@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/email-send-rate.js

@@ -0,0 +1,417 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE PLATFORM SEND-RATE GOVERNOR — durable half (AGL-2409).
+ *
+ * The policy is pure and lives in `@aglyn/shared-util-email`
+ * (`send-rate.ts`); this adds the Firestore counter that makes the ceiling
+ * global rather than per-instance, the configuration read that makes a ramp a
+ * value change instead of a deploy, and the installation that puts the whole
+ * thing on `sendEmail`'s path.
+ *
+ * ## Storage: the `rateLimits` collection, on purpose
+ *
+ * Both documents live in `rateLimits`, the same collection AGL-794's counters,
+ * AGL-1679's degradation markers and AGL-1907's signup-refusal markers already
+ * use, for the reason those two state: it inherits the deny-all security rule
+ * and the `expiresAt` TTL policy that already exist rather than needing a new
+ * collection, a rules deploy and a second TTL policy.
+ *
+ *  - `rateLimits/sendRate_{windowStartMs}` — one document per hour, holding
+ *    the count. Carries `expiresAt`, so the TTL policy sweeps it.
+ *  - `rateLimits/sendRateConfig` — the ceiling. **Carries NO `expiresAt`, and
+ *    must never be given one**, or the TTL policy that serves the counters
+ *    would quietly delete the configuration and the platform would silently
+ *    revert to the compiled-in default. `emailSendRateConfigWrite` is the one
+ *    writer and `email-send-rate.spec.ts` asserts the field is absent.
+ *
+ * The window document does NOT carry `lastAtMs`. AGL-1693's rate-limiter
+ * health probe queries this collection with `where('lastAtMs', '>=', cutoff)`;
+ * a per-hour document in that range would compete with the degradation
+ * markers the probe exists to find. It uses `sentAtMs`, which keeps the two
+ * queries disjoint at the index level — the same reasoning, and the same
+ * mistake avoided, as `refusedAtMs` on the signup markers.
+ *
+ * ## Failure posture: OPEN
+ *
+ * If the counter or the config cannot be read, every send is granted. That is
+ * the opposite of `consumeRateLimit`'s fail-closed-on-contention rule, and the
+ * difference is what the two controls protect. A brute-force limiter that
+ * fails open lets an attacker in; this one failing open lets a campaign out.
+ * The cost of failing CLOSED here is refusing a paying customer's campaign
+ * because of an unrelated Firestore blip — and, worse, refusing a bulk sweep
+ * that a customer's month depends on. Neither is worth the hour of ramp it
+ * would buy back, and the operator can see it: a degraded grant is reported
+ * and surfaced on /admin/emails.
+ */ import { EMAIL_SEND_RATE_WINDOW_MS, emailSendRateVerdict, emailSendRateWindowStartMs, normalizeEmailSendRateConfig, orgHourlyCampaignCeiling, setEmailSendGovernor } from "@aglyn/shared-util-email";
+import { firebaseAdmin } from "./firebase-admin.js";
+import { RATE_LIMIT_COLLECTION } from "./rate-limit-store.js";
+/** Document id of the live ceiling. NEVER written with `expiresAt`. */ export const EMAIL_SEND_RATE_CONFIG_DOC = 'sendRateConfig';
+/** Id prefix for the per-hour counters. */ export const EMAIL_SEND_RATE_WINDOW_PREFIX = 'sendRate_';
+/** The counter document id for a window. */ export function emailSendRateWindowDocId(windowStartMs) {
+    return `${EMAIL_SEND_RATE_WINDOW_PREFIX}${windowStartMs}`;
+}
+/**
+ * Config cache TTL.
+ *
+ * 15s, the same number and the same reasoning as the platform lockdown doc:
+ * this sits on a path that every outbound message crosses, so a per-send read
+ * would be one Firestore read per email platform-wide, and 15s is the
+ * worst-case lag between staff moving the ramp and a warm process honouring
+ * it. A ramp is measured in hours; fifteen seconds is free.
+ */ const CONFIG_TTL_MS = 15000;
+let configCache;
+let configPending;
+/** Drop the in-process config cache — called by the console after a write. */ export function invalidateEmailSendRateConfigCache() {
+    configCache = undefined;
+    configPending = undefined;
+}
+/**
+ * The live ceiling. Falls back to the compiled-in default on any read error,
+ * which is the fail-open posture stated above: an unreachable config must not
+ * be read as a ceiling of zero.
+ */ export async function readEmailSendRateConfig(options) {
+    var _ref;
+    const now = (_ref = options == null ? void 0 : options.now) != null ? _ref : Date.now();
+    if (!(options == null ? void 0 : options.firestore) && configCache && now - configCache.at < CONFIG_TTL_MS) {
+        return configCache.config;
+    }
+    const load = async ()=>{
+        let config = normalizeEmailSendRateConfig(null);
+        try {
+            var _ref;
+            const firestore = (_ref = options == null ? void 0 : options.firestore) != null ? _ref : firebaseAdmin.app().firestore();
+            const snapshot = await firestore.collection(RATE_LIMIT_COLLECTION).doc(EMAIL_SEND_RATE_CONFIG_DOC).get();
+            config = normalizeEmailSendRateConfig(snapshot.exists ? snapshot.data() : null);
+        } catch (unused) {
+        // Fail open: an unreachable config is an outage, not a ceiling of zero.
+        }
+        return config;
+    };
+    // An injected firestore is a test or a one-off read; never cached, so a
+    // spec cannot poison the process cache for the next one.
+    if (options == null ? void 0 : options.firestore) return load();
+    if (!configPending) {
+        configPending = load().then((config)=>{
+            configCache = {
+                at: now,
+                config
+            };
+            return config;
+        }).finally(()=>{
+            configPending = undefined;
+        });
+    }
+    return configPending;
+}
+/**
+ * Counts `count` messages against the current hour, globally, and answers
+ * whether they may go.
+ *
+ * The transaction reads the counter and writes an ABSOLUTE value derived from
+ * that read — not `FieldValue.increment` — because the read is the authority
+ * for the decision. Firestore aborts and re-runs the callback when a
+ * document it read has moved, so two concurrent sweeps cannot both see the
+ * same headroom and both take it. An increment would be atomic on the number
+ * and useless for the decision, which is exactly the read-then-write shape
+ * AGL-2267 is about one surface over.
+ *
+ * A refused send writes NOTHING. A caller that will retry next hour must not
+ * have spent budget on being told no.
+ */ export async function consumeEmailSendBudget(options) {
+    var _options_now, _options_config;
+    const now = (_options_now = options.now) != null ? _options_now : Date.now();
+    const windowStartMs = emailSendRateWindowStartMs(now);
+    const resetMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS;
+    const config = (_options_config = options.config) != null ? _options_config : await readEmailSendRateConfig({
+        firestore: options.firestore,
+        now
+    });
+    const fallback = ()=>_extends({}, emailSendRateVerdict({
+            priority: options.priority,
+            used: 0,
+            count: options.count,
+            ceiling: config.perHour,
+            enabled: false,
+            windowStartMs
+        }), {
+            windowStartMs,
+            degraded: true
+        });
+    try {
+        var _options_firestore;
+        const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+        const ref = firestore.collection(RATE_LIMIT_COLLECTION).doc(emailSendRateWindowDocId(windowStartMs));
+        const verdict = await firestore.runTransaction(async (tx)=>{
+            var _ref;
+            const snapshot = await tx.get(ref);
+            const used = Number((_ref = snapshot.exists ? snapshot.get('count') : 0) != null ? _ref : 0);
+            const decision = emailSendRateVerdict({
+                priority: options.priority,
+                used,
+                count: options.count,
+                ceiling: config.perHour,
+                enabled: config.enabled,
+                windowStartMs
+            });
+            if (!decision.allowed) return decision;
+            tx.set(ref, {
+                count: decision.used + Math.max(0, Math.floor(Number(options.count) || 0)),
+                windowStartMs,
+                // NOT `lastAtMs` — see the storage note at the top of this file.
+                sentAtMs: now,
+                // The TTL field the counters in this collection already use. Two
+                // windows of retention so the console can show the hour just gone.
+                expiresAt: new Date(resetMs + EMAIL_SEND_RATE_WINDOW_MS)
+            }, {
+                merge: true
+            });
+            return decision;
+        });
+        return _extends({}, verdict, {
+            windowStartMs,
+            degraded: false
+        });
+    } catch (error) {
+        console.error('[send-rate] counter unavailable — allowing', error);
+        return fallback();
+    }
+}
+/**
+ * What the current hour looks like. Read-only, for the staff console.
+ *
+ * Returns `used: 0` rather than throwing when the window document does not
+ * exist, which is the ordinary state of a quiet hour.
+ */ export async function readEmailSendRateWindow(options) {
+    var _ref;
+    const now = (_ref = options == null ? void 0 : options.now) != null ? _ref : Date.now();
+    const windowStartMs = emailSendRateWindowStartMs(now);
+    const resetMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS;
+    try {
+        var _ref1, _ref2;
+        const firestore = (_ref1 = options == null ? void 0 : options.firestore) != null ? _ref1 : firebaseAdmin.app().firestore();
+        const snapshot = await firestore.collection(RATE_LIMIT_COLLECTION).doc(emailSendRateWindowDocId(windowStartMs)).get();
+        const used = Number((_ref2 = snapshot.exists ? snapshot.get('count') : 0) != null ? _ref2 : 0);
+        return {
+            windowStartMs,
+            resetMs,
+            used: Number.isFinite(used) && used > 0 ? Math.floor(used) : 0
+        };
+    } catch (unused) {
+        return {
+            windowStartMs,
+            resetMs,
+            used: 0
+        };
+    }
+}
+/** Id prefix for the per-org, per-hour campaign counters. */ export const EMAIL_ORG_SEND_RATE_WINDOW_PREFIX = 'sendRateOrg_';
+/**
+ * The per-org counter document id for a window.
+ *
+ * A separate document per org rather than a map field on the platform window,
+ * so two orgs sending in the same hour contend on their own documents instead
+ * of serialising on one. The platform window is already a single hot document
+ * and adding N org fields to it would make every campaign in the hour a write
+ * conflict with every other.
+ */ export function emailOrgSendRateWindowDocId(windowStartMs, orgId) {
+    return `${EMAIL_ORG_SEND_RATE_WINDOW_PREFIX}${windowStartMs}_${orgId}`;
+}
+/** The current hour for one org. Read-only, for a usage surface. */ export async function readOrgEmailSendWindow(options) {
+    var _options_now;
+    const now = (_options_now = options.now) != null ? _options_now : Date.now();
+    const windowStartMs = emailSendRateWindowStartMs(now);
+    const resetMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS;
+    if (!options.orgId) return {
+        windowStartMs,
+        resetMs,
+        used: 0
+    };
+    try {
+        var _options_firestore, _ref;
+        const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+        const snapshot = await firestore.collection(RATE_LIMIT_COLLECTION).doc(emailOrgSendRateWindowDocId(windowStartMs, options.orgId)).get();
+        const used = Number((_ref = snapshot.exists ? snapshot.get('count') : 0) != null ? _ref : 0);
+        return {
+            windowStartMs,
+            resetMs,
+            used: Number.isFinite(used) && used > 0 ? Math.floor(used) : 0
+        };
+    } catch (unused) {
+        return {
+            windowStartMs,
+            resetMs,
+            used: 0
+        };
+    }
+}
+/**
+ * THE PER-ORG SHARE OF THE PLATFORM HOUR.
+ *
+ * The platform governor bounds total volume; it does not bound how much of
+ * that total ONE tenant may take. Without this, a single org with a large
+ * audience occupies the whole hour and every other customer's campaigns are
+ * refused by a ceiling they did nothing to reach — one tenant denying service
+ * to the rest, on a limit they cannot see.
+ *
+ * The ceiling is derived, not configured: `orgHourlyCampaignCeiling` is a
+ * share of whatever the live platform ceiling currently is, so a staff ramp
+ * moves both together and the two can never drift into contradiction. See
+ * `send-ceilings.ts` for the arithmetic and the relations it maintains.
+ *
+ * **Campaigns only.** This function is not on `sendEmail`'s path and is called
+ * from the campaign sender alone. A transactional message can never reach it,
+ * which is the same boundary `emailSendRateVerdict` enforces one layer down
+ * and for the same reason: a password reset refused by a throttle converts a
+ * reputation risk into an outage on somebody else's business.
+ *
+ * ## Fails OPEN
+ *
+ * An unreachable counter grants the send, matching `consumeEmailSendBudget`.
+ * A refusal produced by a Firestore blip is a refused campaign for a paying
+ * customer, and the hour of pacing it buys back is not worth it.
+ *
+ * ## Claimed, not reconciled
+ *
+ * The claim is taken for the whole batch and never refunded, unlike the
+ * monthly reservation. The window is one hour and TTL-swept, so an
+ * undelivered remainder costs the org the rest of that hour and nothing
+ * after it — where an unreconciled MONTHLY claim would cost the rest of the
+ * month, which is why that one is reconciled and this one is not. The error
+ * is in the direction that can only ever pace mail more, never let more out.
+ */ export async function claimOrgEmailSendBudget(options) {
+    var _options_now;
+    const now = (_options_now = options.now) != null ? _options_now : Date.now();
+    const windowStartMs = emailSendRateWindowStartMs(now);
+    const retryAtMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS;
+    const ceiling = orgHourlyCampaignCeiling(options.platformPerHour);
+    const count = Math.max(0, Math.floor(Number(options.count) || 0));
+    const granted = (used, degraded)=>({
+            allowed: true,
+            used,
+            ceiling,
+            remaining: Math.max(0, ceiling - (used + count)),
+            retryAtMs,
+            degraded
+        });
+    // A parked control still reports the ceiling, so a surface reading this
+    // shows a real number rather than blanking while the control is off.
+    if (options.enabled === false) return granted(0, false);
+    // No org means the counter has nowhere to live. The monthly reservation
+    // refuses in this case because an unattributable campaign must not send
+    // unbounded; here the monthly claim has already made that decision, so
+    // failing open costs nothing it has not already been charged for.
+    if (!options.orgId) return granted(0, true);
+    try {
+        var _options_firestore;
+        const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+        const ref = firestore.collection(RATE_LIMIT_COLLECTION).doc(emailOrgSendRateWindowDocId(windowStartMs, options.orgId));
+        return await firestore.runTransaction(async (tx)=>{
+            var _ref;
+            const snapshot = await tx.get(ref);
+            const rawUsed = Number((_ref = snapshot.exists ? snapshot.get('count') : 0) != null ? _ref : 0);
+            // A corrupt or negative counter must not read as headroom.
+            const used = Number.isFinite(rawUsed) && rawUsed > 0 ? Math.floor(rawUsed) : 0;
+            if (used + count > ceiling) {
+                // A refused claim writes NOTHING. A campaign that will be retried
+                // next hour must not have spent budget on being told no.
+                return {
+                    allowed: false,
+                    used,
+                    ceiling,
+                    remaining: Math.max(0, ceiling - used),
+                    retryAtMs,
+                    degraded: false
+                };
+            }
+            // An absolute write from this transaction's own read, not
+            // `FieldValue.increment` — the read is the authority for the decision,
+            // and an increment would be atomic on the number while proving nothing
+            // about the value the decision was made from.
+            tx.set(ref, {
+                count: used + count,
+                windowStartMs,
+                orgId: options.orgId,
+                // NOT `lastAtMs` — the rate-limiter health probe queries this
+                // collection on that field and a per-hour document in its range
+                // would compete with the markers it exists to find.
+                sentAtMs: now,
+                expiresAt: new Date(retryAtMs + EMAIL_SEND_RATE_WINDOW_MS)
+            }, {
+                merge: true
+            });
+            return granted(used, false);
+        });
+    } catch (error) {
+        console.error('[send-rate] org window unavailable — allowing', error);
+        return granted(0, true);
+    }
+}
+/**
+ * The document the console writes when staff move the ramp.
+ *
+ * Returned rather than written so the route owns the write (and the audit row
+ * beside it), and so a spec can assert the SHAPE without a Firestore. The one
+ * thing it must never contain is `expiresAt`.
+ */ export function emailSendRateConfigWrite(input) {
+    var _input_now, _input_actorEmail;
+    const normalized = normalizeEmailSendRateConfig({
+        perHour: input.perHour,
+        enabled: input.enabled,
+        note: input.note,
+        updatedAtMs: (_input_now = input.now) != null ? _input_now : Date.now(),
+        updatedByEmail: (_input_actorEmail = input.actorEmail) != null ? _input_actorEmail : null
+    });
+    return {
+        perHour: normalized.perHour,
+        enabled: normalized.enabled,
+        note: normalized.note,
+        updatedAtMs: normalized.updatedAtMs,
+        updatedByEmail: normalized.updatedByEmail
+    };
+}
+/**
+ * Puts the durable governor on `sendEmail`'s path.
+ *
+ * **Called at module load**, from the bottom of this file, so that importing
+ * `@aglyn/tenant-data-admin` anywhere is enough — every server surface in the
+ * product already imports that barrel, and `export *` forces this module to
+ * evaluate. The alternative, an `installEmailSendGovernor()` call at each
+ * server entrypoint, is the 37-places-to-remember shape this codebase already
+ * rejected once for the `context` tag.
+ *
+ * Idempotent: installing twice replaces the same closure with an equivalent
+ * one, and the closure holds no state — the state is the Firestore document.
+ */ export function installEmailSendGovernor() {
+    setEmailSendGovernor(async (request)=>{
+        const result = await consumeEmailSendBudget({
+            priority: request.priority,
+            count: request.count
+        });
+        return {
+            allowed: result.allowed,
+            ceiling: result.ceiling,
+            used: result.used,
+            remaining: result.remaining,
+            retryAtMs: result.retryAtMs,
+            degraded: result.degraded
+        };
+    });
+}
+installEmailSendGovernor();
+
+//# sourceMappingURL=email-send-rate.js.map

package/src/lib/server/email-send-rate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/email-send-rate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE PLATFORM SEND-RATE GOVERNOR — durable half (AGL-2409).\n *\n * The policy is pure and lives in `@aglyn/shared-util-email`\n * (`send-rate.ts`); this adds the Firestore counter that makes the ceiling\n * global rather than per-instance, the configuration read that makes a ramp a\n * value change instead of a deploy, and the installation that puts the whole\n * thing on `sendEmail`'s path.\n *\n * ## Storage: the `rateLimits` collection, on purpose\n *\n * Both documents live in `rateLimits`, the same collection AGL-794's counters,\n * AGL-1679's degradation markers and AGL-1907's signup-refusal markers already\n * use, for the reason those two state: it inherits the deny-all security rule\n * and the `expiresAt` TTL policy that already exist rather than needing a new\n * collection, a rules deploy and a second TTL policy.\n *\n *  - `rateLimits/sendRate_{windowStartMs}` — one document per hour, holding\n *    the count. Carries `expiresAt`, so the TTL policy sweeps it.\n *  - `rateLimits/sendRateConfig` — the ceiling. **Carries NO `expiresAt`, and\n *    must never be given one**, or the TTL policy that serves the counters\n *    would quietly delete the configuration and the platform would silently\n *    revert to the compiled-in default. `emailSendRateConfigWrite` is the one\n *    writer and `email-send-rate.spec.ts` asserts the field is absent.\n *\n * The window document does NOT carry `lastAtMs`. AGL-1693's rate-limiter\n * health probe queries this collection with `where('lastAtMs', '>=', cutoff)`;\n * a per-hour document in that range would compete with the degradation\n * markers the probe exists to find. It uses `sentAtMs`, which keeps the two\n * queries disjoint at the index level — the same reasoning, and the same\n * mistake avoided, as `refusedAtMs` on the signup markers.\n *\n * ## Failure posture: OPEN\n *\n * If the counter or the config cannot be read, every send is granted. That is\n * the opposite of `consumeRateLimit`'s fail-closed-on-contention rule, and the\n * difference is what the two controls protect. A brute-force limiter that\n * fails open lets an attacker in; this one failing open lets a campaign out.\n * The cost of failing CLOSED here is refusing a paying customer's campaign\n * because of an unrelated Firestore blip — and, worse, refusing a bulk sweep\n * that a customer's month depends on. Neither is worth the hour of ramp it\n * would buy back, and the operator can see it: a degraded grant is reported\n * and surfaced on /admin/emails.\n */\n\nimport {\n  type EmailSendGovernorRequest,\n  type EmailSendGovernorVerdict,\n  type EmailSendPriority,\n  type EmailSendRateConfig,\n  type EmailSendRateVerdict,\n  EMAIL_SEND_RATE_WINDOW_MS,\n  emailSendRateVerdict,\n  emailSendRateWindowStartMs,\n  normalizeEmailSendRateConfig,\n  orgHourlyCampaignCeiling,\n  setEmailSendGovernor,\n} from '@aglyn/shared-util-email'\nimport { firebaseAdmin } from './firebase-admin'\nimport { RATE_LIMIT_COLLECTION } from './rate-limit-store'\n\n/** Document id of the live ceiling. NEVER written with `expiresAt`. */\nexport const EMAIL_SEND_RATE_CONFIG_DOC = 'sendRateConfig'\n\n/** Id prefix for the per-hour counters. */\nexport const EMAIL_SEND_RATE_WINDOW_PREFIX = 'sendRate_'\n\n/** The counter document id for a window. */\nexport function emailSendRateWindowDocId(windowStartMs: number): string {\n  return `${EMAIL_SEND_RATE_WINDOW_PREFIX}${windowStartMs}`\n}\n\n/**\n * Config cache TTL.\n *\n * 15s, the same number and the same reasoning as the platform lockdown doc:\n * this sits on a path that every outbound message crosses, so a per-send read\n * would be one Firestore read per email platform-wide, and 15s is the\n * worst-case lag between staff moving the ramp and a warm process honouring\n * it. A ramp is measured in hours; fifteen seconds is free.\n */\nconst CONFIG_TTL_MS = 15_000\n\nlet configCache: { at: number; config: EmailSendRateConfig } | undefined\nlet configPending: Promise<EmailSendRateConfig> | undefined\n\n/** Drop the in-process config cache — called by the console after a write. */\nexport function invalidateEmailSendRateConfigCache(): void {\n  configCache = undefined\n  configPending = undefined\n}\n\n/**\n * The live ceiling. Falls back to the compiled-in default on any read error,\n * which is the fail-open posture stated above: an unreachable config must not\n * be read as a ceiling of zero.\n */\nexport async function readEmailSendRateConfig(options?: {\n  firestore?: any\n  now?: number\n}): Promise<EmailSendRateConfig> {\n  const now = options?.now ?? Date.now()\n  if (!options?.firestore && configCache && now - configCache.at < CONFIG_TTL_MS) {\n    return configCache.config\n  }\n  const load = async (): Promise<EmailSendRateConfig> => {\n    let config = normalizeEmailSendRateConfig(null)\n    try {\n      const firestore = options?.firestore ?? firebaseAdmin.app().firestore()\n      const snapshot = await firestore\n        .collection(RATE_LIMIT_COLLECTION)\n        .doc(EMAIL_SEND_RATE_CONFIG_DOC)\n        .get()\n      config = normalizeEmailSendRateConfig(\n        snapshot.exists ? (snapshot.data() as Partial<EmailSendRateConfig>) : null,\n      )\n    } catch {\n      // Fail open: an unreachable config is an outage, not a ceiling of zero.\n    }\n    return config\n  }\n  // An injected firestore is a test or a one-off read; never cached, so a\n  // spec cannot poison the process cache for the next one.\n  if (options?.firestore) return load()\n  if (!configPending) {\n    configPending = load()\n      .then((config) => {\n        configCache = { at: now, config }\n        return config\n      })\n      .finally(() => {\n        configPending = undefined\n      })\n  }\n  return configPending\n}\n\nexport interface ConsumeEmailSendBudgetOptions {\n  priority: EmailSendPriority\n  /** Messages this send would add. */\n  count: number\n  now?: number\n  firestore?: any\n  /** Injectable for tests; otherwise read (and cached) from Firestore. */\n  config?: EmailSendRateConfig\n}\n\nexport interface ConsumeEmailSendBudgetResult extends EmailSendRateVerdict {\n  windowStartMs: number\n  /** True when the counter was unreachable and this failed open. */\n  degraded: boolean\n}\n\n/**\n * Counts `count` messages against the current hour, globally, and answers\n * whether they may go.\n *\n * The transaction reads the counter and writes an ABSOLUTE value derived from\n * that read — not `FieldValue.increment` — because the read is the authority\n * for the decision. Firestore aborts and re-runs the callback when a\n * document it read has moved, so two concurrent sweeps cannot both see the\n * same headroom and both take it. An increment would be atomic on the number\n * and useless for the decision, which is exactly the read-then-write shape\n * AGL-2267 is about one surface over.\n *\n * A refused send writes NOTHING. A caller that will retry next hour must not\n * have spent budget on being told no.\n */\nexport async function consumeEmailSendBudget(\n  options: ConsumeEmailSendBudgetOptions,\n): Promise<ConsumeEmailSendBudgetResult> {\n  const now = options.now ?? Date.now()\n  const windowStartMs = emailSendRateWindowStartMs(now)\n  const resetMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS\n  const config =\n    options.config ??\n    (await readEmailSendRateConfig({ firestore: options.firestore, now }))\n\n  const fallback = (): ConsumeEmailSendBudgetResult => ({\n    ...emailSendRateVerdict({\n      priority: options.priority,\n      used: 0,\n      count: options.count,\n      ceiling: config.perHour,\n      enabled: false,\n      windowStartMs,\n    }),\n    windowStartMs,\n    degraded: true,\n  })\n\n  try {\n    const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n    const ref = firestore\n      .collection(RATE_LIMIT_COLLECTION)\n      .doc(emailSendRateWindowDocId(windowStartMs))\n\n    const verdict = await firestore.runTransaction(async (tx: any) => {\n      const snapshot = await tx.get(ref)\n      const used = Number((snapshot.exists ? snapshot.get('count') : 0) ?? 0)\n      const decision = emailSendRateVerdict({\n        priority: options.priority,\n        used,\n        count: options.count,\n        ceiling: config.perHour,\n        enabled: config.enabled,\n        windowStartMs,\n      })\n      if (!decision.allowed) return decision\n      tx.set(\n        ref,\n        {\n          count: decision.used + Math.max(0, Math.floor(Number(options.count) || 0)),\n          windowStartMs,\n          // NOT `lastAtMs` — see the storage note at the top of this file.\n          sentAtMs: now,\n          // The TTL field the counters in this collection already use. Two\n          // windows of retention so the console can show the hour just gone.\n          expiresAt: new Date(resetMs + EMAIL_SEND_RATE_WINDOW_MS),\n        },\n        { merge: true },\n      )\n      return decision\n    })\n\n    return { ...(verdict as EmailSendRateVerdict), windowStartMs, degraded: false }\n  } catch (error) {\n    console.error('[send-rate] counter unavailable — allowing', error)\n    return fallback()\n  }\n}\n\n/**\n * What the current hour looks like. Read-only, for the staff console.\n *\n * Returns `used: 0` rather than throwing when the window document does not\n * exist, which is the ordinary state of a quiet hour.\n */\nexport async function readEmailSendRateWindow(options?: {\n  firestore?: any\n  now?: number\n}): Promise<{ windowStartMs: number; resetMs: number; used: number }> {\n  const now = options?.now ?? Date.now()\n  const windowStartMs = emailSendRateWindowStartMs(now)\n  const resetMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS\n  try {\n    const firestore = options?.firestore ?? firebaseAdmin.app().firestore()\n    const snapshot = await firestore\n      .collection(RATE_LIMIT_COLLECTION)\n      .doc(emailSendRateWindowDocId(windowStartMs))\n      .get()\n    const used = Number((snapshot.exists ? snapshot.get('count') : 0) ?? 0)\n    return {\n      windowStartMs,\n      resetMs,\n      used: Number.isFinite(used) && used > 0 ? Math.floor(used) : 0,\n    }\n  } catch {\n    return { windowStartMs, resetMs, used: 0 }\n  }\n}\n\n/** Id prefix for the per-org, per-hour campaign counters. */\nexport const EMAIL_ORG_SEND_RATE_WINDOW_PREFIX = 'sendRateOrg_'\n\n/**\n * The per-org counter document id for a window.\n *\n * A separate document per org rather than a map field on the platform window,\n * so two orgs sending in the same hour contend on their own documents instead\n * of serialising on one. The platform window is already a single hot document\n * and adding N org fields to it would make every campaign in the hour a write\n * conflict with every other.\n */\nexport function emailOrgSendRateWindowDocId(\n  windowStartMs: number,\n  orgId: string,\n): string {\n  return `${EMAIL_ORG_SEND_RATE_WINDOW_PREFIX}${windowStartMs}_${orgId}`\n}\n\n/** The current hour for one org. Read-only, for a usage surface. */\nexport async function readOrgEmailSendWindow(options: {\n  orgId: string\n  firestore?: any\n  now?: number\n}): Promise<{ windowStartMs: number; resetMs: number; used: number }> {\n  const now = options.now ?? Date.now()\n  const windowStartMs = emailSendRateWindowStartMs(now)\n  const resetMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS\n  if (!options.orgId) return { windowStartMs, resetMs, used: 0 }\n  try {\n    const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n    const snapshot = await firestore\n      .collection(RATE_LIMIT_COLLECTION)\n      .doc(emailOrgSendRateWindowDocId(windowStartMs, options.orgId))\n      .get()\n    const used = Number((snapshot.exists ? snapshot.get('count') : 0) ?? 0)\n    return {\n      windowStartMs,\n      resetMs,\n      used: Number.isFinite(used) && used > 0 ? Math.floor(used) : 0,\n    }\n  } catch {\n    return { windowStartMs, resetMs, used: 0 }\n  }\n}\n\n/** The answer to a per-org hourly claim. Every field is a stated number. */\nexport interface OrgEmailSendClaimResult {\n  allowed: boolean\n  /** Count in this org's window BEFORE this send. */\n  used: number\n  /** What this org may send in an hour. */\n  ceiling: number\n  /** Headroom after this send, floored at 0. */\n  remaining: number\n  /** When the window rolls and a deferred campaign may go. */\n  retryAtMs: number\n  /** True when the counter was unreachable and this failed open. */\n  degraded: boolean\n}\n\n/**\n * THE PER-ORG SHARE OF THE PLATFORM HOUR.\n *\n * The platform governor bounds total volume; it does not bound how much of\n * that total ONE tenant may take. Without this, a single org with a large\n * audience occupies the whole hour and every other customer's campaigns are\n * refused by a ceiling they did nothing to reach — one tenant denying service\n * to the rest, on a limit they cannot see.\n *\n * The ceiling is derived, not configured: `orgHourlyCampaignCeiling` is a\n * share of whatever the live platform ceiling currently is, so a staff ramp\n * moves both together and the two can never drift into contradiction. See\n * `send-ceilings.ts` for the arithmetic and the relations it maintains.\n *\n * **Campaigns only.** This function is not on `sendEmail`'s path and is called\n * from the campaign sender alone. A transactional message can never reach it,\n * which is the same boundary `emailSendRateVerdict` enforces one layer down\n * and for the same reason: a password reset refused by a throttle converts a\n * reputation risk into an outage on somebody else's business.\n *\n * ## Fails OPEN\n *\n * An unreachable counter grants the send, matching `consumeEmailSendBudget`.\n * A refusal produced by a Firestore blip is a refused campaign for a paying\n * customer, and the hour of pacing it buys back is not worth it.\n *\n * ## Claimed, not reconciled\n *\n * The claim is taken for the whole batch and never refunded, unlike the\n * monthly reservation. The window is one hour and TTL-swept, so an\n * undelivered remainder costs the org the rest of that hour and nothing\n * after it — where an unreconciled MONTHLY claim would cost the rest of the\n * month, which is why that one is reconciled and this one is not. The error\n * is in the direction that can only ever pace mail more, never let more out.\n */\nexport async function claimOrgEmailSendBudget(options: {\n  orgId: string\n  /** Messages this campaign would send. */\n  count: number\n  /** The live platform ceiling; the org share is derived from it. */\n  platformPerHour: number\n  /** False parks the control, exactly as the platform governor's flag does. */\n  enabled?: boolean\n  now?: number\n  firestore?: any\n}): Promise<OrgEmailSendClaimResult> {\n  const now = options.now ?? Date.now()\n  const windowStartMs = emailSendRateWindowStartMs(now)\n  const retryAtMs = windowStartMs + EMAIL_SEND_RATE_WINDOW_MS\n  const ceiling = orgHourlyCampaignCeiling(options.platformPerHour)\n  const count = Math.max(0, Math.floor(Number(options.count) || 0))\n\n  const granted = (used: number, degraded: boolean): OrgEmailSendClaimResult => ({\n    allowed: true,\n    used,\n    ceiling,\n    remaining: Math.max(0, ceiling - (used + count)),\n    retryAtMs,\n    degraded,\n  })\n\n  // A parked control still reports the ceiling, so a surface reading this\n  // shows a real number rather than blanking while the control is off.\n  if (options.enabled === false) return granted(0, false)\n  // No org means the counter has nowhere to live. The monthly reservation\n  // refuses in this case because an unattributable campaign must not send\n  // unbounded; here the monthly claim has already made that decision, so\n  // failing open costs nothing it has not already been charged for.\n  if (!options.orgId) return granted(0, true)\n\n  try {\n    const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n    const ref = firestore\n      .collection(RATE_LIMIT_COLLECTION)\n      .doc(emailOrgSendRateWindowDocId(windowStartMs, options.orgId))\n\n    return await firestore.runTransaction(async (tx: any) => {\n      const snapshot = await tx.get(ref)\n      const rawUsed = Number((snapshot.exists ? snapshot.get('count') : 0) ?? 0)\n      // A corrupt or negative counter must not read as headroom.\n      const used =\n        Number.isFinite(rawUsed) && rawUsed > 0 ? Math.floor(rawUsed) : 0\n      if (used + count > ceiling) {\n        // A refused claim writes NOTHING. A campaign that will be retried\n        // next hour must not have spent budget on being told no.\n        return {\n          allowed: false,\n          used,\n          ceiling,\n          remaining: Math.max(0, ceiling - used),\n          retryAtMs,\n          degraded: false,\n        }\n      }\n      // An absolute write from this transaction's own read, not\n      // `FieldValue.increment` — the read is the authority for the decision,\n      // and an increment would be atomic on the number while proving nothing\n      // about the value the decision was made from.\n      tx.set(\n        ref,\n        {\n          count: used + count,\n          windowStartMs,\n          orgId: options.orgId,\n          // NOT `lastAtMs` — the rate-limiter health probe queries this\n          // collection on that field and a per-hour document in its range\n          // would compete with the markers it exists to find.\n          sentAtMs: now,\n          expiresAt: new Date(retryAtMs + EMAIL_SEND_RATE_WINDOW_MS),\n        },\n        { merge: true },\n      )\n      return granted(used, false)\n    })\n  } catch (error) {\n    console.error('[send-rate] org window unavailable — allowing', error)\n    return granted(0, true)\n  }\n}\n\n/**\n * The document the console writes when staff move the ramp.\n *\n * Returned rather than written so the route owns the write (and the audit row\n * beside it), and so a spec can assert the SHAPE without a Firestore. The one\n * thing it must never contain is `expiresAt`.\n */\nexport function emailSendRateConfigWrite(input: {\n  perHour: number\n  enabled: boolean\n  actorEmail?: string | null\n  note?: string\n  now?: number\n}): Partial<EmailSendRateConfig> {\n  const normalized = normalizeEmailSendRateConfig({\n    perHour: input.perHour,\n    enabled: input.enabled,\n    note: input.note,\n    updatedAtMs: input.now ?? Date.now(),\n    updatedByEmail: input.actorEmail ?? null,\n  })\n  return {\n    perHour: normalized.perHour,\n    enabled: normalized.enabled,\n    note: normalized.note,\n    updatedAtMs: normalized.updatedAtMs,\n    updatedByEmail: normalized.updatedByEmail,\n  }\n}\n\n/**\n * Puts the durable governor on `sendEmail`'s path.\n *\n * **Called at module load**, from the bottom of this file, so that importing\n * `@aglyn/tenant-data-admin` anywhere is enough — every server surface in the\n * product already imports that barrel, and `export *` forces this module to\n * evaluate. The alternative, an `installEmailSendGovernor()` call at each\n * server entrypoint, is the 37-places-to-remember shape this codebase already\n * rejected once for the `context` tag.\n *\n * Idempotent: installing twice replaces the same closure with an equivalent\n * one, and the closure holds no state — the state is the Firestore document.\n */\nexport function installEmailSendGovernor(): void {\n  setEmailSendGovernor(\n    async (\n      request: EmailSendGovernorRequest,\n    ): Promise<EmailSendGovernorVerdict> => {\n      const result = await consumeEmailSendBudget({\n        priority: request.priority,\n        count: request.count,\n      })\n      return {\n        allowed: result.allowed,\n        ceiling: result.ceiling,\n        used: result.used,\n        remaining: result.remaining,\n        retryAtMs: result.retryAtMs,\n        degraded: result.degraded,\n      }\n    },\n  )\n}\n\ninstallEmailSendGovernor()\n"],"names":["EMAIL_SEND_RATE_WINDOW_MS","emailSendRateVerdict","emailSendRateWindowStartMs","normalizeEmailSendRateConfig","orgHourlyCampaignCeiling","setEmailSendGovernor","firebaseAdmin","RATE_LIMIT_COLLECTION","EMAIL_SEND_RATE_CONFIG_DOC","EMAIL_SEND_RATE_WINDOW_PREFIX","emailSendRateWindowDocId","windowStartMs","CONFIG_TTL_MS","configCache","configPending","invalidateEmailSendRateConfigCache","undefined","readEmailSendRateConfig","options","now","Date","firestore","at","config","load","app","snapshot","collection","doc","get","exists","data","then","finally","consumeEmailSendBudget","resetMs","fallback","priority","used","count","ceiling","perHour","enabled","degraded","ref","verdict","runTransaction","tx","Number","decision","allowed","set","Math","max","floor","sentAtMs","expiresAt","merge","error","console","readEmailSendRateWindow","isFinite","EMAIL_ORG_SEND_RATE_WINDOW_PREFIX","emailOrgSendRateWindowDocId","orgId","readOrgEmailSendWindow","claimOrgEmailSendBudget","retryAtMs","platformPerHour","granted","remaining","rawUsed","emailSendRateConfigWrite","input","normalized","note","updatedAtMs","updatedByEmail","actorEmail","installEmailSendGovernor","request","result"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GAED,SAMEA,yBAAyB,EACzBC,oBAAoB,EACpBC,0BAA0B,EAC1BC,4BAA4B,EAC5BC,wBAAwB,EACxBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,aAAa,QAAQ,sBAAkB;AAChD,SAASC,qBAAqB,QAAQ,wBAAoB;AAE1D,qEAAqE,GACrE,OAAO,MAAMC,6BAA6B,iBAAgB;AAE1D,yCAAyC,GACzC,OAAO,MAAMC,gCAAgC,YAAW;AAExD,0CAA0C,GAC1C,OAAO,SAASC,yBAAyBC,aAAqB;IAC5D,OAAO,GAAGF,gCAAgCE,eAAe;AAC3D;AAEA;;;;;;;;CAQC,GACD,MAAMC,gBAAgB;AAEtB,IAAIC;AACJ,IAAIC;AAEJ,4EAA4E,GAC5E,OAAO,SAASC;IACdF,cAAcG;IACdF,gBAAgBE;AAClB;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBAAwBC,OAG7C;;IACC,MAAMC,cAAMD,2BAAAA,QAASC,GAAG,mBAAIC,KAAKD,GAAG;IACpC,IAAI,EAACD,2BAAAA,QAASG,SAAS,KAAIR,eAAeM,MAAMN,YAAYS,EAAE,GAAGV,eAAe;QAC9E,OAAOC,YAAYU,MAAM;IAC3B;IACA,MAAMC,OAAO;QACX,IAAID,SAASpB,6BAA6B;QAC1C,IAAI;;YACF,MAAMkB,oBAAYH,2BAAAA,QAASG,SAAS,mBAAIf,cAAcmB,GAAG,GAAGJ,SAAS;YACrE,MAAMK,WAAW,MAAML,UACpBM,UAAU,CAACpB,uBACXqB,GAAG,CAACpB,4BACJqB,GAAG;YACNN,SAASpB,6BACPuB,SAASI,MAAM,GAAIJ,SAASK,IAAI,KAAsC;QAE1E,EAAE,eAAM;QACN,wEAAwE;QAC1E;QACA,OAAOR;IACT;IACA,wEAAwE;IACxE,yDAAyD;IACzD,IAAIL,2BAAAA,QAASG,SAAS,EAAE,OAAOG;IAC/B,IAAI,CAACV,eAAe;QAClBA,gBAAgBU,OACbQ,IAAI,CAAC,CAACT;YACLV,cAAc;gBAAES,IAAIH;gBAAKI;YAAO;YAChC,OAAOA;QACT,GACCU,OAAO,CAAC;YACPnB,gBAAgBE;QAClB;IACJ;IACA,OAAOF;AACT;AAkBA;;;;;;;;;;;;;;CAcC,GACD,OAAO,eAAeoB,uBACpBhB,OAAsC;QAE1BA,cAIVA;IAJF,MAAMC,OAAMD,eAAAA,QAAQC,GAAG,YAAXD,eAAeE,KAAKD,GAAG;IACnC,MAAMR,gBAAgBT,2BAA2BiB;IACjD,MAAMgB,UAAUxB,gBAAgBX;IAChC,MAAMuB,UACJL,kBAAAA,QAAQK,MAAM,YAAdL,kBACC,MAAMD,wBAAwB;QAAEI,WAAWH,QAAQG,SAAS;QAAEF;IAAI;IAErE,MAAMiB,WAAW,IAAqC,aACjDnC,qBAAqB;YACtBoC,UAAUnB,QAAQmB,QAAQ;YAC1BC,MAAM;YACNC,OAAOrB,QAAQqB,KAAK;YACpBC,SAASjB,OAAOkB,OAAO;YACvBC,SAAS;YACT/B;QACF;YACAA;YACAgC,UAAU;;IAGZ,IAAI;YACgBzB;QAAlB,MAAMG,aAAYH,qBAAAA,QAAQG,SAAS,YAAjBH,qBAAqBZ,cAAcmB,GAAG,GAAGJ,SAAS;QACpE,MAAMuB,MAAMvB,UACTM,UAAU,CAACpB,uBACXqB,GAAG,CAAClB,yBAAyBC;QAEhC,MAAMkC,UAAU,MAAMxB,UAAUyB,cAAc,CAAC,OAAOC;gBAE/BrB;YADrB,MAAMA,WAAW,MAAMqB,GAAGlB,GAAG,CAACe;YAC9B,MAAMN,OAAOU,QAAQtB,OAAAA,SAASI,MAAM,GAAGJ,SAASG,GAAG,CAAC,WAAW,aAA1CH,OAAgD;YACrE,MAAMuB,WAAWhD,qBAAqB;gBACpCoC,UAAUnB,QAAQmB,QAAQ;gBAC1BC;gBACAC,OAAOrB,QAAQqB,KAAK;gBACpBC,SAASjB,OAAOkB,OAAO;gBACvBC,SAASnB,OAAOmB,OAAO;gBACvB/B;YACF;YACA,IAAI,CAACsC,SAASC,OAAO,EAAE,OAAOD;YAC9BF,GAAGI,GAAG,CACJP,KACA;gBACEL,OAAOU,SAASX,IAAI,GAAGc,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACN,OAAO9B,QAAQqB,KAAK,KAAK;gBACvE5B;gBACA,iEAAiE;gBACjE4C,UAAUpC;gBACV,iEAAiE;gBACjE,mEAAmE;gBACnEqC,WAAW,IAAIpC,KAAKe,UAAUnC;YAChC,GACA;gBAAEyD,OAAO;YAAK;YAEhB,OAAOR;QACT;QAEA,OAAO,aAAMJ;YAAkClC;YAAegC,UAAU;;IAC1E,EAAE,OAAOe,OAAO;QACdC,QAAQD,KAAK,CAAC,8CAA8CA;QAC5D,OAAOtB;IACT;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAewB,wBAAwB1C,OAG7C;;IACC,MAAMC,cAAMD,2BAAAA,QAASC,GAAG,mBAAIC,KAAKD,GAAG;IACpC,MAAMR,gBAAgBT,2BAA2BiB;IACjD,MAAMgB,UAAUxB,gBAAgBX;IAChC,IAAI;mBAMmB0B;QALrB,MAAML,qBAAYH,2BAAAA,QAASG,SAAS,oBAAIf,cAAcmB,GAAG,GAAGJ,SAAS;QACrE,MAAMK,WAAW,MAAML,UACpBM,UAAU,CAACpB,uBACXqB,GAAG,CAAClB,yBAAyBC,gBAC7BkB,GAAG;QACN,MAAMS,OAAOU,QAAQtB,QAAAA,SAASI,MAAM,GAAGJ,SAASG,GAAG,CAAC,WAAW,aAA1CH,QAAgD;QACrE,OAAO;YACLf;YACAwB;YACAG,MAAMU,OAAOa,QAAQ,CAACvB,SAASA,OAAO,IAAIc,KAAKE,KAAK,CAAChB,QAAQ;QAC/D;IACF,EAAE,eAAM;QACN,OAAO;YAAE3B;YAAewB;YAASG,MAAM;QAAE;IAC3C;AACF;AAEA,2DAA2D,GAC3D,OAAO,MAAMwB,oCAAoC,eAAc;AAE/D;;;;;;;;CAQC,GACD,OAAO,SAASC,4BACdpD,aAAqB,EACrBqD,KAAa;IAEb,OAAO,GAAGF,oCAAoCnD,cAAc,CAAC,EAAEqD,OAAO;AACxE;AAEA,kEAAkE,GAClE,OAAO,eAAeC,uBAAuB/C,OAI5C;QACaA;IAAZ,MAAMC,OAAMD,eAAAA,QAAQC,GAAG,YAAXD,eAAeE,KAAKD,GAAG;IACnC,MAAMR,gBAAgBT,2BAA2BiB;IACjD,MAAMgB,UAAUxB,gBAAgBX;IAChC,IAAI,CAACkB,QAAQ8C,KAAK,EAAE,OAAO;QAAErD;QAAewB;QAASG,MAAM;IAAE;IAC7D,IAAI;YACgBpB,oBAKGQ;QALrB,MAAML,aAAYH,qBAAAA,QAAQG,SAAS,YAAjBH,qBAAqBZ,cAAcmB,GAAG,GAAGJ,SAAS;QACpE,MAAMK,WAAW,MAAML,UACpBM,UAAU,CAACpB,uBACXqB,GAAG,CAACmC,4BAA4BpD,eAAeO,QAAQ8C,KAAK,GAC5DnC,GAAG;QACN,MAAMS,OAAOU,QAAQtB,OAAAA,SAASI,MAAM,GAAGJ,SAASG,GAAG,CAAC,WAAW,aAA1CH,OAAgD;QACrE,OAAO;YACLf;YACAwB;YACAG,MAAMU,OAAOa,QAAQ,CAACvB,SAASA,OAAO,IAAIc,KAAKE,KAAK,CAAChB,QAAQ;QAC/D;IACF,EAAE,eAAM;QACN,OAAO;YAAE3B;YAAewB;YAASG,MAAM;QAAE;IAC3C;AACF;AAiBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,OAAO,eAAe4B,wBAAwBhD,OAU7C;QACaA;IAAZ,MAAMC,OAAMD,eAAAA,QAAQC,GAAG,YAAXD,eAAeE,KAAKD,GAAG;IACnC,MAAMR,gBAAgBT,2BAA2BiB;IACjD,MAAMgD,YAAYxD,gBAAgBX;IAClC,MAAMwC,UAAUpC,yBAAyBc,QAAQkD,eAAe;IAChE,MAAM7B,QAAQa,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACN,OAAO9B,QAAQqB,KAAK,KAAK;IAE9D,MAAM8B,UAAU,CAAC/B,MAAcK,WAAgD,CAAA;YAC7EO,SAAS;YACTZ;YACAE;YACA8B,WAAWlB,KAAKC,GAAG,CAAC,GAAGb,UAAWF,CAAAA,OAAOC,KAAI;YAC7C4B;YACAxB;QACF,CAAA;IAEA,wEAAwE;IACxE,qEAAqE;IACrE,IAAIzB,QAAQwB,OAAO,KAAK,OAAO,OAAO2B,QAAQ,GAAG;IACjD,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,CAACnD,QAAQ8C,KAAK,EAAE,OAAOK,QAAQ,GAAG;IAEtC,IAAI;YACgBnD;QAAlB,MAAMG,aAAYH,qBAAAA,QAAQG,SAAS,YAAjBH,qBAAqBZ,cAAcmB,GAAG,GAAGJ,SAAS;QACpE,MAAMuB,MAAMvB,UACTM,UAAU,CAACpB,uBACXqB,GAAG,CAACmC,4BAA4BpD,eAAeO,QAAQ8C,KAAK;QAE/D,OAAO,MAAM3C,UAAUyB,cAAc,CAAC,OAAOC;gBAEnBrB;YADxB,MAAMA,WAAW,MAAMqB,GAAGlB,GAAG,CAACe;YAC9B,MAAM2B,UAAUvB,QAAQtB,OAAAA,SAASI,MAAM,GAAGJ,SAASG,GAAG,CAAC,WAAW,aAA1CH,OAAgD;YACxE,2DAA2D;YAC3D,MAAMY,OACJU,OAAOa,QAAQ,CAACU,YAAYA,UAAU,IAAInB,KAAKE,KAAK,CAACiB,WAAW;YAClE,IAAIjC,OAAOC,QAAQC,SAAS;gBAC1B,kEAAkE;gBAClE,yDAAyD;gBACzD,OAAO;oBACLU,SAAS;oBACTZ;oBACAE;oBACA8B,WAAWlB,KAAKC,GAAG,CAAC,GAAGb,UAAUF;oBACjC6B;oBACAxB,UAAU;gBACZ;YACF;YACA,0DAA0D;YAC1D,uEAAuE;YACvE,uEAAuE;YACvE,8CAA8C;YAC9CI,GAAGI,GAAG,CACJP,KACA;gBACEL,OAAOD,OAAOC;gBACd5B;gBACAqD,OAAO9C,QAAQ8C,KAAK;gBACpB,8DAA8D;gBAC9D,gEAAgE;gBAChE,oDAAoD;gBACpDT,UAAUpC;gBACVqC,WAAW,IAAIpC,KAAK+C,YAAYnE;YAClC,GACA;gBAAEyD,OAAO;YAAK;YAEhB,OAAOY,QAAQ/B,MAAM;QACvB;IACF,EAAE,OAAOoB,OAAO;QACdC,QAAQD,KAAK,CAAC,iDAAiDA;QAC/D,OAAOW,QAAQ,GAAG;IACpB;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASG,yBAAyBC,KAMxC;QAKgBA,YACGA;IALlB,MAAMC,aAAavE,6BAA6B;QAC9CsC,SAASgC,MAAMhC,OAAO;QACtBC,SAAS+B,MAAM/B,OAAO;QACtBiC,MAAMF,MAAME,IAAI;QAChBC,WAAW,GAAEH,aAAAA,MAAMtD,GAAG,YAATsD,aAAarD,KAAKD,GAAG;QAClC0D,cAAc,GAAEJ,oBAAAA,MAAMK,UAAU,YAAhBL,oBAAoB;IACtC;IACA,OAAO;QACLhC,SAASiC,WAAWjC,OAAO;QAC3BC,SAASgC,WAAWhC,OAAO;QAC3BiC,MAAMD,WAAWC,IAAI;QACrBC,aAAaF,WAAWE,WAAW;QACnCC,gBAAgBH,WAAWG,cAAc;IAC3C;AACF;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASE;IACd1E,qBACE,OACE2E;QAEA,MAAMC,SAAS,MAAM/C,uBAAuB;YAC1CG,UAAU2C,QAAQ3C,QAAQ;YAC1BE,OAAOyC,QAAQzC,KAAK;QACtB;QACA,OAAO;YACLW,SAAS+B,OAAO/B,OAAO;YACvBV,SAASyC,OAAOzC,OAAO;YACvBF,MAAM2C,OAAO3C,IAAI;YACjBgC,WAAWW,OAAOX,SAAS;YAC3BH,WAAWc,OAAOd,SAAS;YAC3BxB,UAAUsC,OAAOtC,QAAQ;QAC3B;IACF;AAEJ;AAEAoC"}