@aglyn/tenant-data-admin 1.0.0-beta.220 → 1.0.0-beta.221

package/src/lib/server/page-security-hold.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/page-security-hold.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE AUTOMATIC SECURITY HOLD (AGL-3450).\n *\n * The page screen (`hosted-page-review.ts`) holds a phishing page: the\n * version is not served and an urgent `phishing` row lands in the abuse\n * queue. When the workspace is in its first fortnight\n * ({@link isYoungWorkspaceAge}), a hold is also the moment to stop the\n * ACCOUNT: the two document-share harvesters found on 2026-10-01 were each\n * one page in a days-old workspace, and nothing stopped the same account\n * publishing the next one. So a held page from a young workspace places a\n * `security` lock on the workspace, on the site (`takedown`, so it stays down\n * through an outage) and on the account that published it.\n *\n * `security`, never `abuse`: `abuse` is a permanent ban, and a screen is not\n * a person. The hold is reversible and precautionary; staff confirm it and\n * re-place it as `abuse` by hand, or lift it on Staff → Lockdown, so a false\n * positive costs a support email rather than an account.\n *\n * ## Split by where each half can run\n *\n * The review runs wherever a page is composed — the published-site runtime\n * on every render, and the console's link re-check. The lock does not: it is\n * the staff lockdown path (`apps/console/utils/server/org-lockdown.ts` and\n * its neighbours), which revokes sessions, evicts the tenant cache, emails\n * the owners and writes the audit trail, and which only the console holds.\n * So this module is the DURABLE half: a `securityHolds/{orgId}` document,\n * created once, that says \"this workspace is to be held, and why\". The\n * console applies every pending one on its fifteen-minute tick and at the\n * end of any console sweep that held a page.\n *\n * ## Idempotent by construction\n *\n * One document per WORKSPACE, created in a transaction only when absent. A\n * second held page from the same workspace finds it and does nothing: no\n * second lock, notice or alert. Once staff have looked at a workspace and\n * lifted its hold, its next held page is held and queued for them as usual,\n * and is not locked again automatically — staff are the ones who know it now.\n *\n * ## Never the house\n *\n * A workspace that owns the platform's own marketing site\n * (`PLATFORM_MARKETING_HOST_ID`) is never held here; the console re-checks\n * that and refuses a workspace owned by a staff account before it locks\n * anything.\n *=========================================*/\n\nimport {\n  describePhishingScreenSignals,\n  isYoungWorkspaceAge,\n  type PhishingScreenSignal,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport firebaseAdmin from './firebase-admin'\nimport { platformMarketingHostId } from './platform-marketing-consent'\n\n/** Where a workspace's automatic hold is recorded: one document per workspace. */\nexport const SECURITY_HOLD_COLLECTION = 'securityHolds'\n\n/** The actor every automatic hold's audit rows name. */\nexport const SECURITY_HOLD_ACTOR_UID = 'system:page-screen'\n\n/** How long one console run may hold a claim before another may take it over. */\nexport const SECURITY_HOLD_CLAIM_LEASE_MS = 10 * 60_000\n\n/** The lock reason a hold places. Never `abuse`: see the module header. */\nexport const SECURITY_HOLD_LOCK_REASON = 'security'\n\n/**\n * - `pending` — requested; the console has not applied it yet.\n * - `applying` — a console run claimed it.\n * - `applied` — the locks were placed (see `outcome` for each).\n * - `skipped` — nothing was locked, and `outcome.skipped` says why: the house,\n *   a staff-owned workspace, a workspace already gone.\n */\nexport type SecurityHoldState = 'pending' | 'applying' | 'applied' | 'skipped'\n\n/** What a held page asks the console to hold. */\nexport interface SecurityHoldRequest {\n  orgId: string\n  hostId: string\n  screenId: string\n  versionId: string\n  /** The abuse row the page hold filed, and its `HS-…` reference. */\n  reviewId: string\n  reference: string\n  signals: readonly PhishingScreenSignal[]\n  ageDays: number | null\n  /** The page, in the words the review row names it. */\n  pageLabel: string\n  pageUrl: string | null\n  siteName: string | null\n}\n\n/** The stored document. */\nexport interface SecurityHoldRecord extends SecurityHoldRequest {\n  state: SecurityHoldState\n  /** The signals, in the words staff read on the abuse row. */\n  evidence: string\n  requestedAtMs: number\n  claimedAtMs?: number | null\n  settledAtMs?: number | null\n  /** What the console did, step by step. */\n  outcome?: Record<string, unknown> | null\n}\n\nexport type SecurityHoldRequestOutcome =\n  | 'requested'\n  | 'exists'\n  | 'not-young'\n  | 'no-workspace'\n  | 'house'\n  | 'failed'\n\n/**\n * Does this workspace own the platform's own marketing site? Read from the\n * org document the caller already holds, so asking costs nothing. `false` on\n * an install that names no marketing host.\n */\nexport function isHouseWorkspace(input: {\n  hostId?: string | null\n  org?: Record<string, unknown> | null\n}): boolean {\n  const house = platformMarketingHostId()\n  if (!house) return false\n  if (input.hostId === house) return true\n  const hosts = input.org?.['hosts']\n  return Boolean(hosts && typeof hosts === 'object' && house in (hosts as Record<string, unknown>))\n}\n\n/** Workspaces this process already asked about, so a busy held page asks once. */\nconst requestedMemo = new Set<string>()\n\n/** Test seam: forget what this process asked. */\nexport function resetPageSecurityHoldMemoForTests(): void {\n  requestedMemo.clear()\n}\n\nfunction holdsCollection(firestore?: FirebaseFirestore.Firestore) {\n  return (firestore ?? firebaseAdmin.app().firestore()).collection(SECURITY_HOLD_COLLECTION)\n}\n\n/**\n * Ask for a held page's workspace to be held. Creates the workspace's hold\n * document when there is none; answers `exists` when there is. A workspace\n * that is not young, has no id or is the house is never held.\n *\n * Never throws: the page hold it rides on has already happened.\n */\nexport async function requestPageSecurityHold(\n  request: SecurityHoldRequest & {\n    org?: Record<string, unknown> | null\n    nowMs?: number\n  },\n): Promise<SecurityHoldRequestOutcome> {\n  if (!isYoungWorkspaceAge(request.ageDays)) return 'not-young'\n  if (!request.orgId) return 'no-workspace'\n  if (isHouseWorkspace({ hostId: request.hostId, org: request.org })) return 'house'\n  if (requestedMemo.has(request.orgId)) return 'exists'\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const ref = holdsCollection(firestore).doc(request.orgId)\n    const record: SecurityHoldRecord = {\n      orgId: request.orgId,\n      hostId: request.hostId,\n      screenId: request.screenId,\n      versionId: request.versionId,\n      reviewId: request.reviewId,\n      reference: request.reference,\n      signals: [...request.signals],\n      ageDays: request.ageDays,\n      pageLabel: String(request.pageLabel ?? '').slice(0, 300),\n      pageUrl: request.pageUrl ? String(request.pageUrl).slice(0, 500) : null,\n      siteName: request.siteName ? String(request.siteName).slice(0, 200) : null,\n      evidence: describePhishingScreenSignals(request.signals).join(' ').slice(0, 2000),\n      state: 'pending',\n      requestedAtMs: request.nowMs ?? Date.now(),\n      claimedAtMs: null,\n      settledAtMs: null,\n      outcome: null,\n    }\n    const created = await firestore.runTransaction(async (transaction) => {\n      const existing = await transaction.get(ref)\n      if (existing.exists) return false\n      transaction.set(ref, record)\n      return true\n    })\n    requestedMemo.add(request.orgId)\n    return created ? 'requested' : 'exists'\n  } catch (error) {\n    console.error('[security-hold] the hold could not be requested', request.orgId, error)\n    return 'failed'\n  }\n}\n\n/** The pending holds, oldest first by nothing more than the store's order. */\nexport async function listPendingSecurityHolds(\n  firestore: FirebaseFirestore.Firestore,\n  limit = 20,\n): Promise<SecurityHoldRecord[]> {\n  const snapshot = await holdsCollection(firestore)\n    .where('state', 'in', ['pending', 'applying'])\n    .limit(limit)\n    .get()\n  return snapshot.docs.map((doc) => doc.data() as SecurityHoldRecord)\n}\n\n/**\n * Claim one hold for this run. A hold another run claimed inside the lease\n * is left to it; one whose claim lapsed (that run died) is taken over.\n * Answers the claimed record, or null.\n */\nexport async function claimSecurityHold(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  nowMs: number = Date.now(),\n): Promise<SecurityHoldRecord | null> {\n  const ref = holdsCollection(firestore).doc(orgId)\n  return firestore.runTransaction(async (transaction) => {\n    const snapshot = await transaction.get(ref)\n    if (!snapshot.exists) return null\n    const record = snapshot.data() as SecurityHoldRecord\n    const claimLive =\n      record.state === 'applying' &&\n      typeof record.claimedAtMs === 'number' &&\n      nowMs - record.claimedAtMs < SECURITY_HOLD_CLAIM_LEASE_MS\n    if (record.state !== 'pending' && !(record.state === 'applying' && !claimLive)) return null\n    transaction.set(ref, { state: 'applying', claimedAtMs: nowMs }, { merge: true })\n    return { ...record, state: 'applying', claimedAtMs: nowMs }\n  })\n}\n\n/** Record what the console did with a claimed hold. */\nexport async function settleSecurityHold(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  state: 'applied' | 'skipped',\n  outcome: Record<string, unknown>,\n  nowMs: number = Date.now(),\n): Promise<void> {\n  await holdsCollection(firestore)\n    .doc(orgId)\n    .set({ state, outcome, settledAtMs: nowMs }, { merge: true })\n}\n"],"names":["describePhishingScreenSignals","isYoungWorkspaceAge","firebaseAdmin","platformMarketingHostId","SECURITY_HOLD_COLLECTION","SECURITY_HOLD_ACTOR_UID","SECURITY_HOLD_CLAIM_LEASE_MS","SECURITY_HOLD_LOCK_REASON","isHouseWorkspace","input","house","hostId","hosts","org","Boolean","requestedMemo","Set","resetPageSecurityHoldMemoForTests","clear","holdsCollection","firestore","app","collection","requestPageSecurityHold","request","ageDays","orgId","has","ref","doc","record","screenId","versionId","reviewId","reference","signals","pageLabel","String","slice","pageUrl","siteName","evidence","join","state","requestedAtMs","nowMs","Date","now","claimedAtMs","settledAtMs","outcome","created","runTransaction","transaction","existing","get","exists","set","add","error","console","listPendingSecurityHolds","limit","snapshot","where","docs","map","data","claimSecurityHold","claimLive","merge","settleSecurityHold"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA4C2C,GAE3C,SACEA,6BAA6B,EAC7BC,mBAAmB,QAEd,oDAAmD;AAC1D,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,uBAAuB,QAAQ,kCAA8B;AAEtE,gFAAgF,GAChF,OAAO,MAAMC,2BAA2B,gBAAe;AAEvD,sDAAsD,GACtD,OAAO,MAAMC,0BAA0B,qBAAoB;AAE3D,+EAA+E,GAC/E,OAAO,MAAMC,+BAA+B,KAAK,MAAM;AAEvD,yEAAyE,GACzE,OAAO,MAAMC,4BAA4B,WAAU;AAgDnD;;;;CAIC,GACD,OAAO,SAASC,iBAAiBC,KAGhC;QAIeA;IAHd,MAAMC,QAAQP;IACd,IAAI,CAACO,OAAO,OAAO;IACnB,IAAID,MAAME,MAAM,KAAKD,OAAO,OAAO;IACnC,MAAME,SAAQH,aAAAA,MAAMI,GAAG,qBAATJ,UAAW,CAAC,QAAQ;IAClC,OAAOK,QAAQF,SAAS,OAAOA,UAAU,YAAYF,SAAUE;AACjE;AAEA,gFAAgF,GAChF,MAAMG,gBAAgB,IAAIC;AAE1B,+CAA+C,GAC/C,OAAO,SAASC;IACdF,cAAcG,KAAK;AACrB;AAEA,SAASC,gBAAgBC,SAAuC;IAC9D,OAAO,CAACA,oBAAAA,YAAalB,cAAcmB,GAAG,GAAGD,SAAS,IAAIE,UAAU,CAAClB;AACnE;AAEA;;;;;;CAMC,GACD,OAAO,eAAemB,wBACpBC,OAGC;IAED,IAAI,CAACvB,oBAAoBuB,QAAQC,OAAO,GAAG,OAAO;IAClD,IAAI,CAACD,QAAQE,KAAK,EAAE,OAAO;IAC3B,IAAIlB,iBAAiB;QAAEG,QAAQa,QAAQb,MAAM;QAAEE,KAAKW,QAAQX,GAAG;IAAC,IAAI,OAAO;IAC3E,IAAIE,cAAcY,GAAG,CAACH,QAAQE,KAAK,GAAG,OAAO;IAC7C,IAAI;YAYkBF,oBAKHA;QAhBjB,MAAMJ,YAAYlB,cAAcmB,GAAG,GAAGD,SAAS;QAC/C,MAAMQ,MAAMT,gBAAgBC,WAAWS,GAAG,CAACL,QAAQE,KAAK;QACxD,MAAMI,SAA6B;YACjCJ,OAAOF,QAAQE,KAAK;YACpBf,QAAQa,QAAQb,MAAM;YACtBoB,UAAUP,QAAQO,QAAQ;YAC1BC,WAAWR,QAAQQ,SAAS;YAC5BC,UAAUT,QAAQS,QAAQ;YAC1BC,WAAWV,QAAQU,SAAS;YAC5BC,SAAS;mBAAIX,QAAQW,OAAO;aAAC;YAC7BV,SAASD,QAAQC,OAAO;YACxBW,WAAWC,QAAOb,qBAAAA,QAAQY,SAAS,YAAjBZ,qBAAqB,IAAIc,KAAK,CAAC,GAAG;YACpDC,SAASf,QAAQe,OAAO,GAAGF,OAAOb,QAAQe,OAAO,EAAED,KAAK,CAAC,GAAG,OAAO;YACnEE,UAAUhB,QAAQgB,QAAQ,GAAGH,OAAOb,QAAQgB,QAAQ,EAAEF,KAAK,CAAC,GAAG,OAAO;YACtEG,UAAUzC,8BAA8BwB,QAAQW,OAAO,EAAEO,IAAI,CAAC,KAAKJ,KAAK,CAAC,GAAG;YAC5EK,OAAO;YACPC,aAAa,GAAEpB,iBAAAA,QAAQqB,KAAK,YAAbrB,iBAAiBsB,KAAKC,GAAG;YACxCC,aAAa;YACbC,aAAa;YACbC,SAAS;QACX;QACA,MAAMC,UAAU,MAAM/B,UAAUgC,cAAc,CAAC,OAAOC;YACpD,MAAMC,WAAW,MAAMD,YAAYE,GAAG,CAAC3B;YACvC,IAAI0B,SAASE,MAAM,EAAE,OAAO;YAC5BH,YAAYI,GAAG,CAAC7B,KAAKE;YACrB,OAAO;QACT;QACAf,cAAc2C,GAAG,CAAClC,QAAQE,KAAK;QAC/B,OAAOyB,UAAU,cAAc;IACjC,EAAE,OAAOQ,OAAO;QACdC,QAAQD,KAAK,CAAC,mDAAmDnC,QAAQE,KAAK,EAAEiC;QAChF,OAAO;IACT;AACF;AAEA,4EAA4E,GAC5E,OAAO,eAAeE,yBACpBzC,SAAsC,EACtC0C,QAAQ,EAAE;IAEV,MAAMC,WAAW,MAAM5C,gBAAgBC,WACpC4C,KAAK,CAAC,SAAS,MAAM;QAAC;QAAW;KAAW,EAC5CF,KAAK,CAACA,OACNP,GAAG;IACN,OAAOQ,SAASE,IAAI,CAACC,GAAG,CAAC,CAACrC,MAAQA,IAAIsC,IAAI;AAC5C;AAEA;;;;CAIC,GACD,OAAO,eAAeC,kBACpBhD,SAAsC,EACtCM,KAAa,EACbmB,QAAgBC,KAAKC,GAAG,EAAE;IAE1B,MAAMnB,MAAMT,gBAAgBC,WAAWS,GAAG,CAACH;IAC3C,OAAON,UAAUgC,cAAc,CAAC,OAAOC;QACrC,MAAMU,WAAW,MAAMV,YAAYE,GAAG,CAAC3B;QACvC,IAAI,CAACmC,SAASP,MAAM,EAAE,OAAO;QAC7B,MAAM1B,SAASiC,SAASI,IAAI;QAC5B,MAAME,YACJvC,OAAOa,KAAK,KAAK,cACjB,OAAOb,OAAOkB,WAAW,KAAK,YAC9BH,QAAQf,OAAOkB,WAAW,GAAG1C;QAC/B,IAAIwB,OAAOa,KAAK,KAAK,aAAa,CAAEb,CAAAA,OAAOa,KAAK,KAAK,cAAc,CAAC0B,SAAQ,GAAI,OAAO;QACvFhB,YAAYI,GAAG,CAAC7B,KAAK;YAAEe,OAAO;YAAYK,aAAaH;QAAM,GAAG;YAAEyB,OAAO;QAAK;QAC9E,OAAO,aAAKxC;YAAQa,OAAO;YAAYK,aAAaH;;IACtD;AACF;AAEA,qDAAqD,GACrD,OAAO,eAAe0B,mBACpBnD,SAAsC,EACtCM,KAAa,EACbiB,KAA4B,EAC5BO,OAAgC,EAChCL,QAAgBC,KAAKC,GAAG,EAAE;IAE1B,MAAM5B,gBAAgBC,WACnBS,GAAG,CAACH,OACJ+B,GAAG,CAAC;QAAEd;QAAOO;QAASD,aAAaJ;IAAM,GAAG;QAAEyB,OAAO;IAAK;AAC/D"}

package/src/lib/server/web-risk.d.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type LinkReputationAnswer, type LinkThreatType } from '@aglyn/shared-util-email/link-reputation';
+export declare const WEB_RISK_SEARCH_ENDPOINT = "https://webrisk.googleapis.com/v1/uris:search";
+export declare const WEB_RISK_CACHE_COLLECTION = "webRiskVerdicts";
+/** The kill switch: `{ enabled: false }` turns every lookup off. */
+export declare const WEB_RISK_SETTINGS_COLLECTION = "platformSettings";
+export declare const WEB_RISK_SETTINGS_DOC = "webRisk";
+/** One call's budget. */
+export declare const WEB_RISK_TIMEOUT_MS = 1000;
+/** One lookup's budget, however many hosts it asks about. */
+export declare const WEB_RISK_DEADLINE_MS = 1200;
+/** How long a clean answer is kept in the store. */
+export declare const WEB_RISK_CLEAN_TTL_MS: number;
+/** How long a clean answer is trusted from this process's memory. */
+export declare const WEB_RISK_MEMORY_CLEAN_TTL_MS: number;
+/** A listing whose answer named no `expireTime` is kept this long. */
+export declare const WEB_RISK_LISTED_FALLBACK_TTL_MS: number;
+/** What `uris.search` answered for one URI. */
+export interface WebRiskSearchResult {
+    /** The lists it is on; empty when it is on none. */
+    threats: LinkThreatType[];
+    /** Until when the answer may be kept, when the API said. */
+    expireTimeMs: number | null;
+}
+/** The contract: one URI, its listing. Throws on anything but an answer. */
+export interface WebRiskClient {
+    searchUri(uri: string): Promise<WebRiskSearchResult>;
+}
+/** The API answered with a status that is not an answer. */
+export declare class WebRiskHttpError extends Error {
+    readonly status: number;
+    constructor(status: number, detail: string);
+}
+/** There is no credential to call with. */
+export declare class WebRiskUnavailableError extends Error {
+    constructor(reason: string);
+}
+/** `uris.search`'s body, read defensively: an empty object is "not listed". */
+export declare function parseWebRiskSearch(body: unknown): WebRiskSearchResult;
+/** The URI a host is looked up as. Only the host: never a path or a query. */
+export declare function webRiskUriForHost(host: string): string;
+/** The default client: `uris.search` over HTTPS with a bearer token. */
+export declare function createWebRiskHttpClient(options: {
+    accessToken: () => Promise<string | null>;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    endpoint?: string;
+}): WebRiskClient;
+/** Test seam: forget the caches, the switch, the back-off; optionally stand in a client. */
+export declare function resetWebRiskForTests(client?: WebRiskClient | null): void;
+/**
+ * Hosts that are the platform's own: every site's subdomain on the tenant
+ * apex. Never looked up — a neighbour's site is screened on its own page.
+ */
+export declare function platformReputationExclusions(): string[];
+export interface HostReputationLookupOptions {
+    /** How long the caller will wait, overall. */
+    deadlineMs?: number;
+    /** The most hosts asked about; the rest read unknown. */
+    maxHosts?: number;
+    nowMs?: number;
+}
+/** What a lookup answered, and how many hosts it had to ask the API about. */
+export interface HostReputationLookupResult extends LinkReputationAnswer {
+    looked: number;
+}
+/**
+ * The reputation of each host: listed, clean, or unknown. Platform hosts are
+ * clean without asking. Never throws, and never waits longer than the
+ * deadline: a call still running then finishes in the background and fills
+ * the caches for the next asker.
+ *
+ * "Never throws" covers the store as well as the API: a missing app, a
+ * settings read that fails before it is a promise, or a cache reference
+ * that cannot be built all read every host as unknown. The page review
+ * calls this before its own fail-closed `try`, so a throw here would take
+ * down every page with a link off the site.
+ */
+export declare function lookupHostReputation(hosts: readonly string[], options?: HostReputationLookupOptions): Promise<HostReputationLookupResult>;
+/**
+ * Puts this lookup behind the shared screen's reputation seam, so the send
+ * seam (`screenTenantMessage`) asks it. Called by
+ * `installOutboundScreenGate`, at that module's load.
+ */
+export declare function installLinkReputationLookup(): void;

package/src/lib/server/web-risk.js

@@ -0,0 +1,383 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * GOOGLE WEB RISK (AGL-3451): the lookup behind the link reputation screen.
+ *
+ * `@aglyn/shared-util-email/link-reputation` decides which hosts are foreign
+ * and turns a listing into a strong `web-risk-link` signal. This is the store
+ * half: the `uris.search` client, the cache, the kill switch.
+ *
+ * ## The client
+ *
+ * {@link WebRiskClient} is the contract: one URI in, the threat types it is
+ * listed for and how long that answer may be kept. The default
+ * implementation calls `webrisk.googleapis.com/v1/uris:search` for
+ * SOCIAL_ENGINEERING, MALWARE and UNWANTED_SOFTWARE as the platform's own
+ * service account — the firebase-admin credential every other server-side
+ * Google call here already uses (`client-error-report.ts`), so there is no
+ * key of its own. Only `https://<host>/` is ever sent: see the module header
+ * of `link-reputation.ts`.
+ *
+ * ## Not evidence when it fails
+ *
+ * A call is given {@link WEB_RISK_TIMEOUT_MS}, and a whole lookup
+ * {@link WEB_RISK_DEADLINE_MS}. A host whose answer did not arrive, or whose
+ * call failed, is UNKNOWN: it holds nothing and logs a warning. A credential
+ * the API refuses (the API is not enabled on a self-hosted project, say) backs
+ * the lookup off for a quarter of an hour, so a misconfiguration is one log
+ * line rather than one per page.
+ *
+ * ## The cache
+ *
+ * Per host, in two layers:
+ *
+ * - this process's memory — a listed host until the answer's `expireTime`,
+ *   which Web Risk sets and which may not be exceeded; a clean one for
+ *   {@link WEB_RISK_MEMORY_CLEAN_TTL_MS}, short so a listing the daily
+ *   re-check writes reaches every warm render within minutes;
+ * - `webRiskVerdicts/{host}` — server-only, one document per host, a clean
+ *   answer kept {@link WEB_RISK_CLEAN_TTL_MS}. Bounded by the number of
+ *   distinct foreign hosts and rewritten in place, so it needs no TTL policy.
+ *
+ * Read in one `getAll` per lookup, so a page's twenty hosts cost one round
+ * trip, and nothing at all once they are in memory.
+ *
+ * ## The kill switch
+ *
+ * `platformSettings/webRisk` `{ enabled: false }` stops every lookup within a
+ * minute — every host reads unknown, so nothing holds on it — without a
+ * deploy. Absent or anything else means on.
+ *=========================================*/ import { TENANT_APEX } from "@aglyn/aglyn/app-utils/tenant-apex";
+import { LINK_THREAT_TYPES, MAX_REPUTATION_HOSTS_PER_LOOKUP, normalizeReputationHost, setLinkReputationLookup } from "@aglyn/shared-util-email/link-reputation";
+import { getApp } from "firebase-admin/app";
+import firebaseAdmin from "./firebase-admin.js";
+export const WEB_RISK_SEARCH_ENDPOINT = 'https://webrisk.googleapis.com/v1/uris:search';
+export const WEB_RISK_CACHE_COLLECTION = 'webRiskVerdicts';
+/** The kill switch: `{ enabled: false }` turns every lookup off. */ export const WEB_RISK_SETTINGS_COLLECTION = 'platformSettings';
+export const WEB_RISK_SETTINGS_DOC = 'webRisk';
+/** One call's budget. */ export const WEB_RISK_TIMEOUT_MS = 1000;
+/** One lookup's budget, however many hosts it asks about. */ export const WEB_RISK_DEADLINE_MS = 1200;
+/** How long a clean answer is kept in the store. */ export const WEB_RISK_CLEAN_TTL_MS = 12 * 60 * 60000;
+/** How long a clean answer is trusted from this process's memory. */ export const WEB_RISK_MEMORY_CLEAN_TTL_MS = 10 * 60000;
+/** A listing whose answer named no `expireTime` is kept this long. */ export const WEB_RISK_LISTED_FALLBACK_TTL_MS = 5 * 60000;
+/** How long the switch's answer is trusted. */ const SWITCH_TTL_MS = 60000;
+/** How long a refused credential stops the lookup. */ const REFUSED_BACKOFF_MS = 15 * 60000;
+/** How long a rate limit stops the lookup. */ const THROTTLED_BACKOFF_MS = 60000;
+/** At most one warning per this long, so an outage is not a log flood. */ const WARN_EVERY_MS = 60000;
+/** The API answered with a status that is not an answer. */ export class WebRiskHttpError extends Error {
+    constructor(status, detail){
+        super(`Web Risk answered ${status}: ${detail.slice(0, 200)}`), this.status = status;
+        this.name = 'WebRiskHttpError';
+    }
+}
+/** There is no credential to call with. */ export class WebRiskUnavailableError extends Error {
+    constructor(reason){
+        super(reason);
+        this.name = 'WebRiskUnavailableError';
+    }
+}
+/** `uris.search`'s body, read defensively: an empty object is "not listed". */ export function parseWebRiskSearch(body) {
+    const threat = body == null ? void 0 : body.threat;
+    if (!threat || typeof threat !== 'object') return {
+        threats: [],
+        expireTimeMs: null
+    };
+    const listed = Array.isArray(threat.threatTypes) ? threat.threatTypes : [];
+    const threats = LINK_THREAT_TYPES.filter((type)=>listed.includes(type));
+    const expireTimeMs = typeof threat.expireTime === 'string' ? Date.parse(threat.expireTime) : Number.NaN;
+    return {
+        threats,
+        expireTimeMs: Number.isFinite(expireTimeMs) ? expireTimeMs : null
+    };
+}
+/** The URI a host is looked up as. Only the host: never a path or a query. */ export function webRiskUriForHost(host) {
+    return `https://${host}/`;
+}
+/** The default client: `uris.search` over HTTPS with a bearer token. */ export function createWebRiskHttpClient(options) {
+    var _options_fetch, _options_timeoutMs;
+    const request = (_options_fetch = options.fetch) != null ? _options_fetch : fetch;
+    const timeoutMs = (_options_timeoutMs = options.timeoutMs) != null ? _options_timeoutMs : WEB_RISK_TIMEOUT_MS;
+    return {
+        async searchUri (uri) {
+            var _options_endpoint;
+            const token = await options.accessToken();
+            if (!token) throw new WebRiskUnavailableError('no service-account credential');
+            const url = new URL((_options_endpoint = options.endpoint) != null ? _options_endpoint : WEB_RISK_SEARCH_ENDPOINT);
+            for (const type of LINK_THREAT_TYPES)url.searchParams.append('threatTypes', type);
+            url.searchParams.set('uri', uri);
+            const controller = new AbortController();
+            const timer = setTimeout(()=>controller.abort(), timeoutMs);
+            try {
+                const response = await request(url.toString(), {
+                    method: 'GET',
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                        Accept: 'application/json'
+                    },
+                    signal: controller.signal
+                });
+                if (!response.ok) {
+                    throw new WebRiskHttpError(response.status, await response.text().catch(()=>''));
+                }
+                return parseWebRiskSearch(await response.json());
+            } finally{
+                clearTimeout(timer);
+            }
+        }
+    };
+}
+/**
+ * The platform service account's access token, or null when this deployment
+ * has none — the same credential `client-error-report.ts` writes logs with.
+ */ async function serviceAccountAccessToken() {
+    try {
+        var _ref;
+        var _this;
+        const credential = getApp().options.credential;
+        if (!credential) return null;
+        return (_ref = (_this = await credential.getAccessToken()) == null ? void 0 : _this.access_token) != null ? _ref : null;
+    } catch (unused) {
+        return null;
+    }
+}
+let defaultClient = null;
+let clientOverride;
+function activeClient() {
+    if (clientOverride !== undefined) return clientOverride;
+    defaultClient != null ? defaultClient : defaultClient = createWebRiskHttpClient({
+        accessToken: serviceAccountAccessToken
+    });
+    return defaultClient;
+}
+const memory = new Map();
+let switchMemo = null;
+let backoffUntilMs = 0;
+let lastWarnAtMs = 0;
+/** Test seam: forget the caches, the switch, the back-off; optionally stand in a client. */ export function resetWebRiskForTests(client) {
+    memory.clear();
+    switchMemo = null;
+    backoffUntilMs = 0;
+    lastWarnAtMs = 0;
+    clientOverride = client;
+    defaultClient = null;
+}
+function warn(nowMs, message, error) {
+    if (nowMs - lastWarnAtMs < WARN_EVERY_MS) return;
+    lastWarnAtMs = nowMs;
+    console.warn(`[web-risk] ${message} — the host reads unknown, which is not evidence`, error != null ? error : '');
+}
+/** Is the lookup switched off? Read at most once a minute; an unreadable switch is on. */ async function switchedOff(nowMs) {
+    if (switchMemo && nowMs - switchMemo.atMs < SWITCH_TTL_MS) return switchMemo.off;
+    const off = await firebaseAdmin.app().firestore().collection(WEB_RISK_SETTINGS_COLLECTION).doc(WEB_RISK_SETTINGS_DOC).get().then((snapshot)=>snapshot.get('enabled') === false, ()=>false);
+    switchMemo = {
+        off,
+        atMs: nowMs
+    };
+    return off;
+}
+/**
+ * Hosts that are the platform's own: every site's subdomain on the tenant
+ * apex. Never looked up — a neighbour's site is screened on its own page.
+ */ export function platformReputationExclusions() {
+    return [
+        TENANT_APEX
+    ].filter(Boolean);
+}
+function isPlatformHost(host) {
+    return platformReputationExclusions().some((domain)=>host === domain || host.endsWith(`.${domain}`));
+}
+function verdictFrom(data) {
+    if (!data) return null;
+    const threats = Array.isArray(data['threats']) ? LINK_THREAT_TYPES.filter((type)=>data['threats'].includes(type)) : [];
+    const checkedAtMs = Number(data['checkedAtMs']);
+    const expiresAtMs = Number(data['expiresAtMs']);
+    if (!Number.isFinite(checkedAtMs) || !Number.isFinite(expiresAtMs)) return null;
+    return {
+        threats,
+        checkedAtMs,
+        expiresAtMs
+    };
+}
+function remember(host, verdict, nowMs) {
+    memory.set(host, _extends({}, verdict, {
+        memoryUntilMs: verdict.threats.length ? verdict.expiresAtMs : Math.min(verdict.expiresAtMs, nowMs + WEB_RISK_MEMORY_CLEAN_TTL_MS)
+    }));
+}
+/**
+ * The reputation of each host: listed, clean, or unknown. Platform hosts are
+ * clean without asking. Never throws, and never waits longer than the
+ * deadline: a call still running then finishes in the background and fills
+ * the caches for the next asker.
+ *
+ * "Never throws" covers the store as well as the API: a missing app, a
+ * settings read that fails before it is a promise, or a cache reference
+ * that cannot be built all read every host as unknown. The page review
+ * calls this before its own fail-closed `try`, so a throw here would take
+ * down every page with a link off the site.
+ */ export async function lookupHostReputation(hosts, options = {}) {
+    try {
+        return await lookupHostReputationOrThrow(hosts, options);
+    } catch (error) {
+        var _options_nowMs;
+        warn((_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now(), 'a lookup failed before it could answer', error);
+        const unknown = [
+            ...new Set(hosts.map((raw)=>normalizeReputationHost(raw)).filter((host)=>Boolean(host)))
+        ];
+        return {
+            hits: [],
+            clean: [],
+            unknown,
+            looked: 0
+        };
+    }
+}
+async function lookupHostReputationOrThrow(hosts, options) {
+    var _options_nowMs;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const result = {
+        hits: [],
+        clean: [],
+        unknown: [],
+        looked: 0
+    };
+    const wanted = [];
+    for (const raw of hosts){
+        var _options_maxHosts;
+        const host = normalizeReputationHost(raw);
+        if (!host || wanted.includes(host) || result.clean.includes(host)) continue;
+        if (isPlatformHost(host)) result.clean.push(host);
+        else if (wanted.length < ((_options_maxHosts = options.maxHosts) != null ? _options_maxHosts : MAX_REPUTATION_HOSTS_PER_LOOKUP)) wanted.push(host);
+        else result.unknown.push(host);
+    }
+    if (!wanted.length) return result;
+    const settle = (host, verdict)=>{
+        if (verdict.threats.length) result.hits.push({
+            host,
+            threats: verdict.threats
+        });
+        else result.clean.push(host);
+    };
+    // 1. This process's memory.
+    let missing = wanted.filter((host)=>{
+        const known = memory.get(host);
+        if (known && nowMs < known.memoryUntilMs) {
+            settle(host, known);
+            return false;
+        }
+        return true;
+    });
+    if (!missing.length) return result;
+    // 2. The switch. Off reads every remaining host as unknown.
+    if (await switchedOff(nowMs)) {
+        result.unknown.push(...missing);
+        return result;
+    }
+    // 3. The store, in one round trip.
+    const firestore = firebaseAdmin.app().firestore();
+    const collection = firestore.collection(WEB_RISK_CACHE_COLLECTION);
+    try {
+        const snapshots = await firestore.getAll(...missing.map((host)=>collection.doc(host)));
+        const stored = new Map();
+        for (const snapshot of snapshots){
+            const verdict = verdictFrom(snapshot.exists ? snapshot.data() : undefined);
+            if (verdict && nowMs < verdict.expiresAtMs) stored.set(snapshot.id, verdict);
+        }
+        missing = missing.filter((host)=>{
+            const verdict = stored.get(host);
+            if (!verdict) return true;
+            remember(host, verdict, nowMs);
+            settle(host, verdict);
+            return false;
+        });
+    } catch (error) {
+        warn(nowMs, 'the verdict cache could not be read', error);
+    }
+    if (!missing.length) return result;
+    // 4. The API, every remaining host at once, within the deadline.
+    const client = activeClient();
+    if (!client || nowMs < backoffUntilMs) {
+        result.unknown.push(...missing);
+        return result;
+    }
+    result.looked = missing.length;
+    const answers = new Map();
+    const calls = missing.map(async (host)=>{
+        try {
+            var _answer_expireTimeMs;
+            const answer = await client.searchUri(webRiskUriForHost(host));
+            const checkedAtMs = Date.now();
+            const verdict = {
+                threats: answer.threats,
+                checkedAtMs,
+                expiresAtMs: answer.threats.length ? (_answer_expireTimeMs = answer.expireTimeMs) != null ? _answer_expireTimeMs : checkedAtMs + WEB_RISK_LISTED_FALLBACK_TTL_MS : checkedAtMs + WEB_RISK_CLEAN_TTL_MS
+            };
+            answers.set(host, verdict);
+            remember(host, verdict, checkedAtMs);
+            await collection.doc(host).set(_extends({
+                host
+            }, verdict, {
+                listed: verdict.threats.length > 0
+            })).catch((error)=>warn(checkedAtMs, 'a verdict could not be cached', error));
+        } catch (error) {
+            if (error instanceof WebRiskHttpError && [
+                401,
+                403,
+                404
+            ].includes(error.status)) {
+                backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS;
+                console.error('[web-risk] the API refused the credential — lookups paused for 15 minutes', error);
+            } else if (error instanceof WebRiskHttpError && error.status === 429) {
+                backoffUntilMs = Date.now() + THROTTLED_BACKOFF_MS;
+                warn(Date.now(), 'the API is rate limiting', error);
+            } else if (error instanceof WebRiskUnavailableError) {
+                backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS;
+                warn(Date.now(), 'no credential to call the API with', error);
+            } else {
+                warn(Date.now(), `the lookup of ${host} failed or timed out`, error);
+            }
+        }
+    });
+    let timer;
+    await Promise.race([
+        Promise.allSettled(calls),
+        new Promise((resolve)=>{
+            var _options_deadlineMs;
+            timer = setTimeout(resolve, (_options_deadlineMs = options.deadlineMs) != null ? _options_deadlineMs : WEB_RISK_DEADLINE_MS);
+        })
+    ]);
+    if (timer) clearTimeout(timer);
+    const late = missing.filter((host)=>!answers.has(host));
+    for (const host of missing){
+        const verdict = answers.get(host);
+        if (verdict) settle(host, verdict);
+    }
+    result.unknown.push(...late);
+    if (late.length) warn(Date.now(), `${late.length} host(s) had no answer within the deadline`);
+    return result;
+}
+/**
+ * Puts this lookup behind the shared screen's reputation seam, so the send
+ * seam (`screenTenantMessage`) asks it. Called by
+ * `installOutboundScreenGate`, at that module's load.
+ */ export function installLinkReputationLookup() {
+    if (typeof setLinkReputationLookup !== 'function') return;
+    setLinkReputationLookup((hosts, options)=>lookupHostReputation(hosts, {
+            deadlineMs: options == null ? void 0 : options.deadlineMs
+        }));
+}
+
+//# sourceMappingURL=web-risk.js.map

package/src/lib/server/web-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/web-risk.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * GOOGLE WEB RISK (AGL-3451): the lookup behind the link reputation screen.\n *\n * `@aglyn/shared-util-email/link-reputation` decides which hosts are foreign\n * and turns a listing into a strong `web-risk-link` signal. This is the store\n * half: the `uris.search` client, the cache, the kill switch.\n *\n * ## The client\n *\n * {@link WebRiskClient} is the contract: one URI in, the threat types it is\n * listed for and how long that answer may be kept. The default\n * implementation calls `webrisk.googleapis.com/v1/uris:search` for\n * SOCIAL_ENGINEERING, MALWARE and UNWANTED_SOFTWARE as the platform's own\n * service account — the firebase-admin credential every other server-side\n * Google call here already uses (`client-error-report.ts`), so there is no\n * key of its own. Only `https://<host>/` is ever sent: see the module header\n * of `link-reputation.ts`.\n *\n * ## Not evidence when it fails\n *\n * A call is given {@link WEB_RISK_TIMEOUT_MS}, and a whole lookup\n * {@link WEB_RISK_DEADLINE_MS}. A host whose answer did not arrive, or whose\n * call failed, is UNKNOWN: it holds nothing and logs a warning. A credential\n * the API refuses (the API is not enabled on a self-hosted project, say) backs\n * the lookup off for a quarter of an hour, so a misconfiguration is one log\n * line rather than one per page.\n *\n * ## The cache\n *\n * Per host, in two layers:\n *\n * - this process's memory — a listed host until the answer's `expireTime`,\n *   which Web Risk sets and which may not be exceeded; a clean one for\n *   {@link WEB_RISK_MEMORY_CLEAN_TTL_MS}, short so a listing the daily\n *   re-check writes reaches every warm render within minutes;\n * - `webRiskVerdicts/{host}` — server-only, one document per host, a clean\n *   answer kept {@link WEB_RISK_CLEAN_TTL_MS}. Bounded by the number of\n *   distinct foreign hosts and rewritten in place, so it needs no TTL policy.\n *\n * Read in one `getAll` per lookup, so a page's twenty hosts cost one round\n * trip, and nothing at all once they are in memory.\n *\n * ## The kill switch\n *\n * `platformSettings/webRisk` `{ enabled: false }` stops every lookup within a\n * minute — every host reads unknown, so nothing holds on it — without a\n * deploy. Absent or anything else means on.\n *=========================================*/\n\nimport { TENANT_APEX } from '@aglyn/aglyn/app-utils/tenant-apex'\nimport {\n  LINK_THREAT_TYPES,\n  type LinkReputationAnswer,\n  type LinkThreatType,\n  MAX_REPUTATION_HOSTS_PER_LOOKUP,\n  normalizeReputationHost,\n  setLinkReputationLookup,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { getApp } from 'firebase-admin/app'\nimport firebaseAdmin from './firebase-admin'\n\nexport const WEB_RISK_SEARCH_ENDPOINT = 'https://webrisk.googleapis.com/v1/uris:search'\nexport const WEB_RISK_CACHE_COLLECTION = 'webRiskVerdicts'\n/** The kill switch: `{ enabled: false }` turns every lookup off. */\nexport const WEB_RISK_SETTINGS_COLLECTION = 'platformSettings'\nexport const WEB_RISK_SETTINGS_DOC = 'webRisk'\n\n/** One call's budget. */\nexport const WEB_RISK_TIMEOUT_MS = 1_000\n/** One lookup's budget, however many hosts it asks about. */\nexport const WEB_RISK_DEADLINE_MS = 1_200\n/** How long a clean answer is kept in the store. */\nexport const WEB_RISK_CLEAN_TTL_MS = 12 * 60 * 60_000\n/** How long a clean answer is trusted from this process's memory. */\nexport const WEB_RISK_MEMORY_CLEAN_TTL_MS = 10 * 60_000\n/** A listing whose answer named no `expireTime` is kept this long. */\nexport const WEB_RISK_LISTED_FALLBACK_TTL_MS = 5 * 60_000\n/** How long the switch's answer is trusted. */\nconst SWITCH_TTL_MS = 60_000\n/** How long a refused credential stops the lookup. */\nconst REFUSED_BACKOFF_MS = 15 * 60_000\n/** How long a rate limit stops the lookup. */\nconst THROTTLED_BACKOFF_MS = 60_000\n/** At most one warning per this long, so an outage is not a log flood. */\nconst WARN_EVERY_MS = 60_000\n\n/** What `uris.search` answered for one URI. */\nexport interface WebRiskSearchResult {\n  /** The lists it is on; empty when it is on none. */\n  threats: LinkThreatType[]\n  /** Until when the answer may be kept, when the API said. */\n  expireTimeMs: number | null\n}\n\n/** The contract: one URI, its listing. Throws on anything but an answer. */\nexport interface WebRiskClient {\n  searchUri(uri: string): Promise<WebRiskSearchResult>\n}\n\n/** The API answered with a status that is not an answer. */\nexport class WebRiskHttpError extends Error {\n  constructor(\n    readonly status: number,\n    detail: string,\n  ) {\n    super(`Web Risk answered ${status}: ${detail.slice(0, 200)}`)\n    this.name = 'WebRiskHttpError'\n  }\n}\n\n/** There is no credential to call with. */\nexport class WebRiskUnavailableError extends Error {\n  constructor(reason: string) {\n    super(reason)\n    this.name = 'WebRiskUnavailableError'\n  }\n}\n\n/** `uris.search`'s body, read defensively: an empty object is \"not listed\". */\nexport function parseWebRiskSearch(body: unknown): WebRiskSearchResult {\n  const threat = (body as { threat?: { threatTypes?: unknown; expireTime?: unknown } } | null)\n    ?.threat\n  if (!threat || typeof threat !== 'object') return { threats: [], expireTimeMs: null }\n  const listed = Array.isArray(threat.threatTypes) ? threat.threatTypes : []\n  const threats = LINK_THREAT_TYPES.filter((type) => listed.includes(type))\n  const expireTimeMs =\n    typeof threat.expireTime === 'string' ? Date.parse(threat.expireTime) : Number.NaN\n  return { threats, expireTimeMs: Number.isFinite(expireTimeMs) ? expireTimeMs : null }\n}\n\n/** The URI a host is looked up as. Only the host: never a path or a query. */\nexport function webRiskUriForHost(host: string): string {\n  return `https://${host}/`\n}\n\n/** The default client: `uris.search` over HTTPS with a bearer token. */\nexport function createWebRiskHttpClient(options: {\n  accessToken: () => Promise<string | null>\n  fetch?: typeof fetch\n  timeoutMs?: number\n  endpoint?: string\n}): WebRiskClient {\n  const request = options.fetch ?? fetch\n  const timeoutMs = options.timeoutMs ?? WEB_RISK_TIMEOUT_MS\n  return {\n    async searchUri(uri: string): Promise<WebRiskSearchResult> {\n      const token = await options.accessToken()\n      if (!token) throw new WebRiskUnavailableError('no service-account credential')\n      const url = new URL(options.endpoint ?? WEB_RISK_SEARCH_ENDPOINT)\n      for (const type of LINK_THREAT_TYPES) url.searchParams.append('threatTypes', type)\n      url.searchParams.set('uri', uri)\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), timeoutMs)\n      try {\n        const response = await request(url.toString(), {\n          method: 'GET',\n          headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },\n          signal: controller.signal,\n        })\n        if (!response.ok) {\n          throw new WebRiskHttpError(response.status, await response.text().catch(() => ''))\n        }\n        return parseWebRiskSearch(await response.json())\n      } finally {\n        clearTimeout(timer)\n      }\n    },\n  }\n}\n\n/**\n * The platform service account's access token, or null when this deployment\n * has none — the same credential `client-error-report.ts` writes logs with.\n */\nasync function serviceAccountAccessToken(): Promise<string | null> {\n  try {\n    const credential = getApp().options.credential\n    if (!credential) return null\n    return (await credential.getAccessToken())?.access_token ?? null\n  } catch {\n    return null\n  }\n}\n\nlet defaultClient: WebRiskClient | null = null\nlet clientOverride: WebRiskClient | null | undefined\n\nfunction activeClient(): WebRiskClient | null {\n  if (clientOverride !== undefined) return clientOverride\n  defaultClient ??= createWebRiskHttpClient({ accessToken: serviceAccountAccessToken })\n  return defaultClient\n}\n\ninterface Verdict {\n  threats: LinkThreatType[]\n  checkedAtMs: number\n  /** When the answer stops being good, in the store. */\n  expiresAtMs: number\n}\n\nconst memory = new Map<string, Verdict & { memoryUntilMs: number }>()\nlet switchMemo: { off: boolean; atMs: number } | null = null\nlet backoffUntilMs = 0\nlet lastWarnAtMs = 0\n\n/** Test seam: forget the caches, the switch, the back-off; optionally stand in a client. */\nexport function resetWebRiskForTests(client?: WebRiskClient | null): void {\n  memory.clear()\n  switchMemo = null\n  backoffUntilMs = 0\n  lastWarnAtMs = 0\n  clientOverride = client\n  defaultClient = null\n}\n\nfunction warn(nowMs: number, message: string, error?: unknown): void {\n  if (nowMs - lastWarnAtMs < WARN_EVERY_MS) return\n  lastWarnAtMs = nowMs\n  console.warn(`[web-risk] ${message} — the host reads unknown, which is not evidence`, error ?? '')\n}\n\n/** Is the lookup switched off? Read at most once a minute; an unreadable switch is on. */\nasync function switchedOff(nowMs: number): Promise<boolean> {\n  if (switchMemo && nowMs - switchMemo.atMs < SWITCH_TTL_MS) return switchMemo.off\n  const off = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(WEB_RISK_SETTINGS_COLLECTION)\n    .doc(WEB_RISK_SETTINGS_DOC)\n    .get()\n    .then(\n      (snapshot) => snapshot.get('enabled') === false,\n      () => false,\n    )\n  switchMemo = { off, atMs: nowMs }\n  return off\n}\n\n/**\n * Hosts that are the platform's own: every site's subdomain on the tenant\n * apex. Never looked up — a neighbour's site is screened on its own page.\n */\nexport function platformReputationExclusions(): string[] {\n  return [TENANT_APEX].filter(Boolean)\n}\n\nfunction isPlatformHost(host: string): boolean {\n  return platformReputationExclusions().some(\n    (domain) => host === domain || host.endsWith(`.${domain}`),\n  )\n}\n\nfunction verdictFrom(data: Record<string, unknown> | undefined): Verdict | null {\n  if (!data) return null\n  const threats = Array.isArray(data['threats'])\n    ? LINK_THREAT_TYPES.filter((type) => (data['threats'] as unknown[]).includes(type))\n    : []\n  const checkedAtMs = Number(data['checkedAtMs'])\n  const expiresAtMs = Number(data['expiresAtMs'])\n  if (!Number.isFinite(checkedAtMs) || !Number.isFinite(expiresAtMs)) return null\n  return { threats, checkedAtMs, expiresAtMs }\n}\n\nfunction remember(host: string, verdict: Verdict, nowMs: number): void {\n  memory.set(host, {\n    ...verdict,\n    memoryUntilMs: verdict.threats.length\n      ? verdict.expiresAtMs\n      : Math.min(verdict.expiresAtMs, nowMs + WEB_RISK_MEMORY_CLEAN_TTL_MS),\n  })\n}\n\nexport interface HostReputationLookupOptions {\n  /** How long the caller will wait, overall. */\n  deadlineMs?: number\n  /** The most hosts asked about; the rest read unknown. */\n  maxHosts?: number\n  nowMs?: number\n}\n\n/** What a lookup answered, and how many hosts it had to ask the API about. */\nexport interface HostReputationLookupResult extends LinkReputationAnswer {\n  looked: number\n}\n\n/**\n * The reputation of each host: listed, clean, or unknown. Platform hosts are\n * clean without asking. Never throws, and never waits longer than the\n * deadline: a call still running then finishes in the background and fills\n * the caches for the next asker.\n *\n * \"Never throws\" covers the store as well as the API: a missing app, a\n * settings read that fails before it is a promise, or a cache reference\n * that cannot be built all read every host as unknown. The page review\n * calls this before its own fail-closed `try`, so a throw here would take\n * down every page with a link off the site.\n */\nexport async function lookupHostReputation(\n  hosts: readonly string[],\n  options: HostReputationLookupOptions = {},\n): Promise<HostReputationLookupResult> {\n  try {\n    return await lookupHostReputationOrThrow(hosts, options)\n  } catch (error) {\n    warn(options.nowMs ?? Date.now(), 'a lookup failed before it could answer', error)\n    const unknown = [\n      ...new Set(\n        hosts\n          .map((raw) => normalizeReputationHost(raw))\n          .filter((host): host is string => Boolean(host)),\n      ),\n    ]\n    return { hits: [], clean: [], unknown, looked: 0 }\n  }\n}\n\nasync function lookupHostReputationOrThrow(\n  hosts: readonly string[],\n  options: HostReputationLookupOptions,\n): Promise<HostReputationLookupResult> {\n  const nowMs = options.nowMs ?? Date.now()\n  const result: HostReputationLookupResult = { hits: [], clean: [], unknown: [], looked: 0 }\n  const wanted: string[] = []\n  for (const raw of hosts) {\n    const host = normalizeReputationHost(raw)\n    if (!host || wanted.includes(host) || result.clean.includes(host)) continue\n    if (isPlatformHost(host)) result.clean.push(host)\n    else if (wanted.length < (options.maxHosts ?? MAX_REPUTATION_HOSTS_PER_LOOKUP)) wanted.push(host)\n    else result.unknown.push(host)\n  }\n  if (!wanted.length) return result\n\n  const settle = (host: string, verdict: Verdict) => {\n    if (verdict.threats.length) result.hits.push({ host, threats: verdict.threats })\n    else result.clean.push(host)\n  }\n\n  // 1. This process's memory.\n  let missing = wanted.filter((host) => {\n    const known = memory.get(host)\n    if (known && nowMs < known.memoryUntilMs) {\n      settle(host, known)\n      return false\n    }\n    return true\n  })\n  if (!missing.length) return result\n\n  // 2. The switch. Off reads every remaining host as unknown.\n  if (await switchedOff(nowMs)) {\n    result.unknown.push(...missing)\n    return result\n  }\n\n  // 3. The store, in one round trip.\n  const firestore = firebaseAdmin.app().firestore()\n  const collection = firestore.collection(WEB_RISK_CACHE_COLLECTION)\n  try {\n    const snapshots = await firestore.getAll(...missing.map((host) => collection.doc(host)))\n    const stored = new Map<string, Verdict>()\n    for (const snapshot of snapshots) {\n      const verdict = verdictFrom(snapshot.exists ? (snapshot.data() as Record<string, unknown>) : undefined)\n      if (verdict && nowMs < verdict.expiresAtMs) stored.set(snapshot.id, verdict)\n    }\n    missing = missing.filter((host) => {\n      const verdict = stored.get(host)\n      if (!verdict) return true\n      remember(host, verdict, nowMs)\n      settle(host, verdict)\n      return false\n    })\n  } catch (error) {\n    warn(nowMs, 'the verdict cache could not be read', error)\n  }\n  if (!missing.length) return result\n\n  // 4. The API, every remaining host at once, within the deadline.\n  const client = activeClient()\n  if (!client || nowMs < backoffUntilMs) {\n    result.unknown.push(...missing)\n    return result\n  }\n  result.looked = missing.length\n  const answers = new Map<string, Verdict>()\n  const calls = missing.map(async (host) => {\n    try {\n      const answer = await client.searchUri(webRiskUriForHost(host))\n      const checkedAtMs = Date.now()\n      const verdict: Verdict = {\n        threats: answer.threats,\n        checkedAtMs,\n        expiresAtMs: answer.threats.length\n          ? (answer.expireTimeMs ?? checkedAtMs + WEB_RISK_LISTED_FALLBACK_TTL_MS)\n          : checkedAtMs + WEB_RISK_CLEAN_TTL_MS,\n      }\n      answers.set(host, verdict)\n      remember(host, verdict, checkedAtMs)\n      await collection\n        .doc(host)\n        .set({ host, ...verdict, listed: verdict.threats.length > 0 })\n        .catch((error: unknown) => warn(checkedAtMs, 'a verdict could not be cached', error))\n    } catch (error) {\n      if (error instanceof WebRiskHttpError && [401, 403, 404].includes(error.status)) {\n        backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS\n        console.error('[web-risk] the API refused the credential — lookups paused for 15 minutes', error)\n      } else if (error instanceof WebRiskHttpError && error.status === 429) {\n        backoffUntilMs = Date.now() + THROTTLED_BACKOFF_MS\n        warn(Date.now(), 'the API is rate limiting', error)\n      } else if (error instanceof WebRiskUnavailableError) {\n        backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS\n        warn(Date.now(), 'no credential to call the API with', error)\n      } else {\n        warn(Date.now(), `the lookup of ${host} failed or timed out`, error)\n      }\n    }\n  })\n  let timer: ReturnType<typeof setTimeout> | undefined\n  await Promise.race([\n    Promise.allSettled(calls),\n    new Promise<void>((resolve) => {\n      timer = setTimeout(resolve, options.deadlineMs ?? WEB_RISK_DEADLINE_MS)\n    }),\n  ])\n  if (timer) clearTimeout(timer)\n  const late = missing.filter((host) => !answers.has(host))\n  for (const host of missing) {\n    const verdict = answers.get(host)\n    if (verdict) settle(host, verdict)\n  }\n  result.unknown.push(...late)\n  if (late.length) warn(Date.now(), `${late.length} host(s) had no answer within the deadline`)\n  return result\n}\n\n/**\n * Puts this lookup behind the shared screen's reputation seam, so the send\n * seam (`screenTenantMessage`) asks it. Called by\n * `installOutboundScreenGate`, at that module's load.\n */\nexport function installLinkReputationLookup(): void {\n  if (typeof setLinkReputationLookup !== 'function') return\n  setLinkReputationLookup((hosts, options) =>\n    lookupHostReputation(hosts, { deadlineMs: options?.deadlineMs }),\n  )\n}\n"],"names":["TENANT_APEX","LINK_THREAT_TYPES","MAX_REPUTATION_HOSTS_PER_LOOKUP","normalizeReputationHost","setLinkReputationLookup","getApp","firebaseAdmin","WEB_RISK_SEARCH_ENDPOINT","WEB_RISK_CACHE_COLLECTION","WEB_RISK_SETTINGS_COLLECTION","WEB_RISK_SETTINGS_DOC","WEB_RISK_TIMEOUT_MS","WEB_RISK_DEADLINE_MS","WEB_RISK_CLEAN_TTL_MS","WEB_RISK_MEMORY_CLEAN_TTL_MS","WEB_RISK_LISTED_FALLBACK_TTL_MS","SWITCH_TTL_MS","REFUSED_BACKOFF_MS","THROTTLED_BACKOFF_MS","WARN_EVERY_MS","WebRiskHttpError","Error","status","detail","slice","name","WebRiskUnavailableError","reason","parseWebRiskSearch","body","threat","threats","expireTimeMs","listed","Array","isArray","threatTypes","filter","type","includes","expireTime","Date","parse","Number","NaN","isFinite","webRiskUriForHost","host","createWebRiskHttpClient","options","request","fetch","timeoutMs","searchUri","uri","token","accessToken","url","URL","endpoint","searchParams","append","set","controller","AbortController","timer","setTimeout","abort","response","toString","method","headers","Authorization","Accept","signal","ok","text","catch","json","clearTimeout","serviceAccountAccessToken","credential","getAccessToken","access_token","defaultClient","clientOverride","activeClient","undefined","memory","Map","switchMemo","backoffUntilMs","lastWarnAtMs","resetWebRiskForTests","client","clear","warn","nowMs","message","error","console","switchedOff","atMs","off","app","firestore","collection","doc","get","then","snapshot","platformReputationExclusions","Boolean","isPlatformHost","some","domain","endsWith","verdictFrom","data","checkedAtMs","expiresAtMs","remember","verdict","memoryUntilMs","length","Math","min","lookupHostReputation","hosts","lookupHostReputationOrThrow","now","unknown","Set","map","raw","hits","clean","looked","result","wanted","push","maxHosts","settle","missing","known","snapshots","getAll","stored","exists","id","answers","calls","answer","Promise","race","allSettled","resolve","deadlineMs","late","has","installLinkReputationLookup"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA+C2C,GAE3C,SAASA,WAAW,QAAQ,qCAAoC;AAChE,SACEC,iBAAiB,EAGjBC,+BAA+B,EAC/BC,uBAAuB,EACvBC,uBAAuB,QAClB,2CAA0C;AACjD,SAASC,MAAM,QAAQ,qBAAoB;AAC3C,OAAOC,mBAAmB,sBAAkB;AAE5C,OAAO,MAAMC,2BAA2B,gDAA+C;AACvF,OAAO,MAAMC,4BAA4B,kBAAiB;AAC1D,kEAAkE,GAClE,OAAO,MAAMC,+BAA+B,mBAAkB;AAC9D,OAAO,MAAMC,wBAAwB,UAAS;AAE9C,uBAAuB,GACvB,OAAO,MAAMC,sBAAsB,KAAK;AACxC,2DAA2D,GAC3D,OAAO,MAAMC,uBAAuB,KAAK;AACzC,kDAAkD,GAClD,OAAO,MAAMC,wBAAwB,KAAK,KAAK,MAAM;AACrD,mEAAmE,GACnE,OAAO,MAAMC,+BAA+B,KAAK,MAAM;AACvD,oEAAoE,GACpE,OAAO,MAAMC,kCAAkC,IAAI,MAAM;AACzD,6CAA6C,GAC7C,MAAMC,gBAAgB;AACtB,oDAAoD,GACpD,MAAMC,qBAAqB,KAAK;AAChC,4CAA4C,GAC5C,MAAMC,uBAAuB;AAC7B,wEAAwE,GACxE,MAAMC,gBAAgB;AAetB,0DAA0D,GAC1D,OAAO,MAAMC,yBAAyBC;IACpC,YACE,AAASC,MAAc,EACvBC,MAAc,CACd;QACA,KAAK,CAAC,CAAC,kBAAkB,EAAED,OAAO,EAAE,EAAEC,OAAOC,KAAK,CAAC,GAAG,MAAM,QAHnDF,SAAAA;QAIT,IAAI,CAACG,IAAI,GAAG;IACd;AACF;AAEA,yCAAyC,GACzC,OAAO,MAAMC,gCAAgCL;IAC3C,YAAYM,MAAc,CAAE;QAC1B,KAAK,CAACA;QACN,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,6EAA6E,GAC7E,OAAO,SAASG,mBAAmBC,IAAa;IAC9C,MAAMC,SAAUD,wBAAD,AAACA,KACZC,MAAM;IACV,IAAI,CAACA,UAAU,OAAOA,WAAW,UAAU,OAAO;QAAEC,SAAS,EAAE;QAAEC,cAAc;IAAK;IACpF,MAAMC,SAASC,MAAMC,OAAO,CAACL,OAAOM,WAAW,IAAIN,OAAOM,WAAW,GAAG,EAAE;IAC1E,MAAML,UAAU9B,kBAAkBoC,MAAM,CAAC,CAACC,OAASL,OAAOM,QAAQ,CAACD;IACnE,MAAMN,eACJ,OAAOF,OAAOU,UAAU,KAAK,WAAWC,KAAKC,KAAK,CAACZ,OAAOU,UAAU,IAAIG,OAAOC,GAAG;IACpF,OAAO;QAAEb;QAASC,cAAcW,OAAOE,QAAQ,CAACb,gBAAgBA,eAAe;IAAK;AACtF;AAEA,4EAA4E,GAC5E,OAAO,SAASc,kBAAkBC,IAAY;IAC5C,OAAO,CAAC,QAAQ,EAAEA,KAAK,CAAC,CAAC;AAC3B;AAEA,sEAAsE,GACtE,OAAO,SAASC,wBAAwBC,OAKvC;QACiBA,gBACEA;IADlB,MAAMC,WAAUD,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBE;IACjC,MAAMC,aAAYH,qBAAAA,QAAQG,SAAS,YAAjBH,qBAAqBtC;IACvC,OAAO;QACL,MAAM0C,WAAUC,GAAW;gBAGLL;YAFpB,MAAMM,QAAQ,MAAMN,QAAQO,WAAW;YACvC,IAAI,CAACD,OAAO,MAAM,IAAI7B,wBAAwB;YAC9C,MAAM+B,MAAM,IAAIC,KAAIT,oBAAAA,QAAQU,QAAQ,YAAhBV,oBAAoB1C;YACxC,KAAK,MAAM+B,QAAQrC,kBAAmBwD,IAAIG,YAAY,CAACC,MAAM,CAAC,eAAevB;YAC7EmB,IAAIG,YAAY,CAACE,GAAG,CAAC,OAAOR;YAC5B,MAAMS,aAAa,IAAIC;YACvB,MAAMC,QAAQC,WAAW,IAAMH,WAAWI,KAAK,IAAIf;YACnD,IAAI;gBACF,MAAMgB,WAAW,MAAMlB,QAAQO,IAAIY,QAAQ,IAAI;oBAC7CC,QAAQ;oBACRC,SAAS;wBAAEC,eAAe,CAAC,OAAO,EAAEjB,OAAO;wBAAEkB,QAAQ;oBAAmB;oBACxEC,QAAQX,WAAWW,MAAM;gBAC3B;gBACA,IAAI,CAACN,SAASO,EAAE,EAAE;oBAChB,MAAM,IAAIvD,iBAAiBgD,SAAS9C,MAAM,EAAE,MAAM8C,SAASQ,IAAI,GAAGC,KAAK,CAAC,IAAM;gBAChF;gBACA,OAAOjD,mBAAmB,MAAMwC,SAASU,IAAI;YAC/C,SAAU;gBACRC,aAAad;YACf;QACF;IACF;AACF;AAEA;;;CAGC,GACD,eAAee;IACb,IAAI;;YAGM;QAFR,MAAMC,aAAa5E,SAAS4C,OAAO,CAACgC,UAAU;QAC9C,IAAI,CAACA,YAAY,OAAO;QACxB,gBAAQ,QAAA,MAAMA,WAAWC,cAAc,uBAAhC,AAAC,MAAoCC,YAAY,mBAAI;IAC9D,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,IAAIC,gBAAsC;AAC1C,IAAIC;AAEJ,SAASC;IACP,IAAID,mBAAmBE,WAAW,OAAOF;IACzCD,wBAAAA,gBAAAA,gBAAkBpC,wBAAwB;QAAEQ,aAAawB;IAA0B;IACnF,OAAOI;AACT;AASA,MAAMI,SAAS,IAAIC;AACnB,IAAIC,aAAoD;AACxD,IAAIC,iBAAiB;AACrB,IAAIC,eAAe;AAEnB,0FAA0F,GAC1F,OAAO,SAASC,qBAAqBC,MAA6B;IAChEN,OAAOO,KAAK;IACZL,aAAa;IACbC,iBAAiB;IACjBC,eAAe;IACfP,iBAAiBS;IACjBV,gBAAgB;AAClB;AAEA,SAASY,KAAKC,KAAa,EAAEC,OAAe,EAAEC,KAAe;IAC3D,IAAIF,QAAQL,eAAezE,eAAe;IAC1CyE,eAAeK;IACfG,QAAQJ,IAAI,CAAC,CAAC,WAAW,EAAEE,QAAQ,gDAAgD,CAAC,EAAEC,gBAAAA,QAAS;AACjG;AAEA,wFAAwF,GACxF,eAAeE,YAAYJ,KAAa;IACtC,IAAIP,cAAcO,QAAQP,WAAWY,IAAI,GAAGtF,eAAe,OAAO0E,WAAWa,GAAG;IAChF,MAAMA,MAAM,MAAMjG,cACfkG,GAAG,GACHC,SAAS,GACTC,UAAU,CAACjG,8BACXkG,GAAG,CAACjG,uBACJkG,GAAG,GACHC,IAAI,CACH,CAACC,WAAaA,SAASF,GAAG,CAAC,eAAe,OAC1C,IAAM;IAEVlB,aAAa;QAAEa;QAAKD,MAAML;IAAM;IAChC,OAAOM;AACT;AAEA;;;CAGC,GACD,OAAO,SAASQ;IACd,OAAO;QAAC/G;KAAY,CAACqC,MAAM,CAAC2E;AAC9B;AAEA,SAASC,eAAelE,IAAY;IAClC,OAAOgE,+BAA+BG,IAAI,CACxC,CAACC,SAAWpE,SAASoE,UAAUpE,KAAKqE,QAAQ,CAAC,CAAC,CAAC,EAAED,QAAQ;AAE7D;AAEA,SAASE,YAAYC,IAAyC;IAC5D,IAAI,CAACA,MAAM,OAAO;IAClB,MAAMvF,UAAUG,MAAMC,OAAO,CAACmF,IAAI,CAAC,UAAU,IACzCrH,kBAAkBoC,MAAM,CAAC,CAACC,OAAS,AAACgF,IAAI,CAAC,UAAU,CAAe/E,QAAQ,CAACD,SAC3E,EAAE;IACN,MAAMiF,cAAc5E,OAAO2E,IAAI,CAAC,cAAc;IAC9C,MAAME,cAAc7E,OAAO2E,IAAI,CAAC,cAAc;IAC9C,IAAI,CAAC3E,OAAOE,QAAQ,CAAC0E,gBAAgB,CAAC5E,OAAOE,QAAQ,CAAC2E,cAAc,OAAO;IAC3E,OAAO;QAAEzF;QAASwF;QAAaC;IAAY;AAC7C;AAEA,SAASC,SAAS1E,IAAY,EAAE2E,OAAgB,EAAEzB,KAAa;IAC7DT,OAAO1B,GAAG,CAACf,MAAM,aACZ2E;QACHC,eAAeD,QAAQ3F,OAAO,CAAC6F,MAAM,GACjCF,QAAQF,WAAW,GACnBK,KAAKC,GAAG,CAACJ,QAAQF,WAAW,EAAEvB,QAAQnF;;AAE9C;AAeA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeiH,qBACpBC,KAAwB,EACxB/E,UAAuC,CAAC,CAAC;IAEzC,IAAI;QACF,OAAO,MAAMgF,4BAA4BD,OAAO/E;IAClD,EAAE,OAAOkD,OAAO;YACTlD;QAAL+C,MAAK/C,iBAAAA,QAAQgD,KAAK,YAAbhD,iBAAiBR,KAAKyF,GAAG,IAAI,0CAA0C/B;QAC5E,MAAMgC,UAAU;eACX,IAAIC,IACLJ,MACGK,GAAG,CAAC,CAACC,MAAQnI,wBAAwBmI,MACrCjG,MAAM,CAAC,CAACU,OAAyBiE,QAAQjE;SAE/C;QACD,OAAO;YAAEwF,MAAM,EAAE;YAAEC,OAAO,EAAE;YAAEL;YAASM,QAAQ;QAAE;IACnD;AACF;AAEA,eAAeR,4BACbD,KAAwB,EACxB/E,OAAoC;QAEtBA;IAAd,MAAMgD,SAAQhD,iBAAAA,QAAQgD,KAAK,YAAbhD,iBAAiBR,KAAKyF,GAAG;IACvC,MAAMQ,SAAqC;QAAEH,MAAM,EAAE;QAAEC,OAAO,EAAE;QAAEL,SAAS,EAAE;QAAEM,QAAQ;IAAE;IACzF,MAAME,SAAmB,EAAE;IAC3B,KAAK,MAAML,OAAON,MAAO;YAIG/E;QAH1B,MAAMF,OAAO5C,wBAAwBmI;QACrC,IAAI,CAACvF,QAAQ4F,OAAOpG,QAAQ,CAACQ,SAAS2F,OAAOF,KAAK,CAACjG,QAAQ,CAACQ,OAAO;QACnE,IAAIkE,eAAelE,OAAO2F,OAAOF,KAAK,CAACI,IAAI,CAAC7F;aACvC,IAAI4F,OAAOf,MAAM,KAAI3E,oBAAAA,QAAQ4F,QAAQ,YAAhB5F,oBAAoB/C,kCAAkCyI,OAAOC,IAAI,CAAC7F;aACvF2F,OAAOP,OAAO,CAACS,IAAI,CAAC7F;IAC3B;IACA,IAAI,CAAC4F,OAAOf,MAAM,EAAE,OAAOc;IAE3B,MAAMI,SAAS,CAAC/F,MAAc2E;QAC5B,IAAIA,QAAQ3F,OAAO,CAAC6F,MAAM,EAAEc,OAAOH,IAAI,CAACK,IAAI,CAAC;YAAE7F;YAAMhB,SAAS2F,QAAQ3F,OAAO;QAAC;aACzE2G,OAAOF,KAAK,CAACI,IAAI,CAAC7F;IACzB;IAEA,4BAA4B;IAC5B,IAAIgG,UAAUJ,OAAOtG,MAAM,CAAC,CAACU;QAC3B,MAAMiG,QAAQxD,OAAOoB,GAAG,CAAC7D;QACzB,IAAIiG,SAAS/C,QAAQ+C,MAAMrB,aAAa,EAAE;YACxCmB,OAAO/F,MAAMiG;YACb,OAAO;QACT;QACA,OAAO;IACT;IACA,IAAI,CAACD,QAAQnB,MAAM,EAAE,OAAOc;IAE5B,4DAA4D;IAC5D,IAAI,MAAMrC,YAAYJ,QAAQ;QAC5ByC,OAAOP,OAAO,CAACS,IAAI,IAAIG;QACvB,OAAOL;IACT;IAEA,mCAAmC;IACnC,MAAMjC,YAAYnG,cAAckG,GAAG,GAAGC,SAAS;IAC/C,MAAMC,aAAaD,UAAUC,UAAU,CAAClG;IACxC,IAAI;QACF,MAAMyI,YAAY,MAAMxC,UAAUyC,MAAM,IAAIH,QAAQV,GAAG,CAAC,CAACtF,OAAS2D,WAAWC,GAAG,CAAC5D;QACjF,MAAMoG,SAAS,IAAI1D;QACnB,KAAK,MAAMqB,YAAYmC,UAAW;YAChC,MAAMvB,UAAUL,YAAYP,SAASsC,MAAM,GAAItC,SAASQ,IAAI,KAAiC/B;YAC7F,IAAImC,WAAWzB,QAAQyB,QAAQF,WAAW,EAAE2B,OAAOrF,GAAG,CAACgD,SAASuC,EAAE,EAAE3B;QACtE;QACAqB,UAAUA,QAAQ1G,MAAM,CAAC,CAACU;YACxB,MAAM2E,UAAUyB,OAAOvC,GAAG,CAAC7D;YAC3B,IAAI,CAAC2E,SAAS,OAAO;YACrBD,SAAS1E,MAAM2E,SAASzB;YACxB6C,OAAO/F,MAAM2E;YACb,OAAO;QACT;IACF,EAAE,OAAOvB,OAAO;QACdH,KAAKC,OAAO,uCAAuCE;IACrD;IACA,IAAI,CAAC4C,QAAQnB,MAAM,EAAE,OAAOc;IAE5B,iEAAiE;IACjE,MAAM5C,SAASR;IACf,IAAI,CAACQ,UAAUG,QAAQN,gBAAgB;QACrC+C,OAAOP,OAAO,CAACS,IAAI,IAAIG;QACvB,OAAOL;IACT;IACAA,OAAOD,MAAM,GAAGM,QAAQnB,MAAM;IAC9B,MAAM0B,UAAU,IAAI7D;IACpB,MAAM8D,QAAQR,QAAQV,GAAG,CAAC,OAAOtF;QAC/B,IAAI;gBAOKyG;YANP,MAAMA,SAAS,MAAM1D,OAAOzC,SAAS,CAACP,kBAAkBC;YACxD,MAAMwE,cAAc9E,KAAKyF,GAAG;YAC5B,MAAMR,UAAmB;gBACvB3F,SAASyH,OAAOzH,OAAO;gBACvBwF;gBACAC,aAAagC,OAAOzH,OAAO,CAAC6F,MAAM,IAC7B4B,uBAAAA,OAAOxH,YAAY,YAAnBwH,uBAAuBjC,cAAcxG,kCACtCwG,cAAc1G;YACpB;YACAyI,QAAQxF,GAAG,CAACf,MAAM2E;YAClBD,SAAS1E,MAAM2E,SAASH;YACxB,MAAMb,WACHC,GAAG,CAAC5D,MACJe,GAAG,CAAC;gBAAEf;eAAS2E;gBAASzF,QAAQyF,QAAQ3F,OAAO,CAAC6F,MAAM,GAAG;gBACzD/C,KAAK,CAAC,CAACsB,QAAmBH,KAAKuB,aAAa,iCAAiCpB;QAClF,EAAE,OAAOA,OAAO;YACd,IAAIA,iBAAiB/E,oBAAoB;gBAAC;gBAAK;gBAAK;aAAI,CAACmB,QAAQ,CAAC4D,MAAM7E,MAAM,GAAG;gBAC/EqE,iBAAiBlD,KAAKyF,GAAG,KAAKjH;gBAC9BmF,QAAQD,KAAK,CAAC,6EAA6EA;YAC7F,OAAO,IAAIA,iBAAiB/E,oBAAoB+E,MAAM7E,MAAM,KAAK,KAAK;gBACpEqE,iBAAiBlD,KAAKyF,GAAG,KAAKhH;gBAC9B8E,KAAKvD,KAAKyF,GAAG,IAAI,4BAA4B/B;YAC/C,OAAO,IAAIA,iBAAiBzE,yBAAyB;gBACnDiE,iBAAiBlD,KAAKyF,GAAG,KAAKjH;gBAC9B+E,KAAKvD,KAAKyF,GAAG,IAAI,sCAAsC/B;YACzD,OAAO;gBACLH,KAAKvD,KAAKyF,GAAG,IAAI,CAAC,cAAc,EAAEnF,KAAK,oBAAoB,CAAC,EAAEoD;YAChE;QACF;IACF;IACA,IAAIlC;IACJ,MAAMwF,QAAQC,IAAI,CAAC;QACjBD,QAAQE,UAAU,CAACJ;QACnB,IAAIE,QAAc,CAACG;gBACW3G;YAA5BgB,QAAQC,WAAW0F,UAAS3G,sBAAAA,QAAQ4G,UAAU,YAAlB5G,sBAAsBrC;QACpD;KACD;IACD,IAAIqD,OAAOc,aAAad;IACxB,MAAM6F,OAAOf,QAAQ1G,MAAM,CAAC,CAACU,OAAS,CAACuG,QAAQS,GAAG,CAAChH;IACnD,KAAK,MAAMA,QAAQgG,QAAS;QAC1B,MAAMrB,UAAU4B,QAAQ1C,GAAG,CAAC7D;QAC5B,IAAI2E,SAASoB,OAAO/F,MAAM2E;IAC5B;IACAgB,OAAOP,OAAO,CAACS,IAAI,IAAIkB;IACvB,IAAIA,KAAKlC,MAAM,EAAE5B,KAAKvD,KAAKyF,GAAG,IAAI,GAAG4B,KAAKlC,MAAM,CAAC,0CAA0C,CAAC;IAC5F,OAAOc;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASsB;IACd,IAAI,OAAO5J,4BAA4B,YAAY;IACnDA,wBAAwB,CAAC4H,OAAO/E,UAC9B8E,qBAAqBC,OAAO;YAAE6B,UAAU,EAAE5G,2BAAAA,QAAS4G,UAAU;QAAC;AAElE"}