@aglyn/tenant-data-admin 1.0.0-beta.203 → 1.0.0-beta.204

package/src/lib/server/risk-notice.js

@@ -0,0 +1,1240 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * notifyRiskEvent: ONE WAY TO TELL PEOPLE SOMETHING WAS HELD (AGL-3368).
+ *
+ * Every place the platform holds, flags, locks or pauses something on a
+ * workspace calls this, with the kind from the catalog
+ * (`@aglyn/shared-util-email/risk-notice-catalog`) and the facts it knows.
+ * This decides who hears, on which channel, and in which words:
+ *
+ * - THE WORKSPACE'S OWNERS AND ADMINS (the org roster's `owner`/`admin`
+ *   roles, the audience `notifyOrgAdmins` reaches), plus — for a kind about
+ *   one site's sales or pages — the site's managers, the audience
+ *   `notifyHostManagers` reaches and the one a sale's fraud signal always
+ *   went to. An account lock goes to the account's own person instead.
+ *   They get an in-app notification (`system.riskNotice`) and, for every
+ *   kind the catalog marks `emailOwners`, an email.
+ * - STAFF, through `notifyStaff`, for the kinds the catalog marks
+ *   `alertStaff`. A row-backed alert links the row itself.
+ *
+ * ## The owner email is account mail from the platform
+ *
+ * It is sent with no sending identity and no `audience: 'tenant'`, so it
+ * leaves on the platform's own configured sender — never the workspace's.
+ * That is what lets a LOCKED workspace's owners receive their lock notice:
+ * a suspended workspace's own identity refuses every send
+ * (`workspace-suspended`), but this mail is not the workspace's. It is
+ * `owedFor: 'account'`, carries no marketing context, and ignores
+ * notification preferences: the owner did not opt into it and cannot opt
+ * out of being told their email was held. The tenant phishing screen never
+ * sees it — that screen asks only about a site's mail.
+ *
+ * ## One notice per event, and a digest under a burst
+ *
+ * A notice's id is a hash of its dedupe key (by default the kind and the
+ * abuse-queue row), created once — so a redelivered webhook or a re-held
+ * message never tells anyone twice, on top of the one-alert-per-row rule
+ * the row writers already keep.
+ *
+ * Past {@link RISK_NOTICE_BURST.owners} notices in an hour for one
+ * workspace (and {@link RISK_NOTICE_BURST.staff} for staff), further notices
+ * are recorded but not delivered one by one. The first one folded sends a
+ * short "more are arriving" note in-app; when the hour closes,
+ * {@link flushRiskNoticeDigests} (hourly cron, and the next notice after the
+ * window) sends ONE summary. A workspace under attack gets a digest, not
+ * five hundred emails. Locks, lifts and cancellations (`neverDigest`) always
+ * go out on their own.
+ *
+ * ## Never throws
+ *
+ * Every caller is a write that has already happened — a hold, a lock, a
+ * webhook. A failed notice is reported in the result (the lockdown route
+ * shows it as an unconfirmed step) and logged; it never undoes the event.
+ *=========================================*/ import { createHash } from "crypto";
+import { ABUSE_REPORT_COLLECTION, abuseReportContactEmail } from "@aglyn/aglyn/app-utils/abuse-report";
+import { DOCS_BASE_URL } from "@aglyn/aglyn/app-utils/docs-help";
+import { isRiskEventKind, renderOwnerRiskNotice, renderRiskNoticeText, renderStaffRiskNotice, resolveOwnerRiskActions, RISK_NOTICE_CATALOG, RISK_NOTICE_CLOSING_KINDS, RISK_NOTICE_DIGEST_EMAIL_KEY, RISK_NOTICE_HELP_PATH, RISK_NOTICE_WORKSPACE_BRANDED, riskNoticeEmailKey } from "@aglyn/shared-util-email/risk-notice-catalog";
+import { sendEmail as sendEmailImpl } from "@aglyn/shared-util-email";
+import { heldPageDetails, heldPageLabel, heldPageTargets, heldPageVisitorSentence, isOpenPageHoldStatus, isPageHoldNoticeKind, PAGE_HOLD_NOTICE_KINDS, pageHoldChip, parseHeldPageItemPath } from "@aglyn/shared-util-email/held-page";
+import { FieldValue } from "firebase-admin/firestore";
+import { findUserByUidAcrossPools } from "./auth-pools.js";
+import firebaseAdmin from "./firebase-admin.js";
+import { notifyStaff as notifyStaffImpl, notifyUsers as notifyUsersImpl } from "./notifications.js";
+import { meterPlatformEmail } from "./email-metering.js";
+import { listOrgMembers } from "./organizations.js";
+import { orgSystemEmailBrand, renderSystemEmailContent, systemEmailBrand } from "./render-system-email.js";
+import { RISK_REVIEW_REQUESTED_EMAIL_KEY } from "@aglyn/shared-util-email/risk-notice-emails";
+/** Admin-SDK only; no client rule opens it. One document per notice. */ export const RISK_NOTICE_COLLECTION = 'riskNotices';
+/** Admin-SDK only: each workspace's burst window and folded notices. */ export const RISK_NOTICE_LEDGER_COLLECTION = 'riskNoticeLedger';
+/** The in-app notification type every owner notice is written as. */ export const RISK_NOTICE_NOTIFICATION_TYPE = 'system.riskNotice';
+/**
+ * The burst allowance: how many notices one workspace's owners, and staff
+ * about one workspace, receive one by one in {@link RISK_NOTICE_BURST.windowMs}
+ * before the rest are folded into a digest.
+ */ export const RISK_NOTICE_BURST = {
+    owners: 5,
+    staff: 10,
+    windowMs: 60 * 60 * 1000,
+    /** How many folded notices a digest lists by name. */ digestListMax: 25
+};
+/** Longest review-request note stored. */ export const RISK_REVIEW_NOTE_MAX = 2000;
+/** How many review requests one row keeps. */ export const RISK_REVIEW_REQUESTS_MAX = 20;
+/** How soon the same workspace may ask again about the same row. */ export const RISK_REVIEW_REQUEST_COOLDOWN_MS = 10 * 60 * 1000;
+async function defaultListOwners(orgId) {
+    const members = await listOrgMembers(orgId);
+    return members.filter((member)=>member.role === 'owner' || member.role === 'admin').map((member)=>{
+        var _member_email;
+        return {
+            uid: String(member.$id),
+            email: (_member_email = member.email) != null ? _member_email : null
+        };
+    });
+}
+async function defaultLookupEmail(uid) {
+    var _ref;
+    var _found_record;
+    const found = await findUserByUidAcrossPools(uid).catch(()=>null);
+    const email = String((_ref = found == null ? void 0 : (_found_record = found.record) == null ? void 0 : _found_record.email) != null ? _ref : '').trim();
+    return email.includes('@') ? email : null;
+}
+function resolveDeps(overrides = {}) {
+    var _overrides_firestore, _overrides_sendEmail, _overrides_notifyUsers, _overrides_notifyStaff, _overrides_listOwners, _overrides_lookupEmail, _overrides_nowMs;
+    return {
+        firestore: (_overrides_firestore = overrides.firestore) != null ? _overrides_firestore : firebaseAdmin.app().firestore(),
+        sendEmail: (_overrides_sendEmail = overrides.sendEmail) != null ? _overrides_sendEmail : sendEmailImpl,
+        notifyUsers: (_overrides_notifyUsers = overrides.notifyUsers) != null ? _overrides_notifyUsers : notifyUsersImpl,
+        notifyStaff: (_overrides_notifyStaff = overrides.notifyStaff) != null ? _overrides_notifyStaff : notifyStaffImpl,
+        listOwners: (_overrides_listOwners = overrides.listOwners) != null ? _overrides_listOwners : defaultListOwners,
+        lookupEmail: (_overrides_lookupEmail = overrides.lookupEmail) != null ? _overrides_lookupEmail : defaultLookupEmail,
+        nowMs: (_overrides_nowMs = overrides.nowMs) != null ? _overrides_nowMs : ()=>Date.now()
+    };
+}
+function consoleOrigin() {
+    var _process_env_NEXT_PUBLIC_CONSOLE_URL;
+    return ((_process_env_NEXT_PUBLIC_CONSOLE_URL = process.env.NEXT_PUBLIC_CONSOLE_URL) != null ? _process_env_NEXT_PUBLIC_CONSOLE_URL : '').trim().replace(/\/+$/, '');
+}
+/** The help page every notice links, on the docs site. */ export function riskNoticeHelpUrl(anchor) {
+    return `${DOCS_BASE_URL.replace(/\/+$/, '')}${RISK_NOTICE_HELP_PATH}${anchor ? `#${anchor}` : ''}`;
+}
+/** `Sep 28, 2026, 16:31 UTC` — one format for every notice. */ export function formatRiskNoticeTime(ms) {
+    const date = new Date(ms);
+    if (!Number.isFinite(date.getTime())) return '';
+    return `${date.toLocaleString('en-US', {
+        month: 'short',
+        day: 'numeric',
+        year: 'numeric',
+        hour: '2-digit',
+        minute: '2-digit',
+        hour12: false,
+        timeZone: 'UTC'
+    })} UTC`;
+}
+/** The id of the notice a dedupe key names: hex, like the abuse queue's. */ export function riskNoticeId(dedupeKey) {
+    return createHash('sha256').update(`risk-notice:${dedupeKey}`).digest('hex').slice(0, 40);
+}
+/** The default dedupe key: one notice per kind per row, else per event. */ export function riskNoticeDedupeKey(input, occurredAtMs) {
+    var _input_orgId, _input_hostId, _input_userUid, _ref, _ref1;
+    var _input_item, _input_item1;
+    if (input.dedupeKey) return input.dedupeKey;
+    if (input.reviewId) return `${input.kind}:${input.reviewId}`;
+    return [
+        input.kind,
+        (_input_orgId = input.orgId) != null ? _input_orgId : '',
+        (_input_hostId = input.hostId) != null ? _input_hostId : '',
+        (_input_userUid = input.userUid) != null ? _input_userUid : '',
+        (_ref = (_ref1 = (_input_item = input.item) == null ? void 0 : _input_item.path) != null ? _ref1 : (_input_item1 = input.item) == null ? void 0 : _input_item1.label) != null ? _ref : '',
+        String(occurredAtMs)
+    ].join(':');
+}
+/** The ledger a notice's burst allowance is counted on. */ function ledgerIdFor(input) {
+    if (input.orgId) return `org:${input.orgId}`;
+    if (input.userUid) return `user:${input.userUid}`;
+    if (input.hostId) return `host:${input.hostId}`;
+    return null;
+}
+/** The console path an owner's Holds & reviews page is at, in stored shape. */ export function riskHoldsPath(noticeId) {
+    return `/org/settings/holds${noticeId ? `?notice=${encodeURIComponent(noticeId)}` : ''}`;
+}
+/** A staff deep link to one abuse-queue row. */ export function staffAbuseRowPath(reviewId) {
+    return `/admin/abuse-reports?report=${encodeURIComponent(reviewId)}`;
+}
+/** Absolute, for an email: the console origin before a stored path. */ function absolute(path) {
+    if (!path) return '';
+    if (/^https?:\/\//.test(path)) return path;
+    const origin = consoleOrigin();
+    return origin ? `${origin}${path}` : '';
+}
+/**
+ * The stored-shape console links resolve per reader in the console
+ * (`normalizeNotificationLink`); an EMAIL has no reader context, so its
+ * links are rewritten here from the org slug and the site's subdomain.
+ */ function emailPath(path, context) {
+    if (/^https?:\/\//.test(path)) return path;
+    if (path.startsWith('/admin/') || path.startsWith('/manage/')) return path;
+    if (path === '/org' || path.startsWith('/org/') || path.startsWith('/org?')) {
+        return context.orgSlug ? `/${context.orgSlug}${path.slice(4)}` : null;
+    }
+    if (context.hostId && (path === `/${context.hostId}` || path.startsWith(`/${context.hostId}/`) || path.startsWith(`/${context.hostId}?`))) {
+        return context.orgSlug && context.hostSubdomain ? `/${context.orgSlug}/hosts/${context.hostSubdomain}${path.slice(context.hostId.length + 1)}` : null;
+    }
+    return path;
+}
+/**
+ * Stored-shape site paths (`/{hostId}/…`) as console routes, for a reader
+ * with no org context of its own — staff reading the abuse queue
+ * (AGL-3374). One read of the sites and one of their workspaces for the
+ * whole batch; a path that cannot be resolved is left out.
+ */ export async function resolveHostConsolePaths(firestore, entries) {
+    const resolved = new Map();
+    const hostIds = [
+        ...new Set(entries.map((entry)=>entry.hostId).filter(Boolean))
+    ];
+    if (!hostIds.length) return resolved;
+    const hosts = await firestore.getAll(...hostIds.map((id)=>firestore.collection('hosts').doc(id)));
+    const hostFacts = new Map(hosts.map((host)=>{
+        var _host_get, _host_get1;
+        return [
+            host.id,
+            {
+                subdomain: String((_host_get = host.get('subdomain')) != null ? _host_get : '') || null,
+                orgId: String((_host_get1 = host.get('orgId')) != null ? _host_get1 : '') || null
+            }
+        ];
+    }));
+    // The row names its workspace; a site document may too.
+    const orgOf = (entry)=>{
+        var _hostFacts_get;
+        return entry.orgId || ((_hostFacts_get = hostFacts.get(entry.hostId)) == null ? void 0 : _hostFacts_get.orgId) || null;
+    };
+    const orgIds = [
+        ...new Set(entries.map(orgOf).filter(Boolean))
+    ];
+    const orgs = orgIds.length ? await firestore.getAll(...orgIds.map((id)=>firestore.collection('orgs').doc(id))) : [];
+    const slugs = new Map(orgs.map((org)=>{
+        var _org_get;
+        return [
+            org.id,
+            String((_org_get = org.get('slug')) != null ? _org_get : '') || null
+        ];
+    }));
+    for (const entry of entries){
+        var _slugs_get, _ref;
+        const facts = hostFacts.get(entry.hostId);
+        const orgId = orgOf(entry);
+        const href = emailPath(entry.path, {
+            orgSlug: orgId ? (_slugs_get = slugs.get(orgId)) != null ? _slugs_get : null : null,
+            hostId: entry.hostId,
+            hostSubdomain: (_ref = facts == null ? void 0 : facts.subdomain) != null ? _ref : null
+        });
+        if (href && href !== entry.path) resolved.set(`${entry.hostId}\n${entry.path}`, href);
+    }
+    return resolved;
+}
+/** The workspace facts every notice renders with. Never throws. */ async function readContext(firestore, input) {
+    var _input_orgId;
+    let orgId = (_input_orgId = input.orgId) != null ? _input_orgId : null;
+    let hostSubdomain = null;
+    let siteManagerUids = [];
+    if (input.hostId) {
+        const host = await firestore.collection('hosts').doc(input.hostId).get().catch(()=>null);
+        if (host == null ? void 0 : host.exists) {
+            var _host_get, _host_get1, _host_get2;
+            hostSubdomain = String((_host_get = host.get('subdomain')) != null ? _host_get : '') || null;
+            orgId = orgId != null ? orgId : String((_host_get1 = host.get('orgId')) != null ? _host_get1 : '') || null;
+            const roles = (_host_get2 = host.get('memberRoles')) != null ? _host_get2 : {};
+            siteManagerUids = Object.entries(roles).filter(([, role])=>role === 'admin' || role === 'editor').map(([uid])=>uid);
+        }
+    }
+    let orgName = null;
+    let orgSlug = null;
+    if (orgId) {
+        const org = await firestore.collection('orgs').doc(orgId).get().catch(()=>null);
+        if (org == null ? void 0 : org.exists) {
+            var _org_get, _org_get1;
+            orgName = String((_org_get = org.get('name')) != null ? _org_get : '') || null;
+            orgSlug = String((_org_get1 = org.get('slug')) != null ? _org_get1 : '') || null;
+        }
+    }
+    return {
+        orgId,
+        orgName,
+        orgSlug,
+        hostSubdomain,
+        siteManagerUids
+    };
+}
+/**
+ * The brand a kind's email is sent in: the workspace's own for a routine
+ * notice about its customers' payments, the platform's for everything the
+ * platform does (holds, locks, lifts, cancellations, reviews).
+ */ export async function riskNoticeEmailBrand(kind, orgId) {
+    return kind && RISK_NOTICE_WORKSPACE_BRANDED.has(kind) ? orgSystemEmailBrand(orgId) : systemEmailBrand(null);
+}
+/**
+ * Renders one notice email through the System emails seam (AGL-3367): the
+ * published design for the kind's own `risk-…` key, or its built-in copy,
+ * inside the header and footer every platform email wears. The plain-text
+ * composition below is the last resort for a render that produced nothing.
+ * ONE function, so every notice renders the same way.
+ */ export async function renderRiskNoticeEmail(key, merge, brand = systemEmailBrand(null)) {
+    const content = await renderSystemEmailContent(key, merge, brand, riskNoticeFallback(merge)).catch(()=>riskNoticeFallback(merge));
+    return _extends({
+        key
+    }, content, brand.fromName ? {
+        fromName: brand.fromName
+    } : {});
+}
+/** The notice as plain text, when no design renders. */ function riskNoticeFallback(merge) {
+    var _merge_noticetitle;
+    const lines = [
+        merge['notice.summary'],
+        merge['notice.meaning'],
+        merge['notice.steps'] ? `What to do next:\n${merge['notice.steps']}` : '',
+        merge['notice.actions'],
+        merge['reference'] ? `Reference: ${merge['reference']}` : '',
+        merge['help.url'] ? `Why was something held or flagged? ${merge['help.url']}` : ''
+    ].filter((line)=>Boolean(line && line.trim()));
+    return {
+        subject: (_merge_noticetitle = merge['notice.title']) != null ? _merge_noticetitle : '',
+        text: lines.join('\n\n')
+    };
+}
+function numbered(steps) {
+    return steps.map((step, index)=>`${index + 1}. ${step}`).join('\n');
+}
+function emptyDelivery(skipped = null) {
+    return {
+        recipients: 0,
+        inApp: 0,
+        emailed: 0,
+        emailFailed: 0,
+        emailSkipped: skipped,
+        digested: false
+    };
+}
+/**
+ * Count this notice against its workspace's hour and say whether it is
+ * delivered now. Fails OPEN: a ledger that cannot be written never costs a
+ * notice.
+ */ async function countBurst(deps, ledgerId, entry) {
+    const nowMs = deps.nowMs();
+    const ref = deps.firestore.collection(RISK_NOTICE_LEDGER_COLLECTION).doc(ledgerId);
+    try {
+        return await deps.firestore.runTransaction(async (transaction)=>{
+            var _snapshot_get, _snapshot_get1, _snapshot_get2;
+            const snapshot = await transaction.get(ref);
+            const startedAtMs = Number((_snapshot_get = snapshot.get('windowStartedAtMs')) != null ? _snapshot_get : 0);
+            const fresh = !startedAtMs || nowMs - startedAtMs >= RISK_NOTICE_BURST.windowMs;
+            const ownerCount = (fresh ? 0 : Number((_snapshot_get1 = snapshot.get('ownerCount')) != null ? _snapshot_get1 : 0)) + 1;
+            const staffCount = (fresh ? 0 : Number((_snapshot_get2 = snapshot.get('staffCount')) != null ? _snapshot_get2 : 0)) + (entry.alertStaff ? 1 : 0);
+            const owners = ownerCount <= RISK_NOTICE_BURST.owners ? 'deliver' : ownerCount === RISK_NOTICE_BURST.owners + 1 ? 'fold-first' : 'fold';
+            const staff = staffCount <= RISK_NOTICE_BURST.staff ? 'deliver' : 'fold';
+            const pendingOwners = Array.isArray(snapshot.get('pendingOwners')) ? snapshot.get('pendingOwners') : [];
+            const pendingStaff = Array.isArray(snapshot.get('pendingStaff')) ? snapshot.get('pendingStaff') : [];
+            // How many of each notice were folded, however many the list keeps.
+            const tally = (field, title)=>{
+                var _snapshot_get, _current_title;
+                const current = (_snapshot_get = snapshot.get(field)) != null ? _snapshot_get : {};
+                return _extends({}, current, {
+                    [title]: Number((_current_title = current[title]) != null ? _current_title : 0) + 1
+                });
+            };
+            transaction.set(ref, _extends({
+                ledgerId
+            }, fresh ? {
+                windowStartedAtMs: nowMs
+            } : {}, {
+                ownerCount,
+                staffCount
+            }, owners !== 'deliver' ? {
+                pendingOwners: [
+                    ...pendingOwners,
+                    {
+                        kind: entry.kind,
+                        title: entry.title,
+                        noticeId: entry.noticeId,
+                        atMs: nowMs
+                    }
+                ].slice(-RISK_NOTICE_BURST.digestListMax),
+                pendingOwnerTally: tally('pendingOwnerTally', entry.title),
+                pendingOwnerCount: FieldValue.increment(1)
+            } : {}, entry.alertStaff && staff !== 'deliver' ? {
+                pendingStaff: [
+                    ...pendingStaff,
+                    {
+                        kind: entry.kind,
+                        title: entry.staffTitle,
+                        noticeId: entry.noticeId,
+                        atMs: nowMs
+                    }
+                ].slice(-RISK_NOTICE_BURST.digestListMax),
+                pendingStaffTally: tally('pendingStaffTally', entry.staffTitle),
+                pendingStaffCount: FieldValue.increment(1)
+            } : {}, {
+                updatedAtMs: nowMs
+            }), {
+                merge: true
+            });
+            return {
+                owners,
+                staff
+            };
+        });
+    } catch (error) {
+        console.error('[risk-notice] burst ledger unavailable — delivering', error);
+        return {
+            owners: 'deliver',
+            staff: 'deliver'
+        };
+    }
+}
+/** Where the owner half goes: uids, and the addresses already in hand. */ async function ownerRecipients(deps, input, siteManagerUids) {
+    const emails = {};
+    const uids = new Set();
+    const definition = RISK_NOTICE_CATALOG[input.kind];
+    if (input.recipients) {
+        for (const recipient of input.recipients){
+            if (!recipient.uid) continue;
+            uids.add(recipient.uid);
+            if (recipient.email) emails[recipient.uid] = recipient.email;
+        }
+        return {
+            uids: [
+                ...uids
+            ],
+            emails
+        };
+    }
+    if (input.kind === 'account-locked' || input.kind === 'account-unlocked') {
+        if (input.userUid) uids.add(input.userUid);
+    } else if (input.orgId) {
+        const owners = await deps.listOwners(input.orgId).catch(()=>[]);
+        for (const owner of owners){
+            uids.add(owner.uid);
+            if (owner.email) emails[owner.uid] = owner.email;
+        }
+    }
+    if (definition.includeSiteManagers) for (const uid of siteManagerUids)uids.add(uid);
+    return {
+        uids: [
+            ...uids
+        ],
+        emails
+    };
+}
+/**
+ * Tell the right people about one risk event. See the module header.
+ * Never throws.
+ */ export async function notifyRiskEvent(input, overrides = {}) {
+    const result = {
+        noticeId: null,
+        duplicate: false,
+        owners: emptyDelivery(),
+        staff: {
+            alerted: false,
+            digested: false
+        },
+        error: null
+    };
+    if (!isRiskEventKind(input == null ? void 0 : input.kind)) {
+        result.error = `Unknown risk event kind: ${String(input == null ? void 0 : input.kind)}`;
+        return result;
+    }
+    let deps;
+    try {
+        deps = resolveDeps(overrides);
+    } catch (error) {
+        var _ref;
+        result.error = (_ref = error == null ? void 0 : error.message) != null ? _ref : String(error);
+        return result;
+    }
+    const definition = RISK_NOTICE_CATALOG[input.kind];
+    const nowMs = deps.nowMs();
+    const occurredAtMs = Number.isFinite(input.occurredAtMs) ? Number(input.occurredAtMs) : nowMs;
+    const noticeId = riskNoticeId(riskNoticeDedupeKey(input, occurredAtMs));
+    result.noticeId = noticeId;
+    try {
+        var _abuseReportContactEmail, _ref1, _input_reference, _ref2, _ref3, _input_amount, _context_orgName, _input_staffEvidence, _ref4, _input_reviewId, _input_hostId, _input_stripeUrl, _ref5, _ref6, _ownerActions_find;
+        var _input_item, _input_lock, _input_lock1, _input_item1, _input_lock2, _input_lock3;
+        const context = await readContext(deps.firestore, input);
+        const orgId = context.orgId;
+        const event = _extends({}, input, {
+            orgId
+        });
+        /*
+     * The values the OWNER half renders with. `staff.evidence` is absent by
+     * construction: the owner record and the owner channels never hold it.
+     */ const supportEmail = (_abuseReportContactEmail = abuseReportContactEmail('support')) != null ? _abuseReportContactEmail : '';
+        const ownerValues = {
+            'workspace.name': context.orgName,
+            'item.label': (_ref1 = (_input_item = input.item) == null ? void 0 : _input_item.label) != null ? _ref1 : null,
+            occurredAt: formatRiskNoticeTime(occurredAtMs),
+            reference: (_input_reference = input.reference) != null ? _input_reference : null,
+            'support.email': supportEmail || null,
+            'lock.message': (_ref2 = (_input_lock = input.lock) == null ? void 0 : _input_lock.message) != null ? _ref2 : null,
+            'lock.affected': (_ref3 = (_input_lock1 = input.lock) == null ? void 0 : _input_lock1.affected) != null ? _ref3 : null,
+            amount: (_input_amount = input.amount) != null ? _input_amount : null,
+            'evidence.dueBy': input.evidenceDueByMs ? formatRiskNoticeTime(input.evidenceDueByMs) : null
+        };
+        const staffValues = _extends({}, ownerValues, {
+            'workspace.name': (_context_orgName = context.orgName) != null ? _context_orgName : orgId,
+            'staff.evidence': (_input_staffEvidence = input.staffEvidence) != null ? _input_staffEvidence : null
+        });
+        const actionParams = {
+            itemPath: (_ref4 = (_input_item1 = input.item) == null ? void 0 : _input_item1.path) != null ? _ref4 : null,
+            noticeId,
+            reviewId: (_input_reviewId = input.reviewId) != null ? _input_reviewId : null,
+            orgId,
+            hostId: (_input_hostId = input.hostId) != null ? _input_hostId : null,
+            stripeUrl: (_input_stripeUrl = input.stripeUrl) != null ? _input_stripeUrl : null,
+            lockScope: (_ref5 = (_input_lock2 = input.lock) == null ? void 0 : _input_lock2.scope) != null ? _ref5 : null,
+            lockTargetId: (_ref6 = (_input_lock3 = input.lock) == null ? void 0 : _input_lock3.targetId) != null ? _ref6 : null
+        };
+        const owner = renderOwnerRiskNotice(input.kind, ownerValues);
+        const staff = renderStaffRiskNotice(input.kind, staffValues);
+        // ONE notice per dedupe key: `create` refuses a second.
+        const noticeRef = deps.firestore.collection(RISK_NOTICE_COLLECTION).doc(noticeId);
+        try {
+            var _input_hostId1, _input_userUid, _input_reviewId1, _input_reference1;
+            await noticeRef.create(_extends({
+                kind: input.kind,
+                severity: definition.severity,
+                orgId,
+                hostId: (_input_hostId1 = input.hostId) != null ? _input_hostId1 : null,
+                userUid: (_input_userUid = input.userUid) != null ? _input_userUid : null,
+                reviewId: (_input_reviewId1 = input.reviewId) != null ? _input_reviewId1 : null,
+                reference: (_input_reference1 = input.reference) != null ? _input_reference1 : null,
+                // What the owner surface renders, and nothing staff-only.
+                ownerValues: stripEmpty(ownerValues),
+                actionParams: stripEmpty(actionParams),
+                occurredAtMs,
+                createdAtMs: nowMs,
+                createdAt: FieldValue.serverTimestamp()
+            }, input.page ? {
+                page: input.page
+            } : {}));
+        } catch (error) {
+            if (isAlreadyExists(error)) {
+                result.duplicate = true;
+                return result;
+            }
+            throw error;
+        }
+        // A row-backed notice stamps the row, so the staff queue renders the
+        // catalog's text and actions and the owner surface finds the row.
+        if (input.reviewId && !RISK_NOTICE_CLOSING_KINDS.has(input.kind)) {
+            var _ref7, _ref8, _input_stripeUrl1;
+            var _input_item2, _input_item3;
+            await deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(input.reviewId).set({
+                riskNotice: {
+                    kind: input.kind,
+                    noticeId,
+                    itemLabel: (_ref7 = (_input_item2 = input.item) == null ? void 0 : _input_item2.label) != null ? _ref7 : null,
+                    itemPath: (_ref8 = (_input_item3 = input.item) == null ? void 0 : _input_item3.path) != null ? _ref8 : null,
+                    stripeUrl: (_input_stripeUrl1 = input.stripeUrl) != null ? _input_stripeUrl1 : null,
+                    ownersNotifiedAtMs: nowMs
+                }
+            }, {
+                merge: true
+            }).catch((error)=>console.error('[risk-notice] could not stamp the abuse row', error));
+        }
+        // Anything folded in an hour that has now closed goes first.
+        const ledgerId = ledgerIdFor(event);
+        if (ledgerId) await flushLedger(deps, ledgerId).catch(()=>undefined);
+        const verdict = definition.neverDigest || !ledgerId ? {
+            owners: 'deliver',
+            staff: 'deliver'
+        } : await countBurst(deps, ledgerId, {
+            kind: input.kind,
+            title: owner.title,
+            staffTitle: staff.title,
+            noticeId,
+            alertStaff: definition.alertStaff
+        });
+        // ---- The owners and admins ----
+        const recipients = await ownerRecipients(deps, event, context.siteManagerUids);
+        result.owners.recipients = recipients.uids.length;
+        const ownerActions = resolveOwnerRiskActions(input.kind, actionParams);
+        const primary = (_ownerActions_find = ownerActions.find((action)=>action.id === 'request-review')) != null ? _ownerActions_find : ownerActions[0];
+        if (verdict.owners === 'deliver') {
+            if (recipients.uids.length) {
+                var _ref9;
+                await deps.notifyUsers(recipients.uids, _extends({
+                    type: RISK_NOTICE_NOTIFICATION_TYPE,
+                    title: owner.title,
+                    body: `${owner.summary} ${owner.meaning}`.slice(0, 1000),
+                    link: (_ref9 = primary == null ? void 0 : primary.href) != null ? _ref9 : riskHoldsPath(noticeId)
+                }, orgId ? {
+                    orgId
+                } : {}, input.hostId ? {
+                    hostId: input.hostId
+                } : {}), {
+                    emails: recipients.emails
+                });
+                result.owners.inApp = recipients.uids.length;
+            }
+            if (!definition.emailOwners) {
+                result.owners.emailSkipped = 'This kind is not emailed.';
+            } else if (input.emailOwners === false) {
+                result.owners.emailSkipped = 'Staff chose not to email the owners for this event.';
+            } else if (!recipients.uids.length) {
+                result.owners.emailSkipped = 'Nobody to email: the workspace has no owner or admin on record.';
+            } else {
+                var _input_hostId2, _input_reference2, _ref10;
+                var _input_lock4;
+                const merge = emailMerge({
+                    title: owner.title,
+                    summary: owner.summary,
+                    meaning: owner.meaning,
+                    steps: owner.steps,
+                    actions: ownerActions,
+                    context: {
+                        orgSlug: context.orgSlug,
+                        hostId: (_input_hostId2 = input.hostId) != null ? _input_hostId2 : null,
+                        hostSubdomain: context.hostSubdomain
+                    },
+                    reference: (_input_reference2 = input.reference) != null ? _input_reference2 : null,
+                    helpAnchor: definition.helpAnchor,
+                    workspaceName: context.orgName,
+                    lockMessage: (_ref10 = (_input_lock4 = input.lock) == null ? void 0 : _input_lock4.message) != null ? _ref10 : null
+                });
+                const rendered = await renderRiskNoticeEmail(riskNoticeEmailKey(input.kind), merge, await riskNoticeEmailBrand(input.kind, orgId));
+                const delivery = await emailPeople(deps, recipients, rendered, supportEmail);
+                result.owners.emailed = delivery.sent;
+                result.owners.emailFailed = delivery.failed;
+                if (!delivery.sent && !delivery.failed) {
+                    result.owners.emailSkipped = 'No recipient has an email address on record.';
+                }
+            }
+        } else {
+            result.owners.digested = true;
+            if (verdict.owners === 'fold-first' && recipients.uids.length) {
+                await deps.notifyUsers(recipients.uids, _extends({
+                    type: RISK_NOTICE_NOTIFICATION_TYPE,
+                    title: 'More account notices are arriving',
+                    body: 'Several items on your workspace were held or flagged in the last hour. ' + 'We will send one summary instead of a message for each. Every item is listed on Holds & reviews.',
+                    link: riskHoldsPath()
+                }, orgId ? {
+                    orgId
+                } : {}), {
+                    emails: recipients.emails
+                });
+                result.owners.inApp = recipients.uids.length;
+            }
+        }
+        // ---- Staff ----
+        if (definition.alertStaff) {
+            if (verdict.staff === 'deliver') {
+                await deps.notifyStaff({
+                    type: 'system.abuseReportUrgent',
+                    title: staff.title,
+                    body: staff.summary.slice(0, 1000),
+                    link: input.reviewId ? staffAbuseRowPath(input.reviewId) : '/admin/abuse-reports'
+                });
+                result.staff.alerted = true;
+            } else {
+                result.staff.digested = true;
+            }
+        }
+        await noticeRef.set({
+            delivery: {
+                owners: result.owners,
+                staff: result.staff
+            }
+        }, {
+            merge: true
+        }).catch(()=>undefined);
+        return result;
+    } catch (error) {
+        var _ref11;
+        console.error('[risk-notice] a notice could not be delivered', error);
+        result.error = (_ref11 = error == null ? void 0 : error.message) != null ? _ref11 : String(error);
+        return result;
+    }
+}
+function stripEmpty(values) {
+    const out = {};
+    for (const [key, value] of Object.entries(values)){
+        if (typeof value === 'string' && value) out[key] = value;
+    }
+    return out;
+}
+function isAlreadyExists(error) {
+    const code = error == null ? void 0 : error.code;
+    return code === 6 || code === 'already-exists' || code === 'ALREADY_EXISTS';
+}
+/** The flat merge map a notice email renders with. */ function emailMerge(input) {
+    var _links_find, _ref, _ref1, _input_workspaceName, _input_lockMessage, _input_reference;
+    const links = input.actions.flatMap((action)=>{
+        const path = emailPath(action.href, input.context);
+        const url = path ? absolute(path) : '';
+        return url ? [
+            {
+                label: action.label,
+                url
+            }
+        ] : [];
+    });
+    const primary = (_links_find = links.find((link)=>link.label === 'Request a review')) != null ? _links_find : links[0];
+    const holdsPath = emailPath(riskHoldsPath(), input.context);
+    return {
+        'notice.title': input.title,
+        'notice.summary': input.summary,
+        'notice.meaning': input.meaning,
+        'notice.steps': numbered(input.steps),
+        'notice.actions': links.map((link)=>`${link.label}: ${link.url}`).join('\n'),
+        'notice.primaryActionLabel': (_ref = primary == null ? void 0 : primary.label) != null ? _ref : '',
+        'notice.primaryActionUrl': (_ref1 = primary == null ? void 0 : primary.url) != null ? _ref1 : '',
+        'workspace.name': (_input_workspaceName = input.workspaceName) != null ? _input_workspaceName : '',
+        'lock.message': (_input_lockMessage = input.lockMessage) != null ? _input_lockMessage : '',
+        reference: (_input_reference = input.reference) != null ? _input_reference : '',
+        'holds.url': holdsPath ? absolute(holdsPath) : '',
+        'help.url': riskNoticeHelpUrl(input.helpAnchor)
+    };
+}
+/**
+ * One email per person — two owners have not agreed to see each other's
+ * addresses. Platform sender, transactional, owed for the account.
+ */ async function emailPeople(deps, recipients, rendered, supportEmail) {
+    let sent = 0;
+    let failed = 0;
+    const seen = new Set();
+    for (const uid of recipients.uids.slice(0, 50)){
+        var _ref, _recipients_emails_uid;
+        const address = String((_ref = (_recipients_emails_uid = recipients.emails[uid]) != null ? _recipients_emails_uid : await deps.lookupEmail(uid).catch(()=>null)) != null ? _ref : '').trim().toLowerCase();
+        if (!address.includes('@') || seen.has(address)) continue;
+        seen.add(address);
+        const outcome = await deps.sendEmail(_extends({
+            to: address,
+            subject: rendered.subject,
+            text: rendered.text
+        }, rendered.html ? {
+            html: rendered.html
+        } : {}, rendered.fromName ? {
+            fromName: rendered.fromName
+        } : {}, supportEmail ? {
+            replyTo: supportEmail
+        } : {}, {
+            context: 'risk-notice',
+            owedFor: 'account'
+        })).catch((error)=>({
+                sent: false,
+                reason: 'provider-error',
+                detail: String(error)
+            }));
+        if (outcome.sent) {
+            sent += 1;
+            // The platform's own account mail: its cost is the platform's, whatever
+            // workspace it is about (AGL-1438).
+            await meterPlatformEmail().catch(()=>undefined);
+        } else failed += 1;
+    }
+    return {
+        sent,
+        failed
+    };
+}
+/**
+ * Send one ledger's digest if its hour has closed and anything was folded.
+ * Returns whether a digest went out.
+ */ async function flushLedger(deps, ledgerId) {
+    const nowMs = deps.nowMs();
+    const ref = deps.firestore.collection(RISK_NOTICE_LEDGER_COLLECTION).doc(ledgerId);
+    const taken = await deps.firestore.runTransaction(async (transaction)=>{
+        var _snapshot_get, _snapshot_get1, _snapshot_get2, _snapshot_get3, _snapshot_get4;
+        const snapshot = await transaction.get(ref);
+        if (!snapshot.exists) return null;
+        const startedAtMs = Number((_snapshot_get = snapshot.get('windowStartedAtMs')) != null ? _snapshot_get : 0);
+        const ownerCount = Number((_snapshot_get1 = snapshot.get('pendingOwnerCount')) != null ? _snapshot_get1 : 0);
+        const staffCount = Number((_snapshot_get2 = snapshot.get('pendingStaffCount')) != null ? _snapshot_get2 : 0);
+        if (!ownerCount && !staffCount) return null;
+        if (startedAtMs && nowMs - startedAtMs < RISK_NOTICE_BURST.windowMs) return null;
+        transaction.set(ref, {
+            pendingOwners: [],
+            pendingStaff: [],
+            pendingOwnerCount: 0,
+            pendingStaffCount: 0,
+            // Deleted rather than set to `{}`: a merge leaves an existing map's
+            // keys in place when handed an empty one.
+            pendingOwnerTally: FieldValue.delete(),
+            pendingStaffTally: FieldValue.delete(),
+            ownerCount: 0,
+            staffCount: 0,
+            windowStartedAtMs: 0,
+            lastDigestAtMs: nowMs
+        }, {
+            merge: true
+        });
+        return {
+            owners: (_snapshot_get3 = snapshot.get('pendingOwnerTally')) != null ? _snapshot_get3 : {},
+            staff: (_snapshot_get4 = snapshot.get('pendingStaffTally')) != null ? _snapshot_get4 : {},
+            ownerCount,
+            staffCount
+        };
+    });
+    if (!taken) return false;
+    const [scope, id] = [
+        ledgerId.slice(0, ledgerId.indexOf(':')),
+        ledgerId.slice(ledgerId.indexOf(':') + 1)
+    ];
+    const orgId = scope === 'org' ? id : null;
+    const summarize = (tally, count)=>{
+        const entries = Object.entries(tally).sort((a, b)=>b[1] - a[1]);
+        const lines = entries.slice(0, RISK_NOTICE_BURST.digestListMax).map(([title, n])=>`• ${title}${n > 1 ? ` (${n})` : ''}`);
+        const listed = entries.slice(0, RISK_NOTICE_BURST.digestListMax).reduce((total, [, n])=>total + n, 0);
+        if (count > listed) lines.push(`• …and ${count - listed} more`);
+        return lines.join('\n');
+    };
+    if (taken.ownerCount > 0) {
+        var _context_orgName;
+        const context = orgId ? await readContext(deps.firestore, {
+            kind: 'email-held',
+            orgId
+        }) : {
+            orgName: null,
+            orgSlug: null,
+            siteManagerUids: [],
+            orgId: null,
+            hostSubdomain: null
+        };
+        const recipients = scope === 'user' ? {
+            uids: [
+                id
+            ],
+            emails: {}
+        } : orgId ? await ownerRecipients(deps, {
+            kind: 'email-held',
+            orgId
+        }, []) : {
+            uids: [],
+            emails: {}
+        };
+        const title = `Summary: more items on ${(_context_orgName = context.orgName) != null ? _context_orgName : 'your workspace'} were held or flagged`;
+        const summary = summarize(taken.owners, taken.ownerCount);
+        if (recipients.uids.length) {
+            var _context_orgName1, _abuseReportContactEmail;
+            await deps.notifyUsers(recipients.uids, _extends({
+                type: RISK_NOTICE_NOTIFICATION_TYPE,
+                title,
+                body: summary.slice(0, 1000),
+                link: riskHoldsPath()
+            }, orgId ? {
+                orgId
+            } : {}), {
+                emails: recipients.emails
+            });
+            const holdsPath = emailPath(riskHoldsPath(), {
+                orgSlug: context.orgSlug,
+                hostId: null,
+                hostSubdomain: null
+            });
+            const rendered = await renderRiskNoticeEmail(RISK_NOTICE_DIGEST_EMAIL_KEY, {
+                'notice.title': title,
+                'notice.summary': renderRiskNoticeText('In the last hour, more items on {{workspace.name}} were held or flagged than we send one by one:', {
+                    'workspace.name': context.orgName
+                }),
+                'notice.meaning': summary,
+                'notice.steps': numbered([
+                    'Open Holds & reviews to see each item, its status and what to do.',
+                    'If any of them is a mistake, choose Request a review on it.'
+                ]),
+                'notice.actions': holdsPath && absolute(holdsPath) ? `View holds and reviews: ${absolute(holdsPath)}` : '',
+                'holds.url': holdsPath ? absolute(holdsPath) : '',
+                'help.url': riskNoticeHelpUrl(),
+                reference: '',
+                'workspace.name': (_context_orgName1 = context.orgName) != null ? _context_orgName1 : ''
+            });
+            await emailPeople(deps, recipients, rendered, (_abuseReportContactEmail = abuseReportContactEmail('support')) != null ? _abuseReportContactEmail : '');
+        }
+    }
+    if (taken.staffCount > 0) {
+        await deps.notifyStaff({
+            type: 'system.abuseReportUrgent',
+            title: `Digest: ${taken.staffCount} more risk alerts on ${ledgerId}`,
+            body: summarize(taken.staff, taken.staffCount).slice(0, 1000),
+            link: '/admin/abuse-reports'
+        });
+    }
+    return true;
+}
+/**
+ * Send every digest whose hour has closed (the hourly cron). Returns how
+ * many went out. Never throws.
+ */ export async function flushRiskNoticeDigests(overrides = {}) {
+    const deps = resolveDeps(overrides);
+    const cutoff = deps.nowMs() - RISK_NOTICE_BURST.windowMs;
+    let flushed = 0;
+    let failed = 0;
+    try {
+        const snapshot = await deps.firestore.collection(RISK_NOTICE_LEDGER_COLLECTION).where('windowStartedAtMs', '<=', cutoff).where('windowStartedAtMs', '>', 0).limit(200).get();
+        for (const doc of snapshot.docs){
+            try {
+                if (await flushLedger(deps, doc.id)) flushed += 1;
+            } catch (error) {
+                failed += 1;
+                console.error('[risk-notice] a digest could not be sent', error);
+            }
+        }
+    } catch (error) {
+        console.error('[risk-notice] the digest sweep failed', error);
+        failed += 1;
+    }
+    return {
+        flushed,
+        failed
+    };
+}
+/**
+ * The closing notice for a row staff decided: the kind the row's opening
+ * notice names in `closesWith`, sent to the same people about the same item.
+ * Silent (returns null) for a row with no risk notice or a kind that does
+ * not close. Never throws.
+ */ export async function closeRiskNotice(input, overrides = {}) {
+    try {
+        var _row_get, _row_get1, _row_get2, _stamp_itemPath;
+        var _RISK_NOTICE_CATALOG_stamp_kind_closesWith;
+        const deps = resolveDeps(overrides);
+        const row = await deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(input.reviewId).get();
+        const stamp = row.get('riskNotice');
+        if (!(stamp == null ? void 0 : stamp.kind) || !isRiskEventKind(stamp.kind)) return null;
+        const closing = (_RISK_NOTICE_CATALOG_stamp_kind_closesWith = RISK_NOTICE_CATALOG[stamp.kind].closesWith) == null ? void 0 : _RISK_NOTICE_CATALOG_stamp_kind_closesWith[input.decision];
+        if (!closing) return null;
+        return await notifyRiskEvent({
+            kind: closing,
+            orgId: (_row_get = row.get('orgId')) != null ? _row_get : null,
+            hostId: (_row_get1 = row.get('hostId')) != null ? _row_get1 : null,
+            reviewId: input.reviewId,
+            reference: (_row_get2 = row.get('reference')) != null ? _row_get2 : null,
+            item: stamp.itemLabel ? {
+                label: stamp.itemLabel,
+                path: (_stamp_itemPath = stamp.itemPath) != null ? _stamp_itemPath : null
+            } : null,
+            dedupeKey: `${closing}:${input.reviewId}`
+        }, overrides);
+    } catch (error) {
+        console.error('[risk-notice] the closing notice failed', error);
+        return null;
+    }
+}
+/**
+ * An owner or admin asks for a review of a held or flagged item.
+ *
+ * APPENDS to the item's existing abuse-queue row — never a new row, and
+ * never a decision: the row's `status` and its `heldSend` are not written
+ * here, so no request can release a hold or lift a lock. Staff see the
+ * request as a note on the row, and are notified with a link to it.
+ */ export async function requestRiskReview(input, overrides = {}) {
+    var _input_note, _notice_get;
+    const deps = resolveDeps(overrides);
+    const note = String((_input_note = input.note) != null ? _input_note : '').trim().slice(0, RISK_REVIEW_NOTE_MAX);
+    if (note.length < 10) {
+        return {
+            ok: false,
+            status: 400,
+            error: 'Tell us a little about it — at least a sentence.'
+        };
+    }
+    const notice = await deps.firestore.collection(RISK_NOTICE_COLLECTION).doc(input.noticeId).get();
+    if (!notice.exists || notice.get('orgId') !== input.orgId) {
+        return {
+            ok: false,
+            status: 404,
+            error: 'No such notice on this workspace.'
+        };
+    }
+    const kind = notice.get('kind');
+    const reviewId = String((_notice_get = notice.get('reviewId')) != null ? _notice_get : '');
+    if (!isRiskEventKind(kind) || !RISK_NOTICE_CATALOG[kind].reviewable || !reviewId) {
+        return {
+            ok: false,
+            status: 409,
+            error: 'This notice has nothing to review. Contact support instead.'
+        };
+    }
+    const nowMs = deps.nowMs();
+    const rowRef = deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId);
+    const outcome = await deps.firestore.runTransaction(async (transaction)=>{
+        var _last_atMs, _row_get;
+        const row = await transaction.get(rowRef);
+        if (!row.exists || row.get('orgId') !== input.orgId) return 'missing';
+        const requests = Array.isArray(row.get('ownerReviewRequests')) ? row.get('ownerReviewRequests') : [];
+        const last = requests[requests.length - 1];
+        if (last && nowMs - Number((_last_atMs = last.atMs) != null ? _last_atMs : 0) < RISK_REVIEW_REQUEST_COOLDOWN_MS) {
+            return 'cooldown';
+        }
+        const entry = {
+            atMs: nowMs,
+            uid: input.uid,
+            email: input.email,
+            note,
+            noticeId: input.noticeId
+        };
+        // Only these three fields. Never `status`, never `heldSend`.
+        transaction.set(rowRef, {
+            ownerReviewRequests: [
+                ...requests,
+                entry
+            ].slice(-RISK_REVIEW_REQUESTS_MAX),
+            reviewRequestedAtMs: nowMs,
+            updatedAt: FieldValue.serverTimestamp()
+        }, {
+            merge: true
+        });
+        return {
+            reference: (_row_get = row.get('reference')) != null ? _row_get : null
+        };
+    });
+    if (outcome === 'missing') {
+        return {
+            ok: false,
+            status: 404,
+            error: 'The case for this notice is gone. Contact support instead.'
+        };
+    }
+    if (outcome === 'cooldown') {
+        return {
+            ok: false,
+            status: 429,
+            error: 'We already have a request on this. You can add another in a few minutes.'
+        };
+    }
+    await deps.notifyStaff({
+        type: 'system.abuseReportUrgent',
+        title: `Review requested${outcome.reference ? ` — ${outcome.reference}` : ''}`,
+        body: `A workspace owner or admin asked for a review: "${note.slice(0, 280)}"`,
+        link: staffAbuseRowPath(reviewId)
+    });
+    // The person who asked is told it arrived — account mail, platform brand.
+    if (input.email) {
+        var _outcome_reference, _abuseReportContactEmail;
+        const rendered = await renderRiskNoticeEmail(RISK_REVIEW_REQUESTED_EMAIL_KEY, {
+            'notice.title': 'We received your review request',
+            'notice.summary': 'Your request reached our review team' + (outcome.reference ? ` under the reference ${outcome.reference}` : '') + '. A person reads every request.',
+            'notice.meaning': 'Nothing changes until the review is done; you will get a notice either way.',
+            'notice.steps': numbered([
+                'Nothing more is needed.',
+                'You can follow the item\'s status on Holds & reviews.'
+            ]),
+            reference: (_outcome_reference = outcome.reference) != null ? _outcome_reference : '',
+            'help.url': riskNoticeHelpUrl('requesting-a-review')
+        });
+        await emailPeople(deps, {
+            uids: [
+                input.uid
+            ],
+            emails: {
+                [input.uid]: input.email
+            }
+        }, rendered, (_abuseReportContactEmail = abuseReportContactEmail('support')) != null ? _abuseReportContactEmail : '').catch(()=>undefined);
+    }
+    return {
+        ok: true,
+        reference: outcome.reference,
+        requestedAtMs: nowMs
+    };
+}
+/**
+ * A page notice's facts from its stored subject, or — for a notice written
+ * before notices carried one — from its label and item path. Pure.
+ */ export function ownerPageHoldFacts(kind, notice) {
+    var _notice_ownerValues, _notice_actionParams;
+    if (!isPageHoldNoticeKind(kind)) return null;
+    const subject = notice.page;
+    if (subject && typeof subject === 'object' && subject.screenId) {
+        return {
+            label: heldPageLabel(subject),
+            details: heldPageDetails(subject),
+            visitorSentence: heldPageVisitorSentence(subject),
+            targets: heldPageTargets(subject)
+        };
+    }
+    const values = (_notice_ownerValues = notice.ownerValues) != null ? _notice_ownerValues : {};
+    const params = (_notice_actionParams = notice.actionParams) != null ? _notice_actionParams : {};
+    const parsed = parseHeldPageItemPath(params.itemPath);
+    return {
+        label: values['item.label'] || 'a page on your site',
+        details: [],
+        visitorSentence: kind === 'page-flagged' ? heldPageVisitorSentence({
+            visitorView: 'live'
+        }) : 'Visitors see the previous version of this page, or a not-found page if it was never published, until the review is done.',
+        targets: parsed ? [
+            {
+                type: 'screen',
+                id: parsed.screenId
+            }
+        ] : []
+    };
+}
+/**
+ * Every page on a site that is held, flagged or not approved (AGL-3374): the
+ * `riskNotices` of the two page kinds for this host, newest first — one
+ * query on (`hostId`, `kind`, `createdAtMs`), which
+ * `cloud/firebase-firestore.indexes.json` holds — and each notice's row for
+ * its state. A released or cleared page is not listed.
+ */ export async function listHostPageHolds(input, overrides = {}) {
+    var _input_limit;
+    const deps = resolveDeps(overrides);
+    const snapshot = await deps.firestore.collection(RISK_NOTICE_COLLECTION).where('hostId', '==', input.hostId).where('kind', 'in', [
+        ...PAGE_HOLD_NOTICE_KINDS
+    ]).orderBy('createdAtMs', 'desc').limit(Math.min(Math.max((_input_limit = input.limit) != null ? _input_limit : 50, 1), 100)).get();
+    const reviewIds = [
+        ...new Set(snapshot.docs.map((doc)=>{
+            var _doc_get;
+            return String((_doc_get = doc.get('reviewId')) != null ? _doc_get : '');
+        }).filter(Boolean))
+    ];
+    const rows = new Map();
+    if (reviewIds.length) {
+        const read = await deps.firestore.getAll(...reviewIds.map((id)=>deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(id)));
+        for (const row of read)rows.set(row.id, row);
+    }
+    const views = [];
+    const seenRows = new Set();
+    for (const doc of snapshot.docs){
+        var _doc_get, _doc_get1, _ref, _doc_get2;
+        const kind = doc.get('kind');
+        if (!isPageHoldNoticeKind(kind)) continue;
+        const reviewId = String((_doc_get = doc.get('reviewId')) != null ? _doc_get : '');
+        // One entry per case: a row re-notified keeps its newest notice.
+        if (reviewId && seenRows.has(reviewId)) continue;
+        if (reviewId) seenRows.add(reviewId);
+        const row = reviewId ? rows.get(reviewId) : undefined;
+        const status = (row == null ? void 0 : row.exists) ? ownerRowStatus(row) : kind === 'page-flagged' ? 'in-review' : 'held';
+        if (!isOpenPageHoldStatus(status)) continue;
+        const facts = ownerPageHoldFacts(kind, {
+            page: doc.get('page'),
+            ownerValues: doc.get('ownerValues'),
+            actionParams: doc.get('actionParams')
+        });
+        if (!facts) continue;
+        views.push(_extends({}, facts, {
+            noticeId: doc.id,
+            kind,
+            status,
+            chip: pageHoldChip(kind, status),
+            reference: (_doc_get1 = doc.get('reference')) != null ? _doc_get1 : null,
+            occurredAtMs: Number((_ref = (_doc_get2 = doc.get('occurredAtMs')) != null ? _doc_get2 : doc.get('createdAtMs')) != null ? _ref : 0),
+            reviewable: RISK_NOTICE_CATALOG[kind].reviewable && Boolean(row == null ? void 0 : row.exists),
+            reviewRequestedAtMs: typeof (row == null ? void 0 : row.get('reviewRequestedAtMs')) === 'number' ? row.get('reviewRequestedAtMs') : null
+        }));
+    }
+    return views;
+}
+/**
+ * The workspace's notices, newest first, rendered for its owners: the
+ * catalog's owner half only, and the row's decision state — never its
+ * evidence, never its staff notes.
+ */ export async function listOwnerRiskNotices(input, overrides = {}) {
+    var _input_limit, _org_get;
+    const deps = resolveDeps(overrides);
+    const snapshot = await deps.firestore.collection(RISK_NOTICE_COLLECTION).where('orgId', '==', input.orgId).orderBy('createdAtMs', 'desc').limit(Math.min(Math.max((_input_limit = input.limit) != null ? _input_limit : 50, 1), 100)).get();
+    const reviewIds = [
+        ...new Set(snapshot.docs.map((doc)=>{
+            var _doc_get;
+            return String((_doc_get = doc.get('reviewId')) != null ? _doc_get : '');
+        }).filter(Boolean))
+    ];
+    const rows = new Map();
+    if (reviewIds.length) {
+        const read = await deps.firestore.getAll(...reviewIds.map((id)=>deps.firestore.collection(ABUSE_REPORT_COLLECTION).doc(id)));
+        for (const row of read)rows.set(row.id, row);
+    }
+    // The reader's own console paths: the org's slug and each site's
+    // subdomain, read once for the page rather than per notice.
+    const org = await deps.firestore.collection('orgs').doc(input.orgId).get();
+    const orgSlug = String((_org_get = org.get('slug')) != null ? _org_get : '') || null;
+    const hostIds = [
+        ...new Set(snapshot.docs.map((doc)=>{
+            var _doc_get;
+            return String((_doc_get = doc.get('hostId')) != null ? _doc_get : '');
+        }).filter(Boolean))
+    ];
+    const subdomains = new Map();
+    if (hostIds.length) {
+        var _host_get;
+        const hosts = await deps.firestore.getAll(...hostIds.map((id)=>deps.firestore.collection('hosts').doc(id)));
+        for (const host of hosts)subdomains.set(host.id, String((_host_get = host.get('subdomain')) != null ? _host_get : '') || null);
+    }
+    const views = [];
+    for (const doc of snapshot.docs){
+        var _doc_get, _doc_get1, _doc_get2, _doc_get3, _ref, _doc_get4;
+        const kind = doc.get('kind');
+        if (!isRiskEventKind(kind)) continue;
+        const values = (_doc_get = doc.get('ownerValues')) != null ? _doc_get : {};
+        const params = (_doc_get1 = doc.get('actionParams')) != null ? _doc_get1 : {};
+        const definition = RISK_NOTICE_CATALOG[kind];
+        const copy = renderOwnerRiskNotice(kind, values);
+        const reviewId = String((_doc_get2 = doc.get('reviewId')) != null ? _doc_get2 : '');
+        const row = reviewId ? rows.get(reviewId) : undefined;
+        const requests = row && Array.isArray(row.get('ownerReviewRequests')) ? row.get('ownerReviewRequests') : [];
+        views.push(_extends({
+            noticeId: doc.id,
+            kind,
+            severity: definition.severity
+        }, copy, {
+            actions: resolveOwnerRiskActions(kind, _extends({}, params, {
+                noticeId: doc.id
+            })).flatMap((action)=>{
+                var _doc_get, _subdomains_get;
+                const hostId = String((_doc_get = doc.get('hostId')) != null ? _doc_get : '') || null;
+                const href = emailPath(action.href, {
+                    orgSlug,
+                    hostId,
+                    hostSubdomain: hostId ? (_subdomains_get = subdomains.get(hostId)) != null ? _subdomains_get : null : null
+                });
+                return href ? [
+                    _extends({}, action, {
+                        href
+                    })
+                ] : [];
+            }),
+            reference: (_doc_get3 = doc.get('reference')) != null ? _doc_get3 : null,
+            occurredAtMs: Number((_ref = (_doc_get4 = doc.get('occurredAtMs')) != null ? _doc_get4 : doc.get('createdAtMs')) != null ? _ref : 0),
+            helpUrl: riskNoticeHelpUrl(definition.helpAnchor),
+            status: (row == null ? void 0 : row.exists) ? ownerRowStatus(row) : null,
+            reviewable: definition.reviewable && Boolean(row == null ? void 0 : row.exists),
+            reviewRequests: requests.filter((request)=>request.noticeId === doc.id).map((request)=>{
+                var _request_atMs, _request_note;
+                return {
+                    atMs: Number((_request_atMs = request.atMs) != null ? _request_atMs : 0),
+                    note: String((_request_note = request.note) != null ? _request_note : ''),
+                    mine: request.uid === input.viewerUid
+                };
+            }),
+            page: ownerPageHoldFacts(kind, {
+                page: doc.get('page'),
+                ownerValues: values,
+                actionParams: params
+            })
+        }));
+    }
+    return views;
+}
+/** A row's state in the owner's words. Pure. */ export function ownerRowStatus(row) {
+    var _row_get;
+    const held = row.get('heldSend');
+    if ((held == null ? void 0 : held.state) === 'released') return 'released';
+    if ((held == null ? void 0 : held.state) === 'rejected') return 'rejected';
+    const status = String((_row_get = row.get('status')) != null ? _row_get : 'open');
+    if (status === 'dismissed') return held ? 'released' : 'closed';
+    if (status === 'actioned') return held ? 'rejected' : 'closed';
+    if ((held == null ? void 0 : held.state) === 'held') return 'held';
+    return 'in-review';
+}
+
+//# sourceMappingURL=risk-notice.js.map