@aglyn/tenant-data-admin 1.0.0-beta.217 → 1.0.0-beta.219

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.217",
+  "version": "1.0.0-beta.219",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,16 +25,16 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.217",
-    "@aglyn/shared-util-email": "1.0.0-beta.217",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.217",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.217",
-    "@aglyn/shared-util-http": "1.0.0-beta.217",
-    "@aglyn/shared-util-tools": "1.0.0-beta.217",
+    "@aglyn/aglyn": "1.0.0-beta.219",
+    "@aglyn/shared-util-email": "1.0.0-beta.219",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.219",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.219",
+    "@aglyn/shared-util-http": "1.0.0-beta.219",
+    "@aglyn/shared-util-tools": "1.0.0-beta.219",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
-    "sharp": "^0.35.3",
-    "undici": "^7.29.0"
+    "sharp": "^0.35.5",
+    "undici": "^8.11.2"
   },
   "peerDependencies": {
     "firebase-admin": "^14.3.0",

package/src/lib/server/account-lock-mail.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHAT AN ACCOUNT LOCK DOES TO MAIL ADDRESSED BY EMAIL (AGL-3420).
+ *
+ * The uid-keyed fan-outs already skip a locked account
+ * (`isAccountMailWithheld`, AGL-3418). What they cannot reach is mail
+ * addressed by email alone — a campaign to a list, a sequence to a contact —
+ * so the lock is written onto the suppression lists, keyed by every address
+ * the account holds:
+ *
+ *  - **Every lock:** each of the house workspace's sites, `account_lock`, so
+ *    Aglyn's own campaigns and sequences stop. Other workspaces are not ours
+ *    to speak for.
+ *  - **A ban** (`abuse`): the platform list as well, `account_ban`, which
+ *    the preflight on `sendEmail` refuses on every send by any sender. The
+ *    account is kept only so the address cannot sign up again; after its
+ *    notice it is sent nothing.
+ *
+ * Called after the lock is durable and after its notices have gone, and it
+ * never undoes the lock: a failure is reported beside the lock, not instead
+ * of it.
+ */
+export interface AccountLockMailReport {
+    /** The addresses the account holds that were written or lifted. */
+    addresses: number;
+    /** A source of addresses failed; the set may be short. */
+    incomplete: boolean;
+    /** Platform ban rows filed (lock) or released (lift). */
+    banRows: number;
+    /** House sites the per-site rows were written on or lifted from. */
+    houseSites: number;
+    /** Per-site rows written (lock) or deleted (lift). */
+    houseRows: number;
+    /** Writes that threw. */
+    failed: number;
+}
+interface AccountLockMailInput {
+    uid: string;
+    /** The Auth record, for its addresses. */
+    record: {
+        email?: string | null;
+        providerData?: readonly {
+            email?: string | null;
+        }[];
+    } | null;
+    firestore?: any;
+}
+/** Write a lock onto the lists. `ban` files the platform rows as well. */
+export declare function applyAccountLockToMail(input: AccountLockMailInput & {
+    ban: boolean;
+}): Promise<AccountLockMailReport>;
+/**
+ * Take a lift off the lists: the account's ban rows (restoring any
+ * suppression a ban was filed over) and its house rows.
+ */
+export declare function liftAccountLockFromMail(input: AccountLockMailInput & {
+    releasedByUid?: string | null;
+}): Promise<AccountLockMailReport>;
+export {};

package/src/lib/server/account-lock-mail.js

@@ -0,0 +1,139 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { resolveAccountAddresses } from "./account-addresses.js";
+import { releaseAccountBanSuppressions, releaseAccountLockSuppression, suppressEmail, suppressEmailForAccountLock } from "./email-suppression.js";
+import { getOrgForHost } from "./organizations.js";
+import { platformMarketingHostId } from "./platform-marketing-consent.js";
+/** The house workspace's site ids, or none on an install without one. */ async function houseSiteIds() {
+    var _ref;
+    var _house_org;
+    const houseHostId = platformMarketingHostId();
+    if (!houseHostId) return [];
+    const house = await getOrgForHost(houseHostId);
+    const directory = (_ref = house == null ? void 0 : (_house_org = house.org) == null ? void 0 : _house_org.hosts) != null ? _ref : {};
+    const ids = Object.keys(directory).filter((id)=>Boolean(directory[id]));
+    return ids.includes(houseHostId) ? ids : [
+        houseHostId,
+        ...ids
+    ];
+}
+async function addressesOf(input) {
+    const set = await resolveAccountAddresses(_extends({
+        uid: input.uid,
+        record: input.record
+    }, input.firestore ? {
+        firestore: input.firestore
+    } : {}));
+    return {
+        emails: set.addresses.map((entry)=>entry.address),
+        incomplete: set.incomplete
+    };
+}
+/** Write a lock onto the lists. `ban` files the platform rows as well. */ export async function applyAccountLockToMail(input) {
+    const { emails, incomplete } = await addressesOf(input);
+    const sites = await houseSiteIds();
+    const report = {
+        addresses: emails.length,
+        incomplete,
+        banRows: 0,
+        houseSites: sites.length,
+        houseRows: 0,
+        failed: 0
+    };
+    for (const email of emails){
+        if (input.ban) {
+            try {
+                await suppressEmail(_extends({
+                    email,
+                    reason: 'account_ban',
+                    subjectUid: input.uid,
+                    context: 'account-ban',
+                    stampRecord: false
+                }, input.firestore ? {
+                    firestore: input.firestore
+                } : {}));
+                report.banRows += 1;
+            } catch (error) {
+                console.error('[account-lock-mail] ban row failed', input.uid, error);
+                report.failed += 1;
+            }
+        }
+        for (const hostId of sites){
+            try {
+                const wrote = await suppressEmailForAccountLock(_extends({
+                    hostId,
+                    email,
+                    uid: input.uid
+                }, input.firestore ? {
+                    firestore: input.firestore
+                } : {}));
+                if (wrote) report.houseRows += 1;
+            } catch (error) {
+                console.error('[account-lock-mail] house row failed', input.uid, hostId, error);
+                report.failed += 1;
+            }
+        }
+    }
+    return report;
+}
+/**
+ * Take a lift off the lists: the account's ban rows (restoring any
+ * suppression a ban was filed over) and its house rows.
+ */ export async function liftAccountLockFromMail(input) {
+    const { emails, incomplete } = await addressesOf(input);
+    const sites = await houseSiteIds();
+    const report = {
+        addresses: emails.length,
+        incomplete,
+        banRows: 0,
+        houseSites: sites.length,
+        houseRows: 0,
+        failed: 0
+    };
+    try {
+        var _input_releasedByUid;
+        report.banRows = await releaseAccountBanSuppressions(_extends({
+            uid: input.uid,
+            releasedByUid: (_input_releasedByUid = input.releasedByUid) != null ? _input_releasedByUid : null
+        }, input.firestore ? {
+            firestore: input.firestore
+        } : {}));
+    } catch (error) {
+        console.error('[account-lock-mail] ban release failed', input.uid, error);
+        report.failed += 1;
+    }
+    for (const email of emails){
+        for (const hostId of sites){
+            try {
+                const deleted = await releaseAccountLockSuppression(_extends({
+                    hostId,
+                    email,
+                    uid: input.uid
+                }, input.firestore ? {
+                    firestore: input.firestore
+                } : {}));
+                if (deleted) report.houseRows += 1;
+            } catch (error) {
+                console.error('[account-lock-mail] house release failed', input.uid, hostId, error);
+                report.failed += 1;
+            }
+        }
+    }
+    return report;
+}
+
+//# sourceMappingURL=account-lock-mail.js.map

package/src/lib/server/account-lock-mail.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/account-lock-mail.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { resolveAccountAddresses } from './account-addresses'\nimport {\n  releaseAccountBanSuppressions,\n  releaseAccountLockSuppression,\n  suppressEmail,\n  suppressEmailForAccountLock,\n} from './email-suppression'\nimport { getOrgForHost } from './organizations'\nimport { platformMarketingHostId } from './platform-marketing-consent'\n\n/**\n * WHAT AN ACCOUNT LOCK DOES TO MAIL ADDRESSED BY EMAIL (AGL-3420).\n *\n * The uid-keyed fan-outs already skip a locked account\n * (`isAccountMailWithheld`, AGL-3418). What they cannot reach is mail\n * addressed by email alone — a campaign to a list, a sequence to a contact —\n * so the lock is written onto the suppression lists, keyed by every address\n * the account holds:\n *\n *  - **Every lock:** each of the house workspace's sites, `account_lock`, so\n *    Aglyn's own campaigns and sequences stop. Other workspaces are not ours\n *    to speak for.\n *  - **A ban** (`abuse`): the platform list as well, `account_ban`, which\n *    the preflight on `sendEmail` refuses on every send by any sender. The\n *    account is kept only so the address cannot sign up again; after its\n *    notice it is sent nothing.\n *\n * Called after the lock is durable and after its notices have gone, and it\n * never undoes the lock: a failure is reported beside the lock, not instead\n * of it.\n */\n\nexport interface AccountLockMailReport {\n  /** The addresses the account holds that were written or lifted. */\n  addresses: number\n  /** A source of addresses failed; the set may be short. */\n  incomplete: boolean\n  /** Platform ban rows filed (lock) or released (lift). */\n  banRows: number\n  /** House sites the per-site rows were written on or lifted from. */\n  houseSites: number\n  /** Per-site rows written (lock) or deleted (lift). */\n  houseRows: number\n  /** Writes that threw. */\n  failed: number\n}\n\ninterface AccountLockMailInput {\n  uid: string\n  /** The Auth record, for its addresses. */\n  record: {\n    email?: string | null\n    providerData?: readonly { email?: string | null }[]\n  } | null\n  firestore?: any\n}\n\n/** The house workspace's site ids, or none on an install without one. */\nasync function houseSiteIds(): Promise<string[]> {\n  const houseHostId = platformMarketingHostId()\n  if (!houseHostId) return []\n  const house = await getOrgForHost(houseHostId)\n  const directory = (house?.org as { hosts?: Record<string, unknown> } | undefined)?.hosts ?? {}\n  const ids = Object.keys(directory).filter((id) => Boolean(directory[id]))\n  return ids.includes(houseHostId) ? ids : [houseHostId, ...ids]\n}\n\nasync function addressesOf(input: AccountLockMailInput) {\n  const set = await resolveAccountAddresses({\n    uid: input.uid,\n    record: input.record,\n    ...(input.firestore ? { firestore: input.firestore } : {}),\n  })\n  return { emails: set.addresses.map((entry) => entry.address), incomplete: set.incomplete }\n}\n\n/** Write a lock onto the lists. `ban` files the platform rows as well. */\nexport async function applyAccountLockToMail(\n  input: AccountLockMailInput & { ban: boolean },\n): Promise<AccountLockMailReport> {\n  const { emails, incomplete } = await addressesOf(input)\n  const sites = await houseSiteIds()\n  const report: AccountLockMailReport = {\n    addresses: emails.length,\n    incomplete,\n    banRows: 0,\n    houseSites: sites.length,\n    houseRows: 0,\n    failed: 0,\n  }\n  for (const email of emails) {\n    if (input.ban) {\n      try {\n        await suppressEmail({\n          email,\n          reason: 'account_ban',\n          subjectUid: input.uid,\n          context: 'account-ban',\n          stampRecord: false,\n          ...(input.firestore ? { firestore: input.firestore } : {}),\n        })\n        report.banRows += 1\n      } catch (error) {\n        console.error('[account-lock-mail] ban row failed', input.uid, error)\n        report.failed += 1\n      }\n    }\n    for (const hostId of sites) {\n      try {\n        const wrote = await suppressEmailForAccountLock({\n          hostId,\n          email,\n          uid: input.uid,\n          ...(input.firestore ? { firestore: input.firestore } : {}),\n        })\n        if (wrote) report.houseRows += 1\n      } catch (error) {\n        console.error('[account-lock-mail] house row failed', input.uid, hostId, error)\n        report.failed += 1\n      }\n    }\n  }\n  return report\n}\n\n/**\n * Take a lift off the lists: the account's ban rows (restoring any\n * suppression a ban was filed over) and its house rows.\n */\nexport async function liftAccountLockFromMail(\n  input: AccountLockMailInput & { releasedByUid?: string | null },\n): Promise<AccountLockMailReport> {\n  const { emails, incomplete } = await addressesOf(input)\n  const sites = await houseSiteIds()\n  const report: AccountLockMailReport = {\n    addresses: emails.length,\n    incomplete,\n    banRows: 0,\n    houseSites: sites.length,\n    houseRows: 0,\n    failed: 0,\n  }\n  try {\n    report.banRows = await releaseAccountBanSuppressions({\n      uid: input.uid,\n      releasedByUid: input.releasedByUid ?? null,\n      ...(input.firestore ? { firestore: input.firestore } : {}),\n    })\n  } catch (error) {\n    console.error('[account-lock-mail] ban release failed', input.uid, error)\n    report.failed += 1\n  }\n  for (const email of emails) {\n    for (const hostId of sites) {\n      try {\n        const deleted = await releaseAccountLockSuppression({\n          hostId,\n          email,\n          uid: input.uid,\n          ...(input.firestore ? { firestore: input.firestore } : {}),\n        })\n        if (deleted) report.houseRows += 1\n      } catch (error) {\n        console.error('[account-lock-mail] house release failed', input.uid, hostId, error)\n        report.failed += 1\n      }\n    }\n  }\n  return report\n}\n"],"names":["resolveAccountAddresses","releaseAccountBanSuppressions","releaseAccountLockSuppression","suppressEmail","suppressEmailForAccountLock","getOrgForHost","platformMarketingHostId","houseSiteIds","house","houseHostId","directory","org","hosts","ids","Object","keys","filter","id","Boolean","includes","addressesOf","input","set","uid","record","firestore","emails","addresses","map","entry","address","incomplete","applyAccountLockToMail","sites","report","length","banRows","houseSites","houseRows","failed","email","ban","reason","subjectUid","context","stampRecord","error","console","hostId","wrote","liftAccountLockFromMail","releasedByUid","deleted"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,uBAAuB,QAAQ,yBAAqB;AAC7D,SACEC,6BAA6B,EAC7BC,6BAA6B,EAC7BC,aAAa,EACbC,2BAA2B,QACtB,yBAAqB;AAC5B,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,uBAAuB,QAAQ,kCAA8B;AAiDtE,uEAAuE,GACvE,eAAeC;;QAIMC;IAHnB,MAAMC,cAAcH;IACpB,IAAI,CAACG,aAAa,OAAO,EAAE;IAC3B,MAAMD,QAAQ,MAAMH,cAAcI;IAClC,MAAMC,oBAAaF,0BAAAA,aAAAA,MAAOG,GAAG,qBAAX,AAACH,WAAgEI,KAAK,mBAAI,CAAC;IAC7F,MAAMC,MAAMC,OAAOC,IAAI,CAACL,WAAWM,MAAM,CAAC,CAACC,KAAOC,QAAQR,SAAS,CAACO,GAAG;IACvE,OAAOJ,IAAIM,QAAQ,CAACV,eAAeI,MAAM;QAACJ;WAAgBI;KAAI;AAChE;AAEA,eAAeO,YAAYC,KAA2B;IACpD,MAAMC,MAAM,MAAMtB,wBAAwB;QACxCuB,KAAKF,MAAME,GAAG;QACdC,QAAQH,MAAMG,MAAM;OAChBH,MAAMI,SAAS,GAAG;QAAEA,WAAWJ,MAAMI,SAAS;IAAC,IAAI,CAAC;IAE1D,OAAO;QAAEC,QAAQJ,IAAIK,SAAS,CAACC,GAAG,CAAC,CAACC,QAAUA,MAAMC,OAAO;QAAGC,YAAYT,IAAIS,UAAU;IAAC;AAC3F;AAEA,wEAAwE,GACxE,OAAO,eAAeC,uBACpBX,KAA8C;IAE9C,MAAM,EAAEK,MAAM,EAAEK,UAAU,EAAE,GAAG,MAAMX,YAAYC;IACjD,MAAMY,QAAQ,MAAM1B;IACpB,MAAM2B,SAAgC;QACpCP,WAAWD,OAAOS,MAAM;QACxBJ;QACAK,SAAS;QACTC,YAAYJ,MAAME,MAAM;QACxBG,WAAW;QACXC,QAAQ;IACV;IACA,KAAK,MAAMC,SAASd,OAAQ;QAC1B,IAAIL,MAAMoB,GAAG,EAAE;YACb,IAAI;gBACF,MAAMtC,cAAc;oBAClBqC;oBACAE,QAAQ;oBACRC,YAAYtB,MAAME,GAAG;oBACrBqB,SAAS;oBACTC,aAAa;mBACTxB,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1DS,OAAOE,OAAO,IAAI;YACpB,EAAE,OAAOU,OAAO;gBACdC,QAAQD,KAAK,CAAC,sCAAsCzB,MAAME,GAAG,EAAEuB;gBAC/DZ,OAAOK,MAAM,IAAI;YACnB;QACF;QACA,KAAK,MAAMS,UAAUf,MAAO;YAC1B,IAAI;gBACF,MAAMgB,QAAQ,MAAM7C,4BAA4B;oBAC9C4C;oBACAR;oBACAjB,KAAKF,MAAME,GAAG;mBACVF,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1D,IAAIwB,OAAOf,OAAOI,SAAS,IAAI;YACjC,EAAE,OAAOQ,OAAO;gBACdC,QAAQD,KAAK,CAAC,wCAAwCzB,MAAME,GAAG,EAAEyB,QAAQF;gBACzEZ,OAAOK,MAAM,IAAI;YACnB;QACF;IACF;IACA,OAAOL;AACT;AAEA;;;CAGC,GACD,OAAO,eAAegB,wBACpB7B,KAA+D;IAE/D,MAAM,EAAEK,MAAM,EAAEK,UAAU,EAAE,GAAG,MAAMX,YAAYC;IACjD,MAAMY,QAAQ,MAAM1B;IACpB,MAAM2B,SAAgC;QACpCP,WAAWD,OAAOS,MAAM;QACxBJ;QACAK,SAAS;QACTC,YAAYJ,MAAME,MAAM;QACxBG,WAAW;QACXC,QAAQ;IACV;IACA,IAAI;YAGelB;QAFjBa,OAAOE,OAAO,GAAG,MAAMnC,8BAA8B;YACnDsB,KAAKF,MAAME,GAAG;YACd4B,aAAa,GAAE9B,uBAAAA,MAAM8B,aAAa,YAAnB9B,uBAAuB;WAClCA,MAAMI,SAAS,GAAG;YAAEA,WAAWJ,MAAMI,SAAS;QAAC,IAAI,CAAC;IAE5D,EAAE,OAAOqB,OAAO;QACdC,QAAQD,KAAK,CAAC,0CAA0CzB,MAAME,GAAG,EAAEuB;QACnEZ,OAAOK,MAAM,IAAI;IACnB;IACA,KAAK,MAAMC,SAASd,OAAQ;QAC1B,KAAK,MAAMsB,UAAUf,MAAO;YAC1B,IAAI;gBACF,MAAMmB,UAAU,MAAMlD,8BAA8B;oBAClD8C;oBACAR;oBACAjB,KAAKF,MAAME,GAAG;mBACVF,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1D,IAAI2B,SAASlB,OAAOI,SAAS,IAAI;YACnC,EAAE,OAAOQ,OAAO;gBACdC,QAAQD,KAAK,CAAC,4CAA4CzB,MAAME,GAAG,EAAEyB,QAAQF;gBAC7EZ,OAAOK,MAAM,IAAI;YACnB;QACF;IACF;IACA,OAAOL;AACT"}

package/src/lib/server/account-mail.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHETHER AUTOMATED PLATFORM MAIL TO ONE ACCOUNT IS WITHHELD (AGL-3418).
+ *
+ * True for an account under an active user lock (`lockdowns/user--{uid}`)
+ * or whose Auth record is disabled. Such an account cannot sign in to act on
+ * a usage alert, a digest or a notification, and for a risk lock the mail is
+ * worse than useless: it keeps a suspected bad actor informed about the
+ * workspace it was locked out of.
+ *
+ * Discretionary mail only. The lock and unlock notices, security alerts,
+ * password and verification mail, erasure confirmations and receipts do not
+ * ask this, and must not — they are how the person learns what happened.
+ *
+ * Pass `authDisabled` when the caller already holds the Auth record, to skip
+ * the pool lookup. A lookup that fails reads as "not disabled": the lock
+ * record is the authoritative signal, and an outage must not silence mail.
+ */
+export declare function isAccountMailWithheld(uid: string | null | undefined, options?: {
+    authDisabled?: boolean;
+}): Promise<boolean>;
+/**
+ * `uids` minus every account {@link isAccountMailWithheld} withholds, in
+ * the order given. The checks run concurrently.
+ */
+export declare function withoutMailWithheldAccounts(uids: readonly string[]): Promise<string[]>;

package/src/lib/server/account-mail.js

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { isLockdownActive } from "@aglyn/aglyn/server";
+import { findUserByUidAcrossPools } from "./auth-pools.js";
+import { getUserLockdown } from "./lockdown.js";
+/**
+ * WHETHER AUTOMATED PLATFORM MAIL TO ONE ACCOUNT IS WITHHELD (AGL-3418).
+ *
+ * True for an account under an active user lock (`lockdowns/user--{uid}`)
+ * or whose Auth record is disabled. Such an account cannot sign in to act on
+ * a usage alert, a digest or a notification, and for a risk lock the mail is
+ * worse than useless: it keeps a suspected bad actor informed about the
+ * workspace it was locked out of.
+ *
+ * Discretionary mail only. The lock and unlock notices, security alerts,
+ * password and verification mail, erasure confirmations and receipts do not
+ * ask this, and must not — they are how the person learns what happened.
+ *
+ * Pass `authDisabled` when the caller already holds the Auth record, to skip
+ * the pool lookup. A lookup that fails reads as "not disabled": the lock
+ * record is the authoritative signal, and an outage must not silence mail.
+ */ export async function isAccountMailWithheld(uid, options = {}) {
+    var _pooled_record;
+    if (!uid) return false;
+    if (options.authDisabled) return true;
+    if (isLockdownActive(await getUserLockdown(uid), Date.now())) return true;
+    if (options.authDisabled === false) return false;
+    const pooled = await findUserByUidAcrossPools(uid).catch(()=>null);
+    return (pooled == null ? void 0 : (_pooled_record = pooled.record) == null ? void 0 : _pooled_record.disabled) === true;
+}
+/**
+ * `uids` minus every account {@link isAccountMailWithheld} withholds, in
+ * the order given. The checks run concurrently.
+ */ export async function withoutMailWithheldAccounts(uids) {
+    const withheld = await Promise.all(uids.map((uid)=>isAccountMailWithheld(uid).catch(()=>false)));
+    return uids.filter((_, index)=>!withheld[index]);
+}
+
+//# sourceMappingURL=account-mail.js.map

package/src/lib/server/account-mail.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/account-mail.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isLockdownActive } from '@aglyn/aglyn/server'\nimport { findUserByUidAcrossPools } from './auth-pools'\nimport { getUserLockdown } from './lockdown'\n\n/**\n * WHETHER AUTOMATED PLATFORM MAIL TO ONE ACCOUNT IS WITHHELD (AGL-3418).\n *\n * True for an account under an active user lock (`lockdowns/user--{uid}`)\n * or whose Auth record is disabled. Such an account cannot sign in to act on\n * a usage alert, a digest or a notification, and for a risk lock the mail is\n * worse than useless: it keeps a suspected bad actor informed about the\n * workspace it was locked out of.\n *\n * Discretionary mail only. The lock and unlock notices, security alerts,\n * password and verification mail, erasure confirmations and receipts do not\n * ask this, and must not — they are how the person learns what happened.\n *\n * Pass `authDisabled` when the caller already holds the Auth record, to skip\n * the pool lookup. A lookup that fails reads as \"not disabled\": the lock\n * record is the authoritative signal, and an outage must not silence mail.\n */\nexport async function isAccountMailWithheld(\n  uid: string | null | undefined,\n  options: { authDisabled?: boolean } = {},\n): Promise<boolean> {\n  if (!uid) return false\n  if (options.authDisabled) return true\n  if (isLockdownActive(await getUserLockdown(uid), Date.now())) return true\n  if (options.authDisabled === false) return false\n  const pooled = await findUserByUidAcrossPools(uid).catch(() => null)\n  return pooled?.record?.disabled === true\n}\n\n/**\n * `uids` minus every account {@link isAccountMailWithheld} withholds, in\n * the order given. The checks run concurrently.\n */\nexport async function withoutMailWithheldAccounts(\n  uids: readonly string[],\n): Promise<string[]> {\n  const withheld = await Promise.all(\n    uids.map((uid) => isAccountMailWithheld(uid).catch(() => false)),\n  )\n  return uids.filter((_, index) => !withheld[index])\n}\n"],"names":["isLockdownActive","findUserByUidAcrossPools","getUserLockdown","isAccountMailWithheld","uid","options","pooled","authDisabled","Date","now","catch","record","disabled","withoutMailWithheldAccounts","uids","withheld","Promise","all","map","filter","_","index"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,QAAQ,sBAAqB;AACtD,SAASC,wBAAwB,QAAQ,kBAAc;AACvD,SAASC,eAAe,QAAQ,gBAAY;AAE5C;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,eAAeC,sBACpBC,GAA8B,EAC9BC,UAAsC,CAAC,CAAC;QAOjCC;IALP,IAAI,CAACF,KAAK,OAAO;IACjB,IAAIC,QAAQE,YAAY,EAAE,OAAO;IACjC,IAAIP,iBAAiB,MAAME,gBAAgBE,MAAMI,KAAKC,GAAG,KAAK,OAAO;IACrE,IAAIJ,QAAQE,YAAY,KAAK,OAAO,OAAO;IAC3C,MAAMD,SAAS,MAAML,yBAAyBG,KAAKM,KAAK,CAAC,IAAM;IAC/D,OAAOJ,CAAAA,2BAAAA,iBAAAA,OAAQK,MAAM,qBAAdL,eAAgBM,QAAQ,MAAK;AACtC;AAEA;;;CAGC,GACD,OAAO,eAAeC,4BACpBC,IAAuB;IAEvB,MAAMC,WAAW,MAAMC,QAAQC,GAAG,CAChCH,KAAKI,GAAG,CAAC,CAACd,MAAQD,sBAAsBC,KAAKM,KAAK,CAAC,IAAM;IAE3D,OAAOI,KAAKK,MAAM,CAAC,CAACC,GAAGC,QAAU,CAACN,QAAQ,CAACM,MAAM;AACnD"}

package/src/lib/server/api-v1-description.d.ts

@@ -0,0 +1,112 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * How a `/v1` resource is described in the customer API's OpenAPI document
+ * (AGL-2733), in the shape the console's builder turns into paths, tags and
+ * schemas — whoever serves the resource.
+ *
+ * The platform describes its own resources with these; a plugin that serves
+ * one (`api-v1-resources.ts`) hands the builder its description through the
+ * registration, so the document, and the MCP tools derived from it, describe
+ * every resource the build serves and nothing it does not.
+ *
+ * Pure data and pure functions: nothing here reads a request or a store.
+ */
+/** A JSON Schema / OpenAPI fragment. */
+export type ApiV1Schema = Record<string, unknown>;
+export interface ApiV1Operation {
+    /** Path relative to the server, e.g. `/v1/contacts/{contactId}`. */
+    readonly path: string;
+    readonly method: 'get' | 'post' | 'patch' | 'delete';
+    readonly operationId: string;
+    readonly summary: string;
+    readonly description?: string;
+    /** `true` when the response is the paginated list envelope. */
+    readonly list?: boolean;
+    /** Schema name for the response body, when it is a single record. */
+    readonly returns?: string;
+    /** Schema name for the request body. */
+    readonly accepts?: string;
+    /** Extra query parameters beyond the pagination pair. */
+    readonly filters?: readonly ApiV1Schema[];
+    /** Path parameters, in order. */
+    readonly pathParams?: readonly {
+        name: string;
+        description: string;
+    }[];
+    /**
+     * `true` for a create: a fresh one answers `201`, and a replay of the same
+     * `Idempotency-Key` answers `200` with the record the original create made.
+     */
+    readonly creates?: boolean;
+    /** Entitlement the call needs, named in the 403. */
+    readonly entitlement?: string;
+}
+export interface ApiV1ResourceDescription {
+    readonly tag: string;
+    readonly description: string;
+    readonly schemaName: string;
+    readonly fields: Record<string, ApiV1Schema>;
+    readonly required: readonly string[];
+    readonly ops: readonly ApiV1Operation[];
+    /**
+     * The members a write body may carry: the handler's own writable set, in the
+     * order they are described. A record returns members nothing can write —
+     * `siteId`, `sources`, the stamps — and a closed body listing them would tell
+     * a generated client to send what the handler refuses.
+     */
+    readonly writable?: readonly string[];
+    /** Schemas for writable members the record does not return, or returns differently. */
+    readonly writeOnly?: Record<string, ApiV1Schema>;
+    /** What a create accepts that an update does not, in words. */
+    readonly writeNote?: string;
+    /** Members a write must carry. Only for a body a single method takes. */
+    readonly writeRequired?: readonly string[];
+    /**
+     * Further named schemas the operations reference — a request body that is
+     * not the record's write shape (`ContactMerge`), a response that is not the
+     * record (`LeadConversion`). Each replaces a schema of the same name the
+     * builder would otherwise derive.
+     */
+    readonly components?: Record<string, ApiV1Schema>;
+}
+export declare const isoField: (description: string) => ApiV1Schema;
+export declare const stringField: (description: string) => ApiV1Schema;
+export declare const integerField: (description: string) => ApiV1Schema;
+export declare const booleanField: (description: string) => ApiV1Schema;
+export declare const stringListField: (description: string) => ApiV1Schema;
+/**
+ * A field the API may answer with `null`.
+ *
+ * OpenAPI 3.1 is JSON Schema 2020-12, where nullability is a type UNION and
+ * not the 3.0 `nullable: true` keyword — a generator reading `nullable` here
+ * would silently produce a non-optional field, which is the whole class of bug
+ * the document exists to remove.
+ */
+export declare const nullableField: (base: ApiV1Schema) => ApiV1Schema;
+export declare const openObjectField: (description: string) => ApiV1Schema;
+/** A record's `object` member, which names its kind. */
+export declare const objectKindField: (name: string) => ApiV1Schema;
+export declare const postalAddressField: () => ApiV1Schema;
+/** Every record carries these two. */
+export declare const RECORD_STAMPS: {
+    created: ApiV1Schema;
+    updated: ApiV1Schema;
+};
+export declare const UPDATED_AFTER_PARAM: ApiV1Schema;
+/** An optional query parameter a list filters by. */
+export declare const queryParam: (name: string, description: string, schema?: ApiV1Schema) => ApiV1Schema;

package/src/lib/server/api-v1-description.js

@@ -0,0 +1,126 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * How a `/v1` resource is described in the customer API's OpenAPI document
+ * (AGL-2733), in the shape the console's builder turns into paths, tags and
+ * schemas — whoever serves the resource.
+ *
+ * The platform describes its own resources with these; a plugin that serves
+ * one (`api-v1-resources.ts`) hands the builder its description through the
+ * registration, so the document, and the MCP tools derived from it, describe
+ * every resource the build serves and nothing it does not.
+ *
+ * Pure data and pure functions: nothing here reads a request or a store.
+ */ /** A JSON Schema / OpenAPI fragment. */ import { _ as _extends } from "@swc/helpers/_/_extends";
+// ── Field schemas ──────────────────────────────────────────────────────────
+export const isoField = (description)=>({
+        type: 'string',
+        format: 'date-time',
+        description
+    });
+export const stringField = (description)=>({
+        type: 'string',
+        description
+    });
+export const integerField = (description)=>({
+        type: 'integer',
+        description
+    });
+export const booleanField = (description)=>({
+        type: 'boolean',
+        description
+    });
+export const stringListField = (description)=>({
+        type: 'array',
+        items: {
+            type: 'string'
+        },
+        description
+    });
+/**
+ * A field the API may answer with `null`.
+ *
+ * OpenAPI 3.1 is JSON Schema 2020-12, where nullability is a type UNION and
+ * not the 3.0 `nullable: true` keyword — a generator reading `nullable` here
+ * would silently produce a non-optional field, which is the whole class of bug
+ * the document exists to remove.
+ */ export const nullableField = (base)=>_extends({}, base, {
+        type: [
+            base['type'],
+            'null'
+        ]
+    });
+export const openObjectField = (description)=>({
+        type: 'object',
+        description,
+        additionalProperties: true
+    });
+/** A record's `object` member, which names its kind. */ export const objectKindField = (name)=>({
+        type: 'string',
+        const: name,
+        description: `Always \`${name}\`. Lets a client discriminate a mixed array.`
+    });
+export const postalAddressField = ()=>({
+        type: 'object',
+        description: 'Postal address. Members are optional and free-form.',
+        properties: {
+            line1: {
+                type: 'string'
+            },
+            line2: {
+                type: 'string'
+            },
+            city: {
+                type: 'string'
+            },
+            region: {
+                type: 'string'
+            },
+            postalCode: {
+                type: 'string'
+            },
+            country: {
+                type: 'string'
+            }
+        },
+        additionalProperties: true
+    });
+/** Every record carries these two. */ export const RECORD_STAMPS = {
+    created: isoField('When the record was created.'),
+    updated: isoField('When the record last changed. CRM lists can be walked by it.')
+};
+// ── Query parameters ───────────────────────────────────────────────────────
+export const UPDATED_AFTER_PARAM = {
+    name: 'updatedAfter',
+    in: 'query',
+    required: false,
+    description: 'ISO 8601 instant WITH an offset (`2026-09-01T00:00:00Z`). A bare date ' + 'is a 400 — midnight in whose zone is not a question this API can ' + 'answer. Reorders the list by `updated` ascending, and moves every other ' + 'filter out of the query and onto the page, so pages can come back short.',
+    schema: {
+        type: 'string',
+        format: 'date-time'
+    }
+};
+/** An optional query parameter a list filters by. */ export const queryParam = (name, description, schema = {
+    type: 'string'
+})=>({
+        name,
+        in: 'query',
+        required: false,
+        description,
+        schema
+    });
+
+//# sourceMappingURL=api-v1-description.js.map

package/src/lib/server/api-v1-description.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/api-v1-description.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * How a `/v1` resource is described in the customer API's OpenAPI document\n * (AGL-2733), in the shape the console's builder turns into paths, tags and\n * schemas — whoever serves the resource.\n *\n * The platform describes its own resources with these; a plugin that serves\n * one (`api-v1-resources.ts`) hands the builder its description through the\n * registration, so the document, and the MCP tools derived from it, describe\n * every resource the build serves and nothing it does not.\n *\n * Pure data and pure functions: nothing here reads a request or a store.\n */\n\n/** A JSON Schema / OpenAPI fragment. */\nexport type ApiV1Schema = Record<string, unknown>\n\nexport interface ApiV1Operation {\n  /** Path relative to the server, e.g. `/v1/contacts/{contactId}`. */\n  readonly path: string\n  readonly method: 'get' | 'post' | 'patch' | 'delete'\n  readonly operationId: string\n  readonly summary: string\n  readonly description?: string\n  /** `true` when the response is the paginated list envelope. */\n  readonly list?: boolean\n  /** Schema name for the response body, when it is a single record. */\n  readonly returns?: string\n  /** Schema name for the request body. */\n  readonly accepts?: string\n  /** Extra query parameters beyond the pagination pair. */\n  readonly filters?: readonly ApiV1Schema[]\n  /** Path parameters, in order. */\n  readonly pathParams?: readonly { name: string; description: string }[]\n  /**\n   * `true` for a create: a fresh one answers `201`, and a replay of the same\n   * `Idempotency-Key` answers `200` with the record the original create made.\n   */\n  readonly creates?: boolean\n  /** Entitlement the call needs, named in the 403. */\n  readonly entitlement?: string\n}\n\nexport interface ApiV1ResourceDescription {\n  readonly tag: string\n  readonly description: string\n  readonly schemaName: string\n  readonly fields: Record<string, ApiV1Schema>\n  readonly required: readonly string[]\n  readonly ops: readonly ApiV1Operation[]\n  /**\n   * The members a write body may carry: the handler's own writable set, in the\n   * order they are described. A record returns members nothing can write —\n   * `siteId`, `sources`, the stamps — and a closed body listing them would tell\n   * a generated client to send what the handler refuses.\n   */\n  readonly writable?: readonly string[]\n  /** Schemas for writable members the record does not return, or returns differently. */\n  readonly writeOnly?: Record<string, ApiV1Schema>\n  /** What a create accepts that an update does not, in words. */\n  readonly writeNote?: string\n  /** Members a write must carry. Only for a body a single method takes. */\n  readonly writeRequired?: readonly string[]\n  /**\n   * Further named schemas the operations reference — a request body that is\n   * not the record's write shape (`ContactMerge`), a response that is not the\n   * record (`LeadConversion`). Each replaces a schema of the same name the\n   * builder would otherwise derive.\n   */\n  readonly components?: Record<string, ApiV1Schema>\n}\n\n// ── Field schemas ──────────────────────────────────────────────────────────\n\nexport const isoField = (description: string): ApiV1Schema => ({\n  type: 'string',\n  format: 'date-time',\n  description,\n})\n\nexport const stringField = (description: string): ApiV1Schema => ({ type: 'string', description })\nexport const integerField = (description: string): ApiV1Schema => ({ type: 'integer', description })\nexport const booleanField = (description: string): ApiV1Schema => ({ type: 'boolean', description })\nexport const stringListField = (description: string): ApiV1Schema => ({\n  type: 'array',\n  items: { type: 'string' },\n  description,\n})\n\n/**\n * A field the API may answer with `null`.\n *\n * OpenAPI 3.1 is JSON Schema 2020-12, where nullability is a type UNION and\n * not the 3.0 `nullable: true` keyword — a generator reading `nullable` here\n * would silently produce a non-optional field, which is the whole class of bug\n * the document exists to remove.\n */\nexport const nullableField = (base: ApiV1Schema): ApiV1Schema => ({\n  ...base,\n  type: [base['type'], 'null'],\n})\n\nexport const openObjectField = (description: string): ApiV1Schema => ({\n  type: 'object',\n  description,\n  additionalProperties: true,\n})\n\n/** A record's `object` member, which names its kind. */\nexport const objectKindField = (name: string): ApiV1Schema => ({\n  type: 'string',\n  const: name,\n  description: `Always \\`${name}\\`. Lets a client discriminate a mixed array.`,\n})\n\nexport const postalAddressField = (): ApiV1Schema => ({\n  type: 'object',\n  description: 'Postal address. Members are optional and free-form.',\n  properties: {\n    line1: { type: 'string' },\n    line2: { type: 'string' },\n    city: { type: 'string' },\n    region: { type: 'string' },\n    postalCode: { type: 'string' },\n    country: { type: 'string' },\n  },\n  additionalProperties: true,\n})\n\n/** Every record carries these two. */\nexport const RECORD_STAMPS = {\n  created: isoField('When the record was created.'),\n  updated: isoField('When the record last changed. CRM lists can be walked by it.'),\n}\n\n// ── Query parameters ───────────────────────────────────────────────────────\n\nexport const UPDATED_AFTER_PARAM: ApiV1Schema = {\n  name: 'updatedAfter',\n  in: 'query',\n  required: false,\n  description:\n    'ISO 8601 instant WITH an offset (`2026-09-01T00:00:00Z`). A bare date ' +\n    'is a 400 — midnight in whose zone is not a question this API can ' +\n    'answer. Reorders the list by `updated` ascending, and moves every other ' +\n    'filter out of the query and onto the page, so pages can come back short.',\n  schema: { type: 'string', format: 'date-time' },\n}\n\n/** An optional query parameter a list filters by. */\nexport const queryParam = (\n  name: string,\n  description: string,\n  schema: ApiV1Schema = { type: 'string' },\n): ApiV1Schema => ({\n  name,\n  in: 'query',\n  required: false,\n  description,\n  schema,\n})\n"],"names":["isoField","description","type","format","stringField","integerField","booleanField","stringListField","items","nullableField","base","openObjectField","additionalProperties","objectKindField","name","const","postalAddressField","properties","line1","line2","city","region","postalCode","country","RECORD_STAMPS","created","updated","UPDATED_AFTER_PARAM","in","required","schema","queryParam"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC,GAED,sCAAsC;AA0DtC,8EAA8E;AAE9E,OAAO,MAAMA,WAAW,CAACC,cAAsC,CAAA;QAC7DC,MAAM;QACNC,QAAQ;QACRF;IACF,CAAA,EAAE;AAEF,OAAO,MAAMG,cAAc,CAACH,cAAsC,CAAA;QAAEC,MAAM;QAAUD;IAAY,CAAA,EAAE;AAClG,OAAO,MAAMI,eAAe,CAACJ,cAAsC,CAAA;QAAEC,MAAM;QAAWD;IAAY,CAAA,EAAE;AACpG,OAAO,MAAMK,eAAe,CAACL,cAAsC,CAAA;QAAEC,MAAM;QAAWD;IAAY,CAAA,EAAE;AACpG,OAAO,MAAMM,kBAAkB,CAACN,cAAsC,CAAA;QACpEC,MAAM;QACNM,OAAO;YAAEN,MAAM;QAAS;QACxBD;IACF,CAAA,EAAE;AAEF;;;;;;;CAOC,GACD,OAAO,MAAMQ,gBAAgB,CAACC,OAAoC,aAC7DA;QACHR,MAAM;YAACQ,IAAI,CAAC,OAAO;YAAE;SAAO;OAC5B;AAEF,OAAO,MAAMC,kBAAkB,CAACV,cAAsC,CAAA;QACpEC,MAAM;QACND;QACAW,sBAAsB;IACxB,CAAA,EAAE;AAEF,sDAAsD,GACtD,OAAO,MAAMC,kBAAkB,CAACC,OAA+B,CAAA;QAC7DZ,MAAM;QACNa,OAAOD;QACPb,aAAa,CAAC,SAAS,EAAEa,KAAK,6CAA6C,CAAC;IAC9E,CAAA,EAAE;AAEF,OAAO,MAAME,qBAAqB,IAAoB,CAAA;QACpDd,MAAM;QACND,aAAa;QACbgB,YAAY;YACVC,OAAO;gBAAEhB,MAAM;YAAS;YACxBiB,OAAO;gBAAEjB,MAAM;YAAS;YACxBkB,MAAM;gBAAElB,MAAM;YAAS;YACvBmB,QAAQ;gBAAEnB,MAAM;YAAS;YACzBoB,YAAY;gBAAEpB,MAAM;YAAS;YAC7BqB,SAAS;gBAAErB,MAAM;YAAS;QAC5B;QACAU,sBAAsB;IACxB,CAAA,EAAE;AAEF,oCAAoC,GACpC,OAAO,MAAMY,gBAAgB;IAC3BC,SAASzB,SAAS;IAClB0B,SAAS1B,SAAS;AACpB,EAAC;AAED,8EAA8E;AAE9E,OAAO,MAAM2B,sBAAmC;IAC9Cb,MAAM;IACNc,IAAI;IACJC,UAAU;IACV5B,aACE,2EACA,sEACA,6EACA;IACF6B,QAAQ;QAAE5B,MAAM;QAAUC,QAAQ;IAAY;AAChD,EAAC;AAED,mDAAmD,GACnD,OAAO,MAAM4B,aAAa,CACxBjB,MACAb,aACA6B,SAAsB;IAAE5B,MAAM;AAAS,CAAC,GACvB,CAAA;QACjBY;QACAc,IAAI;QACJC,UAAU;QACV5B;QACA6B;IACF,CAAA,EAAE"}