@aglyn/tenant-data-admin 1.0.0-beta.226 → 1.0.0-beta.228

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.226",
+  "version": "1.0.0-beta.228",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.226",
-    "@aglyn/shared-util-email": "1.0.0-beta.226",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.226",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.226",
-    "@aglyn/shared-util-http": "1.0.0-beta.226",
-    "@aglyn/shared-util-tools": "1.0.0-beta.226",
+    "@aglyn/aglyn": "1.0.0-beta.228",
+    "@aglyn/shared-util-email": "1.0.0-beta.228",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.228",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.228",
+    "@aglyn/shared-util-http": "1.0.0-beta.228",
+    "@aglyn/shared-util-tools": "1.0.0-beta.228",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
     "sharp": "^0.35.5",

package/src/lib/server/duplicate-resource.js

@@ -179,8 +179,9 @@ import firebaseAdmin from "./firebase-admin.js";
             'nodes'
         ],
         versionParentField: 'formId',
+        // Counted only: a saved form is not behind `reusableComponents`, the same
+        // as its create at `/api/hosts/resources` (AGL-3597).
         quotaKey: 'formsPerHost',
-        entitlement: 'reusableComponents',
         slug: true
     }
 };

package/src/lib/server/duplicate-resource.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/duplicate-resource.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Duplicating a site resource whole, as a draft (AGL-2936).\n *\n * One module for every kind that lives under a site — screens and email\n * designs, reusable components, layouts, templates and forms, and the kinds\n * a plugin declares a copy for (a workflow) — so the console route, the AI\n * runtime's `duplicate_resource` tool and any later door make the same copy:\n * the same fields, the same uniqueness\n * rules, the same band arithmetic, the same activity rows. A caller that\n * has verified who is asking and that they may write the site hands over\n * the ids and gets back the copy's id, or a refusal it can answer with.\n *\n * WHAT MAKES THE COPY A DRAFT is different per kind, and each is the\n * omission of exactly one thing the create paths would otherwise do:\n *\n *   - a screen is reachable only through the host's routing map, so the\n *     copy gets no entry there — it has a slug of its own (`-copy`) but no\n *     address until somebody publishes it;\n *   - a collection's entry template renders only for the collection that\n *     points at it, and nothing points at the copy;\n *   - a layout, component or form is served only where a page places it,\n *     and nothing places the copy;\n *   - a declared kind drops what its plugin says a copy must not carry —\n *     a workflow's trigger is cleared, so the copy runs nothing;\n *   - a template is inert until it is used.\n *\n * COUNTED LIKE A CREATE. The copy is one more document in a collection the\n * plan bands, so it meets the same counter the create route meets — for a\n * screen that is not a page, the flat platform ceiling rather than a band —\n * and meets it INSIDE the transaction that writes the copy (AGL-2231): a count\n * taken before the write is a count N concurrent copies all pass. The\n * siblings are read once and answer three questions — the count, the name\n * the copy may take, and the slug — because three reads of one collection\n * is the reason a route and its readout come to disagree.\n *\n * THE VERSION TRAVELS WITH THE DOCUMENT. A besigner resource is opened by\n * its version, so the copy of a screen with no version is a screen nobody\n * can open. The source's most recently saved version is copied into the\n * copy's own `versions` as its first — no `versioning` entitlement is\n * owed for a first version — with its stored node bytes carried across\n * untouched: they are msgpack at rest, and re-encoding them is the\n * double-encode `encodeStoredNodes` exists to avoid.\n *\n * THE ONE TREE THAT IS REWRITTEN is a form's (AGL-3024). A form's design\n * names its own form inside itself, so carrying those bytes across hands the\n * copy a design that files every submission under the SOURCE — silently,\n * because the copy still renders and the row still lands. That binding is\n * moved onto the copy below. No other kind embeds its own id in its design,\n * so no other kind is decoded.\n */\n\n// The leaf module, not the server barrel: specs stage that barrel as a\n// closed world, and the list keys every create stamps (AGL-3321) are\n// nothing they have reason to name.\nimport { artifactCreateListKeys } from '@aglyn/aglyn/app-utils/artifact-list-keys'\nimport {\n  billableScreenIds,\n  checkEntitlement,\n  checkQuota,\n  claimAttempt,\n  createResourceUid,\n  decodeStoredNodes,\n  encodeStoredNodes,\n  newFormListFields,\n  NON_PAGE_SCREEN_MAX_PER_HOST,\n  nonPageScreenIds,\n  SCREEN_KIND_EMAIL,\n  SCREEN_KIND_TEMPLATE,\n  screenClaimsToBeAPage,\n  type BillableScreenSource,\n  type OrgEntitlements,\n  type OrgFeatureFlags,\n} from '@aglyn/aglyn/server'\nimport {\n  DUPLICABLE_RESOURCE_NOUNS,\n  DUPLICATE_BUSY_MESSAGE,\n  duplicateDisplayName,\n  duplicateVersionNote,\n  uniqueDuplicateName,\n  uniqueDuplicateSlug,\n  type DuplicableHostResourceKind,\n} from '@aglyn/aglyn/app-utils/duplicate-resource'\nimport { formDesignReboundTo } from '@aglyn/aglyn/app-utils/forms'\nimport { pluginHostResource } from '@aglyn/aglyn/plugin-manager/plugin-host-resources'\nimport { Timestamp } from 'firebase-admin/firestore'\nimport { logResourceDuplicated } from './duplicate-activity'\nimport firebaseAdmin from './firebase-admin'\n\n/** How the copy of each kind is made. */\ninterface KindRecipe {\n  collection: string\n  /** The field the name lives in — `displayName` on core's kinds; a declared kind names its own. */\n  nameField: string\n  /** The source fields carried onto the copy; everything else stays behind. */\n  fields: readonly string[]\n  /** The back-pointer a copied version carries, when the kind versions at all. */\n  versionParentField?: 'screenId' | 'layoutId' | 'componentId' | 'formId'\n  /** The plan counter the copy is charged to. */\n  quotaKey?: keyof OrgEntitlements & string\n  /** The feature the plan must include for the kind to exist at all. */\n  entitlement?: keyof OrgFeatureFlags\n  /** Whether a `slug` on the source becomes a unique `-copy` slug. */\n  slug?: boolean\n  /** What the copy carries beyond the source's fields. */\n  stamps?: Readonly<Record<string, unknown>>\n}\n\n/**\n * Per kind, the same fields the create route's allow-list admits, less the\n * ones a copy must not inherit: a screen's `versionId` (the copy mints its\n * own), a template's `source` (stamped `authored` below — a copy of a\n * marketplace template is the customer's own), and anything the server\n * stamps on every create.\n *\n * The platform's own kinds only. A kind a plugin owns — a workflow, whose\n * copy clears its trigger so it runs nothing until armed — is declared by\n * that plugin beside its collection in `plugins.config.json` and read by\n * {@link recipeFor} (AGL-3080), compiled so a copy never depends on this\n * process having loaded the plugin.\n */\nconst RECIPES: Partial<Record<DuplicableHostResourceKind, KindRecipe>> = {\n  screen: {\n    collection: 'screens',\n    nameField: 'displayName',\n    fields: [\n      'description',\n      'seo',\n      'kind',\n      'visibility',\n      'locale',\n      'protection',\n      // The shared-layout binding. A version inherits it from its screen, so\n      // a copy without it renders with no header or footer (AGL-3120).\n      'layoutId',\n    ],\n    versionParentField: 'screenId',\n    quotaKey: 'screensPerHost',\n    slug: true,\n  },\n  // No `quotaKey`: an email design is not a page, so it meets the flat\n  // platform ceiling on non-page screens below rather than the page band.\n  emailDesign: {\n    collection: 'screens',\n    nameField: 'displayName',\n    fields: ['description', 'kind'],\n    versionParentField: 'screenId',\n  },\n  component: {\n    collection: 'components',\n    nameField: 'displayName',\n    // `kind` keeps an email block an email block (AGL-3287): without it the\n    // copy reads as a page component, leaves every email editor's palette,\n    // and turns up in page editors where its email blocks cannot render.\n    fields: ['description', 'icon', 'rootId', 'nodes', 'props', 'kind'],\n    versionParentField: 'componentId',\n    entitlement: 'reusableComponents',\n  },\n  layout: {\n    collection: 'layouts',\n    nameField: 'displayName',\n    fields: ['description'],\n    versionParentField: 'layoutId',\n    quotaKey: 'sharedLayoutsPerHost',\n  },\n  template: {\n    collection: 'templates',\n    nameField: 'displayName',\n    fields: [\n      'kind',\n      // A component template's own kind — email block or page component —\n      // so Use template on a copy still makes the right one (AGL-3287).\n      'componentKind',\n      'description',\n      'category',\n      'placeholders',\n      'nodes',\n      'rootId',\n      'props',\n      'slug',\n      'seo',\n      'theme',\n    ],\n    quotaKey: 'templatesPerHost',\n    stamps: { source: { type: 'authored' } },\n  },\n  form: {\n    collection: 'forms',\n    nameField: 'displayName',\n    fields: [\n      'fields',\n      'consentFieldName',\n      'routing',\n      'legacyMatch',\n      'rootId',\n      'nodes',\n    ],\n    versionParentField: 'formId',\n    quotaKey: 'formsPerHost',\n    entitlement: 'reusableComponents',\n    slug: true,\n  },\n}\n\n/**\n * The recipe for a kind: core's own, else the one its plugin declared, else\n * `null` — which is refused, never guessed at. A declared copy is met against\n * the same plan counter and feature as the kind's create.\n */\nexport function recipeFor(kind: string): KindRecipe | null {\n  if (Object.prototype.hasOwnProperty.call(RECIPES, kind)) {\n    return RECIPES[kind as DuplicableHostResourceKind] ?? null\n  }\n  const declared = pluginHostResource(kind)\n  if (!declared?.duplicate) return null\n  return {\n    collection: declared.collection,\n    nameField: declared.duplicate.nameField,\n    fields: declared.duplicate.fields,\n    ...(declared.quotaKey\n      ? { quotaKey: declared.quotaKey as keyof OrgEntitlements & string }\n      : {}),\n    ...(declared.entitlement\n      ? { entitlement: declared.entitlement as keyof OrgFeatureFlags }\n      : {}),\n    ...(declared.duplicate.stamps ? { stamps: declared.duplicate.stamps } : {}),\n  }\n}\n\nexport interface DuplicateResourceOptions {\n  orgId: string\n  hostId: string\n  sourceId: string\n  /** The name the copy takes; blank means `Copy of <source>`. */\n  name?: string | null\n  /** The verified person making the copy. */\n  uid: string\n  email?: string | null\n  /**\n   * The owning org's document, when the caller already holds it; read\n   * here otherwise. The bands are resolved from it.\n   */\n  org?: Record<string, unknown> | null\n  /**\n   * A client-minted key for this attempt, so a double click makes one copy\n   * and a retry of a finished attempt answers what the first did. A caller\n   * with no client behind it — the AI runtime — sends none and is not\n   * claimed.\n   */\n  attemptKey?: string | null\n}\n\nexport type DuplicateResourceResult =\n  | {\n      ok: true\n      id: string\n      /** The copy's first version, for the kinds that version. */\n      versionId: string | null\n      name: string\n    }\n  | { ok: false; status: number; error: string }\n\n/** What a sibling contributes to the three answers the siblings give. */\ninterface SiblingRow {\n  id: string\n  name: string\n  slug: string\n  kind: unknown\n  deletedAt: unknown\n  sourceType: unknown\n}\n\nconst asRecord = (value: unknown): Record<string, unknown> =>\n  value && typeof value === 'object' && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : {}\n\n/**\n * Makes the copy. The caller has authenticated `uid` and verified that they\n * may write content on `hostId`; this decides everything after that.\n */\nexport async function duplicateResource(\n  kind: DuplicableHostResourceKind,\n  options: DuplicateResourceOptions,\n): Promise<DuplicateResourceResult> {\n  const recipe = recipeFor(kind)\n  const noun = DUPLICABLE_RESOURCE_NOUNS[kind]\n  if (!recipe) return { ok: false, status: 400, error: 'That resource cannot be duplicated' }\n  const sourceId = String(options.sourceId ?? '').trim().slice(0, 64)\n  if (!sourceId) return { ok: false, status: 400, error: `Missing the ${noun} to copy` }\n  const firestore = firebaseAdmin.app().firestore()\n\n  const attemptKey = String(options.attemptKey ?? '').trim().slice(0, 200)\n  const claimed = attemptKey\n    ? await claimAttempt(firestore as never, {\n        kind: `duplicate-${kind}`,\n        scopeId: `${options.hostId}:${sourceId}`,\n        orgId: options.orgId,\n        key: attemptKey,\n        busyMessage: DUPLICATE_BUSY_MESSAGE,\n      })\n    : null\n  if (claimed && 'replay' in claimed) {\n    return claimed.replay.body as DuplicateResourceResult\n  }\n  const claim = claimed && 'claim' in claimed ? claimed.claim : null\n\n  try {\n    const result = await copy(firestore, kind, recipe, { ...options, sourceId })\n    if (result.ok) {\n      await logResourceDuplicated(\n        kind,\n        { uid: options.uid, email: options.email ?? null },\n        {\n          orgId: options.orgId,\n          hostId: options.hostId,\n          source: { id: sourceId, name: result.sourceName },\n          target: { id: result.id, name: result.name, versionId: result.versionId },\n        },\n      )\n      const answer: DuplicateResourceResult = {\n        ok: true,\n        id: result.id,\n        versionId: result.versionId,\n        name: result.name,\n      }\n      await claim?.record(200, answer)\n      return answer\n    }\n    // A refusal releases the key: the person fixes the cause — frees a slot,\n    // picks another name — and presses the same button again.\n    await claim?.release()\n    return result\n  } catch (error) {\n    await claim?.release()\n    throw error\n  }\n}\n\ntype CopyOutcome =\n  | { ok: true; id: string; versionId: string | null; name: string; sourceName: string }\n  | { ok: false; status: number; error: string }\n\nasync function copy(\n  firestore: FirebaseFirestore.Firestore,\n  kind: DuplicableHostResourceKind,\n  recipe: KindRecipe,\n  options: DuplicateResourceOptions & { sourceId: string },\n): Promise<CopyOutcome> {\n  const { hostId, sourceId, uid } = options\n  const noun = DUPLICABLE_RESOURCE_NOUNS[kind]\n  const hostRef = firestore.collection('hosts').doc(hostId)\n  const collectionRef = hostRef.collection(recipe.collection)\n  const sourceRef = collectionRef.doc(sourceId)\n  const org =\n    options.org ??\n    (((await firestore.collection('orgs').doc(options.orgId).get()).data() ??\n      null) as Record<string, unknown> | null)\n\n  if (recipe.entitlement && !checkEntitlement(org as never, recipe.entitlement)) {\n    return {\n      ok: false,\n      status: 403,\n      error: 'This feature is not included in your plan — see Billing',\n    }\n  }\n\n  const id = createResourceUid()\n  const versionId = recipe.versionParentField ? createResourceUid() : null\n\n  return firestore.runTransaction(async (tx): Promise<CopyOutcome> => {\n    // ALL READS BEFORE ANY WRITE, which Firestore requires. The host is read\n    // inside the transaction rather than passed in because its routing map\n    // is an input to the screen count and is ordinary client-writable.\n    const siblingFields = [\n      recipe.nameField,\n      'slug',\n      'kind',\n      'deletedAt',\n      'source.type',\n    ]\n    const [hostSnapshot, source, siblingsSnapshot] = await Promise.all([\n      tx.get(hostRef),\n      tx.get(sourceRef),\n      tx.get(collectionRef.select(...siblingFields)),\n    ])\n    if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n    if (!source.exists || source.get('deletedAt') != null) {\n      return { ok: false, status: 404, error: `Unknown ${noun}` }\n    }\n    const data = asRecord(source.data())\n\n    // The two screen kinds share a collection and are told apart by `kind`:\n    // an email design copied as a page would land on the Screens list, and\n    // the other way round would put a page on the Emails page.\n    //\n    // Of the screens that are not pages, only a collection's entry template\n    // may be copied as a screen (AGL-3102), and the copy stays a template:\n    // `kind` rides across with the recipe's fields, so it composes nothing\n    // until a collection points at it — which is how a second collection\n    // starts from the first one's design. An error screen is refused:\n    // `kind: 'error'` is the slot assignment's to stamp, because that write\n    // is what bounds how many a site holds, and a copy would stamp one\n    // outside it.\n    const sourceKind = data['kind']\n    const nonPageScreen =\n      recipe.collection === 'screens' &&\n      !screenClaimsToBeAPage({ kind: sourceKind as string })\n    if (recipe.collection === 'screens') {\n      if (kind === 'emailDesign' && sourceKind !== SCREEN_KIND_EMAIL) {\n        return { ok: false, status: 400, error: 'That page is not an email design' }\n      }\n      if (kind === 'screen' && nonPageScreen && sourceKind !== SCREEN_KIND_TEMPLATE) {\n        return {\n          ok: false,\n          status: 400,\n          error: 'Only a page or a collection entry template can be duplicated as a page',\n        }\n      }\n    }\n\n    const siblings: SiblingRow[] = siblingsSnapshot.docs.map((row) => ({\n      id: row.id,\n      name: String(row.get(recipe.nameField) ?? ''),\n      slug: String(row.get('slug') ?? ''),\n      kind: row.get('kind'),\n      deletedAt: row.get('deletedAt'),\n      sourceType: row.get('source.type'),\n    }))\n    const live = siblings.filter((row) => row.deletedAt == null)\n\n    // THE BAND, met inside the transaction (AGL-2231) with the create route's\n    // own arithmetic: screens count what the routing map makes billable,\n    // templates exclude the platform's starters, everything else counts its\n    // live documents. A screen copy that is not a page — an email design or\n    // an entry template — meets the flat platform ceiling on non-page screens\n    // instead, the one an email design's create meets and a demoted template\n    // fills, and never the page band: it spends none of it.\n    const screenRows: BillableScreenSource[] = siblings.map((row) => ({\n      id: row.id,\n      kind: row.kind,\n      deletedAt: row.deletedAt,\n    }))\n    const routingMap = hostSnapshot.get('screens') as never\n    if (nonPageScreen) {\n      if (nonPageScreenIds(screenRows, routingMap).size >= NON_PAGE_SCREEN_MAX_PER_HOST) {\n        return {\n          ok: false,\n          status: 403,\n          error:\n            'This site is at its limit of ' +\n            `${NON_PAGE_SCREEN_MAX_PER_HOST} email designs and template pages — ` +\n            'delete some to make room',\n        }\n      }\n    } else if (recipe.quotaKey) {\n      const used =\n        kind === 'screen'\n          ? billableScreenIds(screenRows, routingMap).size\n          : kind === 'template'\n            ? live.filter((row) => row.sourceType !== 'starter').length\n            : live.length\n      const quota = checkQuota(org as never, recipe.quotaKey as never, used)\n      if (!quota.allowed) {\n        return {\n          ok: false,\n          status: 403,\n          error:\n            `Your plan includes ${quota.limit} ${noun}${quota.limit === 1 ? '' : 's'} — ` +\n            'upgrade in Billing for more',\n        }\n      }\n    }\n\n    // THE NAME AND THE SLUG, unique among the live siblings. A deleted\n    // sibling's name is free: a person who deleted \"Home\" and copies\n    // \"About\" as \"Home\" is not confused by a tombstone.\n    const sourceName = String(data[recipe.nameField] ?? '').trim()\n    const requested = String(options.name ?? '').trim() || duplicateDisplayName(sourceName)\n    const name = uniqueDuplicateName(\n      requested,\n      live.map((row) => row.name),\n    )\n    const slug = recipe.slug\n      ? uniqueDuplicateSlug(\n          data['slug'] as string | undefined,\n          live.map((row) => row.slug),\n        )\n      : undefined\n\n    // THE VERSION: the most recently saved one, else the one the document\n    // points at. Read inside the transaction so the copy is of what was\n    // saved when the count was taken.\n    let versionData: Record<string, unknown> | null = null\n    let sourceVersionNumber: number | null = null\n    if (recipe.versionParentField) {\n      const versionsRef = sourceRef.collection('versions')\n      const [newest, all] = await Promise.all([\n        tx.get(versionsRef.orderBy('updatedAt', 'desc').limit(1)),\n        tx.get(versionsRef.select()),\n      ])\n      let found: FirebaseFirestore.DocumentSnapshot | null = newest.docs[0] ?? null\n      const pointer = String(data['versionId'] ?? '')\n      if (!found && pointer) {\n        const pointed = await tx.get(versionsRef.doc(pointer))\n        if (pointed.exists) found = pointed\n      }\n      if (found) {\n        versionData = asRecord(found.data())\n        sourceVersionNumber = all.size\n      }\n    }\n\n    // THE DOCUMENT: the recipe's fields, the name, the slug, the stamps.\n    const doc: Record<string, unknown> = {}\n    for (const field of recipe.fields) {\n      if (data[field] !== undefined) doc[field] = data[field]\n    }\n    doc[recipe.nameField] = name\n    if (recipe.slug) {\n      if (slug) doc['slug'] = slug\n      else delete doc['slug']\n    }\n    /*\n     * THE FORM'S BINDING, moved onto the copy (AGL-3024).\n     *\n     * A form's design names its own form in a prop, and that name is what\n     * `/api/forms/submit` files a submission under. Copied verbatim it still\n     * names the SOURCE, so the copy renders, collects, and files everything\n     * it collects under the form it was copied from — while its own list\n     * stays empty and nothing anywhere reports an error. `checkFormContract`\n     * is what the console's form page banners it with; `formDesignReboundTo`\n     * is the write side of the same fact.\n     *\n     * This is the one place a copied tree is not carried across untouched,\n     * and the exception is narrow on purpose: no other kind here embeds its\n     * own id in its design. `formDesignReboundTo` answers `null` when there\n     * is nothing to move, so every other kind — and a form whose design is\n     * already correct — pays nothing for this.\n     */\n    const rebound = (raw: unknown): unknown => {\n      if (kind !== 'form') return raw\n      return (\n        formDesignReboundTo(decodeStoredNodes(raw), {\n          formId: id,\n          formName: name,\n        }) ?? raw\n      )\n    }\n    // The stored tree is msgpack at rest; `encodeStoredNodes` passes encoded\n    // bytes through and packs a plain map, so a legacy plain source lands\n    // compressed like every create does — and so does a rebound one, which\n    // comes back decoded.\n    const packed = encodeStoredNodes(rebound(doc['nodes']))\n    if (packed) doc['nodes'] = Buffer.from(packed)\n    tx.create(collectionRef.doc(id), {\n      ...doc,\n      ...(recipe.stamps ?? {}),\n      // The keys the copy's list finds it by (AGL-3321), from the copy's own\n      // name and stamps — see `artifactCreateListKeys`.\n      ...artifactCreateListKeys(recipe.collection, { ...doc, ...(recipe.stamps ?? {}) }),\n      // A copied form starts as a new one does, with its own search keys and\n      // nothing counted (AGL-3330); only the routing it copied is kept.\n      ...(kind === 'form'\n        ? newFormListFields({\n            id,\n            displayName: name,\n            slug: doc['slug'],\n            routing: doc['routing'] as Parameters<typeof newFormListFields>[0]['routing'],\n          })\n        : {}),\n      ...(versionData && versionId ? { versionId } : {}),\n      createdAt: Timestamp.now(),\n      updatedAt: Timestamp.now(),\n      createdBy: uid,\n    })\n    if (versionData && versionId && recipe.versionParentField) {\n      const versionNodes = encodeStoredNodes(rebound(versionData['nodes']))\n      tx.create(collectionRef.doc(id).collection('versions').doc(versionId), {\n        ...versionData,\n        ...(versionNodes ? { nodes: Buffer.from(versionNodes) } : {}),\n        [recipe.versionParentField]: id,\n        hostId,\n        displayName: duplicateVersionNote(sourceName, sourceVersionNumber),\n        createdAt: Timestamp.now(),\n        updatedAt: Timestamp.now(),\n        createdBy: uid,\n      })\n    }\n    return {\n      ok: true,\n      id,\n      versionId: versionData && versionId ? versionId : null,\n      name,\n      sourceName,\n    }\n  })\n}\n"],"names":["artifactCreateListKeys","billableScreenIds","checkEntitlement","checkQuota","claimAttempt","createResourceUid","decodeStoredNodes","encodeStoredNodes","newFormListFields","NON_PAGE_SCREEN_MAX_PER_HOST","nonPageScreenIds","SCREEN_KIND_EMAIL","SCREEN_KIND_TEMPLATE","screenClaimsToBeAPage","DUPLICABLE_RESOURCE_NOUNS","DUPLICATE_BUSY_MESSAGE","duplicateDisplayName","duplicateVersionNote","uniqueDuplicateName","uniqueDuplicateSlug","formDesignReboundTo","pluginHostResource","Timestamp","logResourceDuplicated","firebaseAdmin","RECIPES","screen","collection","nameField","fields","versionParentField","quotaKey","slug","emailDesign","component","entitlement","layout","template","stamps","source","type","form","recipeFor","kind","Object","prototype","hasOwnProperty","call","declared","duplicate","asRecord","value","Array","isArray","duplicateResource","options","recipe","noun","ok","status","error","sourceId","String","trim","slice","firestore","app","attemptKey","claimed","scopeId","hostId","orgId","key","busyMessage","replay","body","claim","result","copy","uid","email","id","name","sourceName","target","versionId","answer","record","release","hostRef","doc","collectionRef","sourceRef","org","get","data","runTransaction","tx","siblingFields","hostSnapshot","siblingsSnapshot","Promise","all","select","exists","sourceKind","nonPageScreen","siblings","docs","map","row","deletedAt","sourceType","live","filter","screenRows","routingMap","size","used","length","quota","allowed","limit","requested","undefined","versionData","sourceVersionNumber","newest","versionsRef","orderBy","found","pointer","pointed","field","rebound","raw","formId","formName","packed","Buffer","from","create","displayName","routing","createdAt","now","updatedAt","createdBy","versionNodes","nodes"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDC,GAED,uEAAuE;AACvE,qEAAqE;AACrE,oCAAoC;AACpC,SAASA,sBAAsB,QAAQ,4CAA2C;AAClF,SACEC,iBAAiB,EACjBC,gBAAgB,EAChBC,UAAU,EACVC,YAAY,EACZC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,EACjBC,4BAA4B,EAC5BC,gBAAgB,EAChBC,iBAAiB,EACjBC,oBAAoB,EACpBC,qBAAqB,QAIhB,sBAAqB;AAC5B,SACEC,yBAAyB,EACzBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACpBC,mBAAmB,EACnBC,mBAAmB,QAEd,4CAA2C;AAClD,SAASC,mBAAmB,QAAQ,+BAA8B;AAClE,SAASC,kBAAkB,QAAQ,oDAAmD;AACtF,SAASC,SAAS,QAAQ,2BAA0B;AACpD,SAASC,qBAAqB,QAAQ,0BAAsB;AAC5D,OAAOC,mBAAmB,sBAAkB;AAqB5C;;;;;;;;;;;;CAYC,GACD,MAAMC,UAAmE;IACvEC,QAAQ;QACNC,YAAY;QACZC,WAAW;QACXC,QAAQ;YACN;YACA;YACA;YACA;YACA;YACA;YACA,uEAAuE;YACvE,iEAAiE;YACjE;SACD;QACDC,oBAAoB;QACpBC,UAAU;QACVC,MAAM;IACR;IACA,qEAAqE;IACrE,wEAAwE;IACxEC,aAAa;QACXN,YAAY;QACZC,WAAW;QACXC,QAAQ;YAAC;YAAe;SAAO;QAC/BC,oBAAoB;IACtB;IACAI,WAAW;QACTP,YAAY;QACZC,WAAW;QACX,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrEC,QAAQ;YAAC;YAAe;YAAQ;YAAU;YAAS;YAAS;SAAO;QACnEC,oBAAoB;QACpBK,aAAa;IACf;IACAC,QAAQ;QACNT,YAAY;QACZC,WAAW;QACXC,QAAQ;YAAC;SAAc;QACvBC,oBAAoB;QACpBC,UAAU;IACZ;IACAM,UAAU;QACRV,YAAY;QACZC,WAAW;QACXC,QAAQ;YACN;YACA,oEAAoE;YACpE,kEAAkE;YAClE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QACDE,UAAU;QACVO,QAAQ;YAAEC,QAAQ;gBAAEC,MAAM;YAAW;QAAE;IACzC;IACAC,MAAM;QACJd,YAAY;QACZC,WAAW;QACXC,QAAQ;YACN;YACA;YACA;YACA;YACA;YACA;SACD;QACDC,oBAAoB;QACpBC,UAAU;QACVI,aAAa;QACbH,MAAM;IACR;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASU,UAAUC,IAAY;IACpC,IAAIC,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACtB,SAASkB,OAAO;YAChDlB;QAAP,QAAOA,gBAAAA,OAAO,CAACkB,KAAmC,YAA3ClB,gBAA+C;IACxD;IACA,MAAMuB,WAAW3B,mBAAmBsB;IACpC,IAAI,EAACK,4BAAAA,SAAUC,SAAS,GAAE,OAAO;IACjC,OAAO;QACLtB,YAAYqB,SAASrB,UAAU;QAC/BC,WAAWoB,SAASC,SAAS,CAACrB,SAAS;QACvCC,QAAQmB,SAASC,SAAS,CAACpB,MAAM;OAC7BmB,SAASjB,QAAQ,GACjB;QAAEA,UAAUiB,SAASjB,QAAQ;IAAmC,IAChE,CAAC,GACDiB,SAASb,WAAW,GACpB;QAAEA,aAAaa,SAASb,WAAW;IAA0B,IAC7D,CAAC,GACDa,SAASC,SAAS,CAACX,MAAM,GAAG;QAAEA,QAAQU,SAASC,SAAS,CAACX,MAAM;IAAC,IAAI,CAAC;AAE7E;AA6CA,MAAMY,WAAW,CAACC,QAChBA,SAAS,OAAOA,UAAU,YAAY,CAACC,MAAMC,OAAO,CAACF,SAChDA,QACD,CAAC;AAEP;;;CAGC,GACD,OAAO,eAAeG,kBACpBX,IAAgC,EAChCY,OAAiC;QAKTA,mBAIEA;IAP1B,MAAMC,SAASd,UAAUC;IACzB,MAAMc,OAAO3C,yBAAyB,CAAC6B,KAAK;IAC5C,IAAI,CAACa,QAAQ,OAAO;QAAEE,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAqC;IAC1F,MAAMC,WAAWC,QAAOP,oBAAAA,QAAQM,QAAQ,YAAhBN,oBAAoB,IAAIQ,IAAI,GAAGC,KAAK,CAAC,GAAG;IAChE,IAAI,CAACH,UAAU,OAAO;QAAEH,IAAI;QAAOC,QAAQ;QAAKC,OAAO,CAAC,YAAY,EAAEH,KAAK,QAAQ,CAAC;IAAC;IACrF,MAAMQ,YAAYzC,cAAc0C,GAAG,GAAGD,SAAS;IAE/C,MAAME,aAAaL,QAAOP,sBAAAA,QAAQY,UAAU,YAAlBZ,sBAAsB,IAAIQ,IAAI,GAAGC,KAAK,CAAC,GAAG;IACpE,MAAMI,UAAUD,aACZ,MAAM/D,aAAa6D,WAAoB;QACrCtB,MAAM,CAAC,UAAU,EAAEA,MAAM;QACzB0B,SAAS,GAAGd,QAAQe,MAAM,CAAC,CAAC,EAAET,UAAU;QACxCU,OAAOhB,QAAQgB,KAAK;QACpBC,KAAKL;QACLM,aAAa1D;IACf,KACA;IACJ,IAAIqD,WAAW,YAAYA,SAAS;QAClC,OAAOA,QAAQM,MAAM,CAACC,IAAI;IAC5B;IACA,MAAMC,QAAQR,WAAW,WAAWA,UAAUA,QAAQQ,KAAK,GAAG;IAE9D,IAAI;QACF,MAAMC,SAAS,MAAMC,KAAKb,WAAWtB,MAAMa,QAAQ,aAAKD;YAASM;;QACjE,IAAIgB,OAAOnB,EAAE,EAAE;gBAGgBH;YAF7B,MAAMhC,sBACJoB,MACA;gBAAEoC,KAAKxB,QAAQwB,GAAG;gBAAEC,KAAK,GAAEzB,iBAAAA,QAAQyB,KAAK,YAAbzB,iBAAiB;YAAK,GACjD;gBACEgB,OAAOhB,QAAQgB,KAAK;gBACpBD,QAAQf,QAAQe,MAAM;gBACtB/B,QAAQ;oBAAE0C,IAAIpB;oBAAUqB,MAAML,OAAOM,UAAU;gBAAC;gBAChDC,QAAQ;oBAAEH,IAAIJ,OAAOI,EAAE;oBAAEC,MAAML,OAAOK,IAAI;oBAAEG,WAAWR,OAAOQ,SAAS;gBAAC;YAC1E;YAEF,MAAMC,SAAkC;gBACtC5B,IAAI;gBACJuB,IAAIJ,OAAOI,EAAE;gBACbI,WAAWR,OAAOQ,SAAS;gBAC3BH,MAAML,OAAOK,IAAI;YACnB;YACA,OAAMN,yBAAAA,MAAOW,MAAM,CAAC,KAAKD;YACzB,OAAOA;QACT;QACA,yEAAyE;QACzE,0DAA0D;QAC1D,OAAMV,yBAAAA,MAAOY,OAAO;QACpB,OAAOX;IACT,EAAE,OAAOjB,OAAO;QACd,OAAMgB,yBAAAA,MAAOY,OAAO;QACpB,MAAM5B;IACR;AACF;AAMA,eAAekB,KACbb,SAAsC,EACtCtB,IAAgC,EAChCa,MAAkB,EAClBD,OAAwD;QAQtDA,cACE;IAPJ,MAAM,EAAEe,MAAM,EAAET,QAAQ,EAAEkB,GAAG,EAAE,GAAGxB;IAClC,MAAME,OAAO3C,yBAAyB,CAAC6B,KAAK;IAC5C,MAAM8C,UAAUxB,UAAUtC,UAAU,CAAC,SAAS+D,GAAG,CAACpB;IAClD,MAAMqB,gBAAgBF,QAAQ9D,UAAU,CAAC6B,OAAO7B,UAAU;IAC1D,MAAMiE,YAAYD,cAAcD,GAAG,CAAC7B;IACpC,MAAMgC,OACJtC,eAAAA,QAAQsC,GAAG,YAAXtC,gBACE,QAAA,AAAC,CAAA,MAAMU,UAAUtC,UAAU,CAAC,QAAQ+D,GAAG,CAACnC,QAAQgB,KAAK,EAAEuB,GAAG,EAAC,EAAGC,IAAI,cAAlE,QACA;IAEJ,IAAIvC,OAAOrB,WAAW,IAAI,CAACjC,iBAAiB2F,KAAcrC,OAAOrB,WAAW,GAAG;QAC7E,OAAO;YACLuB,IAAI;YACJC,QAAQ;YACRC,OAAO;QACT;IACF;IAEA,MAAMqB,KAAK5E;IACX,MAAMgF,YAAY7B,OAAO1B,kBAAkB,GAAGzB,sBAAsB;IAEpE,OAAO4D,UAAU+B,cAAc,CAAC,OAAOC;YA2GXF,wBACDxC,eA+EnBC,gBAGuDA;QA7L7D,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM0C,gBAAgB;YACpB1C,OAAO5B,SAAS;YAChB;YACA;YACA;YACA;SACD;QACD,MAAM,CAACuE,cAAc5D,QAAQ6D,iBAAiB,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACjEL,GAAGH,GAAG,CAACL;YACPQ,GAAGH,GAAG,CAACF;YACPK,GAAGH,GAAG,CAACH,cAAcY,MAAM,IAAIL;SAChC;QACD,IAAI,CAACC,aAAaK,MAAM,EAAE,OAAO;YAAE9C,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAe;QACjF,IAAI,CAACrB,OAAOiE,MAAM,IAAIjE,OAAOuD,GAAG,CAAC,gBAAgB,MAAM;YACrD,OAAO;gBAAEpC,IAAI;gBAAOC,QAAQ;gBAAKC,OAAO,CAAC,QAAQ,EAAEH,MAAM;YAAC;QAC5D;QACA,MAAMsC,OAAO7C,SAASX,OAAOwD,IAAI;QAEjC,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;QACnE,cAAc;QACd,MAAMU,aAAaV,IAAI,CAAC,OAAO;QAC/B,MAAMW,gBACJlD,OAAO7B,UAAU,KAAK,aACtB,CAACd,sBAAsB;YAAE8B,MAAM8D;QAAqB;QACtD,IAAIjD,OAAO7B,UAAU,KAAK,WAAW;YACnC,IAAIgB,SAAS,iBAAiB8D,eAAe9F,mBAAmB;gBAC9D,OAAO;oBAAE+C,IAAI;oBAAOC,QAAQ;oBAAKC,OAAO;gBAAmC;YAC7E;YACA,IAAIjB,SAAS,YAAY+D,iBAAiBD,eAAe7F,sBAAsB;gBAC7E,OAAO;oBACL8C,IAAI;oBACJC,QAAQ;oBACRC,OAAO;gBACT;YACF;QACF;QAEA,MAAM+C,WAAyBP,iBAAiBQ,IAAI,CAACC,GAAG,CAAC,CAACC;gBAE3CA,UACAA;mBAHoD;gBACjE7B,IAAI6B,IAAI7B,EAAE;gBACVC,MAAMpB,QAAOgD,WAAAA,IAAIhB,GAAG,CAACtC,OAAO5B,SAAS,aAAxBkF,WAA6B;gBAC1C9E,MAAM8B,QAAOgD,YAAAA,IAAIhB,GAAG,CAAC,mBAARgB,YAAmB;gBAChCnE,MAAMmE,IAAIhB,GAAG,CAAC;gBACdiB,WAAWD,IAAIhB,GAAG,CAAC;gBACnBkB,YAAYF,IAAIhB,GAAG,CAAC;YACtB;;QACA,MAAMmB,OAAON,SAASO,MAAM,CAAC,CAACJ,MAAQA,IAAIC,SAAS,IAAI;QAEvD,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,wDAAwD;QACxD,MAAMI,aAAqCR,SAASE,GAAG,CAAC,CAACC,MAAS,CAAA;gBAChE7B,IAAI6B,IAAI7B,EAAE;gBACVtC,MAAMmE,IAAInE,IAAI;gBACdoE,WAAWD,IAAIC,SAAS;YAC1B,CAAA;QACA,MAAMK,aAAajB,aAAaL,GAAG,CAAC;QACpC,IAAIY,eAAe;YACjB,IAAIhG,iBAAiByG,YAAYC,YAAYC,IAAI,IAAI5G,8BAA8B;gBACjF,OAAO;oBACLiD,IAAI;oBACJC,QAAQ;oBACRC,OACE,kCACA,GAAGnD,6BAA6B,oCAAoC,CAAC,GACrE;gBACJ;YACF;QACF,OAAO,IAAI+C,OAAOzB,QAAQ,EAAE;YAC1B,MAAMuF,OACJ3E,SAAS,WACL1C,kBAAkBkH,YAAYC,YAAYC,IAAI,GAC9C1E,SAAS,aACPsE,KAAKC,MAAM,CAAC,CAACJ,MAAQA,IAAIE,UAAU,KAAK,WAAWO,MAAM,GACzDN,KAAKM,MAAM;YACnB,MAAMC,QAAQrH,WAAW0F,KAAcrC,OAAOzB,QAAQ,EAAWuF;YACjE,IAAI,CAACE,MAAMC,OAAO,EAAE;gBAClB,OAAO;oBACL/D,IAAI;oBACJC,QAAQ;oBACRC,OACE,CAAC,mBAAmB,EAAE4D,MAAME,KAAK,CAAC,CAAC,EAAEjE,OAAO+D,MAAME,KAAK,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC,GAC7E;gBACJ;YACF;QACF;QAEA,mEAAmE;QACnE,iEAAiE;QACjE,oDAAoD;QACpD,MAAMvC,aAAarB,QAAOiC,yBAAAA,IAAI,CAACvC,OAAO5B,SAAS,CAAC,YAAtBmE,yBAA0B,IAAIhC,IAAI;QAC5D,MAAM4D,YAAY7D,QAAOP,gBAAAA,QAAQ2B,IAAI,YAAZ3B,gBAAgB,IAAIQ,IAAI,MAAM/C,qBAAqBmE;QAC5E,MAAMD,OAAOhE,oBACXyG,WACAV,KAAKJ,GAAG,CAAC,CAACC,MAAQA,IAAI5B,IAAI;QAE5B,MAAMlD,OAAOwB,OAAOxB,IAAI,GACpBb,oBACE4E,IAAI,CAAC,OAAO,EACZkB,KAAKJ,GAAG,CAAC,CAACC,MAAQA,IAAI9E,IAAI,KAE5B4F;QAEJ,sEAAsE;QACtE,oEAAoE;QACpE,kCAAkC;QAClC,IAAIC,cAA8C;QAClD,IAAIC,sBAAqC;QACzC,IAAItE,OAAO1B,kBAAkB,EAAE;gBAM0BiG,eAChChC;YANvB,MAAMiC,cAAcpC,UAAUjE,UAAU,CAAC;YACzC,MAAM,CAACoG,QAAQzB,IAAI,GAAG,MAAMD,QAAQC,GAAG,CAAC;gBACtCL,GAAGH,GAAG,CAACkC,YAAYC,OAAO,CAAC,aAAa,QAAQP,KAAK,CAAC;gBACtDzB,GAAGH,GAAG,CAACkC,YAAYzB,MAAM;aAC1B;YACD,IAAI2B,SAAmDH,gBAAAA,OAAOnB,IAAI,CAAC,EAAE,YAAdmB,gBAAkB;YACzE,MAAMI,UAAUrE,QAAOiC,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB;YAC5C,IAAI,CAACmC,SAASC,SAAS;gBACrB,MAAMC,UAAU,MAAMnC,GAAGH,GAAG,CAACkC,YAAYtC,GAAG,CAACyC;gBAC7C,IAAIC,QAAQ5B,MAAM,EAAE0B,QAAQE;YAC9B;YACA,IAAIF,OAAO;gBACTL,cAAc3E,SAASgF,MAAMnC,IAAI;gBACjC+B,sBAAsBxB,IAAIe,IAAI;YAChC;QACF;QAEA,qEAAqE;QACrE,MAAM3B,MAA+B,CAAC;QACtC,KAAK,MAAM2C,SAAS7E,OAAO3B,MAAM,CAAE;YACjC,IAAIkE,IAAI,CAACsC,MAAM,KAAKT,WAAWlC,GAAG,CAAC2C,MAAM,GAAGtC,IAAI,CAACsC,MAAM;QACzD;QACA3C,GAAG,CAAClC,OAAO5B,SAAS,CAAC,GAAGsD;QACxB,IAAI1B,OAAOxB,IAAI,EAAE;YACf,IAAIA,MAAM0D,GAAG,CAAC,OAAO,GAAG1D;iBACnB,OAAO0D,GAAG,CAAC,OAAO;QACzB;QACA;;;;;;;;;;;;;;;;KAgBC,GACD,MAAM4C,UAAU,CAACC;gBAGbnH;YAFF,IAAIuB,SAAS,QAAQ,OAAO4F;YAC5B,QACEnH,uBAAAA,oBAAoBd,kBAAkBiI,MAAM;gBAC1CC,QAAQvD;gBACRwD,UAAUvD;YACZ,cAHA9D,uBAGMmH;QAEV;QACA,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,sBAAsB;QACtB,MAAMG,SAASnI,kBAAkB+H,QAAQ5C,GAAG,CAAC,QAAQ;QACrD,IAAIgD,QAAQhD,GAAG,CAAC,QAAQ,GAAGiD,OAAOC,IAAI,CAACF;QACvCzC,GAAG4C,MAAM,CAAClD,cAAcD,GAAG,CAACT,KAAK,aAC5BS,MACClC,iBAAAA,OAAOlB,MAAM,YAAbkB,iBAAiB,CAAC,GAGnBxD,uBAAuBwD,OAAO7B,UAAU,EAAE,aAAK+D,MAASlC,kBAAAA,OAAOlB,MAAM,YAAbkB,kBAAiB,CAAC,KAGzEb,SAAS,SACTnC,kBAAkB;YAChByE;YACA6D,aAAa5D;YACblD,MAAM0D,GAAG,CAAC,OAAO;YACjBqD,SAASrD,GAAG,CAAC,UAAU;QACzB,KACA,CAAC,GACDmC,eAAexC,YAAY;YAAEA;QAAU,IAAI,CAAC;YAChD2D,WAAW1H,UAAU2H,GAAG;YACxBC,WAAW5H,UAAU2H,GAAG;YACxBE,WAAWpE;;QAEb,IAAI8C,eAAexC,aAAa7B,OAAO1B,kBAAkB,EAAE;YACzD,MAAMsH,eAAe7I,kBAAkB+H,QAAQT,WAAW,CAAC,QAAQ;YACnE5B,GAAG4C,MAAM,CAAClD,cAAcD,GAAG,CAACT,IAAItD,UAAU,CAAC,YAAY+D,GAAG,CAACL,YAAY,aAClEwC,aACCuB,eAAe;gBAAEC,OAAOV,OAAOC,IAAI,CAACQ;YAAc,IAAI,CAAC;gBAC3D,CAAC5F,OAAO1B,kBAAkB,CAAC,EAAEmD;gBAC7BX;gBACAwE,aAAa7H,qBAAqBkE,YAAY2C;gBAC9CkB,WAAW1H,UAAU2H,GAAG;gBACxBC,WAAW5H,UAAU2H,GAAG;gBACxBE,WAAWpE;;QAEf;QACA,OAAO;YACLrB,IAAI;YACJuB;YACAI,WAAWwC,eAAexC,YAAYA,YAAY;YAClDH;YACAC;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/duplicate-resource.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Duplicating a site resource whole, as a draft (AGL-2936).\n *\n * One module for every kind that lives under a site — screens and email\n * designs, reusable components, layouts, templates and forms, and the kinds\n * a plugin declares a copy for (a workflow) — so the console route, the AI\n * runtime's `duplicate_resource` tool and any later door make the same copy:\n * the same fields, the same uniqueness\n * rules, the same band arithmetic, the same activity rows. A caller that\n * has verified who is asking and that they may write the site hands over\n * the ids and gets back the copy's id, or a refusal it can answer with.\n *\n * WHAT MAKES THE COPY A DRAFT is different per kind, and each is the\n * omission of exactly one thing the create paths would otherwise do:\n *\n *   - a screen is reachable only through the host's routing map, so the\n *     copy gets no entry there — it has a slug of its own (`-copy`) but no\n *     address until somebody publishes it;\n *   - a collection's entry template renders only for the collection that\n *     points at it, and nothing points at the copy;\n *   - a layout, component or form is served only where a page places it,\n *     and nothing places the copy;\n *   - a declared kind drops what its plugin says a copy must not carry —\n *     a workflow's trigger is cleared, so the copy runs nothing;\n *   - a template is inert until it is used.\n *\n * COUNTED LIKE A CREATE. The copy is one more document in a collection the\n * plan bands, so it meets the same counter the create route meets — for a\n * screen that is not a page, the flat platform ceiling rather than a band —\n * and meets it INSIDE the transaction that writes the copy (AGL-2231): a count\n * taken before the write is a count N concurrent copies all pass. The\n * siblings are read once and answer three questions — the count, the name\n * the copy may take, and the slug — because three reads of one collection\n * is the reason a route and its readout come to disagree.\n *\n * THE VERSION TRAVELS WITH THE DOCUMENT. A besigner resource is opened by\n * its version, so the copy of a screen with no version is a screen nobody\n * can open. The source's most recently saved version is copied into the\n * copy's own `versions` as its first — no `versioning` entitlement is\n * owed for a first version — with its stored node bytes carried across\n * untouched: they are msgpack at rest, and re-encoding them is the\n * double-encode `encodeStoredNodes` exists to avoid.\n *\n * THE ONE TREE THAT IS REWRITTEN is a form's (AGL-3024). A form's design\n * names its own form inside itself, so carrying those bytes across hands the\n * copy a design that files every submission under the SOURCE — silently,\n * because the copy still renders and the row still lands. That binding is\n * moved onto the copy below. No other kind embeds its own id in its design,\n * so no other kind is decoded.\n */\n\n// The leaf module, not the server barrel: specs stage that barrel as a\n// closed world, and the list keys every create stamps (AGL-3321) are\n// nothing they have reason to name.\nimport { artifactCreateListKeys } from '@aglyn/aglyn/app-utils/artifact-list-keys'\nimport {\n  billableScreenIds,\n  checkEntitlement,\n  checkQuota,\n  claimAttempt,\n  createResourceUid,\n  decodeStoredNodes,\n  encodeStoredNodes,\n  newFormListFields,\n  NON_PAGE_SCREEN_MAX_PER_HOST,\n  nonPageScreenIds,\n  SCREEN_KIND_EMAIL,\n  SCREEN_KIND_TEMPLATE,\n  screenClaimsToBeAPage,\n  type BillableScreenSource,\n  type OrgEntitlements,\n  type OrgFeatureFlags,\n} from '@aglyn/aglyn/server'\nimport {\n  DUPLICABLE_RESOURCE_NOUNS,\n  DUPLICATE_BUSY_MESSAGE,\n  duplicateDisplayName,\n  duplicateVersionNote,\n  uniqueDuplicateName,\n  uniqueDuplicateSlug,\n  type DuplicableHostResourceKind,\n} from '@aglyn/aglyn/app-utils/duplicate-resource'\nimport { formDesignReboundTo } from '@aglyn/aglyn/app-utils/forms'\nimport { pluginHostResource } from '@aglyn/aglyn/plugin-manager/plugin-host-resources'\nimport { Timestamp } from 'firebase-admin/firestore'\nimport { logResourceDuplicated } from './duplicate-activity'\nimport firebaseAdmin from './firebase-admin'\n\n/** How the copy of each kind is made. */\ninterface KindRecipe {\n  collection: string\n  /** The field the name lives in — `displayName` on core's kinds; a declared kind names its own. */\n  nameField: string\n  /** The source fields carried onto the copy; everything else stays behind. */\n  fields: readonly string[]\n  /** The back-pointer a copied version carries, when the kind versions at all. */\n  versionParentField?: 'screenId' | 'layoutId' | 'componentId' | 'formId'\n  /** The plan counter the copy is charged to. */\n  quotaKey?: keyof OrgEntitlements & string\n  /** The feature the plan must include for the kind to exist at all. */\n  entitlement?: keyof OrgFeatureFlags\n  /** Whether a `slug` on the source becomes a unique `-copy` slug. */\n  slug?: boolean\n  /** What the copy carries beyond the source's fields. */\n  stamps?: Readonly<Record<string, unknown>>\n}\n\n/**\n * Per kind, the same fields the create route's allow-list admits, less the\n * ones a copy must not inherit: a screen's `versionId` (the copy mints its\n * own), a template's `source` (stamped `authored` below — a copy of a\n * marketplace template is the customer's own), and anything the server\n * stamps on every create.\n *\n * The platform's own kinds only. A kind a plugin owns — a workflow, whose\n * copy clears its trigger so it runs nothing until armed — is declared by\n * that plugin beside its collection in `plugins.config.json` and read by\n * {@link recipeFor} (AGL-3080), compiled so a copy never depends on this\n * process having loaded the plugin.\n */\nconst RECIPES: Partial<Record<DuplicableHostResourceKind, KindRecipe>> = {\n  screen: {\n    collection: 'screens',\n    nameField: 'displayName',\n    fields: [\n      'description',\n      'seo',\n      'kind',\n      'visibility',\n      'locale',\n      'protection',\n      // The shared-layout binding. A version inherits it from its screen, so\n      // a copy without it renders with no header or footer (AGL-3120).\n      'layoutId',\n    ],\n    versionParentField: 'screenId',\n    quotaKey: 'screensPerHost',\n    slug: true,\n  },\n  // No `quotaKey`: an email design is not a page, so it meets the flat\n  // platform ceiling on non-page screens below rather than the page band.\n  emailDesign: {\n    collection: 'screens',\n    nameField: 'displayName',\n    fields: ['description', 'kind'],\n    versionParentField: 'screenId',\n  },\n  component: {\n    collection: 'components',\n    nameField: 'displayName',\n    // `kind` keeps an email block an email block (AGL-3287): without it the\n    // copy reads as a page component, leaves every email editor's palette,\n    // and turns up in page editors where its email blocks cannot render.\n    fields: ['description', 'icon', 'rootId', 'nodes', 'props', 'kind'],\n    versionParentField: 'componentId',\n    entitlement: 'reusableComponents',\n  },\n  layout: {\n    collection: 'layouts',\n    nameField: 'displayName',\n    fields: ['description'],\n    versionParentField: 'layoutId',\n    quotaKey: 'sharedLayoutsPerHost',\n  },\n  template: {\n    collection: 'templates',\n    nameField: 'displayName',\n    fields: [\n      'kind',\n      // A component template's own kind — email block or page component —\n      // so Use template on a copy still makes the right one (AGL-3287).\n      'componentKind',\n      'description',\n      'category',\n      'placeholders',\n      'nodes',\n      'rootId',\n      'props',\n      'slug',\n      'seo',\n      'theme',\n    ],\n    quotaKey: 'templatesPerHost',\n    stamps: { source: { type: 'authored' } },\n  },\n  form: {\n    collection: 'forms',\n    nameField: 'displayName',\n    fields: [\n      'fields',\n      'consentFieldName',\n      'routing',\n      'legacyMatch',\n      'rootId',\n      'nodes',\n    ],\n    versionParentField: 'formId',\n    // Counted only: a saved form is not behind `reusableComponents`, the same\n    // as its create at `/api/hosts/resources` (AGL-3597).\n    quotaKey: 'formsPerHost',\n    slug: true,\n  },\n}\n\n/**\n * The recipe for a kind: core's own, else the one its plugin declared, else\n * `null` — which is refused, never guessed at. A declared copy is met against\n * the same plan counter and feature as the kind's create.\n */\nexport function recipeFor(kind: string): KindRecipe | null {\n  if (Object.prototype.hasOwnProperty.call(RECIPES, kind)) {\n    return RECIPES[kind as DuplicableHostResourceKind] ?? null\n  }\n  const declared = pluginHostResource(kind)\n  if (!declared?.duplicate) return null\n  return {\n    collection: declared.collection,\n    nameField: declared.duplicate.nameField,\n    fields: declared.duplicate.fields,\n    ...(declared.quotaKey\n      ? { quotaKey: declared.quotaKey as keyof OrgEntitlements & string }\n      : {}),\n    ...(declared.entitlement\n      ? { entitlement: declared.entitlement as keyof OrgFeatureFlags }\n      : {}),\n    ...(declared.duplicate.stamps ? { stamps: declared.duplicate.stamps } : {}),\n  }\n}\n\nexport interface DuplicateResourceOptions {\n  orgId: string\n  hostId: string\n  sourceId: string\n  /** The name the copy takes; blank means `Copy of <source>`. */\n  name?: string | null\n  /** The verified person making the copy. */\n  uid: string\n  email?: string | null\n  /**\n   * The owning org's document, when the caller already holds it; read\n   * here otherwise. The bands are resolved from it.\n   */\n  org?: Record<string, unknown> | null\n  /**\n   * A client-minted key for this attempt, so a double click makes one copy\n   * and a retry of a finished attempt answers what the first did. A caller\n   * with no client behind it — the AI runtime — sends none and is not\n   * claimed.\n   */\n  attemptKey?: string | null\n}\n\nexport type DuplicateResourceResult =\n  | {\n      ok: true\n      id: string\n      /** The copy's first version, for the kinds that version. */\n      versionId: string | null\n      name: string\n    }\n  | { ok: false; status: number; error: string }\n\n/** What a sibling contributes to the three answers the siblings give. */\ninterface SiblingRow {\n  id: string\n  name: string\n  slug: string\n  kind: unknown\n  deletedAt: unknown\n  sourceType: unknown\n}\n\nconst asRecord = (value: unknown): Record<string, unknown> =>\n  value && typeof value === 'object' && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : {}\n\n/**\n * Makes the copy. The caller has authenticated `uid` and verified that they\n * may write content on `hostId`; this decides everything after that.\n */\nexport async function duplicateResource(\n  kind: DuplicableHostResourceKind,\n  options: DuplicateResourceOptions,\n): Promise<DuplicateResourceResult> {\n  const recipe = recipeFor(kind)\n  const noun = DUPLICABLE_RESOURCE_NOUNS[kind]\n  if (!recipe) return { ok: false, status: 400, error: 'That resource cannot be duplicated' }\n  const sourceId = String(options.sourceId ?? '').trim().slice(0, 64)\n  if (!sourceId) return { ok: false, status: 400, error: `Missing the ${noun} to copy` }\n  const firestore = firebaseAdmin.app().firestore()\n\n  const attemptKey = String(options.attemptKey ?? '').trim().slice(0, 200)\n  const claimed = attemptKey\n    ? await claimAttempt(firestore as never, {\n        kind: `duplicate-${kind}`,\n        scopeId: `${options.hostId}:${sourceId}`,\n        orgId: options.orgId,\n        key: attemptKey,\n        busyMessage: DUPLICATE_BUSY_MESSAGE,\n      })\n    : null\n  if (claimed && 'replay' in claimed) {\n    return claimed.replay.body as DuplicateResourceResult\n  }\n  const claim = claimed && 'claim' in claimed ? claimed.claim : null\n\n  try {\n    const result = await copy(firestore, kind, recipe, { ...options, sourceId })\n    if (result.ok) {\n      await logResourceDuplicated(\n        kind,\n        { uid: options.uid, email: options.email ?? null },\n        {\n          orgId: options.orgId,\n          hostId: options.hostId,\n          source: { id: sourceId, name: result.sourceName },\n          target: { id: result.id, name: result.name, versionId: result.versionId },\n        },\n      )\n      const answer: DuplicateResourceResult = {\n        ok: true,\n        id: result.id,\n        versionId: result.versionId,\n        name: result.name,\n      }\n      await claim?.record(200, answer)\n      return answer\n    }\n    // A refusal releases the key: the person fixes the cause — frees a slot,\n    // picks another name — and presses the same button again.\n    await claim?.release()\n    return result\n  } catch (error) {\n    await claim?.release()\n    throw error\n  }\n}\n\ntype CopyOutcome =\n  | { ok: true; id: string; versionId: string | null; name: string; sourceName: string }\n  | { ok: false; status: number; error: string }\n\nasync function copy(\n  firestore: FirebaseFirestore.Firestore,\n  kind: DuplicableHostResourceKind,\n  recipe: KindRecipe,\n  options: DuplicateResourceOptions & { sourceId: string },\n): Promise<CopyOutcome> {\n  const { hostId, sourceId, uid } = options\n  const noun = DUPLICABLE_RESOURCE_NOUNS[kind]\n  const hostRef = firestore.collection('hosts').doc(hostId)\n  const collectionRef = hostRef.collection(recipe.collection)\n  const sourceRef = collectionRef.doc(sourceId)\n  const org =\n    options.org ??\n    (((await firestore.collection('orgs').doc(options.orgId).get()).data() ??\n      null) as Record<string, unknown> | null)\n\n  if (recipe.entitlement && !checkEntitlement(org as never, recipe.entitlement)) {\n    return {\n      ok: false,\n      status: 403,\n      error: 'This feature is not included in your plan — see Billing',\n    }\n  }\n\n  const id = createResourceUid()\n  const versionId = recipe.versionParentField ? createResourceUid() : null\n\n  return firestore.runTransaction(async (tx): Promise<CopyOutcome> => {\n    // ALL READS BEFORE ANY WRITE, which Firestore requires. The host is read\n    // inside the transaction rather than passed in because its routing map\n    // is an input to the screen count and is ordinary client-writable.\n    const siblingFields = [\n      recipe.nameField,\n      'slug',\n      'kind',\n      'deletedAt',\n      'source.type',\n    ]\n    const [hostSnapshot, source, siblingsSnapshot] = await Promise.all([\n      tx.get(hostRef),\n      tx.get(sourceRef),\n      tx.get(collectionRef.select(...siblingFields)),\n    ])\n    if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n    if (!source.exists || source.get('deletedAt') != null) {\n      return { ok: false, status: 404, error: `Unknown ${noun}` }\n    }\n    const data = asRecord(source.data())\n\n    // The two screen kinds share a collection and are told apart by `kind`:\n    // an email design copied as a page would land on the Screens list, and\n    // the other way round would put a page on the Emails page.\n    //\n    // Of the screens that are not pages, only a collection's entry template\n    // may be copied as a screen (AGL-3102), and the copy stays a template:\n    // `kind` rides across with the recipe's fields, so it composes nothing\n    // until a collection points at it — which is how a second collection\n    // starts from the first one's design. An error screen is refused:\n    // `kind: 'error'` is the slot assignment's to stamp, because that write\n    // is what bounds how many a site holds, and a copy would stamp one\n    // outside it.\n    const sourceKind = data['kind']\n    const nonPageScreen =\n      recipe.collection === 'screens' &&\n      !screenClaimsToBeAPage({ kind: sourceKind as string })\n    if (recipe.collection === 'screens') {\n      if (kind === 'emailDesign' && sourceKind !== SCREEN_KIND_EMAIL) {\n        return { ok: false, status: 400, error: 'That page is not an email design' }\n      }\n      if (kind === 'screen' && nonPageScreen && sourceKind !== SCREEN_KIND_TEMPLATE) {\n        return {\n          ok: false,\n          status: 400,\n          error: 'Only a page or a collection entry template can be duplicated as a page',\n        }\n      }\n    }\n\n    const siblings: SiblingRow[] = siblingsSnapshot.docs.map((row) => ({\n      id: row.id,\n      name: String(row.get(recipe.nameField) ?? ''),\n      slug: String(row.get('slug') ?? ''),\n      kind: row.get('kind'),\n      deletedAt: row.get('deletedAt'),\n      sourceType: row.get('source.type'),\n    }))\n    const live = siblings.filter((row) => row.deletedAt == null)\n\n    // THE BAND, met inside the transaction (AGL-2231) with the create route's\n    // own arithmetic: screens count what the routing map makes billable,\n    // templates exclude the platform's starters, everything else counts its\n    // live documents. A screen copy that is not a page — an email design or\n    // an entry template — meets the flat platform ceiling on non-page screens\n    // instead, the one an email design's create meets and a demoted template\n    // fills, and never the page band: it spends none of it.\n    const screenRows: BillableScreenSource[] = siblings.map((row) => ({\n      id: row.id,\n      kind: row.kind,\n      deletedAt: row.deletedAt,\n    }))\n    const routingMap = hostSnapshot.get('screens') as never\n    if (nonPageScreen) {\n      if (nonPageScreenIds(screenRows, routingMap).size >= NON_PAGE_SCREEN_MAX_PER_HOST) {\n        return {\n          ok: false,\n          status: 403,\n          error:\n            'This site is at its limit of ' +\n            `${NON_PAGE_SCREEN_MAX_PER_HOST} email designs and template pages — ` +\n            'delete some to make room',\n        }\n      }\n    } else if (recipe.quotaKey) {\n      const used =\n        kind === 'screen'\n          ? billableScreenIds(screenRows, routingMap).size\n          : kind === 'template'\n            ? live.filter((row) => row.sourceType !== 'starter').length\n            : live.length\n      const quota = checkQuota(org as never, recipe.quotaKey as never, used)\n      if (!quota.allowed) {\n        return {\n          ok: false,\n          status: 403,\n          error:\n            `Your plan includes ${quota.limit} ${noun}${quota.limit === 1 ? '' : 's'} — ` +\n            'upgrade in Billing for more',\n        }\n      }\n    }\n\n    // THE NAME AND THE SLUG, unique among the live siblings. A deleted\n    // sibling's name is free: a person who deleted \"Home\" and copies\n    // \"About\" as \"Home\" is not confused by a tombstone.\n    const sourceName = String(data[recipe.nameField] ?? '').trim()\n    const requested = String(options.name ?? '').trim() || duplicateDisplayName(sourceName)\n    const name = uniqueDuplicateName(\n      requested,\n      live.map((row) => row.name),\n    )\n    const slug = recipe.slug\n      ? uniqueDuplicateSlug(\n          data['slug'] as string | undefined,\n          live.map((row) => row.slug),\n        )\n      : undefined\n\n    // THE VERSION: the most recently saved one, else the one the document\n    // points at. Read inside the transaction so the copy is of what was\n    // saved when the count was taken.\n    let versionData: Record<string, unknown> | null = null\n    let sourceVersionNumber: number | null = null\n    if (recipe.versionParentField) {\n      const versionsRef = sourceRef.collection('versions')\n      const [newest, all] = await Promise.all([\n        tx.get(versionsRef.orderBy('updatedAt', 'desc').limit(1)),\n        tx.get(versionsRef.select()),\n      ])\n      let found: FirebaseFirestore.DocumentSnapshot | null = newest.docs[0] ?? null\n      const pointer = String(data['versionId'] ?? '')\n      if (!found && pointer) {\n        const pointed = await tx.get(versionsRef.doc(pointer))\n        if (pointed.exists) found = pointed\n      }\n      if (found) {\n        versionData = asRecord(found.data())\n        sourceVersionNumber = all.size\n      }\n    }\n\n    // THE DOCUMENT: the recipe's fields, the name, the slug, the stamps.\n    const doc: Record<string, unknown> = {}\n    for (const field of recipe.fields) {\n      if (data[field] !== undefined) doc[field] = data[field]\n    }\n    doc[recipe.nameField] = name\n    if (recipe.slug) {\n      if (slug) doc['slug'] = slug\n      else delete doc['slug']\n    }\n    /*\n     * THE FORM'S BINDING, moved onto the copy (AGL-3024).\n     *\n     * A form's design names its own form in a prop, and that name is what\n     * `/api/forms/submit` files a submission under. Copied verbatim it still\n     * names the SOURCE, so the copy renders, collects, and files everything\n     * it collects under the form it was copied from — while its own list\n     * stays empty and nothing anywhere reports an error. `checkFormContract`\n     * is what the console's form page banners it with; `formDesignReboundTo`\n     * is the write side of the same fact.\n     *\n     * This is the one place a copied tree is not carried across untouched,\n     * and the exception is narrow on purpose: no other kind here embeds its\n     * own id in its design. `formDesignReboundTo` answers `null` when there\n     * is nothing to move, so every other kind — and a form whose design is\n     * already correct — pays nothing for this.\n     */\n    const rebound = (raw: unknown): unknown => {\n      if (kind !== 'form') return raw\n      return (\n        formDesignReboundTo(decodeStoredNodes(raw), {\n          formId: id,\n          formName: name,\n        }) ?? raw\n      )\n    }\n    // The stored tree is msgpack at rest; `encodeStoredNodes` passes encoded\n    // bytes through and packs a plain map, so a legacy plain source lands\n    // compressed like every create does — and so does a rebound one, which\n    // comes back decoded.\n    const packed = encodeStoredNodes(rebound(doc['nodes']))\n    if (packed) doc['nodes'] = Buffer.from(packed)\n    tx.create(collectionRef.doc(id), {\n      ...doc,\n      ...(recipe.stamps ?? {}),\n      // The keys the copy's list finds it by (AGL-3321), from the copy's own\n      // name and stamps — see `artifactCreateListKeys`.\n      ...artifactCreateListKeys(recipe.collection, { ...doc, ...(recipe.stamps ?? {}) }),\n      // A copied form starts as a new one does, with its own search keys and\n      // nothing counted (AGL-3330); only the routing it copied is kept.\n      ...(kind === 'form'\n        ? newFormListFields({\n            id,\n            displayName: name,\n            slug: doc['slug'],\n            routing: doc['routing'] as Parameters<typeof newFormListFields>[0]['routing'],\n          })\n        : {}),\n      ...(versionData && versionId ? { versionId } : {}),\n      createdAt: Timestamp.now(),\n      updatedAt: Timestamp.now(),\n      createdBy: uid,\n    })\n    if (versionData && versionId && recipe.versionParentField) {\n      const versionNodes = encodeStoredNodes(rebound(versionData['nodes']))\n      tx.create(collectionRef.doc(id).collection('versions').doc(versionId), {\n        ...versionData,\n        ...(versionNodes ? { nodes: Buffer.from(versionNodes) } : {}),\n        [recipe.versionParentField]: id,\n        hostId,\n        displayName: duplicateVersionNote(sourceName, sourceVersionNumber),\n        createdAt: Timestamp.now(),\n        updatedAt: Timestamp.now(),\n        createdBy: uid,\n      })\n    }\n    return {\n      ok: true,\n      id,\n      versionId: versionData && versionId ? versionId : null,\n      name,\n      sourceName,\n    }\n  })\n}\n"],"names":["artifactCreateListKeys","billableScreenIds","checkEntitlement","checkQuota","claimAttempt","createResourceUid","decodeStoredNodes","encodeStoredNodes","newFormListFields","NON_PAGE_SCREEN_MAX_PER_HOST","nonPageScreenIds","SCREEN_KIND_EMAIL","SCREEN_KIND_TEMPLATE","screenClaimsToBeAPage","DUPLICABLE_RESOURCE_NOUNS","DUPLICATE_BUSY_MESSAGE","duplicateDisplayName","duplicateVersionNote","uniqueDuplicateName","uniqueDuplicateSlug","formDesignReboundTo","pluginHostResource","Timestamp","logResourceDuplicated","firebaseAdmin","RECIPES","screen","collection","nameField","fields","versionParentField","quotaKey","slug","emailDesign","component","entitlement","layout","template","stamps","source","type","form","recipeFor","kind","Object","prototype","hasOwnProperty","call","declared","duplicate","asRecord","value","Array","isArray","duplicateResource","options","recipe","noun","ok","status","error","sourceId","String","trim","slice","firestore","app","attemptKey","claimed","scopeId","hostId","orgId","key","busyMessage","replay","body","claim","result","copy","uid","email","id","name","sourceName","target","versionId","answer","record","release","hostRef","doc","collectionRef","sourceRef","org","get","data","runTransaction","tx","siblingFields","hostSnapshot","siblingsSnapshot","Promise","all","select","exists","sourceKind","nonPageScreen","siblings","docs","map","row","deletedAt","sourceType","live","filter","screenRows","routingMap","size","used","length","quota","allowed","limit","requested","undefined","versionData","sourceVersionNumber","newest","versionsRef","orderBy","found","pointer","pointed","field","rebound","raw","formId","formName","packed","Buffer","from","create","displayName","routing","createdAt","now","updatedAt","createdBy","versionNodes","nodes"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDC,GAED,uEAAuE;AACvE,qEAAqE;AACrE,oCAAoC;AACpC,SAASA,sBAAsB,QAAQ,4CAA2C;AAClF,SACEC,iBAAiB,EACjBC,gBAAgB,EAChBC,UAAU,EACVC,YAAY,EACZC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,EACjBC,4BAA4B,EAC5BC,gBAAgB,EAChBC,iBAAiB,EACjBC,oBAAoB,EACpBC,qBAAqB,QAIhB,sBAAqB;AAC5B,SACEC,yBAAyB,EACzBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACpBC,mBAAmB,EACnBC,mBAAmB,QAEd,4CAA2C;AAClD,SAASC,mBAAmB,QAAQ,+BAA8B;AAClE,SAASC,kBAAkB,QAAQ,oDAAmD;AACtF,SAASC,SAAS,QAAQ,2BAA0B;AACpD,SAASC,qBAAqB,QAAQ,0BAAsB;AAC5D,OAAOC,mBAAmB,sBAAkB;AAqB5C;;;;;;;;;;;;CAYC,GACD,MAAMC,UAAmE;IACvEC,QAAQ;QACNC,YAAY;QACZC,WAAW;QACXC,QAAQ;YACN;YACA;YACA;YACA;YACA;YACA;YACA,uEAAuE;YACvE,iEAAiE;YACjE;SACD;QACDC,oBAAoB;QACpBC,UAAU;QACVC,MAAM;IACR;IACA,qEAAqE;IACrE,wEAAwE;IACxEC,aAAa;QACXN,YAAY;QACZC,WAAW;QACXC,QAAQ;YAAC;YAAe;SAAO;QAC/BC,oBAAoB;IACtB;IACAI,WAAW;QACTP,YAAY;QACZC,WAAW;QACX,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrEC,QAAQ;YAAC;YAAe;YAAQ;YAAU;YAAS;YAAS;SAAO;QACnEC,oBAAoB;QACpBK,aAAa;IACf;IACAC,QAAQ;QACNT,YAAY;QACZC,WAAW;QACXC,QAAQ;YAAC;SAAc;QACvBC,oBAAoB;QACpBC,UAAU;IACZ;IACAM,UAAU;QACRV,YAAY;QACZC,WAAW;QACXC,QAAQ;YACN;YACA,oEAAoE;YACpE,kEAAkE;YAClE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QACDE,UAAU;QACVO,QAAQ;YAAEC,QAAQ;gBAAEC,MAAM;YAAW;QAAE;IACzC;IACAC,MAAM;QACJd,YAAY;QACZC,WAAW;QACXC,QAAQ;YACN;YACA;YACA;YACA;YACA;YACA;SACD;QACDC,oBAAoB;QACpB,0EAA0E;QAC1E,sDAAsD;QACtDC,UAAU;QACVC,MAAM;IACR;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASU,UAAUC,IAAY;IACpC,IAAIC,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACtB,SAASkB,OAAO;YAChDlB;QAAP,QAAOA,gBAAAA,OAAO,CAACkB,KAAmC,YAA3ClB,gBAA+C;IACxD;IACA,MAAMuB,WAAW3B,mBAAmBsB;IACpC,IAAI,EAACK,4BAAAA,SAAUC,SAAS,GAAE,OAAO;IACjC,OAAO;QACLtB,YAAYqB,SAASrB,UAAU;QAC/BC,WAAWoB,SAASC,SAAS,CAACrB,SAAS;QACvCC,QAAQmB,SAASC,SAAS,CAACpB,MAAM;OAC7BmB,SAASjB,QAAQ,GACjB;QAAEA,UAAUiB,SAASjB,QAAQ;IAAmC,IAChE,CAAC,GACDiB,SAASb,WAAW,GACpB;QAAEA,aAAaa,SAASb,WAAW;IAA0B,IAC7D,CAAC,GACDa,SAASC,SAAS,CAACX,MAAM,GAAG;QAAEA,QAAQU,SAASC,SAAS,CAACX,MAAM;IAAC,IAAI,CAAC;AAE7E;AA6CA,MAAMY,WAAW,CAACC,QAChBA,SAAS,OAAOA,UAAU,YAAY,CAACC,MAAMC,OAAO,CAACF,SAChDA,QACD,CAAC;AAEP;;;CAGC,GACD,OAAO,eAAeG,kBACpBX,IAAgC,EAChCY,OAAiC;QAKTA,mBAIEA;IAP1B,MAAMC,SAASd,UAAUC;IACzB,MAAMc,OAAO3C,yBAAyB,CAAC6B,KAAK;IAC5C,IAAI,CAACa,QAAQ,OAAO;QAAEE,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAqC;IAC1F,MAAMC,WAAWC,QAAOP,oBAAAA,QAAQM,QAAQ,YAAhBN,oBAAoB,IAAIQ,IAAI,GAAGC,KAAK,CAAC,GAAG;IAChE,IAAI,CAACH,UAAU,OAAO;QAAEH,IAAI;QAAOC,QAAQ;QAAKC,OAAO,CAAC,YAAY,EAAEH,KAAK,QAAQ,CAAC;IAAC;IACrF,MAAMQ,YAAYzC,cAAc0C,GAAG,GAAGD,SAAS;IAE/C,MAAME,aAAaL,QAAOP,sBAAAA,QAAQY,UAAU,YAAlBZ,sBAAsB,IAAIQ,IAAI,GAAGC,KAAK,CAAC,GAAG;IACpE,MAAMI,UAAUD,aACZ,MAAM/D,aAAa6D,WAAoB;QACrCtB,MAAM,CAAC,UAAU,EAAEA,MAAM;QACzB0B,SAAS,GAAGd,QAAQe,MAAM,CAAC,CAAC,EAAET,UAAU;QACxCU,OAAOhB,QAAQgB,KAAK;QACpBC,KAAKL;QACLM,aAAa1D;IACf,KACA;IACJ,IAAIqD,WAAW,YAAYA,SAAS;QAClC,OAAOA,QAAQM,MAAM,CAACC,IAAI;IAC5B;IACA,MAAMC,QAAQR,WAAW,WAAWA,UAAUA,QAAQQ,KAAK,GAAG;IAE9D,IAAI;QACF,MAAMC,SAAS,MAAMC,KAAKb,WAAWtB,MAAMa,QAAQ,aAAKD;YAASM;;QACjE,IAAIgB,OAAOnB,EAAE,EAAE;gBAGgBH;YAF7B,MAAMhC,sBACJoB,MACA;gBAAEoC,KAAKxB,QAAQwB,GAAG;gBAAEC,KAAK,GAAEzB,iBAAAA,QAAQyB,KAAK,YAAbzB,iBAAiB;YAAK,GACjD;gBACEgB,OAAOhB,QAAQgB,KAAK;gBACpBD,QAAQf,QAAQe,MAAM;gBACtB/B,QAAQ;oBAAE0C,IAAIpB;oBAAUqB,MAAML,OAAOM,UAAU;gBAAC;gBAChDC,QAAQ;oBAAEH,IAAIJ,OAAOI,EAAE;oBAAEC,MAAML,OAAOK,IAAI;oBAAEG,WAAWR,OAAOQ,SAAS;gBAAC;YAC1E;YAEF,MAAMC,SAAkC;gBACtC5B,IAAI;gBACJuB,IAAIJ,OAAOI,EAAE;gBACbI,WAAWR,OAAOQ,SAAS;gBAC3BH,MAAML,OAAOK,IAAI;YACnB;YACA,OAAMN,yBAAAA,MAAOW,MAAM,CAAC,KAAKD;YACzB,OAAOA;QACT;QACA,yEAAyE;QACzE,0DAA0D;QAC1D,OAAMV,yBAAAA,MAAOY,OAAO;QACpB,OAAOX;IACT,EAAE,OAAOjB,OAAO;QACd,OAAMgB,yBAAAA,MAAOY,OAAO;QACpB,MAAM5B;IACR;AACF;AAMA,eAAekB,KACbb,SAAsC,EACtCtB,IAAgC,EAChCa,MAAkB,EAClBD,OAAwD;QAQtDA,cACE;IAPJ,MAAM,EAAEe,MAAM,EAAET,QAAQ,EAAEkB,GAAG,EAAE,GAAGxB;IAClC,MAAME,OAAO3C,yBAAyB,CAAC6B,KAAK;IAC5C,MAAM8C,UAAUxB,UAAUtC,UAAU,CAAC,SAAS+D,GAAG,CAACpB;IAClD,MAAMqB,gBAAgBF,QAAQ9D,UAAU,CAAC6B,OAAO7B,UAAU;IAC1D,MAAMiE,YAAYD,cAAcD,GAAG,CAAC7B;IACpC,MAAMgC,OACJtC,eAAAA,QAAQsC,GAAG,YAAXtC,gBACE,QAAA,AAAC,CAAA,MAAMU,UAAUtC,UAAU,CAAC,QAAQ+D,GAAG,CAACnC,QAAQgB,KAAK,EAAEuB,GAAG,EAAC,EAAGC,IAAI,cAAlE,QACA;IAEJ,IAAIvC,OAAOrB,WAAW,IAAI,CAACjC,iBAAiB2F,KAAcrC,OAAOrB,WAAW,GAAG;QAC7E,OAAO;YACLuB,IAAI;YACJC,QAAQ;YACRC,OAAO;QACT;IACF;IAEA,MAAMqB,KAAK5E;IACX,MAAMgF,YAAY7B,OAAO1B,kBAAkB,GAAGzB,sBAAsB;IAEpE,OAAO4D,UAAU+B,cAAc,CAAC,OAAOC;YA2GXF,wBACDxC,eA+EnBC,gBAGuDA;QA7L7D,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM0C,gBAAgB;YACpB1C,OAAO5B,SAAS;YAChB;YACA;YACA;YACA;SACD;QACD,MAAM,CAACuE,cAAc5D,QAAQ6D,iBAAiB,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACjEL,GAAGH,GAAG,CAACL;YACPQ,GAAGH,GAAG,CAACF;YACPK,GAAGH,GAAG,CAACH,cAAcY,MAAM,IAAIL;SAChC;QACD,IAAI,CAACC,aAAaK,MAAM,EAAE,OAAO;YAAE9C,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAe;QACjF,IAAI,CAACrB,OAAOiE,MAAM,IAAIjE,OAAOuD,GAAG,CAAC,gBAAgB,MAAM;YACrD,OAAO;gBAAEpC,IAAI;gBAAOC,QAAQ;gBAAKC,OAAO,CAAC,QAAQ,EAAEH,MAAM;YAAC;QAC5D;QACA,MAAMsC,OAAO7C,SAASX,OAAOwD,IAAI;QAEjC,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;QACnE,cAAc;QACd,MAAMU,aAAaV,IAAI,CAAC,OAAO;QAC/B,MAAMW,gBACJlD,OAAO7B,UAAU,KAAK,aACtB,CAACd,sBAAsB;YAAE8B,MAAM8D;QAAqB;QACtD,IAAIjD,OAAO7B,UAAU,KAAK,WAAW;YACnC,IAAIgB,SAAS,iBAAiB8D,eAAe9F,mBAAmB;gBAC9D,OAAO;oBAAE+C,IAAI;oBAAOC,QAAQ;oBAAKC,OAAO;gBAAmC;YAC7E;YACA,IAAIjB,SAAS,YAAY+D,iBAAiBD,eAAe7F,sBAAsB;gBAC7E,OAAO;oBACL8C,IAAI;oBACJC,QAAQ;oBACRC,OAAO;gBACT;YACF;QACF;QAEA,MAAM+C,WAAyBP,iBAAiBQ,IAAI,CAACC,GAAG,CAAC,CAACC;gBAE3CA,UACAA;mBAHoD;gBACjE7B,IAAI6B,IAAI7B,EAAE;gBACVC,MAAMpB,QAAOgD,WAAAA,IAAIhB,GAAG,CAACtC,OAAO5B,SAAS,aAAxBkF,WAA6B;gBAC1C9E,MAAM8B,QAAOgD,YAAAA,IAAIhB,GAAG,CAAC,mBAARgB,YAAmB;gBAChCnE,MAAMmE,IAAIhB,GAAG,CAAC;gBACdiB,WAAWD,IAAIhB,GAAG,CAAC;gBACnBkB,YAAYF,IAAIhB,GAAG,CAAC;YACtB;;QACA,MAAMmB,OAAON,SAASO,MAAM,CAAC,CAACJ,MAAQA,IAAIC,SAAS,IAAI;QAEvD,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,wDAAwD;QACxD,MAAMI,aAAqCR,SAASE,GAAG,CAAC,CAACC,MAAS,CAAA;gBAChE7B,IAAI6B,IAAI7B,EAAE;gBACVtC,MAAMmE,IAAInE,IAAI;gBACdoE,WAAWD,IAAIC,SAAS;YAC1B,CAAA;QACA,MAAMK,aAAajB,aAAaL,GAAG,CAAC;QACpC,IAAIY,eAAe;YACjB,IAAIhG,iBAAiByG,YAAYC,YAAYC,IAAI,IAAI5G,8BAA8B;gBACjF,OAAO;oBACLiD,IAAI;oBACJC,QAAQ;oBACRC,OACE,kCACA,GAAGnD,6BAA6B,oCAAoC,CAAC,GACrE;gBACJ;YACF;QACF,OAAO,IAAI+C,OAAOzB,QAAQ,EAAE;YAC1B,MAAMuF,OACJ3E,SAAS,WACL1C,kBAAkBkH,YAAYC,YAAYC,IAAI,GAC9C1E,SAAS,aACPsE,KAAKC,MAAM,CAAC,CAACJ,MAAQA,IAAIE,UAAU,KAAK,WAAWO,MAAM,GACzDN,KAAKM,MAAM;YACnB,MAAMC,QAAQrH,WAAW0F,KAAcrC,OAAOzB,QAAQ,EAAWuF;YACjE,IAAI,CAACE,MAAMC,OAAO,EAAE;gBAClB,OAAO;oBACL/D,IAAI;oBACJC,QAAQ;oBACRC,OACE,CAAC,mBAAmB,EAAE4D,MAAME,KAAK,CAAC,CAAC,EAAEjE,OAAO+D,MAAME,KAAK,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC,GAC7E;gBACJ;YACF;QACF;QAEA,mEAAmE;QACnE,iEAAiE;QACjE,oDAAoD;QACpD,MAAMvC,aAAarB,QAAOiC,yBAAAA,IAAI,CAACvC,OAAO5B,SAAS,CAAC,YAAtBmE,yBAA0B,IAAIhC,IAAI;QAC5D,MAAM4D,YAAY7D,QAAOP,gBAAAA,QAAQ2B,IAAI,YAAZ3B,gBAAgB,IAAIQ,IAAI,MAAM/C,qBAAqBmE;QAC5E,MAAMD,OAAOhE,oBACXyG,WACAV,KAAKJ,GAAG,CAAC,CAACC,MAAQA,IAAI5B,IAAI;QAE5B,MAAMlD,OAAOwB,OAAOxB,IAAI,GACpBb,oBACE4E,IAAI,CAAC,OAAO,EACZkB,KAAKJ,GAAG,CAAC,CAACC,MAAQA,IAAI9E,IAAI,KAE5B4F;QAEJ,sEAAsE;QACtE,oEAAoE;QACpE,kCAAkC;QAClC,IAAIC,cAA8C;QAClD,IAAIC,sBAAqC;QACzC,IAAItE,OAAO1B,kBAAkB,EAAE;gBAM0BiG,eAChChC;YANvB,MAAMiC,cAAcpC,UAAUjE,UAAU,CAAC;YACzC,MAAM,CAACoG,QAAQzB,IAAI,GAAG,MAAMD,QAAQC,GAAG,CAAC;gBACtCL,GAAGH,GAAG,CAACkC,YAAYC,OAAO,CAAC,aAAa,QAAQP,KAAK,CAAC;gBACtDzB,GAAGH,GAAG,CAACkC,YAAYzB,MAAM;aAC1B;YACD,IAAI2B,SAAmDH,gBAAAA,OAAOnB,IAAI,CAAC,EAAE,YAAdmB,gBAAkB;YACzE,MAAMI,UAAUrE,QAAOiC,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB;YAC5C,IAAI,CAACmC,SAASC,SAAS;gBACrB,MAAMC,UAAU,MAAMnC,GAAGH,GAAG,CAACkC,YAAYtC,GAAG,CAACyC;gBAC7C,IAAIC,QAAQ5B,MAAM,EAAE0B,QAAQE;YAC9B;YACA,IAAIF,OAAO;gBACTL,cAAc3E,SAASgF,MAAMnC,IAAI;gBACjC+B,sBAAsBxB,IAAIe,IAAI;YAChC;QACF;QAEA,qEAAqE;QACrE,MAAM3B,MAA+B,CAAC;QACtC,KAAK,MAAM2C,SAAS7E,OAAO3B,MAAM,CAAE;YACjC,IAAIkE,IAAI,CAACsC,MAAM,KAAKT,WAAWlC,GAAG,CAAC2C,MAAM,GAAGtC,IAAI,CAACsC,MAAM;QACzD;QACA3C,GAAG,CAAClC,OAAO5B,SAAS,CAAC,GAAGsD;QACxB,IAAI1B,OAAOxB,IAAI,EAAE;YACf,IAAIA,MAAM0D,GAAG,CAAC,OAAO,GAAG1D;iBACnB,OAAO0D,GAAG,CAAC,OAAO;QACzB;QACA;;;;;;;;;;;;;;;;KAgBC,GACD,MAAM4C,UAAU,CAACC;gBAGbnH;YAFF,IAAIuB,SAAS,QAAQ,OAAO4F;YAC5B,QACEnH,uBAAAA,oBAAoBd,kBAAkBiI,MAAM;gBAC1CC,QAAQvD;gBACRwD,UAAUvD;YACZ,cAHA9D,uBAGMmH;QAEV;QACA,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,sBAAsB;QACtB,MAAMG,SAASnI,kBAAkB+H,QAAQ5C,GAAG,CAAC,QAAQ;QACrD,IAAIgD,QAAQhD,GAAG,CAAC,QAAQ,GAAGiD,OAAOC,IAAI,CAACF;QACvCzC,GAAG4C,MAAM,CAAClD,cAAcD,GAAG,CAACT,KAAK,aAC5BS,MACClC,iBAAAA,OAAOlB,MAAM,YAAbkB,iBAAiB,CAAC,GAGnBxD,uBAAuBwD,OAAO7B,UAAU,EAAE,aAAK+D,MAASlC,kBAAAA,OAAOlB,MAAM,YAAbkB,kBAAiB,CAAC,KAGzEb,SAAS,SACTnC,kBAAkB;YAChByE;YACA6D,aAAa5D;YACblD,MAAM0D,GAAG,CAAC,OAAO;YACjBqD,SAASrD,GAAG,CAAC,UAAU;QACzB,KACA,CAAC,GACDmC,eAAexC,YAAY;YAAEA;QAAU,IAAI,CAAC;YAChD2D,WAAW1H,UAAU2H,GAAG;YACxBC,WAAW5H,UAAU2H,GAAG;YACxBE,WAAWpE;;QAEb,IAAI8C,eAAexC,aAAa7B,OAAO1B,kBAAkB,EAAE;YACzD,MAAMsH,eAAe7I,kBAAkB+H,QAAQT,WAAW,CAAC,QAAQ;YACnE5B,GAAG4C,MAAM,CAAClD,cAAcD,GAAG,CAACT,IAAItD,UAAU,CAAC,YAAY+D,GAAG,CAACL,YAAY,aAClEwC,aACCuB,eAAe;gBAAEC,OAAOV,OAAOC,IAAI,CAACQ;YAAc,IAAI,CAAC;gBAC3D,CAAC5F,OAAO1B,kBAAkB,CAAC,EAAEmD;gBAC7BX;gBACAwE,aAAa7H,qBAAqBkE,YAAY2C;gBAC9CkB,WAAW1H,UAAU2H,GAAG;gBACxBC,WAAW5H,UAAU2H,GAAG;gBACxBE,WAAWpE;;QAEf;QACA,OAAO;YACLrB,IAAI;YACJuB;YACAI,WAAWwC,eAAexC,YAAYA,YAAY;YAClDH;YACAC;QACF;IACF;AACF"}

package/src/lib/server/notifications.d.ts

@@ -42,6 +42,13 @@ export interface NotifyUsersOptions {
      * email on would otherwise get it twice.
      */
     skipEmail?: boolean;
+    /**
+     * People not to mail through the email channel for this one notification,
+     * because the caller emails them the same event itself — the seller's
+     * designed sale email beside a Buy Now order's notification. Everyone else
+     * the fan-out reaches is mailed as their preferences say.
+     */
+    skipEmailFor?: readonly string[];
 }
 /**
  * Notification fan-out (AGL-259): batch-writes one doc per recipient at
@@ -113,4 +120,10 @@ export declare function withSiteName(text: string, site: string): string;
  * read. Spread conditionally: the field is optional on the host model and
  * Firestore rejects `undefined`.
  */
-export declare function notifyHostManagers(hostId: string, payload: NotificationPayload): Promise<void>;
+export declare function notifyHostManagers(hostId: string, payload: NotificationPayload, options?: {
+    /**
+     * Mail the workspace owner nothing through the email channel, because
+     * the caller sends them their own email about the same event.
+     */
+    skipOwnerEmail?: boolean;
+}): Promise<void>;

package/src/lib/server/notifications.js

@@ -35,7 +35,8 @@ const firestore = ()=>firebaseAdmin.app().firestore();
  * notification emails.
  *
  * Both ceilings only ever bite on a fan-out where many recipients have
- * OPTED IN — the email channel defaults off, so the ordinary notification
+ * OPTED IN — the email channel defaults off outside a site's transactions
+ * (`NOTIFICATION_TYPE_CHANNEL_DEFAULTS`), so the ordinary notification
  * costs exactly what it cost before this existed. They are here because a
  * fan-out takes up to 400 uids and `notifyUsers` runs inside the mutation
  * that emitted it: a notification must not be able to turn one write into
@@ -198,6 +199,7 @@ const NOTIFY_EMAIL_MAX_SENDS = 50;
         let count = 0;
         const mailTo = [];
         for (const userDoc of userDocs){
+            var _options_skipEmailFor;
             const settings = userDoc.get(NOTIFICATION_SETTINGS_FIELD);
             const legacy = userDoc.get('notificationPrefs');
             if (notificationChannelEnabled(settings, 'console', payload.type, scope, legacy)) {
@@ -209,7 +211,7 @@ const NOTIFY_EMAIL_MAX_SENDS = 50;
                 }));
                 count += 1;
             }
-            if (notificationChannelEnabled(settings, 'email', payload.type, scope, legacy)) {
+            if (notificationChannelEnabled(settings, 'email', payload.type, scope, legacy) && !((_options_skipEmailFor = options.skipEmailFor) == null ? void 0 : _options_skipEmailFor.includes(userDoc.id))) {
                 mailTo.push(userDoc.id);
             }
         }
@@ -381,7 +383,7 @@ async function listStaffUids() {
  * The host doc already carries `orgId` (AGL-233), so this costs no extra
  * read. Spread conditionally: the field is optional on the host model and
  * Firestore rejects `undefined`.
- */ export async function notifyHostManagers(hostId, payload) {
+ */ export async function notifyHostManagers(hostId, payload, options = {}) {
     try {
         var _host_get, _payload_orgId;
         const host = await firestore().collection('hosts').doc(hostId).get();
@@ -389,6 +391,7 @@ async function listStaffUids() {
         const managers = Object.entries(memberRoles).filter(([, role])=>role === 'admin' || role === 'editor').map(([uid])=>uid);
         const orgId = (_payload_orgId = payload.orgId) != null ? _payload_orgId : host.get('orgId');
         const site = hostDisplayName(host.data(), hostId);
+        const ownerUid = options.skipOwnerEmail && orgId ? (await firestore().collection('orgs').doc(orgId).get()).get('ownerUid') : undefined;
         await notifyUsers(managers, _extends({}, payload, {
             title: withSiteName(payload.title, site)
         }, payload.body !== undefined ? {
@@ -397,7 +400,11 @@ async function listStaffUids() {
             hostId
         }, orgId ? {
             orgId
-        } : {}));
+        } : {}), ownerUid ? {
+            skipEmailFor: [
+                ownerUid
+            ]
+        } : {});
     } catch (error) {
         console.error('host manager notification failed', error);
     }

package/src/lib/server/notifications.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/notifications.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  buildRoute,\n  NOTIFICATION_SELF_SENT_EMAIL_TYPES,\n  NOTIFICATION_SETTINGS_FIELD,\n  normalizeNotificationLink,\n  notificationChannelEnabled,\n  type AglynNotification,\n  Route,\n  type NotificationSettings,\n} from '@aglyn/aglyn/server'\nimport { operatorAlertForNotificationType } from '@aglyn/aglyn/plugin-manager/operator-alerts'\nimport { isEmailConfigured, sendEmail } from '@aglyn/shared-util-email'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { withoutMailWithheldAccounts } from './account-mail'\nimport { findUserByUidAcrossPools, listStaffUidsAcrossPools } from './auth-pools'\nimport { filterSuppressedEmails } from './email-suppression'\nimport { meterOrgEmail, meterPlatformEmail } from './email-metering'\nimport firebaseAdmin from './firebase-admin'\nimport { listOrgMembers } from './organizations'\nimport {\n  loadSystemEmail,\n  renderLoadedSystemEmail,\n  systemEmailBrand,\n  systemEmailContent,\n  type SystemEmailBrand,\n} from './render-system-email'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\nexport type NotificationPayload = Omit<\n  AglynNotification,\n  '$id' | 'createdAt' | 'readAt'\n>\n\nexport interface NotifyUsersOptions {\n  /**\n   * Addresses the caller already holds, by uid (AGL-3224).\n   *\n   * Purely an optimization, and one worth taking where it is free: a caller\n   * that read the roster — `notifyOrgAdmins` does — has every address in hand\n   * already, and without this the email half would look each one up again in\n   * the directory. Absent uids fall back to that lookup, so passing a partial\n   * map is fine and passing none is correct.\n   */\n  emails?: Readonly<Record<string, string | null | undefined>>\n  /**\n   * Who the fan-out is for (AGL-3367). `staff` is the platform talking to its\n   * own people, so the email wears the platform's brand and is the platform's\n   * cost even when the notification is ABOUT an org, which a canceled\n   * subscription or a new ticket always is. Anything else speaks in the org's\n   * brand when the notification names one.\n   */\n  audience?: 'staff'\n  /**\n   * Write the console notification only, and mail nobody through the\n   * per-person email channel (AGL-3375): the caller has emailed the same\n   * alert to the operator's inbox, and a staff member who also switched\n   * email on would otherwise get it twice.\n   */\n  skipEmail?: boolean\n}\n\n/** The console's absolute origin for an email link, or `''` when unset. */\nfunction consoleOrigin(): string {\n  return (process.env.NEXT_PUBLIC_CONSOLE_URL ?? '').trim().replace(/\\/+$/, '')\n}\n\n/**\n * At most this many directory lookups per fan-out, and at most this many\n * notification emails.\n *\n * Both ceilings only ever bite on a fan-out where many recipients have\n * OPTED IN — the email channel defaults off, so the ordinary notification\n * costs exactly what it cost before this existed. They are here because a\n * fan-out takes up to 400 uids and `notifyUsers` runs inside the mutation\n * that emitted it: a notification must not be able to turn one write into\n * four hundred directory reads and four hundred sends.\n */\nconst NOTIFY_EMAIL_MAX_LOOKUPS = 25\nconst NOTIFY_EMAIL_MAX_SENDS = 50\n\n/**\n * The email beside the console notification (AGL-3224).\n *\n * One send per recipient, never a shared `to:` list — two people who manage\n * the same site have not agreed to be shown each other's addresses, and the\n * settings link in the footer belongs to one person.\n *\n * `List-Unsubscribe` points at the settings page rather than at a one-click\n * endpoint: this is not marketing mail and RFC 8058's POST form would be\n * claiming a capability that does not exist. What it does do is put the way\n * out in the headers as well as the body, so a client that surfaces it shows\n * the person the page where the switch they want actually is.\n *\n * Rendered through the `notification` system email (AGL-3367), which is what\n * gives it the header and footer every other system email wears, and makes\n * it designable on the staff System emails page. It used to hand `sendEmail`\n * bare text, which is the unbranded card the fallback HTML part draws. The\n * template is read once per fan-out and rendered per recipient.\n *\n * Never throws, like everything else on this path.\n */\nasync function emailNotification(\n  uids: string[],\n  payload: NotificationPayload,\n  known: Readonly<Record<string, string | null | undefined>>,\n  audience: NotifyUsersOptions['audience'],\n): Promise<void> {\n  const origin = consoleOrigin()\n  const settingsUrl = `${origin}${buildRoute(Route.MANAGE_NOTIFICATION_SETTINGS)}`\n  const context = await notificationEmailContext(payload, audience)\n  const url = notificationEmailUrl(payload, context, origin)\n  const loaded = await loadSystemEmail('notification').catch(() => null)\n  const fallbackText = [\n    payload.title,\n    payload.body ?? '',\n    url,\n    origin ? `Change what you are emailed about: ${settingsUrl}` : '',\n  ]\n    .filter(Boolean)\n    .join('\\n\\n')\n  let lookups = 0\n  let sent = 0\n  for (const uid of uids) {\n    if (sent >= NOTIFY_EMAIL_MAX_SENDS) break\n    let address = String(known[uid] ?? '').trim().toLowerCase()\n    if (!address.includes('@')) {\n      if (lookups >= NOTIFY_EMAIL_MAX_LOOKUPS) continue\n      lookups += 1\n      const pooled = await findUserByUidAcrossPools(uid).catch(() => null)\n      address = String(pooled?.record?.email ?? '').trim().toLowerCase()\n    }\n    if (!address.includes('@')) continue\n    const recipients = await filterSuppressedEmails([address])\n    if (!recipients.length) continue\n    const rendered = loaded\n      ? renderLoadedSystemEmail(\n          loaded,\n          {\n            ...context.brand.merge,\n            'notification.title': payload.title,\n            'notification.body': payload.body ?? '',\n            'notification.url': url,\n            settingsUrl: origin ? settingsUrl : '',\n          },\n          context.brand.options,\n        )\n      : null\n    const result = await sendEmail({\n      to: recipients,\n      ...systemEmailContent(rendered, {\n        subject: payload.title,\n        text: fallbackText,\n      }),\n      ...(context.brand.fromName ? { fromName: context.brand.fromName } : {}),\n      context: 'notification',\n      ...(origin\n        ? { headers: { 'List-Unsubscribe': `<${settingsUrl}>` } }\n        : {}),\n    })\n    if (!result.sent) continue\n    sent += 1\n    // Whose cost it is: a notification to a workspace's people is that\n    // workspace's mail, and a staff alert or an account-level notice is the\n    // platform's, whichever org it is about.\n    await (payload.orgId && audience !== 'staff'\n      ? meterOrgEmail(payload.orgId)\n      : meterPlatformEmail()\n    ).catch(() => undefined)\n  }\n}\n\n/** What a notification email needs from the org and site it is about. */\ninterface NotificationEmailContext {\n  brand: SystemEmailBrand\n  orgSlug?: string\n  hostSubdomain?: string\n}\n\n/**\n * The org's brand, and the slug and subdomain its stored link is rewritten\n * with (AGL-3367): at most two reads per fan-out, made only when someone is\n * being emailed.\n *\n * A staff fan-out reads nothing. Its brand is the platform's, and its links\n * are staff routes that need no rewriting.\n */\nasync function notificationEmailContext(\n  payload: NotificationPayload,\n  audience: NotifyUsersOptions['audience'],\n): Promise<NotificationEmailContext> {\n  if (audience === 'staff' || !payload.orgId) {\n    return { brand: systemEmailBrand(null) }\n  }\n  try {\n    const db = firestore()\n    const [org, host] = await Promise.all([\n      db.collection('orgs').doc(payload.orgId).get(),\n      payload.hostId\n        ? db.collection('hosts').doc(payload.hostId).get()\n        : Promise.resolve(null),\n    ])\n    const slug = org.get('slug')\n    const subdomain = host?.get('subdomain')\n    return {\n      brand: systemEmailBrand(org.exists ? (org.data() ?? null) : null),\n      ...(typeof slug === 'string' && slug ? { orgSlug: slug } : {}),\n      ...(typeof subdomain === 'string' && subdomain\n        ? { hostSubdomain: subdomain }\n        : {}),\n    }\n  } catch (error) {\n    console.error('notification email context failed', error)\n    return { brand: systemEmailBrand(null) }\n  }\n}\n\n/**\n * Where the email's button goes: the notification's own link, rewritten onto\n * today's routes the way the console rewrites it when it is clicked, else\n * the notifications page. A stored host link is `/{hostDocId}/…`, which only\n * that rewrite turns into a page that exists. Empty when the deployment has\n * no console origin to make a link absolute with.\n */\nfunction notificationEmailUrl(\n  payload: NotificationPayload,\n  context: NotificationEmailContext,\n  origin: string,\n): string {\n  const link = normalizeNotificationLink(payload.link, {\n    orgSlug: context.orgSlug,\n    hostId: payload.hostId,\n    hostSubdomain: context.hostSubdomain,\n  })\n  if (link && /^https?:\\/\\//i.test(link)) return link\n  if (!origin) return ''\n  return `${origin}${link?.startsWith('/') ? link : buildRoute(Route.MANAGE_NOTIFICATIONS)}`\n}\n\n/**\n * Notification fan-out (AGL-259): batch-writes one doc per recipient at\n * `users/{uid}/notifications`, and — for recipients who asked for it\n * (AGL-3224) — sends one email beside it. Never throws: a notification miss,\n * or a send that failed, must not break the mutation that emitted it.\n */\nexport async function notifyUsers(\n  uids: Iterable<string>,\n  payload: NotificationPayload,\n  options: NotifyUsersOptions = {},\n): Promise<void> {\n  try {\n    const db = firestore()\n    const targets = [...new Set(uids)].filter(Boolean).slice(0, 400)\n    if (!targets.length) return\n    // Per-user preferences (AGL-267, AGL-3223): one getAll over the user\n    // docs, which now answers for both channels and for all three scopes —\n    // the settings live on this document precisely so that stays one read.\n    const userDocs = await db.getAll(\n      ...targets.map((uid) => db.collection('users').doc(uid)),\n    )\n    const scope = { orgId: payload.orgId, hostId: payload.hostId }\n    const batch = db.batch()\n    let count = 0\n    const mailTo: string[] = []\n    for (const userDoc of userDocs) {\n      const settings = userDoc.get(NOTIFICATION_SETTINGS_FIELD) as\n        | NotificationSettings\n        | undefined\n      const legacy = userDoc.get('notificationPrefs') as\n        | Record<string, boolean>\n        | undefined\n      if (\n        notificationChannelEnabled(\n          settings,\n          'console',\n          payload.type,\n          scope,\n          legacy,\n        )\n      ) {\n        batch.set(\n          db\n            .collection('users')\n            .doc(userDoc.id)\n            .collection('notifications')\n            .doc(),\n          // `read: false` on create, so the feed can ask for unread and read\n          // alike by equality (AGL-3321; see `AglynNotification.read`).\n          { ...payload, read: false, createdAt: FieldValue.serverTimestamp() },\n        )\n        count += 1\n      }\n      if (\n        notificationChannelEnabled(settings, 'email', payload.type, scope, legacy)\n      ) {\n        mailTo.push(userDoc.id)\n      }\n    }\n    if (count > 0) await batch.commit()\n    /*\n     * THE EMAIL AFTER THE COMMIT, and not inside its `try`.\n     *\n     * The console notification is the durable record and the send is a\n     * courtesy on top of it, so the order is the one where a failing network\n     * call cannot lose the record. The two channels are independent by\n     * design — a person may have muted the feed and asked for mail, or the\n     * reverse — so neither is gated on the other having happened.\n     *\n     * Digests are excluded: they compose and send their own mail, under\n     * their own switches, and the generic channel would send a second\n     * message announcing that the first one had been sent.\n     *\n     * A locked or disabled account is not mailed (AGL-3418); its feed entry\n     * above still records the event.\n     */\n    if (\n      mailTo.length &&\n      !options.skipEmail &&\n      isEmailConfigured() &&\n      !NOTIFICATION_SELF_SENT_EMAIL_TYPES.has(payload.type)\n    ) {\n      const reachable = await withoutMailWithheldAccounts(mailTo)\n      if (!reachable.length) return\n      await emailNotification(\n        reachable,\n        payload,\n        options.emails ?? {},\n        options.audience,\n      )\n    }\n  } catch (error) {\n    console.error('notification fan-out failed', error)\n  }\n}\n\n// Staff are identified by a Firebase Auth custom claim (`staff`), which is not\n// a Firestore query — so the roster comes from paginating the auth users. A\n// burst of ticket activity shouldn't rescan every time, so the (small) result\n// is cached briefly. Fails soft to an empty list.\nlet staffUidCache: { uids: string[]; at: number } | null = null\nconst STAFF_CACHE_MS = 60_000\n\nasync function listStaffUids(): Promise<string[]> {\n  const now = Date.now()\n  if (staffUidCache && now - staffUidCache.at < STAFF_CACHE_MS) {\n    return staffUidCache.uids\n  }\n  // Across ALL auth pools (AGL-1122). This scanned only the project pool, so\n  // a staff member who signs in through enterprise SSO — whose account lives\n  // in a GCIP tenant pool — was never in the fan-out. Nothing errored; the\n  // notification simply never arrived, which is the worst shape a miss can\n  // take on an alerting path.\n  const uids = await listStaffUidsAcrossPools()\n  staffUidCache = { uids, at: now }\n  return uids\n}\n\n/**\n * Notifies every staff-claim holder (AGL-850) — the support-desk audience.\n * Staff are not org members, so `notifyOrgAdmins`/`notifyHostManagers` never\n * reach them; this enumerates the `staff` custom claim instead. The docs land\n * at `users/{uid}/notifications`, which the console notifications menu already\n * renders, so no separate staff inbox is needed. Never throws.\n *\n * A type the operator alert registry names (AGL-3377) — a fraud or risk\n * alert, a dispute nobody owns, a support ticket — is raised as that alert\n * instead: the same console notification, plus staff's switches, the\n * operator email or digest, and the webhook. See `raiseOperatorAlert`.\n */\nexport async function notifyStaff(payload: NotificationPayload): Promise<void> {\n  try {\n    const alert = operatorAlertForNotificationType(payload.type)\n    if (alert) {\n      const { raiseOperatorAlert } = await import('./operator-alerts')\n      await raiseOperatorAlert(alert, {\n        subject: payload.title,\n        ...(payload.body ? { body: payload.body } : {}),\n        ...(payload.level ? { level: payload.level } : {}),\n        ...(payload.link ? { url: payload.link } : {}),\n        ...(payload.orgId ? { orgId: payload.orgId } : {}),\n        ...(payload.hostId ? { hostId: payload.hostId } : {}),\n      })\n      return\n    }\n    await notifyStaffConsole(payload)\n  } catch (error) {\n    console.error('staff notification failed', error)\n  }\n}\n\n/**\n * The staff console notification alone, with the per-person email channel\n * it carries: what `notifyStaff` did before the registry, and what\n * `raiseOperatorAlert` writes as its first step. Never throws.\n */\nexport async function notifyStaffConsole(\n  payload: NotificationPayload,\n  options: { skipEmail?: boolean } = {},\n): Promise<void> {\n  try {\n    await notifyUsers(await listStaffUids(), payload, {\n      audience: 'staff',\n      ...(options.skipEmail ? { skipEmail: true } : {}),\n    })\n  } catch (error) {\n    console.error('staff notification failed', error)\n  }\n}\n\n/**\n * Notifies the org's owner + admins (billing, membership, org events).\n *\n * `skipEmail` is for a caller that emails the same notice to the same people\n * itself — the usage alerts do (AGL-3431) — so an admin who switched the\n * email channel on is not sent it twice.\n */\nexport async function notifyOrgAdmins(\n  orgId: string,\n  payload: NotificationPayload,\n  options: Pick<NotifyUsersOptions, 'skipEmail'> = {},\n): Promise<void> {\n  try {\n    const members = await listOrgMembers(orgId)\n    const admins = members.filter(\n      (member) => member.role === 'owner' || member.role === 'admin',\n    )\n    // The roster rows carry addresses, so the email channel (AGL-3224) needs\n    // no directory lookup for anyone reached this way.\n    const emails: Record<string, string | undefined> = {}\n    for (const member of admins) {\n      if (member.email) emails[member.$id] = member.email\n    }\n    await notifyUsers(\n      admins.map((member) => member.$id),\n      { ...payload, orgId },\n      { emails, ...(options.skipEmail ? { skipEmail: true } : {}) },\n    )\n  } catch (error) {\n    console.error('org admin notification failed', error)\n  }\n}\n\n/**\n * The name a site's managers know it by: the name they gave it, then its\n * address, then — for a doc with neither — its id.\n */\nexport function hostDisplayName(\n  host: Record<string, unknown> | undefined,\n  hostId: string,\n): string {\n  for (const value of [host?.['displayName'], host?.['subdomain']]) {\n    if (typeof value === 'string' && value.trim()) return value.trim()\n  }\n  return hostId\n}\n\n/**\n * Fills `{site}` in a host notification's title or body (AGL-3432).\n *\n * A manager of ten storefronts reads \"New order — $42.00\" and cannot tell\n * which store it came from, and the email shows only the body to someone who\n * skips the subject. `notifyHostManagers` already reads the host doc, so a\n * caller writes \"New order on {site}\" and pays no read of its own.\n */\nexport function withSiteName(text: string, site: string): string {\n  return text.includes('{site}') ? text.split('{site}').join(site) : text\n}\n\n/**\n * Notifies everyone who manages a host (admin/editor in the host doc's\n * `memberRoles` projection) — the audience for form submissions and\n * bookings on that site.\n *\n * The OWNING ORG travels with the notification (AGL-1773). Host links are\n * stored in the legacy `/{hostDocId}/rest` shape and rewritten to\n * `/{orgSlug}/hosts/{subdomain}/rest` when they are FOLLOWED\n * (`normalizeNotificationLink`, AGL-644) — a rewrite that needs an org slug.\n * With no `orgId` on the doc the console had nothing to key on and fell back\n * to whichever org the reader happens to have OPEN, so a manager who belongs\n * to more than one workspace was routed to `/{other-org}/hosts/{subdomain}/…`\n * and got a designed 404: `HostGuard` only resolves subdomains belonging to\n * the current org. `notifyOrgAdmins` has always stamped it; the host fan-out\n * — every form submission, booking, order and stock alert — never did.\n *\n * The host doc already carries `orgId` (AGL-233), so this costs no extra\n * read. Spread conditionally: the field is optional on the host model and\n * Firestore rejects `undefined`.\n */\nexport async function notifyHostManagers(\n  hostId: string,\n  payload: NotificationPayload,\n): Promise<void> {\n  try {\n    const host = await firestore().collection('hosts').doc(hostId).get()\n    const memberRoles =\n      (host.get('memberRoles') as Record<string, string> | undefined) ?? {}\n    const managers = Object.entries(memberRoles)\n      .filter(([, role]) => role === 'admin' || role === 'editor')\n      .map(([uid]) => uid)\n    const orgId = payload.orgId ?? (host.get('orgId') as string | undefined)\n    const site = hostDisplayName(host.data(), hostId)\n    await notifyUsers(managers, {\n      ...payload,\n      title: withSiteName(payload.title, site),\n      ...(payload.body !== undefined\n        ? { body: withSiteName(payload.body, site) }\n        : {}),\n      hostId,\n      ...(orgId ? { orgId } : {}),\n    })\n  } catch (error) {\n    console.error('host manager notification failed', error)\n  }\n}\n"],"names":["buildRoute","NOTIFICATION_SELF_SENT_EMAIL_TYPES","NOTIFICATION_SETTINGS_FIELD","normalizeNotificationLink","notificationChannelEnabled","Route","operatorAlertForNotificationType","isEmailConfigured","sendEmail","FieldValue","withoutMailWithheldAccounts","findUserByUidAcrossPools","listStaffUidsAcrossPools","filterSuppressedEmails","meterOrgEmail","meterPlatformEmail","firebaseAdmin","listOrgMembers","loadSystemEmail","renderLoadedSystemEmail","systemEmailBrand","systemEmailContent","firestore","app","consoleOrigin","process","env","NEXT_PUBLIC_CONSOLE_URL","trim","replace","NOTIFY_EMAIL_MAX_LOOKUPS","NOTIFY_EMAIL_MAX_SENDS","emailNotification","uids","payload","known","audience","origin","settingsUrl","MANAGE_NOTIFICATION_SETTINGS","context","notificationEmailContext","url","notificationEmailUrl","loaded","catch","fallbackText","title","body","filter","Boolean","join","lookups","sent","uid","address","String","toLowerCase","includes","pooled","record","email","recipients","length","rendered","brand","merge","options","result","to","subject","text","fromName","headers","orgId","undefined","org","db","host","Promise","all","collection","doc","get","hostId","resolve","slug","subdomain","exists","data","orgSlug","hostSubdomain","error","console","link","test","startsWith","MANAGE_NOTIFICATIONS","notifyUsers","targets","Set","slice","userDocs","getAll","map","scope","batch","count","mailTo","userDoc","settings","legacy","type","set","id","read","createdAt","serverTimestamp","push","commit","skipEmail","has","reachable","emails","staffUidCache","STAFF_CACHE_MS","listStaffUids","now","Date","at","notifyStaff","alert","raiseOperatorAlert","level","notifyStaffConsole","notifyOrgAdmins","members","admins","member","role","$id","hostDisplayName","value","withSiteName","site","split","notifyHostManagers","memberRoles","managers","Object","entries"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,UAAU,EACVC,kCAAkC,EAClCC,2BAA2B,EAC3BC,yBAAyB,EACzBC,0BAA0B,EAE1BC,KAAK,QAEA,sBAAqB;AAC5B,SAASC,gCAAgC,QAAQ,8CAA6C;AAC9F,SAASC,iBAAiB,EAAEC,SAAS,QAAQ,2BAA0B;AACvE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,oBAAgB;AAC5D,SAASC,wBAAwB,EAAEC,wBAAwB,QAAQ,kBAAc;AACjF,SAASC,sBAAsB,QAAQ,yBAAqB;AAC5D,SAASC,aAAa,EAAEC,kBAAkB,QAAQ,sBAAkB;AACpE,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,cAAc,QAAQ,qBAAiB;AAChD,SACEC,eAAe,EACfC,uBAAuB,EACvBC,gBAAgB,EAChBC,kBAAkB,QAEb,2BAAuB;AAE9B,MAAMC,YAAY,IAAMN,cAAcO,GAAG,GAAGD,SAAS;AAmCrD,yEAAyE,GACzE,SAASE;QACCC;IAAR,OAAO,EAACA,uCAAAA,QAAQC,GAAG,CAACC,uBAAuB,YAAnCF,uCAAuC,IAAIG,IAAI,GAAGC,OAAO,CAAC,QAAQ;AAC5E;AAEA;;;;;;;;;;CAUC,GACD,MAAMC,2BAA2B;AACjC,MAAMC,yBAAyB;AAE/B;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,eAAeC,kBACbC,IAAc,EACdC,OAA4B,EAC5BC,KAA0D,EAC1DC,QAAwC;QAStCF;IAPF,MAAMG,SAASb;IACf,MAAMc,cAAc,GAAGD,SAASrC,WAAWK,MAAMkC,4BAA4B,GAAG;IAChF,MAAMC,UAAU,MAAMC,yBAAyBP,SAASE;IACxD,MAAMM,MAAMC,qBAAqBT,SAASM,SAASH;IACnD,MAAMO,SAAS,MAAM1B,gBAAgB,gBAAgB2B,KAAK,CAAC,IAAM;IACjE,MAAMC,eAAe;QACnBZ,QAAQa,KAAK;SACbb,gBAAAA,QAAQc,IAAI,YAAZd,gBAAgB;QAChBQ;QACAL,SAAS,CAAC,mCAAmC,EAAEC,aAAa,GAAG;KAChE,CACEW,MAAM,CAACC,SACPC,IAAI,CAAC;IACR,IAAIC,UAAU;IACd,IAAIC,OAAO;IACX,KAAK,MAAMC,OAAOrB,KAAM;YAEDE,YAgBQD;QAjB7B,IAAImB,QAAQtB,wBAAwB;QACpC,IAAIwB,UAAUC,QAAOrB,aAAAA,KAAK,CAACmB,IAAI,YAAVnB,aAAc,IAAIP,IAAI,GAAG6B,WAAW;QACzD,IAAI,CAACF,QAAQG,QAAQ,CAAC,MAAM;;gBAITC;YAHjB,IAAIP,WAAWtB,0BAA0B;YACzCsB,WAAW;YACX,MAAMO,SAAS,MAAMhD,yBAAyB2C,KAAKT,KAAK,CAAC,IAAM;YAC/DU,UAAUC,eAAOG,2BAAAA,iBAAAA,OAAQC,MAAM,qBAAdD,eAAgBE,KAAK,mBAAI,IAAIjC,IAAI,GAAG6B,WAAW;QAClE;QACA,IAAI,CAACF,QAAQG,QAAQ,CAAC,MAAM;QAC5B,MAAMI,aAAa,MAAMjD,uBAAuB;YAAC0C;SAAQ;QACzD,IAAI,CAACO,WAAWC,MAAM,EAAE;QACxB,MAAMC,WAAWpB,SACbzB,wBACEyB,QACA,aACKJ,QAAQyB,KAAK,CAACC,KAAK;YACtB,sBAAsBhC,QAAQa,KAAK;YACnC,mBAAmB,GAAEb,iBAAAA,QAAQc,IAAI,YAAZd,iBAAgB;YACrC,oBAAoBQ;YACpBJ,aAAaD,SAASC,cAAc;YAEtCE,QAAQyB,KAAK,CAACE,OAAO,IAEvB;QACJ,MAAMC,SAAS,MAAM5D,UAAU;YAC7B6D,IAAIP;WACDzC,mBAAmB2C,UAAU;YAC9BM,SAASpC,QAAQa,KAAK;YACtBwB,MAAMzB;QACR,IACIN,QAAQyB,KAAK,CAACO,QAAQ,GAAG;YAAEA,UAAUhC,QAAQyB,KAAK,CAACO,QAAQ;QAAC,IAAI,CAAC;YACrEhC,SAAS;WACLH,SACA;YAAEoC,SAAS;gBAAE,oBAAoB,CAAC,CAAC,EAAEnC,YAAY,CAAC,CAAC;YAAC;QAAE,IACtD,CAAC;QAEP,IAAI,CAAC8B,OAAOf,IAAI,EAAE;QAClBA,QAAQ;QACR,mEAAmE;QACnE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,AAACnB,CAAAA,QAAQwC,KAAK,IAAItC,aAAa,UACjCtB,cAAcoB,QAAQwC,KAAK,IAC3B3D,oBAAmB,EACrB8B,KAAK,CAAC,IAAM8B;IAChB;AACF;AASA;;;;;;;CAOC,GACD,eAAelC,yBACbP,OAA4B,EAC5BE,QAAwC;IAExC,IAAIA,aAAa,WAAW,CAACF,QAAQwC,KAAK,EAAE;QAC1C,OAAO;YAAET,OAAO7C,iBAAiB;QAAM;IACzC;IACA,IAAI;YAWsCwD;QAVxC,MAAMC,KAAKvD;QACX,MAAM,CAACsD,KAAKE,KAAK,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACpCH,GAAGI,UAAU,CAAC,QAAQC,GAAG,CAAChD,QAAQwC,KAAK,EAAES,GAAG;YAC5CjD,QAAQkD,MAAM,GACVP,GAAGI,UAAU,CAAC,SAASC,GAAG,CAAChD,QAAQkD,MAAM,EAAED,GAAG,KAC9CJ,QAAQM,OAAO,CAAC;SACrB;QACD,MAAMC,OAAOV,IAAIO,GAAG,CAAC;QACrB,MAAMI,YAAYT,wBAAAA,KAAMK,GAAG,CAAC;QAC5B,OAAO;YACLlB,OAAO7C,iBAAiBwD,IAAIY,MAAM,IAAIZ,YAAAA,IAAIa,IAAI,cAARb,YAAc,OAAQ;WACxD,OAAOU,SAAS,YAAYA,OAAO;YAAEI,SAASJ;QAAK,IAAI,CAAC,GACxD,OAAOC,cAAc,YAAYA,YACjC;YAAEI,eAAeJ;QAAU,IAC3B,CAAC;IAET,EAAE,OAAOK,OAAO;QACdC,QAAQD,KAAK,CAAC,qCAAqCA;QACnD,OAAO;YAAE3B,OAAO7C,iBAAiB;QAAM;IACzC;AACF;AAEA;;;;;;CAMC,GACD,SAASuB,qBACPT,OAA4B,EAC5BM,OAAiC,EACjCH,MAAc;IAEd,MAAMyD,OAAO3F,0BAA0B+B,QAAQ4D,IAAI,EAAE;QACnDJ,SAASlD,QAAQkD,OAAO;QACxBN,QAAQlD,QAAQkD,MAAM;QACtBO,eAAenD,QAAQmD,aAAa;IACtC;IACA,IAAIG,QAAQ,gBAAgBC,IAAI,CAACD,OAAO,OAAOA;IAC/C,IAAI,CAACzD,QAAQ,OAAO;IACpB,OAAO,GAAGA,SAASyD,CAAAA,wBAAAA,KAAME,UAAU,CAAC,QAAOF,OAAO9F,WAAWK,MAAM4F,oBAAoB,GAAG;AAC5F;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,YACpBjE,IAAsB,EACtBC,OAA4B,EAC5BiC,UAA8B,CAAC,CAAC;IAEhC,IAAI;QACF,MAAMU,KAAKvD;QACX,MAAM6E,UAAU;eAAI,IAAIC,IAAInE;SAAM,CAACgB,MAAM,CAACC,SAASmD,KAAK,CAAC,GAAG;QAC5D,IAAI,CAACF,QAAQpC,MAAM,EAAE;QACrB,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,MAAMuC,WAAW,MAAMzB,GAAG0B,MAAM,IAC3BJ,QAAQK,GAAG,CAAC,CAAClD,MAAQuB,GAAGI,UAAU,CAAC,SAASC,GAAG,CAAC5B;QAErD,MAAMmD,QAAQ;YAAE/B,OAAOxC,QAAQwC,KAAK;YAAEU,QAAQlD,QAAQkD,MAAM;QAAC;QAC7D,MAAMsB,QAAQ7B,GAAG6B,KAAK;QACtB,IAAIC,QAAQ;QACZ,MAAMC,SAAmB,EAAE;QAC3B,KAAK,MAAMC,WAAWP,SAAU;YAC9B,MAAMQ,WAAWD,QAAQ1B,GAAG,CAACjF;YAG7B,MAAM6G,SAASF,QAAQ1B,GAAG,CAAC;YAG3B,IACE/E,2BACE0G,UACA,WACA5E,QAAQ8E,IAAI,EACZP,OACAM,SAEF;gBACAL,MAAMO,GAAG,CACPpC,GACGI,UAAU,CAAC,SACXC,GAAG,CAAC2B,QAAQK,EAAE,EACdjC,UAAU,CAAC,iBACXC,GAAG,IACN,mEAAmE;gBACnE,8DAA8D;gBAC9D,aAAKhD;oBAASiF,MAAM;oBAAOC,WAAW3G,WAAW4G,eAAe;;gBAElEV,SAAS;YACX;YACA,IACEvG,2BAA2B0G,UAAU,SAAS5E,QAAQ8E,IAAI,EAAEP,OAAOM,SACnE;gBACAH,OAAOU,IAAI,CAACT,QAAQK,EAAE;YACxB;QACF;QACA,IAAIP,QAAQ,GAAG,MAAMD,MAAMa,MAAM;QACjC;;;;;;;;;;;;;;;KAeC,GACD,IACEX,OAAO7C,MAAM,IACb,CAACI,QAAQqD,SAAS,IAClBjH,uBACA,CAACN,mCAAmCwH,GAAG,CAACvF,QAAQ8E,IAAI,GACpD;gBAME7C;YALF,MAAMuD,YAAY,MAAMhH,4BAA4BkG;YACpD,IAAI,CAACc,UAAU3D,MAAM,EAAE;YACvB,MAAM/B,kBACJ0F,WACAxF,UACAiC,kBAAAA,QAAQwD,MAAM,YAAdxD,kBAAkB,CAAC,GACnBA,QAAQ/B,QAAQ;QAEpB;IACF,EAAE,OAAOwD,OAAO;QACdC,QAAQD,KAAK,CAAC,+BAA+BA;IAC/C;AACF;AAEA,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,kDAAkD;AAClD,IAAIgC,gBAAuD;AAC3D,MAAMC,iBAAiB;AAEvB,eAAeC;IACb,MAAMC,MAAMC,KAAKD,GAAG;IACpB,IAAIH,iBAAiBG,MAAMH,cAAcK,EAAE,GAAGJ,gBAAgB;QAC5D,OAAOD,cAAc3F,IAAI;IAC3B;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAMA,OAAO,MAAMrB;IACnBgH,gBAAgB;QAAE3F;QAAMgG,IAAIF;IAAI;IAChC,OAAO9F;AACT;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeiG,YAAYhG,OAA4B;IAC5D,IAAI;QACF,MAAMiG,QAAQ7H,iCAAiC4B,QAAQ8E,IAAI;QAC3D,IAAImB,OAAO;YACT,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC;YAC5C,MAAMA,mBAAmBD,OAAO;gBAC9B7D,SAASpC,QAAQa,KAAK;eAClBb,QAAQc,IAAI,GAAG;gBAAEA,MAAMd,QAAQc,IAAI;YAAC,IAAI,CAAC,GACzCd,QAAQmG,KAAK,GAAG;gBAAEA,OAAOnG,QAAQmG,KAAK;YAAC,IAAI,CAAC,GAC5CnG,QAAQ4D,IAAI,GAAG;gBAAEpD,KAAKR,QAAQ4D,IAAI;YAAC,IAAI,CAAC,GACxC5D,QAAQwC,KAAK,GAAG;gBAAEA,OAAOxC,QAAQwC,KAAK;YAAC,IAAI,CAAC,GAC5CxC,QAAQkD,MAAM,GAAG;gBAAEA,QAAQlD,QAAQkD,MAAM;YAAC,IAAI,CAAC;YAErD;QACF;QACA,MAAMkD,mBAAmBpG;IAC3B,EAAE,OAAO0D,OAAO;QACdC,QAAQD,KAAK,CAAC,6BAA6BA;IAC7C;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAe0C,mBACpBpG,OAA4B,EAC5BiC,UAAmC,CAAC,CAAC;IAErC,IAAI;QACF,MAAM+B,YAAY,MAAM4B,iBAAiB5F,SAAS;YAChDE,UAAU;WACN+B,QAAQqD,SAAS,GAAG;YAAEA,WAAW;QAAK,IAAI,CAAC;IAEnD,EAAE,OAAO5B,OAAO;QACdC,QAAQD,KAAK,CAAC,6BAA6BA;IAC7C;AACF;AAEA;;;;;;CAMC,GACD,OAAO,eAAe2C,gBACpB7D,KAAa,EACbxC,OAA4B,EAC5BiC,UAAiD,CAAC,CAAC;IAEnD,IAAI;QACF,MAAMqE,UAAU,MAAMvH,eAAeyD;QACrC,MAAM+D,SAASD,QAAQvF,MAAM,CAC3B,CAACyF,SAAWA,OAAOC,IAAI,KAAK,WAAWD,OAAOC,IAAI,KAAK;QAEzD,yEAAyE;QACzE,mDAAmD;QACnD,MAAMhB,SAA6C,CAAC;QACpD,KAAK,MAAMe,UAAUD,OAAQ;YAC3B,IAAIC,OAAO7E,KAAK,EAAE8D,MAAM,CAACe,OAAOE,GAAG,CAAC,GAAGF,OAAO7E,KAAK;QACrD;QACA,MAAMqC,YACJuC,OAAOjC,GAAG,CAAC,CAACkC,SAAWA,OAAOE,GAAG,GACjC,aAAK1G;YAASwC;YACd;YAAEiD;WAAYxD,QAAQqD,SAAS,GAAG;YAAEA,WAAW;QAAK,IAAI,CAAC;IAE7D,EAAE,OAAO5B,OAAO;QACdC,QAAQD,KAAK,CAAC,iCAAiCA;IACjD;AACF;AAEA;;;CAGC,GACD,OAAO,SAASiD,gBACd/D,IAAyC,EACzCM,MAAc;IAEd,KAAK,MAAM0D,SAAS;QAAChE,wBAAAA,IAAM,CAAC,cAAc;QAAEA,wBAAAA,IAAM,CAAC,YAAY;KAAC,CAAE;QAChE,IAAI,OAAOgE,UAAU,YAAYA,MAAMlH,IAAI,IAAI,OAAOkH,MAAMlH,IAAI;IAClE;IACA,OAAOwD;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAAS2D,aAAaxE,IAAY,EAAEyE,IAAY;IACrD,OAAOzE,KAAKb,QAAQ,CAAC,YAAYa,KAAK0E,KAAK,CAAC,UAAU9F,IAAI,CAAC6F,QAAQzE;AACrE;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,eAAe2E,mBACpB9D,MAAc,EACdlD,OAA4B;IAE5B,IAAI;YAGC4C,WAIW5C;QANd,MAAM4C,OAAO,MAAMxD,YAAY2D,UAAU,CAAC,SAASC,GAAG,CAACE,QAAQD,GAAG;QAClE,MAAMgE,eACHrE,YAAAA,KAAKK,GAAG,CAAC,0BAATL,YAAkE,CAAC;QACtE,MAAMsE,WAAWC,OAAOC,OAAO,CAACH,aAC7BlG,MAAM,CAAC,CAAC,GAAG0F,KAAK,GAAKA,SAAS,WAAWA,SAAS,UAClDnC,GAAG,CAAC,CAAC,CAAClD,IAAI,GAAKA;QAClB,MAAMoB,SAAQxC,iBAAAA,QAAQwC,KAAK,YAAbxC,iBAAkB4C,KAAKK,GAAG,CAAC;QACzC,MAAM6D,OAAOH,gBAAgB/D,KAAKW,IAAI,IAAIL;QAC1C,MAAMc,YAAYkD,UAAU,aACvBlH;YACHa,OAAOgG,aAAa7G,QAAQa,KAAK,EAAEiG;WAC/B9G,QAAQc,IAAI,KAAK2B,YACjB;YAAE3B,MAAM+F,aAAa7G,QAAQc,IAAI,EAAEgG;QAAM,IACzC,CAAC;YACL5D;WACIV,QAAQ;YAAEA;QAAM,IAAI,CAAC;IAE7B,EAAE,OAAOkB,OAAO;QACdC,QAAQD,KAAK,CAAC,oCAAoCA;IACpD;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/notifications.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  buildRoute,\n  NOTIFICATION_SELF_SENT_EMAIL_TYPES,\n  NOTIFICATION_SETTINGS_FIELD,\n  normalizeNotificationLink,\n  notificationChannelEnabled,\n  type AglynNotification,\n  Route,\n  type NotificationSettings,\n} from '@aglyn/aglyn/server'\nimport { operatorAlertForNotificationType } from '@aglyn/aglyn/plugin-manager/operator-alerts'\nimport { isEmailConfigured, sendEmail } from '@aglyn/shared-util-email'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { withoutMailWithheldAccounts } from './account-mail'\nimport { findUserByUidAcrossPools, listStaffUidsAcrossPools } from './auth-pools'\nimport { filterSuppressedEmails } from './email-suppression'\nimport { meterOrgEmail, meterPlatformEmail } from './email-metering'\nimport firebaseAdmin from './firebase-admin'\nimport { listOrgMembers } from './organizations'\nimport {\n  loadSystemEmail,\n  renderLoadedSystemEmail,\n  systemEmailBrand,\n  systemEmailContent,\n  type SystemEmailBrand,\n} from './render-system-email'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\nexport type NotificationPayload = Omit<\n  AglynNotification,\n  '$id' | 'createdAt' | 'readAt'\n>\n\nexport interface NotifyUsersOptions {\n  /**\n   * Addresses the caller already holds, by uid (AGL-3224).\n   *\n   * Purely an optimization, and one worth taking where it is free: a caller\n   * that read the roster — `notifyOrgAdmins` does — has every address in hand\n   * already, and without this the email half would look each one up again in\n   * the directory. Absent uids fall back to that lookup, so passing a partial\n   * map is fine and passing none is correct.\n   */\n  emails?: Readonly<Record<string, string | null | undefined>>\n  /**\n   * Who the fan-out is for (AGL-3367). `staff` is the platform talking to its\n   * own people, so the email wears the platform's brand and is the platform's\n   * cost even when the notification is ABOUT an org, which a canceled\n   * subscription or a new ticket always is. Anything else speaks in the org's\n   * brand when the notification names one.\n   */\n  audience?: 'staff'\n  /**\n   * Write the console notification only, and mail nobody through the\n   * per-person email channel (AGL-3375): the caller has emailed the same\n   * alert to the operator's inbox, and a staff member who also switched\n   * email on would otherwise get it twice.\n   */\n  skipEmail?: boolean\n  /**\n   * People not to mail through the email channel for this one notification,\n   * because the caller emails them the same event itself — the seller's\n   * designed sale email beside a Buy Now order's notification. Everyone else\n   * the fan-out reaches is mailed as their preferences say.\n   */\n  skipEmailFor?: readonly string[]\n}\n\n/** The console's absolute origin for an email link, or `''` when unset. */\nfunction consoleOrigin(): string {\n  return (process.env.NEXT_PUBLIC_CONSOLE_URL ?? '').trim().replace(/\\/+$/, '')\n}\n\n/**\n * At most this many directory lookups per fan-out, and at most this many\n * notification emails.\n *\n * Both ceilings only ever bite on a fan-out where many recipients have\n * OPTED IN — the email channel defaults off outside a site's transactions\n * (`NOTIFICATION_TYPE_CHANNEL_DEFAULTS`), so the ordinary notification\n * costs exactly what it cost before this existed. They are here because a\n * fan-out takes up to 400 uids and `notifyUsers` runs inside the mutation\n * that emitted it: a notification must not be able to turn one write into\n * four hundred directory reads and four hundred sends.\n */\nconst NOTIFY_EMAIL_MAX_LOOKUPS = 25\nconst NOTIFY_EMAIL_MAX_SENDS = 50\n\n/**\n * The email beside the console notification (AGL-3224).\n *\n * One send per recipient, never a shared `to:` list — two people who manage\n * the same site have not agreed to be shown each other's addresses, and the\n * settings link in the footer belongs to one person.\n *\n * `List-Unsubscribe` points at the settings page rather than at a one-click\n * endpoint: this is not marketing mail and RFC 8058's POST form would be\n * claiming a capability that does not exist. What it does do is put the way\n * out in the headers as well as the body, so a client that surfaces it shows\n * the person the page where the switch they want actually is.\n *\n * Rendered through the `notification` system email (AGL-3367), which is what\n * gives it the header and footer every other system email wears, and makes\n * it designable on the staff System emails page. It used to hand `sendEmail`\n * bare text, which is the unbranded card the fallback HTML part draws. The\n * template is read once per fan-out and rendered per recipient.\n *\n * Never throws, like everything else on this path.\n */\nasync function emailNotification(\n  uids: string[],\n  payload: NotificationPayload,\n  known: Readonly<Record<string, string | null | undefined>>,\n  audience: NotifyUsersOptions['audience'],\n): Promise<void> {\n  const origin = consoleOrigin()\n  const settingsUrl = `${origin}${buildRoute(Route.MANAGE_NOTIFICATION_SETTINGS)}`\n  const context = await notificationEmailContext(payload, audience)\n  const url = notificationEmailUrl(payload, context, origin)\n  const loaded = await loadSystemEmail('notification').catch(() => null)\n  const fallbackText = [\n    payload.title,\n    payload.body ?? '',\n    url,\n    origin ? `Change what you are emailed about: ${settingsUrl}` : '',\n  ]\n    .filter(Boolean)\n    .join('\\n\\n')\n  let lookups = 0\n  let sent = 0\n  for (const uid of uids) {\n    if (sent >= NOTIFY_EMAIL_MAX_SENDS) break\n    let address = String(known[uid] ?? '').trim().toLowerCase()\n    if (!address.includes('@')) {\n      if (lookups >= NOTIFY_EMAIL_MAX_LOOKUPS) continue\n      lookups += 1\n      const pooled = await findUserByUidAcrossPools(uid).catch(() => null)\n      address = String(pooled?.record?.email ?? '').trim().toLowerCase()\n    }\n    if (!address.includes('@')) continue\n    const recipients = await filterSuppressedEmails([address])\n    if (!recipients.length) continue\n    const rendered = loaded\n      ? renderLoadedSystemEmail(\n          loaded,\n          {\n            ...context.brand.merge,\n            'notification.title': payload.title,\n            'notification.body': payload.body ?? '',\n            'notification.url': url,\n            settingsUrl: origin ? settingsUrl : '',\n          },\n          context.brand.options,\n        )\n      : null\n    const result = await sendEmail({\n      to: recipients,\n      ...systemEmailContent(rendered, {\n        subject: payload.title,\n        text: fallbackText,\n      }),\n      ...(context.brand.fromName ? { fromName: context.brand.fromName } : {}),\n      context: 'notification',\n      ...(origin\n        ? { headers: { 'List-Unsubscribe': `<${settingsUrl}>` } }\n        : {}),\n    })\n    if (!result.sent) continue\n    sent += 1\n    // Whose cost it is: a notification to a workspace's people is that\n    // workspace's mail, and a staff alert or an account-level notice is the\n    // platform's, whichever org it is about.\n    await (payload.orgId && audience !== 'staff'\n      ? meterOrgEmail(payload.orgId)\n      : meterPlatformEmail()\n    ).catch(() => undefined)\n  }\n}\n\n/** What a notification email needs from the org and site it is about. */\ninterface NotificationEmailContext {\n  brand: SystemEmailBrand\n  orgSlug?: string\n  hostSubdomain?: string\n}\n\n/**\n * The org's brand, and the slug and subdomain its stored link is rewritten\n * with (AGL-3367): at most two reads per fan-out, made only when someone is\n * being emailed.\n *\n * A staff fan-out reads nothing. Its brand is the platform's, and its links\n * are staff routes that need no rewriting.\n */\nasync function notificationEmailContext(\n  payload: NotificationPayload,\n  audience: NotifyUsersOptions['audience'],\n): Promise<NotificationEmailContext> {\n  if (audience === 'staff' || !payload.orgId) {\n    return { brand: systemEmailBrand(null) }\n  }\n  try {\n    const db = firestore()\n    const [org, host] = await Promise.all([\n      db.collection('orgs').doc(payload.orgId).get(),\n      payload.hostId\n        ? db.collection('hosts').doc(payload.hostId).get()\n        : Promise.resolve(null),\n    ])\n    const slug = org.get('slug')\n    const subdomain = host?.get('subdomain')\n    return {\n      brand: systemEmailBrand(org.exists ? (org.data() ?? null) : null),\n      ...(typeof slug === 'string' && slug ? { orgSlug: slug } : {}),\n      ...(typeof subdomain === 'string' && subdomain\n        ? { hostSubdomain: subdomain }\n        : {}),\n    }\n  } catch (error) {\n    console.error('notification email context failed', error)\n    return { brand: systemEmailBrand(null) }\n  }\n}\n\n/**\n * Where the email's button goes: the notification's own link, rewritten onto\n * today's routes the way the console rewrites it when it is clicked, else\n * the notifications page. A stored host link is `/{hostDocId}/…`, which only\n * that rewrite turns into a page that exists. Empty when the deployment has\n * no console origin to make a link absolute with.\n */\nfunction notificationEmailUrl(\n  payload: NotificationPayload,\n  context: NotificationEmailContext,\n  origin: string,\n): string {\n  const link = normalizeNotificationLink(payload.link, {\n    orgSlug: context.orgSlug,\n    hostId: payload.hostId,\n    hostSubdomain: context.hostSubdomain,\n  })\n  if (link && /^https?:\\/\\//i.test(link)) return link\n  if (!origin) return ''\n  return `${origin}${link?.startsWith('/') ? link : buildRoute(Route.MANAGE_NOTIFICATIONS)}`\n}\n\n/**\n * Notification fan-out (AGL-259): batch-writes one doc per recipient at\n * `users/{uid}/notifications`, and — for recipients who asked for it\n * (AGL-3224) — sends one email beside it. Never throws: a notification miss,\n * or a send that failed, must not break the mutation that emitted it.\n */\nexport async function notifyUsers(\n  uids: Iterable<string>,\n  payload: NotificationPayload,\n  options: NotifyUsersOptions = {},\n): Promise<void> {\n  try {\n    const db = firestore()\n    const targets = [...new Set(uids)].filter(Boolean).slice(0, 400)\n    if (!targets.length) return\n    // Per-user preferences (AGL-267, AGL-3223): one getAll over the user\n    // docs, which now answers for both channels and for all three scopes —\n    // the settings live on this document precisely so that stays one read.\n    const userDocs = await db.getAll(\n      ...targets.map((uid) => db.collection('users').doc(uid)),\n    )\n    const scope = { orgId: payload.orgId, hostId: payload.hostId }\n    const batch = db.batch()\n    let count = 0\n    const mailTo: string[] = []\n    for (const userDoc of userDocs) {\n      const settings = userDoc.get(NOTIFICATION_SETTINGS_FIELD) as\n        | NotificationSettings\n        | undefined\n      const legacy = userDoc.get('notificationPrefs') as\n        | Record<string, boolean>\n        | undefined\n      if (\n        notificationChannelEnabled(\n          settings,\n          'console',\n          payload.type,\n          scope,\n          legacy,\n        )\n      ) {\n        batch.set(\n          db\n            .collection('users')\n            .doc(userDoc.id)\n            .collection('notifications')\n            .doc(),\n          // `read: false` on create, so the feed can ask for unread and read\n          // alike by equality (AGL-3321; see `AglynNotification.read`).\n          { ...payload, read: false, createdAt: FieldValue.serverTimestamp() },\n        )\n        count += 1\n      }\n      if (\n        notificationChannelEnabled(settings, 'email', payload.type, scope, legacy) &&\n        !options.skipEmailFor?.includes(userDoc.id)\n      ) {\n        mailTo.push(userDoc.id)\n      }\n    }\n    if (count > 0) await batch.commit()\n    /*\n     * THE EMAIL AFTER THE COMMIT, and not inside its `try`.\n     *\n     * The console notification is the durable record and the send is a\n     * courtesy on top of it, so the order is the one where a failing network\n     * call cannot lose the record. The two channels are independent by\n     * design — a person may have muted the feed and asked for mail, or the\n     * reverse — so neither is gated on the other having happened.\n     *\n     * Digests are excluded: they compose and send their own mail, under\n     * their own switches, and the generic channel would send a second\n     * message announcing that the first one had been sent.\n     *\n     * A locked or disabled account is not mailed (AGL-3418); its feed entry\n     * above still records the event.\n     */\n    if (\n      mailTo.length &&\n      !options.skipEmail &&\n      isEmailConfigured() &&\n      !NOTIFICATION_SELF_SENT_EMAIL_TYPES.has(payload.type)\n    ) {\n      const reachable = await withoutMailWithheldAccounts(mailTo)\n      if (!reachable.length) return\n      await emailNotification(\n        reachable,\n        payload,\n        options.emails ?? {},\n        options.audience,\n      )\n    }\n  } catch (error) {\n    console.error('notification fan-out failed', error)\n  }\n}\n\n// Staff are identified by a Firebase Auth custom claim (`staff`), which is not\n// a Firestore query — so the roster comes from paginating the auth users. A\n// burst of ticket activity shouldn't rescan every time, so the (small) result\n// is cached briefly. Fails soft to an empty list.\nlet staffUidCache: { uids: string[]; at: number } | null = null\nconst STAFF_CACHE_MS = 60_000\n\nasync function listStaffUids(): Promise<string[]> {\n  const now = Date.now()\n  if (staffUidCache && now - staffUidCache.at < STAFF_CACHE_MS) {\n    return staffUidCache.uids\n  }\n  // Across ALL auth pools (AGL-1122). This scanned only the project pool, so\n  // a staff member who signs in through enterprise SSO — whose account lives\n  // in a GCIP tenant pool — was never in the fan-out. Nothing errored; the\n  // notification simply never arrived, which is the worst shape a miss can\n  // take on an alerting path.\n  const uids = await listStaffUidsAcrossPools()\n  staffUidCache = { uids, at: now }\n  return uids\n}\n\n/**\n * Notifies every staff-claim holder (AGL-850) — the support-desk audience.\n * Staff are not org members, so `notifyOrgAdmins`/`notifyHostManagers` never\n * reach them; this enumerates the `staff` custom claim instead. The docs land\n * at `users/{uid}/notifications`, which the console notifications menu already\n * renders, so no separate staff inbox is needed. Never throws.\n *\n * A type the operator alert registry names (AGL-3377) — a fraud or risk\n * alert, a dispute nobody owns, a support ticket — is raised as that alert\n * instead: the same console notification, plus staff's switches, the\n * operator email or digest, and the webhook. See `raiseOperatorAlert`.\n */\nexport async function notifyStaff(payload: NotificationPayload): Promise<void> {\n  try {\n    const alert = operatorAlertForNotificationType(payload.type)\n    if (alert) {\n      const { raiseOperatorAlert } = await import('./operator-alerts')\n      await raiseOperatorAlert(alert, {\n        subject: payload.title,\n        ...(payload.body ? { body: payload.body } : {}),\n        ...(payload.level ? { level: payload.level } : {}),\n        ...(payload.link ? { url: payload.link } : {}),\n        ...(payload.orgId ? { orgId: payload.orgId } : {}),\n        ...(payload.hostId ? { hostId: payload.hostId } : {}),\n      })\n      return\n    }\n    await notifyStaffConsole(payload)\n  } catch (error) {\n    console.error('staff notification failed', error)\n  }\n}\n\n/**\n * The staff console notification alone, with the per-person email channel\n * it carries: what `notifyStaff` did before the registry, and what\n * `raiseOperatorAlert` writes as its first step. Never throws.\n */\nexport async function notifyStaffConsole(\n  payload: NotificationPayload,\n  options: { skipEmail?: boolean } = {},\n): Promise<void> {\n  try {\n    await notifyUsers(await listStaffUids(), payload, {\n      audience: 'staff',\n      ...(options.skipEmail ? { skipEmail: true } : {}),\n    })\n  } catch (error) {\n    console.error('staff notification failed', error)\n  }\n}\n\n/**\n * Notifies the org's owner + admins (billing, membership, org events).\n *\n * `skipEmail` is for a caller that emails the same notice to the same people\n * itself — the usage alerts do (AGL-3431) — so an admin who switched the\n * email channel on is not sent it twice.\n */\nexport async function notifyOrgAdmins(\n  orgId: string,\n  payload: NotificationPayload,\n  options: Pick<NotifyUsersOptions, 'skipEmail'> = {},\n): Promise<void> {\n  try {\n    const members = await listOrgMembers(orgId)\n    const admins = members.filter(\n      (member) => member.role === 'owner' || member.role === 'admin',\n    )\n    // The roster rows carry addresses, so the email channel (AGL-3224) needs\n    // no directory lookup for anyone reached this way.\n    const emails: Record<string, string | undefined> = {}\n    for (const member of admins) {\n      if (member.email) emails[member.$id] = member.email\n    }\n    await notifyUsers(\n      admins.map((member) => member.$id),\n      { ...payload, orgId },\n      { emails, ...(options.skipEmail ? { skipEmail: true } : {}) },\n    )\n  } catch (error) {\n    console.error('org admin notification failed', error)\n  }\n}\n\n/**\n * The name a site's managers know it by: the name they gave it, then its\n * address, then — for a doc with neither — its id.\n */\nexport function hostDisplayName(\n  host: Record<string, unknown> | undefined,\n  hostId: string,\n): string {\n  for (const value of [host?.['displayName'], host?.['subdomain']]) {\n    if (typeof value === 'string' && value.trim()) return value.trim()\n  }\n  return hostId\n}\n\n/**\n * Fills `{site}` in a host notification's title or body (AGL-3432).\n *\n * A manager of ten storefronts reads \"New order — $42.00\" and cannot tell\n * which store it came from, and the email shows only the body to someone who\n * skips the subject. `notifyHostManagers` already reads the host doc, so a\n * caller writes \"New order on {site}\" and pays no read of its own.\n */\nexport function withSiteName(text: string, site: string): string {\n  return text.includes('{site}') ? text.split('{site}').join(site) : text\n}\n\n/**\n * Notifies everyone who manages a host (admin/editor in the host doc's\n * `memberRoles` projection) — the audience for form submissions and\n * bookings on that site.\n *\n * The OWNING ORG travels with the notification (AGL-1773). Host links are\n * stored in the legacy `/{hostDocId}/rest` shape and rewritten to\n * `/{orgSlug}/hosts/{subdomain}/rest` when they are FOLLOWED\n * (`normalizeNotificationLink`, AGL-644) — a rewrite that needs an org slug.\n * With no `orgId` on the doc the console had nothing to key on and fell back\n * to whichever org the reader happens to have OPEN, so a manager who belongs\n * to more than one workspace was routed to `/{other-org}/hosts/{subdomain}/…`\n * and got a designed 404: `HostGuard` only resolves subdomains belonging to\n * the current org. `notifyOrgAdmins` has always stamped it; the host fan-out\n * — every form submission, booking, order and stock alert — never did.\n *\n * The host doc already carries `orgId` (AGL-233), so this costs no extra\n * read. Spread conditionally: the field is optional on the host model and\n * Firestore rejects `undefined`.\n */\nexport async function notifyHostManagers(\n  hostId: string,\n  payload: NotificationPayload,\n  options: {\n    /**\n     * Mail the workspace owner nothing through the email channel, because\n     * the caller sends them their own email about the same event.\n     */\n    skipOwnerEmail?: boolean\n  } = {},\n): Promise<void> {\n  try {\n    const host = await firestore().collection('hosts').doc(hostId).get()\n    const memberRoles =\n      (host.get('memberRoles') as Record<string, string> | undefined) ?? {}\n    const managers = Object.entries(memberRoles)\n      .filter(([, role]) => role === 'admin' || role === 'editor')\n      .map(([uid]) => uid)\n    const orgId = payload.orgId ?? (host.get('orgId') as string | undefined)\n    const site = hostDisplayName(host.data(), hostId)\n    const ownerUid =\n      options.skipOwnerEmail && orgId\n        ? ((await firestore().collection('orgs').doc(orgId).get()).get('ownerUid') as\n            | string\n            | undefined)\n        : undefined\n    await notifyUsers(\n      managers,\n      {\n        ...payload,\n        title: withSiteName(payload.title, site),\n        ...(payload.body !== undefined\n          ? { body: withSiteName(payload.body, site) }\n          : {}),\n        hostId,\n        ...(orgId ? { orgId } : {}),\n      },\n      ownerUid ? { skipEmailFor: [ownerUid] } : {},\n    )\n  } catch (error) {\n    console.error('host manager notification failed', error)\n  }\n}\n"],"names":["buildRoute","NOTIFICATION_SELF_SENT_EMAIL_TYPES","NOTIFICATION_SETTINGS_FIELD","normalizeNotificationLink","notificationChannelEnabled","Route","operatorAlertForNotificationType","isEmailConfigured","sendEmail","FieldValue","withoutMailWithheldAccounts","findUserByUidAcrossPools","listStaffUidsAcrossPools","filterSuppressedEmails","meterOrgEmail","meterPlatformEmail","firebaseAdmin","listOrgMembers","loadSystemEmail","renderLoadedSystemEmail","systemEmailBrand","systemEmailContent","firestore","app","consoleOrigin","process","env","NEXT_PUBLIC_CONSOLE_URL","trim","replace","NOTIFY_EMAIL_MAX_LOOKUPS","NOTIFY_EMAIL_MAX_SENDS","emailNotification","uids","payload","known","audience","origin","settingsUrl","MANAGE_NOTIFICATION_SETTINGS","context","notificationEmailContext","url","notificationEmailUrl","loaded","catch","fallbackText","title","body","filter","Boolean","join","lookups","sent","uid","address","String","toLowerCase","includes","pooled","record","email","recipients","length","rendered","brand","merge","options","result","to","subject","text","fromName","headers","orgId","undefined","org","db","host","Promise","all","collection","doc","get","hostId","resolve","slug","subdomain","exists","data","orgSlug","hostSubdomain","error","console","link","test","startsWith","MANAGE_NOTIFICATIONS","notifyUsers","targets","Set","slice","userDocs","getAll","map","scope","batch","count","mailTo","userDoc","settings","legacy","type","set","id","read","createdAt","serverTimestamp","skipEmailFor","push","commit","skipEmail","has","reachable","emails","staffUidCache","STAFF_CACHE_MS","listStaffUids","now","Date","at","notifyStaff","alert","raiseOperatorAlert","level","notifyStaffConsole","notifyOrgAdmins","members","admins","member","role","$id","hostDisplayName","value","withSiteName","site","split","notifyHostManagers","memberRoles","managers","Object","entries","ownerUid","skipOwnerEmail"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,UAAU,EACVC,kCAAkC,EAClCC,2BAA2B,EAC3BC,yBAAyB,EACzBC,0BAA0B,EAE1BC,KAAK,QAEA,sBAAqB;AAC5B,SAASC,gCAAgC,QAAQ,8CAA6C;AAC9F,SAASC,iBAAiB,EAAEC,SAAS,QAAQ,2BAA0B;AACvE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,oBAAgB;AAC5D,SAASC,wBAAwB,EAAEC,wBAAwB,QAAQ,kBAAc;AACjF,SAASC,sBAAsB,QAAQ,yBAAqB;AAC5D,SAASC,aAAa,EAAEC,kBAAkB,QAAQ,sBAAkB;AACpE,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,cAAc,QAAQ,qBAAiB;AAChD,SACEC,eAAe,EACfC,uBAAuB,EACvBC,gBAAgB,EAChBC,kBAAkB,QAEb,2BAAuB;AAE9B,MAAMC,YAAY,IAAMN,cAAcO,GAAG,GAAGD,SAAS;AA0CrD,yEAAyE,GACzE,SAASE;QACCC;IAAR,OAAO,EAACA,uCAAAA,QAAQC,GAAG,CAACC,uBAAuB,YAAnCF,uCAAuC,IAAIG,IAAI,GAAGC,OAAO,CAAC,QAAQ;AAC5E;AAEA;;;;;;;;;;;CAWC,GACD,MAAMC,2BAA2B;AACjC,MAAMC,yBAAyB;AAE/B;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,eAAeC,kBACbC,IAAc,EACdC,OAA4B,EAC5BC,KAA0D,EAC1DC,QAAwC;QAStCF;IAPF,MAAMG,SAASb;IACf,MAAMc,cAAc,GAAGD,SAASrC,WAAWK,MAAMkC,4BAA4B,GAAG;IAChF,MAAMC,UAAU,MAAMC,yBAAyBP,SAASE;IACxD,MAAMM,MAAMC,qBAAqBT,SAASM,SAASH;IACnD,MAAMO,SAAS,MAAM1B,gBAAgB,gBAAgB2B,KAAK,CAAC,IAAM;IACjE,MAAMC,eAAe;QACnBZ,QAAQa,KAAK;SACbb,gBAAAA,QAAQc,IAAI,YAAZd,gBAAgB;QAChBQ;QACAL,SAAS,CAAC,mCAAmC,EAAEC,aAAa,GAAG;KAChE,CACEW,MAAM,CAACC,SACPC,IAAI,CAAC;IACR,IAAIC,UAAU;IACd,IAAIC,OAAO;IACX,KAAK,MAAMC,OAAOrB,KAAM;YAEDE,YAgBQD;QAjB7B,IAAImB,QAAQtB,wBAAwB;QACpC,IAAIwB,UAAUC,QAAOrB,aAAAA,KAAK,CAACmB,IAAI,YAAVnB,aAAc,IAAIP,IAAI,GAAG6B,WAAW;QACzD,IAAI,CAACF,QAAQG,QAAQ,CAAC,MAAM;;gBAITC;YAHjB,IAAIP,WAAWtB,0BAA0B;YACzCsB,WAAW;YACX,MAAMO,SAAS,MAAMhD,yBAAyB2C,KAAKT,KAAK,CAAC,IAAM;YAC/DU,UAAUC,eAAOG,2BAAAA,iBAAAA,OAAQC,MAAM,qBAAdD,eAAgBE,KAAK,mBAAI,IAAIjC,IAAI,GAAG6B,WAAW;QAClE;QACA,IAAI,CAACF,QAAQG,QAAQ,CAAC,MAAM;QAC5B,MAAMI,aAAa,MAAMjD,uBAAuB;YAAC0C;SAAQ;QACzD,IAAI,CAACO,WAAWC,MAAM,EAAE;QACxB,MAAMC,WAAWpB,SACbzB,wBACEyB,QACA,aACKJ,QAAQyB,KAAK,CAACC,KAAK;YACtB,sBAAsBhC,QAAQa,KAAK;YACnC,mBAAmB,GAAEb,iBAAAA,QAAQc,IAAI,YAAZd,iBAAgB;YACrC,oBAAoBQ;YACpBJ,aAAaD,SAASC,cAAc;YAEtCE,QAAQyB,KAAK,CAACE,OAAO,IAEvB;QACJ,MAAMC,SAAS,MAAM5D,UAAU;YAC7B6D,IAAIP;WACDzC,mBAAmB2C,UAAU;YAC9BM,SAASpC,QAAQa,KAAK;YACtBwB,MAAMzB;QACR,IACIN,QAAQyB,KAAK,CAACO,QAAQ,GAAG;YAAEA,UAAUhC,QAAQyB,KAAK,CAACO,QAAQ;QAAC,IAAI,CAAC;YACrEhC,SAAS;WACLH,SACA;YAAEoC,SAAS;gBAAE,oBAAoB,CAAC,CAAC,EAAEnC,YAAY,CAAC,CAAC;YAAC;QAAE,IACtD,CAAC;QAEP,IAAI,CAAC8B,OAAOf,IAAI,EAAE;QAClBA,QAAQ;QACR,mEAAmE;QACnE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,AAACnB,CAAAA,QAAQwC,KAAK,IAAItC,aAAa,UACjCtB,cAAcoB,QAAQwC,KAAK,IAC3B3D,oBAAmB,EACrB8B,KAAK,CAAC,IAAM8B;IAChB;AACF;AASA;;;;;;;CAOC,GACD,eAAelC,yBACbP,OAA4B,EAC5BE,QAAwC;IAExC,IAAIA,aAAa,WAAW,CAACF,QAAQwC,KAAK,EAAE;QAC1C,OAAO;YAAET,OAAO7C,iBAAiB;QAAM;IACzC;IACA,IAAI;YAWsCwD;QAVxC,MAAMC,KAAKvD;QACX,MAAM,CAACsD,KAAKE,KAAK,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACpCH,GAAGI,UAAU,CAAC,QAAQC,GAAG,CAAChD,QAAQwC,KAAK,EAAES,GAAG;YAC5CjD,QAAQkD,MAAM,GACVP,GAAGI,UAAU,CAAC,SAASC,GAAG,CAAChD,QAAQkD,MAAM,EAAED,GAAG,KAC9CJ,QAAQM,OAAO,CAAC;SACrB;QACD,MAAMC,OAAOV,IAAIO,GAAG,CAAC;QACrB,MAAMI,YAAYT,wBAAAA,KAAMK,GAAG,CAAC;QAC5B,OAAO;YACLlB,OAAO7C,iBAAiBwD,IAAIY,MAAM,IAAIZ,YAAAA,IAAIa,IAAI,cAARb,YAAc,OAAQ;WACxD,OAAOU,SAAS,YAAYA,OAAO;YAAEI,SAASJ;QAAK,IAAI,CAAC,GACxD,OAAOC,cAAc,YAAYA,YACjC;YAAEI,eAAeJ;QAAU,IAC3B,CAAC;IAET,EAAE,OAAOK,OAAO;QACdC,QAAQD,KAAK,CAAC,qCAAqCA;QACnD,OAAO;YAAE3B,OAAO7C,iBAAiB;QAAM;IACzC;AACF;AAEA;;;;;;CAMC,GACD,SAASuB,qBACPT,OAA4B,EAC5BM,OAAiC,EACjCH,MAAc;IAEd,MAAMyD,OAAO3F,0BAA0B+B,QAAQ4D,IAAI,EAAE;QACnDJ,SAASlD,QAAQkD,OAAO;QACxBN,QAAQlD,QAAQkD,MAAM;QACtBO,eAAenD,QAAQmD,aAAa;IACtC;IACA,IAAIG,QAAQ,gBAAgBC,IAAI,CAACD,OAAO,OAAOA;IAC/C,IAAI,CAACzD,QAAQ,OAAO;IACpB,OAAO,GAAGA,SAASyD,CAAAA,wBAAAA,KAAME,UAAU,CAAC,QAAOF,OAAO9F,WAAWK,MAAM4F,oBAAoB,GAAG;AAC5F;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,YACpBjE,IAAsB,EACtBC,OAA4B,EAC5BiC,UAA8B,CAAC,CAAC;IAEhC,IAAI;QACF,MAAMU,KAAKvD;QACX,MAAM6E,UAAU;eAAI,IAAIC,IAAInE;SAAM,CAACgB,MAAM,CAACC,SAASmD,KAAK,CAAC,GAAG;QAC5D,IAAI,CAACF,QAAQpC,MAAM,EAAE;QACrB,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,MAAMuC,WAAW,MAAMzB,GAAG0B,MAAM,IAC3BJ,QAAQK,GAAG,CAAC,CAAClD,MAAQuB,GAAGI,UAAU,CAAC,SAASC,GAAG,CAAC5B;QAErD,MAAMmD,QAAQ;YAAE/B,OAAOxC,QAAQwC,KAAK;YAAEU,QAAQlD,QAAQkD,MAAM;QAAC;QAC7D,MAAMsB,QAAQ7B,GAAG6B,KAAK;QACtB,IAAIC,QAAQ;QACZ,MAAMC,SAAmB,EAAE;QAC3B,KAAK,MAAMC,WAAWP,SAAU;gBA8B3BnC;YA7BH,MAAM2C,WAAWD,QAAQ1B,GAAG,CAACjF;YAG7B,MAAM6G,SAASF,QAAQ1B,GAAG,CAAC;YAG3B,IACE/E,2BACE0G,UACA,WACA5E,QAAQ8E,IAAI,EACZP,OACAM,SAEF;gBACAL,MAAMO,GAAG,CACPpC,GACGI,UAAU,CAAC,SACXC,GAAG,CAAC2B,QAAQK,EAAE,EACdjC,UAAU,CAAC,iBACXC,GAAG,IACN,mEAAmE;gBACnE,8DAA8D;gBAC9D,aAAKhD;oBAASiF,MAAM;oBAAOC,WAAW3G,WAAW4G,eAAe;;gBAElEV,SAAS;YACX;YACA,IACEvG,2BAA2B0G,UAAU,SAAS5E,QAAQ8E,IAAI,EAAEP,OAAOM,WACnE,GAAC5C,wBAAAA,QAAQmD,YAAY,qBAApBnD,sBAAsBT,QAAQ,CAACmD,QAAQK,EAAE,IAC1C;gBACAN,OAAOW,IAAI,CAACV,QAAQK,EAAE;YACxB;QACF;QACA,IAAIP,QAAQ,GAAG,MAAMD,MAAMc,MAAM;QACjC;;;;;;;;;;;;;;;KAeC,GACD,IACEZ,OAAO7C,MAAM,IACb,CAACI,QAAQsD,SAAS,IAClBlH,uBACA,CAACN,mCAAmCyH,GAAG,CAACxF,QAAQ8E,IAAI,GACpD;gBAME7C;YALF,MAAMwD,YAAY,MAAMjH,4BAA4BkG;YACpD,IAAI,CAACe,UAAU5D,MAAM,EAAE;YACvB,MAAM/B,kBACJ2F,WACAzF,UACAiC,kBAAAA,QAAQyD,MAAM,YAAdzD,kBAAkB,CAAC,GACnBA,QAAQ/B,QAAQ;QAEpB;IACF,EAAE,OAAOwD,OAAO;QACdC,QAAQD,KAAK,CAAC,+BAA+BA;IAC/C;AACF;AAEA,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,kDAAkD;AAClD,IAAIiC,gBAAuD;AAC3D,MAAMC,iBAAiB;AAEvB,eAAeC;IACb,MAAMC,MAAMC,KAAKD,GAAG;IACpB,IAAIH,iBAAiBG,MAAMH,cAAcK,EAAE,GAAGJ,gBAAgB;QAC5D,OAAOD,cAAc5F,IAAI;IAC3B;IACA,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAMA,OAAO,MAAMrB;IACnBiH,gBAAgB;QAAE5F;QAAMiG,IAAIF;IAAI;IAChC,OAAO/F;AACT;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,eAAekG,YAAYjG,OAA4B;IAC5D,IAAI;QACF,MAAMkG,QAAQ9H,iCAAiC4B,QAAQ8E,IAAI;QAC3D,IAAIoB,OAAO;YACT,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC;YAC5C,MAAMA,mBAAmBD,OAAO;gBAC9B9D,SAASpC,QAAQa,KAAK;eAClBb,QAAQc,IAAI,GAAG;gBAAEA,MAAMd,QAAQc,IAAI;YAAC,IAAI,CAAC,GACzCd,QAAQoG,KAAK,GAAG;gBAAEA,OAAOpG,QAAQoG,KAAK;YAAC,IAAI,CAAC,GAC5CpG,QAAQ4D,IAAI,GAAG;gBAAEpD,KAAKR,QAAQ4D,IAAI;YAAC,IAAI,CAAC,GACxC5D,QAAQwC,KAAK,GAAG;gBAAEA,OAAOxC,QAAQwC,KAAK;YAAC,IAAI,CAAC,GAC5CxC,QAAQkD,MAAM,GAAG;gBAAEA,QAAQlD,QAAQkD,MAAM;YAAC,IAAI,CAAC;YAErD;QACF;QACA,MAAMmD,mBAAmBrG;IAC3B,EAAE,OAAO0D,OAAO;QACdC,QAAQD,KAAK,CAAC,6BAA6BA;IAC7C;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAe2C,mBACpBrG,OAA4B,EAC5BiC,UAAmC,CAAC,CAAC;IAErC,IAAI;QACF,MAAM+B,YAAY,MAAM6B,iBAAiB7F,SAAS;YAChDE,UAAU;WACN+B,QAAQsD,SAAS,GAAG;YAAEA,WAAW;QAAK,IAAI,CAAC;IAEnD,EAAE,OAAO7B,OAAO;QACdC,QAAQD,KAAK,CAAC,6BAA6BA;IAC7C;AACF;AAEA;;;;;;CAMC,GACD,OAAO,eAAe4C,gBACpB9D,KAAa,EACbxC,OAA4B,EAC5BiC,UAAiD,CAAC,CAAC;IAEnD,IAAI;QACF,MAAMsE,UAAU,MAAMxH,eAAeyD;QACrC,MAAMgE,SAASD,QAAQxF,MAAM,CAC3B,CAAC0F,SAAWA,OAAOC,IAAI,KAAK,WAAWD,OAAOC,IAAI,KAAK;QAEzD,yEAAyE;QACzE,mDAAmD;QACnD,MAAMhB,SAA6C,CAAC;QACpD,KAAK,MAAMe,UAAUD,OAAQ;YAC3B,IAAIC,OAAO9E,KAAK,EAAE+D,MAAM,CAACe,OAAOE,GAAG,CAAC,GAAGF,OAAO9E,KAAK;QACrD;QACA,MAAMqC,YACJwC,OAAOlC,GAAG,CAAC,CAACmC,SAAWA,OAAOE,GAAG,GACjC,aAAK3G;YAASwC;YACd;YAAEkD;WAAYzD,QAAQsD,SAAS,GAAG;YAAEA,WAAW;QAAK,IAAI,CAAC;IAE7D,EAAE,OAAO7B,OAAO;QACdC,QAAQD,KAAK,CAAC,iCAAiCA;IACjD;AACF;AAEA;;;CAGC,GACD,OAAO,SAASkD,gBACdhE,IAAyC,EACzCM,MAAc;IAEd,KAAK,MAAM2D,SAAS;QAACjE,wBAAAA,IAAM,CAAC,cAAc;QAAEA,wBAAAA,IAAM,CAAC,YAAY;KAAC,CAAE;QAChE,IAAI,OAAOiE,UAAU,YAAYA,MAAMnH,IAAI,IAAI,OAAOmH,MAAMnH,IAAI;IAClE;IACA,OAAOwD;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAAS4D,aAAazE,IAAY,EAAE0E,IAAY;IACrD,OAAO1E,KAAKb,QAAQ,CAAC,YAAYa,KAAK2E,KAAK,CAAC,UAAU/F,IAAI,CAAC8F,QAAQ1E;AACrE;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,eAAe4E,mBACpB/D,MAAc,EACdlD,OAA4B,EAC5BiC,UAMI,CAAC,CAAC;IAEN,IAAI;YAGCW,WAIW5C;QANd,MAAM4C,OAAO,MAAMxD,YAAY2D,UAAU,CAAC,SAASC,GAAG,CAACE,QAAQD,GAAG;QAClE,MAAMiE,eACHtE,YAAAA,KAAKK,GAAG,CAAC,0BAATL,YAAkE,CAAC;QACtE,MAAMuE,WAAWC,OAAOC,OAAO,CAACH,aAC7BnG,MAAM,CAAC,CAAC,GAAG2F,KAAK,GAAKA,SAAS,WAAWA,SAAS,UAClDpC,GAAG,CAAC,CAAC,CAAClD,IAAI,GAAKA;QAClB,MAAMoB,SAAQxC,iBAAAA,QAAQwC,KAAK,YAAbxC,iBAAkB4C,KAAKK,GAAG,CAAC;QACzC,MAAM8D,OAAOH,gBAAgBhE,KAAKW,IAAI,IAAIL;QAC1C,MAAMoE,WACJrF,QAAQsF,cAAc,IAAI/E,QACrB,AAAC,CAAA,MAAMpD,YAAY2D,UAAU,CAAC,QAAQC,GAAG,CAACR,OAAOS,GAAG,EAAC,EAAGA,GAAG,CAAC,cAG7DR;QACN,MAAMuB,YACJmD,UACA,aACKnH;YACHa,OAAOiG,aAAa9G,QAAQa,KAAK,EAAEkG;WAC/B/G,QAAQc,IAAI,KAAK2B,YACjB;YAAE3B,MAAMgG,aAAa9G,QAAQc,IAAI,EAAEiG;QAAM,IACzC,CAAC;YACL7D;WACIV,QAAQ;YAAEA;QAAM,IAAI,CAAC,IAE3B8E,WAAW;YAAElC,cAAc;gBAACkC;aAAS;QAAC,IAAI,CAAC;IAE/C,EAAE,OAAO5D,OAAO;QACdC,QAAQD,KAAK,CAAC,oCAAoCA;IACpD;AACF"}

package/src/lib/server/organizations.js

@@ -29,6 +29,7 @@ import { nameSearchKey, nameSearchReversed, nameSearchTokens } from "@aglyn/agly
 // resolves `undefined` at runtime.
 import { ORG_BILLING_DOC_ID, ORG_BILLING_SUBCOLLECTION } from "@aglyn/aglyn/app-utils/org-billing-doc";
 import { MEMBER_EMAIL_ALIASES_COLLECTION } from "@aglyn/aglyn/app-utils/member-email-aliases";
+import { runPluginDeclarationsRepair } from "@aglyn/aglyn/plugin-manager/plugin-declarations-repair";
 import { FieldValue } from "firebase-admin/firestore";
 import { cache } from "react";
 import { findUserByUidAcrossPools } from "./auth-pools.js";
@@ -629,7 +630,34 @@ export async function orgDataCollectionForHost(hostId, name) {
 }
 export async function memberHasOrgPermission(orgId, member, permission) {
     if (!member) return false;
-    return (await resolveMemberOrgPermissions(orgId, member))[permission];
+    return verdictFor(permission, await resolveMemberOrgPermissions(orgId, member), ()=>resolveMemberOrgPermissions(orgId, member));
+}
+/**
+ * A key the catalog does not hold is never a silent "no" (AGL-3596).
+ *
+ * A plugin's catalog key reaches this process only through its declarations,
+ * and a route that never loaded the plugin depends on the app's boot step
+ * having registered them. A resolver that answered `undefined` for such a key
+ * read as a refusal indistinguishable from a real one: the site create door
+ * asked an owner for `ai.generate` that way and refused every guided start.
+ * So a missing key runs the app's boot step once (`plugin-declarations-repair`)
+ * and asks again, and a key still missing after that is logged as the
+ * deployment fault it is before it answers "no".
+ */ async function verdictFor(permission, granted, again) {
+    if (permission in granted) return granted[permission] === true;
+    const repaired = await runPluginDeclarationsRepair().catch((error)=>{
+        console.error('[permissions] plugin declarations repair failed', {
+            permission,
+            error
+        });
+        return false;
+    });
+    if (repaired) {
+        const retried = await again();
+        if (permission in retried) return retried[permission] === true;
+    }
+    console.error(`[permissions] "${permission}" is not in this process's permission catalog: ` + 'the plugin that declares it never registered here, so it is refused');
+    return false;
 }
 /**
  * May this member hold a catalog permission on this site (AGL-2927,
@@ -652,7 +680,7 @@ export async function memberHasOrgPermission(orgId, member, permission) {
     var _resolveCollaboratorHostPermissions;
     if (!member) return false;
     if (isOrgWideMember(member)) {
-        return (await resolveMemberOrgPermissions(orgId, member))[permission] === true;
+        return verdictFor(permission, await resolveMemberOrgPermissions(orgId, member), ()=>resolveMemberOrgPermissions(orgId, member));
     }
     const site = typeof hostId === 'string' ? hostId.trim() : '';
     return (_ref = (_resolveCollaboratorHostPermissions = resolveCollaboratorHostPermissions(member, site)) == null ? void 0 : _resolveCollaboratorHostPermissions[permission]) != null ? _ref : false;