@aglyn/tenant-data-admin 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/server/render-monitor.js

@@ -0,0 +1,412 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { TENANT_APEX } from "@aglyn/aglyn/app-utils/tenant-apex";
+/**
+ * THE RENDER MONITOR (AGL-3568): does a published site still render a page
+ * that was not already in a cache?
+ *
+ * On 2026-10-05 every uncached page render on the published-site runtime
+ * hung to the platform's 60 s limit for 28 minutes, and nothing alerted. The
+ * three monitors that existed each missed it for its own reason:
+ *
+ *  - the GitHub uptime probe is scheduled every 15 minutes and GitHub ran it
+ *    four times that day, none of them during the outage;
+ *  - its page rows fetch `/`, which the ISR cache answers, so a visitor's
+ *    page that was cached still loaded and the row stayed green;
+ *  - `/api/health/render/site` runs the page LOADER in-process and never the
+ *    site layout, which is where the request was stuck.
+ *
+ * So this fetches pages over HTTP, from the console (a different deployment
+ * from the one it watches), on Cloud Scheduler every five minutes, and asks
+ * for two pages no cache can answer:
+ *
+ *  - `dynamic` — `/search`, a route every site has that renders on every
+ *    request (`force-dynamic`) inside the full site layout. A 200 that is a
+ *    complete document proves the layout and head ran just now.
+ *  - `isr` — a path nobody has ever requested, under the catch-all page.
+ *    A never-seen path is the one request the ISR cache cannot answer, so it
+ *    renders in the same static context every published page renders in,
+ *    which is the context the 2026-09-09 outage only appeared in. It is a
+ *    404 by construction, and the site's own not-found page is drawn inside
+ *    the same layout, so a complete 404 document is a pass.
+ *
+ * A site that fails `threshold` runs in a row raises
+ * `system.siteRenderFailing` once; the first passing run after that raises
+ * `system.siteRenderRecovered` once. The state lives in
+ * `operatorHealthState/render-monitor--<host>`, beside every other health
+ * check, so Staff → Operator alerts lists it with its status and since when.
+ *
+ * Nothing here names an Aglyn host: the default target is the install's own
+ * demonstration site label under its own tenant apex, the convention the
+ * middleware and the render canaries already follow.
+ */ /** The state documents' collection: the health checks' own. */ const RENDER_MONITOR_COLLECTION = 'operatorHealthState';
+/** Every render monitor document id starts with this. */ export const RENDER_MONITOR_CHECK_PREFIX = 'render-monitor--';
+/** The beat id `/api/health/crons` reads for the scheduled run. */ export const RENDER_MONITOR_JOB_ID = 'render-monitor';
+/**
+ * How long one page fetch may take. Well under the 60 s a platform function
+ * may run, so a hung render is graded here as a timeout rather than waiting
+ * for the platform's 504, and well under the route's own `maxDuration`.
+ */ export const RENDER_MONITOR_TIMEOUT_MS = 25000;
+/** Failing runs in a row before the alert goes out. */ export const RENDER_MONITOR_DEFAULT_THRESHOLD = 2;
+/**
+ * The prefix of the never-requested path the `isr` probe asks for. A
+ * lowercase slug on purpose: it must reach the catch-all page like any
+ * screen slug would, not a reserved or rewritten route.
+ */ export const RENDER_PROBE_ISR_PREFIX = '/aglyn-render-probe-';
+export const RENDER_PROBES = [
+    {
+        kind: 'dynamic',
+        path: ()=>'/search',
+        expectStatus: 200
+    },
+    {
+        kind: 'isr',
+        path: (nonce)=>`${RENDER_PROBE_ISR_PREFIX}${nonce}`,
+        expectStatus: 404
+    }
+];
+/** Vercel's challenge interstitial, matched on the body like the front doors. */ const CHECKPOINT_MARKER = /Vercel Security Checkpoint/i;
+/**
+ * Cache states that mean the bytes came out of a store. A probe meant to
+ * prove a render cannot pass on one of these, whatever the status.
+ */ const CACHED_STATES = new Set([
+    'HIT',
+    'STALE',
+    'PRERENDER'
+]);
+/**
+ * Grade one probe response. Pure.
+ *
+ * The page markers are the front doors' (`tools/scripts/lib/front-door.mjs`)
+ * and for their reason: structural, never site copy. `</html>` proves the
+ * document finished streaming, `/_next/static/` that our build produced it.
+ */ export function gradeRenderProbe(response, expectStatus) {
+    var _response_body, _response_contentType, _response_cacheState;
+    const body = (_response_body = response.body) != null ? _response_body : '';
+    if (CHECKPOINT_MARKER.test(body)) {
+        return {
+            ok: false,
+            challenged: true,
+            code: 'challenged',
+            detail: `bot protection answered (HTTP ${response.status}) instead of the site; check AGLYN_PROBE_TOKEN on the console`
+        };
+    }
+    if (response.status >= 300 && response.status < 400) {
+        var _response_location;
+        return {
+            ok: false,
+            challenged: false,
+            code: 'redirected',
+            detail: `redirected to ${(_response_location = response.location) != null ? _response_location : '?'}, so no page was rendered`
+        };
+    }
+    if (response.status !== expectStatus) {
+        return {
+            ok: false,
+            challenged: false,
+            code: `http-${response.status}`,
+            detail: `HTTP ${response.status}`
+        };
+    }
+    if (!/text\/html/i.test((_response_contentType = response.contentType) != null ? _response_contentType : '')) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'not-html',
+            detail: `not HTML (${response.contentType || 'no content-type'})`
+        };
+    }
+    if (!body.includes('</html>')) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'incomplete',
+            detail: 'the document never finished (no </html>)'
+        };
+    }
+    if (!body.includes('/_next/static/')) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'not-our-render',
+            detail: 'no Next asset references, so the app did not render it'
+        };
+    }
+    const cache = String((_response_cacheState = response.cacheState) != null ? _response_cacheState : '').trim().toUpperCase();
+    if (CACHED_STATES.has(cache)) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'served-from-cache',
+            detail: `served from cache (${cache}), so it proves no render`
+        };
+    }
+    return {
+        ok: true,
+        challenged: false,
+        code: 'ok',
+        detail: 'rendered'
+    };
+}
+/** A configured value as an origin, or '' when it is not one. */ export function originOf(value) {
+    const trimmed = String(value != null ? value : '').trim().replace(/\/+$/, '');
+    return /^https?:\/\/[^/\s?#]+$/i.test(trimmed) ? trimmed.toLowerCase() : '';
+}
+/**
+ * Which sites the monitor renders, from the console's environment.
+ *
+ * 1. The install's demonstration site: `OPERATOR_HEALTH_TENANT_ORIGIN` when
+ *    set (the one published site the operator alerts tick already watches),
+ *    else `https://<AGLYN_TENANT_DEMO or demo>.<tenant apex>`.
+ * 2. Plus every origin in `RENDER_MONITOR_ORIGINS`, comma separated.
+ *
+ * `RENDER_MONITOR_ORIGINS=off` watches nothing, for an install with no
+ * published site to watch. Values that are not origins are dropped.
+ */ export function resolveRenderMonitorTargets(env) {
+    var _env_RENDER_MONITOR_ORIGINS, _env_NEXT_PUBLIC_TENANT_DOMAIN, _env_AGLYN_TENANT_DEMO;
+    const raw = String((_env_RENDER_MONITOR_ORIGINS = env['RENDER_MONITOR_ORIGINS']) != null ? _env_RENDER_MONITOR_ORIGINS : '').trim();
+    if (/^(off|none|false|0)$/i.test(raw)) return [];
+    const apex = String((_env_NEXT_PUBLIC_TENANT_DOMAIN = env['NEXT_PUBLIC_TENANT_DOMAIN']) != null ? _env_NEXT_PUBLIC_TENANT_DOMAIN : '').trim() || TENANT_APEX;
+    const label = String((_env_AGLYN_TENANT_DEMO = env['AGLYN_TENANT_DEMO']) != null ? _env_AGLYN_TENANT_DEMO : '').trim() || 'demo';
+    const demo = originOf(env['OPERATOR_HEALTH_TENANT_ORIGIN']) || originOf(`https://${label}.${apex}`);
+    const listed = raw.split(/[\s,]+/).map((value)=>originOf(value)).filter(Boolean);
+    return [
+        ...new Set([
+            demo,
+            ...listed
+        ].filter(Boolean))
+    ];
+}
+/** The state document id for one origin. */ export function renderMonitorCheckId(origin) {
+    return `${RENDER_MONITOR_CHECK_PREFIX}${new URL(origin).host}`;
+}
+/**
+ * The next state for one site, given what this run saw. Pure.
+ *
+ * The status turns `degraded` only once `threshold` runs in a row have
+ * failed, so one slow cold start or one dropped connection says nothing. It
+ * turns back on the first passing run, because a render that works is
+ * proof, and a recovery held back is a recovery nobody hears about.
+ */ export function nextRenderMonitorState(prior, observation, context) {
+    var _observation_detail, _ref, _ref1, _ref2, _ref3;
+    const { origin, label, threshold, now } = context;
+    const checkId = renderMonitorCheckId(origin);
+    const detail = String((_observation_detail = observation.detail) != null ? _observation_detail : '').slice(0, 1000);
+    const wasDegraded = (prior == null ? void 0 : prior.status) === 'degraded';
+    if (observation.ok) {
+        return {
+            next: {
+                checkId,
+                label,
+                origin,
+                status: 'ok',
+                sinceMs: !wasDegraded && (prior == null ? void 0 : prior.sinceMs) ? prior.sinceMs : now,
+                detail,
+                updatedAtMs: now,
+                consecutiveFailures: 0,
+                failingSinceMs: null,
+                lastOkAtMs: now
+            },
+            transition: wasDegraded ? 'recovered' : null
+        };
+    }
+    const failures = ((_ref = prior == null ? void 0 : prior.consecutiveFailures) != null ? _ref : 0) + 1;
+    const failingSinceMs = (_ref1 = prior == null ? void 0 : prior.failingSinceMs) != null ? _ref1 : now;
+    const degraded = wasDegraded || failures >= Math.max(1, threshold);
+    return {
+        next: {
+            checkId,
+            label,
+            origin,
+            status: degraded ? 'degraded' : 'ok',
+            sinceMs: degraded ? wasDegraded && (prior == null ? void 0 : prior.sinceMs) ? prior.sinceMs : failingSinceMs : (_ref2 = prior == null ? void 0 : prior.sinceMs) != null ? _ref2 : now,
+            detail,
+            updatedAtMs: now,
+            consecutiveFailures: failures,
+            failingSinceMs,
+            lastOkAtMs: (_ref3 = prior == null ? void 0 : prior.lastOkAtMs) != null ? _ref3 : null
+        },
+        transition: degraded && !wasDegraded ? 'failing' : null
+    };
+}
+/**
+ * The default store: one Firestore transaction on the site's document, so
+ * two overlapping runs cannot both decide they saw the edge.
+ */ const firestoreStore = async (checkId, work)=>{
+    const { default: firebaseAdmin } = await import("./firebase-admin.js");
+    const db = firebaseAdmin.app().firestore();
+    const ref = db.collection(RENDER_MONITOR_COLLECTION).doc(checkId);
+    return db.runTransaction(async (transaction)=>{
+        const snapshot = await transaction.get(ref);
+        const prior = snapshot.exists ? snapshot.data() : null;
+        const { next, result } = work(prior);
+        transaction.set(ref, next);
+        return result;
+    });
+};
+const defaultRaise = async (type, options)=>{
+    const { raiseOperatorAlert } = await import("./operator-alerts.js");
+    return raiseOperatorAlert(type, options);
+};
+function describeDuration(ms) {
+    const minutes = Math.max(1, Math.round(ms / 60000));
+    if (minutes < 60) return `${minutes} min`;
+    const hours = Math.floor(minutes / 60);
+    const rest = minutes % 60;
+    return rest ? `${hours} h ${rest} min` : `${hours} h`;
+}
+function probeLine(row) {
+    return `${row.kind} ${new URL(row.url).pathname}: ${row.detail} (${row.ms} ms)`;
+}
+/** Fetch and grade one probe. Never throws. */ async function runProbe(origin, spec, options) {
+    const url = `${origin}${spec.path(options.nonce)}`;
+    const startedAt = options.clock();
+    try {
+        var _response_headers_get;
+        const response = await options.fetcher(url, {
+            redirect: 'manual',
+            cache: 'no-store',
+            headers: _extends({
+                'user-agent': 'aglyn-render-monitor',
+                accept: 'text/html,application/xhtml+xml'
+            }, options.headers),
+            signal: AbortSignal.timeout(options.timeoutMs)
+        });
+        const body = await response.text();
+        const verdict = gradeRenderProbe({
+            status: response.status,
+            contentType: response.headers.get('content-type'),
+            body,
+            location: response.headers.get('location'),
+            cacheState: (_response_headers_get = response.headers.get('x-vercel-cache')) != null ? _response_headers_get : response.headers.get('x-nextjs-cache')
+        }, spec.expectStatus);
+        return _extends({
+            kind: spec.kind,
+            url,
+            ms: options.clock() - startedAt,
+            httpStatus: response.status
+        }, verdict);
+    } catch (error) {
+        var _ref, _ref1;
+        var _error_cause;
+        const name = error == null ? void 0 : error.name;
+        const timedOut = name === 'TimeoutError' || name === 'AbortError';
+        return {
+            kind: spec.kind,
+            url,
+            ms: options.clock() - startedAt,
+            httpStatus: null,
+            ok: false,
+            challenged: false,
+            code: timedOut ? 'timeout' : 'unreachable',
+            detail: timedOut ? `no complete page in ${Math.round(options.timeoutMs / 1000)} s` : `unreachable (${(_ref = (_ref1 = error == null ? void 0 : (_error_cause = error.cause) == null ? void 0 : _error_cause.code) != null ? _ref1 : name) != null ? _ref : 'error'})`
+        };
+    }
+}
+/**
+ * One run: render every target, record each site's state, raise the edge.
+ *
+ * A dry run fetches and grades and writes nothing, so a person can ask
+ * "what would the monitor see right now" without moving its state.
+ */ export async function runRenderMonitor(options = {}) {
+    var _options_env, _options_now, _options_store, _options_raise, _env_RENDER_MONITOR_FAILURE_THRESHOLD, _options_nonce;
+    const env = (_options_env = options.env) != null ? _options_env : process.env;
+    const clock = (_options_now = options.now) != null ? _options_now : Date.now;
+    const store = (_options_store = options.store) != null ? _options_store : firestoreStore;
+    const raise = (_options_raise = options.raise) != null ? _options_raise : defaultRaise;
+    const dryRun = Boolean(options.dryRun);
+    const parsedThreshold = Number.parseInt(String((_env_RENDER_MONITOR_FAILURE_THRESHOLD = env['RENDER_MONITOR_FAILURE_THRESHOLD']) != null ? _env_RENDER_MONITOR_FAILURE_THRESHOLD : ''), 10);
+    const threshold = Number.isFinite(parsedThreshold) && parsedThreshold >= 1 ? parsedThreshold : RENDER_MONITOR_DEFAULT_THRESHOLD;
+    const nonce = (_options_nonce = options.nonce) != null ? _options_nonce : ()=>`${clock().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+    const sites = await Promise.all(resolveRenderMonitorTargets(env).map(async (origin)=>{
+        const probes = await Promise.all(RENDER_PROBES.map((spec)=>{
+            var _options_fetcher, _options_headers, _options_timeoutMs;
+            return runProbe(origin, spec, {
+                fetcher: (_options_fetcher = options.fetcher) != null ? _options_fetcher : fetch,
+                headers: (_options_headers = options.headers) != null ? _options_headers : {},
+                nonce: nonce(),
+                timeoutMs: (_options_timeoutMs = options.timeoutMs) != null ? _options_timeoutMs : RENDER_MONITOR_TIMEOUT_MS,
+                clock
+            });
+        }));
+        const ok = probes.every((probe)=>probe.ok);
+        const site = {
+            origin,
+            ok,
+            probes
+        };
+        if (dryRun) return site;
+        const host = new URL(origin).host;
+        const failing = probes.filter((probe)=>!probe.ok);
+        const detail = ok ? 'Fresh renders pass.' : failing.map(probeLine).join('; ');
+        try {
+            const now = clock();
+            const { next, transition, failingSinceMs } = await store(renderMonitorCheckId(origin), (prior)=>{
+                var _ref, _ref1;
+                const decided = nextRenderMonitorState(prior, {
+                    ok,
+                    detail
+                }, {
+                    origin,
+                    label: `Page rendering on ${host}`,
+                    threshold,
+                    now
+                });
+                return {
+                    next: decided.next,
+                    result: _extends({}, decided, {
+                        // When the failures a recovery ends began.
+                        failingSinceMs: (_ref = (_ref1 = prior == null ? void 0 : prior.failingSinceMs) != null ? _ref1 : prior == null ? void 0 : prior.sinceMs) != null ? _ref : now
+                    })
+                };
+            });
+            site.status = next.status;
+            site.consecutiveFailures = next.consecutiveFailures;
+            site.transition = transition;
+            if (transition === 'failing') {
+                await raise('system.siteRenderFailing', {
+                    dedupeKey: host,
+                    context: {
+                        site: host,
+                        failures: next.consecutiveFailures,
+                        since: describeDuration(now - next.sinceMs),
+                        detail
+                    }
+                });
+            } else if (transition === 'recovered') {
+                await raise('system.siteRenderRecovered', {
+                    dedupeKey: host,
+                    context: {
+                        site: host,
+                        duration: describeDuration(now - failingSinceMs)
+                    }
+                });
+            }
+        } catch (error) {
+            site.error = error instanceof Error ? error.message : String(error);
+            console.error(`[render-monitor] ${host} could not be recorded`, error);
+        }
+        return site;
+    }));
+    return {
+        dryRun,
+        threshold,
+        sites
+    };
+}
+
+//# sourceMappingURL=render-monitor.js.map

package/src/lib/server/render-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/render-monitor.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { TENANT_APEX } from '@aglyn/aglyn/app-utils/tenant-apex'\nimport type { OperatorHealthStateDoc } from './operator-health'\n\n/**\n * THE RENDER MONITOR (AGL-3568): does a published site still render a page\n * that was not already in a cache?\n *\n * On 2026-10-05 every uncached page render on the published-site runtime\n * hung to the platform's 60 s limit for 28 minutes, and nothing alerted. The\n * three monitors that existed each missed it for its own reason:\n *\n *  - the GitHub uptime probe is scheduled every 15 minutes and GitHub ran it\n *    four times that day, none of them during the outage;\n *  - its page rows fetch `/`, which the ISR cache answers, so a visitor's\n *    page that was cached still loaded and the row stayed green;\n *  - `/api/health/render/site` runs the page LOADER in-process and never the\n *    site layout, which is where the request was stuck.\n *\n * So this fetches pages over HTTP, from the console (a different deployment\n * from the one it watches), on Cloud Scheduler every five minutes, and asks\n * for two pages no cache can answer:\n *\n *  - `dynamic` — `/search`, a route every site has that renders on every\n *    request (`force-dynamic`) inside the full site layout. A 200 that is a\n *    complete document proves the layout and head ran just now.\n *  - `isr` — a path nobody has ever requested, under the catch-all page.\n *    A never-seen path is the one request the ISR cache cannot answer, so it\n *    renders in the same static context every published page renders in,\n *    which is the context the 2026-09-09 outage only appeared in. It is a\n *    404 by construction, and the site's own not-found page is drawn inside\n *    the same layout, so a complete 404 document is a pass.\n *\n * A site that fails `threshold` runs in a row raises\n * `system.siteRenderFailing` once; the first passing run after that raises\n * `system.siteRenderRecovered` once. The state lives in\n * `operatorHealthState/render-monitor--<host>`, beside every other health\n * check, so Staff → Operator alerts lists it with its status and since when.\n *\n * Nothing here names an Aglyn host: the default target is the install's own\n * demonstration site label under its own tenant apex, the convention the\n * middleware and the render canaries already follow.\n */\n\n/** The state documents' collection: the health checks' own. */\nconst RENDER_MONITOR_COLLECTION = 'operatorHealthState'\n\n/** Every render monitor document id starts with this. */\nexport const RENDER_MONITOR_CHECK_PREFIX = 'render-monitor--'\n\n/** The beat id `/api/health/crons` reads for the scheduled run. */\nexport const RENDER_MONITOR_JOB_ID = 'render-monitor'\n\n/**\n * How long one page fetch may take. Well under the 60 s a platform function\n * may run, so a hung render is graded here as a timeout rather than waiting\n * for the platform's 504, and well under the route's own `maxDuration`.\n */\nexport const RENDER_MONITOR_TIMEOUT_MS = 25_000\n\n/** Failing runs in a row before the alert goes out. */\nexport const RENDER_MONITOR_DEFAULT_THRESHOLD = 2\n\n/**\n * The prefix of the never-requested path the `isr` probe asks for. A\n * lowercase slug on purpose: it must reach the catch-all page like any\n * screen slug would, not a reserved or rewritten route.\n */\nexport const RENDER_PROBE_ISR_PREFIX = '/aglyn-render-probe-'\n\nexport type RenderProbeKind = 'dynamic' | 'isr'\n\nexport interface RenderProbeSpec {\n  kind: RenderProbeKind\n  /** The path to request, given a fresh nonce. */\n  path: (nonce: string) => string\n  /** The status a healthy render answers with. */\n  expectStatus: number\n}\n\nexport const RENDER_PROBES: readonly RenderProbeSpec[] = [\n  { kind: 'dynamic', path: () => '/search', expectStatus: 200 },\n  {\n    kind: 'isr',\n    path: (nonce) => `${RENDER_PROBE_ISR_PREFIX}${nonce}`,\n    expectStatus: 404,\n  },\n]\n\n/** One fetched response, reduced to what grading reads. */\nexport interface RenderProbeResponse {\n  status: number\n  contentType?: string | null\n  body?: string\n  location?: string | null\n  /** `x-vercel-cache` on Vercel, `x-nextjs-cache` on a plain `next start`. */\n  cacheState?: string | null\n}\n\nexport interface RenderProbeVerdict {\n  ok: boolean\n  /** Bot protection answered instead of the site. */\n  challenged: boolean\n  /** A stable code; `ok` on a pass. */\n  code: string\n  detail: string\n}\n\n/** Vercel's challenge interstitial, matched on the body like the front doors. */\nconst CHECKPOINT_MARKER = /Vercel Security Checkpoint/i\n\n/**\n * Cache states that mean the bytes came out of a store. A probe meant to\n * prove a render cannot pass on one of these, whatever the status.\n */\nconst CACHED_STATES = new Set(['HIT', 'STALE', 'PRERENDER'])\n\n/**\n * Grade one probe response. Pure.\n *\n * The page markers are the front doors' (`tools/scripts/lib/front-door.mjs`)\n * and for their reason: structural, never site copy. `</html>` proves the\n * document finished streaming, `/_next/static/` that our build produced it.\n */\nexport function gradeRenderProbe(\n  response: RenderProbeResponse,\n  expectStatus: number,\n): RenderProbeVerdict {\n  const body = response.body ?? ''\n  if (CHECKPOINT_MARKER.test(body)) {\n    return {\n      ok: false,\n      challenged: true,\n      code: 'challenged',\n      detail: `bot protection answered (HTTP ${response.status}) instead of the site; check AGLYN_PROBE_TOKEN on the console`,\n    }\n  }\n  if (response.status >= 300 && response.status < 400) {\n    return {\n      ok: false,\n      challenged: false,\n      code: 'redirected',\n      detail: `redirected to ${response.location ?? '?'}, so no page was rendered`,\n    }\n  }\n  if (response.status !== expectStatus) {\n    return {\n      ok: false,\n      challenged: false,\n      code: `http-${response.status}`,\n      detail: `HTTP ${response.status}`,\n    }\n  }\n  if (!/text\\/html/i.test(response.contentType ?? '')) {\n    return {\n      ok: false,\n      challenged: false,\n      code: 'not-html',\n      detail: `not HTML (${response.contentType || 'no content-type'})`,\n    }\n  }\n  if (!body.includes('</html>')) {\n    return {\n      ok: false,\n      challenged: false,\n      code: 'incomplete',\n      detail: 'the document never finished (no </html>)',\n    }\n  }\n  if (!body.includes('/_next/static/')) {\n    return {\n      ok: false,\n      challenged: false,\n      code: 'not-our-render',\n      detail: 'no Next asset references, so the app did not render it',\n    }\n  }\n  const cache = String(response.cacheState ?? '').trim().toUpperCase()\n  if (CACHED_STATES.has(cache)) {\n    return {\n      ok: false,\n      challenged: false,\n      code: 'served-from-cache',\n      detail: `served from cache (${cache}), so it proves no render`,\n    }\n  }\n  return { ok: true, challenged: false, code: 'ok', detail: 'rendered' }\n}\n\n/** A configured value as an origin, or '' when it is not one. */\nexport function originOf(value: string | undefined | null): string {\n  const trimmed = String(value ?? '').trim().replace(/\\/+$/, '')\n  return /^https?:\\/\\/[^/\\s?#]+$/i.test(trimmed) ? trimmed.toLowerCase() : ''\n}\n\n/**\n * Which sites the monitor renders, from the console's environment.\n *\n * 1. The install's demonstration site: `OPERATOR_HEALTH_TENANT_ORIGIN` when\n *    set (the one published site the operator alerts tick already watches),\n *    else `https://<AGLYN_TENANT_DEMO or demo>.<tenant apex>`.\n * 2. Plus every origin in `RENDER_MONITOR_ORIGINS`, comma separated.\n *\n * `RENDER_MONITOR_ORIGINS=off` watches nothing, for an install with no\n * published site to watch. Values that are not origins are dropped.\n */\nexport function resolveRenderMonitorTargets(\n  env: Readonly<Record<string, string | undefined>>,\n): string[] {\n  const raw = String(env['RENDER_MONITOR_ORIGINS'] ?? '').trim()\n  if (/^(off|none|false|0)$/i.test(raw)) return []\n  const apex =\n    String(env['NEXT_PUBLIC_TENANT_DOMAIN'] ?? '').trim() || TENANT_APEX\n  const label = String(env['AGLYN_TENANT_DEMO'] ?? '').trim() || 'demo'\n  const demo =\n    originOf(env['OPERATOR_HEALTH_TENANT_ORIGIN']) ||\n    originOf(`https://${label}.${apex}`)\n  const listed = raw\n    .split(/[\\s,]+/)\n    .map((value) => originOf(value))\n    .filter(Boolean)\n  return [...new Set([demo, ...listed].filter(Boolean))]\n}\n\n/** The state document id for one origin. */\nexport function renderMonitorCheckId(origin: string): string {\n  return `${RENDER_MONITOR_CHECK_PREFIX}${new URL(origin).host}`\n}\n\n/** One render monitor state document. */\nexport interface RenderMonitorStateDoc extends OperatorHealthStateDoc {\n  origin: string\n  /** Failing runs in a row, reset by any passing run. */\n  consecutiveFailures: number\n  /** When the current run of failures began; null while passing. */\n  failingSinceMs: number | null\n  lastOkAtMs: number | null\n}\n\nexport type RenderMonitorTransition = 'failing' | 'recovered' | null\n\n/**\n * The next state for one site, given what this run saw. Pure.\n *\n * The status turns `degraded` only once `threshold` runs in a row have\n * failed, so one slow cold start or one dropped connection says nothing. It\n * turns back on the first passing run, because a render that works is\n * proof, and a recovery held back is a recovery nobody hears about.\n */\nexport function nextRenderMonitorState(\n  prior: Partial<RenderMonitorStateDoc> | null,\n  observation: { ok: boolean; detail: string },\n  context: { origin: string; label: string; threshold: number; now: number },\n): { next: RenderMonitorStateDoc; transition: RenderMonitorTransition } {\n  const { origin, label, threshold, now } = context\n  const checkId = renderMonitorCheckId(origin)\n  const detail = String(observation.detail ?? '').slice(0, 1_000)\n  const wasDegraded = prior?.status === 'degraded'\n  if (observation.ok) {\n    return {\n      next: {\n        checkId,\n        label,\n        origin,\n        status: 'ok',\n        sinceMs: !wasDegraded && prior?.sinceMs ? prior.sinceMs : now,\n        detail,\n        updatedAtMs: now,\n        consecutiveFailures: 0,\n        failingSinceMs: null,\n        lastOkAtMs: now,\n      },\n      transition: wasDegraded ? 'recovered' : null,\n    }\n  }\n  const failures = (prior?.consecutiveFailures ?? 0) + 1\n  const failingSinceMs = prior?.failingSinceMs ?? now\n  const degraded = wasDegraded || failures >= Math.max(1, threshold)\n  return {\n    next: {\n      checkId,\n      label,\n      origin,\n      status: degraded ? 'degraded' : 'ok',\n      sinceMs: degraded\n        ? wasDegraded && prior?.sinceMs\n          ? prior.sinceMs\n          : failingSinceMs\n        : (prior?.sinceMs ?? now),\n      detail,\n      updatedAtMs: now,\n      consecutiveFailures: failures,\n      failingSinceMs,\n      lastOkAtMs: prior?.lastOkAtMs ?? null,\n    },\n    transition: degraded && !wasDegraded ? 'failing' : null,\n  }\n}\n\n/** One probe as the report shows it. */\nexport interface RenderProbeRow extends RenderProbeVerdict {\n  kind: RenderProbeKind\n  url: string\n  ms: number\n  httpStatus: number | null\n}\n\n/** One site's result for a run. */\nexport interface RenderMonitorSiteResult {\n  origin: string\n  ok: boolean\n  probes: RenderProbeRow[]\n  /** The state written; absent on a dry run or a failed write. */\n  status?: 'ok' | 'degraded'\n  consecutiveFailures?: number\n  transition?: RenderMonitorTransition\n  error?: string\n}\n\nexport interface RenderMonitorReport {\n  dryRun: boolean\n  threshold: number\n  sites: RenderMonitorSiteResult[]\n}\n\n/** The read-modify-write of one site's state, as one transaction. */\nexport type RenderMonitorStore = <T>(\n  checkId: string,\n  work: (prior: Partial<RenderMonitorStateDoc> | null) => {\n    next: RenderMonitorStateDoc\n    result: T\n  },\n) => Promise<T>\n\n/**\n * The default store: one Firestore transaction on the site's document, so\n * two overlapping runs cannot both decide they saw the edge.\n */\nconst firestoreStore: RenderMonitorStore = async (checkId, work) => {\n  const { default: firebaseAdmin } = await import('./firebase-admin')\n  const db = firebaseAdmin.app().firestore()\n  const ref = db.collection(RENDER_MONITOR_COLLECTION).doc(checkId)\n  return db.runTransaction(async (transaction: any) => {\n    const snapshot = await transaction.get(ref)\n    const prior = snapshot.exists\n      ? (snapshot.data() as Partial<RenderMonitorStateDoc>)\n      : null\n    const { next, result } = work(prior)\n    transaction.set(ref, next)\n    return result\n  })\n}\n\ntype RaiseAlert = (\n  type: string,\n  options: { dedupeKey?: string; context?: Record<string, string | number> },\n) => Promise<unknown>\n\nconst defaultRaise: RaiseAlert = async (type, options) => {\n  const { raiseOperatorAlert } = await import('./operator-alerts')\n  return raiseOperatorAlert(type, options)\n}\n\nfunction describeDuration(ms: number): string {\n  const minutes = Math.max(1, Math.round(ms / 60_000))\n  if (minutes < 60) return `${minutes} min`\n  const hours = Math.floor(minutes / 60)\n  const rest = minutes % 60\n  return rest ? `${hours} h ${rest} min` : `${hours} h`\n}\n\nfunction probeLine(row: RenderProbeRow): string {\n  return `${row.kind} ${new URL(row.url).pathname}: ${row.detail} (${row.ms} ms)`\n}\n\n/** Fetch and grade one probe. Never throws. */\nasync function runProbe(\n  origin: string,\n  spec: RenderProbeSpec,\n  options: {\n    fetcher: typeof fetch\n    headers: Record<string, string>\n    nonce: string\n    timeoutMs: number\n    clock: () => number\n  },\n): Promise<RenderProbeRow> {\n  const url = `${origin}${spec.path(options.nonce)}`\n  const startedAt = options.clock()\n  try {\n    const response = await options.fetcher(url, {\n      redirect: 'manual',\n      cache: 'no-store',\n      headers: {\n        'user-agent': 'aglyn-render-monitor',\n        accept: 'text/html,application/xhtml+xml',\n        ...options.headers,\n      },\n      signal: AbortSignal.timeout(options.timeoutMs),\n    })\n    const body = await response.text()\n    const verdict = gradeRenderProbe(\n      {\n        status: response.status,\n        contentType: response.headers.get('content-type'),\n        body,\n        location: response.headers.get('location'),\n        cacheState:\n          response.headers.get('x-vercel-cache') ??\n          response.headers.get('x-nextjs-cache'),\n      },\n      spec.expectStatus,\n    )\n    return {\n      kind: spec.kind,\n      url,\n      ms: options.clock() - startedAt,\n      httpStatus: response.status,\n      ...verdict,\n    }\n  } catch (error) {\n    const name = (error as { name?: string } | null)?.name\n    const timedOut = name === 'TimeoutError' || name === 'AbortError'\n    return {\n      kind: spec.kind,\n      url,\n      ms: options.clock() - startedAt,\n      httpStatus: null,\n      ok: false,\n      challenged: false,\n      code: timedOut ? 'timeout' : 'unreachable',\n      detail: timedOut\n        ? `no complete page in ${Math.round(options.timeoutMs / 1_000)} s`\n        : `unreachable (${(error as { cause?: { code?: string } } | null)?.cause?.code ?? name ?? 'error'})`,\n    }\n  }\n}\n\n/**\n * One run: render every target, record each site's state, raise the edge.\n *\n * A dry run fetches and grades and writes nothing, so a person can ask\n * \"what would the monitor see right now\" without moving its state.\n */\nexport async function runRenderMonitor(\n  options: {\n    dryRun?: boolean\n    env?: Readonly<Record<string, string | undefined>>\n    fetcher?: typeof fetch\n    /** Our own edge's bypass headers, from the caller's environment. */\n    headers?: Record<string, string>\n    now?: () => number\n    nonce?: () => string\n    timeoutMs?: number\n    store?: RenderMonitorStore\n    raise?: RaiseAlert\n  } = {},\n): Promise<RenderMonitorReport> {\n  const env = options.env ?? process.env\n  const clock = options.now ?? Date.now\n  const store = options.store ?? firestoreStore\n  const raise = options.raise ?? defaultRaise\n  const dryRun = Boolean(options.dryRun)\n  const parsedThreshold = Number.parseInt(\n    String(env['RENDER_MONITOR_FAILURE_THRESHOLD'] ?? ''),\n    10,\n  )\n  const threshold =\n    Number.isFinite(parsedThreshold) && parsedThreshold >= 1\n      ? parsedThreshold\n      : RENDER_MONITOR_DEFAULT_THRESHOLD\n  const nonce =\n    options.nonce ??\n    (() => `${clock().toString(36)}${Math.random().toString(36).slice(2, 8)}`)\n\n  const sites = await Promise.all(\n    resolveRenderMonitorTargets(env).map(\n      async (origin): Promise<RenderMonitorSiteResult> => {\n        const probes = await Promise.all(\n          RENDER_PROBES.map((spec) =>\n            runProbe(origin, spec, {\n              fetcher: options.fetcher ?? fetch,\n              headers: options.headers ?? {},\n              nonce: nonce(),\n              timeoutMs: options.timeoutMs ?? RENDER_MONITOR_TIMEOUT_MS,\n              clock,\n            }),\n          ),\n        )\n        const ok = probes.every((probe) => probe.ok)\n        const site: RenderMonitorSiteResult = { origin, ok, probes }\n        if (dryRun) return site\n        const host = new URL(origin).host\n        const failing = probes.filter((probe) => !probe.ok)\n        const detail = ok\n          ? 'Fresh renders pass.'\n          : failing.map(probeLine).join('; ')\n        try {\n          const now = clock()\n          const { next, transition, failingSinceMs } = await store(\n            renderMonitorCheckId(origin),\n            (prior) => {\n              const decided = nextRenderMonitorState(\n                prior,\n                { ok, detail },\n                {\n                  origin,\n                  label: `Page rendering on ${host}`,\n                  threshold,\n                  now,\n                },\n              )\n              return {\n                next: decided.next,\n                result: {\n                  ...decided,\n                  // When the failures a recovery ends began.\n                  failingSinceMs: prior?.failingSinceMs ?? prior?.sinceMs ?? now,\n                },\n              }\n            },\n          )\n          site.status = next.status\n          site.consecutiveFailures = next.consecutiveFailures\n          site.transition = transition\n          if (transition === 'failing') {\n            await raise('system.siteRenderFailing', {\n              dedupeKey: host,\n              context: {\n                site: host,\n                failures: next.consecutiveFailures,\n                since: describeDuration(now - next.sinceMs),\n                detail,\n              },\n            })\n          } else if (transition === 'recovered') {\n            await raise('system.siteRenderRecovered', {\n              dedupeKey: host,\n              context: {\n                site: host,\n                duration: describeDuration(now - failingSinceMs),\n              },\n            })\n          }\n        } catch (error) {\n          site.error = error instanceof Error ? error.message : String(error)\n          console.error(`[render-monitor] ${host} could not be recorded`, error)\n        }\n        return site\n      },\n    ),\n  )\n  return { dryRun, threshold, sites }\n}\n"],"names":["TENANT_APEX","RENDER_MONITOR_COLLECTION","RENDER_MONITOR_CHECK_PREFIX","RENDER_MONITOR_JOB_ID","RENDER_MONITOR_TIMEOUT_MS","RENDER_MONITOR_DEFAULT_THRESHOLD","RENDER_PROBE_ISR_PREFIX","RENDER_PROBES","kind","path","expectStatus","nonce","CHECKPOINT_MARKER","CACHED_STATES","Set","gradeRenderProbe","response","body","test","ok","challenged","code","detail","status","location","contentType","includes","cache","String","cacheState","trim","toUpperCase","has","originOf","value","trimmed","replace","toLowerCase","resolveRenderMonitorTargets","env","raw","apex","label","demo","listed","split","map","filter","Boolean","renderMonitorCheckId","origin","URL","host","nextRenderMonitorState","prior","observation","context","threshold","now","checkId","slice","wasDegraded","next","sinceMs","updatedAtMs","consecutiveFailures","failingSinceMs","lastOkAtMs","transition","failures","degraded","Math","max","firestoreStore","work","default","firebaseAdmin","db","app","firestore","ref","collection","doc","runTransaction","transaction","snapshot","get","exists","data","result","set","defaultRaise","type","options","raiseOperatorAlert","describeDuration","ms","minutes","round","hours","floor","rest","probeLine","row","url","pathname","runProbe","spec","startedAt","clock","fetcher","redirect","headers","accept","signal","AbortSignal","timeout","timeoutMs","text","verdict","httpStatus","error","name","timedOut","cause","runRenderMonitor","process","Date","store","raise","dryRun","parsedThreshold","Number","parseInt","isFinite","toString","random","sites","Promise","all","probes","fetch","every","probe","site","failing","join","decided","dedupeKey","since","duration","Error","message","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,WAAW,QAAQ,qCAAoC;AAGhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GAED,6DAA6D,GAC7D,MAAMC,4BAA4B;AAElC,uDAAuD,GACvD,OAAO,MAAMC,8BAA8B,mBAAkB;AAE7D,iEAAiE,GACjE,OAAO,MAAMC,wBAAwB,iBAAgB;AAErD;;;;CAIC,GACD,OAAO,MAAMC,4BAA4B,MAAM;AAE/C,qDAAqD,GACrD,OAAO,MAAMC,mCAAmC,EAAC;AAEjD;;;;CAIC,GACD,OAAO,MAAMC,0BAA0B,uBAAsB;AAY7D,OAAO,MAAMC,gBAA4C;IACvD;QAAEC,MAAM;QAAWC,MAAM,IAAM;QAAWC,cAAc;IAAI;IAC5D;QACEF,MAAM;QACNC,MAAM,CAACE,QAAU,GAAGL,0BAA0BK,OAAO;QACrDD,cAAc;IAChB;CACD,CAAA;AAqBD,+EAA+E,GAC/E,MAAME,oBAAoB;AAE1B;;;CAGC,GACD,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAO;IAAS;CAAY;AAE3D;;;;;;CAMC,GACD,OAAO,SAASC,iBACdC,QAA6B,EAC7BN,YAAoB;QAEPM,gBAyBWA,uBAwBHA;IAjDrB,MAAMC,QAAOD,iBAAAA,SAASC,IAAI,YAAbD,iBAAiB;IAC9B,IAAIJ,kBAAkBM,IAAI,CAACD,OAAO;QAChC,OAAO;YACLE,IAAI;YACJC,YAAY;YACZC,MAAM;YACNC,QAAQ,CAAC,8BAA8B,EAAEN,SAASO,MAAM,CAAC,6DAA6D,CAAC;QACzH;IACF;IACA,IAAIP,SAASO,MAAM,IAAI,OAAOP,SAASO,MAAM,GAAG,KAAK;YAKxBP;QAJ3B,OAAO;YACLG,IAAI;YACJC,YAAY;YACZC,MAAM;YACNC,QAAQ,CAAC,cAAc,GAAEN,qBAAAA,SAASQ,QAAQ,YAAjBR,qBAAqB,IAAI,yBAAyB,CAAC;QAC9E;IACF;IACA,IAAIA,SAASO,MAAM,KAAKb,cAAc;QACpC,OAAO;YACLS,IAAI;YACJC,YAAY;YACZC,MAAM,CAAC,KAAK,EAAEL,SAASO,MAAM,EAAE;YAC/BD,QAAQ,CAAC,KAAK,EAAEN,SAASO,MAAM,EAAE;QACnC;IACF;IACA,IAAI,CAAC,cAAcL,IAAI,EAACF,wBAAAA,SAASS,WAAW,YAApBT,wBAAwB,KAAK;QACnD,OAAO;YACLG,IAAI;YACJC,YAAY;YACZC,MAAM;YACNC,QAAQ,CAAC,UAAU,EAAEN,SAASS,WAAW,IAAI,kBAAkB,CAAC,CAAC;QACnE;IACF;IACA,IAAI,CAACR,KAAKS,QAAQ,CAAC,YAAY;QAC7B,OAAO;YACLP,IAAI;YACJC,YAAY;YACZC,MAAM;YACNC,QAAQ;QACV;IACF;IACA,IAAI,CAACL,KAAKS,QAAQ,CAAC,mBAAmB;QACpC,OAAO;YACLP,IAAI;YACJC,YAAY;YACZC,MAAM;YACNC,QAAQ;QACV;IACF;IACA,MAAMK,QAAQC,QAAOZ,uBAAAA,SAASa,UAAU,YAAnBb,uBAAuB,IAAIc,IAAI,GAAGC,WAAW;IAClE,IAAIlB,cAAcmB,GAAG,CAACL,QAAQ;QAC5B,OAAO;YACLR,IAAI;YACJC,YAAY;YACZC,MAAM;YACNC,QAAQ,CAAC,mBAAmB,EAAEK,MAAM,yBAAyB,CAAC;QAChE;IACF;IACA,OAAO;QAAER,IAAI;QAAMC,YAAY;QAAOC,MAAM;QAAMC,QAAQ;IAAW;AACvE;AAEA,+DAA+D,GAC/D,OAAO,SAASW,SAASC,KAAgC;IACvD,MAAMC,UAAUP,OAAOM,gBAAAA,QAAS,IAAIJ,IAAI,GAAGM,OAAO,CAAC,QAAQ;IAC3D,OAAO,0BAA0BlB,IAAI,CAACiB,WAAWA,QAAQE,WAAW,KAAK;AAC3E;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASC,4BACdC,GAAiD;QAE9BA,6BAGVA,gCACYA;IAJrB,MAAMC,MAAMZ,QAAOW,8BAAAA,GAAG,CAAC,yBAAyB,YAA7BA,8BAAiC,IAAIT,IAAI;IAC5D,IAAI,wBAAwBZ,IAAI,CAACsB,MAAM,OAAO,EAAE;IAChD,MAAMC,OACJb,QAAOW,iCAAAA,GAAG,CAAC,4BAA4B,YAAhCA,iCAAoC,IAAIT,IAAI,MAAM9B;IAC3D,MAAM0C,QAAQd,QAAOW,yBAAAA,GAAG,CAAC,oBAAoB,YAAxBA,yBAA4B,IAAIT,IAAI,MAAM;IAC/D,MAAMa,OACJV,SAASM,GAAG,CAAC,gCAAgC,KAC7CN,SAAS,CAAC,QAAQ,EAAES,MAAM,CAAC,EAAED,MAAM;IACrC,MAAMG,SAASJ,IACZK,KAAK,CAAC,UACNC,GAAG,CAAC,CAACZ,QAAUD,SAASC,QACxBa,MAAM,CAACC;IACV,OAAO;WAAI,IAAIlC,IAAI;YAAC6B;eAASC;SAAO,CAACG,MAAM,CAACC;KAAU;AACxD;AAEA,0CAA0C,GAC1C,OAAO,SAASC,qBAAqBC,MAAc;IACjD,OAAO,GAAGhD,8BAA8B,IAAIiD,IAAID,QAAQE,IAAI,EAAE;AAChE;AAcA;;;;;;;CAOC,GACD,OAAO,SAASC,uBACdC,KAA4C,EAC5CC,WAA4C,EAC5CC,OAA0E;QAIpDD;IAFtB,MAAM,EAAEL,MAAM,EAAER,KAAK,EAAEe,SAAS,EAAEC,GAAG,EAAE,GAAGF;IAC1C,MAAMG,UAAUV,qBAAqBC;IACrC,MAAM5B,SAASM,QAAO2B,sBAAAA,YAAYjC,MAAM,YAAlBiC,sBAAsB,IAAIK,KAAK,CAAC,GAAG;IACzD,MAAMC,cAAcP,CAAAA,yBAAAA,MAAO/B,MAAM,MAAK;IACtC,IAAIgC,YAAYpC,EAAE,EAAE;QAClB,OAAO;YACL2C,MAAM;gBACJH;gBACAjB;gBACAQ;gBACA3B,QAAQ;gBACRwC,SAAS,CAACF,gBAAeP,yBAAAA,MAAOS,OAAO,IAAGT,MAAMS,OAAO,GAAGL;gBAC1DpC;gBACA0C,aAAaN;gBACbO,qBAAqB;gBACrBC,gBAAgB;gBAChBC,YAAYT;YACd;YACAU,YAAYP,cAAc,cAAc;QAC1C;IACF;IACA,MAAMQ,WAAW,SAACf,yBAAAA,MAAOW,mBAAmB,mBAAI,KAAK;IACrD,MAAMC,0BAAiBZ,yBAAAA,MAAOY,cAAc,oBAAIR;IAChD,MAAMY,WAAWT,eAAeQ,YAAYE,KAAKC,GAAG,CAAC,GAAGf;IACxD,OAAO;QACLK,MAAM;YACJH;YACAjB;YACAQ;YACA3B,QAAQ+C,WAAW,aAAa;YAChCP,SAASO,WACLT,gBAAeP,yBAAAA,MAAOS,OAAO,IAC3BT,MAAMS,OAAO,GACbG,0BACDZ,yBAAAA,MAAOS,OAAO,oBAAIL;YACvBpC;YACA0C,aAAaN;YACbO,qBAAqBI;YACrBH;YACAC,UAAU,WAAEb,yBAAAA,MAAOa,UAAU,oBAAI;QACnC;QACAC,YAAYE,YAAY,CAACT,cAAc,YAAY;IACrD;AACF;AAqCA;;;CAGC,GACD,MAAMY,iBAAqC,OAAOd,SAASe;IACzD,MAAM,EAAEC,SAASC,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC;IAChD,MAAMC,KAAKD,cAAcE,GAAG,GAAGC,SAAS;IACxC,MAAMC,MAAMH,GAAGI,UAAU,CAAChF,2BAA2BiF,GAAG,CAACvB;IACzD,OAAOkB,GAAGM,cAAc,CAAC,OAAOC;QAC9B,MAAMC,WAAW,MAAMD,YAAYE,GAAG,CAACN;QACvC,MAAM1B,QAAQ+B,SAASE,MAAM,GACxBF,SAASG,IAAI,KACd;QACJ,MAAM,EAAE1B,IAAI,EAAE2B,MAAM,EAAE,GAAGf,KAAKpB;QAC9B8B,YAAYM,GAAG,CAACV,KAAKlB;QACrB,OAAO2B;IACT;AACF;AAOA,MAAME,eAA2B,OAAOC,MAAMC;IAC5C,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC;IAC5C,OAAOA,mBAAmBF,MAAMC;AAClC;AAEA,SAASE,iBAAiBC,EAAU;IAClC,MAAMC,UAAU1B,KAAKC,GAAG,CAAC,GAAGD,KAAK2B,KAAK,CAACF,KAAK;IAC5C,IAAIC,UAAU,IAAI,OAAO,GAAGA,QAAQ,IAAI,CAAC;IACzC,MAAME,QAAQ5B,KAAK6B,KAAK,CAACH,UAAU;IACnC,MAAMI,OAAOJ,UAAU;IACvB,OAAOI,OAAO,GAAGF,MAAM,GAAG,EAAEE,KAAK,IAAI,CAAC,GAAG,GAAGF,MAAM,EAAE,CAAC;AACvD;AAEA,SAASG,UAAUC,GAAmB;IACpC,OAAO,GAAGA,IAAI/F,IAAI,CAAC,CAAC,EAAE,IAAI2C,IAAIoD,IAAIC,GAAG,EAAEC,QAAQ,CAAC,EAAE,EAAEF,IAAIjF,MAAM,CAAC,EAAE,EAAEiF,IAAIP,EAAE,CAAC,IAAI,CAAC;AACjF;AAEA,6CAA6C,GAC7C,eAAeU,SACbxD,MAAc,EACdyD,IAAqB,EACrBd,OAMC;IAED,MAAMW,MAAM,GAAGtD,SAASyD,KAAKlG,IAAI,CAACoF,QAAQlF,KAAK,GAAG;IAClD,MAAMiG,YAAYf,QAAQgB,KAAK;IAC/B,IAAI;YAmBI7F;QAlBN,MAAMA,WAAW,MAAM6E,QAAQiB,OAAO,CAACN,KAAK;YAC1CO,UAAU;YACVpF,OAAO;YACPqF,SAAS;gBACP,cAAc;gBACdC,QAAQ;eACLpB,QAAQmB,OAAO;YAEpBE,QAAQC,YAAYC,OAAO,CAACvB,QAAQwB,SAAS;QAC/C;QACA,MAAMpG,OAAO,MAAMD,SAASsG,IAAI;QAChC,MAAMC,UAAUxG,iBACd;YACEQ,QAAQP,SAASO,MAAM;YACvBE,aAAaT,SAASgG,OAAO,CAAC1B,GAAG,CAAC;YAClCrE;YACAO,UAAUR,SAASgG,OAAO,CAAC1B,GAAG,CAAC;YAC/BzD,UAAU,GACRb,wBAAAA,SAASgG,OAAO,CAAC1B,GAAG,CAAC,6BAArBtE,wBACAA,SAASgG,OAAO,CAAC1B,GAAG,CAAC;QACzB,GACAqB,KAAKjG,YAAY;QAEnB,OAAO;YACLF,MAAMmG,KAAKnG,IAAI;YACfgG;YACAR,IAAIH,QAAQgB,KAAK,KAAKD;YACtBY,YAAYxG,SAASO,MAAM;WACxBgG;IAEP,EAAE,OAAOE,OAAO;YAaQ;YAAA;QAZtB,MAAMC,OAAQD,yBAAD,AAACA,MAAoCC,IAAI;QACtD,MAAMC,WAAWD,SAAS,kBAAkBA,SAAS;QACrD,OAAO;YACLlH,MAAMmG,KAAKnG,IAAI;YACfgG;YACAR,IAAIH,QAAQgB,KAAK,KAAKD;YACtBY,YAAY;YACZrG,IAAI;YACJC,YAAY;YACZC,MAAMsG,WAAW,YAAY;YAC7BrG,QAAQqG,WACJ,CAAC,oBAAoB,EAAEpD,KAAK2B,KAAK,CAACL,QAAQwB,SAAS,GAAG,MAAO,EAAE,CAAC,GAChE,CAAC,aAAa,GAAE,gBAACI,0BAAD,eAAA,AAACA,MAAgDG,KAAK,qBAAtD,aAAwDvG,IAAI,oBAAIqG,gBAAhE,OAAwE,QAAQ,CAAC,CAAC;QACxG;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,iBACpBhC,UAWI,CAAC,CAAC;QAEMA,cACEA,cACAA,gBACAA,gBAGLtD,uCAQPsD;IAdF,MAAMtD,OAAMsD,eAAAA,QAAQtD,GAAG,YAAXsD,eAAeiC,QAAQvF,GAAG;IACtC,MAAMsE,SAAQhB,eAAAA,QAAQnC,GAAG,YAAXmC,eAAekC,KAAKrE,GAAG;IACrC,MAAMsE,SAAQnC,iBAAAA,QAAQmC,KAAK,YAAbnC,iBAAiBpB;IAC/B,MAAMwD,SAAQpC,iBAAAA,QAAQoC,KAAK,YAAbpC,iBAAiBF;IAC/B,MAAMuC,SAASlF,QAAQ6C,QAAQqC,MAAM;IACrC,MAAMC,kBAAkBC,OAAOC,QAAQ,CACrCzG,QAAOW,wCAAAA,GAAG,CAAC,mCAAmC,YAAvCA,wCAA2C,KAClD;IAEF,MAAMkB,YACJ2E,OAAOE,QAAQ,CAACH,oBAAoBA,mBAAmB,IACnDA,kBACA9H;IACN,MAAMM,SACJkF,iBAAAA,QAAQlF,KAAK,YAAbkF,iBACC,IAAM,GAAGgB,QAAQ0B,QAAQ,CAAC,MAAMhE,KAAKiE,MAAM,GAAGD,QAAQ,CAAC,IAAI3E,KAAK,CAAC,GAAG,IAAI;IAE3E,MAAM6E,QAAQ,MAAMC,QAAQC,GAAG,CAC7BrG,4BAA4BC,KAAKO,GAAG,CAClC,OAAOI;QACL,MAAM0F,SAAS,MAAMF,QAAQC,GAAG,CAC9BpI,cAAcuC,GAAG,CAAC,CAAC6D;gBAENd,kBACAA,kBAEEA;mBAJba,SAASxD,QAAQyD,MAAM;gBACrBG,OAAO,GAAEjB,mBAAAA,QAAQiB,OAAO,YAAfjB,mBAAmBgD;gBAC5B7B,OAAO,GAAEnB,mBAAAA,QAAQmB,OAAO,YAAfnB,mBAAmB,CAAC;gBAC7BlF,OAAOA;gBACP0G,SAAS,GAAExB,qBAAAA,QAAQwB,SAAS,YAAjBxB,qBAAqBzF;gBAChCyG;YACF;;QAGJ,MAAM1F,KAAKyH,OAAOE,KAAK,CAAC,CAACC,QAAUA,MAAM5H,EAAE;QAC3C,MAAM6H,OAAgC;YAAE9F;YAAQ/B;YAAIyH;QAAO;QAC3D,IAAIV,QAAQ,OAAOc;QACnB,MAAM5F,OAAO,IAAID,IAAID,QAAQE,IAAI;QACjC,MAAM6F,UAAUL,OAAO7F,MAAM,CAAC,CAACgG,QAAU,CAACA,MAAM5H,EAAE;QAClD,MAAMG,SAASH,KACX,wBACA8H,QAAQnG,GAAG,CAACwD,WAAW4C,IAAI,CAAC;QAChC,IAAI;YACF,MAAMxF,MAAMmD;YACZ,MAAM,EAAE/C,IAAI,EAAEM,UAAU,EAAEF,cAAc,EAAE,GAAG,MAAM8D,MACjD/E,qBAAqBC,SACrB,CAACI;oBAgBqBA;gBAfpB,MAAM6F,UAAU9F,uBACdC,OACA;oBAAEnC;oBAAIG;gBAAO,GACb;oBACE4B;oBACAR,OAAO,CAAC,kBAAkB,EAAEU,MAAM;oBAClCK;oBACAC;gBACF;gBAEF,OAAO;oBACLI,MAAMqF,QAAQrF,IAAI;oBAClB2B,QAAQ,aACH0D;wBACH,2CAA2C;wBAC3CjF,cAAc,GAAEZ,gBAAAA,yBAAAA,MAAOY,cAAc,oBAAIZ,yBAAAA,MAAOS,OAAO,YAAvCT,OAA2CI;;gBAE/D;YACF;YAEFsF,KAAKzH,MAAM,GAAGuC,KAAKvC,MAAM;YACzByH,KAAK/E,mBAAmB,GAAGH,KAAKG,mBAAmB;YACnD+E,KAAK5E,UAAU,GAAGA;YAClB,IAAIA,eAAe,WAAW;gBAC5B,MAAM6D,MAAM,4BAA4B;oBACtCmB,WAAWhG;oBACXI,SAAS;wBACPwF,MAAM5F;wBACNiB,UAAUP,KAAKG,mBAAmB;wBAClCoF,OAAOtD,iBAAiBrC,MAAMI,KAAKC,OAAO;wBAC1CzC;oBACF;gBACF;YACF,OAAO,IAAI8C,eAAe,aAAa;gBACrC,MAAM6D,MAAM,8BAA8B;oBACxCmB,WAAWhG;oBACXI,SAAS;wBACPwF,MAAM5F;wBACNkG,UAAUvD,iBAAiBrC,MAAMQ;oBACnC;gBACF;YACF;QACF,EAAE,OAAOuD,OAAO;YACduB,KAAKvB,KAAK,GAAGA,iBAAiB8B,QAAQ9B,MAAM+B,OAAO,GAAG5H,OAAO6F;YAC7DgC,QAAQhC,KAAK,CAAC,CAAC,iBAAiB,EAAErE,KAAK,sBAAsB,CAAC,EAAEqE;QAClE;QACA,OAAOuB;IACT;IAGJ,OAAO;QAAEd;QAAQzE;QAAWgF;IAAM;AACpC"}

package/src/lib/server/risk-notice.d.ts

@@ -217,6 +217,13 @@ export declare function riskNoticeProductName(brand: SystemEmailBrand): string;
  * ONE function, so every notice renders the same way.
  */
 export declare function renderRiskNoticeEmail(key: string, merge: Record<string, string>, brand?: SystemEmailBrand): Promise<RenderedRiskNoticeEmail>;
+/**
+ * How long a caller on a page render's path waits on a notice before it
+ * carries on without the answer (AGL-3565). The notice is not canceled; it
+ * finishes behind the page. A held page or redirect is held either way —
+ * what is bounded is how long the visitor waits to be told so.
+ */
+export declare const RISK_NOTICE_RENDER_DEADLINE_MS = 8000;
 /**
  * Tell the right people about one risk event. See the module header.
  * Never throws.

package/src/lib/server/risk-notice.js

@@ -467,6 +467,12 @@ function emptyDelivery(skipped = null) {
         emails
     };
 }
+/**
+ * How long a caller on a page render's path waits on a notice before it
+ * carries on without the answer (AGL-3565). The notice is not canceled; it
+ * finishes behind the page. A held page or redirect is held either way —
+ * what is bounded is how long the visitor waits to be told so.
+ */ export const RISK_NOTICE_RENDER_DEADLINE_MS = 8000;
 /**
  * Tell the right people about one risk event. See the module header.
  * Never throws.