@aglyn/shared-util-email 1.0.0-beta.221 → 1.0.0-beta.222

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/shared-util-email",
-  "version": "1.0.0-beta.221",
+  "version": "1.0.0-beta.222",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,8 +25,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/shared-data-enums": "1.0.0-beta.221",
-    "@aglyn/shared-util-http": "1.0.0-beta.221",
+    "@aglyn/shared-data-enums": "1.0.0-beta.222",
+    "@aglyn/shared-util-http": "1.0.0-beta.222",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23"
   },

package/src/lib/email-media-src.d.ts

@@ -14,7 +14,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-/** Mirrors `resolveMediaSrc`. */
+/**
+ * Mirrors `resolveMediaSrc`, including its routing of a library object's
+ * Storage download URL through the CDN (AGL-3506) — an inbox is a visitor
+ * too, and its bytes count and stop like a page's.
+ */
 export declare function resolveEmailMediaSrc(value: string | undefined | null, hostId?: string | null): string | undefined;
 /**
  * Mirrors `hostPublicOrigin` — now including the part that was configurable

package/src/lib/email-media-src.js

@@ -59,10 +59,56 @@ const ORG_SCOPE_PREFIX = 'org:';
     if (!orgId || !SEGMENT.test(orgId)) return scope;
     return `${ORG_SCOPE_PREFIX}${orgId}:${hostId}`;
 }
-/** Mirrors `resolveMediaSrc`. */ export function resolveEmailMediaSrc(value, hostId) {
+/** Mirrors `MEDIA_POSTER_OBJECT_SUFFIX`. */ const MEDIA_POSTER_OBJECT_SUFFIX = '__poster';
+/** Mirrors `STORAGE_DOWNLOAD_HOST`. */ const STORAGE_DOWNLOAD_HOST = 'firebasestorage.googleapis.com';
+/** Mirrors `storageEmulatorHost`. */ function storageEmulatorHost() {
+    var _process_env;
+    const env = typeof process === 'undefined' ? undefined : (_process_env = process.env) == null ? void 0 : _process_env['FIREBASE_STORAGE_EMULATOR_HOST'];
+    return String(env != null ? env : '').trim().toLowerCase();
+}
+/**
+ * Mirrors `mediaRefFromStorageUrl` and the `mediaAssetOfObjectKey` grammar
+ * it reads the key with (AGL-3506): the `media:` reference a Storage
+ * download URL for a library object names, or undefined.
+ */ function mediaRefOfStorageUrl(value) {
+    if (!value.includes('/v0/b/')) return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    } catch (unused) {
+        return undefined;
+    }
+    const emulator = storageEmulatorHost();
+    if (url.hostname.toLowerCase() !== STORAGE_DOWNLOAD_HOST && !(emulator && url.host.toLowerCase() === emulator)) {
+        return undefined;
+    }
+    const match = /^\/v0\/b\/[^/]+\/o\/([^/]+)$/.exec(url.pathname);
+    if (!match) return undefined;
+    let objectPath;
+    try {
+        objectPath = decodeURIComponent(match[1]);
+    } catch (unused) {
+        return undefined;
+    }
+    const segments = objectPath.split('/');
+    if (segments.length < 4 || segments[2] !== 'media') return undefined;
+    if (segments.some((segment)=>!segment || segment === '..')) return undefined;
+    const [root, scopeId] = segments;
+    const scope = root === 'hosts' ? scopeId : root === 'orgs' ? `${ORG_SCOPE_PREFIX}${scopeId}` : null;
+    const leaf = segments[segments.length - 1];
+    if (!scope || leaf.endsWith(MEDIA_POSTER_OBJECT_SUFFIX)) return undefined;
+    if (!isCdnScope(scope) || !SEGMENT.test(leaf)) return undefined;
+    return `${MEDIA_REF_PREFIX}${scope}/${leaf}`;
+}
+/**
+ * Mirrors `resolveMediaSrc`, including its routing of a library object's
+ * Storage download URL through the CDN (AGL-3506) — an inbox is a visitor
+ * too, and its bytes count and stop like a page's.
+ */ export function resolveEmailMediaSrc(value, hostId) {
     if (!value) return undefined;
-    if (!value.startsWith(MEDIA_REF_PREFIX)) return value;
-    const rest = value.slice(MEDIA_REF_PREFIX.length);
+    const stored = value.startsWith(MEDIA_REF_PREFIX) ? value : mediaRefOfStorageUrl(value);
+    if (!stored) return value;
+    const rest = stored.slice(MEDIA_REF_PREFIX.length);
     // The scope may contain ':' but never '/', so the FIRST slash is the
     // boundary and the media id is everything after it.
     const slash = rest.indexOf('/');

package/src/lib/email-media-src.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/email-media-src.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Absolute image URLs for email (AGL-1224).\n *\n * ## Why this is a mirror rather than an import\n *\n * The authority is `resolveMediaSrc` / `hostPublicOrigin` in\n * `libs/aglyn/src/lib/app-utils/` and this file must not diverge from it. It\n * cannot import it: `shared-util-email` is tagged `scope:shared`, and the\n * module-boundary rule makes shared libs LEAVES — `scope:shared` may depend\n * only on `scope:shared`, while `scope:aglyn` and `aglyn:framework` may depend\n * on shared. The arrow points one way on purpose, so that every send site can\n * import this renderer without dragging the framework in behind it.\n *\n * The same file already solves the same problem the same way: see\n * `EMAIL_NODE_ROOT_ID` in `./email-render`, a copy of the besigner's\n * `CANVAS_ROOT_ELEMENT_ID` held here with a drift guard in the console specs.\n * So: copy, name it a copy, and PIN it —\n * `apps/console/specs/email-media-src-drift.spec.ts` runs both implementations\n * over a shared table of inputs and fails if they ever disagree. That spec\n * lives in the console because the console is allowed to import both.\n *\n * ## What it does\n *\n * A picked image is stored as `media:{scope}/{mediaId}`, optionally with a\n * content pin (`@{contentHash}`, AGL-2685), and resolves to the SITE-RELATIVE\n * path `/api/media/cdn/{scope}/{mediaId}`. A browser has a page\n * to resolve that against; an inbox does not. So the reference is resolved and\n * then prefixed with the origin of whichever host is sending.\n */\n\nconst MEDIA_REF_PREFIX = 'media:'\nconst MEDIA_REF_HASH_SEPARATOR = '@'\nconst MEDIA_CDN_ROUTE = '/api/media/cdn'\nconst ORG_SCOPE_PREFIX = 'org:'\n/** Mirrors `SEGMENT` in media-ref.ts, which mirrors the CDN's own grammar. */\nconst SEGMENT = /^[A-Za-z0-9_-]{1,64}$/\n\n/** Mirrors `isMediaCdnScope`. */\nfunction isCdnScope(scope: string): boolean {\n  if (!scope.startsWith(ORG_SCOPE_PREFIX)) return SEGMENT.test(scope)\n  const parts = scope.slice(ORG_SCOPE_PREFIX.length).split(':')\n  if (parts.length < 1 || parts.length > 2) return false\n  return parts.every((part) => SEGMENT.test(part))\n}\n\n/** Mirrors `hostQualifiedScope`. */\nfunction hostQualified(scope: string, hostId: string | undefined | null) {\n  if (!hostId || !SEGMENT.test(hostId)) return scope\n  if (!scope.startsWith(ORG_SCOPE_PREFIX)) return scope\n  const orgId = scope.slice(ORG_SCOPE_PREFIX.length).split(':')[0]\n  if (!orgId || !SEGMENT.test(orgId)) return scope\n  return `${ORG_SCOPE_PREFIX}${orgId}:${hostId}`\n}\n\n/** Mirrors `resolveMediaSrc`. */\nexport function resolveEmailMediaSrc(\n  value: string | undefined | null,\n  hostId?: string | null,\n): string | undefined {\n  if (!value) return undefined\n  if (!value.startsWith(MEDIA_REF_PREFIX)) return value\n  const rest = value.slice(MEDIA_REF_PREFIX.length)\n  // The scope may contain ':' but never '/', so the FIRST slash is the\n  // boundary and the media id is everything after it.\n  const slash = rest.indexOf('/')\n  if (slash <= 0) return undefined\n  const scope = rest.slice(0, slash)\n  // A reference may carry a content pin, `…/{mediaId}@{contentHash}`\n  // (AGL-2685). Neither half can contain '@', so the first one is the\n  // boundary, and the pin itself names no URL.\n  const tail = rest.slice(slash + 1)\n  const at = tail.indexOf(MEDIA_REF_HASH_SEPARATOR)\n  const mediaId = at === -1 ? tail : tail.slice(0, at)\n  if (!isCdnScope(scope) || !SEGMENT.test(mediaId)) return undefined\n  // The stable URL, pinned or not (AGL-2798). An inbox is the consumer that\n  // can least be re-rendered, which makes it the last place to hand a URL\n  // whose year-long `immutable` response no replace can reach.\n  return `${MEDIA_CDN_ROUTE}/${hostQualified(scope, hostId)}/${mediaId}`\n}\n\n/**\n * The tenant apex, mirroring `TENANT_APEX` (AGL-2195).\n *\n * NOT an import of it, and the reason is a lint rule rather than taste:\n * `shared-util-email` is tagged `scope:shared`, `@aglyn/aglyn` is not, and\n * `@nx/enforce-module-boundaries` refuses the edge. So the copy is structural.\n * What keeps it honest is `apps/console/specs/email-media-src-drift.spec.ts`,\n * which lives in a project that CAN see both and asserts the two agree —\n * including under a configured apex.\n *\n * The expression is byte-for-byte `TENANT_APEX`'s, trim included: a mirror\n * that normalised differently would disagree only on the malformed inputs\n * nobody writes a test for.\n */\nconst TENANT_APEX =\n  (process.env.NEXT_PUBLIC_TENANT_DOMAIN || '').trim() || 'aglyn.app'\n\n/**\n * Mirrors `hostPublicOrigin` — now including the part that was configurable\n * (AGL-2195).\n *\n * The docblock said \"mirrors\" while the body wrote `aglyn.app` in flat, so\n * every absolute link and image `src` in an email a self-hosted deployment\n * sent pointed at Aglyn's apex. An email is the sharpest place to get this\n * wrong: the URL leaves the deployment and is clicked days later from an\n * inbox, where nothing can rewrite it.\n *\n */\nexport function hostEmailOrigin(\n  host: { cname?: string | null; subdomain?: string | null } | null | undefined,\n): string | undefined {\n  if (host?.cname) return `https://${host.cname}`\n  if (host?.subdomain) return `https://${host.subdomain}.${TENANT_APEX}`\n  return undefined\n}\n"],"names":["MEDIA_REF_PREFIX","MEDIA_REF_HASH_SEPARATOR","MEDIA_CDN_ROUTE","ORG_SCOPE_PREFIX","SEGMENT","isCdnScope","scope","startsWith","test","parts","slice","length","split","every","part","hostQualified","hostId","orgId","resolveEmailMediaSrc","value","undefined","rest","slash","indexOf","tail","at","mediaId","TENANT_APEX","process","env","NEXT_PUBLIC_TENANT_DOMAIN","trim","hostEmailOrigin","host","cname","subdomain"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GAED,MAAMA,mBAAmB;AACzB,MAAMC,2BAA2B;AACjC,MAAMC,kBAAkB;AACxB,MAAMC,mBAAmB;AACzB,4EAA4E,GAC5E,MAAMC,UAAU;AAEhB,+BAA+B,GAC/B,SAASC,WAAWC,KAAa;IAC/B,IAAI,CAACA,MAAMC,UAAU,CAACJ,mBAAmB,OAAOC,QAAQI,IAAI,CAACF;IAC7D,MAAMG,QAAQH,MAAMI,KAAK,CAACP,iBAAiBQ,MAAM,EAAEC,KAAK,CAAC;IACzD,IAAIH,MAAME,MAAM,GAAG,KAAKF,MAAME,MAAM,GAAG,GAAG,OAAO;IACjD,OAAOF,MAAMI,KAAK,CAAC,CAACC,OAASV,QAAQI,IAAI,CAACM;AAC5C;AAEA,kCAAkC,GAClC,SAASC,cAAcT,KAAa,EAAEU,MAAiC;IACrE,IAAI,CAACA,UAAU,CAACZ,QAAQI,IAAI,CAACQ,SAAS,OAAOV;IAC7C,IAAI,CAACA,MAAMC,UAAU,CAACJ,mBAAmB,OAAOG;IAChD,MAAMW,QAAQX,MAAMI,KAAK,CAACP,iBAAiBQ,MAAM,EAAEC,KAAK,CAAC,IAAI,CAAC,EAAE;IAChE,IAAI,CAACK,SAAS,CAACb,QAAQI,IAAI,CAACS,QAAQ,OAAOX;IAC3C,OAAO,GAAGH,mBAAmBc,MAAM,CAAC,EAAED,QAAQ;AAChD;AAEA,+BAA+B,GAC/B,OAAO,SAASE,qBACdC,KAAgC,EAChCH,MAAsB;IAEtB,IAAI,CAACG,OAAO,OAAOC;IACnB,IAAI,CAACD,MAAMZ,UAAU,CAACP,mBAAmB,OAAOmB;IAChD,MAAME,OAAOF,MAAMT,KAAK,CAACV,iBAAiBW,MAAM;IAChD,qEAAqE;IACrE,oDAAoD;IACpD,MAAMW,QAAQD,KAAKE,OAAO,CAAC;IAC3B,IAAID,SAAS,GAAG,OAAOF;IACvB,MAAMd,QAAQe,KAAKX,KAAK,CAAC,GAAGY;IAC5B,mEAAmE;IACnE,oEAAoE;IACpE,6CAA6C;IAC7C,MAAME,OAAOH,KAAKX,KAAK,CAACY,QAAQ;IAChC,MAAMG,KAAKD,KAAKD,OAAO,CAACtB;IACxB,MAAMyB,UAAUD,OAAO,CAAC,IAAID,OAAOA,KAAKd,KAAK,CAAC,GAAGe;IACjD,IAAI,CAACpB,WAAWC,UAAU,CAACF,QAAQI,IAAI,CAACkB,UAAU,OAAON;IACzD,0EAA0E;IAC1E,wEAAwE;IACxE,6DAA6D;IAC7D,OAAO,GAAGlB,gBAAgB,CAAC,EAAEa,cAAcT,OAAOU,QAAQ,CAAC,EAAEU,SAAS;AACxE;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAMC,cACJ,AAACC,CAAAA,QAAQC,GAAG,CAACC,yBAAyB,IAAI,EAAC,EAAGC,IAAI,MAAM;AAE1D;;;;;;;;;;CAUC,GACD,OAAO,SAASC,gBACdC,IAA6E;IAE7E,IAAIA,wBAAAA,KAAMC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAED,KAAKC,KAAK,EAAE;IAC/C,IAAID,wBAAAA,KAAME,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAEF,KAAKE,SAAS,CAAC,CAAC,EAAER,aAAa;IACtE,OAAOP;AACT"}
+{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/email-media-src.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Absolute image URLs for email (AGL-1224).\n *\n * ## Why this is a mirror rather than an import\n *\n * The authority is `resolveMediaSrc` / `hostPublicOrigin` in\n * `libs/aglyn/src/lib/app-utils/` and this file must not diverge from it. It\n * cannot import it: `shared-util-email` is tagged `scope:shared`, and the\n * module-boundary rule makes shared libs LEAVES — `scope:shared` may depend\n * only on `scope:shared`, while `scope:aglyn` and `aglyn:framework` may depend\n * on shared. The arrow points one way on purpose, so that every send site can\n * import this renderer without dragging the framework in behind it.\n *\n * The same file already solves the same problem the same way: see\n * `EMAIL_NODE_ROOT_ID` in `./email-render`, a copy of the besigner's\n * `CANVAS_ROOT_ELEMENT_ID` held here with a drift guard in the console specs.\n * So: copy, name it a copy, and PIN it —\n * `apps/console/specs/email-media-src-drift.spec.ts` runs both implementations\n * over a shared table of inputs and fails if they ever disagree. That spec\n * lives in the console because the console is allowed to import both.\n *\n * ## What it does\n *\n * A picked image is stored as `media:{scope}/{mediaId}`, optionally with a\n * content pin (`@{contentHash}`, AGL-2685), and resolves to the SITE-RELATIVE\n * path `/api/media/cdn/{scope}/{mediaId}`. A browser has a page\n * to resolve that against; an inbox does not. So the reference is resolved and\n * then prefixed with the origin of whichever host is sending.\n */\n\nconst MEDIA_REF_PREFIX = 'media:'\nconst MEDIA_REF_HASH_SEPARATOR = '@'\nconst MEDIA_CDN_ROUTE = '/api/media/cdn'\nconst ORG_SCOPE_PREFIX = 'org:'\n/** Mirrors `SEGMENT` in media-ref.ts, which mirrors the CDN's own grammar. */\nconst SEGMENT = /^[A-Za-z0-9_-]{1,64}$/\n\n/** Mirrors `isMediaCdnScope`. */\nfunction isCdnScope(scope: string): boolean {\n  if (!scope.startsWith(ORG_SCOPE_PREFIX)) return SEGMENT.test(scope)\n  const parts = scope.slice(ORG_SCOPE_PREFIX.length).split(':')\n  if (parts.length < 1 || parts.length > 2) return false\n  return parts.every((part) => SEGMENT.test(part))\n}\n\n/** Mirrors `hostQualifiedScope`. */\nfunction hostQualified(scope: string, hostId: string | undefined | null) {\n  if (!hostId || !SEGMENT.test(hostId)) return scope\n  if (!scope.startsWith(ORG_SCOPE_PREFIX)) return scope\n  const orgId = scope.slice(ORG_SCOPE_PREFIX.length).split(':')[0]\n  if (!orgId || !SEGMENT.test(orgId)) return scope\n  return `${ORG_SCOPE_PREFIX}${orgId}:${hostId}`\n}\n\n/** Mirrors `MEDIA_POSTER_OBJECT_SUFFIX`. */\nconst MEDIA_POSTER_OBJECT_SUFFIX = '__poster'\n/** Mirrors `STORAGE_DOWNLOAD_HOST`. */\nconst STORAGE_DOWNLOAD_HOST = 'firebasestorage.googleapis.com'\n\n/** Mirrors `storageEmulatorHost`. */\nfunction storageEmulatorHost(): string {\n  const env =\n    typeof process === 'undefined'\n      ? undefined\n      : process.env?.['FIREBASE_STORAGE_EMULATOR_HOST']\n  return String(env ?? '')\n    .trim()\n    .toLowerCase()\n}\n\n/**\n * Mirrors `mediaRefFromStorageUrl` and the `mediaAssetOfObjectKey` grammar\n * it reads the key with (AGL-3506): the `media:` reference a Storage\n * download URL for a library object names, or undefined.\n */\nfunction mediaRefOfStorageUrl(value: string): string | undefined {\n  if (!value.includes('/v0/b/')) return undefined\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch {\n    return undefined\n  }\n  const emulator = storageEmulatorHost()\n  if (\n    url.hostname.toLowerCase() !== STORAGE_DOWNLOAD_HOST &&\n    !(emulator && url.host.toLowerCase() === emulator)\n  ) {\n    return undefined\n  }\n  const match = /^\\/v0\\/b\\/[^/]+\\/o\\/([^/]+)$/.exec(url.pathname)\n  if (!match) return undefined\n  let objectPath: string\n  try {\n    objectPath = decodeURIComponent(match[1])\n  } catch {\n    return undefined\n  }\n  const segments = objectPath.split('/')\n  if (segments.length < 4 || segments[2] !== 'media') return undefined\n  if (segments.some((segment) => !segment || segment === '..')) return undefined\n  const [root, scopeId] = segments\n  const scope =\n    root === 'hosts' ? scopeId : root === 'orgs' ? `${ORG_SCOPE_PREFIX}${scopeId}` : null\n  const leaf = segments[segments.length - 1]\n  if (!scope || leaf.endsWith(MEDIA_POSTER_OBJECT_SUFFIX)) return undefined\n  if (!isCdnScope(scope) || !SEGMENT.test(leaf)) return undefined\n  return `${MEDIA_REF_PREFIX}${scope}/${leaf}`\n}\n\n/**\n * Mirrors `resolveMediaSrc`, including its routing of a library object's\n * Storage download URL through the CDN (AGL-3506) — an inbox is a visitor\n * too, and its bytes count and stop like a page's.\n */\nexport function resolveEmailMediaSrc(\n  value: string | undefined | null,\n  hostId?: string | null,\n): string | undefined {\n  if (!value) return undefined\n  const stored = value.startsWith(MEDIA_REF_PREFIX)\n    ? value\n    : mediaRefOfStorageUrl(value)\n  if (!stored) return value\n  const rest = stored.slice(MEDIA_REF_PREFIX.length)\n  // The scope may contain ':' but never '/', so the FIRST slash is the\n  // boundary and the media id is everything after it.\n  const slash = rest.indexOf('/')\n  if (slash <= 0) return undefined\n  const scope = rest.slice(0, slash)\n  // A reference may carry a content pin, `…/{mediaId}@{contentHash}`\n  // (AGL-2685). Neither half can contain '@', so the first one is the\n  // boundary, and the pin itself names no URL.\n  const tail = rest.slice(slash + 1)\n  const at = tail.indexOf(MEDIA_REF_HASH_SEPARATOR)\n  const mediaId = at === -1 ? tail : tail.slice(0, at)\n  if (!isCdnScope(scope) || !SEGMENT.test(mediaId)) return undefined\n  // The stable URL, pinned or not (AGL-2798). An inbox is the consumer that\n  // can least be re-rendered, which makes it the last place to hand a URL\n  // whose year-long `immutable` response no replace can reach.\n  return `${MEDIA_CDN_ROUTE}/${hostQualified(scope, hostId)}/${mediaId}`\n}\n\n/**\n * The tenant apex, mirroring `TENANT_APEX` (AGL-2195).\n *\n * NOT an import of it, and the reason is a lint rule rather than taste:\n * `shared-util-email` is tagged `scope:shared`, `@aglyn/aglyn` is not, and\n * `@nx/enforce-module-boundaries` refuses the edge. So the copy is structural.\n * What keeps it honest is `apps/console/specs/email-media-src-drift.spec.ts`,\n * which lives in a project that CAN see both and asserts the two agree —\n * including under a configured apex.\n *\n * The expression is byte-for-byte `TENANT_APEX`'s, trim included: a mirror\n * that normalised differently would disagree only on the malformed inputs\n * nobody writes a test for.\n */\nconst TENANT_APEX =\n  (process.env.NEXT_PUBLIC_TENANT_DOMAIN || '').trim() || 'aglyn.app'\n\n/**\n * Mirrors `hostPublicOrigin` — now including the part that was configurable\n * (AGL-2195).\n *\n * The docblock said \"mirrors\" while the body wrote `aglyn.app` in flat, so\n * every absolute link and image `src` in an email a self-hosted deployment\n * sent pointed at Aglyn's apex. An email is the sharpest place to get this\n * wrong: the URL leaves the deployment and is clicked days later from an\n * inbox, where nothing can rewrite it.\n *\n */\nexport function hostEmailOrigin(\n  host: { cname?: string | null; subdomain?: string | null } | null | undefined,\n): string | undefined {\n  if (host?.cname) return `https://${host.cname}`\n  if (host?.subdomain) return `https://${host.subdomain}.${TENANT_APEX}`\n  return undefined\n}\n"],"names":["MEDIA_REF_PREFIX","MEDIA_REF_HASH_SEPARATOR","MEDIA_CDN_ROUTE","ORG_SCOPE_PREFIX","SEGMENT","isCdnScope","scope","startsWith","test","parts","slice","length","split","every","part","hostQualified","hostId","orgId","MEDIA_POSTER_OBJECT_SUFFIX","STORAGE_DOWNLOAD_HOST","storageEmulatorHost","process","env","undefined","String","trim","toLowerCase","mediaRefOfStorageUrl","value","includes","url","URL","emulator","hostname","host","match","exec","pathname","objectPath","decodeURIComponent","segments","some","segment","root","scopeId","leaf","endsWith","resolveEmailMediaSrc","stored","rest","slash","indexOf","tail","at","mediaId","TENANT_APEX","NEXT_PUBLIC_TENANT_DOMAIN","hostEmailOrigin","cname","subdomain"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GAED,MAAMA,mBAAmB;AACzB,MAAMC,2BAA2B;AACjC,MAAMC,kBAAkB;AACxB,MAAMC,mBAAmB;AACzB,4EAA4E,GAC5E,MAAMC,UAAU;AAEhB,+BAA+B,GAC/B,SAASC,WAAWC,KAAa;IAC/B,IAAI,CAACA,MAAMC,UAAU,CAACJ,mBAAmB,OAAOC,QAAQI,IAAI,CAACF;IAC7D,MAAMG,QAAQH,MAAMI,KAAK,CAACP,iBAAiBQ,MAAM,EAAEC,KAAK,CAAC;IACzD,IAAIH,MAAME,MAAM,GAAG,KAAKF,MAAME,MAAM,GAAG,GAAG,OAAO;IACjD,OAAOF,MAAMI,KAAK,CAAC,CAACC,OAASV,QAAQI,IAAI,CAACM;AAC5C;AAEA,kCAAkC,GAClC,SAASC,cAAcT,KAAa,EAAEU,MAAiC;IACrE,IAAI,CAACA,UAAU,CAACZ,QAAQI,IAAI,CAACQ,SAAS,OAAOV;IAC7C,IAAI,CAACA,MAAMC,UAAU,CAACJ,mBAAmB,OAAOG;IAChD,MAAMW,QAAQX,MAAMI,KAAK,CAACP,iBAAiBQ,MAAM,EAAEC,KAAK,CAAC,IAAI,CAAC,EAAE;IAChE,IAAI,CAACK,SAAS,CAACb,QAAQI,IAAI,CAACS,QAAQ,OAAOX;IAC3C,OAAO,GAAGH,mBAAmBc,MAAM,CAAC,EAAED,QAAQ;AAChD;AAEA,0CAA0C,GAC1C,MAAME,6BAA6B;AACnC,qCAAqC,GACrC,MAAMC,wBAAwB;AAE9B,mCAAmC,GACnC,SAASC;QAIDC;IAHN,MAAMC,MACJ,OAAOD,YAAY,cACfE,aACAF,eAAAA,QAAQC,GAAG,qBAAXD,YAAa,CAAC,iCAAiC;IACrD,OAAOG,OAAOF,cAAAA,MAAO,IAClBG,IAAI,GACJC,WAAW;AAChB;AAEA;;;;CAIC,GACD,SAASC,qBAAqBC,KAAa;IACzC,IAAI,CAACA,MAAMC,QAAQ,CAAC,WAAW,OAAON;IACtC,IAAIO;IACJ,IAAI;QACFA,MAAM,IAAIC,IAAIH;IAChB,EAAE,eAAM;QACN,OAAOL;IACT;IACA,MAAMS,WAAWZ;IACjB,IACEU,IAAIG,QAAQ,CAACP,WAAW,OAAOP,yBAC/B,CAAEa,CAAAA,YAAYF,IAAII,IAAI,CAACR,WAAW,OAAOM,QAAO,GAChD;QACA,OAAOT;IACT;IACA,MAAMY,QAAQ,+BAA+BC,IAAI,CAACN,IAAIO,QAAQ;IAC9D,IAAI,CAACF,OAAO,OAAOZ;IACnB,IAAIe;IACJ,IAAI;QACFA,aAAaC,mBAAmBJ,KAAK,CAAC,EAAE;IAC1C,EAAE,eAAM;QACN,OAAOZ;IACT;IACA,MAAMiB,WAAWF,WAAW1B,KAAK,CAAC;IAClC,IAAI4B,SAAS7B,MAAM,GAAG,KAAK6B,QAAQ,CAAC,EAAE,KAAK,SAAS,OAAOjB;IAC3D,IAAIiB,SAASC,IAAI,CAAC,CAACC,UAAY,CAACA,WAAWA,YAAY,OAAO,OAAOnB;IACrE,MAAM,CAACoB,MAAMC,QAAQ,GAAGJ;IACxB,MAAMlC,QACJqC,SAAS,UAAUC,UAAUD,SAAS,SAAS,GAAGxC,mBAAmByC,SAAS,GAAG;IACnF,MAAMC,OAAOL,QAAQ,CAACA,SAAS7B,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACL,SAASuC,KAAKC,QAAQ,CAAC5B,6BAA6B,OAAOK;IAChE,IAAI,CAAClB,WAAWC,UAAU,CAACF,QAAQI,IAAI,CAACqC,OAAO,OAAOtB;IACtD,OAAO,GAAGvB,mBAAmBM,MAAM,CAAC,EAAEuC,MAAM;AAC9C;AAEA;;;;CAIC,GACD,OAAO,SAASE,qBACdnB,KAAgC,EAChCZ,MAAsB;IAEtB,IAAI,CAACY,OAAO,OAAOL;IACnB,MAAMyB,SAASpB,MAAMrB,UAAU,CAACP,oBAC5B4B,QACAD,qBAAqBC;IACzB,IAAI,CAACoB,QAAQ,OAAOpB;IACpB,MAAMqB,OAAOD,OAAOtC,KAAK,CAACV,iBAAiBW,MAAM;IACjD,qEAAqE;IACrE,oDAAoD;IACpD,MAAMuC,QAAQD,KAAKE,OAAO,CAAC;IAC3B,IAAID,SAAS,GAAG,OAAO3B;IACvB,MAAMjB,QAAQ2C,KAAKvC,KAAK,CAAC,GAAGwC;IAC5B,mEAAmE;IACnE,oEAAoE;IACpE,6CAA6C;IAC7C,MAAME,OAAOH,KAAKvC,KAAK,CAACwC,QAAQ;IAChC,MAAMG,KAAKD,KAAKD,OAAO,CAAClD;IACxB,MAAMqD,UAAUD,OAAO,CAAC,IAAID,OAAOA,KAAK1C,KAAK,CAAC,GAAG2C;IACjD,IAAI,CAAChD,WAAWC,UAAU,CAACF,QAAQI,IAAI,CAAC8C,UAAU,OAAO/B;IACzD,0EAA0E;IAC1E,wEAAwE;IACxE,6DAA6D;IAC7D,OAAO,GAAGrB,gBAAgB,CAAC,EAAEa,cAAcT,OAAOU,QAAQ,CAAC,EAAEsC,SAAS;AACxE;AAEA;;;;;;;;;;;;;CAaC,GACD,MAAMC,cACJ,AAAClC,CAAAA,QAAQC,GAAG,CAACkC,yBAAyB,IAAI,EAAC,EAAG/B,IAAI,MAAM;AAE1D;;;;;;;;;;CAUC,GACD,OAAO,SAASgC,gBACdvB,IAA6E;IAE7E,IAAIA,wBAAAA,KAAMwB,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAExB,KAAKwB,KAAK,EAAE;IAC/C,IAAIxB,wBAAAA,KAAMyB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAEzB,KAAKyB,SAAS,CAAC,CAAC,EAAEJ,aAAa;IACtE,OAAOhC;AACT"}

package/src/lib/email-render.js

@@ -183,7 +183,12 @@ export function renderEmailHtml(options) {
         const resolved = resolveEmailMediaSrc(subUrl(value), mediaHostId);
         if (!resolved || !hasSafeMediaScheme(resolved)) return undefined;
         if (!resolved.startsWith('/') || resolved.startsWith('//')) return resolved;
-        return origin ? `${origin}${resolved}` : undefined;
+        if (origin) return `${origin}${resolved}`;
+        // A Storage download URL resolves to the CDN path (AGL-3506). With no
+        // origin to send it from, the absolute URL it already was still fetches,
+        // which beats dropping the picture.
+        const stored = subUrl(value);
+        return stored && /^https:\/\//i.test(stored) ? stored : undefined;
     };
     const renderChildren = (ids)=>(ids != null ? ids : []).map((id)=>renderNode(id)).filter(Boolean).join('');
     const renderNode = (id)=>{

package/src/lib/email-render.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/email-render.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Email render pipeline (AGL-348): converts a designed email screen's\n * node map into email-client-compatible HTML (600px table layout,\n * inlined styles, bulletproof buttons) plus a plain-text alternative.\n * Pure — no I/O; callers resolve products/merge data first.\n *\n * Merge tokens ({{contact.firstName}}, {{unsubscribeUrl}}, …) substitute\n * from the provided map; unknown tokens are left in place so a missing\n * field is visible in test sends instead of silently blank.\n *\n * ## The safety contract, in one place\n *\n * Everything this emits is author-controlled, and it is emitted into mail\n * that has left the building. Three rules, all applied here rather than\n * left to a caller:\n *\n * 1. Block HTML goes through {@link EmailRenderOptions.sanitize}, which is\n *    REQUIRED. There is no identity default to fall back into.\n * 2. Every URL is scheme-checked against `@aglyn/shared-util-http` before it\n *    is escaped into an attribute — escaping stops an attribute breakout and\n *    says nothing at all about `javascript:`.\n * 3. Merge substitution into a URL cannot draw from the `contact.` namespace,\n *    so no template can route a recipient's own address into a query string.\n *\n * Mail clients strip most of this themselves, so none of the three is the\n * last line of defense in an inbox. They are the only line the moment one of\n * these documents renders outside one — a \"view this email in your browser\"\n * page is the ordinary way that happens.\n */\n\nimport {\n  hasSafeLinkScheme,\n  hasSafeMediaScheme,\n} from '@aglyn/shared-util-http/safe-url-scheme'\n\nimport { linkifyEscapedText } from './email-linkify'\nimport { resolveEmailColor, type EmailPalette } from './email-palette'\nimport { resolveEmailMediaSrc } from './email-media-src'\n\nexport interface EmailRenderProduct {\n  name: string\n  priceLabel?: string\n  imageUrl?: string\n  url?: string\n}\n\nexport interface EmailRenderNode {\n  componentId?: string\n  props?: Record<string, any>\n  nodes?: string[]\n}\n\nexport interface EmailRenderOptions {\n  /** Flat node map (screen version `nodes`). */\n  nodes: Record<string, EmailRenderNode | undefined>\n  /** Root node id (defaults to 'root'). */\n  rootId?: string\n  subject?: string\n  /** Hidden preview line shown next to the subject in inboxes. */\n  preheader?: string\n  /** Merge values keyed by token body, e.g. 'contact.firstName'. */\n  merge?: Record<string, string>\n  /** Product data by id for emailProduct blocks. */\n  products?: Record<string, EmailRenderProduct | undefined>\n  /**\n   * The HTML policy applied to every `emailRichtext` / `emailHtml` block.\n   *\n   * REQUIRED, and required is the point. A policy a caller may omit is a\n   * policy that gets omitted, and an omitted one here is not a rendering\n   * bug: the console renders these same nodes through `sanitizeCustomHtml`\n   * before an author ever sees them, so an unpoliced mail render means two\n   * renderers of one document disagreeing about safety, with the unsafe one\n   * being the one that sends.\n   *\n   * This module cannot pick the policy for itself — it is `scope:shared` and\n   * the sanitizer is aglyn-scoped, which nx forbids it to import — so the\n   * choice belongs to the caller, and the type is what makes the caller make\n   * it. Every send path passes `sanitizeAuthorHtml`, which is exactly what\n   * `sanitizeCustomHtml` delegates to, so the mailed copy and the previewed\n   * copy are the same function of the same string.\n   */\n  sanitize: (html: string) => string\n  /**\n   * Absolute origin serving this email's media, e.g. `https://acme.com`\n   * (AGL-1224).\n   *\n   * An image an author picked with \"Browse media\" is stored as a\n   * `media:{scope}/{mediaId}` reference, which resolves to the SITE-RELATIVE\n   * CDN path `/api/media/cdn/…`. A browser has a page to resolve that\n   * against; an inbox has nothing. Without this, every picked image is a\n   * broken-image box in the delivered mail.\n   *\n   * It is an input rather than a lookup because this module is pure, and\n   * because the CDN route is mounted in BOTH the console and the tenant app\n   * — which origin is correct depends on whose email this is.\n   */\n  mediaOrigin?: string\n  /**\n   * Host doc id of the site sending, so an `org:`-scoped reference is\n   * host-qualified. The CDN is unauthenticated and decides from the URL\n   * alone, so an org asset restricted to particular sites is only served\n   * through the qualified form.\n   */\n  mediaHostId?: string\n  /**\n   * Absolute URL of the sender's EMAIL logo, prepended as a centred row at\n   * the top of the 600px table (AGL-2139).\n   *\n   * `emailLogoUrl` was a first-class field of `OrgBrandingProfile`, resolved,\n   * collected in the branding editor, https-validated and persisted — and read\n   * at ZERO render sites. An agency admin on the tier that costs the most\n   * filled it in, the form saved, the value round-tripped, and it appeared in\n   * no email ever. This is the consumer that makes it a live capability\n   * rather than a stored string.\n   *\n   * Absent or blank emits NOTHING — not an empty row, not a spacer. An email\n   * with a gap where a logo should be reads as broken; one without a logo\n   * reads as plain, which is the correct appearance for an org that has not\n   * set one.\n   *\n   * Ignored when {@link EmailRenderOptions.chrome} carries a header: that\n   * header is the logo row, and a caller that has one passes the org's logo\n   * through it, so a message never opens with two.\n   */\n  brandLogoUrl?: string\n  /**\n   * The sender's header and footer, drawn around the body (AGL-3322). See\n   * {@link EmailChrome}. Absent draws neither.\n   */\n  chrome?: EmailChrome\n  /**\n   * The theme the email is sent under (AGL-3370): the console brand for the\n   * platform's own mail, a white-label org's color over it, or the site's\n   * theme for a site's mail. See {@link buildEmailPalette}.\n   *\n   * It does two things. A color an author picked in the Besigner is stored as\n   * a palette token (`primary.main`), which a mail client cannot resolve, so\n   * every color prop is resolved against this before it is written. And\n   * what nobody picked (a button's fill and label, a link) takes the theme's\n   * accent rather than a color of the renderer's own. Absent keeps the\n   * renderer's neutral defaults and drops an unresolvable token.\n   */\n  palette?: EmailPalette\n  /**\n   * A button's corner radius in px: the theme's `shape.borderRadius`, which\n   * the Besigner canvas draws the button with. Absent is MUI's default, 4.\n   */\n  buttonRadius?: number\n}\n\n/**\n * The row above the body that says who sent the mail.\n *\n * `logoAlt` is required because it does two jobs. It is the logo's `alt`,\n * which is what most inboxes show, since they block images by default. And\n * it is the header itself when there is no logo to draw — none was given, or\n * the one given cannot be fetched from an inbox — so the sender is named in\n * bold text rather than by a broken-image box.\n */\nexport interface EmailChromeHeader {\n  /** The logo. Resolved and scheme-checked like every other image here. */\n  logoUrl?: string\n  /** The sender's name: the logo's alt text, or the header when no logo draws. */\n  logoAlt: string\n  /** Where the logo or name links. A refused scheme drops the link, not the header. */\n  href?: string\n}\n\n/**\n * The rows under the body, in the order they draw. Each is optional, and a\n * footer with none of them draws nothing.\n */\nexport interface EmailChromeFooter {\n  /** Why the recipient is getting this mail. */\n  reason?: string\n  /** Where to get help. Drawn as a link; dropped whole when the href is refused. */\n  support?: { label: string; href: string }\n  /** Who sent it, and from where: a copyright and postal line. */\n  legal?: string\n}\n\n/**\n * A sender's header and footer, drawn by the renderer rather than placed by a\n * designer (AGL-3322).\n *\n * For mail whose body carries no header or footer of its own: a system\n * email's built-in copy, or a design sent under a brand whose own blocks it\n * may not carry. The caller decides WHICH brand; this only draws.\n *\n * Every string goes through the same merge substitution as the body, so\n * `{{org.name}}` in a footer line reads as the organization it names, and is\n * escaped like body text. Every URL goes through the same scheme checks as a\n * body link or image. The footer lines are appended to the plain-text part\n * too, the support link as its bare address, because a reader of that part is\n * owed the same reason and the same way to get help.\n */\nexport interface EmailChrome {\n  header?: EmailChromeHeader\n  footer?: EmailChromeFooter\n}\n\n/**\n * The theme an email is drawn in (AGL-3370): its palette, which resolves\n * every color an author picked and colors what they did not, and its button\n * radius. Spread into {@link EmailRenderOptions}.\n */\nexport type EmailTheme = Pick<EmailRenderOptions, 'palette' | 'buttonRadius'>\n\nexport interface RenderedEmail {\n  html: string\n  text: string\n}\n\nconst FONT = 'Helvetica, Arial, sans-serif'\n\n/**\n * The colours the chrome is drawn in (AGL-3322), named once.\n *\n * Literal because this is email HTML: mail clients strip `<style>` and read no\n * CSS variables, so no theme token reaches the wire. They are the values\n * already in the mail, not new ones — the ink and card of a default body\n * block, and the band and caption grey of the email footer block the\n * platform's own mail wears — so the chrome and the body it frames agree.\n */\nconst CHROME_PALETTE = {\n  /** The sender's name in the header: body text's ink. */\n  ink: '#1a1a1a',\n  /** The header band: a default section's card. */\n  card: '#ffffff',\n  /** The footer band. */\n  band: '#F8F9FA',\n  /** Footer lines and the support link. */\n  caption: '#757575',\n} as const\n\nexport function escapeEmailHtml(value: string): string {\n  return value\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n}\n\n/** Substitutes {{token}} occurrences; unknown tokens stay visible. */\nexport function substituteMergeTokens(\n  value: string,\n  merge: Record<string, string> | undefined,\n): string {\n  return value.replace(/\\{\\{\\s*([\\w.]+)\\s*\\}\\}/g, (match, token: string) => {\n    const replacement = merge?.[token]\n    return replacement !== undefined ? replacement : match\n  })\n}\n\nconst TEXT_STYLES: Record<string, string> = {\n  heading: `font-size:28px;font-weight:700;line-height:1.25`,\n  subheading: `font-size:20px;font-weight:600;line-height:1.3`,\n  body: `font-size:15px;font-weight:400;line-height:1.55`,\n  caption: `font-size:12px;font-weight:400;line-height:1.4`,\n}\n\n/** One full-width table row wrapping arbitrary cell HTML. */\nconst row = (cellHtml: string, cellStyle = ''): string =>\n  `<tr><td style=\"${cellStyle}\">${cellHtml}</td></tr>`\n\n/**\n * The id the besigner roots every stored node map at — `CANVAS_ROOT_ELEMENT_ID`\n * in `@aglyn/aglyn`. `renderEmailHtml` still defaults `rootId` to `'root'` for\n * ad-hoc callers, but anything rendering a real besigner document MUST pass\n * this: rendering a besigner map as `'root'` finds no root and emits nothing\n * (AGL-765). Kept here so server code need not import the heavy `@aglyn/aglyn`\n * barrel; a drift guard in the console specs asserts the two stay equal.\n */\nexport const EMAIL_NODE_ROOT_ID = '_@_'\n\nexport function renderEmailHtml(options: EmailRenderOptions): RenderedEmail {\n  const {\n    nodes,\n    rootId = 'root',\n    subject = '',\n    preheader = '',\n    merge,\n    products,\n    sanitize,\n    mediaOrigin,\n    mediaHostId,\n    brandLogoUrl,\n    chrome,\n    palette,\n    buttonRadius,\n  } = options\n  const radius =\n    Number.isFinite(buttonRadius) && Number(buttonRadius) >= 0\n      ? Math.min(Number(buttonRadius), 48)\n      : 4\n\n  /**\n   * A stored color, resolved: a palette token against the theme, a literal\n   * as written, anything else to the fallback. The only way a color prop\n   * reaches the markup, so nothing unresolvable or unsafe is ever written\n   * into a style attribute.\n   */\n  const colorOf = (value: unknown, fallback: string): string =>\n    resolveEmailColor(value, palette) ?? fallback\n  /** The theme's accent, for what the author left unset. */\n  const accent = {\n    fill: colorOf('primary.main', '#1a73e8'),\n    label: colorOf('primary.contrastText', '#ffffff'),\n    // The accent AS TEXT: `primary.dark` is the theme's AA-checked text\n    // shade, where the fill color itself may be too pale to read as a link.\n    link: colorOf('primary.dark', '#1a73e8'),\n  }\n\n  const textParts: string[] = []\n  const sub = (value: unknown): string =>\n    substituteMergeTokens(String(value ?? ''), merge)\n\n  /**\n   * The merge map as it applies inside a URL: everything except the\n   * `contact.` namespace.\n   *\n   * That namespace is the recipient — `contact.email`, `contact.name`,\n   * `contact.firstName` are what campaign-send puts in the map. Substituting\n   * them into an `href` or a `src` is how a template like\n   * `https://example.test/?e={{contact.email}}` turns every send into the\n   * recipient's own address on somebody's query string, and putting personal\n   * data in a URL is a line this codebase does not cross. The refusal has to\n   * live here because it is the SUBSTITUTION that creates the value: no\n   * scheme check and no sanitizer can see the address, since the template\n   * the author wrote and the editor reviewed contains only the token.\n   *\n   * Nothing else narrows: `{{unsubscribeUrl}}` and `{{site.url}}` ARE URLs\n   * and are the reason a token appears in this position at all.\n   *\n   * A refused token is left standing rather than blanked, which is this\n   * module's existing convention for a token it will not fill — a test send\n   * shows `?e={{contact.email}}` in the link, which names the problem to the\n   * author instead of silently shipping a subtly different URL.\n   */\n  const urlMerge = merge\n    ? Object.fromEntries(\n        Object.entries(merge).filter(\n          ([token]) => !token.startsWith('contact.'),\n        ),\n      )\n    : undefined\n\n  /** {@link sub} for a value that lands in a URL — see {@link urlMerge}. */\n  const subUrl = (value: unknown): string =>\n    substituteMergeTokens(String(value ?? ''), urlMerge)\n\n  /**\n   * A link target safe to emit, or undefined.\n   *\n   * Escaping the value into the attribute stops a breakout and says nothing\n   * about the scheme, so `escapeEmailHtml` on its own passes a stored\n   * `javascript:` or `data:` href through verbatim. The check runs on the\n   * SUBSTITUTED string, because a merge value is part of the final URL and a\n   * template that reads clean can resolve to one that does not.\n   */\n  const linkHref = (value: unknown): string | undefined => {\n    const href = subUrl(value)\n    if (!href) return undefined\n    return hasSafeLinkScheme(href) ? href : undefined\n  }\n\n  const origin = mediaOrigin?.replace(/\\/+$/, '')\n\n  /**\n   * A stored image value turned into something an inbox can actually fetch,\n   * or undefined (AGL-1224).\n   *\n   * `resolveEmailMediaSrc` handles the three stored generations — a `media:`\n   * reference, the AGL-175 relative CDN path, and a plain absolute URL an\n   * author typed — but the first two come back site-relative, which is the\n   * whole bug: only a browser has a page to resolve them against.\n   *\n   * With no origin to absolutize against, the image is DROPPED rather than\n   * emitted relative. Both are a missing picture; a dropped one leaves a gap,\n   * while `src=\"/api/media/cdn/…\"` renders as a broken-image box, which reads\n   * to a recipient as a broken email rather than a plain one.\n   *\n   * ⚠️ This comment used to claim \"neither send path relies on this — both\n   * supply an origin\", and treated reaching the drop as hypothetical. It was\n   * wrong, and it was wrong in the direction that hides the bug: campaign-send\n   * passed no `mediaOrigin`/`mediaHostId` at all, so every author-picked image\n   * was silently dropped from every marketing campaign until AGL-1394. The\n   * quiet failure IS still the right one for a caller that genuinely has no\n   * origin — but \"no caller reaches this\" is a claim about the whole repo, and\n   * it decays the moment someone adds a third send path. Verify it before\n   * relying on it; do not restore a count here.\n   *\n   * A protocol-relative `//host/x.png` is passed through untouched: it is\n   * already absolute enough to name a host, and prefixing an origin would\n   * corrupt it.\n   *\n   * The scheme is checked on the way out. `resolveEmailMediaSrc` recognizes\n   * the two stored reference forms and passes anything else through as an\n   * author-typed URL, so it is this check and nothing else that stands\n   * between what an author types and the `src` attribute. A refusal drops\n   * the image on the same reasoning as everything else here that cannot be\n   * made fetchable: a gap reads as a plain email, and a `src` we would not\n   * stand behind is not made safer by shipping it.\n   */\n  const imageSrc = (value: unknown): string | undefined => {\n    const resolved = resolveEmailMediaSrc(subUrl(value), mediaHostId)\n    if (!resolved || !hasSafeMediaScheme(resolved)) return undefined\n    if (!resolved.startsWith('/') || resolved.startsWith('//')) return resolved\n    return origin ? `${origin}${resolved}` : undefined\n  }\n\n  const renderChildren = (ids: string[] | undefined): string =>\n    (ids ?? [])\n      .map((id) => renderNode(id))\n      .filter(Boolean)\n      .join('')\n\n  const renderNode = (id: string): string => {\n    const node = nodes[id]\n    if (!node) return ''\n    const props = node.props ?? {}\n    switch (node.componentId) {\n      case 'emailSection': {\n        const background = colorOf(props.backgroundColor, '#ffffff')\n        const padding = Number.isFinite(Number(props.padding))\n          ? Number(props.padding)\n          : 24\n        const align = props.align || 'left'\n        // A ROW, like every other block, with the band's table inside its\n        // cell. Whatever encloses a section is a table — the 600px column, or\n        // another section's inner table — and a `<table>` placed straight into\n        // a table's rows is not a child an HTML parser keeps there: it closes\n        // the enclosing table and lands after it. Emitted bare, a section would\n        // draw outside the column, as wide as the viewport rather than the\n        // 600px the editor shows, and take every row after it out too.\n        return row(\n          `<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" ` +\n            `style=\"background-color:${background};\">` +\n            row(\n              `<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\">` +\n                renderChildren(node.nodes) +\n                `</table>`,\n              `padding:${padding}px;text-align:${align};`,\n            ) +\n            `</table>`,\n        )\n      }\n      case 'emailText': {\n        const text = sub(props.children)\n        // A block whose copy is only a token the send left empty (a\n        // notification with no detail line, AGL-3367) draws nothing, rather\n        // than an empty row and a blank paragraph in the text part.\n        if (!text.trim()) return ''\n        textParts.push(text)\n        const style = TEXT_STYLES[props.variant as string] ?? TEXT_STYLES['body']\n        const color = colorOf(props.color, '#1a1a1a')\n        const align = props.align || 'left'\n        return row(\n          `<div style=\"font-family:${FONT};${style};color:${color};text-align:${align};\">` +\n            linkifyEscapedText(escapeEmailHtml(text), accent.link).replace(/\\n/g, '<br />') +\n            `</div>`,\n          'padding:4px 0;',\n        )\n      }\n      case 'emailRichtext':\n      case 'emailHtml': {\n        const html = sanitize(sub(props.html))\n        if (!html.trim()) return ''\n        textParts.push(html.replace(/<[^>]+>/g, ' ').trim())\n        return row(\n          `<div style=\"font-family:${FONT};font-size:15px;line-height:1.55;\">${html}</div>`,\n          'padding:4px 0;',\n        )\n      }\n      case 'emailImage': {\n        const src = imageSrc(props.src)\n        if (!src) return ''\n        const width = Number(props.width) > 0 ? Number(props.width) : 600\n        const alt = escapeEmailHtml(String(props.alt ?? ''))\n        const align = props.align || 'center'\n        const img =\n          `<img src=\"${escapeEmailHtml(src)}\" alt=\"${alt}\" width=\"${Math.min(width, 600)}\" ` +\n          `style=\"display:inline-block;max-width:100%;height:auto;border:0;\" />`\n        // A refused href drops the WRAPPER, not the picture: the image is the\n        // content and the link is decoration on it.\n        const href = linkHref(props.href)\n        return row(\n          href\n            ? `<a href=\"${escapeEmailHtml(href)}\" target=\"_blank\">${img}</a>`\n            : img,\n          `padding:8px 0;text-align:${align};`,\n        )\n      }\n      case 'emailButton': {\n        const label = sub(props.children ?? 'Call to action')\n        // A refused href falls back to the placeholder the empty case already\n        // uses, so the button keeps its place in the layout and goes nowhere.\n        // Dropping the row instead would take the author's copy with it, and\n        // an inert button reads as an unfinished email rather than a broken\n        // one. The plain-text alternative gets the same value the anchor\n        // does — a text/plain body is inert, but it is still delivered mail\n        // and a refused URL does not belong in it either.\n        const href = linkHref(props.href ?? '#') ?? '#'\n        const background = colorOf(props.backgroundColor, accent.fill)\n        const color = colorOf(props.color, accent.label)\n        const align = props.align || 'center'\n        textParts.push(`${label}: ${href}`)\n        // Bulletproof-ish button: padded anchor, table-aligned.\n        return row(\n          `<a href=\"${escapeEmailHtml(href)}\" target=\"_blank\" ` +\n            `style=\"display:inline-block;padding:12px 28px;border-radius:${radius}px;` +\n            `background-color:${background};color:${color};font-family:${FONT};` +\n            `font-size:15px;font-weight:600;text-decoration:none;\">` +\n            escapeEmailHtml(label) +\n            `</a>`,\n          `padding:12px 0;text-align:${align};`,\n        )\n      }\n      case 'emailDivider': {\n        const color = colorOf(props.color, '#e0e0e0')\n        return row(\n          `<div style=\"border-top:1px solid ${color};font-size:0;line-height:0;\">&nbsp;</div>`,\n          'padding:12px 0;',\n        )\n      }\n      case 'emailSpacer': {\n        const height = Number(props.height) > 0 ? Number(props.height) : 24\n        return row(\n          `<div style=\"height:${height}px;font-size:0;line-height:0;\">&nbsp;</div>`,\n        )\n      }\n      case 'emailProduct': {\n        const product = props.productId\n          ? products?.[String(props.productId)]\n          : undefined\n        if (!product) return ''\n        const label = sub(props.buttonLabel ?? 'Shop now')\n        // Catalog data rather than author markup, and the caller absolutizes\n        // it before it arrives — but \"it came from a trusted table\" is a\n        // claim about every writer of that table, so the same rule applies\n        // here as to an author-typed href. Refused means no button and no\n        // line in the text part; the product card itself still renders.\n        const productUrl =\n          product.url && hasSafeLinkScheme(product.url)\n            ? product.url\n            : undefined\n        textParts.push(\n          `${product.name}${product.priceLabel ? ` — ${product.priceLabel}` : ''}` +\n            (productUrl ? `: ${productUrl}` : ''),\n        )\n        // Same treatment as emailImage: a catalog image can be a picked\n        // asset, so it carries the same reference/relative forms (AGL-1224).\n        const productImage = imageSrc(product.imageUrl)\n        const image = productImage\n          ? `<img src=\"${escapeEmailHtml(productImage)}\" alt=\"${escapeEmailHtml(product.name)}\" width=\"280\" style=\"max-width:100%;height:auto;border:0;border-radius:6px;\" /><br />`\n          : ''\n        const button = productUrl\n          ? `<a href=\"${escapeEmailHtml(productUrl)}\" target=\"_blank\" style=\"display:inline-block;margin-top:8px;padding:10px 24px;border-radius:${radius}px;background-color:${accent.fill};color:${accent.label};font-family:${FONT};font-size:14px;font-weight:600;text-decoration:none;\">${escapeEmailHtml(label)}</a>`\n          : ''\n        return row(\n          `<div style=\"border:1px solid #e0e0e0;border-radius:8px;padding:16px;text-align:center;font-family:${FONT};\">` +\n            image +\n            `<div style=\"font-size:16px;font-weight:600;margin-top:8px;\">${escapeEmailHtml(product.name)}</div>` +\n            (product.priceLabel\n              ? `<div style=\"font-size:14px;color:#555555;margin-top:2px;\">${escapeEmailHtml(product.priceLabel)}</div>`\n              : '') +\n            button +\n            `</div>`,\n          'padding:8px 0;',\n        )\n      }\n      default: {\n        // Unknown/web components: render their children so mixed documents\n        // degrade gracefully instead of dropping content.\n        return renderChildren(node.nodes)\n      }\n    }\n  }\n\n  const body = renderNode(rootId) || renderChildren(nodes[rootId]?.nodes)\n  const preheaderHtml = preheader\n    ? `<div style=\"display:none;max-height:0;overflow:hidden;mso-hide:all;\">` +\n      escapeEmailHtml(sub(preheader)) +\n      `</div>`\n    : ''\n\n  // INSIDE the 600px table, above the designed body, so it inherits the\n  // column's width on a phone instead of being centred against the viewport.\n  // `alt` is the product name where one is known, because a logo blocked by\n  // the client (which is the default in most inboxes) must still say who sent\n  // the mail. Height is capped rather than set, so a wordmark and a square\n  // mark both land at a sane size without the sender supplying dimensions.\n  //\n  // The src goes through `imageSrc` like every other image in the message\n  // (AGL-2230), and NOT into the tag raw. `emailLogoUrl` is collected by\n  // `MediaUrlField`, whose \"Browse\" button writes the picked asset's\n  // site-relative `cdnPath` — and the org DAM's other generation stores a\n  // `media:{scope}/{mediaId}` reference. Neither is a URL an inbox can\n  // resolve: there is no page to resolve it against, so a raw pass-through\n  // put `src=\"media:h1/med9\"` at the top of every transactional email a\n  // white-label org sent. `imageSrc` absolutizes both forms against\n  // `mediaOrigin`, passes a real https URL through untouched, and returns\n  // undefined when it cannot produce something fetchable — in which case the\n  // row is dropped, on the same reasoning as AGL-1224: a gap reads as a plain\n  // email, a broken-image box reads as a broken one.\n  const brandLogo = imageSrc(String(brandLogoUrl ?? '').trim()) ?? ''\n  // The product name from the merge map, because most inboxes block images by\n  // default — a logo with no `alt` is a blank box where the sender's identity\n  // should be. Falls back to nothing rather than to a literal, which would\n  // reintroduce the hard-coded brand this whole change removes.\n  const brandLogoAlt = merge?.['brand.productName'] ?? ''\n  const brandLogoHtml = brandLogo\n    ? row(\n        `<img src=\"${escapeEmailHtml(brandLogo)}\" alt=\"${escapeEmailHtml(brandLogoAlt)}\" ` +\n          `style=\"max-height:48px;max-width:200px;display:block;margin:0 auto;border:0;\" />`,\n        'padding:24px 24px 0;text-align:center;',\n      )\n    : ''\n\n  /**\n   * The chrome header row, or '' when it has nothing to draw.\n   *\n   * Same placement and the same `imageSrc` as the logo row above, which it\n   * replaces. Height is capped at 40px rather than set, so a wordmark and a\n   * square mark both land at a sane size; the `height` attribute is for the\n   * desktop clients that ignore CSS `max-height` and would otherwise draw the\n   * file at its own size. A logo that cannot be fetched from an inbox falls\n   * back to the name in bold, never to an `<img>` that draws a broken box.\n   * White, so the header and a default body read as one card.\n   */\n  const renderChromeHeader = (header: EmailChromeHeader): string => {\n    const logo = imageSrc(String(header.logoUrl ?? '').trim())\n    const name = sub(header.logoAlt).trim()\n    const href = linkHref(header.href)\n    const link = (inner: string, style: string): string =>\n      href\n        ? `<a href=\"${escapeEmailHtml(href)}\" target=\"_blank\" style=\"${style}\">${inner}</a>`\n        : inner\n    let mark: string\n    if (logo) {\n      mark = link(\n        `<img src=\"${escapeEmailHtml(logo)}\" alt=\"${escapeEmailHtml(name)}\" height=\"40\" ` +\n          `style=\"display:block;margin:0 auto;border:0;height:auto;width:auto;max-height:40px;max-width:200px;\" />`,\n        'text-decoration:none;',\n      )\n    } else if (name) {\n      mark =\n        `<div style=\"font-family:${FONT};font-size:20px;font-weight:700;line-height:1.3;color:${CHROME_PALETTE.ink};text-align:center;\">` +\n        link(escapeEmailHtml(name), `color:${CHROME_PALETTE.ink};text-decoration:none;`) +\n        `</div>`\n    } else {\n      return ''\n    }\n    return row(\n      mark,\n      `padding:24px 24px 0;text-align:center;background-color:${CHROME_PALETTE.card};`,\n    )\n  }\n\n  const headerHtml = chrome?.header\n    ? renderChromeHeader(chrome.header)\n    : brandLogoHtml\n\n  /**\n   * The chrome footer: rows under the body in the look of the email footer\n   * block the platform's own mail wears (a `#F8F9FA` section, padded 24,\n   * centered captions), and the same lines appended to the plain-text part.\n   *\n   * Rendered AFTER the body on purpose: the body's blocks push their text as\n   * they draw, and the footer's lines belong after all of it. A line that\n   * resolves to nothing is left out rather than drawn as an empty row.\n   */\n  const renderChromeFooter = (footer: EmailChromeFooter): string => {\n    const htmlLines: string[] = []\n    const textLines: string[] = []\n    const reason = sub(footer.reason).trim()\n    if (reason) {\n      htmlLines.push(escapeEmailHtml(reason))\n      textLines.push(reason)\n    }\n    const supportLabel = sub(footer.support?.label).trim()\n    const supportHref = linkHref(footer.support?.href)\n    if (supportLabel && supportHref) {\n      htmlLines.push(\n        `<a href=\"${escapeEmailHtml(supportHref)}\" target=\"_blank\" ` +\n          `style=\"color:${CHROME_PALETTE.caption};text-decoration:underline;\">${escapeEmailHtml(supportLabel)}</a>`,\n      )\n      // A plain-text reader gets the address itself, bare: a mailto's\n      // mailbox, or the URL. \"Get help: https://…\" names where it goes; a\n      // label that already IS the mailbox is not repeated.\n      const bare = /^mailto:/i.test(supportHref)\n        ? supportHref.slice('mailto:'.length).split('?')[0]\n        : supportHref\n      textLines.push(supportLabel === bare ? bare : `${supportLabel}: ${bare}`)\n    }\n    const legal = sub(footer.legal).trim()\n    if (legal) {\n      htmlLines.push(escapeEmailHtml(legal))\n      textLines.push(legal)\n    }\n    if (!htmlLines.length) return ''\n    textParts.push(textLines.join('\\n'))\n    return row(\n      htmlLines\n        .map(\n          (line, index) =>\n            `<div style=\"font-family:${FONT};font-size:12px;font-weight:400;line-height:1.4;color:${CHROME_PALETTE.caption};` +\n            `${index ? 'margin-top:8px;' : ''}\">${line.replace(/\\n/g, '<br />')}</div>`,\n        )\n        .join(''),\n      `padding:24px;text-align:center;background-color:${CHROME_PALETTE.band};`,\n    )\n  }\n\n  const footerHtml = chrome?.footer ? renderChromeFooter(chrome.footer) : ''\n\n  const html =\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\" />` +\n    `<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />` +\n    `<title>${escapeEmailHtml(sub(subject))}</title></head>` +\n    `<body style=\"margin:0;padding:0;background-color:#f4f4f4;\">` +\n    preheaderHtml +\n    `<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" style=\"background-color:#f4f4f4;\">` +\n    row(\n      `<table role=\"presentation\" width=\"600\" cellpadding=\"0\" cellspacing=\"0\" align=\"center\" style=\"max-width:600px;width:100%;margin:0 auto;\">` +\n        headerHtml +\n        body +\n        footerHtml +\n        `</table>`,\n      'padding:24px 8px;',\n    ) +\n    `</table></body></html>`\n\n  return { html, text: textParts.join('\\n\\n') }\n}\n"],"names":["hasSafeLinkScheme","hasSafeMediaScheme","linkifyEscapedText","resolveEmailColor","resolveEmailMediaSrc","FONT","CHROME_PALETTE","ink","card","band","caption","escapeEmailHtml","value","replace","substituteMergeTokens","merge","match","token","replacement","undefined","TEXT_STYLES","heading","subheading","body","row","cellHtml","cellStyle","EMAIL_NODE_ROOT_ID","renderEmailHtml","options","imageSrc","nodes","rootId","subject","preheader","products","sanitize","mediaOrigin","mediaHostId","brandLogoUrl","chrome","palette","buttonRadius","radius","Number","isFinite","Math","min","colorOf","fallback","accent","fill","label","link","textParts","sub","String","urlMerge","Object","fromEntries","entries","filter","startsWith","subUrl","linkHref","href","origin","resolved","renderChildren","ids","map","id","renderNode","Boolean","join","node","props","componentId","background","backgroundColor","padding","align","text","children","trim","push","style","variant","color","html","src","width","alt","img","height","product","productId","buttonLabel","productUrl","url","name","priceLabel","productImage","imageUrl","image","button","preheaderHtml","brandLogo","brandLogoAlt","brandLogoHtml","renderChromeHeader","header","logo","logoUrl","logoAlt","inner","mark","headerHtml","renderChromeFooter","footer","htmlLines","textLines","reason","supportLabel","support","supportHref","bare","test","slice","length","split","legal","line","index","footerHtml"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GAED,SACEA,iBAAiB,EACjBC,kBAAkB,QACb,0CAAyC;AAEhD,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,SAASC,iBAAiB,QAA2B,qBAAiB;AACtE,SAASC,oBAAoB,QAAQ,uBAAmB;AAgLxD,MAAMC,OAAO;AAEb;;;;;;;;CAQC,GACD,MAAMC,iBAAiB;IACrB,sDAAsD,GACtDC,KAAK;IACL,+CAA+C,GAC/CC,MAAM;IACN,qBAAqB,GACrBC,MAAM;IACN,uCAAuC,GACvCC,SAAS;AACX;AAEA,OAAO,SAASC,gBAAgBC,KAAa;IAC3C,OAAOA,MACJC,OAAO,CAAC,MAAM,SACdA,OAAO,CAAC,MAAM,QACdA,OAAO,CAAC,MAAM,QACdA,OAAO,CAAC,MAAM;AACnB;AAEA,oEAAoE,GACpE,OAAO,SAASC,sBACdF,KAAa,EACbG,KAAyC;IAEzC,OAAOH,MAAMC,OAAO,CAAC,2BAA2B,CAACG,OAAOC;QACtD,MAAMC,cAAcH,yBAAAA,KAAO,CAACE,MAAM;QAClC,OAAOC,gBAAgBC,YAAYD,cAAcF;IACnD;AACF;AAEA,MAAMI,cAAsC;IAC1CC,SAAS,CAAC,+CAA+C,CAAC;IAC1DC,YAAY,CAAC,8CAA8C,CAAC;IAC5DC,MAAM,CAAC,+CAA+C,CAAC;IACvDb,SAAS,CAAC,8CAA8C,CAAC;AAC3D;AAEA,2DAA2D,GAC3D,MAAMc,MAAM,CAACC,UAAkBC,YAAY,EAAE,GAC3C,CAAC,eAAe,EAAEA,UAAU,EAAE,EAAED,SAAS,UAAU,CAAC;AAEtD;;;;;;;CAOC,GACD,OAAO,MAAME,qBAAqB,MAAK;AAEvC,OAAO,SAASC,gBAAgBC,OAA2B;QA0UvCC;QA1BgCC;IA/SlD,MAAM,EACJA,KAAK,EACLC,SAAS,MAAM,EACfC,UAAU,EAAE,EACZC,YAAY,EAAE,EACdnB,KAAK,EACLoB,QAAQ,EACRC,QAAQ,EACRC,WAAW,EACXC,WAAW,EACXC,YAAY,EACZC,MAAM,EACNC,OAAO,EACPC,YAAY,EACb,GAAGb;IACJ,MAAMc,SACJC,OAAOC,QAAQ,CAACH,iBAAiBE,OAAOF,iBAAiB,IACrDI,KAAKC,GAAG,CAACH,OAAOF,eAAe,MAC/B;IAEN;;;;;GAKC,GACD,MAAMM,UAAU,CAACpC,OAAgBqC;YAC/B9C;gBAAAA,qBAAAA,kBAAkBS,OAAO6B,oBAAzBtC,qBAAqC8C;;IACvC,wDAAwD,GACxD,MAAMC,SAAS;QACbC,MAAMH,QAAQ,gBAAgB;QAC9BI,OAAOJ,QAAQ,wBAAwB;QACvC,oEAAoE;QACpE,wEAAwE;QACxEK,MAAML,QAAQ,gBAAgB;IAChC;IAEA,MAAMM,YAAsB,EAAE;IAC9B,MAAMC,MAAM,CAAC3C,QACXE,sBAAsB0C,OAAO5C,gBAAAA,QAAS,KAAKG;IAE7C;;;;;;;;;;;;;;;;;;;;;GAqBC,GACD,MAAM0C,WAAW1C,QACb2C,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAC7C,OAAO8C,MAAM,CAC1B,CAAC,CAAC5C,MAAM,GAAK,CAACA,MAAM6C,UAAU,CAAC,gBAGnC3C;IAEJ,wEAAwE,GACxE,MAAM4C,SAAS,CAACnD,QACdE,sBAAsB0C,OAAO5C,gBAAAA,QAAS,KAAK6C;IAE7C;;;;;;;;GAQC,GACD,MAAMO,WAAW,CAACpD;QAChB,MAAMqD,OAAOF,OAAOnD;QACpB,IAAI,CAACqD,MAAM,OAAO9C;QAClB,OAAOnB,kBAAkBiE,QAAQA,OAAO9C;IAC1C;IAEA,MAAM+C,SAAS7B,+BAAAA,YAAaxB,OAAO,CAAC,QAAQ;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCC,GACD,MAAMiB,WAAW,CAAClB;QAChB,MAAMuD,WAAW/D,qBAAqB2D,OAAOnD,QAAQ0B;QACrD,IAAI,CAAC6B,YAAY,CAAClE,mBAAmBkE,WAAW,OAAOhD;QACvD,IAAI,CAACgD,SAASL,UAAU,CAAC,QAAQK,SAASL,UAAU,CAAC,OAAO,OAAOK;QACnE,OAAOD,SAAS,GAAGA,SAASC,UAAU,GAAGhD;IAC3C;IAEA,MAAMiD,iBAAiB,CAACC,MACtB,CAACA,cAAAA,MAAO,EAAE,EACPC,GAAG,CAAC,CAACC,KAAOC,WAAWD,KACvBV,MAAM,CAACY,SACPC,IAAI,CAAC;IAEV,MAAMF,aAAa,CAACD;YAGJI;QAFd,MAAMA,OAAO5C,KAAK,CAACwC,GAAG;QACtB,IAAI,CAACI,MAAM,OAAO;QAClB,MAAMC,SAAQD,cAAAA,KAAKC,KAAK,YAAVD,cAAc,CAAC;QAC7B,OAAQA,KAAKE,WAAW;YACtB,KAAK;gBAAgB;oBACnB,MAAMC,aAAa9B,QAAQ4B,MAAMG,eAAe,EAAE;oBAClD,MAAMC,UAAUpC,OAAOC,QAAQ,CAACD,OAAOgC,MAAMI,OAAO,KAChDpC,OAAOgC,MAAMI,OAAO,IACpB;oBACJ,MAAMC,QAAQL,MAAMK,KAAK,IAAI;oBAC7B,kEAAkE;oBAClE,sEAAsE;oBACtE,uEAAuE;oBACvE,sEAAsE;oBACtE,wEAAwE;oBACxE,mEAAmE;oBACnE,+DAA+D;oBAC/D,OAAOzD,IACL,CAAC,wEAAwE,CAAC,GACxE,CAAC,wBAAwB,EAAEsD,WAAW,GAAG,CAAC,GAC1CtD,IACE,CAAC,wEAAwE,CAAC,GACxE4C,eAAeO,KAAK5C,KAAK,IACzB,CAAC,QAAQ,CAAC,EACZ,CAAC,QAAQ,EAAEiD,QAAQ,cAAc,EAAEC,MAAM,CAAC,CAAC,IAE7C,CAAC,QAAQ,CAAC;gBAEhB;YACA,KAAK;gBAAa;wBAOF7D;oBANd,MAAM8D,OAAO3B,IAAIqB,MAAMO,QAAQ;oBAC/B,4DAA4D;oBAC5D,oEAAoE;oBACpE,4DAA4D;oBAC5D,IAAI,CAACD,KAAKE,IAAI,IAAI,OAAO;oBACzB9B,UAAU+B,IAAI,CAACH;oBACf,MAAMI,SAAQlE,6BAAAA,WAAW,CAACwD,MAAMW,OAAO,CAAW,YAApCnE,6BAAwCA,WAAW,CAAC,OAAO;oBACzE,MAAMoE,QAAQxC,QAAQ4B,MAAMY,KAAK,EAAE;oBACnC,MAAMP,QAAQL,MAAMK,KAAK,IAAI;oBAC7B,OAAOzD,IACL,CAAC,wBAAwB,EAAEnB,KAAK,CAAC,EAAEiF,MAAM,OAAO,EAAEE,MAAM,YAAY,EAAEP,MAAM,GAAG,CAAC,GAC9E/E,mBAAmBS,gBAAgBuE,OAAOhC,OAAOG,IAAI,EAAExC,OAAO,CAAC,OAAO,YACtE,CAAC,MAAM,CAAC,EACV;gBAEJ;YACA,KAAK;YACL,KAAK;gBAAa;oBAChB,MAAM4E,OAAOrD,SAASmB,IAAIqB,MAAMa,IAAI;oBACpC,IAAI,CAACA,KAAKL,IAAI,IAAI,OAAO;oBACzB9B,UAAU+B,IAAI,CAACI,KAAK5E,OAAO,CAAC,YAAY,KAAKuE,IAAI;oBACjD,OAAO5D,IACL,CAAC,wBAAwB,EAAEnB,KAAK,mCAAmC,EAAEoF,KAAK,MAAM,CAAC,EACjF;gBAEJ;YACA,KAAK;gBAAc;wBAIkBb;oBAHnC,MAAMc,MAAM5D,SAAS8C,MAAMc,GAAG;oBAC9B,IAAI,CAACA,KAAK,OAAO;oBACjB,MAAMC,QAAQ/C,OAAOgC,MAAMe,KAAK,IAAI,IAAI/C,OAAOgC,MAAMe,KAAK,IAAI;oBAC9D,MAAMC,MAAMjF,gBAAgB6C,QAAOoB,aAAAA,MAAMgB,GAAG,YAAThB,aAAa;oBAChD,MAAMK,QAAQL,MAAMK,KAAK,IAAI;oBAC7B,MAAMY,MACJ,CAAC,UAAU,EAAElF,gBAAgB+E,KAAK,OAAO,EAAEE,IAAI,SAAS,EAAE9C,KAAKC,GAAG,CAAC4C,OAAO,KAAK,EAAE,CAAC,GAClF,CAAC,oEAAoE,CAAC;oBACxE,sEAAsE;oBACtE,4CAA4C;oBAC5C,MAAM1B,OAAOD,SAASY,MAAMX,IAAI;oBAChC,OAAOzC,IACLyC,OACI,CAAC,SAAS,EAAEtD,gBAAgBsD,MAAM,kBAAkB,EAAE4B,IAAI,IAAI,CAAC,GAC/DA,KACJ,CAAC,yBAAyB,EAAEZ,MAAM,CAAC,CAAC;gBAExC;YACA,KAAK;gBAAe;wBACAL,iBAQLZ,WAASY;oBARtB,MAAMxB,QAAQG,KAAIqB,kBAAAA,MAAMO,QAAQ,YAAdP,kBAAkB;oBACpC,sEAAsE;oBACtE,sEAAsE;oBACtE,qEAAqE;oBACrE,oEAAoE;oBACpE,iEAAiE;oBACjE,oEAAoE;oBACpE,kDAAkD;oBAClD,MAAMX,QAAOD,YAAAA,UAASY,cAAAA,MAAMX,IAAI,YAAVW,cAAc,gBAAvBZ,YAA+B;oBAC5C,MAAMc,aAAa9B,QAAQ4B,MAAMG,eAAe,EAAE7B,OAAOC,IAAI;oBAC7D,MAAMqC,QAAQxC,QAAQ4B,MAAMY,KAAK,EAAEtC,OAAOE,KAAK;oBAC/C,MAAM6B,QAAQL,MAAMK,KAAK,IAAI;oBAC7B3B,UAAU+B,IAAI,CAAC,GAAGjC,MAAM,EAAE,EAAEa,MAAM;oBAClC,wDAAwD;oBACxD,OAAOzC,IACL,CAAC,SAAS,EAAEb,gBAAgBsD,MAAM,kBAAkB,CAAC,GACnD,CAAC,4DAA4D,EAAEtB,OAAO,GAAG,CAAC,GAC1E,CAAC,iBAAiB,EAAEmC,WAAW,OAAO,EAAEU,MAAM,aAAa,EAAEnF,KAAK,CAAC,CAAC,GACpE,CAAC,sDAAsD,CAAC,GACxDM,gBAAgByC,SAChB,CAAC,IAAI,CAAC,EACR,CAAC,0BAA0B,EAAE6B,MAAM,CAAC,CAAC;gBAEzC;YACA,KAAK;gBAAgB;oBACnB,MAAMO,QAAQxC,QAAQ4B,MAAMY,KAAK,EAAE;oBACnC,OAAOhE,IACL,CAAC,iCAAiC,EAAEgE,MAAM,yCAAyC,CAAC,EACpF;gBAEJ;YACA,KAAK;gBAAe;oBAClB,MAAMM,SAASlD,OAAOgC,MAAMkB,MAAM,IAAI,IAAIlD,OAAOgC,MAAMkB,MAAM,IAAI;oBACjE,OAAOtE,IACL,CAAC,mBAAmB,EAAEsE,OAAO,2CAA2C,CAAC;gBAE7E;YACA,KAAK;gBAAgB;wBAKDlB;oBAJlB,MAAMmB,UAAUnB,MAAMoB,SAAS,GAC3B7D,4BAAAA,QAAU,CAACqB,OAAOoB,MAAMoB,SAAS,EAAE,GACnC7E;oBACJ,IAAI,CAAC4E,SAAS,OAAO;oBACrB,MAAM3C,QAAQG,KAAIqB,qBAAAA,MAAMqB,WAAW,YAAjBrB,qBAAqB;oBACvC,qEAAqE;oBACrE,iEAAiE;oBACjE,mEAAmE;oBACnE,kEAAkE;oBAClE,gEAAgE;oBAChE,MAAMsB,aACJH,QAAQI,GAAG,IAAInG,kBAAkB+F,QAAQI,GAAG,IACxCJ,QAAQI,GAAG,GACXhF;oBACNmC,UAAU+B,IAAI,CACZ,GAAGU,QAAQK,IAAI,GAAGL,QAAQM,UAAU,GAAG,CAAC,GAAG,EAAEN,QAAQM,UAAU,EAAE,GAAG,IAAI,GACrEH,CAAAA,aAAa,CAAC,EAAE,EAAEA,YAAY,GAAG,EAAC;oBAEvC,gEAAgE;oBAChE,qEAAqE;oBACrE,MAAMI,eAAexE,SAASiE,QAAQQ,QAAQ;oBAC9C,MAAMC,QAAQF,eACV,CAAC,UAAU,EAAE3F,gBAAgB2F,cAAc,OAAO,EAAE3F,gBAAgBoF,QAAQK,IAAI,EAAE,qFAAqF,CAAC,GACxK;oBACJ,MAAMK,SAASP,aACX,CAAC,SAAS,EAAEvF,gBAAgBuF,YAAY,6FAA6F,EAAEvD,OAAO,oBAAoB,EAAEO,OAAOC,IAAI,CAAC,OAAO,EAAED,OAAOE,KAAK,CAAC,aAAa,EAAE/C,KAAK,uDAAuD,EAAEM,gBAAgByC,OAAO,IAAI,CAAC,GAC/S;oBACJ,OAAO5B,IACL,CAAC,kGAAkG,EAAEnB,KAAK,GAAG,CAAC,GAC5GmG,QACA,CAAC,4DAA4D,EAAE7F,gBAAgBoF,QAAQK,IAAI,EAAE,MAAM,CAAC,GACnGL,CAAAA,QAAQM,UAAU,GACf,CAAC,0DAA0D,EAAE1F,gBAAgBoF,QAAQM,UAAU,EAAE,MAAM,CAAC,GACxG,EAAC,IACLI,SACA,CAAC,MAAM,CAAC,EACV;gBAEJ;YACA;gBAAS;oBACP,mEAAmE;oBACnE,kDAAkD;oBAClD,OAAOrC,eAAeO,KAAK5C,KAAK;gBAClC;QACF;IACF;IAEA,MAAMR,OAAOiD,WAAWxC,WAAWoC,gBAAerC,gBAAAA,KAAK,CAACC,OAAO,qBAAbD,cAAeA,KAAK;IACtE,MAAM2E,gBAAgBxE,YAClB,CAAC,qEAAqE,CAAC,GACvEvB,gBAAgB4C,IAAIrB,cACpB,CAAC,MAAM,CAAC,GACR;IAEJ,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,EAAE;IACF,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,sEAAsE;IACtE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAMyE,aAAY7E,YAAAA,SAAS0B,OAAOjB,uBAAAA,eAAgB,IAAI6C,IAAI,eAAxCtD,YAA+C;IACjE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM8E,uBAAe7F,yBAAAA,KAAO,CAAC,oBAAoB,mBAAI;IACrD,MAAM8F,gBAAgBF,YAClBnF,IACE,CAAC,UAAU,EAAEb,gBAAgBgG,WAAW,OAAO,EAAEhG,gBAAgBiG,cAAc,EAAE,CAAC,GAChF,CAAC,gFAAgF,CAAC,EACpF,4CAEF;IAEJ;;;;;;;;;;GAUC,GACD,MAAME,qBAAqB,CAACC;YACGA;QAA7B,MAAMC,OAAOlF,SAAS0B,QAAOuD,kBAAAA,OAAOE,OAAO,YAAdF,kBAAkB,IAAI3B,IAAI;QACvD,MAAMgB,OAAO7C,IAAIwD,OAAOG,OAAO,EAAE9B,IAAI;QACrC,MAAMnB,OAAOD,SAAS+C,OAAO9C,IAAI;QACjC,MAAMZ,OAAO,CAAC8D,OAAe7B,QAC3BrB,OACI,CAAC,SAAS,EAAEtD,gBAAgBsD,MAAM,yBAAyB,EAAEqB,MAAM,EAAE,EAAE6B,MAAM,IAAI,CAAC,GAClFA;QACN,IAAIC;QACJ,IAAIJ,MAAM;YACRI,OAAO/D,KACL,CAAC,UAAU,EAAE1C,gBAAgBqG,MAAM,OAAO,EAAErG,gBAAgByF,MAAM,cAAc,CAAC,GAC/E,CAAC,uGAAuG,CAAC,EAC3G;QAEJ,OAAO,IAAIA,MAAM;YACfgB,OACE,CAAC,wBAAwB,EAAE/G,KAAK,sDAAsD,EAAEC,eAAeC,GAAG,CAAC,qBAAqB,CAAC,GACjI8C,KAAK1C,gBAAgByF,OAAO,CAAC,MAAM,EAAE9F,eAAeC,GAAG,CAAC,sBAAsB,CAAC,IAC/E,CAAC,MAAM,CAAC;QACZ,OAAO;YACL,OAAO;QACT;QACA,OAAOiB,IACL4F,MACA,CAAC,uDAAuD,EAAE9G,eAAeE,IAAI,CAAC,CAAC,CAAC;IAEpF;IAEA,MAAM6G,aAAa7E,CAAAA,0BAAAA,OAAQuE,MAAM,IAC7BD,mBAAmBtE,OAAOuE,MAAM,IAChCF;IAEJ;;;;;;;;GAQC,GACD,MAAMS,qBAAqB,CAACC;YAQDA,iBACIA;QAR7B,MAAMC,YAAsB,EAAE;QAC9B,MAAMC,YAAsB,EAAE;QAC9B,MAAMC,SAASnE,IAAIgE,OAAOG,MAAM,EAAEtC,IAAI;QACtC,IAAIsC,QAAQ;YACVF,UAAUnC,IAAI,CAAC1E,gBAAgB+G;YAC/BD,UAAUpC,IAAI,CAACqC;QACjB;QACA,MAAMC,eAAepE,KAAIgE,kBAAAA,OAAOK,OAAO,qBAAdL,gBAAgBnE,KAAK,EAAEgC,IAAI;QACpD,MAAMyC,cAAc7D,UAASuD,mBAAAA,OAAOK,OAAO,qBAAdL,iBAAgBtD,IAAI;QACjD,IAAI0D,gBAAgBE,aAAa;YAC/BL,UAAUnC,IAAI,CACZ,CAAC,SAAS,EAAE1E,gBAAgBkH,aAAa,kBAAkB,CAAC,GAC1D,CAAC,aAAa,EAAEvH,eAAeI,OAAO,CAAC,6BAA6B,EAAEC,gBAAgBgH,cAAc,IAAI,CAAC;YAE7G,gEAAgE;YAChE,oEAAoE;YACpE,qDAAqD;YACrD,MAAMG,OAAO,YAAYC,IAAI,CAACF,eAC1BA,YAAYG,KAAK,CAAC,UAAUC,MAAM,EAAEC,KAAK,CAAC,IAAI,CAAC,EAAE,GACjDL;YACJJ,UAAUpC,IAAI,CAACsC,iBAAiBG,OAAOA,OAAO,GAAGH,aAAa,EAAE,EAAEG,MAAM;QAC1E;QACA,MAAMK,QAAQ5E,IAAIgE,OAAOY,KAAK,EAAE/C,IAAI;QACpC,IAAI+C,OAAO;YACTX,UAAUnC,IAAI,CAAC1E,gBAAgBwH;YAC/BV,UAAUpC,IAAI,CAAC8C;QACjB;QACA,IAAI,CAACX,UAAUS,MAAM,EAAE,OAAO;QAC9B3E,UAAU+B,IAAI,CAACoC,UAAU/C,IAAI,CAAC;QAC9B,OAAOlD,IACLgG,UACGlD,GAAG,CACF,CAAC8D,MAAMC,QACL,CAAC,wBAAwB,EAAEhI,KAAK,sDAAsD,EAAEC,eAAeI,OAAO,CAAC,CAAC,CAAC,GACjH,GAAG2H,QAAQ,oBAAoB,GAAG,EAAE,EAAED,KAAKvH,OAAO,CAAC,OAAO,UAAU,MAAM,CAAC,EAE9E6D,IAAI,CAAC,KACR,CAAC,gDAAgD,EAAEpE,eAAeG,IAAI,CAAC,CAAC,CAAC;IAE7E;IAEA,MAAM6H,aAAa9F,CAAAA,0BAAAA,OAAQ+E,MAAM,IAAGD,mBAAmB9E,OAAO+E,MAAM,IAAI;IAExE,MAAM9B,OACJ,CAAC,mDAAmD,CAAC,GACrD,CAAC,sEAAsE,CAAC,GACxE,CAAC,OAAO,EAAE9E,gBAAgB4C,IAAItB,UAAU,eAAe,CAAC,GACxD,CAAC,2DAA2D,CAAC,GAC7DyE,gBACA,CAAC,0GAA0G,CAAC,GAC5GlF,IACE,CAAC,wIAAwI,CAAC,GACxI6F,aACA9F,OACA+G,aACA,CAAC,QAAQ,CAAC,EACZ,uBAEF,CAAC,sBAAsB,CAAC;IAE1B,OAAO;QAAE7C;QAAMP,MAAM5B,UAAUoB,IAAI,CAAC;IAAQ;AAC9C"}
+{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/email-render.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Email render pipeline (AGL-348): converts a designed email screen's\n * node map into email-client-compatible HTML (600px table layout,\n * inlined styles, bulletproof buttons) plus a plain-text alternative.\n * Pure — no I/O; callers resolve products/merge data first.\n *\n * Merge tokens ({{contact.firstName}}, {{unsubscribeUrl}}, …) substitute\n * from the provided map; unknown tokens are left in place so a missing\n * field is visible in test sends instead of silently blank.\n *\n * ## The safety contract, in one place\n *\n * Everything this emits is author-controlled, and it is emitted into mail\n * that has left the building. Three rules, all applied here rather than\n * left to a caller:\n *\n * 1. Block HTML goes through {@link EmailRenderOptions.sanitize}, which is\n *    REQUIRED. There is no identity default to fall back into.\n * 2. Every URL is scheme-checked against `@aglyn/shared-util-http` before it\n *    is escaped into an attribute — escaping stops an attribute breakout and\n *    says nothing at all about `javascript:`.\n * 3. Merge substitution into a URL cannot draw from the `contact.` namespace,\n *    so no template can route a recipient's own address into a query string.\n *\n * Mail clients strip most of this themselves, so none of the three is the\n * last line of defense in an inbox. They are the only line the moment one of\n * these documents renders outside one — a \"view this email in your browser\"\n * page is the ordinary way that happens.\n */\n\nimport {\n  hasSafeLinkScheme,\n  hasSafeMediaScheme,\n} from '@aglyn/shared-util-http/safe-url-scheme'\n\nimport { linkifyEscapedText } from './email-linkify'\nimport { resolveEmailColor, type EmailPalette } from './email-palette'\nimport { resolveEmailMediaSrc } from './email-media-src'\n\nexport interface EmailRenderProduct {\n  name: string\n  priceLabel?: string\n  imageUrl?: string\n  url?: string\n}\n\nexport interface EmailRenderNode {\n  componentId?: string\n  props?: Record<string, any>\n  nodes?: string[]\n}\n\nexport interface EmailRenderOptions {\n  /** Flat node map (screen version `nodes`). */\n  nodes: Record<string, EmailRenderNode | undefined>\n  /** Root node id (defaults to 'root'). */\n  rootId?: string\n  subject?: string\n  /** Hidden preview line shown next to the subject in inboxes. */\n  preheader?: string\n  /** Merge values keyed by token body, e.g. 'contact.firstName'. */\n  merge?: Record<string, string>\n  /** Product data by id for emailProduct blocks. */\n  products?: Record<string, EmailRenderProduct | undefined>\n  /**\n   * The HTML policy applied to every `emailRichtext` / `emailHtml` block.\n   *\n   * REQUIRED, and required is the point. A policy a caller may omit is a\n   * policy that gets omitted, and an omitted one here is not a rendering\n   * bug: the console renders these same nodes through `sanitizeCustomHtml`\n   * before an author ever sees them, so an unpoliced mail render means two\n   * renderers of one document disagreeing about safety, with the unsafe one\n   * being the one that sends.\n   *\n   * This module cannot pick the policy for itself — it is `scope:shared` and\n   * the sanitizer is aglyn-scoped, which nx forbids it to import — so the\n   * choice belongs to the caller, and the type is what makes the caller make\n   * it. Every send path passes `sanitizeAuthorHtml`, which is exactly what\n   * `sanitizeCustomHtml` delegates to, so the mailed copy and the previewed\n   * copy are the same function of the same string.\n   */\n  sanitize: (html: string) => string\n  /**\n   * Absolute origin serving this email's media, e.g. `https://acme.com`\n   * (AGL-1224).\n   *\n   * An image an author picked with \"Browse media\" is stored as a\n   * `media:{scope}/{mediaId}` reference, which resolves to the SITE-RELATIVE\n   * CDN path `/api/media/cdn/…`. A browser has a page to resolve that\n   * against; an inbox has nothing. Without this, every picked image is a\n   * broken-image box in the delivered mail.\n   *\n   * It is an input rather than a lookup because this module is pure, and\n   * because the CDN route is mounted in BOTH the console and the tenant app\n   * — which origin is correct depends on whose email this is.\n   */\n  mediaOrigin?: string\n  /**\n   * Host doc id of the site sending, so an `org:`-scoped reference is\n   * host-qualified. The CDN is unauthenticated and decides from the URL\n   * alone, so an org asset restricted to particular sites is only served\n   * through the qualified form.\n   */\n  mediaHostId?: string\n  /**\n   * Absolute URL of the sender's EMAIL logo, prepended as a centred row at\n   * the top of the 600px table (AGL-2139).\n   *\n   * `emailLogoUrl` was a first-class field of `OrgBrandingProfile`, resolved,\n   * collected in the branding editor, https-validated and persisted — and read\n   * at ZERO render sites. An agency admin on the tier that costs the most\n   * filled it in, the form saved, the value round-tripped, and it appeared in\n   * no email ever. This is the consumer that makes it a live capability\n   * rather than a stored string.\n   *\n   * Absent or blank emits NOTHING — not an empty row, not a spacer. An email\n   * with a gap where a logo should be reads as broken; one without a logo\n   * reads as plain, which is the correct appearance for an org that has not\n   * set one.\n   *\n   * Ignored when {@link EmailRenderOptions.chrome} carries a header: that\n   * header is the logo row, and a caller that has one passes the org's logo\n   * through it, so a message never opens with two.\n   */\n  brandLogoUrl?: string\n  /**\n   * The sender's header and footer, drawn around the body (AGL-3322). See\n   * {@link EmailChrome}. Absent draws neither.\n   */\n  chrome?: EmailChrome\n  /**\n   * The theme the email is sent under (AGL-3370): the console brand for the\n   * platform's own mail, a white-label org's color over it, or the site's\n   * theme for a site's mail. See {@link buildEmailPalette}.\n   *\n   * It does two things. A color an author picked in the Besigner is stored as\n   * a palette token (`primary.main`), which a mail client cannot resolve, so\n   * every color prop is resolved against this before it is written. And\n   * what nobody picked (a button's fill and label, a link) takes the theme's\n   * accent rather than a color of the renderer's own. Absent keeps the\n   * renderer's neutral defaults and drops an unresolvable token.\n   */\n  palette?: EmailPalette\n  /**\n   * A button's corner radius in px: the theme's `shape.borderRadius`, which\n   * the Besigner canvas draws the button with. Absent is MUI's default, 4.\n   */\n  buttonRadius?: number\n}\n\n/**\n * The row above the body that says who sent the mail.\n *\n * `logoAlt` is required because it does two jobs. It is the logo's `alt`,\n * which is what most inboxes show, since they block images by default. And\n * it is the header itself when there is no logo to draw — none was given, or\n * the one given cannot be fetched from an inbox — so the sender is named in\n * bold text rather than by a broken-image box.\n */\nexport interface EmailChromeHeader {\n  /** The logo. Resolved and scheme-checked like every other image here. */\n  logoUrl?: string\n  /** The sender's name: the logo's alt text, or the header when no logo draws. */\n  logoAlt: string\n  /** Where the logo or name links. A refused scheme drops the link, not the header. */\n  href?: string\n}\n\n/**\n * The rows under the body, in the order they draw. Each is optional, and a\n * footer with none of them draws nothing.\n */\nexport interface EmailChromeFooter {\n  /** Why the recipient is getting this mail. */\n  reason?: string\n  /** Where to get help. Drawn as a link; dropped whole when the href is refused. */\n  support?: { label: string; href: string }\n  /** Who sent it, and from where: a copyright and postal line. */\n  legal?: string\n}\n\n/**\n * A sender's header and footer, drawn by the renderer rather than placed by a\n * designer (AGL-3322).\n *\n * For mail whose body carries no header or footer of its own: a system\n * email's built-in copy, or a design sent under a brand whose own blocks it\n * may not carry. The caller decides WHICH brand; this only draws.\n *\n * Every string goes through the same merge substitution as the body, so\n * `{{org.name}}` in a footer line reads as the organization it names, and is\n * escaped like body text. Every URL goes through the same scheme checks as a\n * body link or image. The footer lines are appended to the plain-text part\n * too, the support link as its bare address, because a reader of that part is\n * owed the same reason and the same way to get help.\n */\nexport interface EmailChrome {\n  header?: EmailChromeHeader\n  footer?: EmailChromeFooter\n}\n\n/**\n * The theme an email is drawn in (AGL-3370): its palette, which resolves\n * every color an author picked and colors what they did not, and its button\n * radius. Spread into {@link EmailRenderOptions}.\n */\nexport type EmailTheme = Pick<EmailRenderOptions, 'palette' | 'buttonRadius'>\n\nexport interface RenderedEmail {\n  html: string\n  text: string\n}\n\nconst FONT = 'Helvetica, Arial, sans-serif'\n\n/**\n * The colours the chrome is drawn in (AGL-3322), named once.\n *\n * Literal because this is email HTML: mail clients strip `<style>` and read no\n * CSS variables, so no theme token reaches the wire. They are the values\n * already in the mail, not new ones — the ink and card of a default body\n * block, and the band and caption grey of the email footer block the\n * platform's own mail wears — so the chrome and the body it frames agree.\n */\nconst CHROME_PALETTE = {\n  /** The sender's name in the header: body text's ink. */\n  ink: '#1a1a1a',\n  /** The header band: a default section's card. */\n  card: '#ffffff',\n  /** The footer band. */\n  band: '#F8F9FA',\n  /** Footer lines and the support link. */\n  caption: '#757575',\n} as const\n\nexport function escapeEmailHtml(value: string): string {\n  return value\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n}\n\n/** Substitutes {{token}} occurrences; unknown tokens stay visible. */\nexport function substituteMergeTokens(\n  value: string,\n  merge: Record<string, string> | undefined,\n): string {\n  return value.replace(/\\{\\{\\s*([\\w.]+)\\s*\\}\\}/g, (match, token: string) => {\n    const replacement = merge?.[token]\n    return replacement !== undefined ? replacement : match\n  })\n}\n\nconst TEXT_STYLES: Record<string, string> = {\n  heading: `font-size:28px;font-weight:700;line-height:1.25`,\n  subheading: `font-size:20px;font-weight:600;line-height:1.3`,\n  body: `font-size:15px;font-weight:400;line-height:1.55`,\n  caption: `font-size:12px;font-weight:400;line-height:1.4`,\n}\n\n/** One full-width table row wrapping arbitrary cell HTML. */\nconst row = (cellHtml: string, cellStyle = ''): string =>\n  `<tr><td style=\"${cellStyle}\">${cellHtml}</td></tr>`\n\n/**\n * The id the besigner roots every stored node map at — `CANVAS_ROOT_ELEMENT_ID`\n * in `@aglyn/aglyn`. `renderEmailHtml` still defaults `rootId` to `'root'` for\n * ad-hoc callers, but anything rendering a real besigner document MUST pass\n * this: rendering a besigner map as `'root'` finds no root and emits nothing\n * (AGL-765). Kept here so server code need not import the heavy `@aglyn/aglyn`\n * barrel; a drift guard in the console specs asserts the two stay equal.\n */\nexport const EMAIL_NODE_ROOT_ID = '_@_'\n\nexport function renderEmailHtml(options: EmailRenderOptions): RenderedEmail {\n  const {\n    nodes,\n    rootId = 'root',\n    subject = '',\n    preheader = '',\n    merge,\n    products,\n    sanitize,\n    mediaOrigin,\n    mediaHostId,\n    brandLogoUrl,\n    chrome,\n    palette,\n    buttonRadius,\n  } = options\n  const radius =\n    Number.isFinite(buttonRadius) && Number(buttonRadius) >= 0\n      ? Math.min(Number(buttonRadius), 48)\n      : 4\n\n  /**\n   * A stored color, resolved: a palette token against the theme, a literal\n   * as written, anything else to the fallback. The only way a color prop\n   * reaches the markup, so nothing unresolvable or unsafe is ever written\n   * into a style attribute.\n   */\n  const colorOf = (value: unknown, fallback: string): string =>\n    resolveEmailColor(value, palette) ?? fallback\n  /** The theme's accent, for what the author left unset. */\n  const accent = {\n    fill: colorOf('primary.main', '#1a73e8'),\n    label: colorOf('primary.contrastText', '#ffffff'),\n    // The accent AS TEXT: `primary.dark` is the theme's AA-checked text\n    // shade, where the fill color itself may be too pale to read as a link.\n    link: colorOf('primary.dark', '#1a73e8'),\n  }\n\n  const textParts: string[] = []\n  const sub = (value: unknown): string =>\n    substituteMergeTokens(String(value ?? ''), merge)\n\n  /**\n   * The merge map as it applies inside a URL: everything except the\n   * `contact.` namespace.\n   *\n   * That namespace is the recipient — `contact.email`, `contact.name`,\n   * `contact.firstName` are what campaign-send puts in the map. Substituting\n   * them into an `href` or a `src` is how a template like\n   * `https://example.test/?e={{contact.email}}` turns every send into the\n   * recipient's own address on somebody's query string, and putting personal\n   * data in a URL is a line this codebase does not cross. The refusal has to\n   * live here because it is the SUBSTITUTION that creates the value: no\n   * scheme check and no sanitizer can see the address, since the template\n   * the author wrote and the editor reviewed contains only the token.\n   *\n   * Nothing else narrows: `{{unsubscribeUrl}}` and `{{site.url}}` ARE URLs\n   * and are the reason a token appears in this position at all.\n   *\n   * A refused token is left standing rather than blanked, which is this\n   * module's existing convention for a token it will not fill — a test send\n   * shows `?e={{contact.email}}` in the link, which names the problem to the\n   * author instead of silently shipping a subtly different URL.\n   */\n  const urlMerge = merge\n    ? Object.fromEntries(\n        Object.entries(merge).filter(\n          ([token]) => !token.startsWith('contact.'),\n        ),\n      )\n    : undefined\n\n  /** {@link sub} for a value that lands in a URL — see {@link urlMerge}. */\n  const subUrl = (value: unknown): string =>\n    substituteMergeTokens(String(value ?? ''), urlMerge)\n\n  /**\n   * A link target safe to emit, or undefined.\n   *\n   * Escaping the value into the attribute stops a breakout and says nothing\n   * about the scheme, so `escapeEmailHtml` on its own passes a stored\n   * `javascript:` or `data:` href through verbatim. The check runs on the\n   * SUBSTITUTED string, because a merge value is part of the final URL and a\n   * template that reads clean can resolve to one that does not.\n   */\n  const linkHref = (value: unknown): string | undefined => {\n    const href = subUrl(value)\n    if (!href) return undefined\n    return hasSafeLinkScheme(href) ? href : undefined\n  }\n\n  const origin = mediaOrigin?.replace(/\\/+$/, '')\n\n  /**\n   * A stored image value turned into something an inbox can actually fetch,\n   * or undefined (AGL-1224).\n   *\n   * `resolveEmailMediaSrc` handles the three stored generations — a `media:`\n   * reference, the AGL-175 relative CDN path, and a plain absolute URL an\n   * author typed — but the first two come back site-relative, which is the\n   * whole bug: only a browser has a page to resolve them against.\n   *\n   * With no origin to absolutize against, the image is DROPPED rather than\n   * emitted relative. Both are a missing picture; a dropped one leaves a gap,\n   * while `src=\"/api/media/cdn/…\"` renders as a broken-image box, which reads\n   * to a recipient as a broken email rather than a plain one.\n   *\n   * ⚠️ This comment used to claim \"neither send path relies on this — both\n   * supply an origin\", and treated reaching the drop as hypothetical. It was\n   * wrong, and it was wrong in the direction that hides the bug: campaign-send\n   * passed no `mediaOrigin`/`mediaHostId` at all, so every author-picked image\n   * was silently dropped from every marketing campaign until AGL-1394. The\n   * quiet failure IS still the right one for a caller that genuinely has no\n   * origin — but \"no caller reaches this\" is a claim about the whole repo, and\n   * it decays the moment someone adds a third send path. Verify it before\n   * relying on it; do not restore a count here.\n   *\n   * A protocol-relative `//host/x.png` is passed through untouched: it is\n   * already absolute enough to name a host, and prefixing an origin would\n   * corrupt it.\n   *\n   * The scheme is checked on the way out. `resolveEmailMediaSrc` recognizes\n   * the two stored reference forms and passes anything else through as an\n   * author-typed URL, so it is this check and nothing else that stands\n   * between what an author types and the `src` attribute. A refusal drops\n   * the image on the same reasoning as everything else here that cannot be\n   * made fetchable: a gap reads as a plain email, and a `src` we would not\n   * stand behind is not made safer by shipping it.\n   */\n  const imageSrc = (value: unknown): string | undefined => {\n    const resolved = resolveEmailMediaSrc(subUrl(value), mediaHostId)\n    if (!resolved || !hasSafeMediaScheme(resolved)) return undefined\n    if (!resolved.startsWith('/') || resolved.startsWith('//')) return resolved\n    if (origin) return `${origin}${resolved}`\n    // A Storage download URL resolves to the CDN path (AGL-3506). With no\n    // origin to send it from, the absolute URL it already was still fetches,\n    // which beats dropping the picture.\n    const stored = subUrl(value)\n    return stored && /^https:\\/\\//i.test(stored) ? stored : undefined\n  }\n\n  const renderChildren = (ids: string[] | undefined): string =>\n    (ids ?? [])\n      .map((id) => renderNode(id))\n      .filter(Boolean)\n      .join('')\n\n  const renderNode = (id: string): string => {\n    const node = nodes[id]\n    if (!node) return ''\n    const props = node.props ?? {}\n    switch (node.componentId) {\n      case 'emailSection': {\n        const background = colorOf(props.backgroundColor, '#ffffff')\n        const padding = Number.isFinite(Number(props.padding))\n          ? Number(props.padding)\n          : 24\n        const align = props.align || 'left'\n        // A ROW, like every other block, with the band's table inside its\n        // cell. Whatever encloses a section is a table — the 600px column, or\n        // another section's inner table — and a `<table>` placed straight into\n        // a table's rows is not a child an HTML parser keeps there: it closes\n        // the enclosing table and lands after it. Emitted bare, a section would\n        // draw outside the column, as wide as the viewport rather than the\n        // 600px the editor shows, and take every row after it out too.\n        return row(\n          `<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" ` +\n            `style=\"background-color:${background};\">` +\n            row(\n              `<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\">` +\n                renderChildren(node.nodes) +\n                `</table>`,\n              `padding:${padding}px;text-align:${align};`,\n            ) +\n            `</table>`,\n        )\n      }\n      case 'emailText': {\n        const text = sub(props.children)\n        // A block whose copy is only a token the send left empty (a\n        // notification with no detail line, AGL-3367) draws nothing, rather\n        // than an empty row and a blank paragraph in the text part.\n        if (!text.trim()) return ''\n        textParts.push(text)\n        const style = TEXT_STYLES[props.variant as string] ?? TEXT_STYLES['body']\n        const color = colorOf(props.color, '#1a1a1a')\n        const align = props.align || 'left'\n        return row(\n          `<div style=\"font-family:${FONT};${style};color:${color};text-align:${align};\">` +\n            linkifyEscapedText(escapeEmailHtml(text), accent.link).replace(/\\n/g, '<br />') +\n            `</div>`,\n          'padding:4px 0;',\n        )\n      }\n      case 'emailRichtext':\n      case 'emailHtml': {\n        const html = sanitize(sub(props.html))\n        if (!html.trim()) return ''\n        textParts.push(html.replace(/<[^>]+>/g, ' ').trim())\n        return row(\n          `<div style=\"font-family:${FONT};font-size:15px;line-height:1.55;\">${html}</div>`,\n          'padding:4px 0;',\n        )\n      }\n      case 'emailImage': {\n        const src = imageSrc(props.src)\n        if (!src) return ''\n        const width = Number(props.width) > 0 ? Number(props.width) : 600\n        const alt = escapeEmailHtml(String(props.alt ?? ''))\n        const align = props.align || 'center'\n        const img =\n          `<img src=\"${escapeEmailHtml(src)}\" alt=\"${alt}\" width=\"${Math.min(width, 600)}\" ` +\n          `style=\"display:inline-block;max-width:100%;height:auto;border:0;\" />`\n        // A refused href drops the WRAPPER, not the picture: the image is the\n        // content and the link is decoration on it.\n        const href = linkHref(props.href)\n        return row(\n          href\n            ? `<a href=\"${escapeEmailHtml(href)}\" target=\"_blank\">${img}</a>`\n            : img,\n          `padding:8px 0;text-align:${align};`,\n        )\n      }\n      case 'emailButton': {\n        const label = sub(props.children ?? 'Call to action')\n        // A refused href falls back to the placeholder the empty case already\n        // uses, so the button keeps its place in the layout and goes nowhere.\n        // Dropping the row instead would take the author's copy with it, and\n        // an inert button reads as an unfinished email rather than a broken\n        // one. The plain-text alternative gets the same value the anchor\n        // does — a text/plain body is inert, but it is still delivered mail\n        // and a refused URL does not belong in it either.\n        const href = linkHref(props.href ?? '#') ?? '#'\n        const background = colorOf(props.backgroundColor, accent.fill)\n        const color = colorOf(props.color, accent.label)\n        const align = props.align || 'center'\n        textParts.push(`${label}: ${href}`)\n        // Bulletproof-ish button: padded anchor, table-aligned.\n        return row(\n          `<a href=\"${escapeEmailHtml(href)}\" target=\"_blank\" ` +\n            `style=\"display:inline-block;padding:12px 28px;border-radius:${radius}px;` +\n            `background-color:${background};color:${color};font-family:${FONT};` +\n            `font-size:15px;font-weight:600;text-decoration:none;\">` +\n            escapeEmailHtml(label) +\n            `</a>`,\n          `padding:12px 0;text-align:${align};`,\n        )\n      }\n      case 'emailDivider': {\n        const color = colorOf(props.color, '#e0e0e0')\n        return row(\n          `<div style=\"border-top:1px solid ${color};font-size:0;line-height:0;\">&nbsp;</div>`,\n          'padding:12px 0;',\n        )\n      }\n      case 'emailSpacer': {\n        const height = Number(props.height) > 0 ? Number(props.height) : 24\n        return row(\n          `<div style=\"height:${height}px;font-size:0;line-height:0;\">&nbsp;</div>`,\n        )\n      }\n      case 'emailProduct': {\n        const product = props.productId\n          ? products?.[String(props.productId)]\n          : undefined\n        if (!product) return ''\n        const label = sub(props.buttonLabel ?? 'Shop now')\n        // Catalog data rather than author markup, and the caller absolutizes\n        // it before it arrives — but \"it came from a trusted table\" is a\n        // claim about every writer of that table, so the same rule applies\n        // here as to an author-typed href. Refused means no button and no\n        // line in the text part; the product card itself still renders.\n        const productUrl =\n          product.url && hasSafeLinkScheme(product.url)\n            ? product.url\n            : undefined\n        textParts.push(\n          `${product.name}${product.priceLabel ? ` — ${product.priceLabel}` : ''}` +\n            (productUrl ? `: ${productUrl}` : ''),\n        )\n        // Same treatment as emailImage: a catalog image can be a picked\n        // asset, so it carries the same reference/relative forms (AGL-1224).\n        const productImage = imageSrc(product.imageUrl)\n        const image = productImage\n          ? `<img src=\"${escapeEmailHtml(productImage)}\" alt=\"${escapeEmailHtml(product.name)}\" width=\"280\" style=\"max-width:100%;height:auto;border:0;border-radius:6px;\" /><br />`\n          : ''\n        const button = productUrl\n          ? `<a href=\"${escapeEmailHtml(productUrl)}\" target=\"_blank\" style=\"display:inline-block;margin-top:8px;padding:10px 24px;border-radius:${radius}px;background-color:${accent.fill};color:${accent.label};font-family:${FONT};font-size:14px;font-weight:600;text-decoration:none;\">${escapeEmailHtml(label)}</a>`\n          : ''\n        return row(\n          `<div style=\"border:1px solid #e0e0e0;border-radius:8px;padding:16px;text-align:center;font-family:${FONT};\">` +\n            image +\n            `<div style=\"font-size:16px;font-weight:600;margin-top:8px;\">${escapeEmailHtml(product.name)}</div>` +\n            (product.priceLabel\n              ? `<div style=\"font-size:14px;color:#555555;margin-top:2px;\">${escapeEmailHtml(product.priceLabel)}</div>`\n              : '') +\n            button +\n            `</div>`,\n          'padding:8px 0;',\n        )\n      }\n      default: {\n        // Unknown/web components: render their children so mixed documents\n        // degrade gracefully instead of dropping content.\n        return renderChildren(node.nodes)\n      }\n    }\n  }\n\n  const body = renderNode(rootId) || renderChildren(nodes[rootId]?.nodes)\n  const preheaderHtml = preheader\n    ? `<div style=\"display:none;max-height:0;overflow:hidden;mso-hide:all;\">` +\n      escapeEmailHtml(sub(preheader)) +\n      `</div>`\n    : ''\n\n  // INSIDE the 600px table, above the designed body, so it inherits the\n  // column's width on a phone instead of being centred against the viewport.\n  // `alt` is the product name where one is known, because a logo blocked by\n  // the client (which is the default in most inboxes) must still say who sent\n  // the mail. Height is capped rather than set, so a wordmark and a square\n  // mark both land at a sane size without the sender supplying dimensions.\n  //\n  // The src goes through `imageSrc` like every other image in the message\n  // (AGL-2230), and NOT into the tag raw. `emailLogoUrl` is collected by\n  // `MediaUrlField`, whose \"Browse\" button writes the picked asset's\n  // site-relative `cdnPath` — and the org DAM's other generation stores a\n  // `media:{scope}/{mediaId}` reference. Neither is a URL an inbox can\n  // resolve: there is no page to resolve it against, so a raw pass-through\n  // put `src=\"media:h1/med9\"` at the top of every transactional email a\n  // white-label org sent. `imageSrc` absolutizes both forms against\n  // `mediaOrigin`, passes a real https URL through untouched, and returns\n  // undefined when it cannot produce something fetchable — in which case the\n  // row is dropped, on the same reasoning as AGL-1224: a gap reads as a plain\n  // email, a broken-image box reads as a broken one.\n  const brandLogo = imageSrc(String(brandLogoUrl ?? '').trim()) ?? ''\n  // The product name from the merge map, because most inboxes block images by\n  // default — a logo with no `alt` is a blank box where the sender's identity\n  // should be. Falls back to nothing rather than to a literal, which would\n  // reintroduce the hard-coded brand this whole change removes.\n  const brandLogoAlt = merge?.['brand.productName'] ?? ''\n  const brandLogoHtml = brandLogo\n    ? row(\n        `<img src=\"${escapeEmailHtml(brandLogo)}\" alt=\"${escapeEmailHtml(brandLogoAlt)}\" ` +\n          `style=\"max-height:48px;max-width:200px;display:block;margin:0 auto;border:0;\" />`,\n        'padding:24px 24px 0;text-align:center;',\n      )\n    : ''\n\n  /**\n   * The chrome header row, or '' when it has nothing to draw.\n   *\n   * Same placement and the same `imageSrc` as the logo row above, which it\n   * replaces. Height is capped at 40px rather than set, so a wordmark and a\n   * square mark both land at a sane size; the `height` attribute is for the\n   * desktop clients that ignore CSS `max-height` and would otherwise draw the\n   * file at its own size. A logo that cannot be fetched from an inbox falls\n   * back to the name in bold, never to an `<img>` that draws a broken box.\n   * White, so the header and a default body read as one card.\n   */\n  const renderChromeHeader = (header: EmailChromeHeader): string => {\n    const logo = imageSrc(String(header.logoUrl ?? '').trim())\n    const name = sub(header.logoAlt).trim()\n    const href = linkHref(header.href)\n    const link = (inner: string, style: string): string =>\n      href\n        ? `<a href=\"${escapeEmailHtml(href)}\" target=\"_blank\" style=\"${style}\">${inner}</a>`\n        : inner\n    let mark: string\n    if (logo) {\n      mark = link(\n        `<img src=\"${escapeEmailHtml(logo)}\" alt=\"${escapeEmailHtml(name)}\" height=\"40\" ` +\n          `style=\"display:block;margin:0 auto;border:0;height:auto;width:auto;max-height:40px;max-width:200px;\" />`,\n        'text-decoration:none;',\n      )\n    } else if (name) {\n      mark =\n        `<div style=\"font-family:${FONT};font-size:20px;font-weight:700;line-height:1.3;color:${CHROME_PALETTE.ink};text-align:center;\">` +\n        link(escapeEmailHtml(name), `color:${CHROME_PALETTE.ink};text-decoration:none;`) +\n        `</div>`\n    } else {\n      return ''\n    }\n    return row(\n      mark,\n      `padding:24px 24px 0;text-align:center;background-color:${CHROME_PALETTE.card};`,\n    )\n  }\n\n  const headerHtml = chrome?.header\n    ? renderChromeHeader(chrome.header)\n    : brandLogoHtml\n\n  /**\n   * The chrome footer: rows under the body in the look of the email footer\n   * block the platform's own mail wears (a `#F8F9FA` section, padded 24,\n   * centered captions), and the same lines appended to the plain-text part.\n   *\n   * Rendered AFTER the body on purpose: the body's blocks push their text as\n   * they draw, and the footer's lines belong after all of it. A line that\n   * resolves to nothing is left out rather than drawn as an empty row.\n   */\n  const renderChromeFooter = (footer: EmailChromeFooter): string => {\n    const htmlLines: string[] = []\n    const textLines: string[] = []\n    const reason = sub(footer.reason).trim()\n    if (reason) {\n      htmlLines.push(escapeEmailHtml(reason))\n      textLines.push(reason)\n    }\n    const supportLabel = sub(footer.support?.label).trim()\n    const supportHref = linkHref(footer.support?.href)\n    if (supportLabel && supportHref) {\n      htmlLines.push(\n        `<a href=\"${escapeEmailHtml(supportHref)}\" target=\"_blank\" ` +\n          `style=\"color:${CHROME_PALETTE.caption};text-decoration:underline;\">${escapeEmailHtml(supportLabel)}</a>`,\n      )\n      // A plain-text reader gets the address itself, bare: a mailto's\n      // mailbox, or the URL. \"Get help: https://…\" names where it goes; a\n      // label that already IS the mailbox is not repeated.\n      const bare = /^mailto:/i.test(supportHref)\n        ? supportHref.slice('mailto:'.length).split('?')[0]\n        : supportHref\n      textLines.push(supportLabel === bare ? bare : `${supportLabel}: ${bare}`)\n    }\n    const legal = sub(footer.legal).trim()\n    if (legal) {\n      htmlLines.push(escapeEmailHtml(legal))\n      textLines.push(legal)\n    }\n    if (!htmlLines.length) return ''\n    textParts.push(textLines.join('\\n'))\n    return row(\n      htmlLines\n        .map(\n          (line, index) =>\n            `<div style=\"font-family:${FONT};font-size:12px;font-weight:400;line-height:1.4;color:${CHROME_PALETTE.caption};` +\n            `${index ? 'margin-top:8px;' : ''}\">${line.replace(/\\n/g, '<br />')}</div>`,\n        )\n        .join(''),\n      `padding:24px;text-align:center;background-color:${CHROME_PALETTE.band};`,\n    )\n  }\n\n  const footerHtml = chrome?.footer ? renderChromeFooter(chrome.footer) : ''\n\n  const html =\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\" />` +\n    `<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />` +\n    `<title>${escapeEmailHtml(sub(subject))}</title></head>` +\n    `<body style=\"margin:0;padding:0;background-color:#f4f4f4;\">` +\n    preheaderHtml +\n    `<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" style=\"background-color:#f4f4f4;\">` +\n    row(\n      `<table role=\"presentation\" width=\"600\" cellpadding=\"0\" cellspacing=\"0\" align=\"center\" style=\"max-width:600px;width:100%;margin:0 auto;\">` +\n        headerHtml +\n        body +\n        footerHtml +\n        `</table>`,\n      'padding:24px 8px;',\n    ) +\n    `</table></body></html>`\n\n  return { html, text: textParts.join('\\n\\n') }\n}\n"],"names":["hasSafeLinkScheme","hasSafeMediaScheme","linkifyEscapedText","resolveEmailColor","resolveEmailMediaSrc","FONT","CHROME_PALETTE","ink","card","band","caption","escapeEmailHtml","value","replace","substituteMergeTokens","merge","match","token","replacement","undefined","TEXT_STYLES","heading","subheading","body","row","cellHtml","cellStyle","EMAIL_NODE_ROOT_ID","renderEmailHtml","options","imageSrc","nodes","rootId","subject","preheader","products","sanitize","mediaOrigin","mediaHostId","brandLogoUrl","chrome","palette","buttonRadius","radius","Number","isFinite","Math","min","colorOf","fallback","accent","fill","label","link","textParts","sub","String","urlMerge","Object","fromEntries","entries","filter","startsWith","subUrl","linkHref","href","origin","resolved","stored","test","renderChildren","ids","map","id","renderNode","Boolean","join","node","props","componentId","background","backgroundColor","padding","align","text","children","trim","push","style","variant","color","html","src","width","alt","img","height","product","productId","buttonLabel","productUrl","url","name","priceLabel","productImage","imageUrl","image","button","preheaderHtml","brandLogo","brandLogoAlt","brandLogoHtml","renderChromeHeader","header","logo","logoUrl","logoAlt","inner","mark","headerHtml","renderChromeFooter","footer","htmlLines","textLines","reason","supportLabel","support","supportHref","bare","slice","length","split","legal","line","index","footerHtml"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GAED,SACEA,iBAAiB,EACjBC,kBAAkB,QACb,0CAAyC;AAEhD,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,SAASC,iBAAiB,QAA2B,qBAAiB;AACtE,SAASC,oBAAoB,QAAQ,uBAAmB;AAgLxD,MAAMC,OAAO;AAEb;;;;;;;;CAQC,GACD,MAAMC,iBAAiB;IACrB,sDAAsD,GACtDC,KAAK;IACL,+CAA+C,GAC/CC,MAAM;IACN,qBAAqB,GACrBC,MAAM;IACN,uCAAuC,GACvCC,SAAS;AACX;AAEA,OAAO,SAASC,gBAAgBC,KAAa;IAC3C,OAAOA,MACJC,OAAO,CAAC,MAAM,SACdA,OAAO,CAAC,MAAM,QACdA,OAAO,CAAC,MAAM,QACdA,OAAO,CAAC,MAAM;AACnB;AAEA,oEAAoE,GACpE,OAAO,SAASC,sBACdF,KAAa,EACbG,KAAyC;IAEzC,OAAOH,MAAMC,OAAO,CAAC,2BAA2B,CAACG,OAAOC;QACtD,MAAMC,cAAcH,yBAAAA,KAAO,CAACE,MAAM;QAClC,OAAOC,gBAAgBC,YAAYD,cAAcF;IACnD;AACF;AAEA,MAAMI,cAAsC;IAC1CC,SAAS,CAAC,+CAA+C,CAAC;IAC1DC,YAAY,CAAC,8CAA8C,CAAC;IAC5DC,MAAM,CAAC,+CAA+C,CAAC;IACvDb,SAAS,CAAC,8CAA8C,CAAC;AAC3D;AAEA,2DAA2D,GAC3D,MAAMc,MAAM,CAACC,UAAkBC,YAAY,EAAE,GAC3C,CAAC,eAAe,EAAEA,UAAU,EAAE,EAAED,SAAS,UAAU,CAAC;AAEtD;;;;;;;CAOC,GACD,OAAO,MAAME,qBAAqB,MAAK;AAEvC,OAAO,SAASC,gBAAgBC,OAA2B;QA+UvCC;QA1BgCC;IApTlD,MAAM,EACJA,KAAK,EACLC,SAAS,MAAM,EACfC,UAAU,EAAE,EACZC,YAAY,EAAE,EACdnB,KAAK,EACLoB,QAAQ,EACRC,QAAQ,EACRC,WAAW,EACXC,WAAW,EACXC,YAAY,EACZC,MAAM,EACNC,OAAO,EACPC,YAAY,EACb,GAAGb;IACJ,MAAMc,SACJC,OAAOC,QAAQ,CAACH,iBAAiBE,OAAOF,iBAAiB,IACrDI,KAAKC,GAAG,CAACH,OAAOF,eAAe,MAC/B;IAEN;;;;;GAKC,GACD,MAAMM,UAAU,CAACpC,OAAgBqC;YAC/B9C;gBAAAA,qBAAAA,kBAAkBS,OAAO6B,oBAAzBtC,qBAAqC8C;;IACvC,wDAAwD,GACxD,MAAMC,SAAS;QACbC,MAAMH,QAAQ,gBAAgB;QAC9BI,OAAOJ,QAAQ,wBAAwB;QACvC,oEAAoE;QACpE,wEAAwE;QACxEK,MAAML,QAAQ,gBAAgB;IAChC;IAEA,MAAMM,YAAsB,EAAE;IAC9B,MAAMC,MAAM,CAAC3C,QACXE,sBAAsB0C,OAAO5C,gBAAAA,QAAS,KAAKG;IAE7C;;;;;;;;;;;;;;;;;;;;;GAqBC,GACD,MAAM0C,WAAW1C,QACb2C,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAAC7C,OAAO8C,MAAM,CAC1B,CAAC,CAAC5C,MAAM,GAAK,CAACA,MAAM6C,UAAU,CAAC,gBAGnC3C;IAEJ,wEAAwE,GACxE,MAAM4C,SAAS,CAACnD,QACdE,sBAAsB0C,OAAO5C,gBAAAA,QAAS,KAAK6C;IAE7C;;;;;;;;GAQC,GACD,MAAMO,WAAW,CAACpD;QAChB,MAAMqD,OAAOF,OAAOnD;QACpB,IAAI,CAACqD,MAAM,OAAO9C;QAClB,OAAOnB,kBAAkBiE,QAAQA,OAAO9C;IAC1C;IAEA,MAAM+C,SAAS7B,+BAAAA,YAAaxB,OAAO,CAAC,QAAQ;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCC,GACD,MAAMiB,WAAW,CAAClB;QAChB,MAAMuD,WAAW/D,qBAAqB2D,OAAOnD,QAAQ0B;QACrD,IAAI,CAAC6B,YAAY,CAAClE,mBAAmBkE,WAAW,OAAOhD;QACvD,IAAI,CAACgD,SAASL,UAAU,CAAC,QAAQK,SAASL,UAAU,CAAC,OAAO,OAAOK;QACnE,IAAID,QAAQ,OAAO,GAAGA,SAASC,UAAU;QACzC,sEAAsE;QACtE,yEAAyE;QACzE,oCAAoC;QACpC,MAAMC,SAASL,OAAOnD;QACtB,OAAOwD,UAAU,eAAeC,IAAI,CAACD,UAAUA,SAASjD;IAC1D;IAEA,MAAMmD,iBAAiB,CAACC,MACtB,CAACA,cAAAA,MAAO,EAAE,EACPC,GAAG,CAAC,CAACC,KAAOC,WAAWD,KACvBZ,MAAM,CAACc,SACPC,IAAI,CAAC;IAEV,MAAMF,aAAa,CAACD;YAGJI;QAFd,MAAMA,OAAO9C,KAAK,CAAC0C,GAAG;QACtB,IAAI,CAACI,MAAM,OAAO;QAClB,MAAMC,SAAQD,cAAAA,KAAKC,KAAK,YAAVD,cAAc,CAAC;QAC7B,OAAQA,KAAKE,WAAW;YACtB,KAAK;gBAAgB;oBACnB,MAAMC,aAAahC,QAAQ8B,MAAMG,eAAe,EAAE;oBAClD,MAAMC,UAAUtC,OAAOC,QAAQ,CAACD,OAAOkC,MAAMI,OAAO,KAChDtC,OAAOkC,MAAMI,OAAO,IACpB;oBACJ,MAAMC,QAAQL,MAAMK,KAAK,IAAI;oBAC7B,kEAAkE;oBAClE,sEAAsE;oBACtE,uEAAuE;oBACvE,sEAAsE;oBACtE,wEAAwE;oBACxE,mEAAmE;oBACnE,+DAA+D;oBAC/D,OAAO3D,IACL,CAAC,wEAAwE,CAAC,GACxE,CAAC,wBAAwB,EAAEwD,WAAW,GAAG,CAAC,GAC1CxD,IACE,CAAC,wEAAwE,CAAC,GACxE8C,eAAeO,KAAK9C,KAAK,IACzB,CAAC,QAAQ,CAAC,EACZ,CAAC,QAAQ,EAAEmD,QAAQ,cAAc,EAAEC,MAAM,CAAC,CAAC,IAE7C,CAAC,QAAQ,CAAC;gBAEhB;YACA,KAAK;gBAAa;wBAOF/D;oBANd,MAAMgE,OAAO7B,IAAIuB,MAAMO,QAAQ;oBAC/B,4DAA4D;oBAC5D,oEAAoE;oBACpE,4DAA4D;oBAC5D,IAAI,CAACD,KAAKE,IAAI,IAAI,OAAO;oBACzBhC,UAAUiC,IAAI,CAACH;oBACf,MAAMI,SAAQpE,6BAAAA,WAAW,CAAC0D,MAAMW,OAAO,CAAW,YAApCrE,6BAAwCA,WAAW,CAAC,OAAO;oBACzE,MAAMsE,QAAQ1C,QAAQ8B,MAAMY,KAAK,EAAE;oBACnC,MAAMP,QAAQL,MAAMK,KAAK,IAAI;oBAC7B,OAAO3D,IACL,CAAC,wBAAwB,EAAEnB,KAAK,CAAC,EAAEmF,MAAM,OAAO,EAAEE,MAAM,YAAY,EAAEP,MAAM,GAAG,CAAC,GAC9EjF,mBAAmBS,gBAAgByE,OAAOlC,OAAOG,IAAI,EAAExC,OAAO,CAAC,OAAO,YACtE,CAAC,MAAM,CAAC,EACV;gBAEJ;YACA,KAAK;YACL,KAAK;gBAAa;oBAChB,MAAM8E,OAAOvD,SAASmB,IAAIuB,MAAMa,IAAI;oBACpC,IAAI,CAACA,KAAKL,IAAI,IAAI,OAAO;oBACzBhC,UAAUiC,IAAI,CAACI,KAAK9E,OAAO,CAAC,YAAY,KAAKyE,IAAI;oBACjD,OAAO9D,IACL,CAAC,wBAAwB,EAAEnB,KAAK,mCAAmC,EAAEsF,KAAK,MAAM,CAAC,EACjF;gBAEJ;YACA,KAAK;gBAAc;wBAIkBb;oBAHnC,MAAMc,MAAM9D,SAASgD,MAAMc,GAAG;oBAC9B,IAAI,CAACA,KAAK,OAAO;oBACjB,MAAMC,QAAQjD,OAAOkC,MAAMe,KAAK,IAAI,IAAIjD,OAAOkC,MAAMe,KAAK,IAAI;oBAC9D,MAAMC,MAAMnF,gBAAgB6C,QAAOsB,aAAAA,MAAMgB,GAAG,YAAThB,aAAa;oBAChD,MAAMK,QAAQL,MAAMK,KAAK,IAAI;oBAC7B,MAAMY,MACJ,CAAC,UAAU,EAAEpF,gBAAgBiF,KAAK,OAAO,EAAEE,IAAI,SAAS,EAAEhD,KAAKC,GAAG,CAAC8C,OAAO,KAAK,EAAE,CAAC,GAClF,CAAC,oEAAoE,CAAC;oBACxE,sEAAsE;oBACtE,4CAA4C;oBAC5C,MAAM5B,OAAOD,SAASc,MAAMb,IAAI;oBAChC,OAAOzC,IACLyC,OACI,CAAC,SAAS,EAAEtD,gBAAgBsD,MAAM,kBAAkB,EAAE8B,IAAI,IAAI,CAAC,GAC/DA,KACJ,CAAC,yBAAyB,EAAEZ,MAAM,CAAC,CAAC;gBAExC;YACA,KAAK;gBAAe;wBACAL,iBAQLd,WAASc;oBARtB,MAAM1B,QAAQG,KAAIuB,kBAAAA,MAAMO,QAAQ,YAAdP,kBAAkB;oBACpC,sEAAsE;oBACtE,sEAAsE;oBACtE,qEAAqE;oBACrE,oEAAoE;oBACpE,iEAAiE;oBACjE,oEAAoE;oBACpE,kDAAkD;oBAClD,MAAMb,QAAOD,YAAAA,UAASc,cAAAA,MAAMb,IAAI,YAAVa,cAAc,gBAAvBd,YAA+B;oBAC5C,MAAMgB,aAAahC,QAAQ8B,MAAMG,eAAe,EAAE/B,OAAOC,IAAI;oBAC7D,MAAMuC,QAAQ1C,QAAQ8B,MAAMY,KAAK,EAAExC,OAAOE,KAAK;oBAC/C,MAAM+B,QAAQL,MAAMK,KAAK,IAAI;oBAC7B7B,UAAUiC,IAAI,CAAC,GAAGnC,MAAM,EAAE,EAAEa,MAAM;oBAClC,wDAAwD;oBACxD,OAAOzC,IACL,CAAC,SAAS,EAAEb,gBAAgBsD,MAAM,kBAAkB,CAAC,GACnD,CAAC,4DAA4D,EAAEtB,OAAO,GAAG,CAAC,GAC1E,CAAC,iBAAiB,EAAEqC,WAAW,OAAO,EAAEU,MAAM,aAAa,EAAErF,KAAK,CAAC,CAAC,GACpE,CAAC,sDAAsD,CAAC,GACxDM,gBAAgByC,SAChB,CAAC,IAAI,CAAC,EACR,CAAC,0BAA0B,EAAE+B,MAAM,CAAC,CAAC;gBAEzC;YACA,KAAK;gBAAgB;oBACnB,MAAMO,QAAQ1C,QAAQ8B,MAAMY,KAAK,EAAE;oBACnC,OAAOlE,IACL,CAAC,iCAAiC,EAAEkE,MAAM,yCAAyC,CAAC,EACpF;gBAEJ;YACA,KAAK;gBAAe;oBAClB,MAAMM,SAASpD,OAAOkC,MAAMkB,MAAM,IAAI,IAAIpD,OAAOkC,MAAMkB,MAAM,IAAI;oBACjE,OAAOxE,IACL,CAAC,mBAAmB,EAAEwE,OAAO,2CAA2C,CAAC;gBAE7E;YACA,KAAK;gBAAgB;wBAKDlB;oBAJlB,MAAMmB,UAAUnB,MAAMoB,SAAS,GAC3B/D,4BAAAA,QAAU,CAACqB,OAAOsB,MAAMoB,SAAS,EAAE,GACnC/E;oBACJ,IAAI,CAAC8E,SAAS,OAAO;oBACrB,MAAM7C,QAAQG,KAAIuB,qBAAAA,MAAMqB,WAAW,YAAjBrB,qBAAqB;oBACvC,qEAAqE;oBACrE,iEAAiE;oBACjE,mEAAmE;oBACnE,kEAAkE;oBAClE,gEAAgE;oBAChE,MAAMsB,aACJH,QAAQI,GAAG,IAAIrG,kBAAkBiG,QAAQI,GAAG,IACxCJ,QAAQI,GAAG,GACXlF;oBACNmC,UAAUiC,IAAI,CACZ,GAAGU,QAAQK,IAAI,GAAGL,QAAQM,UAAU,GAAG,CAAC,GAAG,EAAEN,QAAQM,UAAU,EAAE,GAAG,IAAI,GACrEH,CAAAA,aAAa,CAAC,EAAE,EAAEA,YAAY,GAAG,EAAC;oBAEvC,gEAAgE;oBAChE,qEAAqE;oBACrE,MAAMI,eAAe1E,SAASmE,QAAQQ,QAAQ;oBAC9C,MAAMC,QAAQF,eACV,CAAC,UAAU,EAAE7F,gBAAgB6F,cAAc,OAAO,EAAE7F,gBAAgBsF,QAAQK,IAAI,EAAE,qFAAqF,CAAC,GACxK;oBACJ,MAAMK,SAASP,aACX,CAAC,SAAS,EAAEzF,gBAAgByF,YAAY,6FAA6F,EAAEzD,OAAO,oBAAoB,EAAEO,OAAOC,IAAI,CAAC,OAAO,EAAED,OAAOE,KAAK,CAAC,aAAa,EAAE/C,KAAK,uDAAuD,EAAEM,gBAAgByC,OAAO,IAAI,CAAC,GAC/S;oBACJ,OAAO5B,IACL,CAAC,kGAAkG,EAAEnB,KAAK,GAAG,CAAC,GAC5GqG,QACA,CAAC,4DAA4D,EAAE/F,gBAAgBsF,QAAQK,IAAI,EAAE,MAAM,CAAC,GACnGL,CAAAA,QAAQM,UAAU,GACf,CAAC,0DAA0D,EAAE5F,gBAAgBsF,QAAQM,UAAU,EAAE,MAAM,CAAC,GACxG,EAAC,IACLI,SACA,CAAC,MAAM,CAAC,EACV;gBAEJ;YACA;gBAAS;oBACP,mEAAmE;oBACnE,kDAAkD;oBAClD,OAAOrC,eAAeO,KAAK9C,KAAK;gBAClC;QACF;IACF;IAEA,MAAMR,OAAOmD,WAAW1C,WAAWsC,gBAAevC,gBAAAA,KAAK,CAACC,OAAO,qBAAbD,cAAeA,KAAK;IACtE,MAAM6E,gBAAgB1E,YAClB,CAAC,qEAAqE,CAAC,GACvEvB,gBAAgB4C,IAAIrB,cACpB,CAAC,MAAM,CAAC,GACR;IAEJ,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,EAAE;IACF,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,sEAAsE;IACtE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM2E,aAAY/E,YAAAA,SAAS0B,OAAOjB,uBAAAA,eAAgB,IAAI+C,IAAI,eAAxCxD,YAA+C;IACjE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAMgF,uBAAe/F,yBAAAA,KAAO,CAAC,oBAAoB,mBAAI;IACrD,MAAMgG,gBAAgBF,YAClBrF,IACE,CAAC,UAAU,EAAEb,gBAAgBkG,WAAW,OAAO,EAAElG,gBAAgBmG,cAAc,EAAE,CAAC,GAChF,CAAC,gFAAgF,CAAC,EACpF,4CAEF;IAEJ;;;;;;;;;;GAUC,GACD,MAAME,qBAAqB,CAACC;YACGA;QAA7B,MAAMC,OAAOpF,SAAS0B,QAAOyD,kBAAAA,OAAOE,OAAO,YAAdF,kBAAkB,IAAI3B,IAAI;QACvD,MAAMgB,OAAO/C,IAAI0D,OAAOG,OAAO,EAAE9B,IAAI;QACrC,MAAMrB,OAAOD,SAASiD,OAAOhD,IAAI;QACjC,MAAMZ,OAAO,CAACgE,OAAe7B,QAC3BvB,OACI,CAAC,SAAS,EAAEtD,gBAAgBsD,MAAM,yBAAyB,EAAEuB,MAAM,EAAE,EAAE6B,MAAM,IAAI,CAAC,GAClFA;QACN,IAAIC;QACJ,IAAIJ,MAAM;YACRI,OAAOjE,KACL,CAAC,UAAU,EAAE1C,gBAAgBuG,MAAM,OAAO,EAAEvG,gBAAgB2F,MAAM,cAAc,CAAC,GAC/E,CAAC,uGAAuG,CAAC,EAC3G;QAEJ,OAAO,IAAIA,MAAM;YACfgB,OACE,CAAC,wBAAwB,EAAEjH,KAAK,sDAAsD,EAAEC,eAAeC,GAAG,CAAC,qBAAqB,CAAC,GACjI8C,KAAK1C,gBAAgB2F,OAAO,CAAC,MAAM,EAAEhG,eAAeC,GAAG,CAAC,sBAAsB,CAAC,IAC/E,CAAC,MAAM,CAAC;QACZ,OAAO;YACL,OAAO;QACT;QACA,OAAOiB,IACL8F,MACA,CAAC,uDAAuD,EAAEhH,eAAeE,IAAI,CAAC,CAAC,CAAC;IAEpF;IAEA,MAAM+G,aAAa/E,CAAAA,0BAAAA,OAAQyE,MAAM,IAC7BD,mBAAmBxE,OAAOyE,MAAM,IAChCF;IAEJ;;;;;;;;GAQC,GACD,MAAMS,qBAAqB,CAACC;YAQDA,iBACIA;QAR7B,MAAMC,YAAsB,EAAE;QAC9B,MAAMC,YAAsB,EAAE;QAC9B,MAAMC,SAASrE,IAAIkE,OAAOG,MAAM,EAAEtC,IAAI;QACtC,IAAIsC,QAAQ;YACVF,UAAUnC,IAAI,CAAC5E,gBAAgBiH;YAC/BD,UAAUpC,IAAI,CAACqC;QACjB;QACA,MAAMC,eAAetE,KAAIkE,kBAAAA,OAAOK,OAAO,qBAAdL,gBAAgBrE,KAAK,EAAEkC,IAAI;QACpD,MAAMyC,cAAc/D,UAASyD,mBAAAA,OAAOK,OAAO,qBAAdL,iBAAgBxD,IAAI;QACjD,IAAI4D,gBAAgBE,aAAa;YAC/BL,UAAUnC,IAAI,CACZ,CAAC,SAAS,EAAE5E,gBAAgBoH,aAAa,kBAAkB,CAAC,GAC1D,CAAC,aAAa,EAAEzH,eAAeI,OAAO,CAAC,6BAA6B,EAAEC,gBAAgBkH,cAAc,IAAI,CAAC;YAE7G,gEAAgE;YAChE,oEAAoE;YACpE,qDAAqD;YACrD,MAAMG,OAAO,YAAY3D,IAAI,CAAC0D,eAC1BA,YAAYE,KAAK,CAAC,UAAUC,MAAM,EAAEC,KAAK,CAAC,IAAI,CAAC,EAAE,GACjDJ;YACJJ,UAAUpC,IAAI,CAACsC,iBAAiBG,OAAOA,OAAO,GAAGH,aAAa,EAAE,EAAEG,MAAM;QAC1E;QACA,MAAMI,QAAQ7E,IAAIkE,OAAOW,KAAK,EAAE9C,IAAI;QACpC,IAAI8C,OAAO;YACTV,UAAUnC,IAAI,CAAC5E,gBAAgByH;YAC/BT,UAAUpC,IAAI,CAAC6C;QACjB;QACA,IAAI,CAACV,UAAUQ,MAAM,EAAE,OAAO;QAC9B5E,UAAUiC,IAAI,CAACoC,UAAU/C,IAAI,CAAC;QAC9B,OAAOpD,IACLkG,UACGlD,GAAG,CACF,CAAC6D,MAAMC,QACL,CAAC,wBAAwB,EAAEjI,KAAK,sDAAsD,EAAEC,eAAeI,OAAO,CAAC,CAAC,CAAC,GACjH,GAAG4H,QAAQ,oBAAoB,GAAG,EAAE,EAAED,KAAKxH,OAAO,CAAC,OAAO,UAAU,MAAM,CAAC,EAE9E+D,IAAI,CAAC,KACR,CAAC,gDAAgD,EAAEtE,eAAeG,IAAI,CAAC,CAAC,CAAC;IAE7E;IAEA,MAAM8H,aAAa/F,CAAAA,0BAAAA,OAAQiF,MAAM,IAAGD,mBAAmBhF,OAAOiF,MAAM,IAAI;IAExE,MAAM9B,OACJ,CAAC,mDAAmD,CAAC,GACrD,CAAC,sEAAsE,CAAC,GACxE,CAAC,OAAO,EAAEhF,gBAAgB4C,IAAItB,UAAU,eAAe,CAAC,GACxD,CAAC,2DAA2D,CAAC,GAC7D2E,gBACA,CAAC,0GAA0G,CAAC,GAC5GpF,IACE,CAAC,wIAAwI,CAAC,GACxI+F,aACAhG,OACAgH,aACA,CAAC,QAAQ,CAAC,EACZ,uBAEF,CAAC,sBAAsB,CAAC;IAE1B,OAAO;QAAE5C;QAAMP,MAAM9B,UAAUsB,IAAI,CAAC;IAAQ;AAC9C"}

package/src/lib/hosted-page-screen.d.ts

@@ -35,6 +35,13 @@ export interface HostedPageScreenVerdict {
      * link reputation lookup reads (AGL-3451), so the page is walked once.
      */
     linkHosts: string[];
+    /**
+     * The same links whole, as written (`linkUrlsIn`), for the lookup's
+     * `'url'` mode (AGL-3459). Query strings are still on them:
+     * `foreignLinksForReputation` drops them before anything is looked up or
+     * stored.
+     */
+    linkUrls: string[];
 }
 /**
  * The credential an input asks for, read from the two attributes that decide

package/src/lib/hosted-page-screen.js

@@ -69,7 +69,7 @@
  *
  * Pure: the caller hands over the composed node tree and the workspace's own
  * names and hosts, and decides what a hold does.
- *=========================================*/ import { ACCOUNT_LURE_PATTERNS, DOCUMENT_SHARE_LURE_PATTERNS, isWorkspaceOwnBrand, linkHostsIn, isBrandsOwnDomain, lookalikeBrandForHost, PHISHING_LURE_PATTERNS, PHISHING_SCREEN_BRANDS, registrableDomain, isAnyOfficialBrandDomain, isCommonLinkDomain, squashScreenText, visibleTextOf } from "./outbound-phishing-screen.js";
+ *=========================================*/ import { ACCOUNT_LURE_PATTERNS, DOCUMENT_SHARE_LURE_PATTERNS, isWorkspaceOwnBrand, linkHostsIn, linkUrlsIn, isBrandsOwnDomain, lookalikeBrandForHost, PHISHING_LURE_PATTERNS, PHISHING_SCREEN_BRANDS, registrableDomain, isAnyOfficialBrandDomain, isCommonLinkDomain, squashScreenText, visibleTextOf } from "./outbound-phishing-screen.js";
 /** The most a page's text is read to, so a huge page costs a bounded scan. */ const MAX_PAGE_TEXT = 2000000;
 /** The most nodes the walk visits. */ const MAX_NODES = 20000;
 /** Props that describe a field the author defined, rather than content. */ const FIELD_PROP_KEYS = [
@@ -388,7 +388,8 @@
     }
     return {
         signals,
-        linkHosts
+        linkHosts,
+        linkUrls: linkUrlsIn(pageText)
     };
 }
 /**
@@ -458,10 +459,13 @@
     var _input_destination, _input_ownNames, _input_ownDomains, _input_source;
     const signals = [];
     const destination = String((_input_destination = input.destination) != null ? _input_destination : '').trim();
-    const hosts = linkHostsIn(destination.startsWith('//') ? `https:${destination}` : destination);
+    const absolute = destination.startsWith('//') ? `https:${destination}` : destination;
+    const hosts = linkHostsIn(absolute);
+    const linkUrls = linkUrlsIn(absolute);
     if (!hosts.length) return {
         signals,
-        linkHosts: hosts
+        linkHosts: hosts,
+        linkUrls
     };
     const ownNames = squashScreenText(((_input_ownNames = input.ownNames) != null ? _input_ownNames : []).filter(Boolean).join(' '));
     const ownHosts = ((_input_ownDomains = input.ownDomains) != null ? _input_ownDomains : []).map((domain)=>String(domain != null ? domain : '').trim().toLowerCase().replace(/\.+$/, '')).filter((domain)=>domain.includes('.'));
@@ -482,7 +486,8 @@
     const leaves = !ownHosts.some((own)=>host === own || host.endsWith(`.${own}`)) && !isAnyOfficialBrandDomain(registrable) && !isCommonLinkDomain(registrable);
     if (!leaves) return {
         signals,
-        linkHosts: hosts
+        linkHosts: hosts,
+        linkUrls
     };
     const source = String((_input_source = input.source) != null ? _input_source : '').trim();
     const words = pathWords(source);
@@ -509,7 +514,8 @@
     }
     return {
         signals,
-        linkHosts: hosts
+        linkHosts: hosts,
+        linkUrls
     };
 }
 /** A path read as words: `/secure-document_access` → `secure document access`. */ function pathWords(path) {