview","error","variant","allowDuplicate","handleFind","Number","matched","persist","handleAdd","name","attestConsent","added","handleRemove","accepted","title","description","email","confirmationText","confirmationButtonProps","then","$id","console","enrollable","optedIn","needAttestation","columns","field","headerName","flex","minWidth","valueGetter","_value","width","addedAt","toDate","getTime","renderCell","direction","spacing","sx","alignItems","size","source","noWrap","String","items","icon","path","destructive","onClick","py","border","borderColor","borderRadius","p","clause","disabled","severity","toLocaleString","truncated","complete","useFlexGap","flexWrap","placeholder","multiline","minRows","maxRows","onChange","event","target","helperText","flexGrow","join","verdicts","verdict","refusal","input","summary","control","checked","result","enrolled","setClauses","notices","aria-label","rowHeight","hideFooter","filterMode","filterModel","onFilterModelChange","quickFilter","noRowsLabel","rowCount","onPageChange","onPageSizeChange","displayName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CC,GAED,SACEA,kBAAkB,QAGb,eAAc;AACrB,SAASC,uBAAuB,QAAQ,yBAAwB;AAChE,SAASC,OAAO,EAAEC,sBAAsB,QAAQ,uBAAsB;AACtE,OAAOC,qBAAqB,8DAA6D;AACzF,SAASC,cAAc,QAAQ,4DAA2D;AAC1F,OAAOC,oBACLC,iBAAiB,QACZ,+DAA8D;AACrE,SACEC,cAAc,EACdC,SAAS,EACTC,iBAAiB,QACZ,uDAAsD;AAC7D,SAASC,qBAAqB,QAAQ,8CAA6C;AACnF,SAASC,gBAAgB,QAAQ,8CAA6C;AAC9E,SAASC,iBAAiB,QAAQ,kDAAiD;AACnF,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SACEC,KAAK,EACLC,GAAG,EACHC,MAAM,EACNC,QAAQ,EACRC,IAAI,EACJC,gBAAgB,EAChBC,KAAK,EACLC,SAAS,EACTC,UAAU,QACL,gBAAe;AAEtB,SAASC,UAAU,EAAEC,SAAS,EAAEC,GAAG,QAAQ,qBAAoB;AAC/D,SAASC,WAAW,EAAEC,SAAS,EAAEC,OAAO,EAAEC,QAAQ,QAAQ,QAAO;AACjE,SAASC,YAAY,EAAEC,OAAO,QAAQ,iCAAgC;AACtE,SAASC,YAAY,QAAQ,sDAAqD;AAClF,SAASC,iBAAiB,QAAQ,kDAAiD;AAEnF,SAASC,eAAe,QAAQ,2CAA0C;AAC1E,SACEC,0BAA0B,EAC1BC,0BAA0B,EAC1BC,iBAAiB,QACZ,+BAA2B;AA4JlC,SAASC,aACPC,MAAiB,EACjBC,KAAmB;IAEnB,MAAMC,SAAS1C,mBAAmBwC,QAAmCC;IACrE,MAAME,OAAOD,OAAOE,SAAS,GACzB,CAAC,GAAG,EAAE,IAAIC,KAAKH,OAAOE,SAAS,EAAEE,kBAAkB,IAAI,GACvD;IACJ,IAAIJ,OAAOK,KAAK,KAAK,YAAY;QAC/B,OAAO;YAAEC,KAAK;YAAaC,OAAO,CAAC,SAAS,EAAEN,MAAM;YAAEO,OAAO;QAAQ;IACvE;IACA,IAAIR,OAAOK,KAAK,KAAK,WAAW;QAC9B;;;;;KAKC,GACD,OAAOL,OAAOS,UAAU,KAAK,aACzB;YAAEH,KAAK;YAAYC,OAAO,CAAC,qBAAqB,EAAEN,MAAM;YAAEO,OAAO;QAAU,IAC3E;YAAEF,KAAK;YAAYC,OAAO,CAAC,QAAQ,EAAEN,MAAM;YAAEO,OAAO;QAAU;IACpE;IACA;;;;;GAKC,GACD,IAAIR,OAAOU,UAAU,KAAK,cAAc;QACtC,OAAO;YAAEJ,KAAK;YAAcC,OAAO;YAA4BC,OAAO;QAAU;IAClF;IACA,IAAIR,OAAOU,UAAU,KAAK,YAAY;QACpC,OAAO;YAAEJ,KAAK;YAAWC,OAAO;YAA+BC,OAAO;QAAU;IAClF;IACA,OAAO;QAAEF,KAAK;QAAQC,OAAO;QAAsBC,OAAO;IAAU;AACtE;AAEA,0DAA0D,GAC1D,MAAMG,aAA0D;IAC9DC,MAAM;IACNC,QAAQ;AACV;AACA,sEAAsE,GACtE,MAAMC,uBAAuB;IAAC;CAAM;AACpC,uDAAuD,GACvD,MAAMC,sBAAsB;IAAEC,SAAS;AAAU;AAEjD,4EAA4E,GAC5E,MAAMC,QAAQ,CAACnB,SACbA,OAAOoB,GAAG,KAAK,SAAS,SAAS;AAEnC,6EAA6E,GAC7E,OAAO,SAASC,eAAeC,KAAa;IAC1C,OAAOA,MACJC,KAAK,CAAC,WACNC,GAAG,CAAC,CAACC,QAAUA,MAAMC,IAAI,GAC1B,uEAAuE;KACtEF,GAAG,CAAC,CAACC,QAAUA,MAAME,OAAO,CAAC,cAAc,KAC3CC,MAAM,CAACC;AACZ;AAEA,OAAO,SAASC,iBAAiBC,KAA4B;IAC3D,MAAM,EACJC,MAAM,EACNC,YAAY,EACZC,KAAK,EACLC,MAAM,EACNC,QAAQ,EACRC,mBAAmB,EACnBC,QAAQ,EACRC,WAAW,EACZ,GAAGR;IACJ,MAAMS,YAAYjD;IAClB,MAAM,EAAEkD,MAAMC,IAAI,EAAE,GAAGlD;IACvB,MAAM,EAAEmD,eAAe,EAAE,GAAGrE;IAC5B,MAAM,EAAEsE,OAAO,EAAE,GAAGjF;IAEpB;;;;;;;;;;;;;;;;;GAiBC,GACD,MAAMkF,aAAaxE,kBAAkB;QAAEyE,cAAc9B;IAAqB;IAC1E;;;;;;GAMC,GACD,MAAM,CAAC+B,WAAWC,aAAa,GAAG1D,SAA+B;IACjE,MAAM,EACJ2D,MAAMC,OAAO,EACbC,OAAO,EACPC,IAAI,EACJC,OAAO,EACPC,QAAQ,EACRC,WAAW,EACXC,IAAI,EACL,GAAG/D,aAAwB;QAC1BT,YAAYA,WAAWwD,WAAWN,KAAK,CAAC,EAAE,EAAEA,KAAK,CAAC,EAAE,EAAE,SAASC,QAAQ;QACvEsB,aAAa3D;QACb4D,SAAS;YACPC,SAASd,WAAWc,OAAO;YAC3BC,QAAQf,WAAWgB,WAAW;YAC9BC,MAAMf;QACR;QACAgB,MAAM;YAACvB;YAAWN,KAAK,CAAC,EAAE;YAAEA,KAAK,CAAC,EAAE;YAAEC;SAAO;QAC7C6B,SAAS;IACX;IACA,MAAMC,YAAY5E,QAChB,IAAO,CAAA;YAAE6B,SAAS,CAACgD,MAAmBnE,aAAamE,KAAKjC,cAAcxB,KAAK;QAAC,CAAA,GAC5E;QAACwB;KAAa;IAEhB,MAAMkC,aAAazE,kBAA6B;QAC9C0E,OAAOtE,kBAAkBsE,KAAK;QAC9BN,MAAMf;QACNsB,cAAcrB;QACdsB,SAASd,KAAKc,OAAO;QACrBrB,MAAMC;QACNe;QACAM,SAAStD;IACX;IACA,MAAMuD,YACJ3B,WAAWc,OAAO,CAACc,MAAM,GAAG,KAAK5B,WAAWgB,WAAW,CAACa,IAAI,CAAC,CAACC,OAASA,KAAKjD,IAAI;IAClF,MAAM,EAAEkD,cAAc,EAAE,GAAG7C;IAC3B,MAAM8C,YAAYL,YAAYM,KAAKC,SAAS,CAACvB,KAAKwB,OAAO,IAAI;IAC7D5F,UAAU;QACR,IAAI,CAACwF,gBAAgB;QACrBA,eACEC,YACI;YACEpE,OAAO;YACPa,OAAO;gBAAE0D,SAASF,KAAKG,KAAK,CAACJ;YAAW;QAC1C,IACA;IAER,GAAG;QAACA;QAAWD;KAAe;IAC9B,MAAMM,WAAW7F,QACf,IACEtB,kBAAkByF,KAAK2B,OAAO,EAAE;YAC9BC,QAAQtF,kBAAkBsF,MAAM;YAChCb,SAAS3E;YACTyF,SAASxF;QACX,IACF;QAAC2D,KAAK2B,OAAO;KAAC;IAGhB,MAAM,CAACG,UAAUC,YAAY,GAAGjG,SAAS;IACzC,MAAM,CAACkG,SAASC,WAAW,GAAGnG,SAAS;IACvC,MAAM,CAACoG,SAASC,WAAW,GAAGrG,SAAyB;IACvD,MAAM,CAACsG,UAAUC,YAAY,GAAGvG,SAAS;IACzC,MAAM,CAACwG,SAASC,WAAW,GAAGzG,SAA6B;IAC3D,MAAM,CAAC0G,MAAMC,QAAQ,GAAG3G,SAAS;IACjC;;;;;;;;GAQC,GACD,MAAM,CAAC4G,OAAOC,SAAS,GAAG7G,SAA6B;IAEvD,MAAM8G,YAAYF,QAAQA,MAAMG,MAAM,GAAGhF,eAAeiE;IAExD;;;;;;;;;;GAUC,GACDlG,UAAU;QACRuG,WAAW;QACXE,YAAY;QACZE,WAAW;QACXI,SAAS;IACX,GAAG;QAACb;KAAS;IAEb,MAAMgB,OAAOnH,YACX,OAAOoH,OAAeC;QACpB,MAAMC,WAAW,MAAM9G,gBAAgB+C,MAAM,CAAC,WAAW,EAAE6D,OAAO,EAAE;YAClEG,QAAQ;YACRnC,SAAS;gBAAE,gBAAgB;YAAmB;YAC9CiC,MAAM1B,KAAKC,SAAS,CAAC;gBAAE/C;gBAAQG;eAAWqE;QAC5C;QACA,MAAMG,UAAU,MAAMF,SAASG,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QACpD,OAAO;YAAEC,IAAIL,SAASK,EAAE;YAAEH;QAAQ;IACpC,GACA;QAACjE;QAAMV;QAAQG;KAAO;IAGxB,MAAM4E,gBAAgB5H,YAAY;QAChC,IAAI6G,QAAQ,CAACI,UAAU3B,MAAM,EAAE;QAC/BwB,QAAQ;QACR,IAAI;YACF,MAAM,EAAEa,EAAE,EAAEH,OAAO,EAAE,GAAG,MAAML,KAAK,wBAAwB;gBACzDD,QAAQD;YACV;YACA,IAAI,CAACU,IAAI;;gBACP,OAAO,KAAKnE,wBACVgE,2BAAAA,QAASK,KAAK,mBAAI,uCAClB;oBAAEC,SAAS;oBAAWC,gBAAgB;gBAAK;YAE/C;YACAvB,WAAWgB;QACb,EAAE,eAAM;YACNhE,gBAAgB,uCAAuC;gBACrDsE,SAAS;gBACTC,gBAAgB;YAClB;QACF,SAAU;YACRjB,QAAQ;QACV;IACF,GAAG;QAACD;QAAMI;QAAWE;QAAM3D;KAAgB;IAE3C,MAAMwE,aAAahI,YAAY;QAC7B,IAAI6G,QAAQ,CAAC1D,UAAU;QACvB2D,QAAQ;QACR,IAAI;;YACF,MAAM,EAAEa,EAAE,EAAEH,OAAO,EAAE,GAAG,MAAML,KAAK,qBAAqB;gBACtDxF,MAAMwB;YACR;YACA,IAAI,CAACwE,IAAI;;gBACP,OAAO,KAAKnE,yBACVgE,2BAAAA,QAASK,KAAK,oBAAI,yCAClB;oBAAEC,SAAS;oBAAWC,gBAAgB;gBAAK;YAE/C;YACA;;;;;;OAMC,GACDf,SAASQ;YACThB,WAAWgB;YACXd,YAAY;YACZE,WAAW;YACX,IAAI,CAACqB,eAAOT,2BAAAA,QAASU,OAAO,mBAAI,IAAI;gBAClC1E,gBAAgB,8BAA8B;oBAC5CsE,SAAS;oBACTK,SAAS;gBACX;YACF;QACF,EAAE,eAAM;YACN3E,gBAAgB,yCAAyC;gBACvDsE,SAAS;gBACTC,gBAAgB;YAClB;QACF,SAAU;YACRjB,QAAQ;QACV;IACF,GAAG;QAACD;QAAM1D;QAAUgE;QAAM3D;KAAgB;IAE1C,MAAM4E,YAAYpI,YAAY;QAC5B,IAAI6G,QAAQ,CAACN,SAAS;QACtBO,QAAQ;QACR,IAAI;;YACF,MAAM,EAAEa,EAAE,EAAEH,OAAO,EAAE,GAAG,MAAML,KAAK,oBAAoB;gBACrDD,QAAQD;eACJA,UAAU3B,MAAM,KAAK,KAAKe,QAAQ9D,IAAI,KACtC;gBAAE8F,MAAMhC,QAAQ9D,IAAI;YAAG,IACvB,CAAC;gBACL,+DAA+D;gBAC/D,sEAAsE;gBACtE,2CAA2C;gBAC3C+F,eAAe7B;;YAEjB,IAAI,CAACkB,IAAI;;gBACP,OAAO,KAAKnE,yBACVgE,2BAAAA,QAASK,KAAK,oBAAI,gCAClB;oBAAEC,SAAS;oBAAWC,gBAAgB;gBAAK;YAE/C;YACA,MAAMQ,QAAQN,eAAOT,2BAAAA,QAASe,KAAK,mBAAI;YACvC3B,oBAAYY,2BAAAA,QAASb,OAAO,oBAAI,EAAE;YAClCH,WAAW;YACX,IAAI+B,OAAO;gBACTnC,YAAY;gBACZE,WAAW;gBACXU,SAAS;gBACT9D,uCAAAA;YACF;YACAM,gBACE+E,UAAU,IAAI,qBAAqB,GAAGA,MAAM,aAAa,CAAC,EAC1D;gBAAET,SAASS,QAAQ,YAAY;gBAAWJ,SAAS;YAAM;QAE7D,EAAE,eAAM;YACN3E,gBAAgB,gCAAgC;gBAC9CsE,SAAS;gBACTC,gBAAgB;YAClB;QACF,SAAU;YACRjB,QAAQ;QACV;IACF,GAAG;QACDD;QACAN;QACAU;QACAZ;QACAI;QACAU;QACA3D;QACAN;KACD;IAED,MAAMsF,eAAexI,YACnB,OAAOa;YAIEA;QAHP,MAAM4H,WAAW,MAAMhF,QAAQ;YAC7BiF,OAAO;YACPC,aACE,IAAG9H,gBAAAA,OAAO+H,KAAK,YAAZ/H,gBAAgB,cAAc,sBAAsB,EAAEoC,SAAS,EAAE,CAAC,GACrE,mEACA,qEACA,qEACA;YACF4F,kBAAkB;YAClBC,yBAAyB;gBAAEvH,OAAO;YAAQ;QAC5C,EACE,uEAAuE;QACvE,qEAAqE;SACpEwH,IAAI,CAAC,IAAM,MACXrB,KAAK,CAAC,IAAM;QACf,IAAI,CAACe,UAAU;QACf,IAAI;YACF,MAAM3I,UACJC,IACEsD,WACAN,KAAK,CAAC,EAAE,EACRA,KAAK,CAAC,EAAE,EACR,SACAC,QACA,WACAnC,OAAOmI,GAAG;YAGd9F,uCAAAA;YACAM,gBAAgB,yBAAyB;gBACvCsE,SAAS;gBACTK,SAAS;YACX;QACF,EAAE,OAAON,OAAO;YACdoB,QAAQpB,KAAK,CAACA;YACdrE,gBAAgB,yBAAyB;gBAAEsE,SAAS;YAAQ;QAC9D;IACF,GACA;QACErE;QACAR;QACAI;QACAN;QACAC;QACAQ;QACAN;KACD;IAGH,MAAMgG,aAAa3C,UACfA,QAAQ4C,OAAO,GAAG5C,QAAQ6C,eAAe,GACzC;IAEJ,MAAMC,UAAwB;QAC5B;YACEC,OAAO;YACPC,YAAY;YACZC,MAAM;YACNC,UAAU;YACVC,aAAa,CAACC,QAAQ5E;oBAAQA;wBAAAA,aAAAA,IAAI6D,KAAK,YAAT7D,aAAa;;QAC7C;QACA;YACEuE,OAAO;YACPC,YAAY;YACZC,MAAM;YACNC,UAAU;YACVC,aAAa,CAACC,QAAQ5E;oBAAQA;wBAAAA,YAAAA,IAAIsD,IAAI,YAARtD,YAAY;;QAC5C;QACA;YACEuE,OAAO;YACPC,YAAY;YACZK,OAAO;YACP,gDAAgD;YAChDF,aAAa,CAACC,QAAQ5E;;oBAAQA,6BAAAA,qBAAAA,sBAAAA;gCAAAA,eAAAA,IAAI8E,OAAO,sBAAX9E,uBAAAA,aAAa+E,MAAM,sBAAnB/E,sBAAAA,0BAAAA,mCAAAA,8BAAAA,oBAAyBgF,OAAO,qBAAhChF,iCAAAA,uCAAwC;;YACtEiF,YAAY,CAAC,EAAEjF,GAAG,EAAE;oBAClBA;uBAAAA,EAAAA,eAAAA,IAAI8E,OAAO,qBAAX9E,aAAa+E,MAAM,IAAG/E,IAAI8E,OAAO,CAACC,MAAM,GAAG3I,kBAAkB,KAAK;;QACtE;QACA;YACEmI,OAAO;YACPC,YAAY;YACZK,OAAO;YACPF,aAAa,CAACC,QAAQ5E,MAAQ/C,MAAM+C;YACpC;;;;;OAKC,GACDiF,YAAY,CAAC,EAAEjF,GAAG,EAAE,iBAClB,MAACrF;oBAAMuK,WAAU;oBAAMC,SAAS;oBAAGC,IAAI;wBAAEC,YAAY;wBAAUX,UAAU;oBAAE;;sCACzE,KAACjK;4BAAK6K,MAAK;4BAAQvC,SAAQ;4BAAWxG,OAAOI,UAAU,CAACM,MAAM+C,KAAK;;wBAClEA,IAAIuF,MAAM,iBACT,KAAC1K;4BAAWkI,SAAQ;4BAAUvG,OAAM;4BAAiBgJ,MAAM;sCACxDxF,IAAIuF,MAAM;6BAEX;;;QAGV;QACA;YACEhB,OAAO;YACPC,YAAY;YACZK,OAAO;YACPF,aAAa,CAACC,QAAQ5E,MAAQnE,aAAamE,KAAKjC,cAAcxB,KAAK;YACnE0I,YAAY,CAAC,EAAEjF,GAAG,EAAE;gBAClB,MAAMhD,UAAUnB,aAAamE,KAAKjC;gBAClC,qBACE,KAACtD;oBACC6K,MAAK;oBACLvC,SAAQ;oBACRvG,OAAOQ,QAAQR,KAAK;oBACpBD,OAAOS,QAAQT,KAAK;;YAG1B;QACF;QACA;;;;;KAKC,GACDvC,kBACE,CAACgG;gBAEiBA;iCADhB,KAAClG;gBACCyC,OAAOkJ,QAAOzF,aAAAA,IAAI6D,KAAK,YAAT7D,aAAaA,IAAIiE,GAAG;gBAClCyB,OAAO;oBACL;wBACEpJ,KAAK;wBACLC,OAAO;wBACPoJ,oBAAM,KAACnM;4BAAQoM,MAAMrM,wBAAwBqM,IAAI;4BAAEN,MAAM;;wBACzDO,aAAa;wBACbC,SAAS,IAAM,KAAKrC,aAAazD;oBACnC;iBACD;;WAGL;YAAE6E,OAAO;QAAG;KAEf;IAED,qBACE,MAAClK;QAAMwK,SAAS;QAAGC,IAAI;YAAEW,IAAI;QAAE;;YAQ5B3H,yBACC,MAACzD;gBACCwK,SAAS;gBACTC,IAAI;oBAAEY,QAAQ;oBAAGC,aAAa;oBAAWC,cAAc;oBAAGC,GAAG;gBAAI;;kCAEjE,KAACtL;wBAAWkI,SAAQ;wBAAWvG,OAAM;kCAClC;;oBAEF,CAAC6B,sBAAAA,cAAe,EAAE,EAAEf,GAAG,CAAC,CAAC8I,uBACxB,KAACvL;4BAAwBkI,SAAQ;sCAC9BqD;2BADcA;kCAInB,KAAC9L;kCACC,cAAA,KAACC;4BACC+K,MAAK;4BACLvC,SAAQ;4BACRsD,UAAUvE;4BACVgE,SAAS,IAAM,KAAK7C;sCAEnBnB,OAAO,eAAe;;;oBAG1BE,sBACC,KAAC3H;wBAAMiM,UAAUtE,MAAMmB,OAAO,GAAG,SAAS;kCACvC,AAACnB,CAAAA,MAAMmB,OAAO,KAAK,IAChB,qBACA,GAAGnB,MAAMmB,OAAO,CAACoD,cAAc,GAAG,aAAa,CAAC,AAAD,IAChDvE,CAAAA,MAAMwE,SAAS,GACZ,CAAC,+BAA+B,EAAExE,MAAMG,MAAM,CAAC5B,MAAM,CAAC,EAAE,CAAC,GACzD,8CACA,EAAC,IACJyB,CAAAA,MAAMyE,QAAQ,GACX,KACA,2DACA,sCAAqC;yBAE3C;kCACJ,KAAC5L;wBAAWkI,SAAQ;wBAAUvG,OAAM;kCACjC,oEACC,gEACA;;;iBAGJ;0BAEJ,KAAC3B;gBAAWkI,SAAQ;gBAAQvG,OAAM;0BAC/B,qEACC,oEACA;;0BAGJ,MAAC7B;gBAAMuK,WAAU;gBAAMC,SAAS;gBAAGuB,UAAU;gBAACtB,IAAI;oBAAEuB,UAAU;gBAAO;;kCACnE,KAAC/L;wBACC0K,MAAK;wBACL/I,OAAM;wBACNqK,aAAY;wBACZC,SAAS;wBACTC,SAAS;wBACTC,SAAS;wBACT3J,OAAOgE;wBACP4F,UAAU,CAACC,QAAU5F,YAAY4F,MAAMC,MAAM,CAAC9J,KAAK;wBACnD+J,YACEjF,UAAU3B,MAAM,GAAG,IACf,GAAG2B,UAAU3B,MAAM,CAAC,UAAU,CAAC,GAC/B;wBAEN6E,IAAI;4BAAEgC,UAAU;4BAAG1C,UAAU;wBAAI;;oBAElCxC,UAAU3B,MAAM,GAAG,IAAI,qBACtB,KAAC3F;wBACC0K,MAAK;wBACL/I,OAAM;wBACNa,OAAOkE;wBACP0F,UAAU,CAACC,QAAU1F,WAAW0F,MAAMC,MAAM,CAAC9J,KAAK;wBAClDgI,IAAI;4BAAEV,UAAU;wBAAI;;kCAGxB,KAACpK;kCACC,cAAA,KAACC;4BACC+K,MAAK;4BACLvC,SAAQ;4BACRsD,UAAUvE,QAAQ,CAACI,UAAU3B,MAAM,IAAI5C,QAAQ6D;4BAC/CsE,SAAS,IAAM,KAAKjD;sCAEnBf,OAAO,cAAc;;;;;YAW3BN,wBACC,MAAC7G;gBAAMwK,SAAS;;kCACd,KAAC9K;wBAAMiM,UAAUnC,aAAa,SAAS;kCACpC;4BACC3C,QAAQ4C,OAAO,GACX,GAAG5C,QAAQ4C,OAAO,CAAC,iBAAiB,CAAC,GACrC;4BACJ5C,QAAQ6C,eAAe,GACnB,GAAG7C,QAAQ6C,eAAe,CAAC,yBAAyB,CAAC,GACrD;4BACJ7C,QAAQP,OAAO,GACX,GAAGO,QAAQP,OAAO,CAAC,uBAAuB,CAAC,GAC3C;yBACL,CACEvD,MAAM,CAACC,SACP0J,IAAI,CAAC;;oBAQT7F,QAAQ8F,QAAQ,CACd5J,MAAM,CAAC,CAAC6J,UAAYA,QAAQC,OAAO,EACnClK,GAAG,CAAC,CAACiK,wBACJ,KAAC1M;4BAECkI,SAAQ;4BACRvG,OAAM;sCAEL,GAAG+K,QAAQE,KAAK,CAAC,GAAG,EAAEF,QAAQG,OAAO,EAAE;2BAJnCH,QAAQE,KAAK;oBAOvBjG,QAAQ6C,eAAe,iBACtB,KAAC3J;wBACCiN,uBACE,KAACnN;4BACCoN,SAASlG;4BACTsF,UAAU,CAACC,QAAUtF,YAAYsF,MAAMC,MAAM,CAACU,OAAO;;wBAGzDrL,qBACE,KAAC1B;4BAAWkI,SAAQ;sCACjB,CAAC,iDAAiD,CAAC,GAClD,GAAGvB,QAAQ6C,eAAe,CAAC,CAAC,CAAC,GAC7B,GAAG7C,QAAQ6C,eAAe,KAAK,IAAI,WAAW,SAAS,CAAC,CAAC,GACzD,8DACA;;yBAIN;kCACJ,KAAC/J;kCACC,cAAA,KAACC;4BACC+K,MAAK;4BACLvC,SAAQ;4BACRsD,UACEvE,QACA,CAACqC,cACA3C,QAAQ6C,eAAe,GAAG,KAAK,CAAC3C;4BAEnCoE,SAAS,IAAM,KAAKzC;sCAEnBvB,OAAO,YAAY,CAAC,IAAI,EAAEqC,YAAY;;;;iBAI3C;YAOHvC,CAAAA,2BAAAA,QAASrB,MAAM,kBACd,KAAC5F;gBAAMwK,SAAS;0BACbvD,QACElE,MAAM,CAAC,CAACmK,SAAW,CAACA,OAAOC,QAAQ,EACnCxK,GAAG,CAAC,CAACuK;wBAM+BA;yCALnC,KAAChN;wBAECkI,SAAQ;wBACRvG,OAAM;kCAEL,GAAGqL,OAAOJ,KAAK,CAAC,cAAc,GAAEI,gBAAAA,OAAO/E,KAAK,YAAZ+E,gBAAgB,IAAI;uBAJhDA,OAAOJ,KAAK;;iBAQvB;YAEHzI,QAAQuB,MAAM,KAAK,KAAK,CAACtB,WAAW,CAACqB,0BACpC,KAACzF;gBAAWkI,SAAQ;gBAAQvG,OAAM;0BAC/B;+BAGH;;kCACE,KAAC9C;wBACCwH,QAAQtF,kBAAkBsF,MAAM;wBAChCb,SAAS3E;wBACT+D,SAASd,WAAWc,OAAO;wBAC3BuH,UAAUrI,WAAWoJ,UAAU;wBAC/B5G,SAASxF;;kCAEX,KAAC/B;wBACCqH,SAASD;wBACTgH,SAAS;+BAAI1I,KAAK0I,OAAO;+BAAK/H,WAAW+H,OAAO;yBAAC;;kCAEnD,KAACjO;wBACCkO,cAAY,CAAC,WAAW,EAAE/J,UAAU;wBACpCa,MAAMkB,WAAWlB,IAAI;wBACrBkB,YAAYA;wBACZqE,SAASrK,sBACPqK,SACA1I,kBAAkBsF,MAAM,EACxBvF,4BACAD;wBAEFwM,WAAWhO;wBACX,8DAA8D;wBAC9DiO,UAAU;wBACV,iEAAiE;wBACjE,+DAA+D;wBAC/DC,YAAW;wBACXC,aAAa1J,WAAW0J,WAAW;wBACnCC,qBAAqB3J,WAAW2J,mBAAmB;wBACnDC,WAAW;wBACXC,aAAY;;kCAEd,KAAC7O;wBACCuF,MAAMA;wBACNE,UAAUA;wBACVqJ,UAAUzJ,QAAQuB,MAAM;wBACxBtB,SAASA;wBACTyJ,cAAcvJ;wBACdwJ,kBAAkBtJ;;;;0BAexB,KAACxE;gBAAWkI,SAAQ;gBAAUvG,OAAM;0BACjC,mEACC,wEACA,kEACA,sEACA;;0BAGJ,KAAC3B;gBAAWkI,SAAQ;gBAAUvG,OAAM;0BACjC,yEACC,wEACA;;;;AAIV;AACAoB,iBAAiBgL,WAAW,GAAG;AAE/B,eAAehL,iBAAgB"}
+{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/components/list-members-panel.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\n/**\n * Who is on one list, and the three things you can do about it.\n *\n * The audience card could create a list and delete a list. It could not show\n * you a single name on one. This panel is the rest of it: read the membership,\n * add somebody, take somebody off. The list's own settings — its name, and the\n * rule behind a dynamic one — belong to the edit route, because they are\n * facts about the LIST rather than about who is on it.\n *\n * ## It mounts only on a list's own page\n *\n * The audience detail route renders this for the ONE list being read. A\n * membership listener per row would open one per list on the audiences table,\n * on a surface where most visits are to read the list of lists — the\n * read-on-mount shape `emails-console-read-cost.spec.tsx` meters. Nothing here\n * reads anything until a list is opened, and the add form reads nothing until\n * an address is typed.\n *\n * ## Whether somebody may be ADDED is the server's answer, always\n *\n * Every sentence about an address being typed in is `email/list-members-preview`\n * answering from that person's actual record and both suppression lists. This\n * component decides none of it. A screen that decided for itself would be a\n * second copy of the rule on the one surface whose job is to tell the operator\n * the truth about what is about to happen — including, and especially, that\n * the product knows nothing about this person's permission.\n *\n * ## The membership table reads consent through the SEND-TIME reader\n *\n * The `Consent` column answers the same question `performCampaignSend` asks of\n * the same document, so it asks it with the same function —\n * {@link readMarketingBasis}, against the consent group this console is being\n * viewed as. A column that picked the fields out of the row itself is a second\n * reader of a stored shape, and the two only agree until the shape moves.\n *\n * ## Removing is not suppressing, and the screen says so\n *\n * Taking somebody off a list is the operator changing their mind about an\n * audience. It is not the person asking to stop being mailed, it does not stop\n * another list reaching them, and it writes nothing to the suppression list.\n * Those are different acts with different records, and a console that let them\n * blur is a console where \"remove\" is quietly relied on as an unsubscribe.\n */\n\nimport {\n  readMarketingBasis,\n  type ConsentGroup,\n  type DynamicListRule,\n  type MarketingConsentRecord,\n} from '@aglyn/aglyn'\nimport { mdiAccountRemoveOutline } from '@aglyn/shared-data-mdi'\nimport { MdiIcon, useConfirmationContext } from '@aglyn/shared-ui-jsx'\nimport ListFilterChips from '@aglyn/shared-ui-jsx/components/list-filter-chips.component'\nimport { ListPagination } from '@aglyn/shared-ui-jsx/components/list-pagination.component'\nimport ListQueryNotices, {\n  listQueryRefusals,\n} from '@aglyn/shared-ui-jsx/components/list-query-notices.component'\nimport {\n  ListRowActions,\n  ListTable,\n  listActionsColumn,\n} from '@aglyn/shared-ui-jsx/components/list-table.component'\nimport { listFilterGridColumns } from '@aglyn/shared-ui-jsx/const/list-grid-filter'\nimport { TABLE_ROW_HEIGHT } from '@aglyn/shared-ui-jsx/const/table-pagination'\nimport { useListGridFilter } from '@aglyn/shared-ui-jsx/hooks/use-list-grid-filter'\nimport { useSnackbar } from '@aglyn/shared-ui-snackstack'\nimport {\n  Alert,\n  Box,\n  Button,\n  Checkbox,\n  Chip,\n  FormControlLabel,\n  Stack,\n  TextField,\n  Typography,\n} from '@mui/material'\nimport type { GridColDef } from '@mui/x-data-grid'\nimport { collection, deleteDoc, doc } from 'firebase/firestore'\nimport { useCallback, useEffect, useMemo, useState } from 'react'\nimport { useFirestore, useUser } from '@aglyn/tenant-feature-instance'\nimport { useListQuery } from '@aglyn/tenant-feature-instance/hooks/use-list-query'\nimport { useListColumnSort } from '@aglyn/shared-ui-jsx/hooks/use-list-column-sort'\nimport type { ListQuerySort } from '@aglyn/shared-ui-jsx/const/list-query-plan'\nimport { authorizedFetch } from '@aglyn/shared-util-http/authorized-token'\nimport {\n  LIST_MEMBER_FILTER_HEADERS,\n  LIST_MEMBER_FILTER_OPTIONS,\n  LIST_MEMBER_QUERY,\n} from '../constants/list-queries'\n\nexport interface ListMembersPanelProps {\n  hostId: string\n  /**\n   * The controller this membership is being read AS — the declared group of\n   * sites that are one sender, or this site alone.\n   *\n   * Required and undefaulted, for the reason {@link readMarketingBasis} makes\n   * it required: a basis runs to a brand, so a surface that has not said which\n   * brand is asking cannot report one. Defaulting to the group of one here\n   * would compile and would then answer a declared group's questions with a\n   * single site's facts — reporting a sibling's refusal as no record at all,\n   * and a pooled grant as another brand's.\n   */\n  consentGroup: ConsentGroup\n  /** `['orgs', orgId]` — the resolved org scope the card already holds. */\n  scope: readonly [string, string]\n  listId: string\n  listName: string\n  /**\n   * Called after a membership is added or removed.\n   *\n   * The audience page's subscriber total is a server aggregate, taken once.\n   * Left alone it would go on reporting the figure from before the add — a\n   * stale total directly above a live table that disagrees with it, which\n   * reads as the add having failed. The page re-takes the aggregate on this\n   * signal and at no other time, so nothing is re-counted while somebody is\n   * only reading.\n   */\n  onMembershipChanged?: () => void\n  /**\n   * The list's saved filters, when it has any and its membership is FIXED.\n   *\n   * Present, the panel offers to find the people they select and add them —\n   * the same act as typing addresses, with the search doing the typing. Absent\n   * (a live list, or one with no filters saved), the add form is the address\n   * box alone: a live list's membership is the sweep's to decide, and offering\n   * to add its own matches by hand would produce hand-added copies of rows the\n   * sweep already owns.\n   */\n  findRule?: DynamicListRule | null\n  /** The same filters in sentences, so the button says what it will find. */\n  ruleSummary?: readonly string[]\n  /**\n   * Told what the table is filtered to — `null` when it is not — so the\n   * card's Export can offer \"the current filter\": the predicates this\n   * table's own query is asking, which the export reads with the same query.\n   */\n  onFilterChange?: (filter: ListMembersFilter | null) => void\n}\n\n/** The member table's filter, as the export dialog offers it. */\nexport interface ListMembersFilter {\n  label: string\n  value: { filters: ReadonlyArray<{ path: string; op: string; value: unknown }> }\n}\n\n/**\n * One member row, as stored.\n *\n * The consent fields are deliberately NOT enumerated here. They live one level\n * down, in an entry per site under `marketingConsentByHost`, and a row type\n * that named them at the top would be an invitation to read them there — which\n * is exactly what this table did while `enrollListMember` wrote them nested,\n * so every membership on every list reported \"No basis on record\" while the\n * send path mailed the same people on a basis it could see perfectly well. The\n * index signature is what {@link readMarketingBasis} takes; it is the only\n * reader of those fields on this surface.\n */\ninterface MemberRow {\n  $id: string\n  email?: string\n  name?: string\n  source?: string\n  via?: 'manual' | 'rule'\n  addedAt?: { toDate?: () => Date }\n  [field: string]: unknown\n}\n\n/** What `email/list-members-preview` answers for one address. */\ninterface AddressVerdict {\n  input: string\n  email: string | null\n  refusal: string | null\n  requiresAttestation: boolean\n  summary: string\n}\n\ninterface Preview {\n  verdicts: AddressVerdict[]\n  optedIn: number\n  needAttestation: number\n  refused: number\n}\n\n/** What a filter search found, as `email/list-rule-preview` reports it. */\ninterface FoundPeople extends Preview {\n  /** People the filters matched — NOT the length of `emails`. */\n  matched: number\n  /** `emails` is one batch of a larger match. */\n  truncated: boolean\n  /** False when the scan hit its budget, so `matched` is itself a floor. */\n  complete: boolean\n  emails: string[]\n}\n\n/** What one address's outcome was, after the add. */\ninterface AddResult {\n  input: string\n  email: string | null\n  enrolled: boolean\n  error?: string\n}\n\n/**\n * How the basis reads on screen, for the group this console is viewed as.\n *\n * ## Read through `readMarketingBasis`, never off the row\n *\n * This picked `marketingConsent`, `marketingConsentBasis` and\n * `marketingConsentAtMs` off the top of the membership document, which is\n * where `enrollListMember` used to put them. They now live in an entry per\n * site under `marketingConsentByHost`, because a basis runs to the brand it\n * was given to rather than to the account that holds the row. Nothing here\n * moved with them, so every top-level read answered `undefined` and every\n * member of every list — including people carrying a perfectly good attested\n * basis — was reported as having no basis on record, on the one screen an\n * operator consults before mailing them. `performCampaignSend` reads the same\n * documents through the function below and mailed them, correctly, at the same\n * time.\n *\n * The fix is not a second field name. It is that the send path's reader is the\n * only reader: a surface that parses the stored shape itself agrees with the\n * sender only until the shape moves, and it moves without anybody thinking to\n * look here.\n *\n * ## Five states, because the model carries five\n *\n * An attestation and an opt-in are not the same fact — one is a person's own\n * decision, the other a claim an account made on their behalf — and a table\n * rendering both as a tick is the conflation `list-members.ts` stores the\n * basis to prevent. The three that are not a grant are not one state either.\n * Absence is not refusal, and neither of them is \"opted in, to somebody else\n * in this account\": that third one is a person the sender deliberately leaves\n * alone, and an operator who cannot see why reads it as the product having\n * lost their subscriber.\n */\ntype ConsentKey =\n  | 'opted-out'\n  | 'attested'\n  | 'opted-in'\n  | 'other-site'\n  | 'no-site'\n  | 'none'\n\n/**\n * A rule-enrolled member's basis as their CONTACT records it, as\n * `email/list-member-consent` answers it.\n *\n * A row a list rule wrote never holds a basis of its own — matching a rule is\n * not an opt-in — so `performCampaignSend` reads those people's contacts, and\n * this column shows what it reads. Fetched, because the browser may not read\n * the org's contacts by address.\n */\nexport interface ContactBasis {\n  basis: MarketingConsentRecord['basis']\n  assertedBy: MarketingConsentRecord['assertedBy']\n  basisAtMs: number | null\n  otherGrant: MarketingConsentRecord['otherGrant']\n}\n\n/** The key a member row and the consent route both use for an address. */\nconst memberAddress = (member: MemberRow): string =>\n  typeof member.email === 'string' ? member.email.trim().toLowerCase() : ''\n\nexport function consentLabel(\n  member: MemberRow,\n  group: ConsentGroup,\n  fromContact?: ContactBasis | null,\n): { key: ConsentKey; label: string; color: 'default' | 'warning' | 'error' } {\n  const own = readMarketingBasis(member as Record<string, unknown>, group)\n  // The contact answers only where the row itself is silent and a rule put it\n  // there — the same overlay the send applies.\n  const record =\n    fromContact && member.via === 'rule' && own.basis === 'unrecorded'\n      ? fromContact\n      : own\n  const when = record.basisAtMs\n    ? ` · ${new Date(record.basisAtMs).toLocaleDateString()}`\n    : ''\n  if (record.basis === 'declined') {\n    return { key: 'opted-out', label: `Opted out${when}`, color: 'error' }\n  }\n  if (record.basis === 'granted') {\n    /*\n     * `assertedBy` rather than the stored basis field, because there are two\n     * ways a record says an operator asserted it — a membership's\n     * `marketingConsentBasis`, and the provenance object a backfill writes —\n     * and the reader has already resolved both into this one answer.\n     */\n    return record.assertedBy === 'operator'\n      ? { key: 'attested', label: `Attested by your team${when}`, color: 'warning' }\n      : { key: 'opted-in', label: `Opted in${when}`, color: 'default' }\n  }\n  /*\n   * A grant this site may not use. Reported rather than folded into \"no\n   * basis\" because the two are different situations with different answers:\n   * nobody has ever asked this person, versus somebody asked them on behalf\n   * of another brand in this account and this brand may not borrow it.\n   */\n  if (record.otherGrant === 'other-host') {\n    return { key: 'other-site', label: 'Opted in to another site', color: 'warning' }\n  }\n  if (record.otherGrant === 'unscoped') {\n    return { key: 'no-site', label: 'Opted in — no site recorded', color: 'warning' }\n  }\n  return { key: 'none', label: 'No basis on record', color: 'default' }\n}\n\n/** How a member got here, by the words the column draws. */\nconst VIA_LABELS: Readonly<Record<'rule' | 'manual', string>> = {\n  rule: 'Rule',\n  manual: 'Added',\n}\n/** The How filter's choices are picked, so the panel shows a select. */\nconst MEMBER_SELECT_FIELDS = ['via']\n/** The page-sorted header, for its notice (AGL-3680). */\nconst MEMBER_SORT_HEADERS = { consent: 'Consent' }\n\n/** How a row reads `via`: a row that predates the field was added by hand. */\nconst viaOf = (member: MemberRow): 'rule' | 'manual' =>\n  member.via === 'rule' ? 'rule' : 'manual'\n\n/** Free text — a paste, a typed address, commas or newlines — to addresses. */\nexport function splitAddresses(value: string): string[] {\n  return value\n    .split(/[\\s,;]+/)\n    .map((entry) => entry.trim())\n    // A pasted mail-client line is `Name <a@b.co>`; keep the address part.\n    .map((entry) => entry.replace(/^.*<|>.*$/g, ''))\n    .filter(Boolean)\n}\n\nexport function ListMembersPanel(props: ListMembersPanelProps) {\n  const {\n    hostId,\n    consentGroup,\n    scope,\n    listId,\n    listName,\n    onMembershipChanged,\n    findRule,\n    ruleSummary,\n  } = props\n  const firestore = useFirestore()\n  const { data: user } = useUser()\n  const { enqueueSnackbar } = useSnackbar()\n  const { confirm } = useConfirmationContext()\n\n  /*\n   * Ordered by DOCUMENT ID and paged, not capped and re-sorted here.\n   *\n   * `__name__` rather than `addedAt`, which is the column a reader would\n   * assume: `orderBy` FILTERS as well as sorts, so a document missing the\n   * field is not in the result at all — and `addedAt` is stamped only when a\n   * membership is CREATED, so every row written under the two legacy ids\n   * `list-members.ts` still adopts predates it. Ordering on it would drop the\n   * oldest members from their own list, silently, which is the failure that\n   * turned an audience into a random sample (AGL-2501). The id is the one key\n   * every row has, so it stays the default. The Joined header asks for\n   * `addedAt` only since the writer stamps it on every row it touches and\n   * `backfill-list-member-sort-fields.mjs` on the rest (AGL-3680).\n   *\n   * Every filter and search word is a predicate on the same query\n   * (AGL-3321) — see `LIST_MEMBER_QUERY` — so a page is a page of the\n   * matches.\n   */\n  const gridFilter = useListGridFilter({ selectFields: MEMBER_SELECT_FIELDS })\n  /*\n   * EVERY HEADER SORTS (AGL-3680). Address, Name, Joined and How order the\n   * QUERY — `enrollListMember` stamps each on every row, null where there is\n   * none, so no order drops a member — each `alone`: under a filter or the\n   * search the list keeps its id order and says so. Consent is read per\n   * viewing consent group, so it sorts the page on screen.\n   */\n  const [askedSort, setAskedSort] = useState<ListQuerySort | null>(null)\n  const {\n    rows: members,\n    hasMore,\n    page,\n    setPage,\n    pageSize,\n    setPageSize,\n    plan,\n  } = useListQuery<MemberRow>({\n    collection: collection(firestore, scope[0], scope[1], 'lists', listId, 'members'),\n    declaration: LIST_MEMBER_QUERY,\n    request: {\n      clauses: gridFilter.clauses,\n      search: gridFilter.searchWords,\n      sort: askedSort,\n    },\n    deps: [firestore, scope[0], scope[1], listId],\n    idField: '$id',\n  })\n  /** Rule members' contact bases, by address — see {@link ContactBasis}. */\n  const [contactConsent, setContactConsent] = useState<\n    Readonly<Record<string, ContactBasis | null>>\n  >({})\n  const labelFor = useCallback(\n    (row: MemberRow) =>\n      consentLabel(row, consentGroup, contactConsent[memberAddress(row)]),\n    [consentGroup, contactConsent],\n  )\n  const pageSorts = useMemo(\n    () => ({ consent: (row: MemberRow) => labelFor(row).label }),\n    [labelFor],\n  )\n  const columnSort = useListColumnSort<MemberRow>({\n    sorts: LIST_MEMBER_QUERY.sorts,\n    sort: askedSort,\n    onSortChange: setAskedSort,\n    orderBy: plan.orderBy,\n    rows: members,\n    pageSorts,\n    headers: MEMBER_SORT_HEADERS,\n  })\n  const filtering =\n    gridFilter.clauses.length > 0 || gridFilter.searchWords.some((word) => word.trim())\n  const { onFilterChange } = props\n  const filterKey = filtering ? JSON.stringify(plan.filters) : ''\n  useEffect(() => {\n    if (!onFilterChange) return\n    onFilterChange(\n      filterKey\n        ? {\n            label: 'Members matching the table’s filters',\n            value: { filters: JSON.parse(filterKey) },\n          }\n        : null,\n    )\n  }, [filterKey, onFilterChange])\n  const refusals = useMemo(\n    () =>\n      listQueryRefusals(plan.refused, {\n        fields: LIST_MEMBER_QUERY.fields,\n        headers: LIST_MEMBER_FILTER_HEADERS,\n        options: LIST_MEMBER_FILTER_OPTIONS,\n      }),\n    [plan.refused],\n  )\n\n  const [addInput, setAddInput] = useState('')\n  const [addName, setAddName] = useState('')\n  const [preview, setPreview] = useState<Preview | null>(null)\n  const [attested, setAttested] = useState(false)\n  const [results, setResults] = useState<AddResult[] | null>(null)\n  const [busy, setBusy] = useState(false)\n  /*\n   * The addresses a SEARCH found, when the operator ran one.\n   *\n   * A second way to fill the same candidate set, not a second way to add. Once\n   * this holds addresses, everything below it — the consent readout, the\n   * attestation, the Add button — is the code the typed path already used, so\n   * there is exactly one place in this component where somebody is put on a\n   * list and exactly one gate in front of it.\n   */\n  const [found, setFound] = useState<FoundPeople | null>(null)\n\n  const addresses = found ? found.emails : splitAddresses(addInput)\n\n  /*\n   * Any edit to the box invalidates the answer.\n   *\n   * A preview belongs to the exact addresses it was run for. Leaving a stale\n   * one on screen would show a count, and an attestation checkbox, for a set\n   * the operator has since changed — so the number they stand behind would\n   * not be the number that acts. Typing also abandons a search: the two are\n   * alternative ways of naming a candidate set, and holding both at once\n   * would leave the Add button acting on whichever the code happened to\n   * prefer.\n   */\n  useEffect(() => {\n    setPreview(null)\n    setAttested(false)\n    setResults(null)\n    setFound(null)\n  }, [addInput])\n\n  const post = useCallback(\n    async (route: string, body: Record<string, unknown>) => {\n      const response = await authorizedFetch(user, `/api/email/${route}`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ hostId, listId, ...body }),\n      })\n      const payload = await response.json().catch(() => ({}))\n      return { ok: response.ok, payload }\n    },\n    [user, hostId, listId],\n  )\n\n  /*\n   * The page's rule rows that say nothing about consent themselves, asked of\n   * their contacts once per page. Rows already answered are not asked again;\n   * a refused or failed read leaves the row's own label, which is the honest\n   * fallback — it is what the row records.\n   */\n  const unansweredRuleRows = members\n    .filter(\n      (row) =>\n        row.via === 'rule' &&\n        consentLabel(row, consentGroup).key === 'none' &&\n        !(memberAddress(row) in contactConsent),\n    )\n    .map(memberAddress)\n    .filter(Boolean)\n  const unansweredKey = unansweredRuleRows.join('\\n')\n  useEffect(() => {\n    if (!unansweredKey || !user) return\n    let current = true\n    const asked = unansweredKey.split('\\n')\n    void post('list-member-consent', { emails: asked })\n      .then(({ ok, payload }) => {\n        if (!current || !ok) return\n        const answered = (payload?.consent ?? {}) as Record<string, ContactBasis>\n        // Every address asked is settled — `null` where the route had nothing\n        // to add — so a page is asked about once.\n        const settled: Record<string, ContactBasis | null> = {}\n        for (const email of asked) settled[email] = answered[email] ?? null\n        setContactConsent((before) => ({ ...before, ...settled }))\n      })\n      .catch(() => undefined)\n    return () => {\n      current = false\n    }\n  }, [unansweredKey, user, post])\n\n  const handlePreview = useCallback(async () => {\n    if (busy || !addresses.length) return\n    setBusy(true)\n    try {\n      const { ok, payload } = await post('list-members-preview', {\n        emails: addresses,\n      })\n      if (!ok) {\n        return void enqueueSnackbar(\n          payload?.error ?? 'The addresses could not be checked.',\n          { variant: 'warning', allowDuplicate: true },\n        )\n      }\n      setPreview(payload as Preview)\n    } catch {\n      enqueueSnackbar('The addresses could not be checked.', {\n        variant: 'warning',\n        allowDuplicate: true,\n      })\n    } finally {\n      setBusy(false)\n    }\n  }, [busy, addresses, post, enqueueSnackbar])\n\n  const handleFind = useCallback(async () => {\n    if (busy || !findRule) return\n    setBusy(true)\n    try {\n      const { ok, payload } = await post('list-rule-preview', {\n        rule: findRule,\n      })\n      if (!ok) {\n        return void enqueueSnackbar(\n          payload?.error ?? 'The audience could not be worked out.',\n          { variant: 'warning', allowDuplicate: true },\n        )\n      }\n      /*\n       * The verdicts come back from the SAME resolution the typed path runs,\n       * so what lands in `preview` here is the same object the consent\n       * readout below already knows how to draw. A search that returned its\n       * own shaped summary would be a second consent readout, and the second\n       * one is the one nobody reviews.\n       */\n      setFound(payload as FoundPeople)\n      setPreview(payload as Preview)\n      setAttested(false)\n      setResults(null)\n      if (!Number(payload?.matched ?? 0)) {\n        enqueueSnackbar('These filters match nobody', {\n          variant: 'info',\n          persist: false,\n        })\n      }\n    } catch {\n      enqueueSnackbar('The audience could not be worked out.', {\n        variant: 'warning',\n        allowDuplicate: true,\n      })\n    } finally {\n      setBusy(false)\n    }\n  }, [busy, findRule, post, enqueueSnackbar])\n\n  const handleAdd = useCallback(async () => {\n    if (busy || !preview) return\n    setBusy(true)\n    try {\n      const { ok, payload } = await post('list-members-add', {\n        emails: addresses,\n        ...(addresses.length === 1 && addName.trim()\n          ? { name: addName.trim() }\n          : {}),\n        // The operator's assertion, not a basis they named: the server\n        // derives a pass-through from each person's own record, and this flag\n        // can only ever add the attributable kind.\n        attestConsent: attested,\n      })\n      if (!ok) {\n        return void enqueueSnackbar(\n          payload?.error ?? 'Nobody was added to the list',\n          { variant: 'warning', allowDuplicate: true },\n        )\n      }\n      const added = Number(payload?.added ?? 0)\n      setResults((payload?.results ?? []) as AddResult[])\n      setPreview(null)\n      if (added) {\n        setAddInput('')\n        setAddName('')\n        setFound(null)\n        onMembershipChanged?.()\n      }\n      enqueueSnackbar(\n        added === 1 ? 'One person added' : `${added} people added`,\n        { variant: added ? 'success' : 'warning', persist: false },\n      )\n    } catch {\n      enqueueSnackbar('Nobody was added to the list', {\n        variant: 'warning',\n        allowDuplicate: true,\n      })\n    } finally {\n      setBusy(false)\n    }\n  }, [\n    busy,\n    preview,\n    addresses,\n    addName,\n    attested,\n    post,\n    enqueueSnackbar,\n    onMembershipChanged,\n  ])\n\n  const handleRemove = useCallback(\n    async (member: MemberRow) => {\n      const accepted = await confirm({\n        title: 'Remove from this list?',\n        description:\n          `${member.email ?? 'This person'} stops being part of \"${listName}\" ` +\n          'and campaigns to this list stop reaching them. This is NOT an ' +\n          'unsubscribe: it does not add them to your suppression list, and ' +\n          'any other list they are on still reaches them. If they asked to ' +\n          'stop hearing from you, suppress the address instead.',\n        confirmationText: 'Remove',\n        confirmationButtonProps: { color: 'error' },\n      })\n        // `confirm` resolves with no value and REJECTS on cancel, so gating on\n        // the resolved value alone would make this always proceed (AGL-950).\n        .then(() => true)\n        .catch(() => false)\n      if (!accepted) return\n      try {\n        await deleteDoc(\n          doc(\n            firestore,\n            scope[0],\n            scope[1],\n            'lists',\n            listId,\n            'members',\n            member.$id,\n          ),\n        )\n        onMembershipChanged?.()\n        enqueueSnackbar('Removed from the list', {\n          variant: 'success',\n          persist: false,\n        })\n      } catch (error) {\n        console.error(error)\n        enqueueSnackbar('They were not removed', { variant: 'error' })\n      }\n    },\n    [\n      confirm,\n      listName,\n      firestore,\n      scope,\n      listId,\n      enqueueSnackbar,\n      onMembershipChanged,\n    ],\n  )\n\n  const enrollable = preview\n    ? preview.optedIn + preview.needAttestation\n    : 0\n\n  const columns: GridColDef[] = [\n    {\n      field: 'email',\n      headerName: 'Address',\n      flex: 1,\n      minWidth: 220,\n      valueGetter: (_value, row) => row.email ?? '—',\n    },\n    {\n      field: 'name',\n      headerName: 'Name',\n      flex: 1,\n      minWidth: 160,\n      valueGetter: (_value, row) => row.name ?? '—',\n    },\n    {\n      field: 'addedAt',\n      headerName: 'Joined',\n      width: 120,\n      // Sorted on the instant, drawn as a local date.\n      valueGetter: (_value, row) => row.addedAt?.toDate?.()?.getTime?.() ?? 0,\n      renderCell: ({ row }) =>\n        row.addedAt?.toDate ? row.addedAt.toDate().toLocaleDateString() : '—',\n    },\n    {\n      field: 'via',\n      headerName: 'How',\n      width: 200,\n      valueGetter: (_value, row) => viaOf(row),\n      /*\n        `via` says whether a rule put them here or a person did, which is what\n        decides whether they LEAVE on their own: the materializer reconciles its\n        own rows away and never touches a manual one. `source` is the finer\n        provenance underneath it.\n       */\n      renderCell: ({ row }) => (\n        <Stack direction=\"row\" spacing={1} sx={{ alignItems: 'center', minWidth: 0 }}>\n          <Chip size=\"small\" variant=\"outlined\" label={VIA_LABELS[viaOf(row)]} />\n          {row.source ? (\n            <Typography variant=\"caption\" color=\"text.secondary\" noWrap>\n              {row.source}\n            </Typography>\n          ) : null}\n        </Stack>\n      ),\n    },\n    {\n      field: 'consent',\n      headerName: 'Consent',\n      width: 190,\n      valueGetter: (_value, row) => labelFor(row).label,\n      renderCell: ({ row }) => {\n        const consent = labelFor(row)\n        return (\n          <Chip\n            size=\"small\"\n            variant=\"outlined\"\n            color={consent.color}\n            label={consent.label}\n          />\n        )\n      },\n    },\n    /*\n      A SUBSCRIBER HAS NO PAGE of their own here, so the row opens nothing —\n      but taking somebody off an audience is the one act performed on one, and\n      it belongs in the trailing cluster with every other list's actions rather\n      than as a red text button sitting in the row.\n     */\n    listActionsColumn(\n      (row) => (\n        <ListRowActions\n          label={String(row.email ?? row.$id)}\n          items={[\n            {\n              key: 'remove',\n              label: 'Remove from this list',\n              icon: <MdiIcon path={mdiAccountRemoveOutline.path} size={0.8} />,\n              destructive: true,\n              onClick: () => void handleRemove(row),\n            },\n          ]}\n        />\n      ),\n      { width: 72 },\n    ),\n  ]\n\n  return (\n    <Stack spacing={2} sx={{ py: 2 }}>\n      {/*\n        FINDING people, for a list whose membership is fixed.\n        The filters are the same ones a live list is swept by; here they run\n        once, on request, and what they find is offered for adding rather than\n        enrolled. The count and the consent readout arrive together, because\n        the second is the thing that decides how much of the first can act.\n       */}\n      {findRule ? (\n        <Stack\n          spacing={1}\n          sx={{ border: 1, borderColor: 'divider', borderRadius: 1, p: 1.5 }}\n        >\n          <Typography variant=\"overline\" color=\"text.secondary\">\n            {'Find people'}\n          </Typography>\n          {(ruleSummary ?? []).map((clause) => (\n            <Typography key={clause} variant=\"body2\">\n              {clause}\n            </Typography>\n          ))}\n          <Box>\n            <Button\n              size=\"small\"\n              variant=\"outlined\"\n              disabled={busy}\n              onClick={() => void handleFind()}\n            >\n              {busy ? 'Searching…' : 'Find matching people'}\n            </Button>\n          </Box>\n          {found ? (\n            <Alert severity={found.matched ? 'info' : 'warning'}>\n              {(found.matched === 1\n                ? '1 person matches'\n                : `${found.matched.toLocaleString()} people match`) +\n                (found.truncated\n                  ? ` — this batch covers the first ${found.emails.length}. ` +\n                    'Add them, then search again for the rest.'\n                  : '') +\n                (found.complete\n                  ? ''\n                  : ' The search stopped at its read budget, so this is at ' +\n                    'least that many rather than exactly.')}\n            </Alert>\n          ) : null}\n          <Typography variant=\"caption\" color=\"text.secondary\">\n            {'Whoever you add stays on this list. It does not keep growing — ' +\n              'change the membership to live on the edit page if you want ' +\n              'new matches enrolled automatically.'}\n          </Typography>\n        </Stack>\n      ) : null}\n\n      <Typography variant=\"body2\" color=\"text.secondary\">\n        {'Add someone by typing their address, or paste a column of them. ' +\n          'Every address is checked against their consent record and both ' +\n          'suppression lists before anyone is added.'}\n      </Typography>\n\n      <Stack direction=\"row\" spacing={1} useFlexGap sx={{ flexWrap: 'wrap' }}>\n        <TextField\n          size=\"small\"\n          label=\"Email addresses\"\n          placeholder=\"someone@example.com\"\n          multiline\n          minRows={1}\n          maxRows={6}\n          value={addInput}\n          onChange={(event) => setAddInput(event.target.value)}\n          helperText={\n            addresses.length > 1\n              ? `${addresses.length} addresses`\n              : 'One address, or paste many'\n          }\n          sx={{ flexGrow: 1, minWidth: 260 }}\n        />\n        {addresses.length > 1 ? null : (\n          <TextField\n            size=\"small\"\n            label=\"Name\"\n            value={addName}\n            onChange={(event) => setAddName(event.target.value)}\n            sx={{ minWidth: 180 }}\n          />\n        )}\n        <Box>\n          <Button\n            size=\"small\"\n            variant=\"outlined\"\n            disabled={busy || !addresses.length || Boolean(preview)}\n            onClick={() => void handlePreview()}\n          >\n            {busy ? 'Checking…' : 'Check'}\n          </Button>\n        </Box>\n      </Stack>\n\n      {/*\n        The count, in front of the operator, BEFORE the attestation control\n        exists. One assertion covers the batch, so the number it covers has to\n        be on screen when it is given — an attestation offered above an\n        unexamined paste is a signature on a blank page.\n       */}\n      {preview ? (\n        <Stack spacing={1}>\n          <Alert severity={enrollable ? 'info' : 'warning'}>\n            {[\n              preview.optedIn\n                ? `${preview.optedIn} already opted in`\n                : '',\n              preview.needAttestation\n                ? `${preview.needAttestation} with no opt-in on record`\n                : '',\n              preview.refused\n                ? `${preview.refused} cannot be added at all`\n                : '',\n            ]\n              .filter(Boolean)\n              .join(' · ')}\n          </Alert>\n          {/*\n            The HARD refusals only. An address that merely needs the\n            attestation is not a refusal — listing it here would put the very\n            people the checkbox below is about under a heading that says they\n            cannot be added.\n           */}\n          {preview.verdicts\n            .filter((verdict) => verdict.refusal)\n            .map((verdict) => (\n              <Typography\n                key={verdict.input}\n                variant=\"caption\"\n                color=\"text.secondary\"\n              >\n                {`${verdict.input} — ${verdict.summary}`}\n              </Typography>\n            ))}\n          {preview.needAttestation ? (\n            <FormControlLabel\n              control={\n                <Checkbox\n                  checked={attested}\n                  onChange={(event) => setAttested(event.target.checked)}\n                />\n              }\n              label={\n                <Typography variant=\"body2\">\n                  {`I have permission to send marketing email to the ` +\n                    `${preview.needAttestation} ` +\n                    `${preview.needAttestation === 1 ? 'person' : 'people'} ` +\n                    'above with no opt-in on record. This is recorded against ' +\n                    'my account, with the date.'}\n                </Typography>\n              }\n            />\n          ) : null}\n          <Box>\n            <Button\n              size=\"small\"\n              variant=\"contained\"\n              disabled={\n                busy ||\n                !enrollable ||\n                (preview.needAttestation > 0 && !attested)\n              }\n              onClick={() => void handleAdd()}\n            >\n              {busy ? 'Adding…' : `Add ${enrollable}`}\n            </Button>\n          </Box>\n        </Stack>\n      ) : null}\n\n      {/*\n        What actually happened, per address. A batch where one address was\n        suppressed and forty were fine is not a failure, and a bare count would\n        leave the operator to work out which of their lines is missing.\n       */}\n      {results?.length ? (\n        <Stack spacing={0.5}>\n          {results\n            .filter((result) => !result.enrolled)\n            .map((result) => (\n              <Typography\n                key={result.input}\n                variant=\"caption\"\n                color=\"text.secondary\"\n              >\n                {`${result.input} — not added. ${result.error ?? ''}`}\n              </Typography>\n            ))}\n        </Stack>\n      ) : null}\n\n      {members.length === 0 && !hasMore && !filtering ? (\n        <Typography variant=\"body2\" color=\"text.secondary\">\n          {'Nobody is on this list yet.'}\n        </Typography>\n      ) : (\n        <>\n          <ListFilterChips\n            fields={LIST_MEMBER_QUERY.fields}\n            headers={LIST_MEMBER_FILTER_HEADERS}\n            clauses={gridFilter.clauses}\n            onChange={gridFilter.setClauses}\n            options={LIST_MEMBER_FILTER_OPTIONS}\n          />\n          <ListQueryNotices\n            refused={refusals}\n            notices={[...plan.notices, ...columnSort.notices]}\n          />\n          <ListTable\n            aria-label={`Members of ${listName}`}\n            rows={columnSort.rows}\n            columnSort={columnSort}\n            columns={listFilterGridColumns(\n              columns,\n              LIST_MEMBER_QUERY.fields,\n              LIST_MEMBER_FILTER_OPTIONS,\n              LIST_MEMBER_FILTER_HEADERS,\n            )}\n            rowHeight={TABLE_ROW_HEIGHT}\n            // Paged by the footer below, so the grid must not also slice.\n            hideFooter\n            // The panel, the search and the headers go to the query (Consent\n            // sorts the page, and says so); the grid itself sorts nothing.\n            filterMode=\"server\"\n            filterModel={gridFilter.filterModel}\n            onFilterModelChange={gridFilter.onFilterModelChange}\n            quickFilter\n            noRowsLabel=\"No members match these filters\"\n          />\n          <ListPagination\n            page={page}\n            pageSize={pageSize}\n            rowCount={members.length}\n            hasMore={hasMore}\n            onPageChange={setPage}\n            onPageSizeChange={setPageSize}\n          />\n        </>\n      )}\n\n      {/*\n        What the column MEANS, and what to do about the one state an operator\n        can act on. \"No basis on record\" is a fact about this site's records,\n        not a refusal and not a dead end — the remedy is the add form above,\n        which merges onto the membership that is already here rather than\n        creating a second one. Whether a basis-less member is actually mailed\n        is the org's consent policy to decide and is deliberately not claimed\n        here: this surface does not hold that setting, and a caption that\n        guessed it would be wrong for every org on the other mode.\n       */}\n      <Typography variant=\"caption\" color=\"text.secondary\">\n        {'\"No basis on record\" means nobody has recorded this person\\'s ' +\n          'permission for this site — it is not a refusal. To record one, put ' +\n          'their address in the box above and state that you have their ' +\n          'permission; the statement is kept against your account, with the ' +\n          'date.'}\n      </Typography>\n\n      <Typography variant=\"caption\" color=\"text.secondary\">\n        {'Removing someone from a list is not an unsubscribe. It does not add ' +\n          'them to your suppression list, and it does not stop any other list ' +\n          'reaching them. If somebody asked you to stop, suppress the address.'}\n      </Typography>\n    </Stack>\n  )\n}\nListMembersPanel.displayName = 'ListMembersPanel'\n\nexport default ListMembersPanel\n"],"names":["readMarketingBasis","mdiAccountRemoveOutline","MdiIcon","useConfirmationContext","ListFilterChips","ListPagination","ListQueryNotices","listQueryRefusals","ListRowActions","ListTable","listActionsColumn","listFilterGridColumns","TABLE_ROW_HEIGHT","useListGridFilter","useSnackbar","Alert","Box","Button","Checkbox","Chip","FormControlLabel","Stack","TextField","Typography","collection","deleteDoc","doc","useCallback","useEffect","useMemo","useState","useFirestore","useUser","useListQuery","useListColumnSort","authorizedFetch","LIST_MEMBER_FILTER_HEADERS","LIST_MEMBER_FILTER_OPTIONS","LIST_MEMBER_QUERY","memberAddress","member","email","trim","toLowerCase","consentLabel","group","fromContact","own","record","via","basis","when","basisAtMs","Date","toLocaleDateString","key","label","color","assertedBy","otherGrant","VIA_LABELS","rule","manual","MEMBER_SELECT_FIELDS","MEMBER_SORT_HEADERS","consent","viaOf","splitAddresses","value","split","map","entry","replace","filter","Boolean","ListMembersPanel","props","hostId","consentGroup","scope","listId","listName","onMembershipChanged","findRule","ruleSummary","firestore","data","user","enqueueSnackbar","confirm","gridFilter","selectFields","askedSort","setAskedSort","rows","members","hasMore","page","setPage","pageSize","setPageSize","plan","declaration","request","clauses","search","searchWords","sort","deps","idField","contactConsent","setContactConsent","labelFor","row","pageSorts","columnSort","sorts","onSortChange","orderBy","headers","filtering","length","some","word","onFilterChange","filterKey","JSON","stringify","filters","parse","refusals","refused","fields","options","addInput","setAddInput","addName","setAddName","preview","setPreview","attested","setAttested","results","setResults","busy","setBusy","found","setFound","addresses","emails","post","route","body","response","method","payload","json","catch","ok","unansweredRuleRows","unansweredKey","join","current","asked","then","answered","settled","before","undefined","handlePreview","error","variant","allowDuplicate","handleFind","Number","matched","persist","handleAdd","name","attestConsent","added","handleRemove","accepted","title","description","confirmationText","confirmationButtonProps","$id","console","enrollable","optedIn","needAttestation","columns","field","headerName","flex","minWidth","valueGetter","_value","width","addedAt","toDate","getTime","renderCell","direction","spacing","sx","alignItems","size","source","noWrap","String","items","icon","path","destructive","onClick","py","border","borderColor","borderRadius","p","clause","disabled","severity","toLocaleString","truncated","complete","useFlexGap","flexWrap","placeholder","multiline","minRows","maxRows","onChange","event","target","helperText","flexGrow","verdicts","verdict","refusal","input","summary","control","checked","result","enrolled","setClauses","notices","aria-label","rowHeight","hideFooter","filterMode","filterModel","onFilterModelChange","quickFilter","noRowsLabel","rowCount","onPageChange","onPageSizeChange","displayName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CC,GAED,SACEA,kBAAkB,QAIb,eAAc;AACrB,SAASC,uBAAuB,QAAQ,yBAAwB;AAChE,SAASC,OAAO,EAAEC,sBAAsB,QAAQ,uBAAsB;AACtE,OAAOC,qBAAqB,8DAA6D;AACzF,SAASC,cAAc,QAAQ,4DAA2D;AAC1F,OAAOC,oBACLC,iBAAiB,QACZ,+DAA8D;AACrE,SACEC,cAAc,EACdC,SAAS,EACTC,iBAAiB,QACZ,uDAAsD;AAC7D,SAASC,qBAAqB,QAAQ,8CAA6C;AACnF,SAASC,gBAAgB,QAAQ,8CAA6C;AAC9E,SAASC,iBAAiB,QAAQ,kDAAiD;AACnF,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SACEC,KAAK,EACLC,GAAG,EACHC,MAAM,EACNC,QAAQ,EACRC,IAAI,EACJC,gBAAgB,EAChBC,KAAK,EACLC,SAAS,EACTC,UAAU,QACL,gBAAe;AAEtB,SAASC,UAAU,EAAEC,SAAS,EAAEC,GAAG,QAAQ,qBAAoB;AAC/D,SAASC,WAAW,EAAEC,SAAS,EAAEC,OAAO,EAAEC,QAAQ,QAAQ,QAAO;AACjE,SAASC,YAAY,EAAEC,OAAO,QAAQ,iCAAgC;AACtE,SAASC,YAAY,QAAQ,sDAAqD;AAClF,SAASC,iBAAiB,QAAQ,kDAAiD;AAEnF,SAASC,eAAe,QAAQ,2CAA0C;AAC1E,SACEC,0BAA0B,EAC1BC,0BAA0B,EAC1BC,iBAAiB,QACZ,+BAA2B;AA4KlC,wEAAwE,GACxE,MAAMC,gBAAgB,CAACC,SACrB,OAAOA,OAAOC,KAAK,KAAK,WAAWD,OAAOC,KAAK,CAACC,IAAI,GAAGC,WAAW,KAAK;AAEzE,OAAO,SAASC,aACdJ,MAAiB,EACjBK,KAAmB,EACnBC,WAAiC;IAEjC,MAAMC,MAAM/C,mBAAmBwC,QAAmCK;IAClE,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAMG,SACJF,eAAeN,OAAOS,GAAG,KAAK,UAAUF,IAAIG,KAAK,KAAK,eAClDJ,cACAC;IACN,MAAMI,OAAOH,OAAOI,SAAS,GACzB,CAAC,GAAG,EAAE,IAAIC,KAAKL,OAAOI,SAAS,EAAEE,kBAAkB,IAAI,GACvD;IACJ,IAAIN,OAAOE,KAAK,KAAK,YAAY;QAC/B,OAAO;YAAEK,KAAK;YAAaC,OAAO,CAAC,SAAS,EAAEL,MAAM;YAAEM,OAAO;QAAQ;IACvE;IACA,IAAIT,OAAOE,KAAK,KAAK,WAAW;QAC9B;;;;;KAKC,GACD,OAAOF,OAAOU,UAAU,KAAK,aACzB;YAAEH,KAAK;YAAYC,OAAO,CAAC,qBAAqB,EAAEL,MAAM;YAAEM,OAAO;QAAU,IAC3E;YAAEF,KAAK;YAAYC,OAAO,CAAC,QAAQ,EAAEL,MAAM;YAAEM,OAAO;QAAU;IACpE;IACA;;;;;GAKC,GACD,IAAIT,OAAOW,UAAU,KAAK,cAAc;QACtC,OAAO;YAAEJ,KAAK;YAAcC,OAAO;YAA4BC,OAAO;QAAU;IAClF;IACA,IAAIT,OAAOW,UAAU,KAAK,YAAY;QACpC,OAAO;YAAEJ,KAAK;YAAWC,OAAO;YAA+BC,OAAO;QAAU;IAClF;IACA,OAAO;QAAEF,KAAK;QAAQC,OAAO;QAAsBC,OAAO;IAAU;AACtE;AAEA,0DAA0D,GAC1D,MAAMG,aAA0D;IAC9DC,MAAM;IACNC,QAAQ;AACV;AACA,sEAAsE,GACtE,MAAMC,uBAAuB;IAAC;CAAM;AACpC,uDAAuD,GACvD,MAAMC,sBAAsB;IAAEC,SAAS;AAAU;AAEjD,4EAA4E,GAC5E,MAAMC,QAAQ,CAAC1B,SACbA,OAAOS,GAAG,KAAK,SAAS,SAAS;AAEnC,6EAA6E,GAC7E,OAAO,SAASkB,eAAeC,KAAa;IAC1C,OAAOA,MACJC,KAAK,CAAC,WACNC,GAAG,CAAC,CAACC,QAAUA,MAAM7B,IAAI,GAC1B,uEAAuE;KACtE4B,GAAG,CAAC,CAACC,QAAUA,MAAMC,OAAO,CAAC,cAAc,KAC3CC,MAAM,CAACC;AACZ;AAEA,OAAO,SAASC,iBAAiBC,KAA4B;IAC3D,MAAM,EACJC,MAAM,EACNC,YAAY,EACZC,KAAK,EACLC,MAAM,EACNC,QAAQ,EACRC,mBAAmB,EACnBC,QAAQ,EACRC,WAAW,EACZ,GAAGR;IACJ,MAAMS,YAAYtD;IAClB,MAAM,EAAEuD,MAAMC,IAAI,EAAE,GAAGvD;IACvB,MAAM,EAAEwD,eAAe,EAAE,GAAG1E;IAC5B,MAAM,EAAE2E,OAAO,EAAE,GAAGtF;IAEpB;;;;;;;;;;;;;;;;;GAiBC,GACD,MAAMuF,aAAa7E,kBAAkB;QAAE8E,cAAc5B;IAAqB;IAC1E;;;;;;GAMC,GACD,MAAM,CAAC6B,WAAWC,aAAa,GAAG/D,SAA+B;IACjE,MAAM,EACJgE,MAAMC,OAAO,EACbC,OAAO,EACPC,IAAI,EACJC,OAAO,EACPC,QAAQ,EACRC,WAAW,EACXC,IAAI,EACL,GAAGpE,aAAwB;QAC1BT,YAAYA,WAAW6D,WAAWN,KAAK,CAAC,EAAE,EAAEA,KAAK,CAAC,EAAE,EAAE,SAASC,QAAQ;QACvEsB,aAAahE;QACbiE,SAAS;YACPC,SAASd,WAAWc,OAAO;YAC3BC,QAAQf,WAAWgB,WAAW;YAC9BC,MAAMf;QACR;QACAgB,MAAM;YAACvB;YAAWN,KAAK,CAAC,EAAE;YAAEA,KAAK,CAAC,EAAE;YAAEC;SAAO;QAC7C6B,SAAS;IACX;IACA,wEAAwE,GACxE,MAAM,CAACC,gBAAgBC,kBAAkB,GAAGjF,SAE1C,CAAC;IACH,MAAMkF,WAAWrF,YACf,CAACsF,MACCrE,aAAaqE,KAAKnC,cAAcgC,cAAc,CAACvE,cAAc0E,KAAK,GACpE;QAACnC;QAAcgC;KAAe;IAEhC,MAAMI,YAAYrF,QAChB,IAAO,CAAA;YAAEoC,SAAS,CAACgD,MAAmBD,SAASC,KAAKzD,KAAK;QAAC,CAAA,GAC1D;QAACwD;KAAS;IAEZ,MAAMG,aAAajF,kBAA6B;QAC9CkF,OAAO9E,kBAAkB8E,KAAK;QAC9BT,MAAMf;QACNyB,cAAcxB;QACdyB,SAASjB,KAAKiB,OAAO;QACrBxB,MAAMC;QACNmB;QACAK,SAASvD;IACX;IACA,MAAMwD,YACJ9B,WAAWc,OAAO,CAACiB,MAAM,GAAG,KAAK/B,WAAWgB,WAAW,CAACgB,IAAI,CAAC,CAACC,OAASA,KAAKjF,IAAI;IAClF,MAAM,EAAEkF,cAAc,EAAE,GAAGhD;IAC3B,MAAMiD,YAAYL,YAAYM,KAAKC,SAAS,CAAC1B,KAAK2B,OAAO,IAAI;IAC7DpG,UAAU;QACR,IAAI,CAACgG,gBAAgB;QACrBA,eACEC,YACI;YACErE,OAAO;YACPY,OAAO;gBAAE4D,SAASF,KAAKG,KAAK,CAACJ;YAAW;QAC1C,IACA;IAER,GAAG;QAACA;QAAWD;KAAe;IAC9B,MAAMM,WAAWrG,QACf,IACEtB,kBAAkB8F,KAAK8B,OAAO,EAAE;YAC9BC,QAAQ9F,kBAAkB8F,MAAM;YAChCb,SAASnF;YACTiG,SAAShG;QACX,IACF;QAACgE,KAAK8B,OAAO;KAAC;IAGhB,MAAM,CAACG,UAAUC,YAAY,GAAGzG,SAAS;IACzC,MAAM,CAAC0G,SAASC,WAAW,GAAG3G,SAAS;IACvC,MAAM,CAAC4G,SAASC,WAAW,GAAG7G,SAAyB;IACvD,MAAM,CAAC8G,UAAUC,YAAY,GAAG/G,SAAS;IACzC,MAAM,CAACgH,SAASC,WAAW,GAAGjH,SAA6B;IAC3D,MAAM,CAACkH,MAAMC,QAAQ,GAAGnH,SAAS;IACjC;;;;;;;;GAQC,GACD,MAAM,CAACoH,OAAOC,SAAS,GAAGrH,SAA6B;IAEvD,MAAMsH,YAAYF,QAAQA,MAAMG,MAAM,GAAGlF,eAAemE;IAExD;;;;;;;;;;GAUC,GACD1G,UAAU;QACR+G,WAAW;QACXE,YAAY;QACZE,WAAW;QACXI,SAAS;IACX,GAAG;QAACb;KAAS;IAEb,MAAMgB,OAAO3H,YACX,OAAO4H,OAAeC;QACpB,MAAMC,WAAW,MAAMtH,gBAAgBoD,MAAM,CAAC,WAAW,EAAEgE,OAAO,EAAE;YAClEG,QAAQ;YACRnC,SAAS;gBAAE,gBAAgB;YAAmB;YAC9CiC,MAAM1B,KAAKC,SAAS,CAAC;gBAAElD;gBAAQG;eAAWwE;QAC5C;QACA,MAAMG,UAAU,MAAMF,SAASG,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QACpD,OAAO;YAAEC,IAAIL,SAASK,EAAE;YAAEH;QAAQ;IACpC,GACA;QAACpE;QAAMV;QAAQG;KAAO;IAGxB;;;;;GAKC,GACD,MAAM+E,qBAAqBhE,QACxBtB,MAAM,CACL,CAACwC,MACCA,IAAIhE,GAAG,KAAK,UACZL,aAAaqE,KAAKnC,cAAcvB,GAAG,KAAK,UACxC,CAAEhB,CAAAA,cAAc0E,QAAQH,cAAa,GAExCxC,GAAG,CAAC/B,eACJkC,MAAM,CAACC;IACV,MAAMsF,gBAAgBD,mBAAmBE,IAAI,CAAC;IAC9CrI,UAAU;QACR,IAAI,CAACoI,iBAAiB,CAACzE,MAAM;QAC7B,IAAI2E,UAAU;QACd,MAAMC,QAAQH,cAAc3F,KAAK,CAAC;QAClC,KAAKiF,KAAK,uBAAuB;YAAED,QAAQc;QAAM,GAC9CC,IAAI,CAAC,CAAC,EAAEN,EAAE,EAAEH,OAAO,EAAE;sBAMwBU;YAL5C,IAAI,CAACH,WAAW,CAACJ,IAAI;YACrB,MAAMO,mBAAYV,2BAAAA,QAAS1F,OAAO,mBAAI,CAAC;YACvC,sEAAsE;YACtE,0CAA0C;YAC1C,MAAMqG,UAA+C,CAAC;YACtD,KAAK,MAAM7H,SAAS0H,MAAOG,OAAO,CAAC7H,MAAM,IAAG4H,kBAAAA,QAAQ,CAAC5H,MAAM,YAAf4H,kBAAmB;YAC/DtD,kBAAkB,CAACwD,SAAY,aAAKA,QAAWD;QACjD,GACCT,KAAK,CAAC,IAAMW;QACf,OAAO;YACLN,UAAU;QACZ;IACF,GAAG;QAACF;QAAezE;QAAM+D;KAAK;IAE9B,MAAMmB,gBAAgB9I,YAAY;QAChC,IAAIqH,QAAQ,CAACI,UAAU3B,MAAM,EAAE;QAC/BwB,QAAQ;QACR,IAAI;YACF,MAAM,EAAEa,EAAE,EAAEH,OAAO,EAAE,GAAG,MAAML,KAAK,wBAAwB;gBACzDD,QAAQD;YACV;YACA,IAAI,CAACU,IAAI;;gBACP,OAAO,KAAKtE,wBACVmE,2BAAAA,QAASe,KAAK,mBAAI,uCAClB;oBAAEC,SAAS;oBAAWC,gBAAgB;gBAAK;YAE/C;YACAjC,WAAWgB;QACb,EAAE,eAAM;YACNnE,gBAAgB,uCAAuC;gBACrDmF,SAAS;gBACTC,gBAAgB;YAClB;QACF,SAAU;YACR3B,QAAQ;QACV;IACF,GAAG;QAACD;QAAMI;QAAWE;QAAM9D;KAAgB;IAE3C,MAAMqF,aAAalJ,YAAY;QAC7B,IAAIqH,QAAQ,CAAC7D,UAAU;QACvB8D,QAAQ;QACR,IAAI;;YACF,MAAM,EAAEa,EAAE,EAAEH,OAAO,EAAE,GAAG,MAAML,KAAK,qBAAqB;gBACtDzF,MAAMsB;YACR;YACA,IAAI,CAAC2E,IAAI;;gBACP,OAAO,KAAKtE,yBACVmE,2BAAAA,QAASe,KAAK,oBAAI,yCAClB;oBAAEC,SAAS;oBAAWC,gBAAgB;gBAAK;YAE/C;YACA;;;;;;OAMC,GACDzB,SAASQ;YACThB,WAAWgB;YACXd,YAAY;YACZE,WAAW;YACX,IAAI,CAAC+B,eAAOnB,2BAAAA,QAASoB,OAAO,mBAAI,IAAI;gBAClCvF,gBAAgB,8BAA8B;oBAC5CmF,SAAS;oBACTK,SAAS;gBACX;YACF;QACF,EAAE,eAAM;YACNxF,gBAAgB,yCAAyC;gBACvDmF,SAAS;gBACTC,gBAAgB;YAClB;QACF,SAAU;YACR3B,QAAQ;QACV;IACF,GAAG;QAACD;QAAM7D;QAAUmE;QAAM9D;KAAgB;IAE1C,MAAMyF,YAAYtJ,YAAY;QAC5B,IAAIqH,QAAQ,CAACN,SAAS;QACtBO,QAAQ;QACR,IAAI;;YACF,MAAM,EAAEa,EAAE,EAAEH,OAAO,EAAE,GAAG,MAAML,KAAK,oBAAoB;gBACrDD,QAAQD;eACJA,UAAU3B,MAAM,KAAK,KAAKe,QAAQ9F,IAAI,KACtC;gBAAEwI,MAAM1C,QAAQ9F,IAAI;YAAG,IACvB,CAAC;gBACL,+DAA+D;gBAC/D,sEAAsE;gBACtE,2CAA2C;gBAC3CyI,eAAevC;;YAEjB,IAAI,CAACkB,IAAI;;gBACP,OAAO,KAAKtE,yBACVmE,2BAAAA,QAASe,KAAK,oBAAI,gCAClB;oBAAEC,SAAS;oBAAWC,gBAAgB;gBAAK;YAE/C;YACA,MAAMQ,QAAQN,eAAOnB,2BAAAA,QAASyB,KAAK,mBAAI;YACvCrC,oBAAYY,2BAAAA,QAASb,OAAO,oBAAI,EAAE;YAClCH,WAAW;YACX,IAAIyC,OAAO;gBACT7C,YAAY;gBACZE,WAAW;gBACXU,SAAS;gBACTjE,uCAAAA;YACF;YACAM,gBACE4F,UAAU,IAAI,qBAAqB,GAAGA,MAAM,aAAa,CAAC,EAC1D;gBAAET,SAASS,QAAQ,YAAY;gBAAWJ,SAAS;YAAM;QAE7D,EAAE,eAAM;YACNxF,gBAAgB,gCAAgC;gBAC9CmF,SAAS;gBACTC,gBAAgB;YAClB;QACF,SAAU;YACR3B,QAAQ;QACV;IACF,GAAG;QACDD;QACAN;QACAU;QACAZ;QACAI;QACAU;QACA9D;QACAN;KACD;IAED,MAAMmG,eAAe1J,YACnB,OAAOa;YAIEA;QAHP,MAAM8I,WAAW,MAAM7F,QAAQ;YAC7B8F,OAAO;YACPC,aACE,IAAGhJ,gBAAAA,OAAOC,KAAK,YAAZD,gBAAgB,cAAc,sBAAsB,EAAEyC,SAAS,EAAE,CAAC,GACrE,mEACA,qEACA,qEACA;YACFwG,kBAAkB;YAClBC,yBAAyB;gBAAEjI,OAAO;YAAQ;QAC5C,EACE,uEAAuE;QACvE,qEAAqE;SACpE2G,IAAI,CAAC,IAAM,MACXP,KAAK,CAAC,IAAM;QACf,IAAI,CAACyB,UAAU;QACf,IAAI;YACF,MAAM7J,UACJC,IACE2D,WACAN,KAAK,CAAC,EAAE,EACRA,KAAK,CAAC,EAAE,EACR,SACAC,QACA,WACAxC,OAAOmJ,GAAG;YAGdzG,uCAAAA;YACAM,gBAAgB,yBAAyB;gBACvCmF,SAAS;gBACTK,SAAS;YACX;QACF,EAAE,OAAON,OAAO;YACdkB,QAAQlB,KAAK,CAACA;YACdlF,gBAAgB,yBAAyB;gBAAEmF,SAAS;YAAQ;QAC9D;IACF,GACA;QACElF;QACAR;QACAI;QACAN;QACAC;QACAQ;QACAN;KACD;IAGH,MAAM2G,aAAanD,UACfA,QAAQoD,OAAO,GAAGpD,QAAQqD,eAAe,GACzC;IAEJ,MAAMC,UAAwB;QAC5B;YACEC,OAAO;YACPC,YAAY;YACZC,MAAM;YACNC,UAAU;YACVC,aAAa,CAACC,QAAQrF;oBAAQA;wBAAAA,aAAAA,IAAIxE,KAAK,YAATwE,aAAa;;QAC7C;QACA;YACEgF,OAAO;YACPC,YAAY;YACZC,MAAM;YACNC,UAAU;YACVC,aAAa,CAACC,QAAQrF;oBAAQA;wBAAAA,YAAAA,IAAIiE,IAAI,YAARjE,YAAY;;QAC5C;QACA;YACEgF,OAAO;YACPC,YAAY;YACZK,OAAO;YACP,gDAAgD;YAChDF,aAAa,CAACC,QAAQrF;;oBAAQA,6BAAAA,qBAAAA,sBAAAA;gCAAAA,eAAAA,IAAIuF,OAAO,sBAAXvF,uBAAAA,aAAawF,MAAM,sBAAnBxF,sBAAAA,0BAAAA,mCAAAA,8BAAAA,oBAAyByF,OAAO,qBAAhCzF,iCAAAA,uCAAwC;;YACtE0F,YAAY,CAAC,EAAE1F,GAAG,EAAE;oBAClBA;uBAAAA,EAAAA,eAAAA,IAAIuF,OAAO,qBAAXvF,aAAawF,MAAM,IAAGxF,IAAIuF,OAAO,CAACC,MAAM,GAAGnJ,kBAAkB,KAAK;;QACtE;QACA;YACE2I,OAAO;YACPC,YAAY;YACZK,OAAO;YACPF,aAAa,CAACC,QAAQrF,MAAQ/C,MAAM+C;YACpC;;;;;OAKC,GACD0F,YAAY,CAAC,EAAE1F,GAAG,EAAE,iBAClB,MAAC5F;oBAAMuL,WAAU;oBAAMC,SAAS;oBAAGC,IAAI;wBAAEC,YAAY;wBAAUX,UAAU;oBAAE;;sCACzE,KAACjL;4BAAK6L,MAAK;4BAAQrC,SAAQ;4BAAWnH,OAAOI,UAAU,CAACM,MAAM+C,KAAK;;wBAClEA,IAAIgG,MAAM,iBACT,KAAC1L;4BAAWoJ,SAAQ;4BAAUlH,OAAM;4BAAiByJ,MAAM;sCACxDjG,IAAIgG,MAAM;6BAEX;;;QAGV;QACA;YACEhB,OAAO;YACPC,YAAY;YACZK,OAAO;YACPF,aAAa,CAACC,QAAQrF,MAAQD,SAASC,KAAKzD,KAAK;YACjDmJ,YAAY,CAAC,EAAE1F,GAAG,EAAE;gBAClB,MAAMhD,UAAU+C,SAASC;gBACzB,qBACE,KAAC9F;oBACC6L,MAAK;oBACLrC,SAAQ;oBACRlH,OAAOQ,QAAQR,KAAK;oBACpBD,OAAOS,QAAQT,KAAK;;YAG1B;QACF;QACA;;;;;KAKC,GACD9C,kBACE,CAACuG;gBAEiBA;iCADhB,KAACzG;gBACCgD,OAAO2J,QAAOlG,aAAAA,IAAIxE,KAAK,YAATwE,aAAaA,IAAI0E,GAAG;gBAClCyB,OAAO;oBACL;wBACE7J,KAAK;wBACLC,OAAO;wBACP6J,oBAAM,KAACnN;4BAAQoN,MAAMrN,wBAAwBqN,IAAI;4BAAEN,MAAM;;wBACzDO,aAAa;wBACbC,SAAS,IAAM,KAAKnC,aAAapE;oBACnC;iBACD;;WAGL;YAAEsF,OAAO;QAAG;KAEf;IAED,qBACE,MAAClL;QAAMwL,SAAS;QAAGC,IAAI;YAAEW,IAAI;QAAE;;YAQ5BtI,yBACC,MAAC9D;gBACCwL,SAAS;gBACTC,IAAI;oBAAEY,QAAQ;oBAAGC,aAAa;oBAAWC,cAAc;oBAAGC,GAAG;gBAAI;;kCAEjE,KAACtM;wBAAWoJ,SAAQ;wBAAWlH,OAAM;kCAClC;;oBAEF,CAAC2B,sBAAAA,cAAe,EAAE,EAAEd,GAAG,CAAC,CAACwJ,uBACxB,KAACvM;4BAAwBoJ,SAAQ;sCAC9BmD;2BADcA;kCAInB,KAAC9M;kCACC,cAAA,KAACC;4BACC+L,MAAK;4BACLrC,SAAQ;4BACRoD,UAAU/E;4BACVwE,SAAS,IAAM,KAAK3C;sCAEnB7B,OAAO,eAAe;;;oBAG1BE,sBACC,KAACnI;wBAAMiN,UAAU9E,MAAM6B,OAAO,GAAG,SAAS;kCACvC,AAAC7B,CAAAA,MAAM6B,OAAO,KAAK,IAChB,qBACA,GAAG7B,MAAM6B,OAAO,CAACkD,cAAc,GAAG,aAAa,CAAC,AAAD,IAChD/E,CAAAA,MAAMgF,SAAS,GACZ,CAAC,+BAA+B,EAAEhF,MAAMG,MAAM,CAAC5B,MAAM,CAAC,EAAE,CAAC,GACzD,8CACA,EAAC,IACJyB,CAAAA,MAAMiF,QAAQ,GACX,KACA,2DACA,sCAAqC;yBAE3C;kCACJ,KAAC5M;wBAAWoJ,SAAQ;wBAAUlH,OAAM;kCACjC,oEACC,gEACA;;;iBAGJ;0BAEJ,KAAClC;gBAAWoJ,SAAQ;gBAAQlH,OAAM;0BAC/B,qEACC,oEACA;;0BAGJ,MAACpC;gBAAMuL,WAAU;gBAAMC,SAAS;gBAAGuB,UAAU;gBAACtB,IAAI;oBAAEuB,UAAU;gBAAO;;kCACnE,KAAC/M;wBACC0L,MAAK;wBACLxJ,OAAM;wBACN8K,aAAY;wBACZC,SAAS;wBACTC,SAAS;wBACTC,SAAS;wBACTrK,OAAOkE;wBACPoG,UAAU,CAACC,QAAUpG,YAAYoG,MAAMC,MAAM,CAACxK,KAAK;wBACnDyK,YACEzF,UAAU3B,MAAM,GAAG,IACf,GAAG2B,UAAU3B,MAAM,CAAC,UAAU,CAAC,GAC/B;wBAENqF,IAAI;4BAAEgC,UAAU;4BAAG1C,UAAU;wBAAI;;oBAElChD,UAAU3B,MAAM,GAAG,IAAI,qBACtB,KAACnG;wBACC0L,MAAK;wBACLxJ,OAAM;wBACNY,OAAOoE;wBACPkG,UAAU,CAACC,QAAUlG,WAAWkG,MAAMC,MAAM,CAACxK,KAAK;wBAClD0I,IAAI;4BAAEV,UAAU;wBAAI;;kCAGxB,KAACpL;kCACC,cAAA,KAACC;4BACC+L,MAAK;4BACLrC,SAAQ;4BACRoD,UAAU/E,QAAQ,CAACI,UAAU3B,MAAM,IAAI/C,QAAQgE;4BAC/C8E,SAAS,IAAM,KAAK/C;sCAEnBzB,OAAO,cAAc;;;;;YAW3BN,wBACC,MAACrH;gBAAMwL,SAAS;;kCACd,KAAC9L;wBAAMiN,UAAUnC,aAAa,SAAS;kCACpC;4BACCnD,QAAQoD,OAAO,GACX,GAAGpD,QAAQoD,OAAO,CAAC,iBAAiB,CAAC,GACrC;4BACJpD,QAAQqD,eAAe,GACnB,GAAGrD,QAAQqD,eAAe,CAAC,yBAAyB,CAAC,GACrD;4BACJrD,QAAQP,OAAO,GACX,GAAGO,QAAQP,OAAO,CAAC,uBAAuB,CAAC,GAC3C;yBACL,CACE1D,MAAM,CAACC,SACPuF,IAAI,CAAC;;oBAQTvB,QAAQqG,QAAQ,CACdtK,MAAM,CAAC,CAACuK,UAAYA,QAAQC,OAAO,EACnC3K,GAAG,CAAC,CAAC0K,wBACJ,KAACzN;4BAECoJ,SAAQ;4BACRlH,OAAM;sCAEL,GAAGuL,QAAQE,KAAK,CAAC,GAAG,EAAEF,QAAQG,OAAO,EAAE;2BAJnCH,QAAQE,KAAK;oBAOvBxG,QAAQqD,eAAe,iBACtB,KAAC3K;wBACCgO,uBACE,KAAClO;4BACCmO,SAASzG;4BACT8F,UAAU,CAACC,QAAU9F,YAAY8F,MAAMC,MAAM,CAACS,OAAO;;wBAGzD7L,qBACE,KAACjC;4BAAWoJ,SAAQ;sCACjB,CAAC,iDAAiD,CAAC,GAClD,GAAGjC,QAAQqD,eAAe,CAAC,CAAC,CAAC,GAC7B,GAAGrD,QAAQqD,eAAe,KAAK,IAAI,WAAW,SAAS,CAAC,CAAC,GACzD,8DACA;;yBAIN;kCACJ,KAAC/K;kCACC,cAAA,KAACC;4BACC+L,MAAK;4BACLrC,SAAQ;4BACRoD,UACE/E,QACA,CAAC6C,cACAnD,QAAQqD,eAAe,GAAG,KAAK,CAACnD;4BAEnC4E,SAAS,IAAM,KAAKvC;sCAEnBjC,OAAO,YAAY,CAAC,IAAI,EAAE6C,YAAY;;;;iBAI3C;YAOH/C,CAAAA,2BAAAA,QAASrB,MAAM,kBACd,KAACpG;gBAAMwL,SAAS;0BACb/D,QACErE,MAAM,CAAC,CAAC6K,SAAW,CAACA,OAAOC,QAAQ,EACnCjL,GAAG,CAAC,CAACgL;wBAM+BA;yCALnC,KAAC/N;wBAECoJ,SAAQ;wBACRlH,OAAM;kCAEL,GAAG6L,OAAOJ,KAAK,CAAC,cAAc,GAAEI,gBAAAA,OAAO5E,KAAK,YAAZ4E,gBAAgB,IAAI;uBAJhDA,OAAOJ,KAAK;;iBAQvB;YAEHnJ,QAAQ0B,MAAM,KAAK,KAAK,CAACzB,WAAW,CAACwB,0BACpC,KAACjG;gBAAWoJ,SAAQ;gBAAQlH,OAAM;0BAC/B;+BAGH;;kCACE,KAACrD;wBACCgI,QAAQ9F,kBAAkB8F,MAAM;wBAChCb,SAASnF;wBACToE,SAASd,WAAWc,OAAO;wBAC3BkI,UAAUhJ,WAAW8J,UAAU;wBAC/BnH,SAAShG;;kCAEX,KAAC/B;wBACC6H,SAASD;wBACTuH,SAAS;+BAAIpJ,KAAKoJ,OAAO;+BAAKtI,WAAWsI,OAAO;yBAAC;;kCAEnD,KAAChP;wBACCiP,cAAY,CAAC,WAAW,EAAEzK,UAAU;wBACpCa,MAAMqB,WAAWrB,IAAI;wBACrBqB,YAAYA;wBACZ6E,SAASrL,sBACPqL,SACA1J,kBAAkB8F,MAAM,EACxB/F,4BACAD;wBAEFuN,WAAW/O;wBACX,8DAA8D;wBAC9DgP,UAAU;wBACV,iEAAiE;wBACjE,+DAA+D;wBAC/DC,YAAW;wBACXC,aAAapK,WAAWoK,WAAW;wBACnCC,qBAAqBrK,WAAWqK,mBAAmB;wBACnDC,WAAW;wBACXC,aAAY;;kCAEd,KAAC5P;wBACC4F,MAAMA;wBACNE,UAAUA;wBACV+J,UAAUnK,QAAQ0B,MAAM;wBACxBzB,SAASA;wBACTmK,cAAcjK;wBACdkK,kBAAkBhK;;;;0BAexB,KAAC7E;gBAAWoJ,SAAQ;gBAAUlH,OAAM;0BACjC,mEACC,wEACA,kEACA,sEACA;;0BAGJ,KAAClC;gBAAWoJ,SAAQ;gBAAUlH,OAAM;0BACjC,yEACC,wEACA;;;;AAIV;AACAkB,iBAAiB0L,WAAW,GAAG;AAE/B,eAAe1L,iBAAgB"}

package/src/lib/server-console.d.ts

@@ -35,6 +35,30 @@ export { LIST_MEMBER_BATCH_MAX, resolveAddresses, resolveListContext, type Addre
  * the box was ticked would not be a count anybody could stand behind.
  */
 export declare const emailListMembersPreviewHandler: PluginApiHandler;
+/** The most member rows one consent read may name — one table page and then some. */
+export declare const LIST_MEMBER_CONSENT_MAX = 100;
+/**
+ * `POST email/list-member-consent` — the basis a send will act on, for the
+ * rows of a list a RULE enrolled.
+ *
+ * Body: `{ hostId, listId, emails[] }`. Answers `{ consent: { [email]:
+ * { basis, assertedBy, basisAtMs, otherGrant } } }` for each named address
+ * that is a `via: 'rule'` member of the list with no basis on its own row;
+ * every other address is left out, and the table keeps reading those rows
+ * itself.
+ *
+ * A rule-enrolled row never holds a basis — matching a rule is not an opt-in
+ * — so `performCampaignSend` reads those people's contacts instead, through
+ * `withContactConsentForRuleMembers`. The column calls this so it shows the
+ * same answer; the browser cannot make the read itself, because the rules
+ * put the org's contacts behind org-wide membership and a `visibleTo` scope
+ * that an address lookup cannot be combined with.
+ *
+ * The member rows are re-read here rather than taken from the request, so a
+ * caller cannot get a contact's consent read for an address that is not a
+ * rule member of this list. Reads only, behind the same gate as the preview.
+ */
+export declare const emailListMemberConsentHandler: PluginApiHandler;
 /**
  * `POST email/list-members-add` — put these addresses on the list.
  *

package/src/lib/server-console.js

@@ -73,8 +73,9 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
 import { registerEmailSuppressionsApi } from "./server-suppressions.js";
 import { registerEmailListImportApi } from "./server-list-import.js";
 import { LIST_MEMBER_BATCH_MAX, readAddresses, resolveAddresses, resolveListContext } from "./server-list-gate.js";
-import { ASSIGNMENT_REFUSAL_MESSAGES, assignmentBasis, dynamicListRuleIsEmpty, normalizeDynamicListRule, readMarketingBasis, registerPluginApiRoute } from "@aglyn/aglyn/server";
-import { collectDynamicListCandidates, enrollListMember, firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { ASSIGNMENT_REFUSAL_MESSAGES, assignmentBasis, dynamicListRuleIsEmpty, normalizeContactEmail, normalizeDynamicListRule, readMarketingBasis, registerPluginApiRoute } from "@aglyn/aglyn/server";
+import { collectDynamicListCandidates, consentGroupForSite, enrollListMember, firebaseAdmin, orgDataCollectionForHost } from "@aglyn/tenant-data-admin";
+import { CONTACT_LOOKUP_CHUNK, withContactConsentForRuleMembers } from "@aglyn/tenant-data-admin/server/consent-by-address";
 import { registerSubscriptionTopicIndex } from "./server-topic-index.js";
 /** `source` stamped on every membership these routes write. */ export const CONSOLE_ADD_SOURCE = 'console:list-add';
 /*
@@ -141,6 +142,96 @@ import { registerSubscriptionTopicIndex } from "./server-topic-index.js";
         });
     }
 };
+/** The most member rows one consent read may name — one table page and then some. */ export const LIST_MEMBER_CONSENT_MAX = 100;
+/**
+ * `POST email/list-member-consent` — the basis a send will act on, for the
+ * rows of a list a RULE enrolled.
+ *
+ * Body: `{ hostId, listId, emails[] }`. Answers `{ consent: { [email]:
+ * { basis, assertedBy, basisAtMs, otherGrant } } }` for each named address
+ * that is a `via: 'rule'` member of the list with no basis on its own row;
+ * every other address is left out, and the table keeps reading those rows
+ * itself.
+ *
+ * A rule-enrolled row never holds a basis — matching a rule is not an opt-in
+ * — so `performCampaignSend` reads those people's contacts instead, through
+ * `withContactConsentForRuleMembers`. The column calls this so it shows the
+ * same answer; the browser cannot make the read itself, because the rules
+ * put the org's contacts behind org-wide membership and a `visibleTo` scope
+ * that an address lookup cannot be combined with.
+ *
+ * The member rows are re-read here rather than taken from the request, so a
+ * caller cannot get a contact's consent read for an address that is not a
+ * rule member of this list. Reads only, behind the same gate as the preview.
+ */ export const emailListMemberConsentHandler = async (req, res)=>{
+    var _req_body;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const raw = Array.isArray((_req_body = req.body) == null ? void 0 : _req_body.emails) ? req.body.emails : [];
+    const emails = [
+        ...new Set(raw.map((value)=>normalizeContactEmail(value)).filter((value)=>Boolean(value)))
+    ];
+    if (emails.length > LIST_MEMBER_CONSENT_MAX) {
+        return res.status(400).json({
+            error: `At most ${LIST_MEMBER_CONSENT_MAX} addresses per request.`
+        });
+    }
+    try {
+        const context = await resolveListContext(req);
+        if (context.ok === false) {
+            return res.status(context.status).json(context.body);
+        }
+        if (!emails.length) return res.status(200).json({
+            consent: {}
+        });
+        const group = await consentGroupForSite(context.hostId);
+        const records = new Map();
+        const ruleMembers = new Set();
+        const members = context.listRef.collection('members');
+        for(let at = 0; at < emails.length; at += CONTACT_LOOKUP_CHUNK){
+            const chunk = emails.slice(at, at + CONTACT_LOOKUP_CHUNK);
+            const snapshot = await members.where('email', 'in', chunk).get();
+            for (const doc of snapshot.docs){
+                const email = normalizeContactEmail(doc.get('email'));
+                if (!email || doc.get('via') !== 'rule') continue;
+                ruleMembers.add(email);
+                records.set(email, readMarketingBasis(doc.data(), group));
+            }
+        }
+        // Only the rows the overlay will fill are answered.
+        const unrecorded = new Set([
+            ...ruleMembers
+        ].filter((email)=>{
+            var _records_get;
+            return ((_records_get = records.get(email)) == null ? void 0 : _records_get.basis) === 'unrecorded';
+        }));
+        await withContactConsentForRuleMembers(orgDataCollectionForHost(context.hostId, 'contacts'), group, records, unrecorded);
+        const consent = {};
+        for (const email of unrecorded){
+            const record = records.get(email);
+            if (!record) continue;
+            // Named fields: the record also carries provenance that is not the
+            // browser's (see the preview route above).
+            consent[email] = {
+                basis: record.basis,
+                assertedBy: record.assertedBy,
+                basisAtMs: record.basisAtMs,
+                otherGrant: record.otherGrant
+            };
+        }
+        return res.status(200).json({
+            consent
+        });
+    } catch (error) {
+        console.error('[email] list member consent read failed', error);
+        return res.status(500).json({
+            error: 'Consent could not be read.'
+        });
+    }
+};
 /**
  * `POST email/list-members-add` — put these addresses on the list.
  *
@@ -413,6 +504,7 @@ import { registerSubscriptionTopicIndex } from "./server-topic-index.js";
     registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler);
     registerPluginApiRoute('email/list-members-preview', emailListMembersPreviewHandler);
     registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler);
+    registerPluginApiRoute('email/list-member-consent', emailListMemberConsentHandler);
     // The importer runs on the transfer framework (its resource registers from
     // the console declarations), and its permission step reads what the dry
     // run found through this one route — behind `resolveListContext`, the gate

package/src/lib/server-console.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Putting somebody on an email list from the Emails console.\n *\n * The audience card could create a list and delete a list and nothing else:\n * no way to see who was on one, no way to add anybody, no way to take anybody\n * off. Every member document in production arrived from a capture surface —\n * the newsletter handler, the workflow `enrollList` step, the dynamic-list\n * materializer, the Inbox assignment — so the one act a merchant most expects\n * of a list, \"add this person\", was the one act the product refused.\n *\n * ## Why this is a route and not a client write\n *\n * Rules put `orgs/{orgId}/lists/{listId}/members` behind org-wide membership,\n * and until now that block allowed a client CREATE. Nothing used it, and it\n * was the whole feature waiting to be built wrong: a browser that can write a\n * member document can write `marketingConsent: true` beside an address it has\n * never checked, which is a consent record minted by pressing a button. The\n * rules now deny client create and update on that collection, and this route\n * is the writer — through `enrollListMember`, which owns the document id, and\n * through the shared `enrollment-basis`, which owns the basis.\n *\n * ## The same policy the Inbox uses, not a second one\n *\n * `assignmentBasis` and `assignmentReadout` are imported from the framework,\n * where they moved when this became their second caller. There is no third\n * consent basis and no console-only override: a stored `declined` refuses\n * here exactly as it refuses there, an attestation is recorded with the\n * account that made it, and a stored opt-in is carried across with the date\n * the PERSON set rather than the date somebody pressed Add.\n *\n * ## Reads only, until the operator has seen the count\n *\n * `email/list-members-preview` writes nothing. It answers, per address, what\n * would happen and why, so the attestation the operator gives on the second\n * call is given with the numbers in front of them. Both routes run the SAME\n * resolution over the SAME inputs — `resolveAddresses` — so the summary they\n * were shown is the summary that acts.\n *\n * ## Finding people is a read, and it uses the same gate\n *\n * `email/list-rule-preview` answers \"who do these filters select\" without\n * writing anything, so a fixed list can be filled from a search rather than\n * from somebody typing addresses one at a time. It runs the addresses it finds\n * through `resolveAddresses` as well — a bulk path that reached the membership\n * without the suppression check and the attestation would be a way to enroll\n * exactly the people the single-address path refuses.\n *\n * ## The gate itself is `server-list-gate.ts`\n *\n * Who may change a list's membership, and what is true about each address, are\n * asked by these two routes and by the file importer (the list-member transfer\n * resource, `transfer/list-members.server.ts`). They live in a module of their\n * own so the importer shares this file's answer rather than importing this\n * file — which would be a cycle, and a cycle whose module-level constants\n * would evaluate in whichever order the loader happened to reach them.\n */\n\nimport { registerEmailDesignDraftWriter } from './server-email-drafts'\nimport { registerEmailSuppressionsApi } from './server-suppressions'\nimport { registerEmailListImportApi } from './server-list-import'\nimport {\n  LIST_MEMBER_BATCH_MAX,\n  readAddresses,\n  resolveAddresses,\n  resolveListContext,\n} from './server-list-gate'\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentBasis,\n  dynamicListRuleIsEmpty,\n  normalizeDynamicListRule,\n  readMarketingBasis,\n  registerPluginApiRoute,\n  type AssignmentRefusal,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  collectDynamicListCandidates,\n  enrollListMember,\n  firebaseAdmin,\n} from '@aglyn/tenant-data-admin'\nimport { registerSubscriptionTopicIndex } from './server-topic-index'\n\n/** `source` stamped on every membership these routes write. */\nexport const CONSOLE_ADD_SOURCE = 'console:list-add'\n\n/*\n * Re-exported, not redefined. `@aglyn/plugins-email/server` has published\n * these names since the add path shipped, and the console panel and its specs\n * import them from there; moving the gate must not move the plugin's public\n * surface with it.\n */\nexport {\n  LIST_MEMBER_BATCH_MAX,\n  resolveAddresses,\n  resolveListContext,\n  type AddressResolution,\n  type AddressVerdict,\n  type ListContext,\n  type ResolvedBatch,\n} from './server-list-gate'\n\n\n/**\n * `POST email/list-members-preview` — what adding these addresses would do.\n *\n * Reads only, and reached by an explicit act — typing an address or pasting a\n * column — never on mount. It exists because the answer needs three things\n * the browser cannot have: the org's contacts (rules put them behind org-wide\n * membership, which the acting console session may not hold) and both\n * suppression lists. Computing any of it client-side would be a second copy\n * of the rule, on the surface whose whole job is to tell the operator the\n * truth about what is about to happen.\n *\n * It takes no attestation and has nowhere to put one. The preview answers\n * what is TRUE about each person, which is the input to the operator's\n * decision rather than a function of it — a preview whose numbers moved as\n * the box was ticked would not be a count anybody could stand behind.\n */\nexport const emailListMembersPreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const { verdicts, optedIn, needAttestation, refused } =\n      await resolveAddresses({\n        hostId: context.hostId,\n        inputs: requested.emails,\n      })\n    /*\n     * Named fields rather than a spread of the resolution.\n     *\n     * The resolution carries the consent RECORDS it was computed from, for the\n     * write path's use — raw stored basis, provenance, the account behind an\n     * operator assertion. None of that is the browser's, and a spread would\n     * put all of it on the wire the moment a field was added to the internal\n     * shape. What the surface needs is the verdicts and the counts.\n     */\n    return res.status(200).json({\n      listName: context.listName,\n      verdicts,\n      optedIn,\n      needAttestation,\n      refused,\n    })\n  } catch (error) {\n    console.error('[email] list member preview failed', error)\n    return res.status(500).json({ error: 'The addresses could not be checked.' })\n  }\n}\n\n/**\n * `POST email/list-members-add` — put these addresses on the list.\n *\n * Body: `{ hostId, listId, email | emails[], name?, attestConsent? }`.\n * `attestConsent` is the operator STATING that they have these people's\n * permission; it is not a way to name a basis, because the pass-through basis\n * is derived server-side from each person's own record.\n *\n * ## One attestation, for the count the operator was shown\n *\n * The batch carries a single assertion because it is a single act: an\n * operator pasting a column is making one claim about where that column came\n * from. What makes that safe is that the claim is applied per address by the\n * same function the preview ran, so it reaches only the addresses that\n * actually need it — an address with a stored opt-in keeps its own basis and\n * its own date, and an address nothing can enroll is refused with the\n * attestation on the table.\n *\n * ## Partial success is the honest answer\n *\n * A batch where one address is suppressed and forty are fine is not a failed\n * request. Every address comes back with what happened to it, so 200 here\n * means \"the request was processed\", never \"everybody was added\" — the caller\n * reads the per-address verdicts, which is why they are returned rather than\n * a count.\n */\nexport const emailListMembersAddHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  const attested = req.body?.attestConsent === true\n  const name = String(req.body?.name ?? '').trim()\n\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const nowMs = Date.now()\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: requested.emails,\n    })\n\n    const results = []\n    for (const verdict of resolution.verdicts) {\n      if (verdict.refusal || !verdict.email) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: verdict.refusal,\n          error: verdict.summary,\n        })\n        continue\n      }\n      /*\n       * The ONE place a basis is decided, and the only place the attestation\n       * is consulted.\n       *\n       * `resolveAddresses` has already answered the questions that are facts\n       * about the person; this answers the question that is about the\n       * operator, per address, from the consent record that resolution read.\n       * `no-basis` — an address with nothing on record and nobody asserting\n       * anything — is refused HERE and only here.\n       */\n      const decision = assignmentBasis({\n        stored: resolution.stored.get(verdict.email) ?? readMarketingBasis(null, resolution.group),\n        attested,\n        actingUid: context.uid,\n        nowMs,\n      })\n      if ('refusal' in decision) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: decision.refusal,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[decision.refusal],\n        })\n        continue\n      }\n      const enrollment = await enrollListMember({\n        listRef: context.listRef,\n        group: resolution.group,\n        email: verdict.email,\n        ...(name && requested.emails.length === 1 ? { name } : {}),\n        source: CONSOLE_ADD_SOURCE,\n        // Never `'rule'`: the dynamic-list materializer reconciles its own\n        // rows away when a person stops matching, and a decision somebody\n        // made by hand is not a rule match that lapsed.\n        via: 'manual',\n        consent: decision,\n        // A pass-through carries the person's grants as their record holds\n        // them (AGL-3320); an attestation carries none and is this site's.\n        ...(decision.basis === 'contact-opt-in'\n          ? { grantEntries: resolution.grants.get(verdict.email) ?? {} }\n          : {}),\n      })\n      if (enrollment.enrolled === false) {\n        /*\n         * The membership itself records a refusal the CRM record did not.\n         * `enrollListMember` is the only writer of the collection and holds\n         * the row, so it is the backstop for every enrollment route; reaching\n         * it here means the two records disagree, and the refusal wins.\n         */\n        const reason: AssignmentRefusal =\n          enrollment.refusal === 'declined' ? 'declined' : 'unroutable-address'\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[reason],\n        })\n        continue\n      }\n      results.push({\n        input: verdict.input,\n        email: verdict.email,\n        enrolled: true,\n        memberId: enrollment.memberId,\n        created: enrollment.created,\n        basis: decision.basis,\n      })\n    }\n\n    return res.status(200).json({\n      listName: context.listName,\n      added: results.filter((result) => result.enrolled).length,\n      results,\n    })\n  } catch (error) {\n    console.error('[email] list member add failed', error)\n    return res.status(500).json({ error: 'The addresses could not be added.' })\n  }\n}\n\n/**\n * WHO A SET OF FILTERS FINDS, and what would happen if you added them.\n *\n * ## The gap it fills\n *\n * The filters behind a list could only ever be MATERIALIZED — the sweep wrote\n * the matching people straight into the membership. A merchant could not ask\n * \"who is this\" without committing to it, and a fixed list could not use the\n * filters at all: its only way to gain a member was somebody typing or pasting\n * an address. This answers the question without writing anything.\n *\n * ## It is the same consent gate, not a second one\n *\n * The addresses the scan finds are put through {@link resolveAddresses} — the\n * exact function `email/list-members-preview` uses — so a suppressed address\n * is reported as refused here, and somebody with no opt-in on record is\n * reported as needing an attestation here, before any of them is offered for\n * adding. That is deliberate and load-bearing: a bulk path that skipped the\n * check would be a way to fill a list with people the one-at-a-time path\n * refuses, which is the defect class this product already has a register entry\n * for. The ADD still goes through `email/list-members-add`, which re-runs\n * every check server-side, so this preview is an honest readout rather than a\n * permission.\n *\n * ## What it will not do\n *\n * It writes nothing, it enrolls nobody, and it compares no count against any\n * limit. The batch cap below bounds how many addresses it hands back for a\n * single add — the scan itself still reports how many people it MATCHED, so a\n * merchant is told the audience is larger than one batch rather than shown a\n * truncated number as if it were the whole.\n */\nexport const emailListRulePreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const rule = normalizeDynamicListRule(req.body?.rule)\n    if (dynamicListRuleIsEmpty(rule)) {\n      /*\n       * Not an error, and not an empty result either. A rule with no source\n       * matches nobody by construction, and reporting that as \"0 people\" is\n       * indistinguishable from a rule that ran and found none — which is the\n       * confusion the `empty` flag exists to prevent everywhere else.\n       */\n      return res.status(200).json({\n        matched: 0,\n        truncated: false,\n        complete: true,\n        empty: true,\n        emails: [],\n        verdicts: [],\n        optedIn: 0,\n        needAttestation: 0,\n        refused: 0,\n      })\n    }\n    const scan = await collectDynamicListCandidates({\n      hostId: context.hostId,\n      rule,\n    })\n    /*\n     * The addresses, in the scan's own order, capped at what one add can\n     * carry. `matched` is reported separately and is NOT this length: a\n     * merchant looking at a 400-person audience must be told it is 400 even\n     * when the button in front of them adds 100.\n     */\n    const emails = scan.candidates\n      .map((candidate) => candidate.email)\n      .filter(Boolean)\n    const batch = emails.slice(0, LIST_MEMBER_BATCH_MAX)\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: batch,\n    })\n    return res.status(200).json({\n      listName: context.listName,\n      matched: emails.length,\n      /*\n       * Two different reasons a readout can be short of the truth, reported\n       * apart: `truncated` is this batch being smaller than the match, and\n       * `complete: false` is the SCAN having run out of budget, so `matched`\n       * is itself a floor.\n       */\n      truncated: emails.length > batch.length,\n      complete: scan.complete,\n      empty: false,\n      emails: batch,\n      verdicts: resolution.verdicts,\n      optedIn: resolution.optedIn,\n      needAttestation: resolution.needAttestation,\n      refused: resolution.refused,\n    })\n  } catch (error) {\n    console.error('[email] list rule preview failed', error)\n    return res\n      .status(500)\n      .json({ error: 'The audience could not be worked out.' })\n  }\n}\n\n/**\n * Console API registration.\n *\n * None of these is on the machine-path exemption list in\n * `plugin-api-rate-limit.ts`, so each is counted against the console\n * dispatcher's per-subject budget — the ceiling that bounds a surface which\n * puts a person into a marketing audience, and which scans a whole contact\n * silo to work out who that would be.\n *\n * The limiter these are counted by is the CONSOLE one,\n * `consoleApiRateLimitRefusal`. The visitor limiter is a different limiter on\n * a different dispatcher: `visitorWriteRateLimitRefusal` is installed only in\n * `apps/tenant`, and no request to these routes has ever passed through it.\n * The two share a counter and an exemption list and nothing else — the console\n * key is the authenticated subject, because on an authenticated surface a\n * per-(site, IP) bucket both isolates nothing the identity has not already\n * isolated and hands one operator a fresh budget per site.\n */\nexport function registerEmailConsoleApi(): void {\n  // The email design writer another plugin reaches through the core's\n  // resource-drafts seam (AGL-2912). Registered here alone: the AI jobs that\n  // write through it run only on the console, inline and on the beat\n  // (AGL-3026).\n  registerEmailDesignDraftWriter()\n  // The org's topic catalog, as the tenant surface publishes it: the console\n  // runs sends under a stream too.\n  registerSubscriptionTopicIndex(() => firebaseAdmin.app().firestore())\n  registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler)\n  registerPluginApiRoute(\n    'email/list-members-preview',\n    emailListMembersPreviewHandler,\n  )\n  registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler)\n  // The importer runs on the transfer framework (its resource registers from\n  // the console declarations), and its permission step reads what the dry\n  // run found through this one route — behind `resolveListContext`, the gate\n  // the import's own writes reach through `resolveAddresses` too.\n  registerEmailListImportApi()\n  // Suppressions live in their own module: they are a per-SITE list gated on\n  // the site role, where list membership is an ORG audience gated on org-wide\n  // access, and one file holding both gates is one file for the wrong one to\n  // be copied out of.\n  registerEmailSuppressionsApi()\n}\n"],"names":["registerEmailDesignDraftWriter","registerEmailSuppressionsApi","registerEmailListImportApi","LIST_MEMBER_BATCH_MAX","readAddresses","resolveAddresses","resolveListContext","ASSIGNMENT_REFUSAL_MESSAGES","assignmentBasis","dynamicListRuleIsEmpty","normalizeDynamicListRule","readMarketingBasis","registerPluginApiRoute","collectDynamicListCandidates","enrollListMember","firebaseAdmin","registerSubscriptionTopicIndex","CONSOLE_ADD_SOURCE","emailListMembersPreviewHandler","req","res","method","status","json","error","requested","context","ok","body","verdicts","optedIn","needAttestation","refused","hostId","inputs","emails","listName","console","emailListMembersAddHandler","attested","attestConsent","name","String","trim","nowMs","Date","now","resolution","results","verdict","refusal","email","push","input","enrolled","reason","summary","decision","stored","get","group","actingUid","uid","enrollment","listRef","length","source","via","consent","basis","grantEntries","grants","memberId","created","added","filter","result","emailListRulePreviewHandler","rule","matched","truncated","complete","empty","scan","candidates","map","candidate","Boolean","batch","slice","registerEmailConsoleApi","app","firestore"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GAED,SAASA,8BAA8B,QAAQ,2BAAuB;AACtE,SAASC,4BAA4B,QAAQ,2BAAuB;AACpE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SACEC,qBAAqB,EACrBC,aAAa,EACbC,gBAAgB,EAChBC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,2BAA2B,EAC3BC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,kBAAkB,EAClBC,sBAAsB,QAGjB,sBAAqB;AAC5B,SACEC,4BAA4B,EAC5BC,gBAAgB,EAChBC,aAAa,QACR,2BAA0B;AACjC,SAASC,8BAA8B,QAAQ,0BAAsB;AAErE,6DAA6D,GAC7D,OAAO,MAAMC,qBAAqB,mBAAkB;AAEpD;;;;;CAKC,GACD,SACEd,qBAAqB,EACrBE,gBAAgB,EAChBC,kBAAkB,QAKb,wBAAoB;AAG3B;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMY,iCAAmD,OAC9DC,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYrB,cAAce;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,IAAI;QACF,MAAME,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAM,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,eAAe,EAAEC,OAAO,EAAE,GACnD,MAAM3B,iBAAiB;YACrB4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QACF;;;;;;;;KAQC,GACD,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BP;YACAC;YACAC;YACAC;QACF;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,sCAAsCA;QACpD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsC;IAC7E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,MAAMc,6BAA+C,OAC1DnB,KACAC;;QASiBD,WACGA;IARpB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYrB,cAAce;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,MAAMe,WAAWpB,EAAAA,YAAAA,IAAIS,IAAI,qBAART,UAAUqB,aAAa,MAAK;IAC7C,MAAMC,OAAOC,gBAAOvB,aAAAA,IAAIS,IAAI,qBAART,WAAUsB,IAAI,mBAAI,IAAIE,IAAI;IAE9C,IAAI;QACF,MAAMjB,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMgB,QAAQC,KAAKC,GAAG;QACtB,MAAMC,aAAa,MAAM1C,iBAAiB;YACxC4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QAEA,MAAMa,UAAU,EAAE;QAClB,KAAK,MAAMC,WAAWF,WAAWlB,QAAQ,CAAE;gBAsB/BkB,wBA6BYA;YAlDtB,IAAIE,QAAQC,OAAO,IAAI,CAACD,QAAQE,KAAK,EAAE;gBACrCH,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQN,QAAQC,OAAO;oBACvB1B,OAAOyB,QAAQO,OAAO;gBACxB;gBACA;YACF;YACA;;;;;;;;;OASC,GACD,MAAMC,WAAWjD,gBAAgB;gBAC/BkD,MAAM,GAAEX,yBAAAA,WAAWW,MAAM,CAACC,GAAG,CAACV,QAAQE,KAAK,aAAnCJ,yBAAwCpC,mBAAmB,MAAMoC,WAAWa,KAAK;gBACzFrB;gBACAsB,WAAWnC,QAAQoC,GAAG;gBACtBlB;YACF;YACA,IAAI,aAAaa,UAAU;gBACzBT,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQE,SAASP,OAAO;oBACxB1B,OAAOjB,2BAA2B,CAACkD,SAASP,OAAO,CAAC;gBACtD;gBACA;YACF;YACA,MAAMa,aAAa,MAAMjD,iBAAiB;gBACxCkD,SAAStC,QAAQsC,OAAO;gBACxBJ,OAAOb,WAAWa,KAAK;gBACvBT,OAAOF,QAAQE,KAAK;eAChBV,QAAQhB,UAAUU,MAAM,CAAC8B,MAAM,KAAK,IAAI;gBAAExB;YAAK,IAAI,CAAC;gBACxDyB,QAAQjD;gBACR,mEAAmE;gBACnE,kEAAkE;gBAClE,gDAAgD;gBAChDkD,KAAK;gBACLC,SAASX;eAGLA,SAASY,KAAK,KAAK,mBACnB;gBAAEC,YAAY,GAAEvB,yBAAAA,WAAWwB,MAAM,CAACZ,GAAG,CAACV,QAAQE,KAAK,aAAnCJ,yBAAwC,CAAC;YAAE,IAC3D,CAAC;YAEP,IAAIgB,WAAWT,QAAQ,KAAK,OAAO;gBACjC;;;;;SAKC,GACD,MAAMC,SACJQ,WAAWb,OAAO,KAAK,aAAa,aAAa;gBACnDF,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC;oBACA/B,OAAOjB,2BAA2B,CAACgD,OAAO;gBAC5C;gBACA;YACF;YACAP,QAAQI,IAAI,CAAC;gBACXC,OAAOJ,QAAQI,KAAK;gBACpBF,OAAOF,QAAQE,KAAK;gBACpBG,UAAU;gBACVkB,UAAUT,WAAWS,QAAQ;gBAC7BC,SAASV,WAAWU,OAAO;gBAC3BJ,OAAOZ,SAASY,KAAK;YACvB;QACF;QAEA,OAAOjD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BsC,OAAO1B,QAAQ2B,MAAM,CAAC,CAACC,SAAWA,OAAOtB,QAAQ,EAAEW,MAAM;YACzDjB;QACF;IACF,EAAE,OAAOxB,OAAO;QACda,QAAQb,KAAK,CAAC,kCAAkCA;QAChD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMqD,8BAAgD,OAC3D1D,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI;YAKoCL;QAJtC,MAAMO,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMkD,OAAOpE,0BAAyBS,YAAAA,IAAIS,IAAI,qBAART,UAAU2D,IAAI;QACpD,IAAIrE,uBAAuBqE,OAAO;YAChC;;;;;OAKC,GACD,OAAO1D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BwD,SAAS;gBACTC,WAAW;gBACXC,UAAU;gBACVC,OAAO;gBACP/C,QAAQ,EAAE;gBACVN,UAAU,EAAE;gBACZC,SAAS;gBACTC,iBAAiB;gBACjBC,SAAS;YACX;QACF;QACA,MAAMmD,OAAO,MAAMtE,6BAA6B;YAC9CoB,QAAQP,QAAQO,MAAM;YACtB6C;QACF;QACA;;;;;KAKC,GACD,MAAM3C,SAASgD,KAAKC,UAAU,CAC3BC,GAAG,CAAC,CAACC,YAAcA,UAAUnC,KAAK,EAClCwB,MAAM,CAACY;QACV,MAAMC,QAAQrD,OAAOsD,KAAK,CAAC,GAAGtF;QAC9B,MAAM4C,aAAa,MAAM1C,iBAAiB;YACxC4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQsD;QACV;QACA,OAAOpE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1B2C,SAAS5C,OAAO8B,MAAM;YACtB;;;;;OAKC,GACDe,WAAW7C,OAAO8B,MAAM,GAAGuB,MAAMvB,MAAM;YACvCgB,UAAUE,KAAKF,QAAQ;YACvBC,OAAO;YACP/C,QAAQqD;YACR3D,UAAUkB,WAAWlB,QAAQ;YAC7BC,SAASiB,WAAWjB,OAAO;YAC3BC,iBAAiBgB,WAAWhB,eAAe;YAC3CC,SAASe,WAAWf,OAAO;QAC7B;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,oCAAoCA;QAClD,OAAOJ,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAwC;IAC3D;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASkE;IACd,oEAAoE;IACpE,2EAA2E;IAC3E,mEAAmE;IACnE,cAAc;IACd1F;IACA,2EAA2E;IAC3E,iCAAiC;IACjCgB,+BAA+B,IAAMD,cAAc4E,GAAG,GAAGC,SAAS;IAClEhF,uBAAuB,2BAA2BiE;IAClDjE,uBACE,8BACAM;IAEFN,uBAAuB,0BAA0B0B;IACjD,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,gEAAgE;IAChEpC;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,oBAAoB;IACpBD;AACF"}
+{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Putting somebody on an email list from the Emails console.\n *\n * The audience card could create a list and delete a list and nothing else:\n * no way to see who was on one, no way to add anybody, no way to take anybody\n * off. Every member document in production arrived from a capture surface —\n * the newsletter handler, the workflow `enrollList` step, the dynamic-list\n * materializer, the Inbox assignment — so the one act a merchant most expects\n * of a list, \"add this person\", was the one act the product refused.\n *\n * ## Why this is a route and not a client write\n *\n * Rules put `orgs/{orgId}/lists/{listId}/members` behind org-wide membership,\n * and until now that block allowed a client CREATE. Nothing used it, and it\n * was the whole feature waiting to be built wrong: a browser that can write a\n * member document can write `marketingConsent: true` beside an address it has\n * never checked, which is a consent record minted by pressing a button. The\n * rules now deny client create and update on that collection, and this route\n * is the writer — through `enrollListMember`, which owns the document id, and\n * through the shared `enrollment-basis`, which owns the basis.\n *\n * ## The same policy the Inbox uses, not a second one\n *\n * `assignmentBasis` and `assignmentReadout` are imported from the framework,\n * where they moved when this became their second caller. There is no third\n * consent basis and no console-only override: a stored `declined` refuses\n * here exactly as it refuses there, an attestation is recorded with the\n * account that made it, and a stored opt-in is carried across with the date\n * the PERSON set rather than the date somebody pressed Add.\n *\n * ## Reads only, until the operator has seen the count\n *\n * `email/list-members-preview` writes nothing. It answers, per address, what\n * would happen and why, so the attestation the operator gives on the second\n * call is given with the numbers in front of them. Both routes run the SAME\n * resolution over the SAME inputs — `resolveAddresses` — so the summary they\n * were shown is the summary that acts.\n *\n * ## Finding people is a read, and it uses the same gate\n *\n * `email/list-rule-preview` answers \"who do these filters select\" without\n * writing anything, so a fixed list can be filled from a search rather than\n * from somebody typing addresses one at a time. It runs the addresses it finds\n * through `resolveAddresses` as well — a bulk path that reached the membership\n * without the suppression check and the attestation would be a way to enroll\n * exactly the people the single-address path refuses.\n *\n * ## The gate itself is `server-list-gate.ts`\n *\n * Who may change a list's membership, and what is true about each address, are\n * asked by these two routes and by the file importer (the list-member transfer\n * resource, `transfer/list-members.server.ts`). They live in a module of their\n * own so the importer shares this file's answer rather than importing this\n * file — which would be a cycle, and a cycle whose module-level constants\n * would evaluate in whichever order the loader happened to reach them.\n */\n\nimport { registerEmailDesignDraftWriter } from './server-email-drafts'\nimport { registerEmailSuppressionsApi } from './server-suppressions'\nimport { registerEmailListImportApi } from './server-list-import'\nimport {\n  LIST_MEMBER_BATCH_MAX,\n  readAddresses,\n  resolveAddresses,\n  resolveListContext,\n} from './server-list-gate'\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentBasis,\n  dynamicListRuleIsEmpty,\n  normalizeContactEmail,\n  normalizeDynamicListRule,\n  readMarketingBasis,\n  type MarketingConsentRecord,\n  registerPluginApiRoute,\n  type AssignmentRefusal,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  collectDynamicListCandidates,\n  consentGroupForSite,\n  enrollListMember,\n  firebaseAdmin,\n  orgDataCollectionForHost,\n} from '@aglyn/tenant-data-admin'\nimport {\n  CONTACT_LOOKUP_CHUNK,\n  withContactConsentForRuleMembers,\n} from '@aglyn/tenant-data-admin/server/consent-by-address'\nimport { registerSubscriptionTopicIndex } from './server-topic-index'\n\n/** `source` stamped on every membership these routes write. */\nexport const CONSOLE_ADD_SOURCE = 'console:list-add'\n\n/*\n * Re-exported, not redefined. `@aglyn/plugins-email/server` has published\n * these names since the add path shipped, and the console panel and its specs\n * import them from there; moving the gate must not move the plugin's public\n * surface with it.\n */\nexport {\n  LIST_MEMBER_BATCH_MAX,\n  resolveAddresses,\n  resolveListContext,\n  type AddressResolution,\n  type AddressVerdict,\n  type ListContext,\n  type ResolvedBatch,\n} from './server-list-gate'\n\n\n/**\n * `POST email/list-members-preview` — what adding these addresses would do.\n *\n * Reads only, and reached by an explicit act — typing an address or pasting a\n * column — never on mount. It exists because the answer needs three things\n * the browser cannot have: the org's contacts (rules put them behind org-wide\n * membership, which the acting console session may not hold) and both\n * suppression lists. Computing any of it client-side would be a second copy\n * of the rule, on the surface whose whole job is to tell the operator the\n * truth about what is about to happen.\n *\n * It takes no attestation and has nowhere to put one. The preview answers\n * what is TRUE about each person, which is the input to the operator's\n * decision rather than a function of it — a preview whose numbers moved as\n * the box was ticked would not be a count anybody could stand behind.\n */\nexport const emailListMembersPreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const { verdicts, optedIn, needAttestation, refused } =\n      await resolveAddresses({\n        hostId: context.hostId,\n        inputs: requested.emails,\n      })\n    /*\n     * Named fields rather than a spread of the resolution.\n     *\n     * The resolution carries the consent RECORDS it was computed from, for the\n     * write path's use — raw stored basis, provenance, the account behind an\n     * operator assertion. None of that is the browser's, and a spread would\n     * put all of it on the wire the moment a field was added to the internal\n     * shape. What the surface needs is the verdicts and the counts.\n     */\n    return res.status(200).json({\n      listName: context.listName,\n      verdicts,\n      optedIn,\n      needAttestation,\n      refused,\n    })\n  } catch (error) {\n    console.error('[email] list member preview failed', error)\n    return res.status(500).json({ error: 'The addresses could not be checked.' })\n  }\n}\n\n/** The most member rows one consent read may name — one table page and then some. */\nexport const LIST_MEMBER_CONSENT_MAX = 100\n\n/**\n * `POST email/list-member-consent` — the basis a send will act on, for the\n * rows of a list a RULE enrolled.\n *\n * Body: `{ hostId, listId, emails[] }`. Answers `{ consent: { [email]:\n * { basis, assertedBy, basisAtMs, otherGrant } } }` for each named address\n * that is a `via: 'rule'` member of the list with no basis on its own row;\n * every other address is left out, and the table keeps reading those rows\n * itself.\n *\n * A rule-enrolled row never holds a basis — matching a rule is not an opt-in\n * — so `performCampaignSend` reads those people's contacts instead, through\n * `withContactConsentForRuleMembers`. The column calls this so it shows the\n * same answer; the browser cannot make the read itself, because the rules\n * put the org's contacts behind org-wide membership and a `visibleTo` scope\n * that an address lookup cannot be combined with.\n *\n * The member rows are re-read here rather than taken from the request, so a\n * caller cannot get a contact's consent read for an address that is not a\n * rule member of this list. Reads only, behind the same gate as the preview.\n */\nexport const emailListMemberConsentHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const raw: unknown[] = Array.isArray(req.body?.emails) ? req.body.emails : []\n  const emails = [\n    ...new Set(\n      raw\n        .map((value) => normalizeContactEmail(value))\n        .filter((value): value is string => Boolean(value)),\n    ),\n  ]\n  if (emails.length > LIST_MEMBER_CONSENT_MAX) {\n    return res.status(400).json({\n      error: `At most ${LIST_MEMBER_CONSENT_MAX} addresses per request.`,\n    })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    if (!emails.length) return res.status(200).json({ consent: {} })\n    const group = await consentGroupForSite(context.hostId)\n    const records = new Map<string, MarketingConsentRecord>()\n    const ruleMembers = new Set<string>()\n    const members = context.listRef.collection('members')\n    for (let at = 0; at < emails.length; at += CONTACT_LOOKUP_CHUNK) {\n      const chunk = emails.slice(at, at + CONTACT_LOOKUP_CHUNK)\n      const snapshot = await members.where('email', 'in', chunk).get()\n      for (const doc of snapshot.docs) {\n        const email = normalizeContactEmail(doc.get('email'))\n        if (!email || doc.get('via') !== 'rule') continue\n        ruleMembers.add(email)\n        records.set(\n          email,\n          readMarketingBasis(doc.data() as Record<string, unknown>, group),\n        )\n      }\n    }\n    // Only the rows the overlay will fill are answered.\n    const unrecorded = new Set(\n      [...ruleMembers].filter(\n        (email) => records.get(email)?.basis === 'unrecorded',\n      ),\n    )\n    await withContactConsentForRuleMembers(\n      orgDataCollectionForHost(context.hostId, 'contacts'),\n      group,\n      records,\n      unrecorded,\n    )\n    const consent: Record<string, Record<string, unknown>> = {}\n    for (const email of unrecorded) {\n      const record = records.get(email)\n      if (!record) continue\n      // Named fields: the record also carries provenance that is not the\n      // browser's (see the preview route above).\n      consent[email] = {\n        basis: record.basis,\n        assertedBy: record.assertedBy,\n        basisAtMs: record.basisAtMs,\n        otherGrant: record.otherGrant,\n      }\n    }\n    return res.status(200).json({ consent })\n  } catch (error) {\n    console.error('[email] list member consent read failed', error)\n    return res.status(500).json({ error: 'Consent could not be read.' })\n  }\n}\n\n/**\n * `POST email/list-members-add` — put these addresses on the list.\n *\n * Body: `{ hostId, listId, email | emails[], name?, attestConsent? }`.\n * `attestConsent` is the operator STATING that they have these people's\n * permission; it is not a way to name a basis, because the pass-through basis\n * is derived server-side from each person's own record.\n *\n * ## One attestation, for the count the operator was shown\n *\n * The batch carries a single assertion because it is a single act: an\n * operator pasting a column is making one claim about where that column came\n * from. What makes that safe is that the claim is applied per address by the\n * same function the preview ran, so it reaches only the addresses that\n * actually need it — an address with a stored opt-in keeps its own basis and\n * its own date, and an address nothing can enroll is refused with the\n * attestation on the table.\n *\n * ## Partial success is the honest answer\n *\n * A batch where one address is suppressed and forty are fine is not a failed\n * request. Every address comes back with what happened to it, so 200 here\n * means \"the request was processed\", never \"everybody was added\" — the caller\n * reads the per-address verdicts, which is why they are returned rather than\n * a count.\n */\nexport const emailListMembersAddHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  const attested = req.body?.attestConsent === true\n  const name = String(req.body?.name ?? '').trim()\n\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const nowMs = Date.now()\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: requested.emails,\n    })\n\n    const results = []\n    for (const verdict of resolution.verdicts) {\n      if (verdict.refusal || !verdict.email) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: verdict.refusal,\n          error: verdict.summary,\n        })\n        continue\n      }\n      /*\n       * The ONE place a basis is decided, and the only place the attestation\n       * is consulted.\n       *\n       * `resolveAddresses` has already answered the questions that are facts\n       * about the person; this answers the question that is about the\n       * operator, per address, from the consent record that resolution read.\n       * `no-basis` — an address with nothing on record and nobody asserting\n       * anything — is refused HERE and only here.\n       */\n      const decision = assignmentBasis({\n        stored: resolution.stored.get(verdict.email) ?? readMarketingBasis(null, resolution.group),\n        attested,\n        actingUid: context.uid,\n        nowMs,\n      })\n      if ('refusal' in decision) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: decision.refusal,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[decision.refusal],\n        })\n        continue\n      }\n      const enrollment = await enrollListMember({\n        listRef: context.listRef,\n        group: resolution.group,\n        email: verdict.email,\n        ...(name && requested.emails.length === 1 ? { name } : {}),\n        source: CONSOLE_ADD_SOURCE,\n        // Never `'rule'`: the dynamic-list materializer reconciles its own\n        // rows away when a person stops matching, and a decision somebody\n        // made by hand is not a rule match that lapsed.\n        via: 'manual',\n        consent: decision,\n        // A pass-through carries the person's grants as their record holds\n        // them (AGL-3320); an attestation carries none and is this site's.\n        ...(decision.basis === 'contact-opt-in'\n          ? { grantEntries: resolution.grants.get(verdict.email) ?? {} }\n          : {}),\n      })\n      if (enrollment.enrolled === false) {\n        /*\n         * The membership itself records a refusal the CRM record did not.\n         * `enrollListMember` is the only writer of the collection and holds\n         * the row, so it is the backstop for every enrollment route; reaching\n         * it here means the two records disagree, and the refusal wins.\n         */\n        const reason: AssignmentRefusal =\n          enrollment.refusal === 'declined' ? 'declined' : 'unroutable-address'\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[reason],\n        })\n        continue\n      }\n      results.push({\n        input: verdict.input,\n        email: verdict.email,\n        enrolled: true,\n        memberId: enrollment.memberId,\n        created: enrollment.created,\n        basis: decision.basis,\n      })\n    }\n\n    return res.status(200).json({\n      listName: context.listName,\n      added: results.filter((result) => result.enrolled).length,\n      results,\n    })\n  } catch (error) {\n    console.error('[email] list member add failed', error)\n    return res.status(500).json({ error: 'The addresses could not be added.' })\n  }\n}\n\n/**\n * WHO A SET OF FILTERS FINDS, and what would happen if you added them.\n *\n * ## The gap it fills\n *\n * The filters behind a list could only ever be MATERIALIZED — the sweep wrote\n * the matching people straight into the membership. A merchant could not ask\n * \"who is this\" without committing to it, and a fixed list could not use the\n * filters at all: its only way to gain a member was somebody typing or pasting\n * an address. This answers the question without writing anything.\n *\n * ## It is the same consent gate, not a second one\n *\n * The addresses the scan finds are put through {@link resolveAddresses} — the\n * exact function `email/list-members-preview` uses — so a suppressed address\n * is reported as refused here, and somebody with no opt-in on record is\n * reported as needing an attestation here, before any of them is offered for\n * adding. That is deliberate and load-bearing: a bulk path that skipped the\n * check would be a way to fill a list with people the one-at-a-time path\n * refuses, which is the defect class this product already has a register entry\n * for. The ADD still goes through `email/list-members-add`, which re-runs\n * every check server-side, so this preview is an honest readout rather than a\n * permission.\n *\n * ## What it will not do\n *\n * It writes nothing, it enrolls nobody, and it compares no count against any\n * limit. The batch cap below bounds how many addresses it hands back for a\n * single add — the scan itself still reports how many people it MATCHED, so a\n * merchant is told the audience is larger than one batch rather than shown a\n * truncated number as if it were the whole.\n */\nexport const emailListRulePreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const rule = normalizeDynamicListRule(req.body?.rule)\n    if (dynamicListRuleIsEmpty(rule)) {\n      /*\n       * Not an error, and not an empty result either. A rule with no source\n       * matches nobody by construction, and reporting that as \"0 people\" is\n       * indistinguishable from a rule that ran and found none — which is the\n       * confusion the `empty` flag exists to prevent everywhere else.\n       */\n      return res.status(200).json({\n        matched: 0,\n        truncated: false,\n        complete: true,\n        empty: true,\n        emails: [],\n        verdicts: [],\n        optedIn: 0,\n        needAttestation: 0,\n        refused: 0,\n      })\n    }\n    const scan = await collectDynamicListCandidates({\n      hostId: context.hostId,\n      rule,\n    })\n    /*\n     * The addresses, in the scan's own order, capped at what one add can\n     * carry. `matched` is reported separately and is NOT this length: a\n     * merchant looking at a 400-person audience must be told it is 400 even\n     * when the button in front of them adds 100.\n     */\n    const emails = scan.candidates\n      .map((candidate) => candidate.email)\n      .filter(Boolean)\n    const batch = emails.slice(0, LIST_MEMBER_BATCH_MAX)\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: batch,\n    })\n    return res.status(200).json({\n      listName: context.listName,\n      matched: emails.length,\n      /*\n       * Two different reasons a readout can be short of the truth, reported\n       * apart: `truncated` is this batch being smaller than the match, and\n       * `complete: false` is the SCAN having run out of budget, so `matched`\n       * is itself a floor.\n       */\n      truncated: emails.length > batch.length,\n      complete: scan.complete,\n      empty: false,\n      emails: batch,\n      verdicts: resolution.verdicts,\n      optedIn: resolution.optedIn,\n      needAttestation: resolution.needAttestation,\n      refused: resolution.refused,\n    })\n  } catch (error) {\n    console.error('[email] list rule preview failed', error)\n    return res\n      .status(500)\n      .json({ error: 'The audience could not be worked out.' })\n  }\n}\n\n/**\n * Console API registration.\n *\n * None of these is on the machine-path exemption list in\n * `plugin-api-rate-limit.ts`, so each is counted against the console\n * dispatcher's per-subject budget — the ceiling that bounds a surface which\n * puts a person into a marketing audience, and which scans a whole contact\n * silo to work out who that would be.\n *\n * The limiter these are counted by is the CONSOLE one,\n * `consoleApiRateLimitRefusal`. The visitor limiter is a different limiter on\n * a different dispatcher: `visitorWriteRateLimitRefusal` is installed only in\n * `apps/tenant`, and no request to these routes has ever passed through it.\n * The two share a counter and an exemption list and nothing else — the console\n * key is the authenticated subject, because on an authenticated surface a\n * per-(site, IP) bucket both isolates nothing the identity has not already\n * isolated and hands one operator a fresh budget per site.\n */\nexport function registerEmailConsoleApi(): void {\n  // The email design writer another plugin reaches through the core's\n  // resource-drafts seam (AGL-2912). Registered here alone: the AI jobs that\n  // write through it run only on the console, inline and on the beat\n  // (AGL-3026).\n  registerEmailDesignDraftWriter()\n  // The org's topic catalog, as the tenant surface publishes it: the console\n  // runs sends under a stream too.\n  registerSubscriptionTopicIndex(() => firebaseAdmin.app().firestore())\n  registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler)\n  registerPluginApiRoute(\n    'email/list-members-preview',\n    emailListMembersPreviewHandler,\n  )\n  registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler)\n  registerPluginApiRoute(\n    'email/list-member-consent',\n    emailListMemberConsentHandler,\n  )\n  // The importer runs on the transfer framework (its resource registers from\n  // the console declarations), and its permission step reads what the dry\n  // run found through this one route — behind `resolveListContext`, the gate\n  // the import's own writes reach through `resolveAddresses` too.\n  registerEmailListImportApi()\n  // Suppressions live in their own module: they are a per-SITE list gated on\n  // the site role, where list membership is an ORG audience gated on org-wide\n  // access, and one file holding both gates is one file for the wrong one to\n  // be copied out of.\n  registerEmailSuppressionsApi()\n}\n"],"names":["registerEmailDesignDraftWriter","registerEmailSuppressionsApi","registerEmailListImportApi","LIST_MEMBER_BATCH_MAX","readAddresses","resolveAddresses","resolveListContext","ASSIGNMENT_REFUSAL_MESSAGES","assignmentBasis","dynamicListRuleIsEmpty","normalizeContactEmail","normalizeDynamicListRule","readMarketingBasis","registerPluginApiRoute","collectDynamicListCandidates","consentGroupForSite","enrollListMember","firebaseAdmin","orgDataCollectionForHost","CONTACT_LOOKUP_CHUNK","withContactConsentForRuleMembers","registerSubscriptionTopicIndex","CONSOLE_ADD_SOURCE","emailListMembersPreviewHandler","req","res","method","status","json","error","requested","context","ok","body","verdicts","optedIn","needAttestation","refused","hostId","inputs","emails","listName","console","LIST_MEMBER_CONSENT_MAX","emailListMemberConsentHandler","raw","Array","isArray","Set","map","value","filter","Boolean","length","consent","group","records","Map","ruleMembers","members","listRef","collection","at","chunk","slice","snapshot","where","get","doc","docs","email","add","set","data","unrecorded","basis","record","assertedBy","basisAtMs","otherGrant","emailListMembersAddHandler","attested","attestConsent","name","String","trim","nowMs","Date","now","resolution","results","verdict","refusal","push","input","enrolled","reason","summary","decision","stored","actingUid","uid","enrollment","source","via","grantEntries","grants","memberId","created","added","result","emailListRulePreviewHandler","rule","matched","truncated","complete","empty","scan","candidates","candidate","batch","registerEmailConsoleApi","app","firestore"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GAED,SAASA,8BAA8B,QAAQ,2BAAuB;AACtE,SAASC,4BAA4B,QAAQ,2BAAuB;AACpE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SACEC,qBAAqB,EACrBC,aAAa,EACbC,gBAAgB,EAChBC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,2BAA2B,EAC3BC,eAAe,EACfC,sBAAsB,EACtBC,qBAAqB,EACrBC,wBAAwB,EACxBC,kBAAkB,EAElBC,sBAAsB,QAGjB,sBAAqB;AAC5B,SACEC,4BAA4B,EAC5BC,mBAAmB,EACnBC,gBAAgB,EAChBC,aAAa,EACbC,wBAAwB,QACnB,2BAA0B;AACjC,SACEC,oBAAoB,EACpBC,gCAAgC,QAC3B,qDAAoD;AAC3D,SAASC,8BAA8B,QAAQ,0BAAsB;AAErE,6DAA6D,GAC7D,OAAO,MAAMC,qBAAqB,mBAAkB;AAEpD;;;;;CAKC,GACD,SACEnB,qBAAqB,EACrBE,gBAAgB,EAChBC,kBAAkB,QAKb,wBAAoB;AAG3B;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMiB,iCAAmD,OAC9DC,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAY1B,cAAcoB;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,IAAI;QACF,MAAME,UAAU,MAAMzB,mBAAmBkB;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAM,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,eAAe,EAAEC,OAAO,EAAE,GACnD,MAAMhC,iBAAiB;YACrBiC,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QACF;;;;;;;;KAQC,GACD,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BP;YACAC;YACAC;YACAC;QACF;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,sCAAsCA;QACpD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsC;IAC7E;AACF,EAAC;AAED,mFAAmF,GACnF,OAAO,MAAMc,0BAA0B,IAAG;AAE1C;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,MAAMC,gCAAkD,OAC7DpB,KACAC;QAKqCD;IAHrC,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMgB,MAAiBC,MAAMC,OAAO,EAACvB,YAAAA,IAAIS,IAAI,qBAART,UAAUgB,MAAM,IAAIhB,IAAIS,IAAI,CAACO,MAAM,GAAG,EAAE;IAC7E,MAAMA,SAAS;WACV,IAAIQ,IACLH,IACGI,GAAG,CAAC,CAACC,QAAUxC,sBAAsBwC,QACrCC,MAAM,CAAC,CAACD,QAA2BE,QAAQF;KAEjD;IACD,IAAIV,OAAOa,MAAM,GAAGV,yBAAyB;QAC3C,OAAOlB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BC,OAAO,CAAC,QAAQ,EAAEc,wBAAwB,uBAAuB,CAAC;QACpE;IACF;IACA,IAAI;QACF,MAAMZ,UAAU,MAAMzB,mBAAmBkB;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,IAAI,CAACO,OAAOa,MAAM,EAAE,OAAO5B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE0B,SAAS,CAAC;QAAE;QAC9D,MAAMC,QAAQ,MAAMxC,oBAAoBgB,QAAQO,MAAM;QACtD,MAAMkB,UAAU,IAAIC;QACpB,MAAMC,cAAc,IAAIV;QACxB,MAAMW,UAAU5B,QAAQ6B,OAAO,CAACC,UAAU,CAAC;QAC3C,IAAK,IAAIC,KAAK,GAAGA,KAAKtB,OAAOa,MAAM,EAAES,MAAM3C,qBAAsB;YAC/D,MAAM4C,QAAQvB,OAAOwB,KAAK,CAACF,IAAIA,KAAK3C;YACpC,MAAM8C,WAAW,MAAMN,QAAQO,KAAK,CAAC,SAAS,MAAMH,OAAOI,GAAG;YAC9D,KAAK,MAAMC,OAAOH,SAASI,IAAI,CAAE;gBAC/B,MAAMC,QAAQ5D,sBAAsB0D,IAAID,GAAG,CAAC;gBAC5C,IAAI,CAACG,SAASF,IAAID,GAAG,CAAC,WAAW,QAAQ;gBACzCT,YAAYa,GAAG,CAACD;gBAChBd,QAAQgB,GAAG,CACTF,OACA1D,mBAAmBwD,IAAIK,IAAI,IAA+BlB;YAE9D;QACF;QACA,oDAAoD;QACpD,MAAMmB,aAAa,IAAI1B,IACrB;eAAIU;SAAY,CAACP,MAAM,CACrB,CAACmB;gBAAUd;mBAAAA,EAAAA,eAAAA,QAAQW,GAAG,CAACG,2BAAZd,aAAoBmB,KAAK,MAAK;;QAG7C,MAAMvD,iCACJF,yBAAyBa,QAAQO,MAAM,EAAE,aACzCiB,OACAC,SACAkB;QAEF,MAAMpB,UAAmD,CAAC;QAC1D,KAAK,MAAMgB,SAASI,WAAY;YAC9B,MAAME,SAASpB,QAAQW,GAAG,CAACG;YAC3B,IAAI,CAACM,QAAQ;YACb,mEAAmE;YACnE,2CAA2C;YAC3CtB,OAAO,CAACgB,MAAM,GAAG;gBACfK,OAAOC,OAAOD,KAAK;gBACnBE,YAAYD,OAAOC,UAAU;gBAC7BC,WAAWF,OAAOE,SAAS;gBAC3BC,YAAYH,OAAOG,UAAU;YAC/B;QACF;QACA,OAAOtD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE0B;QAAQ;IACxC,EAAE,OAAOzB,OAAO;QACda,QAAQb,KAAK,CAAC,2CAA2CA;QACzD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA6B;IACpE;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,MAAMmD,6BAA+C,OAC1DxD,KACAC;;QASiBD,WACGA;IARpB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAY1B,cAAcoB;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,MAAMoD,WAAWzD,EAAAA,YAAAA,IAAIS,IAAI,qBAART,UAAU0D,aAAa,MAAK;IAC7C,MAAMC,OAAOC,gBAAO5D,aAAAA,IAAIS,IAAI,qBAART,WAAU2D,IAAI,mBAAI,IAAIE,IAAI;IAE9C,IAAI;QACF,MAAMtD,UAAU,MAAMzB,mBAAmBkB;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMqD,QAAQC,KAAKC,GAAG;QACtB,MAAMC,aAAa,MAAMpF,iBAAiB;YACxCiC,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QAEA,MAAMkD,UAAU,EAAE;QAClB,KAAK,MAAMC,WAAWF,WAAWvD,QAAQ,CAAE;gBAsB/BuD,wBA6BYA;YAlDtB,IAAIE,QAAQC,OAAO,IAAI,CAACD,QAAQrB,KAAK,EAAE;gBACrCoB,QAAQG,IAAI,CAAC;oBACXC,OAAOH,QAAQG,KAAK;oBACpBxB,OAAOqB,QAAQrB,KAAK;oBACpByB,UAAU;oBACVC,QAAQL,QAAQC,OAAO;oBACvB/D,OAAO8D,QAAQM,OAAO;gBACxB;gBACA;YACF;YACA;;;;;;;;;OASC,GACD,MAAMC,WAAW1F,gBAAgB;gBAC/B2F,MAAM,GAAEV,yBAAAA,WAAWU,MAAM,CAAChC,GAAG,CAACwB,QAAQrB,KAAK,aAAnCmB,yBAAwC7E,mBAAmB,MAAM6E,WAAWlC,KAAK;gBACzF0B;gBACAmB,WAAWrE,QAAQsE,GAAG;gBACtBf;YACF;YACA,IAAI,aAAaY,UAAU;gBACzBR,QAAQG,IAAI,CAAC;oBACXC,OAAOH,QAAQG,KAAK;oBACpBxB,OAAOqB,QAAQrB,KAAK;oBACpByB,UAAU;oBACVC,QAAQE,SAASN,OAAO;oBACxB/D,OAAOtB,2BAA2B,CAAC2F,SAASN,OAAO,CAAC;gBACtD;gBACA;YACF;YACA,MAAMU,aAAa,MAAMtF,iBAAiB;gBACxC4C,SAAS7B,QAAQ6B,OAAO;gBACxBL,OAAOkC,WAAWlC,KAAK;gBACvBe,OAAOqB,QAAQrB,KAAK;eAChBa,QAAQrD,UAAUU,MAAM,CAACa,MAAM,KAAK,IAAI;gBAAE8B;YAAK,IAAI,CAAC;gBACxDoB,QAAQjF;gBACR,mEAAmE;gBACnE,kEAAkE;gBAClE,gDAAgD;gBAChDkF,KAAK;gBACLlD,SAAS4C;eAGLA,SAASvB,KAAK,KAAK,mBACnB;gBAAE8B,YAAY,GAAEhB,yBAAAA,WAAWiB,MAAM,CAACvC,GAAG,CAACwB,QAAQrB,KAAK,aAAnCmB,yBAAwC,CAAC;YAAE,IAC3D,CAAC;YAEP,IAAIa,WAAWP,QAAQ,KAAK,OAAO;gBACjC;;;;;SAKC,GACD,MAAMC,SACJM,WAAWV,OAAO,KAAK,aAAa,aAAa;gBACnDF,QAAQG,IAAI,CAAC;oBACXC,OAAOH,QAAQG,KAAK;oBACpBxB,OAAOqB,QAAQrB,KAAK;oBACpByB,UAAU;oBACVC;oBACAnE,OAAOtB,2BAA2B,CAACyF,OAAO;gBAC5C;gBACA;YACF;YACAN,QAAQG,IAAI,CAAC;gBACXC,OAAOH,QAAQG,KAAK;gBACpBxB,OAAOqB,QAAQrB,KAAK;gBACpByB,UAAU;gBACVY,UAAUL,WAAWK,QAAQ;gBAC7BC,SAASN,WAAWM,OAAO;gBAC3BjC,OAAOuB,SAASvB,KAAK;YACvB;QACF;QAEA,OAAOlD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BoE,OAAOnB,QAAQvC,MAAM,CAAC,CAAC2D,SAAWA,OAAOf,QAAQ,EAAE1C,MAAM;YACzDqC;QACF;IACF,EAAE,OAAO7D,OAAO;QACda,QAAQb,KAAK,CAAC,kCAAkCA;QAChD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMkF,8BAAgD,OAC3DvF,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI;YAKoCL;QAJtC,MAAMO,UAAU,MAAMzB,mBAAmBkB;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAM+E,OAAOrG,0BAAyBa,YAAAA,IAAIS,IAAI,qBAART,UAAUwF,IAAI;QACpD,IAAIvG,uBAAuBuG,OAAO;YAChC;;;;;OAKC,GACD,OAAOvF,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BqF,SAAS;gBACTC,WAAW;gBACXC,UAAU;gBACVC,OAAO;gBACP5E,QAAQ,EAAE;gBACVN,UAAU,EAAE;gBACZC,SAAS;gBACTC,iBAAiB;gBACjBC,SAAS;YACX;QACF;QACA,MAAMgF,OAAO,MAAMvG,6BAA6B;YAC9CwB,QAAQP,QAAQO,MAAM;YACtB0E;QACF;QACA;;;;;KAKC,GACD,MAAMxE,SAAS6E,KAAKC,UAAU,CAC3BrE,GAAG,CAAC,CAACsE,YAAcA,UAAUjD,KAAK,EAClCnB,MAAM,CAACC;QACV,MAAMoE,QAAQhF,OAAOwB,KAAK,CAAC,GAAG7D;QAC9B,MAAMsF,aAAa,MAAMpF,iBAAiB;YACxCiC,QAAQP,QAAQO,MAAM;YACtBC,QAAQiF;QACV;QACA,OAAO/F,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BwE,SAASzE,OAAOa,MAAM;YACtB;;;;;OAKC,GACD6D,WAAW1E,OAAOa,MAAM,GAAGmE,MAAMnE,MAAM;YACvC8D,UAAUE,KAAKF,QAAQ;YACvBC,OAAO;YACP5E,QAAQgF;YACRtF,UAAUuD,WAAWvD,QAAQ;YAC7BC,SAASsD,WAAWtD,OAAO;YAC3BC,iBAAiBqD,WAAWrD,eAAe;YAC3CC,SAASoD,WAAWpD,OAAO;QAC7B;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,oCAAoCA;QAClD,OAAOJ,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAwC;IAC3D;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAAS4F;IACd,oEAAoE;IACpE,2EAA2E;IAC3E,mEAAmE;IACnE,cAAc;IACdzH;IACA,2EAA2E;IAC3E,iCAAiC;IACjCqB,+BAA+B,IAAMJ,cAAcyG,GAAG,GAAGC,SAAS;IAClE9G,uBAAuB,2BAA2BkG;IAClDlG,uBACE,8BACAU;IAEFV,uBAAuB,0BAA0BmE;IACjDnE,uBACE,6BACA+B;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,gEAAgE;IAChE1C;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,oBAAoB;IACpBD;AACF"}

package/src/lib/server-list-gate.js

@@ -1,4 +1,3 @@
-import { _ as _extends } from "@swc/helpers/_/_extends";
 /**
  * @license
  * Copyright 2026 Aglyn LLC
@@ -45,13 +44,12 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * because an attestation is a fact about the operator and folding it in here
  * would make the preview's numbers move as the box was ticked. The basis is
  * decided once, at the write, by `assignmentBasis`.
- */ import { ASSIGNMENT_REFUSAL_MESSAGES, assignmentReadout, grantEntriesAsRecorded, isOrgWideMember, normalizeContactEmail, readMarketingBasis } from "@aglyn/aglyn/server";
+ */ import { ASSIGNMENT_REFUSAL_MESSAGES, assignmentReadout, isOrgWideMember, normalizeContactEmail, readMarketingBasis } from "@aglyn/aglyn/server";
 import { consentGroupForSite, filterSendableForHost, filterSuppressedEmails, firebaseAdmin, getOrgForHost, orgDataCollectionForHost, resolveOrgMembership } from "@aglyn/tenant-data-admin";
-// The leaves, not the barrels: this plugin's specs substitute both barrels
+// The leaf, not the barrel: this plugin's specs substitute both barrels
 // wholesale, and what a deleted contact's refusal still says must be read
 // under them by the real store and the real merge.
-import { readRetainedRefusals } from "@aglyn/tenant-data-admin/server/retained-refusals";
-import { refusalsOf, withRetainedRefusals } from "@aglyn/aglyn/app-utils/retained-refusals";
+import { readContactConsent } from "@aglyn/tenant-data-admin/server/consent-by-address";
 /**
  * The most addresses one request may name.
  *
@@ -65,7 +63,6 @@ import { refusalsOf, withRetainedRefusals } from "@aglyn/aglyn/app-utils/retaine
  * this function is where it refuses, because this is where something is
  * added.
  */ export const LIST_MEMBER_BATCH_MAX = 100;
-/** How many contact addresses one `in` query may carry. */ const CONTACT_LOOKUP_CHUNK = 30;
 /**
  * Who is asking, and about which list.
  *
@@ -225,7 +222,7 @@ import { refusalsOf, withRetainedRefusals } from "@aglyn/aglyn/app-utils/retaine
    */ const group = await consentGroupForSite(input.hostId);
     const [suppression, { stored, grants }] = await Promise.all([
         suppressionFor(input.hostId, group, addresses),
-        storedConsentFor(input.hostId, group, addresses)
+        readContactConsent(orgDataCollectionForHost(input.hostId, 'contacts'), group, addresses)
     ]);
     const unrecorded = readMarketingBasis(null, group);
     const verdicts = rows.map((row)=>{
@@ -298,101 +295,6 @@ import { refusalsOf, withRetainedRefusals } from "@aglyn/aglyn/app-utils/retaine
     }
     return refusals;
 }
-/**
- * The stored consent facts for these addresses, off the org's contacts.
- *
- * Read UNSCOPED, deliberately, exactly as the Inbox route reads it:
- * `scopedToHost` narrows an org collection to what one site may see, and a
- * refusal filtered out by that narrowing is a refusal this route would then
- * step over — the failure mode is enrolling somebody who said no. It is safe
- * because the caller has already been proved an org-wide member, which is the
- * tier the rules grant the whole org's contacts to.
- *
- * ## A refusal wins over an opt-in when the CRM holds both
- *
- * Nothing guarantees one contact per address — the collection is keyed by
- * resource id, not by email — so two records for one person can disagree.
- * Taking whichever the query happened to answer first would make the outcome
- * depend on document order. A recorded refusal is the answer whenever one
- * exists, which is the same precedence `assignmentBasis` applies within a
- * single record.
- *
- * ## A refusal outlives the contact it was written on (AGL-3338)
- *
- * Deleting a contact keeps every refusal it held in the org's retained store,
- * so the address is read with what was retained laid over whatever record is
- * left — `withRetainedRefusals` — and an address with no contact at all still
- * reads `declined` when its person said no. A grant given after the refusal,
- * on a contact the person signed up again through, is the person changing
- * their mind and reads `granted`. The grants carried onto a membership come
- * off the same merged record.
- *
- * A failed read falls to `declined` for the whole batch, for the reason the
- * Inbox route states: a read that throws can neither say the person consented
- * nor that they refused, and the direction that costs a retry is the one that
- * does not enroll somebody whose stored refusal we simply failed to see. The
- * retained store is read the same way, and fails the same way.
- */ async function storedConsentFor(hostId, group, addresses) {
-    const found = new Map();
-    const grants = new Map();
-    if (!addresses.length) return {
-        stored: found,
-        grants
-    };
-    try {
-        const contacts = await orgDataCollectionForHost(hostId, 'contacts');
-        const chunks = [];
-        for(let at = 0; at < addresses.length; at += CONTACT_LOOKUP_CHUNK){
-            chunks.push(addresses.slice(at, at + CONTACT_LOOKUP_CHUNK));
-        }
-        const [snapshots, retained] = await Promise.all([
-            Promise.all(chunks.map((chunk)=>contacts.where('email', 'in', chunk).get())),
-            readRetainedRefusals(contacts, addresses)
-        ]);
-        const consider = (email, data)=>{
-            const merged = withRetainedRefusals(data, refusalsOf(retained.get(email)));
-            const record = readMarketingBasis(merged, group);
-            const already = found.get(email);
-            if ((already == null ? void 0 : already.basis) === 'declined') return;
-            if (already && record.basis !== 'declined') return;
-            found.set(email, record);
-            grants.set(email, grantEntriesAsRecorded(merged, group));
-        };
-        for (const snapshot of snapshots){
-            for (const doc of snapshot.docs){
-                const email = normalizeContactEmail(doc.get('email'));
-                if (email) consider(email, doc.data());
-            }
-        }
-        // What was retained for an address no contact answers any more.
-        for (const email of retained.keys()){
-            if (!found.has(email)) consider(email, null);
-        }
-        return {
-            stored: found,
-            grants
-        };
-    } catch (error) {
-        console.error('[email] consent lookup failed', error);
-        const refused = _extends({}, readMarketingBasis(null, group), {
-            basis: 'declined',
-            // Attributed to nobody: this is what a failed read falls back to, not a
-            // refusal anybody recorded.
-            assertedBy: null,
-            source: null,
-            basisAtMs: null,
-            capturedAtMs: null
-        });
-        return {
-            stored: new Map(addresses.map((email)=>[
-                    email,
-                    refused
-                ])),
-            // Nobody is enrollable on a failed read, so nobody's grants travel.
-            grants: new Map()
-        };
-    }
-}
 /** The addresses named by one request, or the refusal to send back. */ export function readAddresses(req) {
     const body = req.body;
     const raw = Array.isArray(body == null ? void 0 : body.emails) ? body.emails : (body == null ? void 0 : body.email) === undefined ? [] : [

package/src/lib/server-list-gate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-list-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE GATE IN FRONT OF EVERY LIST ENROLLMENT THE CONSOLE MAKES.\n *\n * Who is allowed to change a list's membership, and what is true about each\n * address they name. Three route modules ask it — the audience card's add and\n * preview, the filter search, and the file importer — and they ask this one\n * copy of it.\n *\n * ## Why it is a module of its own\n *\n * It began inside `server-console.ts`, beside its first two callers, and that\n * was right while there were two. The importer made three, and an importer is\n * exactly the surface where a second, laxer idea of \"may this person be\n * enrolled\" is most tempting: a file is bulk, bulk is slow, and skipping the\n * per-address consent read is the obvious saving. A bulk path that reached the\n * membership without the suppression check and the attestation would be a way\n * to enroll precisely the people the one-at-a-time path refuses, which is the\n * defect class `docs/specs/email-competitive-gaps.md` has a closed P1 entry\n * for.\n *\n * Sharing the gate is also what stops the cheaper failure: two modules that\n * merely agree today, with nothing in either one saying the other exists.\n *\n * ## What it decides, and what it deliberately does not\n *\n * {@link resolveAddresses} answers the questions that are FACTS about a\n * person — a stored refusal, a suppression on either list, an opt-in already\n * on record, a line that is not an address. It never consults an attestation,\n * because an attestation is a fact about the operator and folding it in here\n * would make the preview's numbers move as the box was ticked. The basis is\n * decided once, at the write, by `assignmentBasis`.\n */\n\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentReadout,\n  grantEntriesAsRecorded,\n  isOrgWideMember,\n  normalizeContactEmail,\n  readMarketingBasis,\n  type AddressRefusal,\n  type AssignmentRefusal,\n  type ConsentGroup,\n  type MarketingConsentRecord,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  filterSendableForHost,\n  filterSuppressedEmails,\n  firebaseAdmin,\n  getOrgForHost,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\n// The leaves, not the barrels: this plugin's specs substitute both barrels\n// wholesale, and what a deleted contact's refusal still says must be read\n// under them by the real store and the real merge.\nimport { readRetainedRefusals } from '@aglyn/tenant-data-admin/server/retained-refusals'\nimport { refusalsOf, withRetainedRefusals } from '@aglyn/aglyn/app-utils/retained-refusals'\n\n/**\n * The most addresses one request may name.\n *\n * A ceiling on the WRITE, not on the audience. It bounds the work one request\n * does — the resolution below is a handful of reads per address — and it can\n * never refuse a person already enrolled or make room by removing one, which\n * is the difference between a batch size and a capacity limit. Nothing in the\n * product caps list membership: `contactsPerHost` is the audience band and it\n * is metered against CONTACTS, in `upsert-contact.ts`, and enrolling somebody\n * on a list writes no contact. If a membership ceiling is ever introduced,\n * this function is where it refuses, because this is where something is\n * added.\n */\nexport const LIST_MEMBER_BATCH_MAX = 100\n\n/** How many contact addresses one `in` query may carry. */\nconst CONTACT_LOOKUP_CHUNK = 30\n\n/** Everything a list-membership route needs, or the refusal to send back. */\nexport type ListContext =\n  | {\n      ok: true\n      uid: string\n      hostId: string\n      orgId: string\n      listRef: FirebaseFirestore.DocumentReference\n      listName: string\n    }\n  | { ok: false; status: number; body: Record<string, unknown> }\n\n/**\n * Who is asking, and about which list.\n *\n * ## Two gates, not one — the same two the Inbox assignment route applies\n *\n * A host role is necessary and NOT sufficient. Lists live at\n * `orgs/{orgId}/lists` and their members are contacts, so the rules put both\n * behind `isOrgWideMember()`. An editor invited to ONE site is an org member\n * with `allHosts: false`, and gating an org-wide write on the host role alone\n * would let a single-site collaborator enroll people into an audience every\n * other site in the org can mail — and, through the preview, read the consent\n * record of any address they care to type. The Admin SDK evaluates no rules,\n * so this route is the enforcement rather than an echo of it.\n *\n * The plugin's own gates sit above this and are the dispatcher's: a workspace\n * that has switched the email plugin off, or a site it is disabled for, or a\n * release flag that has not reached this org, all 404 before a handler runs.\n */\nexport async function resolveListContext(\n  req: Parameters<PluginApiHandler>[0],\n): Promise<ListContext> {\n  const hostId = String(req.body?.hostId ?? '')\n  const listId = String(req.body?.listId ?? '')\n  if (!hostId || !listId) {\n    return {\n      ok: false,\n      status: 400,\n      body: { error: 'Missing hostId or listId' },\n    }\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    return { ok: false, status: 401, body: { error: 'Unauthenticated' } }\n  }\n\n  const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  const firestore = firebaseAdmin.app().firestore()\n  const hostSnapshot = await firestore.collection('hosts').doc(hostId).get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, body: { error: 'Unknown site' } }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return {\n      ok: false,\n      status: 403,\n      body: { error: 'Not a site admin or editor' },\n    }\n  }\n\n  const orgId = String(\n    (await getOrgForHost(hostId).catch(() => null))?.orgId ?? '',\n  )\n  if (!orgId) {\n    return {\n      ok: false,\n      status: 404,\n      body: { error: 'This site has no organization, so it has no lists.' },\n    }\n  }\n  const membership = await resolveOrgMembership(decoded.uid, orgId).catch(\n    () => null,\n  )\n  if (!isOrgWideListWriter(membership?.member)) {\n    return {\n      ok: false,\n      status: 403,\n      body: {\n        error:\n          'Marketing lists belong to the whole organization, so changing who ' +\n          'is on one needs organization-wide access rather than access to ' +\n          'this site.',\n      },\n    }\n  }\n\n  const listRef = firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection('lists')\n    .doc(listId)\n  const listSnapshot = await listRef.get()\n  // A stale or mistyped id must not CREATE a list: a campaign's `list`\n  // audience would then read a list nobody set up.\n  if (!listSnapshot.exists) {\n    return { ok: false, status: 404, body: { error: 'Unknown list' } }\n  }\n\n  return {\n    ok: true,\n    uid: decoded.uid,\n    hostId,\n    orgId,\n    listRef,\n    listName: String(listSnapshot.get('name') ?? listId),\n  }\n}\n\n/**\n * Whether an org member may change who is on the organization's lists: an\n * org-wide owner, admin or editor whose membership is not suspended. The one\n * answer the list routes and the list-member import ask (see\n * {@link resolveListContext} for why a site role is not enough).\n */\nexport function isOrgWideListWriter(member: unknown): boolean {\n  const entry = member as\n    | { role?: string; orgSuspended?: boolean }\n    | null\n    | undefined\n  return (\n    isOrgWideMember(entry as Parameters<typeof isOrgWideMember>[0]) &&\n    (entry?.role === 'owner' ||\n      entry?.role === 'admin' ||\n      entry?.role === 'editor') &&\n    entry?.orgSuspended !== true\n  )\n}\n\n/** What would happen to one address, and why. */\nexport interface AddressVerdict {\n  /** Exactly what the operator typed, so a bad line can be pointed at. */\n  input: string\n  /** The normalized address, or `null` when there is not one. */\n  email: string | null\n  /**\n   * Why this address can never go on the list, or `null`.\n   *\n   * A HARD refusal only — a stored `declined`, either suppression list, or a\n   * line that is not an address. `no-basis` is deliberately NOT one of them:\n   * \"you have not said you have permission yet\" is an unanswered question,\n   * not a refusal, and reporting it as one would list the very people an\n   * attestation is about to admit under the heading of people it cannot.\n   * That distinction is {@link requiresAttestation}.\n   */\n  refusal: AssignmentRefusal | null\n  /** True when only an attestation stands between this address and the list. */\n  requiresAttestation: boolean\n  /** One sentence of consent facts, in the merchant's terms. */\n  summary: string\n}\n\n/** The whole answer, per address and in totals. */\nexport interface AddressResolution {\n  verdicts: AddressVerdict[]\n  /** Addresses a stored opt-in already covers — no attestation needed. */\n  optedIn: number\n  /** Addresses that need the operator to state they have permission. */\n  needAttestation: number\n  /** Addresses nothing can enroll, whatever the operator says. */\n  refused: number\n}\n\n/**\n * The resolution plus the consent records it was computed from.\n *\n * The records ride along so the write path can derive the basis it STORES\n * from the same read the verdicts were built on. Re-reading them would be a\n * second answer to \"what does this person's record say\", between which a\n * concurrent edit fits — and the operator would have attested against the\n * first one.\n */\nexport interface ResolvedBatch extends AddressResolution {\n  stored: Map<string, MarketingConsentRecord>\n  /**\n   * Each opted-in person's own grants, as `grantEntriesAsRecorded` read them\n   * off the SAME contact document `stored` was read from — what a\n   * pass-through enrollment carries onto the membership (AGL-3320).\n   *\n   * From the same read for the reason `stored` is: the basis decided and the\n   * sites it covers must describe one version of the person's record.\n   */\n  grants: Map<string, Record<string, Record<string, unknown>>>\n  /**\n   * The consent group the resolution was made against, so the WRITE records\n   * a basis for exactly the controller the verdicts were computed for.\n   *\n   * Returned rather than re-resolved by the caller for the same reason\n   * `stored` is: two resolutions of the same question are two answers a\n   * concurrent edit can fit between, and the operator attested against the\n   * first one.\n   */\n  group: ConsentGroup\n}\n\n/**\n * Every address, normalized, deduplicated and put through the policy.\n *\n * ## Deduplicated on the NORMALIZED address, and reported once\n *\n * A pasted column routinely names the same person twice with different\n * casing, and `enrollListMember` keys the membership from the normalized\n * address, so two lines would be one row. Counting them twice would tell the\n * operator they are attesting for more people than they are.\n *\n * ## An unusable line is REPORTED, never dropped\n *\n * A paste that silently discarded its malformed lines would tell an operator\n * that 100 addresses went on the list when 94 did, and the six they never\n * hear about are the six they typed wrong. Every input line comes back with a\n * verdict, including the ones that are not addresses at all.\n *\n * ## Suppression is attributed, and costs nothing when there is none\n *\n * `filterSendableForHost` answers both lists in one pass and fails CLOSED, so\n * it is asked first; only the addresses it refused are put through the\n * platform half again to find out WHICH list holds them. In the ordinary case\n * that second call is never made.\n */\nexport async function resolveAddresses(input: {\n  hostId: string\n  inputs: readonly string[]\n}): Promise<ResolvedBatch> {\n  const seen = new Set<string>()\n  const rows: Array<{ input: string; email: string | null }> = []\n  for (const raw of input.inputs) {\n    const email = normalizeContactEmail(raw)\n    if (email && seen.has(email)) continue\n    if (email) seen.add(email)\n    rows.push({ input: String(raw ?? '').trim(), email })\n  }\n\n  const addresses = rows\n    .map((row) => row.email)\n    .filter((email): email is string => Boolean(email))\n\n  /*\n   * The group first, because every answer below is about a CONTROLLER and\n   * not about a site: a business running three sites as one sender enrolls\n   * into all three at once, and an agency's client — which declared no group\n   * — resolves to itself.\n   */\n  const group = await consentGroupForSite(input.hostId)\n  const [suppression, { stored, grants }] = await Promise.all([\n    suppressionFor(input.hostId, group, addresses),\n    storedConsentFor(input.hostId, group, addresses),\n  ])\n\n  const unrecorded: MarketingConsentRecord = readMarketingBasis(null, group)\n  const verdicts = rows.map((row): AddressVerdict => {\n    if (!row.email) {\n      return {\n        input: row.input,\n        email: null,\n        refusal: 'unroutable-address',\n        requiresAttestation: false,\n        summary: ASSIGNMENT_REFUSAL_MESSAGES['unroutable-address'],\n      }\n    }\n    const record = stored.get(row.email) ?? unrecorded\n    const readout = assignmentReadout({\n      stored: record,\n      suppression: suppression.get(row.email) ?? null,\n    })\n    return {\n      input: row.input,\n      email: row.email,\n      /*\n       * Straight off the readout, with no attestation in the question.\n       *\n       * `assignmentReadout` answers what is TRUE about this person — a stored\n       * refusal, a suppression, an opt-in, or nothing on record — and none of\n       * those changes because the operator did or did not tick a box. Feeding\n       * the flag in here would make the preview's answer depend on it, so the\n       * count the operator stands behind would move as they answered. The\n       * basis itself is decided once, at the write, by `assignmentBasis`.\n       */\n      refusal: readout.enrollable\n        ? null\n        : (suppression.get(row.email) ?? 'declined'),\n      requiresAttestation: readout.requiresAttestation,\n      summary: readout.summary,\n    }\n  })\n\n  return {\n    verdicts,\n    stored,\n    grants,\n    group,\n    optedIn: verdicts.filter(\n      (verdict) => !verdict.refusal && !verdict.requiresAttestation,\n    ).length,\n    needAttestation: verdicts.filter((verdict) => verdict.requiresAttestation)\n      .length,\n    refused: verdicts.filter(\n      (verdict) => verdict.refusal && !verdict.requiresAttestation,\n    ).length,\n  }\n}\n\n/**\n * Which of these addresses is suppressed, and by which list.\n *\n * Composed from the shipped helpers rather than reading the two collections\n * here: normalization, de-duplication and the fail-closed posture live in\n * `email-suppression.ts`, and a second copy of them is a second set of rules\n * for the enrollment check and the send-time check to disagree about — which\n * is exactly the disagreement `an-enrollment-is-not-a-license-to-send.spec.ts`\n * exists to stop.\n *\n * Read across the site's consent group, as the send reads it: somebody who\n * unsubscribed from a sibling of a declared group is refused here too, rather\n * than enrolled onto a list whose campaigns will never reach them.\n */\nasync function suppressionFor(\n  hostId: string,\n  group: ConsentGroup,\n  addresses: readonly string[],\n): Promise<Map<string, AddressRefusal>> {\n  const refusals = new Map<string, AddressRefusal>()\n  if (!addresses.length) return refusals\n  const sendable = new Set(\n    await filterSendableForHost(hostId, addresses, undefined, group),\n  )\n  const blocked = addresses.filter((email) => !sendable.has(email))\n  if (!blocked.length) return refusals\n  // Only the blocked ones, and only to say WHICH list. Survivors of the\n  // platform half are held by this site's own list, or a group sibling's.\n  const platformSendable = new Set(await filterSuppressedEmails(blocked))\n  for (const email of blocked) {\n    refusals.set(\n      email,\n      platformSendable.has(email) ? 'suppressed-host' : 'suppressed-platform',\n    )\n  }\n  return refusals\n}\n\n/**\n * The stored consent facts for these addresses, off the org's contacts.\n *\n * Read UNSCOPED, deliberately, exactly as the Inbox route reads it:\n * `scopedToHost` narrows an org collection to what one site may see, and a\n * refusal filtered out by that narrowing is a refusal this route would then\n * step over — the failure mode is enrolling somebody who said no. It is safe\n * because the caller has already been proved an org-wide member, which is the\n * tier the rules grant the whole org's contacts to.\n *\n * ## A refusal wins over an opt-in when the CRM holds both\n *\n * Nothing guarantees one contact per address — the collection is keyed by\n * resource id, not by email — so two records for one person can disagree.\n * Taking whichever the query happened to answer first would make the outcome\n * depend on document order. A recorded refusal is the answer whenever one\n * exists, which is the same precedence `assignmentBasis` applies within a\n * single record.\n *\n * ## A refusal outlives the contact it was written on (AGL-3338)\n *\n * Deleting a contact keeps every refusal it held in the org's retained store,\n * so the address is read with what was retained laid over whatever record is\n * left — `withRetainedRefusals` — and an address with no contact at all still\n * reads `declined` when its person said no. A grant given after the refusal,\n * on a contact the person signed up again through, is the person changing\n * their mind and reads `granted`. The grants carried onto a membership come\n * off the same merged record.\n *\n * A failed read falls to `declined` for the whole batch, for the reason the\n * Inbox route states: a read that throws can neither say the person consented\n * nor that they refused, and the direction that costs a retry is the one that\n * does not enroll somebody whose stored refusal we simply failed to see. The\n * retained store is read the same way, and fails the same way.\n */\nasync function storedConsentFor(\n  hostId: string,\n  group: ConsentGroup,\n  addresses: readonly string[],\n): Promise<{\n  stored: Map<string, MarketingConsentRecord>\n  grants: Map<string, Record<string, Record<string, unknown>>>\n}> {\n  const found = new Map<string, MarketingConsentRecord>()\n  const grants = new Map<string, Record<string, Record<string, unknown>>>()\n  if (!addresses.length) return { stored: found, grants }\n  try {\n    const contacts = await orgDataCollectionForHost(hostId, 'contacts')\n    const chunks: string[][] = []\n    for (let at = 0; at < addresses.length; at += CONTACT_LOOKUP_CHUNK) {\n      chunks.push(addresses.slice(at, at + CONTACT_LOOKUP_CHUNK))\n    }\n    const [snapshots, retained] = await Promise.all([\n      Promise.all(chunks.map((chunk) => contacts.where('email', 'in', chunk).get())),\n      readRetainedRefusals(contacts, addresses),\n    ])\n    const consider = (email: string, data: Record<string, unknown> | null) => {\n      const merged = withRetainedRefusals(data, refusalsOf(retained.get(email)))\n      const record = readMarketingBasis(merged, group)\n      const already = found.get(email)\n      if (already?.basis === 'declined') return\n      if (already && record.basis !== 'declined') return\n      found.set(email, record)\n      grants.set(email, grantEntriesAsRecorded(merged, group))\n    }\n    for (const snapshot of snapshots) {\n      for (const doc of snapshot.docs) {\n        const email = normalizeContactEmail(doc.get('email'))\n        if (email) consider(email, doc.data() as Record<string, unknown>)\n      }\n    }\n    // What was retained for an address no contact answers any more.\n    for (const email of retained.keys()) {\n      if (!found.has(email)) consider(email, null)\n    }\n    return { stored: found, grants }\n  } catch (error) {\n    console.error('[email] consent lookup failed', error)\n    const refused: MarketingConsentRecord = {\n      ...readMarketingBasis(null, group),\n      basis: 'declined',\n      // Attributed to nobody: this is what a failed read falls back to, not a\n      // refusal anybody recorded.\n      assertedBy: null,\n      source: null,\n      basisAtMs: null,\n      capturedAtMs: null,\n    }\n    return {\n      stored: new Map(addresses.map((email) => [email, refused])),\n      // Nobody is enrollable on a failed read, so nobody's grants travel.\n      grants: new Map(),\n    }\n  }\n}\n\n/** The addresses named by one request, or the refusal to send back. */\nexport function readAddresses(\n  req: Parameters<PluginApiHandler>[0],\n): { emails: string[] } | { error: string } {\n  const body = req.body as { emails?: unknown; email?: unknown } | undefined\n  const raw = Array.isArray(body?.emails)\n    ? body.emails\n    : body?.email === undefined\n      ? []\n      : [body.email]\n  const emails = raw\n    .map((value) => String(value ?? '').trim())\n    .filter((value) => value.length > 0)\n  if (!emails.length) return { error: 'No addresses' }\n  if (emails.length > LIST_MEMBER_BATCH_MAX) {\n    return {\n      error:\n        `${emails.length} addresses is more than one go can take. Add up to ` +\n        `${LIST_MEMBER_BATCH_MAX} at a time.`,\n    }\n  }\n  return { emails }\n}\n"],"names":["ASSIGNMENT_REFUSAL_MESSAGES","assignmentReadout","grantEntriesAsRecorded","isOrgWideMember","normalizeContactEmail","readMarketingBasis","consentGroupForSite","filterSendableForHost","filterSuppressedEmails","firebaseAdmin","getOrgForHost","orgDataCollectionForHost","resolveOrgMembership","readRetainedRefusals","refusalsOf","withRetainedRefusals","LIST_MEMBER_BATCH_MAX","CONTACT_LOOKUP_CHUNK","resolveListContext","req","hostSnapshot","listSnapshot","hostId","String","body","listId","ok","status","error","authorization","headers","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","firestore","collection","doc","get","exists","memberRole","uid","orgId","catch","membership","isOrgWideListWriter","member","listRef","listName","entry","role","orgSuspended","resolveAddresses","input","seen","Set","rows","raw","inputs","email","has","add","push","trim","addresses","map","row","filter","Boolean","group","suppression","stored","grants","Promise","all","suppressionFor","storedConsentFor","unrecorded","verdicts","refusal","requiresAttestation","summary","record","readout","enrollable","optedIn","verdict","needAttestation","refused","refusals","Map","sendable","blocked","platformSendable","set","found","contacts","chunks","at","snapshots","retained","chunk","where","consider","data","merged","already","basis","snapshot","docs","keys","console","assertedBy","source","basisAtMs","capturedAtMs","readAddresses","Array","isArray","emails","value"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,SACEA,2BAA2B,EAC3BC,iBAAiB,EACjBC,sBAAsB,EACtBC,eAAe,EACfC,qBAAqB,EACrBC,kBAAkB,QAMb,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,qBAAqB,EACrBC,sBAAsB,EACtBC,aAAa,EACbC,aAAa,EACbC,wBAAwB,EACxBC,oBAAoB,QACf,2BAA0B;AACjC,2EAA2E;AAC3E,0EAA0E;AAC1E,mDAAmD;AACnD,SAASC,oBAAoB,QAAQ,oDAAmD;AACxF,SAASC,UAAU,EAAEC,oBAAoB,QAAQ,2CAA0C;AAE3F;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,wBAAwB,IAAG;AAExC,yDAAyD,GACzD,MAAMC,uBAAuB;AAc7B;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeC,mBACpBC,GAAoC;qBAYPA,4BAcTC,0BAqDDC;QA7EGF,WACAA,YAiCnB;IAlCH,MAAMG,SAASC,gBAAOJ,YAAAA,IAAIK,IAAI,qBAARL,UAAUG,MAAM,mBAAI;IAC1C,MAAMG,SAASF,iBAAOJ,aAAAA,IAAIK,IAAI,qBAARL,WAAUM,MAAM,oBAAI;IAC1C,IAAI,CAACH,UAAU,CAACG,QAAQ;QACtB,OAAO;YACLC,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAA2B;QAC5C;IACF;IAEA,MAAMC,gBAAgBN,QAAOJ,6BAAAA,IAAIW,OAAO,CAACD,aAAa,YAAzBV,6BAA6B;IAC1D,MAAMY,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZ,OAAO;YAAEL,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAkB;QAAE;IACtE;IAEA,MAAMQ,UAAU,MAAM3B,cAAc4B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;IAC/D,MAAMS,YAAY/B,cAAc4B,GAAG,GAAGG,SAAS;IAC/C,MAAMpB,eAAe,MAAMoB,UAAUC,UAAU,CAAC,SAASC,GAAG,CAACpB,QAAQqB,GAAG;IACxE,IAAI,CAACvB,aAAawB,MAAM,EAAE;QACxB,OAAO;YAAElB,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAe;QAAE;IACnE;IACA,MAAMiB,aAAa,EAACzB,oBAAAA,aAAauB,GAAG,CAAC,0BAAjBvB,oBAAmC,CAAC,EAAE,CAACgB,QAAQU,GAAG,CAAC;IACvE,IAAID,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YACLnB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAA6B;QAC9C;IACF;IAEA,MAAMmB,QAAQxB,iBACX,QAAA,MAAMb,cAAcY,QAAQ0B,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDD,KAAK,oBAAI;IAE5D,IAAI,CAACA,OAAO;QACV,OAAO;YACLrB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAAqD;QACtE;IACF;IACA,MAAMqB,aAAa,MAAMrC,qBAAqBwB,QAAQU,GAAG,EAAEC,OAAOC,KAAK,CACrE,IAAM;IAER,IAAI,CAACE,oBAAoBD,8BAAAA,WAAYE,MAAM,GAAG;QAC5C,OAAO;YACLzB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBACJI,OACE,uEACA,oEACA;YACJ;QACF;IACF;IAEA,MAAMwB,UAAUZ,UACbC,UAAU,CAAC,QACXC,GAAG,CAACK,OACJN,UAAU,CAAC,SACXC,GAAG,CAACjB;IACP,MAAMJ,eAAe,MAAM+B,QAAQT,GAAG;IACtC,qEAAqE;IACrE,iDAAiD;IACjD,IAAI,CAACtB,aAAauB,MAAM,EAAE;QACxB,OAAO;YAAElB,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAe;QAAE;IACnE;IAEA,OAAO;QACLF,IAAI;QACJoB,KAAKV,QAAQU,GAAG;QAChBxB;QACAyB;QACAK;QACAC,UAAU9B,QAAOF,oBAAAA,aAAasB,GAAG,CAAC,mBAAjBtB,oBAA4BI;IAC/C;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASyB,oBAAoBC,MAAe;IACjD,MAAMG,QAAQH;IAId,OACEhD,gBAAgBmD,UACfA,CAAAA,CAAAA,yBAAAA,MAAOC,IAAI,MAAK,WACfD,CAAAA,yBAAAA,MAAOC,IAAI,MAAK,WAChBD,CAAAA,yBAAAA,MAAOC,IAAI,MAAK,QAAO,KACzBD,CAAAA,yBAAAA,MAAOE,YAAY,MAAK;AAE5B;AAoEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,iBAAiBC,KAGtC;IACC,MAAMC,OAAO,IAAIC;IACjB,MAAMC,OAAuD,EAAE;IAC/D,KAAK,MAAMC,OAAOJ,MAAMK,MAAM,CAAE;QAC9B,MAAMC,QAAQ5D,sBAAsB0D;QACpC,IAAIE,SAASL,KAAKM,GAAG,CAACD,QAAQ;QAC9B,IAAIA,OAAOL,KAAKO,GAAG,CAACF;QACpBH,KAAKM,IAAI,CAAC;YAAET,OAAOnC,OAAOuC,cAAAA,MAAO,IAAIM,IAAI;YAAIJ;QAAM;IACrD;IAEA,MAAMK,YAAYR,KACfS,GAAG,CAAC,CAACC,MAAQA,IAAIP,KAAK,EACtBQ,MAAM,CAAC,CAACR,QAA2BS,QAAQT;IAE9C;;;;;GAKC,GACD,MAAMU,QAAQ,MAAMpE,oBAAoBoD,MAAMpC,MAAM;IACpD,MAAM,CAACqD,aAAa,EAAEC,MAAM,EAAEC,MAAM,EAAE,CAAC,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC1DC,eAAetB,MAAMpC,MAAM,EAAEoD,OAAOL;QACpCY,iBAAiBvB,MAAMpC,MAAM,EAAEoD,OAAOL;KACvC;IAED,MAAMa,aAAqC7E,mBAAmB,MAAMqE;IACpE,MAAMS,WAAWtB,KAAKS,GAAG,CAAC,CAACC;YAUVK,aAGAD,kBAiBRA;QA7BP,IAAI,CAACJ,IAAIP,KAAK,EAAE;YACd,OAAO;gBACLN,OAAOa,IAAIb,KAAK;gBAChBM,OAAO;gBACPoB,SAAS;gBACTC,qBAAqB;gBACrBC,SAAStF,2BAA2B,CAAC,qBAAqB;YAC5D;QACF;QACA,MAAMuF,UAASX,cAAAA,OAAOjC,GAAG,CAAC4B,IAAIP,KAAK,aAApBY,cAAyBM;QACxC,MAAMM,UAAUvF,kBAAkB;YAChC2E,QAAQW;YACRZ,WAAW,GAAEA,mBAAAA,YAAYhC,GAAG,CAAC4B,IAAIP,KAAK,aAAzBW,mBAA8B;QAC7C;QACA,OAAO;YACLjB,OAAOa,IAAIb,KAAK;YAChBM,OAAOO,IAAIP,KAAK;YAChB;;;;;;;;;OASC,GACDoB,SAASI,QAAQC,UAAU,GACvB,QACCd,oBAAAA,YAAYhC,GAAG,CAAC4B,IAAIP,KAAK,aAAzBW,oBAA8B;YACnCU,qBAAqBG,QAAQH,mBAAmB;YAChDC,SAASE,QAAQF,OAAO;QAC1B;IACF;IAEA,OAAO;QACLH;QACAP;QACAC;QACAH;QACAgB,SAASP,SAASX,MAAM,CACtB,CAACmB,UAAY,CAACA,QAAQP,OAAO,IAAI,CAACO,QAAQN,mBAAmB,EAC7DnD,MAAM;QACR0D,iBAAiBT,SAASX,MAAM,CAAC,CAACmB,UAAYA,QAAQN,mBAAmB,EACtEnD,MAAM;QACT2D,SAASV,SAASX,MAAM,CACtB,CAACmB,UAAYA,QAAQP,OAAO,IAAI,CAACO,QAAQN,mBAAmB,EAC5DnD,MAAM;IACV;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,eAAe8C,eACb1D,MAAc,EACdoD,KAAmB,EACnBL,SAA4B;IAE5B,MAAMyB,WAAW,IAAIC;IACrB,IAAI,CAAC1B,UAAUnC,MAAM,EAAE,OAAO4D;IAC9B,MAAME,WAAW,IAAIpC,IACnB,MAAMrD,sBAAsBe,QAAQ+C,WAAWlC,WAAWuC;IAE5D,MAAMuB,UAAU5B,UAAUG,MAAM,CAAC,CAACR,QAAU,CAACgC,SAAS/B,GAAG,CAACD;IAC1D,IAAI,CAACiC,QAAQ/D,MAAM,EAAE,OAAO4D;IAC5B,sEAAsE;IACtE,wEAAwE;IACxE,MAAMI,mBAAmB,IAAItC,IAAI,MAAMpD,uBAAuByF;IAC9D,KAAK,MAAMjC,SAASiC,QAAS;QAC3BH,SAASK,GAAG,CACVnC,OACAkC,iBAAiBjC,GAAG,CAACD,SAAS,oBAAoB;IAEtD;IACA,OAAO8B;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,eAAeb,iBACb3D,MAAc,EACdoD,KAAmB,EACnBL,SAA4B;IAK5B,MAAM+B,QAAQ,IAAIL;IAClB,MAAMlB,SAAS,IAAIkB;IACnB,IAAI,CAAC1B,UAAUnC,MAAM,EAAE,OAAO;QAAE0C,QAAQwB;QAAOvB;IAAO;IACtD,IAAI;QACF,MAAMwB,WAAW,MAAM1F,yBAAyBW,QAAQ;QACxD,MAAMgF,SAAqB,EAAE;QAC7B,IAAK,IAAIC,KAAK,GAAGA,KAAKlC,UAAUnC,MAAM,EAAEqE,MAAMtF,qBAAsB;YAClEqF,OAAOnC,IAAI,CAACE,UAAUpC,KAAK,CAACsE,IAAIA,KAAKtF;QACvC;QACA,MAAM,CAACuF,WAAWC,SAAS,GAAG,MAAM3B,QAAQC,GAAG,CAAC;YAC9CD,QAAQC,GAAG,CAACuB,OAAOhC,GAAG,CAAC,CAACoC,QAAUL,SAASM,KAAK,CAAC,SAAS,MAAMD,OAAO/D,GAAG;YAC1E9B,qBAAqBwF,UAAUhC;SAChC;QACD,MAAMuC,WAAW,CAAC5C,OAAe6C;YAC/B,MAAMC,SAAS/F,qBAAqB8F,MAAM/F,WAAW2F,SAAS9D,GAAG,CAACqB;YAClE,MAAMuB,SAASlF,mBAAmByG,QAAQpC;YAC1C,MAAMqC,UAAUX,MAAMzD,GAAG,CAACqB;YAC1B,IAAI+C,CAAAA,2BAAAA,QAASC,KAAK,MAAK,YAAY;YACnC,IAAID,WAAWxB,OAAOyB,KAAK,KAAK,YAAY;YAC5CZ,MAAMD,GAAG,CAACnC,OAAOuB;YACjBV,OAAOsB,GAAG,CAACnC,OAAO9D,uBAAuB4G,QAAQpC;QACnD;QACA,KAAK,MAAMuC,YAAYT,UAAW;YAChC,KAAK,MAAM9D,OAAOuE,SAASC,IAAI,CAAE;gBAC/B,MAAMlD,QAAQ5D,sBAAsBsC,IAAIC,GAAG,CAAC;gBAC5C,IAAIqB,OAAO4C,SAAS5C,OAAOtB,IAAImE,IAAI;YACrC;QACF;QACA,gEAAgE;QAChE,KAAK,MAAM7C,SAASyC,SAASU,IAAI,GAAI;YACnC,IAAI,CAACf,MAAMnC,GAAG,CAACD,QAAQ4C,SAAS5C,OAAO;QACzC;QACA,OAAO;YAAEY,QAAQwB;YAAOvB;QAAO;IACjC,EAAE,OAAOjD,OAAO;QACdwF,QAAQxF,KAAK,CAAC,iCAAiCA;QAC/C,MAAMiE,UAAkC,aACnCxF,mBAAmB,MAAMqE;YAC5BsC,OAAO;YACP,wEAAwE;YACxE,4BAA4B;YAC5BK,YAAY;YACZC,QAAQ;YACRC,WAAW;YACXC,cAAc;;QAEhB,OAAO;YACL5C,QAAQ,IAAImB,IAAI1B,UAAUC,GAAG,CAAC,CAACN,QAAU;oBAACA;oBAAO6B;iBAAQ;YACzD,oEAAoE;YACpEhB,QAAQ,IAAIkB;QACd;IACF;AACF;AAEA,qEAAqE,GACrE,OAAO,SAAS0B,cACdtG,GAAoC;IAEpC,MAAMK,OAAOL,IAAIK,IAAI;IACrB,MAAMsC,MAAM4D,MAAMC,OAAO,CAACnG,wBAAAA,KAAMoG,MAAM,IAClCpG,KAAKoG,MAAM,GACXpG,CAAAA,wBAAAA,KAAMwC,KAAK,MAAK7B,YACd,EAAE,GACF;QAACX,KAAKwC,KAAK;KAAC;IAClB,MAAM4D,SAAS9D,IACZQ,GAAG,CAAC,CAACuD,QAAUtG,OAAOsG,gBAAAA,QAAS,IAAIzD,IAAI,IACvCI,MAAM,CAAC,CAACqD,QAAUA,MAAM3F,MAAM,GAAG;IACpC,IAAI,CAAC0F,OAAO1F,MAAM,EAAE,OAAO;QAAEN,OAAO;IAAe;IACnD,IAAIgG,OAAO1F,MAAM,GAAGlB,uBAAuB;QACzC,OAAO;YACLY,OACE,GAAGgG,OAAO1F,MAAM,CAAC,mDAAmD,CAAC,GACrE,GAAGlB,sBAAsB,WAAW,CAAC;QACzC;IACF;IACA,OAAO;QAAE4G;IAAO;AAClB"}
+{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-list-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE GATE IN FRONT OF EVERY LIST ENROLLMENT THE CONSOLE MAKES.\n *\n * Who is allowed to change a list's membership, and what is true about each\n * address they name. Three route modules ask it — the audience card's add and\n * preview, the filter search, and the file importer — and they ask this one\n * copy of it.\n *\n * ## Why it is a module of its own\n *\n * It began inside `server-console.ts`, beside its first two callers, and that\n * was right while there were two. The importer made three, and an importer is\n * exactly the surface where a second, laxer idea of \"may this person be\n * enrolled\" is most tempting: a file is bulk, bulk is slow, and skipping the\n * per-address consent read is the obvious saving. A bulk path that reached the\n * membership without the suppression check and the attestation would be a way\n * to enroll precisely the people the one-at-a-time path refuses, which is the\n * defect class `docs/specs/email-competitive-gaps.md` has a closed P1 entry\n * for.\n *\n * Sharing the gate is also what stops the cheaper failure: two modules that\n * merely agree today, with nothing in either one saying the other exists.\n *\n * ## What it decides, and what it deliberately does not\n *\n * {@link resolveAddresses} answers the questions that are FACTS about a\n * person — a stored refusal, a suppression on either list, an opt-in already\n * on record, a line that is not an address. It never consults an attestation,\n * because an attestation is a fact about the operator and folding it in here\n * would make the preview's numbers move as the box was ticked. The basis is\n * decided once, at the write, by `assignmentBasis`.\n */\n\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentReadout,\n  isOrgWideMember,\n  normalizeContactEmail,\n  readMarketingBasis,\n  type AddressRefusal,\n  type AssignmentRefusal,\n  type ConsentGroup,\n  type MarketingConsentRecord,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  filterSendableForHost,\n  filterSuppressedEmails,\n  firebaseAdmin,\n  getOrgForHost,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\n// The leaf, not the barrel: this plugin's specs substitute both barrels\n// wholesale, and what a deleted contact's refusal still says must be read\n// under them by the real store and the real merge.\nimport { readContactConsent } from '@aglyn/tenant-data-admin/server/consent-by-address'\n\n/**\n * The most addresses one request may name.\n *\n * A ceiling on the WRITE, not on the audience. It bounds the work one request\n * does — the resolution below is a handful of reads per address — and it can\n * never refuse a person already enrolled or make room by removing one, which\n * is the difference between a batch size and a capacity limit. Nothing in the\n * product caps list membership: `contactsPerHost` is the audience band and it\n * is metered against CONTACTS, in `upsert-contact.ts`, and enrolling somebody\n * on a list writes no contact. If a membership ceiling is ever introduced,\n * this function is where it refuses, because this is where something is\n * added.\n */\nexport const LIST_MEMBER_BATCH_MAX = 100\n\n/** Everything a list-membership route needs, or the refusal to send back. */\nexport type ListContext =\n  | {\n      ok: true\n      uid: string\n      hostId: string\n      orgId: string\n      listRef: FirebaseFirestore.DocumentReference\n      listName: string\n    }\n  | { ok: false; status: number; body: Record<string, unknown> }\n\n/**\n * Who is asking, and about which list.\n *\n * ## Two gates, not one — the same two the Inbox assignment route applies\n *\n * A host role is necessary and NOT sufficient. Lists live at\n * `orgs/{orgId}/lists` and their members are contacts, so the rules put both\n * behind `isOrgWideMember()`. An editor invited to ONE site is an org member\n * with `allHosts: false`, and gating an org-wide write on the host role alone\n * would let a single-site collaborator enroll people into an audience every\n * other site in the org can mail — and, through the preview, read the consent\n * record of any address they care to type. The Admin SDK evaluates no rules,\n * so this route is the enforcement rather than an echo of it.\n *\n * The plugin's own gates sit above this and are the dispatcher's: a workspace\n * that has switched the email plugin off, or a site it is disabled for, or a\n * release flag that has not reached this org, all 404 before a handler runs.\n */\nexport async function resolveListContext(\n  req: Parameters<PluginApiHandler>[0],\n): Promise<ListContext> {\n  const hostId = String(req.body?.hostId ?? '')\n  const listId = String(req.body?.listId ?? '')\n  if (!hostId || !listId) {\n    return {\n      ok: false,\n      status: 400,\n      body: { error: 'Missing hostId or listId' },\n    }\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    return { ok: false, status: 401, body: { error: 'Unauthenticated' } }\n  }\n\n  const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  const firestore = firebaseAdmin.app().firestore()\n  const hostSnapshot = await firestore.collection('hosts').doc(hostId).get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, body: { error: 'Unknown site' } }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return {\n      ok: false,\n      status: 403,\n      body: { error: 'Not a site admin or editor' },\n    }\n  }\n\n  const orgId = String(\n    (await getOrgForHost(hostId).catch(() => null))?.orgId ?? '',\n  )\n  if (!orgId) {\n    return {\n      ok: false,\n      status: 404,\n      body: { error: 'This site has no organization, so it has no lists.' },\n    }\n  }\n  const membership = await resolveOrgMembership(decoded.uid, orgId).catch(\n    () => null,\n  )\n  if (!isOrgWideListWriter(membership?.member)) {\n    return {\n      ok: false,\n      status: 403,\n      body: {\n        error:\n          'Marketing lists belong to the whole organization, so changing who ' +\n          'is on one needs organization-wide access rather than access to ' +\n          'this site.',\n      },\n    }\n  }\n\n  const listRef = firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection('lists')\n    .doc(listId)\n  const listSnapshot = await listRef.get()\n  // A stale or mistyped id must not CREATE a list: a campaign's `list`\n  // audience would then read a list nobody set up.\n  if (!listSnapshot.exists) {\n    return { ok: false, status: 404, body: { error: 'Unknown list' } }\n  }\n\n  return {\n    ok: true,\n    uid: decoded.uid,\n    hostId,\n    orgId,\n    listRef,\n    listName: String(listSnapshot.get('name') ?? listId),\n  }\n}\n\n/**\n * Whether an org member may change who is on the organization's lists: an\n * org-wide owner, admin or editor whose membership is not suspended. The one\n * answer the list routes and the list-member import ask (see\n * {@link resolveListContext} for why a site role is not enough).\n */\nexport function isOrgWideListWriter(member: unknown): boolean {\n  const entry = member as\n    | { role?: string; orgSuspended?: boolean }\n    | null\n    | undefined\n  return (\n    isOrgWideMember(entry as Parameters<typeof isOrgWideMember>[0]) &&\n    (entry?.role === 'owner' ||\n      entry?.role === 'admin' ||\n      entry?.role === 'editor') &&\n    entry?.orgSuspended !== true\n  )\n}\n\n/** What would happen to one address, and why. */\nexport interface AddressVerdict {\n  /** Exactly what the operator typed, so a bad line can be pointed at. */\n  input: string\n  /** The normalized address, or `null` when there is not one. */\n  email: string | null\n  /**\n   * Why this address can never go on the list, or `null`.\n   *\n   * A HARD refusal only — a stored `declined`, either suppression list, or a\n   * line that is not an address. `no-basis` is deliberately NOT one of them:\n   * \"you have not said you have permission yet\" is an unanswered question,\n   * not a refusal, and reporting it as one would list the very people an\n   * attestation is about to admit under the heading of people it cannot.\n   * That distinction is {@link requiresAttestation}.\n   */\n  refusal: AssignmentRefusal | null\n  /** True when only an attestation stands between this address and the list. */\n  requiresAttestation: boolean\n  /** One sentence of consent facts, in the merchant's terms. */\n  summary: string\n}\n\n/** The whole answer, per address and in totals. */\nexport interface AddressResolution {\n  verdicts: AddressVerdict[]\n  /** Addresses a stored opt-in already covers — no attestation needed. */\n  optedIn: number\n  /** Addresses that need the operator to state they have permission. */\n  needAttestation: number\n  /** Addresses nothing can enroll, whatever the operator says. */\n  refused: number\n}\n\n/**\n * The resolution plus the consent records it was computed from.\n *\n * The records ride along so the write path can derive the basis it STORES\n * from the same read the verdicts were built on. Re-reading them would be a\n * second answer to \"what does this person's record say\", between which a\n * concurrent edit fits — and the operator would have attested against the\n * first one.\n */\nexport interface ResolvedBatch extends AddressResolution {\n  stored: Map<string, MarketingConsentRecord>\n  /**\n   * Each opted-in person's own grants, as `grantEntriesAsRecorded` read them\n   * off the SAME contact document `stored` was read from — what a\n   * pass-through enrollment carries onto the membership (AGL-3320).\n   *\n   * From the same read for the reason `stored` is: the basis decided and the\n   * sites it covers must describe one version of the person's record.\n   */\n  grants: Map<string, Record<string, Record<string, unknown>>>\n  /**\n   * The consent group the resolution was made against, so the WRITE records\n   * a basis for exactly the controller the verdicts were computed for.\n   *\n   * Returned rather than re-resolved by the caller for the same reason\n   * `stored` is: two resolutions of the same question are two answers a\n   * concurrent edit can fit between, and the operator attested against the\n   * first one.\n   */\n  group: ConsentGroup\n}\n\n/**\n * Every address, normalized, deduplicated and put through the policy.\n *\n * ## Deduplicated on the NORMALIZED address, and reported once\n *\n * A pasted column routinely names the same person twice with different\n * casing, and `enrollListMember` keys the membership from the normalized\n * address, so two lines would be one row. Counting them twice would tell the\n * operator they are attesting for more people than they are.\n *\n * ## An unusable line is REPORTED, never dropped\n *\n * A paste that silently discarded its malformed lines would tell an operator\n * that 100 addresses went on the list when 94 did, and the six they never\n * hear about are the six they typed wrong. Every input line comes back with a\n * verdict, including the ones that are not addresses at all.\n *\n * ## Suppression is attributed, and costs nothing when there is none\n *\n * `filterSendableForHost` answers both lists in one pass and fails CLOSED, so\n * it is asked first; only the addresses it refused are put through the\n * platform half again to find out WHICH list holds them. In the ordinary case\n * that second call is never made.\n */\nexport async function resolveAddresses(input: {\n  hostId: string\n  inputs: readonly string[]\n}): Promise<ResolvedBatch> {\n  const seen = new Set<string>()\n  const rows: Array<{ input: string; email: string | null }> = []\n  for (const raw of input.inputs) {\n    const email = normalizeContactEmail(raw)\n    if (email && seen.has(email)) continue\n    if (email) seen.add(email)\n    rows.push({ input: String(raw ?? '').trim(), email })\n  }\n\n  const addresses = rows\n    .map((row) => row.email)\n    .filter((email): email is string => Boolean(email))\n\n  /*\n   * The group first, because every answer below is about a CONTROLLER and\n   * not about a site: a business running three sites as one sender enrolls\n   * into all three at once, and an agency's client — which declared no group\n   * — resolves to itself.\n   */\n  const group = await consentGroupForSite(input.hostId)\n  const [suppression, { stored, grants }] = await Promise.all([\n    suppressionFor(input.hostId, group, addresses),\n    readContactConsent(\n      orgDataCollectionForHost(input.hostId, 'contacts'),\n      group,\n      addresses,\n    ),\n  ])\n\n  const unrecorded: MarketingConsentRecord = readMarketingBasis(null, group)\n  const verdicts = rows.map((row): AddressVerdict => {\n    if (!row.email) {\n      return {\n        input: row.input,\n        email: null,\n        refusal: 'unroutable-address',\n        requiresAttestation: false,\n        summary: ASSIGNMENT_REFUSAL_MESSAGES['unroutable-address'],\n      }\n    }\n    const record = stored.get(row.email) ?? unrecorded\n    const readout = assignmentReadout({\n      stored: record,\n      suppression: suppression.get(row.email) ?? null,\n    })\n    return {\n      input: row.input,\n      email: row.email,\n      /*\n       * Straight off the readout, with no attestation in the question.\n       *\n       * `assignmentReadout` answers what is TRUE about this person — a stored\n       * refusal, a suppression, an opt-in, or nothing on record — and none of\n       * those changes because the operator did or did not tick a box. Feeding\n       * the flag in here would make the preview's answer depend on it, so the\n       * count the operator stands behind would move as they answered. The\n       * basis itself is decided once, at the write, by `assignmentBasis`.\n       */\n      refusal: readout.enrollable\n        ? null\n        : (suppression.get(row.email) ?? 'declined'),\n      requiresAttestation: readout.requiresAttestation,\n      summary: readout.summary,\n    }\n  })\n\n  return {\n    verdicts,\n    stored,\n    grants,\n    group,\n    optedIn: verdicts.filter(\n      (verdict) => !verdict.refusal && !verdict.requiresAttestation,\n    ).length,\n    needAttestation: verdicts.filter((verdict) => verdict.requiresAttestation)\n      .length,\n    refused: verdicts.filter(\n      (verdict) => verdict.refusal && !verdict.requiresAttestation,\n    ).length,\n  }\n}\n\n/**\n * Which of these addresses is suppressed, and by which list.\n *\n * Composed from the shipped helpers rather than reading the two collections\n * here: normalization, de-duplication and the fail-closed posture live in\n * `email-suppression.ts`, and a second copy of them is a second set of rules\n * for the enrollment check and the send-time check to disagree about — which\n * is exactly the disagreement `an-enrollment-is-not-a-license-to-send.spec.ts`\n * exists to stop.\n *\n * Read across the site's consent group, as the send reads it: somebody who\n * unsubscribed from a sibling of a declared group is refused here too, rather\n * than enrolled onto a list whose campaigns will never reach them.\n */\nasync function suppressionFor(\n  hostId: string,\n  group: ConsentGroup,\n  addresses: readonly string[],\n): Promise<Map<string, AddressRefusal>> {\n  const refusals = new Map<string, AddressRefusal>()\n  if (!addresses.length) return refusals\n  const sendable = new Set(\n    await filterSendableForHost(hostId, addresses, undefined, group),\n  )\n  const blocked = addresses.filter((email) => !sendable.has(email))\n  if (!blocked.length) return refusals\n  // Only the blocked ones, and only to say WHICH list. Survivors of the\n  // platform half are held by this site's own list, or a group sibling's.\n  const platformSendable = new Set(await filterSuppressedEmails(blocked))\n  for (const email of blocked) {\n    refusals.set(\n      email,\n      platformSendable.has(email) ? 'suppressed-host' : 'suppressed-platform',\n    )\n  }\n  return refusals\n}\n\n/** The addresses named by one request, or the refusal to send back. */\nexport function readAddresses(\n  req: Parameters<PluginApiHandler>[0],\n): { emails: string[] } | { error: string } {\n  const body = req.body as { emails?: unknown; email?: unknown } | undefined\n  const raw = Array.isArray(body?.emails)\n    ? body.emails\n    : body?.email === undefined\n      ? []\n      : [body.email]\n  const emails = raw\n    .map((value) => String(value ?? '').trim())\n    .filter((value) => value.length > 0)\n  if (!emails.length) return { error: 'No addresses' }\n  if (emails.length > LIST_MEMBER_BATCH_MAX) {\n    return {\n      error:\n        `${emails.length} addresses is more than one go can take. Add up to ` +\n        `${LIST_MEMBER_BATCH_MAX} at a time.`,\n    }\n  }\n  return { emails }\n}\n"],"names":["ASSIGNMENT_REFUSAL_MESSAGES","assignmentReadout","isOrgWideMember","normalizeContactEmail","readMarketingBasis","consentGroupForSite","filterSendableForHost","filterSuppressedEmails","firebaseAdmin","getOrgForHost","orgDataCollectionForHost","resolveOrgMembership","readContactConsent","LIST_MEMBER_BATCH_MAX","resolveListContext","req","hostSnapshot","listSnapshot","hostId","String","body","listId","ok","status","error","authorization","headers","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","firestore","collection","doc","get","exists","memberRole","uid","orgId","catch","membership","isOrgWideListWriter","member","listRef","listName","entry","role","orgSuspended","resolveAddresses","input","seen","Set","rows","raw","inputs","email","has","add","push","trim","addresses","map","row","filter","Boolean","group","suppression","stored","grants","Promise","all","suppressionFor","unrecorded","verdicts","refusal","requiresAttestation","summary","record","readout","enrollable","optedIn","verdict","needAttestation","refused","refusals","Map","sendable","blocked","platformSendable","set","readAddresses","Array","isArray","emails","value"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,SACEA,2BAA2B,EAC3BC,iBAAiB,EACjBC,eAAe,EACfC,qBAAqB,EACrBC,kBAAkB,QAMb,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,qBAAqB,EACrBC,sBAAsB,EACtBC,aAAa,EACbC,aAAa,EACbC,wBAAwB,EACxBC,oBAAoB,QACf,2BAA0B;AACjC,wEAAwE;AACxE,0EAA0E;AAC1E,mDAAmD;AACnD,SAASC,kBAAkB,QAAQ,qDAAoD;AAEvF;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,wBAAwB,IAAG;AAcxC;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeC,mBACpBC,GAAoC;qBAYPA,4BAcTC,0BAqDDC;QA7EGF,WACAA,YAiCnB;IAlCH,MAAMG,SAASC,gBAAOJ,YAAAA,IAAIK,IAAI,qBAARL,UAAUG,MAAM,mBAAI;IAC1C,MAAMG,SAASF,iBAAOJ,aAAAA,IAAIK,IAAI,qBAARL,WAAUM,MAAM,oBAAI;IAC1C,IAAI,CAACH,UAAU,CAACG,QAAQ;QACtB,OAAO;YACLC,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAA2B;QAC5C;IACF;IAEA,MAAMC,gBAAgBN,QAAOJ,6BAAAA,IAAIW,OAAO,CAACD,aAAa,YAAzBV,6BAA6B;IAC1D,MAAMY,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZ,OAAO;YAAEL,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAkB;QAAE;IACtE;IAEA,MAAMQ,UAAU,MAAMxB,cAAcyB,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;IAC/D,MAAMS,YAAY5B,cAAcyB,GAAG,GAAGG,SAAS;IAC/C,MAAMpB,eAAe,MAAMoB,UAAUC,UAAU,CAAC,SAASC,GAAG,CAACpB,QAAQqB,GAAG;IACxE,IAAI,CAACvB,aAAawB,MAAM,EAAE;QACxB,OAAO;YAAElB,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAe;QAAE;IACnE;IACA,MAAMiB,aAAa,EAACzB,oBAAAA,aAAauB,GAAG,CAAC,0BAAjBvB,oBAAmC,CAAC,EAAE,CAACgB,QAAQU,GAAG,CAAC;IACvE,IAAID,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YACLnB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAA6B;QAC9C;IACF;IAEA,MAAMmB,QAAQxB,iBACX,QAAA,MAAMV,cAAcS,QAAQ0B,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDD,KAAK,oBAAI;IAE5D,IAAI,CAACA,OAAO;QACV,OAAO;YACLrB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBAAEI,OAAO;YAAqD;QACtE;IACF;IACA,MAAMqB,aAAa,MAAMlC,qBAAqBqB,QAAQU,GAAG,EAAEC,OAAOC,KAAK,CACrE,IAAM;IAER,IAAI,CAACE,oBAAoBD,8BAAAA,WAAYE,MAAM,GAAG;QAC5C,OAAO;YACLzB,IAAI;YACJC,QAAQ;YACRH,MAAM;gBACJI,OACE,uEACA,oEACA;YACJ;QACF;IACF;IAEA,MAAMwB,UAAUZ,UACbC,UAAU,CAAC,QACXC,GAAG,CAACK,OACJN,UAAU,CAAC,SACXC,GAAG,CAACjB;IACP,MAAMJ,eAAe,MAAM+B,QAAQT,GAAG;IACtC,qEAAqE;IACrE,iDAAiD;IACjD,IAAI,CAACtB,aAAauB,MAAM,EAAE;QACxB,OAAO;YAAElB,IAAI;YAAOC,QAAQ;YAAKH,MAAM;gBAAEI,OAAO;YAAe;QAAE;IACnE;IAEA,OAAO;QACLF,IAAI;QACJoB,KAAKV,QAAQU,GAAG;QAChBxB;QACAyB;QACAK;QACAC,UAAU9B,QAAOF,oBAAAA,aAAasB,GAAG,CAAC,mBAAjBtB,oBAA4BI;IAC/C;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASyB,oBAAoBC,MAAe;IACjD,MAAMG,QAAQH;IAId,OACE7C,gBAAgBgD,UACfA,CAAAA,CAAAA,yBAAAA,MAAOC,IAAI,MAAK,WACfD,CAAAA,yBAAAA,MAAOC,IAAI,MAAK,WAChBD,CAAAA,yBAAAA,MAAOC,IAAI,MAAK,QAAO,KACzBD,CAAAA,yBAAAA,MAAOE,YAAY,MAAK;AAE5B;AAoEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,iBAAiBC,KAGtC;IACC,MAAMC,OAAO,IAAIC;IACjB,MAAMC,OAAuD,EAAE;IAC/D,KAAK,MAAMC,OAAOJ,MAAMK,MAAM,CAAE;QAC9B,MAAMC,QAAQzD,sBAAsBuD;QACpC,IAAIE,SAASL,KAAKM,GAAG,CAACD,QAAQ;QAC9B,IAAIA,OAAOL,KAAKO,GAAG,CAACF;QACpBH,KAAKM,IAAI,CAAC;YAAET,OAAOnC,OAAOuC,cAAAA,MAAO,IAAIM,IAAI;YAAIJ;QAAM;IACrD;IAEA,MAAMK,YAAYR,KACfS,GAAG,CAAC,CAACC,MAAQA,IAAIP,KAAK,EACtBQ,MAAM,CAAC,CAACR,QAA2BS,QAAQT;IAE9C;;;;;GAKC,GACD,MAAMU,QAAQ,MAAMjE,oBAAoBiD,MAAMpC,MAAM;IACpD,MAAM,CAACqD,aAAa,EAAEC,MAAM,EAAEC,MAAM,EAAE,CAAC,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC1DC,eAAetB,MAAMpC,MAAM,EAAEoD,OAAOL;QACpCrD,mBACEF,yBAAyB4C,MAAMpC,MAAM,EAAE,aACvCoD,OACAL;KAEH;IAED,MAAMY,aAAqCzE,mBAAmB,MAAMkE;IACpE,MAAMQ,WAAWrB,KAAKS,GAAG,CAAC,CAACC;YAUVK,aAGAD,kBAiBRA;QA7BP,IAAI,CAACJ,IAAIP,KAAK,EAAE;YACd,OAAO;gBACLN,OAAOa,IAAIb,KAAK;gBAChBM,OAAO;gBACPmB,SAAS;gBACTC,qBAAqB;gBACrBC,SAASjF,2BAA2B,CAAC,qBAAqB;YAC5D;QACF;QACA,MAAMkF,UAASV,cAAAA,OAAOjC,GAAG,CAAC4B,IAAIP,KAAK,aAApBY,cAAyBK;QACxC,MAAMM,UAAUlF,kBAAkB;YAChCuE,QAAQU;YACRX,WAAW,GAAEA,mBAAAA,YAAYhC,GAAG,CAAC4B,IAAIP,KAAK,aAAzBW,mBAA8B;QAC7C;QACA,OAAO;YACLjB,OAAOa,IAAIb,KAAK;YAChBM,OAAOO,IAAIP,KAAK;YAChB;;;;;;;;;OASC,GACDmB,SAASI,QAAQC,UAAU,GACvB,QACCb,oBAAAA,YAAYhC,GAAG,CAAC4B,IAAIP,KAAK,aAAzBW,oBAA8B;YACnCS,qBAAqBG,QAAQH,mBAAmB;YAChDC,SAASE,QAAQF,OAAO;QAC1B;IACF;IAEA,OAAO;QACLH;QACAN;QACAC;QACAH;QACAe,SAASP,SAASV,MAAM,CACtB,CAACkB,UAAY,CAACA,QAAQP,OAAO,IAAI,CAACO,QAAQN,mBAAmB,EAC7DlD,MAAM;QACRyD,iBAAiBT,SAASV,MAAM,CAAC,CAACkB,UAAYA,QAAQN,mBAAmB,EACtElD,MAAM;QACT0D,SAASV,SAASV,MAAM,CACtB,CAACkB,UAAYA,QAAQP,OAAO,IAAI,CAACO,QAAQN,mBAAmB,EAC5DlD,MAAM;IACV;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,eAAe8C,eACb1D,MAAc,EACdoD,KAAmB,EACnBL,SAA4B;IAE5B,MAAMwB,WAAW,IAAIC;IACrB,IAAI,CAACzB,UAAUnC,MAAM,EAAE,OAAO2D;IAC9B,MAAME,WAAW,IAAInC,IACnB,MAAMlD,sBAAsBY,QAAQ+C,WAAWlC,WAAWuC;IAE5D,MAAMsB,UAAU3B,UAAUG,MAAM,CAAC,CAACR,QAAU,CAAC+B,SAAS9B,GAAG,CAACD;IAC1D,IAAI,CAACgC,QAAQ9D,MAAM,EAAE,OAAO2D;IAC5B,sEAAsE;IACtE,wEAAwE;IACxE,MAAMI,mBAAmB,IAAIrC,IAAI,MAAMjD,uBAAuBqF;IAC9D,KAAK,MAAMhC,SAASgC,QAAS;QAC3BH,SAASK,GAAG,CACVlC,OACAiC,iBAAiBhC,GAAG,CAACD,SAAS,oBAAoB;IAEtD;IACA,OAAO6B;AACT;AAEA,qEAAqE,GACrE,OAAO,SAASM,cACdhF,GAAoC;IAEpC,MAAMK,OAAOL,IAAIK,IAAI;IACrB,MAAMsC,MAAMsC,MAAMC,OAAO,CAAC7E,wBAAAA,KAAM8E,MAAM,IAClC9E,KAAK8E,MAAM,GACX9E,CAAAA,wBAAAA,KAAMwC,KAAK,MAAK7B,YACd,EAAE,GACF;QAACX,KAAKwC,KAAK;KAAC;IAClB,MAAMsC,SAASxC,IACZQ,GAAG,CAAC,CAACiC,QAAUhF,OAAOgF,gBAAAA,QAAS,IAAInC,IAAI,IACvCI,MAAM,CAAC,CAAC+B,QAAUA,MAAMrE,MAAM,GAAG;IACpC,IAAI,CAACoE,OAAOpE,MAAM,EAAE,OAAO;QAAEN,OAAO;IAAe;IACnD,IAAI0E,OAAOpE,MAAM,GAAGjB,uBAAuB;QACzC,OAAO;YACLW,OACE,GAAG0E,OAAOpE,MAAM,CAAC,mDAAmD,CAAC,GACrE,GAAGjB,sBAAsB,WAAW,CAAC;QACzC;IACF;IACA,OAAO;QAAEqF;IAAO;AAClB"}