@aglyn/plugins-email 1.0.0-beta.143

package/src/lib/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport { mdiEmailOutline } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport {\n  EMAIL_MESSAGES_ZONE,\n  EMAIL_TEMPLATE_RECIPIENTS_ZONE,\n} from './components/email-zones'\nimport { EMAILS_CONSOLE_SECTIONS } from './components/emails-console-sections'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/** Code-split: the Emails console page only loads when opened. */\nconst EmailsConsolePage = lazy(() => import('./components/emails-console-page'))\n\n/*\n * What this plugin draws inside a campaign's own pages, each loaded only where\n * the campaign owner's zone is on screen.\n */\nconst CampaignTopicSelect = lazy(\n  () => import('./components/campaign-topic-select'),\n)\nconst CampaignTopicOptionsWidget = lazy(\n  () => import('./components/campaign-topic-options-widget'),\n)\nconst CampaignSenderEditorWidget = lazy(\n  () => import('./components/campaign-sender-editor-widget'),\n)\nconst CampaignDesignCreateWidget = lazy(\n  () => import('./components/campaign-design-create-widget'),\n)\nconst EmailDesignPreview = lazy(\n  () => import('./components/email-design-preview'),\n)\n\n/**\n * Console half (AGL-395): registers the Emails nav item + page in the\n * ConsoleExtension registry. Safe to call at console app load — the page is\n * lazy, so no besigner/canvas code loads. The shell renders the Emails nav\n * item and, via its generic plugin route, the page (the messages and their\n * composer, the templates, the audience lists, the topic catalog, the sending\n * identities and the suppression list) — with no edit to the console's own\n * nav or page files.\n */\nexport function registerEmailConsole(): void {\n  /*\n   * The two places this plugin's pages hand over to whichever plugin owns\n   * campaigns. A message is one send of a campaign and every action on it is\n   * that plugin's route, so the Messages section is a zone this page hosts\n   * rather than pages this plugin imports; the same holds for the recipients\n   * table under a template's report. Named, because a spec calls this\n   * registrar without the loader.\n   */\n  registerPluginZone(\n    {\n      zone: EMAIL_MESSAGES_ZONE,\n      label: 'The Emails page’s Messages section',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'The whole body of `/emails/messages` and the routes under it. A widget here is handed the site, the Emails page’s base path and the segments under `messages`, and draws the list, one message’s report or its composer.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: EMAIL_TEMPLATE_RECIPIENTS_ZONE,\n      label: 'Who received a template’s emails',\n      surface: 'console',\n      description:\n        'On one template’s page, under its report. A widget here lists the recipients of every send built from that template; it is handed the site and the template’s screen id.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    pluginId: BUNDLE_ID,\n    displayName: 'Email',\n    /*\n     * WHO may open the email console, declared so the shell enforces it.\n     *\n     * The audiences section reads `orgs/{orgId}/lists/{listId}/members`, and\n     * those members are enrolled CONTACTS — an address, a name, and the\n     * consent basis recording why the person may be mailed. That is the same\n     * org-shared people data the CRM holds, reached from a different page.\n     *\n     * The rules gate those reads on `isOrgWideMember()` ALONE, with no role\n     * condition, so org-wide membership of any role is enough to list every\n     * audience the organization has and everybody on it. An org VIEWER — the\n     * role that exists to read and change nothing — therefore reads the whole\n     * marketing audience today. `data.manage` is what closes that: it\n     * defaults to owner, admin and editor, so the population it admits is\n     * exactly the one `server-list-gate.ts` accepts a list write from, and\n     * the viewer it excludes is the reader the rules never excluded.\n     *\n     * `data.manage` rather than a key of this plugin's own for the reason the\n     * catalog gives for refusing a `marketing.manage`: campaigns are written\n     * client-direct against rules that gate on the HOST role, so a new\n     * org-level key would name an action with no org-level boundary under it.\n     * `data.manage` is not in that position — it already governs the\n     * org-shared data this surface exposes, and the list gate already reads\n     * the roles it defaults to.\n     *\n     * A SITE COLLABORATOR holding it opens the page, and the answer is NOT\n     * the one Contacts reached. There the listener is scoped and the rules\n     * prove the same predicate per document; here the audiences read demands\n     * `isOrgWideMember()`, which a collaborator is not, so the org-shared\n     * half is already refused beneath the console and the half that remains —\n     * this site's own messages, templates and sending identities — is theirs.\n     * Refusing the surface outright would take that away to close nothing.\n     */\n    permission: 'data.manage',\n    /*\n     * The mail a campaign rides on is this plugin's — the topic catalog, the\n     * sending identities, the design document and its renderer — so each is\n     * drawn here, in a zone the campaign owner's composer and message page\n     * host. Every one reports through a callback; none writes a campaign.\n     */\n    widgets: [\n      {\n        slot: 'campaignTopicSelect',\n        widgetId: 'email-campaign-topic-select',\n        title: 'Topic',\n        Component: CampaignTopicSelect,\n      },\n      {\n        slot: 'campaignTopicOptions',\n        widgetId: 'email-campaign-topic-options',\n        title: 'Topics',\n        Component: CampaignTopicOptionsWidget,\n      },\n      {\n        slot: 'campaignSenderEditor',\n        widgetId: 'email-campaign-sender-editor',\n        title: 'Add a sender',\n        Component: CampaignSenderEditorWidget,\n      },\n      {\n        slot: 'campaignDesignCreate',\n        widgetId: 'email-campaign-design-create',\n        title: 'Design this email',\n        Component: CampaignDesignCreateWidget,\n      },\n      {\n        slot: 'campaignDesignPreview',\n        widgetId: 'email-campaign-design-preview',\n        title: 'Preview',\n        Component: EmailDesignPreview,\n      },\n    ],\n    navItems: [\n      {\n        label: 'Emails',\n        href: '/emails',\n        icon: { path: mdiEmailOutline.path },\n        // Sections as ROUTES (AGL-2501): `/emails/messages` and friends are\n        // real URLs the shell resolves and gates, so the page mounts the one\n        // being read instead of subscribing all six.\n        sections: EMAILS_CONSOLE_SECTIONS,\n        header: {\n          title: 'Emails',\n          icon: { path: mdiEmailOutline.path },\n          docsTopic: 'emailCampaigns',\n        },\n        Component: EmailsConsolePage,\n      },\n    ],\n  })\n}\n\nexport * from './site'\n"],"names":["Aglyn","registerPluginZone","mdiEmailOutline","lazy","EMAIL_MESSAGES_ZONE","EMAIL_TEMPLATE_RECIPIENTS_ZONE","EMAILS_CONSOLE_SECTIONS","BUNDLE_ID","EmailsConsolePage","CampaignTopicSelect","CampaignTopicOptionsWidget","CampaignSenderEditorWidget","CampaignDesignCreateWidget","EmailDesignPreview","registerEmailConsole","zone","label","surface","layout","description","pluginId","registerConsoleExtension","displayName","permission","widgets","slot","widgetId","title","Component","navItems","href","icon","path","sections","header","docsTopic"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,IAAI,QAAQ,QAAO;AAC5B,SACEC,mBAAmB,EACnBC,8BAA8B,QACzB,8BAA0B;AACjC,SAASC,uBAAuB,QAAQ,0CAAsC;AAC9E,SAASC,SAAS,QAAQ,+BAA2B;AAErD,gEAAgE,GAChE,MAAMC,oBAAoBL,KAAK,IAAM,MAAM,CAAC;AAE5C;;;CAGC,GACD,MAAMM,sBAAsBN,KAC1B,IAAM,MAAM,CAAC;AAEf,MAAMO,6BAA6BP,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMQ,6BAA6BR,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMS,6BAA6BT,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMU,qBAAqBV,KACzB,IAAM,MAAM,CAAC;AAGf;;;;;;;;CAQC,GACD,OAAO,SAASW;IACd;;;;;;;GAOC,GACDb,mBACE;QACEc,MAAMX;QACNY,OAAO;QACPC,SAAS;QACTC,QAAQ;QACRC,aACE;IACJ,GACA;QAAEC,UAAUb;IAAU;IAExBN,mBACE;QACEc,MAAMV;QACNW,OAAO;QACPC,SAAS;QACTE,aACE;IACJ,GACA;QAAEC,UAAUb;IAAU;IAExBP,MAAMqB,wBAAwB,CAAC;QAC7BD,UAAUb;QACVe,aAAa;QACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgCC,GACDC,YAAY;QACZ;;;;;KAKC,GACDC,SAAS;YACP;gBACEC,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWnB;YACb;YACA;gBACEgB,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWlB;YACb;YACA;gBACEe,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWjB;YACb;YACA;gBACEc,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWhB;YACb;YACA;gBACEa,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWf;YACb;SACD;QACDgB,UAAU;YACR;gBACEb,OAAO;gBACPc,MAAM;gBACNC,MAAM;oBAAEC,MAAM9B,gBAAgB8B,IAAI;gBAAC;gBACnC,oEAAoE;gBACpE,qEAAqE;gBACrE,6CAA6C;gBAC7CC,UAAU3B;gBACV4B,QAAQ;oBACNP,OAAO;oBACPI,MAAM;wBAAEC,MAAM9B,gBAAgB8B,IAAI;oBAAC;oBACnCG,WAAW;gBACb;gBACAP,WAAWpB;YACb;SACD;IACH;AACF;AAEA,cAAc,YAAQ"}

package/src/lib/server-console.d.ts

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/** `source` stamped on every membership these routes write. */
+export declare const CONSOLE_ADD_SOURCE = "console:list-add";
+export { LIST_MEMBER_BATCH_MAX, resolveAddresses, resolveListContext, type AddressResolution, type AddressVerdict, type ListContext, type ResolvedBatch, } from './server-list-gate';
+/**
+ * `POST email/list-members-preview` — what adding these addresses would do.
+ *
+ * Reads only, and reached by an explicit act — typing an address or pasting a
+ * column — never on mount. It exists because the answer needs three things
+ * the browser cannot have: the org's contacts (rules put them behind org-wide
+ * membership, which the acting console session may not hold) and both
+ * suppression lists. Computing any of it client-side would be a second copy
+ * of the rule, on the surface whose whole job is to tell the operator the
+ * truth about what is about to happen.
+ *
+ * It takes no attestation and has nowhere to put one. The preview answers
+ * what is TRUE about each person, which is the input to the operator's
+ * decision rather than a function of it — a preview whose numbers moved as
+ * the box was ticked would not be a count anybody could stand behind.
+ */
+export declare const emailListMembersPreviewHandler: PluginApiHandler;
+/**
+ * `POST email/list-members-add` — put these addresses on the list.
+ *
+ * Body: `{ hostId, listId, email | emails[], name?, attestConsent? }`.
+ * `attestConsent` is the operator STATING that they have these people's
+ * permission; it is not a way to name a basis, because the pass-through basis
+ * is derived server-side from each person's own record.
+ *
+ * ## One attestation, for the count the operator was shown
+ *
+ * The batch carries a single assertion because it is a single act: an
+ * operator pasting a column is making one claim about where that column came
+ * from. What makes that safe is that the claim is applied per address by the
+ * same function the preview ran, so it reaches only the addresses that
+ * actually need it — an address with a stored opt-in keeps its own basis and
+ * its own date, and an address nothing can enroll is refused with the
+ * attestation on the table.
+ *
+ * ## Partial success is the honest answer
+ *
+ * A batch where one address is suppressed and forty are fine is not a failed
+ * request. Every address comes back with what happened to it, so 200 here
+ * means "the request was processed", never "everybody was added" — the caller
+ * reads the per-address verdicts, which is why they are returned rather than
+ * a count.
+ */
+export declare const emailListMembersAddHandler: PluginApiHandler;
+/**
+ * WHO A SET OF FILTERS FINDS, and what would happen if you added them.
+ *
+ * ## The gap it fills
+ *
+ * The filters behind a list could only ever be MATERIALIZED — the sweep wrote
+ * the matching people straight into the membership. A merchant could not ask
+ * "who is this" without committing to it, and a fixed list could not use the
+ * filters at all: its only way to gain a member was somebody typing or pasting
+ * an address. This answers the question without writing anything.
+ *
+ * ## It is the same consent gate, not a second one
+ *
+ * The addresses the scan finds are put through {@link resolveAddresses} — the
+ * exact function `email/list-members-preview` uses — so a suppressed address
+ * is reported as refused here, and somebody with no opt-in on record is
+ * reported as needing an attestation here, before any of them is offered for
+ * adding. That is deliberate and load-bearing: a bulk path that skipped the
+ * check would be a way to fill a list with people the one-at-a-time path
+ * refuses, which is the defect class this product already has a register entry
+ * for. The ADD still goes through `email/list-members-add`, which re-runs
+ * every check server-side, so this preview is an honest readout rather than a
+ * permission.
+ *
+ * ## What it will not do
+ *
+ * It writes nothing, it enrolls nobody, and it compares no count against any
+ * limit. The batch cap below bounds how many addresses it hands back for a
+ * single add — the scan itself still reports how many people it MATCHED, so a
+ * merchant is told the audience is larger than one batch rather than shown a
+ * truncated number as if it were the whole.
+ */
+export declare const emailListRulePreviewHandler: PluginApiHandler;
+/**
+ * Console API registration.
+ *
+ * None of these is on the machine-path exemption list in
+ * `plugin-api-rate-limit.ts`, so each is counted against the console
+ * dispatcher's per-subject budget — the ceiling that bounds a surface which
+ * puts a person into a marketing audience, and which scans a whole contact
+ * silo to work out who that would be.
+ *
+ * The limiter these are counted by is the CONSOLE one,
+ * `consoleApiRateLimitRefusal`. The visitor limiter is a different limiter on
+ * a different dispatcher: `visitorWriteRateLimitRefusal` is installed only in
+ * `apps/tenant`, and no request to these routes has ever passed through it.
+ * The two share a counter and an exemption list and nothing else — the console
+ * key is the authenticated subject, because on an authenticated surface a
+ * per-(site, IP) bucket both isolates nothing the identity has not already
+ * isolated and hands one operator a fresh budget per site.
+ */
+export declare function registerEmailConsoleApi(): void;

package/src/lib/server-console.js

@@ -0,0 +1,422 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Putting somebody on an email list from the Emails console.
+ *
+ * The audience card could create a list and delete a list and nothing else:
+ * no way to see who was on one, no way to add anybody, no way to take anybody
+ * off. Every member document in production arrived from a capture surface —
+ * the newsletter handler, the workflow `enrollList` step, the dynamic-list
+ * materializer, the Inbox assignment — so the one act a merchant most expects
+ * of a list, "add this person", was the one act the product refused.
+ *
+ * ## Why this is a route and not a client write
+ *
+ * Rules put `orgs/{orgId}/lists/{listId}/members` behind org-wide membership,
+ * and until now that block allowed a client CREATE. Nothing used it, and it
+ * was the whole feature waiting to be built wrong: a browser that can write a
+ * member document can write `marketingConsent: true` beside an address it has
+ * never checked, which is a consent record minted by pressing a button. The
+ * rules now deny client create and update on that collection, and this route
+ * is the writer — through `enrollListMember`, which owns the document id, and
+ * through the shared `list-assignment-policy`, which owns the basis.
+ *
+ * ## The same policy the Inbox uses, not a second one
+ *
+ * `assignmentBasis` and `assignmentReadout` are imported from the framework,
+ * where they moved when this became their second caller. There is no third
+ * consent basis and no console-only override: a stored `declined` refuses
+ * here exactly as it refuses there, an attestation is recorded with the
+ * account that made it, and a stored opt-in is carried across with the date
+ * the PERSON set rather than the date somebody pressed Add.
+ *
+ * ## Reads only, until the operator has seen the count
+ *
+ * `email/list-members-preview` writes nothing. It answers, per address, what
+ * would happen and why, so the attestation the operator gives on the second
+ * call is given with the numbers in front of them. Both routes run the SAME
+ * resolution over the SAME inputs — `resolveAddresses` — so the summary they
+ * were shown is the summary that acts.
+ *
+ * ## Finding people is a read, and it uses the same gate
+ *
+ * `email/list-rule-preview` answers "who do these filters select" without
+ * writing anything, so a fixed list can be filled from a search rather than
+ * from somebody typing addresses one at a time. It runs the addresses it finds
+ * through `resolveAddresses` as well — a bulk path that reached the membership
+ * without the suppression check and the attestation would be a way to enroll
+ * exactly the people the single-address path refuses.
+ *
+ * ## The gate itself is `server-list-gate.ts`
+ *
+ * Who may change a list's membership, and what is true about each address, are
+ * asked by three route modules now: these two, and the file importer in
+ * `server-list-import.ts`. They live in a module of their own so the importer
+ * shares this file's answer rather than importing this file — which would be a
+ * cycle, and a cycle whose module-level constants would evaluate in whichever
+ * order the loader happened to reach them.
+ */ import { registerEmailDesignDraftWriter } from "./server-email-drafts.js";
+import { registerEmailSuppressionsApi } from "./server-suppressions.js";
+import { registerEmailListImportApi } from "./server-list-import.js";
+import { LIST_MEMBER_BATCH_MAX, readAddresses, resolveAddresses, resolveListContext } from "./server-list-gate.js";
+import { ASSIGNMENT_REFUSAL_MESSAGES, assignmentBasis, dynamicListRuleIsEmpty, normalizeDynamicListRule, readMarketingBasis, registerPluginApiRoute } from "@aglyn/aglyn/server";
+import { collectDynamicListCandidates, enrollListMember } from "@aglyn/tenant-data-admin";
+/** `source` stamped on every membership these routes write. */ export const CONSOLE_ADD_SOURCE = 'console:list-add';
+/*
+ * Re-exported, not redefined. `@aglyn/plugins-email/server` has published
+ * these names since the add path shipped, and the console panel and its specs
+ * import them from there; moving the gate must not move the plugin's public
+ * surface with it.
+ */ export { LIST_MEMBER_BATCH_MAX, resolveAddresses, resolveListContext } from "./server-list-gate.js";
+/**
+ * `POST email/list-members-preview` — what adding these addresses would do.
+ *
+ * Reads only, and reached by an explicit act — typing an address or pasting a
+ * column — never on mount. It exists because the answer needs three things
+ * the browser cannot have: the org's contacts (rules put them behind org-wide
+ * membership, which the acting console session may not hold) and both
+ * suppression lists. Computing any of it client-side would be a second copy
+ * of the rule, on the surface whose whole job is to tell the operator the
+ * truth about what is about to happen.
+ *
+ * It takes no attestation and has nowhere to put one. The preview answers
+ * what is TRUE about each person, which is the input to the operator's
+ * decision rather than a function of it — a preview whose numbers moved as
+ * the box was ticked would not be a count anybody could stand behind.
+ */ export const emailListMembersPreviewHandler = async (req, res)=>{
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const requested = readAddresses(req);
+    if ('error' in requested) {
+        return res.status(400).json({
+            error: requested.error
+        });
+    }
+    try {
+        const context = await resolveListContext(req);
+        if (context.ok === false) {
+            return res.status(context.status).json(context.body);
+        }
+        const { verdicts, optedIn, needAttestation, refused } = await resolveAddresses({
+            hostId: context.hostId,
+            inputs: requested.emails
+        });
+        /*
+     * Named fields rather than a spread of the resolution.
+     *
+     * The resolution carries the consent RECORDS it was computed from, for the
+     * write path's use — raw stored basis, provenance, the account behind an
+     * operator assertion. None of that is the browser's, and a spread would
+     * put all of it on the wire the moment a field was added to the internal
+     * shape. What the surface needs is the verdicts and the counts.
+     */ return res.status(200).json({
+            listName: context.listName,
+            verdicts,
+            optedIn,
+            needAttestation,
+            refused
+        });
+    } catch (error) {
+        console.error('[email] list member preview failed', error);
+        return res.status(500).json({
+            error: 'The addresses could not be checked.'
+        });
+    }
+};
+/**
+ * `POST email/list-members-add` — put these addresses on the list.
+ *
+ * Body: `{ hostId, listId, email | emails[], name?, attestConsent? }`.
+ * `attestConsent` is the operator STATING that they have these people's
+ * permission; it is not a way to name a basis, because the pass-through basis
+ * is derived server-side from each person's own record.
+ *
+ * ## One attestation, for the count the operator was shown
+ *
+ * The batch carries a single assertion because it is a single act: an
+ * operator pasting a column is making one claim about where that column came
+ * from. What makes that safe is that the claim is applied per address by the
+ * same function the preview ran, so it reaches only the addresses that
+ * actually need it — an address with a stored opt-in keeps its own basis and
+ * its own date, and an address nothing can enroll is refused with the
+ * attestation on the table.
+ *
+ * ## Partial success is the honest answer
+ *
+ * A batch where one address is suppressed and forty are fine is not a failed
+ * request. Every address comes back with what happened to it, so 200 here
+ * means "the request was processed", never "everybody was added" — the caller
+ * reads the per-address verdicts, which is why they are returned rather than
+ * a count.
+ */ export const emailListMembersAddHandler = async (req, res)=>{
+    var _ref;
+    var _req_body, _req_body1;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const requested = readAddresses(req);
+    if ('error' in requested) {
+        return res.status(400).json({
+            error: requested.error
+        });
+    }
+    const attested = ((_req_body = req.body) == null ? void 0 : _req_body.attestConsent) === true;
+    const name = String((_ref = (_req_body1 = req.body) == null ? void 0 : _req_body1.name) != null ? _ref : '').trim();
+    try {
+        const context = await resolveListContext(req);
+        if (context.ok === false) {
+            return res.status(context.status).json(context.body);
+        }
+        const nowMs = Date.now();
+        const resolution = await resolveAddresses({
+            hostId: context.hostId,
+            inputs: requested.emails
+        });
+        const results = [];
+        for (const verdict of resolution.verdicts){
+            var _resolution_stored_get;
+            if (verdict.refusal || !verdict.email) {
+                results.push({
+                    input: verdict.input,
+                    email: verdict.email,
+                    enrolled: false,
+                    reason: verdict.refusal,
+                    error: verdict.summary
+                });
+                continue;
+            }
+            /*
+       * The ONE place a basis is decided, and the only place the attestation
+       * is consulted.
+       *
+       * `resolveAddresses` has already answered the questions that are facts
+       * about the person; this answers the question that is about the
+       * operator, per address, from the consent record that resolution read.
+       * `no-basis` — an address with nothing on record and nobody asserting
+       * anything — is refused HERE and only here.
+       */ const decision = assignmentBasis({
+                stored: (_resolution_stored_get = resolution.stored.get(verdict.email)) != null ? _resolution_stored_get : readMarketingBasis(null, resolution.group),
+                attested,
+                actingUid: context.uid,
+                nowMs
+            });
+            if ('refusal' in decision) {
+                results.push({
+                    input: verdict.input,
+                    email: verdict.email,
+                    enrolled: false,
+                    reason: decision.refusal,
+                    error: ASSIGNMENT_REFUSAL_MESSAGES[decision.refusal]
+                });
+                continue;
+            }
+            const enrollment = await enrollListMember(_extends({
+                listRef: context.listRef,
+                group: resolution.group,
+                email: verdict.email
+            }, name && requested.emails.length === 1 ? {
+                name
+            } : {}, {
+                source: CONSOLE_ADD_SOURCE,
+                // Never `'rule'`: the dynamic-list materializer reconciles its own
+                // rows away when a person stops matching, and a decision somebody
+                // made by hand is not a rule match that lapsed.
+                via: 'manual',
+                consent: decision
+            }));
+            if (enrollment.enrolled === false) {
+                /*
+         * The membership itself records a refusal the CRM record did not.
+         * `enrollListMember` is the only writer of the collection and holds
+         * the row, so it is the backstop for every enrollment route; reaching
+         * it here means the two records disagree, and the refusal wins.
+         */ const reason = enrollment.refusal === 'declined' ? 'declined' : 'unroutable-address';
+                results.push({
+                    input: verdict.input,
+                    email: verdict.email,
+                    enrolled: false,
+                    reason,
+                    error: ASSIGNMENT_REFUSAL_MESSAGES[reason]
+                });
+                continue;
+            }
+            results.push({
+                input: verdict.input,
+                email: verdict.email,
+                enrolled: true,
+                memberId: enrollment.memberId,
+                created: enrollment.created,
+                basis: decision.basis
+            });
+        }
+        return res.status(200).json({
+            listName: context.listName,
+            added: results.filter((result)=>result.enrolled).length,
+            results
+        });
+    } catch (error) {
+        console.error('[email] list member add failed', error);
+        return res.status(500).json({
+            error: 'The addresses could not be added.'
+        });
+    }
+};
+/**
+ * WHO A SET OF FILTERS FINDS, and what would happen if you added them.
+ *
+ * ## The gap it fills
+ *
+ * The filters behind a list could only ever be MATERIALIZED — the sweep wrote
+ * the matching people straight into the membership. A merchant could not ask
+ * "who is this" without committing to it, and a fixed list could not use the
+ * filters at all: its only way to gain a member was somebody typing or pasting
+ * an address. This answers the question without writing anything.
+ *
+ * ## It is the same consent gate, not a second one
+ *
+ * The addresses the scan finds are put through {@link resolveAddresses} — the
+ * exact function `email/list-members-preview` uses — so a suppressed address
+ * is reported as refused here, and somebody with no opt-in on record is
+ * reported as needing an attestation here, before any of them is offered for
+ * adding. That is deliberate and load-bearing: a bulk path that skipped the
+ * check would be a way to fill a list with people the one-at-a-time path
+ * refuses, which is the defect class this product already has a register entry
+ * for. The ADD still goes through `email/list-members-add`, which re-runs
+ * every check server-side, so this preview is an honest readout rather than a
+ * permission.
+ *
+ * ## What it will not do
+ *
+ * It writes nothing, it enrolls nobody, and it compares no count against any
+ * limit. The batch cap below bounds how many addresses it hands back for a
+ * single add — the scan itself still reports how many people it MATCHED, so a
+ * merchant is told the audience is larger than one batch rather than shown a
+ * truncated number as if it were the whole.
+ */ export const emailListRulePreviewHandler = async (req, res)=>{
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    try {
+        var _req_body;
+        const context = await resolveListContext(req);
+        if (context.ok === false) {
+            return res.status(context.status).json(context.body);
+        }
+        const rule = normalizeDynamicListRule((_req_body = req.body) == null ? void 0 : _req_body.rule);
+        if (dynamicListRuleIsEmpty(rule)) {
+            /*
+       * Not an error, and not an empty result either. A rule with no source
+       * matches nobody by construction, and reporting that as "0 people" is
+       * indistinguishable from a rule that ran and found none — which is the
+       * confusion the `empty` flag exists to prevent everywhere else.
+       */ return res.status(200).json({
+                matched: 0,
+                truncated: false,
+                complete: true,
+                empty: true,
+                emails: [],
+                verdicts: [],
+                optedIn: 0,
+                needAttestation: 0,
+                refused: 0
+            });
+        }
+        const scan = await collectDynamicListCandidates({
+            hostId: context.hostId,
+            rule
+        });
+        /*
+     * The addresses, in the scan's own order, capped at what one add can
+     * carry. `matched` is reported separately and is NOT this length: a
+     * merchant looking at a 400-person audience must be told it is 400 even
+     * when the button in front of them adds 100.
+     */ const emails = scan.candidates.map((candidate)=>candidate.email).filter(Boolean);
+        const batch = emails.slice(0, LIST_MEMBER_BATCH_MAX);
+        const resolution = await resolveAddresses({
+            hostId: context.hostId,
+            inputs: batch
+        });
+        return res.status(200).json({
+            listName: context.listName,
+            matched: emails.length,
+            /*
+       * Two different reasons a readout can be short of the truth, reported
+       * apart: `truncated` is this batch being smaller than the match, and
+       * `complete: false` is the SCAN having run out of budget, so `matched`
+       * is itself a floor.
+       */ truncated: emails.length > batch.length,
+            complete: scan.complete,
+            empty: false,
+            emails: batch,
+            verdicts: resolution.verdicts,
+            optedIn: resolution.optedIn,
+            needAttestation: resolution.needAttestation,
+            refused: resolution.refused
+        });
+    } catch (error) {
+        console.error('[email] list rule preview failed', error);
+        return res.status(500).json({
+            error: 'The audience could not be worked out.'
+        });
+    }
+};
+/**
+ * Console API registration.
+ *
+ * None of these is on the machine-path exemption list in
+ * `plugin-api-rate-limit.ts`, so each is counted against the console
+ * dispatcher's per-subject budget — the ceiling that bounds a surface which
+ * puts a person into a marketing audience, and which scans a whole contact
+ * silo to work out who that would be.
+ *
+ * The limiter these are counted by is the CONSOLE one,
+ * `consoleApiRateLimitRefusal`. The visitor limiter is a different limiter on
+ * a different dispatcher: `visitorWriteRateLimitRefusal` is installed only in
+ * `apps/tenant`, and no request to these routes has ever passed through it.
+ * The two share a counter and an exemption list and nothing else — the console
+ * key is the authenticated subject, because on an authenticated surface a
+ * per-(site, IP) bucket both isolates nothing the identity has not already
+ * isolated and hands one operator a fresh budget per site.
+ */ export function registerEmailConsoleApi() {
+    // The email design writer another plugin reaches through the core's
+    // resource-drafts seam (AGL-2912). Registered here alone: the AI jobs that
+    // write through it run only on the console, inline and on the beat
+    // (AGL-3026).
+    registerEmailDesignDraftWriter();
+    registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler);
+    registerPluginApiRoute('email/list-members-preview', emailListMembersPreviewHandler);
+    registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler);
+    // The importer is four routes over one staged job, so it has its own
+    // module — but not its own gate: it reaches this file's `resolveListContext`
+    // and `resolveAddresses` rather than a bulk-shaped copy of them, which is
+    // the whole reason an import cannot enroll somebody the add path refuses.
+    registerEmailListImportApi();
+    // Suppressions live in their own module: they are a per-SITE list gated on
+    // the site role, where list membership is an ORG audience gated on org-wide
+    // access, and one file holding both gates is one file for the wrong one to
+    // be copied out of.
+    registerEmailSuppressionsApi();
+}
+
+//# sourceMappingURL=server-console.js.map

package/src/lib/server-console.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Putting somebody on an email list from the Emails console.\n *\n * The audience card could create a list and delete a list and nothing else:\n * no way to see who was on one, no way to add anybody, no way to take anybody\n * off. Every member document in production arrived from a capture surface —\n * the newsletter handler, the workflow `enrollList` step, the dynamic-list\n * materializer, the Inbox assignment — so the one act a merchant most expects\n * of a list, \"add this person\", was the one act the product refused.\n *\n * ## Why this is a route and not a client write\n *\n * Rules put `orgs/{orgId}/lists/{listId}/members` behind org-wide membership,\n * and until now that block allowed a client CREATE. Nothing used it, and it\n * was the whole feature waiting to be built wrong: a browser that can write a\n * member document can write `marketingConsent: true` beside an address it has\n * never checked, which is a consent record minted by pressing a button. The\n * rules now deny client create and update on that collection, and this route\n * is the writer — through `enrollListMember`, which owns the document id, and\n * through the shared `list-assignment-policy`, which owns the basis.\n *\n * ## The same policy the Inbox uses, not a second one\n *\n * `assignmentBasis` and `assignmentReadout` are imported from the framework,\n * where they moved when this became their second caller. There is no third\n * consent basis and no console-only override: a stored `declined` refuses\n * here exactly as it refuses there, an attestation is recorded with the\n * account that made it, and a stored opt-in is carried across with the date\n * the PERSON set rather than the date somebody pressed Add.\n *\n * ## Reads only, until the operator has seen the count\n *\n * `email/list-members-preview` writes nothing. It answers, per address, what\n * would happen and why, so the attestation the operator gives on the second\n * call is given with the numbers in front of them. Both routes run the SAME\n * resolution over the SAME inputs — `resolveAddresses` — so the summary they\n * were shown is the summary that acts.\n *\n * ## Finding people is a read, and it uses the same gate\n *\n * `email/list-rule-preview` answers \"who do these filters select\" without\n * writing anything, so a fixed list can be filled from a search rather than\n * from somebody typing addresses one at a time. It runs the addresses it finds\n * through `resolveAddresses` as well — a bulk path that reached the membership\n * without the suppression check and the attestation would be a way to enroll\n * exactly the people the single-address path refuses.\n *\n * ## The gate itself is `server-list-gate.ts`\n *\n * Who may change a list's membership, and what is true about each address, are\n * asked by three route modules now: these two, and the file importer in\n * `server-list-import.ts`. They live in a module of their own so the importer\n * shares this file's answer rather than importing this file — which would be a\n * cycle, and a cycle whose module-level constants would evaluate in whichever\n * order the loader happened to reach them.\n */\n\nimport { registerEmailDesignDraftWriter } from './server-email-drafts'\nimport { registerEmailSuppressionsApi } from './server-suppressions'\nimport { registerEmailListImportApi } from './server-list-import'\nimport {\n  LIST_MEMBER_BATCH_MAX,\n  readAddresses,\n  resolveAddresses,\n  resolveListContext,\n} from './server-list-gate'\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentBasis,\n  dynamicListRuleIsEmpty,\n  normalizeDynamicListRule,\n  readMarketingBasis,\n  registerPluginApiRoute,\n  type AssignmentRefusal,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  collectDynamicListCandidates,\n  enrollListMember,\n} from '@aglyn/tenant-data-admin'\n\n/** `source` stamped on every membership these routes write. */\nexport const CONSOLE_ADD_SOURCE = 'console:list-add'\n\n/*\n * Re-exported, not redefined. `@aglyn/plugins-email/server` has published\n * these names since the add path shipped, and the console panel and its specs\n * import them from there; moving the gate must not move the plugin's public\n * surface with it.\n */\nexport {\n  LIST_MEMBER_BATCH_MAX,\n  resolveAddresses,\n  resolveListContext,\n  type AddressResolution,\n  type AddressVerdict,\n  type ListContext,\n  type ResolvedBatch,\n} from './server-list-gate'\n\n\n/**\n * `POST email/list-members-preview` — what adding these addresses would do.\n *\n * Reads only, and reached by an explicit act — typing an address or pasting a\n * column — never on mount. It exists because the answer needs three things\n * the browser cannot have: the org's contacts (rules put them behind org-wide\n * membership, which the acting console session may not hold) and both\n * suppression lists. Computing any of it client-side would be a second copy\n * of the rule, on the surface whose whole job is to tell the operator the\n * truth about what is about to happen.\n *\n * It takes no attestation and has nowhere to put one. The preview answers\n * what is TRUE about each person, which is the input to the operator's\n * decision rather than a function of it — a preview whose numbers moved as\n * the box was ticked would not be a count anybody could stand behind.\n */\nexport const emailListMembersPreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const { verdicts, optedIn, needAttestation, refused } =\n      await resolveAddresses({\n        hostId: context.hostId,\n        inputs: requested.emails,\n      })\n    /*\n     * Named fields rather than a spread of the resolution.\n     *\n     * The resolution carries the consent RECORDS it was computed from, for the\n     * write path's use — raw stored basis, provenance, the account behind an\n     * operator assertion. None of that is the browser's, and a spread would\n     * put all of it on the wire the moment a field was added to the internal\n     * shape. What the surface needs is the verdicts and the counts.\n     */\n    return res.status(200).json({\n      listName: context.listName,\n      verdicts,\n      optedIn,\n      needAttestation,\n      refused,\n    })\n  } catch (error) {\n    console.error('[email] list member preview failed', error)\n    return res.status(500).json({ error: 'The addresses could not be checked.' })\n  }\n}\n\n/**\n * `POST email/list-members-add` — put these addresses on the list.\n *\n * Body: `{ hostId, listId, email | emails[], name?, attestConsent? }`.\n * `attestConsent` is the operator STATING that they have these people's\n * permission; it is not a way to name a basis, because the pass-through basis\n * is derived server-side from each person's own record.\n *\n * ## One attestation, for the count the operator was shown\n *\n * The batch carries a single assertion because it is a single act: an\n * operator pasting a column is making one claim about where that column came\n * from. What makes that safe is that the claim is applied per address by the\n * same function the preview ran, so it reaches only the addresses that\n * actually need it — an address with a stored opt-in keeps its own basis and\n * its own date, and an address nothing can enroll is refused with the\n * attestation on the table.\n *\n * ## Partial success is the honest answer\n *\n * A batch where one address is suppressed and forty are fine is not a failed\n * request. Every address comes back with what happened to it, so 200 here\n * means \"the request was processed\", never \"everybody was added\" — the caller\n * reads the per-address verdicts, which is why they are returned rather than\n * a count.\n */\nexport const emailListMembersAddHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  const attested = req.body?.attestConsent === true\n  const name = String(req.body?.name ?? '').trim()\n\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const nowMs = Date.now()\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: requested.emails,\n    })\n\n    const results = []\n    for (const verdict of resolution.verdicts) {\n      if (verdict.refusal || !verdict.email) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: verdict.refusal,\n          error: verdict.summary,\n        })\n        continue\n      }\n      /*\n       * The ONE place a basis is decided, and the only place the attestation\n       * is consulted.\n       *\n       * `resolveAddresses` has already answered the questions that are facts\n       * about the person; this answers the question that is about the\n       * operator, per address, from the consent record that resolution read.\n       * `no-basis` — an address with nothing on record and nobody asserting\n       * anything — is refused HERE and only here.\n       */\n      const decision = assignmentBasis({\n        stored: resolution.stored.get(verdict.email) ?? readMarketingBasis(null, resolution.group),\n        attested,\n        actingUid: context.uid,\n        nowMs,\n      })\n      if ('refusal' in decision) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: decision.refusal,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[decision.refusal],\n        })\n        continue\n      }\n      const enrollment = await enrollListMember({\n        listRef: context.listRef,\n        group: resolution.group,\n        email: verdict.email,\n        ...(name && requested.emails.length === 1 ? { name } : {}),\n        source: CONSOLE_ADD_SOURCE,\n        // Never `'rule'`: the dynamic-list materializer reconciles its own\n        // rows away when a person stops matching, and a decision somebody\n        // made by hand is not a rule match that lapsed.\n        via: 'manual',\n        consent: decision,\n      })\n      if (enrollment.enrolled === false) {\n        /*\n         * The membership itself records a refusal the CRM record did not.\n         * `enrollListMember` is the only writer of the collection and holds\n         * the row, so it is the backstop for every enrollment route; reaching\n         * it here means the two records disagree, and the refusal wins.\n         */\n        const reason: AssignmentRefusal =\n          enrollment.refusal === 'declined' ? 'declined' : 'unroutable-address'\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[reason],\n        })\n        continue\n      }\n      results.push({\n        input: verdict.input,\n        email: verdict.email,\n        enrolled: true,\n        memberId: enrollment.memberId,\n        created: enrollment.created,\n        basis: decision.basis,\n      })\n    }\n\n    return res.status(200).json({\n      listName: context.listName,\n      added: results.filter((result) => result.enrolled).length,\n      results,\n    })\n  } catch (error) {\n    console.error('[email] list member add failed', error)\n    return res.status(500).json({ error: 'The addresses could not be added.' })\n  }\n}\n\n/**\n * WHO A SET OF FILTERS FINDS, and what would happen if you added them.\n *\n * ## The gap it fills\n *\n * The filters behind a list could only ever be MATERIALIZED — the sweep wrote\n * the matching people straight into the membership. A merchant could not ask\n * \"who is this\" without committing to it, and a fixed list could not use the\n * filters at all: its only way to gain a member was somebody typing or pasting\n * an address. This answers the question without writing anything.\n *\n * ## It is the same consent gate, not a second one\n *\n * The addresses the scan finds are put through {@link resolveAddresses} — the\n * exact function `email/list-members-preview` uses — so a suppressed address\n * is reported as refused here, and somebody with no opt-in on record is\n * reported as needing an attestation here, before any of them is offered for\n * adding. That is deliberate and load-bearing: a bulk path that skipped the\n * check would be a way to fill a list with people the one-at-a-time path\n * refuses, which is the defect class this product already has a register entry\n * for. The ADD still goes through `email/list-members-add`, which re-runs\n * every check server-side, so this preview is an honest readout rather than a\n * permission.\n *\n * ## What it will not do\n *\n * It writes nothing, it enrolls nobody, and it compares no count against any\n * limit. The batch cap below bounds how many addresses it hands back for a\n * single add — the scan itself still reports how many people it MATCHED, so a\n * merchant is told the audience is larger than one batch rather than shown a\n * truncated number as if it were the whole.\n */\nexport const emailListRulePreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const rule = normalizeDynamicListRule(req.body?.rule)\n    if (dynamicListRuleIsEmpty(rule)) {\n      /*\n       * Not an error, and not an empty result either. A rule with no source\n       * matches nobody by construction, and reporting that as \"0 people\" is\n       * indistinguishable from a rule that ran and found none — which is the\n       * confusion the `empty` flag exists to prevent everywhere else.\n       */\n      return res.status(200).json({\n        matched: 0,\n        truncated: false,\n        complete: true,\n        empty: true,\n        emails: [],\n        verdicts: [],\n        optedIn: 0,\n        needAttestation: 0,\n        refused: 0,\n      })\n    }\n    const scan = await collectDynamicListCandidates({\n      hostId: context.hostId,\n      rule,\n    })\n    /*\n     * The addresses, in the scan's own order, capped at what one add can\n     * carry. `matched` is reported separately and is NOT this length: a\n     * merchant looking at a 400-person audience must be told it is 400 even\n     * when the button in front of them adds 100.\n     */\n    const emails = scan.candidates\n      .map((candidate) => candidate.email)\n      .filter(Boolean)\n    const batch = emails.slice(0, LIST_MEMBER_BATCH_MAX)\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: batch,\n    })\n    return res.status(200).json({\n      listName: context.listName,\n      matched: emails.length,\n      /*\n       * Two different reasons a readout can be short of the truth, reported\n       * apart: `truncated` is this batch being smaller than the match, and\n       * `complete: false` is the SCAN having run out of budget, so `matched`\n       * is itself a floor.\n       */\n      truncated: emails.length > batch.length,\n      complete: scan.complete,\n      empty: false,\n      emails: batch,\n      verdicts: resolution.verdicts,\n      optedIn: resolution.optedIn,\n      needAttestation: resolution.needAttestation,\n      refused: resolution.refused,\n    })\n  } catch (error) {\n    console.error('[email] list rule preview failed', error)\n    return res\n      .status(500)\n      .json({ error: 'The audience could not be worked out.' })\n  }\n}\n\n/**\n * Console API registration.\n *\n * None of these is on the machine-path exemption list in\n * `plugin-api-rate-limit.ts`, so each is counted against the console\n * dispatcher's per-subject budget — the ceiling that bounds a surface which\n * puts a person into a marketing audience, and which scans a whole contact\n * silo to work out who that would be.\n *\n * The limiter these are counted by is the CONSOLE one,\n * `consoleApiRateLimitRefusal`. The visitor limiter is a different limiter on\n * a different dispatcher: `visitorWriteRateLimitRefusal` is installed only in\n * `apps/tenant`, and no request to these routes has ever passed through it.\n * The two share a counter and an exemption list and nothing else — the console\n * key is the authenticated subject, because on an authenticated surface a\n * per-(site, IP) bucket both isolates nothing the identity has not already\n * isolated and hands one operator a fresh budget per site.\n */\nexport function registerEmailConsoleApi(): void {\n  // The email design writer another plugin reaches through the core's\n  // resource-drafts seam (AGL-2912). Registered here alone: the AI jobs that\n  // write through it run only on the console, inline and on the beat\n  // (AGL-3026).\n  registerEmailDesignDraftWriter()\n  registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler)\n  registerPluginApiRoute(\n    'email/list-members-preview',\n    emailListMembersPreviewHandler,\n  )\n  registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler)\n  // The importer is four routes over one staged job, so it has its own\n  // module — but not its own gate: it reaches this file's `resolveListContext`\n  // and `resolveAddresses` rather than a bulk-shaped copy of them, which is\n  // the whole reason an import cannot enroll somebody the add path refuses.\n  registerEmailListImportApi()\n  // Suppressions live in their own module: they are a per-SITE list gated on\n  // the site role, where list membership is an ORG audience gated on org-wide\n  // access, and one file holding both gates is one file for the wrong one to\n  // be copied out of.\n  registerEmailSuppressionsApi()\n}\n"],"names":["registerEmailDesignDraftWriter","registerEmailSuppressionsApi","registerEmailListImportApi","LIST_MEMBER_BATCH_MAX","readAddresses","resolveAddresses","resolveListContext","ASSIGNMENT_REFUSAL_MESSAGES","assignmentBasis","dynamicListRuleIsEmpty","normalizeDynamicListRule","readMarketingBasis","registerPluginApiRoute","collectDynamicListCandidates","enrollListMember","CONSOLE_ADD_SOURCE","emailListMembersPreviewHandler","req","res","method","status","json","error","requested","context","ok","body","verdicts","optedIn","needAttestation","refused","hostId","inputs","emails","listName","console","emailListMembersAddHandler","attested","attestConsent","name","String","trim","nowMs","Date","now","resolution","results","verdict","refusal","email","push","input","enrolled","reason","summary","decision","stored","get","group","actingUid","uid","enrollment","listRef","length","source","via","consent","memberId","created","basis","added","filter","result","emailListRulePreviewHandler","rule","matched","truncated","complete","empty","scan","candidates","map","candidate","Boolean","batch","slice","registerEmailConsoleApi"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GAED,SAASA,8BAA8B,QAAQ,2BAAuB;AACtE,SAASC,4BAA4B,QAAQ,2BAAuB;AACpE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SACEC,qBAAqB,EACrBC,aAAa,EACbC,gBAAgB,EAChBC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,2BAA2B,EAC3BC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,kBAAkB,EAClBC,sBAAsB,QAGjB,sBAAqB;AAC5B,SACEC,4BAA4B,EAC5BC,gBAAgB,QACX,2BAA0B;AAEjC,6DAA6D,GAC7D,OAAO,MAAMC,qBAAqB,mBAAkB;AAEpD;;;;;CAKC,GACD,SACEZ,qBAAqB,EACrBE,gBAAgB,EAChBC,kBAAkB,QAKb,wBAAoB;AAG3B;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMU,iCAAmD,OAC9DC,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYnB,cAAca;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,IAAI;QACF,MAAME,UAAU,MAAMlB,mBAAmBW;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAM,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,eAAe,EAAEC,OAAO,EAAE,GACnD,MAAMzB,iBAAiB;YACrB0B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QACF;;;;;;;;KAQC,GACD,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BP;YACAC;YACAC;YACAC;QACF;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,sCAAsCA;QACpD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsC;IAC7E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,MAAMc,6BAA+C,OAC1DnB,KACAC;;QASiBD,WACGA;IARpB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYnB,cAAca;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,MAAMe,WAAWpB,EAAAA,YAAAA,IAAIS,IAAI,qBAART,UAAUqB,aAAa,MAAK;IAC7C,MAAMC,OAAOC,gBAAOvB,aAAAA,IAAIS,IAAI,qBAART,WAAUsB,IAAI,mBAAI,IAAIE,IAAI;IAE9C,IAAI;QACF,MAAMjB,UAAU,MAAMlB,mBAAmBW;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMgB,QAAQC,KAAKC,GAAG;QACtB,MAAMC,aAAa,MAAMxC,iBAAiB;YACxC0B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QAEA,MAAMa,UAAU,EAAE;QAClB,KAAK,MAAMC,WAAWF,WAAWlB,QAAQ,CAAE;gBAsB/BkB;YArBV,IAAIE,QAAQC,OAAO,IAAI,CAACD,QAAQE,KAAK,EAAE;gBACrCH,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQN,QAAQC,OAAO;oBACvB1B,OAAOyB,QAAQO,OAAO;gBACxB;gBACA;YACF;YACA;;;;;;;;;OASC,GACD,MAAMC,WAAW/C,gBAAgB;gBAC/BgD,MAAM,GAAEX,yBAAAA,WAAWW,MAAM,CAACC,GAAG,CAACV,QAAQE,KAAK,aAAnCJ,yBAAwClC,mBAAmB,MAAMkC,WAAWa,KAAK;gBACzFrB;gBACAsB,WAAWnC,QAAQoC,GAAG;gBACtBlB;YACF;YACA,IAAI,aAAaa,UAAU;gBACzBT,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQE,SAASP,OAAO;oBACxB1B,OAAOf,2BAA2B,CAACgD,SAASP,OAAO,CAAC;gBACtD;gBACA;YACF;YACA,MAAMa,aAAa,MAAM/C,iBAAiB;gBACxCgD,SAAStC,QAAQsC,OAAO;gBACxBJ,OAAOb,WAAWa,KAAK;gBACvBT,OAAOF,QAAQE,KAAK;eAChBV,QAAQhB,UAAUU,MAAM,CAAC8B,MAAM,KAAK,IAAI;gBAAExB;YAAK,IAAI,CAAC;gBACxDyB,QAAQjD;gBACR,mEAAmE;gBACnE,kEAAkE;gBAClE,gDAAgD;gBAChDkD,KAAK;gBACLC,SAASX;;YAEX,IAAIM,WAAWT,QAAQ,KAAK,OAAO;gBACjC;;;;;SAKC,GACD,MAAMC,SACJQ,WAAWb,OAAO,KAAK,aAAa,aAAa;gBACnDF,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC;oBACA/B,OAAOf,2BAA2B,CAAC8C,OAAO;gBAC5C;gBACA;YACF;YACAP,QAAQI,IAAI,CAAC;gBACXC,OAAOJ,QAAQI,KAAK;gBACpBF,OAAOF,QAAQE,KAAK;gBACpBG,UAAU;gBACVe,UAAUN,WAAWM,QAAQ;gBAC7BC,SAASP,WAAWO,OAAO;gBAC3BC,OAAOd,SAASc,KAAK;YACvB;QACF;QAEA,OAAOnD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BoC,OAAOxB,QAAQyB,MAAM,CAAC,CAACC,SAAWA,OAAOpB,QAAQ,EAAEW,MAAM;YACzDjB;QACF;IACF,EAAE,OAAOxB,OAAO;QACda,QAAQb,KAAK,CAAC,kCAAkCA;QAChD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMmD,8BAAgD,OAC3DxD,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI;YAKoCL;QAJtC,MAAMO,UAAU,MAAMlB,mBAAmBW;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMgD,OAAOhE,0BAAyBO,YAAAA,IAAIS,IAAI,qBAART,UAAUyD,IAAI;QACpD,IAAIjE,uBAAuBiE,OAAO;YAChC;;;;;OAKC,GACD,OAAOxD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BsD,SAAS;gBACTC,WAAW;gBACXC,UAAU;gBACVC,OAAO;gBACP7C,QAAQ,EAAE;gBACVN,UAAU,EAAE;gBACZC,SAAS;gBACTC,iBAAiB;gBACjBC,SAAS;YACX;QACF;QACA,MAAMiD,OAAO,MAAMlE,6BAA6B;YAC9CkB,QAAQP,QAAQO,MAAM;YACtB2C;QACF;QACA;;;;;KAKC,GACD,MAAMzC,SAAS8C,KAAKC,UAAU,CAC3BC,GAAG,CAAC,CAACC,YAAcA,UAAUjC,KAAK,EAClCsB,MAAM,CAACY;QACV,MAAMC,QAAQnD,OAAOoD,KAAK,CAAC,GAAGlF;QAC9B,MAAM0C,aAAa,MAAMxC,iBAAiB;YACxC0B,QAAQP,QAAQO,MAAM;YACtBC,QAAQoD;QACV;QACA,OAAOlE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1ByC,SAAS1C,OAAO8B,MAAM;YACtB;;;;;OAKC,GACDa,WAAW3C,OAAO8B,MAAM,GAAGqB,MAAMrB,MAAM;YACvCc,UAAUE,KAAKF,QAAQ;YACvBC,OAAO;YACP7C,QAAQmD;YACRzD,UAAUkB,WAAWlB,QAAQ;YAC7BC,SAASiB,WAAWjB,OAAO;YAC3BC,iBAAiBgB,WAAWhB,eAAe;YAC3CC,SAASe,WAAWf,OAAO;QAC7B;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,oCAAoCA;QAClD,OAAOJ,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAwC;IAC3D;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASgE;IACd,oEAAoE;IACpE,2EAA2E;IAC3E,mEAAmE;IACnE,cAAc;IACdtF;IACAY,uBAAuB,2BAA2B6D;IAClD7D,uBACE,8BACAI;IAEFJ,uBAAuB,0BAA0BwB;IACjD,qEAAqE;IACrE,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1ElC;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,oBAAoB;IACpBD;AACF"}