@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/email-sender-reputation.js

@@ -0,0 +1,464 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * PER-TENANT SENDING REPUTATION — the durable half.
+ *
+ * The policy is pure and lives in `@aglyn/shared-util-email`
+ * (`sender-reputation.ts`); this adds the counters that make a rate a fact
+ * rather than an intention, and the daily claim that paces a workspace's
+ * first week.
+ *
+ * ## One document per workspace per day
+ *
+ * `rateLimits/emailRep_{YYYY-MM-DD}_{orgId}` holds four numbers:
+ *
+ *  - `claimed` — campaign messages the day's ramp has granted. The PACING
+ *    counter, taken before a send and reconciled to what actually left.
+ *  - `accepted` — campaign messages that actually left. The DENOMINATOR every
+ *    rate divides by.
+ *  - `bounced`, `complained` — what the provider reported back.
+ *
+ * A day per document rather than a map of days on one, because the day is
+ * what the TTL policy can sweep: `rateLimits` already carries an `expiresAt`
+ * policy, and a document that ages out is a window that prunes itself. A map
+ * of every day a workspace has ever sent would grow forever and would have to
+ * be pruned by a job nobody would write.
+ *
+ * A per-ORG document rather than per-site, because the org is the tenant: the
+ * plan, the monthly allowance and the hourly share are all keyed on it, and a
+ * merchant with three sites on one domain is one sender to a mailbox
+ * provider.
+ *
+ * The window document deliberately carries **no `lastAtMs`** — the
+ * rate-limiter health probe queries this collection on that field, and a
+ * per-day document in its range would compete with the degradation markers it
+ * exists to find. The same reasoning as `sendRate_*` and `sendRateOrg_*`
+ * beside it.
+ *
+ * ## Which day a bounce is filed under
+ *
+ * The day the EVENT arrived, not the day the message was sent. The webhook
+ * knows the first and would need a per-message lookup for the second, and
+ * over a seven-day window the two differ only at the edges — a bounce lands
+ * within minutes and a complaint within hours or a day. Stated because the
+ * rate is a ratio of two things counted on slightly different clocks, and a
+ * reader comparing it against a provider's dashboard should know why they
+ * will not agree to the last decimal.
+ *
+ * ## Failure posture: OPEN, and that is not the usual answer here
+ *
+ * An unreadable counter grades `ok` and grants the send, matching
+ * `consumeEmailSendBudget` and `claimOrgEmailSendBudget`. The breaker is the
+ * one control in this file that could refuse a paying customer's campaign,
+ * and a refusal produced by a Firestore blip is an outage dressed as a policy
+ * decision. The reputation risk it fails to catch is bounded by an hour of
+ * sending; the refusal it would produce is not bounded by anything.
+ */ import { EMAIL_REPUTATION_WINDOW_DAYS, emailRampVerdict, emailReputationVerdict, normalizeEmailReputationPolicy, orgDailyCampaignCeiling, reputationDayKey, reputationWindowDayKeys, daysBetween } from "@aglyn/shared-util-email";
+import { readEmailSendRateConfig } from "./email-send-rate.js";
+import { firebaseAdmin } from "./firebase-admin.js";
+import { RATE_LIMIT_COLLECTION } from "./rate-limit-store.js";
+/** Id prefix for the per-org, per-day reputation documents. */ export const EMAIL_REPUTATION_DOC_PREFIX = 'emailRep_';
+/** One day in ms, named so the arithmetic below reads as arithmetic. */ const DAY_MS = 86400000;
+/** The document id for one workspace's day. */ export function emailReputationDocId(dayKey, orgId) {
+    return `${EMAIL_REPUTATION_DOC_PREFIX}${dayKey}_${orgId}`;
+}
+function reputationRef(firestore, dayKey, orgId) {
+    return firestore.collection(RATE_LIMIT_COLLECTION).doc(emailReputationDocId(dayKey, orgId));
+}
+/** A stored count, clamped. A corrupt negative reads as 0, never as headroom. */ function storedCount(snapshot, field) {
+    var _ref;
+    const value = Number((_ref = (snapshot == null ? void 0 : snapshot.exists) ? snapshot.get(field) : 0) != null ? _ref : 0);
+    return Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
+}
+/**
+ * When a day's document may be swept.
+ *
+ * One window plus a day of slack past the end of the day it counts, so the
+ * oldest day a rate still divides by is never deleted underneath the read
+ * that needs it.
+ */ function reputationExpiresAt(dayStartMs) {
+    return new Date(dayStartMs + (EMAIL_REPUTATION_WINDOW_DAYS + 2) * DAY_MS);
+}
+/** Midnight UTC of the day a timestamp falls in. */ function dayStartMs(atMs) {
+    return Math.floor(atMs / DAY_MS) * DAY_MS;
+}
+/**
+ * Adds to one of a workspace's daily counters.
+ *
+ * **Never throws.** Reputation accounting runs after mail has gone out, or
+ * inside a webhook the provider will retry — a counter write that failed must
+ * not turn a delivered campaign into a 500 or a webhook into a retry storm.
+ * `FieldValue.increment` rather than a transaction because nothing decides
+ * anything from this write: the decision is made by a separate read, and an
+ * increment is the contention-free way to record a fact.
+ */ export async function recordEmailReputationEvent(options) {
+    var _options_orgId, _options_count, _options_atMs;
+    const orgId = String((_options_orgId = options.orgId) != null ? _options_orgId : '');
+    const count = Math.floor(Number((_options_count = options.count) != null ? _options_count : 1));
+    if (!orgId || !Number.isFinite(count) || count <= 0) return;
+    const atMs = Number((_options_atMs = options.atMs) != null ? _options_atMs : Date.now());
+    const at = Number.isFinite(atMs) && atMs > 0 ? atMs : Date.now();
+    try {
+        var _options_firestore;
+        const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+        await reputationRef(firestore, reputationDayKey(at), orgId).set({
+            [options.counter]: firebaseAdmin.firestore.FieldValue.increment(count),
+            orgId,
+            dayKey: reputationDayKey(at),
+            // NOT `lastAtMs` — see the storage note at the top of this file.
+            expiresAt: reputationExpiresAt(dayStartMs(at))
+        }, {
+            merge: true
+        });
+    } catch (error) {
+        console.error('[sender-reputation] counter write failed', error);
+    }
+}
+/** Campaign messages that actually left, for a workspace. The denominator. */ export function recordCampaignAccepted(orgId, count, options) {
+    return recordEmailReputationEvent(_extends({
+        orgId,
+        counter: 'accepted',
+        count
+    }, options));
+}
+/**
+ * A permanent bounce or a spam complaint, attributed to the workspace that
+ * sent it.
+ *
+ * The suppression the same event produces is a separate act and is not
+ * conditional on this: an address comes off the list whether or not the
+ * counter write lands.
+ */ export function recordEmailReputationFailure(orgId, kind, options) {
+    return recordEmailReputationEvent(_extends({
+        orgId,
+        counter: kind === 'complaint' ? 'complained' : 'bounced',
+        count: 1
+    }, options));
+}
+/**
+ * Sums a workspace's last {@link EMAIL_REPUTATION_WINDOW_DAYS} days.
+ *
+ * One `getAll` over the window's day documents — seven reads per campaign,
+ * not per message, and none at all for a workspace that has never sent. An
+ * absent day is a quiet day and reads as zero.
+ */ export async function readSenderReputationWindow(options) {
+    var _options_windowDays, _options_orgId, _options_now;
+    const windowDays = Math.max(1, Math.floor(Number((_options_windowDays = options.windowDays) != null ? _options_windowDays : EMAIL_REPUTATION_WINDOW_DAYS)) || EMAIL_REPUTATION_WINDOW_DAYS);
+    const empty = {
+        accepted: 0,
+        bounced: 0,
+        complained: 0,
+        claimedToday: 0,
+        windowDays,
+        degraded: false
+    };
+    const orgId = String((_options_orgId = options.orgId) != null ? _options_orgId : '');
+    if (!orgId) return empty;
+    const now = Number((_options_now = options.now) != null ? _options_now : Date.now());
+    try {
+        var _options_firestore;
+        const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+        const dayKeys = reputationWindowDayKeys(now, windowDays);
+        const today = reputationDayKey(now);
+        const snapshots = await firestore.getAll(...dayKeys.map((dayKey)=>reputationRef(firestore, dayKey, orgId)));
+        return snapshots.reduce((totals, snapshot, index)=>_extends({}, totals, {
+                accepted: totals.accepted + storedCount(snapshot, 'accepted'),
+                bounced: totals.bounced + storedCount(snapshot, 'bounced'),
+                complained: totals.complained + storedCount(snapshot, 'complained'),
+                claimedToday: dayKeys[index] === today ? totals.claimedToday + storedCount(snapshot, 'claimed') : totals.claimedToday
+            }), empty);
+    } catch (error) {
+        console.error('[sender-reputation] window unavailable — grading ok', error);
+        return _extends({}, empty, {
+            degraded: true
+        });
+    }
+}
+/**
+ * Grades one workspace.
+ *
+ * The policy and the grace period come from the ORG DOCUMENT, which the
+ * campaign sender has already read — passed in rather than re-fetched, so
+ * this costs the window read and nothing else.
+ */ export async function readSenderReputation(options) {
+    var _options_now, _options_reinstatedUntilMs;
+    const now = Number((_options_now = options.now) != null ? _options_now : Date.now());
+    const window = await readSenderReputationWindow({
+        orgId: options.orgId,
+        now,
+        firestore: options.firestore
+    });
+    const verdict = emailReputationVerdict({
+        counts: window,
+        // A degraded read grades against zeroes, which is `ok` by construction.
+        // Stated rather than special-cased: the fail-open posture at the top of
+        // this file is the reason, and a branch here would be a second place for
+        // it to be got wrong.
+        policy: normalizeEmailReputationPolicy(options.policy),
+        windowDays: window.windowDays,
+        reinstatedUntilMs: Number((_options_reinstatedUntilMs = options.reinstatedUntilMs) != null ? _options_reinstatedUntilMs : 0) || null,
+        now
+    });
+    return _extends({}, verdict, {
+        degraded: window.degraded,
+        window
+    });
+}
+/**
+ * The ramp step a workspace has EARNED, from a window it has already read.
+ *
+ * A thin wrapper over the pure policy that supplies the one number the policy
+ * cannot know: what a graduated workspace's day is, which is a share of the
+ * live platform ceiling and therefore moves with a staff ramp.
+ */ export function resolveOrgEmailRamp(options) {
+    return emailRampVerdict({
+        ageDays: options.ageDays,
+        deliveredLifetime: options.deliveredLifetime,
+        graduatedPerDay: orgDailyCampaignCeiling(options.platformPerHour)
+    });
+}
+/**
+ * A workspace's ramp step, resolved from its record and its history.
+ *
+ * The reads {@link resolveOrgEmailRamp} needs, in the order that pays for
+ * the fewest of them. The platform ceiling comes first because it is process-
+ * cached for fifteen seconds and therefore free; the seven-day window is a
+ * `getAll` and is only paid when the ramp can still bind.
+ *
+ * ## A graduated workspace pays nothing
+ *
+ * Age alone decides graduation — delivery volume can only RAISE a step, never
+ * reach past the last one — so a workspace past its first week is answered
+ * from the org record with no window read at all. That is every existing
+ * customer and every org whose record predates the creation timestamp, which
+ * is to say almost every call.
+ *
+ * ## An unreadable window is `degraded`, and it is the caller's to answer
+ *
+ * The window read grades itself rather than throwing, and an unreadable one
+ * reads as zero delivered — the LOWEST step, which is the conservative
+ * direction for a ceiling. What it is not is a fact, so it is flagged: a
+ * surface admitting one message at a time cannot defer the remainder to
+ * tomorrow the way a campaign can, and a limiter with no answer must refuse
+ * rather than admit.
+ *
+ * ## The platform flag parks this control
+ *
+ * `enabled: false` on the send-rate config graduates every workspace here,
+ * exactly as it parks the hourly share and {@link claimOrgEmailSendDay} — one
+ * switch, and it turns the ramp off everywhere it is consulted.
+ */ export async function readOrgEmailRamp(options) {
+    var _options_now;
+    const now = Number((_options_now = options.now) != null ? _options_now : Date.now());
+    const at = Number.isFinite(now) && now > 0 ? now : Date.now();
+    const config = await readEmailSendRateConfig(options.firestore ? {
+        firestore: options.firestore,
+        now: at
+    } : {
+        now: at
+    });
+    const platformPerHour = config.perHour;
+    if (!config.enabled) {
+        // A parked control answers with the verdict an established workspace
+        // gets, so a surface reading the step does not blank while it is off.
+        const parked = resolveOrgEmailRamp({
+            ageDays: null,
+            deliveredLifetime: 0,
+            platformPerHour
+        });
+        return {
+            ramp: parked,
+            degraded: false
+        };
+    }
+    const ageDays = orgAgeDays(options.createdAt, at);
+    /*
+   * The step this workspace would be on having delivered nothing. It is the
+   * graduation test and the floor in one value: delivered volume only ever
+   * raises a step, so a verdict that graduates here graduates at any volume,
+   * and one that does not is the lowest step the workspace can be on.
+   */ const floor = resolveOrgEmailRamp({
+        ageDays,
+        deliveredLifetime: 0,
+        platformPerHour
+    });
+    if (floor.graduated) return {
+        ramp: floor,
+        degraded: false
+    };
+    const window = await readSenderReputationWindow({
+        orgId: options.orgId,
+        now: at,
+        firestore: options.firestore
+    });
+    if (window.degraded) return {
+        ramp: floor,
+        degraded: true
+    };
+    return {
+        ramp: resolveOrgEmailRamp({
+            ageDays,
+            deliveredLifetime: window.accepted,
+            platformPerHour
+        }),
+        degraded: false
+    };
+}
+/**
+ * THE NEW-SENDER RAMP, ENFORCED.
+ *
+ * Claims `count` campaign messages against what this workspace may send
+ * today, atomically. The transaction reads the counter and writes an ABSOLUTE
+ * value derived from that read rather than an increment, for the reason
+ * `reserveCampaignEmailSends` and `claimOrgEmailSendBudget` both do: the read
+ * is the authority for the decision, and an increment proves nothing about
+ * the value the decision was made from.
+ *
+ * The ceiling arrives as a resolved {@link EmailRampVerdict} rather than
+ * being derived here, because the caller has already paid the window read
+ * that decides which step the workspace is on — see
+ * {@link resolveOrgEmailRamp}. A graduated workspace claims nothing at all:
+ * the ramp does not bind it, and the hourly share that does has already been
+ * claimed by the time this runs.
+ *
+ * **Campaigns only**, like the hourly claim beside it. This function is not
+ * on `sendEmail`'s path and cannot be reached by a transactional message.
+ *
+ * A refused claim writes NOTHING — a campaign that resumes tomorrow must not
+ * have spent tomorrow's budget on being told no.
+ */ export async function claimOrgEmailSendDay(options) {
+    var _options_now, _options_orgId;
+    const now = Number((_options_now = options.now) != null ? _options_now : Date.now());
+    const at = Number.isFinite(now) && now > 0 ? now : Date.now();
+    const dayKey = reputationDayKey(at);
+    const retryAtMs = dayStartMs(at) + DAY_MS;
+    const count = Math.max(0, Math.floor(Number(options.count) || 0));
+    const orgId = String((_options_orgId = options.orgId) != null ? _options_orgId : '');
+    const ramp = options.ramp;
+    const granted = (used, degraded, reservation)=>({
+            allowed: true,
+            used,
+            ceiling: ramp.perDay,
+            remaining: Math.max(0, ramp.perDay - (used + count)),
+            retryAtMs,
+            ramp,
+            degraded,
+            reservation
+        });
+    // A parked control still reports a real ceiling, so a surface reading this
+    // does not blank while the control is off.
+    if (options.enabled === false) return granted(0, false, null);
+    // A graduated workspace is not paced by the ramp at all. No read, no write,
+    // and no claim to give back.
+    if (ramp.graduated) return granted(0, false, null);
+    if (!orgId) return granted(0, true, null);
+    try {
+        var _options_firestore;
+        const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+        const ref = reputationRef(firestore, dayKey, orgId);
+        return await firestore.runTransaction(async (tx)=>{
+            const snapshot = await tx.get(ref);
+            const used = storedCount(snapshot, 'claimed');
+            if (used + count > ramp.perDay) {
+                // A refused claim writes NOTHING.
+                return {
+                    allowed: false,
+                    used,
+                    ceiling: ramp.perDay,
+                    remaining: Math.max(0, ramp.perDay - used),
+                    retryAtMs,
+                    ramp,
+                    degraded: false,
+                    reservation: null
+                };
+            }
+            tx.set(ref, {
+                claimed: used + count,
+                orgId,
+                dayKey,
+                expiresAt: reputationExpiresAt(dayStartMs(at))
+            }, {
+                merge: true
+            });
+            return granted(used, false, {
+                orgId,
+                dayKey,
+                claimed: count
+            });
+        });
+    } catch (error) {
+        console.error('[sender-reputation] day window unavailable — allowing', error);
+        return granted(0, true, null);
+    }
+}
+/**
+ * Returns the undelivered part of a day's ramp claim.
+ *
+ * The hourly claim is deliberately never reconciled — its window is an hour
+ * and an unrefunded remainder costs the org the rest of it. A DAY is long
+ * enough that the same choice would cost a new workspace its whole first day
+ * over one failed batch, which is the opposite of what a ramp is for.
+ *
+ * **Never throws** and never drives the counter below zero, exactly as
+ * `reconcileCampaignSendReservation` does one surface over.
+ */ export async function reconcileOrgEmailSendDay(reservation, delivered, firestore) {
+    if (!(reservation == null ? void 0 : reservation.orgId)) return;
+    const sent = Math.max(0, Math.floor(Number(delivered) || 0));
+    const refund = Math.max(0, reservation.claimed - sent);
+    if (refund <= 0) return;
+    try {
+        const db = firestore != null ? firestore : firebaseAdmin.app().firestore();
+        const ref = reputationRef(db, reservation.dayKey, reservation.orgId);
+        await db.runTransaction(async (tx)=>{
+            const snapshot = await tx.get(ref);
+            const used = storedCount(snapshot, 'claimed');
+            tx.set(ref, {
+                claimed: Math.max(0, used - refund)
+            }, {
+                merge: true
+            });
+        });
+    } catch (error) {
+        console.error('[sender-reputation] day reconcile failed', error);
+    }
+}
+/**
+ * How old a workspace is, in days, from whatever its `createdAt` turns out to
+ * be.
+ *
+ * Firestore hands back a `Timestamp`, a restore or a fixture can leave a
+ * number, and an org written before the field existed has nothing. All three
+ * are handled and the last one answers `null`, which
+ * {@link claimOrgEmailSendDay} reads as graduated — the only safe direction,
+ * for the reason stated there.
+ */ export function orgAgeDays(createdAt, now = Date.now()) {
+    const raw = createdAt;
+    let createdMs = 0;
+    if (typeof raw === 'number') createdMs = raw;
+    else if (typeof raw === 'string') createdMs = Date.parse(raw);
+    else if (typeof (raw == null ? void 0 : raw.toMillis) === 'function') createdMs = raw.toMillis();
+    else if (typeof (raw == null ? void 0 : raw.seconds) === 'number') createdMs = raw.seconds * 1000;
+    /*
+   * The one check, and it has to answer `null` rather than 0. A creation date
+   * that could not be read is an org whose record predates the field, which
+   * is an EXISTING customer; `0` would say "created today" and ramp every
+   * paying tenant on the platform down to the first step.
+   */ if (!Number.isFinite(createdMs) || createdMs <= 0) return null;
+    return daysBetween(createdMs, now);
+}
+
+//# sourceMappingURL=email-sender-reputation.js.map

package/src/lib/server/email-sender-reputation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/email-sender-reputation.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * PER-TENANT SENDING REPUTATION — the durable half.\n *\n * The policy is pure and lives in `@aglyn/shared-util-email`\n * (`sender-reputation.ts`); this adds the counters that make a rate a fact\n * rather than an intention, and the daily claim that paces a workspace's\n * first week.\n *\n * ## One document per workspace per day\n *\n * `rateLimits/emailRep_{YYYY-MM-DD}_{orgId}` holds four numbers:\n *\n *  - `claimed` — campaign messages the day's ramp has granted. The PACING\n *    counter, taken before a send and reconciled to what actually left.\n *  - `accepted` — campaign messages that actually left. The DENOMINATOR every\n *    rate divides by.\n *  - `bounced`, `complained` — what the provider reported back.\n *\n * A day per document rather than a map of days on one, because the day is\n * what the TTL policy can sweep: `rateLimits` already carries an `expiresAt`\n * policy, and a document that ages out is a window that prunes itself. A map\n * of every day a workspace has ever sent would grow forever and would have to\n * be pruned by a job nobody would write.\n *\n * A per-ORG document rather than per-site, because the org is the tenant: the\n * plan, the monthly allowance and the hourly share are all keyed on it, and a\n * merchant with three sites on one domain is one sender to a mailbox\n * provider.\n *\n * The window document deliberately carries **no `lastAtMs`** — the\n * rate-limiter health probe queries this collection on that field, and a\n * per-day document in its range would compete with the degradation markers it\n * exists to find. The same reasoning as `sendRate_*` and `sendRateOrg_*`\n * beside it.\n *\n * ## Which day a bounce is filed under\n *\n * The day the EVENT arrived, not the day the message was sent. The webhook\n * knows the first and would need a per-message lookup for the second, and\n * over a seven-day window the two differ only at the edges — a bounce lands\n * within minutes and a complaint within hours or a day. Stated because the\n * rate is a ratio of two things counted on slightly different clocks, and a\n * reader comparing it against a provider's dashboard should know why they\n * will not agree to the last decimal.\n *\n * ## Failure posture: OPEN, and that is not the usual answer here\n *\n * An unreadable counter grades `ok` and grants the send, matching\n * `consumeEmailSendBudget` and `claimOrgEmailSendBudget`. The breaker is the\n * one control in this file that could refuse a paying customer's campaign,\n * and a refusal produced by a Firestore blip is an outage dressed as a policy\n * decision. The reputation risk it fails to catch is bounded by an hour of\n * sending; the refusal it would produce is not bounded by anything.\n */\n\nimport {\n  EMAIL_REPUTATION_WINDOW_DAYS,\n  emailRampVerdict,\n  emailReputationVerdict,\n  normalizeEmailReputationPolicy,\n  orgDailyCampaignCeiling,\n  reputationDayKey,\n  reputationWindowDayKeys,\n  daysBetween,\n  type EmailRampVerdict,\n  type EmailReputationCounts,\n  type EmailReputationPolicy,\n  type EmailReputationVerdict,\n} from '@aglyn/shared-util-email'\nimport { readEmailSendRateConfig } from './email-send-rate'\nimport { firebaseAdmin } from './firebase-admin'\nimport { RATE_LIMIT_COLLECTION } from './rate-limit-store'\n\n/** Id prefix for the per-org, per-day reputation documents. */\nexport const EMAIL_REPUTATION_DOC_PREFIX = 'emailRep_'\n\n/** One day in ms, named so the arithmetic below reads as arithmetic. */\nconst DAY_MS = 86_400_000\n\n/** The document id for one workspace's day. */\nexport function emailReputationDocId(dayKey: string, orgId: string): string {\n  return `${EMAIL_REPUTATION_DOC_PREFIX}${dayKey}_${orgId}`\n}\n\n/** The counted fields, so a writer cannot invent a fifth by typo. */\nexport type EmailReputationCounter =\n  | 'claimed'\n  | 'accepted'\n  | 'bounced'\n  | 'complained'\n\nfunction reputationRef(firestore: any, dayKey: string, orgId: string): any {\n  return firestore\n    .collection(RATE_LIMIT_COLLECTION)\n    .doc(emailReputationDocId(dayKey, orgId))\n}\n\n/** A stored count, clamped. A corrupt negative reads as 0, never as headroom. */\nfunction storedCount(snapshot: any, field: EmailReputationCounter): number {\n  const value = Number((snapshot?.exists ? snapshot.get(field) : 0) ?? 0)\n  return Number.isFinite(value) && value > 0 ? Math.floor(value) : 0\n}\n\n/**\n * When a day's document may be swept.\n *\n * One window plus a day of slack past the end of the day it counts, so the\n * oldest day a rate still divides by is never deleted underneath the read\n * that needs it.\n */\nfunction reputationExpiresAt(dayStartMs: number): Date {\n  return new Date(dayStartMs + (EMAIL_REPUTATION_WINDOW_DAYS + 2) * DAY_MS)\n}\n\n/** Midnight UTC of the day a timestamp falls in. */\nfunction dayStartMs(atMs: number): number {\n  return Math.floor(atMs / DAY_MS) * DAY_MS\n}\n\n/**\n * Adds to one of a workspace's daily counters.\n *\n * **Never throws.** Reputation accounting runs after mail has gone out, or\n * inside a webhook the provider will retry — a counter write that failed must\n * not turn a delivered campaign into a 500 or a webhook into a retry storm.\n * `FieldValue.increment` rather than a transaction because nothing decides\n * anything from this write: the decision is made by a separate read, and an\n * increment is the contention-free way to record a fact.\n */\nexport async function recordEmailReputationEvent(options: {\n  orgId: string\n  counter: EmailReputationCounter\n  count?: number\n  atMs?: number\n  firestore?: any\n}): Promise<void> {\n  const orgId = String(options.orgId ?? '')\n  const count = Math.floor(Number(options.count ?? 1))\n  if (!orgId || !Number.isFinite(count) || count <= 0) return\n  const atMs = Number(options.atMs ?? Date.now())\n  const at = Number.isFinite(atMs) && atMs > 0 ? atMs : Date.now()\n  try {\n    const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n    await reputationRef(firestore, reputationDayKey(at), orgId).set(\n      {\n        [options.counter]: firebaseAdmin.firestore.FieldValue.increment(count),\n        orgId,\n        dayKey: reputationDayKey(at),\n        // NOT `lastAtMs` — see the storage note at the top of this file.\n        expiresAt: reputationExpiresAt(dayStartMs(at)),\n      },\n      { merge: true },\n    )\n  } catch (error) {\n    console.error('[sender-reputation] counter write failed', error)\n  }\n}\n\n/** Campaign messages that actually left, for a workspace. The denominator. */\nexport function recordCampaignAccepted(\n  orgId: string,\n  count: number,\n  options?: { atMs?: number; firestore?: any },\n): Promise<void> {\n  return recordEmailReputationEvent({\n    orgId,\n    counter: 'accepted',\n    count,\n    ...options,\n  })\n}\n\n/**\n * A permanent bounce or a spam complaint, attributed to the workspace that\n * sent it.\n *\n * The suppression the same event produces is a separate act and is not\n * conditional on this: an address comes off the list whether or not the\n * counter write lands.\n */\nexport function recordEmailReputationFailure(\n  orgId: string,\n  kind: 'bounce' | 'complaint',\n  options?: { atMs?: number; firestore?: any },\n): Promise<void> {\n  return recordEmailReputationEvent({\n    orgId,\n    counter: kind === 'complaint' ? 'complained' : 'bounced',\n    count: 1,\n    ...options,\n  })\n}\n\n/** The counts a workspace's window holds, plus what the ramp needs. */\nexport interface SenderReputationWindow extends EmailReputationCounts {\n  /**\n   * Campaign messages the ramp has granted TODAY.\n   *\n   * Read here rather than by a second query because today's document is\n   * already in this window: the ramp needs one number off it and the rates\n   * need three off all of them, and two reads of one document to answer two\n   * questions about the same workspace is a round trip nobody has to pay.\n   */\n  claimedToday: number\n  /** Days the window covers. */\n  windowDays: number\n  /** True when the window could not be read and everything below is zero. */\n  degraded: boolean\n}\n\n/**\n * Sums a workspace's last {@link EMAIL_REPUTATION_WINDOW_DAYS} days.\n *\n * One `getAll` over the window's day documents — seven reads per campaign,\n * not per message, and none at all for a workspace that has never sent. An\n * absent day is a quiet day and reads as zero.\n */\nexport async function readSenderReputationWindow(options: {\n  orgId: string\n  now?: number\n  windowDays?: number\n  firestore?: any\n}): Promise<SenderReputationWindow> {\n  const windowDays = Math.max(\n    1,\n    Math.floor(Number(options.windowDays ?? EMAIL_REPUTATION_WINDOW_DAYS)) ||\n      EMAIL_REPUTATION_WINDOW_DAYS,\n  )\n  const empty: SenderReputationWindow = {\n    accepted: 0,\n    bounced: 0,\n    complained: 0,\n    claimedToday: 0,\n    windowDays,\n    degraded: false,\n  }\n  const orgId = String(options.orgId ?? '')\n  if (!orgId) return empty\n  const now = Number(options.now ?? Date.now())\n  try {\n    const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n    const dayKeys = reputationWindowDayKeys(now, windowDays)\n    const today = reputationDayKey(now)\n    const snapshots = await firestore.getAll(\n      ...dayKeys.map((dayKey) => reputationRef(firestore, dayKey, orgId)),\n    )\n    return snapshots.reduce(\n      (totals: SenderReputationWindow, snapshot: any, index: number) => ({\n        ...totals,\n        accepted: totals.accepted + storedCount(snapshot, 'accepted'),\n        bounced: totals.bounced + storedCount(snapshot, 'bounced'),\n        complained: totals.complained + storedCount(snapshot, 'complained'),\n        claimedToday:\n          dayKeys[index] === today\n            ? totals.claimedToday + storedCount(snapshot, 'claimed')\n            : totals.claimedToday,\n      }),\n      empty,\n    )\n  } catch (error) {\n    console.error('[sender-reputation] window unavailable — grading ok', error)\n    return { ...empty, degraded: true }\n  }\n}\n\n/** A workspace's reputation, and whether its campaigns may go out. */\nexport interface SenderReputationRead extends EmailReputationVerdict {\n  /** True when the window could not be read, so nothing was graded. */\n  degraded: boolean\n  /** The counts the grade was made from, so a caller can size a ramp too. */\n  window: SenderReputationWindow\n}\n\n/**\n * Grades one workspace.\n *\n * The policy and the grace period come from the ORG DOCUMENT, which the\n * campaign sender has already read — passed in rather than re-fetched, so\n * this costs the window read and nothing else.\n */\nexport async function readSenderReputation(options: {\n  orgId: string\n  policy?: unknown\n  reinstatedUntilMs?: unknown\n  now?: number\n  firestore?: any\n}): Promise<SenderReputationRead> {\n  const now = Number(options.now ?? Date.now())\n  const window = await readSenderReputationWindow({\n    orgId: options.orgId,\n    now,\n    firestore: options.firestore,\n  })\n  const verdict = emailReputationVerdict({\n    counts: window,\n    // A degraded read grades against zeroes, which is `ok` by construction.\n    // Stated rather than special-cased: the fail-open posture at the top of\n    // this file is the reason, and a branch here would be a second place for\n    // it to be got wrong.\n    policy: normalizeEmailReputationPolicy(options.policy),\n    windowDays: window.windowDays,\n    reinstatedUntilMs: Number(options.reinstatedUntilMs ?? 0) || null,\n    now,\n  })\n  return { ...verdict, degraded: window.degraded, window }\n}\n\n/**\n * The ramp step a workspace has EARNED, from a window it has already read.\n *\n * A thin wrapper over the pure policy that supplies the one number the policy\n * cannot know: what a graduated workspace's day is, which is a share of the\n * live platform ceiling and therefore moves with a staff ramp.\n */\nexport function resolveOrgEmailRamp(options: {\n  /** Days since the workspace was created; null or absent graduates it. */\n  ageDays: number | null | undefined\n  /** Campaign messages it has delivered inside the window. */\n  deliveredLifetime: number\n  /** The live platform ceiling. */\n  platformPerHour: number\n}): EmailRampVerdict {\n  return emailRampVerdict({\n    ageDays: options.ageDays,\n    deliveredLifetime: options.deliveredLifetime,\n    graduatedPerDay: orgDailyCampaignCeiling(options.platformPerHour),\n  })\n}\n\n/** A workspace's ramp step, and whether the history behind it was readable. */\nexport interface OrgEmailRampRead {\n  /** The step, from the age and the delivery history that resolved. */\n  ramp: EmailRampVerdict\n  /**\n   * True when the ramp BINDS and the window it is sized from was unreadable,\n   * so {@link ramp} is a floor rather than an answer.\n   *\n   * A caller that pages a batch — the campaign path — may treat this as the\n   * step and carry on, because the floor is the lowest step and erring low\n   * defers mail rather than sending it. A caller that admits or refuses ONE\n   * message has no such third answer and must refuse: see\n   * {@link readOrgEmailRamp}.\n   */\n  degraded: boolean\n}\n\n/**\n * A workspace's ramp step, resolved from its record and its history.\n *\n * The reads {@link resolveOrgEmailRamp} needs, in the order that pays for\n * the fewest of them. The platform ceiling comes first because it is process-\n * cached for fifteen seconds and therefore free; the seven-day window is a\n * `getAll` and is only paid when the ramp can still bind.\n *\n * ## A graduated workspace pays nothing\n *\n * Age alone decides graduation — delivery volume can only RAISE a step, never\n * reach past the last one — so a workspace past its first week is answered\n * from the org record with no window read at all. That is every existing\n * customer and every org whose record predates the creation timestamp, which\n * is to say almost every call.\n *\n * ## An unreadable window is `degraded`, and it is the caller's to answer\n *\n * The window read grades itself rather than throwing, and an unreadable one\n * reads as zero delivered — the LOWEST step, which is the conservative\n * direction for a ceiling. What it is not is a fact, so it is flagged: a\n * surface admitting one message at a time cannot defer the remainder to\n * tomorrow the way a campaign can, and a limiter with no answer must refuse\n * rather than admit.\n *\n * ## The platform flag parks this control\n *\n * `enabled: false` on the send-rate config graduates every workspace here,\n * exactly as it parks the hourly share and {@link claimOrgEmailSendDay} — one\n * switch, and it turns the ramp off everywhere it is consulted.\n */\nexport async function readOrgEmailRamp(options: {\n  orgId: string\n  /** The org record's `createdAt`, in whatever shape it was stored. */\n  createdAt: unknown\n  now?: number\n  firestore?: any\n}): Promise<OrgEmailRampRead> {\n  const now = Number(options.now ?? Date.now())\n  const at = Number.isFinite(now) && now > 0 ? now : Date.now()\n  const config = await readEmailSendRateConfig(\n    options.firestore ? { firestore: options.firestore, now: at } : { now: at },\n  )\n  const platformPerHour = config.perHour\n  if (!config.enabled) {\n    // A parked control answers with the verdict an established workspace\n    // gets, so a surface reading the step does not blank while it is off.\n    const parked = resolveOrgEmailRamp({\n      ageDays: null,\n      deliveredLifetime: 0,\n      platformPerHour,\n    })\n    return { ramp: parked, degraded: false }\n  }\n  const ageDays = orgAgeDays(options.createdAt, at)\n  /*\n   * The step this workspace would be on having delivered nothing. It is the\n   * graduation test and the floor in one value: delivered volume only ever\n   * raises a step, so a verdict that graduates here graduates at any volume,\n   * and one that does not is the lowest step the workspace can be on.\n   */\n  const floor = resolveOrgEmailRamp({\n    ageDays,\n    deliveredLifetime: 0,\n    platformPerHour,\n  })\n  if (floor.graduated) return { ramp: floor, degraded: false }\n  const window = await readSenderReputationWindow({\n    orgId: options.orgId,\n    now: at,\n    firestore: options.firestore,\n  })\n  if (window.degraded) return { ramp: floor, degraded: true }\n  return {\n    ramp: resolveOrgEmailRamp({\n      ageDays,\n      deliveredLifetime: window.accepted,\n      platformPerHour,\n    }),\n    degraded: false,\n  }\n}\n\n/** The answer to a per-day ramp claim. Every field is a stated number. */\nexport interface OrgEmailSendDayClaim {\n  allowed: boolean\n  /** Messages claimed today BEFORE this send. */\n  used: number\n  /** What this workspace may send today. */\n  ceiling: number\n  /** Headroom after this send, floored at 0. */\n  remaining: number\n  /** When the day rolls and a deferred campaign may go, ms. */\n  retryAtMs: number\n  /** The ramp decision the ceiling came from. */\n  ramp: EmailRampVerdict\n  /** True when the counter was unreachable and this failed open. */\n  degraded: boolean\n  /**\n   * What to hand {@link reconcileOrgEmailSendDay} once the batch is done.\n   * Null when nothing was claimed — a graduated workspace, a parked control,\n   * or a refusal.\n   */\n  reservation: OrgEmailSendDayReservation | null\n}\n\n/** A claim on a day's ramp, so an undelivered remainder can be given back. */\nexport interface OrgEmailSendDayReservation {\n  orgId: string\n  dayKey: string\n  claimed: number\n}\n\n/**\n * THE NEW-SENDER RAMP, ENFORCED.\n *\n * Claims `count` campaign messages against what this workspace may send\n * today, atomically. The transaction reads the counter and writes an ABSOLUTE\n * value derived from that read rather than an increment, for the reason\n * `reserveCampaignEmailSends` and `claimOrgEmailSendBudget` both do: the read\n * is the authority for the decision, and an increment proves nothing about\n * the value the decision was made from.\n *\n * The ceiling arrives as a resolved {@link EmailRampVerdict} rather than\n * being derived here, because the caller has already paid the window read\n * that decides which step the workspace is on — see\n * {@link resolveOrgEmailRamp}. A graduated workspace claims nothing at all:\n * the ramp does not bind it, and the hourly share that does has already been\n * claimed by the time this runs.\n *\n * **Campaigns only**, like the hourly claim beside it. This function is not\n * on `sendEmail`'s path and cannot be reached by a transactional message.\n *\n * A refused claim writes NOTHING — a campaign that resumes tomorrow must not\n * have spent tomorrow's budget on being told no.\n */\nexport async function claimOrgEmailSendDay(options: {\n  orgId: string\n  /** Messages this batch would send. */\n  count: number\n  /** What this workspace may send today, from {@link resolveOrgEmailRamp}. */\n  ramp: EmailRampVerdict\n  /** False parks the control, exactly as the platform governor's flag does. */\n  enabled?: boolean\n  now?: number\n  firestore?: any\n}): Promise<OrgEmailSendDayClaim> {\n  const now = Number(options.now ?? Date.now())\n  const at = Number.isFinite(now) && now > 0 ? now : Date.now()\n  const dayKey = reputationDayKey(at)\n  const retryAtMs = dayStartMs(at) + DAY_MS\n  const count = Math.max(0, Math.floor(Number(options.count) || 0))\n  const orgId = String(options.orgId ?? '')\n  const ramp = options.ramp\n\n  const granted = (\n    used: number,\n    degraded: boolean,\n    reservation: OrgEmailSendDayReservation | null,\n  ): OrgEmailSendDayClaim => ({\n    allowed: true,\n    used,\n    ceiling: ramp.perDay,\n    remaining: Math.max(0, ramp.perDay - (used + count)),\n    retryAtMs,\n    ramp,\n    degraded,\n    reservation,\n  })\n\n  // A parked control still reports a real ceiling, so a surface reading this\n  // does not blank while the control is off.\n  if (options.enabled === false) return granted(0, false, null)\n  // A graduated workspace is not paced by the ramp at all. No read, no write,\n  // and no claim to give back.\n  if (ramp.graduated) return granted(0, false, null)\n  if (!orgId) return granted(0, true, null)\n\n  try {\n    const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n    const ref = reputationRef(firestore, dayKey, orgId)\n    return await firestore.runTransaction(async (tx: any) => {\n      const snapshot = await tx.get(ref)\n      const used = storedCount(snapshot, 'claimed')\n      if (used + count > ramp.perDay) {\n        // A refused claim writes NOTHING.\n        return {\n          allowed: false,\n          used,\n          ceiling: ramp.perDay,\n          remaining: Math.max(0, ramp.perDay - used),\n          retryAtMs,\n          ramp,\n          degraded: false,\n          reservation: null,\n        }\n      }\n      tx.set(\n        ref,\n        {\n          claimed: used + count,\n          orgId,\n          dayKey,\n          expiresAt: reputationExpiresAt(dayStartMs(at)),\n        },\n        { merge: true },\n      )\n      return granted(used, false, { orgId, dayKey, claimed: count })\n    })\n  } catch (error) {\n    console.error('[sender-reputation] day window unavailable — allowing', error)\n    return granted(0, true, null)\n  }\n}\n\n/**\n * Returns the undelivered part of a day's ramp claim.\n *\n * The hourly claim is deliberately never reconciled — its window is an hour\n * and an unrefunded remainder costs the org the rest of it. A DAY is long\n * enough that the same choice would cost a new workspace its whole first day\n * over one failed batch, which is the opposite of what a ramp is for.\n *\n * **Never throws** and never drives the counter below zero, exactly as\n * `reconcileCampaignSendReservation` does one surface over.\n */\nexport async function reconcileOrgEmailSendDay(\n  reservation: OrgEmailSendDayReservation | null | undefined,\n  delivered: number,\n  firestore?: any,\n): Promise<void> {\n  if (!reservation?.orgId) return\n  const sent = Math.max(0, Math.floor(Number(delivered) || 0))\n  const refund = Math.max(0, reservation.claimed - sent)\n  if (refund <= 0) return\n  try {\n    const db = firestore ?? firebaseAdmin.app().firestore()\n    const ref = reputationRef(db, reservation.dayKey, reservation.orgId)\n    await db.runTransaction(async (tx: any) => {\n      const snapshot = await tx.get(ref)\n      const used = storedCount(snapshot, 'claimed')\n      tx.set(ref, { claimed: Math.max(0, used - refund) }, { merge: true })\n    })\n  } catch (error) {\n    console.error('[sender-reputation] day reconcile failed', error)\n  }\n}\n\n/**\n * How old a workspace is, in days, from whatever its `createdAt` turns out to\n * be.\n *\n * Firestore hands back a `Timestamp`, a restore or a fixture can leave a\n * number, and an org written before the field existed has nothing. All three\n * are handled and the last one answers `null`, which\n * {@link claimOrgEmailSendDay} reads as graduated — the only safe direction,\n * for the reason stated there.\n */\nexport function orgAgeDays(\n  createdAt: unknown,\n  now: number = Date.now(),\n): number | null {\n  const raw = createdAt as\n    | { toMillis?: () => number; seconds?: number }\n    | number\n    | string\n    | null\n    | undefined\n  let createdMs = 0\n  if (typeof raw === 'number') createdMs = raw\n  else if (typeof raw === 'string') createdMs = Date.parse(raw)\n  else if (typeof raw?.toMillis === 'function') createdMs = raw.toMillis()\n  else if (typeof raw?.seconds === 'number') createdMs = raw.seconds * 1000\n  /*\n   * The one check, and it has to answer `null` rather than 0. A creation date\n   * that could not be read is an org whose record predates the field, which\n   * is an EXISTING customer; `0` would say \"created today\" and ramp every\n   * paying tenant on the platform down to the first step.\n   */\n  if (!Number.isFinite(createdMs) || createdMs <= 0) return null\n  return daysBetween(createdMs, now)\n}\n\n/** Re-exported so a caller reads one module for the whole control. */\nexport type { EmailReputationPolicy, EmailRampVerdict }\n"],"names":["EMAIL_REPUTATION_WINDOW_DAYS","emailRampVerdict","emailReputationVerdict","normalizeEmailReputationPolicy","orgDailyCampaignCeiling","reputationDayKey","reputationWindowDayKeys","daysBetween","readEmailSendRateConfig","firebaseAdmin","RATE_LIMIT_COLLECTION","EMAIL_REPUTATION_DOC_PREFIX","DAY_MS","emailReputationDocId","dayKey","orgId","reputationRef","firestore","collection","doc","storedCount","snapshot","field","value","Number","exists","get","isFinite","Math","floor","reputationExpiresAt","dayStartMs","Date","atMs","recordEmailReputationEvent","options","String","count","now","at","app","set","counter","FieldValue","increment","expiresAt","merge","error","console","recordCampaignAccepted","recordEmailReputationFailure","kind","readSenderReputationWindow","windowDays","max","empty","accepted","bounced","complained","claimedToday","degraded","dayKeys","today","snapshots","getAll","map","reduce","totals","index","readSenderReputation","window","verdict","counts","policy","reinstatedUntilMs","resolveOrgEmailRamp","ageDays","deliveredLifetime","graduatedPerDay","platformPerHour","readOrgEmailRamp","config","perHour","enabled","parked","ramp","orgAgeDays","createdAt","graduated","claimOrgEmailSendDay","retryAtMs","granted","used","reservation","allowed","ceiling","perDay","remaining","ref","runTransaction","tx","claimed","reconcileOrgEmailSendDay","delivered","sent","refund","db","raw","createdMs","parse","toMillis","seconds"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDC,GAED,SACEA,4BAA4B,EAC5BC,gBAAgB,EAChBC,sBAAsB,EACtBC,8BAA8B,EAC9BC,uBAAuB,EACvBC,gBAAgB,EAChBC,uBAAuB,EACvBC,WAAW,QAKN,2BAA0B;AACjC,SAASC,uBAAuB,QAAQ,uBAAmB;AAC3D,SAASC,aAAa,QAAQ,sBAAkB;AAChD,SAASC,qBAAqB,QAAQ,wBAAoB;AAE1D,6DAA6D,GAC7D,OAAO,MAAMC,8BAA8B,YAAW;AAEtD,sEAAsE,GACtE,MAAMC,SAAS;AAEf,6CAA6C,GAC7C,OAAO,SAASC,qBAAqBC,MAAc,EAAEC,KAAa;IAChE,OAAO,GAAGJ,8BAA8BG,OAAO,CAAC,EAAEC,OAAO;AAC3D;AASA,SAASC,cAAcC,SAAc,EAAEH,MAAc,EAAEC,KAAa;IAClE,OAAOE,UACJC,UAAU,CAACR,uBACXS,GAAG,CAACN,qBAAqBC,QAAQC;AACtC;AAEA,+EAA+E,GAC/E,SAASK,YAAYC,QAAa,EAAEC,KAA6B;QACzCD;IAAtB,MAAME,QAAQC,QAAQH,OAAAA,CAAAA,4BAAAA,SAAUI,MAAM,IAAGJ,SAASK,GAAG,CAACJ,SAAS,aAAzCD,OAA+C;IACrE,OAAOG,OAAOG,QAAQ,CAACJ,UAAUA,QAAQ,IAAIK,KAAKC,KAAK,CAACN,SAAS;AACnE;AAEA;;;;;;CAMC,GACD,SAASO,oBAAoBC,UAAkB;IAC7C,OAAO,IAAIC,KAAKD,aAAa,AAAC/B,CAAAA,+BAA+B,CAAA,IAAKY;AACpE;AAEA,kDAAkD,GAClD,SAASmB,WAAWE,IAAY;IAC9B,OAAOL,KAAKC,KAAK,CAACI,OAAOrB,UAAUA;AACrC;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAesB,2BAA2BC,OAMhD;QACsBA,gBACWA,gBAEZA;IAHpB,MAAMpB,QAAQqB,QAAOD,iBAAAA,QAAQpB,KAAK,YAAboB,iBAAiB;IACtC,MAAME,QAAQT,KAAKC,KAAK,CAACL,QAAOW,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiB;IACjD,IAAI,CAACpB,SAAS,CAACS,OAAOG,QAAQ,CAACU,UAAUA,SAAS,GAAG;IACrD,MAAMJ,OAAOT,QAAOW,gBAAAA,QAAQF,IAAI,YAAZE,gBAAgBH,KAAKM,GAAG;IAC5C,MAAMC,KAAKf,OAAOG,QAAQ,CAACM,SAASA,OAAO,IAAIA,OAAOD,KAAKM,GAAG;IAC9D,IAAI;YACgBH;QAAlB,MAAMlB,aAAYkB,qBAAAA,QAAQlB,SAAS,YAAjBkB,qBAAqB1B,cAAc+B,GAAG,GAAGvB,SAAS;QACpE,MAAMD,cAAcC,WAAWZ,iBAAiBkC,KAAKxB,OAAO0B,GAAG,CAC7D;YACE,CAACN,QAAQO,OAAO,CAAC,EAAEjC,cAAcQ,SAAS,CAAC0B,UAAU,CAACC,SAAS,CAACP;YAChEtB;YACAD,QAAQT,iBAAiBkC;YACzB,iEAAiE;YACjEM,WAAWf,oBAAoBC,WAAWQ;QAC5C,GACA;YAAEO,OAAO;QAAK;IAElB,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,4CAA4CA;IAC5D;AACF;AAEA,4EAA4E,GAC5E,OAAO,SAASE,uBACdlC,KAAa,EACbsB,KAAa,EACbF,OAA4C;IAE5C,OAAOD,2BAA2B;QAChCnB;QACA2B,SAAS;QACTL;OACGF;AAEP;AAEA;;;;;;;CAOC,GACD,OAAO,SAASe,6BACdnC,KAAa,EACboC,IAA4B,EAC5BhB,OAA4C;IAE5C,OAAOD,2BAA2B;QAChCnB;QACA2B,SAASS,SAAS,cAAc,eAAe;QAC/Cd,OAAO;OACJF;AAEP;AAmBA;;;;;;CAMC,GACD,OAAO,eAAeiB,2BAA2BjB,OAKhD;QAGqBA,qBAWCA,gBAEFA;IAfnB,MAAMkB,aAAazB,KAAK0B,GAAG,CACzB,GACA1B,KAAKC,KAAK,CAACL,QAAOW,sBAAAA,QAAQkB,UAAU,YAAlBlB,sBAAsBnC,kCACtCA;IAEJ,MAAMuD,QAAgC;QACpCC,UAAU;QACVC,SAAS;QACTC,YAAY;QACZC,cAAc;QACdN;QACAO,UAAU;IACZ;IACA,MAAM7C,QAAQqB,QAAOD,iBAAAA,QAAQpB,KAAK,YAAboB,iBAAiB;IACtC,IAAI,CAACpB,OAAO,OAAOwC;IACnB,MAAMjB,MAAMd,QAAOW,eAAAA,QAAQG,GAAG,YAAXH,eAAeH,KAAKM,GAAG;IAC1C,IAAI;YACgBH;QAAlB,MAAMlB,aAAYkB,qBAAAA,QAAQlB,SAAS,YAAjBkB,qBAAqB1B,cAAc+B,GAAG,GAAGvB,SAAS;QACpE,MAAM4C,UAAUvD,wBAAwBgC,KAAKe;QAC7C,MAAMS,QAAQzD,iBAAiBiC;QAC/B,MAAMyB,YAAY,MAAM9C,UAAU+C,MAAM,IACnCH,QAAQI,GAAG,CAAC,CAACnD,SAAWE,cAAcC,WAAWH,QAAQC;QAE9D,OAAOgD,UAAUG,MAAM,CACrB,CAACC,QAAgC9C,UAAe+C,QAAmB,aAC9DD;gBACHX,UAAUW,OAAOX,QAAQ,GAAGpC,YAAYC,UAAU;gBAClDoC,SAASU,OAAOV,OAAO,GAAGrC,YAAYC,UAAU;gBAChDqC,YAAYS,OAAOT,UAAU,GAAGtC,YAAYC,UAAU;gBACtDsC,cACEE,OAAO,CAACO,MAAM,KAAKN,QACfK,OAAOR,YAAY,GAAGvC,YAAYC,UAAU,aAC5C8C,OAAOR,YAAY;gBAE3BJ;IAEJ,EAAE,OAAOR,OAAO;QACdC,QAAQD,KAAK,CAAC,uDAAuDA;QACrE,OAAO,aAAKQ;YAAOK,UAAU;;IAC/B;AACF;AAUA;;;;;;CAMC,GACD,OAAO,eAAeS,qBAAqBlC,OAM1C;QACoBA,cAcSA;IAd5B,MAAMG,MAAMd,QAAOW,eAAAA,QAAQG,GAAG,YAAXH,eAAeH,KAAKM,GAAG;IAC1C,MAAMgC,SAAS,MAAMlB,2BAA2B;QAC9CrC,OAAOoB,QAAQpB,KAAK;QACpBuB;QACArB,WAAWkB,QAAQlB,SAAS;IAC9B;IACA,MAAMsD,UAAUrE,uBAAuB;QACrCsE,QAAQF;QACR,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,sBAAsB;QACtBG,QAAQtE,+BAA+BgC,QAAQsC,MAAM;QACrDpB,YAAYiB,OAAOjB,UAAU;QAC7BqB,mBAAmBlD,QAAOW,6BAAAA,QAAQuC,iBAAiB,YAAzBvC,6BAA6B,MAAM;QAC7DG;IACF;IACA,OAAO,aAAKiC;QAASX,UAAUU,OAAOV,QAAQ;QAAEU;;AAClD;AAEA;;;;;;CAMC,GACD,OAAO,SAASK,oBAAoBxC,OAOnC;IACC,OAAOlC,iBAAiB;QACtB2E,SAASzC,QAAQyC,OAAO;QACxBC,mBAAmB1C,QAAQ0C,iBAAiB;QAC5CC,iBAAiB1E,wBAAwB+B,QAAQ4C,eAAe;IAClE;AACF;AAmBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,eAAeC,iBAAiB7C,OAMtC;QACoBA;IAAnB,MAAMG,MAAMd,QAAOW,eAAAA,QAAQG,GAAG,YAAXH,eAAeH,KAAKM,GAAG;IAC1C,MAAMC,KAAKf,OAAOG,QAAQ,CAACW,QAAQA,MAAM,IAAIA,MAAMN,KAAKM,GAAG;IAC3D,MAAM2C,SAAS,MAAMzE,wBACnB2B,QAAQlB,SAAS,GAAG;QAAEA,WAAWkB,QAAQlB,SAAS;QAAEqB,KAAKC;IAAG,IAAI;QAAED,KAAKC;IAAG;IAE5E,MAAMwC,kBAAkBE,OAAOC,OAAO;IACtC,IAAI,CAACD,OAAOE,OAAO,EAAE;QACnB,qEAAqE;QACrE,sEAAsE;QACtE,MAAMC,SAAST,oBAAoB;YACjCC,SAAS;YACTC,mBAAmB;YACnBE;QACF;QACA,OAAO;YAAEM,MAAMD;YAAQxB,UAAU;QAAM;IACzC;IACA,MAAMgB,UAAUU,WAAWnD,QAAQoD,SAAS,EAAEhD;IAC9C;;;;;GAKC,GACD,MAAMV,QAAQ8C,oBAAoB;QAChCC;QACAC,mBAAmB;QACnBE;IACF;IACA,IAAIlD,MAAM2D,SAAS,EAAE,OAAO;QAAEH,MAAMxD;QAAO+B,UAAU;IAAM;IAC3D,MAAMU,SAAS,MAAMlB,2BAA2B;QAC9CrC,OAAOoB,QAAQpB,KAAK;QACpBuB,KAAKC;QACLtB,WAAWkB,QAAQlB,SAAS;IAC9B;IACA,IAAIqD,OAAOV,QAAQ,EAAE,OAAO;QAAEyB,MAAMxD;QAAO+B,UAAU;IAAK;IAC1D,OAAO;QACLyB,MAAMV,oBAAoB;YACxBC;YACAC,mBAAmBP,OAAOd,QAAQ;YAClCuB;QACF;QACAnB,UAAU;IACZ;AACF;AAgCA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,eAAe6B,qBAAqBtD,OAU1C;QACoBA,cAKEA;IALrB,MAAMG,MAAMd,QAAOW,eAAAA,QAAQG,GAAG,YAAXH,eAAeH,KAAKM,GAAG;IAC1C,MAAMC,KAAKf,OAAOG,QAAQ,CAACW,QAAQA,MAAM,IAAIA,MAAMN,KAAKM,GAAG;IAC3D,MAAMxB,SAAST,iBAAiBkC;IAChC,MAAMmD,YAAY3D,WAAWQ,MAAM3B;IACnC,MAAMyB,QAAQT,KAAK0B,GAAG,CAAC,GAAG1B,KAAKC,KAAK,CAACL,OAAOW,QAAQE,KAAK,KAAK;IAC9D,MAAMtB,QAAQqB,QAAOD,iBAAAA,QAAQpB,KAAK,YAAboB,iBAAiB;IACtC,MAAMkD,OAAOlD,QAAQkD,IAAI;IAEzB,MAAMM,UAAU,CACdC,MACAhC,UACAiC,cAC0B,CAAA;YAC1BC,SAAS;YACTF;YACAG,SAASV,KAAKW,MAAM;YACpBC,WAAWrE,KAAK0B,GAAG,CAAC,GAAG+B,KAAKW,MAAM,GAAIJ,CAAAA,OAAOvD,KAAI;YACjDqD;YACAL;YACAzB;YACAiC;QACF,CAAA;IAEA,2EAA2E;IAC3E,2CAA2C;IAC3C,IAAI1D,QAAQgD,OAAO,KAAK,OAAO,OAAOQ,QAAQ,GAAG,OAAO;IACxD,4EAA4E;IAC5E,6BAA6B;IAC7B,IAAIN,KAAKG,SAAS,EAAE,OAAOG,QAAQ,GAAG,OAAO;IAC7C,IAAI,CAAC5E,OAAO,OAAO4E,QAAQ,GAAG,MAAM;IAEpC,IAAI;YACgBxD;QAAlB,MAAMlB,aAAYkB,qBAAAA,QAAQlB,SAAS,YAAjBkB,qBAAqB1B,cAAc+B,GAAG,GAAGvB,SAAS;QACpE,MAAMiF,MAAMlF,cAAcC,WAAWH,QAAQC;QAC7C,OAAO,MAAME,UAAUkF,cAAc,CAAC,OAAOC;YAC3C,MAAM/E,WAAW,MAAM+E,GAAG1E,GAAG,CAACwE;YAC9B,MAAMN,OAAOxE,YAAYC,UAAU;YACnC,IAAIuE,OAAOvD,QAAQgD,KAAKW,MAAM,EAAE;gBAC9B,kCAAkC;gBAClC,OAAO;oBACLF,SAAS;oBACTF;oBACAG,SAASV,KAAKW,MAAM;oBACpBC,WAAWrE,KAAK0B,GAAG,CAAC,GAAG+B,KAAKW,MAAM,GAAGJ;oBACrCF;oBACAL;oBACAzB,UAAU;oBACViC,aAAa;gBACf;YACF;YACAO,GAAG3D,GAAG,CACJyD,KACA;gBACEG,SAAST,OAAOvD;gBAChBtB;gBACAD;gBACA+B,WAAWf,oBAAoBC,WAAWQ;YAC5C,GACA;gBAAEO,OAAO;YAAK;YAEhB,OAAO6C,QAAQC,MAAM,OAAO;gBAAE7E;gBAAOD;gBAAQuF,SAAShE;YAAM;QAC9D;IACF,EAAE,OAAOU,OAAO;QACdC,QAAQD,KAAK,CAAC,yDAAyDA;QACvE,OAAO4C,QAAQ,GAAG,MAAM;IAC1B;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeW,yBACpBT,WAA0D,EAC1DU,SAAiB,EACjBtF,SAAe;IAEf,IAAI,EAAC4E,+BAAAA,YAAa9E,KAAK,GAAE;IACzB,MAAMyF,OAAO5E,KAAK0B,GAAG,CAAC,GAAG1B,KAAKC,KAAK,CAACL,OAAO+E,cAAc;IACzD,MAAME,SAAS7E,KAAK0B,GAAG,CAAC,GAAGuC,YAAYQ,OAAO,GAAGG;IACjD,IAAIC,UAAU,GAAG;IACjB,IAAI;QACF,MAAMC,KAAKzF,oBAAAA,YAAaR,cAAc+B,GAAG,GAAGvB,SAAS;QACrD,MAAMiF,MAAMlF,cAAc0F,IAAIb,YAAY/E,MAAM,EAAE+E,YAAY9E,KAAK;QACnE,MAAM2F,GAAGP,cAAc,CAAC,OAAOC;YAC7B,MAAM/E,WAAW,MAAM+E,GAAG1E,GAAG,CAACwE;YAC9B,MAAMN,OAAOxE,YAAYC,UAAU;YACnC+E,GAAG3D,GAAG,CAACyD,KAAK;gBAAEG,SAASzE,KAAK0B,GAAG,CAAC,GAAGsC,OAAOa;YAAQ,GAAG;gBAAE3D,OAAO;YAAK;QACrE;IACF,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,4CAA4CA;IAC5D;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASuC,WACdC,SAAkB,EAClBjD,MAAcN,KAAKM,GAAG,EAAE;IAExB,MAAMqE,MAAMpB;IAMZ,IAAIqB,YAAY;IAChB,IAAI,OAAOD,QAAQ,UAAUC,YAAYD;SACpC,IAAI,OAAOA,QAAQ,UAAUC,YAAY5E,KAAK6E,KAAK,CAACF;SACpD,IAAI,QAAOA,uBAAAA,IAAKG,QAAQ,MAAK,YAAYF,YAAYD,IAAIG,QAAQ;SACjE,IAAI,QAAOH,uBAAAA,IAAKI,OAAO,MAAK,UAAUH,YAAYD,IAAII,OAAO,GAAG;IACrE;;;;;GAKC,GACD,IAAI,CAACvF,OAAOG,QAAQ,CAACiF,cAAcA,aAAa,GAAG,OAAO;IAC1D,OAAOrG,YAAYqG,WAAWtE;AAChC"}