@aglyn/shared-util-email 1.0.0-beta.143

package/src/lib/sender-reputation.js

@@ -0,0 +1,392 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * PER-TENANT SENDING REPUTATION — the policy half.
+ *
+ * Every tenant's marketing mail leaves on one shared sending domain under
+ * `p=reject`. A mailbox provider grades that domain, not the tenant, so one
+ * merchant's bad list is felt by every other merchant's campaigns AND by the
+ * transactional mail — password resets, receipts, booking reminders — that
+ * shares the domain with them. Nothing in the product computed a rate at any
+ * scope, so there was no number to act on and no point at which anything
+ * stopped.
+ *
+ * This module is the decision, as a pure function of counts. The durable
+ * counters live in `@aglyn/tenant-data-admin` (`email-sender-reputation.ts`),
+ * which is the only layer that may hold the Admin SDK — the same split
+ * `send-rate.ts` draws beside it, for the same reason.
+ *
+ * ## What it may do, and what it may never do
+ *
+ * **It refuses a SEND. It never touches a person or their data.** No contact
+ * is deleted, no audience is trimmed, nobody is unsubscribed and no list
+ * membership changes. That is the enforce-at-the-reduction rule
+ * (`over-limit.ts`): a limit that refuses a person or their data leaks, so a
+ * capacity control gates the DROP and never the holding. A send is a flow —
+ * refusing one strands nobody's data, and the merchant can send it after
+ * cleaning the list.
+ *
+ * **It may only ever refuse a CAMPAIGN.** A transactional message can never
+ * reach this decision: {@link emailReputationVerdict} is consulted from the campaign
+ * sender alone, and both layers underneath it — `emailSendRateVerdict` and
+ * `sendEmail` itself — independently refuse to drop a transactional priority
+ * whatever a control above them says. A password reset refused by a
+ * reputation breaker converts a deliverability risk into an outage on
+ * somebody else's business, and the mail explaining why is itself mail that
+ * would not send.
+ *
+ * ## The three numbers, and the two that are not rates
+ *
+ * A rate on its own is not evidence. Two guards stand in front of every
+ * threshold and both have to clear:
+ *
+ *  - {@link EMAIL_REPUTATION_MIN_VOLUME} — a denominator below which a rate
+ *    is noise. One complaint out of four is 25% and means nothing.
+ *  - {@link EMAIL_REPUTATION_MIN_EVENTS} — a numerator below which a rate is
+ *    one person having a bad day. M3AAWG's own sizing caveat is that test
+ *    sends below ten thousand recipients do not yield statistically
+ *    significant results; at our volumes the honest response is not to pretend
+ *    otherwise but to require that the signal be repeated before it bites.
+ *
+ * A threshold crossed with either guard unmet is reported as a FINDING and
+ * changes nothing. That is deliberate: the operator surface has to show a
+ * rate climbing before it trips, or the first anybody hears of the control is
+ * a refused campaign.
+ *
+ * ## The thresholds
+ *
+ * `complaintRate` is graded against Google's published bulk-sender rule —
+ * keep spam complaints under 0.10% and never at or above 0.30% — so the watch
+ * level and the trip level are the two numbers Google itself names rather
+ * than two we picked.
+ *
+ * `bounceRate` has no published cross-provider number; 5% watch and 10% trip
+ * is the shape Amazon SES enforces on its own senders, and it is the one
+ * decision here taken from a vendor rather than from a standard.
+ */ /** Days of history a rate is computed over. */ export const EMAIL_REPUTATION_WINDOW_DAYS = 7;
+/**
+ * Messages a window must carry before any rate in it is actionable.
+ *
+ * 200 is the first ramp step (see {@link EMAIL_RAMP_STEPS}), so a brand-new
+ * tenant cannot be tripped by its very first day of sending — it has to send
+ * a second day, by which time there is a real denominator.
+ */ export const EMAIL_REPUTATION_MIN_VOLUME = 200;
+/** Bad events a finding must carry before it is actionable. */ export const EMAIL_REPUTATION_MIN_EVENTS = 3;
+/** Google's "keep it under this" spam rate. */ export const EMAIL_COMPLAINT_RATE_WATCH = 0.001;
+/** Google's "never reach this" spam rate. */ export const EMAIL_COMPLAINT_RATE_TRIP = 0.003;
+/** Bounce rate that earns a warning. */ export const EMAIL_BOUNCE_RATE_WATCH = 0.05;
+/** Bounce rate that stops the sender. */ export const EMAIL_BOUNCE_RATE_TRIP = 0.1;
+export const EMAIL_REPUTATION_POLICIES = [
+    'standard',
+    'strict',
+    'none'
+];
+/** The default when an org has configured nothing. */ export const EMAIL_REPUTATION_DEFAULT_POLICY = 'standard';
+/**
+ * Reads a stored policy, falling back to the default.
+ *
+ * Never falls back to `'none'`. An unreadable policy that parked the breaker
+ * would be a control switched off by a typo, which is the shape where a
+ * ceiling silently stops existing.
+ */ export function normalizeEmailReputationPolicy(raw) {
+    const value = String(raw != null ? raw : '');
+    return EMAIL_REPUTATION_POLICIES.includes(value) ? value : EMAIL_REPUTATION_DEFAULT_POLICY;
+}
+/**
+ * WHICH POLICY THIS SENDER IS ACTUALLY GRADED ON, given whose domain it is.
+ *
+ * A pooled sender shares one domain with every other site that has no domain
+ * of its own, so a complaint it earns is charged to their receipts as much as
+ * to its own. That asymmetry used to be handled by keeping marketing off the
+ * pool altogether. It is handled here instead: on the pool a campaign is
+ * graded `strict`, which stops it on the WATCH thresholds — Google's "keep
+ * under" 0.10% complaint rate and a 5% bounce rate — rather than waiting for
+ * the trip levels three and two times higher.
+ *
+ * On a domain the merchant owns, the org's own setting stands. The reputation
+ * being spent there is theirs alone, and how fast they spend it is theirs to
+ * decide.
+ *
+ * ## The pool overrides `none`, and that is the point
+ *
+ * A workspace that has switched its own breaker off must not thereby switch
+ * off the one protecting the other sites on its pool member. Same posture as
+ * the platform marketing frequency ceiling, which is the same number on every
+ * plan for the same reason: a control that exists to protect tenants from each
+ * other cannot be something one tenant sets aside.
+ *
+ * @param source the resolved {@link SendingIdentitySource}. Anything that is
+ *        not `'shared'` — a custom domain, the platform's own identity, or an
+ *        unresolved send — takes the configured policy, because only the pool
+ *        spends somebody else's reputation.
+ */ export function effectiveReputationPolicy(source, configured) {
+    if (source === 'shared') return 'strict';
+    return normalizeEmailReputationPolicy(configured);
+}
+/** A count clamped to a non-negative integer. A corrupt counter reads as 0. */ function count(raw) {
+    const value = Math.floor(Number(raw));
+    return Number.isFinite(value) && value > 0 ? value : 0;
+}
+/** `events / volume`, or 0 when there is no denominator. */ export function emailReputationRate(events, volume) {
+    const numerator = count(events);
+    const denominator = count(volume);
+    return denominator > 0 ? numerator / denominator : 0;
+}
+/** A fraction as the percentage a person reads, to two places. */ export function formatReputationRate(rate) {
+    const value = Number(rate);
+    if (!Number.isFinite(value) || value <= 0) return '0%';
+    return `${(value * 100).toFixed(2)}%`;
+}
+function buildFinding(input) {
+    const { rate, events, volume, watch, trip } = input;
+    if (rate < watch) return null;
+    const severity = rate >= trip ? 'high' : 'low';
+    const threshold = severity === 'high' ? trip : watch;
+    const actionable = volume >= EMAIL_REPUTATION_MIN_VOLUME && events >= EMAIL_REPUTATION_MIN_EVENTS;
+    return {
+        code: input.code,
+        severity,
+        rate,
+        threshold,
+        events,
+        volume,
+        actionable,
+        detail: `${events.toLocaleString()} ${input.noun} in ` + `${volume.toLocaleString()} messages is ${formatReputationRate(rate)}, ` + `against a limit of ${formatReputationRate(threshold)}` + (actionable ? '.' : ' — too little volume to act on yet, so this is recorded and ' + 'nothing is stopped.')
+    };
+}
+/**
+ * Grades one tenant's window, and says whether a campaign may go out.
+ *
+ * Pure and total: no input throws, because this runs on the path that decides
+ * whether a campaign sends and a thrown grade would be an outage caused by
+ * bookkeeping. That is the posture `describeEmailCeilings` takes beside it.
+ *
+ * A tenant with no history at all grades `ok` — an absent counter is a tenant
+ * that has not sent, not a tenant with a perfect record and not one to
+ * refuse. The direction matters: the opposite reading would refuse every
+ * first campaign on the platform, which is the stubbed-resolver failure where
+ * a clamp goes green having stopped everything.
+ */ export function emailReputationVerdict(input) {
+    var _input_now, _input_reinstatedUntilMs;
+    var _input_counts, _input_counts1, _input_counts2;
+    const policy = normalizeEmailReputationPolicy(input.policy);
+    const accepted = count((_input_counts = input.counts) == null ? void 0 : _input_counts.accepted);
+    const bounced = count((_input_counts1 = input.counts) == null ? void 0 : _input_counts1.bounced);
+    const complained = count((_input_counts2 = input.counts) == null ? void 0 : _input_counts2.complained);
+    const windowDays = count(input.windowDays) || EMAIL_REPUTATION_WINDOW_DAYS;
+    const complaintRate = emailReputationRate(complained, accepted);
+    const bounceRate = emailReputationRate(bounced, accepted);
+    const findings = [
+        buildFinding({
+            code: 'complaint-rate',
+            rate: complaintRate,
+            events: complained,
+            volume: accepted,
+            watch: EMAIL_COMPLAINT_RATE_WATCH,
+            trip: EMAIL_COMPLAINT_RATE_TRIP,
+            noun: 'spam complaints'
+        }),
+        buildFinding({
+            code: 'bounce-rate',
+            rate: bounceRate,
+            events: bounced,
+            volume: accepted,
+            watch: EMAIL_BOUNCE_RATE_WATCH,
+            trip: EMAIL_BOUNCE_RATE_TRIP,
+            noun: 'permanent bounces'
+        })
+    ].filter((finding)=>finding !== null);
+    const actionable = findings.filter((finding)=>finding.actionable);
+    const stopping = policy === 'none' ? [] : policy === 'strict' ? actionable : actionable.filter((finding)=>finding.severity === 'high');
+    const now = Number((_input_now = input.now) != null ? _input_now : Date.now());
+    const reinstatedUntilMs = Number((_input_reinstatedUntilMs = input.reinstatedUntilMs) != null ? _input_reinstatedUntilMs : 0);
+    const reinstated = Number.isFinite(reinstatedUntilMs) && reinstatedUntilMs > now ? Math.floor(reinstatedUntilMs) : null;
+    const base = {
+        policy,
+        complaintRate,
+        bounceRate,
+        volume: accepted,
+        windowDays,
+        findings
+    };
+    if (stopping.length && reinstated !== null) {
+        return _extends({}, base, {
+            state: 'reinstated',
+            blocked: false,
+            reason: '',
+            reinstatedUntilMs: reinstated
+        });
+    }
+    if (stopping.length) {
+        return _extends({}, base, {
+            state: 'tripped',
+            blocked: true,
+            reason: 'Campaign sending is paused for this workspace because the mail it ' + `has sent in the last ${windowDays} days is being rejected or ` + `reported as spam too often. ${stopping.map((finding)=>finding.detail).join(' ')} Nobody has been removed from your audience and no ` + 'contact has been changed. Remove the addresses that bounced, send ' + 'only to people who asked for this mail, and campaign sending ' + 'resumes as the last ' + `${windowDays} days roll off. Transactional mail — receipts, ` + 'booking reminders, password resets — keeps sending.',
+            reinstatedUntilMs: null
+        });
+    }
+    return _extends({}, base, {
+        state: actionable.length ? 'watch' : 'ok',
+        blocked: false,
+        reason: '',
+        reinstatedUntilMs: reinstated
+    });
+}
+/**
+ * The ramp, lowest step first.
+ *
+ * The first step is SES's published sandbox figure. Each step after it is
+ * roughly a five-fold increase gated on having actually delivered most of the
+ * step below it, which is the warm-up curve every deliverability guide
+ * describes and the one a mailbox provider's own reputation model is built to
+ * see.
+ */ export const EMAIL_RAMP_STEPS = [
+    {
+        minAgeDays: 0,
+        minDelivered: 0,
+        perDay: 200
+    },
+    {
+        minAgeDays: 1,
+        minDelivered: 100,
+        perDay: 1000
+    },
+    {
+        minAgeDays: 3,
+        minDelivered: 800,
+        perDay: 5000
+    }
+];
+/**
+ * Age at which the ramp stops binding entirely.
+ *
+ * Past this the hourly share and the plan are the only ceilings, which is
+ * what they were before the ramp existed. Seven days matches the last step's
+ * reach and is short enough that it is a warm-up rather than a tier.
+ */ export const EMAIL_RAMP_GRADUATION_DAYS = 7;
+/**
+ * The daily campaign ceiling for one tenant.
+ *
+ * Pure and total, like every other ceiling in this library.
+ */ export function emailRampVerdict(input) {
+    const graduatedPerDay = Math.max(1, count(input.graduatedPerDay));
+    const rawAge = Number(input.ageDays);
+    const graduate = ()=>({
+            graduated: true,
+            perDay: graduatedPerDay,
+            share: 1,
+            step: EMAIL_RAMP_STEPS.length,
+            daysToNextStep: null,
+            detail: 'This workspace is past its first week of sending, so the new-sender ' + 'ramp no longer applies.'
+        });
+    /*
+   * `null` and `undefined` are checked BEFORE the coercion, because
+   * `Number(null)` is 0 — a finite, non-negative number that reads as "created
+   * today" and would put every org whose record predates the creation
+   * timestamp onto the first ramp step. The absent case has to be caught as
+   * itself; a numeric guard cannot see it.
+   */ if (input.ageDays === null || input.ageDays === undefined) return graduate();
+    if (!Number.isFinite(rawAge) || rawAge < 0) return graduate();
+    const ageDays = Math.floor(rawAge);
+    if (ageDays >= EMAIL_RAMP_GRADUATION_DAYS) return graduate();
+    const delivered = count(input.deliveredLifetime);
+    let step = 0;
+    for(let index = 1; index < EMAIL_RAMP_STEPS.length; index += 1){
+        const candidate = EMAIL_RAMP_STEPS[index];
+        if (ageDays >= candidate.minAgeDays && delivered >= candidate.minDelivered) {
+            step = index;
+        } else {
+            break;
+        }
+    }
+    const next = EMAIL_RAMP_STEPS[step + 1];
+    // Never above the ceiling underneath it: a graduated tenant's day is the
+    // hardest number in this arithmetic, and a ramp step over it would promise
+    // a new tenant more than an established one may send.
+    const perDay = Math.min(graduatedPerDay, EMAIL_RAMP_STEPS[step].perDay);
+    return {
+        graduated: false,
+        perDay,
+        // `graduatedPerDay` is floored at 1 above, so this divides by a positive
+        // number, and `perDay` is the smaller of the two, so it lands in `(0, 1]`.
+        share: perDay / graduatedPerDay,
+        step,
+        daysToNextStep: next ? Math.max(0, next.minAgeDays - ageDays) : null,
+        detail: `This workspace was created ${ageDays === 0 ? 'today' : `${ageDays} ` + `day${ageDays === 1 ? '' : 's'} ago`}, ` + `so it may send ${perDay.toLocaleString()} campaign emails a day while ` + 'it establishes a sending history. The rest of a campaign is not lost — ' + 'it goes out automatically on the following days.'
+    };
+}
+/**
+ * A daily allowance, held to the share of it a young workspace has earned.
+ *
+ * The ramp applied to a surface whose day is a plan figure rather than the
+ * graduated campaign ceiling — see the share note in the header. A graduated
+ * workspace, and an absent verdict, get the allowance untouched, so a caller
+ * that cannot resolve a ramp is not silently throttling anybody.
+ *
+ * ## The two clamps, and why each is the direction it is
+ *
+ * FLOORED AT 1 while the allowance is positive, the same reasoning
+ * `orgHourlyCampaignCeiling` floors its own share at 1: the first step is a
+ * small fraction of a graduated day, and a plan band low enough to round that
+ * fraction away must throttle a workspace to a trickle rather than stop it
+ * dead. A ceiling of zero on day one is indistinguishable from a plan that
+ * carries no one-to-one email at all, and the two have to stay tellable
+ * apart.
+ *
+ * An allowance of ZERO stays zero, because that is not a small band — it is
+ * a plan with no allowance, and a ramp that raised it to 1 would sell a
+ * feature the tier does not carry. Pacing never grants.
+ *
+ * An INFINITE allowance stays infinite. It is the sentinel a contract with no
+ * ceiling is written as, a share of it is still unbounded, and the clamp
+ * below would read the infinity as a corrupt counter and answer zero — a
+ * ramp that refused the agreements that buy the most.
+ */ export function rampedDailyAllowance(allowance, ramp) {
+    const uncapped = Number(allowance);
+    if (uncapped === Number.POSITIVE_INFINITY) return uncapped;
+    const included = count(uncapped);
+    if (included <= 0 || !ramp || ramp.graduated) return included;
+    // An unreadable share collapses to the floor rather than to the whole
+    // allowance: a ramp that binds and cannot say by how much owes the
+    // narrowest answer it has, not the widest.
+    const share = Number(ramp.share);
+    const earned = Number.isFinite(share) && share > 0 ? included * share : 0;
+    return Math.min(included, Math.max(1, Math.floor(earned)));
+}
+/** Days between two instants, floored. Negative inputs read as 0. */ export function daysBetween(fromMs, toMs) {
+    const from = Number(fromMs);
+    const to = Number(toMs);
+    if (!Number.isFinite(from) || !Number.isFinite(to) || from <= 0) return 0;
+    return Math.max(0, Math.floor((to - from) / 86400000));
+}
+/** The UTC day a timestamp falls in, as `YYYY-MM-DD`. */ export function reputationDayKey(atMs = Date.now()) {
+    const value = Number(atMs);
+    const date = new Date(Number.isFinite(value) && value > 0 ? value : Date.now());
+    return date.toISOString().slice(0, 10);
+}
+/** The `YYYY-MM-DD` keys of the window ending on `atMs`, oldest first. */ export function reputationWindowDayKeys(atMs = Date.now(), windowDays = EMAIL_REPUTATION_WINDOW_DAYS) {
+    const days = Math.max(1, count(windowDays) || EMAIL_REPUTATION_WINDOW_DAYS);
+    const end = Number(atMs);
+    const at = Number.isFinite(end) && end > 0 ? end : Date.now();
+    const keys = [];
+    for(let offset = days - 1; offset >= 0; offset -= 1){
+        keys.push(reputationDayKey(at - offset * 86400000));
+    }
+    return keys;
+}
+
+//# sourceMappingURL=sender-reputation.js.map

package/src/lib/sender-reputation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/sender-reputation.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * PER-TENANT SENDING REPUTATION — the policy half.\n *\n * Every tenant's marketing mail leaves on one shared sending domain under\n * `p=reject`. A mailbox provider grades that domain, not the tenant, so one\n * merchant's bad list is felt by every other merchant's campaigns AND by the\n * transactional mail — password resets, receipts, booking reminders — that\n * shares the domain with them. Nothing in the product computed a rate at any\n * scope, so there was no number to act on and no point at which anything\n * stopped.\n *\n * This module is the decision, as a pure function of counts. The durable\n * counters live in `@aglyn/tenant-data-admin` (`email-sender-reputation.ts`),\n * which is the only layer that may hold the Admin SDK — the same split\n * `send-rate.ts` draws beside it, for the same reason.\n *\n * ## What it may do, and what it may never do\n *\n * **It refuses a SEND. It never touches a person or their data.** No contact\n * is deleted, no audience is trimmed, nobody is unsubscribed and no list\n * membership changes. That is the enforce-at-the-reduction rule\n * (`over-limit.ts`): a limit that refuses a person or their data leaks, so a\n * capacity control gates the DROP and never the holding. A send is a flow —\n * refusing one strands nobody's data, and the merchant can send it after\n * cleaning the list.\n *\n * **It may only ever refuse a CAMPAIGN.** A transactional message can never\n * reach this decision: {@link emailReputationVerdict} is consulted from the campaign\n * sender alone, and both layers underneath it — `emailSendRateVerdict` and\n * `sendEmail` itself — independently refuse to drop a transactional priority\n * whatever a control above them says. A password reset refused by a\n * reputation breaker converts a deliverability risk into an outage on\n * somebody else's business, and the mail explaining why is itself mail that\n * would not send.\n *\n * ## The three numbers, and the two that are not rates\n *\n * A rate on its own is not evidence. Two guards stand in front of every\n * threshold and both have to clear:\n *\n *  - {@link EMAIL_REPUTATION_MIN_VOLUME} — a denominator below which a rate\n *    is noise. One complaint out of four is 25% and means nothing.\n *  - {@link EMAIL_REPUTATION_MIN_EVENTS} — a numerator below which a rate is\n *    one person having a bad day. M3AAWG's own sizing caveat is that test\n *    sends below ten thousand recipients do not yield statistically\n *    significant results; at our volumes the honest response is not to pretend\n *    otherwise but to require that the signal be repeated before it bites.\n *\n * A threshold crossed with either guard unmet is reported as a FINDING and\n * changes nothing. That is deliberate: the operator surface has to show a\n * rate climbing before it trips, or the first anybody hears of the control is\n * a refused campaign.\n *\n * ## The thresholds\n *\n * `complaintRate` is graded against Google's published bulk-sender rule —\n * keep spam complaints under 0.10% and never at or above 0.30% — so the watch\n * level and the trip level are the two numbers Google itself names rather\n * than two we picked.\n *\n * `bounceRate` has no published cross-provider number; 5% watch and 10% trip\n * is the shape Amazon SES enforces on its own senders, and it is the one\n * decision here taken from a vendor rather than from a standard.\n */\n\n/** Days of history a rate is computed over. */\nexport const EMAIL_REPUTATION_WINDOW_DAYS = 7\n\n/**\n * Messages a window must carry before any rate in it is actionable.\n *\n * 200 is the first ramp step (see {@link EMAIL_RAMP_STEPS}), so a brand-new\n * tenant cannot be tripped by its very first day of sending — it has to send\n * a second day, by which time there is a real denominator.\n */\nexport const EMAIL_REPUTATION_MIN_VOLUME = 200\n\n/** Bad events a finding must carry before it is actionable. */\nexport const EMAIL_REPUTATION_MIN_EVENTS = 3\n\n/** Google's \"keep it under this\" spam rate. */\nexport const EMAIL_COMPLAINT_RATE_WATCH = 0.001\n\n/** Google's \"never reach this\" spam rate. */\nexport const EMAIL_COMPLAINT_RATE_TRIP = 0.003\n\n/** Bounce rate that earns a warning. */\nexport const EMAIL_BOUNCE_RATE_WATCH = 0.05\n\n/** Bounce rate that stops the sender. */\nexport const EMAIL_BOUNCE_RATE_TRIP = 0.1\n\n/**\n * What a tenant's findings are allowed to do to it.\n *\n * The three Amazon SES publishes for its own tenant isolation, and the names\n * are theirs because the behaviors are theirs. **These are persisted values**\n * — they are stored on the org — so they are added to and never renamed.\n */\nexport type EmailReputationPolicy =\n  /** Stop the sender on a high-severity finding. The default. */\n  | 'standard'\n  /** Stop the sender on any finding at all. */\n  | 'strict'\n  /** Record only. Never stops anything. */\n  | 'none'\n\nexport const EMAIL_REPUTATION_POLICIES: readonly EmailReputationPolicy[] = [\n  'standard',\n  'strict',\n  'none',\n]\n\n/** The default when an org has configured nothing. */\nexport const EMAIL_REPUTATION_DEFAULT_POLICY: EmailReputationPolicy = 'standard'\n\n/**\n * Reads a stored policy, falling back to the default.\n *\n * Never falls back to `'none'`. An unreadable policy that parked the breaker\n * would be a control switched off by a typo, which is the shape where a\n * ceiling silently stops existing.\n */\nexport function normalizeEmailReputationPolicy(\n  raw: unknown,\n): EmailReputationPolicy {\n  const value = String(raw ?? '')\n  return (EMAIL_REPUTATION_POLICIES as readonly string[]).includes(value)\n    ? (value as EmailReputationPolicy)\n    : EMAIL_REPUTATION_DEFAULT_POLICY\n}\n\n/**\n * WHICH POLICY THIS SENDER IS ACTUALLY GRADED ON, given whose domain it is.\n *\n * A pooled sender shares one domain with every other site that has no domain\n * of its own, so a complaint it earns is charged to their receipts as much as\n * to its own. That asymmetry used to be handled by keeping marketing off the\n * pool altogether. It is handled here instead: on the pool a campaign is\n * graded `strict`, which stops it on the WATCH thresholds — Google's \"keep\n * under\" 0.10% complaint rate and a 5% bounce rate — rather than waiting for\n * the trip levels three and two times higher.\n *\n * On a domain the merchant owns, the org's own setting stands. The reputation\n * being spent there is theirs alone, and how fast they spend it is theirs to\n * decide.\n *\n * ## The pool overrides `none`, and that is the point\n *\n * A workspace that has switched its own breaker off must not thereby switch\n * off the one protecting the other sites on its pool member. Same posture as\n * the platform marketing frequency ceiling, which is the same number on every\n * plan for the same reason: a control that exists to protect tenants from each\n * other cannot be something one tenant sets aside.\n *\n * @param source the resolved {@link SendingIdentitySource}. Anything that is\n *        not `'shared'` — a custom domain, the platform's own identity, or an\n *        unresolved send — takes the configured policy, because only the pool\n *        spends somebody else's reputation.\n */\nexport function effectiveReputationPolicy(\n  source: string | null | undefined,\n  configured: unknown,\n): EmailReputationPolicy {\n  if (source === 'shared') return 'strict'\n  return normalizeEmailReputationPolicy(configured)\n}\n\n/** Which measurement produced a finding. */\nexport type EmailReputationFindingCode = 'complaint-rate' | 'bounce-rate'\n\n/** How badly. `high` is what a `standard` policy stops on. */\nexport type EmailReputationSeverity = 'low' | 'high'\n\n/** One measurement that crossed a threshold, with the numbers behind it. */\nexport interface EmailReputationFinding {\n  code: EmailReputationFindingCode\n  severity: EmailReputationSeverity\n  /** The measured rate, as a fraction. */\n  rate: number\n  /** The threshold it crossed, as a fraction. */\n  threshold: number\n  /** Events in the window — the numerator. */\n  events: number\n  /** Messages in the window — the denominator. */\n  volume: number\n  /**\n   * False when a guard was unmet, so this finding is reported and cannot\n   * stop anything. See the header for why both guards exist.\n   */\n  actionable: boolean\n  /** Human-readable, and the text a surface may show verbatim. */\n  detail: string\n}\n\n/** The counts a window holds. Every field is a message count. */\nexport interface EmailReputationCounts {\n  /** Campaign messages handed to the sender in the window. The denominator. */\n  accepted: number\n  /** Permanent bounces reported against them. */\n  bounced: number\n  /** Spam complaints reported against them. */\n  complained: number\n}\n\n/** A tenant's reputation state. */\nexport type EmailReputationState =\n  /** No finding, or none actionable. */\n  | 'ok'\n  /** A finding this policy does not stop on. */\n  | 'watch'\n  /** The sender is stopped. */\n  | 'tripped'\n  /**\n   * Findings stand but a grace period is ignoring them, so a tenant that has\n   * fixed its list can send again without an operator having to time the\n   * moment the window rolls off. SES's own `Reinstated`.\n   */\n  | 'reinstated'\n\n/** The reconciled reputation of one tenant. */\nexport interface EmailReputationVerdict {\n  state: EmailReputationState\n  /** True only when a campaign may not go out. */\n  blocked: boolean\n  policy: EmailReputationPolicy\n  complaintRate: number\n  bounceRate: number\n  /** Messages the window measured. */\n  volume: number\n  /** Days the window covers. */\n  windowDays: number\n  /** Every threshold crossed, actionable or not. */\n  findings: EmailReputationFinding[]\n  /**\n   * Why a merchant cannot send, in words they can act on. Empty when\n   * {@link blocked} is false — a surface must never show a reason for a\n   * state that is not blocking.\n   */\n  reason: string\n  /** When a grace period ends, ms. Null unless {@link state} is `reinstated`. */\n  reinstatedUntilMs: number | null\n}\n\n/** A count clamped to a non-negative integer. A corrupt counter reads as 0. */\nfunction count(raw: unknown): number {\n  const value = Math.floor(Number(raw))\n  return Number.isFinite(value) && value > 0 ? value : 0\n}\n\n/** `events / volume`, or 0 when there is no denominator. */\nexport function emailReputationRate(events: number, volume: number): number {\n  const numerator = count(events)\n  const denominator = count(volume)\n  return denominator > 0 ? numerator / denominator : 0\n}\n\n/** A fraction as the percentage a person reads, to two places. */\nexport function formatReputationRate(rate: number): string {\n  const value = Number(rate)\n  if (!Number.isFinite(value) || value <= 0) return '0%'\n  return `${(value * 100).toFixed(2)}%`\n}\n\nfunction buildFinding(input: {\n  code: EmailReputationFindingCode\n  rate: number\n  events: number\n  volume: number\n  watch: number\n  trip: number\n  noun: string\n}): EmailReputationFinding | null {\n  const { rate, events, volume, watch, trip } = input\n  if (rate < watch) return null\n  const severity: EmailReputationSeverity = rate >= trip ? 'high' : 'low'\n  const threshold = severity === 'high' ? trip : watch\n  const actionable =\n    volume >= EMAIL_REPUTATION_MIN_VOLUME && events >= EMAIL_REPUTATION_MIN_EVENTS\n  return {\n    code: input.code,\n    severity,\n    rate,\n    threshold,\n    events,\n    volume,\n    actionable,\n    detail:\n      `${events.toLocaleString()} ${input.noun} in ` +\n      `${volume.toLocaleString()} messages is ${formatReputationRate(rate)}, ` +\n      `against a limit of ${formatReputationRate(threshold)}` +\n      (actionable\n        ? '.'\n        : ' — too little volume to act on yet, so this is recorded and ' +\n          'nothing is stopped.'),\n  }\n}\n\nexport interface EmailReputationVerdictInput {\n  counts: EmailReputationCounts\n  policy?: EmailReputationPolicy\n  /** Days the counts cover, for the message. */\n  windowDays?: number\n  /** A grace period that ignores active findings, ms since epoch. */\n  reinstatedUntilMs?: number | null\n  /** Injectable for tests. */\n  now?: number\n}\n\n/**\n * Grades one tenant's window, and says whether a campaign may go out.\n *\n * Pure and total: no input throws, because this runs on the path that decides\n * whether a campaign sends and a thrown grade would be an outage caused by\n * bookkeeping. That is the posture `describeEmailCeilings` takes beside it.\n *\n * A tenant with no history at all grades `ok` — an absent counter is a tenant\n * that has not sent, not a tenant with a perfect record and not one to\n * refuse. The direction matters: the opposite reading would refuse every\n * first campaign on the platform, which is the stubbed-resolver failure where\n * a clamp goes green having stopped everything.\n */\nexport function emailReputationVerdict(\n  input: EmailReputationVerdictInput,\n): EmailReputationVerdict {\n  const policy = normalizeEmailReputationPolicy(input.policy)\n  const accepted = count(input.counts?.accepted)\n  const bounced = count(input.counts?.bounced)\n  const complained = count(input.counts?.complained)\n  const windowDays = count(input.windowDays) || EMAIL_REPUTATION_WINDOW_DAYS\n  const complaintRate = emailReputationRate(complained, accepted)\n  const bounceRate = emailReputationRate(bounced, accepted)\n\n  const findings = [\n    buildFinding({\n      code: 'complaint-rate',\n      rate: complaintRate,\n      events: complained,\n      volume: accepted,\n      watch: EMAIL_COMPLAINT_RATE_WATCH,\n      trip: EMAIL_COMPLAINT_RATE_TRIP,\n      noun: 'spam complaints',\n    }),\n    buildFinding({\n      code: 'bounce-rate',\n      rate: bounceRate,\n      events: bounced,\n      volume: accepted,\n      watch: EMAIL_BOUNCE_RATE_WATCH,\n      trip: EMAIL_BOUNCE_RATE_TRIP,\n      noun: 'permanent bounces',\n    }),\n  ].filter((finding): finding is EmailReputationFinding => finding !== null)\n\n  const actionable = findings.filter((finding) => finding.actionable)\n  const stopping =\n    policy === 'none'\n      ? []\n      : policy === 'strict'\n        ? actionable\n        : actionable.filter((finding) => finding.severity === 'high')\n\n  const now = Number(input.now ?? Date.now())\n  const reinstatedUntilMs = Number(input.reinstatedUntilMs ?? 0)\n  const reinstated =\n    Number.isFinite(reinstatedUntilMs) && reinstatedUntilMs > now\n      ? Math.floor(reinstatedUntilMs)\n      : null\n\n  const base = {\n    policy,\n    complaintRate,\n    bounceRate,\n    volume: accepted,\n    windowDays,\n    findings,\n  }\n\n  if (stopping.length && reinstated !== null) {\n    return {\n      ...base,\n      state: 'reinstated',\n      blocked: false,\n      reason: '',\n      reinstatedUntilMs: reinstated,\n    }\n  }\n  if (stopping.length) {\n    return {\n      ...base,\n      state: 'tripped',\n      blocked: true,\n      reason:\n        'Campaign sending is paused for this workspace because the mail it ' +\n        `has sent in the last ${windowDays} days is being rejected or ` +\n        `reported as spam too often. ${stopping\n          .map((finding) => finding.detail)\n          .join(' ')} Nobody has been removed from your audience and no ` +\n        'contact has been changed. Remove the addresses that bounced, send ' +\n        'only to people who asked for this mail, and campaign sending ' +\n        'resumes as the last ' +\n        `${windowDays} days roll off. Transactional mail — receipts, ` +\n        'booking reminders, password resets — keeps sending.',\n      reinstatedUntilMs: null,\n    }\n  }\n  return {\n    ...base,\n    state: actionable.length ? 'watch' : 'ok',\n    blocked: false,\n    reason: '',\n    reinstatedUntilMs: reinstated,\n  }\n}\n\n/*==========================================\n * THE NEW-SENDER RAMP.\n *\n * A brand-new, unvetted signup and a customer with a year of clean sending\n * got the same share of the platform hour. Public self-serve signup makes\n * that the shape by which a shared domain gets blocked: nothing in the\n * product stopped a tenant created five minutes ago from putting its whole\n * first import onto the domain every other tenant's receipts leave on.\n *\n * The pattern the industry ships for this is a sandbox, and two documented\n * versions bracket it. Postmark reviews each new account by hand, typically\n * inside a day, and until then the account may only mail domains it has\n * verified. Amazon SES makes it mechanical and publishes the numbers: 200\n * messages per 24 hours until a request lifts it.\n *\n * The SES shape is the one taken here, for three reasons: it needs no human\n * in the loop on a Sept-1 public signup, it is a number rather than a\n * judgement, and it is legible to the merchant — \"your workspace is new, so\n * it sends 200 a day this week\" is a sentence, where \"an operator has not\n * reviewed you yet\" is a wait with no end.\n *\n * ## It is PACING, not an entitlement\n *\n * The ramp never reduces what a plan includes; it spreads the first week of\n * it. A campaign over the day's step is DEFERRED, not refused — it resumes\n * on the next day exactly as it resumes on the next hour, through the same\n * batching the send path already has. Nothing is lost and nothing is\n * removed.\n *\n * ## Why a step needs BOTH a day count and a volume\n *\n * A ramp gated on age alone is a ramp you skip by waiting: sign up, do\n * nothing for a week, then send the whole import at full speed on day eight\n * with no delivery history at all. A step therefore has to be EARNED by\n * clean volume as well as reached in time — which is what a warm-up is.\n *\n * ## What an org with no creation date gets\n *\n * GRADUATED, not throttled. An unreadable age must resolve to the permissive\n * answer here, and that is not a preference: an org record whose `createdAt`\n * is missing is an EXISTING customer, and reading a missing field as \"brand\n * new\" would ramp every paying tenant on the platform down to 200 a day on\n * the deploy. The direction to be wrong in is the one that does not throttle\n * a customer who has been sending for a year.\n *\n * ## The step is a SHARE, and that is what lets a second surface use it\n *\n * A step is stated two ways: `perDay`, the campaign figure, and `share`, the\n * same restriction as a fraction of a graduated day. They are one number —\n * `perDay / graduatedPerDay` — because a ramp is a proportion of what an\n * established workspace may do, and only the campaign path happens to have\n * the graduated day as its own allowance.\n *\n * Every other daily allowance on the platform is a plan figure sized for one\n * workspace rather than for the whole platform's hour, so a step compared\n * against one directly would never bind: `min(band, step)` is the band, and\n * the ramp would be a guard that always passes.\n * {@link rampedDailyAllowance} takes the share to the allowance instead,\n * which is the arithmetic the campaign path already does — its allowance IS\n * the graduated day, so share times allowance is `perDay` exactly.\n *=========================================*/\n\n/** One step of the ramp. */\nexport interface EmailRampStep {\n  /** Days since the workspace was created before this step is reachable. */\n  minAgeDays: number\n  /** Campaign messages it must have delivered before this step is reachable. */\n  minDelivered: number\n  /** Campaign messages a day at this step. */\n  perDay: number\n}\n\n/**\n * The ramp, lowest step first.\n *\n * The first step is SES's published sandbox figure. Each step after it is\n * roughly a five-fold increase gated on having actually delivered most of the\n * step below it, which is the warm-up curve every deliverability guide\n * describes and the one a mailbox provider's own reputation model is built to\n * see.\n */\nexport const EMAIL_RAMP_STEPS: readonly EmailRampStep[] = [\n  { minAgeDays: 0, minDelivered: 0, perDay: 200 },\n  { minAgeDays: 1, minDelivered: 100, perDay: 1_000 },\n  { minAgeDays: 3, minDelivered: 800, perDay: 5_000 },\n]\n\n/**\n * Age at which the ramp stops binding entirely.\n *\n * Past this the hourly share and the plan are the only ceilings, which is\n * what they were before the ramp existed. Seven days matches the last step's\n * reach and is short enough that it is a warm-up rather than a tier.\n */\nexport const EMAIL_RAMP_GRADUATION_DAYS = 7\n\n/** What the ramp allows a tenant today. */\nexport interface EmailRampVerdict {\n  /** True when the ramp no longer binds and the hourly share is the ceiling. */\n  graduated: boolean\n  /** Campaign messages this tenant may send today. */\n  perDay: number\n  /**\n   * The step as a FRACTION of a graduated day, in `(0, 1]`.\n   *\n   * The same restriction {@link perDay} states, in the form a surface with a\n   * different daily allowance can apply — see the surfaces note in the header\n   * above. 1 when graduated, which is the identity every consumer wants for\n   * an established workspace.\n   */\n  share: number\n  /** Which step it is on, 0-based. Equals the step count when graduated. */\n  step: number\n  /** Days until the next step is reachable on age alone. Null when graduated. */\n  daysToNextStep: number | null\n  /** Human-readable, and the text a surface may show verbatim. */\n  detail: string\n}\n\nexport interface EmailRampInput {\n  /**\n   * Days since the workspace was created. A negative, unreadable or absent\n   * value GRADUATES — see the header for why that direction is the only safe\n   * one.\n   */\n  ageDays: number | null | undefined\n  /** Campaign messages this workspace has delivered, all time. */\n  deliveredLifetime: number\n  /**\n   * The hourly share expressed as a day, which is the ceiling a graduated\n   * tenant has. A ramp step is never allowed to exceed it — a step above the\n   * ceiling underneath it would be a number that can never be reached.\n   */\n  graduatedPerDay: number\n}\n\n/**\n * The daily campaign ceiling for one tenant.\n *\n * Pure and total, like every other ceiling in this library.\n */\nexport function emailRampVerdict(input: EmailRampInput): EmailRampVerdict {\n  const graduatedPerDay = Math.max(1, count(input.graduatedPerDay))\n  const rawAge = Number(input.ageDays)\n  const graduate = (): EmailRampVerdict => ({\n    graduated: true,\n    perDay: graduatedPerDay,\n    share: 1,\n    step: EMAIL_RAMP_STEPS.length,\n    daysToNextStep: null,\n    detail:\n      'This workspace is past its first week of sending, so the new-sender ' +\n      'ramp no longer applies.',\n  })\n  /*\n   * `null` and `undefined` are checked BEFORE the coercion, because\n   * `Number(null)` is 0 — a finite, non-negative number that reads as \"created\n   * today\" and would put every org whose record predates the creation\n   * timestamp onto the first ramp step. The absent case has to be caught as\n   * itself; a numeric guard cannot see it.\n   */\n  if (input.ageDays === null || input.ageDays === undefined) return graduate()\n  if (!Number.isFinite(rawAge) || rawAge < 0) return graduate()\n  const ageDays = Math.floor(rawAge)\n  if (ageDays >= EMAIL_RAMP_GRADUATION_DAYS) return graduate()\n\n  const delivered = count(input.deliveredLifetime)\n  let step = 0\n  for (let index = 1; index < EMAIL_RAMP_STEPS.length; index += 1) {\n    const candidate = EMAIL_RAMP_STEPS[index]\n    if (ageDays >= candidate.minAgeDays && delivered >= candidate.minDelivered) {\n      step = index\n    } else {\n      break\n    }\n  }\n  const next = EMAIL_RAMP_STEPS[step + 1]\n  // Never above the ceiling underneath it: a graduated tenant's day is the\n  // hardest number in this arithmetic, and a ramp step over it would promise\n  // a new tenant more than an established one may send.\n  const perDay = Math.min(graduatedPerDay, EMAIL_RAMP_STEPS[step].perDay)\n  return {\n    graduated: false,\n    perDay,\n    // `graduatedPerDay` is floored at 1 above, so this divides by a positive\n    // number, and `perDay` is the smaller of the two, so it lands in `(0, 1]`.\n    share: perDay / graduatedPerDay,\n    step,\n    daysToNextStep: next ? Math.max(0, next.minAgeDays - ageDays) : null,\n    detail:\n      `This workspace was created ${ageDays === 0 ? 'today' : `${ageDays} ` + `day${ageDays === 1 ? '' : 's'} ago`}, ` +\n      `so it may send ${perDay.toLocaleString()} campaign emails a day while ` +\n      'it establishes a sending history. The rest of a campaign is not lost — ' +\n      'it goes out automatically on the following days.',\n  }\n}\n\n/**\n * A daily allowance, held to the share of it a young workspace has earned.\n *\n * The ramp applied to a surface whose day is a plan figure rather than the\n * graduated campaign ceiling — see the share note in the header. A graduated\n * workspace, and an absent verdict, get the allowance untouched, so a caller\n * that cannot resolve a ramp is not silently throttling anybody.\n *\n * ## The two clamps, and why each is the direction it is\n *\n * FLOORED AT 1 while the allowance is positive, the same reasoning\n * `orgHourlyCampaignCeiling` floors its own share at 1: the first step is a\n * small fraction of a graduated day, and a plan band low enough to round that\n * fraction away must throttle a workspace to a trickle rather than stop it\n * dead. A ceiling of zero on day one is indistinguishable from a plan that\n * carries no one-to-one email at all, and the two have to stay tellable\n * apart.\n *\n * An allowance of ZERO stays zero, because that is not a small band — it is\n * a plan with no allowance, and a ramp that raised it to 1 would sell a\n * feature the tier does not carry. Pacing never grants.\n *\n * An INFINITE allowance stays infinite. It is the sentinel a contract with no\n * ceiling is written as, a share of it is still unbounded, and the clamp\n * below would read the infinity as a corrupt counter and answer zero — a\n * ramp that refused the agreements that buy the most.\n */\nexport function rampedDailyAllowance(\n  allowance: number,\n  ramp: EmailRampVerdict | null | undefined,\n): number {\n  const uncapped = Number(allowance)\n  if (uncapped === Number.POSITIVE_INFINITY) return uncapped\n  const included = count(uncapped)\n  if (included <= 0 || !ramp || ramp.graduated) return included\n  // An unreadable share collapses to the floor rather than to the whole\n  // allowance: a ramp that binds and cannot say by how much owes the\n  // narrowest answer it has, not the widest.\n  const share = Number(ramp.share)\n  const earned = Number.isFinite(share) && share > 0 ? included * share : 0\n  return Math.min(included, Math.max(1, Math.floor(earned)))\n}\n\n/** Days between two instants, floored. Negative inputs read as 0. */\nexport function daysBetween(fromMs: number, toMs: number): number {\n  const from = Number(fromMs)\n  const to = Number(toMs)\n  if (!Number.isFinite(from) || !Number.isFinite(to) || from <= 0) return 0\n  return Math.max(0, Math.floor((to - from) / 86_400_000))\n}\n\n/** The UTC day a timestamp falls in, as `YYYY-MM-DD`. */\nexport function reputationDayKey(atMs: number = Date.now()): string {\n  const value = Number(atMs)\n  const date = new Date(Number.isFinite(value) && value > 0 ? value : Date.now())\n  return date.toISOString().slice(0, 10)\n}\n\n/** The `YYYY-MM-DD` keys of the window ending on `atMs`, oldest first. */\nexport function reputationWindowDayKeys(\n  atMs: number = Date.now(),\n  windowDays: number = EMAIL_REPUTATION_WINDOW_DAYS,\n): string[] {\n  const days = Math.max(1, count(windowDays) || EMAIL_REPUTATION_WINDOW_DAYS)\n  const end = Number(atMs)\n  const at = Number.isFinite(end) && end > 0 ? end : Date.now()\n  const keys: string[] = []\n  for (let offset = days - 1; offset >= 0; offset -= 1) {\n    keys.push(reputationDayKey(at - offset * 86_400_000))\n  }\n  return keys\n}\n"],"names":["EMAIL_REPUTATION_WINDOW_DAYS","EMAIL_REPUTATION_MIN_VOLUME","EMAIL_REPUTATION_MIN_EVENTS","EMAIL_COMPLAINT_RATE_WATCH","EMAIL_COMPLAINT_RATE_TRIP","EMAIL_BOUNCE_RATE_WATCH","EMAIL_BOUNCE_RATE_TRIP","EMAIL_REPUTATION_POLICIES","EMAIL_REPUTATION_DEFAULT_POLICY","normalizeEmailReputationPolicy","raw","value","String","includes","effectiveReputationPolicy","source","configured","count","Math","floor","Number","isFinite","emailReputationRate","events","volume","numerator","denominator","formatReputationRate","rate","toFixed","buildFinding","input","watch","trip","severity","threshold","actionable","code","detail","toLocaleString","noun","emailReputationVerdict","policy","accepted","counts","bounced","complained","windowDays","complaintRate","bounceRate","findings","filter","finding","stopping","now","Date","reinstatedUntilMs","reinstated","base","length","state","blocked","reason","map","join","EMAIL_RAMP_STEPS","minAgeDays","minDelivered","perDay","EMAIL_RAMP_GRADUATION_DAYS","emailRampVerdict","graduatedPerDay","max","rawAge","ageDays","graduate","graduated","share","step","daysToNextStep","undefined","delivered","deliveredLifetime","index","candidate","next","min","rampedDailyAllowance","allowance","ramp","uncapped","POSITIVE_INFINITY","included","earned","daysBetween","fromMs","toMs","from","to","reputationDayKey","atMs","date","toISOString","slice","reputationWindowDayKeys","days","end","at","keys","offset","push"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+DC,GAED,6CAA6C,GAC7C,OAAO,MAAMA,+BAA+B,EAAC;AAE7C;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8B,IAAG;AAE9C,6DAA6D,GAC7D,OAAO,MAAMC,8BAA8B,EAAC;AAE5C,6CAA6C,GAC7C,OAAO,MAAMC,6BAA6B,MAAK;AAE/C,2CAA2C,GAC3C,OAAO,MAAMC,4BAA4B,MAAK;AAE9C,sCAAsC,GACtC,OAAO,MAAMC,0BAA0B,KAAI;AAE3C,uCAAuC,GACvC,OAAO,MAAMC,yBAAyB,IAAG;AAiBzC,OAAO,MAAMC,4BAA8D;IACzE;IACA;IACA;CACD,CAAA;AAED,oDAAoD,GACpD,OAAO,MAAMC,kCAAyD,WAAU;AAEhF;;;;;;CAMC,GACD,OAAO,SAASC,+BACdC,GAAY;IAEZ,MAAMC,QAAQC,OAAOF,cAAAA,MAAO;IAC5B,OAAO,AAACH,0BAAgDM,QAAQ,CAACF,SAC5DA,QACDH;AACN;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GACD,OAAO,SAASM,0BACdC,MAAiC,EACjCC,UAAmB;IAEnB,IAAID,WAAW,UAAU,OAAO;IAChC,OAAON,+BAA+BO;AACxC;AA8EA,6EAA6E,GAC7E,SAASC,MAAMP,GAAY;IACzB,MAAMC,QAAQO,KAAKC,KAAK,CAACC,OAAOV;IAChC,OAAOU,OAAOC,QAAQ,CAACV,UAAUA,QAAQ,IAAIA,QAAQ;AACvD;AAEA,0DAA0D,GAC1D,OAAO,SAASW,oBAAoBC,MAAc,EAAEC,MAAc;IAChE,MAAMC,YAAYR,MAAMM;IACxB,MAAMG,cAAcT,MAAMO;IAC1B,OAAOE,cAAc,IAAID,YAAYC,cAAc;AACrD;AAEA,gEAAgE,GAChE,OAAO,SAASC,qBAAqBC,IAAY;IAC/C,MAAMjB,QAAQS,OAAOQ;IACrB,IAAI,CAACR,OAAOC,QAAQ,CAACV,UAAUA,SAAS,GAAG,OAAO;IAClD,OAAO,GAAG,AAACA,CAAAA,QAAQ,GAAE,EAAGkB,OAAO,CAAC,GAAG,CAAC,CAAC;AACvC;AAEA,SAASC,aAAaC,KAQrB;IACC,MAAM,EAAEH,IAAI,EAAEL,MAAM,EAAEC,MAAM,EAAEQ,KAAK,EAAEC,IAAI,EAAE,GAAGF;IAC9C,IAAIH,OAAOI,OAAO,OAAO;IACzB,MAAME,WAAoCN,QAAQK,OAAO,SAAS;IAClE,MAAME,YAAYD,aAAa,SAASD,OAAOD;IAC/C,MAAMI,aACJZ,UAAUvB,+BAA+BsB,UAAUrB;IACrD,OAAO;QACLmC,MAAMN,MAAMM,IAAI;QAChBH;QACAN;QACAO;QACAZ;QACAC;QACAY;QACAE,QACE,GAAGf,OAAOgB,cAAc,GAAG,CAAC,EAAER,MAAMS,IAAI,CAAC,IAAI,CAAC,GAC9C,GAAGhB,OAAOe,cAAc,GAAG,aAAa,EAAEZ,qBAAqBC,MAAM,EAAE,CAAC,GACxE,CAAC,mBAAmB,EAAED,qBAAqBQ,YAAY,GACtDC,CAAAA,aACG,MACA,iEACA,qBAAoB;IAC5B;AACF;AAaA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASK,uBACdV,KAAkC;QAuCfA,YACcA;QArCVA,eACDA,gBACGA;IAHzB,MAAMW,SAASjC,+BAA+BsB,MAAMW,MAAM;IAC1D,MAAMC,WAAW1B,OAAMc,gBAAAA,MAAMa,MAAM,qBAAZb,cAAcY,QAAQ;IAC7C,MAAME,UAAU5B,OAAMc,iBAAAA,MAAMa,MAAM,qBAAZb,eAAcc,OAAO;IAC3C,MAAMC,aAAa7B,OAAMc,iBAAAA,MAAMa,MAAM,qBAAZb,eAAce,UAAU;IACjD,MAAMC,aAAa9B,MAAMc,MAAMgB,UAAU,KAAK/C;IAC9C,MAAMgD,gBAAgB1B,oBAAoBwB,YAAYH;IACtD,MAAMM,aAAa3B,oBAAoBuB,SAASF;IAEhD,MAAMO,WAAW;QACfpB,aAAa;YACXO,MAAM;YACNT,MAAMoB;YACNzB,QAAQuB;YACRtB,QAAQmB;YACRX,OAAO7B;YACP8B,MAAM7B;YACNoC,MAAM;QACR;QACAV,aAAa;YACXO,MAAM;YACNT,MAAMqB;YACN1B,QAAQsB;YACRrB,QAAQmB;YACRX,OAAO3B;YACP4B,MAAM3B;YACNkC,MAAM;QACR;KACD,CAACW,MAAM,CAAC,CAACC,UAA+CA,YAAY;IAErE,MAAMhB,aAAac,SAASC,MAAM,CAAC,CAACC,UAAYA,QAAQhB,UAAU;IAClE,MAAMiB,WACJX,WAAW,SACP,EAAE,GACFA,WAAW,WACTN,aACAA,WAAWe,MAAM,CAAC,CAACC,UAAYA,QAAQlB,QAAQ,KAAK;IAE5D,MAAMoB,MAAMlC,QAAOW,aAAAA,MAAMuB,GAAG,YAATvB,aAAawB,KAAKD,GAAG;IACxC,MAAME,oBAAoBpC,QAAOW,2BAAAA,MAAMyB,iBAAiB,YAAvBzB,2BAA2B;IAC5D,MAAM0B,aACJrC,OAAOC,QAAQ,CAACmC,sBAAsBA,oBAAoBF,MACtDpC,KAAKC,KAAK,CAACqC,qBACX;IAEN,MAAME,OAAO;QACXhB;QACAM;QACAC;QACAzB,QAAQmB;QACRI;QACAG;IACF;IAEA,IAAIG,SAASM,MAAM,IAAIF,eAAe,MAAM;QAC1C,OAAO,aACFC;YACHE,OAAO;YACPC,SAAS;YACTC,QAAQ;YACRN,mBAAmBC;;IAEvB;IACA,IAAIJ,SAASM,MAAM,EAAE;QACnB,OAAO,aACFD;YACHE,OAAO;YACPC,SAAS;YACTC,QACE,uEACA,CAAC,qBAAqB,EAAEf,WAAW,2BAA2B,CAAC,GAC/D,CAAC,4BAA4B,EAAEM,SAC5BU,GAAG,CAAC,CAACX,UAAYA,QAAQd,MAAM,EAC/B0B,IAAI,CAAC,KAAK,mDAAmD,CAAC,GACjE,uEACA,kEACA,yBACA,GAAGjB,WAAW,+CAA+C,CAAC,GAC9D;YACFS,mBAAmB;;IAEvB;IACA,OAAO,aACFE;QACHE,OAAOxB,WAAWuB,MAAM,GAAG,UAAU;QACrCE,SAAS;QACTC,QAAQ;QACRN,mBAAmBC;;AAEvB;AA0EA;;;;;;;;CAQC,GACD,OAAO,MAAMQ,mBAA6C;IACxD;QAAEC,YAAY;QAAGC,cAAc;QAAGC,QAAQ;IAAI;IAC9C;QAAEF,YAAY;QAAGC,cAAc;QAAKC,QAAQ;IAAM;IAClD;QAAEF,YAAY;QAAGC,cAAc;QAAKC,QAAQ;IAAM;CACnD,CAAA;AAED;;;;;;CAMC,GACD,OAAO,MAAMC,6BAA6B,EAAC;AA0C3C;;;;CAIC,GACD,OAAO,SAASC,iBAAiBvC,KAAqB;IACpD,MAAMwC,kBAAkBrD,KAAKsD,GAAG,CAAC,GAAGvD,MAAMc,MAAMwC,eAAe;IAC/D,MAAME,SAASrD,OAAOW,MAAM2C,OAAO;IACnC,MAAMC,WAAW,IAAyB,CAAA;YACxCC,WAAW;YACXR,QAAQG;YACRM,OAAO;YACPC,MAAMb,iBAAiBN,MAAM;YAC7BoB,gBAAgB;YAChBzC,QACE,yEACA;QACJ,CAAA;IACA;;;;;;GAMC,GACD,IAAIP,MAAM2C,OAAO,KAAK,QAAQ3C,MAAM2C,OAAO,KAAKM,WAAW,OAAOL;IAClE,IAAI,CAACvD,OAAOC,QAAQ,CAACoD,WAAWA,SAAS,GAAG,OAAOE;IACnD,MAAMD,UAAUxD,KAAKC,KAAK,CAACsD;IAC3B,IAAIC,WAAWL,4BAA4B,OAAOM;IAElD,MAAMM,YAAYhE,MAAMc,MAAMmD,iBAAiB;IAC/C,IAAIJ,OAAO;IACX,IAAK,IAAIK,QAAQ,GAAGA,QAAQlB,iBAAiBN,MAAM,EAAEwB,SAAS,EAAG;QAC/D,MAAMC,YAAYnB,gBAAgB,CAACkB,MAAM;QACzC,IAAIT,WAAWU,UAAUlB,UAAU,IAAIe,aAAaG,UAAUjB,YAAY,EAAE;YAC1EW,OAAOK;QACT,OAAO;YACL;QACF;IACF;IACA,MAAME,OAAOpB,gBAAgB,CAACa,OAAO,EAAE;IACvC,yEAAyE;IACzE,2EAA2E;IAC3E,sDAAsD;IACtD,MAAMV,SAASlD,KAAKoE,GAAG,CAACf,iBAAiBN,gBAAgB,CAACa,KAAK,CAACV,MAAM;IACtE,OAAO;QACLQ,WAAW;QACXR;QACA,yEAAyE;QACzE,2EAA2E;QAC3ES,OAAOT,SAASG;QAChBO;QACAC,gBAAgBM,OAAOnE,KAAKsD,GAAG,CAAC,GAAGa,KAAKnB,UAAU,GAAGQ,WAAW;QAChEpC,QACE,CAAC,2BAA2B,EAAEoC,YAAY,IAAI,UAAU,GAAGA,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,EAAEA,YAAY,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,GAChH,CAAC,eAAe,EAAEN,OAAO7B,cAAc,GAAG,6BAA6B,CAAC,GACxE,4EACA;IACJ;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,SAASgD,qBACdC,SAAiB,EACjBC,IAAyC;IAEzC,MAAMC,WAAWtE,OAAOoE;IACxB,IAAIE,aAAatE,OAAOuE,iBAAiB,EAAE,OAAOD;IAClD,MAAME,WAAW3E,MAAMyE;IACvB,IAAIE,YAAY,KAAK,CAACH,QAAQA,KAAKb,SAAS,EAAE,OAAOgB;IACrD,sEAAsE;IACtE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAMf,QAAQzD,OAAOqE,KAAKZ,KAAK;IAC/B,MAAMgB,SAASzE,OAAOC,QAAQ,CAACwD,UAAUA,QAAQ,IAAIe,WAAWf,QAAQ;IACxE,OAAO3D,KAAKoE,GAAG,CAACM,UAAU1E,KAAKsD,GAAG,CAAC,GAAGtD,KAAKC,KAAK,CAAC0E;AACnD;AAEA,mEAAmE,GACnE,OAAO,SAASC,YAAYC,MAAc,EAAEC,IAAY;IACtD,MAAMC,OAAO7E,OAAO2E;IACpB,MAAMG,KAAK9E,OAAO4E;IAClB,IAAI,CAAC5E,OAAOC,QAAQ,CAAC4E,SAAS,CAAC7E,OAAOC,QAAQ,CAAC6E,OAAOD,QAAQ,GAAG,OAAO;IACxE,OAAO/E,KAAKsD,GAAG,CAAC,GAAGtD,KAAKC,KAAK,CAAC,AAAC+E,CAAAA,KAAKD,IAAG,IAAK;AAC9C;AAEA,uDAAuD,GACvD,OAAO,SAASE,iBAAiBC,OAAe7C,KAAKD,GAAG,EAAE;IACxD,MAAM3C,QAAQS,OAAOgF;IACrB,MAAMC,OAAO,IAAI9C,KAAKnC,OAAOC,QAAQ,CAACV,UAAUA,QAAQ,IAAIA,QAAQ4C,KAAKD,GAAG;IAC5E,OAAO+C,KAAKC,WAAW,GAAGC,KAAK,CAAC,GAAG;AACrC;AAEA,wEAAwE,GACxE,OAAO,SAASC,wBACdJ,OAAe7C,KAAKD,GAAG,EAAE,EACzBP,aAAqB/C,4BAA4B;IAEjD,MAAMyG,OAAOvF,KAAKsD,GAAG,CAAC,GAAGvD,MAAM8B,eAAe/C;IAC9C,MAAM0G,MAAMtF,OAAOgF;IACnB,MAAMO,KAAKvF,OAAOC,QAAQ,CAACqF,QAAQA,MAAM,IAAIA,MAAMnD,KAAKD,GAAG;IAC3D,MAAMsD,OAAiB,EAAE;IACzB,IAAK,IAAIC,SAASJ,OAAO,GAAGI,UAAU,GAAGA,UAAU,EAAG;QACpDD,KAAKE,IAAI,CAACX,iBAAiBQ,KAAKE,SAAS;IAC3C;IACA,OAAOD;AACT"}