@aglyn/tenant-data-admin 1.0.0-beta.220 → 1.0.0-beta.221

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.220",
+  "version": "1.0.0-beta.221",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.220",
-    "@aglyn/shared-util-email": "1.0.0-beta.220",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.220",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.220",
-    "@aglyn/shared-util-http": "1.0.0-beta.220",
-    "@aglyn/shared-util-tools": "1.0.0-beta.220",
+    "@aglyn/aglyn": "1.0.0-beta.221",
+    "@aglyn/shared-util-email": "1.0.0-beta.221",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.221",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.221",
+    "@aglyn/shared-util-http": "1.0.0-beta.221",
+    "@aglyn/shared-util-tools": "1.0.0-beta.221",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
     "sharp": "^0.35.5",

package/src/lib/server/hosted-page-review.d.ts

@@ -36,6 +36,13 @@ export interface HostedPageReviewRequest {
      * to name the page — never to decide whether it serves.
      */
     page?: HostedPageContext | null;
+    /**
+     * Signals found about this page elsewhere, judged with the page's own
+     * (AGL-3451): the daily link re-check passes a link Web Risk has listed
+     * since the page went live, so the hold, its row and the young
+     * workspace's security hold all come from this one path.
+     */
+    extraSignals?: readonly PhishingScreenSignal[];
 }
 export type HostedPageReviewOutcome = {
     outcome: 'serve';

package/src/lib/server/hosted-page-review.js

@@ -51,6 +51,9 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  *   site's cache and the next render serves it) or mark it actioned to
  *   REJECT (it stays unserved; any later version carrying the same signals
  *   is refused without a new row).
+ * - A hold from a workspace in its first fortnight also asks for an
+ *   automatic `security` hold on the workspace, the site and the publishing
+ *   account (`page-security-hold.ts`, AGL-3450), which the console places.
  * - Keyed on the SIGNALS, as the send seam's rows are: a composed page
  *   carries per-render values (dates, collection rows) that no content hash
  *   would survive, while what makes it phishing does not change between
@@ -58,12 +61,16 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  *
  * ## Tiers
  *
- * `signalsThatHold`: a lookalike link or embed and an author-defined
- * credential field hold for EVERY workspace; a brand's call to action or
- * lure, and a call to action that leaves the site beside a lure, only for a
- * workspace in its first fortnight. The workspace's documents are read only
- * when the pure screen has found something, so a clean page costs no read
- * for this.
+ * `signalsThatHold`: a lookalike link or embed, an author-defined
+ * credential field and a link to a host Google Web Risk lists
+ * (`web-risk-link`, AGL-3451) hold for EVERY workspace; a brand's call to
+ * action or lure, and a call to action that leaves the site beside a lure,
+ * only for a workspace in its first fortnight. The workspace's documents are
+ * read only when something was found, so a clean page costs no read for
+ * this. The page's foreign hosts are looked up first, against a cache
+ * (`web-risk.ts`), and noted beside the version it serves so the daily
+ * re-check can look again: a harvester is often listed only after it is
+ * published. A lookup that fails finds nothing, so it never holds a page.
  *
  * Fails CLOSED, unlike the send path: a page the pure screen flagged whose
  * review cannot finish — the workspace read, the row write — is answered
@@ -81,17 +88,21 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * {@link reviewSiteRedirect} before it serves one. Same screen
  * (`screenSiteRedirect`), same tiers, same row and the same staff decision:
  * a held rule does not fire, and is filed as a `page` hold on its rule's
- * document.
+ * document. Its destination is looked up against the reputation list too
+ * (AGL-3451), so a redirect to a listed site holds for every workspace.
  *=========================================*/ import { ABUSE_REPORT_COLLECTION } from "@aglyn/aglyn/app-utils/abuse-report";
 import { heldPageConsolePath, heldPageDetails, heldPageLabel, heldPageVisitorSentence } from "@aglyn/shared-util-email/held-page";
 import { screenHostedPage, screenSiteRedirect } from "@aglyn/shared-util-email/hosted-page-screen";
 import { lookalikeBrandForHost, phishingScreenBrandLabel, describePhishingScreenSignals, isYoungWorkspaceAge, signalsThatHold } from "@aglyn/shared-util-email/outbound-phishing-screen";
+import { foreignHostsForReputation, webRiskSignals } from "@aglyn/shared-util-email/link-reputation";
 import { FieldValue } from "firebase-admin/firestore";
 import firebaseAdmin from "./firebase-admin.js";
 import { describeHeldPage } from "./held-page-subject.js";
 import { notifyRiskEvent } from "./risk-notice.js";
 import { orgAgeDays } from "./org-age.js";
+import { requestPageSecurityHold } from "./page-security-hold.js";
 import { getHostDocAdmin, getOrgForHost } from "./organizations.js";
+import { lookupHostReputation, platformReputationExclusions } from "./web-risk.js";
 import { canonicalJson, fileOutboundHold, flaggedHostOf, heldOutboundReference, heldOutboundReviewId, outboundContentHash, workspaceScreenIdentity } from "./outbound-send-review.js";
 /** Where the last version a page served clean is noted: a hint, re-screened before use. */ export const PAGE_REVIEW_SUBCOLLECTION = 'pageReviews';
 /** The review row's id for a page and the signals that held. */ export function pageReviewId(hostId, screenId, signals) {
@@ -105,10 +116,53 @@ const pageMemo = new Map();
 /** The version each page last served clean, as this process last wrote it. */ const servedMemo = new Map();
 /** Lookalike hosts this process already flagged for an established page, and when. */ const flaggedMemo = new Map();
 const FLAGGED_MEMO_TTL_MS = 60 * 60000;
+/**
+ * The foreign hosts each reviewed page version links to (AGL-3451), for
+ * {@link recordServedPageVersion} to note beside the version it served, which
+ * is what the daily link re-check walks. Bounded: a process that reviews more
+ * pages than this starts again.
+ */ const reviewedForeignHosts = new Map();
+const REVIEWED_FOREIGN_HOSTS_MAX = 10000;
 /** Test seam: forget what this process learned. */ export function resetHostedPageReviewMemoForTests() {
     pageMemo.clear();
     servedMemo.clear();
     flaggedMemo.clear();
+    reviewedForeignHosts.clear();
+}
+/**
+ * Every foreign host the page links to, and the ones Google Web Risk lists
+ * (AGL-3451). Foreign before the workspace is known: not the platform's
+ * own, not a brand's own domain, not a common social link. Never throws; a
+ * lookup that failed lists nothing.
+ */ async function pageLinkReputation(linkHosts) {
+    // Runs before the review's fail-closed `try`, so it must not throw: an
+    // answer it cannot give is no listing, never a reason to hold.
+    try {
+        const hosts = foreignHostsForReputation(linkHosts, {
+            excludeDomains: platformReputationExclusions()
+        });
+        if (!hosts.length) return {
+            hosts,
+            signals: []
+        };
+        const answer = await lookupHostReputation(hosts);
+        return {
+            hosts,
+            signals: webRiskSignals(answer.hits)
+        };
+    } catch (error) {
+        console.warn('[page-review] link reputation could not be read — no listing assumed', error);
+        return {
+            hosts: [],
+            signals: []
+        };
+    }
+}
+/** Is this host one of the workspace's own? */ function isOwnHost(host, ownDomains) {
+    return (ownDomains != null ? ownDomains : []).some((own)=>{
+        const domain = String(own != null ? own : '').trim().toLowerCase();
+        return Boolean(domain) && (host === domain || host.endsWith(`.${domain}`));
+    });
 }
 /**
  * The subject a row already stored, or a fresh description (AGL-3374). A row
@@ -132,11 +186,21 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
  * Screen one page as a visitor would receive it, and say whether it may be
  * served. See the module header.
  */ export async function reviewHostedPage(request) {
-    var _request_nowMs;
+    var _request_extraSignals, _request_nowMs;
     const found = screenHostedPage({
         nodes: request.nodes
     });
-    if (!found.signals.length) return {
+    // Every foreign host it points at, against the reputation list
+    // (AGL-3451): a harvester known to be bad anywhere holds however plain the
+    // page around it is. Strong, so it holds at any workspace age.
+    const reputation = await pageLinkReputation(found.linkHosts);
+    if (reviewedForeignHosts.size >= REVIEWED_FOREIGN_HOSTS_MAX) reviewedForeignHosts.clear();
+    reviewedForeignHosts.set(`${request.hostId}/${request.screenId}/${request.versionId}`, reputation.hosts);
+    const listed = [
+        ...reputation.signals,
+        ...(_request_extraSignals = request.extraSignals) != null ? _request_extraSignals : []
+    ];
+    if (!found.signals.length && !listed.length) return {
         outcome: 'serve'
     };
     const nowMs = (_request_nowMs = request.nowMs) != null ? _request_nowMs : Date.now();
@@ -160,6 +224,11 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
         const verdict = screenHostedPage(_extends({
             nodes: request.nodes
         }, identity));
+        // A listing of the workspace's own host is not a link away from it.
+        const screened = [
+            ...verdict.signals,
+            ...listed.filter((signal)=>!('host' in signal) || !isOwnHost(signal.host, identity.ownDomains))
+        ];
         const ageDays = orgAgeDays(org == null ? void 0 : org.createdAt, nowMs);
         // Every workspace is screened, however old: an established account can
         // be compromised, and a compromised account publishing a lure is the
@@ -174,7 +243,7 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
         //   - content ALREADY LIVE keeps serving, and is flagged to staff as
         //     urgent, who lock the site if it is impersonation.
         if (!isYoungWorkspaceAge(ageDays)) {
-            const strong = signalsThatHold(verdict.signals, {
+            const strong = signalsThatHold(screened, {
                 ageDays
             });
             if (!strong.length) return {
@@ -198,7 +267,7 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
                 };
             }
         }
-        const signals = signalsThatHold(verdict.signals, {
+        const signals = signalsThatHold(screened, {
             ageDays
         });
         if (!signals.length) return {
@@ -272,6 +341,25 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
             url,
             reportedHostname: flagged
         });
+        // A hold from a workspace in its first fortnight also holds the
+        // workspace, the site and the account that published it (AGL-3450).
+        if (state === 'held') {
+            await requestPageSecurityHold({
+                orgId: orgId != null ? orgId : '',
+                org,
+                hostId: request.hostId,
+                screenId: request.screenId,
+                versionId: request.versionId,
+                reviewId,
+                reference,
+                signals,
+                ageDays,
+                pageLabel: label,
+                pageUrl: url,
+                siteName: typeof (host == null ? void 0 : host['name']) === 'string' ? host['name'] : null,
+                nowMs
+            });
+        }
         pageMemo.set(reviewId, {
             state,
             atMs: nowMs
@@ -288,7 +376,10 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
         // review that could not finish has not cleared it. Not remembered, so
         // the next render reviews it again.
         console.error('[page-review] a flagged page could not be reviewed — holding it', error);
-        const reviewId = pageReviewId(request.hostId, request.screenId, found.signals);
+        const reviewId = pageReviewId(request.hostId, request.screenId, [
+            ...found.signals,
+            ...listed
+        ]);
         return {
             outcome: 'held',
             reviewId,
@@ -317,7 +408,10 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
         source: request.source,
         destination: request.destination
     });
-    if (!found.signals.length) return {
+    // Where it sends visitors, against the reputation list (AGL-3451): a
+    // listed destination holds for every workspace, as a listed link does.
+    const reputation = await pageLinkReputation(found.linkHosts);
+    if (!found.signals.length && !reputation.signals.length) return {
         outcome: 'serve'
     };
     const nowMs = (_request_nowMs = request.nowMs) != null ? _request_nowMs : Date.now();
@@ -340,8 +434,12 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
             source: request.source,
             destination: request.destination
         }, identity));
+        const screened = [
+            ...verdict.signals,
+            ...reputation.signals.filter((signal)=>!('host' in signal) || !isOwnHost(signal.host, identity.ownDomains))
+        ];
         const ageDays = orgAgeDays(org == null ? void 0 : org.createdAt, nowMs);
-        const signals = signalsThatHold(verdict.signals, {
+        const signals = signalsThatHold(screened, {
             ageDays
         });
         if (!signals.length) return {
@@ -407,7 +505,10 @@ const FLAGGED_MEMO_TTL_MS = 60 * 60000;
     } catch (error) {
         // Closed, as a page is: the screen found a signal and nothing cleared it.
         console.error('[page-review] a flagged redirect could not be reviewed — holding it', error);
-        const reviewId = redirectReviewId(request.hostId, request.ruleId, found.signals);
+        const reviewId = redirectReviewId(request.hostId, request.ruleId, [
+            ...found.signals,
+            ...reputation.signals
+        ]);
         return {
             outcome: 'held',
             reviewId,
@@ -549,19 +650,29 @@ async function isAlreadyLive(hostId, screenId, versionId, nowMs) {
  * after that, however often the page is rendered.
  */ export async function recordServedPageVersion(hostId, screenId, versionId) {
     const key = `${hostId}/${screenId}`;
-    if (!versionId || servedMemo.get(key) === versionId) return;
+    // The foreign hosts this version links to, as its review found them
+    // (AGL-3451): noted beside it so the daily link re-check can walk them.
+    const foreignHosts = reviewedForeignHosts.get(`${key}/${versionId}`);
+    const memoValue = foreignHosts ? `${versionId}|${foreignHosts.join(',')}` : versionId;
+    if (!versionId || servedMemo.get(key) === memoValue) return;
     try {
         const ref = pageReviewRef(hostId, screenId);
         const snapshot = await ref.get();
-        if (snapshot.get('servedVersionId') !== versionId) {
-            await ref.set({
+        const versionMoved = snapshot.get('servedVersionId') !== versionId;
+        const stored = snapshot.get('foreignHosts');
+        const hostsMoved = foreignHosts !== undefined && (Array.isArray(stored) ? stored.join(',') : '') !== foreignHosts.join(',');
+        if (versionMoved || hostsMoved) {
+            await ref.set(_extends({}, versionMoved ? {
                 servedVersionId: versionId,
                 servedAtMs: Date.now()
-            }, {
+            } : {}, foreignHosts ? {
+                foreignHosts,
+                foreignHostCount: foreignHosts.length
+            } : {}), {
                 merge: true
             });
         }
-        servedMemo.set(key, versionId);
+        servedMemo.set(key, memoValue);
     } catch (error) {
         console.warn('[page-review] the served version could not be noted', error);
     }

package/src/lib/server/hosted-page-review.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/hosted-page-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * HELD FOR REVIEW: a published page (AGL-3362).\n *\n * ## Why the check sits where a page is COMPOSED, not where it is published\n *\n * A publish is a browser write. The besigner toolbar, the versions panel,\n * the screen details page, page-from-template, the layout and component\n * besigners and the form besigner each move a pointer (`versionId`, the\n * host's `screens` map, a component's own `nodes`) straight from the\n * client SDK; the scheduled-publish beat moves it from the server; an\n * experiment serves a version no pointer names; and an author may rewrite\n * the LIVE version document itself without moving any pointer at all. A\n * check on any one of those writes is a check the next one walks around.\n *\n * They all meet in one place: `composeScreenNodes` (`@aglyn/tenant-runtime`),\n * which every published render, the password unlock, the collection and\n * product templates and every experiment variant go through, and which\n * returns the page exactly as a visitor will receive it — the screen, its\n * layout chrome, its grafted components and its forms. So the screen is read\n * there, and a held page is one that is never composed for a visitor. For a\n * visitor, \"publish\" is the first render after the pointer moved; this is\n * that moment.\n *\n * ## What a hold does\n *\n * - The version is not served. The last version this page served clean\n *   ({@link servedPageVersion}) is composed instead — screened again, since\n *   a version document can be edited in place — and if there is none, or it\n *   holds too, the page is not found. A first publish that holds therefore\n *   serves nothing.\n * - One review row per (page, signal set) lands in the abuse queue at\n *   `/admin/abuse-reports`, the same `phishing` row a held email files\n *   (`fileOutboundHold`), with `heldSend.kind: 'page'`, the page's URL and\n *   the held version. Staff dismiss it to RELEASE (the admin route drops the\n *   site's cache and the next render serves it) or mark it actioned to\n *   REJECT (it stays unserved; any later version carrying the same signals\n *   is refused without a new row).\n * - Keyed on the SIGNALS, as the send seam's rows are: a composed page\n *   carries per-render values (dates, collection rows) that no content hash\n *   would survive, while what makes it phishing does not change between\n *   renders.\n *\n * ## Tiers\n *\n * `signalsThatHold`: a lookalike link or embed and an author-defined\n * credential field hold for EVERY workspace; a brand's call to action or\n * lure, and a call to action that leaves the site beside a lure, only for a\n * workspace in its first fortnight. The workspace's documents are read only\n * when the pure screen has found something, so a clean page costs no read\n * for this.\n *\n * Fails CLOSED, unlike the send path: a page the pure screen flagged whose\n * review cannot finish — the workspace read, the row write — is answered\n * `held`, and the composer serves its last clean version or nothing. The\n * answer is not remembered, so the next render reviews it again. Composition\n * itself reads the store, so an outage here is an outage on the render\n * already, and the only cost of not serving a page the screen flagged is a\n * false positive's wait; serving it is the phishing page this exists to\n * stop. A page the screen found nothing on never reaches this.\n *\n * ## Site redirects\n *\n * A redirect rule that sends a path off the site is a page whose one call to\n * action fires on arrival, so the redirects plugin asks\n * {@link reviewSiteRedirect} before it serves one. Same screen\n * (`screenSiteRedirect`), same tiers, same row and the same staff decision:\n * a held rule does not fire, and is filed as a `page` hold on its rule's\n * document.\n *=========================================*/\n\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport {\n  heldPageConsolePath,\n  heldPageDetails,\n  heldPageLabel,\n  heldPageVisitorSentence,\n  type HeldPageSubject,\n} from '@aglyn/shared-util-email/held-page'\nimport { screenHostedPage, screenSiteRedirect } from '@aglyn/shared-util-email/hosted-page-screen'\nimport {\n  lookalikeBrandForHost,\n  phishingScreenBrandLabel,\n  type PhishingScreenSignal,\n  describePhishingScreenSignals,\n  isYoungWorkspaceAge,\n  signalsThatHold,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { describeHeldPage, type HostedPageContext } from './held-page-subject'\nimport { notifyRiskEvent } from './risk-notice'\nimport { orgAgeDays } from './org-age'\nimport { getHostDocAdmin, getOrgForHost } from './organizations'\nimport {\n  canonicalJson,\n  fileOutboundHold,\n  flaggedHostOf,\n  heldOutboundReference,\n  heldOutboundReviewId,\n  outboundContentHash,\n  type HeldOutboundSendState,\n  workspaceScreenIdentity,\n} from './outbound-send-review'\n\n/** Where the last version a page served clean is noted: a hint, re-screened before use. */\nexport const PAGE_REVIEW_SUBCOLLECTION = 'pageReviews'\n\nexport interface HostedPageReviewRequest {\n  hostId: string\n  screenId: string\n  versionId: string\n  /** The page as composed for a visitor. */\n  nodes: unknown\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n  /**\n   * What the composer knows about the page (AGL-3374): the screen document,\n   * the template route it is rendering, the variant, and a way to read the\n   * layouts and components composed into it. Read only when a row is filed,\n   * to name the page — never to decide whether it serves.\n   */\n  page?: HostedPageContext | null\n}\n\nexport type HostedPageReviewOutcome =\n  | { outcome: 'serve' }\n  | { outcome: 'held' | 'rejected'; reviewId: string; reference: string }\n\n/** The review row's id for a page and the signals that held. */\nexport function pageReviewId(\n  hostId: string,\n  screenId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/screens/${screenId}`, outboundContentHash([key]))\n}\n\n/** How long this process trusts a page row's state — the send seam's minute. */\nconst PAGE_MEMO_TTL_MS = 60_000\nconst pageMemo = new Map<string, { state: HeldOutboundSendState; atMs: number }>()\n/** The version each page last served clean, as this process last wrote it. */\nconst servedMemo = new Map<string, string>()\n/** Lookalike hosts this process already flagged for an established page, and when. */\nconst flaggedMemo = new Map<string, number>()\nconst FLAGGED_MEMO_TTL_MS = 60 * 60_000\n\n/** Test seam: forget what this process learned. */\nexport function resetHostedPageReviewMemoForTests(): void {\n  pageMemo.clear()\n  servedMemo.clear()\n  flaggedMemo.clear()\n}\n\n/**\n * The subject a row already stored, or a fresh description (AGL-3374). A row\n * that names its page is not described again, so the reads the description\n * may make are paid once per row, not once per render.\n */\nasync function subjectForRow(\n  reviewId: string,\n  describe: () => Promise<HeldPageSubject>,\n): Promise<HeldPageSubject> {\n  const stored = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .get()\n    .then((row) => storedSubject(row.get('heldPage')))\n    .catch(() => null)\n  return stored ?? describe()\n}\n\n/** A row's stored subject, when it has one. */\nfunction storedSubject(heldPage: unknown): HeldPageSubject | null {\n  const subject = (heldPage as { subject?: HeldPageSubject } | null | undefined)?.subject\n  return subject && typeof subject === 'object' && subject.screenId ? subject : null\n}\n\n/** The row's first line, naming the page and where it was seen. */\nfunction pageHeadline(subject: HeldPageSubject, siteName: string): string {\n  return [`${heldPageLabel(subject)} of ${siteName}.`, ...heldPageDetails(subject)].join(' ')\n}\n\n/**\n * Screen one page as a visitor would receive it, and say whether it may be\n * served. See the module header.\n */\nexport async function reviewHostedPage(\n  request: HostedPageReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenHostedPage({ nodes: request.nodes })\n  if (!found.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    // Again, now knowing whose page it is: a brand in the workspace's own\n    // name or domain is its own, and a link to its own site is not away.\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenHostedPage({ nodes: request.nodes, ...identity })\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    // Every workspace is screened, however old: an established account can\n    // be compromised, and a compromised account publishing a lure is the\n    // same harm as a new one. What differs is what a hold may take DOWN.\n    // Holding content that is already live serves its last clean version or\n    // nothing, and on a real business's home page that is an outage the\n    // screen caused (aglyn.com, 2026-09-28, a page that had served clean\n    // until a rule changed). So for an established workspace:\n    //   - NEW content (a new version of a live page, or a page that has\n    //     never been live) holds, exactly as for a young workspace; the live\n    //     page keeps serving its last clean version, or the new page waits;\n    //   - content ALREADY LIVE keeps serving, and is flagged to staff as\n    //     urgent, who lock the site if it is impersonation.\n    if (!isYoungWorkspaceAge(ageDays)) {\n      const strong = signalsThatHold(verdict.signals, { ageDays })\n      if (!strong.length) return { outcome: 'serve' }\n      if (await isAlreadyLive(request.hostId, request.screenId, request.versionId, nowMs)) {\n        await flagLivePage({\n          hostId: request.hostId,\n          screenId: request.screenId,\n          versionId: request.versionId,\n          orgId,\n          host,\n          signals: strong,\n          nowMs,\n          page: request.page ?? null,\n          identity,\n        })\n        return { outcome: 'serve' }\n      }\n    }\n    const signals = signalsThatHold(verdict.signals, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = pageReviewId(request.hostId, request.screenId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    // The page by its real name and route (AGL-3374): a template, a list,\n    // a variant, or a page whose flagged content lives in its layout.\n    const subject = await subjectForRow(reviewId, async () =>\n      describeHeldPage({\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        host,\n        page: request.page,\n        signals,\n        identity,\n        live: false,\n        previousVersionId: await servedPageVersion(request.hostId, request.screenId),\n      }),\n    )\n    const url = subject.entryUrl ?? subject.url\n    const flagged = flaggedHostOf(signals)\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const label = heldPageLabel(subject)\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/screens/${request.screenId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      extra: {\n        heldPage: { screenId: request.screenId, versionId: request.versionId, url, subject },\n      },\n      headline:\n        `Held ${pageHeadline(subject, siteName)} Version ${request.versionId}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. ${heldPageVisitorSentence(subject)}`,\n      alertTitle: 'Published page held for review — possible phishing',\n      alertBody: `${label.charAt(0).toUpperCase()}${label.slice(1)} was held before it went live.`,\n      // The owners' words for it, and where they fix it (AGL-3368, AGL-3374).\n      item: { label, path: heldPageConsolePath(subject, request.hostId) },\n      page: subject,\n      // The page itself is what was reported; the flagged host, when there\n      // is one, is named in the details and on `reportedHostname`.\n      url,\n      reportedHostname: flagged,\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed: the screen has already found a signal on this page, and a\n    // review that could not finish has not cleared it. Not remembered, so\n    // the next render reviews it again.\n    console.error('[page-review] a flagged page could not be reviewed — holding it', error)\n    const reviewId = pageReviewId(request.hostId, request.screenId, found.signals)\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nexport interface SiteRedirectReviewRequest {\n  hostId: string\n  /** The rule's document id under `hosts/{hostId}/redirects`. */\n  ruleId: string\n  /** The path, or the pattern, the rule answers. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n}\n\n/** The review row's id for a redirect rule and the signals that held. */\nexport function redirectReviewId(\n  hostId: string,\n  ruleId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/redirects/${ruleId}`, outboundContentHash([key]))\n}\n\n/**\n * Screen one redirect rule before it sends a visitor off the site\n * (AGL-3447), and say whether it may fire. See the module header.\n *\n * Every workspace is screened and the tiers decide, as for a page: a\n * destination that wears a brand holds for all of them, a lure path sent\n * off the site only for a workspace in its first fortnight. A held rule is\n * filed once per (rule, signal set) and decided by staff on that row:\n * dismissed, it fires; actioned, it never does with those signals.\n */\nexport async function reviewSiteRedirect(\n  request: SiteRedirectReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenSiteRedirect({ source: request.source, destination: request.destination })\n  if (!found.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenSiteRedirect({\n      source: request.source,\n      destination: request.destination,\n      ...identity,\n    })\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    const signals = signalsThatHold(verdict.signals, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    const source = request.source.slice(0, 200)\n    const destination = request.destination.slice(0, 500)\n    const label = `the redirect from ${source}`\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const [subdomainHost, customDomain] = identity.ownDomains ?? []\n    const siteHost = customDomain || subdomainHost\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/redirects/${request.ruleId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      headline:\n        `Held ${label} of ${siteName}, which sends visitors to ${destination}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. The rule does not fire until this is decided.`,\n      alertTitle: 'Site redirect held for review — possible phishing',\n      alertBody: `The redirect from ${source} was held before it sent anyone off the site.`,\n      // Where the owners fix it: the site's Redirects page.\n      item: { label, path: `/${request.hostId}/redirects` },\n      url: siteHost && source.startsWith('/') ? `https://${siteHost}${source}` : destination,\n      reportedHostname: flaggedHostOf(signals),\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed, as a page is: the screen found a signal and nothing cleared it.\n    console.error('[page-review] a flagged redirect could not be reviewed — holding it', error)\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, found.signals)\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nfunction pageReviewRef(hostId: string, screenId: string) {\n  return firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection(PAGE_REVIEW_SUBCOLLECTION)\n    .doc(screenId)\n}\n\n/**\n * Is this version of the page already what visitors receive? It is when it\n * is the version the page last served clean, or when the page has no record\n * at all and is not new: it went live before the screen existed. A page\n * created in the last {@link NEW_PAGE_DAYS} days with no record has never\n * been live, so holding it takes nothing down.\n */\nconst NEW_PAGE_DAYS = 7\nasync function isAlreadyLive(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n  nowMs: number,\n): Promise<boolean> {\n  const lastClean = await servedPageVersion(hostId, screenId)\n  if (lastClean) return lastClean === versionId\n  try {\n    const screen = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('screens')\n      .doc(screenId)\n      .get()\n    const created = screen.get('createdAt') as { toMillis?: () => number } | number | undefined\n    const createdMs =\n      typeof created === 'number' ? created : typeof created?.toMillis === 'function' ? created.toMillis() : null\n    // No readable creation time: an old page, so live.\n    return createdMs === null || nowMs - createdMs >= NEW_PAGE_DAYS * 24 * 60 * 60 * 1000\n  } catch {\n    return true\n  }\n}\n\n/**\n * A page ALREADY LIVE carries a strong signal: file one urgent abuse row for\n * it (keyed on the page and its signals, so a busy page is one row) and, the\n * first time, tell staff and the owners through the `page-flagged` notice.\n * The page keeps serving; staff lock the site if it is impersonation or the\n * account looks compromised. Once per page and signal set per process.\n */\nasync function flagLivePage(input: {\n  hostId: string\n  screenId: string\n  versionId: string\n  orgId: string | null\n  host: Record<string, unknown> | null\n  signals: readonly PhishingScreenSignal[]\n  nowMs: number\n  page?: HostedPageContext | null\n  identity?: ReturnType<typeof workspaceScreenIdentity>\n}): Promise<void> {\n  const key = `${input.hostId}\\n${input.screenId}\\n${input.signals.map((signal) => canonicalJson(signal)).sort().join('\\n')}`\n  const at = flaggedMemo.get(key)\n  if (at !== undefined && input.nowMs - at < FLAGGED_MEMO_TTL_MS) return\n  flaggedMemo.set(key, input.nowMs)\n  try {\n    const reviewId = pageReviewId(input.hostId, `${input.screenId}/live`, input.signals)\n    const reference = heldOutboundReference(reviewId)\n    const evidence = describePhishingScreenSignals(input.signals).join(' ')\n    const flagged = flaggedHostOf(input.signals)\n    const ref = firebaseAdmin.app().firestore().collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const existing = await ref.get()\n    const first = !existing.exists\n    // Named once, when the row is new (AGL-3374).\n    const subject =\n      (existing.exists ? storedSubject(existing.get('heldPage')) : null) ??\n      (await describeHeldPage({\n        hostId: input.hostId,\n        screenId: input.screenId,\n        versionId: input.versionId,\n        host: input.host,\n        page: input.page,\n        signals: input.signals,\n        identity: input.identity ?? workspaceScreenIdentity({ host: input.host }),\n        live: true,\n        previousVersionId: null,\n      }))\n    const url = subject.entryUrl ?? subject.url\n    const siteName =\n      typeof input.host?.['name'] === 'string' && input.host['name']\n        ? `\"${input.host['name']}\"`\n        : 'a site'\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url,\n        reportedHostname: flagged,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          `LIVE: ${pageHeadline(subject, siteName)} It was flagged by the phishing screen and is still serving.`,\n          evidence,\n          'Lock the site if it is impersonation or the account looks compromised; dismiss this if the content is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        heldPage: { screenId: input.screenId, versionId: input.versionId, url, subject },\n        riskNotice: { kind: 'page-flagged' },\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (!first) return\n    await notifyRiskEvent({\n      kind: 'page-flagged',\n      orgId: input.orgId,\n      hostId: input.hostId,\n      reviewId,\n      reference,\n      item: { label: heldPageLabel(subject), path: heldPageConsolePath(subject, input.hostId) },\n      page: subject,\n      staffEvidence: [...heldPageDetails(subject), evidence].join(' '),\n    })\n  } catch (error) {\n    console.error('[page-review] a live page could not be flagged', error)\n  }\n}\n\n/**\n * The version this page last served clean, or null. A HINT, not a\n * clearance: the caller composes and screens it again before serving it,\n * because a version document can be edited after it was served.\n */\nexport async function servedPageVersion(hostId: string, screenId: string): Promise<string | null> {\n  try {\n    const snapshot = await pageReviewRef(hostId, screenId).get()\n    const value = snapshot.get('servedVersionId')\n    return typeof value === 'string' && value ? value : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Note that this page served `versionId` clean. One read the first time a\n * process renders a page, a write only when the version moved; nothing\n * after that, however often the page is rendered.\n */\nexport async function recordServedPageVersion(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n): Promise<void> {\n  const key = `${hostId}/${screenId}`\n  if (!versionId || servedMemo.get(key) === versionId) return\n  try {\n    const ref = pageReviewRef(hostId, screenId)\n    const snapshot = await ref.get()\n    if (snapshot.get('servedVersionId') !== versionId) {\n      await ref.set({ servedVersionId: versionId, servedAtMs: Date.now() }, { merge: true })\n    }\n    servedMemo.set(key, versionId)\n  } catch (error) {\n    console.warn('[page-review] the served version could not be noted', error)\n  }\n}\n\n/**\n * A domain a workspace attached that wears a brand (AGL-3356, AGL-3362):\n * filed in the abuse queue as an urgent `phishing` row for staff, not\n * refused. Two kinds, one rule:\n *\n * - `site` — a custom domain a site is served on (the attach route);\n * - `sending` — a custom domain a workspace sends email as, when it is\n *   added and again when it verifies (`sending-domains.ts`);\n * - `link` — a link a merchant configured that a buyer or a server would\n *   follow: a product's paid download or video hotlink, a supplier's order\n *   webhook (AGL-3363). The link itself is refused where it is followed; this\n *   files it, and tells the site's managers once ({@link notifyLookalikeLink}).\n *\n * Not refused, because the domain is the merchant's own registration and\n * the platform cannot tell a brand's own agency attaching `paypal-promo.com`\n * from a kit — but a brand's lookalike on a site or in a `From:` line is\n * exactly what staff look at first. The site's pages are still screened as\n * they are served, and mail FROM a lookalike domain is held at the send seam\n * for every workspace. The test is the phishing screen's own lookalike rule\n * (`lookalikeBrandForHost`), the one that holds a link in an email. One row\n * per (owner, kind, domain), so a re-attach or a re-verify counts rather than\n * re-alerts.\n *\n * Never throws: the write it rides on has already happened.\n */\nexport async function flagLookalikeDomain(input: {\n  kind: 'site' | 'sending' | 'link'\n  hostId: string | null\n  orgId: string | null\n  domain: string\n  /** For a `link`: where it was configured, as staff read it. */\n  where?: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  const domain = String(input.domain ?? '').trim().toLowerCase()\n  const brand = lookalikeBrandForHost(domain)\n  if (!brand) return 'clean'\n  const label = phishingScreenBrandLabel(brand.id)\n  const sending = input.kind === 'sending'\n  const link = input.kind === 'link'\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const owner = sending\n      ? `orgs/${input.orgId ?? ''}/sendingDomains`\n      : link\n        ? `hosts/${input.hostId ?? ''}/links`\n        : `hosts/${input.hostId ?? ''}/cname`\n    const reviewId = heldOutboundReviewId(owner, domain)\n    const reference = heldOutboundReference(reviewId)\n    const ref = firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const first = !(await ref.get()).exists\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url: `https://${domain}/`,\n        reportedHostname: domain,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          sending\n            ? `A workspace added ${domain} as a domain to send email from.`\n            : link\n              ? `A site configured a link to ${domain} (${input.where ?? 'a commerce link'}).`\n              : `A site attached the custom domain ${domain}.`,\n          `${domain} wears the ${label} name but is not ${label}'s domain.`,\n          sending\n            ? 'Email from it is held at the send seam for every workspace. Mark this actioned ' +\n              'and lock the workspace if it is impersonation; dismiss it if the brand is theirs.'\n            : link\n              ? 'Nobody is sent to it: the link is refused wherever it is followed. Mark this ' +\n                'actioned and lock the site if it is impersonation.'\n              : 'Its pages are still screened as they are served. Mark this actioned ' +\n                'and lock the site if it is impersonation; dismiss it if the brand is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (first && link) {\n      await notifyLookalikeLink({\n        hostId: input.hostId,\n        orgId: input.orgId,\n        domain,\n        label,\n        where: input.where ?? 'a commerce link',\n        reference,\n        reviewId,\n      })\n    } else if (first) {\n      // The owners hear that the domain is waiting on a routine review — not\n      // which name it resembles; staff get the brand and a link to the row.\n      await notifyRiskEvent({\n        kind: 'domain-flagged',\n        orgId: input.orgId,\n        hostId: input.hostId,\n        reviewId,\n        reference,\n        item: {\n          label: sending ? `the sending domain ${domain}` : `the custom domain ${domain}`,\n          // Emails → Sending, or the site's Domain settings.\n          path: sending ? '/org/emails/sending' : input.hostId ? `/${input.hostId}/admin/domain` : null,\n        },\n        staffEvidence:\n          `${sending ? 'Sending domain' : 'Custom domain'} ${domain} looks like ${label}.`,\n      })\n    }\n    return 'flagged'\n  } catch (error) {\n    console.error('[page-review] a lookalike domain could not be flagged', error)\n    return 'failed'\n  }\n}\n\n/**\n * Tell staff and the site's managers and the workspace's owners, once per\n * (site, domain), that a link the merchant configured was refused because it\n * wears another brand's name (AGL-3363), through the risk notice seam\n * (AGL-3368). The merchant reads the catalog's `link-blocked` words — what\n * was refused and how to fix it, never how the check works; staff get the\n * brand and a link to the row. Never throws.\n */\nexport async function notifyLookalikeLink(input: {\n  hostId: string | null\n  orgId?: string | null\n  domain: string\n  label: string\n  where: string\n  reference: string\n  reviewId?: string | null\n}): Promise<void> {\n  await notifyRiskEvent({\n    kind: 'link-blocked',\n    orgId: input.orgId ?? null,\n    hostId: input.hostId,\n    reviewId: input.reviewId ?? null,\n    reference: input.reference,\n    item: {\n      label: `${input.where} pointing to ${input.domain}`,\n      path: input.hostId ? `/${input.hostId}/products` : null,\n    },\n    staffEvidence:\n      `A site configured ${input.where} to ${input.domain}, which looks like ${input.label}. ` +\n      'It is refused wherever it is followed.',\n  }).catch(() => undefined)\n}\n\n/** A site's custom domain, through {@link flagLookalikeDomain}. */\nexport function flagLookalikeCustomDomain(input: {\n  hostId: string\n  orgId: string | null\n  domain: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  return flagLookalikeDomain({ kind: 'site', ...input })\n}\n"],"names":["ABUSE_REPORT_COLLECTION","heldPageConsolePath","heldPageDetails","heldPageLabel","heldPageVisitorSentence","screenHostedPage","screenSiteRedirect","lookalikeBrandForHost","phishingScreenBrandLabel","describePhishingScreenSignals","isYoungWorkspaceAge","signalsThatHold","FieldValue","firebaseAdmin","describeHeldPage","notifyRiskEvent","orgAgeDays","getHostDocAdmin","getOrgForHost","canonicalJson","fileOutboundHold","flaggedHostOf","heldOutboundReference","heldOutboundReviewId","outboundContentHash","workspaceScreenIdentity","PAGE_REVIEW_SUBCOLLECTION","pageReviewId","hostId","screenId","signals","key","map","signal","sort","join","PAGE_MEMO_TTL_MS","pageMemo","Map","servedMemo","flaggedMemo","FLAGGED_MEMO_TTL_MS","resetHostedPageReviewMemoForTests","clear","subjectForRow","reviewId","describe","stored","app","firestore","collection","doc","get","then","row","storedSubject","catch","heldPage","subject","pageHeadline","siteName","reviewHostedPage","request","found","nodes","length","outcome","nowMs","Date","now","host","owner","Promise","all","undefined","org","orgId","identity","verdict","ageDays","createdAt","strong","isAlreadyLive","versionId","flagLivePage","page","reference","memo","atMs","state","live","previousVersionId","servedPageVersion","url","entryUrl","flagged","label","heldSend","kind","path","contentHash","slice","fromName","heldAtMs","extra","headline","alertTitle","alertBody","charAt","toUpperCase","item","reportedHostname","set","error","console","redirectReviewId","ruleId","reviewSiteRedirect","source","destination","subdomainHost","customDomain","ownDomains","siteHost","startsWith","pageReviewRef","NEW_PAGE_DAYS","lastClean","screen","created","createdMs","toMillis","input","at","existing","evidence","ref","first","exists","category","severity","details","reporterEmail","reporterName","dmca","riskNotice","reportCount","increment","updatedAt","serverTimestamp","status","merge","staffEvidence","snapshot","value","recordServedPageVersion","servedVersionId","servedAtMs","warn","flagLookalikeDomain","domain","String","trim","toLowerCase","brand","id","sending","link","where","notifyLookalikeLink","flagLookalikeCustomDomain"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAoE2C,GAE3C,SAASA,uBAAuB,QAAQ,sCAAqC;AAC7E,SACEC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,QAElB,qCAAoC;AAC3C,SAASC,gBAAgB,EAAEC,kBAAkB,QAAQ,8CAA6C;AAClG,SACEC,qBAAqB,EACrBC,wBAAwB,EAExBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,eAAe,QACV,oDAAmD;AAC1D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,gBAAgB,QAAgC,yBAAqB;AAC9E,SAASC,eAAe,QAAQ,mBAAe;AAC/C,SAASC,UAAU,QAAQ,eAAW;AACtC,SAASC,eAAe,EAAEC,aAAa,QAAQ,qBAAiB;AAChE,SACEC,aAAa,EACbC,gBAAgB,EAChBC,aAAa,EACbC,qBAAqB,EACrBC,oBAAoB,EACpBC,mBAAmB,EAEnBC,uBAAuB,QAClB,4BAAwB;AAE/B,yFAAyF,GACzF,OAAO,MAAMC,4BAA4B,cAAa;AA0BtD,8DAA8D,GAC9D,OAAO,SAASC,aACdC,MAAc,EACdC,QAAgB,EAChBC,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,SAAS,EAAEC,UAAU,EAAEL,oBAAoB;QAACO;KAAI;AAC9F;AAEA,8EAA8E,GAC9E,MAAMK,mBAAmB;AACzB,MAAMC,WAAW,IAAIC;AACrB,4EAA4E,GAC5E,MAAMC,aAAa,IAAID;AACvB,oFAAoF,GACpF,MAAME,cAAc,IAAIF;AACxB,MAAMG,sBAAsB,KAAK;AAEjC,iDAAiD,GACjD,OAAO,SAASC;IACdL,SAASM,KAAK;IACdJ,WAAWI,KAAK;IAChBH,YAAYG,KAAK;AACnB;AAEA;;;;CAIC,GACD,eAAeC,cACbC,QAAgB,EAChBC,QAAwC;IAExC,MAAMC,SAAS,MAAMlC,cAClBmC,GAAG,GACHC,SAAS,GACTC,UAAU,CAAClD,yBACXmD,GAAG,CAACN,UACJO,GAAG,GACHC,IAAI,CAAC,CAACC,MAAQC,cAAcD,IAAIF,GAAG,CAAC,cACpCI,KAAK,CAAC,IAAM;IACf,OAAOT,iBAAAA,SAAUD;AACnB;AAEA,6CAA6C,GAC7C,SAASS,cAAcE,QAAiB;IACtC,MAAMC,UAAWD,4BAAD,AAACA,SAA+DC,OAAO;IACvF,OAAOA,WAAW,OAAOA,YAAY,YAAYA,QAAQ7B,QAAQ,GAAG6B,UAAU;AAChF;AAEA,iEAAiE,GACjE,SAASC,aAAaD,OAAwB,EAAEE,QAAgB;IAC9D,OAAO;QAAC,GAAGzD,cAAcuD,SAAS,IAAI,EAAEE,SAAS,CAAC,CAAC;WAAK1D,gBAAgBwD;KAAS,CAACvB,IAAI,CAAC;AACzF;AAEA;;;CAGC,GACD,OAAO,eAAe0B,iBACpBC,OAAgC;QAKlBA;IAHd,MAAMC,QAAQ1D,iBAAiB;QAAE2D,OAAOF,QAAQE,KAAK;IAAC;IACtD,IAAI,CAACD,MAAMjC,OAAO,CAACmC,MAAM,EAAE,OAAO;QAAEC,SAAS;IAAQ;IAErD,MAAMC,SAAQL,iBAAAA,QAAQK,KAAK,YAAbL,iBAAiBM,KAAKC,GAAG;IACvC,IAAI;YAIaP,6BAkEHJ;QArEZ,MAAM,CAACY,MAAMC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCX,QAAQQ,IAAI,KAAKI,YAAYZ,QAAQQ,IAAI,GAAGrD,gBAAgB6C,QAAQlC,MAAM;YAC1EkC,QAAQa,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAEd,iBAAAA,QAAQc,KAAK,YAAbd,iBAAiB;gBAAMa,KAAKb,QAAQa,GAAG;YAAC,IACjDzD,cAAc4C,QAAQlC,MAAM;SACjC;QACD,MAAM+C,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,sEAAsE;QACtE,qEAAqE;QACrE,MAAMC,WAAWpD,wBAAwB;YAAEkD;YAAKL;QAAK;QACrD,MAAMQ,UAAUzE,iBAAiB;YAAE2D,OAAOF,QAAQE,KAAK;WAAKa;QAC5D,MAAME,UAAU/D,WAAY2D,uBAAD,AAACA,IAAwCK,SAAS,EAAEb;QAC/E,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,0DAA0D;QAC1D,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAACzD,oBAAoBqE,UAAU;YACjC,MAAME,SAAStE,gBAAgBmE,QAAQhD,OAAO,EAAE;gBAAEiD;YAAQ;YAC1D,IAAI,CAACE,OAAOhB,MAAM,EAAE,OAAO;gBAAEC,SAAS;YAAQ;YAC9C,IAAI,MAAMgB,cAAcpB,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ,EAAEiC,QAAQqB,SAAS,EAAEhB,QAAQ;oBAS3EL;gBARR,MAAMsB,aAAa;oBACjBxD,QAAQkC,QAAQlC,MAAM;oBACtBC,UAAUiC,QAAQjC,QAAQ;oBAC1BsD,WAAWrB,QAAQqB,SAAS;oBAC5BP;oBACAN;oBACAxC,SAASmD;oBACTd;oBACAkB,IAAI,GAAEvB,gBAAAA,QAAQuB,IAAI,YAAZvB,gBAAgB;oBACtBe;gBACF;gBACA,OAAO;oBAAEX,SAAS;gBAAQ;YAC5B;QACF;QACA,MAAMpC,UAAUnB,gBAAgBmE,QAAQhD,OAAO,EAAE;YAAEiD;QAAQ;QAC3D,IAAI,CAACjD,QAAQmC,MAAM,EAAE,OAAO;YAAEC,SAAS;QAAQ;QAE/C,MAAMrB,WAAWlB,aAAamC,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ,EAAEC;QAChE,MAAMwD,YAAYhE,sBAAsBuB;QACxC,MAAM0C,OAAOlD,SAASe,GAAG,CAACP;QAC1B,IAAI0C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGpD,kBAAkB;YAChD,OAAOmD,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQ5C;gBAAUyC;YAAU;QACtF;QACA,sEAAsE;QACtE,kEAAkE;QAClE,MAAM5B,UAAU,MAAMd,cAAcC,UAAU,UAC5C/B,iBAAiB;gBACfc,QAAQkC,QAAQlC,MAAM;gBACtBC,UAAUiC,QAAQjC,QAAQ;gBAC1BsD,WAAWrB,QAAQqB,SAAS;gBAC5Bb;gBACAe,MAAMvB,QAAQuB,IAAI;gBAClBvD;gBACA+C;gBACAa,MAAM;gBACNC,mBAAmB,MAAMC,kBAAkB9B,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ;YAC7E;QAEF,MAAMgE,OAAMnC,oBAAAA,QAAQoC,QAAQ,YAAhBpC,oBAAoBA,QAAQmC,GAAG;QAC3C,MAAME,UAAU1E,cAAcS;QAC9B,MAAM8B,WACJ,QAAOU,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM0B,QAAQ7F,cAAcuD;QAC5B,MAAM+B,QAAQ,MAAMrE,iBAAiB;YACnCyB;YACAoD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAErC,QAAQlC,MAAM,CAAC,SAAS,EAAEkC,QAAQjC,QAAQ,EAAE;gBAC3DD,QAAQkC,QAAQlC,MAAM;gBACtBgD;gBACAwB,aAAa5E,oBAAoB;oBAACM;iBAAQ;gBAC1C4B,SAASsC,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVxE;gBACA2D,OAAO;gBACPc,UAAUpC;gBACVY;YACF;YACAyB,OAAO;gBACL/C,UAAU;oBAAE5B,UAAUiC,QAAQjC,QAAQ;oBAAEsD,WAAWrB,QAAQqB,SAAS;oBAAEU;oBAAKnC;gBAAQ;YACrF;YACA+C,UACE,CAAC,KAAK,EAAE9C,aAAaD,SAASE,UAAU,SAAS,EAAEE,QAAQqB,SAAS,CAAC,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEJ,kBAAAA,UAAW,IAAI,aAAa,EAAE3E,wBAAwBsD,UAAU;YAC/EgD,YAAY;YACZC,WAAW,GAAGX,MAAMY,MAAM,CAAC,GAAGC,WAAW,KAAKb,MAAMK,KAAK,CAAC,GAAG,8BAA8B,CAAC;YAC5F,wEAAwE;YACxES,MAAM;gBAAEd;gBAAOG,MAAMlG,oBAAoByD,SAASI,QAAQlC,MAAM;YAAE;YAClEyD,MAAM3B;YACN,qEAAqE;YACrE,6DAA6D;YAC7DmC;YACAkB,kBAAkBhB;QACpB;QACA1D,SAAS2E,GAAG,CAACnE,UAAU;YAAE4C;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQ5C;YAAUyC;QAAU;IACjF,EAAE,OAAO2B,OAAO;QACd,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpCC,QAAQD,KAAK,CAAC,mEAAmEA;QACjF,MAAMpE,WAAWlB,aAAamC,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ,EAAEkC,MAAMjC,OAAO;QAC7E,OAAO;YAAEoC,SAAS;YAAQrB;YAAUyC,WAAWhE,sBAAsBuB;QAAU;IACjF;AACF;AAiBA,uEAAuE,GACvE,OAAO,SAASsE,iBACdvF,MAAc,EACdwF,MAAc,EACdtF,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,WAAW,EAAEwF,QAAQ,EAAE5F,oBAAoB;QAACO;KAAI;AAC9F;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAesF,mBACpBvD,OAAkC;QAKpBA;IAHd,MAAMC,QAAQzD,mBAAmB;QAAEgH,QAAQxD,QAAQwD,MAAM;QAAEC,aAAazD,QAAQyD,WAAW;IAAC;IAC5F,IAAI,CAACxD,MAAMjC,OAAO,CAACmC,MAAM,EAAE,OAAO;QAAEC,SAAS;IAAQ;IAErD,MAAMC,SAAQL,iBAAAA,QAAQK,KAAK,YAAbL,iBAAiBM,KAAKC,GAAG;IACvC,IAAI;YAIaP,6BA4BuBe;QA/BtC,MAAM,CAACP,MAAMC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCX,QAAQQ,IAAI,KAAKI,YAAYZ,QAAQQ,IAAI,GAAGrD,gBAAgB6C,QAAQlC,MAAM;YAC1EkC,QAAQa,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAEd,iBAAAA,QAAQc,KAAK,YAAbd,iBAAiB;gBAAMa,KAAKb,QAAQa,GAAG;YAAC,IACjDzD,cAAc4C,QAAQlC,MAAM;SACjC;QACD,MAAM+C,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,MAAMC,WAAWpD,wBAAwB;YAAEkD;YAAKL;QAAK;QACrD,MAAMQ,UAAUxE,mBAAmB;YACjCgH,QAAQxD,QAAQwD,MAAM;YACtBC,aAAazD,QAAQyD,WAAW;WAC7B1C;QAEL,MAAME,UAAU/D,WAAY2D,uBAAD,AAACA,IAAwCK,SAAS,EAAEb;QAC/E,MAAMrC,UAAUnB,gBAAgBmE,QAAQhD,OAAO,EAAE;YAAEiD;QAAQ;QAC3D,IAAI,CAACjD,QAAQmC,MAAM,EAAE,OAAO;YAAEC,SAAS;QAAQ;QAE/C,MAAMrB,WAAWsE,iBAAiBrD,QAAQlC,MAAM,EAAEkC,QAAQsD,MAAM,EAAEtF;QAClE,MAAMwD,YAAYhE,sBAAsBuB;QACxC,MAAM0C,OAAOlD,SAASe,GAAG,CAACP;QAC1B,IAAI0C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGpD,kBAAkB;YAChD,OAAOmD,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQ5C;gBAAUyC;YAAU;QACtF;QACA,MAAMgC,SAASxD,QAAQwD,MAAM,CAACjB,KAAK,CAAC,GAAG;QACvC,MAAMkB,cAAczD,QAAQyD,WAAW,CAAClB,KAAK,CAAC,GAAG;QACjD,MAAML,QAAQ,CAAC,kBAAkB,EAAEsB,QAAQ;QAC3C,MAAM1D,WACJ,QAAOU,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM,CAACkD,eAAeC,aAAa,IAAG5C,uBAAAA,SAAS6C,UAAU,YAAnB7C,uBAAuB,EAAE;QAC/D,MAAM8C,WAAWF,gBAAgBD;QACjC,MAAM/B,QAAQ,MAAMrE,iBAAiB;YACnCyB;YACAoD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAErC,QAAQlC,MAAM,CAAC,WAAW,EAAEkC,QAAQsD,MAAM,EAAE;gBAC3DxF,QAAQkC,QAAQlC,MAAM;gBACtBgD;gBACAwB,aAAa5E,oBAAoB;oBAACM;iBAAQ;gBAC1C4B,SAASsC,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVxE;gBACA2D,OAAO;gBACPc,UAAUpC;gBACVY;YACF;YACA0B,UACE,CAAC,KAAK,EAAET,MAAM,IAAI,EAAEpC,SAAS,0BAA0B,EAAE2D,YAAY,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAExC,kBAAAA,UAAW,IAAI,0DAA0D,CAAC;YACzF2B,YAAY;YACZC,WAAW,CAAC,kBAAkB,EAAEW,OAAO,6CAA6C,CAAC;YACrF,sDAAsD;YACtDR,MAAM;gBAAEd;gBAAOG,MAAM,CAAC,CAAC,EAAErC,QAAQlC,MAAM,CAAC,UAAU,CAAC;YAAC;YACpDiE,KAAK8B,YAAYL,OAAOM,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAED,WAAWL,QAAQ,GAAGC;YAC3ER,kBAAkB1F,cAAcS;QAClC;QACAO,SAAS2E,GAAG,CAACnE,UAAU;YAAE4C;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQ5C;YAAUyC;QAAU;IACjF,EAAE,OAAO2B,OAAO;QACd,0EAA0E;QAC1EC,QAAQD,KAAK,CAAC,uEAAuEA;QACrF,MAAMpE,WAAWsE,iBAAiBrD,QAAQlC,MAAM,EAAEkC,QAAQsD,MAAM,EAAErD,MAAMjC,OAAO;QAC/E,OAAO;YAAEoC,SAAS;YAAQrB;YAAUyC,WAAWhE,sBAAsBuB;QAAU;IACjF;AACF;AAEA,SAASgF,cAAcjG,MAAc,EAAEC,QAAgB;IACrD,OAAOhB,cACJmC,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACvB,QACJsB,UAAU,CAACxB,2BACXyB,GAAG,CAACtB;AACT;AAEA;;;;;;CAMC,GACD,MAAMiG,gBAAgB;AACtB,eAAe5C,cACbtD,MAAc,EACdC,QAAgB,EAChBsD,SAAiB,EACjBhB,KAAa;IAEb,MAAM4D,YAAY,MAAMnC,kBAAkBhE,QAAQC;IAClD,IAAIkG,WAAW,OAAOA,cAAc5C;IACpC,IAAI;QACF,MAAM6C,SAAS,MAAMnH,cAClBmC,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACvB,QACJsB,UAAU,CAAC,WACXC,GAAG,CAACtB,UACJuB,GAAG;QACN,MAAM6E,UAAUD,OAAO5E,GAAG,CAAC;QAC3B,MAAM8E,YACJ,OAAOD,YAAY,WAAWA,UAAU,QAAOA,2BAAAA,QAASE,QAAQ,MAAK,aAAaF,QAAQE,QAAQ,KAAK;QACzG,mDAAmD;QACnD,OAAOD,cAAc,QAAQ/D,QAAQ+D,aAAaJ,gBAAgB,KAAK,KAAK,KAAK;IACnF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,eAAe1C,aAAagD,KAU3B;IACC,MAAMrG,MAAM,GAAGqG,MAAMxG,MAAM,CAAC,EAAE,EAAEwG,MAAMvG,QAAQ,CAAC,EAAE,EAAEuG,MAAMtG,OAAO,CAACE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAASC,IAAI,GAAGC,IAAI,CAAC,OAAO;IAC3H,MAAMkG,KAAK7F,YAAYY,GAAG,CAACrB;IAC3B,IAAIsG,OAAO3D,aAAa0D,MAAMjE,KAAK,GAAGkE,KAAK5F,qBAAqB;IAChED,YAAYwE,GAAG,CAACjF,KAAKqG,MAAMjE,KAAK;IAChC,IAAI;YAUCmE,MAQWF,iBAIF1E;YAEH0E;QAvBT,MAAMvF,WAAWlB,aAAayG,MAAMxG,MAAM,EAAE,GAAGwG,MAAMvG,QAAQ,CAAC,KAAK,CAAC,EAAEuG,MAAMtG,OAAO;QACnF,MAAMwD,YAAYhE,sBAAsBuB;QACxC,MAAM0F,WAAW9H,8BAA8B2H,MAAMtG,OAAO,EAAEK,IAAI,CAAC;QACnE,MAAM4D,UAAU1E,cAAc+G,MAAMtG,OAAO;QAC3C,MAAM0G,MAAM3H,cAAcmC,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAClD,yBAAyBmD,GAAG,CAACN;QACpF,MAAMyF,WAAW,MAAME,IAAIpF,GAAG;QAC9B,MAAMqF,QAAQ,CAACH,SAASI,MAAM;QAC9B,8CAA8C;QAC9C,MAAMhF,WACH4E,OAAAA,SAASI,MAAM,GAAGnF,cAAc+E,SAASlF,GAAG,CAAC,eAAe,gBAA5DkF,OACA,MAAMxH,iBAAiB;YACtBc,QAAQwG,MAAMxG,MAAM;YACpBC,UAAUuG,MAAMvG,QAAQ;YACxBsD,WAAWiD,MAAMjD,SAAS;YAC1Bb,MAAM8D,MAAM9D,IAAI;YAChBe,MAAM+C,MAAM/C,IAAI;YAChBvD,SAASsG,MAAMtG,OAAO;YACtB+C,QAAQ,GAAEuD,kBAAAA,MAAMvD,QAAQ,YAAduD,kBAAkB3G,wBAAwB;gBAAE6C,MAAM8D,MAAM9D,IAAI;YAAC;YACvEoB,MAAM;YACNC,mBAAmB;QACrB;QACF,MAAME,OAAMnC,oBAAAA,QAAQoC,QAAQ,YAAhBpC,oBAAoBA,QAAQmC,GAAG;QAC3C,MAAMjC,WACJ,SAAOwE,cAAAA,MAAM9D,IAAI,qBAAV8D,WAAY,CAAC,OAAO,MAAK,YAAYA,MAAM9D,IAAI,CAAC,OAAO,GAC1D,CAAC,CAAC,EAAE8D,MAAM9D,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GACzB;QACN,MAAMkE,IAAIxB,GAAG,CACX;YACE1B;YACAqD,UAAU;YACVC,UAAU;YACVtB,QAAQ;YACRzB;YACAkB,kBAAkBhB;YAClBnE,QAAQwG,MAAMxG,MAAM;YACpBgD,OAAOwD,MAAMxD,KAAK;YAClBiE,SAAS;gBACP,CAAC,MAAM,EAAElF,aAAaD,SAASE,UAAU,4DAA4D,CAAC;gBACtG2E;gBACA;aACD,CAACpG,IAAI,CAAC;YACP2G,eAAe;YACfC,cAAc;YACdC,MAAM;YACNvF,UAAU;gBAAE5B,UAAUuG,MAAMvG,QAAQ;gBAAEsD,WAAWiD,MAAMjD,SAAS;gBAAEU;gBAAKnC;YAAQ;YAC/EuF,YAAY;gBAAE/C,MAAM;YAAe;YACnCgD,aAAatI,WAAWuI,SAAS,CAAC;YAClCC,WAAWxI,WAAWyI,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQtE,WAAWpE,WAAWyI,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAI,CAACd,OAAO;QACZ,MAAM1H,gBAAgB;YACpBmF,MAAM;YACNtB,OAAOwD,MAAMxD,KAAK;YAClBhD,QAAQwG,MAAMxG,MAAM;YACpBiB;YACAyC;YACAwB,MAAM;gBAAEd,OAAO7F,cAAcuD;gBAAUyC,MAAMlG,oBAAoByD,SAAS0E,MAAMxG,MAAM;YAAE;YACxFyD,MAAM3B;YACN8F,eAAe;mBAAItJ,gBAAgBwD;gBAAU6E;aAAS,CAACpG,IAAI,CAAC;QAC9D;IACF,EAAE,OAAO8E,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;IAClE;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAerB,kBAAkBhE,MAAc,EAAEC,QAAgB;IACtE,IAAI;QACF,MAAM4H,WAAW,MAAM5B,cAAcjG,QAAQC,UAAUuB,GAAG;QAC1D,MAAMsG,QAAQD,SAASrG,GAAG,CAAC;QAC3B,OAAO,OAAOsG,UAAU,YAAYA,QAAQA,QAAQ;IACtD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpB/H,MAAc,EACdC,QAAgB,EAChBsD,SAAiB;IAEjB,MAAMpD,MAAM,GAAGH,OAAO,CAAC,EAAEC,UAAU;IACnC,IAAI,CAACsD,aAAa5C,WAAWa,GAAG,CAACrB,SAASoD,WAAW;IACrD,IAAI;QACF,MAAMqD,MAAMX,cAAcjG,QAAQC;QAClC,MAAM4H,WAAW,MAAMjB,IAAIpF,GAAG;QAC9B,IAAIqG,SAASrG,GAAG,CAAC,uBAAuB+B,WAAW;YACjD,MAAMqD,IAAIxB,GAAG,CAAC;gBAAE4C,iBAAiBzE;gBAAW0E,YAAYzF,KAAKC,GAAG;YAAG,GAAG;gBAAEkF,OAAO;YAAK;QACtF;QACAhH,WAAWyE,GAAG,CAACjF,KAAKoD;IACtB,EAAE,OAAO8B,OAAO;QACdC,QAAQ4C,IAAI,CAAC,uDAAuD7C;IACtE;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,eAAe8C,oBAAoB3B,KAOzC;QACuBA;IAAtB,MAAM4B,SAASC,QAAO7B,gBAAAA,MAAM4B,MAAM,YAAZ5B,gBAAgB,IAAI8B,IAAI,GAAGC,WAAW;IAC5D,MAAMC,QAAQ7J,sBAAsByJ;IACpC,IAAI,CAACI,OAAO,OAAO;IACnB,MAAMpE,QAAQxF,yBAAyB4J,MAAMC,EAAE;IAC/C,MAAMC,UAAUlC,MAAMlC,IAAI,KAAK;IAC/B,MAAMqE,OAAOnC,MAAMlC,IAAI,KAAK;IAC5B,IAAI;YAGUkC,cAEGA,eACAA,gBAmBuCA;QAxBtD,MAAMnF,YAAYpC,cAAcmC,GAAG,GAAGC,SAAS;QAC/C,MAAMsB,QAAQ+F,UACV,CAAC,KAAK,GAAElC,eAAAA,MAAMxD,KAAK,YAAXwD,eAAe,GAAG,eAAe,CAAC,GAC1CmC,OACE,CAAC,MAAM,GAAEnC,gBAAAA,MAAMxG,MAAM,YAAZwG,gBAAgB,GAAG,MAAM,CAAC,GACnC,CAAC,MAAM,GAAEA,iBAAAA,MAAMxG,MAAM,YAAZwG,iBAAgB,GAAG,MAAM,CAAC;QACzC,MAAMvF,WAAWtB,qBAAqBgD,OAAOyF;QAC7C,MAAM1E,YAAYhE,sBAAsBuB;QACxC,MAAM2F,MAAMvF,UAAUC,UAAU,CAAClD,yBAAyBmD,GAAG,CAACN;QAC9D,MAAM4F,QAAQ,CAAC,AAAC,CAAA,MAAMD,IAAIpF,GAAG,EAAC,EAAGsF,MAAM;QACvC,MAAMF,IAAIxB,GAAG,CACX;YACE1B;YACAqD,UAAU;YACVC,UAAU;YACVtB,QAAQ;YACRzB,KAAK,CAAC,QAAQ,EAAEmE,OAAO,CAAC,CAAC;YACzBjD,kBAAkBiD;YAClBpI,QAAQwG,MAAMxG,MAAM;YACpBgD,OAAOwD,MAAMxD,KAAK;YAClBiE,SAAS;gBACPyB,UACI,CAAC,kBAAkB,EAAEN,OAAO,gCAAgC,CAAC,GAC7DO,OACE,CAAC,4BAA4B,EAAEP,OAAO,EAAE,GAAE5B,eAAAA,MAAMoC,KAAK,YAAXpC,eAAe,kBAAkB,EAAE,CAAC,GAC9E,CAAC,kCAAkC,EAAE4B,OAAO,CAAC,CAAC;gBACpD,GAAGA,OAAO,WAAW,EAAEhE,MAAM,iBAAiB,EAAEA,MAAM,UAAU,CAAC;gBACjEsE,UACI,oFACA,sFACAC,OACE,kFACA,uDACA,yEACA;aACP,CAACpI,IAAI,CAAC;YACP2G,eAAe;YACfC,cAAc;YACdC,MAAM;YACNE,aAAatI,WAAWuI,SAAS,CAAC;YAClCC,WAAWxI,WAAWyI,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQtE,WAAWpE,WAAWyI,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAId,SAAS8B,MAAM;gBAMRnC;YALT,MAAMqC,oBAAoB;gBACxB7I,QAAQwG,MAAMxG,MAAM;gBACpBgD,OAAOwD,MAAMxD,KAAK;gBAClBoF;gBACAhE;gBACAwE,KAAK,GAAEpC,gBAAAA,MAAMoC,KAAK,YAAXpC,gBAAe;gBACtB9C;gBACAzC;YACF;QACF,OAAO,IAAI4F,OAAO;YAChB,uEAAuE;YACvE,sEAAsE;YACtE,MAAM1H,gBAAgB;gBACpBmF,MAAM;gBACNtB,OAAOwD,MAAMxD,KAAK;gBAClBhD,QAAQwG,MAAMxG,MAAM;gBACpBiB;gBACAyC;gBACAwB,MAAM;oBACJd,OAAOsE,UAAU,CAAC,mBAAmB,EAAEN,QAAQ,GAAG,CAAC,kBAAkB,EAAEA,QAAQ;oBAC/E,mDAAmD;oBACnD7D,MAAMmE,UAAU,wBAAwBlC,MAAMxG,MAAM,GAAG,CAAC,CAAC,EAAEwG,MAAMxG,MAAM,CAAC,aAAa,CAAC,GAAG;gBAC3F;gBACA4H,eACE,GAAGc,UAAU,mBAAmB,gBAAgB,CAAC,EAAEN,OAAO,YAAY,EAAEhE,MAAM,CAAC,CAAC;YACpF;QACF;QACA,OAAO;IACT,EAAE,OAAOiB,OAAO;QACdC,QAAQD,KAAK,CAAC,yDAAyDA;QACvE,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,eAAewD,oBAAoBrC,KAQzC;QAGUA,cAEGA;IAJZ,MAAMrH,gBAAgB;QACpBmF,MAAM;QACNtB,KAAK,GAAEwD,eAAAA,MAAMxD,KAAK,YAAXwD,eAAe;QACtBxG,QAAQwG,MAAMxG,MAAM;QACpBiB,QAAQ,GAAEuF,kBAAAA,MAAMvF,QAAQ,YAAduF,kBAAkB;QAC5B9C,WAAW8C,MAAM9C,SAAS;QAC1BwB,MAAM;YACJd,OAAO,GAAGoC,MAAMoC,KAAK,CAAC,aAAa,EAAEpC,MAAM4B,MAAM,EAAE;YACnD7D,MAAMiC,MAAMxG,MAAM,GAAG,CAAC,CAAC,EAAEwG,MAAMxG,MAAM,CAAC,SAAS,CAAC,GAAG;QACrD;QACA4H,eACE,CAAC,kBAAkB,EAAEpB,MAAMoC,KAAK,CAAC,IAAI,EAAEpC,MAAM4B,MAAM,CAAC,mBAAmB,EAAE5B,MAAMpC,KAAK,CAAC,EAAE,CAAC,GACxF;IACJ,GAAGxC,KAAK,CAAC,IAAMkB;AACjB;AAEA,iEAAiE,GACjE,OAAO,SAASgG,0BAA0BtC,KAIzC;IACC,OAAO2B,oBAAoB;QAAE7D,MAAM;OAAWkC;AAChD"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/hosted-page-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * HELD FOR REVIEW: a published page (AGL-3362).\n *\n * ## Why the check sits where a page is COMPOSED, not where it is published\n *\n * A publish is a browser write. The besigner toolbar, the versions panel,\n * the screen details page, page-from-template, the layout and component\n * besigners and the form besigner each move a pointer (`versionId`, the\n * host's `screens` map, a component's own `nodes`) straight from the\n * client SDK; the scheduled-publish beat moves it from the server; an\n * experiment serves a version no pointer names; and an author may rewrite\n * the LIVE version document itself without moving any pointer at all. A\n * check on any one of those writes is a check the next one walks around.\n *\n * They all meet in one place: `composeScreenNodes` (`@aglyn/tenant-runtime`),\n * which every published render, the password unlock, the collection and\n * product templates and every experiment variant go through, and which\n * returns the page exactly as a visitor will receive it — the screen, its\n * layout chrome, its grafted components and its forms. So the screen is read\n * there, and a held page is one that is never composed for a visitor. For a\n * visitor, \"publish\" is the first render after the pointer moved; this is\n * that moment.\n *\n * ## What a hold does\n *\n * - The version is not served. The last version this page served clean\n *   ({@link servedPageVersion}) is composed instead — screened again, since\n *   a version document can be edited in place — and if there is none, or it\n *   holds too, the page is not found. A first publish that holds therefore\n *   serves nothing.\n * - One review row per (page, signal set) lands in the abuse queue at\n *   `/admin/abuse-reports`, the same `phishing` row a held email files\n *   (`fileOutboundHold`), with `heldSend.kind: 'page'`, the page's URL and\n *   the held version. Staff dismiss it to RELEASE (the admin route drops the\n *   site's cache and the next render serves it) or mark it actioned to\n *   REJECT (it stays unserved; any later version carrying the same signals\n *   is refused without a new row).\n * - A hold from a workspace in its first fortnight also asks for an\n *   automatic `security` hold on the workspace, the site and the publishing\n *   account (`page-security-hold.ts`, AGL-3450), which the console places.\n * - Keyed on the SIGNALS, as the send seam's rows are: a composed page\n *   carries per-render values (dates, collection rows) that no content hash\n *   would survive, while what makes it phishing does not change between\n *   renders.\n *\n * ## Tiers\n *\n * `signalsThatHold`: a lookalike link or embed, an author-defined\n * credential field and a link to a host Google Web Risk lists\n * (`web-risk-link`, AGL-3451) hold for EVERY workspace; a brand's call to\n * action or lure, and a call to action that leaves the site beside a lure,\n * only for a workspace in its first fortnight. The workspace's documents are\n * read only when something was found, so a clean page costs no read for\n * this. The page's foreign hosts are looked up first, against a cache\n * (`web-risk.ts`), and noted beside the version it serves so the daily\n * re-check can look again: a harvester is often listed only after it is\n * published. A lookup that fails finds nothing, so it never holds a page.\n *\n * Fails CLOSED, unlike the send path: a page the pure screen flagged whose\n * review cannot finish — the workspace read, the row write — is answered\n * `held`, and the composer serves its last clean version or nothing. The\n * answer is not remembered, so the next render reviews it again. Composition\n * itself reads the store, so an outage here is an outage on the render\n * already, and the only cost of not serving a page the screen flagged is a\n * false positive's wait; serving it is the phishing page this exists to\n * stop. A page the screen found nothing on never reaches this.\n *\n * ## Site redirects\n *\n * A redirect rule that sends a path off the site is a page whose one call to\n * action fires on arrival, so the redirects plugin asks\n * {@link reviewSiteRedirect} before it serves one. Same screen\n * (`screenSiteRedirect`), same tiers, same row and the same staff decision:\n * a held rule does not fire, and is filed as a `page` hold on its rule's\n * document. Its destination is looked up against the reputation list too\n * (AGL-3451), so a redirect to a listed site holds for every workspace.\n *=========================================*/\n\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport {\n  heldPageConsolePath,\n  heldPageDetails,\n  heldPageLabel,\n  heldPageVisitorSentence,\n  type HeldPageSubject,\n} from '@aglyn/shared-util-email/held-page'\nimport { screenHostedPage, screenSiteRedirect } from '@aglyn/shared-util-email/hosted-page-screen'\nimport {\n  lookalikeBrandForHost,\n  phishingScreenBrandLabel,\n  type PhishingScreenSignal,\n  describePhishingScreenSignals,\n  isYoungWorkspaceAge,\n  signalsThatHold,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport {\n  foreignHostsForReputation,\n  webRiskSignals,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { describeHeldPage, type HostedPageContext } from './held-page-subject'\nimport { notifyRiskEvent } from './risk-notice'\nimport { orgAgeDays } from './org-age'\nimport { requestPageSecurityHold } from './page-security-hold'\nimport { getHostDocAdmin, getOrgForHost } from './organizations'\nimport { lookupHostReputation, platformReputationExclusions } from './web-risk'\nimport {\n  canonicalJson,\n  fileOutboundHold,\n  flaggedHostOf,\n  heldOutboundReference,\n  heldOutboundReviewId,\n  outboundContentHash,\n  type HeldOutboundSendState,\n  workspaceScreenIdentity,\n} from './outbound-send-review'\n\n/** Where the last version a page served clean is noted: a hint, re-screened before use. */\nexport const PAGE_REVIEW_SUBCOLLECTION = 'pageReviews'\n\nexport interface HostedPageReviewRequest {\n  hostId: string\n  screenId: string\n  versionId: string\n  /** The page as composed for a visitor. */\n  nodes: unknown\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n  /**\n   * What the composer knows about the page (AGL-3374): the screen document,\n   * the template route it is rendering, the variant, and a way to read the\n   * layouts and components composed into it. Read only when a row is filed,\n   * to name the page — never to decide whether it serves.\n   */\n  page?: HostedPageContext | null\n  /**\n   * Signals found about this page elsewhere, judged with the page's own\n   * (AGL-3451): the daily link re-check passes a link Web Risk has listed\n   * since the page went live, so the hold, its row and the young\n   * workspace's security hold all come from this one path.\n   */\n  extraSignals?: readonly PhishingScreenSignal[]\n}\n\nexport type HostedPageReviewOutcome =\n  | { outcome: 'serve' }\n  | { outcome: 'held' | 'rejected'; reviewId: string; reference: string }\n\n/** The review row's id for a page and the signals that held. */\nexport function pageReviewId(\n  hostId: string,\n  screenId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/screens/${screenId}`, outboundContentHash([key]))\n}\n\n/** How long this process trusts a page row's state — the send seam's minute. */\nconst PAGE_MEMO_TTL_MS = 60_000\nconst pageMemo = new Map<string, { state: HeldOutboundSendState; atMs: number }>()\n/** The version each page last served clean, as this process last wrote it. */\nconst servedMemo = new Map<string, string>()\n/** Lookalike hosts this process already flagged for an established page, and when. */\nconst flaggedMemo = new Map<string, number>()\nconst FLAGGED_MEMO_TTL_MS = 60 * 60_000\n/**\n * The foreign hosts each reviewed page version links to (AGL-3451), for\n * {@link recordServedPageVersion} to note beside the version it served, which\n * is what the daily link re-check walks. Bounded: a process that reviews more\n * pages than this starts again.\n */\nconst reviewedForeignHosts = new Map<string, string[]>()\nconst REVIEWED_FOREIGN_HOSTS_MAX = 10_000\n\n/** Test seam: forget what this process learned. */\nexport function resetHostedPageReviewMemoForTests(): void {\n  pageMemo.clear()\n  servedMemo.clear()\n  flaggedMemo.clear()\n  reviewedForeignHosts.clear()\n}\n\n/**\n * Every foreign host the page links to, and the ones Google Web Risk lists\n * (AGL-3451). Foreign before the workspace is known: not the platform's\n * own, not a brand's own domain, not a common social link. Never throws; a\n * lookup that failed lists nothing.\n */\nasync function pageLinkReputation(\n  linkHosts: readonly string[],\n): Promise<{ hosts: string[]; signals: PhishingScreenSignal[] }> {\n  // Runs before the review's fail-closed `try`, so it must not throw: an\n  // answer it cannot give is no listing, never a reason to hold.\n  try {\n    const hosts = foreignHostsForReputation(linkHosts, {\n      excludeDomains: platformReputationExclusions(),\n    })\n    if (!hosts.length) return { hosts, signals: [] }\n    const answer = await lookupHostReputation(hosts)\n    return { hosts, signals: webRiskSignals(answer.hits) }\n  } catch (error) {\n    console.warn('[page-review] link reputation could not be read — no listing assumed', error)\n    return { hosts: [], signals: [] }\n  }\n}\n\n/** Is this host one of the workspace's own? */\nfunction isOwnHost(host: string, ownDomains: readonly (string | null | undefined)[] | undefined): boolean {\n  return (ownDomains ?? []).some((own) => {\n    const domain = String(own ?? '').trim().toLowerCase()\n    return Boolean(domain) && (host === domain || host.endsWith(`.${domain}`))\n  })\n}\n\n/**\n * The subject a row already stored, or a fresh description (AGL-3374). A row\n * that names its page is not described again, so the reads the description\n * may make are paid once per row, not once per render.\n */\nasync function subjectForRow(\n  reviewId: string,\n  describe: () => Promise<HeldPageSubject>,\n): Promise<HeldPageSubject> {\n  const stored = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .get()\n    .then((row) => storedSubject(row.get('heldPage')))\n    .catch(() => null)\n  return stored ?? describe()\n}\n\n/** A row's stored subject, when it has one. */\nfunction storedSubject(heldPage: unknown): HeldPageSubject | null {\n  const subject = (heldPage as { subject?: HeldPageSubject } | null | undefined)?.subject\n  return subject && typeof subject === 'object' && subject.screenId ? subject : null\n}\n\n/** The row's first line, naming the page and where it was seen. */\nfunction pageHeadline(subject: HeldPageSubject, siteName: string): string {\n  return [`${heldPageLabel(subject)} of ${siteName}.`, ...heldPageDetails(subject)].join(' ')\n}\n\n/**\n * Screen one page as a visitor would receive it, and say whether it may be\n * served. See the module header.\n */\nexport async function reviewHostedPage(\n  request: HostedPageReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenHostedPage({ nodes: request.nodes })\n  // Every foreign host it points at, against the reputation list\n  // (AGL-3451): a harvester known to be bad anywhere holds however plain the\n  // page around it is. Strong, so it holds at any workspace age.\n  const reputation = await pageLinkReputation(found.linkHosts)\n  if (reviewedForeignHosts.size >= REVIEWED_FOREIGN_HOSTS_MAX) reviewedForeignHosts.clear()\n  reviewedForeignHosts.set(`${request.hostId}/${request.screenId}/${request.versionId}`, reputation.hosts)\n  const listed = [...reputation.signals, ...(request.extraSignals ?? [])]\n  if (!found.signals.length && !listed.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    // Again, now knowing whose page it is: a brand in the workspace's own\n    // name or domain is its own, and a link to its own site is not away.\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenHostedPage({ nodes: request.nodes, ...identity })\n    // A listing of the workspace's own host is not a link away from it.\n    const screened = [\n      ...verdict.signals,\n      ...listed.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    // Every workspace is screened, however old: an established account can\n    // be compromised, and a compromised account publishing a lure is the\n    // same harm as a new one. What differs is what a hold may take DOWN.\n    // Holding content that is already live serves its last clean version or\n    // nothing, and on a real business's home page that is an outage the\n    // screen caused (aglyn.com, 2026-09-28, a page that had served clean\n    // until a rule changed). So for an established workspace:\n    //   - NEW content (a new version of a live page, or a page that has\n    //     never been live) holds, exactly as for a young workspace; the live\n    //     page keeps serving its last clean version, or the new page waits;\n    //   - content ALREADY LIVE keeps serving, and is flagged to staff as\n    //     urgent, who lock the site if it is impersonation.\n    if (!isYoungWorkspaceAge(ageDays)) {\n      const strong = signalsThatHold(screened, { ageDays })\n      if (!strong.length) return { outcome: 'serve' }\n      if (await isAlreadyLive(request.hostId, request.screenId, request.versionId, nowMs)) {\n        await flagLivePage({\n          hostId: request.hostId,\n          screenId: request.screenId,\n          versionId: request.versionId,\n          orgId,\n          host,\n          signals: strong,\n          nowMs,\n          page: request.page ?? null,\n          identity,\n        })\n        return { outcome: 'serve' }\n      }\n    }\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = pageReviewId(request.hostId, request.screenId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    // The page by its real name and route (AGL-3374): a template, a list,\n    // a variant, or a page whose flagged content lives in its layout.\n    const subject = await subjectForRow(reviewId, async () =>\n      describeHeldPage({\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        host,\n        page: request.page,\n        signals,\n        identity,\n        live: false,\n        previousVersionId: await servedPageVersion(request.hostId, request.screenId),\n      }),\n    )\n    const url = subject.entryUrl ?? subject.url\n    const flagged = flaggedHostOf(signals)\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const label = heldPageLabel(subject)\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/screens/${request.screenId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      extra: {\n        heldPage: { screenId: request.screenId, versionId: request.versionId, url, subject },\n      },\n      headline:\n        `Held ${pageHeadline(subject, siteName)} Version ${request.versionId}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. ${heldPageVisitorSentence(subject)}`,\n      alertTitle: 'Published page held for review — possible phishing',\n      alertBody: `${label.charAt(0).toUpperCase()}${label.slice(1)} was held before it went live.`,\n      // The owners' words for it, and where they fix it (AGL-3368, AGL-3374).\n      item: { label, path: heldPageConsolePath(subject, request.hostId) },\n      page: subject,\n      // The page itself is what was reported; the flagged host, when there\n      // is one, is named in the details and on `reportedHostname`.\n      url,\n      reportedHostname: flagged,\n    })\n    // A hold from a workspace in its first fortnight also holds the\n    // workspace, the site and the account that published it (AGL-3450).\n    if (state === 'held') {\n      await requestPageSecurityHold({\n        orgId: orgId ?? '',\n        org,\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        reviewId,\n        reference,\n        signals,\n        ageDays,\n        pageLabel: label,\n        pageUrl: url,\n        siteName: typeof host?.['name'] === 'string' ? host['name'] : null,\n        nowMs,\n      })\n    }\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed: the screen has already found a signal on this page, and a\n    // review that could not finish has not cleared it. Not remembered, so\n    // the next render reviews it again.\n    console.error('[page-review] a flagged page could not be reviewed — holding it', error)\n    const reviewId = pageReviewId(request.hostId, request.screenId, [...found.signals, ...listed])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nexport interface SiteRedirectReviewRequest {\n  hostId: string\n  /** The rule's document id under `hosts/{hostId}/redirects`. */\n  ruleId: string\n  /** The path, or the pattern, the rule answers. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n}\n\n/** The review row's id for a redirect rule and the signals that held. */\nexport function redirectReviewId(\n  hostId: string,\n  ruleId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/redirects/${ruleId}`, outboundContentHash([key]))\n}\n\n/**\n * Screen one redirect rule before it sends a visitor off the site\n * (AGL-3447), and say whether it may fire. See the module header.\n *\n * Every workspace is screened and the tiers decide, as for a page: a\n * destination that wears a brand holds for all of them, a lure path sent\n * off the site only for a workspace in its first fortnight. A held rule is\n * filed once per (rule, signal set) and decided by staff on that row:\n * dismissed, it fires; actioned, it never does with those signals.\n */\nexport async function reviewSiteRedirect(\n  request: SiteRedirectReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenSiteRedirect({ source: request.source, destination: request.destination })\n  // Where it sends visitors, against the reputation list (AGL-3451): a\n  // listed destination holds for every workspace, as a listed link does.\n  const reputation = await pageLinkReputation(found.linkHosts)\n  if (!found.signals.length && !reputation.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenSiteRedirect({\n      source: request.source,\n      destination: request.destination,\n      ...identity,\n    })\n    const screened = [\n      ...verdict.signals,\n      ...reputation.signals.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    const source = request.source.slice(0, 200)\n    const destination = request.destination.slice(0, 500)\n    const label = `the redirect from ${source}`\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const [subdomainHost, customDomain] = identity.ownDomains ?? []\n    const siteHost = customDomain || subdomainHost\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/redirects/${request.ruleId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      headline:\n        `Held ${label} of ${siteName}, which sends visitors to ${destination}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. The rule does not fire until this is decided.`,\n      alertTitle: 'Site redirect held for review — possible phishing',\n      alertBody: `The redirect from ${source} was held before it sent anyone off the site.`,\n      // Where the owners fix it: the site's Redirects page.\n      item: { label, path: `/${request.hostId}/redirects` },\n      url: siteHost && source.startsWith('/') ? `https://${siteHost}${source}` : destination,\n      reportedHostname: flaggedHostOf(signals),\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed, as a page is: the screen found a signal and nothing cleared it.\n    console.error('[page-review] a flagged redirect could not be reviewed — holding it', error)\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, [\n      ...found.signals,\n      ...reputation.signals,\n    ])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nfunction pageReviewRef(hostId: string, screenId: string) {\n  return firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection(PAGE_REVIEW_SUBCOLLECTION)\n    .doc(screenId)\n}\n\n/**\n * Is this version of the page already what visitors receive? It is when it\n * is the version the page last served clean, or when the page has no record\n * at all and is not new: it went live before the screen existed. A page\n * created in the last {@link NEW_PAGE_DAYS} days with no record has never\n * been live, so holding it takes nothing down.\n */\nconst NEW_PAGE_DAYS = 7\nasync function isAlreadyLive(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n  nowMs: number,\n): Promise<boolean> {\n  const lastClean = await servedPageVersion(hostId, screenId)\n  if (lastClean) return lastClean === versionId\n  try {\n    const screen = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('screens')\n      .doc(screenId)\n      .get()\n    const created = screen.get('createdAt') as { toMillis?: () => number } | number | undefined\n    const createdMs =\n      typeof created === 'number' ? created : typeof created?.toMillis === 'function' ? created.toMillis() : null\n    // No readable creation time: an old page, so live.\n    return createdMs === null || nowMs - createdMs >= NEW_PAGE_DAYS * 24 * 60 * 60 * 1000\n  } catch {\n    return true\n  }\n}\n\n/**\n * A page ALREADY LIVE carries a strong signal: file one urgent abuse row for\n * it (keyed on the page and its signals, so a busy page is one row) and, the\n * first time, tell staff and the owners through the `page-flagged` notice.\n * The page keeps serving; staff lock the site if it is impersonation or the\n * account looks compromised. Once per page and signal set per process.\n */\nasync function flagLivePage(input: {\n  hostId: string\n  screenId: string\n  versionId: string\n  orgId: string | null\n  host: Record<string, unknown> | null\n  signals: readonly PhishingScreenSignal[]\n  nowMs: number\n  page?: HostedPageContext | null\n  identity?: ReturnType<typeof workspaceScreenIdentity>\n}): Promise<void> {\n  const key = `${input.hostId}\\n${input.screenId}\\n${input.signals.map((signal) => canonicalJson(signal)).sort().join('\\n')}`\n  const at = flaggedMemo.get(key)\n  if (at !== undefined && input.nowMs - at < FLAGGED_MEMO_TTL_MS) return\n  flaggedMemo.set(key, input.nowMs)\n  try {\n    const reviewId = pageReviewId(input.hostId, `${input.screenId}/live`, input.signals)\n    const reference = heldOutboundReference(reviewId)\n    const evidence = describePhishingScreenSignals(input.signals).join(' ')\n    const flagged = flaggedHostOf(input.signals)\n    const ref = firebaseAdmin.app().firestore().collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const existing = await ref.get()\n    const first = !existing.exists\n    // Named once, when the row is new (AGL-3374).\n    const subject =\n      (existing.exists ? storedSubject(existing.get('heldPage')) : null) ??\n      (await describeHeldPage({\n        hostId: input.hostId,\n        screenId: input.screenId,\n        versionId: input.versionId,\n        host: input.host,\n        page: input.page,\n        signals: input.signals,\n        identity: input.identity ?? workspaceScreenIdentity({ host: input.host }),\n        live: true,\n        previousVersionId: null,\n      }))\n    const url = subject.entryUrl ?? subject.url\n    const siteName =\n      typeof input.host?.['name'] === 'string' && input.host['name']\n        ? `\"${input.host['name']}\"`\n        : 'a site'\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url,\n        reportedHostname: flagged,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          `LIVE: ${pageHeadline(subject, siteName)} It was flagged by the phishing screen and is still serving.`,\n          evidence,\n          'Lock the site if it is impersonation or the account looks compromised; dismiss this if the content is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        heldPage: { screenId: input.screenId, versionId: input.versionId, url, subject },\n        riskNotice: { kind: 'page-flagged' },\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (!first) return\n    await notifyRiskEvent({\n      kind: 'page-flagged',\n      orgId: input.orgId,\n      hostId: input.hostId,\n      reviewId,\n      reference,\n      item: { label: heldPageLabel(subject), path: heldPageConsolePath(subject, input.hostId) },\n      page: subject,\n      staffEvidence: [...heldPageDetails(subject), evidence].join(' '),\n    })\n  } catch (error) {\n    console.error('[page-review] a live page could not be flagged', error)\n  }\n}\n\n/**\n * The version this page last served clean, or null. A HINT, not a\n * clearance: the caller composes and screens it again before serving it,\n * because a version document can be edited after it was served.\n */\nexport async function servedPageVersion(hostId: string, screenId: string): Promise<string | null> {\n  try {\n    const snapshot = await pageReviewRef(hostId, screenId).get()\n    const value = snapshot.get('servedVersionId')\n    return typeof value === 'string' && value ? value : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Note that this page served `versionId` clean. One read the first time a\n * process renders a page, a write only when the version moved; nothing\n * after that, however often the page is rendered.\n */\nexport async function recordServedPageVersion(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n): Promise<void> {\n  const key = `${hostId}/${screenId}`\n  // The foreign hosts this version links to, as its review found them\n  // (AGL-3451): noted beside it so the daily link re-check can walk them.\n  const foreignHosts = reviewedForeignHosts.get(`${key}/${versionId}`)\n  const memoValue = foreignHosts ? `${versionId}|${foreignHosts.join(',')}` : versionId\n  if (!versionId || servedMemo.get(key) === memoValue) return\n  try {\n    const ref = pageReviewRef(hostId, screenId)\n    const snapshot = await ref.get()\n    const versionMoved = snapshot.get('servedVersionId') !== versionId\n    const stored = snapshot.get('foreignHosts')\n    const hostsMoved =\n      foreignHosts !== undefined &&\n      (Array.isArray(stored) ? stored.join(',') : '') !== foreignHosts.join(',')\n    if (versionMoved || hostsMoved) {\n      await ref.set(\n        {\n          ...(versionMoved ? { servedVersionId: versionId, servedAtMs: Date.now() } : {}),\n          ...(foreignHosts\n            ? { foreignHosts, foreignHostCount: foreignHosts.length }\n            : {}),\n        },\n        { merge: true },\n      )\n    }\n    servedMemo.set(key, memoValue)\n  } catch (error) {\n    console.warn('[page-review] the served version could not be noted', error)\n  }\n}\n\n/**\n * A domain a workspace attached that wears a brand (AGL-3356, AGL-3362):\n * filed in the abuse queue as an urgent `phishing` row for staff, not\n * refused. Two kinds, one rule:\n *\n * - `site` — a custom domain a site is served on (the attach route);\n * - `sending` — a custom domain a workspace sends email as, when it is\n *   added and again when it verifies (`sending-domains.ts`);\n * - `link` — a link a merchant configured that a buyer or a server would\n *   follow: a product's paid download or video hotlink, a supplier's order\n *   webhook (AGL-3363). The link itself is refused where it is followed; this\n *   files it, and tells the site's managers once ({@link notifyLookalikeLink}).\n *\n * Not refused, because the domain is the merchant's own registration and\n * the platform cannot tell a brand's own agency attaching `paypal-promo.com`\n * from a kit — but a brand's lookalike on a site or in a `From:` line is\n * exactly what staff look at first. The site's pages are still screened as\n * they are served, and mail FROM a lookalike domain is held at the send seam\n * for every workspace. The test is the phishing screen's own lookalike rule\n * (`lookalikeBrandForHost`), the one that holds a link in an email. One row\n * per (owner, kind, domain), so a re-attach or a re-verify counts rather than\n * re-alerts.\n *\n * Never throws: the write it rides on has already happened.\n */\nexport async function flagLookalikeDomain(input: {\n  kind: 'site' | 'sending' | 'link'\n  hostId: string | null\n  orgId: string | null\n  domain: string\n  /** For a `link`: where it was configured, as staff read it. */\n  where?: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  const domain = String(input.domain ?? '').trim().toLowerCase()\n  const brand = lookalikeBrandForHost(domain)\n  if (!brand) return 'clean'\n  const label = phishingScreenBrandLabel(brand.id)\n  const sending = input.kind === 'sending'\n  const link = input.kind === 'link'\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const owner = sending\n      ? `orgs/${input.orgId ?? ''}/sendingDomains`\n      : link\n        ? `hosts/${input.hostId ?? ''}/links`\n        : `hosts/${input.hostId ?? ''}/cname`\n    const reviewId = heldOutboundReviewId(owner, domain)\n    const reference = heldOutboundReference(reviewId)\n    const ref = firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const first = !(await ref.get()).exists\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url: `https://${domain}/`,\n        reportedHostname: domain,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          sending\n            ? `A workspace added ${domain} as a domain to send email from.`\n            : link\n              ? `A site configured a link to ${domain} (${input.where ?? 'a commerce link'}).`\n              : `A site attached the custom domain ${domain}.`,\n          `${domain} wears the ${label} name but is not ${label}'s domain.`,\n          sending\n            ? 'Email from it is held at the send seam for every workspace. Mark this actioned ' +\n              'and lock the workspace if it is impersonation; dismiss it if the brand is theirs.'\n            : link\n              ? 'Nobody is sent to it: the link is refused wherever it is followed. Mark this ' +\n                'actioned and lock the site if it is impersonation.'\n              : 'Its pages are still screened as they are served. Mark this actioned ' +\n                'and lock the site if it is impersonation; dismiss it if the brand is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (first && link) {\n      await notifyLookalikeLink({\n        hostId: input.hostId,\n        orgId: input.orgId,\n        domain,\n        label,\n        where: input.where ?? 'a commerce link',\n        reference,\n        reviewId,\n      })\n    } else if (first) {\n      // The owners hear that the domain is waiting on a routine review — not\n      // which name it resembles; staff get the brand and a link to the row.\n      await notifyRiskEvent({\n        kind: 'domain-flagged',\n        orgId: input.orgId,\n        hostId: input.hostId,\n        reviewId,\n        reference,\n        item: {\n          label: sending ? `the sending domain ${domain}` : `the custom domain ${domain}`,\n          // Emails → Sending, or the site's Domain settings.\n          path: sending ? '/org/emails/sending' : input.hostId ? `/${input.hostId}/admin/domain` : null,\n        },\n        staffEvidence:\n          `${sending ? 'Sending domain' : 'Custom domain'} ${domain} looks like ${label}.`,\n      })\n    }\n    return 'flagged'\n  } catch (error) {\n    console.error('[page-review] a lookalike domain could not be flagged', error)\n    return 'failed'\n  }\n}\n\n/**\n * Tell staff and the site's managers and the workspace's owners, once per\n * (site, domain), that a link the merchant configured was refused because it\n * wears another brand's name (AGL-3363), through the risk notice seam\n * (AGL-3368). The merchant reads the catalog's `link-blocked` words — what\n * was refused and how to fix it, never how the check works; staff get the\n * brand and a link to the row. Never throws.\n */\nexport async function notifyLookalikeLink(input: {\n  hostId: string | null\n  orgId?: string | null\n  domain: string\n  label: string\n  where: string\n  reference: string\n  reviewId?: string | null\n}): Promise<void> {\n  await notifyRiskEvent({\n    kind: 'link-blocked',\n    orgId: input.orgId ?? null,\n    hostId: input.hostId,\n    reviewId: input.reviewId ?? null,\n    reference: input.reference,\n    item: {\n      label: `${input.where} pointing to ${input.domain}`,\n      path: input.hostId ? `/${input.hostId}/products` : null,\n    },\n    staffEvidence:\n      `A site configured ${input.where} to ${input.domain}, which looks like ${input.label}. ` +\n      'It is refused wherever it is followed.',\n  }).catch(() => undefined)\n}\n\n/** A site's custom domain, through {@link flagLookalikeDomain}. */\nexport function flagLookalikeCustomDomain(input: {\n  hostId: string\n  orgId: string | null\n  domain: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  return flagLookalikeDomain({ kind: 'site', ...input })\n}\n"],"names":["ABUSE_REPORT_COLLECTION","heldPageConsolePath","heldPageDetails","heldPageLabel","heldPageVisitorSentence","screenHostedPage","screenSiteRedirect","lookalikeBrandForHost","phishingScreenBrandLabel","describePhishingScreenSignals","isYoungWorkspaceAge","signalsThatHold","foreignHostsForReputation","webRiskSignals","FieldValue","firebaseAdmin","describeHeldPage","notifyRiskEvent","orgAgeDays","requestPageSecurityHold","getHostDocAdmin","getOrgForHost","lookupHostReputation","platformReputationExclusions","canonicalJson","fileOutboundHold","flaggedHostOf","heldOutboundReference","heldOutboundReviewId","outboundContentHash","workspaceScreenIdentity","PAGE_REVIEW_SUBCOLLECTION","pageReviewId","hostId","screenId","signals","key","map","signal","sort","join","PAGE_MEMO_TTL_MS","pageMemo","Map","servedMemo","flaggedMemo","FLAGGED_MEMO_TTL_MS","reviewedForeignHosts","REVIEWED_FOREIGN_HOSTS_MAX","resetHostedPageReviewMemoForTests","clear","pageLinkReputation","linkHosts","hosts","excludeDomains","length","answer","hits","error","console","warn","isOwnHost","host","ownDomains","some","own","domain","String","trim","toLowerCase","Boolean","endsWith","subjectForRow","reviewId","describe","stored","app","firestore","collection","doc","get","then","row","storedSubject","catch","heldPage","subject","pageHeadline","siteName","reviewHostedPage","request","found","nodes","reputation","size","set","versionId","listed","extraSignals","outcome","nowMs","Date","now","owner","Promise","all","undefined","org","orgId","identity","verdict","screened","filter","ageDays","createdAt","strong","isAlreadyLive","flagLivePage","page","reference","memo","atMs","state","live","previousVersionId","servedPageVersion","url","entryUrl","flagged","label","heldSend","kind","path","contentHash","slice","fromName","heldAtMs","extra","headline","alertTitle","alertBody","charAt","toUpperCase","item","reportedHostname","pageLabel","pageUrl","redirectReviewId","ruleId","reviewSiteRedirect","source","destination","subdomainHost","customDomain","siteHost","startsWith","pageReviewRef","NEW_PAGE_DAYS","lastClean","screen","created","createdMs","toMillis","input","at","existing","evidence","ref","first","exists","category","severity","details","reporterEmail","reporterName","dmca","riskNotice","reportCount","increment","updatedAt","serverTimestamp","status","merge","staffEvidence","snapshot","value","recordServedPageVersion","foreignHosts","memoValue","versionMoved","hostsMoved","Array","isArray","servedVersionId","servedAtMs","foreignHostCount","flagLookalikeDomain","brand","id","sending","link","where","notifyLookalikeLink","flagLookalikeCustomDomain"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA4E2C,GAE3C,SAASA,uBAAuB,QAAQ,sCAAqC;AAC7E,SACEC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,QAElB,qCAAoC;AAC3C,SAASC,gBAAgB,EAAEC,kBAAkB,QAAQ,8CAA6C;AAClG,SACEC,qBAAqB,EACrBC,wBAAwB,EAExBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,eAAe,QACV,oDAAmD;AAC1D,SACEC,yBAAyB,EACzBC,cAAc,QACT,2CAA0C;AACjD,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,gBAAgB,QAAgC,yBAAqB;AAC9E,SAASC,eAAe,QAAQ,mBAAe;AAC/C,SAASC,UAAU,QAAQ,eAAW;AACtC,SAASC,uBAAuB,QAAQ,0BAAsB;AAC9D,SAASC,eAAe,EAAEC,aAAa,QAAQ,qBAAiB;AAChE,SAASC,oBAAoB,EAAEC,4BAA4B,QAAQ,gBAAY;AAC/E,SACEC,aAAa,EACbC,gBAAgB,EAChBC,aAAa,EACbC,qBAAqB,EACrBC,oBAAoB,EACpBC,mBAAmB,EAEnBC,uBAAuB,QAClB,4BAAwB;AAE/B,yFAAyF,GACzF,OAAO,MAAMC,4BAA4B,cAAa;AAiCtD,8DAA8D,GAC9D,OAAO,SAASC,aACdC,MAAc,EACdC,QAAgB,EAChBC,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,SAAS,EAAEC,UAAU,EAAEL,oBAAoB;QAACO;KAAI;AAC9F;AAEA,8EAA8E,GAC9E,MAAMK,mBAAmB;AACzB,MAAMC,WAAW,IAAIC;AACrB,4EAA4E,GAC5E,MAAMC,aAAa,IAAID;AACvB,oFAAoF,GACpF,MAAME,cAAc,IAAIF;AACxB,MAAMG,sBAAsB,KAAK;AACjC;;;;;CAKC,GACD,MAAMC,uBAAuB,IAAIJ;AACjC,MAAMK,6BAA6B;AAEnC,iDAAiD,GACjD,OAAO,SAASC;IACdP,SAASQ,KAAK;IACdN,WAAWM,KAAK;IAChBL,YAAYK,KAAK;IACjBH,qBAAqBG,KAAK;AAC5B;AAEA;;;;;CAKC,GACD,eAAeC,mBACbC,SAA4B;IAE5B,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI;QACF,MAAMC,QAAQzC,0BAA0BwC,WAAW;YACjDE,gBAAgB/B;QAClB;QACA,IAAI,CAAC8B,MAAME,MAAM,EAAE,OAAO;YAAEF;YAAOlB,SAAS,EAAE;QAAC;QAC/C,MAAMqB,SAAS,MAAMlC,qBAAqB+B;QAC1C,OAAO;YAAEA;YAAOlB,SAAStB,eAAe2C,OAAOC,IAAI;QAAE;IACvD,EAAE,OAAOC,OAAO;QACdC,QAAQC,IAAI,CAAC,wEAAwEF;QACrF,OAAO;YAAEL,OAAO,EAAE;YAAElB,SAAS,EAAE;QAAC;IAClC;AACF;AAEA,6CAA6C,GAC7C,SAAS0B,UAAUC,IAAY,EAAEC,UAA8D;IAC7F,OAAO,CAACA,qBAAAA,aAAc,EAAE,EAAEC,IAAI,CAAC,CAACC;QAC9B,MAAMC,SAASC,OAAOF,cAAAA,MAAO,IAAIG,IAAI,GAAGC,WAAW;QACnD,OAAOC,QAAQJ,WAAYJ,CAAAA,SAASI,UAAUJ,KAAKS,QAAQ,CAAC,CAAC,CAAC,EAAEL,QAAQ,CAAA;IAC1E;AACF;AAEA;;;;CAIC,GACD,eAAeM,cACbC,QAAgB,EAChBC,QAAwC;IAExC,MAAMC,SAAS,MAAM5D,cAClB6D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC9E,yBACX+E,GAAG,CAACN,UACJO,GAAG,GACHC,IAAI,CAAC,CAACC,MAAQC,cAAcD,IAAIF,GAAG,CAAC,cACpCI,KAAK,CAAC,IAAM;IACf,OAAOT,iBAAAA,SAAUD;AACnB;AAEA,6CAA6C,GAC7C,SAASS,cAAcE,QAAiB;IACtC,MAAMC,UAAWD,4BAAD,AAACA,SAA+DC,OAAO;IACvF,OAAOA,WAAW,OAAOA,YAAY,YAAYA,QAAQpD,QAAQ,GAAGoD,UAAU;AAChF;AAEA,iEAAiE,GACjE,SAASC,aAAaD,OAAwB,EAAEE,QAAgB;IAC9D,OAAO;QAAC,GAAGrF,cAAcmF,SAAS,IAAI,EAAEE,SAAS,CAAC,CAAC;WAAKtF,gBAAgBoF;KAAS,CAAC9C,IAAI,CAAC;AACzF;AAEA;;;CAGC,GACD,OAAO,eAAeiD,iBACpBC,OAAgC;QASWA,uBAG7BA;IAVd,MAAMC,QAAQtF,iBAAiB;QAAEuF,OAAOF,QAAQE,KAAK;IAAC;IACtD,+DAA+D;IAC/D,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAMC,aAAa,MAAM1C,mBAAmBwC,MAAMvC,SAAS;IAC3D,IAAIL,qBAAqB+C,IAAI,IAAI9C,4BAA4BD,qBAAqBG,KAAK;IACvFH,qBAAqBgD,GAAG,CAAC,GAAGL,QAAQzD,MAAM,CAAC,CAAC,EAAEyD,QAAQxD,QAAQ,CAAC,CAAC,EAAEwD,QAAQM,SAAS,EAAE,EAAEH,WAAWxC,KAAK;IACvG,MAAM4C,SAAS;WAAIJ,WAAW1D,OAAO;YAAMuD,wBAAAA,QAAQQ,YAAY,YAApBR,wBAAwB,EAAE;KAAE;IACvE,IAAI,CAACC,MAAMxD,OAAO,CAACoB,MAAM,IAAI,CAAC0C,OAAO1C,MAAM,EAAE,OAAO;QAAE4C,SAAS;IAAQ;IAEvE,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAyEHJ;QA5EZ,MAAM,CAACxB,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG1C,gBAAgBsE,QAAQzD,MAAM;YAC1EyD,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDtF,cAAcqE,QAAQzD,MAAM;SACjC;QACD,MAAM0E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,sEAAsE;QACtE,qEAAqE;QACrE,MAAMC,WAAW/E,wBAAwB;YAAE6E;YAAK7C;QAAK;QACrD,MAAMgD,UAAUzG,iBAAiB;YAAEuF,OAAOF,QAAQE,KAAK;WAAKiB;QAC5D,oEAAoE;QACpE,MAAME,WAAW;eACZD,QAAQ3E,OAAO;eACf8D,OAAOe,MAAM,CACd,CAAC1E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACuB,UAAUvB,OAAOwB,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAU/F,WAAYyF,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,0DAA0D;QAC1D,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAAC1F,oBAAoBuG,UAAU;YACjC,MAAME,SAASxG,gBAAgBoG,UAAU;gBAAEE;YAAQ;YACnD,IAAI,CAACE,OAAO5D,MAAM,EAAE,OAAO;gBAAE4C,SAAS;YAAQ;YAC9C,IAAI,MAAMiB,cAAc1B,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ,EAAEwD,QAAQM,SAAS,EAAEI,QAAQ;oBAS3EV;gBARR,MAAM2B,aAAa;oBACjBpF,QAAQyD,QAAQzD,MAAM;oBACtBC,UAAUwD,QAAQxD,QAAQ;oBAC1B8D,WAAWN,QAAQM,SAAS;oBAC5BY;oBACA9C;oBACA3B,SAASgF;oBACTf;oBACAkB,IAAI,GAAE5B,gBAAAA,QAAQ4B,IAAI,YAAZ5B,gBAAgB;oBACtBmB;gBACF;gBACA,OAAO;oBAAEV,SAAS;gBAAQ;YAC5B;QACF;QACA,MAAMhE,UAAUxB,gBAAgBoG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAC9E,QAAQoB,MAAM,EAAE,OAAO;YAAE4C,SAAS;QAAQ;QAE/C,MAAM1B,WAAWzC,aAAa0D,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ,EAAEC;QAChE,MAAMoF,YAAY5F,sBAAsB8C;QACxC,MAAM+C,OAAO9E,SAASsC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGhF,kBAAkB;YAChD,OAAO+E,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,sEAAsE;QACtE,kEAAkE;QAClE,MAAMjC,UAAU,MAAMd,cAAcC,UAAU,UAC5CzD,iBAAiB;gBACfiB,QAAQyD,QAAQzD,MAAM;gBACtBC,UAAUwD,QAAQxD,QAAQ;gBAC1B8D,WAAWN,QAAQM,SAAS;gBAC5BlC;gBACAwD,MAAM5B,QAAQ4B,IAAI;gBAClBnF;gBACA0E;gBACAc,MAAM;gBACNC,mBAAmB,MAAMC,kBAAkBnC,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ;YAC7E;QAEF,MAAM4F,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAME,UAAUtG,cAAcS;QAC9B,MAAMqD,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAMmE,QAAQ9H,cAAcmF;QAC5B,MAAMoC,QAAQ,MAAMjG,iBAAiB;YACnCgD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQzD,MAAM,CAAC,SAAS,EAAEyD,QAAQxD,QAAQ,EAAE;gBAC3DD,QAAQyD,QAAQzD,MAAM;gBACtB2E;gBACAyB,aAAaxG,oBAAoB;oBAACM;iBAAQ;gBAC1CmD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVpG;gBACAuF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAwB,OAAO;gBACLpD,UAAU;oBAAEnD,UAAUwD,QAAQxD,QAAQ;oBAAE8D,WAAWN,QAAQM,SAAS;oBAAE8B;oBAAKxC;gBAAQ;YACrF;YACAoD,UACE,CAAC,KAAK,EAAEnD,aAAaD,SAASE,UAAU,SAAS,EAAEE,QAAQM,SAAS,CAAC,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEiB,kBAAAA,UAAW,IAAI,aAAa,EAAE7G,wBAAwBkF,UAAU;YAC/EqD,YAAY;YACZC,WAAW,GAAGX,MAAMY,MAAM,CAAC,GAAGC,WAAW,KAAKb,MAAMK,KAAK,CAAC,GAAG,8BAA8B,CAAC;YAC5F,wEAAwE;YACxES,MAAM;gBAAEd;gBAAOG,MAAMnI,oBAAoBqF,SAASI,QAAQzD,MAAM;YAAE;YAClEqF,MAAMhC;YACN,qEAAqE;YACrE,6DAA6D;YAC7DwC;YACAkB,kBAAkBhB;QACpB;QACA,gEAAgE;QAChE,oEAAoE;QACpE,IAAIN,UAAU,QAAQ;YACpB,MAAMvG,wBAAwB;gBAC5ByF,KAAK,EAAEA,gBAAAA,QAAS;gBAChBD;gBACA1E,QAAQyD,QAAQzD,MAAM;gBACtBC,UAAUwD,QAAQxD,QAAQ;gBAC1B8D,WAAWN,QAAQM,SAAS;gBAC5BvB;gBACA8C;gBACApF;gBACA8E;gBACAgC,WAAWhB;gBACXiB,SAASpB;gBACTtC,UAAU,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,WAAWA,IAAI,CAAC,OAAO,GAAG;gBAC9DsC;YACF;QACF;QACA1D,SAASqD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpCC,QAAQD,KAAK,CAAC,mEAAmEA;QACjF,MAAMe,WAAWzC,aAAa0D,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ,EAAE;eAAIyD,MAAMxD,OAAO;eAAK8D;SAAO;QAC7F,OAAO;YAAEE,SAAS;YAAQ1B;YAAU8C,WAAW5F,sBAAsB8C;QAAU;IACjF;AACF;AAiBA,uEAAuE,GACvE,OAAO,SAAS0E,iBACdlH,MAAc,EACdmH,MAAc,EACdjH,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,WAAW,EAAEmH,QAAQ,EAAEvH,oBAAoB;QAACO;KAAI;AAC9F;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeiH,mBACpB3D,OAAkC;QAQpBA;IANd,MAAMC,QAAQrF,mBAAmB;QAAEgJ,QAAQ5D,QAAQ4D,MAAM;QAAEC,aAAa7D,QAAQ6D,WAAW;IAAC;IAC5F,qEAAqE;IACrE,uEAAuE;IACvE,MAAM1D,aAAa,MAAM1C,mBAAmBwC,MAAMvC,SAAS;IAC3D,IAAI,CAACuC,MAAMxD,OAAO,CAACoB,MAAM,IAAI,CAACsC,WAAW1D,OAAO,CAACoB,MAAM,EAAE,OAAO;QAAE4C,SAAS;IAAQ;IAEnF,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAkCuBmB;QArCtC,MAAM,CAAC/C,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG1C,gBAAgBsE,QAAQzD,MAAM;YAC1EyD,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDtF,cAAcqE,QAAQzD,MAAM;SACjC;QACD,MAAM0E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,MAAMC,WAAW/E,wBAAwB;YAAE6E;YAAK7C;QAAK;QACrD,MAAMgD,UAAUxG,mBAAmB;YACjCgJ,QAAQ5D,QAAQ4D,MAAM;YACtBC,aAAa7D,QAAQ6D,WAAW;WAC7B1C;QAEL,MAAME,WAAW;eACZD,QAAQ3E,OAAO;eACf0D,WAAW1D,OAAO,CAAC6E,MAAM,CAC1B,CAAC1E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACuB,UAAUvB,OAAOwB,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAU/F,WAAYyF,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,MAAMjE,UAAUxB,gBAAgBoG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAC9E,QAAQoB,MAAM,EAAE,OAAO;YAAE4C,SAAS;QAAQ;QAE/C,MAAM1B,WAAW0E,iBAAiBzD,QAAQzD,MAAM,EAAEyD,QAAQ0D,MAAM,EAAEjH;QAClE,MAAMoF,YAAY5F,sBAAsB8C;QACxC,MAAM+C,OAAO9E,SAASsC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGhF,kBAAkB;YAChD,OAAO+E,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,MAAM+B,SAAS5D,QAAQ4D,MAAM,CAAChB,KAAK,CAAC,GAAG;QACvC,MAAMiB,cAAc7D,QAAQ6D,WAAW,CAACjB,KAAK,CAAC,GAAG;QACjD,MAAML,QAAQ,CAAC,kBAAkB,EAAEqB,QAAQ;QAC3C,MAAM9D,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM,CAAC0F,eAAeC,aAAa,IAAG5C,uBAAAA,SAAS9C,UAAU,YAAnB8C,uBAAuB,EAAE;QAC/D,MAAM6C,WAAWD,gBAAgBD;QACjC,MAAM9B,QAAQ,MAAMjG,iBAAiB;YACnCgD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQzD,MAAM,CAAC,WAAW,EAAEyD,QAAQ0D,MAAM,EAAE;gBAC3DnH,QAAQyD,QAAQzD,MAAM;gBACtB2E;gBACAyB,aAAaxG,oBAAoB;oBAACM;iBAAQ;gBAC1CmD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVpG;gBACAuF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAyB,UACE,CAAC,KAAK,EAAET,MAAM,IAAI,EAAEzC,SAAS,0BAA0B,EAAE+D,YAAY,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEtC,kBAAAA,UAAW,IAAI,0DAA0D,CAAC;YACzF0B,YAAY;YACZC,WAAW,CAAC,kBAAkB,EAAEU,OAAO,6CAA6C,CAAC;YACrF,sDAAsD;YACtDP,MAAM;gBAAEd;gBAAOG,MAAM,CAAC,CAAC,EAAE1C,QAAQzD,MAAM,CAAC,UAAU,CAAC;YAAC;YACpD6F,KAAK4B,YAAYJ,OAAOK,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAED,WAAWJ,QAAQ,GAAGC;YAC3EP,kBAAkBtH,cAAcS;QAClC;QACAO,SAASqD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,0EAA0E;QAC1EC,QAAQD,KAAK,CAAC,uEAAuEA;QACrF,MAAMe,WAAW0E,iBAAiBzD,QAAQzD,MAAM,EAAEyD,QAAQ0D,MAAM,EAAE;eAC7DzD,MAAMxD,OAAO;eACb0D,WAAW1D,OAAO;SACtB;QACD,OAAO;YAAEgE,SAAS;YAAQ1B;YAAU8C,WAAW5F,sBAAsB8C;QAAU;IACjF;AACF;AAEA,SAASmF,cAAc3H,MAAc,EAAEC,QAAgB;IACrD,OAAOnB,cACJ6D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAC9C,QACJ6C,UAAU,CAAC/C,2BACXgD,GAAG,CAAC7C;AACT;AAEA;;;;;;CAMC,GACD,MAAM2H,gBAAgB;AACtB,eAAezC,cACbnF,MAAc,EACdC,QAAgB,EAChB8D,SAAiB,EACjBI,KAAa;IAEb,MAAM0D,YAAY,MAAMjC,kBAAkB5F,QAAQC;IAClD,IAAI4H,WAAW,OAAOA,cAAc9D;IACpC,IAAI;QACF,MAAM+D,SAAS,MAAMhJ,cAClB6D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAC9C,QACJ6C,UAAU,CAAC,WACXC,GAAG,CAAC7C,UACJ8C,GAAG;QACN,MAAMgF,UAAUD,OAAO/E,GAAG,CAAC;QAC3B,MAAMiF,YACJ,OAAOD,YAAY,WAAWA,UAAU,QAAOA,2BAAAA,QAASE,QAAQ,MAAK,aAAaF,QAAQE,QAAQ,KAAK;QACzG,mDAAmD;QACnD,OAAOD,cAAc,QAAQ7D,QAAQ6D,aAAaJ,gBAAgB,KAAK,KAAK,KAAK;IACnF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,eAAexC,aAAa8C,KAU3B;IACC,MAAM/H,MAAM,GAAG+H,MAAMlI,MAAM,CAAC,EAAE,EAAEkI,MAAMjI,QAAQ,CAAC,EAAE,EAAEiI,MAAMhI,OAAO,CAACE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAASC,IAAI,GAAGC,IAAI,CAAC,OAAO;IAC3H,MAAM4H,KAAKvH,YAAYmC,GAAG,CAAC5C;IAC3B,IAAIgI,OAAO1D,aAAayD,MAAM/D,KAAK,GAAGgE,KAAKtH,qBAAqB;IAChED,YAAYkD,GAAG,CAAC3D,KAAK+H,MAAM/D,KAAK;IAChC,IAAI;YAUCiE,MAQWF,iBAIF7E;YAEH6E;QAvBT,MAAM1F,WAAWzC,aAAamI,MAAMlI,MAAM,EAAE,GAAGkI,MAAMjI,QAAQ,CAAC,KAAK,CAAC,EAAEiI,MAAMhI,OAAO;QACnF,MAAMoF,YAAY5F,sBAAsB8C;QACxC,MAAM6F,WAAW7J,8BAA8B0J,MAAMhI,OAAO,EAAEK,IAAI,CAAC;QACnE,MAAMwF,UAAUtG,cAAcyI,MAAMhI,OAAO;QAC3C,MAAMoI,MAAMxJ,cAAc6D,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC9E,yBAAyB+E,GAAG,CAACN;QACpF,MAAM4F,WAAW,MAAME,IAAIvF,GAAG;QAC9B,MAAMwF,QAAQ,CAACH,SAASI,MAAM;QAC9B,8CAA8C;QAC9C,MAAMnF,WACH+E,OAAAA,SAASI,MAAM,GAAGtF,cAAckF,SAASrF,GAAG,CAAC,eAAe,gBAA5DqF,OACA,MAAMrJ,iBAAiB;YACtBiB,QAAQkI,MAAMlI,MAAM;YACpBC,UAAUiI,MAAMjI,QAAQ;YACxB8D,WAAWmE,MAAMnE,SAAS;YAC1BlC,MAAMqG,MAAMrG,IAAI;YAChBwD,MAAM6C,MAAM7C,IAAI;YAChBnF,SAASgI,MAAMhI,OAAO;YACtB0E,QAAQ,GAAEsD,kBAAAA,MAAMtD,QAAQ,YAAdsD,kBAAkBrI,wBAAwB;gBAAEgC,MAAMqG,MAAMrG,IAAI;YAAC;YACvE6D,MAAM;YACNC,mBAAmB;QACrB;QACF,MAAME,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAMtC,WACJ,SAAO2E,cAAAA,MAAMrG,IAAI,qBAAVqG,WAAY,CAAC,OAAO,MAAK,YAAYA,MAAMrG,IAAI,CAAC,OAAO,GAC1D,CAAC,CAAC,EAAEqG,MAAMrG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GACzB;QACN,MAAMyG,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB;YACAkB,kBAAkBhB;YAClB/F,QAAQkI,MAAMlI,MAAM;YACpB2E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP,CAAC,MAAM,EAAErF,aAAaD,SAASE,UAAU,4DAA4D,CAAC;gBACtG8E;gBACA;aACD,CAAC9H,IAAI,CAAC;YACPqI,eAAe;YACfC,cAAc;YACdC,MAAM;YACN1F,UAAU;gBAAEnD,UAAUiI,MAAMjI,QAAQ;gBAAE8D,WAAWmE,MAAMnE,SAAS;gBAAE8B;gBAAKxC;YAAQ;YAC/E0F,YAAY;gBAAE7C,MAAM;YAAe;YACnC8C,aAAanK,WAAWoK,SAAS,CAAC;YAClCC,WAAWrK,WAAWsK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWpG,WAAWsK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAI,CAACd,OAAO;QACZ,MAAMvJ,gBAAgB;YACpBkH,MAAM;YACNvB,OAAOuD,MAAMvD,KAAK;YAClB3E,QAAQkI,MAAMlI,MAAM;YACpBwC;YACA8C;YACAwB,MAAM;gBAAEd,OAAO9H,cAAcmF;gBAAU8C,MAAMnI,oBAAoBqF,SAAS6E,MAAMlI,MAAM;YAAE;YACxFqF,MAAMhC;YACNiG,eAAe;mBAAIrL,gBAAgBoF;gBAAUgF;aAAS,CAAC9H,IAAI,CAAC;QAC9D;IACF,EAAE,OAAOkB,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;IAClE;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAemE,kBAAkB5F,MAAc,EAAEC,QAAgB;IACtE,IAAI;QACF,MAAMsJ,WAAW,MAAM5B,cAAc3H,QAAQC,UAAU8C,GAAG;QAC1D,MAAMyG,QAAQD,SAASxG,GAAG,CAAC;QAC3B,OAAO,OAAOyG,UAAU,YAAYA,QAAQA,QAAQ;IACtD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpBzJ,MAAc,EACdC,QAAgB,EAChB8D,SAAiB;IAEjB,MAAM5D,MAAM,GAAGH,OAAO,CAAC,EAAEC,UAAU;IACnC,oEAAoE;IACpE,wEAAwE;IACxE,MAAMyJ,eAAe5I,qBAAqBiC,GAAG,CAAC,GAAG5C,IAAI,CAAC,EAAE4D,WAAW;IACnE,MAAM4F,YAAYD,eAAe,GAAG3F,UAAU,CAAC,EAAE2F,aAAanJ,IAAI,CAAC,MAAM,GAAGwD;IAC5E,IAAI,CAACA,aAAapD,WAAWoC,GAAG,CAAC5C,SAASwJ,WAAW;IACrD,IAAI;QACF,MAAMrB,MAAMX,cAAc3H,QAAQC;QAClC,MAAMsJ,WAAW,MAAMjB,IAAIvF,GAAG;QAC9B,MAAM6G,eAAeL,SAASxG,GAAG,CAAC,uBAAuBgB;QACzD,MAAMrB,SAAS6G,SAASxG,GAAG,CAAC;QAC5B,MAAM8G,aACJH,iBAAiBjF,aACjB,AAACqF,CAAAA,MAAMC,OAAO,CAACrH,UAAUA,OAAOnC,IAAI,CAAC,OAAO,EAAC,MAAOmJ,aAAanJ,IAAI,CAAC;QACxE,IAAIqJ,gBAAgBC,YAAY;YAC9B,MAAMvB,IAAIxE,GAAG,CACX,aACM8F,eAAe;gBAAEI,iBAAiBjG;gBAAWkG,YAAY7F,KAAKC,GAAG;YAAG,IAAI,CAAC,GACzEqF,eACA;gBAAEA;gBAAcQ,kBAAkBR,aAAapI,MAAM;YAAC,IACtD,CAAC,IAEP;gBAAE+H,OAAO;YAAK;QAElB;QACA1I,WAAWmD,GAAG,CAAC3D,KAAKwJ;IACtB,EAAE,OAAOlI,OAAO;QACdC,QAAQC,IAAI,CAAC,uDAAuDF;IACtE;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,eAAe0I,oBAAoBjC,KAOzC;QACuBA;IAAtB,MAAMjG,SAASC,QAAOgG,gBAAAA,MAAMjG,MAAM,YAAZiG,gBAAgB,IAAI/F,IAAI,GAAGC,WAAW;IAC5D,MAAMgI,QAAQ9L,sBAAsB2D;IACpC,IAAI,CAACmI,OAAO,OAAO;IACnB,MAAMpE,QAAQzH,yBAAyB6L,MAAMC,EAAE;IAC/C,MAAMC,UAAUpC,MAAMhC,IAAI,KAAK;IAC/B,MAAMqE,OAAOrC,MAAMhC,IAAI,KAAK;IAC5B,IAAI;YAGUgC,cAEGA,eACAA,gBAmBuCA;QAxBtD,MAAMtF,YAAY9D,cAAc6D,GAAG,GAAGC,SAAS;QAC/C,MAAM0B,QAAQgG,UACV,CAAC,KAAK,GAAEpC,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe,GAAG,eAAe,CAAC,GAC1CqC,OACE,CAAC,MAAM,GAAErC,gBAAAA,MAAMlI,MAAM,YAAZkI,gBAAgB,GAAG,MAAM,CAAC,GACnC,CAAC,MAAM,GAAEA,iBAAAA,MAAMlI,MAAM,YAAZkI,iBAAgB,GAAG,MAAM,CAAC;QACzC,MAAM1F,WAAW7C,qBAAqB2E,OAAOrC;QAC7C,MAAMqD,YAAY5F,sBAAsB8C;QACxC,MAAM8F,MAAM1F,UAAUC,UAAU,CAAC9E,yBAAyB+E,GAAG,CAACN;QAC9D,MAAM+F,QAAQ,CAAC,AAAC,CAAA,MAAMD,IAAIvF,GAAG,EAAC,EAAGyF,MAAM;QACvC,MAAMF,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB,KAAK,CAAC,QAAQ,EAAE5D,OAAO,CAAC,CAAC;YACzB8E,kBAAkB9E;YAClBjC,QAAQkI,MAAMlI,MAAM;YACpB2E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP2B,UACI,CAAC,kBAAkB,EAAErI,OAAO,gCAAgC,CAAC,GAC7DsI,OACE,CAAC,4BAA4B,EAAEtI,OAAO,EAAE,GAAEiG,eAAAA,MAAMsC,KAAK,YAAXtC,eAAe,kBAAkB,EAAE,CAAC,GAC9E,CAAC,kCAAkC,EAAEjG,OAAO,CAAC,CAAC;gBACpD,GAAGA,OAAO,WAAW,EAAE+D,MAAM,iBAAiB,EAAEA,MAAM,UAAU,CAAC;gBACjEsE,UACI,oFACA,sFACAC,OACE,kFACA,uDACA,yEACA;aACP,CAAChK,IAAI,CAAC;YACPqI,eAAe;YACfC,cAAc;YACdC,MAAM;YACNE,aAAanK,WAAWoK,SAAS,CAAC;YAClCC,WAAWrK,WAAWsK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWpG,WAAWsK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAId,SAASgC,MAAM;gBAMRrC;YALT,MAAMuC,oBAAoB;gBACxBzK,QAAQkI,MAAMlI,MAAM;gBACpB2E,OAAOuD,MAAMvD,KAAK;gBAClB1C;gBACA+D;gBACAwE,KAAK,GAAEtC,gBAAAA,MAAMsC,KAAK,YAAXtC,gBAAe;gBACtB5C;gBACA9C;YACF;QACF,OAAO,IAAI+F,OAAO;YAChB,uEAAuE;YACvE,sEAAsE;YACtE,MAAMvJ,gBAAgB;gBACpBkH,MAAM;gBACNvB,OAAOuD,MAAMvD,KAAK;gBAClB3E,QAAQkI,MAAMlI,MAAM;gBACpBwC;gBACA8C;gBACAwB,MAAM;oBACJd,OAAOsE,UAAU,CAAC,mBAAmB,EAAErI,QAAQ,GAAG,CAAC,kBAAkB,EAAEA,QAAQ;oBAC/E,mDAAmD;oBACnDkE,MAAMmE,UAAU,wBAAwBpC,MAAMlI,MAAM,GAAG,CAAC,CAAC,EAAEkI,MAAMlI,MAAM,CAAC,aAAa,CAAC,GAAG;gBAC3F;gBACAsJ,eACE,GAAGgB,UAAU,mBAAmB,gBAAgB,CAAC,EAAErI,OAAO,YAAY,EAAE+D,MAAM,CAAC,CAAC;YACpF;QACF;QACA,OAAO;IACT,EAAE,OAAOvE,OAAO;QACdC,QAAQD,KAAK,CAAC,yDAAyDA;QACvE,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,eAAegJ,oBAAoBvC,KAQzC;QAGUA,cAEGA;IAJZ,MAAMlJ,gBAAgB;QACpBkH,MAAM;QACNvB,KAAK,GAAEuD,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe;QACtBlI,QAAQkI,MAAMlI,MAAM;QACpBwC,QAAQ,GAAE0F,kBAAAA,MAAM1F,QAAQ,YAAd0F,kBAAkB;QAC5B5C,WAAW4C,MAAM5C,SAAS;QAC1BwB,MAAM;YACJd,OAAO,GAAGkC,MAAMsC,KAAK,CAAC,aAAa,EAAEtC,MAAMjG,MAAM,EAAE;YACnDkE,MAAM+B,MAAMlI,MAAM,GAAG,CAAC,CAAC,EAAEkI,MAAMlI,MAAM,CAAC,SAAS,CAAC,GAAG;QACrD;QACAsJ,eACE,CAAC,kBAAkB,EAAEpB,MAAMsC,KAAK,CAAC,IAAI,EAAEtC,MAAMjG,MAAM,CAAC,mBAAmB,EAAEiG,MAAMlC,KAAK,CAAC,EAAE,CAAC,GACxF;IACJ,GAAG7C,KAAK,CAAC,IAAMsB;AACjB;AAEA,iEAAiE,GACjE,OAAO,SAASiG,0BAA0BxC,KAIzC;IACC,OAAOiC,oBAAoB;QAAEjE,MAAM;OAAWgC;AAChD"}