@aglyn/tenant-data-admin 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/server/hosted-page-review.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/hosted-page-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * HELD FOR REVIEW: a published page (AGL-3362).\n *\n * ## Why the check sits where a page is COMPOSED, not where it is published\n *\n * A publish is a browser write. The besigner toolbar, the versions panel,\n * the screen details page, page-from-template, the layout and component\n * besigners and the form besigner each move a pointer (`versionId`, the\n * host's `screens` map, a component's own `nodes`) straight from the\n * client SDK; the scheduled-publish beat moves it from the server; an\n * experiment serves a version no pointer names; and an author may rewrite\n * the LIVE version document itself without moving any pointer at all. A\n * check on any one of those writes is a check the next one walks around.\n *\n * They all meet in one place: `composeScreenNodes` (`@aglyn/tenant-runtime`),\n * which every published render, the password unlock, the collection and\n * product templates and every experiment variant go through, and which\n * returns the page exactly as a visitor will receive it — the screen, its\n * layout chrome, its grafted components and its forms. So the screen is read\n * there, and a held page is one that is never composed for a visitor. For a\n * visitor, \"publish\" is the first render after the pointer moved; this is\n * that moment.\n *\n * ## What a hold does\n *\n * - The version is not served. The last version this page served clean\n *   ({@link servedPageVersion}) is composed instead — screened again, since\n *   a version document can be edited in place — and if there is none, or it\n *   holds too, the page is not found. A first publish that holds therefore\n *   serves nothing.\n * - One review row per (page, signal set) lands in the abuse queue at\n *   `/admin/abuse-reports`, the same `phishing` row a held email files\n *   (`fileOutboundHold`), with `heldSend.kind: 'page'`, the page's URL and\n *   the held version. Staff dismiss it to RELEASE (the admin route drops the\n *   site's cache and the next render serves it) or mark it actioned to\n *   REJECT (it stays unserved; any later version carrying the same signals\n *   is refused without a new row).\n * - A hold from a workspace in its first fortnight also asks for an\n *   automatic `security` hold on the workspace, the site and the publishing\n *   account (`page-security-hold.ts`, AGL-3450), which the console places.\n * - Keyed on the SIGNALS, as the send seam's rows are: a composed page\n *   carries per-render values (dates, collection rows) that no content hash\n *   would survive, while what makes it phishing does not change between\n *   renders.\n *\n * ## Tiers\n *\n * `signalsThatHold`: a lookalike link or embed, an author-defined\n * credential field and a link to a host Google Web Risk lists\n * (`web-risk-link`, AGL-3451) hold for EVERY workspace; a brand's call to\n * action or lure, and a call to action that leaves the site beside a lure,\n * only for a workspace in its first fortnight. The workspace's documents are\n * read only when something was found, so a clean page costs no read for\n * this. The page's foreign hosts are looked up first, against a cache\n * (`web-risk.ts`), and noted beside the version it serves so the daily\n * re-check can look again: a harvester is often listed only after it is\n * published. A lookup that fails finds nothing, so it never holds a page.\n *\n * Fails CLOSED, unlike the send path: a page the pure screen flagged whose\n * review cannot finish — the workspace read, the row write — is answered\n * `held`, and the composer serves its last clean version or nothing. The\n * answer is not remembered, so the next render reviews it again. Composition\n * itself reads the store, so an outage here is an outage on the render\n * already, and the only cost of not serving a page the screen flagged is a\n * false positive's wait; serving it is the phishing page this exists to\n * stop. A page the screen found nothing on never reaches this.\n *\n * ## Site redirects\n *\n * A redirect rule that sends a path off the site is a page whose one call to\n * action fires on arrival, so the redirects plugin asks\n * {@link reviewSiteRedirect} before it serves one. Same screen\n * (`screenSiteRedirect`), same tiers, same row and the same staff decision:\n * a held rule does not fire, and is filed as a `page` hold on its rule's\n * document. Its destination is looked up against the reputation list too\n * (AGL-3451), so a redirect to a listed site holds for every workspace.\n *=========================================*/\n\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport {\n  heldPageConsolePath,\n  heldPageDetails,\n  heldPageLabel,\n  heldPageVisitorSentence,\n  type HeldPageSubject,\n} from '@aglyn/shared-util-email/held-page'\nimport { screenHostedPage, screenSiteRedirect } from '@aglyn/shared-util-email/hosted-page-screen'\nimport {\n  lookalikeBrandForHost,\n  phishingScreenBrandLabel,\n  type PhishingScreenSignal,\n  describePhishingScreenSignals,\n  isYoungWorkspaceAge,\n  signalsThatHold,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport {\n  foreignHostsForReputation,\n  webRiskSignals,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { describeHeldPage, type HostedPageContext } from './held-page-subject'\nimport { notifyRiskEvent } from './risk-notice'\nimport { orgAgeDays } from './org-age'\nimport { requestPageSecurityHold } from './page-security-hold'\nimport { getHostDocAdmin, getOrgForHost } from './organizations'\nimport { lookupHostReputation, platformReputationExclusions } from './web-risk'\nimport {\n  canonicalJson,\n  fileOutboundHold,\n  flaggedHostOf,\n  heldOutboundReference,\n  heldOutboundReviewId,\n  outboundContentHash,\n  type HeldOutboundSendState,\n  workspaceScreenIdentity,\n} from './outbound-send-review'\n\n/** Where the last version a page served clean is noted: a hint, re-screened before use. */\nexport const PAGE_REVIEW_SUBCOLLECTION = 'pageReviews'\n\nexport interface HostedPageReviewRequest {\n  hostId: string\n  screenId: string\n  versionId: string\n  /** The page as composed for a visitor. */\n  nodes: unknown\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n  /**\n   * What the composer knows about the page (AGL-3374): the screen document,\n   * the template route it is rendering, the variant, and a way to read the\n   * layouts and components composed into it. Read only when a row is filed,\n   * to name the page — never to decide whether it serves.\n   */\n  page?: HostedPageContext | null\n  /**\n   * Signals found about this page elsewhere, judged with the page's own\n   * (AGL-3451): the daily link re-check passes a link Web Risk has listed\n   * since the page went live, so the hold, its row and the young\n   * workspace's security hold all come from this one path.\n   */\n  extraSignals?: readonly PhishingScreenSignal[]\n}\n\nexport type HostedPageReviewOutcome =\n  | { outcome: 'serve' }\n  | { outcome: 'held' | 'rejected'; reviewId: string; reference: string }\n\n/** The review row's id for a page and the signals that held. */\nexport function pageReviewId(\n  hostId: string,\n  screenId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/screens/${screenId}`, outboundContentHash([key]))\n}\n\n/** How long this process trusts a page row's state — the send seam's minute. */\nconst PAGE_MEMO_TTL_MS = 60_000\nconst pageMemo = new Map<string, { state: HeldOutboundSendState; atMs: number }>()\n/** The version each page last served clean, as this process last wrote it. */\nconst servedMemo = new Map<string, string>()\n/** Lookalike hosts this process already flagged for an established page, and when. */\nconst flaggedMemo = new Map<string, number>()\nconst FLAGGED_MEMO_TTL_MS = 60 * 60_000\n/**\n * The foreign hosts each reviewed page version links to (AGL-3451), for\n * {@link recordServedPageVersion} to note beside the version it served, which\n * is what the daily link re-check walks. Bounded: a process that reviews more\n * pages than this starts again.\n */\nconst reviewedForeignHosts = new Map<string, string[]>()\nconst REVIEWED_FOREIGN_HOSTS_MAX = 10_000\n\n/** Test seam: forget what this process learned. */\nexport function resetHostedPageReviewMemoForTests(): void {\n  pageMemo.clear()\n  servedMemo.clear()\n  flaggedMemo.clear()\n  reviewedForeignHosts.clear()\n}\n\n/**\n * Every foreign host the page links to, and the ones Google Web Risk lists\n * (AGL-3451). Foreign before the workspace is known: not the platform's\n * own, not a brand's own domain, not a common social link. Never throws; a\n * lookup that failed lists nothing.\n */\nasync function pageLinkReputation(\n  linkHosts: readonly string[],\n): Promise<{ hosts: string[]; signals: PhishingScreenSignal[] }> {\n  // Runs before the review's fail-closed `try`, so it must not throw: an\n  // answer it cannot give is no listing, never a reason to hold.\n  try {\n    const hosts = foreignHostsForReputation(linkHosts, {\n      excludeDomains: platformReputationExclusions(),\n    })\n    if (!hosts.length) return { hosts, signals: [] }\n    const answer = await lookupHostReputation(hosts)\n    return { hosts, signals: webRiskSignals(answer.hits) }\n  } catch (error) {\n    console.warn('[page-review] link reputation could not be read — no listing assumed', error)\n    return { hosts: [], signals: [] }\n  }\n}\n\n/** Is this host one of the workspace's own? */\nfunction isOwnHost(host: string, ownDomains: readonly (string | null | undefined)[] | undefined): boolean {\n  return (ownDomains ?? []).some((own) => {\n    const domain = String(own ?? '').trim().toLowerCase()\n    return Boolean(domain) && (host === domain || host.endsWith(`.${domain}`))\n  })\n}\n\n/**\n * The subject a row already stored, or a fresh description (AGL-3374). A row\n * that names its page is not described again, so the reads the description\n * may make are paid once per row, not once per render.\n */\nasync function subjectForRow(\n  reviewId: string,\n  describe: () => Promise<HeldPageSubject>,\n): Promise<HeldPageSubject> {\n  const stored = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .get()\n    .then((row) => storedSubject(row.get('heldPage')))\n    .catch(() => null)\n  return stored ?? describe()\n}\n\n/** A row's stored subject, when it has one. */\nfunction storedSubject(heldPage: unknown): HeldPageSubject | null {\n  const subject = (heldPage as { subject?: HeldPageSubject } | null | undefined)?.subject\n  return subject && typeof subject === 'object' && subject.screenId ? subject : null\n}\n\n/** The row's first line, naming the page and where it was seen. */\nfunction pageHeadline(subject: HeldPageSubject, siteName: string): string {\n  return [`${heldPageLabel(subject)} of ${siteName}.`, ...heldPageDetails(subject)].join(' ')\n}\n\n/**\n * Screen one page as a visitor would receive it, and say whether it may be\n * served. See the module header.\n */\nexport async function reviewHostedPage(\n  request: HostedPageReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenHostedPage({ nodes: request.nodes })\n  // Every foreign host it points at, against the reputation list\n  // (AGL-3451): a harvester known to be bad anywhere holds however plain the\n  // page around it is. Strong, so it holds at any workspace age.\n  const reputation = await pageLinkReputation(found.linkHosts)\n  if (reviewedForeignHosts.size >= REVIEWED_FOREIGN_HOSTS_MAX) reviewedForeignHosts.clear()\n  reviewedForeignHosts.set(`${request.hostId}/${request.screenId}/${request.versionId}`, reputation.hosts)\n  const listed = [...reputation.signals, ...(request.extraSignals ?? [])]\n  if (!found.signals.length && !listed.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    // Again, now knowing whose page it is: a brand in the workspace's own\n    // name or domain is its own, and a link to its own site is not away.\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenHostedPage({ nodes: request.nodes, ...identity })\n    // A listing of the workspace's own host is not a link away from it.\n    const screened = [\n      ...verdict.signals,\n      ...listed.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    // Every workspace is screened, however old: an established account can\n    // be compromised, and a compromised account publishing a lure is the\n    // same harm as a new one. What differs is what a hold may take DOWN.\n    // Holding content that is already live serves its last clean version or\n    // nothing, and on a real business's home page that is an outage the\n    // screen caused (aglyn.com, 2026-09-28, a page that had served clean\n    // until a rule changed). So for an established workspace:\n    //   - NEW content (a new version of a live page, or a page that has\n    //     never been live) holds, exactly as for a young workspace; the live\n    //     page keeps serving its last clean version, or the new page waits;\n    //   - content ALREADY LIVE keeps serving, and is flagged to staff as\n    //     urgent, who lock the site if it is impersonation.\n    if (!isYoungWorkspaceAge(ageDays)) {\n      const strong = signalsThatHold(screened, { ageDays })\n      if (!strong.length) return { outcome: 'serve' }\n      if (await isAlreadyLive(request.hostId, request.screenId, request.versionId, nowMs)) {\n        await flagLivePage({\n          hostId: request.hostId,\n          screenId: request.screenId,\n          versionId: request.versionId,\n          orgId,\n          host,\n          signals: strong,\n          nowMs,\n          page: request.page ?? null,\n          identity,\n        })\n        return { outcome: 'serve' }\n      }\n    }\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = pageReviewId(request.hostId, request.screenId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    // The page by its real name and route (AGL-3374): a template, a list,\n    // a variant, or a page whose flagged content lives in its layout.\n    const subject = await subjectForRow(reviewId, async () =>\n      describeHeldPage({\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        host,\n        page: request.page,\n        signals,\n        identity,\n        live: false,\n        previousVersionId: await servedPageVersion(request.hostId, request.screenId),\n      }),\n    )\n    const url = subject.entryUrl ?? subject.url\n    const flagged = flaggedHostOf(signals)\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const label = heldPageLabel(subject)\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/screens/${request.screenId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      extra: {\n        heldPage: { screenId: request.screenId, versionId: request.versionId, url, subject },\n      },\n      headline:\n        `Held ${pageHeadline(subject, siteName)} Version ${request.versionId}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. ${heldPageVisitorSentence(subject)}`,\n      alertTitle: 'Published page held for review — possible phishing',\n      alertBody: `${label.charAt(0).toUpperCase()}${label.slice(1)} was held before it went live.`,\n      // The owners' words for it, and where they fix it (AGL-3368, AGL-3374).\n      item: { label, path: heldPageConsolePath(subject, request.hostId) },\n      page: subject,\n      // The page itself is what was reported; the flagged host, when there\n      // is one, is named in the details and on `reportedHostname`.\n      url,\n      reportedHostname: flagged,\n    })\n    // A hold from a workspace in its first fortnight also holds the\n    // workspace, the site and the account that published it (AGL-3450).\n    if (state === 'held') {\n      await requestPageSecurityHold({\n        orgId: orgId ?? '',\n        org,\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        reviewId,\n        reference,\n        signals,\n        ageDays,\n        pageLabel: label,\n        pageUrl: url,\n        siteName: typeof host?.['name'] === 'string' ? host['name'] : null,\n        nowMs,\n      })\n    }\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed: the screen has already found a signal on this page, and a\n    // review that could not finish has not cleared it. Not remembered, so\n    // the next render reviews it again.\n    console.error('[page-review] a flagged page could not be reviewed — holding it', error)\n    const reviewId = pageReviewId(request.hostId, request.screenId, [...found.signals, ...listed])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nexport interface SiteRedirectReviewRequest {\n  hostId: string\n  /** The rule's document id under `hosts/{hostId}/redirects`. */\n  ruleId: string\n  /** The path, or the pattern, the rule answers. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n}\n\n/** The review row's id for a redirect rule and the signals that held. */\nexport function redirectReviewId(\n  hostId: string,\n  ruleId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/redirects/${ruleId}`, outboundContentHash([key]))\n}\n\n/**\n * Screen one redirect rule before it sends a visitor off the site\n * (AGL-3447), and say whether it may fire. See the module header.\n *\n * Every workspace is screened and the tiers decide, as for a page: a\n * destination that wears a brand holds for all of them, a lure path sent\n * off the site only for a workspace in its first fortnight. A held rule is\n * filed once per (rule, signal set) and decided by staff on that row:\n * dismissed, it fires; actioned, it never does with those signals.\n */\nexport async function reviewSiteRedirect(\n  request: SiteRedirectReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenSiteRedirect({ source: request.source, destination: request.destination })\n  // Where it sends visitors, against the reputation list (AGL-3451): a\n  // listed destination holds for every workspace, as a listed link does.\n  const reputation = await pageLinkReputation(found.linkHosts)\n  if (!found.signals.length && !reputation.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenSiteRedirect({\n      source: request.source,\n      destination: request.destination,\n      ...identity,\n    })\n    const screened = [\n      ...verdict.signals,\n      ...reputation.signals.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    const source = request.source.slice(0, 200)\n    const destination = request.destination.slice(0, 500)\n    const label = `the redirect from ${source}`\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const [subdomainHost, customDomain] = identity.ownDomains ?? []\n    const siteHost = customDomain || subdomainHost\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/redirects/${request.ruleId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      headline:\n        `Held ${label} of ${siteName}, which sends visitors to ${destination}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. The rule does not fire until this is decided.`,\n      alertTitle: 'Site redirect held for review — possible phishing',\n      alertBody: `The redirect from ${source} was held before it sent anyone off the site.`,\n      // Where the owners fix it: the site's Redirects page.\n      item: { label, path: `/${request.hostId}/redirects` },\n      url: siteHost && source.startsWith('/') ? `https://${siteHost}${source}` : destination,\n      reportedHostname: flaggedHostOf(signals),\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed, as a page is: the screen found a signal and nothing cleared it.\n    console.error('[page-review] a flagged redirect could not be reviewed — holding it', error)\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, [\n      ...found.signals,\n      ...reputation.signals,\n    ])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nfunction pageReviewRef(hostId: string, screenId: string) {\n  return firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection(PAGE_REVIEW_SUBCOLLECTION)\n    .doc(screenId)\n}\n\n/**\n * Is this version of the page already what visitors receive? It is when it\n * is the version the page last served clean, or when the page has no record\n * at all and is not new: it went live before the screen existed. A page\n * created in the last {@link NEW_PAGE_DAYS} days with no record has never\n * been live, so holding it takes nothing down.\n */\nconst NEW_PAGE_DAYS = 7\nasync function isAlreadyLive(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n  nowMs: number,\n): Promise<boolean> {\n  const lastClean = await servedPageVersion(hostId, screenId)\n  if (lastClean) return lastClean === versionId\n  try {\n    const screen = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('screens')\n      .doc(screenId)\n      .get()\n    const created = screen.get('createdAt') as { toMillis?: () => number } | number | undefined\n    const createdMs =\n      typeof created === 'number' ? created : typeof created?.toMillis === 'function' ? created.toMillis() : null\n    // No readable creation time: an old page, so live.\n    return createdMs === null || nowMs - createdMs >= NEW_PAGE_DAYS * 24 * 60 * 60 * 1000\n  } catch {\n    return true\n  }\n}\n\n/**\n * A page ALREADY LIVE carries a strong signal: file one urgent abuse row for\n * it (keyed on the page and its signals, so a busy page is one row) and, the\n * first time, tell staff and the owners through the `page-flagged` notice.\n * The page keeps serving; staff lock the site if it is impersonation or the\n * account looks compromised. Once per page and signal set per process.\n */\nasync function flagLivePage(input: {\n  hostId: string\n  screenId: string\n  versionId: string\n  orgId: string | null\n  host: Record<string, unknown> | null\n  signals: readonly PhishingScreenSignal[]\n  nowMs: number\n  page?: HostedPageContext | null\n  identity?: ReturnType<typeof workspaceScreenIdentity>\n}): Promise<void> {\n  const key = `${input.hostId}\\n${input.screenId}\\n${input.signals.map((signal) => canonicalJson(signal)).sort().join('\\n')}`\n  const at = flaggedMemo.get(key)\n  if (at !== undefined && input.nowMs - at < FLAGGED_MEMO_TTL_MS) return\n  flaggedMemo.set(key, input.nowMs)\n  try {\n    const reviewId = pageReviewId(input.hostId, `${input.screenId}/live`, input.signals)\n    const reference = heldOutboundReference(reviewId)\n    const evidence = describePhishingScreenSignals(input.signals).join(' ')\n    const flagged = flaggedHostOf(input.signals)\n    const ref = firebaseAdmin.app().firestore().collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const existing = await ref.get()\n    const first = !existing.exists\n    // Named once, when the row is new (AGL-3374).\n    const subject =\n      (existing.exists ? storedSubject(existing.get('heldPage')) : null) ??\n      (await describeHeldPage({\n        hostId: input.hostId,\n        screenId: input.screenId,\n        versionId: input.versionId,\n        host: input.host,\n        page: input.page,\n        signals: input.signals,\n        identity: input.identity ?? workspaceScreenIdentity({ host: input.host }),\n        live: true,\n        previousVersionId: null,\n      }))\n    const url = subject.entryUrl ?? subject.url\n    const siteName =\n      typeof input.host?.['name'] === 'string' && input.host['name']\n        ? `\"${input.host['name']}\"`\n        : 'a site'\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url,\n        reportedHostname: flagged,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          `LIVE: ${pageHeadline(subject, siteName)} It was flagged by the phishing screen and is still serving.`,\n          evidence,\n          'Lock the site if it is impersonation or the account looks compromised; dismiss this if the content is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        heldPage: { screenId: input.screenId, versionId: input.versionId, url, subject },\n        riskNotice: { kind: 'page-flagged' },\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (!first) return\n    await notifyRiskEvent({\n      kind: 'page-flagged',\n      orgId: input.orgId,\n      hostId: input.hostId,\n      reviewId,\n      reference,\n      item: { label: heldPageLabel(subject), path: heldPageConsolePath(subject, input.hostId) },\n      page: subject,\n      staffEvidence: [...heldPageDetails(subject), evidence].join(' '),\n    })\n  } catch (error) {\n    console.error('[page-review] a live page could not be flagged', error)\n  }\n}\n\n/**\n * The version this page last served clean, or null. A HINT, not a\n * clearance: the caller composes and screens it again before serving it,\n * because a version document can be edited after it was served.\n */\nexport async function servedPageVersion(hostId: string, screenId: string): Promise<string | null> {\n  try {\n    const snapshot = await pageReviewRef(hostId, screenId).get()\n    const value = snapshot.get('servedVersionId')\n    return typeof value === 'string' && value ? value : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Note that this page served `versionId` clean. One read the first time a\n * process renders a page, a write only when the version moved; nothing\n * after that, however often the page is rendered.\n */\nexport async function recordServedPageVersion(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n): Promise<void> {\n  const key = `${hostId}/${screenId}`\n  // The foreign hosts this version links to, as its review found them\n  // (AGL-3451): noted beside it so the daily link re-check can walk them.\n  const foreignHosts = reviewedForeignHosts.get(`${key}/${versionId}`)\n  const memoValue = foreignHosts ? `${versionId}|${foreignHosts.join(',')}` : versionId\n  if (!versionId || servedMemo.get(key) === memoValue) return\n  try {\n    const ref = pageReviewRef(hostId, screenId)\n    const snapshot = await ref.get()\n    const versionMoved = snapshot.get('servedVersionId') !== versionId\n    const stored = snapshot.get('foreignHosts')\n    const hostsMoved =\n      foreignHosts !== undefined &&\n      (Array.isArray(stored) ? stored.join(',') : '') !== foreignHosts.join(',')\n    if (versionMoved || hostsMoved) {\n      await ref.set(\n        {\n          ...(versionMoved ? { servedVersionId: versionId, servedAtMs: Date.now() } : {}),\n          ...(foreignHosts\n            ? { foreignHosts, foreignHostCount: foreignHosts.length }\n            : {}),\n        },\n        { merge: true },\n      )\n    }\n    servedMemo.set(key, memoValue)\n  } catch (error) {\n    console.warn('[page-review] the served version could not be noted', error)\n  }\n}\n\n/**\n * A domain a workspace attached that wears a brand (AGL-3356, AGL-3362):\n * filed in the abuse queue as an urgent `phishing` row for staff, not\n * refused. Two kinds, one rule:\n *\n * - `site` — a custom domain a site is served on (the attach route);\n * - `sending` — a custom domain a workspace sends email as, when it is\n *   added and again when it verifies (`sending-domains.ts`);\n * - `link` — a link a merchant configured that a buyer or a server would\n *   follow: a product's paid download or video hotlink, a supplier's order\n *   webhook (AGL-3363). The link itself is refused where it is followed; this\n *   files it, and tells the site's managers once ({@link notifyLookalikeLink}).\n *\n * Not refused, because the domain is the merchant's own registration and\n * the platform cannot tell a brand's own agency attaching `paypal-promo.com`\n * from a kit — but a brand's lookalike on a site or in a `From:` line is\n * exactly what staff look at first. The site's pages are still screened as\n * they are served, and mail FROM a lookalike domain is held at the send seam\n * for every workspace. The test is the phishing screen's own lookalike rule\n * (`lookalikeBrandForHost`), the one that holds a link in an email. One row\n * per (owner, kind, domain), so a re-attach or a re-verify counts rather than\n * re-alerts.\n *\n * Never throws: the write it rides on has already happened.\n */\nexport async function flagLookalikeDomain(input: {\n  kind: 'site' | 'sending' | 'link'\n  hostId: string | null\n  orgId: string | null\n  domain: string\n  /** For a `link`: where it was configured, as staff read it. */\n  where?: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  const domain = String(input.domain ?? '').trim().toLowerCase()\n  const brand = lookalikeBrandForHost(domain)\n  if (!brand) return 'clean'\n  const label = phishingScreenBrandLabel(brand.id)\n  const sending = input.kind === 'sending'\n  const link = input.kind === 'link'\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const owner = sending\n      ? `orgs/${input.orgId ?? ''}/sendingDomains`\n      : link\n        ? `hosts/${input.hostId ?? ''}/links`\n        : `hosts/${input.hostId ?? ''}/cname`\n    const reviewId = heldOutboundReviewId(owner, domain)\n    const reference = heldOutboundReference(reviewId)\n    const ref = firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const first = !(await ref.get()).exists\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url: `https://${domain}/`,\n        reportedHostname: domain,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          sending\n            ? `A workspace added ${domain} as a domain to send email from.`\n            : link\n              ? `A site configured a link to ${domain} (${input.where ?? 'a commerce link'}).`\n              : `A site attached the custom domain ${domain}.`,\n          `${domain} wears the ${label} name but is not ${label}'s domain.`,\n          sending\n            ? 'Email from it is held at the send seam for every workspace. Mark this actioned ' +\n              'and lock the workspace if it is impersonation; dismiss it if the brand is theirs.'\n            : link\n              ? 'Nobody is sent to it: the link is refused wherever it is followed. Mark this ' +\n                'actioned and lock the site if it is impersonation.'\n              : 'Its pages are still screened as they are served. Mark this actioned ' +\n                'and lock the site if it is impersonation; dismiss it if the brand is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (first && link) {\n      await notifyLookalikeLink({\n        hostId: input.hostId,\n        orgId: input.orgId,\n        domain,\n        label,\n        where: input.where ?? 'a commerce link',\n        reference,\n        reviewId,\n      })\n    } else if (first) {\n      // The owners hear that the domain is waiting on a routine review — not\n      // which name it resembles; staff get the brand and a link to the row.\n      await notifyRiskEvent({\n        kind: 'domain-flagged',\n        orgId: input.orgId,\n        hostId: input.hostId,\n        reviewId,\n        reference,\n        item: {\n          label: sending ? `the sending domain ${domain}` : `the custom domain ${domain}`,\n          // Emails → Sending, or the site's Domain settings.\n          path: sending ? '/org/emails/sending' : input.hostId ? `/${input.hostId}/admin/domain` : null,\n        },\n        staffEvidence:\n          `${sending ? 'Sending domain' : 'Custom domain'} ${domain} looks like ${label}.`,\n      })\n    }\n    return 'flagged'\n  } catch (error) {\n    console.error('[page-review] a lookalike domain could not be flagged', error)\n    return 'failed'\n  }\n}\n\n/**\n * Tell staff and the site's managers and the workspace's owners, once per\n * (site, domain), that a link the merchant configured was refused because it\n * wears another brand's name (AGL-3363), through the risk notice seam\n * (AGL-3368). The merchant reads the catalog's `link-blocked` words — what\n * was refused and how to fix it, never how the check works; staff get the\n * brand and a link to the row. Never throws.\n */\nexport async function notifyLookalikeLink(input: {\n  hostId: string | null\n  orgId?: string | null\n  domain: string\n  label: string\n  where: string\n  reference: string\n  reviewId?: string | null\n}): Promise<void> {\n  await notifyRiskEvent({\n    kind: 'link-blocked',\n    orgId: input.orgId ?? null,\n    hostId: input.hostId,\n    reviewId: input.reviewId ?? null,\n    reference: input.reference,\n    item: {\n      label: `${input.where} pointing to ${input.domain}`,\n      path: input.hostId ? `/${input.hostId}/products` : null,\n    },\n    staffEvidence:\n      `A site configured ${input.where} to ${input.domain}, which looks like ${input.label}. ` +\n      'It is refused wherever it is followed.',\n  }).catch(() => undefined)\n}\n\n/** A site's custom domain, through {@link flagLookalikeDomain}. */\nexport function flagLookalikeCustomDomain(input: {\n  hostId: string\n  orgId: string | null\n  domain: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  return flagLookalikeDomain({ kind: 'site', ...input })\n}\n"],"names":["ABUSE_REPORT_COLLECTION","heldPageConsolePath","heldPageDetails","heldPageLabel","heldPageVisitorSentence","screenHostedPage","screenSiteRedirect","lookalikeBrandForHost","phishingScreenBrandLabel","describePhishingScreenSignals","isYoungWorkspaceAge","signalsThatHold","foreignHostsForReputation","webRiskSignals","FieldValue","firebaseAdmin","describeHeldPage","notifyRiskEvent","orgAgeDays","requestPageSecurityHold","getHostDocAdmin","getOrgForHost","lookupHostReputation","platformReputationExclusions","canonicalJson","fileOutboundHold","flaggedHostOf","heldOutboundReference","heldOutboundReviewId","outboundContentHash","workspaceScreenIdentity","PAGE_REVIEW_SUBCOLLECTION","pageReviewId","hostId","screenId","signals","key","map","signal","sort","join","PAGE_MEMO_TTL_MS","pageMemo","Map","servedMemo","flaggedMemo","FLAGGED_MEMO_TTL_MS","reviewedForeignHosts","REVIEWED_FOREIGN_HOSTS_MAX","resetHostedPageReviewMemoForTests","clear","pageLinkReputation","linkHosts","hosts","excludeDomains","length","answer","hits","error","console","warn","isOwnHost","host","ownDomains","some","own","domain","String","trim","toLowerCase","Boolean","endsWith","subjectForRow","reviewId","describe","stored","app","firestore","collection","doc","get","then","row","storedSubject","catch","heldPage","subject","pageHeadline","siteName","reviewHostedPage","request","found","nodes","reputation","size","set","versionId","listed","extraSignals","outcome","nowMs","Date","now","owner","Promise","all","undefined","org","orgId","identity","verdict","screened","filter","ageDays","createdAt","strong","isAlreadyLive","flagLivePage","page","reference","memo","atMs","state","live","previousVersionId","servedPageVersion","url","entryUrl","flagged","label","heldSend","kind","path","contentHash","slice","fromName","heldAtMs","extra","headline","alertTitle","alertBody","charAt","toUpperCase","item","reportedHostname","pageLabel","pageUrl","redirectReviewId","ruleId","reviewSiteRedirect","source","destination","subdomainHost","customDomain","siteHost","startsWith","pageReviewRef","NEW_PAGE_DAYS","lastClean","screen","created","createdMs","toMillis","input","at","existing","evidence","ref","first","exists","category","severity","details","reporterEmail","reporterName","dmca","riskNotice","reportCount","increment","updatedAt","serverTimestamp","status","merge","staffEvidence","snapshot","value","recordServedPageVersion","foreignHosts","memoValue","versionMoved","hostsMoved","Array","isArray","servedVersionId","servedAtMs","foreignHostCount","flagLookalikeDomain","brand","id","sending","link","where","notifyLookalikeLink","flagLookalikeCustomDomain"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA4E2C,GAE3C,SAASA,uBAAuB,QAAQ,sCAAqC;AAC7E,SACEC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,QAElB,qCAAoC;AAC3C,SAASC,gBAAgB,EAAEC,kBAAkB,QAAQ,8CAA6C;AAClG,SACEC,qBAAqB,EACrBC,wBAAwB,EAExBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,eAAe,QACV,oDAAmD;AAC1D,SACEC,yBAAyB,EACzBC,cAAc,QACT,2CAA0C;AACjD,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,gBAAgB,QAAgC,yBAAqB;AAC9E,SAASC,eAAe,QAAQ,mBAAe;AAC/C,SAASC,UAAU,QAAQ,eAAW;AACtC,SAASC,uBAAuB,QAAQ,0BAAsB;AAC9D,SAASC,eAAe,EAAEC,aAAa,QAAQ,qBAAiB;AAChE,SAASC,oBAAoB,EAAEC,4BAA4B,QAAQ,gBAAY;AAC/E,SACEC,aAAa,EACbC,gBAAgB,EAChBC,aAAa,EACbC,qBAAqB,EACrBC,oBAAoB,EACpBC,mBAAmB,EAEnBC,uBAAuB,QAClB,4BAAwB;AAE/B,yFAAyF,GACzF,OAAO,MAAMC,4BAA4B,cAAa;AAiCtD,8DAA8D,GAC9D,OAAO,SAASC,aACdC,MAAc,EACdC,QAAgB,EAChBC,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,SAAS,EAAEC,UAAU,EAAEL,oBAAoB;QAACO;KAAI;AAC9F;AAEA,8EAA8E,GAC9E,MAAMK,mBAAmB;AACzB,MAAMC,WAAW,IAAIC;AACrB,4EAA4E,GAC5E,MAAMC,aAAa,IAAID;AACvB,oFAAoF,GACpF,MAAME,cAAc,IAAIF;AACxB,MAAMG,sBAAsB,KAAK;AACjC;;;;;CAKC,GACD,MAAMC,uBAAuB,IAAIJ;AACjC,MAAMK,6BAA6B;AAEnC,iDAAiD,GACjD,OAAO,SAASC;IACdP,SAASQ,KAAK;IACdN,WAAWM,KAAK;IAChBL,YAAYK,KAAK;IACjBH,qBAAqBG,KAAK;AAC5B;AAEA;;;;;CAKC,GACD,eAAeC,mBACbC,SAA4B;IAE5B,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI;QACF,MAAMC,QAAQzC,0BAA0BwC,WAAW;YACjDE,gBAAgB/B;QAClB;QACA,IAAI,CAAC8B,MAAME,MAAM,EAAE,OAAO;YAAEF;YAAOlB,SAAS,EAAE;QAAC;QAC/C,MAAMqB,SAAS,MAAMlC,qBAAqB+B;QAC1C,OAAO;YAAEA;YAAOlB,SAAStB,eAAe2C,OAAOC,IAAI;QAAE;IACvD,EAAE,OAAOC,OAAO;QACdC,QAAQC,IAAI,CAAC,wEAAwEF;QACrF,OAAO;YAAEL,OAAO,EAAE;YAAElB,SAAS,EAAE;QAAC;IAClC;AACF;AAEA,6CAA6C,GAC7C,SAAS0B,UAAUC,IAAY,EAAEC,UAA8D;IAC7F,OAAO,CAACA,qBAAAA,aAAc,EAAE,EAAEC,IAAI,CAAC,CAACC;QAC9B,MAAMC,SAASC,OAAOF,cAAAA,MAAO,IAAIG,IAAI,GAAGC,WAAW;QACnD,OAAOC,QAAQJ,WAAYJ,CAAAA,SAASI,UAAUJ,KAAKS,QAAQ,CAAC,CAAC,CAAC,EAAEL,QAAQ,CAAA;IAC1E;AACF;AAEA;;;;CAIC,GACD,eAAeM,cACbC,QAAgB,EAChBC,QAAwC;IAExC,MAAMC,SAAS,MAAM5D,cAClB6D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC9E,yBACX+E,GAAG,CAACN,UACJO,GAAG,GACHC,IAAI,CAAC,CAACC,MAAQC,cAAcD,IAAIF,GAAG,CAAC,cACpCI,KAAK,CAAC,IAAM;IACf,OAAOT,iBAAAA,SAAUD;AACnB;AAEA,6CAA6C,GAC7C,SAASS,cAAcE,QAAiB;IACtC,MAAMC,UAAWD,4BAAD,AAACA,SAA+DC,OAAO;IACvF,OAAOA,WAAW,OAAOA,YAAY,YAAYA,QAAQpD,QAAQ,GAAGoD,UAAU;AAChF;AAEA,iEAAiE,GACjE,SAASC,aAAaD,OAAwB,EAAEE,QAAgB;IAC9D,OAAO;QAAC,GAAGrF,cAAcmF,SAAS,IAAI,EAAEE,SAAS,CAAC,CAAC;WAAKtF,gBAAgBoF;KAAS,CAAC9C,IAAI,CAAC;AACzF;AAEA;;;CAGC,GACD,OAAO,eAAeiD,iBACpBC,OAAgC;QASWA,uBAG7BA;IAVd,MAAMC,QAAQtF,iBAAiB;QAAEuF,OAAOF,QAAQE,KAAK;IAAC;IACtD,+DAA+D;IAC/D,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAMC,aAAa,MAAM1C,mBAAmBwC,MAAMvC,SAAS;IAC3D,IAAIL,qBAAqB+C,IAAI,IAAI9C,4BAA4BD,qBAAqBG,KAAK;IACvFH,qBAAqBgD,GAAG,CAAC,GAAGL,QAAQzD,MAAM,CAAC,CAAC,EAAEyD,QAAQxD,QAAQ,CAAC,CAAC,EAAEwD,QAAQM,SAAS,EAAE,EAAEH,WAAWxC,KAAK;IACvG,MAAM4C,SAAS;WAAIJ,WAAW1D,OAAO;YAAMuD,wBAAAA,QAAQQ,YAAY,YAApBR,wBAAwB,EAAE;KAAE;IACvE,IAAI,CAACC,MAAMxD,OAAO,CAACoB,MAAM,IAAI,CAAC0C,OAAO1C,MAAM,EAAE,OAAO;QAAE4C,SAAS;IAAQ;IAEvE,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAyEHJ;QA5EZ,MAAM,CAACxB,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG1C,gBAAgBsE,QAAQzD,MAAM;YAC1EyD,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDtF,cAAcqE,QAAQzD,MAAM;SACjC;QACD,MAAM0E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,sEAAsE;QACtE,qEAAqE;QACrE,MAAMC,WAAW/E,wBAAwB;YAAE6E;YAAK7C;QAAK;QACrD,MAAMgD,UAAUzG,iBAAiB;YAAEuF,OAAOF,QAAQE,KAAK;WAAKiB;QAC5D,oEAAoE;QACpE,MAAME,WAAW;eACZD,QAAQ3E,OAAO;eACf8D,OAAOe,MAAM,CACd,CAAC1E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACuB,UAAUvB,OAAOwB,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAU/F,WAAYyF,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,0DAA0D;QAC1D,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAAC1F,oBAAoBuG,UAAU;YACjC,MAAME,SAASxG,gBAAgBoG,UAAU;gBAAEE;YAAQ;YACnD,IAAI,CAACE,OAAO5D,MAAM,EAAE,OAAO;gBAAE4C,SAAS;YAAQ;YAC9C,IAAI,MAAMiB,cAAc1B,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ,EAAEwD,QAAQM,SAAS,EAAEI,QAAQ;oBAS3EV;gBARR,MAAM2B,aAAa;oBACjBpF,QAAQyD,QAAQzD,MAAM;oBACtBC,UAAUwD,QAAQxD,QAAQ;oBAC1B8D,WAAWN,QAAQM,SAAS;oBAC5BY;oBACA9C;oBACA3B,SAASgF;oBACTf;oBACAkB,IAAI,GAAE5B,gBAAAA,QAAQ4B,IAAI,YAAZ5B,gBAAgB;oBACtBmB;gBACF;gBACA,OAAO;oBAAEV,SAAS;gBAAQ;YAC5B;QACF;QACA,MAAMhE,UAAUxB,gBAAgBoG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAC9E,QAAQoB,MAAM,EAAE,OAAO;YAAE4C,SAAS;QAAQ;QAE/C,MAAM1B,WAAWzC,aAAa0D,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ,EAAEC;QAChE,MAAMoF,YAAY5F,sBAAsB8C;QACxC,MAAM+C,OAAO9E,SAASsC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGhF,kBAAkB;YAChD,OAAO+E,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,sEAAsE;QACtE,kEAAkE;QAClE,MAAMjC,UAAU,MAAMd,cAAcC,UAAU,UAC5CzD,iBAAiB;gBACfiB,QAAQyD,QAAQzD,MAAM;gBACtBC,UAAUwD,QAAQxD,QAAQ;gBAC1B8D,WAAWN,QAAQM,SAAS;gBAC5BlC;gBACAwD,MAAM5B,QAAQ4B,IAAI;gBAClBnF;gBACA0E;gBACAc,MAAM;gBACNC,mBAAmB,MAAMC,kBAAkBnC,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ;YAC7E;QAEF,MAAM4F,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAME,UAAUtG,cAAcS;QAC9B,MAAMqD,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAMmE,QAAQ9H,cAAcmF;QAC5B,MAAMoC,QAAQ,MAAMjG,iBAAiB;YACnCgD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQzD,MAAM,CAAC,SAAS,EAAEyD,QAAQxD,QAAQ,EAAE;gBAC3DD,QAAQyD,QAAQzD,MAAM;gBACtB2E;gBACAyB,aAAaxG,oBAAoB;oBAACM;iBAAQ;gBAC1CmD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVpG;gBACAuF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAwB,OAAO;gBACLpD,UAAU;oBAAEnD,UAAUwD,QAAQxD,QAAQ;oBAAE8D,WAAWN,QAAQM,SAAS;oBAAE8B;oBAAKxC;gBAAQ;YACrF;YACAoD,UACE,CAAC,KAAK,EAAEnD,aAAaD,SAASE,UAAU,SAAS,EAAEE,QAAQM,SAAS,CAAC,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEiB,kBAAAA,UAAW,IAAI,aAAa,EAAE7G,wBAAwBkF,UAAU;YAC/EqD,YAAY;YACZC,WAAW,GAAGX,MAAMY,MAAM,CAAC,GAAGC,WAAW,KAAKb,MAAMK,KAAK,CAAC,GAAG,8BAA8B,CAAC;YAC5F,wEAAwE;YACxES,MAAM;gBAAEd;gBAAOG,MAAMnI,oBAAoBqF,SAASI,QAAQzD,MAAM;YAAE;YAClEqF,MAAMhC;YACN,qEAAqE;YACrE,6DAA6D;YAC7DwC;YACAkB,kBAAkBhB;QACpB;QACA,gEAAgE;QAChE,oEAAoE;QACpE,IAAIN,UAAU,QAAQ;YACpB,MAAMvG,wBAAwB;gBAC5ByF,KAAK,EAAEA,gBAAAA,QAAS;gBAChBD;gBACA1E,QAAQyD,QAAQzD,MAAM;gBACtBC,UAAUwD,QAAQxD,QAAQ;gBAC1B8D,WAAWN,QAAQM,SAAS;gBAC5BvB;gBACA8C;gBACApF;gBACA8E;gBACAgC,WAAWhB;gBACXiB,SAASpB;gBACTtC,UAAU,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,WAAWA,IAAI,CAAC,OAAO,GAAG;gBAC9DsC;YACF;QACF;QACA1D,SAASqD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpCC,QAAQD,KAAK,CAAC,mEAAmEA;QACjF,MAAMe,WAAWzC,aAAa0D,QAAQzD,MAAM,EAAEyD,QAAQxD,QAAQ,EAAE;eAAIyD,MAAMxD,OAAO;eAAK8D;SAAO;QAC7F,OAAO;YAAEE,SAAS;YAAQ1B;YAAU8C,WAAW5F,sBAAsB8C;QAAU;IACjF;AACF;AAiBA,uEAAuE,GACvE,OAAO,SAAS0E,iBACdlH,MAAc,EACdmH,MAAc,EACdjH,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,WAAW,EAAEmH,QAAQ,EAAEvH,oBAAoB;QAACO;KAAI;AAC9F;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeiH,mBACpB3D,OAAkC;QAQpBA;IANd,MAAMC,QAAQrF,mBAAmB;QAAEgJ,QAAQ5D,QAAQ4D,MAAM;QAAEC,aAAa7D,QAAQ6D,WAAW;IAAC;IAC5F,qEAAqE;IACrE,uEAAuE;IACvE,MAAM1D,aAAa,MAAM1C,mBAAmBwC,MAAMvC,SAAS;IAC3D,IAAI,CAACuC,MAAMxD,OAAO,CAACoB,MAAM,IAAI,CAACsC,WAAW1D,OAAO,CAACoB,MAAM,EAAE,OAAO;QAAE4C,SAAS;IAAQ;IAEnF,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAkCuBmB;QArCtC,MAAM,CAAC/C,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG1C,gBAAgBsE,QAAQzD,MAAM;YAC1EyD,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDtF,cAAcqE,QAAQzD,MAAM;SACjC;QACD,MAAM0E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,MAAMC,WAAW/E,wBAAwB;YAAE6E;YAAK7C;QAAK;QACrD,MAAMgD,UAAUxG,mBAAmB;YACjCgJ,QAAQ5D,QAAQ4D,MAAM;YACtBC,aAAa7D,QAAQ6D,WAAW;WAC7B1C;QAEL,MAAME,WAAW;eACZD,QAAQ3E,OAAO;eACf0D,WAAW1D,OAAO,CAAC6E,MAAM,CAC1B,CAAC1E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACuB,UAAUvB,OAAOwB,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAU/F,WAAYyF,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,MAAMjE,UAAUxB,gBAAgBoG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAC9E,QAAQoB,MAAM,EAAE,OAAO;YAAE4C,SAAS;QAAQ;QAE/C,MAAM1B,WAAW0E,iBAAiBzD,QAAQzD,MAAM,EAAEyD,QAAQ0D,MAAM,EAAEjH;QAClE,MAAMoF,YAAY5F,sBAAsB8C;QACxC,MAAM+C,OAAO9E,SAASsC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGhF,kBAAkB;YAChD,OAAO+E,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,MAAM+B,SAAS5D,QAAQ4D,MAAM,CAAChB,KAAK,CAAC,GAAG;QACvC,MAAMiB,cAAc7D,QAAQ6D,WAAW,CAACjB,KAAK,CAAC,GAAG;QACjD,MAAML,QAAQ,CAAC,kBAAkB,EAAEqB,QAAQ;QAC3C,MAAM9D,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM,CAAC0F,eAAeC,aAAa,IAAG5C,uBAAAA,SAAS9C,UAAU,YAAnB8C,uBAAuB,EAAE;QAC/D,MAAM6C,WAAWD,gBAAgBD;QACjC,MAAM9B,QAAQ,MAAMjG,iBAAiB;YACnCgD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQzD,MAAM,CAAC,WAAW,EAAEyD,QAAQ0D,MAAM,EAAE;gBAC3DnH,QAAQyD,QAAQzD,MAAM;gBACtB2E;gBACAyB,aAAaxG,oBAAoB;oBAACM;iBAAQ;gBAC1CmD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVpG;gBACAuF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAyB,UACE,CAAC,KAAK,EAAET,MAAM,IAAI,EAAEzC,SAAS,0BAA0B,EAAE+D,YAAY,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEtC,kBAAAA,UAAW,IAAI,0DAA0D,CAAC;YACzF0B,YAAY;YACZC,WAAW,CAAC,kBAAkB,EAAEU,OAAO,6CAA6C,CAAC;YACrF,sDAAsD;YACtDP,MAAM;gBAAEd;gBAAOG,MAAM,CAAC,CAAC,EAAE1C,QAAQzD,MAAM,CAAC,UAAU,CAAC;YAAC;YACpD6F,KAAK4B,YAAYJ,OAAOK,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAED,WAAWJ,QAAQ,GAAGC;YAC3EP,kBAAkBtH,cAAcS;QAClC;QACAO,SAASqD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,0EAA0E;QAC1EC,QAAQD,KAAK,CAAC,uEAAuEA;QACrF,MAAMe,WAAW0E,iBAAiBzD,QAAQzD,MAAM,EAAEyD,QAAQ0D,MAAM,EAAE;eAC7DzD,MAAMxD,OAAO;eACb0D,WAAW1D,OAAO;SACtB;QACD,OAAO;YAAEgE,SAAS;YAAQ1B;YAAU8C,WAAW5F,sBAAsB8C;QAAU;IACjF;AACF;AAEA,SAASmF,cAAc3H,MAAc,EAAEC,QAAgB;IACrD,OAAOnB,cACJ6D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAC9C,QACJ6C,UAAU,CAAC/C,2BACXgD,GAAG,CAAC7C;AACT;AAEA;;;;;;CAMC,GACD,MAAM2H,gBAAgB;AACtB,eAAezC,cACbnF,MAAc,EACdC,QAAgB,EAChB8D,SAAiB,EACjBI,KAAa;IAEb,MAAM0D,YAAY,MAAMjC,kBAAkB5F,QAAQC;IAClD,IAAI4H,WAAW,OAAOA,cAAc9D;IACpC,IAAI;QACF,MAAM+D,SAAS,MAAMhJ,cAClB6D,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAC9C,QACJ6C,UAAU,CAAC,WACXC,GAAG,CAAC7C,UACJ8C,GAAG;QACN,MAAMgF,UAAUD,OAAO/E,GAAG,CAAC;QAC3B,MAAMiF,YACJ,OAAOD,YAAY,WAAWA,UAAU,QAAOA,2BAAAA,QAASE,QAAQ,MAAK,aAAaF,QAAQE,QAAQ,KAAK;QACzG,mDAAmD;QACnD,OAAOD,cAAc,QAAQ7D,QAAQ6D,aAAaJ,gBAAgB,KAAK,KAAK,KAAK;IACnF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,eAAexC,aAAa8C,KAU3B;IACC,MAAM/H,MAAM,GAAG+H,MAAMlI,MAAM,CAAC,EAAE,EAAEkI,MAAMjI,QAAQ,CAAC,EAAE,EAAEiI,MAAMhI,OAAO,CAACE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAASC,IAAI,GAAGC,IAAI,CAAC,OAAO;IAC3H,MAAM4H,KAAKvH,YAAYmC,GAAG,CAAC5C;IAC3B,IAAIgI,OAAO1D,aAAayD,MAAM/D,KAAK,GAAGgE,KAAKtH,qBAAqB;IAChED,YAAYkD,GAAG,CAAC3D,KAAK+H,MAAM/D,KAAK;IAChC,IAAI;YAUCiE,MAQWF,iBAIF7E;YAEH6E;QAvBT,MAAM1F,WAAWzC,aAAamI,MAAMlI,MAAM,EAAE,GAAGkI,MAAMjI,QAAQ,CAAC,KAAK,CAAC,EAAEiI,MAAMhI,OAAO;QACnF,MAAMoF,YAAY5F,sBAAsB8C;QACxC,MAAM6F,WAAW7J,8BAA8B0J,MAAMhI,OAAO,EAAEK,IAAI,CAAC;QACnE,MAAMwF,UAAUtG,cAAcyI,MAAMhI,OAAO;QAC3C,MAAMoI,MAAMxJ,cAAc6D,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC9E,yBAAyB+E,GAAG,CAACN;QACpF,MAAM4F,WAAW,MAAME,IAAIvF,GAAG;QAC9B,MAAMwF,QAAQ,CAACH,SAASI,MAAM;QAC9B,8CAA8C;QAC9C,MAAMnF,WACH+E,OAAAA,SAASI,MAAM,GAAGtF,cAAckF,SAASrF,GAAG,CAAC,eAAe,gBAA5DqF,OACA,MAAMrJ,iBAAiB;YACtBiB,QAAQkI,MAAMlI,MAAM;YACpBC,UAAUiI,MAAMjI,QAAQ;YACxB8D,WAAWmE,MAAMnE,SAAS;YAC1BlC,MAAMqG,MAAMrG,IAAI;YAChBwD,MAAM6C,MAAM7C,IAAI;YAChBnF,SAASgI,MAAMhI,OAAO;YACtB0E,QAAQ,GAAEsD,kBAAAA,MAAMtD,QAAQ,YAAdsD,kBAAkBrI,wBAAwB;gBAAEgC,MAAMqG,MAAMrG,IAAI;YAAC;YACvE6D,MAAM;YACNC,mBAAmB;QACrB;QACF,MAAME,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAMtC,WACJ,SAAO2E,cAAAA,MAAMrG,IAAI,qBAAVqG,WAAY,CAAC,OAAO,MAAK,YAAYA,MAAMrG,IAAI,CAAC,OAAO,GAC1D,CAAC,CAAC,EAAEqG,MAAMrG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GACzB;QACN,MAAMyG,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB;YACAkB,kBAAkBhB;YAClB/F,QAAQkI,MAAMlI,MAAM;YACpB2E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP,CAAC,MAAM,EAAErF,aAAaD,SAASE,UAAU,4DAA4D,CAAC;gBACtG8E;gBACA;aACD,CAAC9H,IAAI,CAAC;YACPqI,eAAe;YACfC,cAAc;YACdC,MAAM;YACN1F,UAAU;gBAAEnD,UAAUiI,MAAMjI,QAAQ;gBAAE8D,WAAWmE,MAAMnE,SAAS;gBAAE8B;gBAAKxC;YAAQ;YAC/E0F,YAAY;gBAAE7C,MAAM;YAAe;YACnC8C,aAAanK,WAAWoK,SAAS,CAAC;YAClCC,WAAWrK,WAAWsK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWpG,WAAWsK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAI,CAACd,OAAO;QACZ,MAAMvJ,gBAAgB;YACpBkH,MAAM;YACNvB,OAAOuD,MAAMvD,KAAK;YAClB3E,QAAQkI,MAAMlI,MAAM;YACpBwC;YACA8C;YACAwB,MAAM;gBAAEd,OAAO9H,cAAcmF;gBAAU8C,MAAMnI,oBAAoBqF,SAAS6E,MAAMlI,MAAM;YAAE;YACxFqF,MAAMhC;YACNiG,eAAe;mBAAIrL,gBAAgBoF;gBAAUgF;aAAS,CAAC9H,IAAI,CAAC;QAC9D;IACF,EAAE,OAAOkB,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;IAClE;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAemE,kBAAkB5F,MAAc,EAAEC,QAAgB;IACtE,IAAI;QACF,MAAMsJ,WAAW,MAAM5B,cAAc3H,QAAQC,UAAU8C,GAAG;QAC1D,MAAMyG,QAAQD,SAASxG,GAAG,CAAC;QAC3B,OAAO,OAAOyG,UAAU,YAAYA,QAAQA,QAAQ;IACtD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpBzJ,MAAc,EACdC,QAAgB,EAChB8D,SAAiB;IAEjB,MAAM5D,MAAM,GAAGH,OAAO,CAAC,EAAEC,UAAU;IACnC,oEAAoE;IACpE,wEAAwE;IACxE,MAAMyJ,eAAe5I,qBAAqBiC,GAAG,CAAC,GAAG5C,IAAI,CAAC,EAAE4D,WAAW;IACnE,MAAM4F,YAAYD,eAAe,GAAG3F,UAAU,CAAC,EAAE2F,aAAanJ,IAAI,CAAC,MAAM,GAAGwD;IAC5E,IAAI,CAACA,aAAapD,WAAWoC,GAAG,CAAC5C,SAASwJ,WAAW;IACrD,IAAI;QACF,MAAMrB,MAAMX,cAAc3H,QAAQC;QAClC,MAAMsJ,WAAW,MAAMjB,IAAIvF,GAAG;QAC9B,MAAM6G,eAAeL,SAASxG,GAAG,CAAC,uBAAuBgB;QACzD,MAAMrB,SAAS6G,SAASxG,GAAG,CAAC;QAC5B,MAAM8G,aACJH,iBAAiBjF,aACjB,AAACqF,CAAAA,MAAMC,OAAO,CAACrH,UAAUA,OAAOnC,IAAI,CAAC,OAAO,EAAC,MAAOmJ,aAAanJ,IAAI,CAAC;QACxE,IAAIqJ,gBAAgBC,YAAY;YAC9B,MAAMvB,IAAIxE,GAAG,CACX,aACM8F,eAAe;gBAAEI,iBAAiBjG;gBAAWkG,YAAY7F,KAAKC,GAAG;YAAG,IAAI,CAAC,GACzEqF,eACA;gBAAEA;gBAAcQ,kBAAkBR,aAAapI,MAAM;YAAC,IACtD,CAAC,IAEP;gBAAE+H,OAAO;YAAK;QAElB;QACA1I,WAAWmD,GAAG,CAAC3D,KAAKwJ;IACtB,EAAE,OAAOlI,OAAO;QACdC,QAAQC,IAAI,CAAC,uDAAuDF;IACtE;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,eAAe0I,oBAAoBjC,KAOzC;QACuBA;IAAtB,MAAMjG,SAASC,QAAOgG,gBAAAA,MAAMjG,MAAM,YAAZiG,gBAAgB,IAAI/F,IAAI,GAAGC,WAAW;IAC5D,MAAMgI,QAAQ9L,sBAAsB2D;IACpC,IAAI,CAACmI,OAAO,OAAO;IACnB,MAAMpE,QAAQzH,yBAAyB6L,MAAMC,EAAE;IAC/C,MAAMC,UAAUpC,MAAMhC,IAAI,KAAK;IAC/B,MAAMqE,OAAOrC,MAAMhC,IAAI,KAAK;IAC5B,IAAI;YAGUgC,cAEGA,eACAA,gBAmBuCA;QAxBtD,MAAMtF,YAAY9D,cAAc6D,GAAG,GAAGC,SAAS;QAC/C,MAAM0B,QAAQgG,UACV,CAAC,KAAK,GAAEpC,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe,GAAG,eAAe,CAAC,GAC1CqC,OACE,CAAC,MAAM,GAAErC,gBAAAA,MAAMlI,MAAM,YAAZkI,gBAAgB,GAAG,MAAM,CAAC,GACnC,CAAC,MAAM,GAAEA,iBAAAA,MAAMlI,MAAM,YAAZkI,iBAAgB,GAAG,MAAM,CAAC;QACzC,MAAM1F,WAAW7C,qBAAqB2E,OAAOrC;QAC7C,MAAMqD,YAAY5F,sBAAsB8C;QACxC,MAAM8F,MAAM1F,UAAUC,UAAU,CAAC9E,yBAAyB+E,GAAG,CAACN;QAC9D,MAAM+F,QAAQ,CAAC,AAAC,CAAA,MAAMD,IAAIvF,GAAG,EAAC,EAAGyF,MAAM;QACvC,MAAMF,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB,KAAK,CAAC,QAAQ,EAAE5D,OAAO,CAAC,CAAC;YACzB8E,kBAAkB9E;YAClBjC,QAAQkI,MAAMlI,MAAM;YACpB2E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP2B,UACI,CAAC,kBAAkB,EAAErI,OAAO,gCAAgC,CAAC,GAC7DsI,OACE,CAAC,4BAA4B,EAAEtI,OAAO,EAAE,GAAEiG,eAAAA,MAAMsC,KAAK,YAAXtC,eAAe,kBAAkB,EAAE,CAAC,GAC9E,CAAC,kCAAkC,EAAEjG,OAAO,CAAC,CAAC;gBACpD,GAAGA,OAAO,WAAW,EAAE+D,MAAM,iBAAiB,EAAEA,MAAM,UAAU,CAAC;gBACjEsE,UACI,oFACA,sFACAC,OACE,kFACA,uDACA,yEACA;aACP,CAAChK,IAAI,CAAC;YACPqI,eAAe;YACfC,cAAc;YACdC,MAAM;YACNE,aAAanK,WAAWoK,SAAS,CAAC;YAClCC,WAAWrK,WAAWsK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWpG,WAAWsK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAId,SAASgC,MAAM;gBAMRrC;YALT,MAAMuC,oBAAoB;gBACxBzK,QAAQkI,MAAMlI,MAAM;gBACpB2E,OAAOuD,MAAMvD,KAAK;gBAClB1C;gBACA+D;gBACAwE,KAAK,GAAEtC,gBAAAA,MAAMsC,KAAK,YAAXtC,gBAAe;gBACtB5C;gBACA9C;YACF;QACF,OAAO,IAAI+F,OAAO;YAChB,uEAAuE;YACvE,sEAAsE;YACtE,MAAMvJ,gBAAgB;gBACpBkH,MAAM;gBACNvB,OAAOuD,MAAMvD,KAAK;gBAClB3E,QAAQkI,MAAMlI,MAAM;gBACpBwC;gBACA8C;gBACAwB,MAAM;oBACJd,OAAOsE,UAAU,CAAC,mBAAmB,EAAErI,QAAQ,GAAG,CAAC,kBAAkB,EAAEA,QAAQ;oBAC/E,mDAAmD;oBACnDkE,MAAMmE,UAAU,wBAAwBpC,MAAMlI,MAAM,GAAG,CAAC,CAAC,EAAEkI,MAAMlI,MAAM,CAAC,aAAa,CAAC,GAAG;gBAC3F;gBACAsJ,eACE,GAAGgB,UAAU,mBAAmB,gBAAgB,CAAC,EAAErI,OAAO,YAAY,EAAE+D,MAAM,CAAC,CAAC;YACpF;QACF;QACA,OAAO;IACT,EAAE,OAAOvE,OAAO;QACdC,QAAQD,KAAK,CAAC,yDAAyDA;QACvE,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,eAAegJ,oBAAoBvC,KAQzC;QAGUA,cAEGA;IAJZ,MAAMlJ,gBAAgB;QACpBkH,MAAM;QACNvB,KAAK,GAAEuD,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe;QACtBlI,QAAQkI,MAAMlI,MAAM;QACpBwC,QAAQ,GAAE0F,kBAAAA,MAAM1F,QAAQ,YAAd0F,kBAAkB;QAC5B5C,WAAW4C,MAAM5C,SAAS;QAC1BwB,MAAM;YACJd,OAAO,GAAGkC,MAAMsC,KAAK,CAAC,aAAa,EAAEtC,MAAMjG,MAAM,EAAE;YACnDkE,MAAM+B,MAAMlI,MAAM,GAAG,CAAC,CAAC,EAAEkI,MAAMlI,MAAM,CAAC,SAAS,CAAC,GAAG;QACrD;QACAsJ,eACE,CAAC,kBAAkB,EAAEpB,MAAMsC,KAAK,CAAC,IAAI,EAAEtC,MAAMjG,MAAM,CAAC,mBAAmB,EAAEiG,MAAMlC,KAAK,CAAC,EAAE,CAAC,GACxF;IACJ,GAAG7C,KAAK,CAAC,IAAMsB;AACjB;AAEA,iEAAiE,GACjE,OAAO,SAASiG,0BAA0BxC,KAIzC;IACC,OAAOiC,oBAAoB;QAAEjE,MAAM;OAAWgC;AAChD"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/hosted-page-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * HELD FOR REVIEW: a published page (AGL-3362).\n *\n * ## Why the check sits where a page is COMPOSED, not where it is published\n *\n * A publish is a browser write. The besigner toolbar, the versions panel,\n * the screen details page, page-from-template, the layout and component\n * besigners and the form besigner each move a pointer (`versionId`, the\n * host's `screens` map, a component's own `nodes`) straight from the\n * client SDK; the scheduled-publish beat moves it from the server; an\n * experiment serves a version no pointer names; and an author may rewrite\n * the LIVE version document itself without moving any pointer at all. A\n * check on any one of those writes is a check the next one walks around.\n *\n * They all meet in one place: `composeScreenNodes` (`@aglyn/tenant-runtime`),\n * which every published render, the password unlock, the collection and\n * product templates and every experiment variant go through, and which\n * returns the page exactly as a visitor will receive it — the screen, its\n * layout chrome, its grafted components and its forms. So the screen is read\n * there, and a held page is one that is never composed for a visitor. For a\n * visitor, \"publish\" is the first render after the pointer moved; this is\n * that moment.\n *\n * ## What a hold does\n *\n * - The version is not served. The last version this page served clean\n *   ({@link servedPageVersion}) is composed instead — screened again, since\n *   a version document can be edited in place — and if there is none, or it\n *   holds too, the page is not found. A first publish that holds therefore\n *   serves nothing.\n * - One review row per (page, signal set) lands in the abuse queue at\n *   `/admin/abuse-reports`, the same `phishing` row a held email files\n *   (`fileOutboundHold`), with `heldSend.kind: 'page'`, the page's URL and\n *   the held version. Staff dismiss it to RELEASE (the admin route drops the\n *   site's cache and the next render serves it) or mark it actioned to\n *   REJECT (it stays unserved; any later version carrying the same signals\n *   is refused without a new row).\n * - A hold from a workspace in its first fortnight also asks for an\n *   automatic `security` hold on the workspace, the site and the publishing\n *   account (`page-security-hold.ts`, AGL-3450), which the console places.\n * - Keyed on the SIGNALS, as the send seam's rows are: a composed page\n *   carries per-render values (dates, collection rows) that no content hash\n *   would survive, while what makes it phishing does not change between\n *   renders.\n *\n * ## Tiers\n *\n * `signalsThatHold`: a lookalike link or embed, an author-defined\n * credential field and a link to a host Google Web Risk lists\n * (`web-risk-link`, AGL-3451) hold for EVERY workspace; a brand's call to\n * action or lure, and a call to action that leaves the site beside a lure,\n * only for a workspace in its first fortnight. The workspace's documents are\n * read only when something was found, so a clean page costs no read for\n * this. The page's foreign hosts — and, in `'url'` mode (AGL-3459), its\n * links' addresses without their query strings — are looked up first,\n * against a cache (`web-risk.ts`), and noted beside the version it serves so\n * the daily re-check can look again: a harvester is often listed only after\n * it is published. A lookup that fails finds nothing, so it never holds a\n * page.\n *\n * Fails CLOSED, unlike the send path: a page the pure screen flagged whose\n * review cannot finish — the workspace read, the row write — is answered\n * `held`, and the composer serves its last clean version or nothing. The\n * answer is not remembered, so the next render reviews it again. Composition\n * itself reads the store, so an outage here is an outage on the render\n * already, and the only cost of not serving a page the screen flagged is a\n * false positive's wait; serving it is the phishing page this exists to\n * stop. A page the screen found nothing on never reaches this.\n *\n * ## Site redirects\n *\n * A redirect rule that sends a path off the site is a page whose one call to\n * action fires on arrival, so the redirects plugin asks\n * {@link reviewSiteRedirect} before it serves one. Same screen\n * (`screenSiteRedirect`), same tiers, same row and the same staff decision:\n * a held rule does not fire, and is filed as a `page` hold on its rule's\n * document. Its destination is looked up against the reputation list too\n * (AGL-3451), so a redirect to a listed site holds for every workspace.\n *=========================================*/\n\nimport { ABUSE_REPORT_COLLECTION } from '@aglyn/aglyn/app-utils/abuse-report'\nimport {\n  heldPageConsolePath,\n  heldPageDetails,\n  heldPageLabel,\n  heldPageVisitorSentence,\n  type HeldPageSubject,\n} from '@aglyn/shared-util-email/held-page'\nimport { screenHostedPage, screenSiteRedirect } from '@aglyn/shared-util-email/hosted-page-screen'\nimport {\n  lookalikeBrandForHost,\n  phishingScreenBrandLabel,\n  type PhishingScreenSignal,\n  describePhishingScreenSignals,\n  isYoungWorkspaceAge,\n  signalsThatHold,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport {\n  type ForeignReputationLinks,\n  foreignLinksForReputation,\n  webRiskSignals,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { boundedAwait } from '@aglyn/shared-util-http/bounded-await'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { describeHeldPage, type HostedPageContext } from './held-page-subject'\nimport { notifyRiskEvent, RISK_NOTICE_RENDER_DEADLINE_MS } from './risk-notice'\nimport { orgAgeDays } from './org-age'\nimport { requestPageSecurityHold } from './page-security-hold'\nimport { getHostDocAdmin, getOrgForHost } from './organizations'\nimport { lookupLinkReputation, platformReputationExclusions } from './web-risk'\nimport {\n  canonicalJson,\n  fileOutboundHold,\n  flaggedHostOf,\n  heldOutboundReference,\n  heldOutboundReviewId,\n  outboundContentHash,\n  type HeldOutboundSendState,\n  workspaceScreenIdentity,\n} from './outbound-send-review'\n\n/** Where the last version a page served clean is noted: a hint, re-screened before use. */\nexport const PAGE_REVIEW_SUBCOLLECTION = 'pageReviews'\n\nexport interface HostedPageReviewRequest {\n  hostId: string\n  screenId: string\n  versionId: string\n  /** The page as composed for a visitor. */\n  nodes: unknown\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n  /**\n   * What the composer knows about the page (AGL-3374): the screen document,\n   * the template route it is rendering, the variant, and a way to read the\n   * layouts and components composed into it. Read only when a row is filed,\n   * to name the page — never to decide whether it serves.\n   */\n  page?: HostedPageContext | null\n  /**\n   * Signals found about this page elsewhere, judged with the page's own\n   * (AGL-3451): the daily link re-check passes a link Web Risk has listed\n   * since the page went live, so the hold, its row and the young\n   * workspace's security hold all come from this one path.\n   */\n  extraSignals?: readonly PhishingScreenSignal[]\n}\n\nexport type HostedPageReviewOutcome =\n  | { outcome: 'serve' }\n  | { outcome: 'held' | 'rejected'; reviewId: string; reference: string }\n\n/** The review row's id for a page and the signals that held. */\nexport function pageReviewId(\n  hostId: string,\n  screenId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/screens/${screenId}`, outboundContentHash([key]))\n}\n\n/** How long this process trusts a page row's state — the send seam's minute. */\nconst PAGE_MEMO_TTL_MS = 60_000\nconst pageMemo = new Map<string, { state: HeldOutboundSendState; atMs: number }>()\n/** The version each page last served clean, as this process last wrote it. */\nconst servedMemo = new Map<string, string>()\n/** Lookalike hosts this process already flagged for an established page, and when. */\nconst flaggedMemo = new Map<string, number>()\nconst FLAGGED_MEMO_TTL_MS = 60 * 60_000\n/**\n * The foreign hosts each reviewed page version links to (AGL-3451), and the\n * addresses on them worth asking about (AGL-3459), for\n * {@link recordServedPageVersion} to note beside the version it served, which\n * is what the daily link re-check walks. Bounded: a process that reviews more\n * pages than this starts again.\n */\nconst reviewedForeignHosts = new Map<string, ForeignReputationLinks>()\nconst REVIEWED_FOREIGN_HOSTS_MAX = 10_000\n\n/** Test seam: forget what this process learned. */\nexport function resetHostedPageReviewMemoForTests(): void {\n  pageMemo.clear()\n  servedMemo.clear()\n  flaggedMemo.clear()\n  reviewedForeignHosts.clear()\n}\n\n/**\n * Every foreign host the page links to, the addresses on them worth asking\n * about, and the ones Google Web Risk lists (AGL-3451; addresses only in\n * `'url'` mode, AGL-3459). Foreign before the workspace is known: not the\n * platform's own, not a brand's own domain, not a common social link. The\n * addresses carry no query string or fragment. Never throws; a lookup that\n * failed lists nothing.\n */\nasync function pageLinkReputation(\n  linkUrls: readonly string[],\n): Promise<ForeignReputationLinks & { signals: PhishingScreenSignal[] }> {\n  // Runs before the review's fail-closed `try`, so it must not throw: an\n  // answer it cannot give is no listing, never a reason to hold.\n  try {\n    const foreign = foreignLinksForReputation(linkUrls, {\n      excludeDomains: platformReputationExclusions(),\n    })\n    if (!foreign.hosts.length) return { ...foreign, signals: [] }\n    const answer = await lookupLinkReputation(foreign.hosts, { urls: foreign.urls })\n    return { ...foreign, signals: webRiskSignals(answer.hits) }\n  } catch (error) {\n    console.warn('[page-review] link reputation could not be read — no listing assumed', error)\n    return { hosts: [], urls: [], signals: [] }\n  }\n}\n\n/** Is this host one of the workspace's own? */\nfunction isOwnHost(host: string, ownDomains: readonly (string | null | undefined)[] | undefined): boolean {\n  return (ownDomains ?? []).some((own) => {\n    const domain = String(own ?? '').trim().toLowerCase()\n    return Boolean(domain) && (host === domain || host.endsWith(`.${domain}`))\n  })\n}\n\n/**\n * The subject a row already stored, or a fresh description (AGL-3374). A row\n * that names its page is not described again, so the reads the description\n * may make are paid once per row, not once per render.\n */\nasync function subjectForRow(\n  reviewId: string,\n  describe: () => Promise<HeldPageSubject>,\n): Promise<HeldPageSubject> {\n  const stored = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection(ABUSE_REPORT_COLLECTION)\n    .doc(reviewId)\n    .get()\n    .then((row) => storedSubject(row.get('heldPage')))\n    .catch(() => null)\n  return stored ?? describe()\n}\n\n/** A row's stored subject, when it has one. */\nfunction storedSubject(heldPage: unknown): HeldPageSubject | null {\n  const subject = (heldPage as { subject?: HeldPageSubject } | null | undefined)?.subject\n  return subject && typeof subject === 'object' && subject.screenId ? subject : null\n}\n\n/** The row's first line, naming the page and where it was seen. */\nfunction pageHeadline(subject: HeldPageSubject, siteName: string): string {\n  return [`${heldPageLabel(subject)} of ${siteName}.`, ...heldPageDetails(subject)].join(' ')\n}\n\n/**\n * Screen one page as a visitor would receive it, and say whether it may be\n * served. See the module header.\n */\nexport async function reviewHostedPage(\n  request: HostedPageReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenHostedPage({ nodes: request.nodes })\n  // Every foreign host it points at, against the reputation list\n  // (AGL-3451): a harvester known to be bad anywhere holds however plain the\n  // page around it is. Strong, so it holds at any workspace age.\n  const reputation = await pageLinkReputation(found.linkUrls)\n  if (reviewedForeignHosts.size >= REVIEWED_FOREIGN_HOSTS_MAX) reviewedForeignHosts.clear()\n  reviewedForeignHosts.set(`${request.hostId}/${request.screenId}/${request.versionId}`, {\n    hosts: reputation.hosts,\n    urls: reputation.urls,\n  })\n  const listed = [...reputation.signals, ...(request.extraSignals ?? [])]\n  if (!found.signals.length && !listed.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    // Again, now knowing whose page it is: a brand in the workspace's own\n    // name or domain is its own, and a link to its own site is not away.\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenHostedPage({ nodes: request.nodes, ...identity })\n    // A listing of the workspace's own host is not a link away from it.\n    const screened = [\n      ...verdict.signals,\n      ...listed.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    // Every workspace is screened, however old: an established account can\n    // be compromised, and a compromised account publishing a lure is the\n    // same harm as a new one. What differs is what a hold may take DOWN.\n    // Holding content that is already live serves its last clean version or\n    // nothing, and on a real business's home page that is an outage the\n    // screen caused (aglyn.com, 2026-09-28, a page that had served clean\n    // until a rule changed). So for an established workspace:\n    //   - NEW content (a new version of a live page, or a page that has\n    //     never been live) holds, exactly as for a young workspace; the live\n    //     page keeps serving its last clean version, or the new page waits;\n    //   - content ALREADY LIVE keeps serving, and is flagged to staff as\n    //     urgent, who lock the site if it is impersonation.\n    if (!isYoungWorkspaceAge(ageDays)) {\n      const strong = signalsThatHold(screened, { ageDays })\n      if (!strong.length) return { outcome: 'serve' }\n      if (await isAlreadyLive(request.hostId, request.screenId, request.versionId, nowMs)) {\n        await flagLivePage({\n          hostId: request.hostId,\n          screenId: request.screenId,\n          versionId: request.versionId,\n          orgId,\n          host,\n          signals: strong,\n          nowMs,\n          page: request.page ?? null,\n          identity,\n        })\n        return { outcome: 'serve' }\n      }\n    }\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = pageReviewId(request.hostId, request.screenId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    // The page by its real name and route (AGL-3374): a template, a list,\n    // a variant, or a page whose flagged content lives in its layout.\n    const subject = await subjectForRow(reviewId, async () =>\n      describeHeldPage({\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        host,\n        page: request.page,\n        signals,\n        identity,\n        live: false,\n        previousVersionId: await servedPageVersion(request.hostId, request.screenId),\n      }),\n    )\n    const url = subject.entryUrl ?? subject.url\n    const flagged = flaggedHostOf(signals)\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const label = heldPageLabel(subject)\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/screens/${request.screenId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      extra: {\n        heldPage: { screenId: request.screenId, versionId: request.versionId, url, subject },\n      },\n      headline:\n        `Held ${pageHeadline(subject, siteName)} Version ${request.versionId}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. ${heldPageVisitorSentence(subject)}`,\n      alertTitle: 'Published page held for review — possible phishing',\n      alertBody: `${label.charAt(0).toUpperCase()}${label.slice(1)} was held before it went live.`,\n      // The owners' words for it, and where they fix it (AGL-3368, AGL-3374).\n      item: { label, path: heldPageConsolePath(subject, request.hostId) },\n      page: subject,\n      // The page itself is what was reported; the flagged host, when there\n      // is one, is named in the details and on `reportedHostname`.\n      url,\n      reportedHostname: flagged,\n    })\n    // A hold from a workspace in its first fortnight also holds the\n    // workspace, the site and the account that published it (AGL-3450).\n    if (state === 'held') {\n      await requestPageSecurityHold({\n        orgId: orgId ?? '',\n        org,\n        hostId: request.hostId,\n        screenId: request.screenId,\n        versionId: request.versionId,\n        reviewId,\n        reference,\n        signals,\n        ageDays,\n        pageLabel: label,\n        pageUrl: url,\n        siteName: typeof host?.['name'] === 'string' ? host['name'] : null,\n        nowMs,\n      })\n    }\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed: the screen has already found a signal on this page, and a\n    // review that could not finish has not cleared it. Not remembered, so\n    // the next render reviews it again.\n    console.error('[page-review] a flagged page could not be reviewed — holding it', error)\n    const reviewId = pageReviewId(request.hostId, request.screenId, [...found.signals, ...listed])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nexport interface SiteRedirectReviewRequest {\n  hostId: string\n  /** The rule's document id under `hosts/{hostId}/redirects`. */\n  ruleId: string\n  /** The path, or the pattern, the rule answers. */\n  source: string\n  /** Where it sends the visitor, after any `$n` substitution. */\n  destination: string\n  /** The host and org documents, when the caller already holds them. */\n  host?: Record<string, unknown> | null\n  org?: Record<string, unknown> | null\n  orgId?: string | null\n  nowMs?: number\n}\n\n/** The review row's id for a redirect rule and the signals that held. */\nexport function redirectReviewId(\n  hostId: string,\n  ruleId: string,\n  signals: readonly PhishingScreenSignal[],\n): string {\n  const key = signals\n    .map((signal) => canonicalJson(signal))\n    .sort()\n    .join('\\n')\n  return heldOutboundReviewId(`hosts/${hostId}/redirects/${ruleId}`, outboundContentHash([key]))\n}\n\n/**\n * Screen one redirect rule before it sends a visitor off the site\n * (AGL-3447), and say whether it may fire. See the module header.\n *\n * Every workspace is screened and the tiers decide, as for a page: a\n * destination that wears a brand holds for all of them, a lure path sent\n * off the site only for a workspace in its first fortnight. A held rule is\n * filed once per (rule, signal set) and decided by staff on that row:\n * dismissed, it fires; actioned, it never does with those signals.\n */\nexport async function reviewSiteRedirect(\n  request: SiteRedirectReviewRequest,\n): Promise<HostedPageReviewOutcome> {\n  const found = screenSiteRedirect({ source: request.source, destination: request.destination })\n  // Where it sends visitors, against the reputation list (AGL-3451): a\n  // listed destination holds for every workspace, as a listed link does.\n  const reputation = await pageLinkReputation(found.linkUrls)\n  if (!found.signals.length && !reputation.signals.length) return { outcome: 'serve' }\n\n  const nowMs = request.nowMs ?? Date.now()\n  try {\n    const [host, owner] = await Promise.all([\n      request.host !== undefined ? request.host : getHostDocAdmin(request.hostId),\n      request.org !== undefined\n        ? { orgId: request.orgId ?? null, org: request.org }\n        : getOrgForHost(request.hostId),\n    ])\n    const org = (owner?.org as Record<string, unknown> | null | undefined) ?? null\n    const orgId = owner?.orgId ?? null\n    const identity = workspaceScreenIdentity({ org, host })\n    const verdict = screenSiteRedirect({\n      source: request.source,\n      destination: request.destination,\n      ...identity,\n    })\n    const screened = [\n      ...verdict.signals,\n      ...reputation.signals.filter(\n        (signal) => !('host' in signal) || !isOwnHost(signal.host, identity.ownDomains),\n      ),\n    ]\n    const ageDays = orgAgeDays((org as { createdAt?: unknown } | null)?.createdAt, nowMs)\n    const signals = signalsThatHold(screened, { ageDays })\n    if (!signals.length) return { outcome: 'serve' }\n\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, signals)\n    const reference = heldOutboundReference(reviewId)\n    const memo = pageMemo.get(reviewId)\n    if (memo && nowMs - memo.atMs < PAGE_MEMO_TTL_MS) {\n      return memo.state === 'released'\n        ? { outcome: 'serve' }\n        : { outcome: memo.state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n    }\n    const source = request.source.slice(0, 200)\n    const destination = request.destination.slice(0, 500)\n    const label = `the redirect from ${source}`\n    const siteName =\n      typeof host?.['name'] === 'string' && host['name'] ? `\"${host['name']}\"` : 'a site'\n    const [subdomainHost, customDomain] = identity.ownDomains ?? []\n    const siteHost = customDomain || subdomainHost\n    const state = await fileOutboundHold({\n      reviewId,\n      heldSend: {\n        kind: 'page',\n        path: `hosts/${request.hostId}/redirects/${request.ruleId}`,\n        hostId: request.hostId,\n        orgId,\n        contentHash: outboundContentHash([signals]),\n        subject: label.slice(0, 300),\n        fromName: null,\n        signals,\n        state: 'held',\n        heldAtMs: nowMs,\n        ageDays,\n      },\n      headline:\n        `Held ${label} of ${siteName}, which sends visitors to ${destination}, from a ` +\n        `workspace ${ageDays ?? '?'} day(s) old. The rule does not fire until this is decided.`,\n      alertTitle: 'Site redirect held for review — possible phishing',\n      alertBody: `The redirect from ${source} was held before it sent anyone off the site.`,\n      // Where the owners fix it: the site's Redirects page.\n      item: { label, path: `/${request.hostId}/redirects` },\n      url: siteHost && source.startsWith('/') ? `https://${siteHost}${source}` : destination,\n      reportedHostname: flaggedHostOf(signals),\n    })\n    pageMemo.set(reviewId, { state, atMs: nowMs })\n    return state === 'released'\n      ? { outcome: 'serve' }\n      : { outcome: state === 'rejected' ? 'rejected' : 'held', reviewId, reference }\n  } catch (error) {\n    // Closed, as a page is: the screen found a signal and nothing cleared it.\n    console.error('[page-review] a flagged redirect could not be reviewed — holding it', error)\n    const reviewId = redirectReviewId(request.hostId, request.ruleId, [\n      ...found.signals,\n      ...reputation.signals,\n    ])\n    return { outcome: 'held', reviewId, reference: heldOutboundReference(reviewId) }\n  }\n}\n\nfunction pageReviewRef(hostId: string, screenId: string) {\n  return firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection(PAGE_REVIEW_SUBCOLLECTION)\n    .doc(screenId)\n}\n\n/**\n * Is this version of the page already what visitors receive? It is when it\n * is the version the page last served clean, or when the page has no record\n * at all and is not new: it went live before the screen existed. A page\n * created in the last {@link NEW_PAGE_DAYS} days with no record has never\n * been live, so holding it takes nothing down.\n */\nconst NEW_PAGE_DAYS = 7\nasync function isAlreadyLive(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n  nowMs: number,\n): Promise<boolean> {\n  const lastClean = await servedPageVersion(hostId, screenId)\n  if (lastClean) return lastClean === versionId\n  try {\n    const screen = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(hostId)\n      .collection('screens')\n      .doc(screenId)\n      .get()\n    const created = screen.get('createdAt') as { toMillis?: () => number } | number | undefined\n    const createdMs =\n      typeof created === 'number' ? created : typeof created?.toMillis === 'function' ? created.toMillis() : null\n    // No readable creation time: an old page, so live.\n    return createdMs === null || nowMs - createdMs >= NEW_PAGE_DAYS * 24 * 60 * 60 * 1000\n  } catch {\n    return true\n  }\n}\n\n/**\n * A page ALREADY LIVE carries a strong signal: file one urgent abuse row for\n * it (keyed on the page and its signals, so a busy page is one row) and, the\n * first time, tell staff and the owners through the `page-flagged` notice.\n * The page keeps serving; staff lock the site if it is impersonation or the\n * account looks compromised. Once per page and signal set per process.\n */\nasync function flagLivePage(input: {\n  hostId: string\n  screenId: string\n  versionId: string\n  orgId: string | null\n  host: Record<string, unknown> | null\n  signals: readonly PhishingScreenSignal[]\n  nowMs: number\n  page?: HostedPageContext | null\n  identity?: ReturnType<typeof workspaceScreenIdentity>\n}): Promise<void> {\n  const key = `${input.hostId}\\n${input.screenId}\\n${input.signals.map((signal) => canonicalJson(signal)).sort().join('\\n')}`\n  const at = flaggedMemo.get(key)\n  if (at !== undefined && input.nowMs - at < FLAGGED_MEMO_TTL_MS) return\n  flaggedMemo.set(key, input.nowMs)\n  try {\n    const reviewId = pageReviewId(input.hostId, `${input.screenId}/live`, input.signals)\n    const reference = heldOutboundReference(reviewId)\n    const evidence = describePhishingScreenSignals(input.signals).join(' ')\n    const flagged = flaggedHostOf(input.signals)\n    const ref = firebaseAdmin.app().firestore().collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const existing = await ref.get()\n    const first = !existing.exists\n    // Named once, when the row is new (AGL-3374).\n    const subject =\n      (existing.exists ? storedSubject(existing.get('heldPage')) : null) ??\n      (await describeHeldPage({\n        hostId: input.hostId,\n        screenId: input.screenId,\n        versionId: input.versionId,\n        host: input.host,\n        page: input.page,\n        signals: input.signals,\n        identity: input.identity ?? workspaceScreenIdentity({ host: input.host }),\n        live: true,\n        previousVersionId: null,\n      }))\n    const url = subject.entryUrl ?? subject.url\n    const siteName =\n      typeof input.host?.['name'] === 'string' && input.host['name']\n        ? `\"${input.host['name']}\"`\n        : 'a site'\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url,\n        reportedHostname: flagged,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          `LIVE: ${pageHeadline(subject, siteName)} It was flagged by the phishing screen and is still serving.`,\n          evidence,\n          'Lock the site if it is impersonation or the account looks compromised; dismiss this if the content is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        heldPage: { screenId: input.screenId, versionId: input.versionId, url, subject },\n        riskNotice: { kind: 'page-flagged' },\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (!first) return\n    // Inside the page's render: bounded, so a mail or webhook outage cannot\n    // hold the page (AGL-3565).\n    await boundedAwait(\n      notifyRiskEvent({\n        kind: 'page-flagged',\n        orgId: input.orgId,\n        hostId: input.hostId,\n        reviewId,\n        reference,\n        item: { label: heldPageLabel(subject), path: heldPageConsolePath(subject, input.hostId) },\n        page: subject,\n        staffEvidence: [...heldPageDetails(subject), evidence].join(' '),\n      }),\n      RISK_NOTICE_RENDER_DEADLINE_MS,\n      null,\n      'risk-notice.page-flagged',\n    )\n  } catch (error) {\n    console.error('[page-review] a live page could not be flagged', error)\n  }\n}\n\n/**\n * The version this page last served clean, or null. A HINT, not a\n * clearance: the caller composes and screens it again before serving it,\n * because a version document can be edited after it was served.\n */\nexport async function servedPageVersion(hostId: string, screenId: string): Promise<string | null> {\n  try {\n    const snapshot = await pageReviewRef(hostId, screenId).get()\n    const value = snapshot.get('servedVersionId')\n    return typeof value === 'string' && value ? value : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Note that this page served `versionId` clean. One read the first time a\n * process renders a page, a write only when the version moved; nothing\n * after that, however often the page is rendered.\n */\nexport async function recordServedPageVersion(\n  hostId: string,\n  screenId: string,\n  versionId: string,\n): Promise<void> {\n  const key = `${hostId}/${screenId}`\n  // The foreign hosts this version links to, and the addresses on them, as\n  // its review found them (AGL-3451, AGL-3459): noted beside it so the daily\n  // link re-check can walk them. An address carries no query string.\n  const foreign = reviewedForeignHosts.get(`${key}/${versionId}`)\n  const linksKey = foreign ? `${foreign.hosts.join(',')}|${foreign.urls.join(',')}` : ''\n  const memoValue = foreign ? `${versionId}|${linksKey}` : versionId\n  if (!versionId || servedMemo.get(key) === memoValue) return\n  try {\n    const ref = pageReviewRef(hostId, screenId)\n    const snapshot = await ref.get()\n    const versionMoved = snapshot.get('servedVersionId') !== versionId\n    const storedHosts = snapshot.get('foreignHosts')\n    const storedLinks = snapshot.get('foreignLinks')\n    const linksMoved =\n      foreign !== undefined &&\n      `${Array.isArray(storedHosts) ? storedHosts.join(',') : ''}|${\n        Array.isArray(storedLinks) ? storedLinks.join(',') : ''\n      }` !== linksKey\n    if (versionMoved || linksMoved) {\n      await ref.set(\n        {\n          ...(versionMoved ? { servedVersionId: versionId, servedAtMs: Date.now() } : {}),\n          ...(foreign\n            ? {\n                foreignHosts: foreign.hosts,\n                foreignHostCount: foreign.hosts.length,\n                foreignLinks: foreign.urls,\n              }\n            : {}),\n        },\n        { merge: true },\n      )\n    }\n    servedMemo.set(key, memoValue)\n  } catch (error) {\n    console.warn('[page-review] the served version could not be noted', error)\n  }\n}\n\n/**\n * A domain a workspace attached that wears a brand (AGL-3356, AGL-3362):\n * filed in the abuse queue as an urgent `phishing` row for staff, not\n * refused. Two kinds, one rule:\n *\n * - `site` — a custom domain a site is served on (the attach route);\n * - `sending` — a custom domain a workspace sends email as, when it is\n *   added and again when it verifies (`sending-domains.ts`);\n * - `link` — a link a merchant configured that a buyer or a server would\n *   follow: a product's paid download or video hotlink, a supplier's order\n *   webhook (AGL-3363). The link itself is refused where it is followed; this\n *   files it, and tells the site's managers once ({@link notifyLookalikeLink}).\n *\n * Not refused, because the domain is the merchant's own registration and\n * the platform cannot tell a brand's own agency attaching `paypal-promo.com`\n * from a kit — but a brand's lookalike on a site or in a `From:` line is\n * exactly what staff look at first. The site's pages are still screened as\n * they are served, and mail FROM a lookalike domain is held at the send seam\n * for every workspace. The test is the phishing screen's own lookalike rule\n * (`lookalikeBrandForHost`), the one that holds a link in an email. One row\n * per (owner, kind, domain), so a re-attach or a re-verify counts rather than\n * re-alerts.\n *\n * Never throws: the write it rides on has already happened.\n */\nexport async function flagLookalikeDomain(input: {\n  kind: 'site' | 'sending' | 'link'\n  hostId: string | null\n  orgId: string | null\n  domain: string\n  /** For a `link`: where it was configured, as staff read it. */\n  where?: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  const domain = String(input.domain ?? '').trim().toLowerCase()\n  const brand = lookalikeBrandForHost(domain)\n  if (!brand) return 'clean'\n  const label = phishingScreenBrandLabel(brand.id)\n  const sending = input.kind === 'sending'\n  const link = input.kind === 'link'\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const owner = sending\n      ? `orgs/${input.orgId ?? ''}/sendingDomains`\n      : link\n        ? `hosts/${input.hostId ?? ''}/links`\n        : `hosts/${input.hostId ?? ''}/cname`\n    const reviewId = heldOutboundReviewId(owner, domain)\n    const reference = heldOutboundReference(reviewId)\n    const ref = firestore.collection(ABUSE_REPORT_COLLECTION).doc(reviewId)\n    const first = !(await ref.get()).exists\n    await ref.set(\n      {\n        reference,\n        category: 'phishing',\n        severity: 'urgent',\n        source: 'outbound-screen',\n        url: `https://${domain}/`,\n        reportedHostname: domain,\n        hostId: input.hostId,\n        orgId: input.orgId,\n        details: [\n          sending\n            ? `A workspace added ${domain} as a domain to send email from.`\n            : link\n              ? `A site configured a link to ${domain} (${input.where ?? 'a commerce link'}).`\n              : `A site attached the custom domain ${domain}.`,\n          `${domain} wears the ${label} name but is not ${label}'s domain.`,\n          sending\n            ? 'Email from it is held at the send seam for every workspace. Mark this actioned ' +\n              'and lock the workspace if it is impersonation; dismiss it if the brand is theirs.'\n            : link\n              ? 'Nobody is sent to it: the link is refused wherever it is followed. Mark this ' +\n                'actioned and lock the site if it is impersonation.'\n              : 'Its pages are still screened as they are served. Mark this actioned ' +\n                'and lock the site if it is impersonation; dismiss it if the brand is theirs.',\n        ].join('\\n'),\n        reporterEmail: null,\n        reporterName: null,\n        dmca: null,\n        reportCount: FieldValue.increment(1),\n        updatedAt: FieldValue.serverTimestamp(),\n        ...(first ? { status: 'open', createdAt: FieldValue.serverTimestamp() } : {}),\n      },\n      { merge: true },\n    )\n    if (first && link) {\n      await notifyLookalikeLink({\n        hostId: input.hostId,\n        orgId: input.orgId,\n        domain,\n        label,\n        where: input.where ?? 'a commerce link',\n        reference,\n        reviewId,\n      })\n    } else if (first) {\n      // The owners hear that the domain is waiting on a routine review — not\n      // which name it resembles; staff get the brand and a link to the row.\n      await notifyRiskEvent({\n        kind: 'domain-flagged',\n        orgId: input.orgId,\n        hostId: input.hostId,\n        reviewId,\n        reference,\n        item: {\n          label: sending ? `the sending domain ${domain}` : `the custom domain ${domain}`,\n          // Emails → Sending, or the site's Domain settings.\n          path: sending ? '/org/emails/sending' : input.hostId ? `/${input.hostId}/admin/domain` : null,\n        },\n        staffEvidence:\n          `${sending ? 'Sending domain' : 'Custom domain'} ${domain} looks like ${label}.`,\n      })\n    }\n    return 'flagged'\n  } catch (error) {\n    console.error('[page-review] a lookalike domain could not be flagged', error)\n    return 'failed'\n  }\n}\n\n/**\n * Tell staff and the site's managers and the workspace's owners, once per\n * (site, domain), that a link the merchant configured was refused because it\n * wears another brand's name (AGL-3363), through the risk notice seam\n * (AGL-3368). The merchant reads the catalog's `link-blocked` words — what\n * was refused and how to fix it, never how the check works; staff get the\n * brand and a link to the row. Never throws.\n */\nexport async function notifyLookalikeLink(input: {\n  hostId: string | null\n  orgId?: string | null\n  domain: string\n  label: string\n  where: string\n  reference: string\n  reviewId?: string | null\n}): Promise<void> {\n  await notifyRiskEvent({\n    kind: 'link-blocked',\n    orgId: input.orgId ?? null,\n    hostId: input.hostId,\n    reviewId: input.reviewId ?? null,\n    reference: input.reference,\n    item: {\n      label: `${input.where} pointing to ${input.domain}`,\n      path: input.hostId ? `/${input.hostId}/products` : null,\n    },\n    staffEvidence:\n      `A site configured ${input.where} to ${input.domain}, which looks like ${input.label}. ` +\n      'It is refused wherever it is followed.',\n  }).catch(() => undefined)\n}\n\n/** A site's custom domain, through {@link flagLookalikeDomain}. */\nexport function flagLookalikeCustomDomain(input: {\n  hostId: string\n  orgId: string | null\n  domain: string\n}): Promise<'flagged' | 'clean' | 'failed'> {\n  return flagLookalikeDomain({ kind: 'site', ...input })\n}\n"],"names":["ABUSE_REPORT_COLLECTION","heldPageConsolePath","heldPageDetails","heldPageLabel","heldPageVisitorSentence","screenHostedPage","screenSiteRedirect","lookalikeBrandForHost","phishingScreenBrandLabel","describePhishingScreenSignals","isYoungWorkspaceAge","signalsThatHold","foreignLinksForReputation","webRiskSignals","boundedAwait","FieldValue","firebaseAdmin","describeHeldPage","notifyRiskEvent","RISK_NOTICE_RENDER_DEADLINE_MS","orgAgeDays","requestPageSecurityHold","getHostDocAdmin","getOrgForHost","lookupLinkReputation","platformReputationExclusions","canonicalJson","fileOutboundHold","flaggedHostOf","heldOutboundReference","heldOutboundReviewId","outboundContentHash","workspaceScreenIdentity","PAGE_REVIEW_SUBCOLLECTION","pageReviewId","hostId","screenId","signals","key","map","signal","sort","join","PAGE_MEMO_TTL_MS","pageMemo","Map","servedMemo","flaggedMemo","FLAGGED_MEMO_TTL_MS","reviewedForeignHosts","REVIEWED_FOREIGN_HOSTS_MAX","resetHostedPageReviewMemoForTests","clear","pageLinkReputation","linkUrls","foreign","excludeDomains","hosts","length","answer","urls","hits","error","console","warn","isOwnHost","host","ownDomains","some","own","domain","String","trim","toLowerCase","Boolean","endsWith","subjectForRow","reviewId","describe","stored","app","firestore","collection","doc","get","then","row","storedSubject","catch","heldPage","subject","pageHeadline","siteName","reviewHostedPage","request","found","nodes","reputation","size","set","versionId","listed","extraSignals","outcome","nowMs","Date","now","owner","Promise","all","undefined","org","orgId","identity","verdict","screened","filter","ageDays","createdAt","strong","isAlreadyLive","flagLivePage","page","reference","memo","atMs","state","live","previousVersionId","servedPageVersion","url","entryUrl","flagged","label","heldSend","kind","path","contentHash","slice","fromName","heldAtMs","extra","headline","alertTitle","alertBody","charAt","toUpperCase","item","reportedHostname","pageLabel","pageUrl","redirectReviewId","ruleId","reviewSiteRedirect","source","destination","subdomainHost","customDomain","siteHost","startsWith","pageReviewRef","NEW_PAGE_DAYS","lastClean","screen","created","createdMs","toMillis","input","at","existing","evidence","ref","first","exists","category","severity","details","reporterEmail","reporterName","dmca","riskNotice","reportCount","increment","updatedAt","serverTimestamp","status","merge","staffEvidence","snapshot","value","recordServedPageVersion","linksKey","memoValue","versionMoved","storedHosts","storedLinks","linksMoved","Array","isArray","servedVersionId","servedAtMs","foreignHosts","foreignHostCount","foreignLinks","flagLookalikeDomain","brand","id","sending","link","where","notifyLookalikeLink","flagLookalikeCustomDomain"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA8E2C,GAE3C,SAASA,uBAAuB,QAAQ,sCAAqC;AAC7E,SACEC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,QAElB,qCAAoC;AAC3C,SAASC,gBAAgB,EAAEC,kBAAkB,QAAQ,8CAA6C;AAClG,SACEC,qBAAqB,EACrBC,wBAAwB,EAExBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,eAAe,QACV,oDAAmD;AAC1D,SAEEC,yBAAyB,EACzBC,cAAc,QACT,2CAA0C;AACjD,SAASC,YAAY,QAAQ,wCAAuC;AACpE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,gBAAgB,QAAgC,yBAAqB;AAC9E,SAASC,eAAe,EAAEC,8BAA8B,QAAQ,mBAAe;AAC/E,SAASC,UAAU,QAAQ,eAAW;AACtC,SAASC,uBAAuB,QAAQ,0BAAsB;AAC9D,SAASC,eAAe,EAAEC,aAAa,QAAQ,qBAAiB;AAChE,SAASC,oBAAoB,EAAEC,4BAA4B,QAAQ,gBAAY;AAC/E,SACEC,aAAa,EACbC,gBAAgB,EAChBC,aAAa,EACbC,qBAAqB,EACrBC,oBAAoB,EACpBC,mBAAmB,EAEnBC,uBAAuB,QAClB,4BAAwB;AAE/B,yFAAyF,GACzF,OAAO,MAAMC,4BAA4B,cAAa;AAiCtD,8DAA8D,GAC9D,OAAO,SAASC,aACdC,MAAc,EACdC,QAAgB,EAChBC,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,SAAS,EAAEC,UAAU,EAAEL,oBAAoB;QAACO;KAAI;AAC9F;AAEA,8EAA8E,GAC9E,MAAMK,mBAAmB;AACzB,MAAMC,WAAW,IAAIC;AACrB,4EAA4E,GAC5E,MAAMC,aAAa,IAAID;AACvB,oFAAoF,GACpF,MAAME,cAAc,IAAIF;AACxB,MAAMG,sBAAsB,KAAK;AACjC;;;;;;CAMC,GACD,MAAMC,uBAAuB,IAAIJ;AACjC,MAAMK,6BAA6B;AAEnC,iDAAiD,GACjD,OAAO,SAASC;IACdP,SAASQ,KAAK;IACdN,WAAWM,KAAK;IAChBL,YAAYK,KAAK;IACjBH,qBAAqBG,KAAK;AAC5B;AAEA;;;;;;;CAOC,GACD,eAAeC,mBACbC,QAA2B;IAE3B,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI;QACF,MAAMC,UAAU3C,0BAA0B0C,UAAU;YAClDE,gBAAgB/B;QAClB;QACA,IAAI,CAAC8B,QAAQE,KAAK,CAACC,MAAM,EAAE,OAAO,aAAKH;YAASlB,SAAS,EAAE;;QAC3D,MAAMsB,SAAS,MAAMnC,qBAAqB+B,QAAQE,KAAK,EAAE;YAAEG,MAAML,QAAQK,IAAI;QAAC;QAC9E,OAAO,aAAKL;YAASlB,SAASxB,eAAe8C,OAAOE,IAAI;;IAC1D,EAAE,OAAOC,OAAO;QACdC,QAAQC,IAAI,CAAC,wEAAwEF;QACrF,OAAO;YAAEL,OAAO,EAAE;YAAEG,MAAM,EAAE;YAAEvB,SAAS,EAAE;QAAC;IAC5C;AACF;AAEA,6CAA6C,GAC7C,SAAS4B,UAAUC,IAAY,EAAEC,UAA8D;IAC7F,OAAO,CAACA,qBAAAA,aAAc,EAAE,EAAEC,IAAI,CAAC,CAACC;QAC9B,MAAMC,SAASC,OAAOF,cAAAA,MAAO,IAAIG,IAAI,GAAGC,WAAW;QACnD,OAAOC,QAAQJ,WAAYJ,CAAAA,SAASI,UAAUJ,KAAKS,QAAQ,CAAC,CAAC,CAAC,EAAEL,QAAQ,CAAA;IAC1E;AACF;AAEA;;;;CAIC,GACD,eAAeM,cACbC,QAAgB,EAChBC,QAAwC;IAExC,MAAMC,SAAS,MAAM/D,cAClBgE,GAAG,GACHC,SAAS,GACTC,UAAU,CAAClF,yBACXmF,GAAG,CAACN,UACJO,GAAG,GACHC,IAAI,CAAC,CAACC,MAAQC,cAAcD,IAAIF,GAAG,CAAC,cACpCI,KAAK,CAAC,IAAM;IACf,OAAOT,iBAAAA,SAAUD;AACnB;AAEA,6CAA6C,GAC7C,SAASS,cAAcE,QAAiB;IACtC,MAAMC,UAAWD,4BAAD,AAACA,SAA+DC,OAAO;IACvF,OAAOA,WAAW,OAAOA,YAAY,YAAYA,QAAQtD,QAAQ,GAAGsD,UAAU;AAChF;AAEA,iEAAiE,GACjE,SAASC,aAAaD,OAAwB,EAAEE,QAAgB;IAC9D,OAAO;QAAC,GAAGzF,cAAcuF,SAAS,IAAI,EAAEE,SAAS,CAAC,CAAC;WAAK1F,gBAAgBwF;KAAS,CAAChD,IAAI,CAAC;AACzF;AAEA;;;CAGC,GACD,OAAO,eAAemD,iBACpBC,OAAgC;QAYWA,uBAG7BA;IAbd,MAAMC,QAAQ1F,iBAAiB;QAAE2F,OAAOF,QAAQE,KAAK;IAAC;IACtD,+DAA+D;IAC/D,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAMC,aAAa,MAAM5C,mBAAmB0C,MAAMzC,QAAQ;IAC1D,IAAIL,qBAAqBiD,IAAI,IAAIhD,4BAA4BD,qBAAqBG,KAAK;IACvFH,qBAAqBkD,GAAG,CAAC,GAAGL,QAAQ3D,MAAM,CAAC,CAAC,EAAE2D,QAAQ1D,QAAQ,CAAC,CAAC,EAAE0D,QAAQM,SAAS,EAAE,EAAE;QACrF3C,OAAOwC,WAAWxC,KAAK;QACvBG,MAAMqC,WAAWrC,IAAI;IACvB;IACA,MAAMyC,SAAS;WAAIJ,WAAW5D,OAAO;YAAMyD,wBAAAA,QAAQQ,YAAY,YAApBR,wBAAwB,EAAE;KAAE;IACvE,IAAI,CAACC,MAAM1D,OAAO,CAACqB,MAAM,IAAI,CAAC2C,OAAO3C,MAAM,EAAE,OAAO;QAAE6C,SAAS;IAAQ;IAEvE,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAyEHJ;QA5EZ,MAAM,CAACxB,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG5C,gBAAgBwE,QAAQ3D,MAAM;YAC1E2D,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDxF,cAAcuE,QAAQ3D,MAAM;SACjC;QACD,MAAM4E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,sEAAsE;QACtE,qEAAqE;QACrE,MAAMC,WAAWjF,wBAAwB;YAAE+E;YAAK7C;QAAK;QACrD,MAAMgD,UAAU7G,iBAAiB;YAAE2F,OAAOF,QAAQE,KAAK;WAAKiB;QAC5D,oEAAoE;QACpE,MAAME,WAAW;eACZD,QAAQ7E,OAAO;eACfgE,OAAOe,MAAM,CACd,CAAC5E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACyB,UAAUzB,OAAO0B,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAUjG,WAAY2F,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,0DAA0D;QAC1D,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAAC9F,oBAAoB2G,UAAU;YACjC,MAAME,SAAS5G,gBAAgBwG,UAAU;gBAAEE;YAAQ;YACnD,IAAI,CAACE,OAAO7D,MAAM,EAAE,OAAO;gBAAE6C,SAAS;YAAQ;YAC9C,IAAI,MAAMiB,cAAc1B,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ,EAAE0D,QAAQM,SAAS,EAAEI,QAAQ;oBAS3EV;gBARR,MAAM2B,aAAa;oBACjBtF,QAAQ2D,QAAQ3D,MAAM;oBACtBC,UAAU0D,QAAQ1D,QAAQ;oBAC1BgE,WAAWN,QAAQM,SAAS;oBAC5BY;oBACA9C;oBACA7B,SAASkF;oBACTf;oBACAkB,IAAI,GAAE5B,gBAAAA,QAAQ4B,IAAI,YAAZ5B,gBAAgB;oBACtBmB;gBACF;gBACA,OAAO;oBAAEV,SAAS;gBAAQ;YAC5B;QACF;QACA,MAAMlE,UAAU1B,gBAAgBwG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAChF,QAAQqB,MAAM,EAAE,OAAO;YAAE6C,SAAS;QAAQ;QAE/C,MAAM1B,WAAW3C,aAAa4D,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ,EAAEC;QAChE,MAAMsF,YAAY9F,sBAAsBgD;QACxC,MAAM+C,OAAOhF,SAASwC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGlF,kBAAkB;YAChD,OAAOiF,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,sEAAsE;QACtE,kEAAkE;QAClE,MAAMjC,UAAU,MAAMd,cAAcC,UAAU,UAC5C5D,iBAAiB;gBACfkB,QAAQ2D,QAAQ3D,MAAM;gBACtBC,UAAU0D,QAAQ1D,QAAQ;gBAC1BgE,WAAWN,QAAQM,SAAS;gBAC5BlC;gBACAwD,MAAM5B,QAAQ4B,IAAI;gBAClBrF;gBACA4E;gBACAc,MAAM;gBACNC,mBAAmB,MAAMC,kBAAkBnC,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ;YAC7E;QAEF,MAAM8F,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAME,UAAUxG,cAAcS;QAC9B,MAAMuD,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAMmE,QAAQlI,cAAcuF;QAC5B,MAAMoC,QAAQ,MAAMnG,iBAAiB;YACnCkD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQ3D,MAAM,CAAC,SAAS,EAAE2D,QAAQ1D,QAAQ,EAAE;gBAC3DD,QAAQ2D,QAAQ3D,MAAM;gBACtB6E;gBACAyB,aAAa1G,oBAAoB;oBAACM;iBAAQ;gBAC1CqD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVtG;gBACAyF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAwB,OAAO;gBACLpD,UAAU;oBAAErD,UAAU0D,QAAQ1D,QAAQ;oBAAEgE,WAAWN,QAAQM,SAAS;oBAAE8B;oBAAKxC;gBAAQ;YACrF;YACAoD,UACE,CAAC,KAAK,EAAEnD,aAAaD,SAASE,UAAU,SAAS,EAAEE,QAAQM,SAAS,CAAC,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEiB,kBAAAA,UAAW,IAAI,aAAa,EAAEjH,wBAAwBsF,UAAU;YAC/EqD,YAAY;YACZC,WAAW,GAAGX,MAAMY,MAAM,CAAC,GAAGC,WAAW,KAAKb,MAAMK,KAAK,CAAC,GAAG,8BAA8B,CAAC;YAC5F,wEAAwE;YACxES,MAAM;gBAAEd;gBAAOG,MAAMvI,oBAAoByF,SAASI,QAAQ3D,MAAM;YAAE;YAClEuF,MAAMhC;YACN,qEAAqE;YACrE,6DAA6D;YAC7DwC;YACAkB,kBAAkBhB;QACpB;QACA,gEAAgE;QAChE,oEAAoE;QACpE,IAAIN,UAAU,QAAQ;YACpB,MAAMzG,wBAAwB;gBAC5B2F,KAAK,EAAEA,gBAAAA,QAAS;gBAChBD;gBACA5E,QAAQ2D,QAAQ3D,MAAM;gBACtBC,UAAU0D,QAAQ1D,QAAQ;gBAC1BgE,WAAWN,QAAQM,SAAS;gBAC5BvB;gBACA8C;gBACAtF;gBACAgF;gBACAgC,WAAWhB;gBACXiB,SAASpB;gBACTtC,UAAU,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,WAAWA,IAAI,CAAC,OAAO,GAAG;gBAC9DsC;YACF;QACF;QACA5D,SAASuD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpCC,QAAQD,KAAK,CAAC,mEAAmEA;QACjF,MAAMe,WAAW3C,aAAa4D,QAAQ3D,MAAM,EAAE2D,QAAQ1D,QAAQ,EAAE;eAAI2D,MAAM1D,OAAO;eAAKgE;SAAO;QAC7F,OAAO;YAAEE,SAAS;YAAQ1B;YAAU8C,WAAW9F,sBAAsBgD;QAAU;IACjF;AACF;AAiBA,uEAAuE,GACvE,OAAO,SAAS0E,iBACdpH,MAAc,EACdqH,MAAc,EACdnH,OAAwC;IAExC,MAAMC,MAAMD,QACTE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAC9BC,IAAI,GACJC,IAAI,CAAC;IACR,OAAOZ,qBAAqB,CAAC,MAAM,EAAEK,OAAO,WAAW,EAAEqH,QAAQ,EAAEzH,oBAAoB;QAACO;KAAI;AAC9F;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAemH,mBACpB3D,OAAkC;QAQpBA;IANd,MAAMC,QAAQzF,mBAAmB;QAAEoJ,QAAQ5D,QAAQ4D,MAAM;QAAEC,aAAa7D,QAAQ6D,WAAW;IAAC;IAC5F,qEAAqE;IACrE,uEAAuE;IACvE,MAAM1D,aAAa,MAAM5C,mBAAmB0C,MAAMzC,QAAQ;IAC1D,IAAI,CAACyC,MAAM1D,OAAO,CAACqB,MAAM,IAAI,CAACuC,WAAW5D,OAAO,CAACqB,MAAM,EAAE,OAAO;QAAE6C,SAAS;IAAQ;IAEnF,MAAMC,SAAQV,iBAAAA,QAAQU,KAAK,YAAbV,iBAAiBW,KAAKC,GAAG;IACvC,IAAI;YAIaZ,6BAkCuBmB;QArCtC,MAAM,CAAC/C,MAAMyC,MAAM,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtCf,QAAQ5B,IAAI,KAAK4C,YAAYhB,QAAQ5B,IAAI,GAAG5C,gBAAgBwE,QAAQ3D,MAAM;YAC1E2D,QAAQiB,GAAG,KAAKD,YACZ;gBAAEE,KAAK,GAAElB,iBAAAA,QAAQkB,KAAK,YAAblB,iBAAiB;gBAAMiB,KAAKjB,QAAQiB,GAAG;YAAC,IACjDxF,cAAcuE,QAAQ3D,MAAM;SACjC;QACD,MAAM4E,cAAOJ,yBAAAA,MAAOI,GAAG,mBAAmD;QAC1E,MAAMC,iBAAQL,yBAAAA,MAAOK,KAAK,oBAAI;QAC9B,MAAMC,WAAWjF,wBAAwB;YAAE+E;YAAK7C;QAAK;QACrD,MAAMgD,UAAU5G,mBAAmB;YACjCoJ,QAAQ5D,QAAQ4D,MAAM;YACtBC,aAAa7D,QAAQ6D,WAAW;WAC7B1C;QAEL,MAAME,WAAW;eACZD,QAAQ7E,OAAO;eACf4D,WAAW5D,OAAO,CAAC+E,MAAM,CAC1B,CAAC5E,SAAW,CAAE,CAAA,UAAUA,MAAK,KAAM,CAACyB,UAAUzB,OAAO0B,IAAI,EAAE+C,SAAS9C,UAAU;SAEjF;QACD,MAAMkD,UAAUjG,WAAY2F,uBAAD,AAACA,IAAwCO,SAAS,EAAEd;QAC/E,MAAMnE,UAAU1B,gBAAgBwG,UAAU;YAAEE;QAAQ;QACpD,IAAI,CAAChF,QAAQqB,MAAM,EAAE,OAAO;YAAE6C,SAAS;QAAQ;QAE/C,MAAM1B,WAAW0E,iBAAiBzD,QAAQ3D,MAAM,EAAE2D,QAAQ0D,MAAM,EAAEnH;QAClE,MAAMsF,YAAY9F,sBAAsBgD;QACxC,MAAM+C,OAAOhF,SAASwC,GAAG,CAACP;QAC1B,IAAI+C,QAAQpB,QAAQoB,KAAKC,IAAI,GAAGlF,kBAAkB;YAChD,OAAOiF,KAAKE,KAAK,KAAK,aAClB;gBAAEvB,SAAS;YAAQ,IACnB;gBAAEA,SAASqB,KAAKE,KAAK,KAAK,aAAa,aAAa;gBAAQjD;gBAAU8C;YAAU;QACtF;QACA,MAAM+B,SAAS5D,QAAQ4D,MAAM,CAAChB,KAAK,CAAC,GAAG;QACvC,MAAMiB,cAAc7D,QAAQ6D,WAAW,CAACjB,KAAK,CAAC,GAAG;QACjD,MAAML,QAAQ,CAAC,kBAAkB,EAAEqB,QAAQ;QAC3C,MAAM9D,WACJ,QAAO1B,wBAAAA,IAAM,CAAC,OAAO,MAAK,YAAYA,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAEA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC7E,MAAM,CAAC0F,eAAeC,aAAa,IAAG5C,uBAAAA,SAAS9C,UAAU,YAAnB8C,uBAAuB,EAAE;QAC/D,MAAM6C,WAAWD,gBAAgBD;QACjC,MAAM9B,QAAQ,MAAMnG,iBAAiB;YACnCkD;YACAyD,UAAU;gBACRC,MAAM;gBACNC,MAAM,CAAC,MAAM,EAAE1C,QAAQ3D,MAAM,CAAC,WAAW,EAAE2D,QAAQ0D,MAAM,EAAE;gBAC3DrH,QAAQ2D,QAAQ3D,MAAM;gBACtB6E;gBACAyB,aAAa1G,oBAAoB;oBAACM;iBAAQ;gBAC1CqD,SAAS2C,MAAMK,KAAK,CAAC,GAAG;gBACxBC,UAAU;gBACVtG;gBACAyF,OAAO;gBACPc,UAAUpC;gBACVa;YACF;YACAyB,UACE,CAAC,KAAK,EAAET,MAAM,IAAI,EAAEzC,SAAS,0BAA0B,EAAE+D,YAAY,SAAS,CAAC,GAC/E,CAAC,UAAU,EAAEtC,kBAAAA,UAAW,IAAI,0DAA0D,CAAC;YACzF0B,YAAY;YACZC,WAAW,CAAC,kBAAkB,EAAEU,OAAO,6CAA6C,CAAC;YACrF,sDAAsD;YACtDP,MAAM;gBAAEd;gBAAOG,MAAM,CAAC,CAAC,EAAE1C,QAAQ3D,MAAM,CAAC,UAAU,CAAC;YAAC;YACpD+F,KAAK4B,YAAYJ,OAAOK,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAED,WAAWJ,QAAQ,GAAGC;YAC3EP,kBAAkBxH,cAAcS;QAClC;QACAO,SAASuD,GAAG,CAACtB,UAAU;YAAEiD;YAAOD,MAAMrB;QAAM;QAC5C,OAAOsB,UAAU,aACb;YAAEvB,SAAS;QAAQ,IACnB;YAAEA,SAASuB,UAAU,aAAa,aAAa;YAAQjD;YAAU8C;QAAU;IACjF,EAAE,OAAO7D,OAAO;QACd,0EAA0E;QAC1EC,QAAQD,KAAK,CAAC,uEAAuEA;QACrF,MAAMe,WAAW0E,iBAAiBzD,QAAQ3D,MAAM,EAAE2D,QAAQ0D,MAAM,EAAE;eAC7DzD,MAAM1D,OAAO;eACb4D,WAAW5D,OAAO;SACtB;QACD,OAAO;YAAEkE,SAAS;YAAQ1B;YAAU8C,WAAW9F,sBAAsBgD;QAAU;IACjF;AACF;AAEA,SAASmF,cAAc7H,MAAc,EAAEC,QAAgB;IACrD,OAAOpB,cACJgE,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAChD,QACJ+C,UAAU,CAACjD,2BACXkD,GAAG,CAAC/C;AACT;AAEA;;;;;;CAMC,GACD,MAAM6H,gBAAgB;AACtB,eAAezC,cACbrF,MAAc,EACdC,QAAgB,EAChBgE,SAAiB,EACjBI,KAAa;IAEb,MAAM0D,YAAY,MAAMjC,kBAAkB9F,QAAQC;IAClD,IAAI8H,WAAW,OAAOA,cAAc9D;IACpC,IAAI;QACF,MAAM+D,SAAS,MAAMnJ,cAClBgE,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAAChD,QACJ+C,UAAU,CAAC,WACXC,GAAG,CAAC/C,UACJgD,GAAG;QACN,MAAMgF,UAAUD,OAAO/E,GAAG,CAAC;QAC3B,MAAMiF,YACJ,OAAOD,YAAY,WAAWA,UAAU,QAAOA,2BAAAA,QAASE,QAAQ,MAAK,aAAaF,QAAQE,QAAQ,KAAK;QACzG,mDAAmD;QACnD,OAAOD,cAAc,QAAQ7D,QAAQ6D,aAAaJ,gBAAgB,KAAK,KAAK,KAAK;IACnF,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,eAAexC,aAAa8C,KAU3B;IACC,MAAMjI,MAAM,GAAGiI,MAAMpI,MAAM,CAAC,EAAE,EAAEoI,MAAMnI,QAAQ,CAAC,EAAE,EAAEmI,MAAMlI,OAAO,CAACE,GAAG,CAAC,CAACC,SAAWd,cAAcc,SAASC,IAAI,GAAGC,IAAI,CAAC,OAAO;IAC3H,MAAM8H,KAAKzH,YAAYqC,GAAG,CAAC9C;IAC3B,IAAIkI,OAAO1D,aAAayD,MAAM/D,KAAK,GAAGgE,KAAKxH,qBAAqB;IAChED,YAAYoD,GAAG,CAAC7D,KAAKiI,MAAM/D,KAAK;IAChC,IAAI;YAUCiE,MAQWF,iBAIF7E;YAEH6E;QAvBT,MAAM1F,WAAW3C,aAAaqI,MAAMpI,MAAM,EAAE,GAAGoI,MAAMnI,QAAQ,CAAC,KAAK,CAAC,EAAEmI,MAAMlI,OAAO;QACnF,MAAMsF,YAAY9F,sBAAsBgD;QACxC,MAAM6F,WAAWjK,8BAA8B8J,MAAMlI,OAAO,EAAEK,IAAI,CAAC;QACnE,MAAM0F,UAAUxG,cAAc2I,MAAMlI,OAAO;QAC3C,MAAMsI,MAAM3J,cAAcgE,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAClF,yBAAyBmF,GAAG,CAACN;QACpF,MAAM4F,WAAW,MAAME,IAAIvF,GAAG;QAC9B,MAAMwF,QAAQ,CAACH,SAASI,MAAM;QAC9B,8CAA8C;QAC9C,MAAMnF,WACH+E,OAAAA,SAASI,MAAM,GAAGtF,cAAckF,SAASrF,GAAG,CAAC,eAAe,gBAA5DqF,OACA,MAAMxJ,iBAAiB;YACtBkB,QAAQoI,MAAMpI,MAAM;YACpBC,UAAUmI,MAAMnI,QAAQ;YACxBgE,WAAWmE,MAAMnE,SAAS;YAC1BlC,MAAMqG,MAAMrG,IAAI;YAChBwD,MAAM6C,MAAM7C,IAAI;YAChBrF,SAASkI,MAAMlI,OAAO;YACtB4E,QAAQ,GAAEsD,kBAAAA,MAAMtD,QAAQ,YAAdsD,kBAAkBvI,wBAAwB;gBAAEkC,MAAMqG,MAAMrG,IAAI;YAAC;YACvE6D,MAAM;YACNC,mBAAmB;QACrB;QACF,MAAME,OAAMxC,oBAAAA,QAAQyC,QAAQ,YAAhBzC,oBAAoBA,QAAQwC,GAAG;QAC3C,MAAMtC,WACJ,SAAO2E,cAAAA,MAAMrG,IAAI,qBAAVqG,WAAY,CAAC,OAAO,MAAK,YAAYA,MAAMrG,IAAI,CAAC,OAAO,GAC1D,CAAC,CAAC,EAAEqG,MAAMrG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GACzB;QACN,MAAMyG,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB;YACAkB,kBAAkBhB;YAClBjG,QAAQoI,MAAMpI,MAAM;YACpB6E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP,CAAC,MAAM,EAAErF,aAAaD,SAASE,UAAU,4DAA4D,CAAC;gBACtG8E;gBACA;aACD,CAAChI,IAAI,CAAC;YACPuI,eAAe;YACfC,cAAc;YACdC,MAAM;YACN1F,UAAU;gBAAErD,UAAUmI,MAAMnI,QAAQ;gBAAEgE,WAAWmE,MAAMnE,SAAS;gBAAE8B;gBAAKxC;YAAQ;YAC/E0F,YAAY;gBAAE7C,MAAM;YAAe;YACnC8C,aAAatK,WAAWuK,SAAS,CAAC;YAClCC,WAAWxK,WAAWyK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWvG,WAAWyK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAI,CAACd,OAAO;QACZ,wEAAwE;QACxE,4BAA4B;QAC5B,MAAM9J,aACJI,gBAAgB;YACdqH,MAAM;YACNvB,OAAOuD,MAAMvD,KAAK;YAClB7E,QAAQoI,MAAMpI,MAAM;YACpB0C;YACA8C;YACAwB,MAAM;gBAAEd,OAAOlI,cAAcuF;gBAAU8C,MAAMvI,oBAAoByF,SAAS6E,MAAMpI,MAAM;YAAE;YACxFuF,MAAMhC;YACNiG,eAAe;mBAAIzL,gBAAgBwF;gBAAUgF;aAAS,CAAChI,IAAI,CAAC;QAC9D,IACAvB,gCACA,MACA;IAEJ,EAAE,OAAO2C,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;IAClE;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAemE,kBAAkB9F,MAAc,EAAEC,QAAgB;IACtE,IAAI;QACF,MAAMwJ,WAAW,MAAM5B,cAAc7H,QAAQC,UAAUgD,GAAG;QAC1D,MAAMyG,QAAQD,SAASxG,GAAG,CAAC;QAC3B,OAAO,OAAOyG,UAAU,YAAYA,QAAQA,QAAQ;IACtD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBACpB3J,MAAc,EACdC,QAAgB,EAChBgE,SAAiB;IAEjB,MAAM9D,MAAM,GAAGH,OAAO,CAAC,EAAEC,UAAU;IACnC,yEAAyE;IACzE,2EAA2E;IAC3E,mEAAmE;IACnE,MAAMmB,UAAUN,qBAAqBmC,GAAG,CAAC,GAAG9C,IAAI,CAAC,EAAE8D,WAAW;IAC9D,MAAM2F,WAAWxI,UAAU,GAAGA,QAAQE,KAAK,CAACf,IAAI,CAAC,KAAK,CAAC,EAAEa,QAAQK,IAAI,CAAClB,IAAI,CAAC,MAAM,GAAG;IACpF,MAAMsJ,YAAYzI,UAAU,GAAG6C,UAAU,CAAC,EAAE2F,UAAU,GAAG3F;IACzD,IAAI,CAACA,aAAatD,WAAWsC,GAAG,CAAC9C,SAAS0J,WAAW;IACrD,IAAI;QACF,MAAMrB,MAAMX,cAAc7H,QAAQC;QAClC,MAAMwJ,WAAW,MAAMjB,IAAIvF,GAAG;QAC9B,MAAM6G,eAAeL,SAASxG,GAAG,CAAC,uBAAuBgB;QACzD,MAAM8F,cAAcN,SAASxG,GAAG,CAAC;QACjC,MAAM+G,cAAcP,SAASxG,GAAG,CAAC;QACjC,MAAMgH,aACJ7I,YAAYuD,aACZ,GAAGuF,MAAMC,OAAO,CAACJ,eAAeA,YAAYxJ,IAAI,CAAC,OAAO,GAAG,CAAC,EAC1D2J,MAAMC,OAAO,CAACH,eAAeA,YAAYzJ,IAAI,CAAC,OAAO,IACrD,KAAKqJ;QACT,IAAIE,gBAAgBG,YAAY;YAC9B,MAAMzB,IAAIxE,GAAG,CACX,aACM8F,eAAe;gBAAEM,iBAAiBnG;gBAAWoG,YAAY/F,KAAKC,GAAG;YAAG,IAAI,CAAC,GACzEnD,UACA;gBACEkJ,cAAclJ,QAAQE,KAAK;gBAC3BiJ,kBAAkBnJ,QAAQE,KAAK,CAACC,MAAM;gBACtCiJ,cAAcpJ,QAAQK,IAAI;YAC5B,IACA,CAAC,IAEP;gBAAE8H,OAAO;YAAK;QAElB;QACA5I,WAAWqD,GAAG,CAAC7D,KAAK0J;IACtB,EAAE,OAAOlI,OAAO;QACdC,QAAQC,IAAI,CAAC,uDAAuDF;IACtE;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,eAAe8I,oBAAoBrC,KAOzC;QACuBA;IAAtB,MAAMjG,SAASC,QAAOgG,gBAAAA,MAAMjG,MAAM,YAAZiG,gBAAgB,IAAI/F,IAAI,GAAGC,WAAW;IAC5D,MAAMoI,QAAQtM,sBAAsB+D;IACpC,IAAI,CAACuI,OAAO,OAAO;IACnB,MAAMxE,QAAQ7H,yBAAyBqM,MAAMC,EAAE;IAC/C,MAAMC,UAAUxC,MAAMhC,IAAI,KAAK;IAC/B,MAAMyE,OAAOzC,MAAMhC,IAAI,KAAK;IAC5B,IAAI;YAGUgC,cAEGA,eACAA,gBAmBuCA;QAxBtD,MAAMtF,YAAYjE,cAAcgE,GAAG,GAAGC,SAAS;QAC/C,MAAM0B,QAAQoG,UACV,CAAC,KAAK,GAAExC,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe,GAAG,eAAe,CAAC,GAC1CyC,OACE,CAAC,MAAM,GAAEzC,gBAAAA,MAAMpI,MAAM,YAAZoI,gBAAgB,GAAG,MAAM,CAAC,GACnC,CAAC,MAAM,GAAEA,iBAAAA,MAAMpI,MAAM,YAAZoI,iBAAgB,GAAG,MAAM,CAAC;QACzC,MAAM1F,WAAW/C,qBAAqB6E,OAAOrC;QAC7C,MAAMqD,YAAY9F,sBAAsBgD;QACxC,MAAM8F,MAAM1F,UAAUC,UAAU,CAAClF,yBAAyBmF,GAAG,CAACN;QAC9D,MAAM+F,QAAQ,CAAC,AAAC,CAAA,MAAMD,IAAIvF,GAAG,EAAC,EAAGyF,MAAM;QACvC,MAAMF,IAAIxE,GAAG,CACX;YACEwB;YACAmD,UAAU;YACVC,UAAU;YACVrB,QAAQ;YACRxB,KAAK,CAAC,QAAQ,EAAE5D,OAAO,CAAC,CAAC;YACzB8E,kBAAkB9E;YAClBnC,QAAQoI,MAAMpI,MAAM;YACpB6E,OAAOuD,MAAMvD,KAAK;YAClBgE,SAAS;gBACP+B,UACI,CAAC,kBAAkB,EAAEzI,OAAO,gCAAgC,CAAC,GAC7D0I,OACE,CAAC,4BAA4B,EAAE1I,OAAO,EAAE,GAAEiG,eAAAA,MAAM0C,KAAK,YAAX1C,eAAe,kBAAkB,EAAE,CAAC,GAC9E,CAAC,kCAAkC,EAAEjG,OAAO,CAAC,CAAC;gBACpD,GAAGA,OAAO,WAAW,EAAE+D,MAAM,iBAAiB,EAAEA,MAAM,UAAU,CAAC;gBACjE0E,UACI,oFACA,sFACAC,OACE,kFACA,uDACA,yEACA;aACP,CAACtK,IAAI,CAAC;YACPuI,eAAe;YACfC,cAAc;YACdC,MAAM;YACNE,aAAatK,WAAWuK,SAAS,CAAC;YAClCC,WAAWxK,WAAWyK,eAAe;WACjCZ,QAAQ;YAAEa,QAAQ;YAAQnE,WAAWvG,WAAWyK,eAAe;QAAG,IAAI,CAAC,IAE7E;YAAEE,OAAO;QAAK;QAEhB,IAAId,SAASoC,MAAM;gBAMRzC;YALT,MAAM2C,oBAAoB;gBACxB/K,QAAQoI,MAAMpI,MAAM;gBACpB6E,OAAOuD,MAAMvD,KAAK;gBAClB1C;gBACA+D;gBACA4E,KAAK,GAAE1C,gBAAAA,MAAM0C,KAAK,YAAX1C,gBAAe;gBACtB5C;gBACA9C;YACF;QACF,OAAO,IAAI+F,OAAO;YAChB,uEAAuE;YACvE,sEAAsE;YACtE,MAAM1J,gBAAgB;gBACpBqH,MAAM;gBACNvB,OAAOuD,MAAMvD,KAAK;gBAClB7E,QAAQoI,MAAMpI,MAAM;gBACpB0C;gBACA8C;gBACAwB,MAAM;oBACJd,OAAO0E,UAAU,CAAC,mBAAmB,EAAEzI,QAAQ,GAAG,CAAC,kBAAkB,EAAEA,QAAQ;oBAC/E,mDAAmD;oBACnDkE,MAAMuE,UAAU,wBAAwBxC,MAAMpI,MAAM,GAAG,CAAC,CAAC,EAAEoI,MAAMpI,MAAM,CAAC,aAAa,CAAC,GAAG;gBAC3F;gBACAwJ,eACE,GAAGoB,UAAU,mBAAmB,gBAAgB,CAAC,EAAEzI,OAAO,YAAY,EAAE+D,MAAM,CAAC,CAAC;YACpF;QACF;QACA,OAAO;IACT,EAAE,OAAOvE,OAAO;QACdC,QAAQD,KAAK,CAAC,yDAAyDA;QACvE,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeoJ,oBAAoB3C,KAQzC;QAGUA,cAEGA;IAJZ,MAAMrJ,gBAAgB;QACpBqH,MAAM;QACNvB,KAAK,GAAEuD,eAAAA,MAAMvD,KAAK,YAAXuD,eAAe;QACtBpI,QAAQoI,MAAMpI,MAAM;QACpB0C,QAAQ,GAAE0F,kBAAAA,MAAM1F,QAAQ,YAAd0F,kBAAkB;QAC5B5C,WAAW4C,MAAM5C,SAAS;QAC1BwB,MAAM;YACJd,OAAO,GAAGkC,MAAM0C,KAAK,CAAC,aAAa,EAAE1C,MAAMjG,MAAM,EAAE;YACnDkE,MAAM+B,MAAMpI,MAAM,GAAG,CAAC,CAAC,EAAEoI,MAAMpI,MAAM,CAAC,SAAS,CAAC,GAAG;QACrD;QACAwJ,eACE,CAAC,kBAAkB,EAAEpB,MAAM0C,KAAK,CAAC,IAAI,EAAE1C,MAAMjG,MAAM,CAAC,mBAAmB,EAAEiG,MAAMlC,KAAK,CAAC,EAAE,CAAC,GACxF;IACJ,GAAG7C,KAAK,CAAC,IAAMsB;AACjB;AAEA,iEAAiE,GACjE,OAAO,SAASqG,0BAA0B5C,KAIzC;IACC,OAAOqC,oBAAoB;QAAErE,MAAM;OAAWgC;AAChD"}

package/src/lib/server/link-reputation-review.d.ts

@@ -22,9 +22,11 @@ export interface LivePageLinkRecheck {
     pages: number;
     /** Distinct foreign hosts looked up. */
     hosts: number;
-    /** Of those, how many Web Risk lists. */
+    /** Distinct addresses looked up on them — none unless the lookup is in `'url'` mode. */
+    addresses: number;
+    /** Of the hosts and addresses, how many Web Risk lists. */
     listed: number;
-    /** Hosts nobody could answer for: not evidence, looked up again next time. */
+    /** Hosts and addresses nobody could answer for: not evidence, looked up again next time. */
     unknown: number;
     /** Pages sent back through the review with a listed host. */
     reviewed: number;
@@ -32,6 +34,8 @@ export interface LivePageLinkRecheck {
     held: number;
     /** The sites a hold was placed on, whose cached pages need dropping. */
     heldHostIds: string[];
+    /** Addresses' stored answers deleted a day after they expired (first chunk of a walk only). */
+    reapedAddressVerdicts: number;
     nextCursor: string | null;
     done: boolean;
 }

package/src/lib/server/link-reputation-review.js

@@ -25,17 +25,20 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  *
  * So {@link recheckLivePageLinks} walks every live page's foreign hosts, as
  * the review noted them beside the version it served
- * (`pageReviews/{screenId}.foreignHosts`), looks them up again, and sends
- * each page with a newly listed host back through `reviewHostedPage` with the
- * listing as an extra signal — the same path, so it is held or flagged, its
- * row filed, and a young workspace's security hold requested (AGL-3450),
- * exactly as at render. The console's `/api/admin/web-risk-recheck` runs it
- * a chunk of sites at a time.
- *=========================================*/ import { MAX_REPUTATION_HOSTS_PER_LOOKUP, webRiskSignals } from "@aglyn/shared-util-email/link-reputation";
+ * (`pageReviews/{screenId}.foreignHosts`), looks them up again — and, in
+ * `'url'` mode (AGL-3459), the addresses on them noted beside the hosts
+ * (`foreignLinks`, never a query string) — and sends each page with a newly
+ * listed host or address back through `reviewHostedPage` with the listing as
+ * an extra signal — the same path, so it is held or flagged, its row filed,
+ * and a young workspace's security hold requested (AGL-3450), exactly as at
+ * render. The console's `/api/admin/web-risk-recheck` runs it a chunk of
+ * sites at a time; its first chunk of a walk also deletes the addresses'
+ * stored answers that expired a day ago.
+ *=========================================*/ import { MAX_REPUTATION_HOSTS_PER_LOOKUP, MAX_REPUTATION_URLS_PER_LOOKUP, normalizeReputationLink, webRiskSignals } from "@aglyn/shared-util-email/link-reputation";
 import { FieldPath } from "firebase-admin/firestore";
 import firebaseAdmin from "./firebase-admin.js";
 import { PAGE_REVIEW_SUBCOLLECTION, reviewHostedPage } from "./hosted-page-review.js";
-import { lookupHostReputation } from "./web-risk.js";
+import { lookupLinkReputation, reapExpiredWebRiskUrlVerdicts, webRiskLookupMode } from "./web-risk.js";
 /** Sites walked per chunk. */ export const LINK_RECHECK_SITES_PER_CHUNK = 200;
 /** Sites whose page notes are read at once. */ const SITE_READ_CONCURRENCY = 20;
 /** The budget of each group of hosts looked up within a chunk. */ const RECHECK_DEADLINE_MS = 15000;
@@ -65,12 +68,14 @@ import { lookupHostReputation } from "./web-risk.js";
             for (const review of reviews.docs){
                 const versionId = review.get('servedVersionId');
                 const hosts = review.get('foreignHosts');
+                const links = review.get('foreignLinks');
                 if (typeof versionId !== 'string' || !versionId || !Array.isArray(hosts)) continue;
                 pages.push({
                     hostId: site.id,
                     screenId: review.id,
                     versionId,
-                    hosts: hosts.filter((host)=>typeof host === 'string')
+                    hosts: hosts.filter((host)=>typeof host === 'string'),
+                    links: Array.isArray(links) ? links.filter((link)=>typeof link === 'string') : []
                 });
             }
         }
@@ -88,28 +93,62 @@ import { lookupHostReputation } from "./web-risk.js";
     };
     if (options.dryRun) {
         return _extends({}, chunk, {
+            addresses: 0,
             listed: 0,
             unknown: 0,
             reviewed: 0,
             held: 0,
-            heldHostIds: []
+            heldHostIds: [],
+            reapedAddressVerdicts: 0
         });
     }
+    // Once a walk, before its first chunk: addresses' answers long expired.
+    const reapedAddressVerdicts = options.cursor ? 0 : await reapExpiredWebRiskUrlVerdicts({
+        nowMs,
+        firestore
+    });
+    // The addresses go with their hosts, and only in 'url' mode.
+    const mode = await webRiskLookupMode(nowMs);
+    const addressHost = new Map();
+    if (mode === 'url') {
+        for (const link of new Set(pages.flatMap((page)=>page.links))){
+            var _normalizeReputationLink;
+            const host = (_normalizeReputationLink = normalizeReputationLink(link)) == null ? void 0 : _normalizeReputationLink.host;
+            if (host) addressHost.set(link, host);
+        }
+    }
+    // Keyed by host for a host's listing, by address for an address's: an
+    // address always holds `://`, a host never does.
     const listed = new Map();
-    let unknown = 0;
+    const unknown = new Set();
     for(let at = 0; at < distinct.length; at += MAX_REPUTATION_HOSTS_PER_LOOKUP){
-        const answer = await lookupHostReputation(distinct.slice(at, at + MAX_REPUTATION_HOSTS_PER_LOOKUP), {
-            deadlineMs: RECHECK_DEADLINE_MS,
-            nowMs
-        });
-        for (const hit of answer.hits)listed.set(hit.host, hit);
-        unknown += answer.unknown.length;
+        const group = distinct.slice(at, at + MAX_REPUTATION_HOSTS_PER_LOOKUP);
+        const inGroup = new Set(group);
+        const urls = [
+            ...addressHost
+        ].filter(([, host])=>inGroup.has(host)).map(([url])=>url);
+        // A later slice of addresses finds the group's answered hosts in memory.
+        let offset = 0;
+        do {
+            var _hit_url;
+            const answer = await lookupLinkReputation(group, {
+                urls: urls.slice(offset, offset + MAX_REPUTATION_URLS_PER_LOOKUP),
+                deadlineMs: RECHECK_DEADLINE_MS,
+                nowMs
+            });
+            for (const hit of answer.hits)listed.set((_hit_url = hit.url) != null ? _hit_url : hit.host, hit);
+            for (const key of answer.unknown)unknown.add(key);
+            offset += MAX_REPUTATION_URLS_PER_LOOKUP;
+        }while (offset < urls.length)
     }
     let reviewed = 0;
     let held = 0;
     const heldHostIds = new Set();
     for (const page of pages){
-        const hits = page.hosts.map((host)=>listed.get(host)).filter(Boolean);
+        const hits = [
+            ...page.hosts,
+            ...page.links
+        ].map((key)=>listed.get(key)).filter(Boolean);
         if (!hits.length) continue;
         reviewed += 1;
         try {
@@ -131,13 +170,15 @@ import { lookupHostReputation } from "./web-risk.js";
         }
     }
     return _extends({}, chunk, {
+        addresses: addressHost.size,
         listed: listed.size,
-        unknown,
+        unknown: unknown.size,
         reviewed,
         held,
         heldHostIds: [
             ...heldHostIds
-        ]
+        ],
+        reapedAddressVerdicts
     });
 }
 

package/src/lib/server/link-reputation-review.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/link-reputation-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE DAILY LINK RE-CHECK (AGL-3451).\n *\n * The page review (`hosted-page-review.ts`), the redirect review and the send\n * seam look up every foreign host a page, a redirect or a message points at\n * as it goes out. What is already live is not re-reviewed until somebody\n * publishes it again — and a harvester is often listed only after the page\n * linking to it went up.\n *\n * So {@link recheckLivePageLinks} walks every live page's foreign hosts, as\n * the review noted them beside the version it served\n * (`pageReviews/{screenId}.foreignHosts`), looks them up again, and sends\n * each page with a newly listed host back through `reviewHostedPage` with the\n * listing as an extra signal — the same path, so it is held or flagged, its\n * row filed, and a young workspace's security hold requested (AGL-3450),\n * exactly as at render. The console's `/api/admin/web-risk-recheck` runs it\n * a chunk of sites at a time.\n *=========================================*/\n\nimport {\n  type HostReputationHit,\n  MAX_REPUTATION_HOSTS_PER_LOOKUP,\n  webRiskSignals,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { FieldPath } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { PAGE_REVIEW_SUBCOLLECTION, reviewHostedPage } from './hosted-page-review'\nimport { lookupHostReputation } from './web-risk'\n\n/** One live page whose foreign hosts the review noted. */\ninterface LivePageLinks {\n  hostId: string\n  screenId: string\n  versionId: string\n  hosts: string[]\n}\n\n/** What one chunk of the re-check did. */\nexport interface LivePageLinkRecheck {\n  /** Sites this chunk walked. */\n  sites: number\n  /** Live pages with foreign links among them. */\n  pages: number\n  /** Distinct foreign hosts looked up. */\n  hosts: number\n  /** Of those, how many Web Risk lists. */\n  listed: number\n  /** Hosts nobody could answer for: not evidence, looked up again next time. */\n  unknown: number\n  /** Pages sent back through the review with a listed host. */\n  reviewed: number\n  /** Of those, how many the review held (or found already rejected). */\n  held: number\n  /** The sites a hold was placed on, whose cached pages need dropping. */\n  heldHostIds: string[]\n  nextCursor: string | null\n  done: boolean\n}\n\n/** Sites walked per chunk. */\nexport const LINK_RECHECK_SITES_PER_CHUNK = 200\n/** Sites whose page notes are read at once. */\nconst SITE_READ_CONCURRENCY = 20\n/** The budget of each group of hosts looked up within a chunk. */\nconst RECHECK_DEADLINE_MS = 15_000\n\n/**\n * Re-check the foreign hosts of every live page, a chunk of sites at a time\n * (`cursor` resumes after the last site of the previous chunk). A site that\n * is locked is skipped: nothing of it serves. A page with a newly listed host\n * goes back through {@link reviewHostedPage} with that listing as an extra\n * signal, so what a hold does is decided in one place.\n */\nexport async function recheckLivePageLinks(\n  options: {\n    cursor?: string | null\n    sitesPerChunk?: number\n    nowMs?: number\n    firestore?: FirebaseFirestore.Firestore\n    /** Walk and count only: no lookup, no review. */\n    dryRun?: boolean\n  } = {},\n): Promise<LivePageLinkRecheck> {\n  const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n  const nowMs = options.nowMs ?? Date.now()\n  const limit = options.sitesPerChunk ?? LINK_RECHECK_SITES_PER_CHUNK\n  let query = firestore\n    .collection('hosts')\n    .orderBy(FieldPath.documentId())\n    .select('suspendedAt')\n    .limit(limit)\n  if (options.cursor) query = query.startAfter(options.cursor)\n  const sites = await query.get()\n\n  const pages: LivePageLinks[] = []\n  const live = sites.docs.filter((site) => site.get('suspendedAt') == null)\n  for (let at = 0; at < live.length; at += SITE_READ_CONCURRENCY) {\n    const batch = live.slice(at, at + SITE_READ_CONCURRENCY)\n    const notes = await Promise.all(\n      batch.map((site) =>\n        site.ref\n          .collection(PAGE_REVIEW_SUBCOLLECTION)\n          .where('foreignHostCount', '>', 0)\n          .limit(500)\n          .get()\n          .then((reviews) => ({ site, reviews })),\n      ),\n    )\n    for (const { site, reviews } of notes) {\n      for (const review of reviews.docs) {\n        const versionId = review.get('servedVersionId')\n        const hosts = review.get('foreignHosts')\n        if (typeof versionId !== 'string' || !versionId || !Array.isArray(hosts)) continue\n        pages.push({\n          hostId: site.id,\n          screenId: review.id,\n          versionId,\n          hosts: hosts.filter((host): host is string => typeof host === 'string'),\n        })\n      }\n    }\n  }\n\n  const distinct = [...new Set(pages.flatMap((page) => page.hosts))]\n  const last = sites.docs[sites.docs.length - 1]\n  const chunk = {\n    sites: sites.size,\n    pages: pages.length,\n    hosts: distinct.length,\n    nextCursor: sites.size < limit ? null : (last?.id ?? null),\n    done: sites.size < limit,\n  }\n  if (options.dryRun) {\n    return { ...chunk, listed: 0, unknown: 0, reviewed: 0, held: 0, heldHostIds: [] }\n  }\n  const listed = new Map<string, HostReputationHit>()\n  let unknown = 0\n  for (let at = 0; at < distinct.length; at += MAX_REPUTATION_HOSTS_PER_LOOKUP) {\n    const answer = await lookupHostReputation(\n      distinct.slice(at, at + MAX_REPUTATION_HOSTS_PER_LOOKUP),\n      { deadlineMs: RECHECK_DEADLINE_MS, nowMs },\n    )\n    for (const hit of answer.hits) listed.set(hit.host, hit)\n    unknown += answer.unknown.length\n  }\n\n  let reviewed = 0\n  let held = 0\n  const heldHostIds = new Set<string>()\n  for (const page of pages) {\n    const hits = page.hosts.map((host) => listed.get(host)).filter(Boolean) as HostReputationHit[]\n    if (!hits.length) continue\n    reviewed += 1\n    try {\n      const outcome = await reviewHostedPage({\n        hostId: page.hostId,\n        screenId: page.screenId,\n        versionId: page.versionId,\n        // The page itself is not composed here: the listing is the finding.\n        nodes: {},\n        extraSignals: webRiskSignals(hits),\n        nowMs,\n      })\n      if (outcome.outcome !== 'serve') {\n        held += 1\n        heldHostIds.add(page.hostId)\n      }\n    } catch (error) {\n      console.error('[link-reputation] a live page could not be re-reviewed', page.hostId, page.screenId, error)\n    }\n  }\n\n  return {\n    ...chunk,\n    listed: listed.size,\n    unknown,\n    reviewed,\n    held,\n    heldHostIds: [...heldHostIds],\n  }\n}\n"],"names":["MAX_REPUTATION_HOSTS_PER_LOOKUP","webRiskSignals","FieldPath","firebaseAdmin","PAGE_REVIEW_SUBCOLLECTION","reviewHostedPage","lookupHostReputation","LINK_RECHECK_SITES_PER_CHUNK","SITE_READ_CONCURRENCY","RECHECK_DEADLINE_MS","recheckLivePageLinks","options","firestore","app","nowMs","Date","now","limit","sitesPerChunk","query","collection","orderBy","documentId","select","cursor","startAfter","sites","get","pages","live","docs","filter","site","at","length","batch","slice","notes","Promise","all","map","ref","where","then","reviews","review","versionId","hosts","Array","isArray","push","hostId","id","screenId","host","distinct","Set","flatMap","page","last","chunk","size","nextCursor","done","dryRun","listed","unknown","reviewed","held","heldHostIds","Map","answer","deadlineMs","hit","hits","set","Boolean","outcome","nodes","extraSignals","add","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;2CAiB2C,GAE3C,SAEEA,+BAA+B,EAC/BC,cAAc,QACT,2CAA0C;AACjD,SAASC,SAAS,QAAQ,2BAA0B;AACpD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,yBAAyB,EAAEC,gBAAgB,QAAQ,0BAAsB;AAClF,SAASC,oBAAoB,QAAQ,gBAAY;AAgCjD,4BAA4B,GAC5B,OAAO,MAAMC,+BAA+B,IAAG;AAC/C,6CAA6C,GAC7C,MAAMC,wBAAwB;AAC9B,gEAAgE,GAChE,MAAMC,sBAAsB;AAE5B;;;;;;CAMC,GACD,OAAO,eAAeC,qBACpBC,UAOI,CAAC,CAAC;QAEYA,oBACJA,gBACAA;IAFd,MAAMC,aAAYD,qBAAAA,QAAQC,SAAS,YAAjBD,qBAAqBR,cAAcU,GAAG,GAAGD,SAAS;IACpE,MAAME,SAAQH,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiBI,KAAKC,GAAG;IACvC,MAAMC,SAAQN,yBAAAA,QAAQO,aAAa,YAArBP,yBAAyBJ;IACvC,IAAIY,QAAQP,UACTQ,UAAU,CAAC,SACXC,OAAO,CAACnB,UAAUoB,UAAU,IAC5BC,MAAM,CAAC,eACPN,KAAK,CAACA;IACT,IAAIN,QAAQa,MAAM,EAAEL,QAAQA,MAAMM,UAAU,CAACd,QAAQa,MAAM;IAC3D,MAAME,QAAQ,MAAMP,MAAMQ,GAAG;IAE7B,MAAMC,QAAyB,EAAE;IACjC,MAAMC,OAAOH,MAAMI,IAAI,CAACC,MAAM,CAAC,CAACC,OAASA,KAAKL,GAAG,CAAC,kBAAkB;IACpE,IAAK,IAAIM,KAAK,GAAGA,KAAKJ,KAAKK,MAAM,EAAED,MAAMzB,sBAAuB;QAC9D,MAAM2B,QAAQN,KAAKO,KAAK,CAACH,IAAIA,KAAKzB;QAClC,MAAM6B,QAAQ,MAAMC,QAAQC,GAAG,CAC7BJ,MAAMK,GAAG,CAAC,CAACR,OACTA,KAAKS,GAAG,CACLrB,UAAU,CAAChB,2BACXsC,KAAK,CAAC,oBAAoB,KAAK,GAC/BzB,KAAK,CAAC,KACNU,GAAG,GACHgB,IAAI,CAAC,CAACC,UAAa,CAAA;oBAAEZ;oBAAMY;gBAAQ,CAAA;QAG1C,KAAK,MAAM,EAAEZ,IAAI,EAAEY,OAAO,EAAE,IAAIP,MAAO;YACrC,KAAK,MAAMQ,UAAUD,QAAQd,IAAI,CAAE;gBACjC,MAAMgB,YAAYD,OAAOlB,GAAG,CAAC;gBAC7B,MAAMoB,QAAQF,OAAOlB,GAAG,CAAC;gBACzB,IAAI,OAAOmB,cAAc,YAAY,CAACA,aAAa,CAACE,MAAMC,OAAO,CAACF,QAAQ;gBAC1EnB,MAAMsB,IAAI,CAAC;oBACTC,QAAQnB,KAAKoB,EAAE;oBACfC,UAAUR,OAAOO,EAAE;oBACnBN;oBACAC,OAAOA,MAAMhB,MAAM,CAAC,CAACuB,OAAyB,OAAOA,SAAS;gBAChE;YACF;QACF;IACF;IAEA,MAAMC,WAAW;WAAI,IAAIC,IAAI5B,MAAM6B,OAAO,CAAC,CAACC,OAASA,KAAKX,KAAK;KAAG;IAClE,MAAMY,OAAOjC,MAAMI,IAAI,CAACJ,MAAMI,IAAI,CAACI,MAAM,GAAG,EAAE;IAC9C,MAAM0B,QAAQ;QACZlC,OAAOA,MAAMmC,IAAI;QACjBjC,OAAOA,MAAMM,MAAM;QACnBa,OAAOQ,SAASrB,MAAM;QACtB4B,YAAYpC,MAAMmC,IAAI,GAAG5C,QAAQ,eAAQ0C,wBAAAA,KAAMP,EAAE,mBAAI;QACrDW,MAAMrC,MAAMmC,IAAI,GAAG5C;IACrB;IACA,IAAIN,QAAQqD,MAAM,EAAE;QAClB,OAAO,aAAKJ;YAAOK,QAAQ;YAAGC,SAAS;YAAGC,UAAU;YAAGC,MAAM;YAAGC,aAAa,EAAE;;IACjF;IACA,MAAMJ,SAAS,IAAIK;IACnB,IAAIJ,UAAU;IACd,IAAK,IAAIjC,KAAK,GAAGA,KAAKsB,SAASrB,MAAM,EAAED,MAAMjC,gCAAiC;QAC5E,MAAMuE,SAAS,MAAMjE,qBACnBiD,SAASnB,KAAK,CAACH,IAAIA,KAAKjC,kCACxB;YAAEwE,YAAY/D;YAAqBK;QAAM;QAE3C,KAAK,MAAM2D,OAAOF,OAAOG,IAAI,CAAET,OAAOU,GAAG,CAACF,IAAInB,IAAI,EAAEmB;QACpDP,WAAWK,OAAOL,OAAO,CAAChC,MAAM;IAClC;IAEA,IAAIiC,WAAW;IACf,IAAIC,OAAO;IACX,MAAMC,cAAc,IAAIb;IACxB,KAAK,MAAME,QAAQ9B,MAAO;QACxB,MAAM8C,OAAOhB,KAAKX,KAAK,CAACP,GAAG,CAAC,CAACc,OAASW,OAAOtC,GAAG,CAAC2B,OAAOvB,MAAM,CAAC6C;QAC/D,IAAI,CAACF,KAAKxC,MAAM,EAAE;QAClBiC,YAAY;QACZ,IAAI;YACF,MAAMU,UAAU,MAAMxE,iBAAiB;gBACrC8C,QAAQO,KAAKP,MAAM;gBACnBE,UAAUK,KAAKL,QAAQ;gBACvBP,WAAWY,KAAKZ,SAAS;gBACzB,oEAAoE;gBACpEgC,OAAO,CAAC;gBACRC,cAAc9E,eAAeyE;gBAC7B5D;YACF;YACA,IAAI+D,QAAQA,OAAO,KAAK,SAAS;gBAC/BT,QAAQ;gBACRC,YAAYW,GAAG,CAACtB,KAAKP,MAAM;YAC7B;QACF,EAAE,OAAO8B,OAAO;YACdC,QAAQD,KAAK,CAAC,0DAA0DvB,KAAKP,MAAM,EAAEO,KAAKL,QAAQ,EAAE4B;QACtG;IACF;IAEA,OAAO,aACFrB;QACHK,QAAQA,OAAOJ,IAAI;QACnBK;QACAC;QACAC;QACAC,aAAa;eAAIA;SAAY;;AAEjC"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/link-reputation-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE DAILY LINK RE-CHECK (AGL-3451).\n *\n * The page review (`hosted-page-review.ts`), the redirect review and the send\n * seam look up every foreign host a page, a redirect or a message points at\n * as it goes out. What is already live is not re-reviewed until somebody\n * publishes it again — and a harvester is often listed only after the page\n * linking to it went up.\n *\n * So {@link recheckLivePageLinks} walks every live page's foreign hosts, as\n * the review noted them beside the version it served\n * (`pageReviews/{screenId}.foreignHosts`), looks them up again — and, in\n * `'url'` mode (AGL-3459), the addresses on them noted beside the hosts\n * (`foreignLinks`, never a query string) — and sends each page with a newly\n * listed host or address back through `reviewHostedPage` with the listing as\n * an extra signal — the same path, so it is held or flagged, its row filed,\n * and a young workspace's security hold requested (AGL-3450), exactly as at\n * render. The console's `/api/admin/web-risk-recheck` runs it a chunk of\n * sites at a time; its first chunk of a walk also deletes the addresses'\n * stored answers that expired a day ago.\n *=========================================*/\n\nimport {\n  type HostReputationHit,\n  MAX_REPUTATION_HOSTS_PER_LOOKUP,\n  MAX_REPUTATION_URLS_PER_LOOKUP,\n  normalizeReputationLink,\n  webRiskSignals,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { FieldPath } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { PAGE_REVIEW_SUBCOLLECTION, reviewHostedPage } from './hosted-page-review'\nimport { lookupLinkReputation, reapExpiredWebRiskUrlVerdicts, webRiskLookupMode } from './web-risk'\n\n/** One live page whose foreign hosts the review noted. */\ninterface LivePageLinks {\n  hostId: string\n  screenId: string\n  versionId: string\n  hosts: string[]\n  /** The addresses on those hosts the review noted (AGL-3459); empty before it did. */\n  links: string[]\n}\n\n/** What one chunk of the re-check did. */\nexport interface LivePageLinkRecheck {\n  /** Sites this chunk walked. */\n  sites: number\n  /** Live pages with foreign links among them. */\n  pages: number\n  /** Distinct foreign hosts looked up. */\n  hosts: number\n  /** Distinct addresses looked up on them — none unless the lookup is in `'url'` mode. */\n  addresses: number\n  /** Of the hosts and addresses, how many Web Risk lists. */\n  listed: number\n  /** Hosts and addresses nobody could answer for: not evidence, looked up again next time. */\n  unknown: number\n  /** Pages sent back through the review with a listed host. */\n  reviewed: number\n  /** Of those, how many the review held (or found already rejected). */\n  held: number\n  /** The sites a hold was placed on, whose cached pages need dropping. */\n  heldHostIds: string[]\n  /** Addresses' stored answers deleted a day after they expired (first chunk of a walk only). */\n  reapedAddressVerdicts: number\n  nextCursor: string | null\n  done: boolean\n}\n\n/** Sites walked per chunk. */\nexport const LINK_RECHECK_SITES_PER_CHUNK = 200\n/** Sites whose page notes are read at once. */\nconst SITE_READ_CONCURRENCY = 20\n/** The budget of each group of hosts looked up within a chunk. */\nconst RECHECK_DEADLINE_MS = 15_000\n\n/**\n * Re-check the foreign hosts of every live page, a chunk of sites at a time\n * (`cursor` resumes after the last site of the previous chunk). A site that\n * is locked is skipped: nothing of it serves. A page with a newly listed host\n * goes back through {@link reviewHostedPage} with that listing as an extra\n * signal, so what a hold does is decided in one place.\n */\nexport async function recheckLivePageLinks(\n  options: {\n    cursor?: string | null\n    sitesPerChunk?: number\n    nowMs?: number\n    firestore?: FirebaseFirestore.Firestore\n    /** Walk and count only: no lookup, no review. */\n    dryRun?: boolean\n  } = {},\n): Promise<LivePageLinkRecheck> {\n  const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n  const nowMs = options.nowMs ?? Date.now()\n  const limit = options.sitesPerChunk ?? LINK_RECHECK_SITES_PER_CHUNK\n  let query = firestore\n    .collection('hosts')\n    .orderBy(FieldPath.documentId())\n    .select('suspendedAt')\n    .limit(limit)\n  if (options.cursor) query = query.startAfter(options.cursor)\n  const sites = await query.get()\n\n  const pages: LivePageLinks[] = []\n  const live = sites.docs.filter((site) => site.get('suspendedAt') == null)\n  for (let at = 0; at < live.length; at += SITE_READ_CONCURRENCY) {\n    const batch = live.slice(at, at + SITE_READ_CONCURRENCY)\n    const notes = await Promise.all(\n      batch.map((site) =>\n        site.ref\n          .collection(PAGE_REVIEW_SUBCOLLECTION)\n          .where('foreignHostCount', '>', 0)\n          .limit(500)\n          .get()\n          .then((reviews) => ({ site, reviews })),\n      ),\n    )\n    for (const { site, reviews } of notes) {\n      for (const review of reviews.docs) {\n        const versionId = review.get('servedVersionId')\n        const hosts = review.get('foreignHosts')\n        const links = review.get('foreignLinks')\n        if (typeof versionId !== 'string' || !versionId || !Array.isArray(hosts)) continue\n        pages.push({\n          hostId: site.id,\n          screenId: review.id,\n          versionId,\n          hosts: hosts.filter((host): host is string => typeof host === 'string'),\n          links: Array.isArray(links) ? links.filter((link): link is string => typeof link === 'string') : [],\n        })\n      }\n    }\n  }\n\n  const distinct = [...new Set(pages.flatMap((page) => page.hosts))]\n  const last = sites.docs[sites.docs.length - 1]\n  const chunk = {\n    sites: sites.size,\n    pages: pages.length,\n    hosts: distinct.length,\n    nextCursor: sites.size < limit ? null : (last?.id ?? null),\n    done: sites.size < limit,\n  }\n  if (options.dryRun) {\n    return {\n      ...chunk,\n      addresses: 0,\n      listed: 0,\n      unknown: 0,\n      reviewed: 0,\n      held: 0,\n      heldHostIds: [],\n      reapedAddressVerdicts: 0,\n    }\n  }\n  // Once a walk, before its first chunk: addresses' answers long expired.\n  const reapedAddressVerdicts = options.cursor\n    ? 0\n    : await reapExpiredWebRiskUrlVerdicts({ nowMs, firestore })\n\n  // The addresses go with their hosts, and only in 'url' mode.\n  const mode = await webRiskLookupMode(nowMs)\n  const addressHost = new Map<string, string>()\n  if (mode === 'url') {\n    for (const link of new Set(pages.flatMap((page) => page.links))) {\n      const host = normalizeReputationLink(link)?.host\n      if (host) addressHost.set(link, host)\n    }\n  }\n  // Keyed by host for a host's listing, by address for an address's: an\n  // address always holds `://`, a host never does.\n  const listed = new Map<string, HostReputationHit>()\n  const unknown = new Set<string>()\n  for (let at = 0; at < distinct.length; at += MAX_REPUTATION_HOSTS_PER_LOOKUP) {\n    const group = distinct.slice(at, at + MAX_REPUTATION_HOSTS_PER_LOOKUP)\n    const inGroup = new Set(group)\n    const urls = [...addressHost].filter(([, host]) => inGroup.has(host)).map(([url]) => url)\n    // A later slice of addresses finds the group's answered hosts in memory.\n    let offset = 0\n    do {\n      const answer = await lookupLinkReputation(group, {\n        urls: urls.slice(offset, offset + MAX_REPUTATION_URLS_PER_LOOKUP),\n        deadlineMs: RECHECK_DEADLINE_MS,\n        nowMs,\n      })\n      for (const hit of answer.hits) listed.set(hit.url ?? hit.host, hit)\n      for (const key of answer.unknown) unknown.add(key)\n      offset += MAX_REPUTATION_URLS_PER_LOOKUP\n    } while (offset < urls.length)\n  }\n\n  let reviewed = 0\n  let held = 0\n  const heldHostIds = new Set<string>()\n  for (const page of pages) {\n    const hits = [...page.hosts, ...page.links]\n      .map((key) => listed.get(key))\n      .filter(Boolean) as HostReputationHit[]\n    if (!hits.length) continue\n    reviewed += 1\n    try {\n      const outcome = await reviewHostedPage({\n        hostId: page.hostId,\n        screenId: page.screenId,\n        versionId: page.versionId,\n        // The page itself is not composed here: the listing is the finding.\n        nodes: {},\n        extraSignals: webRiskSignals(hits),\n        nowMs,\n      })\n      if (outcome.outcome !== 'serve') {\n        held += 1\n        heldHostIds.add(page.hostId)\n      }\n    } catch (error) {\n      console.error('[link-reputation] a live page could not be re-reviewed', page.hostId, page.screenId, error)\n    }\n  }\n\n  return {\n    ...chunk,\n    addresses: addressHost.size,\n    listed: listed.size,\n    unknown: unknown.size,\n    reviewed,\n    held,\n    heldHostIds: [...heldHostIds],\n    reapedAddressVerdicts,\n  }\n}\n"],"names":["MAX_REPUTATION_HOSTS_PER_LOOKUP","MAX_REPUTATION_URLS_PER_LOOKUP","normalizeReputationLink","webRiskSignals","FieldPath","firebaseAdmin","PAGE_REVIEW_SUBCOLLECTION","reviewHostedPage","lookupLinkReputation","reapExpiredWebRiskUrlVerdicts","webRiskLookupMode","LINK_RECHECK_SITES_PER_CHUNK","SITE_READ_CONCURRENCY","RECHECK_DEADLINE_MS","recheckLivePageLinks","options","firestore","app","nowMs","Date","now","limit","sitesPerChunk","query","collection","orderBy","documentId","select","cursor","startAfter","sites","get","pages","live","docs","filter","site","at","length","batch","slice","notes","Promise","all","map","ref","where","then","reviews","review","versionId","hosts","links","Array","isArray","push","hostId","id","screenId","host","link","distinct","Set","flatMap","page","last","chunk","size","nextCursor","done","dryRun","addresses","listed","unknown","reviewed","held","heldHostIds","reapedAddressVerdicts","mode","addressHost","Map","set","group","inGroup","urls","has","url","offset","hit","answer","deadlineMs","hits","key","add","Boolean","outcome","nodes","extraSignals","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;2CAoB2C,GAE3C,SAEEA,+BAA+B,EAC/BC,8BAA8B,EAC9BC,uBAAuB,EACvBC,cAAc,QACT,2CAA0C;AACjD,SAASC,SAAS,QAAQ,2BAA0B;AACpD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,yBAAyB,EAAEC,gBAAgB,QAAQ,0BAAsB;AAClF,SAASC,oBAAoB,EAAEC,6BAA6B,EAAEC,iBAAiB,QAAQ,gBAAY;AAsCnG,4BAA4B,GAC5B,OAAO,MAAMC,+BAA+B,IAAG;AAC/C,6CAA6C,GAC7C,MAAMC,wBAAwB;AAC9B,gEAAgE,GAChE,MAAMC,sBAAsB;AAE5B;;;;;;CAMC,GACD,OAAO,eAAeC,qBACpBC,UAOI,CAAC,CAAC;QAEYA,oBACJA,gBACAA;IAFd,MAAMC,aAAYD,qBAAAA,QAAQC,SAAS,YAAjBD,qBAAqBV,cAAcY,GAAG,GAAGD,SAAS;IACpE,MAAME,SAAQH,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiBI,KAAKC,GAAG;IACvC,MAAMC,SAAQN,yBAAAA,QAAQO,aAAa,YAArBP,yBAAyBJ;IACvC,IAAIY,QAAQP,UACTQ,UAAU,CAAC,SACXC,OAAO,CAACrB,UAAUsB,UAAU,IAC5BC,MAAM,CAAC,eACPN,KAAK,CAACA;IACT,IAAIN,QAAQa,MAAM,EAAEL,QAAQA,MAAMM,UAAU,CAACd,QAAQa,MAAM;IAC3D,MAAME,QAAQ,MAAMP,MAAMQ,GAAG;IAE7B,MAAMC,QAAyB,EAAE;IACjC,MAAMC,OAAOH,MAAMI,IAAI,CAACC,MAAM,CAAC,CAACC,OAASA,KAAKL,GAAG,CAAC,kBAAkB;IACpE,IAAK,IAAIM,KAAK,GAAGA,KAAKJ,KAAKK,MAAM,EAAED,MAAMzB,sBAAuB;QAC9D,MAAM2B,QAAQN,KAAKO,KAAK,CAACH,IAAIA,KAAKzB;QAClC,MAAM6B,QAAQ,MAAMC,QAAQC,GAAG,CAC7BJ,MAAMK,GAAG,CAAC,CAACR,OACTA,KAAKS,GAAG,CACLrB,UAAU,CAAClB,2BACXwC,KAAK,CAAC,oBAAoB,KAAK,GAC/BzB,KAAK,CAAC,KACNU,GAAG,GACHgB,IAAI,CAAC,CAACC,UAAa,CAAA;oBAAEZ;oBAAMY;gBAAQ,CAAA;QAG1C,KAAK,MAAM,EAAEZ,IAAI,EAAEY,OAAO,EAAE,IAAIP,MAAO;YACrC,KAAK,MAAMQ,UAAUD,QAAQd,IAAI,CAAE;gBACjC,MAAMgB,YAAYD,OAAOlB,GAAG,CAAC;gBAC7B,MAAMoB,QAAQF,OAAOlB,GAAG,CAAC;gBACzB,MAAMqB,QAAQH,OAAOlB,GAAG,CAAC;gBACzB,IAAI,OAAOmB,cAAc,YAAY,CAACA,aAAa,CAACG,MAAMC,OAAO,CAACH,QAAQ;gBAC1EnB,MAAMuB,IAAI,CAAC;oBACTC,QAAQpB,KAAKqB,EAAE;oBACfC,UAAUT,OAAOQ,EAAE;oBACnBP;oBACAC,OAAOA,MAAMhB,MAAM,CAAC,CAACwB,OAAyB,OAAOA,SAAS;oBAC9DP,OAAOC,MAAMC,OAAO,CAACF,SAASA,MAAMjB,MAAM,CAAC,CAACyB,OAAyB,OAAOA,SAAS,YAAY,EAAE;gBACrG;YACF;QACF;IACF;IAEA,MAAMC,WAAW;WAAI,IAAIC,IAAI9B,MAAM+B,OAAO,CAAC,CAACC,OAASA,KAAKb,KAAK;KAAG;IAClE,MAAMc,OAAOnC,MAAMI,IAAI,CAACJ,MAAMI,IAAI,CAACI,MAAM,GAAG,EAAE;IAC9C,MAAM4B,QAAQ;QACZpC,OAAOA,MAAMqC,IAAI;QACjBnC,OAAOA,MAAMM,MAAM;QACnBa,OAAOU,SAASvB,MAAM;QACtB8B,YAAYtC,MAAMqC,IAAI,GAAG9C,QAAQ,eAAQ4C,wBAAAA,KAAMR,EAAE,mBAAI;QACrDY,MAAMvC,MAAMqC,IAAI,GAAG9C;IACrB;IACA,IAAIN,QAAQuD,MAAM,EAAE;QAClB,OAAO,aACFJ;YACHK,WAAW;YACXC,QAAQ;YACRC,SAAS;YACTC,UAAU;YACVC,MAAM;YACNC,aAAa,EAAE;YACfC,uBAAuB;;IAE3B;IACA,wEAAwE;IACxE,MAAMA,wBAAwB9D,QAAQa,MAAM,GACxC,IACA,MAAMnB,8BAA8B;QAAES;QAAOF;IAAU;IAE3D,6DAA6D;IAC7D,MAAM8D,OAAO,MAAMpE,kBAAkBQ;IACrC,MAAM6D,cAAc,IAAIC;IACxB,IAAIF,SAAS,OAAO;QAClB,KAAK,MAAMlB,QAAQ,IAAIE,IAAI9B,MAAM+B,OAAO,CAAC,CAACC,OAASA,KAAKZ,KAAK,GAAI;gBAClDlD;YAAb,MAAMyD,QAAOzD,2BAAAA,wBAAwB0D,0BAAxB1D,yBAA+ByD,IAAI;YAChD,IAAIA,MAAMoB,YAAYE,GAAG,CAACrB,MAAMD;QAClC;IACF;IACA,sEAAsE;IACtE,iDAAiD;IACjD,MAAMa,SAAS,IAAIQ;IACnB,MAAMP,UAAU,IAAIX;IACpB,IAAK,IAAIzB,KAAK,GAAGA,KAAKwB,SAASvB,MAAM,EAAED,MAAMrC,gCAAiC;QAC5E,MAAMkF,QAAQrB,SAASrB,KAAK,CAACH,IAAIA,KAAKrC;QACtC,MAAMmF,UAAU,IAAIrB,IAAIoB;QACxB,MAAME,OAAO;eAAIL;SAAY,CAAC5C,MAAM,CAAC,CAAC,GAAGwB,KAAK,GAAKwB,QAAQE,GAAG,CAAC1B,OAAOf,GAAG,CAAC,CAAC,CAAC0C,IAAI,GAAKA;QACrF,yEAAyE;QACzE,IAAIC,SAAS;QACb,GAAG;gBAMyCC;YAL1C,MAAMC,SAAS,MAAMjF,qBAAqB0E,OAAO;gBAC/CE,MAAMA,KAAK5C,KAAK,CAAC+C,QAAQA,SAAStF;gBAClCyF,YAAY7E;gBACZK;YACF;YACA,KAAK,MAAMsE,OAAOC,OAAOE,IAAI,CAAEnB,OAAOS,GAAG,EAACO,WAAAA,IAAIF,GAAG,YAAPE,WAAWA,IAAI7B,IAAI,EAAE6B;YAC/D,KAAK,MAAMI,OAAOH,OAAOhB,OAAO,CAAEA,QAAQoB,GAAG,CAACD;YAC9CL,UAAUtF;QACZ,QAASsF,SAASH,KAAK9C,MAAM,CAAC;IAChC;IAEA,IAAIoC,WAAW;IACf,IAAIC,OAAO;IACX,MAAMC,cAAc,IAAId;IACxB,KAAK,MAAME,QAAQhC,MAAO;QACxB,MAAM2D,OAAO;eAAI3B,KAAKb,KAAK;eAAKa,KAAKZ,KAAK;SAAC,CACxCR,GAAG,CAAC,CAACgD,MAAQpB,OAAOzC,GAAG,CAAC6D,MACxBzD,MAAM,CAAC2D;QACV,IAAI,CAACH,KAAKrD,MAAM,EAAE;QAClBoC,YAAY;QACZ,IAAI;YACF,MAAMqB,UAAU,MAAMxF,iBAAiB;gBACrCiD,QAAQQ,KAAKR,MAAM;gBACnBE,UAAUM,KAAKN,QAAQ;gBACvBR,WAAWc,KAAKd,SAAS;gBACzB,oEAAoE;gBACpE8C,OAAO,CAAC;gBACRC,cAAc9F,eAAewF;gBAC7BzE;YACF;YACA,IAAI6E,QAAQA,OAAO,KAAK,SAAS;gBAC/BpB,QAAQ;gBACRC,YAAYiB,GAAG,CAAC7B,KAAKR,MAAM;YAC7B;QACF,EAAE,OAAO0C,OAAO;YACdC,QAAQD,KAAK,CAAC,0DAA0DlC,KAAKR,MAAM,EAAEQ,KAAKN,QAAQ,EAAEwC;QACtG;IACF;IAEA,OAAO,aACFhC;QACHK,WAAWQ,YAAYZ,IAAI;QAC3BK,QAAQA,OAAOL,IAAI;QACnBM,SAASA,QAAQN,IAAI;QACrBO;QACAC;QACAC,aAAa;eAAIA;SAAY;QAC7BC;;AAEJ"}

package/src/lib/server/live-page-drops.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * HOW THIS PROCESS DROPS ONE SITE'S CACHED PAGES, for a write that worked out
+ * which of them it made stale (AGL-3113, AGL-3080).
+ *
+ * A record write — a dataset row, a collection entry — refreshes the pages
+ * that show it, and nothing else. Working out WHICH pages is the writer's: the
+ * data plugin walks the pages that repeat over a dataset, the collection scan
+ * the pages that list an entry. HOW a page is dropped is the runtime's, and
+ * the two runtimes do it differently: the tenant drops its own caches in
+ * process, and the console announces over the shared secret and passes its own
+ * dropper at the call site. So the deployment that owns the caches registers
+ * the dropper here, and a writer reads it; neither names the other.
+ *
+ * ## One per process, on `globalThis`
+ *
+ * The tenant registers from `instrumentation.ts`, by name, at boot. Next
+ * compiles that file apart from the routes, so a dropper held in a module
+ * `let` was set in the boot's copy of this module and read as missing by
+ * every route's copy — a form submission or an automation step that wrote a
+ * row logged `no-live-page-dropper` and left the pages stale for the rest of
+ * their window (AGL-3412 was the same split for the plugin services). Keyed on
+ * `globalThis` under `Symbol.for`, every copy in a realm reads the one slot.
+ */
+/** One site's share of a change: the pages on it that must be dropped. */
+export interface LivePageTarget {
+    hostId: string;
+    /** The tenant keys its cache on this, never on `hostId`. */
+    subdomain: string;
+    /** The attached custom domain, whose pages live under a second cache key. */
+    cname?: string;
+    /** Site-absolute addresses (`/`, `/team`) the change makes stale. */
+    paths: string[];
+    /** The site held more documents than the scan read, so `paths` is partial. */
+    truncated: boolean;
+}
+/**
+ * Drops one site's cached pages. Returns whether the drop landed. It must
+ * never throw: everything above it has already been written.
+ */
+export type LivePageDropper = (target: LivePageTarget) => Promise<boolean>;
+/**
+ * Registers the dropper for this process, replacing any previous one. Returns
+ * the unregister, which removes it only if it is still the one registered.
+ *
+ * Called from a function the platform calls BY NAME at boot, never from a
+ * module's top level: a bundler deletes a module imported only for its side
+ * effect when its package says it has none (AGL-3025).
+ */
+export declare function registerLivePageDropper(drop: LivePageDropper): () => void;
+/** The dropper this process registered, or `undefined` when none did. */
+export declare function registeredLivePageDropper(): LivePageDropper | undefined;