@aglyn/tenant-data-admin 1.0.0-beta.220 → 1.0.0-beta.222

package/src/lib/server/hosted-page-review.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/hosted-page-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * HELD FOR REVIEW: a published page (AGL-3362).\n *\n * ## Why the check sits where a page is COMPOSED, not where it is published\n *\n * A publish is a browser write. The besigner toolbar, the versions panel,\n * the screen details page, page-from-template, the layout and component\n * besigners and the form besigner each move a pointer (`versionId`, the\n * host's `screens` map, a component's own `nodes`) straight from the\n * client SDK; the scheduled-publish beat moves it from the server; an\n * experiment serves a version no pointer names; and an author may rewrite\n * the LIVE version document itself without moving any pointer at all. A\n * check on any one of those writes is a check the next one walks around.\n *\n * They all meet in one place: `composeScreenNodes` (`@aglyn/tenant-runtime`),\n * which every published render, the password unlock, the collection and\n * product templates and every experiment variant go through, and which\n * returns the page exactly as a visitor will receive it — the screen, its\n * layout chrome, its grafted components and its forms. So the screen is read\n * there, and a held page is one that is never composed for a visitor. For a\n * visitor, \"publish\" is the first render after the pointer moved; this is\n * that moment.\n *\n * ## What a hold does\n *\n * - The version is not served. The last version this page served clean\n *   ({@link servedPageVersion}) is composed instead — screened again, since\n *   a version document can be edited in place — and if there is none, or it\n *   holds too, the page is not found. A first publish that holds therefore\n *   serves nothing.\n * - One review row per (page, signal set) lands in the abuse queue at\n *   `/admin/abuse-reports`, the same `phishing` row a held email files\n *   (`fileOutboundHold`), with `heldSend.kind: 'page'`, the page's URL and\n *   the held version. Staff dismiss it to RELEASE (the admin route drops the\n *   site's cache and the next render serves it) or mark it actioned to\n *   REJECT (it stays unserved; any later version carrying the same signals\n *   is refused without a new row).\n * - Keyed on the SIGNALS, as the send seam's rows are: a composed page\n *   carries per-render values (dates, collection rows) that no content hash\n *   would survive, while what makes it phishing does not change between\n *   renders.\n *\n * ## Tiers\n *\n * `signalsThatHold`: a lookalike link or embed and an author-defined\n * credential field hold for EVERY workspace; a brand's call to action or\n * lure, and a call to action that leaves the site beside a lure, only for a\n * workspace in its first fortnight. The workspace's documents are read only\n * when the pure screen has found something, so a clean page costs no read\n * for this.\n *\n * Fails CLOSED, unlike the send path: a page the pure screen flagged whose\n * review cannot finish — the workspace read, the row write — is answered\n * `held`, and the composer serves its last clean version or nothing. The\n * answer is not remembered, so the next render reviews it again. Composition\n * itself reads the store, so an outage here is an outage on the render\n * already, and the only cost of not serving a page the screen flagged is a\n * false positive's wait; serving it is the phishing page this exists to\n * stop. A page the screen found nothing on never reaches this.\n *\n * ## Site redirects\n *\n * A redirect rule that sends a path off the site is a page whose one call to\n * action fires on arrival, so the redirects plugin asks\n * {@link reviewSiteRedirect} before it serves one. Same screen\n * (`screenSiteRedirect`), same tiers, same row and the same staff decision:\n * a held rule does not fire, and is filed as a `page` hold on its rule's\n * document.\n *=========================================*/\n\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport {\n  heldPageConsolePath,\n  heldPageDetails,\n  heldPageLabel,\n  heldPageVisitorSentence,\n  type HeldPageSubject,\n} from '@aglyn/shared-util-email/held-page'\nimport { screenHostedPage, screenSiteRedirect } from '@aglyn/shared-util-email/hosted-page-screen'\nimport {\n  lookalikeBrandForHost,\n  phishingScreenBrandLabel,\n  type PhishingScreenSignal,\n  describePhishingScreenSignals,\n  isYoungWorkspaceAge,\n  signalsThatHold,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { describeHeldPage, type HostedPageContext } from './held-page-subject'\nimport { notifyRiskEvent } from './risk-notice'\nimport { orgAgeDays } from './org-age'\nimport { getHostDocAdmin, getOrgForHost } from './organizations'\nimport {\n  canonicalJson,\n  fileOutboundHold,\n  flaggedHostOf,\n  heldOutboundReference,\n  heldOutboundReviewId,\n  outboundContentHash,\n  type HeldOutboundSendState,\n  workspaceScreenIdentity,\n} from './outbound-send-review'\n\n/** Where the last version a page served clean is noted: a hint, re-screened before use. */\nexport const PAGE_REVIEW_SUBCOLLECTION = 'pageReviews'\n\nexport interface HostedPageReviewRequest {\n  hostId: string\n  screenId: string\n  versionId: string\n  /** The page as composed for a visitor. */\n  nodes: unknown\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n  /**\n   * What the composer knows about the page (AGL-3374): the screen document,\n   * the template route it is rendering, the variant, and a way to read the\n   * layouts and components composed into it. Read only when a row is filed,\n   * to name the page — never to decide whether it serves.\n   */\n  page?: HostedPageContext | null\n}\n\nexport type HostedPageReviewOutcome =\n  | { outcome: 'serve' }\n  | { outcome: 'held' | 'rejected'; reviewId: string; reference: string }\n\n/** The review row's id for a page and the signals that held. */\nexport function pageReviewId(\n  hostId: string,\n  screenId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/screens/${screenId}`, outboundContentHash([key]))\n}\n\n/** How long this process trusts a page row's state — the send seam's minute. */\nconst PAGE_MEMO_TTL_MS = 60_000\nconst pageMemo = new Map<string, { state: HeldOutboundSendState; atMs: number }>()\n/** The version each page last served clean, as this process last wrote it. */\nconst servedMemo = new Map<string, string>()\n/** Lookalike hosts this process already flagged for an established page, and when. */\nconst flaggedMemo = new Map<string, number>()\nconst FLAGGED_MEMO_TTL_MS = 60 * 60_000\n\n/** Test seam: forget what this process learned. */\nexport function resetHostedPageReviewMemoForTests(): void {\n  pageMemo.clear()\n  servedMemo.clear()\n  flaggedMemo.clear()\n}\n\n/**\n * The subject a row already stored, or a fresh description (AGL-3374). A row\n * that names its page is not described again, so the reads the description\n * may make are paid once per row, not once per render.\n */\nasync function subjectForRow(\n  reviewId: string,\n  describe: () => Promise<HeldPageSubject>,\n): Promise<HeldPageSubject> {\n  const stored = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .get()\n    .then((row) => storedSubject(row.get('heldPage')))\n    .catch(() => null)\n  return stored ?? describe()\n}\n\n/** A row's stored subject, when it has one. */\nfunction storedSubject(heldPage: unknown): HeldPageSubject | null {\n  const subject = (heldPage as { subject?: HeldPageSubject } | null | undefined)?.subject\n  return subject && typeof subject === 'object' && subject.screenId ? subject : null\n}\n\n/** The row's first line, naming the page and where it was seen. */\nfunction pageHeadline(subject: HeldPageSubject, siteName: string): string {\n  return [`${heldPageLabel(subject)} of ${siteName}.`, ...heldPageDetails(subject)].join(' ')\n}\n\n/**\n * Screen one page as a visitor would receive it, and say whether it may be\n * served. See the module header.\n */\nexport async function reviewHostedPage(\n  request: HostedPageReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenHostedPage({ nodes: request.nodes })\n  if (!found.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    // Again, now knowing whose page it is: a brand in the workspace's own\n    // name or domain is its own, and a link to its own site is not away.\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenHostedPage({ nodes: request.nodes, ...identity })\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    // Every workspace is screened, however old: an established account can\n    // be compromised, and a compromised account publishing a lure is the\n    // same harm as a new one. What differs is what a hold may take DOWN.\n    // Holding content that is already live serves its last clean version or\n    // nothing, and on a real business's home page that is an outage the\n    // screen caused (aglyn.com, 2026-09-28, a page that had served clean\n    // until a rule changed). So for an established workspace:\n    //   - NEW content (a new version of a live page, or a page that has\n    //     never been live) holds, exactly as for a young workspace; the live\n    //     page keeps serving its last clean version, or the new page waits;\n    //   - content ALREADY LIVE keeps serving, and is flagged to staff as\n    //     urgent, who lock the site if it is impersonation.\n    if (!isYoungWorkspaceAge(ageDays)) {\n      const strong = signalsThatHold(verdict.signals, { ageDays })\n      if (!strong.length) return { outcome: 'serve' }\n      if (await isAlreadyLive(request.hostId, request.screenId, request.versionId, nowMs)) {\n        await flagLivePage({\n          hostId: request.hostId,\n          screenId: request.screenId,\n          versionId: request.versionId,\n          orgId,\n          host,\n          signals: strong,\n          nowMs,\n          page: request.page ?? null,\n          identity,\n        })\n        return { outcome: 'serve' }\n      }\n    }\n    const signals = signalsThatHold(verdict.signals, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = pageReviewId(request.hostId, request.screenId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    // The page by its real name and route (AGL-3374): a template, a list,\n    // a variant, or a page whose flagged content lives in its layout.\n    const subject = await subjectForRow(reviewId, async () =>\n      describeHeldPage({\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        host,\n        page: request.page,\n        signals,\n        identity,\n        live: false,\n        previousVersionId: await servedPageVersion(request.hostId, request.screenId),\n      }),\n    )\n    const url = subject.entryUrl ?? subject.url\n    const flagged = flaggedHostOf(signals)\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const label = heldPageLabel(subject)\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/screens/${request.screenId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      extra: {\n        heldPage: { screenId: request.screenId, versionId: request.versionId, url, subject },\n      },\n      headline:\n        `Held ${pageHeadline(subject, siteName)} Version ${request.versionId}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. ${heldPageVisitorSentence(subject)}`,\n      alertTitle: 'Published page held for review — possible phishing',\n      alertBody: `${label.charAt(0).toUpperCase()}${label.slice(1)} was held before it went live.`,\n      // The owners' words for it, and where they fix it (AGL-3368, AGL-3374).\n      item: { label, path: heldPageConsolePath(subject, request.hostId) },\n      page: subject,\n      // The page itself is what was reported; the flagged host, when there\n      // is one, is named in the details and on `reportedHostname`.\n      url,\n      reportedHostname: flagged,\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed: the screen has already found a signal on this page, and a\n    // review that could not finish has not cleared it. Not remembered, so\n    // the next render reviews it again.\n    console.error('[page-review] a flagged page could not be reviewed — holding it', error)\n    const reviewId = pageReviewId(request.hostId, request.screenId, found.signals)\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nexport interface SiteRedirectReviewRequest {\n  hostId: string\n  /** The rule's document id under `hosts/{hostId}/redirects`. */\n  ruleId: string\n  /** The path, or the pattern, the rule answers. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n}\n\n/** The review row's id for a redirect rule and the signals that held. */\nexport function redirectReviewId(\n  hostId: string,\n  ruleId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/redirects/${ruleId}`, outboundContentHash([key]))\n}\n\n/**\n * Screen one redirect rule before it sends a visitor off the site\n * (AGL-3447), and say whether it may fire. See the module header.\n *\n * Every workspace is screened and the tiers decide, as for a page: a\n * destination that wears a brand holds for all of them, a lure path sent\n * off the site only for a workspace in its first fortnight. A held rule is\n * filed once per (rule, signal set) and decided by staff on that row:\n * dismissed, it fires; actioned, it never does with those signals.\n */\nexport async function reviewSiteRedirect(\n  request: SiteRedirectReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenSiteRedirect({ source: request.source, destination: request.destination })\n  if (!found.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenSiteRedirect({\n      source: request.source,\n      destination: request.destination,\n      ...identity,\n    })\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    const signals = signalsThatHold(verdict.signals, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    const source = request.source.slice(0, 200)\n    const destination = request.destination.slice(0, 500)\n    const label = `the redirect from ${source}`\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const [subdomainHost, customDomain] = identity.ownDomains ?? []\n    const siteHost = customDomain || subdomainHost\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/redirects/${request.ruleId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      headline:\n        `Held ${label} of ${siteName}, which sends visitors to ${destination}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. The rule does not fire until this is decided.`,\n      alertTitle: 'Site redirect held for review — possible phishing',\n      alertBody: `The redirect from ${source} was held before it sent anyone off the site.`,\n      // Where the owners fix it: the site's Redirects page.\n      item: { label, path: `/${request.hostId}/redirects` },\n      url: siteHost && source.startsWith('/') ? `https://${siteHost}${source}` : destination,\n      reportedHostname: flaggedHostOf(signals),\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed, as a page is: the screen found a signal and nothing cleared it.\n    console.error('[page-review] a flagged redirect could not be reviewed — holding it', error)\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, found.signals)\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nfunction pageReviewRef(hostId: string, screenId: string) {\n  return firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection(PAGE_REVIEW_SUBCOLLECTION)\n    .doc(screenId)\n}\n\n/**\n * Is this version of the page already what visitors receive? It is when it\n * is the version the page last served clean, or when the page has no record\n * at all and is not new: it went live before the screen existed. A page\n * created in the last {@link NEW_PAGE_DAYS} days with no record has never\n * been live, so holding it takes nothing down.\n */\nconst NEW_PAGE_DAYS = 7\nasync function isAlreadyLive(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n  nowMs: number,\n): Promise<boolean> {\n  const lastClean = await servedPageVersion(hostId, screenId)\n  if (lastClean) return lastClean === versionId\n  try {\n    const screen = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('screens')\n      .doc(screenId)\n      .get()\n    const created = screen.get('createdAt') as { toMillis?: () => number } | number | undefined\n    const createdMs =\n      typeof created === 'number' ? created : typeof created?.toMillis === 'function' ? created.toMillis() : null\n    // No readable creation time: an old page, so live.\n    return createdMs === null || nowMs - createdMs >= NEW_PAGE_DAYS * 24 * 60 * 60 * 1000\n  } catch {\n    return true\n  }\n}\n\n/**\n * A page ALREADY LIVE carries a strong signal: file one urgent abuse row for\n * it (keyed on the page and its signals, so a busy page is one row) and, the\n * first time, tell staff and the owners through the `page-flagged` notice.\n * The page keeps serving; staff lock the site if it is impersonation or the\n * account looks compromised. Once per page and signal set per process.\n */\nasync function flagLivePage(input: {\n  hostId: string\n  screenId: string\n  versionId: string\n  orgId: string | null\n  host: Record<string, unknown> | null\n  signals: readonly PhishingScreenSignal[]\n  nowMs: number\n  page?: HostedPageContext | null\n  identity?: ReturnType<typeof workspaceScreenIdentity>\n}): Promise<void> {\n  const key = `${input.hostId}\\n${input.screenId}\\n${input.signals.map((signal) => canonicalJson(signal)).sort().join('\\n')}`\n  const at = flaggedMemo.get(key)\n  if (at !== undefined && input.nowMs - at < FLAGGED_MEMO_TTL_MS) return\n  flaggedMemo.set(key, input.nowMs)\n  try {\n    const reviewId = pageReviewId(input.hostId, `${input.screenId}/live`, input.signals)\n    const reference = heldOutboundReference(reviewId)\n    const evidence = describePhishingScreenSignals(input.signals).join(' ')\n    const flagged = flaggedHostOf(input.signals)\n    const ref = firebaseAdmin.app().firestore().collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const existing = await ref.get()\n    const first = !existing.exists\n    // Named once, when the row is new (AGL-3374).\n    const subject =\n      (existing.exists ? storedSubject(existing.get('heldPage')) : null) ??\n      (await describeHeldPage({\n        hostId: input.hostId,\n        screenId: input.screenId,\n        versionId: input.versionId,\n        host: input.host,\n        page: input.page,\n        signals: input.signals,\n        identity: input.identity ?? workspaceScreenIdentity({ host: input.host }),\n        live: true,\n        previousVersionId: null,\n      }))\n    const url = subject.entryUrl ?? subject.url\n    const siteName =\n      typeof input.host?.['name'] === 'string' && input.host['name']\n        ? `\"${input.host['name']}\"`\n        : 'a site'\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url,\n        reportedHostname: flagged,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          `LIVE: ${pageHeadline(subject, siteName)} It was flagged by the phishing screen and is still serving.`,\n          evidence,\n          'Lock the site if it is impersonation or the account looks compromised; dismiss this if the content is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        heldPage: { screenId: input.screenId, versionId: input.versionId, url, subject },\n        riskNotice: { kind: 'page-flagged' },\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (!first) return\n    await notifyRiskEvent({\n      kind: 'page-flagged',\n      orgId: input.orgId,\n      hostId: input.hostId,\n      reviewId,\n      reference,\n      item: { label: heldPageLabel(subject), path: heldPageConsolePath(subject, input.hostId) },\n      page: subject,\n      staffEvidence: [...heldPageDetails(subject), evidence].join(' '),\n    })\n  } catch (error) {\n    console.error('[page-review] a live page could not be flagged', error)\n  }\n}\n\n/**\n * The version this page last served clean, or null. A HINT, not a\n * clearance: the caller composes and screens it again before serving it,\n * because a version document can be edited after it was served.\n */\nexport async function servedPageVersion(hostId: string, screenId: string): Promise<string | null> {\n  try {\n    const snapshot = await pageReviewRef(hostId, screenId).get()\n    const value = snapshot.get('servedVersionId')\n    return typeof value === 'string' && value ? value : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Note that this page served `versionId` clean. One read the first time a\n * process renders a page, a write only when the version moved; nothing\n * after that, however often the page is rendered.\n */\nexport async function recordServedPageVersion(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n): Promise<void> {\n  const key = `${hostId}/${screenId}`\n  if (!versionId || servedMemo.get(key) === versionId) return\n  try {\n    const ref = pageReviewRef(hostId, screenId)\n    const snapshot = await ref.get()\n    if (snapshot.get('servedVersionId') !== versionId) {\n      await ref.set({ servedVersionId: versionId, servedAtMs: Date.now() }, { merge: true })\n    }\n    servedMemo.set(key, versionId)\n  } catch (error) {\n    console.warn('[page-review] the served version could not be noted', error)\n  }\n}\n\n/**\n * A domain a workspace attached that wears a brand (AGL-3356, AGL-3362):\n * filed in the abuse queue as an urgent `phishing` row for staff, not\n * refused. Two kinds, one rule:\n *\n * - `site` — a custom domain a site is served on (the attach route);\n * - `sending` — a custom domain a workspace sends email as, when it is\n *   added and again when it verifies (`sending-domains.ts`);\n * - `link` — a link a merchant configured that a buyer or a server would\n *   follow: a product's paid download or video hotlink, a supplier's order\n *   webhook (AGL-3363). The link itself is refused where it is followed; this\n *   files it, and tells the site's managers once ({@link notifyLookalikeLink}).\n *\n * Not refused, because the domain is the merchant's own registration and\n * the platform cannot tell a brand's own agency attaching `paypal-promo.com`\n * from a kit — but a brand's lookalike on a site or in a `From:` line is\n * exactly what staff look at first. The site's pages are still screened as\n * they are served, and mail FROM a lookalike domain is held at the send seam\n * for every workspace. The test is the phishing screen's own lookalike rule\n * (`lookalikeBrandForHost`), the one that holds a link in an email. One row\n * per (owner, kind, domain), so a re-attach or a re-verify counts rather than\n * re-alerts.\n *\n * Never throws: the write it rides on has already happened.\n */\nexport async function flagLookalikeDomain(input: {\n  kind: 'site' | 'sending' | 'link'\n  hostId: string | null\n  orgId: string | null\n  domain: string\n  /** For a `link`: where it was configured, as staff read it. */\n  where?: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  const domain = String(input.domain ?? '').trim().toLowerCase()\n  const brand = lookalikeBrandForHost(domain)\n  if (!brand) return 'clean'\n  const label = phishingScreenBrandLabel(brand.id)\n  const sending = input.kind === 'sending'\n  const link = input.kind === 'link'\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const owner = sending\n      ? `orgs/${input.orgId ?? ''}/sendingDomains`\n      : link\n        ? `hosts/${input.hostId ?? ''}/links`\n        : `hosts/${input.hostId ?? ''}/cname`\n    const reviewId = heldOutboundReviewId(owner, domain)\n    const reference = heldOutboundReference(reviewId)\n    const ref = firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const first = !(await ref.get()).exists\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url: `https://${domain}/`,\n        reportedHostname: domain,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          sending\n            ? `A workspace added ${domain} as a domain to send email from.`\n            : link\n              ? `A site configured a link to ${domain} (${input.where ?? 'a commerce link'}).`\n              : `A site attached the custom domain ${domain}.`,\n          `${domain} wears the ${label} name but is not ${label}'s domain.`,\n          sending\n            ? 'Email from it is held at the send seam for every workspace. Mark this actioned ' +\n              'and lock the workspace if it is impersonation; dismiss it if the brand is theirs.'\n            : link\n              ? 'Nobody is sent to it: the link is refused wherever it is followed. Mark this ' +\n                'actioned and lock the site if it is impersonation.'\n              : 'Its pages are still screened as they are served. Mark this actioned ' +\n                'and lock the site if it is impersonation; dismiss it if the brand is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (first && link) {\n      await notifyLookalikeLink({\n        hostId: input.hostId,\n        orgId: input.orgId,\n        domain,\n        label,\n        where: input.where ?? 'a commerce link',\n        reference,\n        reviewId,\n      })\n    } else if (first) {\n      // The owners hear that the domain is waiting on a routine review — not\n      // which name it resembles; staff get the brand and a link to the row.\n      await notifyRiskEvent({\n        kind: 'domain-flagged',\n        orgId: input.orgId,\n        hostId: input.hostId,\n        reviewId,\n        reference,\n        item: {\n          label: sending ? `the sending domain ${domain}` : `the custom domain ${domain}`,\n          // Emails → Sending, or the site's Domain settings.\n          path: sending ? '/org/emails/sending' : input.hostId ? `/${input.hostId}/admin/domain` : null,\n        },\n        staffEvidence:\n          `${sending ? 'Sending domain' : 'Custom domain'} ${domain} looks like ${label}.`,\n      })\n    }\n    return 'flagged'\n  } catch (error) {\n    console.error('[page-review] a lookalike domain could not be flagged', error)\n    return 'failed'\n  }\n}\n\n/**\n * Tell staff and the site's managers and the workspace's owners, once per\n * (site, domain), that a link the merchant configured was refused because it\n * wears another brand's name (AGL-3363), through the risk notice seam\n * (AGL-3368). The merchant reads the catalog's `link-blocked` words — what\n * was refused and how to fix it, never how the check works; staff get the\n * brand and a link to the row. Never throws.\n */\nexport async function notifyLookalikeLink(input: {\n  hostId: string | null\n  orgId?: string | null\n  domain: string\n  label: string\n  where: string\n  reference: string\n  reviewId?: string | null\n}): Promise<void> {\n  await notifyRiskEvent({\n    kind: 'link-blocked',\n    orgId: input.orgId ?? null,\n    hostId: input.hostId,\n    reviewId: input.reviewId ?? null,\n    reference: input.reference,\n    item: {\n      label: `${input.where} pointing to ${input.domain}`,\n      path: input.hostId ? `/${input.hostId}/products` : null,\n    },\n    staffEvidence:\n      `A site configured ${input.where} to ${input.domain}, which looks like ${input.label}. ` +\n      'It is refused wherever it is followed.',\n  }).catch(() => undefined)\n}\n\n/** A site's custom domain, through {@link flagLookalikeDomain}. */\nexport function flagLookalikeCustomDomain(input: {\n  hostId: string\n  orgId: string | null\n  domain: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  return flagLookalikeDomain({ kind: 'site', ...input })\n}\n"],"names":["ABUSE_REPORT_COLLECTION","heldPageConsolePath","heldPageDetails","heldPageLabel","heldPageVisitorSentence","screenHostedPage","screenSiteRedirect","lookalikeBrandForHost","phishingScreenBrandLabel","describePhishingScreenSignals","isYoungWorkspaceAge","signalsThatHold","FieldValue","firebaseAdmin","describeHeldPage","notifyRiskEvent","orgAgeDays","getHostDocAdmin","getOrgForHost","canonicalJson","fileOutboundHold","flaggedHostOf","heldOutboundReference","heldOutboundReviewId","outboundContentHash","workspaceScreenIdentity","PAGE_REVIEW_SUBCOLLECTION","pageReviewId","hostId","screenId","signals","key","map","signal","sort","join","PAGE_MEMO_TTL_MS","pageMemo","Map","servedMemo","flaggedMemo","FLAGGED_MEMO_TTL_MS","resetHostedPageReviewMemoForTests","clear","subjectForRow","reviewId","describe","stored","app","firestore","collection","doc","get","then","row","storedSubject","catch","heldPage","subject","pageHeadline","siteName","reviewHostedPage","request","found","nodes","length","outcome","nowMs","Date","now","host","owner","Promise","all","undefined","org","orgId","identity","verdict","ageDays","createdAt","strong","isAlreadyLive","versionId","flagLivePage","page","reference","memo","atMs","state","live","previousVersionId","servedPageVersion","url","entryUrl","flagged","label","heldSend","kind","path","contentHash","slice","fromName","heldAtMs","extra","headline","alertTitle","alertBody","charAt","toUpperCase","item","reportedHostname","set","error","console","redirectReviewId","ruleId","reviewSiteRedirect","source","destination","subdomainHost","customDomain","ownDomains","siteHost","startsWith","pageReviewRef","NEW_PAGE_DAYS","lastClean","screen","created","createdMs","toMillis","input","at","existing","evidence","ref","first","exists","category","severity","details","reporterEmail","reporterName","dmca","riskNotice","reportCount","increment","updatedAt","serverTimestamp","status","merge","staffEvidence","snapshot","value","recordServedPageVersion","servedVersionId","servedAtMs","warn","flagLookalikeDomain","domain","String","trim","toLowerCase","brand","id","sending","link","where","notifyLookalikeLink","flagLookalikeCustomDomain"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAoE2C,GAE3C,SAASA,uBAAuB,QAAQ,sCAAqC;AAC7E,SACEC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,QAElB,qCAAoC;AAC3C,SAASC,gBAAgB,EAAEC,kBAAkB,QAAQ,8CAA6C;AAClG,SACEC,qBAAqB,EACrBC,wBAAwB,EAExBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,eAAe,QACV,oDAAmD;AAC1D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,gBAAgB,QAAgC,yBAAqB;AAC9E,SAASC,eAAe,QAAQ,mBAAe;AAC/C,SAASC,UAAU,QAAQ,eAAW;AACtC,SAASC,eAAe,EAAEC,aAAa,QAAQ,qBAAiB;AAChE,SACEC,aAAa,EACbC,gBAAgB,EAChBC,aAAa,EACbC,qBAAqB,EACrBC,oBAAoB,EACpBC,mBAAmB,EAEnBC,uBAAuB,QAClB,4BAAwB;AAE/B,yFAAyF,GACzF,OAAO,MAAMC,4BAA4B,cAAa;AA0BtD,8DAA8D,GAC9D,OAAO,SAASC,aACdC,MAAc,EACdC,QAAgB,EAChBC,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,SAAS,EAAEC,UAAU,EAAEL,oBAAoB;QAACO;KAAI;AAC9F;AAEA,8EAA8E,GAC9E,MAAMK,mBAAmB;AACzB,MAAMC,WAAW,IAAIC;AACrB,4EAA4E,GAC5E,MAAMC,aAAa,IAAID;AACvB,oFAAoF,GACpF,MAAME,cAAc,IAAIF;AACxB,MAAMG,sBAAsB,KAAK;AAEjC,iDAAiD,GACjD,OAAO,SAASC;IACdL,SAASM,KAAK;IACdJ,WAAWI,KAAK;IAChBH,YAAYG,KAAK;AACnB;AAEA;;;;CAIC,GACD,eAAeC,cACbC,QAAgB,EAChBC,QAAwC;IAExC,MAAMC,SAAS,MAAMlC,cAClBmC,GAAG,GACHC,SAAS,GACTC,UAAU,CAAClD,yBACXmD,GAAG,CAACN,UACJO,GAAG,GACHC,IAAI,CAAC,CAACC,MAAQC,cAAcD,IAAIF,GAAG,CAAC,cACpCI,KAAK,CAAC,IAAM;IACf,OAAOT,iBAAAA,SAAUD;AACnB;AAEA,6CAA6C,GAC7C,SAASS,cAAcE,QAAiB;IACtC,MAAMC,UAAWD,4BAAD,AAACA,SAA+DC,OAAO;IACvF,OAAOA,WAAW,OAAOA,YAAY,YAAYA,QAAQ7B,QAAQ,GAAG6B,UAAU;AAChF;AAEA,iEAAiE,GACjE,SAASC,aAAaD,OAAwB,EAAEE,QAAgB;IAC9D,OAAO;QAAC,GAAGzD,cAAcuD,SAAS,IAAI,EAAEE,SAAS,CAAC,CAAC;WAAK1D,gBAAgBwD;KAAS,CAACvB,IAAI,CAAC;AACzF;AAEA;;;CAGC,GACD,OAAO,eAAe0B,iBACpBC,OAAgC;QAKlBA;IAHd,MAAMC,QAAQ1D,iBAAiB;QAAE2D,OAAOF,QAAQE,KAAK;IAAC;IACtD,IAAI,CAACD,MAAMjC,OAAO,CAACmC,MAAM,EAAE,OAAO;QAAEC,SAAS;IAAQ;IAErD,MAAMC,SAAQL,iBAAAA,QAAQK,KAAK,YAAbL,iBAAiBM,KAAKC,GAAG;IACvC,IAAI;YAIaP,6BAkEHJ;QArEZ,MAAM,CAACY,MAAMC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCX,QAAQQ,IAAI,KAAKI,YAAYZ,QAAQQ,IAAI,GAAGrD,gBAAgB6C,QAAQlC,MAAM;YAC1EkC,QAAQa,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAEd,iBAAAA,QAAQc,KAAK,YAAbd,iBAAiB;gBAAMa,KAAKb,QAAQa,GAAG;YAAC,IACjDzD,cAAc4C,QAAQlC,MAAM;SACjC;QACD,MAAM+C,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,sEAAsE;QACtE,qEAAqE;QACrE,MAAMC,WAAWpD,wBAAwB;YAAEkD;YAAKL;QAAK;QACrD,MAAMQ,UAAUzE,iBAAiB;YAAE2D,OAAOF,QAAQE,KAAK;WAAKa;QAC5D,MAAME,UAAU/D,WAAY2D,uBAAD,AAACA,IAAwCK,SAAS,EAAEb;QAC/E,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,0DAA0D;QAC1D,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAACzD,oBAAoBqE,UAAU;YACjC,MAAME,SAAStE,gBAAgBmE,QAAQhD,OAAO,EAAE;gBAAEiD;YAAQ;YAC1D,IAAI,CAACE,OAAOhB,MAAM,EAAE,OAAO;gBAAEC,SAAS;YAAQ;YAC9C,IAAI,MAAMgB,cAAcpB,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ,EAAEiC,QAAQqB,SAAS,EAAEhB,QAAQ;oBAS3EL;gBARR,MAAMsB,aAAa;oBACjBxD,QAAQkC,QAAQlC,MAAM;oBACtBC,UAAUiC,QAAQjC,QAAQ;oBAC1BsD,WAAWrB,QAAQqB,SAAS;oBAC5BP;oBACAN;oBACAxC,SAASmD;oBACTd;oBACAkB,IAAI,GAAEvB,gBAAAA,QAAQuB,IAAI,YAAZvB,gBAAgB;oBACtBe;gBACF;gBACA,OAAO;oBAAEX,SAAS;gBAAQ;YAC5B;QACF;QACA,MAAMpC,UAAUnB,gBAAgBmE,QAAQhD,OAAO,EAAE;YAAEiD;QAAQ;QAC3D,IAAI,CAACjD,QAAQmC,MAAM,EAAE,OAAO;YAAEC,SAAS;QAAQ;QAE/C,MAAMrB,WAAWlB,aAAamC,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ,EAAEC;QAChE,MAAMwD,YAAYhE,sBAAsBuB;QACxC,MAAM0C,OAAOlD,SAASe,GAAG,CAACP;QAC1B,IAAI0C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGpD,kBAAkB;YAChD,OAAOmD,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQ5C;gBAAUyC;YAAU;QACtF;QACA,sEAAsE;QACtE,kEAAkE;QAClE,MAAM5B,UAAU,MAAMd,cAAcC,UAAU,UAC5C/B,iBAAiB;gBACfc,QAAQkC,QAAQlC,MAAM;gBACtBC,UAAUiC,QAAQjC,QAAQ;gBAC1BsD,WAAWrB,QAAQqB,SAAS;gBAC5Bb;gBACAe,MAAMvB,QAAQuB,IAAI;gBAClBvD;gBACA+C;gBACAa,MAAM;gBACNC,mBAAmB,MAAMC,kBAAkB9B,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ;YAC7E;QAEF,MAAMgE,OAAMnC,oBAAAA,QAAQoC,QAAQ,YAAhBpC,oBAAoBA,QAAQmC,GAAG;QAC3C,MAAME,UAAU1E,cAAcS;QAC9B,MAAM8B,WACJ,QAAOU,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM0B,QAAQ7F,cAAcuD;QAC5B,MAAM+B,QAAQ,MAAMrE,iBAAiB;YACnCyB;YACAoD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAErC,QAAQlC,MAAM,CAAC,SAAS,EAAEkC,QAAQjC,QAAQ,EAAE;gBAC3DD,QAAQkC,QAAQlC,MAAM;gBACtBgD;gBACAwB,aAAa5E,oBAAoB;oBAACM;iBAAQ;gBAC1C4B,SAASsC,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVxE;gBACA2D,OAAO;gBACPc,UAAUpC;gBACVY;YACF;YACAyB,OAAO;gBACL/C,UAAU;oBAAE5B,UAAUiC,QAAQjC,QAAQ;oBAAEsD,WAAWrB,QAAQqB,SAAS;oBAAEU;oBAAKnC;gBAAQ;YACrF;YACA+C,UACE,CAAC,KAAK,EAAE9C,aAAaD,SAASE,UAAU,SAAS,EAAEE,QAAQqB,SAAS,CAAC,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEJ,kBAAAA,UAAW,IAAI,aAAa,EAAE3E,wBAAwBsD,UAAU;YAC/EgD,YAAY;YACZC,WAAW,GAAGX,MAAMY,MAAM,CAAC,GAAGC,WAAW,KAAKb,MAAMK,KAAK,CAAC,GAAG,8BAA8B,CAAC;YAC5F,wEAAwE;YACxES,MAAM;gBAAEd;gBAAOG,MAAMlG,oBAAoByD,SAASI,QAAQlC,MAAM;YAAE;YAClEyD,MAAM3B;YACN,qEAAqE;YACrE,6DAA6D;YAC7DmC;YACAkB,kBAAkBhB;QACpB;QACA1D,SAAS2E,GAAG,CAACnE,UAAU;YAAE4C;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQ5C;YAAUyC;QAAU;IACjF,EAAE,OAAO2B,OAAO;QACd,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpCC,QAAQD,KAAK,CAAC,mEAAmEA;QACjF,MAAMpE,WAAWlB,aAAamC,QAAQlC,MAAM,EAAEkC,QAAQjC,QAAQ,EAAEkC,MAAMjC,OAAO;QAC7E,OAAO;YAAEoC,SAAS;YAAQrB;YAAUyC,WAAWhE,sBAAsBuB;QAAU;IACjF;AACF;AAiBA,uEAAuE,GACvE,OAAO,SAASsE,iBACdvF,MAAc,EACdwF,MAAc,EACdtF,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,WAAW,EAAEwF,QAAQ,EAAE5F,oBAAoB;QAACO;KAAI;AAC9F;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAesF,mBACpBvD,OAAkC;QAKpBA;IAHd,MAAMC,QAAQzD,mBAAmB;QAAEgH,QAAQxD,QAAQwD,MAAM;QAAEC,aAAazD,QAAQyD,WAAW;IAAC;IAC5F,IAAI,CAACxD,MAAMjC,OAAO,CAACmC,MAAM,EAAE,OAAO;QAAEC,SAAS;IAAQ;IAErD,MAAMC,SAAQL,iBAAAA,QAAQK,KAAK,YAAbL,iBAAiBM,KAAKC,GAAG;IACvC,IAAI;YAIaP,6BA4BuBe;QA/BtC,MAAM,CAACP,MAAMC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCX,QAAQQ,IAAI,KAAKI,YAAYZ,QAAQQ,IAAI,GAAGrD,gBAAgB6C,QAAQlC,MAAM;YAC1EkC,QAAQa,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAEd,iBAAAA,QAAQc,KAAK,YAAbd,iBAAiB;gBAAMa,KAAKb,QAAQa,GAAG;YAAC,IACjDzD,cAAc4C,QAAQlC,MAAM;SACjC;QACD,MAAM+C,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,MAAMC,WAAWpD,wBAAwB;YAAEkD;YAAKL;QAAK;QACrD,MAAMQ,UAAUxE,mBAAmB;YACjCgH,QAAQxD,QAAQwD,MAAM;YACtBC,aAAazD,QAAQyD,WAAW;WAC7B1C;QAEL,MAAME,UAAU/D,WAAY2D,uBAAD,AAACA,IAAwCK,SAAS,EAAEb;QAC/E,MAAMrC,UAAUnB,gBAAgBmE,QAAQhD,OAAO,EAAE;YAAEiD;QAAQ;QAC3D,IAAI,CAACjD,QAAQmC,MAAM,EAAE,OAAO;YAAEC,SAAS;QAAQ;QAE/C,MAAMrB,WAAWsE,iBAAiBrD,QAAQlC,MAAM,EAAEkC,QAAQsD,MAAM,EAAEtF;QAClE,MAAMwD,YAAYhE,sBAAsBuB;QACxC,MAAM0C,OAAOlD,SAASe,GAAG,CAACP;QAC1B,IAAI0C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGpD,kBAAkB;YAChD,OAAOmD,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQ5C;gBAAUyC;YAAU;QACtF;QACA,MAAMgC,SAASxD,QAAQwD,MAAM,CAACjB,KAAK,CAAC,GAAG;QACvC,MAAMkB,cAAczD,QAAQyD,WAAW,CAAClB,KAAK,CAAC,GAAG;QACjD,MAAML,QAAQ,CAAC,kBAAkB,EAAEsB,QAAQ;QAC3C,MAAM1D,WACJ,QAAOU,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM,CAACkD,eAAeC,aAAa,IAAG5C,uBAAAA,SAAS6C,UAAU,YAAnB7C,uBAAuB,EAAE;QAC/D,MAAM8C,WAAWF,gBAAgBD;QACjC,MAAM/B,QAAQ,MAAMrE,iBAAiB;YACnCyB;YACAoD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAErC,QAAQlC,MAAM,CAAC,WAAW,EAAEkC,QAAQsD,MAAM,EAAE;gBAC3DxF,QAAQkC,QAAQlC,MAAM;gBACtBgD;gBACAwB,aAAa5E,oBAAoB;oBAACM;iBAAQ;gBAC1C4B,SAASsC,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVxE;gBACA2D,OAAO;gBACPc,UAAUpC;gBACVY;YACF;YACA0B,UACE,CAAC,KAAK,EAAET,MAAM,IAAI,EAAEpC,SAAS,0BAA0B,EAAE2D,YAAY,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAExC,kBAAAA,UAAW,IAAI,0DAA0D,CAAC;YACzF2B,YAAY;YACZC,WAAW,CAAC,kBAAkB,EAAEW,OAAO,6CAA6C,CAAC;YACrF,sDAAsD;YACtDR,MAAM;gBAAEd;gBAAOG,MAAM,CAAC,CAAC,EAAErC,QAAQlC,MAAM,CAAC,UAAU,CAAC;YAAC;YACpDiE,KAAK8B,YAAYL,OAAOM,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAED,WAAWL,QAAQ,GAAGC;YAC3ER,kBAAkB1F,cAAcS;QAClC;QACAO,SAAS2E,GAAG,CAACnE,UAAU;YAAE4C;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQ5C;YAAUyC;QAAU;IACjF,EAAE,OAAO2B,OAAO;QACd,0EAA0E;QAC1EC,QAAQD,KAAK,CAAC,uEAAuEA;QACrF,MAAMpE,WAAWsE,iBAAiBrD,QAAQlC,MAAM,EAAEkC,QAAQsD,MAAM,EAAErD,MAAMjC,OAAO;QAC/E,OAAO;YAAEoC,SAAS;YAAQrB;YAAUyC,WAAWhE,sBAAsBuB;QAAU;IACjF;AACF;AAEA,SAASgF,cAAcjG,MAAc,EAAEC,QAAgB;IACrD,OAAOhB,cACJmC,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACvB,QACJsB,UAAU,CAACxB,2BACXyB,GAAG,CAACtB;AACT;AAEA;;;;;;CAMC,GACD,MAAMiG,gBAAgB;AACtB,eAAe5C,cACbtD,MAAc,EACdC,QAAgB,EAChBsD,SAAiB,EACjBhB,KAAa;IAEb,MAAM4D,YAAY,MAAMnC,kBAAkBhE,QAAQC;IAClD,IAAIkG,WAAW,OAAOA,cAAc5C;IACpC,IAAI;QACF,MAAM6C,SAAS,MAAMnH,cAClBmC,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACvB,QACJsB,UAAU,CAAC,WACXC,GAAG,CAACtB,UACJuB,GAAG;QACN,MAAM6E,UAAUD,OAAO5E,GAAG,CAAC;QAC3B,MAAM8E,YACJ,OAAOD,YAAY,WAAWA,UAAU,QAAOA,2BAAAA,QAASE,QAAQ,MAAK,aAAaF,QAAQE,QAAQ,KAAK;QACzG,mDAAmD;QACnD,OAAOD,cAAc,QAAQ/D,QAAQ+D,aAAaJ,gBAAgB,KAAK,KAAK,KAAK;IACnF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,eAAe1C,aAAagD,KAU3B;IACC,MAAMrG,MAAM,GAAGqG,MAAMxG,MAAM,CAAC,EAAE,EAAEwG,MAAMvG,QAAQ,CAAC,EAAE,EAAEuG,MAAMtG,OAAO,CAACE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAASC,IAAI,GAAGC,IAAI,CAAC,OAAO;IAC3H,MAAMkG,KAAK7F,YAAYY,GAAG,CAACrB;IAC3B,IAAIsG,OAAO3D,aAAa0D,MAAMjE,KAAK,GAAGkE,KAAK5F,qBAAqB;IAChED,YAAYwE,GAAG,CAACjF,KAAKqG,MAAMjE,KAAK;IAChC,IAAI;YAUCmE,MAQWF,iBAIF1E;YAEH0E;QAvBT,MAAMvF,WAAWlB,aAAayG,MAAMxG,MAAM,EAAE,GAAGwG,MAAMvG,QAAQ,CAAC,KAAK,CAAC,EAAEuG,MAAMtG,OAAO;QACnF,MAAMwD,YAAYhE,sBAAsBuB;QACxC,MAAM0F,WAAW9H,8BAA8B2H,MAAMtG,OAAO,EAAEK,IAAI,CAAC;QACnE,MAAM4D,UAAU1E,cAAc+G,MAAMtG,OAAO;QAC3C,MAAM0G,MAAM3H,cAAcmC,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAClD,yBAAyBmD,GAAG,CAACN;QACpF,MAAMyF,WAAW,MAAME,IAAIpF,GAAG;QAC9B,MAAMqF,QAAQ,CAACH,SAASI,MAAM;QAC9B,8CAA8C;QAC9C,MAAMhF,WACH4E,OAAAA,SAASI,MAAM,GAAGnF,cAAc+E,SAASlF,GAAG,CAAC,eAAe,gBAA5DkF,OACA,MAAMxH,iBAAiB;YACtBc,QAAQwG,MAAMxG,MAAM;YACpBC,UAAUuG,MAAMvG,QAAQ;YACxBsD,WAAWiD,MAAMjD,SAAS;YAC1Bb,MAAM8D,MAAM9D,IAAI;YAChBe,MAAM+C,MAAM/C,IAAI;YAChBvD,SAASsG,MAAMtG,OAAO;YACtB+C,QAAQ,GAAEuD,kBAAAA,MAAMvD,QAAQ,YAAduD,kBAAkB3G,wBAAwB;gBAAE6C,MAAM8D,MAAM9D,IAAI;YAAC;YACvEoB,MAAM;YACNC,mBAAmB;QACrB;QACF,MAAME,OAAMnC,oBAAAA,QAAQoC,QAAQ,YAAhBpC,oBAAoBA,QAAQmC,GAAG;QAC3C,MAAMjC,WACJ,SAAOwE,cAAAA,MAAM9D,IAAI,qBAAV8D,WAAY,CAAC,OAAO,MAAK,YAAYA,MAAM9D,IAAI,CAAC,OAAO,GAC1D,CAAC,CAAC,EAAE8D,MAAM9D,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GACzB;QACN,MAAMkE,IAAIxB,GAAG,CACX;YACE1B;YACAqD,UAAU;YACVC,UAAU;YACVtB,QAAQ;YACRzB;YACAkB,kBAAkBhB;YAClBnE,QAAQwG,MAAMxG,MAAM;YACpBgD,OAAOwD,MAAMxD,KAAK;YAClBiE,SAAS;gBACP,CAAC,MAAM,EAAElF,aAAaD,SAASE,UAAU,4DAA4D,CAAC;gBACtG2E;gBACA;aACD,CAACpG,IAAI,CAAC;YACP2G,eAAe;YACfC,cAAc;YACdC,MAAM;YACNvF,UAAU;gBAAE5B,UAAUuG,MAAMvG,QAAQ;gBAAEsD,WAAWiD,MAAMjD,SAAS;gBAAEU;gBAAKnC;YAAQ;YAC/EuF,YAAY;gBAAE/C,MAAM;YAAe;YACnCgD,aAAatI,WAAWuI,SAAS,CAAC;YAClCC,WAAWxI,WAAWyI,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQtE,WAAWpE,WAAWyI,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAI,CAACd,OAAO;QACZ,MAAM1H,gBAAgB;YACpBmF,MAAM;YACNtB,OAAOwD,MAAMxD,KAAK;YAClBhD,QAAQwG,MAAMxG,MAAM;YACpBiB;YACAyC;YACAwB,MAAM;gBAAEd,OAAO7F,cAAcuD;gBAAUyC,MAAMlG,oBAAoByD,SAAS0E,MAAMxG,MAAM;YAAE;YACxFyD,MAAM3B;YACN8F,eAAe;mBAAItJ,gBAAgBwD;gBAAU6E;aAAS,CAACpG,IAAI,CAAC;QAC9D;IACF,EAAE,OAAO8E,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;IAClE;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAerB,kBAAkBhE,MAAc,EAAEC,QAAgB;IACtE,IAAI;QACF,MAAM4H,WAAW,MAAM5B,cAAcjG,QAAQC,UAAUuB,GAAG;QAC1D,MAAMsG,QAAQD,SAASrG,GAAG,CAAC;QAC3B,OAAO,OAAOsG,UAAU,YAAYA,QAAQA,QAAQ;IACtD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpB/H,MAAc,EACdC,QAAgB,EAChBsD,SAAiB;IAEjB,MAAMpD,MAAM,GAAGH,OAAO,CAAC,EAAEC,UAAU;IACnC,IAAI,CAACsD,aAAa5C,WAAWa,GAAG,CAACrB,SAASoD,WAAW;IACrD,IAAI;QACF,MAAMqD,MAAMX,cAAcjG,QAAQC;QAClC,MAAM4H,WAAW,MAAMjB,IAAIpF,GAAG;QAC9B,IAAIqG,SAASrG,GAAG,CAAC,uBAAuB+B,WAAW;YACjD,MAAMqD,IAAIxB,GAAG,CAAC;gBAAE4C,iBAAiBzE;gBAAW0E,YAAYzF,KAAKC,GAAG;YAAG,GAAG;gBAAEkF,OAAO;YAAK;QACtF;QACAhH,WAAWyE,GAAG,CAACjF,KAAKoD;IACtB,EAAE,OAAO8B,OAAO;QACdC,QAAQ4C,IAAI,CAAC,uDAAuD7C;IACtE;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,eAAe8C,oBAAoB3B,KAOzC;QACuBA;IAAtB,MAAM4B,SAASC,QAAO7B,gBAAAA,MAAM4B,MAAM,YAAZ5B,gBAAgB,IAAI8B,IAAI,GAAGC,WAAW;IAC5D,MAAMC,QAAQ7J,sBAAsByJ;IACpC,IAAI,CAACI,OAAO,OAAO;IACnB,MAAMpE,QAAQxF,yBAAyB4J,MAAMC,EAAE;IAC/C,MAAMC,UAAUlC,MAAMlC,IAAI,KAAK;IAC/B,MAAMqE,OAAOnC,MAAMlC,IAAI,KAAK;IAC5B,IAAI;YAGUkC,cAEGA,eACAA,gBAmBuCA;QAxBtD,MAAMnF,YAAYpC,cAAcmC,GAAG,GAAGC,SAAS;QAC/C,MAAMsB,QAAQ+F,UACV,CAAC,KAAK,GAAElC,eAAAA,MAAMxD,KAAK,YAAXwD,eAAe,GAAG,eAAe,CAAC,GAC1CmC,OACE,CAAC,MAAM,GAAEnC,gBAAAA,MAAMxG,MAAM,YAAZwG,gBAAgB,GAAG,MAAM,CAAC,GACnC,CAAC,MAAM,GAAEA,iBAAAA,MAAMxG,MAAM,YAAZwG,iBAAgB,GAAG,MAAM,CAAC;QACzC,MAAMvF,WAAWtB,qBAAqBgD,OAAOyF;QAC7C,MAAM1E,YAAYhE,sBAAsBuB;QACxC,MAAM2F,MAAMvF,UAAUC,UAAU,CAAClD,yBAAyBmD,GAAG,CAACN;QAC9D,MAAM4F,QAAQ,CAAC,AAAC,CAAA,MAAMD,IAAIpF,GAAG,EAAC,EAAGsF,MAAM;QACvC,MAAMF,IAAIxB,GAAG,CACX;YACE1B;YACAqD,UAAU;YACVC,UAAU;YACVtB,QAAQ;YACRzB,KAAK,CAAC,QAAQ,EAAEmE,OAAO,CAAC,CAAC;YACzBjD,kBAAkBiD;YAClBpI,QAAQwG,MAAMxG,MAAM;YACpBgD,OAAOwD,MAAMxD,KAAK;YAClBiE,SAAS;gBACPyB,UACI,CAAC,kBAAkB,EAAEN,OAAO,gCAAgC,CAAC,GAC7DO,OACE,CAAC,4BAA4B,EAAEP,OAAO,EAAE,GAAE5B,eAAAA,MAAMoC,KAAK,YAAXpC,eAAe,kBAAkB,EAAE,CAAC,GAC9E,CAAC,kCAAkC,EAAE4B,OAAO,CAAC,CAAC;gBACpD,GAAGA,OAAO,WAAW,EAAEhE,MAAM,iBAAiB,EAAEA,MAAM,UAAU,CAAC;gBACjEsE,UACI,oFACA,sFACAC,OACE,kFACA,uDACA,yEACA;aACP,CAACpI,IAAI,CAAC;YACP2G,eAAe;YACfC,cAAc;YACdC,MAAM;YACNE,aAAatI,WAAWuI,SAAS,CAAC;YAClCC,WAAWxI,WAAWyI,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQtE,WAAWpE,WAAWyI,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAId,SAAS8B,MAAM;gBAMRnC;YALT,MAAMqC,oBAAoB;gBACxB7I,QAAQwG,MAAMxG,MAAM;gBACpBgD,OAAOwD,MAAMxD,KAAK;gBAClBoF;gBACAhE;gBACAwE,KAAK,GAAEpC,gBAAAA,MAAMoC,KAAK,YAAXpC,gBAAe;gBACtB9C;gBACAzC;YACF;QACF,OAAO,IAAI4F,OAAO;YAChB,uEAAuE;YACvE,sEAAsE;YACtE,MAAM1H,gBAAgB;gBACpBmF,MAAM;gBACNtB,OAAOwD,MAAMxD,KAAK;gBAClBhD,QAAQwG,MAAMxG,MAAM;gBACpBiB;gBACAyC;gBACAwB,MAAM;oBACJd,OAAOsE,UAAU,CAAC,mBAAmB,EAAEN,QAAQ,GAAG,CAAC,kBAAkB,EAAEA,QAAQ;oBAC/E,mDAAmD;oBACnD7D,MAAMmE,UAAU,wBAAwBlC,MAAMxG,MAAM,GAAG,CAAC,CAAC,EAAEwG,MAAMxG,MAAM,CAAC,aAAa,CAAC,GAAG;gBAC3F;gBACA4H,eACE,GAAGc,UAAU,mBAAmB,gBAAgB,CAAC,EAAEN,OAAO,YAAY,EAAEhE,MAAM,CAAC,CAAC;YACpF;QACF;QACA,OAAO;IACT,EAAE,OAAOiB,OAAO;QACdC,QAAQD,KAAK,CAAC,yDAAyDA;QACvE,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,eAAewD,oBAAoBrC,KAQzC;QAGUA,cAEGA;IAJZ,MAAMrH,gBAAgB;QACpBmF,MAAM;QACNtB,KAAK,GAAEwD,eAAAA,MAAMxD,KAAK,YAAXwD,eAAe;QACtBxG,QAAQwG,MAAMxG,MAAM;QACpBiB,QAAQ,GAAEuF,kBAAAA,MAAMvF,QAAQ,YAAduF,kBAAkB;QAC5B9C,WAAW8C,MAAM9C,SAAS;QAC1BwB,MAAM;YACJd,OAAO,GAAGoC,MAAMoC,KAAK,CAAC,aAAa,EAAEpC,MAAM4B,MAAM,EAAE;YACnD7D,MAAMiC,MAAMxG,MAAM,GAAG,CAAC,CAAC,EAAEwG,MAAMxG,MAAM,CAAC,SAAS,CAAC,GAAG;QACrD;QACA4H,eACE,CAAC,kBAAkB,EAAEpB,MAAMoC,KAAK,CAAC,IAAI,EAAEpC,MAAM4B,MAAM,CAAC,mBAAmB,EAAE5B,MAAMpC,KAAK,CAAC,EAAE,CAAC,GACxF;IACJ,GAAGxC,KAAK,CAAC,IAAMkB;AACjB;AAEA,iEAAiE,GACjE,OAAO,SAASgG,0BAA0BtC,KAIzC;IACC,OAAO2B,oBAAoB;QAAE7D,MAAM;OAAWkC;AAChD"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/hosted-page-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * HELD FOR REVIEW: a published page (AGL-3362).\n *\n * ## Why the check sits where a page is COMPOSED, not where it is published\n *\n * A publish is a browser write. The besigner toolbar, the versions panel,\n * the screen details page, page-from-template, the layout and component\n * besigners and the form besigner each move a pointer (`versionId`, the\n * host's `screens` map, a component's own `nodes`) straight from the\n * client SDK; the scheduled-publish beat moves it from the server; an\n * experiment serves a version no pointer names; and an author may rewrite\n * the LIVE version document itself without moving any pointer at all. A\n * check on any one of those writes is a check the next one walks around.\n *\n * They all meet in one place: `composeScreenNodes` (`@aglyn/tenant-runtime`),\n * which every published render, the password unlock, the collection and\n * product templates and every experiment variant go through, and which\n * returns the page exactly as a visitor will receive it — the screen, its\n * layout chrome, its grafted components and its forms. So the screen is read\n * there, and a held page is one that is never composed for a visitor. For a\n * visitor, \"publish\" is the first render after the pointer moved; this is\n * that moment.\n *\n * ## What a hold does\n *\n * - The version is not served. The last version this page served clean\n *   ({@link servedPageVersion}) is composed instead — screened again, since\n *   a version document can be edited in place — and if there is none, or it\n *   holds too, the page is not found. A first publish that holds therefore\n *   serves nothing.\n * - One review row per (page, signal set) lands in the abuse queue at\n *   `/admin/abuse-reports`, the same `phishing` row a held email files\n *   (`fileOutboundHold`), with `heldSend.kind: 'page'`, the page's URL and\n *   the held version. Staff dismiss it to RELEASE (the admin route drops the\n *   site's cache and the next render serves it) or mark it actioned to\n *   REJECT (it stays unserved; any later version carrying the same signals\n *   is refused without a new row).\n * - A hold from a workspace in its first fortnight also asks for an\n *   automatic `security` hold on the workspace, the site and the publishing\n *   account (`page-security-hold.ts`, AGL-3450), which the console places.\n * - Keyed on the SIGNALS, as the send seam's rows are: a composed page\n *   carries per-render values (dates, collection rows) that no content hash\n *   would survive, while what makes it phishing does not change between\n *   renders.\n *\n * ## Tiers\n *\n * `signalsThatHold`: a lookalike link or embed, an author-defined\n * credential field and a link to a host Google Web Risk lists\n * (`web-risk-link`, AGL-3451) hold for EVERY workspace; a brand's call to\n * action or lure, and a call to action that leaves the site beside a lure,\n * only for a workspace in its first fortnight. The workspace's documents are\n * read only when something was found, so a clean page costs no read for\n * this. The page's foreign hosts — and, in `'url'` mode (AGL-3459), its\n * links' addresses without their query strings — are looked up first,\n * against a cache (`web-risk.ts`), and noted beside the version it serves so\n * the daily re-check can look again: a harvester is often listed only after\n * it is published. A lookup that fails finds nothing, so it never holds a\n * page.\n *\n * Fails CLOSED, unlike the send path: a page the pure screen flagged whose\n * review cannot finish — the workspace read, the row write — is answered\n * `held`, and the composer serves its last clean version or nothing. The\n * answer is not remembered, so the next render reviews it again. Composition\n * itself reads the store, so an outage here is an outage on the render\n * already, and the only cost of not serving a page the screen flagged is a\n * false positive's wait; serving it is the phishing page this exists to\n * stop. A page the screen found nothing on never reaches this.\n *\n * ## Site redirects\n *\n * A redirect rule that sends a path off the site is a page whose one call to\n * action fires on arrival, so the redirects plugin asks\n * {@link reviewSiteRedirect} before it serves one. Same screen\n * (`screenSiteRedirect`), same tiers, same row and the same staff decision:\n * a held rule does not fire, and is filed as a `page` hold on its rule's\n * document. Its destination is looked up against the reputation list too\n * (AGL-3451), so a redirect to a listed site holds for every workspace.\n *=========================================*/\n\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport {\n  heldPageConsolePath,\n  heldPageDetails,\n  heldPageLabel,\n  heldPageVisitorSentence,\n  type HeldPageSubject,\n} from '@aglyn/shared-util-email/held-page'\nimport { screenHostedPage, screenSiteRedirect } from '@aglyn/shared-util-email/hosted-page-screen'\nimport {\n  lookalikeBrandForHost,\n  phishingScreenBrandLabel,\n  type PhishingScreenSignal,\n  describePhishingScreenSignals,\n  isYoungWorkspaceAge,\n  signalsThatHold,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport {\n  type ForeignReputationLinks,\n  foreignLinksForReputation,\n  webRiskSignals,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { describeHeldPage, type HostedPageContext } from './held-page-subject'\nimport { notifyRiskEvent } from './risk-notice'\nimport { orgAgeDays } from './org-age'\nimport { requestPageSecurityHold } from './page-security-hold'\nimport { getHostDocAdmin, getOrgForHost } from './organizations'\nimport { lookupLinkReputation, platformReputationExclusions } from './web-risk'\nimport {\n  canonicalJson,\n  fileOutboundHold,\n  flaggedHostOf,\n  heldOutboundReference,\n  heldOutboundReviewId,\n  outboundContentHash,\n  type HeldOutboundSendState,\n  workspaceScreenIdentity,\n} from './outbound-send-review'\n\n/** Where the last version a page served clean is noted: a hint, re-screened before use. */\nexport const PAGE_REVIEW_SUBCOLLECTION = 'pageReviews'\n\nexport interface HostedPageReviewRequest {\n  hostId: string\n  screenId: string\n  versionId: string\n  /** The page as composed for a visitor. */\n  nodes: unknown\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n  /**\n   * What the composer knows about the page (AGL-3374): the screen document,\n   * the template route it is rendering, the variant, and a way to read the\n   * layouts and components composed into it. Read only when a row is filed,\n   * to name the page — never to decide whether it serves.\n   */\n  page?: HostedPageContext | null\n  /**\n   * Signals found about this page elsewhere, judged with the page's own\n   * (AGL-3451): the daily link re-check passes a link Web Risk has listed\n   * since the page went live, so the hold, its row and the young\n   * workspace's security hold all come from this one path.\n   */\n  extraSignals?: readonly PhishingScreenSignal[]\n}\n\nexport type HostedPageReviewOutcome =\n  | { outcome: 'serve' }\n  | { outcome: 'held' | 'rejected'; reviewId: string; reference: string }\n\n/** The review row's id for a page and the signals that held. */\nexport function pageReviewId(\n  hostId: string,\n  screenId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/screens/${screenId}`, outboundContentHash([key]))\n}\n\n/** How long this process trusts a page row's state — the send seam's minute. */\nconst PAGE_MEMO_TTL_MS = 60_000\nconst pageMemo = new Map<string, { state: HeldOutboundSendState; atMs: number }>()\n/** The version each page last served clean, as this process last wrote it. */\nconst servedMemo = new Map<string, string>()\n/** Lookalike hosts this process already flagged for an established page, and when. */\nconst flaggedMemo = new Map<string, number>()\nconst FLAGGED_MEMO_TTL_MS = 60 * 60_000\n/**\n * The foreign hosts each reviewed page version links to (AGL-3451), and the\n * addresses on them worth asking about (AGL-3459), for\n * {@link recordServedPageVersion} to note beside the version it served, which\n * is what the daily link re-check walks. Bounded: a process that reviews more\n * pages than this starts again.\n */\nconst reviewedForeignHosts = new Map<string, ForeignReputationLinks>()\nconst REVIEWED_FOREIGN_HOSTS_MAX = 10_000\n\n/** Test seam: forget what this process learned. */\nexport function resetHostedPageReviewMemoForTests(): void {\n  pageMemo.clear()\n  servedMemo.clear()\n  flaggedMemo.clear()\n  reviewedForeignHosts.clear()\n}\n\n/**\n * Every foreign host the page links to, the addresses on them worth asking\n * about, and the ones Google Web Risk lists (AGL-3451; addresses only in\n * `'url'` mode, AGL-3459). Foreign before the workspace is known: not the\n * platform's own, not a brand's own domain, not a common social link. The\n * addresses carry no query string or fragment. Never throws; a lookup that\n * failed lists nothing.\n */\nasync function pageLinkReputation(\n  linkUrls: readonly string[],\n): Promise<ForeignReputationLinks & { signals: PhishingScreenSignal[] }> {\n  // Runs before the review's fail-closed `try`, so it must not throw: an\n  // answer it cannot give is no listing, never a reason to hold.\n  try {\n    const foreign = foreignLinksForReputation(linkUrls, {\n      excludeDomains: platformReputationExclusions(),\n    })\n    if (!foreign.hosts.length) return { ...foreign, signals: [] }\n    const answer = await lookupLinkReputation(foreign.hosts, { urls: foreign.urls })\n    return { ...foreign, signals: webRiskSignals(answer.hits) }\n  } catch (error) {\n    console.warn('[page-review] link reputation could not be read — no listing assumed', error)\n    return { hosts: [], urls: [], signals: [] }\n  }\n}\n\n/** Is this host one of the workspace's own? */\nfunction isOwnHost(host: string, ownDomains: readonly (string | null | undefined)[] | undefined): boolean {\n  return (ownDomains ?? []).some((own) => {\n    const domain = String(own ?? '').trim().toLowerCase()\n    return Boolean(domain) && (host === domain || host.endsWith(`.${domain}`))\n  })\n}\n\n/**\n * The subject a row already stored, or a fresh description (AGL-3374). A row\n * that names its page is not described again, so the reads the description\n * may make are paid once per row, not once per render.\n */\nasync function subjectForRow(\n  reviewId: string,\n  describe: () => Promise<HeldPageSubject>,\n): Promise<HeldPageSubject> {\n  const stored = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .get()\n    .then((row) => storedSubject(row.get('heldPage')))\n    .catch(() => null)\n  return stored ?? describe()\n}\n\n/** A row's stored subject, when it has one. */\nfunction storedSubject(heldPage: unknown): HeldPageSubject | null {\n  const subject = (heldPage as { subject?: HeldPageSubject } | null | undefined)?.subject\n  return subject && typeof subject === 'object' && subject.screenId ? subject : null\n}\n\n/** The row's first line, naming the page and where it was seen. */\nfunction pageHeadline(subject: HeldPageSubject, siteName: string): string {\n  return [`${heldPageLabel(subject)} of ${siteName}.`, ...heldPageDetails(subject)].join(' ')\n}\n\n/**\n * Screen one page as a visitor would receive it, and say whether it may be\n * served. See the module header.\n */\nexport async function reviewHostedPage(\n  request: HostedPageReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenHostedPage({ nodes: request.nodes })\n  // Every foreign host it points at, against the reputation list\n  // (AGL-3451): a harvester known to be bad anywhere holds however plain the\n  // page around it is. Strong, so it holds at any workspace age.\n  const reputation = await pageLinkReputation(found.linkUrls)\n  if (reviewedForeignHosts.size >= REVIEWED_FOREIGN_HOSTS_MAX) reviewedForeignHosts.clear()\n  reviewedForeignHosts.set(`${request.hostId}/${request.screenId}/${request.versionId}`, {\n    hosts: reputation.hosts,\n    urls: reputation.urls,\n  })\n  const listed = [...reputation.signals, ...(request.extraSignals ?? [])]\n  if (!found.signals.length && !listed.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    // Again, now knowing whose page it is: a brand in the workspace's own\n    // name or domain is its own, and a link to its own site is not away.\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenHostedPage({ nodes: request.nodes, ...identity })\n    // A listing of the workspace's own host is not a link away from it.\n    const screened = [\n      ...verdict.signals,\n      ...listed.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    // Every workspace is screened, however old: an established account can\n    // be compromised, and a compromised account publishing a lure is the\n    // same harm as a new one. What differs is what a hold may take DOWN.\n    // Holding content that is already live serves its last clean version or\n    // nothing, and on a real business's home page that is an outage the\n    // screen caused (aglyn.com, 2026-09-28, a page that had served clean\n    // until a rule changed). So for an established workspace:\n    //   - NEW content (a new version of a live page, or a page that has\n    //     never been live) holds, exactly as for a young workspace; the live\n    //     page keeps serving its last clean version, or the new page waits;\n    //   - content ALREADY LIVE keeps serving, and is flagged to staff as\n    //     urgent, who lock the site if it is impersonation.\n    if (!isYoungWorkspaceAge(ageDays)) {\n      const strong = signalsThatHold(screened, { ageDays })\n      if (!strong.length) return { outcome: 'serve' }\n      if (await isAlreadyLive(request.hostId, request.screenId, request.versionId, nowMs)) {\n        await flagLivePage({\n          hostId: request.hostId,\n          screenId: request.screenId,\n          versionId: request.versionId,\n          orgId,\n          host,\n          signals: strong,\n          nowMs,\n          page: request.page ?? null,\n          identity,\n        })\n        return { outcome: 'serve' }\n      }\n    }\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = pageReviewId(request.hostId, request.screenId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    // The page by its real name and route (AGL-3374): a template, a list,\n    // a variant, or a page whose flagged content lives in its layout.\n    const subject = await subjectForRow(reviewId, async () =>\n      describeHeldPage({\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        host,\n        page: request.page,\n        signals,\n        identity,\n        live: false,\n        previousVersionId: await servedPageVersion(request.hostId, request.screenId),\n      }),\n    )\n    const url = subject.entryUrl ?? subject.url\n    const flagged = flaggedHostOf(signals)\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const label = heldPageLabel(subject)\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/screens/${request.screenId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      extra: {\n        heldPage: { screenId: request.screenId, versionId: request.versionId, url, subject },\n      },\n      headline:\n        `Held ${pageHeadline(subject, siteName)} Version ${request.versionId}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. ${heldPageVisitorSentence(subject)}`,\n      alertTitle: 'Published page held for review — possible phishing',\n      alertBody: `${label.charAt(0).toUpperCase()}${label.slice(1)} was held before it went live.`,\n      // The owners' words for it, and where they fix it (AGL-3368, AGL-3374).\n      item: { label, path: heldPageConsolePath(subject, request.hostId) },\n      page: subject,\n      // The page itself is what was reported; the flagged host, when there\n      // is one, is named in the details and on `reportedHostname`.\n      url,\n      reportedHostname: flagged,\n    })\n    // A hold from a workspace in its first fortnight also holds the\n    // workspace, the site and the account that published it (AGL-3450).\n    if (state === 'held') {\n      await requestPageSecurityHold({\n        orgId: orgId ?? '',\n        org,\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        reviewId,\n        reference,\n        signals,\n        ageDays,\n        pageLabel: label,\n        pageUrl: url,\n        siteName: typeof host?.['name'] === 'string' ? host['name'] : null,\n        nowMs,\n      })\n    }\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed: the screen has already found a signal on this page, and a\n    // review that could not finish has not cleared it. Not remembered, so\n    // the next render reviews it again.\n    console.error('[page-review] a flagged page could not be reviewed — holding it', error)\n    const reviewId = pageReviewId(request.hostId, request.screenId, [...found.signals, ...listed])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nexport interface SiteRedirectReviewRequest {\n  hostId: string\n  /** The rule's document id under `hosts/{hostId}/redirects`. */\n  ruleId: string\n  /** The path, or the pattern, the rule answers. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n}\n\n/** The review row's id for a redirect rule and the signals that held. */\nexport function redirectReviewId(\n  hostId: string,\n  ruleId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/redirects/${ruleId}`, outboundContentHash([key]))\n}\n\n/**\n * Screen one redirect rule before it sends a visitor off the site\n * (AGL-3447), and say whether it may fire. See the module header.\n *\n * Every workspace is screened and the tiers decide, as for a page: a\n * destination that wears a brand holds for all of them, a lure path sent\n * off the site only for a workspace in its first fortnight. A held rule is\n * filed once per (rule, signal set) and decided by staff on that row:\n * dismissed, it fires; actioned, it never does with those signals.\n */\nexport async function reviewSiteRedirect(\n  request: SiteRedirectReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenSiteRedirect({ source: request.source, destination: request.destination })\n  // Where it sends visitors, against the reputation list (AGL-3451): a\n  // listed destination holds for every workspace, as a listed link does.\n  const reputation = await pageLinkReputation(found.linkUrls)\n  if (!found.signals.length && !reputation.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenSiteRedirect({\n      source: request.source,\n      destination: request.destination,\n      ...identity,\n    })\n    const screened = [\n      ...verdict.signals,\n      ...reputation.signals.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    const source = request.source.slice(0, 200)\n    const destination = request.destination.slice(0, 500)\n    const label = `the redirect from ${source}`\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const [subdomainHost, customDomain] = identity.ownDomains ?? []\n    const siteHost = customDomain || subdomainHost\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/redirects/${request.ruleId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      headline:\n        `Held ${label} of ${siteName}, which sends visitors to ${destination}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. The rule does not fire until this is decided.`,\n      alertTitle: 'Site redirect held for review — possible phishing',\n      alertBody: `The redirect from ${source} was held before it sent anyone off the site.`,\n      // Where the owners fix it: the site's Redirects page.\n      item: { label, path: `/${request.hostId}/redirects` },\n      url: siteHost && source.startsWith('/') ? `https://${siteHost}${source}` : destination,\n      reportedHostname: flaggedHostOf(signals),\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed, as a page is: the screen found a signal and nothing cleared it.\n    console.error('[page-review] a flagged redirect could not be reviewed — holding it', error)\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, [\n      ...found.signals,\n      ...reputation.signals,\n    ])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nfunction pageReviewRef(hostId: string, screenId: string) {\n  return firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection(PAGE_REVIEW_SUBCOLLECTION)\n    .doc(screenId)\n}\n\n/**\n * Is this version of the page already what visitors receive? It is when it\n * is the version the page last served clean, or when the page has no record\n * at all and is not new: it went live before the screen existed. A page\n * created in the last {@link NEW_PAGE_DAYS} days with no record has never\n * been live, so holding it takes nothing down.\n */\nconst NEW_PAGE_DAYS = 7\nasync function isAlreadyLive(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n  nowMs: number,\n): Promise<boolean> {\n  const lastClean = await servedPageVersion(hostId, screenId)\n  if (lastClean) return lastClean === versionId\n  try {\n    const screen = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('screens')\n      .doc(screenId)\n      .get()\n    const created = screen.get('createdAt') as { toMillis?: () => number } | number | undefined\n    const createdMs =\n      typeof created === 'number' ? created : typeof created?.toMillis === 'function' ? created.toMillis() : null\n    // No readable creation time: an old page, so live.\n    return createdMs === null || nowMs - createdMs >= NEW_PAGE_DAYS * 24 * 60 * 60 * 1000\n  } catch {\n    return true\n  }\n}\n\n/**\n * A page ALREADY LIVE carries a strong signal: file one urgent abuse row for\n * it (keyed on the page and its signals, so a busy page is one row) and, the\n * first time, tell staff and the owners through the `page-flagged` notice.\n * The page keeps serving; staff lock the site if it is impersonation or the\n * account looks compromised. Once per page and signal set per process.\n */\nasync function flagLivePage(input: {\n  hostId: string\n  screenId: string\n  versionId: string\n  orgId: string | null\n  host: Record<string, unknown> | null\n  signals: readonly PhishingScreenSignal[]\n  nowMs: number\n  page?: HostedPageContext | null\n  identity?: ReturnType<typeof workspaceScreenIdentity>\n}): Promise<void> {\n  const key = `${input.hostId}\\n${input.screenId}\\n${input.signals.map((signal) => canonicalJson(signal)).sort().join('\\n')}`\n  const at = flaggedMemo.get(key)\n  if (at !== undefined && input.nowMs - at < FLAGGED_MEMO_TTL_MS) return\n  flaggedMemo.set(key, input.nowMs)\n  try {\n    const reviewId = pageReviewId(input.hostId, `${input.screenId}/live`, input.signals)\n    const reference = heldOutboundReference(reviewId)\n    const evidence = describePhishingScreenSignals(input.signals).join(' ')\n    const flagged = flaggedHostOf(input.signals)\n    const ref = firebaseAdmin.app().firestore().collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const existing = await ref.get()\n    const first = !existing.exists\n    // Named once, when the row is new (AGL-3374).\n    const subject =\n      (existing.exists ? storedSubject(existing.get('heldPage')) : null) ??\n      (await describeHeldPage({\n        hostId: input.hostId,\n        screenId: input.screenId,\n        versionId: input.versionId,\n        host: input.host,\n        page: input.page,\n        signals: input.signals,\n        identity: input.identity ?? workspaceScreenIdentity({ host: input.host }),\n        live: true,\n        previousVersionId: null,\n      }))\n    const url = subject.entryUrl ?? subject.url\n    const siteName =\n      typeof input.host?.['name'] === 'string' && input.host['name']\n        ? `\"${input.host['name']}\"`\n        : 'a site'\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url,\n        reportedHostname: flagged,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          `LIVE: ${pageHeadline(subject, siteName)} It was flagged by the phishing screen and is still serving.`,\n          evidence,\n          'Lock the site if it is impersonation or the account looks compromised; dismiss this if the content is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        heldPage: { screenId: input.screenId, versionId: input.versionId, url, subject },\n        riskNotice: { kind: 'page-flagged' },\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (!first) return\n    await notifyRiskEvent({\n      kind: 'page-flagged',\n      orgId: input.orgId,\n      hostId: input.hostId,\n      reviewId,\n      reference,\n      item: { label: heldPageLabel(subject), path: heldPageConsolePath(subject, input.hostId) },\n      page: subject,\n      staffEvidence: [...heldPageDetails(subject), evidence].join(' '),\n    })\n  } catch (error) {\n    console.error('[page-review] a live page could not be flagged', error)\n  }\n}\n\n/**\n * The version this page last served clean, or null. A HINT, not a\n * clearance: the caller composes and screens it again before serving it,\n * because a version document can be edited after it was served.\n */\nexport async function servedPageVersion(hostId: string, screenId: string): Promise<string | null> {\n  try {\n    const snapshot = await pageReviewRef(hostId, screenId).get()\n    const value = snapshot.get('servedVersionId')\n    return typeof value === 'string' && value ? value : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Note that this page served `versionId` clean. One read the first time a\n * process renders a page, a write only when the version moved; nothing\n * after that, however often the page is rendered.\n */\nexport async function recordServedPageVersion(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n): Promise<void> {\n  const key = `${hostId}/${screenId}`\n  // The foreign hosts this version links to, and the addresses on them, as\n  // its review found them (AGL-3451, AGL-3459): noted beside it so the daily\n  // link re-check can walk them. An address carries no query string.\n  const foreign = reviewedForeignHosts.get(`${key}/${versionId}`)\n  const linksKey = foreign ? `${foreign.hosts.join(',')}|${foreign.urls.join(',')}` : ''\n  const memoValue = foreign ? `${versionId}|${linksKey}` : versionId\n  if (!versionId || servedMemo.get(key) === memoValue) return\n  try {\n    const ref = pageReviewRef(hostId, screenId)\n    const snapshot = await ref.get()\n    const versionMoved = snapshot.get('servedVersionId') !== versionId\n    const storedHosts = snapshot.get('foreignHosts')\n    const storedLinks = snapshot.get('foreignLinks')\n    const linksMoved =\n      foreign !== undefined &&\n      `${Array.isArray(storedHosts) ? storedHosts.join(',') : ''}|${\n        Array.isArray(storedLinks) ? storedLinks.join(',') : ''\n      }` !== linksKey\n    if (versionMoved || linksMoved) {\n      await ref.set(\n        {\n          ...(versionMoved ? { servedVersionId: versionId, servedAtMs: Date.now() } : {}),\n          ...(foreign\n            ? {\n                foreignHosts: foreign.hosts,\n                foreignHostCount: foreign.hosts.length,\n                foreignLinks: foreign.urls,\n              }\n            : {}),\n        },\n        { merge: true },\n      )\n    }\n    servedMemo.set(key, memoValue)\n  } catch (error) {\n    console.warn('[page-review] the served version could not be noted', error)\n  }\n}\n\n/**\n * A domain a workspace attached that wears a brand (AGL-3356, AGL-3362):\n * filed in the abuse queue as an urgent `phishing` row for staff, not\n * refused. Two kinds, one rule:\n *\n * - `site` — a custom domain a site is served on (the attach route);\n * - `sending` — a custom domain a workspace sends email as, when it is\n *   added and again when it verifies (`sending-domains.ts`);\n * - `link` — a link a merchant configured that a buyer or a server would\n *   follow: a product's paid download or video hotlink, a supplier's order\n *   webhook (AGL-3363). The link itself is refused where it is followed; this\n *   files it, and tells the site's managers once ({@link notifyLookalikeLink}).\n *\n * Not refused, because the domain is the merchant's own registration and\n * the platform cannot tell a brand's own agency attaching `paypal-promo.com`\n * from a kit — but a brand's lookalike on a site or in a `From:` line is\n * exactly what staff look at first. The site's pages are still screened as\n * they are served, and mail FROM a lookalike domain is held at the send seam\n * for every workspace. The test is the phishing screen's own lookalike rule\n * (`lookalikeBrandForHost`), the one that holds a link in an email. One row\n * per (owner, kind, domain), so a re-attach or a re-verify counts rather than\n * re-alerts.\n *\n * Never throws: the write it rides on has already happened.\n */\nexport async function flagLookalikeDomain(input: {\n  kind: 'site' | 'sending' | 'link'\n  hostId: string | null\n  orgId: string | null\n  domain: string\n  /** For a `link`: where it was configured, as staff read it. */\n  where?: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  const domain = String(input.domain ?? '').trim().toLowerCase()\n  const brand = lookalikeBrandForHost(domain)\n  if (!brand) return 'clean'\n  const label = phishingScreenBrandLabel(brand.id)\n  const sending = input.kind === 'sending'\n  const link = input.kind === 'link'\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const owner = sending\n      ? `orgs/${input.orgId ?? ''}/sendingDomains`\n      : link\n        ? `hosts/${input.hostId ?? ''}/links`\n        : `hosts/${input.hostId ?? ''}/cname`\n    const reviewId = heldOutboundReviewId(owner, domain)\n    const reference = heldOutboundReference(reviewId)\n    const ref = firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const first = !(await ref.get()).exists\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url: `https://${domain}/`,\n        reportedHostname: domain,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          sending\n            ? `A workspace added ${domain} as a domain to send email from.`\n            : link\n              ? `A site configured a link to ${domain} (${input.where ?? 'a commerce link'}).`\n              : `A site attached the custom domain ${domain}.`,\n          `${domain} wears the ${label} name but is not ${label}'s domain.`,\n          sending\n            ? 'Email from it is held at the send seam for every workspace. Mark this actioned ' +\n              'and lock the workspace if it is impersonation; dismiss it if the brand is theirs.'\n            : link\n              ? 'Nobody is sent to it: the link is refused wherever it is followed. Mark this ' +\n                'actioned and lock the site if it is impersonation.'\n              : 'Its pages are still screened as they are served. Mark this actioned ' +\n                'and lock the site if it is impersonation; dismiss it if the brand is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (first && link) {\n      await notifyLookalikeLink({\n        hostId: input.hostId,\n        orgId: input.orgId,\n        domain,\n        label,\n        where: input.where ?? 'a commerce link',\n        reference,\n        reviewId,\n      })\n    } else if (first) {\n      // The owners hear that the domain is waiting on a routine review — not\n      // which name it resembles; staff get the brand and a link to the row.\n      await notifyRiskEvent({\n        kind: 'domain-flagged',\n        orgId: input.orgId,\n        hostId: input.hostId,\n        reviewId,\n        reference,\n        item: {\n          label: sending ? `the sending domain ${domain}` : `the custom domain ${domain}`,\n          // Emails → Sending, or the site's Domain settings.\n          path: sending ? '/org/emails/sending' : input.hostId ? `/${input.hostId}/admin/domain` : null,\n        },\n        staffEvidence:\n          `${sending ? 'Sending domain' : 'Custom domain'} ${domain} looks like ${label}.`,\n      })\n    }\n    return 'flagged'\n  } catch (error) {\n    console.error('[page-review] a lookalike domain could not be flagged', error)\n    return 'failed'\n  }\n}\n\n/**\n * Tell staff and the site's managers and the workspace's owners, once per\n * (site, domain), that a link the merchant configured was refused because it\n * wears another brand's name (AGL-3363), through the risk notice seam\n * (AGL-3368). The merchant reads the catalog's `link-blocked` words — what\n * was refused and how to fix it, never how the check works; staff get the\n * brand and a link to the row. Never throws.\n */\nexport async function notifyLookalikeLink(input: {\n  hostId: string | null\n  orgId?: string | null\n  domain: string\n  label: string\n  where: string\n  reference: string\n  reviewId?: string | null\n}): Promise<void> {\n  await notifyRiskEvent({\n    kind: 'link-blocked',\n    orgId: input.orgId ?? null,\n    hostId: input.hostId,\n    reviewId: input.reviewId ?? null,\n    reference: input.reference,\n    item: {\n      label: `${input.where} pointing to ${input.domain}`,\n      path: input.hostId ? `/${input.hostId}/products` : null,\n    },\n    staffEvidence:\n      `A site configured ${input.where} to ${input.domain}, which looks like ${input.label}. ` +\n      'It is refused wherever it is followed.',\n  }).catch(() => undefined)\n}\n\n/** A site's custom domain, through {@link flagLookalikeDomain}. */\nexport function flagLookalikeCustomDomain(input: {\n  hostId: string\n  orgId: string | null\n  domain: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  return flagLookalikeDomain({ kind: 'site', ...input })\n}\n"],"names":["ABUSE_REPORT_COLLECTION","heldPageConsolePath","heldPageDetails","heldPageLabel","heldPageVisitorSentence","screenHostedPage","screenSiteRedirect","lookalikeBrandForHost","phishingScreenBrandLabel","describePhishingScreenSignals","isYoungWorkspaceAge","signalsThatHold","foreignLinksForReputation","webRiskSignals","FieldValue","firebaseAdmin","describeHeldPage","notifyRiskEvent","orgAgeDays","requestPageSecurityHold","getHostDocAdmin","getOrgForHost","lookupLinkReputation","platformReputationExclusions","canonicalJson","fileOutboundHold","flaggedHostOf","heldOutboundReference","heldOutboundReviewId","outboundContentHash","workspaceScreenIdentity","PAGE_REVIEW_SUBCOLLECTION","pageReviewId","hostId","screenId","signals","key","map","signal","sort","join","PAGE_MEMO_TTL_MS","pageMemo","Map","servedMemo","flaggedMemo","FLAGGED_MEMO_TTL_MS","reviewedForeignHosts","REVIEWED_FOREIGN_HOSTS_MAX","resetHostedPageReviewMemoForTests","clear","pageLinkReputation","linkUrls","foreign","excludeDomains","hosts","length","answer","urls","hits","error","console","warn","isOwnHost","host","ownDomains","some","own","domain","String","trim","toLowerCase","Boolean","endsWith","subjectForRow","reviewId","describe","stored","app","firestore","collection","doc","get","then","row","storedSubject","catch","heldPage","subject","pageHeadline","siteName","reviewHostedPage","request","found","nodes","reputation","size","set","versionId","listed","extraSignals","outcome","nowMs","Date","now","owner","Promise","all","undefined","org","orgId","identity","verdict","screened","filter","ageDays","createdAt","strong","isAlreadyLive","flagLivePage","page","reference","memo","atMs","state","live","previousVersionId","servedPageVersion","url","entryUrl","flagged","label","heldSend","kind","path","contentHash","slice","fromName","heldAtMs","extra","headline","alertTitle","alertBody","charAt","toUpperCase","item","reportedHostname","pageLabel","pageUrl","redirectReviewId","ruleId","reviewSiteRedirect","source","destination","subdomainHost","customDomain","siteHost","startsWith","pageReviewRef","NEW_PAGE_DAYS","lastClean","screen","created","createdMs","toMillis","input","at","existing","evidence","ref","first","exists","category","severity","details","reporterEmail","reporterName","dmca","riskNotice","reportCount","increment","updatedAt","serverTimestamp","status","merge","staffEvidence","snapshot","value","recordServedPageVersion","linksKey","memoValue","versionMoved","storedHosts","storedLinks","linksMoved","Array","isArray","servedVersionId","servedAtMs","foreignHosts","foreignHostCount","foreignLinks","flagLookalikeDomain","brand","id","sending","link","where","notifyLookalikeLink","flagLookalikeCustomDomain"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA8E2C,GAE3C,SAASA,uBAAuB,QAAQ,sCAAqC;AAC7E,SACEC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,QAElB,qCAAoC;AAC3C,SAASC,gBAAgB,EAAEC,kBAAkB,QAAQ,8CAA6C;AAClG,SACEC,qBAAqB,EACrBC,wBAAwB,EAExBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,eAAe,QACV,oDAAmD;AAC1D,SAEEC,yBAAyB,EACzBC,cAAc,QACT,2CAA0C;AACjD,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,gBAAgB,QAAgC,yBAAqB;AAC9E,SAASC,eAAe,QAAQ,mBAAe;AAC/C,SAASC,UAAU,QAAQ,eAAW;AACtC,SAASC,uBAAuB,QAAQ,0BAAsB;AAC9D,SAASC,eAAe,EAAEC,aAAa,QAAQ,qBAAiB;AAChE,SAASC,oBAAoB,EAAEC,4BAA4B,QAAQ,gBAAY;AAC/E,SACEC,aAAa,EACbC,gBAAgB,EAChBC,aAAa,EACbC,qBAAqB,EACrBC,oBAAoB,EACpBC,mBAAmB,EAEnBC,uBAAuB,QAClB,4BAAwB;AAE/B,yFAAyF,GACzF,OAAO,MAAMC,4BAA4B,cAAa;AAiCtD,8DAA8D,GAC9D,OAAO,SAASC,aACdC,MAAc,EACdC,QAAgB,EAChBC,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,SAAS,EAAEC,UAAU,EAAEL,oBAAoB;QAACO;KAAI;AAC9F;AAEA,8EAA8E,GAC9E,MAAMK,mBAAmB;AACzB,MAAMC,WAAW,IAAIC;AACrB,4EAA4E,GAC5E,MAAMC,aAAa,IAAID;AACvB,oFAAoF,GACpF,MAAME,cAAc,IAAIF;AACxB,MAAMG,sBAAsB,KAAK;AACjC;;;;;;CAMC,GACD,MAAMC,uBAAuB,IAAIJ;AACjC,MAAMK,6BAA6B;AAEnC,iDAAiD,GACjD,OAAO,SAASC;IACdP,SAASQ,KAAK;IACdN,WAAWM,KAAK;IAChBL,YAAYK,KAAK;IACjBH,qBAAqBG,KAAK;AAC5B;AAEA;;;;;;;CAOC,GACD,eAAeC,mBACbC,QAA2B;IAE3B,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI;QACF,MAAMC,UAAUzC,0BAA0BwC,UAAU;YAClDE,gBAAgB/B;QAClB;QACA,IAAI,CAAC8B,QAAQE,KAAK,CAACC,MAAM,EAAE,OAAO,aAAKH;YAASlB,SAAS,EAAE;;QAC3D,MAAMsB,SAAS,MAAMnC,qBAAqB+B,QAAQE,KAAK,EAAE;YAAEG,MAAML,QAAQK,IAAI;QAAC;QAC9E,OAAO,aAAKL;YAASlB,SAAStB,eAAe4C,OAAOE,IAAI;;IAC1D,EAAE,OAAOC,OAAO;QACdC,QAAQC,IAAI,CAAC,wEAAwEF;QACrF,OAAO;YAAEL,OAAO,EAAE;YAAEG,MAAM,EAAE;YAAEvB,SAAS,EAAE;QAAC;IAC5C;AACF;AAEA,6CAA6C,GAC7C,SAAS4B,UAAUC,IAAY,EAAEC,UAA8D;IAC7F,OAAO,CAACA,qBAAAA,aAAc,EAAE,EAAEC,IAAI,CAAC,CAACC;QAC9B,MAAMC,SAASC,OAAOF,cAAAA,MAAO,IAAIG,IAAI,GAAGC,WAAW;QACnD,OAAOC,QAAQJ,WAAYJ,CAAAA,SAASI,UAAUJ,KAAKS,QAAQ,CAAC,CAAC,CAAC,EAAEL,QAAQ,CAAA;IAC1E;AACF;AAEA;;;;CAIC,GACD,eAAeM,cACbC,QAAgB,EAChBC,QAAwC;IAExC,MAAMC,SAAS,MAAM9D,cAClB+D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAChF,yBACXiF,GAAG,CAACN,UACJO,GAAG,GACHC,IAAI,CAAC,CAACC,MAAQC,cAAcD,IAAIF,GAAG,CAAC,cACpCI,KAAK,CAAC,IAAM;IACf,OAAOT,iBAAAA,SAAUD;AACnB;AAEA,6CAA6C,GAC7C,SAASS,cAAcE,QAAiB;IACtC,MAAMC,UAAWD,4BAAD,AAACA,SAA+DC,OAAO;IACvF,OAAOA,WAAW,OAAOA,YAAY,YAAYA,QAAQtD,QAAQ,GAAGsD,UAAU;AAChF;AAEA,iEAAiE,GACjE,SAASC,aAAaD,OAAwB,EAAEE,QAAgB;IAC9D,OAAO;QAAC,GAAGvF,cAAcqF,SAAS,IAAI,EAAEE,SAAS,CAAC,CAAC;WAAKxF,gBAAgBsF;KAAS,CAAChD,IAAI,CAAC;AACzF;AAEA;;;CAGC,GACD,OAAO,eAAemD,iBACpBC,OAAgC;QAYWA,uBAG7BA;IAbd,MAAMC,QAAQxF,iBAAiB;QAAEyF,OAAOF,QAAQE,KAAK;IAAC;IACtD,+DAA+D;IAC/D,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAMC,aAAa,MAAM5C,mBAAmB0C,MAAMzC,QAAQ;IAC1D,IAAIL,qBAAqBiD,IAAI,IAAIhD,4BAA4BD,qBAAqBG,KAAK;IACvFH,qBAAqBkD,GAAG,CAAC,GAAGL,QAAQ3D,MAAM,CAAC,CAAC,EAAE2D,QAAQ1D,QAAQ,CAAC,CAAC,EAAE0D,QAAQM,SAAS,EAAE,EAAE;QACrF3C,OAAOwC,WAAWxC,KAAK;QACvBG,MAAMqC,WAAWrC,IAAI;IACvB;IACA,MAAMyC,SAAS;WAAIJ,WAAW5D,OAAO;YAAMyD,wBAAAA,QAAQQ,YAAY,YAApBR,wBAAwB,EAAE;KAAE;IACvE,IAAI,CAACC,MAAM1D,OAAO,CAACqB,MAAM,IAAI,CAAC2C,OAAO3C,MAAM,EAAE,OAAO;QAAE6C,SAAS;IAAQ;IAEvE,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAyEHJ;QA5EZ,MAAM,CAACxB,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG5C,gBAAgBwE,QAAQ3D,MAAM;YAC1E2D,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDxF,cAAcuE,QAAQ3D,MAAM;SACjC;QACD,MAAM4E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,sEAAsE;QACtE,qEAAqE;QACrE,MAAMC,WAAWjF,wBAAwB;YAAE+E;YAAK7C;QAAK;QACrD,MAAMgD,UAAU3G,iBAAiB;YAAEyF,OAAOF,QAAQE,KAAK;WAAKiB;QAC5D,oEAAoE;QACpE,MAAME,WAAW;eACZD,QAAQ7E,OAAO;eACfgE,OAAOe,MAAM,CACd,CAAC5E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACyB,UAAUzB,OAAO0B,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAUjG,WAAY2F,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,0DAA0D;QAC1D,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAAC5F,oBAAoByG,UAAU;YACjC,MAAME,SAAS1G,gBAAgBsG,UAAU;gBAAEE;YAAQ;YACnD,IAAI,CAACE,OAAO7D,MAAM,EAAE,OAAO;gBAAE6C,SAAS;YAAQ;YAC9C,IAAI,MAAMiB,cAAc1B,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ,EAAE0D,QAAQM,SAAS,EAAEI,QAAQ;oBAS3EV;gBARR,MAAM2B,aAAa;oBACjBtF,QAAQ2D,QAAQ3D,MAAM;oBACtBC,UAAU0D,QAAQ1D,QAAQ;oBAC1BgE,WAAWN,QAAQM,SAAS;oBAC5BY;oBACA9C;oBACA7B,SAASkF;oBACTf;oBACAkB,IAAI,GAAE5B,gBAAAA,QAAQ4B,IAAI,YAAZ5B,gBAAgB;oBACtBmB;gBACF;gBACA,OAAO;oBAAEV,SAAS;gBAAQ;YAC5B;QACF;QACA,MAAMlE,UAAUxB,gBAAgBsG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAChF,QAAQqB,MAAM,EAAE,OAAO;YAAE6C,SAAS;QAAQ;QAE/C,MAAM1B,WAAW3C,aAAa4D,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ,EAAEC;QAChE,MAAMsF,YAAY9F,sBAAsBgD;QACxC,MAAM+C,OAAOhF,SAASwC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGlF,kBAAkB;YAChD,OAAOiF,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,sEAAsE;QACtE,kEAAkE;QAClE,MAAMjC,UAAU,MAAMd,cAAcC,UAAU,UAC5C3D,iBAAiB;gBACfiB,QAAQ2D,QAAQ3D,MAAM;gBACtBC,UAAU0D,QAAQ1D,QAAQ;gBAC1BgE,WAAWN,QAAQM,SAAS;gBAC5BlC;gBACAwD,MAAM5B,QAAQ4B,IAAI;gBAClBrF;gBACA4E;gBACAc,MAAM;gBACNC,mBAAmB,MAAMC,kBAAkBnC,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ;YAC7E;QAEF,MAAM8F,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAME,UAAUxG,cAAcS;QAC9B,MAAMuD,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAMmE,QAAQhI,cAAcqF;QAC5B,MAAMoC,QAAQ,MAAMnG,iBAAiB;YACnCkD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQ3D,MAAM,CAAC,SAAS,EAAE2D,QAAQ1D,QAAQ,EAAE;gBAC3DD,QAAQ2D,QAAQ3D,MAAM;gBACtB6E;gBACAyB,aAAa1G,oBAAoB;oBAACM;iBAAQ;gBAC1CqD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVtG;gBACAyF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAwB,OAAO;gBACLpD,UAAU;oBAAErD,UAAU0D,QAAQ1D,QAAQ;oBAAEgE,WAAWN,QAAQM,SAAS;oBAAE8B;oBAAKxC;gBAAQ;YACrF;YACAoD,UACE,CAAC,KAAK,EAAEnD,aAAaD,SAASE,UAAU,SAAS,EAAEE,QAAQM,SAAS,CAAC,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEiB,kBAAAA,UAAW,IAAI,aAAa,EAAE/G,wBAAwBoF,UAAU;YAC/EqD,YAAY;YACZC,WAAW,GAAGX,MAAMY,MAAM,CAAC,GAAGC,WAAW,KAAKb,MAAMK,KAAK,CAAC,GAAG,8BAA8B,CAAC;YAC5F,wEAAwE;YACxES,MAAM;gBAAEd;gBAAOG,MAAMrI,oBAAoBuF,SAASI,QAAQ3D,MAAM;YAAE;YAClEuF,MAAMhC;YACN,qEAAqE;YACrE,6DAA6D;YAC7DwC;YACAkB,kBAAkBhB;QACpB;QACA,gEAAgE;QAChE,oEAAoE;QACpE,IAAIN,UAAU,QAAQ;YACpB,MAAMzG,wBAAwB;gBAC5B2F,KAAK,EAAEA,gBAAAA,QAAS;gBAChBD;gBACA5E,QAAQ2D,QAAQ3D,MAAM;gBACtBC,UAAU0D,QAAQ1D,QAAQ;gBAC1BgE,WAAWN,QAAQM,SAAS;gBAC5BvB;gBACA8C;gBACAtF;gBACAgF;gBACAgC,WAAWhB;gBACXiB,SAASpB;gBACTtC,UAAU,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,WAAWA,IAAI,CAAC,OAAO,GAAG;gBAC9DsC;YACF;QACF;QACA5D,SAASuD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpCC,QAAQD,KAAK,CAAC,mEAAmEA;QACjF,MAAMe,WAAW3C,aAAa4D,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ,EAAE;eAAI2D,MAAM1D,OAAO;eAAKgE;SAAO;QAC7F,OAAO;YAAEE,SAAS;YAAQ1B;YAAU8C,WAAW9F,sBAAsBgD;QAAU;IACjF;AACF;AAiBA,uEAAuE,GACvE,OAAO,SAAS0E,iBACdpH,MAAc,EACdqH,MAAc,EACdnH,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,WAAW,EAAEqH,QAAQ,EAAEzH,oBAAoB;QAACO;KAAI;AAC9F;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAemH,mBACpB3D,OAAkC;QAQpBA;IANd,MAAMC,QAAQvF,mBAAmB;QAAEkJ,QAAQ5D,QAAQ4D,MAAM;QAAEC,aAAa7D,QAAQ6D,WAAW;IAAC;IAC5F,qEAAqE;IACrE,uEAAuE;IACvE,MAAM1D,aAAa,MAAM5C,mBAAmB0C,MAAMzC,QAAQ;IAC1D,IAAI,CAACyC,MAAM1D,OAAO,CAACqB,MAAM,IAAI,CAACuC,WAAW5D,OAAO,CAACqB,MAAM,EAAE,OAAO;QAAE6C,SAAS;IAAQ;IAEnF,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAkCuBmB;QArCtC,MAAM,CAAC/C,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG5C,gBAAgBwE,QAAQ3D,MAAM;YAC1E2D,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDxF,cAAcuE,QAAQ3D,MAAM;SACjC;QACD,MAAM4E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,MAAMC,WAAWjF,wBAAwB;YAAE+E;YAAK7C;QAAK;QACrD,MAAMgD,UAAU1G,mBAAmB;YACjCkJ,QAAQ5D,QAAQ4D,MAAM;YACtBC,aAAa7D,QAAQ6D,WAAW;WAC7B1C;QAEL,MAAME,WAAW;eACZD,QAAQ7E,OAAO;eACf4D,WAAW5D,OAAO,CAAC+E,MAAM,CAC1B,CAAC5E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACyB,UAAUzB,OAAO0B,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAUjG,WAAY2F,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,MAAMnE,UAAUxB,gBAAgBsG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAChF,QAAQqB,MAAM,EAAE,OAAO;YAAE6C,SAAS;QAAQ;QAE/C,MAAM1B,WAAW0E,iBAAiBzD,QAAQ3D,MAAM,EAAE2D,QAAQ0D,MAAM,EAAEnH;QAClE,MAAMsF,YAAY9F,sBAAsBgD;QACxC,MAAM+C,OAAOhF,SAASwC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGlF,kBAAkB;YAChD,OAAOiF,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,MAAM+B,SAAS5D,QAAQ4D,MAAM,CAAChB,KAAK,CAAC,GAAG;QACvC,MAAMiB,cAAc7D,QAAQ6D,WAAW,CAACjB,KAAK,CAAC,GAAG;QACjD,MAAML,QAAQ,CAAC,kBAAkB,EAAEqB,QAAQ;QAC3C,MAAM9D,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM,CAAC0F,eAAeC,aAAa,IAAG5C,uBAAAA,SAAS9C,UAAU,YAAnB8C,uBAAuB,EAAE;QAC/D,MAAM6C,WAAWD,gBAAgBD;QACjC,MAAM9B,QAAQ,MAAMnG,iBAAiB;YACnCkD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQ3D,MAAM,CAAC,WAAW,EAAE2D,QAAQ0D,MAAM,EAAE;gBAC3DrH,QAAQ2D,QAAQ3D,MAAM;gBACtB6E;gBACAyB,aAAa1G,oBAAoB;oBAACM;iBAAQ;gBAC1CqD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVtG;gBACAyF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAyB,UACE,CAAC,KAAK,EAAET,MAAM,IAAI,EAAEzC,SAAS,0BAA0B,EAAE+D,YAAY,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEtC,kBAAAA,UAAW,IAAI,0DAA0D,CAAC;YACzF0B,YAAY;YACZC,WAAW,CAAC,kBAAkB,EAAEU,OAAO,6CAA6C,CAAC;YACrF,sDAAsD;YACtDP,MAAM;gBAAEd;gBAAOG,MAAM,CAAC,CAAC,EAAE1C,QAAQ3D,MAAM,CAAC,UAAU,CAAC;YAAC;YACpD+F,KAAK4B,YAAYJ,OAAOK,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAED,WAAWJ,QAAQ,GAAGC;YAC3EP,kBAAkBxH,cAAcS;QAClC;QACAO,SAASuD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,0EAA0E;QAC1EC,QAAQD,KAAK,CAAC,uEAAuEA;QACrF,MAAMe,WAAW0E,iBAAiBzD,QAAQ3D,MAAM,EAAE2D,QAAQ0D,MAAM,EAAE;eAC7DzD,MAAM1D,OAAO;eACb4D,WAAW5D,OAAO;SACtB;QACD,OAAO;YAAEkE,SAAS;YAAQ1B;YAAU8C,WAAW9F,sBAAsBgD;QAAU;IACjF;AACF;AAEA,SAASmF,cAAc7H,MAAc,EAAEC,QAAgB;IACrD,OAAOnB,cACJ+D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAChD,QACJ+C,UAAU,CAACjD,2BACXkD,GAAG,CAAC/C;AACT;AAEA;;;;;;CAMC,GACD,MAAM6H,gBAAgB;AACtB,eAAezC,cACbrF,MAAc,EACdC,QAAgB,EAChBgE,SAAiB,EACjBI,KAAa;IAEb,MAAM0D,YAAY,MAAMjC,kBAAkB9F,QAAQC;IAClD,IAAI8H,WAAW,OAAOA,cAAc9D;IACpC,IAAI;QACF,MAAM+D,SAAS,MAAMlJ,cAClB+D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAChD,QACJ+C,UAAU,CAAC,WACXC,GAAG,CAAC/C,UACJgD,GAAG;QACN,MAAMgF,UAAUD,OAAO/E,GAAG,CAAC;QAC3B,MAAMiF,YACJ,OAAOD,YAAY,WAAWA,UAAU,QAAOA,2BAAAA,QAASE,QAAQ,MAAK,aAAaF,QAAQE,QAAQ,KAAK;QACzG,mDAAmD;QACnD,OAAOD,cAAc,QAAQ7D,QAAQ6D,aAAaJ,gBAAgB,KAAK,KAAK,KAAK;IACnF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,eAAexC,aAAa8C,KAU3B;IACC,MAAMjI,MAAM,GAAGiI,MAAMpI,MAAM,CAAC,EAAE,EAAEoI,MAAMnI,QAAQ,CAAC,EAAE,EAAEmI,MAAMlI,OAAO,CAACE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAASC,IAAI,GAAGC,IAAI,CAAC,OAAO;IAC3H,MAAM8H,KAAKzH,YAAYqC,GAAG,CAAC9C;IAC3B,IAAIkI,OAAO1D,aAAayD,MAAM/D,KAAK,GAAGgE,KAAKxH,qBAAqB;IAChED,YAAYoD,GAAG,CAAC7D,KAAKiI,MAAM/D,KAAK;IAChC,IAAI;YAUCiE,MAQWF,iBAIF7E;YAEH6E;QAvBT,MAAM1F,WAAW3C,aAAaqI,MAAMpI,MAAM,EAAE,GAAGoI,MAAMnI,QAAQ,CAAC,KAAK,CAAC,EAAEmI,MAAMlI,OAAO;QACnF,MAAMsF,YAAY9F,sBAAsBgD;QACxC,MAAM6F,WAAW/J,8BAA8B4J,MAAMlI,OAAO,EAAEK,IAAI,CAAC;QACnE,MAAM0F,UAAUxG,cAAc2I,MAAMlI,OAAO;QAC3C,MAAMsI,MAAM1J,cAAc+D,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAChF,yBAAyBiF,GAAG,CAACN;QACpF,MAAM4F,WAAW,MAAME,IAAIvF,GAAG;QAC9B,MAAMwF,QAAQ,CAACH,SAASI,MAAM;QAC9B,8CAA8C;QAC9C,MAAMnF,WACH+E,OAAAA,SAASI,MAAM,GAAGtF,cAAckF,SAASrF,GAAG,CAAC,eAAe,gBAA5DqF,OACA,MAAMvJ,iBAAiB;YACtBiB,QAAQoI,MAAMpI,MAAM;YACpBC,UAAUmI,MAAMnI,QAAQ;YACxBgE,WAAWmE,MAAMnE,SAAS;YAC1BlC,MAAMqG,MAAMrG,IAAI;YAChBwD,MAAM6C,MAAM7C,IAAI;YAChBrF,SAASkI,MAAMlI,OAAO;YACtB4E,QAAQ,GAAEsD,kBAAAA,MAAMtD,QAAQ,YAAdsD,kBAAkBvI,wBAAwB;gBAAEkC,MAAMqG,MAAMrG,IAAI;YAAC;YACvE6D,MAAM;YACNC,mBAAmB;QACrB;QACF,MAAME,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAMtC,WACJ,SAAO2E,cAAAA,MAAMrG,IAAI,qBAAVqG,WAAY,CAAC,OAAO,MAAK,YAAYA,MAAMrG,IAAI,CAAC,OAAO,GAC1D,CAAC,CAAC,EAAEqG,MAAMrG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GACzB;QACN,MAAMyG,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB;YACAkB,kBAAkBhB;YAClBjG,QAAQoI,MAAMpI,MAAM;YACpB6E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP,CAAC,MAAM,EAAErF,aAAaD,SAASE,UAAU,4DAA4D,CAAC;gBACtG8E;gBACA;aACD,CAAChI,IAAI,CAAC;YACPuI,eAAe;YACfC,cAAc;YACdC,MAAM;YACN1F,UAAU;gBAAErD,UAAUmI,MAAMnI,QAAQ;gBAAEgE,WAAWmE,MAAMnE,SAAS;gBAAE8B;gBAAKxC;YAAQ;YAC/E0F,YAAY;gBAAE7C,MAAM;YAAe;YACnC8C,aAAarK,WAAWsK,SAAS,CAAC;YAClCC,WAAWvK,WAAWwK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWtG,WAAWwK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAI,CAACd,OAAO;QACZ,MAAMzJ,gBAAgB;YACpBoH,MAAM;YACNvB,OAAOuD,MAAMvD,KAAK;YAClB7E,QAAQoI,MAAMpI,MAAM;YACpB0C;YACA8C;YACAwB,MAAM;gBAAEd,OAAOhI,cAAcqF;gBAAU8C,MAAMrI,oBAAoBuF,SAAS6E,MAAMpI,MAAM;YAAE;YACxFuF,MAAMhC;YACNiG,eAAe;mBAAIvL,gBAAgBsF;gBAAUgF;aAAS,CAAChI,IAAI,CAAC;QAC9D;IACF,EAAE,OAAOoB,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;IAClE;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAemE,kBAAkB9F,MAAc,EAAEC,QAAgB;IACtE,IAAI;QACF,MAAMwJ,WAAW,MAAM5B,cAAc7H,QAAQC,UAAUgD,GAAG;QAC1D,MAAMyG,QAAQD,SAASxG,GAAG,CAAC;QAC3B,OAAO,OAAOyG,UAAU,YAAYA,QAAQA,QAAQ;IACtD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpB3J,MAAc,EACdC,QAAgB,EAChBgE,SAAiB;IAEjB,MAAM9D,MAAM,GAAGH,OAAO,CAAC,EAAEC,UAAU;IACnC,yEAAyE;IACzE,2EAA2E;IAC3E,mEAAmE;IACnE,MAAMmB,UAAUN,qBAAqBmC,GAAG,CAAC,GAAG9C,IAAI,CAAC,EAAE8D,WAAW;IAC9D,MAAM2F,WAAWxI,UAAU,GAAGA,QAAQE,KAAK,CAACf,IAAI,CAAC,KAAK,CAAC,EAAEa,QAAQK,IAAI,CAAClB,IAAI,CAAC,MAAM,GAAG;IACpF,MAAMsJ,YAAYzI,UAAU,GAAG6C,UAAU,CAAC,EAAE2F,UAAU,GAAG3F;IACzD,IAAI,CAACA,aAAatD,WAAWsC,GAAG,CAAC9C,SAAS0J,WAAW;IACrD,IAAI;QACF,MAAMrB,MAAMX,cAAc7H,QAAQC;QAClC,MAAMwJ,WAAW,MAAMjB,IAAIvF,GAAG;QAC9B,MAAM6G,eAAeL,SAASxG,GAAG,CAAC,uBAAuBgB;QACzD,MAAM8F,cAAcN,SAASxG,GAAG,CAAC;QACjC,MAAM+G,cAAcP,SAASxG,GAAG,CAAC;QACjC,MAAMgH,aACJ7I,YAAYuD,aACZ,GAAGuF,MAAMC,OAAO,CAACJ,eAAeA,YAAYxJ,IAAI,CAAC,OAAO,GAAG,CAAC,EAC1D2J,MAAMC,OAAO,CAACH,eAAeA,YAAYzJ,IAAI,CAAC,OAAO,IACrD,KAAKqJ;QACT,IAAIE,gBAAgBG,YAAY;YAC9B,MAAMzB,IAAIxE,GAAG,CACX,aACM8F,eAAe;gBAAEM,iBAAiBnG;gBAAWoG,YAAY/F,KAAKC,GAAG;YAAG,IAAI,CAAC,GACzEnD,UACA;gBACEkJ,cAAclJ,QAAQE,KAAK;gBAC3BiJ,kBAAkBnJ,QAAQE,KAAK,CAACC,MAAM;gBACtCiJ,cAAcpJ,QAAQK,IAAI;YAC5B,IACA,CAAC,IAEP;gBAAE8H,OAAO;YAAK;QAElB;QACA5I,WAAWqD,GAAG,CAAC7D,KAAK0J;IACtB,EAAE,OAAOlI,OAAO;QACdC,QAAQC,IAAI,CAAC,uDAAuDF;IACtE;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,eAAe8I,oBAAoBrC,KAOzC;QACuBA;IAAtB,MAAMjG,SAASC,QAAOgG,gBAAAA,MAAMjG,MAAM,YAAZiG,gBAAgB,IAAI/F,IAAI,GAAGC,WAAW;IAC5D,MAAMoI,QAAQpM,sBAAsB6D;IACpC,IAAI,CAACuI,OAAO,OAAO;IACnB,MAAMxE,QAAQ3H,yBAAyBmM,MAAMC,EAAE;IAC/C,MAAMC,UAAUxC,MAAMhC,IAAI,KAAK;IAC/B,MAAMyE,OAAOzC,MAAMhC,IAAI,KAAK;IAC5B,IAAI;YAGUgC,cAEGA,eACAA,gBAmBuCA;QAxBtD,MAAMtF,YAAYhE,cAAc+D,GAAG,GAAGC,SAAS;QAC/C,MAAM0B,QAAQoG,UACV,CAAC,KAAK,GAAExC,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe,GAAG,eAAe,CAAC,GAC1CyC,OACE,CAAC,MAAM,GAAEzC,gBAAAA,MAAMpI,MAAM,YAAZoI,gBAAgB,GAAG,MAAM,CAAC,GACnC,CAAC,MAAM,GAAEA,iBAAAA,MAAMpI,MAAM,YAAZoI,iBAAgB,GAAG,MAAM,CAAC;QACzC,MAAM1F,WAAW/C,qBAAqB6E,OAAOrC;QAC7C,MAAMqD,YAAY9F,sBAAsBgD;QACxC,MAAM8F,MAAM1F,UAAUC,UAAU,CAAChF,yBAAyBiF,GAAG,CAACN;QAC9D,MAAM+F,QAAQ,CAAC,AAAC,CAAA,MAAMD,IAAIvF,GAAG,EAAC,EAAGyF,MAAM;QACvC,MAAMF,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB,KAAK,CAAC,QAAQ,EAAE5D,OAAO,CAAC,CAAC;YACzB8E,kBAAkB9E;YAClBnC,QAAQoI,MAAMpI,MAAM;YACpB6E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP+B,UACI,CAAC,kBAAkB,EAAEzI,OAAO,gCAAgC,CAAC,GAC7D0I,OACE,CAAC,4BAA4B,EAAE1I,OAAO,EAAE,GAAEiG,eAAAA,MAAM0C,KAAK,YAAX1C,eAAe,kBAAkB,EAAE,CAAC,GAC9E,CAAC,kCAAkC,EAAEjG,OAAO,CAAC,CAAC;gBACpD,GAAGA,OAAO,WAAW,EAAE+D,MAAM,iBAAiB,EAAEA,MAAM,UAAU,CAAC;gBACjE0E,UACI,oFACA,sFACAC,OACE,kFACA,uDACA,yEACA;aACP,CAACtK,IAAI,CAAC;YACPuI,eAAe;YACfC,cAAc;YACdC,MAAM;YACNE,aAAarK,WAAWsK,SAAS,CAAC;YAClCC,WAAWvK,WAAWwK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWtG,WAAWwK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAId,SAASoC,MAAM;gBAMRzC;YALT,MAAM2C,oBAAoB;gBACxB/K,QAAQoI,MAAMpI,MAAM;gBACpB6E,OAAOuD,MAAMvD,KAAK;gBAClB1C;gBACA+D;gBACA4E,KAAK,GAAE1C,gBAAAA,MAAM0C,KAAK,YAAX1C,gBAAe;gBACtB5C;gBACA9C;YACF;QACF,OAAO,IAAI+F,OAAO;YAChB,uEAAuE;YACvE,sEAAsE;YACtE,MAAMzJ,gBAAgB;gBACpBoH,MAAM;gBACNvB,OAAOuD,MAAMvD,KAAK;gBAClB7E,QAAQoI,MAAMpI,MAAM;gBACpB0C;gBACA8C;gBACAwB,MAAM;oBACJd,OAAO0E,UAAU,CAAC,mBAAmB,EAAEzI,QAAQ,GAAG,CAAC,kBAAkB,EAAEA,QAAQ;oBAC/E,mDAAmD;oBACnDkE,MAAMuE,UAAU,wBAAwBxC,MAAMpI,MAAM,GAAG,CAAC,CAAC,EAAEoI,MAAMpI,MAAM,CAAC,aAAa,CAAC,GAAG;gBAC3F;gBACAwJ,eACE,GAAGoB,UAAU,mBAAmB,gBAAgB,CAAC,EAAEzI,OAAO,YAAY,EAAE+D,MAAM,CAAC,CAAC;YACpF;QACF;QACA,OAAO;IACT,EAAE,OAAOvE,OAAO;QACdC,QAAQD,KAAK,CAAC,yDAAyDA;QACvE,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeoJ,oBAAoB3C,KAQzC;QAGUA,cAEGA;IAJZ,MAAMpJ,gBAAgB;QACpBoH,MAAM;QACNvB,KAAK,GAAEuD,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe;QACtBpI,QAAQoI,MAAMpI,MAAM;QACpB0C,QAAQ,GAAE0F,kBAAAA,MAAM1F,QAAQ,YAAd0F,kBAAkB;QAC5B5C,WAAW4C,MAAM5C,SAAS;QAC1BwB,MAAM;YACJd,OAAO,GAAGkC,MAAM0C,KAAK,CAAC,aAAa,EAAE1C,MAAMjG,MAAM,EAAE;YACnDkE,MAAM+B,MAAMpI,MAAM,GAAG,CAAC,CAAC,EAAEoI,MAAMpI,MAAM,CAAC,SAAS,CAAC,GAAG;QACrD;QACAwJ,eACE,CAAC,kBAAkB,EAAEpB,MAAM0C,KAAK,CAAC,IAAI,EAAE1C,MAAMjG,MAAM,CAAC,mBAAmB,EAAEiG,MAAMlC,KAAK,CAAC,EAAE,CAAC,GACxF;IACJ,GAAG7C,KAAK,CAAC,IAAMsB;AACjB;AAEA,iEAAiE,GACjE,OAAO,SAASqG,0BAA0B5C,KAIzC;IACC,OAAOqC,oBAAoB;QAAErE,MAAM;OAAWgC;AAChD"}

package/src/lib/server/leaving-notice.d.ts

@@ -0,0 +1,98 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type LeavingNoticeConfig } from '@aglyn/aglyn/app-utils/leaving-notice';
+import { type SiteReturnHost } from '@aglyn/aglyn/app-utils/site-return-url';
+/** How long a new free workspace's sites carry the notice. */
+export declare const LEAVING_NOTICE_DAYS = 14;
+/**
+ * The most outside addresses one page is signed for. A page with more is a
+ * link farm, and the ones past the cap still go through the notice — which
+ * refuses them — rather than around it.
+ */
+export declare const LEAVING_NOTICE_MAX_DESTINATIONS = 500;
+/**
+ * When a workspace's notice window closes (epoch ms), or `null` when its
+ * sites carry no notice: a paid plan, a workspace past its first
+ * {@link LEAVING_NOTICE_DAYS} days, or one whose creation date is unreadable.
+ *
+ * Takes the org as loaded anywhere — a live document, or the render cache's
+ * JSON copy, whose `createdAt` has lost its methods (`orgCreatedMs`).
+ */
+export declare function leavingNoticeEndsAt(org: unknown, nowMs?: number): number | null;
+/**
+ * The hosts a link may reach without the notice: the site's own (its
+ * subdomain, its custom domain and `www.` of it) and the platform's own — the
+ * marketing site, console, support and docs, each with every name under its
+ * registrable domain, plus the bare tenant apex.
+ *
+ * Other sites on the tenant apex are NOT exempt. They are other customers'
+ * sites, and a chain of two new free sites is the same hop as one.
+ */
+export declare function leavingNoticeHosts(site: SiteReturnHost | null | undefined): string[];
+/**
+ * Every outside address a rendered page could link to: each string in the
+ * payload that is one, and each one embedded in a string (Markdown, rich
+ * text HTML, a plain sentence). Over-collecting is harmless — a signature
+ * nobody follows is never read — and under-collecting only sends a link to a
+ * refusal, never around the notice.
+ *
+ * Returned normalized, the spelling the client looks signatures up by.
+ */
+export declare function collectLeavingDestinations(value: unknown, hosts: readonly string[], limit?: number): string[];
+/**
+ * The signature for one destination on one site. Throws when the deployment
+ * has no signing secret, like every signer of it.
+ */
+export declare function signLeavingDestination(hostId: string, destination: string): string;
+/**
+ * Whether `signature` was issued for `destination` on this site. False for
+ * anything else — another site's signature, an edited address, a missing
+ * secret (fail closed).
+ */
+export declare function verifyLeavingDestination(hostId: string, destination: unknown, signature: unknown): boolean;
+/** Signs a page's destinations for one site. */
+export declare function signLeavingDestinations(hostId: string, destinations: readonly string[]): Record<string, string>;
+/**
+ * What a published page of this site carries, or `null` when the site is not
+ * in its window.
+ *
+ * `content` is everything the page renders from — its props, its nodes —
+ * walked for outside addresses to sign.
+ *
+ * A deployment with no signing secret gets no notice, loudly. The route
+ * could verify nothing there and would refuse every link on every new free
+ * site; an outage of every outbound link is not a safer failure than the
+ * links working as they did before this existed.
+ */
+export declare function leavingNoticeConfig(options: {
+    hostId: string | null | undefined;
+    site: SiteReturnHost | null | undefined;
+    org: unknown;
+    content?: unknown;
+    nowMs?: number;
+}): LeavingNoticeConfig | null;
+/**
+ * Only the signatures, for a payload that arrives after its page — a gated
+ * screen's nodes (`enrichGatedScreenPage`). `null` outside the window.
+ */
+export declare function leavingNoticeSignatures(options: {
+    hostId: string | null | undefined;
+    site: SiteReturnHost | null | undefined;
+    org: unknown;
+    content: unknown;
+    nowMs?: number;
+}): Record<string, string> | null;

package/src/lib/server/leaving-notice.js

@@ -0,0 +1,250 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * THE "YOU'RE LEAVING THIS SITE" NOTICE, SERVER HALF (AGL-3452).
+ *
+ * Who gets it, which hosts are exempt, and the signature that keeps the
+ * notice route from becoming an open redirect. The client half — rewriting
+ * an href, the click interceptor — is `@aglyn/aglyn/app-utils/leaving-notice`.
+ *
+ * ## Who
+ *
+ * A site whose workspace is on the FREE plan (the effective plan, so a dead
+ * subscription counts as free, as it does for every entitlement) and in its
+ * first {@link LEAVING_NOTICE_DAYS} days — the same window, read through the
+ * same `isYoungWorkspaceAge`, as the soft phishing rules. Paid and older
+ * workspaces are untouched, and a workspace whose creation date cannot be
+ * read is an existing customer, never a new one.
+ *
+ * ## Why signed
+ *
+ * The notice lives on the site's own host and its Continue button goes
+ * wherever `?to=` says. Unsigned, any site's notice would be a page that
+ * vouches for any address anyone puts in a link — the hop this feature exists
+ * to remove. So the server signs each outside address it finds on a page it
+ * renders, bound to that site, and the route shows a Continue button only for
+ * an address whose signature checks out. Everything else is refused.
+ *
+ * The signature carries no expiry on purpose. The route never redirects on
+ * its own, so a signature that outlives its page buys nothing but one more
+ * view of the same warning — while an expiring one would break the links an
+ * ISR-cached page is still serving the moment the window closes.
+ *=========================================*/ import { createHmac } from "crypto";
+import { DOCS_BASE_URL } from "@aglyn/aglyn/app-utils/docs-help";
+import { leavingDestination, normalizeLeavingDestination } from "@aglyn/aglyn/app-utils/leaving-notice";
+import { resolveEffectivePlan } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { PLATFORM_HOME_URL, PLATFORM_SUPPORT_URL, platformConsoleOrigin } from "@aglyn/aglyn/app-utils/platform-brand";
+import { siteOwnHosts } from "@aglyn/aglyn/app-utils/site-return-url";
+import { TENANT_APEX } from "@aglyn/aglyn/app-utils/tenant-apex";
+import { isYoungWorkspaceAge, OUTBOUND_REVIEW_YOUNG_DAYS, registrableDomain } from "@aglyn/shared-util-email/outbound-phishing-screen";
+import { tokenSigningSecret } from "./media-signing.js";
+import { orgAgeDays, orgCreatedMs } from "./org-age.js";
+import { safeEqual } from "./safe-equal.js";
+/** How long a new free workspace's sites carry the notice. */ export const LEAVING_NOTICE_DAYS = OUTBOUND_REVIEW_YOUNG_DAYS;
+const DAY_MS = 86400000;
+/**
+ * The most outside addresses one page is signed for. A page with more is a
+ * link farm, and the ones past the cap still go through the notice — which
+ * refuses them — rather than around it.
+ */ export const LEAVING_NOTICE_MAX_DESTINATIONS = 500;
+/** Deepest a page payload is walked; composed node maps sit far above it. */ const MAX_WALK_DEPTH = 64;
+/** Longest string scanned for embedded addresses (a long entry body). */ const MAX_SCANNED_STRING = 200000;
+/**
+ * When a workspace's notice window closes (epoch ms), or `null` when its
+ * sites carry no notice: a paid plan, a workspace past its first
+ * {@link LEAVING_NOTICE_DAYS} days, or one whose creation date is unreadable.
+ *
+ * Takes the org as loaded anywhere — a live document, or the render cache's
+ * JSON copy, whose `createdAt` has lost its methods (`orgCreatedMs`).
+ */ export function leavingNoticeEndsAt(org, nowMs = Date.now()) {
+    if (!org || typeof org !== 'object') return null;
+    if (resolveEffectivePlan(org) !== 'free') return null;
+    const createdAt = org.createdAt;
+    if (!isYoungWorkspaceAge(orgAgeDays(createdAt, nowMs))) return null;
+    const createdMs = orgCreatedMs(createdAt);
+    return createdMs === null ? null : createdMs + LEAVING_NOTICE_DAYS * DAY_MS;
+}
+function hostnameOf(raw) {
+    if (!raw) return null;
+    try {
+        const url = new URL(raw);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+        return url.hostname.toLowerCase() || null;
+    } catch (unused) {
+        return null;
+    }
+}
+/**
+ * The hosts a link may reach without the notice: the site's own (its
+ * subdomain, its custom domain and `www.` of it) and the platform's own — the
+ * marketing site, console, support and docs, each with every name under its
+ * registrable domain, plus the bare tenant apex.
+ *
+ * Other sites on the tenant apex are NOT exempt. They are other customers'
+ * sites, and a chain of two new free sites is the same hop as one.
+ */ export function leavingNoticeHosts(site) {
+    const hosts = new Set(siteOwnHosts(site));
+    const apex = TENANT_APEX.toLowerCase();
+    hosts.add(apex);
+    const apexRegistrable = registrableDomain(apex);
+    for (const raw of [
+        PLATFORM_HOME_URL,
+        platformConsoleOrigin(),
+        PLATFORM_SUPPORT_URL,
+        DOCS_BASE_URL
+    ]){
+        const hostname = hostnameOf(raw);
+        if (!hostname) continue;
+        hosts.add(hostname);
+        const registrable = registrableDomain(hostname);
+        // A platform name under the tenant apex itself must not exempt the apex:
+        // that would exempt every customer's site with it.
+        if (registrable.includes('.') && registrable !== apexRegistrable) {
+            hosts.add(`.${registrable}`);
+        }
+    }
+    return [
+        ...hosts
+    ];
+}
+/** An address as it appears in text: scheme, then anything a URL may hold. */ const EMBEDDED_URL = /https?:\/\/[^\s"'<>()[\]{}\\^`|]+/gi;
+/** Characters prose puts after an address that the address does not own. */ const TRAILING_PROSE = /[.,;:!?'"*_~]+$/;
+/** A whole value shaped like an absolute or protocol-relative address. */ const ADDRESS_SHAPE = /^\s*(?:https?:|[\\/]{2})/i;
+/**
+ * Every outside address a rendered page could link to: each string in the
+ * payload that is one, and each one embedded in a string (Markdown, rich
+ * text HTML, a plain sentence). Over-collecting is harmless — a signature
+ * nobody follows is never read — and under-collecting only sends a link to a
+ * refusal, never around the notice.
+ *
+ * Returned normalized, the spelling the client looks signatures up by.
+ */ export function collectLeavingDestinations(value, hosts, limit = LEAVING_NOTICE_MAX_DESTINATIONS) {
+    const found = new Set();
+    const consider = (candidate)=>{
+        if (found.size >= limit) return;
+        const destination = leavingDestination(candidate, hosts);
+        if (destination) found.add(destination);
+    };
+    const scan = (text)=>{
+        if (ADDRESS_SHAPE.test(text)) consider(text);
+        if (!text.includes('http')) return;
+        const scanned = text.length > MAX_SCANNED_STRING ? text.slice(0, MAX_SCANNED_STRING) : text;
+        for (const match of scanned.matchAll(EMBEDDED_URL)){
+            const raw = match[0];
+            consider(raw);
+            const trimmed = raw.replace(TRAILING_PROSE, '');
+            if (trimmed !== raw) consider(trimmed);
+            // An href inside stored HTML is entity-encoded; the DOM decodes it.
+            if (trimmed.includes('&amp;')) consider(trimmed.replace(/&amp;/g, '&'));
+        }
+    };
+    const walk = (node, depth)=>{
+        if (found.size >= limit || depth > MAX_WALK_DEPTH) return;
+        if (typeof node === 'string') {
+            scan(node);
+        } else if (Array.isArray(node)) {
+            for (const item of node)walk(item, depth + 1);
+        } else if (node && typeof node === 'object') {
+            for (const item of Object.values(node))walk(item, depth + 1);
+        }
+    };
+    walk(value, 0);
+    return [
+        ...found
+    ];
+}
+function leavingSignature(hostId, destination) {
+    return createHmac('sha256', tokenSigningSecret()).update(`leaving-notice:v1:${hostId}:${destination}`).digest('base64url');
+}
+/**
+ * The signature for one destination on one site. Throws when the deployment
+ * has no signing secret, like every signer of it.
+ */ export function signLeavingDestination(hostId, destination) {
+    const normalized = normalizeLeavingDestination(destination);
+    if (!hostId || !normalized) {
+        throw new Error('A leaving-notice signature needs a site and an address');
+    }
+    return leavingSignature(hostId, normalized);
+}
+/**
+ * Whether `signature` was issued for `destination` on this site. False for
+ * anything else — another site's signature, an edited address, a missing
+ * secret (fail closed).
+ */ export function verifyLeavingDestination(hostId, destination, signature) {
+    if (!hostId || typeof signature !== 'string' || signature.length > 128) {
+        return false;
+    }
+    const normalized = normalizeLeavingDestination(destination);
+    if (!normalized) return false;
+    let expected;
+    try {
+        expected = leavingSignature(hostId, normalized);
+    } catch (unused) {
+        return false;
+    }
+    return safeEqual(signature, expected);
+}
+/** Signs a page's destinations for one site. */ export function signLeavingDestinations(hostId, destinations) {
+    const sigs = {};
+    for (const destination of destinations){
+        sigs[destination] = leavingSignature(hostId, destination);
+    }
+    return sigs;
+}
+/** Whether this deployment can sign at all. */ function canSign() {
+    try {
+        tokenSigningSecret();
+        return true;
+    } catch (unused) {
+        return false;
+    }
+}
+/**
+ * What a published page of this site carries, or `null` when the site is not
+ * in its window.
+ *
+ * `content` is everything the page renders from — its props, its nodes —
+ * walked for outside addresses to sign.
+ *
+ * A deployment with no signing secret gets no notice, loudly. The route
+ * could verify nothing there and would refuse every link on every new free
+ * site; an outage of every outbound link is not a safer failure than the
+ * links working as they did before this existed.
+ */ export function leavingNoticeConfig(options) {
+    const { hostId, site, org, content } = options;
+    if (!hostId || !site) return null;
+    const until = leavingNoticeEndsAt(org, options.nowMs);
+    if (until === null) return null;
+    if (!canSign()) {
+        console.error('[leaving-notice] TOKEN_SIGNING_SECRET is not configured; the notice is off');
+        return null;
+    }
+    const hosts = leavingNoticeHosts(site);
+    return {
+        until,
+        hosts,
+        sigs: signLeavingDestinations(hostId, collectLeavingDestinations(content, hosts))
+    };
+}
+/**
+ * Only the signatures, for a payload that arrives after its page — a gated
+ * screen's nodes (`enrichGatedScreenPage`). `null` outside the window.
+ */ export function leavingNoticeSignatures(options) {
+    const config = leavingNoticeConfig(options);
+    return config && Object.keys(config.sigs).length ? config.sigs : null;
+}
+
+//# sourceMappingURL=leaving-notice.js.map