@aglyn/plugins-email 1.0.0-beta.182 → 1.0.0-beta.184

package/src/lib/server.js

@@ -22,7 +22,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * module is a bundle `app-router-graph.spec.ts` refuses. Every name here is a
  * pure function or a constant that lives in one leaf file.
  */ import { activeEmailTopics, mergeEmailTopics, normalizeEmailTopic, readTopicSubscriptionState, resolveCampaignTopic, EMAIL_TOPICS_COLLECTION, TOPIC_OPT_OUTS_SUBCOLLECTION } from "@aglyn/aglyn/app-utils/email-topics";
-import { confirmTopicSubscription, EMAIL_FREQUENCY_SUBCOLLECTION, firebaseAdmin, mirrorPlatformResubscribe, mirrorPlatformUnsubscribe, resolveCampaignSendRef, resolveOrgIdForHost, setMarketingCadence, UNSUBSCRIBE_SUPPRESSION_REASON } from "@aglyn/tenant-data-admin";
+import { consentGroupOptOutHosts, soloConsentGroup } from "@aglyn/aglyn/app-utils/consent-groups";
+import { confirmTopicSubscription, consentGroupForSite, EMAIL_FREQUENCY_SUBCOLLECTION, firebaseAdmin, mirrorPlatformResubscribe, mirrorPlatformUnsubscribe, resolveCampaignSendRef, resolveOrgIdForHost, setMarketingCadence, UNSUBSCRIBE_SUPPRESSION_REASON } from "@aglyn/tenant-data-admin";
 import { stampRecordEmailState } from "@aglyn/aglyn/plugin-manager/plugin-record-email-state";
 /*
  * The pure cadence rule from the shared email library, where the SEND path
@@ -165,6 +166,65 @@ function openSignedLink(req) {
         if (timer) clearTimeout(timer);
     }
 }
+/**
+ * THE SENDER A PERSON LEAVES HERE — the link site's consent group
+ * (`consent-groups.ts`), or the site alone.
+ *
+ * An org may declare several sites ONE sender, and every capture form in the
+ * group named it as one. So these pages treat it as one: an opt-out made here
+ * is read by every site in it (the send paths read across the group), the
+ * state shown is the group's, a way back in lifts the group's records, and
+ * the page names the group rather than one of its sites.
+ *
+ * `consentGroupForSite` fails to the site alone, and so does this when it
+ * throws. `waitMs` bounds the wait where a page only NAMES the sender, for the
+ * reason {@link BRAND_READ_TIMEOUT_MS} gives; a page deciding what to read or
+ * lift waits for the real answer.
+ */ async function loadConsentGroup(hostId, waitMs) {
+    const alone = soloConsentGroup(hostId);
+    const resolving = (async ()=>{
+        try {
+            return await consentGroupForSite(hostId);
+        } catch (error) {
+            console.error('[email] consent group read failed', error);
+            return alone;
+        }
+    })();
+    if (!waitMs) return resolving;
+    let timer;
+    try {
+        return await Promise.race([
+            resolving,
+            new Promise((resolve)=>{
+                timer = setTimeout(()=>resolve(alone), waitMs);
+            })
+        ]);
+    } finally{
+        if (timer) clearTimeout(timer);
+    }
+}
+/**
+ * The sender as a page names it.
+ *
+ * The group's name is what the capture form disclosed — "You'll receive
+ * marketing email from" the group — so it is the name the person knows this
+ * sender by, and the one an opt-out here reaches. The site's own brand still
+ * frames the page; `reach` is what stops the two names reading as a mistake.
+ */ function pageSender(brand, group) {
+    if (!group.declared || !group.name) {
+        return {
+            name: escapeHtml(brand.name),
+            reach: ''
+        };
+    }
+    return {
+        name: escapeHtml(group.name),
+        reach: `${escapeHtml(group.name)} sends from ${group.hostIds.length} sites, ` + `${escapeHtml(brand.name)} among them, and this covers all of them.`
+    };
+}
+/** The `reach` sentence as a paragraph, or nothing for a site alone. */ function reachParagraph(sender, gap = 20) {
+    return sender.reach ? paragraph(sender.reach, gap) : '';
+}
 const unsubscribeHandler = async (req, res)=>{
     var _req_method;
     const method = String((_req_method = req.method) != null ? _req_method : 'GET').toUpperCase();
@@ -180,10 +240,15 @@ const unsubscribeHandler = async (req, res)=>{
     const { hostId, email, campaignId, topicId } = params;
     const query = signedQuery(params);
     if (method !== 'POST') {
-        // SAFE. A prescanner lands here and nothing is written — the brand read
-        // is the only Firestore access on this path, and it is a read.
-        const brand = await loadHostBrand(hostId);
-        return void sendPage(res, page(heading('Unsubscribe?') + paragraph(`Confirm that <strong style="color:${PAL.ink}">${escapeHtml(email)}</strong> should stop receiving emails from ` + `<strong style="color:${PAL.ink}">${escapeHtml(brand.name)}</strong>.`) + `<form method="post" action="/api/email/unsubscribe?${escapeHtml(query)}">` + submitButton('Unsubscribe', {
+        // SAFE. A prescanner lands here and nothing is written — the brand and
+        // the consent group are the only Firestore access on this path, and both
+        // are reads.
+        const [brand, group] = await Promise.all([
+            loadHostBrand(hostId),
+            loadConsentGroup(hostId, BRAND_READ_TIMEOUT_MS)
+        ]);
+        const sender = pageSender(brand, group);
+        return void sendPage(res, page(heading('Unsubscribe?') + paragraph(`Confirm that <strong style="color:${PAL.ink}">${escapeHtml(email)}</strong> should stop receiving emails from ` + `<strong style="color:${PAL.ink}">${sender.name}</strong>.`, sender.reach ? 8 : 24) + reachParagraph(sender, 24) + `<form method="post" action="/api/email/unsubscribe?${escapeHtml(query)}">` + submitButton('Unsubscribe', {
             pal: brand.pal
         }) + '</form>' + // The way to a NARROWER choice, offered on the page rather than only
         // in the message footer: a recipient who reached the total
@@ -193,14 +258,21 @@ const unsubscribeHandler = async (req, res)=>{
     }
     try {
         const firestore = firebaseAdmin.app().firestore();
-        const [created, brand] = await Promise.all([
+        /*
+     * Written against the ONE site the link names, and honored by every site
+     * in its consent group: the send paths read a group's lists together, so
+     * the one row is the refusal for the whole sender — and it reaches a site
+     * that joins the group later, which a copy written now could not.
+     */ const [created, brand, group] = await Promise.all([
             writeSiteSuppression(firestore, hostId, key, {
                 email,
                 campaignId,
                 topicId
             }),
-            loadHostBrand(hostId)
+            loadHostBrand(hostId),
+            loadConsentGroup(hostId, BRAND_READ_TIMEOUT_MS)
         ]);
+        const sender = pageSender(brand, group);
         /*
      * The campaign's own unsubscribe count.
      *
@@ -219,7 +291,7 @@ const unsubscribeHandler = async (req, res)=>{
             email,
             left: 'everything'
         });
-        return void sendPage(res, page(successBadge(brand.pal) + heading("You're unsubscribed") + paragraph(`You won't receive further emails from ${escapeHtml(brand.name)}.`, 20) + // Same signed params, so the click that just proved this is really
+        return void sendPage(res, page(successBadge(brand.pal) + heading("You're unsubscribed") + paragraph(`You won't receive further emails from ${sender.name}.`, sender.reach ? 8 : 20) + reachParagraph(sender) + // Same signed params, so the click that just proved this is really
         // this recipient's link doubles as the resubscribe link — no new
         // token, no second email round-trip (AGL-2499).
         `<a href="/api/email/resubscribe?${escapeHtml(query)}" ` + `style="font-size:13px;color:${brand.pal.link};text-decoration:none">` + 'Changed your mind? Resubscribe</a>', 420, brand));
@@ -359,17 +431,24 @@ const unsubscribeHandler = async (req, res)=>{
     if (method !== 'POST') {
         // SAFE, same reasoning as the unsubscribe GET: a prescanner must not be
         // able to resubscribe someone either.
-        const brand = await loadHostBrand(hostId);
-        return void sendPage(res, page(heading('Resubscribe?') + paragraph(`Start receiving emails from <strong style="color:${PAL.ink}">` + `${escapeHtml(brand.name)}</strong> again at ` + `<strong style="color:${PAL.ink}">${escapeHtml(email)}</strong>.`) + `<form method="post" action="/api/email/resubscribe?${escapeHtml(query)}">` + submitButton('Resubscribe', {
+        const [brand, group] = await Promise.all([
+            loadHostBrand(hostId),
+            loadConsentGroup(hostId, BRAND_READ_TIMEOUT_MS)
+        ]);
+        const sender = pageSender(brand, group);
+        return void sendPage(res, page(heading('Resubscribe?') + paragraph(`Start receiving emails from <strong style="color:${PAL.ink}">` + `${sender.name}</strong> again at ` + `<strong style="color:${PAL.ink}">${escapeHtml(email)}</strong>.`, sender.reach ? 8 : 24) + reachParagraph(sender, 24) + `<form method="post" action="/api/email/resubscribe?${escapeHtml(query)}">` + submitButton('Resubscribe', {
             accent: 'link',
             pal: brand.pal
         }) + '</form>', 420, brand));
     }
     try {
         const firestore = firebaseAdmin.app().firestore();
-        const [released, brand] = await Promise.all([
-            releaseSiteSuppression(firestore, hostId, key),
-            loadHostBrand(hostId)
+        // The group decides which rows are lifted, so it is waited for in full.
+        const groupRead = loadConsentGroup(hostId);
+        const [released, brand, group] = await Promise.all([
+            groupRead.then((resolved)=>releaseSiteSuppression(firestore, resolved, key)),
+            loadHostBrand(hostId),
+            groupRead
         ]);
         if (!released) {
             return void sendPage(res, page(protectedAddressBody(), 420, brand));
@@ -381,7 +460,8 @@ const unsubscribeHandler = async (req, res)=>{
             email,
             via: 'email-resubscribe'
         });
-        return void sendPage(res, page(successBadge(brand.pal) + heading("You're resubscribed") + paragraph(`You'll receive emails from ${escapeHtml(brand.name)} again.`, 0), 420, brand));
+        const sender = pageSender(brand, group);
+        return void sendPage(res, page(successBadge(brand.pal) + heading("You're resubscribed") + paragraph(`You'll receive emails from ${sender.name} again.`, sender.reach ? 8 : 0) + reachParagraph(sender, 0), 420, brand));
     } catch (error) {
         console.error(error);
         return void res.status(500).send('Resubscribe failed — please try again');
@@ -399,18 +479,39 @@ const unsubscribeHandler = async (req, res)=>{
  * back in circulation goes through here so that there is exactly one place the
  * rule is stated.
  *
- * @returns false when the record was left standing because it is not an
+ * ## Across the consent group, all or nothing
+ *
+ * The send paths read every site's list in the link site's consent group, so
+ * an unsubscribe filed on a sibling holds this site's mail too — and a way
+ * back in that lifted only this site's row would tell the person they were
+ * resubscribed while the sender went on withholding. Every site's row is
+ * therefore read first, and the release happens only if none of them is a
+ * record this rule may not lift: one bounce or complaint anywhere in the
+ * group still holds the whole group, so lifting the unsubscribes beside it
+ * would change nothing the person could see, and the page says so instead.
+ *
+ * @returns false when a record was left standing because it is not an
  *          unsubscribe.
- */ async function releaseSiteSuppression(firestore, hostId, key) {
-    const ref = firestore.collection('hosts').doc(hostId).collection('suppressions').doc(key);
-    const snapshot = await ref.get();
-    if (snapshot.exists && snapshot.get('reason') !== UNSUBSCRIBE_SUPPRESSION_REASON) {
+ */ async function releaseSiteSuppression(firestore, group, key) {
+    const [own, ...siblings] = consentGroupOptOutHosts(group).map((id)=>firestore.collection('hosts').doc(id).collection('suppressions').doc(key));
+    const [ownSnapshot, ...siblingSnapshots] = await Promise.all([
+        own,
+        ...siblings
+    ].map((ref)=>ref.get()));
+    if ([
+        ownSnapshot,
+        ...siblingSnapshots
+    ].some((snapshot)=>snapshot.exists && snapshot.get('reason') !== UNSUBSCRIBE_SUPPRESSION_REASON)) {
         return false;
     }
     // Idempotent whether or not a doc existed — a resubscribe click on an
     // address that was never suppressed (or already resubscribed) is not an
-    // error, it is the state the visitor wanted.
-    await ref.delete();
+    // error, it is the state the visitor wanted. A sibling's row is deleted
+    // only where one stands.
+    await Promise.all([
+        own.delete(),
+        ...siblings.filter((_ref, index)=>siblingSnapshots[index].exists).map((ref)=>ref.delete())
+    ]);
     return true;
 }
 /** Shown wherever a resubscribe is refused, so the wording is one wording. */ function protectedAddressBody() {
@@ -459,15 +560,18 @@ const unsubscribeHandler = async (req, res)=>{
     try {
         var _req_body, _body_action;
         const firestore = firebaseAdmin.app().firestore();
-        // Three independent reads, so they go together rather than in series —
-        // the brand is not worth a third round trip on the page a recipient is
-        // waiting for.
-        const [catalog, state, brand] = await Promise.all([
+        // Independent reads, so they go together rather than in series — the
+        // brand is not worth another round trip on the page a recipient is
+        // waiting for. The state is the consent GROUP's, so it waits on the group.
+        const groupRead = loadConsentGroup(hostId);
+        const [catalog, state, brand, group] = await Promise.all([
             loadTopicCatalog(firestore, hostId),
-            readSubscriptionState(firestore, hostId, key),
-            loadHostBrand(hostId)
+            groupRead.then((resolved)=>readSubscriptionState(firestore, resolved, key)),
+            loadHostBrand(hostId),
+            groupRead
         ]);
         const topics = activeEmailTopics(catalog);
+        const sender = pageSender(brand, group);
         if (method !== 'POST') {
             // SAFE. Reads only, exactly like the other two GETs.
             return void sendPage(res, page(preferencesFormBody({
@@ -476,7 +580,8 @@ const unsubscribeHandler = async (req, res)=>{
                 topics,
                 state,
                 topicId,
-                brand
+                brand,
+                sender
             }), 520, brand));
         }
         const body = (_req_body = req.body) != null ? _req_body : {};
@@ -492,7 +597,7 @@ const unsubscribeHandler = async (req, res)=>{
                 email,
                 left: 'everything'
             });
-            return void sendPage(res, page(successBadge(brand.pal) + heading('Sorry to see you go') + paragraph(`<strong style="color:${PAL.ink}">${escapeHtml(email)}</strong> ` + 'has been unsubscribed from every email ' + `${escapeHtml(brand.name)} sends.`, 20) + paragraph('Changed your mind? ' + `<a href="/api/email/resubscribe?${escapeHtml(query)}" ` + `style="color:${brand.pal.link};text-decoration:none">` + 'Resubscribe</a>, or ' + `<a href="/api/email/preferences?${escapeHtml(query)}" ` + `style="color:${brand.pal.link};text-decoration:none">` + 'pick just the emails you want</a>.', 0), 420, brand));
+            return void sendPage(res, page(successBadge(brand.pal) + heading('Sorry to see you go') + paragraph(`<strong style="color:${PAL.ink}">${escapeHtml(email)}</strong> ` + 'has been unsubscribed from every email ' + `${sender.name} sends.`, sender.reach ? 8 : 20) + reachParagraph(sender) + paragraph('Changed your mind? ' + `<a href="/api/email/resubscribe?${escapeHtml(query)}" ` + `style="color:${brand.pal.link};text-decoration:none">` + 'Resubscribe</a>, or ' + `<a href="/api/email/preferences?${escapeHtml(query)}" ` + `style="color:${brand.pal.link};text-decoration:none">` + 'pick just the emails you want</a>.', 0), 420, brand));
         }
         /*
      * A CHECKED BOX MEANS "KEEP SENDING", so the opt-outs are the complement.
@@ -514,6 +619,15 @@ const unsubscribeHandler = async (req, res)=>{
             ]
         });
         /*
+     * A ticked box is a stream the person wants back FROM THE SENDER, and the
+     * send paths read an opt-out on any site of the consent group — so an
+     * opt-out a sibling holds is lifted too, or the box would be a choice the
+     * send path goes on refusing. The unticked ones are written here alone:
+     * this site's record is read across the group already.
+     */ await resumeTopicsAcrossGroup(firestore, group, key, [
+            ...keep
+        ]);
+        /*
      * HOW OFTEN, recorded from the same submit as WHAT.
      *
      * They are one decision — "less of this, and less often" — so they are
@@ -537,7 +651,7 @@ const unsubscribeHandler = async (req, res)=>{
      * dropping the address at the site suppression one layer above topics.
      */ let stillBlocked = false;
         if (keep.size) {
-            stillBlocked = !await releaseSiteSuppression(firestore, hostId, key);
+            stillBlocked = !await releaseSiteSuppression(firestore, group, key);
         }
         /*
      * The account's answer about product updates follows what this page just
@@ -566,8 +680,9 @@ const unsubscribeHandler = async (req, res)=>{
                 ...keep
             ],
             drop,
-            topics
-        }), cadence === 'all' && cadenceStored ? 20 : 8) + /*
+            topics,
+            sender
+        }), cadence === 'all' && cadenceStored && !sender.reach ? 20 : 8) + reachParagraph(sender, cadence === 'all' && cadenceStored ? 20 : 8) + /*
            * The pace is reported only when it is a CHOICE. "As they come" is
            * the default and the absence, so announcing it would tell somebody
            * who touched nothing that they had just asked for something.
@@ -608,44 +723,82 @@ const unsubscribeHandler = async (req, res)=>{
     return cadence === 'daily' ? 'one a day' : cadence === 'weekly' ? 'one a week' : 'one a month';
 }
 /**
- * All three per-site records for one address, in three keyed `get()`s.
+ * All three per-site records for one address, in three keyed `get()`s per
+ * site of the link site's consent group.
  *
  * By document id rather than a query, matching `filterSendableForHost`: no
  * composite index to go missing, and nothing that can fail open on a read
  * window. The third is the send counter, which is where the recipient's
  * chosen pace lives — see `EmailFrequencyRecord.cadence` for why it is stored
  * on the document the send path already reads rather than on this page's own.
- */ async function readSubscriptionState(firestore, hostId, key) {
-    var _ref;
-    const hostRef = firestore.collection('hosts').doc(hostId);
-    const [suppression, optOuts, frequency] = await Promise.all([
-        hostRef.collection('suppressions').doc(key).get(),
-        hostRef.collection(TOPIC_OPT_OUTS_SUBCOLLECTION).doc(key).get(),
-        hostRef.collection(EMAIL_FREQUENCY_SUBCOLLECTION).doc(key).get()// The pace is the one field on this page whose absence is a legitimate
-        // answer, so a read that fails renders the default rather than an
-        // error — the recipient still gets their topic checkboxes.
-        .catch(()=>null)
-    ]);
-    const stored = (_ref = (optOuts == null ? void 0 : optOuts.exists) ? optOuts.get('topics') : null) != null ? _ref : {};
+ *
+ * ## The group's state, read the way the send paths read it
+ *
+ * The page shows what the SENDER will do, and the sender is the consent
+ * group: a suppression standing on any of its sites, and a stream left on any
+ * of them, holds this site's mail too, so both show here. The pace is the one
+ * chosen most recently on any site's page. A pending confirmation is the link
+ * site's own, as it is on the send path. A group of one is the three reads
+ * this page always made.
+ */ async function readSubscriptionState(firestore, group, key) {
+    const sites = await Promise.all(consentGroupOptOutHosts(group).map((id)=>{
+        const hostRef = firestore.collection('hosts').doc(id);
+        return Promise.all([
+            hostRef.collection('suppressions').doc(key).get(),
+            hostRef.collection(TOPIC_OPT_OUTS_SUBCOLLECTION).doc(key).get(),
+            hostRef.collection(EMAIL_FREQUENCY_SUBCOLLECTION).doc(key).get()// The pace is the one field on this page whose absence is a
+            // legitimate answer, so a read that fails renders the default
+            // rather than an error — the recipient still gets their topic
+            // checkboxes.
+            .catch(()=>null)
+        ]);
+    }));
     const optedOut = new Set();
     const pending = new Set();
-    for (const [id, record] of Object.entries(stored)){
-        /*
-     * The shared reader, not a field test. An entry with a `resubscribedAt`
-     * is EVIDENCE of an opt-out that has been lifted rather than a live one —
-     * see `writeTopicOptOuts` for why the entry stays — and an entry with a
-     * `confirmedAt` carries the same shape of evidence for a confirmation.
-     * Only one function knows all three states.
-     */ const state = readTopicSubscriptionState(record);
-        if (state === 'opted-out') optedOut.add(id);
-        if (state === 'pending') pending.add(id);
-    }
+    let suppressed = false;
+    let protectedReason = null;
+    let cadence = null;
+    let cadenceSetAtMs = Number.NEGATIVE_INFINITY;
+    sites.forEach(([suppression, optOuts, frequency], index)=>{
+        var _ref;
+        const own = index === 0;
+        if (suppression == null ? void 0 : suppression.exists) {
+            suppressed = true;
+            const reason = suppression.get('reason');
+            if (reason !== UNSUBSCRIBE_SUPPRESSION_REASON && protectedReason === null) {
+                protectedReason = String(reason != null ? reason : 'held');
+            }
+        }
+        const stored = (_ref = (optOuts == null ? void 0 : optOuts.exists) ? optOuts.get('topics') : null) != null ? _ref : {};
+        for (const [id, record] of Object.entries(stored)){
+            /*
+       * The shared reader, not a field test. An entry with a `resubscribedAt`
+       * is EVIDENCE of an opt-out that has been lifted rather than a live one
+       * — see `writeTopicOptOuts` for why the entry stays — and an entry with
+       * a `confirmedAt` carries the same shape of evidence for a
+       * confirmation. Only one function knows all three states.
+       */ const state = readTopicSubscriptionState(record);
+            if (state === 'opted-out') optedOut.add(id);
+            if (own && state === 'pending') pending.add(id);
+        }
+        // The most recent choice on any site, the link site keeping a tie — the
+        // rule `filterCadenceSendable` decides by.
+        if ((frequency == null ? void 0 : frequency.exists) && frequency.get('cadence') != null) {
+            const setAtMs = Number(frequency.get('cadenceSetAtMs'));
+            const atMs = Number.isFinite(setAtMs) ? setAtMs : 0;
+            if (atMs > cadenceSetAtMs) {
+                cadenceSetAtMs = atMs;
+                cadence = frequency.get('cadence');
+            }
+        }
+    });
     return {
-        suppressed: !!(suppression == null ? void 0 : suppression.exists),
-        protectedRecord: !!(suppression == null ? void 0 : suppression.exists) && suppression.get('reason') !== UNSUBSCRIBE_SUPPRESSION_REASON,
+        suppressed,
+        protectedRecord: protectedReason !== null,
+        protectedReason,
         optedOut,
         pending,
-        cadence: normalizeMarketingCadence((frequency == null ? void 0 : frequency.exists) ? frequency.get('cadence') : null)
+        cadence: normalizeMarketingCadence(cadence)
     };
 }
 /**
@@ -739,6 +892,45 @@ const unsubscribeHandler = async (req, res)=>{
         });
     });
 }
+/**
+ * Lifts the opt-outs the link site's consent-group SIBLINGS hold on streams
+ * the person has just asked for back, so a stream rejoined here is rejoined
+ * from the whole sender — the send paths read a sibling's opt-out as this
+ * site's own.
+ *
+ * Only a live opt-out is touched, and it is lifted the way
+ * `writeTopicOptOuts` lifts one: `resubscribedAt` stamped onto the entry,
+ * which stays as the evidence that the opt-out was honored while it stood. A
+ * sibling's pending confirmation is left alone — it is that site's question,
+ * not a refusal of the sender. Nothing is read or written for a site alone.
+ */ async function resumeTopicsAcrossGroup(firestore, group, key, topicIds) {
+    const siblings = consentGroupOptOutHosts(group).slice(1);
+    if (!siblings.length || !topicIds.length) return;
+    await Promise.all(siblings.map(async (id)=>{
+        const ref = firestore.collection('hosts').doc(id).collection(TOPIC_OPT_OUTS_SUBCOLLECTION).doc(key);
+        await firestore.runTransaction(async (transaction)=>{
+            var _existing_get;
+            const existing = await transaction.get(ref);
+            if (!existing.exists) return;
+            const stored = (_existing_get = existing.get('topics')) != null ? _existing_get : {};
+            const lifted = {};
+            for (const topicId of topicIds){
+                const previous = stored[topicId];
+                if (readTopicSubscriptionState(previous) !== 'opted-out') continue;
+                lifted[topicId] = _extends({}, previous, {
+                    resubscribedAt: FieldValue.serverTimestamp()
+                });
+            }
+            if (!Object.keys(lifted).length) return;
+            transaction.set(ref, {
+                topics: _extends({}, stored, lifted),
+                updatedAt: FieldValue.serverTimestamp()
+            }, {
+                merge: true
+            });
+        });
+    }));
+}
 /**
  * Reopens ONE stream for a signed-in account (AGL-3305) — this plugin's side
  * of `plugin-email-streams`, which the console asks when an account's answer
@@ -769,13 +961,15 @@ const unsubscribeHandler = async (req, res)=>{
         status: 'held',
         reason: 'unusable-address'
     };
-    const state = await readSubscriptionState(firestore, request.hostId, key);
+    // The sender the stream is rejoined FROM — the site's consent group, whose
+    // records hold its mail as its own do.
+    const group = await loadConsentGroup(request.hostId);
+    const state = await readSubscriptionState(firestore, group, key);
     if (state.protectedRecord) {
-        var _suppression_get;
-        const suppression = await firestore.collection('hosts').doc(request.hostId).collection('suppressions').doc(key).get();
+        var _state_protectedReason;
         return {
             status: 'held',
-            reason: String((_suppression_get = suppression.get('reason')) != null ? _suppression_get : 'held')
+            reason: (_state_protectedReason = state.protectedReason) != null ? _state_protectedReason : 'held'
         };
     }
     const email = String(request.email).trim().toLowerCase();
@@ -788,6 +982,9 @@ const unsubscribeHandler = async (req, res)=>{
             ],
             confirmPending: false
         });
+        await resumeTopicsAcrossGroup(firestore, group, key, [
+            request.topicId
+        ]);
         return {
             status: 'rejoined',
             releasedSuppression: false,
@@ -803,7 +1000,10 @@ const unsubscribeHandler = async (req, res)=>{
         ],
         confirmPending: false
     });
-    if (!await releaseSiteSuppression(firestore, request.hostId, key)) {
+    await resumeTopicsAcrossGroup(firestore, group, key, [
+        request.topicId
+    ]);
+    if (!await releaseSiteSuppression(firestore, group, key)) {
         // Turned into a bounce or a complaint between the read and the lift.
         return {
             status: 'held',
@@ -849,7 +1049,7 @@ const unsubscribeHandler = async (req, res)=>{
     return `<div style="border-top:1px solid ${PAL.divider};padding-top:18px;margin-top:6px">` + `<div style="font-size:14px;font-weight:600;color:${PAL.ink};margin-bottom:2px">` + 'How often' + '</div>' + `<div style="font-size:13px;line-height:1.45;color:${PAL.muted};margin-bottom:6px">` + 'This applies to everything above. Nothing is canceled — messages just ' + 'wait until the next one is due.' + '</div>' + option('all', 'As they come') + option('daily', 'At most one a day') + option('weekly', 'At most one a week') + option('monthly', 'At most one a month') + '</div>';
 }
 /** The preference page's body. */ function preferencesFormBody(args) {
-    const { email, query, topics, state, topicId, brand } = args;
+    const { email, query, topics, state, topicId, brand, sender } = args;
     const pal = brand.pal;
     // A bounce or a complaint is not a preference, so the page does not pretend
     // the recipient can edit their way out of one. Shown instead of the form
@@ -858,7 +1058,7 @@ const unsubscribeHandler = async (req, res)=>{
     if (state.protectedRecord) return protectedAddressBody();
     const current = resolveCampaignTopic(topicId, topics);
     const action = `/api/email/preferences?${escapeHtml(query)}`;
-    return heading('Email preferences') + paragraph(`Choose what <strong style="color:${PAL.ink}">${escapeHtml(email)}</strong> should keep receiving from ` + `<strong style="color:${PAL.ink}">${escapeHtml(brand.name)}</strong>. Unticked emails stop; everything else carries on.`, 8) + (state.suppressed ? paragraph('You are currently unsubscribed from everything. Tick anything ' + 'below to start receiving it again.', 8) : '') + `<form method="post" action="${action}">` + topics.map((topic)=>topicRow(topic, // A whole-site suppression outranks the per-topic record, so an
+    return heading('Email preferences') + paragraph(`Choose what <strong style="color:${PAL.ink}">${escapeHtml(email)}</strong> should keep receiving from ` + `<strong style="color:${PAL.ink}">${sender.name}</strong>. ` + 'Unticked emails stop; everything else carries on.', 8) + reachParagraph(sender, 8) + (state.suppressed ? paragraph('You are currently unsubscribed from everything. Tick anything ' + 'below to start receiving it again.', 8) : '') + `<form method="post" action="${action}">` + topics.map((topic)=>topicRow(topic, // A whole-site suppression outranks the per-topic record, so an
         // unsubscribed recipient sees every box empty — which is the state
         // they are actually in, and the state the form must round-trip. An
         // unconfirmed topic is empty for the same reason: the send path
@@ -883,12 +1083,13 @@ const unsubscribeHandler = async (req, res)=>{
 }
 /** What the result page tells the recipient actually changed. */ function changeSummary(args) {
     const address = `<strong style="color:${PAL.ink}">${escapeHtml(args.email)}</strong>`;
+    const from = args.sender.reach ? args.sender.name : 'this site';
     if (!args.drop.length) {
-        return `${address} keeps receiving everything this site sends.`;
+        return `${address} keeps receiving everything ${from} sends.`;
     }
     const names = args.drop.map((topic)=>escapeHtml(topic.name)).join(', ');
     if (!args.keep.length) {
-        return `${address} has been unsubscribed from ${names} — everything this ` + 'site currently sends.';
+        return `${address} has been unsubscribed from ${names} — everything ` + `${from} currently sends.`;
     }
     return `${address} will stop receiving ${names}, and keeps the rest.`;
 }