@aglyn/tenant-data-admin 1.0.0-beta.220 → 1.0.0-beta.222

package/src/lib/server/web-risk.js

@@ -0,0 +1,521 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * GOOGLE WEB RISK (AGL-3451): the lookup behind the link reputation screen.
+ *
+ * `@aglyn/shared-util-email/link-reputation` decides which hosts are foreign
+ * and turns a listing into a strong `web-risk-link` signal. This is the store
+ * half: the `uris.search` client, the cache, the switches.
+ *
+ * ## The client
+ *
+ * {@link WebRiskClient} is the contract: one URI in, the threat types it is
+ * listed for and how long that answer may be kept. The default
+ * implementation calls `webrisk.googleapis.com/v1/uris:search` for
+ * SOCIAL_ENGINEERING, MALWARE and UNWANTED_SOFTWARE as the platform's own
+ * service account — the firebase-admin credential every other server-side
+ * Google call here already uses (`client-error-report.ts`), so there is no
+ * key of its own. What is sent depends on the lookup mode, below.
+ *
+ * ## The lookup mode (AGL-3459)
+ *
+ * `platformSettings/webRisk.lookupMode`:
+ *
+ * - `'host'` — the default, and anything that is not `'url'`. Only
+ *   `https://<host>/` is ever sent.
+ * - `'url'` — the host first, from the cache or a call; then, for a host
+ *   that is not itself listed, each of its links' addresses as
+ *   `normalizeReputationLink` reduced them: scheme, host and path, never a
+ *   query string, a fragment or a `user:password@`. A listed address is a
+ *   hit on a clean host, so a kit at a path on a compromised site holds the
+ *   page. At most `MAX_REPUTATION_URLS_PER_LOOKUP` addresses per lookup,
+ *   inside the same deadline as the hosts.
+ *
+ * `'url'` sends more than a host to Google, so it stays off until the
+ * Subprocessors page names that purpose — see the `webrisk.googleapis.com`
+ * entry in `apps/console/constants/subprocessor-inventory.ts`.
+ *
+ * ## Not evidence when it fails
+ *
+ * A call is given {@link WEB_RISK_TIMEOUT_MS}, and a whole lookup
+ * {@link WEB_RISK_DEADLINE_MS} — hosts and addresses together. A host or an
+ * address whose answer did not arrive, or whose call failed, is UNKNOWN: it
+ * holds nothing and logs a warning. A credential the API refuses (the API is
+ * not enabled on a self-hosted project, say) backs the lookup off for a
+ * quarter of an hour, so a misconfiguration is one log line rather than one
+ * per page.
+ *
+ * ## The cache
+ *
+ * Per host and per address, in two layers, with the same rules for both:
+ *
+ * - this process's memory — a listing until the answer's `expireTime`,
+ *   which Web Risk sets and which may not be exceeded; a clean answer for
+ *   {@link WEB_RISK_MEMORY_CLEAN_TTL_MS}, short so a listing the daily
+ *   re-check writes reaches every warm render within minutes. Capped at
+ *   {@link WEB_RISK_MEMORY_MAX_ENTRIES}, then started again;
+ * - the store, server-only, a clean answer kept {@link WEB_RISK_CLEAN_TTL_MS}:
+ *   `webRiskVerdicts/{host}`, bounded by the number of distinct foreign
+ *   hosts and rewritten in place; and `webRiskUrlVerdicts/{sha256(address)}`,
+ *   whose answers the daily re-check deletes a day after they expire
+ *   ({@link reapExpiredWebRiskUrlVerdicts}), because addresses are many more
+ *   than hosts and a path is worth keeping no longer than it is used.
+ *
+ * Read in one `getAll` per lookup, so a page's hosts and addresses cost one
+ * round trip, and nothing at all once they are in memory.
+ *
+ * ## The kill switch
+ *
+ * `platformSettings/webRisk` `{ enabled: false }` stops every lookup within a
+ * minute — every host reads unknown, so nothing holds on it — without a
+ * deploy. Absent or anything else means on.
+ *=========================================*/ import { createHash } from "crypto";
+import { TENANT_APEX } from "@aglyn/aglyn/app-utils/tenant-apex";
+import { LINK_THREAT_TYPES, MAX_REPUTATION_HOSTS_PER_LOOKUP, MAX_REPUTATION_URLS_PER_LOOKUP, normalizeReputationHost, normalizeReputationLink, pickReputationUrls, setLinkReputationLookup } from "@aglyn/shared-util-email/link-reputation";
+import { getApp } from "firebase-admin/app";
+import firebaseAdmin from "./firebase-admin.js";
+export const WEB_RISK_SEARCH_ENDPOINT = 'https://webrisk.googleapis.com/v1/uris:search';
+/** One answer per host. */ export const WEB_RISK_CACHE_COLLECTION = 'webRiskVerdicts';
+/** One answer per address, in `'url'` mode (AGL-3459), keyed by the address's SHA-256. */ export const WEB_RISK_URL_CACHE_COLLECTION = 'webRiskUrlVerdicts';
+/**
+ * The switches: `{ enabled: false }` turns every lookup off;
+ * `lookupMode: 'url'` looks up links' addresses as well as their hosts.
+ */ export const WEB_RISK_SETTINGS_COLLECTION = 'platformSettings';
+export const WEB_RISK_SETTINGS_DOC = 'webRisk';
+/** One call's budget. */ export const WEB_RISK_TIMEOUT_MS = 1000;
+/** One lookup's budget, however many hosts and addresses it asks about. */ export const WEB_RISK_DEADLINE_MS = 1200;
+/** How long a clean answer is kept in the store. */ export const WEB_RISK_CLEAN_TTL_MS = 12 * 60 * 60000;
+/** How long a clean answer is trusted from this process's memory. */ export const WEB_RISK_MEMORY_CLEAN_TTL_MS = 10 * 60000;
+/** A listing whose answer named no `expireTime` is kept this long. */ export const WEB_RISK_LISTED_FALLBACK_TTL_MS = 5 * 60000;
+/** The most answers this process remembers before it starts again. */ export const WEB_RISK_MEMORY_MAX_ENTRIES = 20000;
+/** How long past its expiry an address's stored answer is deleted. */ export const WEB_RISK_URL_VERDICT_GRACE_MS = 24 * 60 * 60000;
+/** How long the switches' answer is trusted. */ const SWITCH_TTL_MS = 60000;
+/** How long a refused credential stops the lookup. */ const REFUSED_BACKOFF_MS = 15 * 60000;
+/** How long a rate limit stops the lookup. */ const THROTTLED_BACKOFF_MS = 60000;
+/** At most one warning per this long, so an outage is not a log flood. */ const WARN_EVERY_MS = 60000;
+/** The API answered with a status that is not an answer. */ export class WebRiskHttpError extends Error {
+    constructor(status, detail){
+        super(`Web Risk answered ${status}: ${detail.slice(0, 200)}`), this.status = status;
+        this.name = 'WebRiskHttpError';
+    }
+}
+/** There is no credential to call with. */ export class WebRiskUnavailableError extends Error {
+    constructor(reason){
+        super(reason);
+        this.name = 'WebRiskUnavailableError';
+    }
+}
+/** `uris.search`'s body, read defensively: an empty object is "not listed". */ export function parseWebRiskSearch(body) {
+    const threat = body == null ? void 0 : body.threat;
+    if (!threat || typeof threat !== 'object') return {
+        threats: [],
+        expireTimeMs: null
+    };
+    const listed = Array.isArray(threat.threatTypes) ? threat.threatTypes : [];
+    const threats = LINK_THREAT_TYPES.filter((type)=>listed.includes(type));
+    const expireTimeMs = typeof threat.expireTime === 'string' ? Date.parse(threat.expireTime) : Number.NaN;
+    return {
+        threats,
+        expireTimeMs: Number.isFinite(expireTimeMs) ? expireTimeMs : null
+    };
+}
+/** The URI a host is looked up as. Only the host: never a path or a query. */ export function webRiskUriForHost(host) {
+    return `https://${host}/`;
+}
+/** The default client: `uris.search` over HTTPS with a bearer token. */ export function createWebRiskHttpClient(options) {
+    var _options_fetch, _options_timeoutMs;
+    const request = (_options_fetch = options.fetch) != null ? _options_fetch : fetch;
+    const timeoutMs = (_options_timeoutMs = options.timeoutMs) != null ? _options_timeoutMs : WEB_RISK_TIMEOUT_MS;
+    return {
+        async searchUri (uri) {
+            var _options_endpoint;
+            const token = await options.accessToken();
+            if (!token) throw new WebRiskUnavailableError('no service-account credential');
+            const url = new URL((_options_endpoint = options.endpoint) != null ? _options_endpoint : WEB_RISK_SEARCH_ENDPOINT);
+            for (const type of LINK_THREAT_TYPES)url.searchParams.append('threatTypes', type);
+            url.searchParams.set('uri', uri);
+            const controller = new AbortController();
+            const timer = setTimeout(()=>controller.abort(), timeoutMs);
+            try {
+                const response = await request(url.toString(), {
+                    method: 'GET',
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                        Accept: 'application/json'
+                    },
+                    signal: controller.signal
+                });
+                if (!response.ok) {
+                    throw new WebRiskHttpError(response.status, await response.text().catch(()=>''));
+                }
+                return parseWebRiskSearch(await response.json());
+            } finally{
+                clearTimeout(timer);
+            }
+        }
+    };
+}
+/**
+ * The platform service account's access token, or null when this deployment
+ * has none — the same credential `client-error-report.ts` writes logs with.
+ */ async function serviceAccountAccessToken() {
+    try {
+        var _ref;
+        var _this;
+        const credential = getApp().options.credential;
+        if (!credential) return null;
+        return (_ref = (_this = await credential.getAccessToken()) == null ? void 0 : _this.access_token) != null ? _ref : null;
+    } catch (unused) {
+        return null;
+    }
+}
+let defaultClient = null;
+let clientOverride;
+function activeClient() {
+    if (clientOverride !== undefined) return clientOverride;
+    defaultClient != null ? defaultClient : defaultClient = createWebRiskHttpClient({
+        accessToken: serviceAccountAccessToken
+    });
+    return defaultClient;
+}
+/** Hosts and addresses share one memory: an address always holds `://`, a host never does. */ const memory = new Map();
+let settingsMemo = null;
+let backoffUntilMs = 0;
+let lastWarnAtMs = 0;
+/** Test seam: forget the caches, the switches, the back-off; optionally stand in a client. */ export function resetWebRiskForTests(client) {
+    memory.clear();
+    settingsMemo = null;
+    backoffUntilMs = 0;
+    lastWarnAtMs = 0;
+    clientOverride = client;
+    defaultClient = null;
+}
+function warn(nowMs, message, error) {
+    if (nowMs - lastWarnAtMs < WARN_EVERY_MS) return;
+    lastWarnAtMs = nowMs;
+    console.warn(`[web-risk] ${message} — it reads unknown, which is not evidence`, error != null ? error : '');
+}
+/**
+ * The switches, read at most once a minute. An unreadable document is on,
+ * in `'host'` mode; a mode that is not exactly `'url'` is `'host'`.
+ */ async function webRiskSettings(nowMs) {
+    if (settingsMemo && nowMs - settingsMemo.atMs < SWITCH_TTL_MS) return settingsMemo;
+    const settings = await firebaseAdmin.app().firestore().collection(WEB_RISK_SETTINGS_COLLECTION).doc(WEB_RISK_SETTINGS_DOC).get().then((snapshot)=>({
+            off: snapshot.get('enabled') === false,
+            mode: snapshot.get('lookupMode') === 'url' ? 'url' : 'host'
+        }), ()=>({
+            off: false,
+            mode: 'host'
+        }));
+    settingsMemo = _extends({}, settings, {
+        atMs: nowMs
+    });
+    return settings;
+}
+/**
+ * The lookup mode in force (AGL-3459): `'url'` only while the lookup is on
+ * and `platformSettings/webRisk.lookupMode` is exactly `'url'`.
+ */ export async function webRiskLookupMode(nowMs = Date.now()) {
+    const settings = await webRiskSettings(nowMs);
+    return settings.off ? 'host' : settings.mode;
+}
+/**
+ * Hosts that are the platform's own: every site's subdomain on the tenant
+ * apex. Never looked up — a neighbour's site is screened on its own page.
+ */ export function platformReputationExclusions() {
+    return [
+        TENANT_APEX
+    ].filter(Boolean);
+}
+function isPlatformHost(host) {
+    return platformReputationExclusions().some((domain)=>host === domain || host.endsWith(`.${domain}`));
+}
+/** An address's document id in {@link WEB_RISK_URL_CACHE_COLLECTION}: an address holds `/`, a hash does not. */ export function webRiskUrlVerdictId(url) {
+    return createHash('sha256').update(url).digest('hex');
+}
+function isAddress(key) {
+    return key.includes('://');
+}
+/** A stored answer, or null. An address's must name the address it was asked for. */ function verdictFrom(data, url) {
+    if (!data) return null;
+    if (url !== undefined && data['url'] !== url) return null;
+    const threats = Array.isArray(data['threats']) ? LINK_THREAT_TYPES.filter((type)=>data['threats'].includes(type)) : [];
+    const checkedAtMs = Number(data['checkedAtMs']);
+    const expiresAtMs = Number(data['expiresAtMs']);
+    if (!Number.isFinite(checkedAtMs) || !Number.isFinite(expiresAtMs)) return null;
+    return {
+        threats,
+        checkedAtMs,
+        expiresAtMs
+    };
+}
+function remember(key, verdict, nowMs) {
+    if (memory.size >= WEB_RISK_MEMORY_MAX_ENTRIES && !memory.has(key)) memory.clear();
+    memory.set(key, _extends({}, verdict, {
+        memoryUntilMs: verdict.threats.length ? verdict.expiresAtMs : Math.min(verdict.expiresAtMs, nowMs + WEB_RISK_MEMORY_CLEAN_TTL_MS)
+    }));
+}
+function fromMemory(key, nowMs) {
+    const known = memory.get(key);
+    return known && nowMs < known.memoryUntilMs ? known : null;
+}
+/**
+ * The reputation of each host — and, in `'url'` mode, of each address on a
+ * host that is not itself listed: listed, clean, or unknown. Platform hosts
+ * are clean without asking. Never throws, and never waits on the API longer
+ * than the deadline: a call still running then finishes in the background
+ * and fills the caches for the next asker.
+ *
+ * "Never throws" covers the store as well as the API: a missing app, a
+ * settings read that fails before it is a promise, or a cache reference
+ * that cannot be built all read every host as unknown. The page review
+ * calls this before its own fail-closed `try`, so a throw here would take
+ * down every page with a link off the site.
+ */ export async function lookupLinkReputation(hosts, options = {}) {
+    try {
+        return await lookupLinkReputationOrThrow(hosts, options);
+    } catch (error) {
+        var _options_nowMs;
+        warn((_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now(), 'a lookup failed before it could answer', error);
+        const unknown = [
+            ...new Set(hosts.map((raw)=>normalizeReputationHost(raw)).filter((host)=>Boolean(host)))
+        ];
+        return {
+            hits: [],
+            clean: [],
+            unknown,
+            looked: 0
+        };
+    }
+}
+async function lookupLinkReputationOrThrow(hosts, options) {
+    var _options_nowMs, _options_maxUrls;
+    var _options_urls;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const result = {
+        hits: [],
+        clean: [],
+        unknown: [],
+        looked: 0
+    };
+    const wanted = [];
+    for (const raw of hosts){
+        var _options_maxHosts;
+        const host = normalizeReputationHost(raw);
+        if (!host || wanted.includes(host) || result.clean.includes(host)) continue;
+        if (isPlatformHost(host)) result.clean.push(host);
+        else if (wanted.length < ((_options_maxHosts = options.maxHosts) != null ? _options_maxHosts : MAX_REPUTATION_HOSTS_PER_LOOKUP)) wanted.push(host);
+        else result.unknown.push(host);
+    }
+    if (!wanted.length) return result;
+    let urls = ((_options_urls = options.urls) == null ? void 0 : _options_urls.length) ? pickReputationUrls(options.urls, wanted, (_options_maxUrls = options.maxUrls) != null ? _options_maxUrls : MAX_REPUTATION_URLS_PER_LOOKUP) : [];
+    const hostOf = new Map(urls.map((url)=>{
+        var _ref;
+        var _normalizeReputationLink;
+        return [
+            url,
+            (_ref = (_normalizeReputationLink = normalizeReputationLink(url)) == null ? void 0 : _normalizeReputationLink.host) != null ? _ref : ''
+        ];
+    }));
+    // What is known before the API is asked, host or address.
+    const known = new Map();
+    const unknownTo = (keys)=>keys.filter((key)=>{
+            const verdict = fromMemory(key, nowMs);
+            if (verdict) known.set(key, verdict);
+            return !verdict;
+        });
+    // 1. This process's memory, for the hosts.
+    let missingHosts = unknownTo(wanted);
+    let missingUrls = [];
+    let mayAsk = true;
+    // 2. The switches — read only when a host is left to ask about, or
+    //    addresses wait on the mode. Off reads everything left as unknown.
+    if (missingHosts.length || urls.length) {
+        const settings = await webRiskSettings(nowMs);
+        if (settings.off || settings.mode !== 'url') urls = [];
+        if (settings.off) mayAsk = false;
+        // An address on a host already known to be listed adds nothing.
+        urls = urls.filter((url)=>{
+            var _hostOf_get;
+            var _known_get;
+            return !((_known_get = known.get((_hostOf_get = hostOf.get(url)) != null ? _hostOf_get : '')) == null ? void 0 : _known_get.threats.length);
+        });
+        // 1b. This process's memory, for the addresses.
+        missingUrls = unknownTo(urls);
+    }
+    // 3. The store, hosts and addresses in one round trip.
+    const firestore = firebaseAdmin.app().firestore();
+    const hostCollection = firestore.collection(WEB_RISK_CACHE_COLLECTION);
+    const urlCollection = firestore.collection(WEB_RISK_URL_CACHE_COLLECTION);
+    if (mayAsk && (missingHosts.length || missingUrls.length)) {
+        const keys = [
+            ...missingHosts,
+            ...missingUrls
+        ];
+        try {
+            const snapshots = await firestore.getAll(...keys.map((key)=>isAddress(key) ? urlCollection.doc(webRiskUrlVerdictId(key)) : hostCollection.doc(key)));
+            snapshots.forEach((snapshot, index)=>{
+                const key = keys[index];
+                const data = snapshot.exists ? snapshot.data() : undefined;
+                const verdict = verdictFrom(data, isAddress(key) ? key : undefined);
+                if (!verdict || nowMs >= verdict.expiresAtMs) return;
+                remember(key, verdict, nowMs);
+                known.set(key, verdict);
+            });
+            missingHosts = missingHosts.filter((host)=>!known.has(host));
+            missingUrls = missingUrls.filter((url)=>!known.has(url));
+        } catch (error) {
+            warn(nowMs, 'the verdict cache could not be read', error);
+        }
+    }
+    // 4. The API, everything left at once, within the deadline: each host
+    //    first, then — unless the host itself is listed — its addresses.
+    const answered = new Map();
+    const client = activeClient();
+    if (mayAsk && client && nowMs >= backoffUntilMs && (missingHosts.length || missingUrls.length)) {
+        let looked = 0;
+        const ask = async (key)=>{
+            if (Date.now() < backoffUntilMs) return null;
+            looked += 1;
+            try {
+                var _answer_expireTimeMs, _hostOf_get;
+                const answer = await client.searchUri(isAddress(key) ? key : webRiskUriForHost(key));
+                const checkedAtMs = Date.now();
+                const verdict = {
+                    threats: answer.threats,
+                    checkedAtMs,
+                    expiresAtMs: answer.threats.length ? (_answer_expireTimeMs = answer.expireTimeMs) != null ? _answer_expireTimeMs : checkedAtMs + WEB_RISK_LISTED_FALLBACK_TTL_MS : checkedAtMs + WEB_RISK_CLEAN_TTL_MS
+                };
+                answered.set(key, verdict);
+                remember(key, verdict, checkedAtMs);
+                const document = isAddress(key) ? urlCollection.doc(webRiskUrlVerdictId(key)).set(_extends({
+                    host: (_hostOf_get = hostOf.get(key)) != null ? _hostOf_get : '',
+                    url: key
+                }, verdict, {
+                    listed: verdict.threats.length > 0
+                })) : hostCollection.doc(key).set(_extends({
+                    host: key
+                }, verdict, {
+                    listed: verdict.threats.length > 0
+                }));
+                await document.catch((error)=>warn(checkedAtMs, 'a verdict could not be cached', error));
+                return verdict;
+            } catch (error) {
+                if (error instanceof WebRiskHttpError && [
+                    401,
+                    403,
+                    404
+                ].includes(error.status)) {
+                    backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS;
+                    console.error('[web-risk] the API refused the credential — lookups paused for 15 minutes', error);
+                } else if (error instanceof WebRiskHttpError && error.status === 429) {
+                    backoffUntilMs = Date.now() + THROTTLED_BACKOFF_MS;
+                    warn(Date.now(), 'the API is rate limiting', error);
+                } else if (error instanceof WebRiskUnavailableError) {
+                    backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS;
+                    warn(Date.now(), 'no credential to call the API with', error);
+                } else {
+                    warn(Date.now(), `the lookup of ${key} failed or timed out`, error);
+                }
+                return null;
+            }
+        };
+        const pipelines = wanted.map(async (host)=>{
+            var _known_get;
+            const hostVerdict = (_known_get = known.get(host)) != null ? _known_get : missingHosts.includes(host) ? await ask(host) : null;
+            if (hostVerdict == null ? void 0 : hostVerdict.threats.length) return;
+            await Promise.all(missingUrls.filter((url)=>hostOf.get(url) === host).map((url)=>ask(url)));
+        });
+        let timer;
+        await Promise.race([
+            Promise.allSettled(pipelines),
+            new Promise((resolve)=>{
+                var _options_deadlineMs;
+                timer = setTimeout(resolve, (_options_deadlineMs = options.deadlineMs) != null ? _options_deadlineMs : WEB_RISK_DEADLINE_MS);
+            })
+        ]);
+        if (timer) clearTimeout(timer);
+        result.looked = looked;
+        const late = [
+            ...missingHosts,
+            ...missingUrls
+        ].filter((key)=>!answered.has(key)).length;
+        if (late) warn(Date.now(), `${late} host(s) or address(es) had no answer within the deadline`);
+    }
+    // 5. The answer. An address on a listed host is not reported: the host's
+    //    listing already names it.
+    const verdictOf = (key)=>{
+        var _known_get;
+        return (_known_get = known.get(key)) != null ? _known_get : answered.get(key);
+    };
+    for (const host of wanted){
+        const verdict = verdictOf(host);
+        if (!verdict) result.unknown.push(host);
+        else if (verdict.threats.length) result.hits.push({
+            host,
+            threats: verdict.threats
+        });
+        else result.clean.push(host);
+    }
+    for (const url of urls){
+        var _hostOf_get;
+        var _verdictOf;
+        const host = (_hostOf_get = hostOf.get(url)) != null ? _hostOf_get : '';
+        if ((_verdictOf = verdictOf(host)) == null ? void 0 : _verdictOf.threats.length) continue;
+        const verdict = verdictOf(url);
+        if (!verdict) result.unknown.push(url);
+        else if (verdict.threats.length) result.hits.push({
+            host,
+            url,
+            threats: verdict.threats
+        });
+        else result.clean.push(url);
+    }
+    return result;
+}
+/**
+ * Delete the addresses' stored answers that expired more than
+ * {@link WEB_RISK_URL_VERDICT_GRACE_MS} ago (AGL-3459), at most `limit` at a
+ * time. The daily re-check calls it once per walk. A host's answers are not
+ * reaped: they are few and rewritten in place. Never throws.
+ */ export async function reapExpiredWebRiskUrlVerdicts(options = {}) {
+    var _options_nowMs, _options_firestore;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+    try {
+        var _options_limit;
+        const stale = await firestore.collection(WEB_RISK_URL_CACHE_COLLECTION).where('expiresAtMs', '<', nowMs - WEB_RISK_URL_VERDICT_GRACE_MS).limit((_options_limit = options.limit) != null ? _options_limit : 500).get();
+        await Promise.all(stale.docs.map((snapshot)=>snapshot.ref.delete()));
+        return stale.docs.length;
+    } catch (error) {
+        console.warn('[web-risk] expired address verdicts could not be deleted', error);
+        return 0;
+    }
+}
+/**
+ * Puts this lookup behind the shared screen's reputation seam, so the send
+ * seam (`screenTenantMessage`) asks it. Called by
+ * `installOutboundScreenGate`, at that module's load.
+ */ export function installLinkReputationLookup() {
+    if (typeof setLinkReputationLookup !== 'function') return;
+    setLinkReputationLookup((hosts, options)=>lookupLinkReputation(hosts, {
+            deadlineMs: options == null ? void 0 : options.deadlineMs,
+            urls: options == null ? void 0 : options.urls
+        }));
+}
+
+//# sourceMappingURL=web-risk.js.map

package/src/lib/server/web-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/web-risk.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n\n/*==========================================\n * GOOGLE WEB RISK (AGL-3451): the lookup behind the link reputation screen.\n *\n * `@aglyn/shared-util-email/link-reputation` decides which hosts are foreign\n * and turns a listing into a strong `web-risk-link` signal. This is the store\n * half: the `uris.search` client, the cache, the switches.\n *\n * ## The client\n *\n * {@link WebRiskClient} is the contract: one URI in, the threat types it is\n * listed for and how long that answer may be kept. The default\n * implementation calls `webrisk.googleapis.com/v1/uris:search` for\n * SOCIAL_ENGINEERING, MALWARE and UNWANTED_SOFTWARE as the platform's own\n * service account — the firebase-admin credential every other server-side\n * Google call here already uses (`client-error-report.ts`), so there is no\n * key of its own. What is sent depends on the lookup mode, below.\n *\n * ## The lookup mode (AGL-3459)\n *\n * `platformSettings/webRisk.lookupMode`:\n *\n * - `'host'` — the default, and anything that is not `'url'`. Only\n *   `https://<host>/` is ever sent.\n * - `'url'` — the host first, from the cache or a call; then, for a host\n *   that is not itself listed, each of its links' addresses as\n *   `normalizeReputationLink` reduced them: scheme, host and path, never a\n *   query string, a fragment or a `user:password@`. A listed address is a\n *   hit on a clean host, so a kit at a path on a compromised site holds the\n *   page. At most `MAX_REPUTATION_URLS_PER_LOOKUP` addresses per lookup,\n *   inside the same deadline as the hosts.\n *\n * `'url'` sends more than a host to Google, so it stays off until the\n * Subprocessors page names that purpose — see the `webrisk.googleapis.com`\n * entry in `apps/console/constants/subprocessor-inventory.ts`.\n *\n * ## Not evidence when it fails\n *\n * A call is given {@link WEB_RISK_TIMEOUT_MS}, and a whole lookup\n * {@link WEB_RISK_DEADLINE_MS} — hosts and addresses together. A host or an\n * address whose answer did not arrive, or whose call failed, is UNKNOWN: it\n * holds nothing and logs a warning. A credential the API refuses (the API is\n * not enabled on a self-hosted project, say) backs the lookup off for a\n * quarter of an hour, so a misconfiguration is one log line rather than one\n * per page.\n *\n * ## The cache\n *\n * Per host and per address, in two layers, with the same rules for both:\n *\n * - this process's memory — a listing until the answer's `expireTime`,\n *   which Web Risk sets and which may not be exceeded; a clean answer for\n *   {@link WEB_RISK_MEMORY_CLEAN_TTL_MS}, short so a listing the daily\n *   re-check writes reaches every warm render within minutes. Capped at\n *   {@link WEB_RISK_MEMORY_MAX_ENTRIES}, then started again;\n * - the store, server-only, a clean answer kept {@link WEB_RISK_CLEAN_TTL_MS}:\n *   `webRiskVerdicts/{host}`, bounded by the number of distinct foreign\n *   hosts and rewritten in place; and `webRiskUrlVerdicts/{sha256(address)}`,\n *   whose answers the daily re-check deletes a day after they expire\n *   ({@link reapExpiredWebRiskUrlVerdicts}), because addresses are many more\n *   than hosts and a path is worth keeping no longer than it is used.\n *\n * Read in one `getAll` per lookup, so a page's hosts and addresses cost one\n * round trip, and nothing at all once they are in memory.\n *\n * ## The kill switch\n *\n * `platformSettings/webRisk` `{ enabled: false }` stops every lookup within a\n * minute — every host reads unknown, so nothing holds on it — without a\n * deploy. Absent or anything else means on.\n *=========================================*/\n\nimport { createHash } from 'crypto'\nimport { TENANT_APEX } from '@aglyn/aglyn/app-utils/tenant-apex'\nimport {\n  LINK_THREAT_TYPES,\n  type LinkReputationAnswer,\n  type LinkThreatType,\n  MAX_REPUTATION_HOSTS_PER_LOOKUP,\n  MAX_REPUTATION_URLS_PER_LOOKUP,\n  normalizeReputationHost,\n  normalizeReputationLink,\n  pickReputationUrls,\n  setLinkReputationLookup,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { getApp } from 'firebase-admin/app'\nimport firebaseAdmin from './firebase-admin'\n\nexport const WEB_RISK_SEARCH_ENDPOINT = 'https://webrisk.googleapis.com/v1/uris:search'\n/** One answer per host. */\nexport const WEB_RISK_CACHE_COLLECTION = 'webRiskVerdicts'\n/** One answer per address, in `'url'` mode (AGL-3459), keyed by the address's SHA-256. */\nexport const WEB_RISK_URL_CACHE_COLLECTION = 'webRiskUrlVerdicts'\n/**\n * The switches: `{ enabled: false }` turns every lookup off;\n * `lookupMode: 'url'` looks up links' addresses as well as their hosts.\n */\nexport const WEB_RISK_SETTINGS_COLLECTION = 'platformSettings'\nexport const WEB_RISK_SETTINGS_DOC = 'webRisk'\n\n/** What a lookup sends: the host only (the default), or the address too. */\nexport type WebRiskLookupMode = 'host' | 'url'\n\n/** One call's budget. */\nexport const WEB_RISK_TIMEOUT_MS = 1_000\n/** One lookup's budget, however many hosts and addresses it asks about. */\nexport const WEB_RISK_DEADLINE_MS = 1_200\n/** How long a clean answer is kept in the store. */\nexport const WEB_RISK_CLEAN_TTL_MS = 12 * 60 * 60_000\n/** How long a clean answer is trusted from this process's memory. */\nexport const WEB_RISK_MEMORY_CLEAN_TTL_MS = 10 * 60_000\n/** A listing whose answer named no `expireTime` is kept this long. */\nexport const WEB_RISK_LISTED_FALLBACK_TTL_MS = 5 * 60_000\n/** The most answers this process remembers before it starts again. */\nexport const WEB_RISK_MEMORY_MAX_ENTRIES = 20_000\n/** How long past its expiry an address's stored answer is deleted. */\nexport const WEB_RISK_URL_VERDICT_GRACE_MS = 24 * 60 * 60_000\n/** How long the switches' answer is trusted. */\nconst SWITCH_TTL_MS = 60_000\n/** How long a refused credential stops the lookup. */\nconst REFUSED_BACKOFF_MS = 15 * 60_000\n/** How long a rate limit stops the lookup. */\nconst THROTTLED_BACKOFF_MS = 60_000\n/** At most one warning per this long, so an outage is not a log flood. */\nconst WARN_EVERY_MS = 60_000\n\n/** What `uris.search` answered for one URI. */\nexport interface WebRiskSearchResult {\n  /** The lists it is on; empty when it is on none. */\n  threats: LinkThreatType[]\n  /** Until when the answer may be kept, when the API said. */\n  expireTimeMs: number | null\n}\n\n/** The contract: one URI, its listing. Throws on anything but an answer. */\nexport interface WebRiskClient {\n  searchUri(uri: string): Promise<WebRiskSearchResult>\n}\n\n/** The API answered with a status that is not an answer. */\nexport class WebRiskHttpError extends Error {\n  constructor(\n    readonly status: number,\n    detail: string,\n  ) {\n    super(`Web Risk answered ${status}: ${detail.slice(0, 200)}`)\n    this.name = 'WebRiskHttpError'\n  }\n}\n\n/** There is no credential to call with. */\nexport class WebRiskUnavailableError extends Error {\n  constructor(reason: string) {\n    super(reason)\n    this.name = 'WebRiskUnavailableError'\n  }\n}\n\n/** `uris.search`'s body, read defensively: an empty object is \"not listed\". */\nexport function parseWebRiskSearch(body: unknown): WebRiskSearchResult {\n  const threat = (body as { threat?: { threatTypes?: unknown; expireTime?: unknown } } | null)\n    ?.threat\n  if (!threat || typeof threat !== 'object') return { threats: [], expireTimeMs: null }\n  const listed = Array.isArray(threat.threatTypes) ? threat.threatTypes : []\n  const threats = LINK_THREAT_TYPES.filter((type) => listed.includes(type))\n  const expireTimeMs =\n    typeof threat.expireTime === 'string' ? Date.parse(threat.expireTime) : Number.NaN\n  return { threats, expireTimeMs: Number.isFinite(expireTimeMs) ? expireTimeMs : null }\n}\n\n/** The URI a host is looked up as. Only the host: never a path or a query. */\nexport function webRiskUriForHost(host: string): string {\n  return `https://${host}/`\n}\n\n/** The default client: `uris.search` over HTTPS with a bearer token. */\nexport function createWebRiskHttpClient(options: {\n  accessToken: () => Promise<string | null>\n  fetch?: typeof fetch\n  timeoutMs?: number\n  endpoint?: string\n}): WebRiskClient {\n  const request = options.fetch ?? fetch\n  const timeoutMs = options.timeoutMs ?? WEB_RISK_TIMEOUT_MS\n  return {\n    async searchUri(uri: string): Promise<WebRiskSearchResult> {\n      const token = await options.accessToken()\n      if (!token) throw new WebRiskUnavailableError('no service-account credential')\n      const url = new URL(options.endpoint ?? WEB_RISK_SEARCH_ENDPOINT)\n      for (const type of LINK_THREAT_TYPES) url.searchParams.append('threatTypes', type)\n      url.searchParams.set('uri', uri)\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), timeoutMs)\n      try {\n        const response = await request(url.toString(), {\n          method: 'GET',\n          headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },\n          signal: controller.signal,\n        })\n        if (!response.ok) {\n          throw new WebRiskHttpError(response.status, await response.text().catch(() => ''))\n        }\n        return parseWebRiskSearch(await response.json())\n      } finally {\n        clearTimeout(timer)\n      }\n    },\n  }\n}\n\n/**\n * The platform service account's access token, or null when this deployment\n * has none — the same credential `client-error-report.ts` writes logs with.\n */\nasync function serviceAccountAccessToken(): Promise<string | null> {\n  try {\n    const credential = getApp().options.credential\n    if (!credential) return null\n    return (await credential.getAccessToken())?.access_token ?? null\n  } catch {\n    return null\n  }\n}\n\nlet defaultClient: WebRiskClient | null = null\nlet clientOverride: WebRiskClient | null | undefined\n\nfunction activeClient(): WebRiskClient | null {\n  if (clientOverride !== undefined) return clientOverride\n  defaultClient ??= createWebRiskHttpClient({ accessToken: serviceAccountAccessToken })\n  return defaultClient\n}\n\ninterface Verdict {\n  threats: LinkThreatType[]\n  checkedAtMs: number\n  /** When the answer stops being good, in the store. */\n  expiresAtMs: number\n}\n\n/** Hosts and addresses share one memory: an address always holds `://`, a host never does. */\nconst memory = new Map<string, Verdict & { memoryUntilMs: number }>()\nlet settingsMemo: { off: boolean; mode: WebRiskLookupMode; atMs: number } | null = null\nlet backoffUntilMs = 0\nlet lastWarnAtMs = 0\n\n/** Test seam: forget the caches, the switches, the back-off; optionally stand in a client. */\nexport function resetWebRiskForTests(client?: WebRiskClient | null): void {\n  memory.clear()\n  settingsMemo = null\n  backoffUntilMs = 0\n  lastWarnAtMs = 0\n  clientOverride = client\n  defaultClient = null\n}\n\nfunction warn(nowMs: number, message: string, error?: unknown): void {\n  if (nowMs - lastWarnAtMs < WARN_EVERY_MS) return\n  lastWarnAtMs = nowMs\n  console.warn(`[web-risk] ${message} — it reads unknown, which is not evidence`, error ?? '')\n}\n\n/**\n * The switches, read at most once a minute. An unreadable document is on,\n * in `'host'` mode; a mode that is not exactly `'url'` is `'host'`.\n */\nasync function webRiskSettings(nowMs: number): Promise<{ off: boolean; mode: WebRiskLookupMode }> {\n  if (settingsMemo && nowMs - settingsMemo.atMs < SWITCH_TTL_MS) return settingsMemo\n  const settings = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(WEB_RISK_SETTINGS_COLLECTION)\n    .doc(WEB_RISK_SETTINGS_DOC)\n    .get()\n    .then(\n      (snapshot) => ({\n        off: snapshot.get('enabled') === false,\n        mode: snapshot.get('lookupMode') === 'url' ? ('url' as const) : ('host' as const),\n      }),\n      () => ({ off: false, mode: 'host' as const }),\n    )\n  settingsMemo = { ...settings, atMs: nowMs }\n  return settings\n}\n\n/**\n * The lookup mode in force (AGL-3459): `'url'` only while the lookup is on\n * and `platformSettings/webRisk.lookupMode` is exactly `'url'`.\n */\nexport async function webRiskLookupMode(nowMs: number = Date.now()): Promise<WebRiskLookupMode> {\n  const settings = await webRiskSettings(nowMs)\n  return settings.off ? 'host' : settings.mode\n}\n\n/**\n * Hosts that are the platform's own: every site's subdomain on the tenant\n * apex. Never looked up — a neighbour's site is screened on its own page.\n */\nexport function platformReputationExclusions(): string[] {\n  return [TENANT_APEX].filter(Boolean)\n}\n\nfunction isPlatformHost(host: string): boolean {\n  return platformReputationExclusions().some(\n    (domain) => host === domain || host.endsWith(`.${domain}`),\n  )\n}\n\n/** An address's document id in {@link WEB_RISK_URL_CACHE_COLLECTION}: an address holds `/`, a hash does not. */\nexport function webRiskUrlVerdictId(url: string): string {\n  return createHash('sha256').update(url).digest('hex')\n}\n\nfunction isAddress(key: string): boolean {\n  return key.includes('://')\n}\n\n/** A stored answer, or null. An address's must name the address it was asked for. */\nfunction verdictFrom(data: Record<string, unknown> | undefined, url?: string): Verdict | null {\n  if (!data) return null\n  if (url !== undefined && data['url'] !== url) return null\n  const threats = Array.isArray(data['threats'])\n    ? LINK_THREAT_TYPES.filter((type) => (data['threats'] as unknown[]).includes(type))\n    : []\n  const checkedAtMs = Number(data['checkedAtMs'])\n  const expiresAtMs = Number(data['expiresAtMs'])\n  if (!Number.isFinite(checkedAtMs) || !Number.isFinite(expiresAtMs)) return null\n  return { threats, checkedAtMs, expiresAtMs }\n}\n\nfunction remember(key: string, verdict: Verdict, nowMs: number): void {\n  if (memory.size >= WEB_RISK_MEMORY_MAX_ENTRIES && !memory.has(key)) memory.clear()\n  memory.set(key, {\n    ...verdict,\n    memoryUntilMs: verdict.threats.length\n      ? verdict.expiresAtMs\n      : Math.min(verdict.expiresAtMs, nowMs + WEB_RISK_MEMORY_CLEAN_TTL_MS),\n  })\n}\n\nfunction fromMemory(key: string, nowMs: number): Verdict | null {\n  const known = memory.get(key)\n  return known && nowMs < known.memoryUntilMs ? known : null\n}\n\nexport interface HostReputationLookupOptions {\n  /** How long the caller will wait, overall. */\n  deadlineMs?: number\n  /** The most hosts asked about; the rest read unknown. */\n  maxHosts?: number\n  /**\n   * The links' addresses, looked up on the hosts asked about in `'url'`\n   * mode (AGL-3459) and ignored in `'host'` mode. Normalized again here, so\n   * a query string handed in is still never sent.\n   */\n  urls?: readonly string[]\n  /** The most addresses asked about ({@link MAX_REPUTATION_URLS_PER_LOOKUP}); the rest are not asked about. */\n  maxUrls?: number\n  nowMs?: number\n}\n\n/** What a lookup answered, and how many calls it made to the API. */\nexport interface HostReputationLookupResult extends LinkReputationAnswer {\n  looked: number\n}\n\n/**\n * The reputation of each host — and, in `'url'` mode, of each address on a\n * host that is not itself listed: listed, clean, or unknown. Platform hosts\n * are clean without asking. Never throws, and never waits on the API longer\n * than the deadline: a call still running then finishes in the background\n * and fills the caches for the next asker.\n *\n * \"Never throws\" covers the store as well as the API: a missing app, a\n * settings read that fails before it is a promise, or a cache reference\n * that cannot be built all read every host as unknown. The page review\n * calls this before its own fail-closed `try`, so a throw here would take\n * down every page with a link off the site.\n */\nexport async function lookupLinkReputation(\n  hosts: readonly string[],\n  options: HostReputationLookupOptions = {},\n): Promise<HostReputationLookupResult> {\n  try {\n    return await lookupLinkReputationOrThrow(hosts, options)\n  } catch (error) {\n    warn(options.nowMs ?? Date.now(), 'a lookup failed before it could answer', error)\n    const unknown = [\n      ...new Set(\n        hosts\n          .map((raw) => normalizeReputationHost(raw))\n          .filter((host): host is string => Boolean(host)),\n      ),\n    ]\n    return { hits: [], clean: [], unknown, looked: 0 }\n  }\n}\n\nasync function lookupLinkReputationOrThrow(\n  hosts: readonly string[],\n  options: HostReputationLookupOptions,\n): Promise<HostReputationLookupResult> {\n  const nowMs = options.nowMs ?? Date.now()\n  const result: HostReputationLookupResult = { hits: [], clean: [], unknown: [], looked: 0 }\n  const wanted: string[] = []\n  for (const raw of hosts) {\n    const host = normalizeReputationHost(raw)\n    if (!host || wanted.includes(host) || result.clean.includes(host)) continue\n    if (isPlatformHost(host)) result.clean.push(host)\n    else if (wanted.length < (options.maxHosts ?? MAX_REPUTATION_HOSTS_PER_LOOKUP)) wanted.push(host)\n    else result.unknown.push(host)\n  }\n  if (!wanted.length) return result\n  let urls = options.urls?.length\n    ? pickReputationUrls(options.urls, wanted, options.maxUrls ?? MAX_REPUTATION_URLS_PER_LOOKUP)\n    : []\n  const hostOf = new Map(urls.map((url) => [url, normalizeReputationLink(url)?.host ?? '']))\n\n  // What is known before the API is asked, host or address.\n  const known = new Map<string, Verdict>()\n  const unknownTo = (keys: readonly string[]) =>\n    keys.filter((key) => {\n      const verdict = fromMemory(key, nowMs)\n      if (verdict) known.set(key, verdict)\n      return !verdict\n    })\n\n  // 1. This process's memory, for the hosts.\n  let missingHosts = unknownTo(wanted)\n  let missingUrls: string[] = []\n  let mayAsk = true\n\n  // 2. The switches — read only when a host is left to ask about, or\n  //    addresses wait on the mode. Off reads everything left as unknown.\n  if (missingHosts.length || urls.length) {\n    const settings = await webRiskSettings(nowMs)\n    if (settings.off || settings.mode !== 'url') urls = []\n    if (settings.off) mayAsk = false\n    // An address on a host already known to be listed adds nothing.\n    urls = urls.filter((url) => !known.get(hostOf.get(url) ?? '')?.threats.length)\n    // 1b. This process's memory, for the addresses.\n    missingUrls = unknownTo(urls)\n  }\n\n  // 3. The store, hosts and addresses in one round trip.\n  const firestore = firebaseAdmin.app().firestore()\n  const hostCollection = firestore.collection(WEB_RISK_CACHE_COLLECTION)\n  const urlCollection = firestore.collection(WEB_RISK_URL_CACHE_COLLECTION)\n  if (mayAsk && (missingHosts.length || missingUrls.length)) {\n    const keys = [...missingHosts, ...missingUrls]\n    try {\n      const snapshots = await firestore.getAll(\n        ...keys.map((key) =>\n          isAddress(key) ? urlCollection.doc(webRiskUrlVerdictId(key)) : hostCollection.doc(key),\n        ),\n      )\n      snapshots.forEach((snapshot, index) => {\n        const key = keys[index]\n        const data = snapshot.exists ? (snapshot.data() as Record<string, unknown>) : undefined\n        const verdict = verdictFrom(data, isAddress(key) ? key : undefined)\n        if (!verdict || nowMs >= verdict.expiresAtMs) return\n        remember(key, verdict, nowMs)\n        known.set(key, verdict)\n      })\n      missingHosts = missingHosts.filter((host) => !known.has(host))\n      missingUrls = missingUrls.filter((url) => !known.has(url))\n    } catch (error) {\n      warn(nowMs, 'the verdict cache could not be read', error)\n    }\n  }\n\n  // 4. The API, everything left at once, within the deadline: each host\n  //    first, then — unless the host itself is listed — its addresses.\n  const answered = new Map<string, Verdict>()\n  const client = activeClient()\n  if (mayAsk && client && nowMs >= backoffUntilMs && (missingHosts.length || missingUrls.length)) {\n    let looked = 0\n    const ask = async (key: string): Promise<Verdict | null> => {\n      if (Date.now() < backoffUntilMs) return null\n      looked += 1\n      try {\n        const answer = await client.searchUri(isAddress(key) ? key : webRiskUriForHost(key))\n        const checkedAtMs = Date.now()\n        const verdict: Verdict = {\n          threats: answer.threats,\n          checkedAtMs,\n          expiresAtMs: answer.threats.length\n            ? (answer.expireTimeMs ?? checkedAtMs + WEB_RISK_LISTED_FALLBACK_TTL_MS)\n            : checkedAtMs + WEB_RISK_CLEAN_TTL_MS,\n        }\n        answered.set(key, verdict)\n        remember(key, verdict, checkedAtMs)\n        const document = isAddress(key)\n          ? urlCollection\n              .doc(webRiskUrlVerdictId(key))\n              .set({ host: hostOf.get(key) ?? '', url: key, ...verdict, listed: verdict.threats.length > 0 })\n          : hostCollection.doc(key).set({ host: key, ...verdict, listed: verdict.threats.length > 0 })\n        await document.catch((error: unknown) => warn(checkedAtMs, 'a verdict could not be cached', error))\n        return verdict\n      } catch (error) {\n        if (error instanceof WebRiskHttpError && [401, 403, 404].includes(error.status)) {\n          backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS\n          console.error('[web-risk] the API refused the credential — lookups paused for 15 minutes', error)\n        } else if (error instanceof WebRiskHttpError && error.status === 429) {\n          backoffUntilMs = Date.now() + THROTTLED_BACKOFF_MS\n          warn(Date.now(), 'the API is rate limiting', error)\n        } else if (error instanceof WebRiskUnavailableError) {\n          backoffUntilMs = Date.now() + REFUSED_BACKOFF_MS\n          warn(Date.now(), 'no credential to call the API with', error)\n        } else {\n          warn(Date.now(), `the lookup of ${key} failed or timed out`, error)\n        }\n        return null\n      }\n    }\n    const pipelines = wanted.map(async (host) => {\n      const hostVerdict = known.get(host) ?? (missingHosts.includes(host) ? await ask(host) : null)\n      if (hostVerdict?.threats.length) return\n      await Promise.all(missingUrls.filter((url) => hostOf.get(url) === host).map((url) => ask(url)))\n    })\n    let timer: ReturnType<typeof setTimeout> | undefined\n    await Promise.race([\n      Promise.allSettled(pipelines),\n      new Promise<void>((resolve) => {\n        timer = setTimeout(resolve, options.deadlineMs ?? WEB_RISK_DEADLINE_MS)\n      }),\n    ])\n    if (timer) clearTimeout(timer)\n    result.looked = looked\n    const late = [...missingHosts, ...missingUrls].filter((key) => !answered.has(key)).length\n    if (late) warn(Date.now(), `${late} host(s) or address(es) had no answer within the deadline`)\n  }\n\n  // 5. The answer. An address on a listed host is not reported: the host's\n  //    listing already names it.\n  const verdictOf = (key: string) => known.get(key) ?? answered.get(key)\n  for (const host of wanted) {\n    const verdict = verdictOf(host)\n    if (!verdict) result.unknown.push(host)\n    else if (verdict.threats.length) result.hits.push({ host, threats: verdict.threats })\n    else result.clean.push(host)\n  }\n  for (const url of urls) {\n    const host = hostOf.get(url) ?? ''\n    if (verdictOf(host)?.threats.length) continue\n    const verdict = verdictOf(url)\n    if (!verdict) result.unknown.push(url)\n    else if (verdict.threats.length) result.hits.push({ host, url, threats: verdict.threats })\n    else result.clean.push(url)\n  }\n  return result\n}\n\n/**\n * Delete the addresses' stored answers that expired more than\n * {@link WEB_RISK_URL_VERDICT_GRACE_MS} ago (AGL-3459), at most `limit` at a\n * time. The daily re-check calls it once per walk. A host's answers are not\n * reaped: they are few and rewritten in place. Never throws.\n */\nexport async function reapExpiredWebRiskUrlVerdicts(\n  options: { nowMs?: number; limit?: number; firestore?: FirebaseFirestore.Firestore } = {},\n): Promise<number> {\n  const nowMs = options.nowMs ?? Date.now()\n  const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n  try {\n    const stale = await firestore\n      .collection(WEB_RISK_URL_CACHE_COLLECTION)\n      .where('expiresAtMs', '<', nowMs - WEB_RISK_URL_VERDICT_GRACE_MS)\n      .limit(options.limit ?? 500)\n      .get()\n    await Promise.all(stale.docs.map((snapshot) => snapshot.ref.delete()))\n    return stale.docs.length\n  } catch (error) {\n    console.warn('[web-risk] expired address verdicts could not be deleted', error)\n    return 0\n  }\n}\n\n/**\n * Puts this lookup behind the shared screen's reputation seam, so the send\n * seam (`screenTenantMessage`) asks it. Called by\n * `installOutboundScreenGate`, at that module's load.\n */\nexport function installLinkReputationLookup(): void {\n  if (typeof setLinkReputationLookup !== 'function') return\n  setLinkReputationLookup((hosts, options) =>\n    lookupLinkReputation(hosts, { deadlineMs: options?.deadlineMs, urls: options?.urls }),\n  )\n}\n"],"names":["createHash","TENANT_APEX","LINK_THREAT_TYPES","MAX_REPUTATION_HOSTS_PER_LOOKUP","MAX_REPUTATION_URLS_PER_LOOKUP","normalizeReputationHost","normalizeReputationLink","pickReputationUrls","setLinkReputationLookup","getApp","firebaseAdmin","WEB_RISK_SEARCH_ENDPOINT","WEB_RISK_CACHE_COLLECTION","WEB_RISK_URL_CACHE_COLLECTION","WEB_RISK_SETTINGS_COLLECTION","WEB_RISK_SETTINGS_DOC","WEB_RISK_TIMEOUT_MS","WEB_RISK_DEADLINE_MS","WEB_RISK_CLEAN_TTL_MS","WEB_RISK_MEMORY_CLEAN_TTL_MS","WEB_RISK_LISTED_FALLBACK_TTL_MS","WEB_RISK_MEMORY_MAX_ENTRIES","WEB_RISK_URL_VERDICT_GRACE_MS","SWITCH_TTL_MS","REFUSED_BACKOFF_MS","THROTTLED_BACKOFF_MS","WARN_EVERY_MS","WebRiskHttpError","Error","status","detail","slice","name","WebRiskUnavailableError","reason","parseWebRiskSearch","body","threat","threats","expireTimeMs","listed","Array","isArray","threatTypes","filter","type","includes","expireTime","Date","parse","Number","NaN","isFinite","webRiskUriForHost","host","createWebRiskHttpClient","options","request","fetch","timeoutMs","searchUri","uri","token","accessToken","url","URL","endpoint","searchParams","append","set","controller","AbortController","timer","setTimeout","abort","response","toString","method","headers","Authorization","Accept","signal","ok","text","catch","json","clearTimeout","serviceAccountAccessToken","credential","getAccessToken","access_token","defaultClient","clientOverride","activeClient","undefined","memory","Map","settingsMemo","backoffUntilMs","lastWarnAtMs","resetWebRiskForTests","client","clear","warn","nowMs","message","error","console","webRiskSettings","atMs","settings","app","firestore","collection","doc","get","then","snapshot","off","mode","webRiskLookupMode","now","platformReputationExclusions","Boolean","isPlatformHost","some","domain","endsWith","webRiskUrlVerdictId","update","digest","isAddress","key","verdictFrom","data","checkedAtMs","expiresAtMs","remember","verdict","size","has","memoryUntilMs","length","Math","min","fromMemory","known","lookupLinkReputation","hosts","lookupLinkReputationOrThrow","unknown","Set","map","raw","hits","clean","looked","result","wanted","push","maxHosts","urls","maxUrls","hostOf","unknownTo","keys","missingHosts","missingUrls","mayAsk","hostCollection","urlCollection","snapshots","getAll","forEach","index","exists","answered","ask","answer","document","pipelines","hostVerdict","Promise","all","race","allSettled","resolve","deadlineMs","late","verdictOf","reapExpiredWebRiskUrlVerdicts","stale","where","limit","docs","ref","delete","installLinkReputationLookup"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAqE2C,GAE3C,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,WAAW,QAAQ,qCAAoC;AAChE,SACEC,iBAAiB,EAGjBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,uBAAuB,EACvBC,uBAAuB,EACvBC,kBAAkB,EAClBC,uBAAuB,QAClB,2CAA0C;AACjD,SAASC,MAAM,QAAQ,qBAAoB;AAC3C,OAAOC,mBAAmB,sBAAkB;AAE5C,OAAO,MAAMC,2BAA2B,gDAA+C;AACvF,yBAAyB,GACzB,OAAO,MAAMC,4BAA4B,kBAAiB;AAC1D,wFAAwF,GACxF,OAAO,MAAMC,gCAAgC,qBAAoB;AACjE;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,mBAAkB;AAC9D,OAAO,MAAMC,wBAAwB,UAAS;AAK9C,uBAAuB,GACvB,OAAO,MAAMC,sBAAsB,KAAK;AACxC,yEAAyE,GACzE,OAAO,MAAMC,uBAAuB,KAAK;AACzC,kDAAkD,GAClD,OAAO,MAAMC,wBAAwB,KAAK,KAAK,MAAM;AACrD,mEAAmE,GACnE,OAAO,MAAMC,+BAA+B,KAAK,MAAM;AACvD,oEAAoE,GACpE,OAAO,MAAMC,kCAAkC,IAAI,MAAM;AACzD,oEAAoE,GACpE,OAAO,MAAMC,8BAA8B,MAAM;AACjD,oEAAoE,GACpE,OAAO,MAAMC,gCAAgC,KAAK,KAAK,MAAM;AAC7D,8CAA8C,GAC9C,MAAMC,gBAAgB;AACtB,oDAAoD,GACpD,MAAMC,qBAAqB,KAAK;AAChC,4CAA4C,GAC5C,MAAMC,uBAAuB;AAC7B,wEAAwE,GACxE,MAAMC,gBAAgB;AAetB,0DAA0D,GAC1D,OAAO,MAAMC,yBAAyBC;IACpC,YACE,AAASC,MAAc,EACvBC,MAAc,CACd;QACA,KAAK,CAAC,CAAC,kBAAkB,EAAED,OAAO,EAAE,EAAEC,OAAOC,KAAK,CAAC,GAAG,MAAM,QAHnDF,SAAAA;QAIT,IAAI,CAACG,IAAI,GAAG;IACd;AACF;AAEA,yCAAyC,GACzC,OAAO,MAAMC,gCAAgCL;IAC3C,YAAYM,MAAc,CAAE;QAC1B,KAAK,CAACA;QACN,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,6EAA6E,GAC7E,OAAO,SAASG,mBAAmBC,IAAa;IAC9C,MAAMC,SAAUD,wBAAD,AAACA,KACZC,MAAM;IACV,IAAI,CAACA,UAAU,OAAOA,WAAW,UAAU,OAAO;QAAEC,SAAS,EAAE;QAAEC,cAAc;IAAK;IACpF,MAAMC,SAASC,MAAMC,OAAO,CAACL,OAAOM,WAAW,IAAIN,OAAOM,WAAW,GAAG,EAAE;IAC1E,MAAML,UAAUpC,kBAAkB0C,MAAM,CAAC,CAACC,OAASL,OAAOM,QAAQ,CAACD;IACnE,MAAMN,eACJ,OAAOF,OAAOU,UAAU,KAAK,WAAWC,KAAKC,KAAK,CAACZ,OAAOU,UAAU,IAAIG,OAAOC,GAAG;IACpF,OAAO;QAAEb;QAASC,cAAcW,OAAOE,QAAQ,CAACb,gBAAgBA,eAAe;IAAK;AACtF;AAEA,4EAA4E,GAC5E,OAAO,SAASc,kBAAkBC,IAAY;IAC5C,OAAO,CAAC,QAAQ,EAAEA,KAAK,CAAC,CAAC;AAC3B;AAEA,sEAAsE,GACtE,OAAO,SAASC,wBAAwBC,OAKvC;QACiBA,gBACEA;IADlB,MAAMC,WAAUD,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBE;IACjC,MAAMC,aAAYH,qBAAAA,QAAQG,SAAS,YAAjBH,qBAAqBxC;IACvC,OAAO;QACL,MAAM4C,WAAUC,GAAW;gBAGLL;YAFpB,MAAMM,QAAQ,MAAMN,QAAQO,WAAW;YACvC,IAAI,CAACD,OAAO,MAAM,IAAI7B,wBAAwB;YAC9C,MAAM+B,MAAM,IAAIC,KAAIT,oBAAAA,QAAQU,QAAQ,YAAhBV,oBAAoB7C;YACxC,KAAK,MAAMkC,QAAQ3C,kBAAmB8D,IAAIG,YAAY,CAACC,MAAM,CAAC,eAAevB;YAC7EmB,IAAIG,YAAY,CAACE,GAAG,CAAC,OAAOR;YAC5B,MAAMS,aAAa,IAAIC;YACvB,MAAMC,QAAQC,WAAW,IAAMH,WAAWI,KAAK,IAAIf;YACnD,IAAI;gBACF,MAAMgB,WAAW,MAAMlB,QAAQO,IAAIY,QAAQ,IAAI;oBAC7CC,QAAQ;oBACRC,SAAS;wBAAEC,eAAe,CAAC,OAAO,EAAEjB,OAAO;wBAAEkB,QAAQ;oBAAmB;oBACxEC,QAAQX,WAAWW,MAAM;gBAC3B;gBACA,IAAI,CAACN,SAASO,EAAE,EAAE;oBAChB,MAAM,IAAIvD,iBAAiBgD,SAAS9C,MAAM,EAAE,MAAM8C,SAASQ,IAAI,GAAGC,KAAK,CAAC,IAAM;gBAChF;gBACA,OAAOjD,mBAAmB,MAAMwC,SAASU,IAAI;YAC/C,SAAU;gBACRC,aAAad;YACf;QACF;IACF;AACF;AAEA;;;CAGC,GACD,eAAee;IACb,IAAI;;YAGM;QAFR,MAAMC,aAAa/E,SAAS+C,OAAO,CAACgC,UAAU;QAC9C,IAAI,CAACA,YAAY,OAAO;QACxB,gBAAQ,QAAA,MAAMA,WAAWC,cAAc,uBAAhC,AAAC,MAAoCC,YAAY,mBAAI;IAC9D,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,IAAIC,gBAAsC;AAC1C,IAAIC;AAEJ,SAASC;IACP,IAAID,mBAAmBE,WAAW,OAAOF;IACzCD,wBAAAA,gBAAAA,gBAAkBpC,wBAAwB;QAAEQ,aAAawB;IAA0B;IACnF,OAAOI;AACT;AASA,4FAA4F,GAC5F,MAAMI,SAAS,IAAIC;AACnB,IAAIC,eAA+E;AACnF,IAAIC,iBAAiB;AACrB,IAAIC,eAAe;AAEnB,4FAA4F,GAC5F,OAAO,SAASC,qBAAqBC,MAA6B;IAChEN,OAAOO,KAAK;IACZL,eAAe;IACfC,iBAAiB;IACjBC,eAAe;IACfP,iBAAiBS;IACjBV,gBAAgB;AAClB;AAEA,SAASY,KAAKC,KAAa,EAAEC,OAAe,EAAEC,KAAe;IAC3D,IAAIF,QAAQL,eAAezE,eAAe;IAC1CyE,eAAeK;IACfG,QAAQJ,IAAI,CAAC,CAAC,WAAW,EAAEE,QAAQ,0CAA0C,CAAC,EAAEC,gBAAAA,QAAS;AAC3F;AAEA;;;CAGC,GACD,eAAeE,gBAAgBJ,KAAa;IAC1C,IAAIP,gBAAgBO,QAAQP,aAAaY,IAAI,GAAGtF,eAAe,OAAO0E;IACtE,MAAMa,WAAW,MAAMpG,cACpBqG,GAAG,GACHC,SAAS,GACTC,UAAU,CAACnG,8BACXoG,GAAG,CAACnG,uBACJoG,GAAG,GACHC,IAAI,CACH,CAACC,WAAc,CAAA;YACbC,KAAKD,SAASF,GAAG,CAAC,eAAe;YACjCI,MAAMF,SAASF,GAAG,CAAC,kBAAkB,QAAS,QAAmB;QACnE,CAAA,GACA,IAAO,CAAA;YAAEG,KAAK;YAAOC,MAAM;QAAgB,CAAA;IAE/CtB,eAAe,aAAKa;QAAUD,MAAML;;IACpC,OAAOM;AACT;AAEA;;;CAGC,GACD,OAAO,eAAeU,kBAAkBhB,QAAgBxD,KAAKyE,GAAG,EAAE;IAChE,MAAMX,WAAW,MAAMF,gBAAgBJ;IACvC,OAAOM,SAASQ,GAAG,GAAG,SAASR,SAASS,IAAI;AAC9C;AAEA;;;CAGC,GACD,OAAO,SAASG;IACd,OAAO;QAACzH;KAAY,CAAC2C,MAAM,CAAC+E;AAC9B;AAEA,SAASC,eAAetE,IAAY;IAClC,OAAOoE,+BAA+BG,IAAI,CACxC,CAACC,SAAWxE,SAASwE,UAAUxE,KAAKyE,QAAQ,CAAC,CAAC,CAAC,EAAED,QAAQ;AAE7D;AAEA,8GAA8G,GAC9G,OAAO,SAASE,oBAAoBhE,GAAW;IAC7C,OAAOhE,WAAW,UAAUiI,MAAM,CAACjE,KAAKkE,MAAM,CAAC;AACjD;AAEA,SAASC,UAAUC,GAAW;IAC5B,OAAOA,IAAItF,QAAQ,CAAC;AACtB;AAEA,mFAAmF,GACnF,SAASuF,YAAYC,IAAyC,EAAEtE,GAAY;IAC1E,IAAI,CAACsE,MAAM,OAAO;IAClB,IAAItE,QAAQ8B,aAAawC,IAAI,CAAC,MAAM,KAAKtE,KAAK,OAAO;IACrD,MAAM1B,UAAUG,MAAMC,OAAO,CAAC4F,IAAI,CAAC,UAAU,IACzCpI,kBAAkB0C,MAAM,CAAC,CAACC,OAAS,AAACyF,IAAI,CAAC,UAAU,CAAexF,QAAQ,CAACD,SAC3E,EAAE;IACN,MAAM0F,cAAcrF,OAAOoF,IAAI,CAAC,cAAc;IAC9C,MAAME,cAActF,OAAOoF,IAAI,CAAC,cAAc;IAC9C,IAAI,CAACpF,OAAOE,QAAQ,CAACmF,gBAAgB,CAACrF,OAAOE,QAAQ,CAACoF,cAAc,OAAO;IAC3E,OAAO;QAAElG;QAASiG;QAAaC;IAAY;AAC7C;AAEA,SAASC,SAASL,GAAW,EAAEM,OAAgB,EAAElC,KAAa;IAC5D,IAAIT,OAAO4C,IAAI,IAAItH,+BAA+B,CAAC0E,OAAO6C,GAAG,CAACR,MAAMrC,OAAOO,KAAK;IAChFP,OAAO1B,GAAG,CAAC+D,KAAK,aACXM;QACHG,eAAeH,QAAQpG,OAAO,CAACwG,MAAM,GACjCJ,QAAQF,WAAW,GACnBO,KAAKC,GAAG,CAACN,QAAQF,WAAW,EAAEhC,QAAQrF;;AAE9C;AAEA,SAAS8H,WAAWb,GAAW,EAAE5B,KAAa;IAC5C,MAAM0C,QAAQnD,OAAOoB,GAAG,CAACiB;IACzB,OAAOc,SAAS1C,QAAQ0C,MAAML,aAAa,GAAGK,QAAQ;AACxD;AAuBA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeC,qBACpBC,KAAwB,EACxB5F,UAAuC,CAAC,CAAC;IAEzC,IAAI;QACF,OAAO,MAAM6F,4BAA4BD,OAAO5F;IAClD,EAAE,OAAOkD,OAAO;YACTlD;QAAL+C,MAAK/C,iBAAAA,QAAQgD,KAAK,YAAbhD,iBAAiBR,KAAKyE,GAAG,IAAI,0CAA0Cf;QAC5E,MAAM4C,UAAU;eACX,IAAIC,IACLH,MACGI,GAAG,CAAC,CAACC,MAAQpJ,wBAAwBoJ,MACrC7G,MAAM,CAAC,CAACU,OAAyBqE,QAAQrE;SAE/C;QACD,OAAO;YAAEoG,MAAM,EAAE;YAAEC,OAAO,EAAE;YAAEL;YAASM,QAAQ;QAAE;IACnD;AACF;AAEA,eAAeP,4BACbD,KAAwB,EACxB5F,OAAoC;QAEtBA,gBAY+BA;QADlCA;IAXX,MAAMgD,SAAQhD,iBAAAA,QAAQgD,KAAK,YAAbhD,iBAAiBR,KAAKyE,GAAG;IACvC,MAAMoC,SAAqC;QAAEH,MAAM,EAAE;QAAEC,OAAO,EAAE;QAAEL,SAAS,EAAE;QAAEM,QAAQ;IAAE;IACzF,MAAME,SAAmB,EAAE;IAC3B,KAAK,MAAML,OAAOL,MAAO;YAIG5F;QAH1B,MAAMF,OAAOjD,wBAAwBoJ;QACrC,IAAI,CAACnG,QAAQwG,OAAOhH,QAAQ,CAACQ,SAASuG,OAAOF,KAAK,CAAC7G,QAAQ,CAACQ,OAAO;QACnE,IAAIsE,eAAetE,OAAOuG,OAAOF,KAAK,CAACI,IAAI,CAACzG;aACvC,IAAIwG,OAAOhB,MAAM,KAAItF,oBAAAA,QAAQwG,QAAQ,YAAhBxG,oBAAoBrD,kCAAkC2J,OAAOC,IAAI,CAACzG;aACvFuG,OAAOP,OAAO,CAACS,IAAI,CAACzG;IAC3B;IACA,IAAI,CAACwG,OAAOhB,MAAM,EAAE,OAAOe;IAC3B,IAAII,OAAOzG,EAAAA,gBAAAA,QAAQyG,IAAI,qBAAZzG,cAAcsF,MAAM,IAC3BvI,mBAAmBiD,QAAQyG,IAAI,EAAEH,SAAQtG,mBAAAA,QAAQ0G,OAAO,YAAf1G,mBAAmBpD,kCAC5D,EAAE;IACN,MAAM+J,SAAS,IAAInE,IAAIiE,KAAKT,GAAG,CAAC,CAACxF;;YAAc1D;eAAN;YAAC0D;qBAAK1D,2BAAAA,wBAAwB0D,yBAAxB1D,yBAA8BgD,IAAI,mBAAI;SAAG;;IAExF,0DAA0D;IAC1D,MAAM4F,QAAQ,IAAIlD;IAClB,MAAMoE,YAAY,CAACC,OACjBA,KAAKzH,MAAM,CAAC,CAACwF;YACX,MAAMM,UAAUO,WAAWb,KAAK5B;YAChC,IAAIkC,SAASQ,MAAM7E,GAAG,CAAC+D,KAAKM;YAC5B,OAAO,CAACA;QACV;IAEF,2CAA2C;IAC3C,IAAI4B,eAAeF,UAAUN;IAC7B,IAAIS,cAAwB,EAAE;IAC9B,IAAIC,SAAS;IAEb,mEAAmE;IACnE,uEAAuE;IACvE,IAAIF,aAAaxB,MAAM,IAAImB,KAAKnB,MAAM,EAAE;QACtC,MAAMhC,WAAW,MAAMF,gBAAgBJ;QACvC,IAAIM,SAASQ,GAAG,IAAIR,SAASS,IAAI,KAAK,OAAO0C,OAAO,EAAE;QACtD,IAAInD,SAASQ,GAAG,EAAEkD,SAAS;QAC3B,gEAAgE;QAChEP,OAAOA,KAAKrH,MAAM,CAAC,CAACoB;gBAAmBmG;gBAAVjB;mBAAD,GAACA,aAAAA,MAAM/B,GAAG,EAACgD,cAAAA,OAAOhD,GAAG,CAACnD,gBAAXmG,cAAmB,wBAA7BjB,WAAkC5G,OAAO,CAACwG,MAAM;;QAC7E,gDAAgD;QAChDyB,cAAcH,UAAUH;IAC1B;IAEA,uDAAuD;IACvD,MAAMjD,YAAYtG,cAAcqG,GAAG,GAAGC,SAAS;IAC/C,MAAMyD,iBAAiBzD,UAAUC,UAAU,CAACrG;IAC5C,MAAM8J,gBAAgB1D,UAAUC,UAAU,CAACpG;IAC3C,IAAI2J,UAAWF,CAAAA,aAAaxB,MAAM,IAAIyB,YAAYzB,MAAM,AAAD,GAAI;QACzD,MAAMuB,OAAO;eAAIC;eAAiBC;SAAY;QAC9C,IAAI;YACF,MAAMI,YAAY,MAAM3D,UAAU4D,MAAM,IACnCP,KAAKb,GAAG,CAAC,CAACpB,MACXD,UAAUC,OAAOsC,cAAcxD,GAAG,CAACc,oBAAoBI,QAAQqC,eAAevD,GAAG,CAACkB;YAGtFuC,UAAUE,OAAO,CAAC,CAACxD,UAAUyD;gBAC3B,MAAM1C,MAAMiC,IAAI,CAACS,MAAM;gBACvB,MAAMxC,OAAOjB,SAAS0D,MAAM,GAAI1D,SAASiB,IAAI,KAAiCxC;gBAC9E,MAAM4C,UAAUL,YAAYC,MAAMH,UAAUC,OAAOA,MAAMtC;gBACzD,IAAI,CAAC4C,WAAWlC,SAASkC,QAAQF,WAAW,EAAE;gBAC9CC,SAASL,KAAKM,SAASlC;gBACvB0C,MAAM7E,GAAG,CAAC+D,KAAKM;YACjB;YACA4B,eAAeA,aAAa1H,MAAM,CAAC,CAACU,OAAS,CAAC4F,MAAMN,GAAG,CAACtF;YACxDiH,cAAcA,YAAY3H,MAAM,CAAC,CAACoB,MAAQ,CAACkF,MAAMN,GAAG,CAAC5E;QACvD,EAAE,OAAO0C,OAAO;YACdH,KAAKC,OAAO,uCAAuCE;QACrD;IACF;IAEA,sEAAsE;IACtE,qEAAqE;IACrE,MAAMsE,WAAW,IAAIhF;IACrB,MAAMK,SAASR;IACf,IAAI2E,UAAUnE,UAAUG,SAASN,kBAAmBoE,CAAAA,aAAaxB,MAAM,IAAIyB,YAAYzB,MAAM,AAAD,GAAI;QAC9F,IAAIc,SAAS;QACb,MAAMqB,MAAM,OAAO7C;YACjB,IAAIpF,KAAKyE,GAAG,KAAKvB,gBAAgB,OAAO;YACxC0D,UAAU;YACV,IAAI;oBAOKsB,sBAQYf;gBAdnB,MAAMe,SAAS,MAAM7E,OAAOzC,SAAS,CAACuE,UAAUC,OAAOA,MAAM/E,kBAAkB+E;gBAC/E,MAAMG,cAAcvF,KAAKyE,GAAG;gBAC5B,MAAMiB,UAAmB;oBACvBpG,SAAS4I,OAAO5I,OAAO;oBACvBiG;oBACAC,aAAa0C,OAAO5I,OAAO,CAACwG,MAAM,IAC7BoC,uBAAAA,OAAO3I,YAAY,YAAnB2I,uBAAuB3C,cAAcnH,kCACtCmH,cAAcrH;gBACpB;gBACA8J,SAAS3G,GAAG,CAAC+D,KAAKM;gBAClBD,SAASL,KAAKM,SAASH;gBACvB,MAAM4C,WAAWhD,UAAUC,OACvBsC,cACGxD,GAAG,CAACc,oBAAoBI,MACxB/D,GAAG,CAAC;oBAAEf,IAAI,GAAE6G,cAAAA,OAAOhD,GAAG,CAACiB,gBAAX+B,cAAmB;oBAAInG,KAAKoE;mBAAQM;oBAASlG,QAAQkG,QAAQpG,OAAO,CAACwG,MAAM,GAAG;sBAC7F2B,eAAevD,GAAG,CAACkB,KAAK/D,GAAG,CAAC;oBAAEf,MAAM8E;mBAAQM;oBAASlG,QAAQkG,QAAQpG,OAAO,CAACwG,MAAM,GAAG;;gBAC1F,MAAMqC,SAAS/F,KAAK,CAAC,CAACsB,QAAmBH,KAAKgC,aAAa,iCAAiC7B;gBAC5F,OAAOgC;YACT,EAAE,OAAOhC,OAAO;gBACd,IAAIA,iBAAiB/E,oBAAoB;oBAAC;oBAAK;oBAAK;iBAAI,CAACmB,QAAQ,CAAC4D,MAAM7E,MAAM,GAAG;oBAC/EqE,iBAAiBlD,KAAKyE,GAAG,KAAKjG;oBAC9BmF,QAAQD,KAAK,CAAC,6EAA6EA;gBAC7F,OAAO,IAAIA,iBAAiB/E,oBAAoB+E,MAAM7E,MAAM,KAAK,KAAK;oBACpEqE,iBAAiBlD,KAAKyE,GAAG,KAAKhG;oBAC9B8E,KAAKvD,KAAKyE,GAAG,IAAI,4BAA4Bf;gBAC/C,OAAO,IAAIA,iBAAiBzE,yBAAyB;oBACnDiE,iBAAiBlD,KAAKyE,GAAG,KAAKjG;oBAC9B+E,KAAKvD,KAAKyE,GAAG,IAAI,sCAAsCf;gBACzD,OAAO;oBACLH,KAAKvD,KAAKyE,GAAG,IAAI,CAAC,cAAc,EAAEW,IAAI,oBAAoB,CAAC,EAAE1B;gBAC/D;gBACA,OAAO;YACT;QACF;QACA,MAAM0E,YAAYtB,OAAON,GAAG,CAAC,OAAOlG;gBACd4F;YAApB,MAAMmC,eAAcnC,aAAAA,MAAM/B,GAAG,CAAC7D,iBAAV4F,aAAoBoB,aAAaxH,QAAQ,CAACQ,QAAQ,MAAM2H,IAAI3H,QAAQ;YACxF,IAAI+H,+BAAAA,YAAa/I,OAAO,CAACwG,MAAM,EAAE;YACjC,MAAMwC,QAAQC,GAAG,CAAChB,YAAY3H,MAAM,CAAC,CAACoB,MAAQmG,OAAOhD,GAAG,CAACnD,SAASV,MAAMkG,GAAG,CAAC,CAACxF,MAAQiH,IAAIjH;QAC3F;QACA,IAAIQ;QACJ,MAAM8G,QAAQE,IAAI,CAAC;YACjBF,QAAQG,UAAU,CAACL;YACnB,IAAIE,QAAc,CAACI;oBACWlI;gBAA5BgB,QAAQC,WAAWiH,UAASlI,sBAAAA,QAAQmI,UAAU,YAAlBnI,sBAAsBvC;YACpD;SACD;QACD,IAAIuD,OAAOc,aAAad;QACxBqF,OAAOD,MAAM,GAAGA;QAChB,MAAMgC,OAAO;eAAItB;eAAiBC;SAAY,CAAC3H,MAAM,CAAC,CAACwF,MAAQ,CAAC4C,SAASpC,GAAG,CAACR,MAAMU,MAAM;QACzF,IAAI8C,MAAMrF,KAAKvD,KAAKyE,GAAG,IAAI,GAAGmE,KAAK,yDAAyD,CAAC;IAC/F;IAEA,yEAAyE;IACzE,+BAA+B;IAC/B,MAAMC,YAAY,CAACzD;YAAgBc;gBAAAA,aAAAA,MAAM/B,GAAG,CAACiB,gBAAVc,aAAkB8B,SAAS7D,GAAG,CAACiB;;IAClE,KAAK,MAAM9E,QAAQwG,OAAQ;QACzB,MAAMpB,UAAUmD,UAAUvI;QAC1B,IAAI,CAACoF,SAASmB,OAAOP,OAAO,CAACS,IAAI,CAACzG;aAC7B,IAAIoF,QAAQpG,OAAO,CAACwG,MAAM,EAAEe,OAAOH,IAAI,CAACK,IAAI,CAAC;YAAEzG;YAAMhB,SAASoG,QAAQpG,OAAO;QAAC;aAC9EuH,OAAOF,KAAK,CAACI,IAAI,CAACzG;IACzB;IACA,KAAK,MAAMU,OAAOiG,KAAM;YACTE;YACT0B;QADJ,MAAMvI,QAAO6G,cAAAA,OAAOhD,GAAG,CAACnD,gBAAXmG,cAAmB;QAChC,KAAI0B,aAAAA,UAAUvI,0BAAVuI,WAAiBvJ,OAAO,CAACwG,MAAM,EAAE;QACrC,MAAMJ,UAAUmD,UAAU7H;QAC1B,IAAI,CAAC0E,SAASmB,OAAOP,OAAO,CAACS,IAAI,CAAC/F;aAC7B,IAAI0E,QAAQpG,OAAO,CAACwG,MAAM,EAAEe,OAAOH,IAAI,CAACK,IAAI,CAAC;YAAEzG;YAAMU;YAAK1B,SAASoG,QAAQpG,OAAO;QAAC;aACnFuH,OAAOF,KAAK,CAACI,IAAI,CAAC/F;IACzB;IACA,OAAO6F;AACT;AAEA;;;;;CAKC,GACD,OAAO,eAAeiC,8BACpBtI,UAAuF,CAAC,CAAC;QAE3EA,gBACIA;IADlB,MAAMgD,SAAQhD,iBAAAA,QAAQgD,KAAK,YAAbhD,iBAAiBR,KAAKyE,GAAG;IACvC,MAAMT,aAAYxD,qBAAAA,QAAQwD,SAAS,YAAjBxD,qBAAqB9C,cAAcqG,GAAG,GAAGC,SAAS;IACpE,IAAI;YAIOxD;QAHT,MAAMuI,QAAQ,MAAM/E,UACjBC,UAAU,CAACpG,+BACXmL,KAAK,CAAC,eAAe,KAAKxF,QAAQlF,+BAClC2K,KAAK,EAACzI,iBAAAA,QAAQyI,KAAK,YAAbzI,iBAAiB,KACvB2D,GAAG;QACN,MAAMmE,QAAQC,GAAG,CAACQ,MAAMG,IAAI,CAAC1C,GAAG,CAAC,CAACnC,WAAaA,SAAS8E,GAAG,CAACC,MAAM;QAClE,OAAOL,MAAMG,IAAI,CAACpD,MAAM;IAC1B,EAAE,OAAOpC,OAAO;QACdC,QAAQJ,IAAI,CAAC,4DAA4DG;QACzE,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,SAAS2F;IACd,IAAI,OAAO7L,4BAA4B,YAAY;IACnDA,wBAAwB,CAAC4I,OAAO5F,UAC9B2F,qBAAqBC,OAAO;YAAEuC,UAAU,EAAEnI,2BAAAA,QAASmI,UAAU;YAAE1B,IAAI,EAAEzG,2BAAAA,QAASyG,IAAI;QAAC;AAEvF"}

package/src/tenancy.d.ts

@@ -52,7 +52,6 @@ export * from './lib/server/edit-access-authz';
 export * from './lib/server/edit-access-token';
 export * from './lib/server/edit-hint-token';
 export * from './lib/server/email-metering';
-export * from './lib/server/campaign-conversion-attribution';
 export * from './lib/server/email-send-rate';
 export * from './lib/server/email-deliverability';
 export * from './lib/server/email-sender-reputation';
@@ -77,6 +76,8 @@ export * from './lib/server/operator-alerts';
 export * from './lib/server/operator-health';
 export * from './lib/server/org-billing';
 export * from './lib/server/organizations';
+export * from './lib/server/staff-seat';
+export * from './lib/server/upgrade-proposal';
 export * from './lib/server/duplicate-activity';
 export * from './lib/server/duplicate-resource';
 export * from './lib/server/workspace-domains';
@@ -102,6 +103,7 @@ export * from './lib/server/media-storage-path';
 export * from './lib/server/safe-equal';
 export * from './lib/server/media-strong-digest';
 export * from './lib/server/media-tombstone';
+export * from './lib/server/media-delivery-regeneration';
 export * from './lib/server/media-variants';
 export * from './lib/server/serve-media-cdn';
 export * from './lib/server/serve-plugin-fetch';