@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/legal-acceptance.d.ts

@@ -0,0 +1,214 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A document as it was PRESENTED.
+ *
+ * The URL alone is worthless as evidence: it is mutable, and answers "what
+ * does that page say today?" rather than "what did this person see?". The
+ * `sha256` is what makes the record self-contained — it pins the exact text,
+ * so the archived snapshot can be proved to be the one that was accepted and
+ * any later edit to it is detectable instead of silent.
+ */
+export interface LegalDocumentReference {
+    /** Stable key, e.g. `terms`, `privacy`. */
+    key: string;
+    /** The absolute URL rendered in the consent control. */
+    url: string;
+    /** SHA-256 of the document text as published at this version. */
+    sha256?: string;
+    /** Byte length of that same text. */
+    bytes?: number;
+}
+export interface RecordLegalAcceptanceInput {
+    /** The document-set version presented. Becomes the document id. */
+    version: string;
+    /** Exactly what was linked, so the record pins content and not just a date. */
+    documents: LegalDocumentReference[];
+    /** Which door the acceptance came through, e.g. `signup-password`. */
+    context: string;
+    /** Standard clickwrap evidence; both are best-effort. */
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    /** Injectable for tests; defaults to the admin app's Firestore. */
+    firestore?: any;
+}
+/**
+ * Write the acceptance record, once, for `version`.
+ *
+ * @returns `recorded: false` when a record for this version already existed —
+ *   a normal outcome (a retry, or a second sign-up attempt on an account that
+ *   already agreed), not an error.
+ */
+export declare function recordLegalAcceptance(uid: string, input: RecordLegalAcceptanceInput): Promise<{
+    recorded: boolean;
+    version: string;
+}>;
+export default recordLegalAcceptance;
+/**
+ * ToS §18.5: written notice to legal@aglyn.com "within 30 days of first
+ * accepting these Terms".
+ *
+ * Pinned here, and pinned AGAINST THE PUBLISHED TEXT by
+ * `apps/console/specs/legal-acceptance-optout-window.spec.ts`, which re-reads
+ * the number out of the snapshot for the current version. A window that
+ * silently disagreed with the document it implements would compute a
+ * confident wrong answer, which is worse than computing none.
+ */
+export declare const ARBITRATION_OPT_OUT_DAYS = 30;
+/**
+ * The numeric rank of a `v<N>` version, or `null` when the id is not of that
+ * shape. `apps/console/specs/legal-document-version.spec.ts` already requires
+ * `/^v\d+$/` of the live constant, so `null` here means a stored record from
+ * some other scheme — not a normal case, and deliberately not guessed at.
+ */
+export declare function parseLegalDocumentVersion(version: string): number | null;
+/**
+ * Order two version ids: negative when `a` is older, positive when newer, 0
+ * when equal.
+ *
+ * An unparseable id sorts OLDER than any `v<N>`, so an unrecognised stored
+ * version can never suppress a re-acceptance prompt by looking newest. Two
+ * unparseable ids fall back to a string compare, which is arbitrary but
+ * stable — the alternative is a comparator that is not a total order, and
+ * `Array#sort` with one of those produces a different answer per engine.
+ */
+export declare function compareLegalDocumentVersions(a: string, b: string): number;
+/** One stored acceptance, flattened for transport to a surface. */
+export interface StoredLegalAcceptance {
+    version: string;
+    /** ISO-8601, from the SERVER timestamp. Null only if the write was partial. */
+    acceptedAt: string | null;
+    /** The door it came through, e.g. `signup-password`, `reaccept-console`. */
+    context: string | null;
+    method: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    /** What was presented, with the content hashes that pin it. */
+    documents: LegalDocumentReference[];
+}
+/**
+ * The §18.5 clock. Measured from the FIRST acceptance of ANY version, not
+ * from the current one: the clause says "first accepting these Terms", and a
+ * window that restarted on every re-acceptance would hand a returning
+ * customer a right the document does not give them — and would silently take
+ * one away in the other direction if it were measured from the newest.
+ */
+export interface ArbitrationOptOutWindow {
+    /** ISO of the earliest acceptance on file; null when there is none. */
+    firstAcceptedAt: string | null;
+    /** ISO of the last instant notice may be sent; null when unmeasurable. */
+    deadline: string | null;
+    /**
+     * Null — NOT false — when there is nothing to measure from. "We hold no
+     * acceptance" and "the window has closed" are different answers to a
+     * dispute, and collapsing them is how a staff surface asserts something
+     * nobody verified.
+     */
+    open: boolean | null;
+    /** Whole days left, 0 once closed; null when unmeasurable. */
+    daysRemaining: number | null;
+}
+export type LegalReacceptanceReason = 
+/** Current version is on file — nothing to ask for. */
+'none'
+/** No acceptance of any version. Pre-AGL-1497 accounts, and SSO/invite doors. */
+ | 'never-accepted'
+/** They accepted, but an older version than the one published now. */
+ | 'version-superseded';
+export interface LegalAcceptanceStatus {
+    /** The version the caller says is current — echoed so a surface can show it. */
+    currentVersion: string;
+    /** True when THIS version is on file. */
+    accepted: boolean;
+    /** Every accepted version, oldest first. */
+    acceptedVersions: string[];
+    latestAcceptedVersion: string | null;
+    /** ISO of the acceptance of `currentVersion`, when there is one. */
+    currentVersionAcceptedAt: string | null;
+    /**
+     * ISO of the acceptance of `latestAcceptedVersion` — WHEN this person last
+     * agreed to anything (2026-08-24).
+     *
+     * `currentVersionAcceptedAt` beside it is null in exactly the case a
+     * re-acceptance banner renders, so it cannot answer "when did you last
+     * agree?" for the person being asked. Null when there is no acceptance, and
+     * ALSO null when the record's own `acceptedAt` never landed — a surface
+     * MUST branch on it rather than formatting it, or it prints a date that
+     * does not exist.
+     */
+    latestAcceptedAt: string | null;
+    /**
+     * Which pinned documents actually MOVED between `latestAcceptedVersion` and
+     * the version published now — derived by comparing the `sha256` on the
+     * stored record against the current manifest, which is the only "what
+     * changed" signal that exists. There is no changelog mechanism, and none is
+     * invented here.
+     *
+     * NULL means UNKNOWN — no current manifest was supplied, there is nothing
+     * accepted to compare against, or a hash is missing on one of the two
+     * sides. That third state is deliberate: an empty array asserts "nothing
+     * changed", which is a claim, and a comparison that could not run must not
+     * make it.
+     */
+    changedDocumentKeys: string[] | null;
+    reacceptanceRequired: boolean;
+    reacceptanceReason: LegalReacceptanceReason;
+    arbitration: ArbitrationOptOutWindow;
+    /** The full history, oldest first — the evidence a dispute is answered from. */
+    acceptances: StoredLegalAcceptance[];
+}
+/**
+ * Read the whole (tiny) acceptance history for one user.
+ *
+ * A plain collection `get()` with NO `orderBy` and NO `where`, sorted in
+ * memory. That is not laziness: a query with an order or a filter is the kind
+ * that needs an index, indexes here deploy by hand, and a read that throws
+ * `FAILED_PRECONDITION` on the one page a dispute is answered from is the
+ * worst possible failure for this feature. One document per version means the
+ * collection is single digits, so the sort is free.
+ */
+export declare function readLegalAcceptances(uid: string, options?: {
+    firestore?: any;
+}): Promise<StoredLegalAcceptance[]>;
+/**
+ * Turn a history into the two answers AGL-2316 asks for: did this person
+ * accept and which version, and is the §18.5 window still open.
+ *
+ * Pure, and separated from the read so both boundaries are testable without a
+ * Firestore double.
+ */
+export declare function evaluateLegalAcceptance(input: {
+    acceptances: StoredLegalAcceptance[];
+    currentVersion: string;
+    /** Injectable for tests; defaults to now. */
+    now?: Date;
+    optOutDays?: number;
+    /**
+     * The manifest published NOW. Optional, and its absence is why
+     * `changedDocumentKeys` has an UNKNOWN state rather than defaulting to
+     * "nothing changed".
+     */
+    currentDocuments?: LegalDocumentReference[];
+}): LegalAcceptanceStatus;
+/** Read + evaluate in one call — what every surface actually wants. */
+export declare function getLegalAcceptanceStatus(uid: string, options: {
+    currentVersion: string;
+    firestore?: any;
+    now?: Date;
+    /** See `evaluateLegalAcceptance`. Needed for `changedDocumentKeys`. */
+    currentDocuments?: LegalDocumentReference[];
+}): Promise<LegalAcceptanceStatus>;

package/src/lib/server/legal-acceptance.js

@@ -0,0 +1,305 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The clickwrap acceptance record, `users/{uid}/legalAcceptances/{version}`
+ * (AGL-1497).
+ *
+ * WHY A COLLECTION, AND WHY UNDER THE USER
+ *
+ * Acceptance is a fact about a HUMAN, not about an org. An org has many
+ * members and they arrive by different doors — the founder who created it, a
+ * teammate who accepted an invite, and a site collaborator who is created with
+ * org `role: 'viewer'` and may never touch the org's billing at all. "The org
+ * accepted" and "this person accepted" are different statements, and only the
+ * second one is a contract with the person in front of you. Storing it on
+ * `orgs/{id}` would make the first stand in for the second, and storing it as
+ * a field on `users/{uid}` would keep only the latest answer.
+ *
+ * One document PER VERSION, so the history is additive: when the Terms change
+ * — and ToS §5.3 expressly reserves that right — a re-acceptance ADDS a
+ * document instead of overwriting the evidence of what was agreed before it.
+ * The version is the document id, which makes the write idempotent for free:
+ * a retried request cannot produce a second record of the same acceptance.
+ *
+ * IMMUTABILITY. The first acceptance of a version wins and is never rewritten.
+ * ToS §18.5 gives a 30-day window to opt out of arbitration measured from
+ * FIRST accepting, so that timestamp decides a real right — a later write that
+ * moved it would silently restart somebody's clock.
+ *
+ * The timestamp is the SERVER's. A record whose time the client supplied is
+ * worth very little in the dispute it exists for.
+ *
+ * Firestore rules make this collection owner-readable and `write: if false`,
+ * so it is Admin-SDK-only: the person the record is about cannot forge, amend
+ * or delete their own acceptance.
+ */ import { FieldValue } from "firebase-admin/firestore";
+import firebaseAdmin from "./firebase-admin.js";
+const firestore = ()=>firebaseAdmin.app().firestore();
+/**
+ * Write the acceptance record, once, for `version`.
+ *
+ * @returns `recorded: false` when a record for this version already existed —
+ *   a normal outcome (a retry, or a second sign-up attempt on an account that
+ *   already agreed), not an error.
+ */ export async function recordLegalAcceptance(uid, input) {
+    var _input_version, _input_firestore, _input_documents, _input_context, _input_ipAddress, _input_userAgent;
+    const version = String((_input_version = input.version) != null ? _input_version : '').trim();
+    // Loud, not best-effort. Everything else on the sign-up path is allowed to
+    // fail quietly because the account still exists and the user is signed in —
+    // but an acceptance we cannot attribute to a person and a version is not
+    // evidence of anything, and silently keeping half of one is worse than
+    // failing where somebody can see it.
+    if (!uid) throw new Error('recordLegalAcceptance: uid is required');
+    if (!version) throw new Error('recordLegalAcceptance: version is required');
+    const ref = ((_input_firestore = input.firestore) != null ? _input_firestore : firestore()).collection('users').doc(uid).collection('legalAcceptances').doc(version);
+    const snapshot = await ref.get();
+    if (snapshot.exists) return {
+        recorded: false,
+        version
+    };
+    await ref.set({
+        version,
+        documents: (_input_documents = input.documents) != null ? _input_documents : [],
+        method: 'clickwrap',
+        context: (_input_context = input.context) != null ? _input_context : null,
+        acceptedAt: FieldValue.serverTimestamp(),
+        ipAddress: (_input_ipAddress = input.ipAddress) != null ? _input_ipAddress : null,
+        userAgent: (_input_userAgent = input.userAgent) != null ? _input_userAgent : null
+    });
+    return {
+        recorded: true,
+        version
+    };
+}
+export default recordLegalAcceptance;
+/* -------------------------------------------------------------------------
+ * READING the record (AGL-2316)
+ *
+ * Everything above writes. Until AGL-2316 nothing read, which made both
+ * promises in this module's header undeliverable: the §18.5 opt-out window
+ * was unprovable, and "re-acceptance is additive" described a mechanism with
+ * no trigger, because nobody ever compared an accepted version against a
+ * current one.
+ *
+ * WHICH STRING IS "THE CURRENT VERSION" — and why nothing new is invented
+ * here. `apps/console/constants/legal-documents.ts` has carried
+ * `LEGAL_DOCUMENT_VERSION` since AGL-1497; it is `v6` today, it is what the
+ * writer route already stamps on every record, and `v1`..`v6` all exist as
+ * immutable snapshots under `apps/console/constants/legal/`. AGL-2316 was
+ * filed believing no such constant existed — it greps for `LEGAL_VERSION` and
+ * `legalVersion`, which is not its name. So the scheme is not a decision; it
+ * is an existing, published fact, and re-basing it (on an effective date, say)
+ * would orphan every acceptance already written. The constants file argues the
+ * date case and rejects it: the masters carry an unfilled `[EFFECTIVE DATE]`,
+ * and ToS §5.3 changes the Terms by MOVING the "Last updated" date, so the
+ * date is the field that shifts under the identifier rather than being one.
+ *
+ * The current version is a PARAMETER here rather than an import. This library
+ * is consumed by the console and by the tenant app, and the constant plus its
+ * snapshots live in the console; passing it in keeps the comparison logic on
+ * the server library and the published fact in the one place a publish edits.
+ * ------------------------------------------------------------------------- */ /**
+ * ToS §18.5: written notice to legal@aglyn.com "within 30 days of first
+ * accepting these Terms".
+ *
+ * Pinned here, and pinned AGAINST THE PUBLISHED TEXT by
+ * `apps/console/specs/legal-acceptance-optout-window.spec.ts`, which re-reads
+ * the number out of the snapshot for the current version. A window that
+ * silently disagreed with the document it implements would compute a
+ * confident wrong answer, which is worse than computing none.
+ */ export const ARBITRATION_OPT_OUT_DAYS = 30;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * The numeric rank of a `v<N>` version, or `null` when the id is not of that
+ * shape. `apps/console/specs/legal-document-version.spec.ts` already requires
+ * `/^v\d+$/` of the live constant, so `null` here means a stored record from
+ * some other scheme — not a normal case, and deliberately not guessed at.
+ */ export function parseLegalDocumentVersion(version) {
+    const match = /^v(\d+)$/.exec(String(version != null ? version : '').trim());
+    if (!match) return null;
+    const rank = Number(match[1]);
+    return Number.isFinite(rank) ? rank : null;
+}
+/**
+ * Order two version ids: negative when `a` is older, positive when newer, 0
+ * when equal.
+ *
+ * An unparseable id sorts OLDER than any `v<N>`, so an unrecognised stored
+ * version can never suppress a re-acceptance prompt by looking newest. Two
+ * unparseable ids fall back to a string compare, which is arbitrary but
+ * stable — the alternative is a comparator that is not a total order, and
+ * `Array#sort` with one of those produces a different answer per engine.
+ */ export function compareLegalDocumentVersions(a, b) {
+    const left = parseLegalDocumentVersion(a);
+    const right = parseLegalDocumentVersion(b);
+    if (left !== null && right !== null) return left - right;
+    if (left !== null) return 1;
+    if (right !== null) return -1;
+    return String(a != null ? a : '').localeCompare(String(b != null ? b : ''));
+}
+/**
+ * Compare the documents pinned on a stored acceptance against the manifest
+ * published now, and return the keys whose text moved.
+ *
+ * Returns null — NOT `[]` — whenever the comparison cannot be made in full.
+ */ function diffPinnedDocuments(accepted, current) {
+    var _accepted_documents;
+    if (!accepted || !current || current.length === 0) return null;
+    const acceptedByKey = new Map();
+    for (const doc of (_accepted_documents = accepted.documents) != null ? _accepted_documents : []){
+        if (doc == null ? void 0 : doc.key) acceptedByKey.set(doc.key, doc);
+    }
+    if (acceptedByKey.size === 0) return null;
+    const changed = [];
+    for (const doc of current){
+        if (!(doc == null ? void 0 : doc.key)) continue;
+        const was = acceptedByKey.get(doc.key);
+        // A document the old record never carried is new to the set, which IS a
+        // change to what is being agreed to.
+        if (!was) {
+            changed.push(doc.key);
+            continue;
+        }
+        // Either side missing a hash makes THIS key unknowable, and one unknown
+        // key makes the whole answer unknown — a partial list would read as a
+        // complete one.
+        if (!was.sha256 || !doc.sha256) return null;
+        if (was.sha256 !== doc.sha256) changed.push(doc.key);
+    }
+    return changed;
+}
+function toIso(value) {
+    var _value_toDate;
+    if (!value) return null;
+    const asDate = value == null ? void 0 : (_value_toDate = value.toDate) == null ? void 0 : _value_toDate.call(value);
+    if (asDate instanceof Date && !Number.isNaN(asDate.getTime())) {
+        return asDate.toISOString();
+    }
+    if (value instanceof Date) {
+        return Number.isNaN(value.getTime()) ? null : value.toISOString();
+    }
+    if (typeof value === 'string') {
+        const parsed = new Date(value);
+        return Number.isNaN(parsed.getTime()) ? null : parsed.toISOString();
+    }
+    return null;
+}
+/**
+ * Read the whole (tiny) acceptance history for one user.
+ *
+ * A plain collection `get()` with NO `orderBy` and NO `where`, sorted in
+ * memory. That is not laziness: a query with an order or a filter is the kind
+ * that needs an index, indexes here deploy by hand, and a read that throws
+ * `FAILED_PRECONDITION` on the one page a dispute is answered from is the
+ * worst possible failure for this feature. One document per version means the
+ * collection is single digits, so the sort is free.
+ */ export async function readLegalAcceptances(uid, options = {}) {
+    var _options_firestore, _ref;
+    if (!uid) throw new Error('readLegalAcceptances: uid is required');
+    const snapshot = await ((_options_firestore = options.firestore) != null ? _options_firestore : firestore()).collection('users').doc(uid).collection('legalAcceptances').get();
+    const records = ((_ref = snapshot == null ? void 0 : snapshot.docs) != null ? _ref : []).map((doc)=>{
+        var _ref, _doc_get, _doc_get1, _doc_get2, _doc_get3, _doc_get4, _doc_get5;
+        return {
+            // The document id IS the version (see the header). Falling back to it
+            // means a record whose `version` field never landed is still usable.
+            version: String((_ref = (_doc_get = doc.get('version')) != null ? _doc_get : doc.id) != null ? _ref : ''),
+            acceptedAt: toIso(doc.get('acceptedAt')),
+            context: (_doc_get1 = doc.get('context')) != null ? _doc_get1 : null,
+            method: (_doc_get2 = doc.get('method')) != null ? _doc_get2 : null,
+            ipAddress: (_doc_get3 = doc.get('ipAddress')) != null ? _doc_get3 : null,
+            userAgent: (_doc_get4 = doc.get('userAgent')) != null ? _doc_get4 : null,
+            documents: (_doc_get5 = doc.get('documents')) != null ? _doc_get5 : []
+        };
+    });
+    return records.sort((a, b)=>compareLegalDocumentVersions(a.version, b.version));
+}
+/**
+ * Turn a history into the two answers AGL-2316 asks for: did this person
+ * accept and which version, and is the §18.5 window still open.
+ *
+ * Pure, and separated from the read so both boundaries are testable without a
+ * Firestore double.
+ */ export function evaluateLegalAcceptance(input) {
+    var _input_currentVersion, _input_acceptances, _input_now, _input_optOutDays, _ref, _ref1, _input_currentDocuments;
+    const currentVersion = String((_input_currentVersion = input.currentVersion) != null ? _input_currentVersion : '').trim();
+    const acceptances = [
+        ...(_input_acceptances = input.acceptances) != null ? _input_acceptances : []
+    ].sort((a, b)=>compareLegalDocumentVersions(a.version, b.version));
+    const now = (_input_now = input.now) != null ? _input_now : new Date();
+    const optOutDays = (_input_optOutDays = input.optOutDays) != null ? _input_optOutDays : ARBITRATION_OPT_OUT_DAYS;
+    const acceptedVersions = acceptances.map((record)=>record.version);
+    const latestAcceptedVersion = acceptedVersions.length > 0 ? acceptedVersions[acceptedVersions.length - 1] : null;
+    const currentRecord = acceptances.find((record)=>record.version === currentVersion);
+    // The record for `latestAcceptedVersion` — the LAST thing this person
+    // agreed to, which is what a banner has to acknowledge. `acceptances` is
+    // sorted by version rank above, so this is its tail.
+    const latestRecord = acceptances.length > 0 ? acceptances[acceptances.length - 1] : null;
+    // FIRST acceptance by TIME, not by version rank. They usually agree, but a
+    // backfill or an out-of-order repair would make the ranks lie, and §18.5's
+    // clock is a clock.
+    const timestamps = acceptances.map((record)=>record.acceptedAt).filter((iso)=>Boolean(iso)).sort();
+    const firstAcceptedAt = timestamps.length > 0 ? timestamps[0] : null;
+    let arbitration = {
+        firstAcceptedAt: null,
+        deadline: null,
+        open: null,
+        daysRemaining: null
+    };
+    if (firstAcceptedAt) {
+        const deadlineMs = new Date(firstAcceptedAt).getTime() + optOutDays * DAY_MS;
+        const remainingMs = deadlineMs - now.getTime();
+        arbitration = {
+            firstAcceptedAt,
+            deadline: new Date(deadlineMs).toISOString(),
+            // INCLUSIVE of the deadline instant. "within 30 days of first
+            // accepting" includes the thirtieth day, and the cheap `<` would close
+            // the window a full day early for anyone who read the clause literally.
+            open: remainingMs >= 0,
+            daysRemaining: remainingMs > 0 ? Math.ceil(remainingMs / DAY_MS) : 0
+        };
+    }
+    let reacceptanceReason = 'none';
+    if (acceptances.length === 0) reacceptanceReason = 'never-accepted';
+    else if (currentVersion && compareLegalDocumentVersions(currentVersion, latestAcceptedVersion) > 0) {
+        reacceptanceReason = 'version-superseded';
+    }
+    return {
+        currentVersion,
+        accepted: Boolean(currentRecord),
+        acceptedVersions,
+        latestAcceptedVersion,
+        currentVersionAcceptedAt: (_ref = currentRecord == null ? void 0 : currentRecord.acceptedAt) != null ? _ref : null,
+        latestAcceptedAt: (_ref1 = latestRecord == null ? void 0 : latestRecord.acceptedAt) != null ? _ref1 : null,
+        changedDocumentKeys: diffPinnedDocuments(latestRecord, (_input_currentDocuments = input.currentDocuments) != null ? _input_currentDocuments : null),
+        reacceptanceRequired: reacceptanceReason !== 'none',
+        reacceptanceReason,
+        arbitration,
+        acceptances
+    };
+}
+/** Read + evaluate in one call — what every surface actually wants. */ export async function getLegalAcceptanceStatus(uid, options) {
+    const acceptances = await readLegalAcceptances(uid, {
+        firestore: options.firestore
+    });
+    return evaluateLegalAcceptance({
+        acceptances,
+        currentVersion: options.currentVersion,
+        now: options.now,
+        currentDocuments: options.currentDocuments
+    });
+}
+
+//# sourceMappingURL=legal-acceptance.js.map

package/src/lib/server/legal-acceptance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/legal-acceptance.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The clickwrap acceptance record, `users/{uid}/legalAcceptances/{version}`\n * (AGL-1497).\n *\n * WHY A COLLECTION, AND WHY UNDER THE USER\n *\n * Acceptance is a fact about a HUMAN, not about an org. An org has many\n * members and they arrive by different doors — the founder who created it, a\n * teammate who accepted an invite, and a site collaborator who is created with\n * org `role: 'viewer'` and may never touch the org's billing at all. \"The org\n * accepted\" and \"this person accepted\" are different statements, and only the\n * second one is a contract with the person in front of you. Storing it on\n * `orgs/{id}` would make the first stand in for the second, and storing it as\n * a field on `users/{uid}` would keep only the latest answer.\n *\n * One document PER VERSION, so the history is additive: when the Terms change\n * — and ToS §5.3 expressly reserves that right — a re-acceptance ADDS a\n * document instead of overwriting the evidence of what was agreed before it.\n * The version is the document id, which makes the write idempotent for free:\n * a retried request cannot produce a second record of the same acceptance.\n *\n * IMMUTABILITY. The first acceptance of a version wins and is never rewritten.\n * ToS §18.5 gives a 30-day window to opt out of arbitration measured from\n * FIRST accepting, so that timestamp decides a real right — a later write that\n * moved it would silently restart somebody's clock.\n *\n * The timestamp is the SERVER's. A record whose time the client supplied is\n * worth very little in the dispute it exists for.\n *\n * Firestore rules make this collection owner-readable and `write: if false`,\n * so it is Admin-SDK-only: the person the record is about cannot forge, amend\n * or delete their own acceptance.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/**\n * A document as it was PRESENTED.\n *\n * The URL alone is worthless as evidence: it is mutable, and answers \"what\n * does that page say today?\" rather than \"what did this person see?\". The\n * `sha256` is what makes the record self-contained — it pins the exact text,\n * so the archived snapshot can be proved to be the one that was accepted and\n * any later edit to it is detectable instead of silent.\n */\nexport interface LegalDocumentReference {\n  /** Stable key, e.g. `terms`, `privacy`. */\n  key: string\n  /** The absolute URL rendered in the consent control. */\n  url: string\n  /** SHA-256 of the document text as published at this version. */\n  sha256?: string\n  /** Byte length of that same text. */\n  bytes?: number\n}\n\nexport interface RecordLegalAcceptanceInput {\n  /** The document-set version presented. Becomes the document id. */\n  version: string\n  /** Exactly what was linked, so the record pins content and not just a date. */\n  documents: LegalDocumentReference[]\n  /** Which door the acceptance came through, e.g. `signup-password`. */\n  context: string\n  /** Standard clickwrap evidence; both are best-effort. */\n  ipAddress?: string | null\n  userAgent?: string | null\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n}\n\n/**\n * Write the acceptance record, once, for `version`.\n *\n * @returns `recorded: false` when a record for this version already existed —\n *   a normal outcome (a retry, or a second sign-up attempt on an account that\n *   already agreed), not an error.\n */\nexport async function recordLegalAcceptance(\n  uid: string,\n  input: RecordLegalAcceptanceInput,\n): Promise<{ recorded: boolean; version: string }> {\n  const version = String(input.version ?? '').trim()\n  // Loud, not best-effort. Everything else on the sign-up path is allowed to\n  // fail quietly because the account still exists and the user is signed in —\n  // but an acceptance we cannot attribute to a person and a version is not\n  // evidence of anything, and silently keeping half of one is worse than\n  // failing where somebody can see it.\n  if (!uid) throw new Error('recordLegalAcceptance: uid is required')\n  if (!version) throw new Error('recordLegalAcceptance: version is required')\n\n  const ref = (input.firestore ?? firestore())\n    .collection('users')\n    .doc(uid)\n    .collection('legalAcceptances')\n    .doc(version)\n\n  const snapshot = await ref.get()\n  if (snapshot.exists) return { recorded: false, version }\n\n  await ref.set({\n    version,\n    documents: input.documents ?? [],\n    method: 'clickwrap',\n    context: input.context ?? null,\n    acceptedAt: FieldValue.serverTimestamp(),\n    ipAddress: input.ipAddress ?? null,\n    userAgent: input.userAgent ?? null,\n  })\n  return { recorded: true, version }\n}\n\nexport default recordLegalAcceptance\n\n/* -------------------------------------------------------------------------\n * READING the record (AGL-2316)\n *\n * Everything above writes. Until AGL-2316 nothing read, which made both\n * promises in this module's header undeliverable: the §18.5 opt-out window\n * was unprovable, and \"re-acceptance is additive\" described a mechanism with\n * no trigger, because nobody ever compared an accepted version against a\n * current one.\n *\n * WHICH STRING IS \"THE CURRENT VERSION\" — and why nothing new is invented\n * here. `apps/console/constants/legal-documents.ts` has carried\n * `LEGAL_DOCUMENT_VERSION` since AGL-1497; it is `v6` today, it is what the\n * writer route already stamps on every record, and `v1`..`v6` all exist as\n * immutable snapshots under `apps/console/constants/legal/`. AGL-2316 was\n * filed believing no such constant existed — it greps for `LEGAL_VERSION` and\n * `legalVersion`, which is not its name. So the scheme is not a decision; it\n * is an existing, published fact, and re-basing it (on an effective date, say)\n * would orphan every acceptance already written. The constants file argues the\n * date case and rejects it: the masters carry an unfilled `[EFFECTIVE DATE]`,\n * and ToS §5.3 changes the Terms by MOVING the \"Last updated\" date, so the\n * date is the field that shifts under the identifier rather than being one.\n *\n * The current version is a PARAMETER here rather than an import. This library\n * is consumed by the console and by the tenant app, and the constant plus its\n * snapshots live in the console; passing it in keeps the comparison logic on\n * the server library and the published fact in the one place a publish edits.\n * ------------------------------------------------------------------------- */\n\n/**\n * ToS §18.5: written notice to legal@aglyn.com \"within 30 days of first\n * accepting these Terms\".\n *\n * Pinned here, and pinned AGAINST THE PUBLISHED TEXT by\n * `apps/console/specs/legal-acceptance-optout-window.spec.ts`, which re-reads\n * the number out of the snapshot for the current version. A window that\n * silently disagreed with the document it implements would compute a\n * confident wrong answer, which is worse than computing none.\n */\nexport const ARBITRATION_OPT_OUT_DAYS = 30\n\nconst DAY_MS = 24 * 60 * 60 * 1000\n\n/**\n * The numeric rank of a `v<N>` version, or `null` when the id is not of that\n * shape. `apps/console/specs/legal-document-version.spec.ts` already requires\n * `/^v\\d+$/` of the live constant, so `null` here means a stored record from\n * some other scheme — not a normal case, and deliberately not guessed at.\n */\nexport function parseLegalDocumentVersion(version: string): number | null {\n  const match = /^v(\\d+)$/.exec(String(version ?? '').trim())\n  if (!match) return null\n  const rank = Number(match[1])\n  return Number.isFinite(rank) ? rank : null\n}\n\n/**\n * Order two version ids: negative when `a` is older, positive when newer, 0\n * when equal.\n *\n * An unparseable id sorts OLDER than any `v<N>`, so an unrecognised stored\n * version can never suppress a re-acceptance prompt by looking newest. Two\n * unparseable ids fall back to a string compare, which is arbitrary but\n * stable — the alternative is a comparator that is not a total order, and\n * `Array#sort` with one of those produces a different answer per engine.\n */\nexport function compareLegalDocumentVersions(a: string, b: string): number {\n  const left = parseLegalDocumentVersion(a)\n  const right = parseLegalDocumentVersion(b)\n  if (left !== null && right !== null) return left - right\n  if (left !== null) return 1\n  if (right !== null) return -1\n  return String(a ?? '').localeCompare(String(b ?? ''))\n}\n\n/** One stored acceptance, flattened for transport to a surface. */\nexport interface StoredLegalAcceptance {\n  version: string\n  /** ISO-8601, from the SERVER timestamp. Null only if the write was partial. */\n  acceptedAt: string | null\n  /** The door it came through, e.g. `signup-password`, `reaccept-console`. */\n  context: string | null\n  method: string | null\n  ipAddress: string | null\n  userAgent: string | null\n  /** What was presented, with the content hashes that pin it. */\n  documents: LegalDocumentReference[]\n}\n\n/**\n * The §18.5 clock. Measured from the FIRST acceptance of ANY version, not\n * from the current one: the clause says \"first accepting these Terms\", and a\n * window that restarted on every re-acceptance would hand a returning\n * customer a right the document does not give them — and would silently take\n * one away in the other direction if it were measured from the newest.\n */\nexport interface ArbitrationOptOutWindow {\n  /** ISO of the earliest acceptance on file; null when there is none. */\n  firstAcceptedAt: string | null\n  /** ISO of the last instant notice may be sent; null when unmeasurable. */\n  deadline: string | null\n  /**\n   * Null — NOT false — when there is nothing to measure from. \"We hold no\n   * acceptance\" and \"the window has closed\" are different answers to a\n   * dispute, and collapsing them is how a staff surface asserts something\n   * nobody verified.\n   */\n  open: boolean | null\n  /** Whole days left, 0 once closed; null when unmeasurable. */\n  daysRemaining: number | null\n}\n\nexport type LegalReacceptanceReason =\n  /** Current version is on file — nothing to ask for. */\n  | 'none'\n  /** No acceptance of any version. Pre-AGL-1497 accounts, and SSO/invite doors. */\n  | 'never-accepted'\n  /** They accepted, but an older version than the one published now. */\n  | 'version-superseded'\n\nexport interface LegalAcceptanceStatus {\n  /** The version the caller says is current — echoed so a surface can show it. */\n  currentVersion: string\n  /** True when THIS version is on file. */\n  accepted: boolean\n  /** Every accepted version, oldest first. */\n  acceptedVersions: string[]\n  latestAcceptedVersion: string | null\n  /** ISO of the acceptance of `currentVersion`, when there is one. */\n  currentVersionAcceptedAt: string | null\n  /**\n   * ISO of the acceptance of `latestAcceptedVersion` — WHEN this person last\n   * agreed to anything (2026-08-24).\n   *\n   * `currentVersionAcceptedAt` beside it is null in exactly the case a\n   * re-acceptance banner renders, so it cannot answer \"when did you last\n   * agree?\" for the person being asked. Null when there is no acceptance, and\n   * ALSO null when the record's own `acceptedAt` never landed — a surface\n   * MUST branch on it rather than formatting it, or it prints a date that\n   * does not exist.\n   */\n  latestAcceptedAt: string | null\n  /**\n   * Which pinned documents actually MOVED between `latestAcceptedVersion` and\n   * the version published now — derived by comparing the `sha256` on the\n   * stored record against the current manifest, which is the only \"what\n   * changed\" signal that exists. There is no changelog mechanism, and none is\n   * invented here.\n   *\n   * NULL means UNKNOWN — no current manifest was supplied, there is nothing\n   * accepted to compare against, or a hash is missing on one of the two\n   * sides. That third state is deliberate: an empty array asserts \"nothing\n   * changed\", which is a claim, and a comparison that could not run must not\n   * make it.\n   */\n  changedDocumentKeys: string[] | null\n  reacceptanceRequired: boolean\n  reacceptanceReason: LegalReacceptanceReason\n  arbitration: ArbitrationOptOutWindow\n  /** The full history, oldest first — the evidence a dispute is answered from. */\n  acceptances: StoredLegalAcceptance[]\n}\n\n/**\n * Compare the documents pinned on a stored acceptance against the manifest\n * published now, and return the keys whose text moved.\n *\n * Returns null — NOT `[]` — whenever the comparison cannot be made in full.\n */\nfunction diffPinnedDocuments(\n  accepted: StoredLegalAcceptance | null,\n  current: LegalDocumentReference[] | null,\n): string[] | null {\n  if (!accepted || !current || current.length === 0) return null\n  const acceptedByKey = new Map<string, LegalDocumentReference>()\n  for (const doc of accepted.documents ?? []) {\n    if (doc?.key) acceptedByKey.set(doc.key, doc)\n  }\n  if (acceptedByKey.size === 0) return null\n\n  const changed: string[] = []\n  for (const doc of current) {\n    if (!doc?.key) continue\n    const was = acceptedByKey.get(doc.key)\n    // A document the old record never carried is new to the set, which IS a\n    // change to what is being agreed to.\n    if (!was) {\n      changed.push(doc.key)\n      continue\n    }\n    // Either side missing a hash makes THIS key unknowable, and one unknown\n    // key makes the whole answer unknown — a partial list would read as a\n    // complete one.\n    if (!was.sha256 || !doc.sha256) return null\n    if (was.sha256 !== doc.sha256) changed.push(doc.key)\n  }\n  return changed\n}\n\nfunction toIso(value: unknown): string | null {\n  if (!value) return null\n  const asDate = (value as { toDate?: () => Date })?.toDate?.()\n  if (asDate instanceof Date && !Number.isNaN(asDate.getTime())) {\n    return asDate.toISOString()\n  }\n  if (value instanceof Date) {\n    return Number.isNaN(value.getTime()) ? null : value.toISOString()\n  }\n  if (typeof value === 'string') {\n    const parsed = new Date(value)\n    return Number.isNaN(parsed.getTime()) ? null : parsed.toISOString()\n  }\n  return null\n}\n\n/**\n * Read the whole (tiny) acceptance history for one user.\n *\n * A plain collection `get()` with NO `orderBy` and NO `where`, sorted in\n * memory. That is not laziness: a query with an order or a filter is the kind\n * that needs an index, indexes here deploy by hand, and a read that throws\n * `FAILED_PRECONDITION` on the one page a dispute is answered from is the\n * worst possible failure for this feature. One document per version means the\n * collection is single digits, so the sort is free.\n */\nexport async function readLegalAcceptances(\n  uid: string,\n  options: { firestore?: any } = {},\n): Promise<StoredLegalAcceptance[]> {\n  if (!uid) throw new Error('readLegalAcceptances: uid is required')\n  const snapshot = await (options.firestore ?? firestore())\n    .collection('users')\n    .doc(uid)\n    .collection('legalAcceptances')\n    .get()\n\n  const records: StoredLegalAcceptance[] = (snapshot?.docs ?? []).map(\n    (doc: any) => ({\n      // The document id IS the version (see the header). Falling back to it\n      // means a record whose `version` field never landed is still usable.\n      version: String(doc.get('version') ?? doc.id ?? ''),\n      acceptedAt: toIso(doc.get('acceptedAt')),\n      context: (doc.get('context') as string) ?? null,\n      method: (doc.get('method') as string) ?? null,\n      ipAddress: (doc.get('ipAddress') as string) ?? null,\n      userAgent: (doc.get('userAgent') as string) ?? null,\n      documents: (doc.get('documents') as LegalDocumentReference[]) ?? [],\n    }),\n  )\n  return records.sort((a, b) =>\n    compareLegalDocumentVersions(a.version, b.version),\n  )\n}\n\n/**\n * Turn a history into the two answers AGL-2316 asks for: did this person\n * accept and which version, and is the §18.5 window still open.\n *\n * Pure, and separated from the read so both boundaries are testable without a\n * Firestore double.\n */\nexport function evaluateLegalAcceptance(input: {\n  acceptances: StoredLegalAcceptance[]\n  currentVersion: string\n  /** Injectable for tests; defaults to now. */\n  now?: Date\n  optOutDays?: number\n  /**\n   * The manifest published NOW. Optional, and its absence is why\n   * `changedDocumentKeys` has an UNKNOWN state rather than defaulting to\n   * \"nothing changed\".\n   */\n  currentDocuments?: LegalDocumentReference[]\n}): LegalAcceptanceStatus {\n  const currentVersion = String(input.currentVersion ?? '').trim()\n  const acceptances = [...(input.acceptances ?? [])].sort((a, b) =>\n    compareLegalDocumentVersions(a.version, b.version),\n  )\n  const now = input.now ?? new Date()\n  const optOutDays = input.optOutDays ?? ARBITRATION_OPT_OUT_DAYS\n\n  const acceptedVersions = acceptances.map((record) => record.version)\n  const latestAcceptedVersion =\n    acceptedVersions.length > 0\n      ? acceptedVersions[acceptedVersions.length - 1]\n      : null\n  const currentRecord = acceptances.find(\n    (record) => record.version === currentVersion,\n  )\n  // The record for `latestAcceptedVersion` — the LAST thing this person\n  // agreed to, which is what a banner has to acknowledge. `acceptances` is\n  // sorted by version rank above, so this is its tail.\n  const latestRecord =\n    acceptances.length > 0 ? acceptances[acceptances.length - 1] : null\n\n  // FIRST acceptance by TIME, not by version rank. They usually agree, but a\n  // backfill or an out-of-order repair would make the ranks lie, and §18.5's\n  // clock is a clock.\n  const timestamps = acceptances\n    .map((record) => record.acceptedAt)\n    .filter((iso): iso is string => Boolean(iso))\n    .sort()\n  const firstAcceptedAt = timestamps.length > 0 ? timestamps[0] : null\n\n  let arbitration: ArbitrationOptOutWindow = {\n    firstAcceptedAt: null,\n    deadline: null,\n    open: null,\n    daysRemaining: null,\n  }\n  if (firstAcceptedAt) {\n    const deadlineMs = new Date(firstAcceptedAt).getTime() + optOutDays * DAY_MS\n    const remainingMs = deadlineMs - now.getTime()\n    arbitration = {\n      firstAcceptedAt,\n      deadline: new Date(deadlineMs).toISOString(),\n      // INCLUSIVE of the deadline instant. \"within 30 days of first\n      // accepting\" includes the thirtieth day, and the cheap `<` would close\n      // the window a full day early for anyone who read the clause literally.\n      open: remainingMs >= 0,\n      daysRemaining: remainingMs > 0 ? Math.ceil(remainingMs / DAY_MS) : 0,\n    }\n  }\n\n  let reacceptanceReason: LegalReacceptanceReason = 'none'\n  if (acceptances.length === 0) reacceptanceReason = 'never-accepted'\n  else if (\n    currentVersion &&\n    compareLegalDocumentVersions(currentVersion, latestAcceptedVersion) > 0\n  ) {\n    reacceptanceReason = 'version-superseded'\n  }\n\n  return {\n    currentVersion,\n    accepted: Boolean(currentRecord),\n    acceptedVersions,\n    latestAcceptedVersion,\n    currentVersionAcceptedAt: currentRecord?.acceptedAt ?? null,\n    latestAcceptedAt: latestRecord?.acceptedAt ?? null,\n    changedDocumentKeys: diffPinnedDocuments(\n      latestRecord,\n      input.currentDocuments ?? null,\n    ),\n    reacceptanceRequired: reacceptanceReason !== 'none',\n    reacceptanceReason,\n    arbitration,\n    acceptances,\n  }\n}\n\n/** Read + evaluate in one call — what every surface actually wants. */\nexport async function getLegalAcceptanceStatus(\n  uid: string,\n  options: {\n    currentVersion: string\n    firestore?: any\n    now?: Date\n    /** See `evaluateLegalAcceptance`. Needed for `changedDocumentKeys`. */\n    currentDocuments?: LegalDocumentReference[]\n  },\n): Promise<LegalAcceptanceStatus> {\n  const acceptances = await readLegalAcceptances(uid, {\n    firestore: options.firestore,\n  })\n  return evaluateLegalAcceptance({\n    acceptances,\n    currentVersion: options.currentVersion,\n    now: options.now,\n    currentDocuments: options.currentDocuments,\n  })\n}\n"],"names":["FieldValue","firebaseAdmin","firestore","app","recordLegalAcceptance","uid","input","version","String","trim","Error","ref","collection","doc","snapshot","get","exists","recorded","set","documents","method","context","acceptedAt","serverTimestamp","ipAddress","userAgent","ARBITRATION_OPT_OUT_DAYS","DAY_MS","parseLegalDocumentVersion","match","exec","rank","Number","isFinite","compareLegalDocumentVersions","a","b","left","right","localeCompare","diffPinnedDocuments","accepted","current","length","acceptedByKey","Map","key","size","changed","was","push","sha256","toIso","value","asDate","toDate","Date","isNaN","getTime","toISOString","parsed","readLegalAcceptances","options","records","docs","map","id","sort","evaluateLegalAcceptance","currentVersion","acceptances","now","optOutDays","acceptedVersions","record","latestAcceptedVersion","currentRecord","find","latestRecord","timestamps","filter","iso","Boolean","firstAcceptedAt","arbitration","deadline","open","daysRemaining","deadlineMs","remainingMs","Math","ceil","reacceptanceReason","currentVersionAcceptedAt","latestAcceptedAt","changedDocumentKeys","currentDocuments","reacceptanceRequired","getLegalAcceptanceStatus"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAE5C,MAAMC,YAAY,IAAMD,cAAcE,GAAG,GAAGD,SAAS;AAoCrD;;;;;;CAMC,GACD,OAAO,eAAeE,sBACpBC,GAAW,EACXC,KAAiC;QAEVA,gBASVA,kBAWAA,kBAEFA,gBAEEA,kBACAA;IAzBb,MAAMC,UAAUC,QAAOF,iBAAAA,MAAMC,OAAO,YAAbD,iBAAiB,IAAIG,IAAI;IAChD,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,qCAAqC;IACrC,IAAI,CAACJ,KAAK,MAAM,IAAIK,MAAM;IAC1B,IAAI,CAACH,SAAS,MAAM,IAAIG,MAAM;IAE9B,MAAMC,MAAM,EAACL,mBAAAA,MAAMJ,SAAS,YAAfI,mBAAmBJ,aAC7BU,UAAU,CAAC,SACXC,GAAG,CAACR,KACJO,UAAU,CAAC,oBACXC,GAAG,CAACN;IAEP,MAAMO,WAAW,MAAMH,IAAII,GAAG;IAC9B,IAAID,SAASE,MAAM,EAAE,OAAO;QAAEC,UAAU;QAAOV;IAAQ;IAEvD,MAAMI,IAAIO,GAAG,CAAC;QACZX;QACAY,SAAS,GAAEb,mBAAAA,MAAMa,SAAS,YAAfb,mBAAmB,EAAE;QAChCc,QAAQ;QACRC,OAAO,GAAEf,iBAAAA,MAAMe,OAAO,YAAbf,iBAAiB;QAC1BgB,YAAYtB,WAAWuB,eAAe;QACtCC,SAAS,GAAElB,mBAAAA,MAAMkB,SAAS,YAAflB,mBAAmB;QAC9BmB,SAAS,GAAEnB,mBAAAA,MAAMmB,SAAS,YAAfnB,mBAAmB;IAChC;IACA,OAAO;QAAEW,UAAU;QAAMV;IAAQ;AACnC;AAEA,eAAeH,sBAAqB;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;6EA0B6E,GAE7E;;;;;;;;;CASC,GACD,OAAO,MAAMsB,2BAA2B,GAAE;AAE1C,MAAMC,SAAS,KAAK,KAAK,KAAK;AAE9B;;;;;CAKC,GACD,OAAO,SAASC,0BAA0BrB,OAAe;IACvD,MAAMsB,QAAQ,WAAWC,IAAI,CAACtB,OAAOD,kBAAAA,UAAW,IAAIE,IAAI;IACxD,IAAI,CAACoB,OAAO,OAAO;IACnB,MAAME,OAAOC,OAAOH,KAAK,CAAC,EAAE;IAC5B,OAAOG,OAAOC,QAAQ,CAACF,QAAQA,OAAO;AACxC;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASG,6BAA6BC,CAAS,EAAEC,CAAS;IAC/D,MAAMC,OAAOT,0BAA0BO;IACvC,MAAMG,QAAQV,0BAA0BQ;IACxC,IAAIC,SAAS,QAAQC,UAAU,MAAM,OAAOD,OAAOC;IACnD,IAAID,SAAS,MAAM,OAAO;IAC1B,IAAIC,UAAU,MAAM,OAAO,CAAC;IAC5B,OAAO9B,OAAO2B,YAAAA,IAAK,IAAII,aAAa,CAAC/B,OAAO4B,YAAAA,IAAK;AACnD;AA0FA;;;;;CAKC,GACD,SAASI,oBACPC,QAAsC,EACtCC,OAAwC;QAItBD;IAFlB,IAAI,CAACA,YAAY,CAACC,WAAWA,QAAQC,MAAM,KAAK,GAAG,OAAO;IAC1D,MAAMC,gBAAgB,IAAIC;IAC1B,KAAK,MAAMhC,QAAO4B,sBAAAA,SAAStB,SAAS,YAAlBsB,sBAAsB,EAAE,CAAE;QAC1C,IAAI5B,uBAAAA,IAAKiC,GAAG,EAAEF,cAAc1B,GAAG,CAACL,IAAIiC,GAAG,EAAEjC;IAC3C;IACA,IAAI+B,cAAcG,IAAI,KAAK,GAAG,OAAO;IAErC,MAAMC,UAAoB,EAAE;IAC5B,KAAK,MAAMnC,OAAO6B,QAAS;QACzB,IAAI,EAAC7B,uBAAAA,IAAKiC,GAAG,GAAE;QACf,MAAMG,MAAML,cAAc7B,GAAG,CAACF,IAAIiC,GAAG;QACrC,wEAAwE;QACxE,qCAAqC;QACrC,IAAI,CAACG,KAAK;YACRD,QAAQE,IAAI,CAACrC,IAAIiC,GAAG;YACpB;QACF;QACA,wEAAwE;QACxE,sEAAsE;QACtE,gBAAgB;QAChB,IAAI,CAACG,IAAIE,MAAM,IAAI,CAACtC,IAAIsC,MAAM,EAAE,OAAO;QACvC,IAAIF,IAAIE,MAAM,KAAKtC,IAAIsC,MAAM,EAAEH,QAAQE,IAAI,CAACrC,IAAIiC,GAAG;IACrD;IACA,OAAOE;AACT;AAEA,SAASI,MAAMC,KAAc;QAEZ;IADf,IAAI,CAACA,OAAO,OAAO;IACnB,MAAMC,SAAUD,0BAAD,gBAAA,AAACA,MAAmCE,MAAM,qBAA1C,mBAACF;IAChB,IAAIC,kBAAkBE,QAAQ,CAACxB,OAAOyB,KAAK,CAACH,OAAOI,OAAO,KAAK;QAC7D,OAAOJ,OAAOK,WAAW;IAC3B;IACA,IAAIN,iBAAiBG,MAAM;QACzB,OAAOxB,OAAOyB,KAAK,CAACJ,MAAMK,OAAO,MAAM,OAAOL,MAAMM,WAAW;IACjE;IACA,IAAI,OAAON,UAAU,UAAU;QAC7B,MAAMO,SAAS,IAAIJ,KAAKH;QACxB,OAAOrB,OAAOyB,KAAK,CAACG,OAAOF,OAAO,MAAM,OAAOE,OAAOD,WAAW;IACnE;IACA,OAAO;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeE,qBACpBxD,GAAW,EACXyD,UAA+B,CAAC,CAAC;QAGTA;IADxB,IAAI,CAACzD,KAAK,MAAM,IAAIK,MAAM;IAC1B,MAAMI,WAAW,MAAM,EAACgD,qBAAAA,QAAQ5D,SAAS,YAAjB4D,qBAAqB5D,aAC1CU,UAAU,CAAC,SACXC,GAAG,CAACR,KACJO,UAAU,CAAC,oBACXG,GAAG;IAEN,MAAMgD,UAAmC,SAACjD,4BAAAA,SAAUkD,IAAI,mBAAI,EAAE,EAAEC,GAAG,CACjE,CAACpD;YAGiBA,MAAAA,UAENA,WACDA,WACGA,WACAA,WACAA;eATC;YACb,sEAAsE;YACtE,qEAAqE;YACrEN,SAASC,QAAOK,QAAAA,WAAAA,IAAIE,GAAG,CAAC,sBAARF,WAAsBA,IAAIqD,EAAE,YAA5BrD,OAAgC;YAChDS,YAAY8B,MAAMvC,IAAIE,GAAG,CAAC;YAC1BM,OAAO,GAAGR,YAAAA,IAAIE,GAAG,CAAC,sBAARF,YAAiC;YAC3CO,MAAM,GAAGP,YAAAA,IAAIE,GAAG,CAAC,qBAARF,YAAgC;YACzCW,SAAS,GAAGX,YAAAA,IAAIE,GAAG,CAAC,wBAARF,YAAmC;YAC/CY,SAAS,GAAGZ,YAAAA,IAAIE,GAAG,CAAC,wBAARF,YAAmC;YAC/CM,SAAS,GAAGN,YAAAA,IAAIE,GAAG,CAAC,wBAARF,YAAqD,EAAE;QACrE;;IAEF,OAAOkD,QAAQI,IAAI,CAAC,CAAChC,GAAGC,IACtBF,6BAA6BC,EAAE5B,OAAO,EAAE6B,EAAE7B,OAAO;AAErD;AAEA;;;;;;CAMC,GACD,OAAO,SAAS6D,wBAAwB9D,KAYvC;QAC+BA,uBACLA,oBAGbA,YACOA,gCA+DfA;IApEJ,MAAM+D,iBAAiB7D,QAAOF,wBAAAA,MAAM+D,cAAc,YAApB/D,wBAAwB,IAAIG,IAAI;IAC9D,MAAM6D,cAAc;YAAKhE,qBAAAA,MAAMgE,WAAW,YAAjBhE,qBAAqB,EAAE;KAAE,CAAC6D,IAAI,CAAC,CAAChC,GAAGC,IAC1DF,6BAA6BC,EAAE5B,OAAO,EAAE6B,EAAE7B,OAAO;IAEnD,MAAMgE,OAAMjE,aAAAA,MAAMiE,GAAG,YAATjE,aAAa,IAAIkD;IAC7B,MAAMgB,cAAalE,oBAAAA,MAAMkE,UAAU,YAAhBlE,oBAAoBoB;IAEvC,MAAM+C,mBAAmBH,YAAYL,GAAG,CAAC,CAACS,SAAWA,OAAOnE,OAAO;IACnE,MAAMoE,wBACJF,iBAAiB9B,MAAM,GAAG,IACtB8B,gBAAgB,CAACA,iBAAiB9B,MAAM,GAAG,EAAE,GAC7C;IACN,MAAMiC,gBAAgBN,YAAYO,IAAI,CACpC,CAACH,SAAWA,OAAOnE,OAAO,KAAK8D;IAEjC,sEAAsE;IACtE,yEAAyE;IACzE,qDAAqD;IACrD,MAAMS,eACJR,YAAY3B,MAAM,GAAG,IAAI2B,WAAW,CAACA,YAAY3B,MAAM,GAAG,EAAE,GAAG;IAEjE,2EAA2E;IAC3E,2EAA2E;IAC3E,oBAAoB;IACpB,MAAMoC,aAAaT,YAChBL,GAAG,CAAC,CAACS,SAAWA,OAAOpD,UAAU,EACjC0D,MAAM,CAAC,CAACC,MAAuBC,QAAQD,MACvCd,IAAI;IACP,MAAMgB,kBAAkBJ,WAAWpC,MAAM,GAAG,IAAIoC,UAAU,CAAC,EAAE,GAAG;IAEhE,IAAIK,cAAuC;QACzCD,iBAAiB;QACjBE,UAAU;QACVC,MAAM;QACNC,eAAe;IACjB;IACA,IAAIJ,iBAAiB;QACnB,MAAMK,aAAa,IAAIhC,KAAK2B,iBAAiBzB,OAAO,KAAKc,aAAa7C;QACtE,MAAM8D,cAAcD,aAAajB,IAAIb,OAAO;QAC5C0B,cAAc;YACZD;YACAE,UAAU,IAAI7B,KAAKgC,YAAY7B,WAAW;YAC1C,8DAA8D;YAC9D,uEAAuE;YACvE,wEAAwE;YACxE2B,MAAMG,eAAe;YACrBF,eAAeE,cAAc,IAAIC,KAAKC,IAAI,CAACF,cAAc9D,UAAU;QACrE;IACF;IAEA,IAAIiE,qBAA8C;IAClD,IAAItB,YAAY3B,MAAM,KAAK,GAAGiD,qBAAqB;SAC9C,IACHvB,kBACAnC,6BAA6BmC,gBAAgBM,yBAAyB,GACtE;QACAiB,qBAAqB;IACvB;IAEA,OAAO;QACLvB;QACA5B,UAAUyC,QAAQN;QAClBH;QACAE;QACAkB,wBAAwB,UAAEjB,iCAAAA,cAAetD,UAAU,mBAAI;QACvDwE,gBAAgB,WAAEhB,gCAAAA,aAAcxD,UAAU,oBAAI;QAC9CyE,qBAAqBvD,oBACnBsC,eACAxE,0BAAAA,MAAM0F,gBAAgB,YAAtB1F,0BAA0B;QAE5B2F,sBAAsBL,uBAAuB;QAC7CA;QACAR;QACAd;IACF;AACF;AAEA,qEAAqE,GACrE,OAAO,eAAe4B,yBACpB7F,GAAW,EACXyD,OAMC;IAED,MAAMQ,cAAc,MAAMT,qBAAqBxD,KAAK;QAClDH,WAAW4D,QAAQ5D,SAAS;IAC9B;IACA,OAAOkE,wBAAwB;QAC7BE;QACAD,gBAAgBP,QAAQO,cAAc;QACtCE,KAAKT,QAAQS,GAAG;QAChByB,kBAAkBlC,QAAQkC,gBAAgB;IAC5C;AACF"}