@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/host-sending-domain.js

@@ -0,0 +1,451 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE PER-SITE SENDING DOMAIN — the claim, and nothing else.
+ *
+ * Provisioning a site's sending domain is two writes to two vendors and one
+ * write of our own. This module owns only the third: the LABEL CLAIM and the
+ * record that says a domain has been asked for. It calls no vendor, reads no
+ * credential, and is safe for the tenant runtime to import — which matters,
+ * because the tenant runtime is where a site first discovers it needs to send.
+ *
+ * The vendor half lives in the console (`provision-sending-domain.ts`), for
+ * the same structural reason `sending-domain-provider.ts` does: the keys that
+ * create a Resend domain and write our DNS zone must not be reachable from a
+ * process that serves published sites.
+ *
+ * ## Request here, issue there
+ *
+ * That split is what makes provisioning ON DEMAND possible at all.
+ * {@link requestHostSendingDomain} is a cheap Firestore write with no
+ * credential behind it; the console-side sweep picks the claim up and does the
+ * vendor work, and the re-check sweep then moves the domain to `verified` on
+ * its own.
+ *
+ * So a site is never blocked waiting on a credential it cannot hold, and the
+ * credential is never held by a process that should not have it.
+ *
+ * ## NOTHING HERE RUNS WITHOUT SOMEBODY ASKING
+ *
+ * A dedicated subdomain is the one shape in the sending model that draws on a
+ * resource we cannot buy our way out of at scale: a slot in the provider's
+ * account-wide domain allowance, three records in our own zone, and a
+ * permanent place in the re-verification sweep. The shared pool is flat at any
+ * number of sites, and a domain the CUSTOMER owns costs our zone nothing at
+ * all — so this is the only one that has to be rationed, and the only one a
+ * ceiling can bind.
+ *
+ * It used to be claimed automatically at three moments: site creation, the
+ * billing webhook's upgrade transition, and a sweep that walked hosts looking
+ * for entitled sites without one. All three made the count grow with paying
+ * customers rather than with anybody's decision, and a merchant who never
+ * wanted an Aglyn-branded sending name still spent a slot on one.
+ *
+ * The function is named for a REQUEST rather than for an invariant on purpose.
+ * `ensure…` is an invitation to call it defensively — "just make sure it
+ * exists" — which is exactly how the three automatic callers came to be, and
+ * `requestedBy` cannot be supplied by a caller that has nobody to name. A
+ * caller that finds itself inventing a value for it is a caller that should
+ * not be claiming.
+ *
+ * ## The label is pinned, and a rename does not move it
+ *
+ * `hosts/{hostId}.sendingLabel` is written ONCE and never rewritten. A site's
+ * `subdomain` is mutable — the rename route rewrites that field in place — and
+ * a sending domain derived from it would move every time a merchant renamed
+ * their site, discarding the accumulated sending reputation that is the whole
+ * point of having a domain per tenant, and stranding the return path that mail
+ * already in flight will bounce to.
+ *
+ * The web address follows the slug. The sending identity does not. A merchant
+ * who genuinely wants a different sending name gets
+ * {@link restartHostSendingDomain}, which says plainly that it starts
+ * reputation over — never a silent side effect of renaming.
+ *
+ * The label is proposed from the site's subdomain AT THE MOMENT OF THE
+ * REQUEST, which is the name the merchant is looking at when they ask. It was
+ * previously the creation-time slug, because the claim happened at creation
+ * and there was no later moment to read; a name derived from what the site is
+ * called today is the less surprising of the two, and the pin is what makes it
+ * stable from then on either way.
+ */ import { isPlatformSendingDomain, mailLabelCandidate, normalizeSendingDomain, platformSendingApex, platformSendingDomainFor, platformSendingLabel } from "@aglyn/shared-util-email";
+import { holdsDedicatedSendingDomain } from "@aglyn/aglyn/app-utils/dedicated-sending-domain";
+import firebaseAdmin from "./firebase-admin.js";
+import { SENDING_DOMAINS_COLLECTION, readSendingDomainRecord } from "./sending-domains.js";
+const firestore = ()=>firebaseAdmin.app().firestore();
+/**
+ * Whether this org's sites may hold a dedicated domain.
+ *
+ * One read, and only ever on a CLAIM path — never on a send. A site that does
+ * not qualify has a sending identity regardless (the shared pool), so nothing
+ * here is on the critical path of a message.
+ *
+ * The WHOLE org document goes to the gate rather than its `plan` field, and
+ * that is what makes a per-org grant real: the entitlement resolves the plan's
+ * default and then the org's own overrides, so an account staff have granted
+ * one may claim without being moved up a tier — and an account whose
+ * subscription has died may not, because `resolveEffectivePlan` reads a dead
+ * subscription down to `free`. A single field would have hidden both.
+ *
+ * Fails closed on a read error, and that is the safe direction: the cost of
+ * answering `false` wrongly is a request the merchant makes again, while the
+ * cost of answering `true` wrongly is a zone record and a provider slot spent
+ * on a site that cannot use them.
+ */ export async function orgHoldsDedicatedSendingDomain(orgId) {
+    const id = String(orgId != null ? orgId : '').trim();
+    if (!id) return false;
+    const snapshot = await firestore().collection('orgs').doc(id).get().catch(()=>null);
+    return (snapshot == null ? void 0 : snapshot.exists) ? holdsDedicatedSendingDomain(snapshot.data()) : false;
+}
+/**
+ * The uniqueness index for pinned mail labels.
+ *
+ * A root collection with the LABEL as the document id, which is what makes the
+ * claim atomic: Firestore's `create` fails when the document exists, so two
+ * sites racing for one label produce one winner and one retry rather than two
+ * winners. This is the same technique the web-subdomain index uses, kept
+ * separate from it on purpose — see `platform-sending-domain.ts` for why the
+ * two namespaces do not share a claim.
+ */ export const SENDING_LABELS_COLLECTION = 'sendingLabels';
+/** How many labels to try before giving up on a site's name. */ const MAX_LABEL_ATTEMPTS = 12;
+const labelRef = (label)=>firestore().collection(SENDING_LABELS_COLLECTION).doc(label);
+/**
+ * Claim the sending domain a site has ASKED for, or return the one it has.
+ *
+ * Idempotent in the way that matters for a two-vendor provisioning flow: it is
+ * the FIRST of the three writes, and it is the one that decides the name. Once
+ * it has returned a domain, every retry — of this function, of the Resend
+ * call, of the DNS write — resolves against the same name. A retry can
+ * therefore never produce a second Resend domain or a second record set,
+ * because there is no second name for them to be created under.
+ *
+ * The three writes it makes are ordered so that a crash between any two leaves
+ * a state the sweep can finish rather than one it must untangle:
+ *
+ * 1. Claim the label. Fails closed on a race; nothing else has happened yet.
+ * 2. Create the domain record at `requested`. This is what the console sweep
+ *    looks for, so a crash after this point still gets picked up.
+ * 3. Point the host at it. A crash before this leaves an unreferenced record
+ *    that the sweep will provision and the next call will attach.
+ *
+ * Step 3 is deliberately last and deliberately non-destructive: a host that
+ * already carries a `sendingLabel` returns early at the top and never reaches
+ * any of this.
+ */ export async function requestHostSendingDomain(options) {
+    var _ref, _ref1, _hostSnapshot_get;
+    const hostId = String((_ref = options == null ? void 0 : options.hostId) != null ? _ref : '').trim();
+    const orgId = String((_ref1 = options == null ? void 0 : options.orgId) != null ? _ref1 : '').trim();
+    // Narrowed rather than trusted: `strictNullChecks` is off, so the declared
+    // union does not survive a caller that reached this through `as never`, and
+    // an unrecognized value stored on the host would make the audit trail read
+    // as though somebody had asked when nothing did.
+    const requestedBy = (options == null ? void 0 : options.requestedBy) === 'staff' ? 'staff' : 'merchant';
+    if (!hostId || !orgId) {
+        return {
+            domain: null,
+            label: null,
+            created: false,
+            error: 'missing-host'
+        };
+    }
+    const hostRef = firestore().collection('hosts').doc(hostId);
+    const hostSnapshot = await hostRef.get();
+    if (!hostSnapshot.exists) {
+        return {
+            domain: null,
+            label: null,
+            created: false,
+            error: 'no-host'
+        };
+    }
+    /*
+   * ALREADY PINNED — the rename guarantee, and the idempotency guarantee, are
+   * the same early return.
+   *
+   * Read from the stored label rather than from the stored domain so the apex
+   * remains a configuration value: an operator who moves the mail namespace
+   * gets existing sites rebuilt onto the new apex under their existing labels,
+   * rather than sites pinned to an apex they have left.
+   */ const pinned = String((_hostSnapshot_get = hostSnapshot.get('sendingLabel')) != null ? _hostSnapshot_get : '').trim();
+    if (pinned) {
+        const domain = platformSendingDomainFor(pinned);
+        return {
+            domain: domain || null,
+            label: pinned,
+            created: false,
+            // A pinned label that no longer builds a domain means the apex changed
+            // to something the label cannot live under, or the label was written by
+            // hand. Naming it is the only useful thing to do — silently re-pinning
+            // would move a site's mail, which is the one thing this must not do.
+            error: domain ? null : 'pinned-label-unusable'
+        };
+    }
+    /*
+   * THE PLAN GATE, AT THE ONLY WRITER.
+   *
+   * Below the pinned-label early return on purpose: a site that already HAS a
+   * domain keeps it through a downgrade. Taking one away would move that site's
+   * mail onto a cold pooled identity and throw away whatever reputation the
+   * name had earned, which is a punishment the merchant did not agree to and
+   * which we would be inflicting silently. Reclaiming a downgraded site's
+   * domain is a teardown decision with its own surface, not a side effect of
+   * the next sweep.
+   *
+   * Here rather than only at the callers because this is the ONE function that
+   * creates a claim — the identity route's request action and
+   * `restartHostSendingDomain` both funnel through it. A gate at the call
+   * sites is a gate the next one skips, and the next one costs a zone record
+   * that nothing reclaims.
+   *
+   * It is the SECOND of two conditions and not the only one. `requestedBy`
+   * says a person asked; this says their plan carries what they asked for.
+   * Neither implies the other, and a claim needs both.
+   */ if (!await orgHoldsDedicatedSendingDomain(orgId)) {
+        return {
+            domain: null,
+            label: null,
+            created: false,
+            error: 'plan-no-dedicated-domain'
+        };
+    }
+    const subdomain = String((options == null ? void 0 : options.subdomain) || hostSnapshot.get('subdomain') || '').trim();
+    for(let attempt = 1; attempt <= MAX_LABEL_ATTEMPTS; attempt += 1){
+        const label = mailLabelCandidate(subdomain, attempt);
+        if (!label) continue;
+        const domain = platformSendingDomainFor(label);
+        if (!domain) continue;
+        const claim = {
+            label,
+            hostId,
+            orgId,
+            domain,
+            claimedAtMs: Date.now()
+        };
+        try {
+            // `create`, not `set`. An existing document is a claim by somebody else
+            // — possibly this same host on a previous run, which the early return
+            // above has already excluded — and overwriting it would hand two sites
+            // one mail domain.
+            await labelRef(label).create(claim);
+        } catch (unused) {
+            continue;
+        }
+        const record = {
+            domain,
+            status: 'requested',
+            // Proposed only. Resend signs on a selector of its own choosing and
+            // `recordIssuedSendingDomain` overwrites this with what it returns.
+            dkimSelector: 'aglyn',
+            dkimPublicKey: null,
+            returnPathHost: null,
+            createdAtMs: Date.now()
+        };
+        await firestore().collection('orgs').doc(orgId).collection(SENDING_DOMAINS_COLLECTION).doc(domain).set(record, {
+            merge: true
+        });
+        /*
+     * The label, the domain, and WHO ASKED FOR IT.
+     *
+     * The request stamp is written with the pointer rather than beside it, so
+     * a site can never hold a dedicated domain that no request accounts for.
+     * It is what lets an operator at the ceiling answer the only question that
+     * matters there — which of these slots somebody actually wanted — without
+     * reading a year of logs, and it is the audit trail for a support claim
+     * made on a merchant's behalf.
+     */ await hostRef.set({
+            sendingLabel: label,
+            sendingDomain: domain,
+            sendingDomainRequestedAtMs: Date.now(),
+            sendingDomainRequestedBy: requestedBy
+        }, {
+            merge: true
+        });
+        return {
+            domain,
+            label,
+            created: true,
+            error: null
+        };
+    }
+    return {
+        domain: null,
+        label: null,
+        created: false,
+        error: 'no-label'
+    };
+}
+/**
+ * What a host's deletion has to clean up, read before anything is deleted.
+ *
+ * Split from the deletion itself so the caller can do the vendor work FIRST
+ * and delete our records only once it has succeeded. The other order loses the
+ * name of the thing it still has to remove: a zone accumulating records for
+ * sites that no longer exist is bad on its own, and a future site reusing the
+ * label would inherit a stranger's DKIM key — which is a working signature for
+ * a domain somebody else's mail leaves on.
+ */ export async function readHostSendingTeardown(hostId) {
+    var _snapshot_get, _snapshot_get1, _ref;
+    const id = String(hostId != null ? hostId : '').trim();
+    if (!id) return null;
+    const snapshot = await firestore().collection('hosts').doc(id).get();
+    if (!snapshot.exists) return null;
+    const label = String((_snapshot_get = snapshot.get('sendingLabel')) != null ? _snapshot_get : '').trim() || null;
+    const domain = normalizeSendingDomain(String((_snapshot_get1 = snapshot.get('sendingDomain')) != null ? _snapshot_get1 : '')) || null;
+    if (!label && !domain) return null;
+    // The claim carries the org, so a host document that has lost its org
+    // pointer can still be torn down.
+    const claim = label ? await labelRef(label).get() : null;
+    const orgId = String((_ref = claim == null ? void 0 : claim.get('orgId')) != null ? _ref : '').trim() || null;
+    let providerDomainId = null;
+    let dkimSelector = null;
+    let trackingTarget = null;
+    if (orgId && domain) {
+        var _ref1, _ref2, _ref3;
+        const record = readSendingDomainRecord(await firestore().collection('orgs').doc(orgId).collection(SENDING_DOMAINS_COLLECTION).doc(domain).get());
+        providerDomainId = (_ref1 = record == null ? void 0 : record.providerDomainId) != null ? _ref1 : null;
+        dkimSelector = String((_ref2 = record == null ? void 0 : record.dkimSelector) != null ? _ref2 : '').trim() || null;
+        trackingTarget = String((_ref3 = record == null ? void 0 : record.trackingTarget) != null ? _ref3 : '').trim() || null;
+    }
+    return {
+        hostId: id,
+        orgId,
+        label,
+        domain,
+        providerDomainId,
+        dkimSelector,
+        trackingTarget
+    };
+}
+/**
+ * Drop our own record of a site's sending domain, once the vendors are clean.
+ *
+ * Releasing the label LAST is deliberate. The label is what makes the domain
+ * findable; while it exists, a half-finished teardown is a thing the sweep can
+ * find and finish. Released first, a crash mid-teardown would leave a Resend
+ * domain and a set of DNS records that nothing points at and nothing will ever
+ * look for again.
+ *
+ * The release is real rather than a tombstone. Once the DKIM record is gone
+ * from the zone and the domain object is gone from the account, a future site
+ * claiming the label inherits nothing — no key, no records, no reputation. A
+ * permanent reservation would only be needed if teardown were unreliable, and
+ * the answer to unreliable teardown is to fix it, not to leak a name for every
+ * site ever deleted.
+ */ export async function releaseHostSendingDomain(teardown) {
+    var _this;
+    if (!teardown) return;
+    if (teardown.orgId && teardown.domain) {
+        await firestore().collection('orgs').doc(teardown.orgId).collection(SENDING_DOMAINS_COLLECTION).doc(teardown.domain).delete().catch(()=>undefined);
+    }
+    /*
+   * Only onto a host that is still there. A merging `set` CREATES the document
+   * it is given, so clearing these two fields on a site that has already been
+   * erased writes an empty `hosts/{hostId}` back into existence — a fragment
+   * of a site the customer asked us to destroy, resurrected by its own
+   * cleanup, and one the routing sweep would then have to collect again.
+   */ const hostRef = firestore().collection('hosts').doc(teardown.hostId);
+    if ((_this = await hostRef.get().catch(()=>null)) == null ? void 0 : _this.exists) {
+        await hostRef.set({
+            sendingLabel: firebaseAdmin.firestore.FieldValue.delete(),
+            sendingDomain: firebaseAdmin.firestore.FieldValue.delete()
+        }, {
+            merge: true
+        }).catch(()=>undefined);
+    }
+    if (teardown.label) {
+        /*
+     * Only if it still names THIS host. A label released by a teardown that
+     * raced a re-provision would otherwise delete the claim the new domain
+     * depends on, and the next site to ask for that name would be handed one
+     * that is already live.
+     */ const ref = labelRef(teardown.label);
+        await firestore().runTransaction(async (transaction)=>{
+            var _snapshot_get;
+            const snapshot = await transaction.get(ref);
+            if (!snapshot.exists) return;
+            if (String((_snapshot_get = snapshot.get('hostId')) != null ? _snapshot_get : '') !== teardown.hostId) return;
+            transaction.delete(ref);
+        }).catch(()=>undefined);
+    }
+}
+/**
+ * Give a site a NEW sending domain, abandoning the one it has.
+ *
+ * The explicit action behind "I want my mail to come from a different name".
+ * It exists so that renaming a site can stay free of side effects: a merchant
+ * who wants the sending name to follow the rename asks for it here, and is
+ * told what it costs.
+ *
+ * What it costs is the reputation. A sending domain's value is its age and its
+ * history with the receiving networks; a new one starts at zero and is treated
+ * with more suspicion than the old one, for weeks. That is why this is not
+ * what a rename does, and why the caller is expected to have said so out loud
+ * before getting here.
+ *
+ * Returns the teardown for the OLD domain. The caller must complete the vendor
+ * cleanup for it, exactly as for a deleted host — the old Resend domain and
+ * its zone records are no more welcome to linger here than there.
+ */ export async function restartHostSendingDomain(options) {
+    const teardown = await readHostSendingTeardown(options == null ? void 0 : options.hostId);
+    if (teardown) await releaseHostSendingDomain(teardown);
+    return {
+        teardown,
+        provisioned: await requestHostSendingDomain(options)
+    };
+}
+/**
+ * Platform sending domains that still need vendor work, oldest first.
+ *
+ * A collection-group query over every org's `sendingDomains`, filtered to the
+ * ones inside our own mail apex — a customer's own domain is records they
+ * publish, and this sweep must never try to write to a zone we do not own.
+ *
+ * `orderBy` on the creation time, and not merely `limit`. A `limit()` with no
+ * `orderBy` returns documents in ID order, which is a stable arbitrary sample
+ * rather than a queue: the same handful of domains would be returned on every
+ * run and anything sorting after them would never be provisioned at all.
+ *
+ * Ordering on a field means a document missing that field is dropped by the
+ * query. That is acceptable here and nowhere else in this file, because
+ * `requestHostSendingDomain` is the only writer and it always sets
+ * `createdAtMs`.
+ */ export async function listPendingSendingDomains(limit = 25) {
+    const snapshot = await firestore().collectionGroup(SENDING_DOMAINS_COLLECTION).where('status', '==', 'requested').orderBy('createdAtMs', 'asc').limit(Math.max(1, limit)).get();
+    const pending = [];
+    for (const doc of snapshot.docs){
+        var _doc_ref_parent_parent;
+        const record = readSendingDomainRecord(doc);
+        if (!record) continue;
+        // Ours to provision, or the customer's to publish. Only the first kind.
+        if (!isPlatformSendingDomain(record.domain)) continue;
+        const orgId = (_doc_ref_parent_parent = doc.ref.parent.parent) == null ? void 0 : _doc_ref_parent_parent.id;
+        if (!orgId) continue;
+        pending.push({
+            orgId,
+            record
+        });
+    }
+    return pending;
+}
+/**
+ * The label a platform domain belongs to, for a caller assembling zone record
+ * names. Re-derived rather than read off the host, so a cleanup can name the
+ * records for a host document that is already gone.
+ */ export function sendingDomainLabel(domain) {
+    return platformSendingLabel(domain, platformSendingApex());
+}
+
+//# sourceMappingURL=host-sending-domain.js.map

package/src/lib/server/host-sending-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-sending-domain.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE PER-SITE SENDING DOMAIN — the claim, and nothing else.\n *\n * Provisioning a site's sending domain is two writes to two vendors and one\n * write of our own. This module owns only the third: the LABEL CLAIM and the\n * record that says a domain has been asked for. It calls no vendor, reads no\n * credential, and is safe for the tenant runtime to import — which matters,\n * because the tenant runtime is where a site first discovers it needs to send.\n *\n * The vendor half lives in the console (`provision-sending-domain.ts`), for\n * the same structural reason `sending-domain-provider.ts` does: the keys that\n * create a Resend domain and write our DNS zone must not be reachable from a\n * process that serves published sites.\n *\n * ## Request here, issue there\n *\n * That split is what makes provisioning ON DEMAND possible at all.\n * {@link requestHostSendingDomain} is a cheap Firestore write with no\n * credential behind it; the console-side sweep picks the claim up and does the\n * vendor work, and the re-check sweep then moves the domain to `verified` on\n * its own.\n *\n * So a site is never blocked waiting on a credential it cannot hold, and the\n * credential is never held by a process that should not have it.\n *\n * ## NOTHING HERE RUNS WITHOUT SOMEBODY ASKING\n *\n * A dedicated subdomain is the one shape in the sending model that draws on a\n * resource we cannot buy our way out of at scale: a slot in the provider's\n * account-wide domain allowance, three records in our own zone, and a\n * permanent place in the re-verification sweep. The shared pool is flat at any\n * number of sites, and a domain the CUSTOMER owns costs our zone nothing at\n * all — so this is the only one that has to be rationed, and the only one a\n * ceiling can bind.\n *\n * It used to be claimed automatically at three moments: site creation, the\n * billing webhook's upgrade transition, and a sweep that walked hosts looking\n * for entitled sites without one. All three made the count grow with paying\n * customers rather than with anybody's decision, and a merchant who never\n * wanted an Aglyn-branded sending name still spent a slot on one.\n *\n * The function is named for a REQUEST rather than for an invariant on purpose.\n * `ensure…` is an invitation to call it defensively — \"just make sure it\n * exists\" — which is exactly how the three automatic callers came to be, and\n * `requestedBy` cannot be supplied by a caller that has nobody to name. A\n * caller that finds itself inventing a value for it is a caller that should\n * not be claiming.\n *\n * ## The label is pinned, and a rename does not move it\n *\n * `hosts/{hostId}.sendingLabel` is written ONCE and never rewritten. A site's\n * `subdomain` is mutable — the rename route rewrites that field in place — and\n * a sending domain derived from it would move every time a merchant renamed\n * their site, discarding the accumulated sending reputation that is the whole\n * point of having a domain per tenant, and stranding the return path that mail\n * already in flight will bounce to.\n *\n * The web address follows the slug. The sending identity does not. A merchant\n * who genuinely wants a different sending name gets\n * {@link restartHostSendingDomain}, which says plainly that it starts\n * reputation over — never a silent side effect of renaming.\n *\n * The label is proposed from the site's subdomain AT THE MOMENT OF THE\n * REQUEST, which is the name the merchant is looking at when they ask. It was\n * previously the creation-time slug, because the claim happened at creation\n * and there was no later moment to read; a name derived from what the site is\n * called today is the less surprising of the two, and the pin is what makes it\n * stable from then on either way.\n */\n\nimport {\n  isPlatformSendingDomain,\n  mailLabelCandidate,\n  normalizeSendingDomain,\n  platformSendingApex,\n  platformSendingDomainFor,\n  platformSendingLabel,\n  type SendingDomainRecord,\n} from '@aglyn/shared-util-email'\nimport { holdsDedicatedSendingDomain } from '@aglyn/aglyn/app-utils/dedicated-sending-domain'\nimport firebaseAdmin from './firebase-admin'\nimport { SENDING_DOMAINS_COLLECTION, readSendingDomainRecord } from './sending-domains'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/**\n * Whether this org's sites may hold a dedicated domain.\n *\n * One read, and only ever on a CLAIM path — never on a send. A site that does\n * not qualify has a sending identity regardless (the shared pool), so nothing\n * here is on the critical path of a message.\n *\n * The WHOLE org document goes to the gate rather than its `plan` field, and\n * that is what makes a per-org grant real: the entitlement resolves the plan's\n * default and then the org's own overrides, so an account staff have granted\n * one may claim without being moved up a tier — and an account whose\n * subscription has died may not, because `resolveEffectivePlan` reads a dead\n * subscription down to `free`. A single field would have hidden both.\n *\n * Fails closed on a read error, and that is the safe direction: the cost of\n * answering `false` wrongly is a request the merchant makes again, while the\n * cost of answering `true` wrongly is a zone record and a provider slot spent\n * on a site that cannot use them.\n */\nexport async function orgHoldsDedicatedSendingDomain(\n  orgId: string | null | undefined,\n): Promise<boolean> {\n  const id = String(orgId ?? '').trim()\n  if (!id) return false\n  const snapshot = await firestore()\n    .collection('orgs')\n    .doc(id)\n    .get()\n    .catch(() => null)\n  return snapshot?.exists\n    ? holdsDedicatedSendingDomain(snapshot.data() as never)\n    : false\n}\n\n/**\n * The uniqueness index for pinned mail labels.\n *\n * A root collection with the LABEL as the document id, which is what makes the\n * claim atomic: Firestore's `create` fails when the document exists, so two\n * sites racing for one label produce one winner and one retry rather than two\n * winners. This is the same technique the web-subdomain index uses, kept\n * separate from it on purpose — see `platform-sending-domain.ts` for why the\n * two namespaces do not share a claim.\n */\nexport const SENDING_LABELS_COLLECTION = 'sendingLabels'\n\n/** How many labels to try before giving up on a site's name. */\nconst MAX_LABEL_ATTEMPTS = 12\n\nconst labelRef = (label: string) =>\n  firestore().collection(SENDING_LABELS_COLLECTION).doc(label)\n\nexport interface SendingLabelClaim {\n  label: string\n  hostId: string\n  orgId: string\n  domain: string\n  claimedAtMs: number\n}\n\nexport interface HostSendingDomainResult {\n  /** The site's sending domain, or null when none could be provisioned. */\n  domain: string | null\n  label: string | null\n  /** True when this call created the claim rather than finding one. */\n  created: boolean\n  /** Why nothing could be claimed. Null on success. */\n  error: string | null\n}\n\n/**\n * Claim the sending domain a site has ASKED for, or return the one it has.\n *\n * Idempotent in the way that matters for a two-vendor provisioning flow: it is\n * the FIRST of the three writes, and it is the one that decides the name. Once\n * it has returned a domain, every retry — of this function, of the Resend\n * call, of the DNS write — resolves against the same name. A retry can\n * therefore never produce a second Resend domain or a second record set,\n * because there is no second name for them to be created under.\n *\n * The three writes it makes are ordered so that a crash between any two leaves\n * a state the sweep can finish rather than one it must untangle:\n *\n * 1. Claim the label. Fails closed on a race; nothing else has happened yet.\n * 2. Create the domain record at `requested`. This is what the console sweep\n *    looks for, so a crash after this point still gets picked up.\n * 3. Point the host at it. A crash before this leaves an unreferenced record\n *    that the sweep will provision and the next call will attach.\n *\n * Step 3 is deliberately last and deliberately non-destructive: a host that\n * already carries a `sendingLabel` returns early at the top and never reaches\n * any of this.\n */\nexport async function requestHostSendingDomain(options: {\n  hostId: string\n  orgId: string\n  /** The site's CURRENT subdomain. Read once, to propose a label. */\n  subdomain: string\n  /**\n   * WHO ASKED. Required, and there is no default.\n   *\n   * A dedicated subdomain is a draw on a bounded resource, so the record of\n   * who drew it is part of the claim rather than something reconstructed from\n   * logs later. `merchant` is somebody with `org.settings` acting on their own\n   * workspace; `staff` is a support action taken on their behalf.\n   *\n   * Its real work is at compile time. A caller that wants to claim\n   * defensively — on a plan change, on a sweep, on site creation — has no\n   * honest value to put here, and that is the point: the parameter cannot be\n   * satisfied by a process, only by a person.\n   */\n  requestedBy: 'merchant' | 'staff'\n}): Promise<HostSendingDomainResult> {\n  const hostId = String(options?.hostId ?? '').trim()\n  const orgId = String(options?.orgId ?? '').trim()\n  // Narrowed rather than trusted: `strictNullChecks` is off, so the declared\n  // union does not survive a caller that reached this through `as never`, and\n  // an unrecognized value stored on the host would make the audit trail read\n  // as though somebody had asked when nothing did.\n  const requestedBy = options?.requestedBy === 'staff' ? 'staff' : 'merchant'\n  if (!hostId || !orgId) {\n    return { domain: null, label: null, created: false, error: 'missing-host' }\n  }\n\n  const hostRef = firestore().collection('hosts').doc(hostId)\n  const hostSnapshot = await hostRef.get()\n  if (!hostSnapshot.exists) {\n    return { domain: null, label: null, created: false, error: 'no-host' }\n  }\n\n  /*\n   * ALREADY PINNED — the rename guarantee, and the idempotency guarantee, are\n   * the same early return.\n   *\n   * Read from the stored label rather than from the stored domain so the apex\n   * remains a configuration value: an operator who moves the mail namespace\n   * gets existing sites rebuilt onto the new apex under their existing labels,\n   * rather than sites pinned to an apex they have left.\n   */\n  const pinned = String(hostSnapshot.get('sendingLabel') ?? '').trim()\n  if (pinned) {\n    const domain = platformSendingDomainFor(pinned)\n    return {\n      domain: domain || null,\n      label: pinned,\n      created: false,\n      // A pinned label that no longer builds a domain means the apex changed\n      // to something the label cannot live under, or the label was written by\n      // hand. Naming it is the only useful thing to do — silently re-pinning\n      // would move a site's mail, which is the one thing this must not do.\n      error: domain ? null : 'pinned-label-unusable',\n    }\n  }\n\n  /*\n   * THE PLAN GATE, AT THE ONLY WRITER.\n   *\n   * Below the pinned-label early return on purpose: a site that already HAS a\n   * domain keeps it through a downgrade. Taking one away would move that site's\n   * mail onto a cold pooled identity and throw away whatever reputation the\n   * name had earned, which is a punishment the merchant did not agree to and\n   * which we would be inflicting silently. Reclaiming a downgraded site's\n   * domain is a teardown decision with its own surface, not a side effect of\n   * the next sweep.\n   *\n   * Here rather than only at the callers because this is the ONE function that\n   * creates a claim — the identity route's request action and\n   * `restartHostSendingDomain` both funnel through it. A gate at the call\n   * sites is a gate the next one skips, and the next one costs a zone record\n   * that nothing reclaims.\n   *\n   * It is the SECOND of two conditions and not the only one. `requestedBy`\n   * says a person asked; this says their plan carries what they asked for.\n   * Neither implies the other, and a claim needs both.\n   */\n  if (!(await orgHoldsDedicatedSendingDomain(orgId))) {\n    return {\n      domain: null,\n      label: null,\n      created: false,\n      error: 'plan-no-dedicated-domain',\n    }\n  }\n\n  const subdomain = String(\n    options?.subdomain || hostSnapshot.get('subdomain') || '',\n  ).trim()\n\n  for (let attempt = 1; attempt <= MAX_LABEL_ATTEMPTS; attempt += 1) {\n    const label = mailLabelCandidate(subdomain, attempt)\n    if (!label) continue\n    const domain = platformSendingDomainFor(label)\n    if (!domain) continue\n\n    const claim: SendingLabelClaim = {\n      label,\n      hostId,\n      orgId,\n      domain,\n      claimedAtMs: Date.now(),\n    }\n\n    try {\n      // `create`, not `set`. An existing document is a claim by somebody else\n      // — possibly this same host on a previous run, which the early return\n      // above has already excluded — and overwriting it would hand two sites\n      // one mail domain.\n      await labelRef(label).create(claim)\n    } catch {\n      continue\n    }\n\n    const record: SendingDomainRecord = {\n      domain,\n      status: 'requested',\n      // Proposed only. Resend signs on a selector of its own choosing and\n      // `recordIssuedSendingDomain` overwrites this with what it returns.\n      dkimSelector: 'aglyn',\n      dkimPublicKey: null,\n      returnPathHost: null,\n      createdAtMs: Date.now(),\n    }\n    await firestore()\n      .collection('orgs')\n      .doc(orgId)\n      .collection(SENDING_DOMAINS_COLLECTION)\n      .doc(domain)\n      .set(record, { merge: true })\n\n    /*\n     * The label, the domain, and WHO ASKED FOR IT.\n     *\n     * The request stamp is written with the pointer rather than beside it, so\n     * a site can never hold a dedicated domain that no request accounts for.\n     * It is what lets an operator at the ceiling answer the only question that\n     * matters there — which of these slots somebody actually wanted — without\n     * reading a year of logs, and it is the audit trail for a support claim\n     * made on a merchant's behalf.\n     */\n    await hostRef.set(\n      {\n        sendingLabel: label,\n        sendingDomain: domain,\n        sendingDomainRequestedAtMs: Date.now(),\n        sendingDomainRequestedBy: requestedBy,\n      },\n      { merge: true },\n    )\n\n    return { domain, label, created: true, error: null }\n  }\n\n  return { domain: null, label: null, created: false, error: 'no-label' }\n}\n\n/**\n * Everything provisioned for one site, for a caller that must take it apart.\n *\n * Returned as data rather than acted on, because the acting needs vendor\n * credentials this module must not hold. The console's cleanup path takes this\n * and makes the calls.\n */\nexport interface HostSendingDomainTeardown {\n  hostId: string\n  orgId: string | null\n  label: string | null\n  domain: string | null\n  /** The provider's id for the domain object, when one was recorded. */\n  providerDomainId: string | null\n  /**\n   * The selector the provider signs under, needed to name the DKIM record for\n   * deletion. Read from the record rather than assumed: the provider chooses\n   * it, and a guessed selector deletes nothing while reporting success — which\n   * would leave a live signing key in the zone for a site that no longer\n   * exists, ready to be inherited by whoever claims the label next.\n   */\n  dkimSelector: string | null\n  /**\n   * The provider's tracking host, when this domain had one.\n   *\n   * Read because it changes WHEN the domain may be released, not just what is\n   * deleted: links in mail this domain has already sent point at that host,\n   * and deleting the domain object takes it with them. See the retention\n   * window in `teardownSendingDomain`.\n   */\n  trackingTarget: string | null\n}\n\n/**\n * What a host's deletion has to clean up, read before anything is deleted.\n *\n * Split from the deletion itself so the caller can do the vendor work FIRST\n * and delete our records only once it has succeeded. The other order loses the\n * name of the thing it still has to remove: a zone accumulating records for\n * sites that no longer exist is bad on its own, and a future site reusing the\n * label would inherit a stranger's DKIM key — which is a working signature for\n * a domain somebody else's mail leaves on.\n */\nexport async function readHostSendingTeardown(\n  hostId: string,\n): Promise<HostSendingDomainTeardown | null> {\n  const id = String(hostId ?? '').trim()\n  if (!id) return null\n\n  const snapshot = await firestore().collection('hosts').doc(id).get()\n  if (!snapshot.exists) return null\n\n  const label = String(snapshot.get('sendingLabel') ?? '').trim() || null\n  const domain =\n    normalizeSendingDomain(String(snapshot.get('sendingDomain') ?? '')) || null\n  if (!label && !domain) return null\n\n  // The claim carries the org, so a host document that has lost its org\n  // pointer can still be torn down.\n  const claim = label ? await labelRef(label).get() : null\n  const orgId = String(claim?.get('orgId') ?? '').trim() || null\n\n  let providerDomainId: string | null = null\n  let dkimSelector: string | null = null\n  let trackingTarget: string | null = null\n  if (orgId && domain) {\n    const record = readSendingDomainRecord(\n      await firestore()\n        .collection('orgs')\n        .doc(orgId)\n        .collection(SENDING_DOMAINS_COLLECTION)\n        .doc(domain)\n        .get(),\n    )\n    providerDomainId = record?.providerDomainId ?? null\n    dkimSelector = String(record?.dkimSelector ?? '').trim() || null\n    trackingTarget = String(record?.trackingTarget ?? '').trim() || null\n  }\n\n  return {\n    hostId: id,\n    orgId,\n    label,\n    domain,\n    providerDomainId,\n    dkimSelector,\n    trackingTarget,\n  }\n}\n\n/**\n * Drop our own record of a site's sending domain, once the vendors are clean.\n *\n * Releasing the label LAST is deliberate. The label is what makes the domain\n * findable; while it exists, a half-finished teardown is a thing the sweep can\n * find and finish. Released first, a crash mid-teardown would leave a Resend\n * domain and a set of DNS records that nothing points at and nothing will ever\n * look for again.\n *\n * The release is real rather than a tombstone. Once the DKIM record is gone\n * from the zone and the domain object is gone from the account, a future site\n * claiming the label inherits nothing — no key, no records, no reputation. A\n * permanent reservation would only be needed if teardown were unreliable, and\n * the answer to unreliable teardown is to fix it, not to leak a name for every\n * site ever deleted.\n */\nexport async function releaseHostSendingDomain(\n  teardown: HostSendingDomainTeardown,\n): Promise<void> {\n  if (!teardown) return\n\n  if (teardown.orgId && teardown.domain) {\n    await firestore()\n      .collection('orgs')\n      .doc(teardown.orgId)\n      .collection(SENDING_DOMAINS_COLLECTION)\n      .doc(teardown.domain)\n      .delete()\n      .catch(() => undefined)\n  }\n\n  /*\n   * Only onto a host that is still there. A merging `set` CREATES the document\n   * it is given, so clearing these two fields on a site that has already been\n   * erased writes an empty `hosts/{hostId}` back into existence — a fragment\n   * of a site the customer asked us to destroy, resurrected by its own\n   * cleanup, and one the routing sweep would then have to collect again.\n   */\n  const hostRef = firestore().collection('hosts').doc(teardown.hostId)\n  if ((await hostRef.get().catch(() => null))?.exists) {\n    await hostRef\n      .set(\n        {\n          sendingLabel: firebaseAdmin.firestore.FieldValue.delete(),\n          sendingDomain: firebaseAdmin.firestore.FieldValue.delete(),\n        },\n        { merge: true },\n      )\n      .catch(() => undefined)\n  }\n\n  if (teardown.label) {\n    /*\n     * Only if it still names THIS host. A label released by a teardown that\n     * raced a re-provision would otherwise delete the claim the new domain\n     * depends on, and the next site to ask for that name would be handed one\n     * that is already live.\n     */\n    const ref = labelRef(teardown.label)\n    await firestore()\n      .runTransaction(async (transaction) => {\n        const snapshot = await transaction.get(ref)\n        if (!snapshot.exists) return\n        if (String(snapshot.get('hostId') ?? '') !== teardown.hostId) return\n        transaction.delete(ref)\n      })\n      .catch(() => undefined)\n  }\n}\n\n/**\n * Give a site a NEW sending domain, abandoning the one it has.\n *\n * The explicit action behind \"I want my mail to come from a different name\".\n * It exists so that renaming a site can stay free of side effects: a merchant\n * who wants the sending name to follow the rename asks for it here, and is\n * told what it costs.\n *\n * What it costs is the reputation. A sending domain's value is its age and its\n * history with the receiving networks; a new one starts at zero and is treated\n * with more suspicion than the old one, for weeks. That is why this is not\n * what a rename does, and why the caller is expected to have said so out loud\n * before getting here.\n *\n * Returns the teardown for the OLD domain. The caller must complete the vendor\n * cleanup for it, exactly as for a deleted host — the old Resend domain and\n * its zone records are no more welcome to linger here than there.\n */\nexport async function restartHostSendingDomain(options: {\n  hostId: string\n  orgId: string\n  subdomain: string\n  /** Carried through to the new claim. See `requestHostSendingDomain`. */\n  requestedBy: 'merchant' | 'staff'\n}): Promise<{\n  teardown: HostSendingDomainTeardown | null\n  provisioned: HostSendingDomainResult\n}> {\n  const teardown = await readHostSendingTeardown(options?.hostId)\n  if (teardown) await releaseHostSendingDomain(teardown)\n  return { teardown, provisioned: await requestHostSendingDomain(options) }\n}\n\n/*==========================================\n  What the console sweep picks up\n==========================================*/\n\nexport interface PendingSendingDomain {\n  orgId: string\n  record: SendingDomainRecord\n}\n\n/**\n * Platform sending domains that still need vendor work, oldest first.\n *\n * A collection-group query over every org's `sendingDomains`, filtered to the\n * ones inside our own mail apex — a customer's own domain is records they\n * publish, and this sweep must never try to write to a zone we do not own.\n *\n * `orderBy` on the creation time, and not merely `limit`. A `limit()` with no\n * `orderBy` returns documents in ID order, which is a stable arbitrary sample\n * rather than a queue: the same handful of domains would be returned on every\n * run and anything sorting after them would never be provisioned at all.\n *\n * Ordering on a field means a document missing that field is dropped by the\n * query. That is acceptable here and nowhere else in this file, because\n * `requestHostSendingDomain` is the only writer and it always sets\n * `createdAtMs`.\n */\nexport async function listPendingSendingDomains(\n  limit = 25,\n): Promise<PendingSendingDomain[]> {\n  const snapshot = await firestore()\n    .collectionGroup(SENDING_DOMAINS_COLLECTION)\n    .where('status', '==', 'requested')\n    .orderBy('createdAtMs', 'asc')\n    .limit(Math.max(1, limit))\n    .get()\n\n  const pending: PendingSendingDomain[] = []\n  for (const doc of snapshot.docs) {\n    const record = readSendingDomainRecord(doc)\n    if (!record) continue\n    // Ours to provision, or the customer's to publish. Only the first kind.\n    if (!isPlatformSendingDomain(record.domain)) continue\n    const orgId = doc.ref.parent.parent?.id\n    if (!orgId) continue\n    pending.push({ orgId, record })\n  }\n  return pending\n}\n\n/**\n * The label a platform domain belongs to, for a caller assembling zone record\n * names. Re-derived rather than read off the host, so a cleanup can name the\n * records for a host document that is already gone.\n */\nexport function sendingDomainLabel(domain: string): string {\n  return platformSendingLabel(domain, platformSendingApex())\n}\n\n"],"names":["isPlatformSendingDomain","mailLabelCandidate","normalizeSendingDomain","platformSendingApex","platformSendingDomainFor","platformSendingLabel","holdsDedicatedSendingDomain","firebaseAdmin","SENDING_DOMAINS_COLLECTION","readSendingDomainRecord","firestore","app","orgHoldsDedicatedSendingDomain","orgId","id","String","trim","snapshot","collection","doc","get","catch","exists","data","SENDING_LABELS_COLLECTION","MAX_LABEL_ATTEMPTS","labelRef","label","requestHostSendingDomain","options","hostSnapshot","hostId","requestedBy","domain","created","error","hostRef","pinned","subdomain","attempt","claim","claimedAtMs","Date","now","create","record","status","dkimSelector","dkimPublicKey","returnPathHost","createdAtMs","set","merge","sendingLabel","sendingDomain","sendingDomainRequestedAtMs","sendingDomainRequestedBy","readHostSendingTeardown","providerDomainId","trackingTarget","releaseHostSendingDomain","teardown","delete","undefined","FieldValue","ref","runTransaction","transaction","restartHostSendingDomain","provisioned","listPendingSendingDomains","limit","collectionGroup","where","orderBy","Math","max","pending","docs","parent","push","sendingDomainLabel"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEC,GAED,SACEA,uBAAuB,EACvBC,kBAAkB,EAClBC,sBAAsB,EACtBC,mBAAmB,EACnBC,wBAAwB,EACxBC,oBAAoB,QAEf,2BAA0B;AACjC,SAASC,2BAA2B,QAAQ,kDAAiD;AAC7F,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,0BAA0B,EAAEC,uBAAuB,QAAQ,uBAAmB;AAEvF,MAAMC,YAAY,IAAMH,cAAcI,GAAG,GAAGD,SAAS;AAErD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeE,+BACpBC,KAAgC;IAEhC,MAAMC,KAAKC,OAAOF,gBAAAA,QAAS,IAAIG,IAAI;IACnC,IAAI,CAACF,IAAI,OAAO;IAChB,MAAMG,WAAW,MAAMP,YACpBQ,UAAU,CAAC,QACXC,GAAG,CAACL,IACJM,GAAG,GACHC,KAAK,CAAC,IAAM;IACf,OAAOJ,CAAAA,4BAAAA,SAAUK,MAAM,IACnBhB,4BAA4BW,SAASM,IAAI,MACzC;AACN;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMC,4BAA4B,gBAAe;AAExD,8DAA8D,GAC9D,MAAMC,qBAAqB;AAE3B,MAAMC,WAAW,CAACC,QAChBjB,YAAYQ,UAAU,CAACM,2BAA2BL,GAAG,CAACQ;AAoBxD;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,eAAeC,yBAAyBC,OAmB9C;qBA2BuBC;IA1BtB,MAAMC,SAAShB,eAAOc,2BAAAA,QAASE,MAAM,mBAAI,IAAIf,IAAI;IACjD,MAAMH,QAAQE,gBAAOc,2BAAAA,QAAShB,KAAK,oBAAI,IAAIG,IAAI;IAC/C,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iDAAiD;IACjD,MAAMgB,cAAcH,CAAAA,2BAAAA,QAASG,WAAW,MAAK,UAAU,UAAU;IACjE,IAAI,CAACD,UAAU,CAAClB,OAAO;QACrB,OAAO;YAAEoB,QAAQ;YAAMN,OAAO;YAAMO,SAAS;YAAOC,OAAO;QAAe;IAC5E;IAEA,MAAMC,UAAU1B,YAAYQ,UAAU,CAAC,SAASC,GAAG,CAACY;IACpD,MAAMD,eAAe,MAAMM,QAAQhB,GAAG;IACtC,IAAI,CAACU,aAAaR,MAAM,EAAE;QACxB,OAAO;YAAEW,QAAQ;YAAMN,OAAO;YAAMO,SAAS;YAAOC,OAAO;QAAU;IACvE;IAEA;;;;;;;;GAQC,GACD,MAAME,SAAStB,QAAOe,oBAAAA,aAAaV,GAAG,CAAC,2BAAjBU,oBAAoC,IAAId,IAAI;IAClE,IAAIqB,QAAQ;QACV,MAAMJ,SAAS7B,yBAAyBiC;QACxC,OAAO;YACLJ,QAAQA,UAAU;YAClBN,OAAOU;YACPH,SAAS;YACT,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrEC,OAAOF,SAAS,OAAO;QACzB;IACF;IAEA;;;;;;;;;;;;;;;;;;;;GAoBC,GACD,IAAI,CAAE,MAAMrB,+BAA+BC,QAAS;QAClD,OAAO;YACLoB,QAAQ;YACRN,OAAO;YACPO,SAAS;YACTC,OAAO;QACT;IACF;IAEA,MAAMG,YAAYvB,OAChBc,CAAAA,2BAAAA,QAASS,SAAS,KAAIR,aAAaV,GAAG,CAAC,gBAAgB,IACvDJ,IAAI;IAEN,IAAK,IAAIuB,UAAU,GAAGA,WAAWd,oBAAoBc,WAAW,EAAG;QACjE,MAAMZ,QAAQ1B,mBAAmBqC,WAAWC;QAC5C,IAAI,CAACZ,OAAO;QACZ,MAAMM,SAAS7B,yBAAyBuB;QACxC,IAAI,CAACM,QAAQ;QAEb,MAAMO,QAA2B;YAC/Bb;YACAI;YACAlB;YACAoB;YACAQ,aAAaC,KAAKC,GAAG;QACvB;QAEA,IAAI;YACF,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,mBAAmB;YACnB,MAAMjB,SAASC,OAAOiB,MAAM,CAACJ;QAC/B,EAAE,eAAM;YACN;QACF;QAEA,MAAMK,SAA8B;YAClCZ;YACAa,QAAQ;YACR,oEAAoE;YACpE,oEAAoE;YACpEC,cAAc;YACdC,eAAe;YACfC,gBAAgB;YAChBC,aAAaR,KAAKC,GAAG;QACvB;QACA,MAAMjC,YACHQ,UAAU,CAAC,QACXC,GAAG,CAACN,OACJK,UAAU,CAACV,4BACXW,GAAG,CAACc,QACJkB,GAAG,CAACN,QAAQ;YAAEO,OAAO;QAAK;QAE7B;;;;;;;;;KASC,GACD,MAAMhB,QAAQe,GAAG,CACf;YACEE,cAAc1B;YACd2B,eAAerB;YACfsB,4BAA4Bb,KAAKC,GAAG;YACpCa,0BAA0BxB;QAC5B,GACA;YAAEoB,OAAO;QAAK;QAGhB,OAAO;YAAEnB;YAAQN;YAAOO,SAAS;YAAMC,OAAO;QAAK;IACrD;IAEA,OAAO;QAAEF,QAAQ;QAAMN,OAAO;QAAMO,SAAS;QAAOC,OAAO;IAAW;AACxE;AAmCA;;;;;;;;;CASC,GACD,OAAO,eAAesB,wBACpB1B,MAAc;QAQOd,eAEWA;IARhC,MAAMH,KAAKC,OAAOgB,iBAAAA,SAAU,IAAIf,IAAI;IACpC,IAAI,CAACF,IAAI,OAAO;IAEhB,MAAMG,WAAW,MAAMP,YAAYQ,UAAU,CAAC,SAASC,GAAG,CAACL,IAAIM,GAAG;IAClE,IAAI,CAACH,SAASK,MAAM,EAAE,OAAO;IAE7B,MAAMK,QAAQZ,QAAOE,gBAAAA,SAASG,GAAG,CAAC,2BAAbH,gBAAgC,IAAID,IAAI,MAAM;IACnE,MAAMiB,SACJ/B,uBAAuBa,QAAOE,iBAAAA,SAASG,GAAG,CAAC,4BAAbH,iBAAiC,QAAQ;IACzE,IAAI,CAACU,SAAS,CAACM,QAAQ,OAAO;IAE9B,sEAAsE;IACtE,kCAAkC;IAClC,MAAMO,QAAQb,QAAQ,MAAMD,SAASC,OAAOP,GAAG,KAAK;IACpD,MAAMP,QAAQE,eAAOyB,yBAAAA,MAAOpB,GAAG,CAAC,2BAAY,IAAIJ,IAAI,MAAM;IAE1D,IAAI0C,mBAAkC;IACtC,IAAIX,eAA8B;IAClC,IAAIY,iBAAgC;IACpC,IAAI9C,SAASoB,QAAQ;;QACnB,MAAMY,SAASpC,wBACb,MAAMC,YACHQ,UAAU,CAAC,QACXC,GAAG,CAACN,OACJK,UAAU,CAACV,4BACXW,GAAG,CAACc,QACJb,GAAG;QAERsC,4BAAmBb,0BAAAA,OAAQa,gBAAgB,oBAAI;QAC/CX,eAAehC,gBAAO8B,0BAAAA,OAAQE,YAAY,oBAAI,IAAI/B,IAAI,MAAM;QAC5D2C,iBAAiB5C,gBAAO8B,0BAAAA,OAAQc,cAAc,oBAAI,IAAI3C,IAAI,MAAM;IAClE;IAEA,OAAO;QACLe,QAAQjB;QACRD;QACAc;QACAM;QACAyB;QACAX;QACAY;IACF;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,eAAeC,yBACpBC,QAAmC;QAsB9B;IApBL,IAAI,CAACA,UAAU;IAEf,IAAIA,SAAShD,KAAK,IAAIgD,SAAS5B,MAAM,EAAE;QACrC,MAAMvB,YACHQ,UAAU,CAAC,QACXC,GAAG,CAAC0C,SAAShD,KAAK,EAClBK,UAAU,CAACV,4BACXW,GAAG,CAAC0C,SAAS5B,MAAM,EACnB6B,MAAM,GACNzC,KAAK,CAAC,IAAM0C;IACjB;IAEA;;;;;;GAMC,GACD,MAAM3B,UAAU1B,YAAYQ,UAAU,CAAC,SAASC,GAAG,CAAC0C,SAAS9B,MAAM;IACnE,KAAK,QAAA,MAAMK,QAAQhB,GAAG,GAAGC,KAAK,CAAC,IAAM,0BAAjC,AAAC,MAAwCC,MAAM,EAAE;QACnD,MAAMc,QACHe,GAAG,CACF;YACEE,cAAc9C,cAAcG,SAAS,CAACsD,UAAU,CAACF,MAAM;YACvDR,eAAe/C,cAAcG,SAAS,CAACsD,UAAU,CAACF,MAAM;QAC1D,GACA;YAAEV,OAAO;QAAK,GAEf/B,KAAK,CAAC,IAAM0C;IACjB;IAEA,IAAIF,SAASlC,KAAK,EAAE;QAClB;;;;;KAKC,GACD,MAAMsC,MAAMvC,SAASmC,SAASlC,KAAK;QACnC,MAAMjB,YACHwD,cAAc,CAAC,OAAOC;gBAGVlD;YAFX,MAAMA,WAAW,MAAMkD,YAAY/C,GAAG,CAAC6C;YACvC,IAAI,CAAChD,SAASK,MAAM,EAAE;YACtB,IAAIP,QAAOE,gBAAAA,SAASG,GAAG,CAAC,qBAAbH,gBAA0B,QAAQ4C,SAAS9B,MAAM,EAAE;YAC9DoC,YAAYL,MAAM,CAACG;QACrB,GACC5C,KAAK,CAAC,IAAM0C;IACjB;AACF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeK,yBAAyBvC,OAM9C;IAIC,MAAMgC,WAAW,MAAMJ,wBAAwB5B,2BAAAA,QAASE,MAAM;IAC9D,IAAI8B,UAAU,MAAMD,yBAAyBC;IAC7C,OAAO;QAAEA;QAAUQ,aAAa,MAAMzC,yBAAyBC;IAAS;AAC1E;AAWA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,eAAeyC,0BACpBC,QAAQ,EAAE;IAEV,MAAMtD,WAAW,MAAMP,YACpB8D,eAAe,CAAChE,4BAChBiE,KAAK,CAAC,UAAU,MAAM,aACtBC,OAAO,CAAC,eAAe,OACvBH,KAAK,CAACI,KAAKC,GAAG,CAAC,GAAGL,QAClBnD,GAAG;IAEN,MAAMyD,UAAkC,EAAE;IAC1C,KAAK,MAAM1D,OAAOF,SAAS6D,IAAI,CAAE;YAKjB3D;QAJd,MAAM0B,SAASpC,wBAAwBU;QACvC,IAAI,CAAC0B,QAAQ;QACb,wEAAwE;QACxE,IAAI,CAAC7C,wBAAwB6C,OAAOZ,MAAM,GAAG;QAC7C,MAAMpB,SAAQM,yBAAAA,IAAI8C,GAAG,CAACc,MAAM,CAACA,MAAM,qBAArB5D,uBAAuBL,EAAE;QACvC,IAAI,CAACD,OAAO;QACZgE,QAAQG,IAAI,CAAC;YAAEnE;YAAOgC;QAAO;IAC/B;IACA,OAAOgC;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASI,mBAAmBhD,MAAc;IAC/C,OAAO5B,qBAAqB4B,QAAQ9B;AACtC"}