@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/tenant-write-lockdown.d.ts

@@ -0,0 +1,131 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The lockdown gate for VISITOR writes on a customer's live site
+ * (AGL-1511) — form submissions, cart changes, checkout.
+ *
+ * Why this is its own chokepoint rather than the console's. The tenant
+ * middleware, which is where AGL-1501 enforces, **does not match `/api`**
+ * (see the matcher in apps/tenant/middleware.ts): it exists to stop CACHED
+ * PAGES serving. So the site's own write endpoints have had no lockdown
+ * enforcement at all — under a full org takedown the pages 503 while a form
+ * POST still writes. This closes that for both modes.
+ *
+ * The product decision this file encodes, from the issue: a visitor-facing
+ * write on a read-serving site gets a **polite inline pause, never a
+ * page-level 503**. A customer's site staying up and earning is the entire
+ * reason read-only mode exists instead of full lockdown, and answering their
+ * visitors with an outage page would spend exactly what the mode was
+ * protecting. So the refusal is a 423 with visitor copy the block renders
+ * inline, and the page around it never stops rendering.
+ *
+ * Under a FULL lock the same 423 is returned rather than a 503, and that is
+ * deliberate too: the middleware has already replaced the whole page for
+ * anyone loading it, so a write arriving here is a stale tab or a script,
+ * and a machine-readable refusal is more useful to both than an HTML page.
+ *
+ * NO staff bypass and NO user scope, matching /api/lockdown-verdict: this is
+ * a public website, the caller is anonymous, and a visitor's identity plays
+ * no part in whether a site accepts an order.
+ */
+import { type LockdownIntent, type LockdownPausedSurface, type LockdownState } from '@aglyn/aglyn/server';
+/**
+ * The active platform/org/host lockdown for one site, or null.
+ *
+ * Both reads are already paid by the callers on this path — the dispatcher
+ * reads the host doc for its plugin deny-list and the org doc for
+ * enablement, and both getters are `React.cache`-deduped per request — so
+ * the gate costs one TTL-cached platform read and nothing else.
+ *
+ * FAIL OPEN on any error, matching every other lockdown reader: an
+ * unreachable Firestore is an outage, not a lockdown, and a shop that stops
+ * taking orders because a read timed out is a worse failure than the one
+ * being guarded against.
+ *
+ * …EXCEPT for a takedown (AGL-1881, extending AGL-1621). One class of lock
+ * inverts that cost function — "the database was down" is not an answer to a
+ * court order — and until now the ledger that carries it covered only the
+ * four scopes whose lock lives in `lockdowns/*`. Org and host locks live on
+ * the org/host document, so the two scopes MOST likely to be carrying a
+ * legal order were the two that fell through. Every successful read now
+ * records its org and host verdict, and a failed read serves back whichever
+ * of them was a takedown and is still active.
+ *
+ * Note what is NOT done here: the catch does not fail closed on the state it
+ * could not read. On a read failure `suspendedEnforcement` is exactly as
+ * unreadable as everything else, which is the whole reason a separate
+ * durable ledger exists — and a catch that locked unconditionally would take
+ * every shop on the platform offline on any transient blip, which is the
+ * deliberate posture this keeps for the default case.
+ */
+export declare function getSiteLockdown(hostId: string, nowMs?: number): Promise<LockdownState | null>;
+/**
+ * The refusal a visitor-facing write route returns, or null to proceed:
+ *
+ *   const paused = await visitorWriteRefusal({ hostId, request, surface })
+ *   if (paused) return paused
+ *
+ * `surface` picks the WORDS only (`lockdownPausedNotice`) — the checkout
+ * sentence has to promise no card was charged, and no generic copy can.
+ */
+export declare function visitorWriteRefusal(options: {
+    hostId: string;
+    /** The request whose method decides read vs write. */
+    request?: {
+        method?: string;
+    } | null;
+    /** Overrides `request`; `write` when neither is given. */
+    intent?: LockdownIntent;
+    surface: LockdownPausedSurface;
+    nowMs?: number;
+}): Promise<Response | null>;
+/**
+ * The refusal a visitor-facing route that SERVES SITE CONTENT over `/api`
+ * returns under a FULL lock, or null to proceed (AGL-2495):
+ *
+ *   const down = await visitorContentRefusal({ hostId })
+ *   if (down) return down
+ *
+ * The gap this closes, found by the AGL-1621 drill. The tenant middleware
+ * is what takes a locked site off the air, and its matcher deliberately
+ * excludes `/api` — so a full org or host takedown 503s every page while an
+ * API route that composes and returns screen nodes keeps handing the site's
+ * content out to anyone who can name a screen. `visitorWriteRefusal` above
+ * cannot answer that: it leaves before any read, by design, because it is a
+ * WRITE gate on the hot unauthenticated GET path.
+ *
+ * FULL locks only, and that is the whole point of it being a separate
+ * helper rather than a flag on the write gate. Read-only mode exists so a
+ * customer's site keeps serving and earning; refusing reads there would
+ * spend exactly what the mode protects. `lockdownBlocks(state, 'read')` is
+ * true only when the mode is full, which is precisely the case where the
+ * pages are already gone.
+ *
+ * Deliberately NOT applied to the whole tenant API surface. A read-refusing
+ * gate on every route would take the lock notice, the verdict probe and the
+ * abuse intake down with the site. This is for the routes that serve the
+ * SITE ITSELF — a composed node tree — where continuing to serve is
+ * continuing to publish. `serve-media-cdn.ts` made the same call for bytes
+ * (AGL-1520); this is the node-tree half of it.
+ *
+ * Fails OPEN through `getSiteLockdown`, like every other reader here.
+ */
+export declare function visitorContentRefusal(options: {
+    hostId: string;
+    surface?: LockdownPausedSurface;
+    nowMs?: number;
+}): Promise<Response | null>;

package/src/lib/server/tenant-write-lockdown.js

@@ -0,0 +1,176 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The lockdown gate for VISITOR writes on a customer's live site
+ * (AGL-1511) — form submissions, cart changes, checkout.
+ *
+ * Why this is its own chokepoint rather than the console's. The tenant
+ * middleware, which is where AGL-1501 enforces, **does not match `/api`**
+ * (see the matcher in apps/tenant/middleware.ts): it exists to stop CACHED
+ * PAGES serving. So the site's own write endpoints have had no lockdown
+ * enforcement at all — under a full org takedown the pages 503 while a form
+ * POST still writes. This closes that for both modes.
+ *
+ * The product decision this file encodes, from the issue: a visitor-facing
+ * write on a read-serving site gets a **polite inline pause, never a
+ * page-level 503**. A customer's site staying up and earning is the entire
+ * reason read-only mode exists instead of full lockdown, and answering their
+ * visitors with an outage page would spend exactly what the mode was
+ * protecting. So the refusal is a 423 with visitor copy the block renders
+ * inline, and the page around it never stops rendering.
+ *
+ * Under a FULL lock the same 423 is returned rather than a 503, and that is
+ * deliberate too: the middleware has already replaced the whole page for
+ * anyone loading it, so a write arriving here is a stale tab or a script,
+ * and a machine-readable refusal is more useful to both than an HTML page.
+ *
+ * NO staff bypass and NO user scope, matching /api/lockdown-verdict: this is
+ * a public website, the caller is anonymous, and a visitor's identity plays
+ * no part in whether a site accepts an order.
+ */ import { isLockdownActive, lockdownBlocks, lockdownIntentForMethod, lockdownPausedNotice, normalizeHostLockdown, normalizeOrgLockdown, resolveLockdown } from "@aglyn/aglyn/server";
+import { getPlatformLockdown, heldSiteTakedown, lockdownJsonResponse, rememberSiteTakedown } from "./lockdown.js";
+import { getHostDocAdmin, getOrgForHost } from "./organizations.js";
+/**
+ * The active platform/org/host lockdown for one site, or null.
+ *
+ * Both reads are already paid by the callers on this path — the dispatcher
+ * reads the host doc for its plugin deny-list and the org doc for
+ * enablement, and both getters are `React.cache`-deduped per request — so
+ * the gate costs one TTL-cached platform read and nothing else.
+ *
+ * FAIL OPEN on any error, matching every other lockdown reader: an
+ * unreachable Firestore is an outage, not a lockdown, and a shop that stops
+ * taking orders because a read timed out is a worse failure than the one
+ * being guarded against.
+ *
+ * …EXCEPT for a takedown (AGL-1881, extending AGL-1621). One class of lock
+ * inverts that cost function — "the database was down" is not an answer to a
+ * court order — and until now the ledger that carries it covered only the
+ * four scopes whose lock lives in `lockdowns/*`. Org and host locks live on
+ * the org/host document, so the two scopes MOST likely to be carrying a
+ * legal order were the two that fell through. Every successful read now
+ * records its org and host verdict, and a failed read serves back whichever
+ * of them was a takedown and is still active.
+ *
+ * Note what is NOT done here: the catch does not fail closed on the state it
+ * could not read. On a read failure `suspendedEnforcement` is exactly as
+ * unreadable as everything else, which is the whole reason a separate
+ * durable ledger exists — and a catch that locked unconditionally would take
+ * every shop on the platform offline on any transient blip, which is the
+ * deliberate posture this keeps for the default case.
+ */ export async function getSiteLockdown(hostId, nowMs = Date.now()) {
+    if (!hostId) return null;
+    try {
+        const [platform, resolved, host] = await Promise.all([
+            getPlatformLockdown(),
+            getOrgForHost(hostId),
+            getHostDocAdmin(hostId)
+        ]);
+        const org = normalizeOrgLockdown(resolved == null ? void 0 : resolved.org);
+        const hostState = normalizeHostLockdown(host);
+        rememberSiteTakedown(hostId, {
+            org,
+            host: hostState
+        });
+        const state = resolveLockdown({
+            platform,
+            org,
+            host: hostState
+        }, nowMs);
+        return isLockdownActive(state, nowMs) ? state : null;
+    } catch (error) {
+        console.error('[tenant-write-lockdown] verdict failed', hostId, error);
+        const held = heldSiteTakedown(hostId, nowMs);
+        // The shipped fail-open answer, returned by the same statement it always
+        // was, for every case where nothing takedown-class was ever observed.
+        if (!held.org && !held.host) return null;
+        // The platform read is TTL-cached and swallows its own errors (it carries
+        // its own ledger entry), so asking again here costs nothing and keeps a
+        // wider lock from being masked by a narrower held one.
+        const platform = await getPlatformLockdown().catch(()=>null);
+        const state = resolveLockdown({
+            platform,
+            org: held.org,
+            host: held.host
+        }, nowMs);
+        return isLockdownActive(state, nowMs) ? state : null;
+    }
+}
+/**
+ * The refusal a visitor-facing write route returns, or null to proceed:
+ *
+ *   const paused = await visitorWriteRefusal({ hostId, request, surface })
+ *   if (paused) return paused
+ *
+ * `surface` picks the WORDS only (`lockdownPausedNotice`) — the checkout
+ * sentence has to promise no card was charged, and no generic copy can.
+ */ export async function visitorWriteRefusal(options) {
+    var _options_nowMs, _options_intent;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const intent = (_options_intent = options.intent) != null ? _options_intent : options.request ? lockdownIntentForMethod(options.request.method) : 'write';
+    // This is a WRITE gate: reads leave before any Firestore read, so the hot
+    // unauthenticated GET path pays nothing. A full lock's refusal of tenant
+    // API *reads* is not attempted here and is unchanged from today — the
+    // middleware owns the page surface, and a read-refusing API gate is its
+    // own decision with its own blast radius (filed separately).
+    if (intent === 'read') return null;
+    const state = await getSiteLockdown(options.hostId, nowMs);
+    if (!lockdownBlocks(state, intent)) return null;
+    return lockdownJsonResponse(state, {
+        notice: lockdownPausedNotice(options.surface)
+    });
+}
+/**
+ * The refusal a visitor-facing route that SERVES SITE CONTENT over `/api`
+ * returns under a FULL lock, or null to proceed (AGL-2495):
+ *
+ *   const down = await visitorContentRefusal({ hostId })
+ *   if (down) return down
+ *
+ * The gap this closes, found by the AGL-1621 drill. The tenant middleware
+ * is what takes a locked site off the air, and its matcher deliberately
+ * excludes `/api` — so a full org or host takedown 503s every page while an
+ * API route that composes and returns screen nodes keeps handing the site's
+ * content out to anyone who can name a screen. `visitorWriteRefusal` above
+ * cannot answer that: it leaves before any read, by design, because it is a
+ * WRITE gate on the hot unauthenticated GET path.
+ *
+ * FULL locks only, and that is the whole point of it being a separate
+ * helper rather than a flag on the write gate. Read-only mode exists so a
+ * customer's site keeps serving and earning; refusing reads there would
+ * spend exactly what the mode protects. `lockdownBlocks(state, 'read')` is
+ * true only when the mode is full, which is precisely the case where the
+ * pages are already gone.
+ *
+ * Deliberately NOT applied to the whole tenant API surface. A read-refusing
+ * gate on every route would take the lock notice, the verdict probe and the
+ * abuse intake down with the site. This is for the routes that serve the
+ * SITE ITSELF — a composed node tree — where continuing to serve is
+ * continuing to publish. `serve-media-cdn.ts` made the same call for bytes
+ * (AGL-1520); this is the node-tree half of it.
+ *
+ * Fails OPEN through `getSiteLockdown`, like every other reader here.
+ */ export async function visitorContentRefusal(options) {
+    var _options_nowMs;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const state = await getSiteLockdown(options.hostId, nowMs);
+    if (!lockdownBlocks(state, 'read')) return null;
+    return lockdownJsonResponse(state, options.surface ? {
+        notice: lockdownPausedNotice(options.surface)
+    } : undefined);
+}
+
+//# sourceMappingURL=tenant-write-lockdown.js.map

package/src/lib/server/tenant-write-lockdown.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/tenant-write-lockdown.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The lockdown gate for VISITOR writes on a customer's live site\n * (AGL-1511) — form submissions, cart changes, checkout.\n *\n * Why this is its own chokepoint rather than the console's. The tenant\n * middleware, which is where AGL-1501 enforces, **does not match `/api`**\n * (see the matcher in apps/tenant/middleware.ts): it exists to stop CACHED\n * PAGES serving. So the site's own write endpoints have had no lockdown\n * enforcement at all — under a full org takedown the pages 503 while a form\n * POST still writes. This closes that for both modes.\n *\n * The product decision this file encodes, from the issue: a visitor-facing\n * write on a read-serving site gets a **polite inline pause, never a\n * page-level 503**. A customer's site staying up and earning is the entire\n * reason read-only mode exists instead of full lockdown, and answering their\n * visitors with an outage page would spend exactly what the mode was\n * protecting. So the refusal is a 423 with visitor copy the block renders\n * inline, and the page around it never stops rendering.\n *\n * Under a FULL lock the same 423 is returned rather than a 503, and that is\n * deliberate too: the middleware has already replaced the whole page for\n * anyone loading it, so a write arriving here is a stale tab or a script,\n * and a machine-readable refusal is more useful to both than an HTML page.\n *\n * NO staff bypass and NO user scope, matching /api/lockdown-verdict: this is\n * a public website, the caller is anonymous, and a visitor's identity plays\n * no part in whether a site accepts an order.\n */\n\nimport {\n  isLockdownActive,\n  lockdownBlocks,\n  type LockdownIntent,\n  lockdownIntentForMethod,\n  type LockdownPausedSurface,\n  lockdownPausedNotice,\n  type LockdownState,\n  normalizeHostLockdown,\n  normalizeOrgLockdown,\n  resolveLockdown,\n} from '@aglyn/aglyn/server'\nimport {\n  getPlatformLockdown,\n  heldSiteTakedown,\n  lockdownJsonResponse,\n  rememberSiteTakedown,\n} from './lockdown'\nimport { getHostDocAdmin, getOrgForHost } from './organizations'\n\n/**\n * The active platform/org/host lockdown for one site, or null.\n *\n * Both reads are already paid by the callers on this path — the dispatcher\n * reads the host doc for its plugin deny-list and the org doc for\n * enablement, and both getters are `React.cache`-deduped per request — so\n * the gate costs one TTL-cached platform read and nothing else.\n *\n * FAIL OPEN on any error, matching every other lockdown reader: an\n * unreachable Firestore is an outage, not a lockdown, and a shop that stops\n * taking orders because a read timed out is a worse failure than the one\n * being guarded against.\n *\n * …EXCEPT for a takedown (AGL-1881, extending AGL-1621). One class of lock\n * inverts that cost function — \"the database was down\" is not an answer to a\n * court order — and until now the ledger that carries it covered only the\n * four scopes whose lock lives in `lockdowns/*`. Org and host locks live on\n * the org/host document, so the two scopes MOST likely to be carrying a\n * legal order were the two that fell through. Every successful read now\n * records its org and host verdict, and a failed read serves back whichever\n * of them was a takedown and is still active.\n *\n * Note what is NOT done here: the catch does not fail closed on the state it\n * could not read. On a read failure `suspendedEnforcement` is exactly as\n * unreadable as everything else, which is the whole reason a separate\n * durable ledger exists — and a catch that locked unconditionally would take\n * every shop on the platform offline on any transient blip, which is the\n * deliberate posture this keeps for the default case.\n */\nexport async function getSiteLockdown(\n  hostId: string,\n  nowMs = Date.now(),\n): Promise<LockdownState | null> {\n  if (!hostId) return null\n  try {\n    const [platform, resolved, host] = await Promise.all([\n      getPlatformLockdown(),\n      getOrgForHost(hostId),\n      getHostDocAdmin(hostId),\n    ])\n    const org = normalizeOrgLockdown(resolved?.org as never)\n    const hostState = normalizeHostLockdown(host as never)\n    rememberSiteTakedown(hostId, { org, host: hostState })\n    const state = resolveLockdown({ platform, org, host: hostState }, nowMs)\n    return isLockdownActive(state, nowMs) ? state : null\n  } catch (error) {\n    console.error('[tenant-write-lockdown] verdict failed', hostId, error)\n    const held = heldSiteTakedown(hostId, nowMs)\n    // The shipped fail-open answer, returned by the same statement it always\n    // was, for every case where nothing takedown-class was ever observed.\n    if (!held.org && !held.host) return null\n    // The platform read is TTL-cached and swallows its own errors (it carries\n    // its own ledger entry), so asking again here costs nothing and keeps a\n    // wider lock from being masked by a narrower held one.\n    const platform = await getPlatformLockdown().catch(() => null)\n    const state = resolveLockdown(\n      { platform, org: held.org, host: held.host },\n      nowMs,\n    )\n    return isLockdownActive(state, nowMs) ? state : null\n  }\n}\n\n/**\n * The refusal a visitor-facing write route returns, or null to proceed:\n *\n *   const paused = await visitorWriteRefusal({ hostId, request, surface })\n *   if (paused) return paused\n *\n * `surface` picks the WORDS only (`lockdownPausedNotice`) — the checkout\n * sentence has to promise no card was charged, and no generic copy can.\n */\nexport async function visitorWriteRefusal(options: {\n  hostId: string\n  /** The request whose method decides read vs write. */\n  request?: { method?: string } | null\n  /** Overrides `request`; `write` when neither is given. */\n  intent?: LockdownIntent\n  surface: LockdownPausedSurface\n  nowMs?: number\n}): Promise<Response | null> {\n  const nowMs = options.nowMs ?? Date.now()\n  const intent =\n    options.intent ??\n    (options.request ? lockdownIntentForMethod(options.request.method) : 'write')\n  // This is a WRITE gate: reads leave before any Firestore read, so the hot\n  // unauthenticated GET path pays nothing. A full lock's refusal of tenant\n  // API *reads* is not attempted here and is unchanged from today — the\n  // middleware owns the page surface, and a read-refusing API gate is its\n  // own decision with its own blast radius (filed separately).\n  if (intent === 'read') return null\n  const state = await getSiteLockdown(options.hostId, nowMs)\n  if (!lockdownBlocks(state, intent)) return null\n  return lockdownJsonResponse(state as LockdownState, {\n    notice: lockdownPausedNotice(options.surface),\n  })\n}\n\n/**\n * The refusal a visitor-facing route that SERVES SITE CONTENT over `/api`\n * returns under a FULL lock, or null to proceed (AGL-2495):\n *\n *   const down = await visitorContentRefusal({ hostId })\n *   if (down) return down\n *\n * The gap this closes, found by the AGL-1621 drill. The tenant middleware\n * is what takes a locked site off the air, and its matcher deliberately\n * excludes `/api` — so a full org or host takedown 503s every page while an\n * API route that composes and returns screen nodes keeps handing the site's\n * content out to anyone who can name a screen. `visitorWriteRefusal` above\n * cannot answer that: it leaves before any read, by design, because it is a\n * WRITE gate on the hot unauthenticated GET path.\n *\n * FULL locks only, and that is the whole point of it being a separate\n * helper rather than a flag on the write gate. Read-only mode exists so a\n * customer's site keeps serving and earning; refusing reads there would\n * spend exactly what the mode protects. `lockdownBlocks(state, 'read')` is\n * true only when the mode is full, which is precisely the case where the\n * pages are already gone.\n *\n * Deliberately NOT applied to the whole tenant API surface. A read-refusing\n * gate on every route would take the lock notice, the verdict probe and the\n * abuse intake down with the site. This is for the routes that serve the\n * SITE ITSELF — a composed node tree — where continuing to serve is\n * continuing to publish. `serve-media-cdn.ts` made the same call for bytes\n * (AGL-1520); this is the node-tree half of it.\n *\n * Fails OPEN through `getSiteLockdown`, like every other reader here.\n */\nexport async function visitorContentRefusal(options: {\n  hostId: string\n  surface?: LockdownPausedSurface\n  nowMs?: number\n}): Promise<Response | null> {\n  const nowMs = options.nowMs ?? Date.now()\n  const state = await getSiteLockdown(options.hostId, nowMs)\n  if (!lockdownBlocks(state, 'read')) return null\n  return lockdownJsonResponse(\n    state as LockdownState,\n    options.surface ? { notice: lockdownPausedNotice(options.surface) } : undefined,\n  )\n}\n"],"names":["isLockdownActive","lockdownBlocks","lockdownIntentForMethod","lockdownPausedNotice","normalizeHostLockdown","normalizeOrgLockdown","resolveLockdown","getPlatformLockdown","heldSiteTakedown","lockdownJsonResponse","rememberSiteTakedown","getHostDocAdmin","getOrgForHost","getSiteLockdown","hostId","nowMs","Date","now","platform","resolved","host","Promise","all","org","hostState","state","error","console","held","catch","visitorWriteRefusal","options","intent","request","method","notice","surface","visitorContentRefusal","undefined"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GAED,SACEA,gBAAgB,EAChBC,cAAc,EAEdC,uBAAuB,EAEvBC,oBAAoB,EAEpBC,qBAAqB,EACrBC,oBAAoB,EACpBC,eAAe,QACV,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,QACf,gBAAY;AACnB,SAASC,eAAe,EAAEC,aAAa,QAAQ,qBAAiB;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,eAAeC,gBACpBC,MAAc,EACdC,QAAQC,KAAKC,GAAG,EAAE;IAElB,IAAI,CAACH,QAAQ,OAAO;IACpB,IAAI;QACF,MAAM,CAACI,UAAUC,UAAUC,KAAK,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACnDf;YACAK,cAAcE;YACdH,gBAAgBG;SACjB;QACD,MAAMS,MAAMlB,qBAAqBc,4BAAAA,SAAUI,GAAG;QAC9C,MAAMC,YAAYpB,sBAAsBgB;QACxCV,qBAAqBI,QAAQ;YAAES;YAAKH,MAAMI;QAAU;QACpD,MAAMC,QAAQnB,gBAAgB;YAAEY;YAAUK;YAAKH,MAAMI;QAAU,GAAGT;QAClE,OAAOf,iBAAiByB,OAAOV,SAASU,QAAQ;IAClD,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,0CAA0CZ,QAAQY;QAChE,MAAME,OAAOpB,iBAAiBM,QAAQC;QACtC,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAACa,KAAKL,GAAG,IAAI,CAACK,KAAKR,IAAI,EAAE,OAAO;QACpC,0EAA0E;QAC1E,wEAAwE;QACxE,uDAAuD;QACvD,MAAMF,WAAW,MAAMX,sBAAsBsB,KAAK,CAAC,IAAM;QACzD,MAAMJ,QAAQnB,gBACZ;YAAEY;YAAUK,KAAKK,KAAKL,GAAG;YAAEH,MAAMQ,KAAKR,IAAI;QAAC,GAC3CL;QAEF,OAAOf,iBAAiByB,OAAOV,SAASU,QAAQ;IAClD;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeK,oBAAoBC,OAQzC;QACeA,gBAEZA;IAFF,MAAMhB,SAAQgB,iBAAAA,QAAQhB,KAAK,YAAbgB,iBAAiBf,KAAKC,GAAG;IACvC,MAAMe,UACJD,kBAAAA,QAAQC,MAAM,YAAdD,kBACCA,QAAQE,OAAO,GAAG/B,wBAAwB6B,QAAQE,OAAO,CAACC,MAAM,IAAI;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,6DAA6D;IAC7D,IAAIF,WAAW,QAAQ,OAAO;IAC9B,MAAMP,QAAQ,MAAMZ,gBAAgBkB,QAAQjB,MAAM,EAAEC;IACpD,IAAI,CAACd,eAAewB,OAAOO,SAAS,OAAO;IAC3C,OAAOvB,qBAAqBgB,OAAwB;QAClDU,QAAQhC,qBAAqB4B,QAAQK,OAAO;IAC9C;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,eAAeC,sBAAsBN,OAI3C;QACeA;IAAd,MAAMhB,SAAQgB,iBAAAA,QAAQhB,KAAK,YAAbgB,iBAAiBf,KAAKC,GAAG;IACvC,MAAMQ,QAAQ,MAAMZ,gBAAgBkB,QAAQjB,MAAM,EAAEC;IACpD,IAAI,CAACd,eAAewB,OAAO,SAAS,OAAO;IAC3C,OAAOhB,qBACLgB,OACAM,QAAQK,OAAO,GAAG;QAAED,QAAQhC,qBAAqB4B,QAAQK,OAAO;IAAE,IAAIE;AAE1E"}

package/src/lib/server/test-firestore.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export interface FakeFirestore {
+    /**
+     * Every document in a collection, keyed by id.
+     *
+     * A SUBcollection is addressed by its full path — `hosts/host-1/suppressions`
+     * — which is also how it is seeded.
+     */
+    docs: (collection: string) => Record<string, any>;
+    collection: (name: string) => any;
+    /**
+     * Several documents in one round trip, the shape the real `getAll` has:
+     * the results come back POSITIONALLY, one per reference, so a caller that
+     * zips them back against its own input list gets what it asked for.
+     */
+    getAll: (...refs: any[]) => Promise<any[]>;
+    /**
+     * A transaction, real enough for a read-then-write body.
+     *
+     * Reads pass straight through and writes are held until the body resolves,
+     * which is the property the code under test depends on: a writer that
+     * decides what to store FROM what it read must not observe its own
+     * half-finished write. It does not model contention or retries — nothing in
+     * this repo's transaction bodies branches on a retry, and a fake that
+     * pretended to would be asserting the fake.
+     */
+    runTransaction: <T>(body: (transaction: any) => Promise<T>) => Promise<T>;
+}
+export declare function fakeFirestore(seed?: Record<string, Record<string, any>>): FakeFirestore;
+export default fakeFirestore;

package/src/lib/server/test-firestore.js

@@ -0,0 +1,124 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A Firestore stand-in for specs that span MORE THAN ONE COLLECTION
+ * (AGL-1592). Test-only; deliberately not exported from the barrel.
+ *
+ * The one-collection fakes elsewhere in this directory return the same
+ * document whatever collection name they are handed, which is fine when the
+ * code under test touches one document and actively misleading when it does
+ * not: the phone opt-out path reads `users/{uid}` and `contactSuppressions/{n}`
+ * and the whole point is that they are different records. A fake that conflated
+ * them would pass while the real thing wrote the marker on top of the
+ * suppression.
+ *
+ * `FieldValue.delete()` is honoured for real, because "the field is gone" and
+ * "the field holds a sentinel object" are different states and only the first
+ * one makes `seedUserProfile`'s blank check fire.
+ */ import { FieldValue } from "firebase-admin/firestore";
+const DELETE = FieldValue.delete();
+export function fakeFirestore(seed = {}) {
+    const store = JSON.parse(JSON.stringify(seed));
+    const snapshotFor = (collection, id)=>{
+        var _store_collection;
+        const data = (_store_collection = store[collection]) == null ? void 0 : _store_collection[id];
+        return {
+            id,
+            exists: data !== undefined,
+            get: (field)=>data == null ? void 0 : data[field],
+            data: ()=>data
+        };
+    };
+    const fake = {
+        docs: (collection)=>{
+            var _store_collection;
+            return (_store_collection = store[collection]) != null ? _store_collection : {};
+        },
+        getAll: async (...refs)=>refs.map((ref)=>snapshotFor(ref.collectionPath, ref.id)),
+        async runTransaction (body) {
+            const pending = [];
+            const transaction = {
+                get: (ref)=>ref.get(),
+                set: (ref, data, options)=>{
+                    pending.push(()=>ref.set(data, options));
+                    return transaction;
+                }
+            };
+            const result = await body(transaction);
+            for (const write of pending)await write();
+            return result;
+        },
+        collection (name) {
+            var _store_name;
+            store[name] = (_store_name = store[name]) != null ? _store_name : {};
+            const api = {
+                doc: (id)=>({
+                        id,
+                        /**
+           * Which collection this reference came from, so `getAll` can resolve
+           * a bare reference the way the real client does.
+           */ collectionPath: name,
+                        /**
+           * A subcollection is a collection at the joined path, so the fake
+           * stays one flat map. Nesting matters here because a per-site list
+           * lives under the site — a fake that returned the same documents for
+           * `hosts/a/suppressions` and `hosts/b/suppressions` would certify a
+           * sender that leaks one site's unsubscribes into another's.
+           */ collection: (sub)=>fake.collection(`${name}/${id}/${sub}`),
+                        get: async ()=>snapshotFor(name, id),
+                        set: async (data, options)=>{
+                            var _store_name_id;
+                            const base = (options == null ? void 0 : options.merge) ? (_store_name_id = store[name][id]) != null ? _store_name_id : {} : {};
+                            const next = _extends({}, base);
+                            for (const [key, value] of Object.entries(data)){
+                                // A real delete, not a stored sentinel — see the header.
+                                if (value && typeof value === 'object' && DELETE.isEqual(value)) {
+                                    delete next[key];
+                                    continue;
+                                }
+                                // Server timestamps arrive as sentinels too. Freeze them into
+                                // something a spec can assert on and a date can be read from.
+                                next[key] = value && typeof value === 'object' && typeof value.isEqual === 'function' ? {
+                                    seconds: Math.floor(Date.now() / 1000)
+                                } : value;
+                            }
+                            store[name][id] = next;
+                        }
+                    }),
+                // Ordering and limits are not what these specs are about; the queue
+                // read just needs to return everything it stored.
+                orderBy: ()=>api,
+                limit: ()=>api,
+                get: async ()=>({
+                        docs: Object.keys(store[name]).map((id)=>snapshotFor(name, id))
+                    }),
+                add: async (data)=>{
+                    const id = `auto-${Object.keys(store[name]).length + 1}`;
+                    store[name][id] = data;
+                    return {
+                        id
+                    };
+                }
+            };
+            return api;
+        }
+    };
+    return fake;
+}
+export default fakeFirestore;
+
+//# sourceMappingURL=test-firestore.js.map

package/src/lib/server/test-firestore.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/test-firestore.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Firestore stand-in for specs that span MORE THAN ONE COLLECTION\n * (AGL-1592). Test-only; deliberately not exported from the barrel.\n *\n * The one-collection fakes elsewhere in this directory return the same\n * document whatever collection name they are handed, which is fine when the\n * code under test touches one document and actively misleading when it does\n * not: the phone opt-out path reads `users/{uid}` and `contactSuppressions/{n}`\n * and the whole point is that they are different records. A fake that conflated\n * them would pass while the real thing wrote the marker on top of the\n * suppression.\n *\n * `FieldValue.delete()` is honoured for real, because \"the field is gone\" and\n * \"the field holds a sentinel object\" are different states and only the first\n * one makes `seedUserProfile`'s blank check fire.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\n\nconst DELETE = FieldValue.delete()\n\nexport interface FakeFirestore {\n  /**\n   * Every document in a collection, keyed by id.\n   *\n   * A SUBcollection is addressed by its full path — `hosts/host-1/suppressions`\n   * — which is also how it is seeded.\n   */\n  docs: (collection: string) => Record<string, any>\n  collection: (name: string) => any\n  /**\n   * Several documents in one round trip, the shape the real `getAll` has:\n   * the results come back POSITIONALLY, one per reference, so a caller that\n   * zips them back against its own input list gets what it asked for.\n   */\n  getAll: (...refs: any[]) => Promise<any[]>\n  /**\n   * A transaction, real enough for a read-then-write body.\n   *\n   * Reads pass straight through and writes are held until the body resolves,\n   * which is the property the code under test depends on: a writer that\n   * decides what to store FROM what it read must not observe its own\n   * half-finished write. It does not model contention or retries — nothing in\n   * this repo's transaction bodies branches on a retry, and a fake that\n   * pretended to would be asserting the fake.\n   */\n  runTransaction: <T>(body: (transaction: any) => Promise<T>) => Promise<T>\n}\n\nexport function fakeFirestore(\n  seed: Record<string, Record<string, any>> = {},\n): FakeFirestore {\n  const store: Record<string, Record<string, any>> = JSON.parse(\n    JSON.stringify(seed),\n  )\n\n  const snapshotFor = (collection: string, id: string) => {\n    const data = store[collection]?.[id]\n    return {\n      id,\n      exists: data !== undefined,\n      get: (field: string) => data?.[field],\n      data: () => data,\n    }\n  }\n\n  const fake: FakeFirestore = {\n    docs: (collection: string) => store[collection] ?? {},\n    getAll: async (...refs: any[]) =>\n      refs.map((ref) => snapshotFor(ref.collectionPath, ref.id)),\n    async runTransaction<T>(body: (transaction: any) => Promise<T>): Promise<T> {\n      const pending: Array<() => Promise<void>> = []\n      const transaction = {\n        get: (ref: any) => ref.get(),\n        set: (ref: any, data: Record<string, any>, options?: { merge?: boolean }) => {\n          pending.push(() => ref.set(data, options))\n          return transaction\n        },\n      }\n      const result = await body(transaction)\n      for (const write of pending) await write()\n      return result\n    },\n    collection(name: string) {\n      store[name] = store[name] ?? {}\n      const api: any = {\n        doc: (id: string) => ({\n          id,\n          /**\n           * Which collection this reference came from, so `getAll` can resolve\n           * a bare reference the way the real client does.\n           */\n          collectionPath: name,\n          /**\n           * A subcollection is a collection at the joined path, so the fake\n           * stays one flat map. Nesting matters here because a per-site list\n           * lives under the site — a fake that returned the same documents for\n           * `hosts/a/suppressions` and `hosts/b/suppressions` would certify a\n           * sender that leaks one site's unsubscribes into another's.\n           */\n          collection: (sub: string) => fake.collection(`${name}/${id}/${sub}`),\n          get: async () => snapshotFor(name, id),\n          set: async (data: Record<string, any>, options?: { merge?: boolean }) => {\n            const base = options?.merge ? (store[name][id] ?? {}) : {}\n            const next: Record<string, any> = { ...base }\n            for (const [key, value] of Object.entries(data)) {\n              // A real delete, not a stored sentinel — see the header.\n              if (value && typeof value === 'object' && DELETE.isEqual(value as any)) {\n                delete next[key]\n                continue\n              }\n              // Server timestamps arrive as sentinels too. Freeze them into\n              // something a spec can assert on and a date can be read from.\n              next[key] =\n                value && typeof value === 'object' && typeof (value as any).isEqual === 'function'\n                  ? { seconds: Math.floor(Date.now() / 1000) }\n                  : value\n            }\n            store[name][id] = next\n          },\n        }),\n        // Ordering and limits are not what these specs are about; the queue\n        // read just needs to return everything it stored.\n        orderBy: () => api,\n        limit: () => api,\n        get: async () => ({\n          docs: Object.keys(store[name]).map((id) => snapshotFor(name, id)),\n        }),\n        add: async (data: Record<string, any>) => {\n          const id = `auto-${Object.keys(store[name]).length + 1}`\n          store[name][id] = data\n          return { id }\n        },\n      }\n      return api\n    },\n  }\n  return fake\n}\n\nexport default fakeFirestore\n"],"names":["FieldValue","DELETE","delete","fakeFirestore","seed","store","JSON","parse","stringify","snapshotFor","collection","id","data","exists","undefined","get","field","fake","docs","getAll","refs","map","ref","collectionPath","runTransaction","body","pending","transaction","set","options","push","result","write","name","api","doc","sub","base","merge","next","key","value","Object","entries","isEqual","seconds","Math","floor","Date","now","orderBy","limit","keys","add","length"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AAErD,MAAMC,SAASD,WAAWE,MAAM;AA8BhC,OAAO,SAASC,cACdC,OAA4C,CAAC,CAAC;IAE9C,MAAMC,QAA6CC,KAAKC,KAAK,CAC3DD,KAAKE,SAAS,CAACJ;IAGjB,MAAMK,cAAc,CAACC,YAAoBC;YAC1BN;QAAb,MAAMO,QAAOP,oBAAAA,KAAK,CAACK,WAAW,qBAAjBL,iBAAmB,CAACM,GAAG;QACpC,OAAO;YACLA;YACAE,QAAQD,SAASE;YACjBC,KAAK,CAACC,QAAkBJ,wBAAAA,IAAM,CAACI,MAAM;YACrCJ,MAAM,IAAMA;QACd;IACF;IAEA,MAAMK,OAAsB;QAC1BC,MAAM,CAACR;gBAAuBL;oBAAAA,oBAAAA,KAAK,CAACK,WAAW,YAAjBL,oBAAqB,CAAC;;QACpDc,QAAQ,OAAO,GAAGC,OAChBA,KAAKC,GAAG,CAAC,CAACC,MAAQb,YAAYa,IAAIC,cAAc,EAAED,IAAIX,EAAE;QAC1D,MAAMa,gBAAkBC,IAAsC;YAC5D,MAAMC,UAAsC,EAAE;YAC9C,MAAMC,cAAc;gBAClBZ,KAAK,CAACO,MAAaA,IAAIP,GAAG;gBAC1Ba,KAAK,CAACN,KAAUV,MAA2BiB;oBACzCH,QAAQI,IAAI,CAAC,IAAMR,IAAIM,GAAG,CAAChB,MAAMiB;oBACjC,OAAOF;gBACT;YACF;YACA,MAAMI,SAAS,MAAMN,KAAKE;YAC1B,KAAK,MAAMK,SAASN,QAAS,MAAMM;YACnC,OAAOD;QACT;QACArB,YAAWuB,IAAY;gBACP5B;YAAdA,KAAK,CAAC4B,KAAK,IAAG5B,cAAAA,KAAK,CAAC4B,KAAK,YAAX5B,cAAe,CAAC;YAC9B,MAAM6B,MAAW;gBACfC,KAAK,CAACxB,KAAgB,CAAA;wBACpBA;wBACA;;;WAGC,GACDY,gBAAgBU;wBAChB;;;;;;WAMC,GACDvB,YAAY,CAAC0B,MAAgBnB,KAAKP,UAAU,CAAC,GAAGuB,KAAK,CAAC,EAAEtB,GAAG,CAAC,EAAEyB,KAAK;wBACnErB,KAAK,UAAYN,YAAYwB,MAAMtB;wBACnCiB,KAAK,OAAOhB,MAA2BiB;gCACNxB;4BAA/B,MAAMgC,OAAOR,CAAAA,2BAAAA,QAASS,KAAK,KAAIjC,iBAAAA,KAAK,CAAC4B,KAAK,CAACtB,GAAG,YAAfN,iBAAmB,CAAC,IAAK,CAAC;4BACzD,MAAMkC,OAA4B,aAAKF;4BACvC,KAAK,MAAM,CAACG,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAAC/B,MAAO;gCAC/C,yDAAyD;gCACzD,IAAI6B,SAAS,OAAOA,UAAU,YAAYxC,OAAO2C,OAAO,CAACH,QAAe;oCACtE,OAAOF,IAAI,CAACC,IAAI;oCAChB;gCACF;gCACA,8DAA8D;gCAC9D,8DAA8D;gCAC9DD,IAAI,CAACC,IAAI,GACPC,SAAS,OAAOA,UAAU,YAAY,OAAO,AAACA,MAAcG,OAAO,KAAK,aACpE;oCAAEC,SAASC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;gCAAM,IACzCR;4BACR;4BACApC,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAG4B;wBACpB;oBACF,CAAA;gBACA,oEAAoE;gBACpE,kDAAkD;gBAClDW,SAAS,IAAMhB;gBACfiB,OAAO,IAAMjB;gBACbnB,KAAK,UAAa,CAAA;wBAChBG,MAAMwB,OAAOU,IAAI,CAAC/C,KAAK,CAAC4B,KAAK,EAAEZ,GAAG,CAAC,CAACV,KAAOF,YAAYwB,MAAMtB;oBAC/D,CAAA;gBACA0C,KAAK,OAAOzC;oBACV,MAAMD,KAAK,CAAC,KAAK,EAAE+B,OAAOU,IAAI,CAAC/C,KAAK,CAAC4B,KAAK,EAAEqB,MAAM,GAAG,GAAG;oBACxDjD,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAGC;oBAClB,OAAO;wBAAED;oBAAG;gBACd;YACF;YACA,OAAOuB;QACT;IACF;IACA,OAAOjB;AACT;AAEA,eAAed,cAAa"}