@aglyn/tenant-data-admin 1.0.0-beta.200 → 1.0.0-beta.202

package/src/lib/server/payment-risk-record.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PaymentRiskSignal } from '@aglyn/aglyn/app-utils/payment-risk';
+import type { AglynNotificationType } from '@aglyn/aglyn/app-utils/notifications';
+/** The notifier's shape: `notifyHostManagers` from the admin barrel. */
+export type PaymentRiskNotifier = (hostId: string, payload: {
+    type: AglynNotificationType;
+    title: string;
+    body: string;
+    link: string;
+}) => Promise<void>;
+export interface RecordPaymentRiskInput {
+    ref: FirebaseFirestore.DocumentReference;
+    signal: PaymentRiskSignal;
+    /** The site whose managers are told. Empty tells nobody. */
+    hostId: string;
+    /** What the record is, as the merchant calls it: `Order 1042`, `Booking`. */
+    subjectLabel: string;
+    /** The console path the notification opens. */
+    link: string;
+    /** The plugin's own notification type: `content.order`, `content.booking`. */
+    notificationType: AglynNotificationType;
+    /**
+     * More fields to write in the same transaction, from the record as read —
+     * a plugin's own activity line (an order's timeline) rides here.
+     */
+    extraUpdate?: (data: Record<string, unknown>) => Record<string, unknown>;
+}
+/**
+ * Stamp `signal` on `input.ref` and notify, once. Returns true when this
+ * delivery wrote it; false for a redelivery or a record that is gone.
+ * Throws only when the write throws, which the webhook answers with a 500 and
+ * Stripe's redelivery.
+ */
+export declare function recordPaymentRiskOnRecord(input: RecordPaymentRiskInput, deps: {
+    firestore: FirebaseFirestore.Firestore;
+    notify: PaymentRiskNotifier;
+}): Promise<boolean>;
+/**
+ * Record a dispute's outcome on the signal already stamped for it. Silent:
+ * the plugin that owns money movement on a lost dispute says so itself.
+ */
+export declare function settlePaymentRiskDisputeOnRecord(ref: FirebaseFirestore.DocumentReference, disputeId: string, outcome: string, deps: {
+    firestore: FirebaseFirestore.Firestore;
+}): Promise<boolean>;

package/src/lib/server/payment-risk-record.js

@@ -0,0 +1,76 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * STAMP A STRIPE FRAUD SIGNAL ON A MERCHANT'S RECORD (AGL-3360).
+ *
+ * The server half of `@aglyn/aglyn/app-utils/payment-risk`. A plugin that
+ * finds its own record behind a charge — an order, a booking — hands the
+ * document here, and this writes the `paymentRisk` field once per signal and
+ * tells the site's managers once. Any plugin that sells through Stripe uses
+ * the same two calls; nothing about the record's kind is known here.
+ *
+ * NOTHING IS REFUNDED OR CANCELED. The merchant decides for their own
+ * customer; the notification says so.
+ *
+ * Dependencies are passed in — the Firestore handle and the notifier — so a
+ * plugin's spec that substitutes the admin barrel substitutes these too.
+ *=========================================*/ import { addPaymentRiskSignal, NOTHING_MOVED, PAYMENT_RISK_FIELD, paymentRiskAdvice, paymentRiskTitle, settlePaymentRiskDispute } from "@aglyn/aglyn/app-utils/payment-risk";
+/**
+ * Stamp `signal` on `input.ref` and notify, once. Returns true when this
+ * delivery wrote it; false for a redelivery or a record that is gone.
+ * Throws only when the write throws, which the webhook answers with a 500 and
+ * Stripe's redelivery.
+ */ export async function recordPaymentRiskOnRecord(input, deps) {
+    const written = await deps.firestore.runTransaction(async (transaction)=>{
+        var _fresh_data;
+        const fresh = await transaction.get(input.ref);
+        if (!fresh.exists) return false;
+        const data = (_fresh_data = fresh.data()) != null ? _fresh_data : {};
+        const next = addPaymentRiskSignal(data[PAYMENT_RISK_FIELD], input.signal);
+        if (!next) return false;
+        transaction.update(input.ref, _extends({}, input.extraUpdate ? input.extraUpdate(data) : {}, {
+            [PAYMENT_RISK_FIELD]: next
+        }));
+        return true;
+    });
+    if (written && input.hostId) {
+        await deps.notify(input.hostId, {
+            type: input.notificationType,
+            title: paymentRiskTitle(input.signal.kind),
+            body: `${input.subjectLabel}. ${paymentRiskAdvice(input.signal.kind)}` + (input.signal.detail ? ` Stripe says: ${input.signal.detail.replace(/_/g, ' ')}.` : '') + ` ${NOTHING_MOVED}`,
+            link: input.link
+        }).catch(()=>undefined);
+    }
+    return written;
+}
+/**
+ * Record a dispute's outcome on the signal already stamped for it. Silent:
+ * the plugin that owns money movement on a lost dispute says so itself.
+ */ export async function settlePaymentRiskDisputeOnRecord(ref, disputeId, outcome, deps) {
+    return deps.firestore.runTransaction(async (transaction)=>{
+        const fresh = await transaction.get(ref);
+        if (!fresh.exists) return false;
+        const next = settlePaymentRiskDispute(fresh.get(PAYMENT_RISK_FIELD), disputeId, outcome);
+        if (!next) return false;
+        transaction.update(ref, {
+            [PAYMENT_RISK_FIELD]: next
+        });
+        return true;
+    });
+}
+
+//# sourceMappingURL=payment-risk-record.js.map

package/src/lib/server/payment-risk-record.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/payment-risk-record.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * STAMP A STRIPE FRAUD SIGNAL ON A MERCHANT'S RECORD (AGL-3360).\n *\n * The server half of `@aglyn/aglyn/app-utils/payment-risk`. A plugin that\n * finds its own record behind a charge — an order, a booking — hands the\n * document here, and this writes the `paymentRisk` field once per signal and\n * tells the site's managers once. Any plugin that sells through Stripe uses\n * the same two calls; nothing about the record's kind is known here.\n *\n * NOTHING IS REFUNDED OR CANCELED. The merchant decides for their own\n * customer; the notification says so.\n *\n * Dependencies are passed in — the Firestore handle and the notifier — so a\n * plugin's spec that substitutes the admin barrel substitutes these too.\n *=========================================*/\n\nimport {\n  addPaymentRiskSignal,\n  NOTHING_MOVED,\n  PAYMENT_RISK_FIELD,\n  type PaymentRisk,\n  type PaymentRiskSignal,\n  paymentRiskAdvice,\n  paymentRiskTitle,\n  settlePaymentRiskDispute,\n} from '@aglyn/aglyn/app-utils/payment-risk'\nimport type { AglynNotificationType } from '@aglyn/aglyn/app-utils/notifications'\n\n/** The notifier's shape: `notifyHostManagers` from the admin barrel. */\nexport type PaymentRiskNotifier = (\n  hostId: string,\n  payload: {\n    type: AglynNotificationType\n    title: string\n    body: string\n    link: string\n  },\n) => Promise<void>\n\nexport interface RecordPaymentRiskInput {\n  ref: FirebaseFirestore.DocumentReference\n  signal: PaymentRiskSignal\n  /** The site whose managers are told. Empty tells nobody. */\n  hostId: string\n  /** What the record is, as the merchant calls it: `Order 1042`, `Booking`. */\n  subjectLabel: string\n  /** The console path the notification opens. */\n  link: string\n  /** The plugin's own notification type: `content.order`, `content.booking`. */\n  notificationType: AglynNotificationType\n  /**\n   * More fields to write in the same transaction, from the record as read —\n   * a plugin's own activity line (an order's timeline) rides here.\n   */\n  extraUpdate?: (data: Record<string, unknown>) => Record<string, unknown>\n}\n\n/**\n * Stamp `signal` on `input.ref` and notify, once. Returns true when this\n * delivery wrote it; false for a redelivery or a record that is gone.\n * Throws only when the write throws, which the webhook answers with a 500 and\n * Stripe's redelivery.\n */\nexport async function recordPaymentRiskOnRecord(\n  input: RecordPaymentRiskInput,\n  deps: {\n    firestore: FirebaseFirestore.Firestore\n    notify: PaymentRiskNotifier\n  },\n): Promise<boolean> {\n  const written = await deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(input.ref)\n    if (!fresh.exists) return false\n    const data = (fresh.data() ?? {}) as Record<string, unknown>\n    const next = addPaymentRiskSignal(\n      data[PAYMENT_RISK_FIELD] as PaymentRisk | undefined,\n      input.signal,\n    )\n    if (!next) return false\n    transaction.update(input.ref, {\n      ...(input.extraUpdate ? input.extraUpdate(data) : {}),\n      [PAYMENT_RISK_FIELD]: next,\n    })\n    return true\n  })\n  if (written && input.hostId) {\n    await deps\n      .notify(input.hostId, {\n        type: input.notificationType,\n        title: paymentRiskTitle(input.signal.kind),\n        body:\n          `${input.subjectLabel}. ${paymentRiskAdvice(input.signal.kind)}` +\n          (input.signal.detail\n            ? ` Stripe says: ${input.signal.detail.replace(/_/g, ' ')}.`\n            : '') +\n          ` ${NOTHING_MOVED}`,\n        link: input.link,\n      })\n      .catch(() => undefined)\n  }\n  return written\n}\n\n/**\n * Record a dispute's outcome on the signal already stamped for it. Silent:\n * the plugin that owns money movement on a lost dispute says so itself.\n */\nexport async function settlePaymentRiskDisputeOnRecord(\n  ref: FirebaseFirestore.DocumentReference,\n  disputeId: string,\n  outcome: string,\n  deps: { firestore: FirebaseFirestore.Firestore },\n): Promise<boolean> {\n  return deps.firestore.runTransaction(async (transaction) => {\n    const fresh = await transaction.get(ref)\n    if (!fresh.exists) return false\n    const next = settlePaymentRiskDispute(\n      fresh.get(PAYMENT_RISK_FIELD) as PaymentRisk | undefined,\n      disputeId,\n      outcome,\n    )\n    if (!next) return false\n    transaction.update(ref, { [PAYMENT_RISK_FIELD]: next })\n    return true\n  })\n}\n"],"names":["addPaymentRiskSignal","NOTHING_MOVED","PAYMENT_RISK_FIELD","paymentRiskAdvice","paymentRiskTitle","settlePaymentRiskDispute","recordPaymentRiskOnRecord","input","deps","written","firestore","runTransaction","transaction","fresh","get","ref","exists","data","next","signal","update","extraUpdate","hostId","notify","type","notificationType","title","kind","body","subjectLabel","detail","replace","link","catch","undefined","settlePaymentRiskDisputeOnRecord","disputeId","outcome"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;2CAc2C,GAE3C,SACEA,oBAAoB,EACpBC,aAAa,EACbC,kBAAkB,EAGlBC,iBAAiB,EACjBC,gBAAgB,EAChBC,wBAAwB,QACnB,sCAAqC;AAgC5C;;;;;CAKC,GACD,OAAO,eAAeC,0BACpBC,KAA6B,EAC7BC,IAGC;IAED,MAAMC,UAAU,MAAMD,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;YAG3CC;QAFd,MAAMA,QAAQ,MAAMD,YAAYE,GAAG,CAACP,MAAMQ,GAAG;QAC7C,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAMC,QAAQJ,cAAAA,MAAMI,IAAI,cAAVJ,cAAgB,CAAC;QAC/B,MAAMK,OAAOlB,qBACXiB,IAAI,CAACf,mBAAmB,EACxBK,MAAMY,MAAM;QAEd,IAAI,CAACD,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACb,MAAMQ,GAAG,EAAE,aACxBR,MAAMc,WAAW,GAAGd,MAAMc,WAAW,CAACJ,QAAQ,CAAC;YACnD,CAACf,mBAAmB,EAAEgB;;QAExB,OAAO;IACT;IACA,IAAIT,WAAWF,MAAMe,MAAM,EAAE;QAC3B,MAAMd,KACHe,MAAM,CAAChB,MAAMe,MAAM,EAAE;YACpBE,MAAMjB,MAAMkB,gBAAgB;YAC5BC,OAAOtB,iBAAiBG,MAAMY,MAAM,CAACQ,IAAI;YACzCC,MACE,GAAGrB,MAAMsB,YAAY,CAAC,EAAE,EAAE1B,kBAAkBI,MAAMY,MAAM,CAACQ,IAAI,GAAG,GAC/DpB,CAAAA,MAAMY,MAAM,CAACW,MAAM,GAChB,CAAC,cAAc,EAAEvB,MAAMY,MAAM,CAACW,MAAM,CAACC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,GAC1D,EAAC,IACL,CAAC,CAAC,EAAE9B,eAAe;YACrB+B,MAAMzB,MAAMyB,IAAI;QAClB,GACCC,KAAK,CAAC,IAAMC;IACjB;IACA,OAAOzB;AACT;AAEA;;;CAGC,GACD,OAAO,eAAe0B,iCACpBpB,GAAwC,EACxCqB,SAAiB,EACjBC,OAAe,EACf7B,IAAgD;IAEhD,OAAOA,KAAKE,SAAS,CAACC,cAAc,CAAC,OAAOC;QAC1C,MAAMC,QAAQ,MAAMD,YAAYE,GAAG,CAACC;QACpC,IAAI,CAACF,MAAMG,MAAM,EAAE,OAAO;QAC1B,MAAME,OAAOb,yBACXQ,MAAMC,GAAG,CAACZ,qBACVkC,WACAC;QAEF,IAAI,CAACnB,MAAM,OAAO;QAClBN,YAAYQ,MAAM,CAACL,KAAK;YAAE,CAACb,mBAAmB,EAAEgB;QAAK;QACrD,OAAO;IACT;AACF"}

package/src/lib/server/render-system-email.d.ts

@@ -0,0 +1,176 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type SystemEmailTemplateDefinition } from '@aglyn/shared-util-email';
+import { type ReusableComponentTree } from '@aglyn/aglyn/server';
+import { isPlatformBrandedSend, type SystemEmailBrandOptions } from '@aglyn/aglyn/app-utils/system-email-chrome';
+export { isPlatformBrandedSend };
+export type { SystemEmailBrandOptions };
+/**
+ * Which copy a system email carries: a design staff published, or the
+ * catalog's built-in copy, which is what every key without a usable design
+ * sends (AGL-3322).
+ */
+export type SystemEmailSource = 'designed' | 'default';
+export interface RenderedSystemEmail {
+    subject: string;
+    html: string;
+    text: string;
+    source: SystemEmailSource;
+}
+/**
+ * A system email loaded once, ready to render for any number of recipients
+ * without touching Firestore again (AGL-768): the published staff design, or
+ * the catalog's built-in copy when there is none.
+ */
+export interface LoadedSystemEmail {
+    definition: SystemEmailTemplateDefinition;
+    /** The design as stored, each email block still a placement; or the built-in copy's node map. */
+    nodes: Record<string, unknown>;
+    subjectTemplate: string;
+    preheaderTemplate: string;
+    source: SystemEmailSource;
+    /**
+     * The published definitions of the email blocks `nodes` places, keyed by
+     * id, read from the platform marketing site ONCE with the template
+     * (AGL-3318), so a batch composes every recipient's copy without another
+     * read. Absent when the design places none, when the deployment names no
+     * marketing site, and when the read failed; each placement then renders as
+     * nothing.
+     */
+    components?: Record<string, ReusableComponentTree>;
+}
+/**
+ * Loads what a key sends — ONE Firestore read — ready to render per
+ * recipient: the published staff design, or the catalog's built-in copy
+ * (AGL-3322) when there is none to use (no document, no published version,
+ * an empty node map, or a read failure).
+ *
+ * `null` only for a key that is unknown or not Resend-delivered, which has
+ * nothing here to render. Split out from {@link renderSystemEmail} so a batch
+ * send resolves the template once and renders it per recipient, rather than
+ * one read each (AGL-768): a Firestore read per invite is fine, one per
+ * recipient in a usage-email batch is not.
+ *
+ * Reads through the Admin SDK, which bypasses the staff-only rules on the
+ * collection — the send path runs as the server, not as a signed-in user.
+ *
+ * A design that places email blocks costs one more read per block, from the
+ * platform marketing site, made here with the template so a batch pays it
+ * once too (AGL-3318). Whether a recipient's copy expands them is decided per
+ * send, by {@link renderLoadedSystemEmail}.
+ */
+export declare function loadSystemEmail(templateKey: string): Promise<LoadedSystemEmail | null>;
+/**
+ * Renders a loaded email for one recipient's merge values (AGL-768). No
+ * Firestore access — call {@link loadSystemEmail} once, then this per
+ * recipient. `null` only if the renderer produced no document at all.
+ *
+ * Which header and footer it wears is decided here, per send, because one
+ * batch-loaded design goes to recipients of different brands:
+ *
+ * - A send under the platform's own brand of a design whose email blocks the
+ *   load read draws those blocks (AGL-3318), and nothing else: they ARE its
+ *   header and footer, and a second one around them would draw both.
+ * - Every other send is drawn inside {@link buildSystemEmailChrome}'s chrome
+ *   (AGL-3322): the built-in copy, which places no blocks; a design sent to a
+ *   white-label org's people, whose blocks stay unexpanded and draw nothing,
+ *   since they are the platform's; and a design on a deployment that names no
+ *   marketing site, or whose blocks could not be read. The chrome is in the
+ *   brand of the send — the org's email logo rides in its header, so a
+ *   white-label mail carries exactly one logo.
+ */
+export declare function renderLoadedSystemEmail(loaded: LoadedSystemEmail, merge?: Record<string, string>, options?: SystemEmailBrandOptions): RenderedSystemEmail | null;
+/**
+ * Renders the system email a key sends to one recipient (AGL-750): the
+ * published staff design, or the catalog's built-in copy (AGL-3322), in the
+ * header and footer of the brand it is sent under.
+ *
+ * **`null` only for a key that is unknown or not Resend-delivered**, which
+ * has nothing here to render. No template document, no published version, an
+ * empty node map and a Firestore failure all render the built-in copy — the
+ * same copy the editor seeds a first design with — so a missing, half-saved
+ * or broken template can never mean a customer receives no email, or a bare
+ * one. Every caller still keeps its own hard-coded copy behind this, as the
+ * last resort for a render that produced nothing.
+ *
+ * A single-recipient convenience over {@link loadSystemEmail} +
+ * {@link renderLoadedSystemEmail}; a batch should call those two directly so
+ * it reads the template once.
+ */
+export declare function renderSystemEmail(templateKey: string, merge?: Record<string, string>, options?: SystemEmailBrandOptions): Promise<RenderedSystemEmail | null>;
+/**
+ * The email a template sends right now, for the staff test-send endpoint
+ * (AGL-766): exactly what a real send of it renders — the published design,
+ * or the built-in copy, with the same header and footer — so a test shows
+ * what recipients receive. `null` for an unknown or non-Resend key.
+ */
+export declare function renderEffectiveSystemEmail(templateKey: string, merge?: Record<string, string>, options?: SystemEmailBrandOptions): Promise<RenderedSystemEmail | null>;
+/**
+ * The brand one system email is sent under (AGL-3367): the merge tokens, the
+ * chrome options and the sender name, from one place.
+ *
+ * `null` is the platform's own brand, and it is the answer for everything
+ * the platform says on its own behalf: a staff alert, a legal receipt, an
+ * enforcement notice. A workspace-context email passes the workspace's org
+ * document, and `resolveBrandingProfile` decides from there: a white-label
+ * org gets its own name, logo, home and support in the header and footer,
+ * and every other org resolves to the platform profile, so the same call is
+ * right for both.
+ */
+export interface SystemEmailBrand {
+    merge: Record<string, string>;
+    options: SystemEmailBrandOptions;
+    /** The display name to send under; absent sends under the platform's. */
+    fromName?: string;
+    /** The org's own name, for the `{{org.name}}` its copy may use. */
+    orgName?: string;
+}
+/** See {@link SystemEmailBrand}. */
+export declare function systemEmailBrand(org: Readonly<Record<string, unknown>> | null | undefined): SystemEmailBrand;
+/**
+ * {@link systemEmailBrand} for an org read by id, for a sender that holds
+ * only the id. A failed or missing read is the platform's brand: the email
+ * still goes, and a white-label org's people see the platform's chrome on
+ * one message rather than no message.
+ */
+export declare function orgSystemEmailBrand(orgId: string | null | undefined): Promise<SystemEmailBrand>;
+/** What a send takes from a rendered system email. */
+export interface SystemEmailContent {
+    subject: string;
+    text: string;
+    html?: string;
+}
+/**
+ * The subject, text and HTML to send, with the caller's own copy as the
+ * last resort for a render that produced nothing: the shape every sender of
+ * a system email repeats, written once.
+ */
+export declare function systemEmailContent(rendered: RenderedSystemEmail | null, fallback: {
+    subject: string;
+    text: string;
+}): SystemEmailContent;
+/**
+ * Renders a key for one recipient in a brand and returns what to send
+ * (AGL-3367): {@link renderSystemEmail} and {@link systemEmailContent} in
+ * one call, for the senders with one message to build. Never throws; a
+ * render that fails sends the fallback copy, which is what it sent before.
+ */
+export declare function renderSystemEmailContent(templateKey: string, merge: Record<string, string>, brand: SystemEmailBrand, fallback: {
+    subject: string;
+    text: string;
+}): Promise<SystemEmailContent>;
+export default renderSystemEmail;

package/src/lib/server/render-system-email.js

@@ -0,0 +1,315 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+var _process_env_NEXT_PUBLIC_CONSOLE_URL;
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { EMAIL_NODE_ROOT_ID, SYSTEM_EMAIL_COLLECTION, buildDefaultEmailNodeMap, getSystemEmailTemplate, renderEmailHtml, substituteMergeTokens } from "@aglyn/shared-util-email";
+import { firebaseAdmin } from "./firebase-admin.js";
+import { platformMarketingHostId } from "./platform-marketing-consent.js";
+import { brandMergeTokens, collectReferencedComponentIds, composeReusableComponentNodes, decodeStoredNodes, resolveBrandingProfile, sanitizeAuthorHtml } from "@aglyn/aglyn/server";
+import { hostComponentReader, loadReferencedComponents } from "@aglyn/aglyn/app-utils/load-referenced-components";
+import { PLATFORM_BRAND_MERGE_TOKENS, buildSystemEmailChrome, isPlatformBrandedSend } from "@aglyn/aglyn/app-utils/system-email-chrome";
+// Defined beside the chrome they decide, and re-exported for the callers and
+// specs that reach them through this module.
+export { isPlatformBrandedSend };
+/**
+ * Blanks any `{{token}}` the caller did not supply.
+ *
+ * `substituteMergeTokens` leaves unknown tokens untouched, which is right for
+ * campaigns (an author wants to see the tag they mistyped) but wrong here —
+ * a system email goes to a customer, and "You've been invited to
+ * {{org.name}}" is worse than a gap. Applied only in this resolver so
+ * campaign behaviour is unchanged.
+ */ function blankUnresolvedTokens(value) {
+    return value.replace(/\{\{[^}]*\}\}/g, '');
+}
+/**
+ * Origin a picked image in a system email is fetched from (AGL-1224).
+ *
+ * A system email is staff-designed and its media lives in the platform
+ * library, which the CONSOLE's `/api/media/cdn` route serves — the tenant app
+ * mounts the same route, but a recipient of an org invite has no site to
+ * resolve against. Same expression `app/layout.tsx` uses for the console's
+ * own canonical URL, so the two cannot drift per deploy.
+ */ const CONSOLE_ORIGIN = (_process_env_NEXT_PUBLIC_CONSOLE_URL = process.env.NEXT_PUBLIC_CONSOLE_URL) != null ? _process_env_NEXT_PUBLIC_CONSOLE_URL : 'https://app.aglyn.com';
+/**
+ * The email blocks a platform email places, read from the site that owns
+ * them (AGL-3318), or `undefined` when there is nothing to read or the read
+ * failed.
+ *
+ * WHICH SITE. A block is a reusable component, and a component belongs to a
+ * site; a platform email belongs to none. The header and footer Aglyn's own
+ * mail wears are the ones on its marketing site, which the deployment names
+ * in `PLATFORM_MARKETING_HOST_ID`, the setting product-email consent already
+ * reads. An install that names none reads nothing, and a block placed in its
+ * system emails renders as nothing.
+ *
+ * NEVER A REASON NOT TO SEND. A site's own email fails its whole load when a
+ * component read fails, and falls back to its built-in copy. Here the copy is
+ * staff's design and the blocks are another site's chrome, so a failed read
+ * costs the blocks and nothing else: it is logged, and the design renders
+ * inside the coded header and footer instead (see
+ * {@link renderLoadedSystemEmail}) rather than being traded for the built-in
+ * copy. A password reset whose header could not be read still carries its
+ * link.
+ */ async function loadPlatformEmailBlocks(firestore, templateKey, nodes) {
+    // A design that places nothing costs nothing: no setting read, no read.
+    if (!collectReferencedComponentIds(nodes).size) return undefined;
+    const hostId = platformMarketingHostId();
+    if (!hostId) return undefined;
+    try {
+        return await loadReferencedComponents(nodes, hostComponentReader(firestore, hostId), {
+            onSkipped: (skipped)=>console.warn(JSON.stringify({
+                    tag: 'AGL-3318:platform-email-blocks-skipped',
+                    templateKey,
+                    hostId,
+                    skipped
+                }))
+        });
+    } catch (error) {
+        console.error(`system email template ${templateKey}: its email blocks failed to load from ${hostId}`, error);
+        return undefined;
+    }
+}
+/**
+ * Whether one send draws the design's email blocks: a send under the
+ * platform's own brand (see {@link isPlatformBrandedSend}) of a design whose
+ * blocks the load could read. Every other send renders the stored nodes, each
+ * block a placement that draws nothing, inside the coded chrome.
+ */ function drawsPlatformBlocks(loaded, merged, options) {
+    return Boolean(loaded.components && Object.keys(loaded.components).length) && isPlatformBrandedSend(merged, options);
+}
+/**
+ * A key's built-in copy as a loaded email (AGL-3322): the node map the editor
+ * seeds a first design with, and the catalog subject. What a key sends until
+ * staff publish a design, and whenever the published one cannot be read.
+ */ function catalogDefault(definition) {
+    return {
+        definition,
+        nodes: buildDefaultEmailNodeMap(definition),
+        subjectTemplate: definition.defaultSubject,
+        preheaderTemplate: '',
+        source: 'default'
+    };
+}
+/**
+ * Loads what a key sends — ONE Firestore read — ready to render per
+ * recipient: the published staff design, or the catalog's built-in copy
+ * (AGL-3322) when there is none to use (no document, no published version,
+ * an empty node map, or a read failure).
+ *
+ * `null` only for a key that is unknown or not Resend-delivered, which has
+ * nothing here to render. Split out from {@link renderSystemEmail} so a batch
+ * send resolves the template once and renders it per recipient, rather than
+ * one read each (AGL-768): a Firestore read per invite is fine, one per
+ * recipient in a usage-email batch is not.
+ *
+ * Reads through the Admin SDK, which bypasses the staff-only rules on the
+ * collection — the send path runs as the server, not as a signed-in user.
+ *
+ * A design that places email blocks costs one more read per block, from the
+ * platform marketing site, made here with the template so a batch pays it
+ * once too (AGL-3318). Whether a recipient's copy expands them is decided per
+ * send, by {@link renderLoadedSystemEmail}.
+ */ export async function loadSystemEmail(templateKey) {
+    const definition = getSystemEmailTemplate(templateKey);
+    if (!definition) return null;
+    // A Firebase- or Stripe-delivered email is sent by that service from its
+    // own templates, so rendering one here would produce output nothing ever
+    // sends (AGL-767).
+    if (definition.deliveredBy !== 'resend') return null;
+    try {
+        var _templateSnapshot_get, _templateSnapshot_get1;
+        const firestore = firebaseAdmin.app().firestore();
+        const templateRef = firestore.collection(SYSTEM_EMAIL_COLLECTION).doc(templateKey);
+        const templateSnapshot = await templateRef.get();
+        if (!templateSnapshot.exists) return catalogDefault(definition);
+        const versionId = templateSnapshot.get('versionId');
+        // Cleared by "reset to default", which nulls the pointer rather than
+        // deleting the document so the audit trail survives.
+        if (!versionId) return catalogDefault(definition);
+        const versionSnapshot = await templateRef.collection('versions').doc(String(versionId)).get();
+        // BOTH stored forms (AGL-1223). The email besigner compresses like every
+        // other besigner document, and versions written before it did are still
+        // plain maps — `decodeStoredNodes` returns those unchanged.
+        //
+        // Reading raw is the failure the guard below cannot catch: over a
+        // `Buffer`, `Object.keys` counts BYTE INDICES, so the emptiness test
+        // passes and a staff-authored email renders empty rather than falling
+        // back to its built-in copy.
+        const nodes = decodeStoredNodes(versionSnapshot.get('nodes'));
+        if (!nodes || !Object.keys(nodes).length) return catalogDefault(definition);
+        const components = await loadPlatformEmailBlocks(firestore, templateKey, nodes);
+        return _extends({
+            definition,
+            nodes,
+            subjectTemplate: String((_templateSnapshot_get = templateSnapshot.get('subject')) != null ? _templateSnapshot_get : '') || definition.defaultSubject,
+            preheaderTemplate: String((_templateSnapshot_get1 = templateSnapshot.get('preheader')) != null ? _templateSnapshot_get1 : ''),
+            source: 'designed'
+        }, components && {
+            components
+        });
+    } catch (error) {
+        // Never let a template problem block the send, or strip it bare: the
+        // recipient gets the built-in copy, in the same header and footer.
+        console.error(`system email template ${templateKey} failed to load; sending its built-in copy`, error);
+        return catalogDefault(definition);
+    }
+}
+/**
+ * Renders a loaded email for one recipient's merge values (AGL-768). No
+ * Firestore access — call {@link loadSystemEmail} once, then this per
+ * recipient. `null` only if the renderer produced no document at all.
+ *
+ * Which header and footer it wears is decided here, per send, because one
+ * batch-loaded design goes to recipients of different brands:
+ *
+ * - A send under the platform's own brand of a design whose email blocks the
+ *   load read draws those blocks (AGL-3318), and nothing else: they ARE its
+ *   header and footer, and a second one around them would draw both.
+ * - Every other send is drawn inside {@link buildSystemEmailChrome}'s chrome
+ *   (AGL-3322): the built-in copy, which places no blocks; a design sent to a
+ *   white-label org's people, whose blocks stay unexpanded and draw nothing,
+ *   since they are the platform's; and a design on a deployment that names no
+ *   marketing site, or whose blocks could not be read. The chrome is in the
+ *   brand of the send — the org's email logo rides in its header, so a
+ *   white-label mail carries exactly one logo.
+ */ export function renderLoadedSystemEmail(loaded, merge = {}, options = {}) {
+    var _rendered_text;
+    const merged = _extends({}, PLATFORM_BRAND_MERGE_TOKENS, merge);
+    const blocks = drawsPlatformBlocks(loaded, merged, options);
+    const rendered = renderEmailHtml(_extends({
+        nodes: blocks ? composeReusableComponentNodes(loaded.nodes, loaded.components) : loaded.nodes,
+        // Besigner maps are rooted at '_@_', not renderEmailHtml's default
+        // 'root' — without this a designed template rendered empty and the send
+        // fell back to built-in copy, so designing did nothing (AGL-765).
+        rootId: EMAIL_NODE_ROOT_ID,
+        subject: substituteMergeTokens(loaded.subjectTemplate, merged),
+        preheader: substituteMergeTokens(loaded.preheaderTemplate, merged),
+        merge: merged,
+        // The same policy the console's own preview of these nodes applies —
+        // `sanitizeCustomHtml` in the email plugin delegates to this exact
+        // function, so what staff review and what the recipient receives are one
+        // function of one string rather than two that have to be kept in step.
+        sanitize: sanitizeAuthorHtml,
+        // Without this a staff-picked image resolves to a site-relative CDN path,
+        // which is a broken-image box in the recipient's inbox (AGL-1224). The
+        // chrome's logo resolves against it too.
+        mediaOrigin: CONSOLE_ORIGIN
+    }, blocks ? {} : {
+        chrome: buildSystemEmailChrome({
+            definition: loaded.definition,
+            merged,
+            brandLogoUrl: options.brandLogoUrl,
+            brandHomeUrl: options.brandHomeUrl
+        })
+    }));
+    if (!(rendered == null ? void 0 : rendered.html)) return null;
+    return {
+        subject: blankUnresolvedTokens(substituteMergeTokens(loaded.subjectTemplate, merged)),
+        html: blankUnresolvedTokens(rendered.html),
+        text: blankUnresolvedTokens((_rendered_text = rendered.text) != null ? _rendered_text : ''),
+        source: loaded.source
+    };
+}
+/**
+ * Renders the system email a key sends to one recipient (AGL-750): the
+ * published staff design, or the catalog's built-in copy (AGL-3322), in the
+ * header and footer of the brand it is sent under.
+ *
+ * **`null` only for a key that is unknown or not Resend-delivered**, which
+ * has nothing here to render. No template document, no published version, an
+ * empty node map and a Firestore failure all render the built-in copy — the
+ * same copy the editor seeds a first design with — so a missing, half-saved
+ * or broken template can never mean a customer receives no email, or a bare
+ * one. Every caller still keeps its own hard-coded copy behind this, as the
+ * last resort for a render that produced nothing.
+ *
+ * A single-recipient convenience over {@link loadSystemEmail} +
+ * {@link renderLoadedSystemEmail}; a batch should call those two directly so
+ * it reads the template once.
+ */ export async function renderSystemEmail(templateKey, merge = {}, options = {}) {
+    const loaded = await loadSystemEmail(templateKey);
+    return loaded ? renderLoadedSystemEmail(loaded, merge, options) : null;
+}
+/**
+ * The email a template sends right now, for the staff test-send endpoint
+ * (AGL-766): exactly what a real send of it renders — the published design,
+ * or the built-in copy, with the same header and footer — so a test shows
+ * what recipients receive. `null` for an unknown or non-Resend key.
+ */ export async function renderEffectiveSystemEmail(templateKey, merge = {}, options = {}) {
+    return renderSystemEmail(templateKey, merge, options);
+}
+/** See {@link SystemEmailBrand}. */ export function systemEmailBrand(org) {
+    if (!org) return {
+        merge: {},
+        options: {}
+    };
+    const branding = resolveBrandingProfile(org);
+    const orgName = typeof org['name'] === 'string' ? org['name'].trim() : '';
+    return _extends({}, orgName ? {
+        orgName
+    } : {}, {
+        merge: brandMergeTokens(branding),
+        options: {
+            brandLogoUrl: branding.emailLogoUrl,
+            brandHomeUrl: branding.homeUrl
+        },
+        fromName: branding.fromName
+    });
+}
+/**
+ * {@link systemEmailBrand} for an org read by id, for a sender that holds
+ * only the id. A failed or missing read is the platform's brand: the email
+ * still goes, and a white-label org's people see the platform's chrome on
+ * one message rather than no message.
+ */ export async function orgSystemEmailBrand(orgId) {
+    if (!orgId) return systemEmailBrand(null);
+    try {
+        var _snapshot_data;
+        const snapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(orgId).get();
+        return systemEmailBrand(snapshot.exists ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : null : null);
+    } catch (error) {
+        console.error(`system email brand for org ${orgId} failed to load`, error);
+        return systemEmailBrand(null);
+    }
+}
+/**
+ * The subject, text and HTML to send, with the caller's own copy as the
+ * last resort for a render that produced nothing: the shape every sender of
+ * a system email repeats, written once.
+ */ export function systemEmailContent(rendered, fallback) {
+    return _extends({
+        subject: (rendered == null ? void 0 : rendered.subject) || fallback.subject,
+        text: (rendered == null ? void 0 : rendered.text) || fallback.text
+    }, (rendered == null ? void 0 : rendered.html) ? {
+        html: rendered.html
+    } : {});
+}
+/**
+ * Renders a key for one recipient in a brand and returns what to send
+ * (AGL-3367): {@link renderSystemEmail} and {@link systemEmailContent} in
+ * one call, for the senders with one message to build. Never throws; a
+ * render that fails sends the fallback copy, which is what it sent before.
+ */ export async function renderSystemEmailContent(templateKey, merge, brand, fallback) {
+    const rendered = await renderSystemEmail(templateKey, _extends({}, brand.merge, merge), brand.options).catch((error)=>{
+        console.error(`system email ${templateKey} failed to render`, error);
+        return null;
+    });
+    return systemEmailContent(rendered, fallback);
+}
+export default renderSystemEmail;
+
+//# sourceMappingURL=render-system-email.js.map