@aglyn/plugins-email 1.0.0-beta.221 → 1.0.0-beta.222

package/src/lib/model/index.js

@@ -26,37 +26,10 @@
 //
 // Re-exported so `@aglyn/plugins-email/model` keeps working unchanged.
 export { renderEmailHtml, substituteMergeTokens, resolveMergeTags } from "@aglyn/shared-util-email";
-// The campaign document model and its arithmetic live in
-// `@aglyn/shared-ui-email-campaigns`. Marketing owns the campaign console
-// section and Email owns the message surfaces; both are independently
-// toggleable plugins, so a shape either one reads has to sit in a lib they
-// depend on as peers rather than inside one of them. Re-exported here so
-// `@aglyn/plugins-email/model` remains one barrel for this plugin's own
-// callers.
-/**
- * Campaign reporting: the rate math, the populations the send recorded, and
- * the link rollup — pure, so every denominator is named once and provable
- * rather than chosen in JSX.
- */ export * from "@aglyn/shared-ui-email-campaigns/model/campaign-report";
-/**
- * The same math taken across every message sent from one TEMPLATE. Separate
- * from `campaign-report` because a sum has a membership: which messages went
- * into it, and therefore which population the rate describes.
- */ export * from "./template-report.js";
-/** Reading one message record — its state, and when it went out. */ export * from "@aglyn/shared-ui-email-campaigns/model/email-record";
 /**
  * Whose template this is: authored here, or installed from a marketplace
  * listing and versioned by somebody else.
  */ export * from "./template-provenance.js";
-/**
- * One campaign message, rendered. Shared by the send loop, the composer's
- * pre-send preview and any other surface that has to show what will be
- * mailed — a preview that renders the message a second way previews
- * something else.
- */ /**
- * The campaign CONTAINER — its window, its lists, and the arithmetic that
- * rolls its sends into one set of figures.
- */ export * from "@aglyn/shared-ui-email-campaigns/model/campaign-container";
 /**
  * How each sending-domain state reads, said once for the list and the
  * domain's own page — including why `inconclusive` is neither of them.

package/src/lib/model/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/model/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Email rendering model (AGL-412): besigner-built email HTML rendering + merge tags, relocated from core app-utils.\n * Context-free — importable by client components, /server handlers, and\n * other plugins/apps via `@aglyn/plugins-email/model`.\n */\n// The renderer and merge-tag helpers moved to `@aglyn/shared-util-email`\n// (AGL-750): they are pure functions over a node map with no imports at all,\n// and the console's own API routes need them to render system email\n// templates. Apps are forbidden to import feature plugins (the `scope:app`\n// → `aglyn:addons` boundary), so leaving them here made them unreachable\n// from exactly the code that has to send the mail.\n//\n// Re-exported so `@aglyn/plugins-email/model` keeps working unchanged.\nexport {\n  renderEmailHtml,\n  substituteMergeTokens,\n  resolveMergeTags,\n  type EmailRenderOptions,\n  type EmailRenderProduct,\n  type RenderedEmail,\n} from '@aglyn/shared-util-email'\n\n// The campaign document model and its arithmetic live in\n// `@aglyn/shared-ui-email-campaigns`. Marketing owns the campaign console\n// section and Email owns the message surfaces; both are independently\n// toggleable plugins, so a shape either one reads has to sit in a lib they\n// depend on as peers rather than inside one of them. Re-exported here so\n// `@aglyn/plugins-email/model` remains one barrel for this plugin's own\n// callers.\n\n/**\n * Campaign reporting: the rate math, the populations the send recorded, and\n * the link rollup — pure, so every denominator is named once and provable\n * rather than chosen in JSX.\n */\nexport * from '@aglyn/shared-ui-email-campaigns/model/campaign-report'\n\n/**\n * The same math taken across every message sent from one TEMPLATE. Separate\n * from `campaign-report` because a sum has a membership: which messages went\n * into it, and therefore which population the rate describes.\n */\nexport * from './template-report'\n\n/** Reading one message record — its state, and when it went out. */\nexport * from '@aglyn/shared-ui-email-campaigns/model/email-record'\n\n/**\n * Whose template this is: authored here, or installed from a marketplace\n * listing and versioned by somebody else.\n */\nexport * from './template-provenance'\n\n/**\n * One campaign message, rendered. Shared by the send loop, the composer's\n * pre-send preview and any other surface that has to show what will be\n * mailed — a preview that renders the message a second way previews\n * something else.\n */\n\n/**\n * The campaign CONTAINER — its window, its lists, and the arithmetic that\n * rolls its sends into one set of figures.\n */\nexport * from '@aglyn/shared-ui-email-campaigns/model/campaign-container'\n\n/**\n * How each sending-domain state reads, said once for the list and the\n * domain's own page — including why `inconclusive` is neither of them.\n */\nexport * from './sending-domain-status'\n"],"names":["renderEmailHtml","substituteMergeTokens","resolveMergeTags"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;CAIC,GACD,yEAAyE;AACzE,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,yEAAyE;AACzE,mDAAmD;AACnD,EAAE;AACF,uEAAuE;AACvE,SACEA,eAAe,EACfC,qBAAqB,EACrBC,gBAAgB,QAIX,2BAA0B;AAEjC,yDAAyD;AACzD,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,WAAW;AAEX;;;;CAIC,GACD,cAAc,yDAAwD;AAEtE;;;;CAIC,GACD,cAAc,uBAAmB;AAEjC,kEAAkE,GAClE,cAAc,sDAAqD;AAEnE;;;CAGC,GACD,cAAc,2BAAuB;AAErC;;;;;CAKC,GAED;;;CAGC,GACD,cAAc,4DAA2D;AAEzE;;;CAGC,GACD,cAAc,6BAAyB"}
+{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/model/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Email rendering model (AGL-412): besigner-built email HTML rendering + merge tags, relocated from core app-utils.\n * Context-free — importable by client components, /server handlers, and\n * other plugins/apps via `@aglyn/plugins-email/model`.\n */\n// The renderer and merge-tag helpers moved to `@aglyn/shared-util-email`\n// (AGL-750): they are pure functions over a node map with no imports at all,\n// and the console's own API routes need them to render system email\n// templates. Apps are forbidden to import feature plugins (the `scope:app`\n// → `aglyn:addons` boundary), so leaving them here made them unreachable\n// from exactly the code that has to send the mail.\n//\n// Re-exported so `@aglyn/plugins-email/model` keeps working unchanged.\nexport {\n  renderEmailHtml,\n  substituteMergeTokens,\n  resolveMergeTags,\n  type EmailRenderOptions,\n  type EmailRenderProduct,\n  type RenderedEmail,\n} from '@aglyn/shared-util-email'\n\n/**\n * Whose template this is: authored here, or installed from a marketplace\n * listing and versioned by somebody else.\n */\nexport * from './template-provenance'\n\n/**\n * How each sending-domain state reads, said once for the list and the\n * domain's own page — including why `inconclusive` is neither of them.\n */\nexport * from './sending-domain-status'\n"],"names":["renderEmailHtml","substituteMergeTokens","resolveMergeTags"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;CAIC,GACD,yEAAyE;AACzE,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,yEAAyE;AACzE,mDAAmD;AACnD,EAAE;AACF,uEAAuE;AACvE,SACEA,eAAe,EACfC,qBAAqB,EACrBC,gBAAgB,QAIX,2BAA0B;AAEjC;;;CAGC,GACD,cAAc,2BAAuB;AAErC;;;CAGC,GACD,cAAc,6BAAyB"}

package/src/lib/plugin.d.ts

@@ -14,6 +14,14 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * The client half of what this plugin imports and exports (AGL-3529,
+ * AGL-3550): how the wizard and the hub name each resource, and the list import's two steps of its
+ * own — whether people the workspace already holds may change, and the
+ * statement of permission under what the dry run found. The server half
+ * registers from the console declarations.
+ */
+export declare function registerEmailTransferResourceUis(): void;
 /**
  * Console half (AGL-395): registers the Emails nav item + page in the
  * ConsoleExtension registry. Safe to call at console app load — the page is

package/src/lib/plugin.js

@@ -14,13 +14,16 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import * as Aglyn from "@aglyn/aglyn";
+import { registerPluginTransferResourceUi } from "@aglyn/aglyn/plugin-manager/plugin-transfer-resources";
 import { registerPluginZone } from "@aglyn/aglyn/plugin-manager/plugin-zones";
-import { mdiEmailOutline } from "@aglyn/shared-data-mdi";
+import { mdiAccountMultipleOutline, mdiEmailOffOutline, mdiEmailOutline } from "@aglyn/shared-data-mdi";
 import { lazy } from "react";
-import { EMAIL_MESSAGES_ZONE, EMAIL_TEMPLATE_RECIPIENTS_ZONE } from "./components/email-zones.js";
+import { EMAIL_MESSAGES_ZONE, EMAIL_TEMPLATE_RECIPIENTS_ZONE, EMAIL_TEMPLATE_REPORT_ZONE } from "./components/email-zones.js";
 import { EMAILS_CONSOLE_SECTIONS } from "./components/emails-console-sections.js";
 import { BUNDLE_ID } from "./constants/bundle-common.js";
+import { SITE_EMAIL_PACKAGE_KIND } from "./constants/site-package.js";
 import { registerEmailRecordRoutes } from "./model/email-record-routes.js";
+import { LIST_CONSENT_STEP_ID, LIST_EXISTING_STEP_ID, LIST_MEMBERS_RESOURCE, SUPPRESSIONS_RESOURCE } from "./transfer/email-transfer-catalog.js";
 /** Code-split: the Emails console page only loads when opened. */ const EmailsConsolePage = lazy(()=>import("./components/emails-console-page.js"));
 /*
  * What this plugin draws inside a campaign's own pages, each loaded only where
@@ -30,6 +33,57 @@ const CampaignTopicOptionsWidget = lazy(()=>import("./components/campaign-topic-
 const CampaignSenderEditorWidget = lazy(()=>import("./components/campaign-sender-editor-widget.js"));
 const CampaignDesignCreateWidget = lazy(()=>import("./components/campaign-design-create-widget.js"));
 const EmailDesignPreview = lazy(()=>import("./components/email-design-preview.js"));
+const SitePackageEmailPreview = lazy(()=>import("./components/site-package-email-preview.js"));
+/* The list import's own wizard steps, loaded when the wizard reaches one. */ const ListExistingStep = lazy(()=>import("./transfer/list-import-steps.js").then((steps)=>({
+            default: steps.ListExistingStep
+        })));
+const ListConsentStep = lazy(()=>import("./transfer/list-import-steps.js").then((steps)=>({
+            default: steps.ListConsentStep
+        })));
+/**
+ * The client half of what this plugin imports and exports (AGL-3529,
+ * AGL-3550): how the wizard and the hub name each resource, and the list import's two steps of its
+ * own — whether people the workspace already holds may change, and the
+ * statement of permission under what the dry run found. The server half
+ * registers from the console declarations.
+ */ export function registerEmailTransferResourceUis() {
+    registerPluginTransferResourceUi(LIST_MEMBERS_RESOURCE, {
+        label: 'list members',
+        icon: {
+            path: mdiAccountMultipleOutline.path
+        },
+        extraSteps: [
+            {
+                id: LIST_EXISTING_STEP_ID,
+                label: 'People already on this list',
+                after: 'matching',
+                component: ListExistingStep
+            },
+            {
+                id: LIST_CONSENT_STEP_ID,
+                label: 'Permission',
+                after: 'conflicts',
+                component: ListConsentStep
+            }
+        ]
+    }, {
+        pluginId: BUNDLE_ID
+    });
+    registerPluginTransferResourceUi(SUPPRESSIONS_RESOURCE, {
+        label: 'suppressions',
+        icon: {
+            path: mdiEmailOffOutline.path
+        }
+    }, {
+        pluginId: BUNDLE_ID
+    });
+    // How the Import & export hub names topics in a workspace package (AGL-3550).
+    registerPluginTransferResourceUi('email.topics', {
+        label: 'Email topics'
+    }, {
+        pluginId: BUNDLE_ID
+    });
+}
 /**
  * Console half (AGL-395): registers the Emails nav item + page in the
  * ConsoleExtension registry. Safe to call at console app load — the page is
@@ -42,6 +96,7 @@ const EmailDesignPreview = lazy(()=>import("./components/email-design-preview.js
     // Where a message and a sending identity are read (AGL-3080), for the
     // surfaces that link to them without knowing this page's address.
     registerEmailRecordRoutes();
+    registerEmailTransferResourceUis();
     /*
    * The two places this plugin's pages hand over to whichever plugin owns
    * campaigns. A message is one send of a campaign and every action on it is
@@ -58,6 +113,14 @@ const EmailDesignPreview = lazy(()=>import("./components/email-design-preview.js
     }, {
         pluginId: BUNDLE_ID
     });
+    registerPluginZone({
+        zone: EMAIL_TEMPLATE_REPORT_ZONE,
+        label: 'What a template’s emails did',
+        surface: 'console',
+        description: 'On one template’s page, under its name. A widget here reports the messages sent from that template — their figures, the audiences they went to and the messages themselves — read from the plugin that sends them; it is handed the site, the template’s id and the Emails page’s base path.'
+    }, {
+        pluginId: BUNDLE_ID
+    });
     registerPluginZone({
         zone: EMAIL_TEMPLATE_RECIPIENTS_ZONE,
         label: 'Who received a template’s emails',
@@ -137,6 +200,17 @@ const EmailDesignPreview = lazy(()=>import("./components/email-design-preview.js
                 widgetId: 'email-campaign-design-preview',
                 title: 'Preview',
                 Component: EmailDesignPreview
+            },
+            {
+                // A site email in a site package import, each side drawn by the
+                // preview that renders through the send path's code (AGL-3545).
+                slot: Aglyn.CONSOLE_WIDGET_SLOTS.sitePackageItemPreview,
+                widgetId: 'email-site-package-preview',
+                title: 'Email preview',
+                itemKinds: [
+                    SITE_EMAIL_PACKAGE_KIND
+                ],
+                Component: SitePackageEmailPreview
             }
         ],
         navItems: [

package/src/lib/plugin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport { mdiEmailOutline } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport {\n  EMAIL_MESSAGES_ZONE,\n  EMAIL_TEMPLATE_RECIPIENTS_ZONE,\n} from './components/email-zones'\nimport { EMAILS_CONSOLE_SECTIONS } from './components/emails-console-sections'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { registerEmailRecordRoutes } from './model/email-record-routes'\n\n/** Code-split: the Emails console page only loads when opened. */\nconst EmailsConsolePage = lazy(() => import('./components/emails-console-page'))\n\n/*\n * What this plugin draws inside a campaign's own pages, each loaded only where\n * the campaign owner's zone is on screen.\n */\nconst CampaignTopicSelect = lazy(\n  () => import('./components/campaign-topic-select'),\n)\nconst CampaignTopicOptionsWidget = lazy(\n  () => import('./components/campaign-topic-options-widget'),\n)\nconst CampaignSenderEditorWidget = lazy(\n  () => import('./components/campaign-sender-editor-widget'),\n)\nconst CampaignDesignCreateWidget = lazy(\n  () => import('./components/campaign-design-create-widget'),\n)\nconst EmailDesignPreview = lazy(\n  () => import('./components/email-design-preview'),\n)\n\n/**\n * Console half (AGL-395): registers the Emails nav item + page in the\n * ConsoleExtension registry. Safe to call at console app load — the page is\n * lazy, so no besigner/canvas code loads. The shell renders the Emails nav\n * item and, via its generic plugin route, the page (the messages and their\n * composer, the templates, the audience lists, the topic catalog, the sending\n * identities and the suppression list) — with no edit to the console's own\n * nav or page files.\n */\nexport function registerEmailConsole(): void {\n  // Where a message and a sending identity are read (AGL-3080), for the\n  // surfaces that link to them without knowing this page's address.\n  registerEmailRecordRoutes()\n  /*\n   * The two places this plugin's pages hand over to whichever plugin owns\n   * campaigns. A message is one send of a campaign and every action on it is\n   * that plugin's route, so the Messages section is a zone this page hosts\n   * rather than pages this plugin imports; the same holds for the recipients\n   * table under a template's report. Named, because a spec calls this\n   * registrar without the loader.\n   */\n  registerPluginZone(\n    {\n      zone: EMAIL_MESSAGES_ZONE,\n      label: 'The Emails page’s Messages section',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'The whole body of `/emails/messages` and the routes under it, under a site and on the organization’s Emails page. A widget here is handed the site (or `null` and the org mount at the organization level), the Emails page’s base path and the segments under `messages`, and draws the list, one message’s report or its composer.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: EMAIL_TEMPLATE_RECIPIENTS_ZONE,\n      label: 'Who received a template’s emails',\n      surface: 'console',\n      description:\n        'On one template’s page, under its report. A widget here lists the recipients of every send built from that template; it is handed the site and the template’s id.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    pluginId: BUNDLE_ID,\n    displayName: 'Email',\n    /*\n     * WHO may open the email console, declared so the shell enforces it.\n     *\n     * The audiences section reads `orgs/{orgId}/lists/{listId}/members`, and\n     * those members are enrolled CONTACTS — an address, a name, and the\n     * consent basis recording why the person may be mailed. That is the same\n     * org-shared people data the CRM holds, reached from a different page.\n     *\n     * The rules gate those reads on `isOrgWideMember()` ALONE, with no role\n     * condition, so org-wide membership of any role is enough to list every\n     * audience the organization has and everybody on it. An org VIEWER — the\n     * role that exists to read and change nothing — therefore reads the whole\n     * marketing audience today. `data.manage` is what closes that: it\n     * defaults to owner, admin and editor, so the population it admits is\n     * exactly the one `server-list-gate.ts` accepts a list write from, and\n     * the viewer it excludes is the reader the rules never excluded.\n     *\n     * `data.manage` rather than a key of this plugin's own for the reason the\n     * catalog gives for refusing a `marketing.manage`: campaigns are written\n     * client-direct against rules that gate on the HOST role, so a new\n     * org-level key would name an action with no org-level boundary under it.\n     * `data.manage` is not in that position — it already governs the\n     * org-shared data this surface exposes, and the list gate already reads\n     * the roles it defaults to.\n     *\n     * A SITE COLLABORATOR holding it opens the page, and the answer is NOT\n     * the one Contacts reached. There the listener is scoped and the rules\n     * prove the same predicate per document; here the audiences read demands\n     * `isOrgWideMember()`, which a collaborator is not, so the org-shared\n     * half is already refused beneath the console and the half that remains —\n     * this site's own messages, templates and sending identities — is theirs.\n     * Refusing the surface outright would take that away to close nothing.\n     */\n    permission: 'data.manage',\n    /*\n     * The mail a campaign rides on is this plugin's — the topic catalog, the\n     * sending identities, the design document and its renderer — so each is\n     * drawn here, in a zone the campaign owner's composer and message page\n     * host. Every one reports through a callback; none writes a campaign.\n     */\n    widgets: [\n      {\n        slot: 'campaignTopicSelect',\n        widgetId: 'email-campaign-topic-select',\n        title: 'Topic',\n        Component: CampaignTopicSelect,\n      },\n      {\n        slot: 'campaignTopicOptions',\n        widgetId: 'email-campaign-topic-options',\n        title: 'Topics',\n        Component: CampaignTopicOptionsWidget,\n      },\n      {\n        slot: 'campaignSenderEditor',\n        widgetId: 'email-campaign-sender-editor',\n        title: 'Add a sender',\n        Component: CampaignSenderEditorWidget,\n      },\n      {\n        slot: 'campaignDesignCreate',\n        widgetId: 'email-campaign-design-create',\n        title: 'Design this email',\n        Component: CampaignDesignCreateWidget,\n      },\n      {\n        slot: 'campaignDesignPreview',\n        widgetId: 'email-campaign-design-preview',\n        title: 'Preview',\n        Component: EmailDesignPreview,\n      },\n    ],\n    navItems: [\n      {\n        label: 'Emails',\n        href: '/emails',\n        icon: { path: mdiEmailOutline.path },\n        // Sections as ROUTES (AGL-2501): `/emails/messages` and friends are\n        // real URLs the shell resolves and gates, so the page mounts the one\n        // being read instead of subscribing all six.\n        sections: EMAILS_CONSOLE_SECTIONS,\n        header: {\n          title: 'Emails',\n          icon: { path: mdiEmailOutline.path },\n          docsTopic: 'emailCampaigns',\n        },\n        Component: EmailsConsolePage,\n      },\n    ],\n    /*\n     * The ORGANIZATION's Emails page, at `/[orgSlug]/emails`: the same six\n     * sections over every site. The audiences and the topics are the org's\n     * already; the messages, the templates, the sending identities and the\n     * suppression lists are read site by site and link into the site that\n     * holds them. The page is the same component — handed no site, it renders\n     * the org sections.\n     *\n     * No `navTabId`, the same as the site tab: this plugin's release flag\n     * gates the plugin itself, so one flag already holds both levels.\n     */\n    orgNavItems: [\n      {\n        label: 'Emails',\n        href: '/emails',\n        icon: { path: mdiEmailOutline.path },\n        sections: EMAILS_CONSOLE_SECTIONS,\n        header: {\n          title: 'Emails',\n          icon: { path: mdiEmailOutline.path },\n          docsTopic: 'emailCampaigns',\n        },\n        Component: EmailsConsolePage,\n      },\n    ],\n  })\n}\n\nexport * from './site'\n"],"names":["Aglyn","registerPluginZone","mdiEmailOutline","lazy","EMAIL_MESSAGES_ZONE","EMAIL_TEMPLATE_RECIPIENTS_ZONE","EMAILS_CONSOLE_SECTIONS","BUNDLE_ID","registerEmailRecordRoutes","EmailsConsolePage","CampaignTopicSelect","CampaignTopicOptionsWidget","CampaignSenderEditorWidget","CampaignDesignCreateWidget","EmailDesignPreview","registerEmailConsole","zone","label","surface","layout","description","pluginId","registerConsoleExtension","displayName","permission","widgets","slot","widgetId","title","Component","navItems","href","icon","path","sections","header","docsTopic","orgNavItems"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,IAAI,QAAQ,QAAO;AAC5B,SACEC,mBAAmB,EACnBC,8BAA8B,QACzB,8BAA0B;AACjC,SAASC,uBAAuB,QAAQ,0CAAsC;AAC9E,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,yBAAyB,QAAQ,iCAA6B;AAEvE,gEAAgE,GAChE,MAAMC,oBAAoBN,KAAK,IAAM,MAAM,CAAC;AAE5C;;;CAGC,GACD,MAAMO,sBAAsBP,KAC1B,IAAM,MAAM,CAAC;AAEf,MAAMQ,6BAA6BR,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMS,6BAA6BT,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMU,6BAA6BV,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMW,qBAAqBX,KACzB,IAAM,MAAM,CAAC;AAGf;;;;;;;;CAQC,GACD,OAAO,SAASY;IACd,sEAAsE;IACtE,kEAAkE;IAClEP;IACA;;;;;;;GAOC,GACDP,mBACE;QACEe,MAAMZ;QACNa,OAAO;QACPC,SAAS;QACTC,QAAQ;QACRC,aACE;IACJ,GACA;QAAEC,UAAUd;IAAU;IAExBN,mBACE;QACEe,MAAMX;QACNY,OAAO;QACPC,SAAS;QACTE,aACE;IACJ,GACA;QAAEC,UAAUd;IAAU;IAExBP,MAAMsB,wBAAwB,CAAC;QAC7BD,UAAUd;QACVgB,aAAa;QACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgCC,GACDC,YAAY;QACZ;;;;;KAKC,GACDC,SAAS;YACP;gBACEC,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWnB;YACb;YACA;gBACEgB,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWlB;YACb;YACA;gBACEe,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWjB;YACb;YACA;gBACEc,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWhB;YACb;YACA;gBACEa,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWf;YACb;SACD;QACDgB,UAAU;YACR;gBACEb,OAAO;gBACPc,MAAM;gBACNC,MAAM;oBAAEC,MAAM/B,gBAAgB+B,IAAI;gBAAC;gBACnC,oEAAoE;gBACpE,qEAAqE;gBACrE,6CAA6C;gBAC7CC,UAAU5B;gBACV6B,QAAQ;oBACNP,OAAO;oBACPI,MAAM;wBAAEC,MAAM/B,gBAAgB+B,IAAI;oBAAC;oBACnCG,WAAW;gBACb;gBACAP,WAAWpB;YACb;SACD;QACD;;;;;;;;;;KAUC,GACD4B,aAAa;YACX;gBACEpB,OAAO;gBACPc,MAAM;gBACNC,MAAM;oBAAEC,MAAM/B,gBAAgB+B,IAAI;gBAAC;gBACnCC,UAAU5B;gBACV6B,QAAQ;oBACNP,OAAO;oBACPI,MAAM;wBAAEC,MAAM/B,gBAAgB+B,IAAI;oBAAC;oBACnCG,WAAW;gBACb;gBACAP,WAAWpB;YACb;SACD;IACH;AACF;AAEA,cAAc,YAAQ"}
+{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { registerPluginTransferResourceUi } from '@aglyn/aglyn/plugin-manager/plugin-transfer-resources'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport {\n  mdiAccountMultipleOutline,\n  mdiEmailOffOutline,\n  mdiEmailOutline,\n} from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport {\n  EMAIL_MESSAGES_ZONE,\n  EMAIL_TEMPLATE_RECIPIENTS_ZONE,\n  EMAIL_TEMPLATE_REPORT_ZONE,\n} from './components/email-zones'\nimport { EMAILS_CONSOLE_SECTIONS } from './components/emails-console-sections'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { SITE_EMAIL_PACKAGE_KIND } from './constants/site-package'\nimport { registerEmailRecordRoutes } from './model/email-record-routes'\nimport {\n  LIST_CONSENT_STEP_ID,\n  LIST_EXISTING_STEP_ID,\n  LIST_MEMBERS_RESOURCE,\n  SUPPRESSIONS_RESOURCE,\n} from './transfer/email-transfer-catalog'\n\n/** Code-split: the Emails console page only loads when opened. */\nconst EmailsConsolePage = lazy(() => import('./components/emails-console-page'))\n\n/*\n * What this plugin draws inside a campaign's own pages, each loaded only where\n * the campaign owner's zone is on screen.\n */\nconst CampaignTopicSelect = lazy(\n  () => import('./components/campaign-topic-select'),\n)\nconst CampaignTopicOptionsWidget = lazy(\n  () => import('./components/campaign-topic-options-widget'),\n)\nconst CampaignSenderEditorWidget = lazy(\n  () => import('./components/campaign-sender-editor-widget'),\n)\nconst CampaignDesignCreateWidget = lazy(\n  () => import('./components/campaign-design-create-widget'),\n)\nconst EmailDesignPreview = lazy(\n  () => import('./components/email-design-preview'),\n)\nconst SitePackageEmailPreview = lazy(\n  () => import('./components/site-package-email-preview'),\n)\n\n/* The list import's own wizard steps, loaded when the wizard reaches one. */\nconst ListExistingStep = lazy(() =>\n  import('./transfer/list-import-steps').then((steps) => ({\n    default: steps.ListExistingStep,\n  })),\n)\nconst ListConsentStep = lazy(() =>\n  import('./transfer/list-import-steps').then((steps) => ({\n    default: steps.ListConsentStep,\n  })),\n)\n\n/**\n * The client half of what this plugin imports and exports (AGL-3529,\n * AGL-3550): how the wizard and the hub name each resource, and the list import's two steps of its\n * own — whether people the workspace already holds may change, and the\n * statement of permission under what the dry run found. The server half\n * registers from the console declarations.\n */\nexport function registerEmailTransferResourceUis(): void {\n  registerPluginTransferResourceUi(\n    LIST_MEMBERS_RESOURCE,\n    {\n      label: 'list members',\n      icon: { path: mdiAccountMultipleOutline.path },\n      extraSteps: [\n        {\n          id: LIST_EXISTING_STEP_ID,\n          label: 'People already on this list',\n          after: 'matching',\n          component: ListExistingStep,\n        },\n        {\n          id: LIST_CONSENT_STEP_ID,\n          label: 'Permission',\n          after: 'conflicts',\n          component: ListConsentStep,\n        },\n      ],\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginTransferResourceUi(\n    SUPPRESSIONS_RESOURCE,\n    { label: 'suppressions', icon: { path: mdiEmailOffOutline.path } },\n    { pluginId: BUNDLE_ID },\n  )\n  // How the Import & export hub names topics in a workspace package (AGL-3550).\n  registerPluginTransferResourceUi(\n    'email.topics',\n    { label: 'Email topics' },\n    { pluginId: BUNDLE_ID },\n  )\n}\n\n/**\n * Console half (AGL-395): registers the Emails nav item + page in the\n * ConsoleExtension registry. Safe to call at console app load — the page is\n * lazy, so no besigner/canvas code loads. The shell renders the Emails nav\n * item and, via its generic plugin route, the page (the messages and their\n * composer, the templates, the audience lists, the topic catalog, the sending\n * identities and the suppression list) — with no edit to the console's own\n * nav or page files.\n */\nexport function registerEmailConsole(): void {\n  // Where a message and a sending identity are read (AGL-3080), for the\n  // surfaces that link to them without knowing this page's address.\n  registerEmailRecordRoutes()\n  registerEmailTransferResourceUis()\n  /*\n   * The two places this plugin's pages hand over to whichever plugin owns\n   * campaigns. A message is one send of a campaign and every action on it is\n   * that plugin's route, so the Messages section is a zone this page hosts\n   * rather than pages this plugin imports; the same holds for the recipients\n   * table under a template's report. Named, because a spec calls this\n   * registrar without the loader.\n   */\n  registerPluginZone(\n    {\n      zone: EMAIL_MESSAGES_ZONE,\n      label: 'The Emails page’s Messages section',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'The whole body of `/emails/messages` and the routes under it, under a site and on the organization’s Emails page. A widget here is handed the site (or `null` and the org mount at the organization level), the Emails page’s base path and the segments under `messages`, and draws the list, one message’s report or its composer.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: EMAIL_TEMPLATE_REPORT_ZONE,\n      label: 'What a template’s emails did',\n      surface: 'console',\n      description:\n        'On one template’s page, under its name. A widget here reports the messages sent from that template — their figures, the audiences they went to and the messages themselves — read from the plugin that sends them; it is handed the site, the template’s id and the Emails page’s base path.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: EMAIL_TEMPLATE_RECIPIENTS_ZONE,\n      label: 'Who received a template’s emails',\n      surface: 'console',\n      description:\n        'On one template’s page, under its report. A widget here lists the recipients of every send built from that template; it is handed the site and the template’s id.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    pluginId: BUNDLE_ID,\n    displayName: 'Email',\n    /*\n     * WHO may open the email console, declared so the shell enforces it.\n     *\n     * The audiences section reads `orgs/{orgId}/lists/{listId}/members`, and\n     * those members are enrolled CONTACTS — an address, a name, and the\n     * consent basis recording why the person may be mailed. That is the same\n     * org-shared people data the CRM holds, reached from a different page.\n     *\n     * The rules gate those reads on `isOrgWideMember()` ALONE, with no role\n     * condition, so org-wide membership of any role is enough to list every\n     * audience the organization has and everybody on it. An org VIEWER — the\n     * role that exists to read and change nothing — therefore reads the whole\n     * marketing audience today. `data.manage` is what closes that: it\n     * defaults to owner, admin and editor, so the population it admits is\n     * exactly the one `server-list-gate.ts` accepts a list write from, and\n     * the viewer it excludes is the reader the rules never excluded.\n     *\n     * `data.manage` rather than a key of this plugin's own for the reason the\n     * catalog gives for refusing a `marketing.manage`: campaigns are written\n     * client-direct against rules that gate on the HOST role, so a new\n     * org-level key would name an action with no org-level boundary under it.\n     * `data.manage` is not in that position — it already governs the\n     * org-shared data this surface exposes, and the list gate already reads\n     * the roles it defaults to.\n     *\n     * A SITE COLLABORATOR holding it opens the page, and the answer is NOT\n     * the one Contacts reached. There the listener is scoped and the rules\n     * prove the same predicate per document; here the audiences read demands\n     * `isOrgWideMember()`, which a collaborator is not, so the org-shared\n     * half is already refused beneath the console and the half that remains —\n     * this site's own messages, templates and sending identities — is theirs.\n     * Refusing the surface outright would take that away to close nothing.\n     */\n    permission: 'data.manage',\n    /*\n     * The mail a campaign rides on is this plugin's — the topic catalog, the\n     * sending identities, the design document and its renderer — so each is\n     * drawn here, in a zone the campaign owner's composer and message page\n     * host. Every one reports through a callback; none writes a campaign.\n     */\n    widgets: [\n      {\n        slot: 'campaignTopicSelect',\n        widgetId: 'email-campaign-topic-select',\n        title: 'Topic',\n        Component: CampaignTopicSelect,\n      },\n      {\n        slot: 'campaignTopicOptions',\n        widgetId: 'email-campaign-topic-options',\n        title: 'Topics',\n        Component: CampaignTopicOptionsWidget,\n      },\n      {\n        slot: 'campaignSenderEditor',\n        widgetId: 'email-campaign-sender-editor',\n        title: 'Add a sender',\n        Component: CampaignSenderEditorWidget,\n      },\n      {\n        slot: 'campaignDesignCreate',\n        widgetId: 'email-campaign-design-create',\n        title: 'Design this email',\n        Component: CampaignDesignCreateWidget,\n      },\n      {\n        slot: 'campaignDesignPreview',\n        widgetId: 'email-campaign-design-preview',\n        title: 'Preview',\n        Component: EmailDesignPreview,\n      },\n      {\n        // A site email in a site package import, each side drawn by the\n        // preview that renders through the send path's code (AGL-3545).\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.sitePackageItemPreview,\n        widgetId: 'email-site-package-preview',\n        title: 'Email preview',\n        itemKinds: [SITE_EMAIL_PACKAGE_KIND],\n        Component: SitePackageEmailPreview,\n      },\n    ],\n    navItems: [\n      {\n        label: 'Emails',\n        href: '/emails',\n        icon: { path: mdiEmailOutline.path },\n        // Sections as ROUTES (AGL-2501): `/emails/messages` and friends are\n        // real URLs the shell resolves and gates, so the page mounts the one\n        // being read instead of subscribing all six.\n        sections: EMAILS_CONSOLE_SECTIONS,\n        header: {\n          title: 'Emails',\n          icon: { path: mdiEmailOutline.path },\n          docsTopic: 'emailCampaigns',\n        },\n        Component: EmailsConsolePage,\n      },\n    ],\n    /*\n     * The ORGANIZATION's Emails page, at `/[orgSlug]/emails`: the same six\n     * sections over every site. The audiences and the topics are the org's\n     * already; the messages, the templates, the sending identities and the\n     * suppression lists are read site by site and link into the site that\n     * holds them. The page is the same component — handed no site, it renders\n     * the org sections.\n     *\n     * No `navTabId`, the same as the site tab: this plugin's release flag\n     * gates the plugin itself, so one flag already holds both levels.\n     */\n    orgNavItems: [\n      {\n        label: 'Emails',\n        href: '/emails',\n        icon: { path: mdiEmailOutline.path },\n        sections: EMAILS_CONSOLE_SECTIONS,\n        header: {\n          title: 'Emails',\n          icon: { path: mdiEmailOutline.path },\n          docsTopic: 'emailCampaigns',\n        },\n        Component: EmailsConsolePage,\n      },\n    ],\n  })\n}\n\nexport * from './site'\n"],"names":["Aglyn","registerPluginTransferResourceUi","registerPluginZone","mdiAccountMultipleOutline","mdiEmailOffOutline","mdiEmailOutline","lazy","EMAIL_MESSAGES_ZONE","EMAIL_TEMPLATE_RECIPIENTS_ZONE","EMAIL_TEMPLATE_REPORT_ZONE","EMAILS_CONSOLE_SECTIONS","BUNDLE_ID","SITE_EMAIL_PACKAGE_KIND","registerEmailRecordRoutes","LIST_CONSENT_STEP_ID","LIST_EXISTING_STEP_ID","LIST_MEMBERS_RESOURCE","SUPPRESSIONS_RESOURCE","EmailsConsolePage","CampaignTopicSelect","CampaignTopicOptionsWidget","CampaignSenderEditorWidget","CampaignDesignCreateWidget","EmailDesignPreview","SitePackageEmailPreview","ListExistingStep","then","steps","default","ListConsentStep","registerEmailTransferResourceUis","label","icon","path","extraSteps","id","after","component","pluginId","registerEmailConsole","zone","surface","layout","description","registerConsoleExtension","displayName","permission","widgets","slot","widgetId","title","Component","CONSOLE_WIDGET_SLOTS","sitePackageItemPreview","itemKinds","navItems","href","sections","header","docsTopic","orgNavItems"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,gCAAgC,QAAQ,wDAAuD;AACxG,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SACEC,yBAAyB,EACzBC,kBAAkB,EAClBC,eAAe,QACV,yBAAwB;AAC/B,SAASC,IAAI,QAAQ,QAAO;AAC5B,SACEC,mBAAmB,EACnBC,8BAA8B,EAC9BC,0BAA0B,QACrB,8BAA0B;AACjC,SAASC,uBAAuB,QAAQ,0CAAsC;AAC9E,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,uBAAuB,QAAQ,8BAA0B;AAClE,SAASC,yBAAyB,QAAQ,iCAA6B;AACvE,SACEC,oBAAoB,EACpBC,qBAAqB,EACrBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAmC;AAE1C,gEAAgE,GAChE,MAAMC,oBAAoBZ,KAAK,IAAM,MAAM,CAAC;AAE5C;;;CAGC,GACD,MAAMa,sBAAsBb,KAC1B,IAAM,MAAM,CAAC;AAEf,MAAMc,6BAA6Bd,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMe,6BAA6Bf,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMgB,6BAA6BhB,KACjC,IAAM,MAAM,CAAC;AAEf,MAAMiB,qBAAqBjB,KACzB,IAAM,MAAM,CAAC;AAEf,MAAMkB,0BAA0BlB,KAC9B,IAAM,MAAM,CAAC;AAGf,2EAA2E,GAC3E,MAAMmB,mBAAmBnB,KAAK,IAC5B,MAAM,CAAC,mCAAgCoB,IAAI,CAAC,CAACC,QAAW,CAAA;YACtDC,SAASD,MAAMF,gBAAgB;QACjC,CAAA;AAEF,MAAMI,kBAAkBvB,KAAK,IAC3B,MAAM,CAAC,mCAAgCoB,IAAI,CAAC,CAACC,QAAW,CAAA;YACtDC,SAASD,MAAME,eAAe;QAChC,CAAA;AAGF;;;;;;CAMC,GACD,OAAO,SAASC;IACd7B,iCACEe,uBACA;QACEe,OAAO;QACPC,MAAM;YAAEC,MAAM9B,0BAA0B8B,IAAI;QAAC;QAC7CC,YAAY;YACV;gBACEC,IAAIpB;gBACJgB,OAAO;gBACPK,OAAO;gBACPC,WAAWZ;YACb;YACA;gBACEU,IAAIrB;gBACJiB,OAAO;gBACPK,OAAO;gBACPC,WAAWR;YACb;SACD;IACH,GACA;QAAES,UAAU3B;IAAU;IAExBV,iCACEgB,uBACA;QAAEc,OAAO;QAAgBC,MAAM;YAAEC,MAAM7B,mBAAmB6B,IAAI;QAAC;IAAE,GACjE;QAAEK,UAAU3B;IAAU;IAExB,8EAA8E;IAC9EV,iCACE,gBACA;QAAE8B,OAAO;IAAe,GACxB;QAAEO,UAAU3B;IAAU;AAE1B;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS4B;IACd,sEAAsE;IACtE,kEAAkE;IAClE1B;IACAiB;IACA;;;;;;;GAOC,GACD5B,mBACE;QACEsC,MAAMjC;QACNwB,OAAO;QACPU,SAAS;QACTC,QAAQ;QACRC,aACE;IACJ,GACA;QAAEL,UAAU3B;IAAU;IAExBT,mBACE;QACEsC,MAAM/B;QACNsB,OAAO;QACPU,SAAS;QACTE,aACE;IACJ,GACA;QAAEL,UAAU3B;IAAU;IAExBT,mBACE;QACEsC,MAAMhC;QACNuB,OAAO;QACPU,SAAS;QACTE,aACE;IACJ,GACA;QAAEL,UAAU3B;IAAU;IAExBX,MAAM4C,wBAAwB,CAAC;QAC7BN,UAAU3B;QACVkC,aAAa;QACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgCC,GACDC,YAAY;QACZ;;;;;KAKC,GACDC,SAAS;YACP;gBACEC,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAWhC;YACb;YACA;gBACE6B,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAW/B;YACb;YACA;gBACE4B,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAW9B;YACb;YACA;gBACE2B,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAW7B;YACb;YACA;gBACE0B,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAW5B;YACb;YACA;gBACE,gEAAgE;gBAChE,gEAAgE;gBAChEyB,MAAMhD,MAAMoD,oBAAoB,CAACC,sBAAsB;gBACvDJ,UAAU;gBACVC,OAAO;gBACPI,WAAW;oBAAC1C;iBAAwB;gBACpCuC,WAAW3B;YACb;SACD;QACD+B,UAAU;YACR;gBACExB,OAAO;gBACPyB,MAAM;gBACNxB,MAAM;oBAAEC,MAAM5B,gBAAgB4B,IAAI;gBAAC;gBACnC,oEAAoE;gBACpE,qEAAqE;gBACrE,6CAA6C;gBAC7CwB,UAAU/C;gBACVgD,QAAQ;oBACNR,OAAO;oBACPlB,MAAM;wBAAEC,MAAM5B,gBAAgB4B,IAAI;oBAAC;oBACnC0B,WAAW;gBACb;gBACAR,WAAWjC;YACb;SACD;QACD;;;;;;;;;;KAUC,GACD0C,aAAa;YACX;gBACE7B,OAAO;gBACPyB,MAAM;gBACNxB,MAAM;oBAAEC,MAAM5B,gBAAgB4B,IAAI;gBAAC;gBACnCwB,UAAU/C;gBACVgD,QAAQ;oBACNR,OAAO;oBACPlB,MAAM;wBAAEC,MAAM5B,gBAAgB4B,IAAI;oBAAC;oBACnC0B,WAAW;gBACb;gBACAR,WAAWjC;YACb;SACD;IACH;AACF;AAEA,cAAc,YAAQ"}

package/src/lib/server/person-eraser.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginPersonEraser } from '@aglyn/aglyn/plugin-manager/plugin-person-erasure';
+/**
+ * THE EMAIL PLUGIN'S SHARE OF A PERSON ERASURE (AGL-2623, AGL-3080): the
+ * person comes off every audience list of the workspace.
+ *
+ * A member is filed under one of the ids `listMemberDocIds` names — the
+ * canonical key, then the ids earlier writers minted — so every list is asked
+ * for all of them with one `getAll`, and a member enrolled under an old id is
+ * not missed. The lists themselves, and their other members, stay.
+ *
+ * Unsubscribes and bounces are not touched: a suppression is keyed by the
+ * hash and is the promise the erasure keeps.
+ *
+ * A DRY RUN counts the memberships and writes nothing.
+ */
+type Firestore = FirebaseFirestore.Firestore;
+export interface EmailPersonEraserDeps {
+    firestore(): Firestore;
+}
+export declare function createEmailPersonEraser(deps: EmailPersonEraserDeps): PluginPersonEraser;
+/** The eraser over the platform's own Firestore, as the declarations register it. */
+export declare const emailPersonEraser: PluginPersonEraser;
+export {};

package/src/lib/server/person-eraser.js

@@ -0,0 +1,44 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { listMemberDocIds } from "@aglyn/tenant-data-admin/server/list-members";
+export function createEmailPersonEraser(deps) {
+    return async ({ orgId, email, dryRun })=>{
+        const db = deps.firestore();
+        const memberIds = listMemberDocIds(email);
+        let memberships = 0;
+        if (!memberIds.length) return {
+            memberships
+        };
+        const lists = await db.collection('orgs').doc(orgId).collection('lists').get();
+        for (const list of lists.docs){
+            const found = await db.getAll(...memberIds.map((id)=>list.ref.collection('members').doc(id)));
+            for (const member of found){
+                if (!member.exists) continue;
+                if (!dryRun) await member.ref.delete();
+                memberships += 1;
+            }
+        }
+        return {
+            memberships
+        };
+    };
+}
+/** The eraser over the platform's own Firestore, as the declarations register it. */ export const emailPersonEraser = (request)=>createEmailPersonEraser({
+        firestore: ()=>firebaseAdmin.app().firestore()
+    })(request);
+
+//# sourceMappingURL=person-eraser.js.map

package/src/lib/server/person-eraser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/email/src/lib/server/person-eraser.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  PluginPersonEraser,\n  PluginPersonErasureReport,\n} from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { listMemberDocIds } from '@aglyn/tenant-data-admin/server/list-members'\n\n/**\n * THE EMAIL PLUGIN'S SHARE OF A PERSON ERASURE (AGL-2623, AGL-3080): the\n * person comes off every audience list of the workspace.\n *\n * A member is filed under one of the ids `listMemberDocIds` names — the\n * canonical key, then the ids earlier writers minted — so every list is asked\n * for all of them with one `getAll`, and a member enrolled under an old id is\n * not missed. The lists themselves, and their other members, stay.\n *\n * Unsubscribes and bounces are not touched: a suppression is keyed by the\n * hash and is the promise the erasure keeps.\n *\n * A DRY RUN counts the memberships and writes nothing.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\nexport interface EmailPersonEraserDeps {\n  firestore(): Firestore\n}\n\nexport function createEmailPersonEraser(deps: EmailPersonEraserDeps): PluginPersonEraser {\n  return async ({ orgId, email, dryRun }): Promise<PluginPersonErasureReport> => {\n    const db = deps.firestore()\n    const memberIds = listMemberDocIds(email)\n    let memberships = 0\n    if (!memberIds.length) return { memberships }\n    const lists = await db.collection('orgs').doc(orgId).collection('lists').get()\n    for (const list of lists.docs) {\n      const found = await db.getAll(...memberIds.map((id) => list.ref.collection('members').doc(id)))\n      for (const member of found) {\n        if (!member.exists) continue\n        if (!dryRun) await member.ref.delete()\n        memberships += 1\n      }\n    }\n    return { memberships }\n  }\n}\n\n/** The eraser over the platform's own Firestore, as the declarations register it. */\nexport const emailPersonEraser: PluginPersonEraser = (request) =>\n  createEmailPersonEraser({ firestore: () => firebaseAdmin.app().firestore() })(request)\n"],"names":["firebaseAdmin","listMemberDocIds","createEmailPersonEraser","deps","orgId","email","dryRun","db","firestore","memberIds","memberships","length","lists","collection","doc","get","list","docs","found","getAll","map","id","ref","member","exists","delete","emailPersonEraser","request","app"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAMD,SAASA,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,gBAAgB,QAAQ,+CAA8C;AAuB/E,OAAO,SAASC,wBAAwBC,IAA2B;IACjE,OAAO,OAAO,EAAEC,KAAK,EAAEC,KAAK,EAAEC,MAAM,EAAE;QACpC,MAAMC,KAAKJ,KAAKK,SAAS;QACzB,MAAMC,YAAYR,iBAAiBI;QACnC,IAAIK,cAAc;QAClB,IAAI,CAACD,UAAUE,MAAM,EAAE,OAAO;YAAED;QAAY;QAC5C,MAAME,QAAQ,MAAML,GAAGM,UAAU,CAAC,QAAQC,GAAG,CAACV,OAAOS,UAAU,CAAC,SAASE,GAAG;QAC5E,KAAK,MAAMC,QAAQJ,MAAMK,IAAI,CAAE;YAC7B,MAAMC,QAAQ,MAAMX,GAAGY,MAAM,IAAIV,UAAUW,GAAG,CAAC,CAACC,KAAOL,KAAKM,GAAG,CAACT,UAAU,CAAC,WAAWC,GAAG,CAACO;YAC1F,KAAK,MAAME,UAAUL,MAAO;gBAC1B,IAAI,CAACK,OAAOC,MAAM,EAAE;gBACpB,IAAI,CAAClB,QAAQ,MAAMiB,OAAOD,GAAG,CAACG,MAAM;gBACpCf,eAAe;YACjB;QACF;QACA,OAAO;YAAEA;QAAY;IACvB;AACF;AAEA,mFAAmF,GACnF,OAAO,MAAMgB,oBAAwC,CAACC,UACpDzB,wBAAwB;QAAEM,WAAW,IAAMR,cAAc4B,GAAG,GAAGpB,SAAS;IAAG,GAAGmB,SAAQ"}

package/src/lib/server-console.js

@@ -64,11 +64,11 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * ## The gate itself is `server-list-gate.ts`
  *
  * Who may change a list's membership, and what is true about each address, are
- * asked by three route modules now: these two, and the file importer in
- * `server-list-import.ts`. They live in a module of their own so the importer
- * shares this file's answer rather than importing this file — which would be a
- * cycle, and a cycle whose module-level constants would evaluate in whichever
- * order the loader happened to reach them.
+ * asked by these two routes and by the file importer (the list-member transfer
+ * resource, `transfer/list-members.server.ts`). They live in a module of their
+ * own so the importer shares this file's answer rather than importing this
+ * file — which would be a cycle, and a cycle whose module-level constants
+ * would evaluate in whichever order the loader happened to reach them.
  */ import { registerEmailDesignDraftWriter } from "./server-email-drafts.js";
 import { registerEmailSuppressionsApi } from "./server-suppressions.js";
 import { registerEmailListImportApi } from "./server-list-import.js";
@@ -413,10 +413,10 @@ import { registerSubscriptionTopicIndex } from "./server-topic-index.js";
     registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler);
     registerPluginApiRoute('email/list-members-preview', emailListMembersPreviewHandler);
     registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler);
-    // The importer is four routes over one staged job, so it has its own
-    // module — but not its own gate: it reaches this file's `resolveListContext`
-    // and `resolveAddresses` rather than a bulk-shaped copy of them, which is
-    // the whole reason an import cannot enroll somebody the add path refuses.
+    // The importer runs on the transfer framework (its resource registers from
+    // the console declarations), and its permission step reads what the dry
+    // run found through this one route — behind `resolveListContext`, the gate
+    // the import's own writes reach through `resolveAddresses` too.
     registerEmailListImportApi();
     // Suppressions live in their own module: they are a per-SITE list gated on
     // the site role, where list membership is an ORG audience gated on org-wide

package/src/lib/server-console.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Putting somebody on an email list from the Emails console.\n *\n * The audience card could create a list and delete a list and nothing else:\n * no way to see who was on one, no way to add anybody, no way to take anybody\n * off. Every member document in production arrived from a capture surface —\n * the newsletter handler, the workflow `enrollList` step, the dynamic-list\n * materializer, the Inbox assignment — so the one act a merchant most expects\n * of a list, \"add this person\", was the one act the product refused.\n *\n * ## Why this is a route and not a client write\n *\n * Rules put `orgs/{orgId}/lists/{listId}/members` behind org-wide membership,\n * and until now that block allowed a client CREATE. Nothing used it, and it\n * was the whole feature waiting to be built wrong: a browser that can write a\n * member document can write `marketingConsent: true` beside an address it has\n * never checked, which is a consent record minted by pressing a button. The\n * rules now deny client create and update on that collection, and this route\n * is the writer — through `enrollListMember`, which owns the document id, and\n * through the shared `enrollment-basis`, which owns the basis.\n *\n * ## The same policy the Inbox uses, not a second one\n *\n * `assignmentBasis` and `assignmentReadout` are imported from the framework,\n * where they moved when this became their second caller. There is no third\n * consent basis and no console-only override: a stored `declined` refuses\n * here exactly as it refuses there, an attestation is recorded with the\n * account that made it, and a stored opt-in is carried across with the date\n * the PERSON set rather than the date somebody pressed Add.\n *\n * ## Reads only, until the operator has seen the count\n *\n * `email/list-members-preview` writes nothing. It answers, per address, what\n * would happen and why, so the attestation the operator gives on the second\n * call is given with the numbers in front of them. Both routes run the SAME\n * resolution over the SAME inputs — `resolveAddresses` — so the summary they\n * were shown is the summary that acts.\n *\n * ## Finding people is a read, and it uses the same gate\n *\n * `email/list-rule-preview` answers \"who do these filters select\" without\n * writing anything, so a fixed list can be filled from a search rather than\n * from somebody typing addresses one at a time. It runs the addresses it finds\n * through `resolveAddresses` as well — a bulk path that reached the membership\n * without the suppression check and the attestation would be a way to enroll\n * exactly the people the single-address path refuses.\n *\n * ## The gate itself is `server-list-gate.ts`\n *\n * Who may change a list's membership, and what is true about each address, are\n * asked by three route modules now: these two, and the file importer in\n * `server-list-import.ts`. They live in a module of their own so the importer\n * shares this file's answer rather than importing this file — which would be a\n * cycle, and a cycle whose module-level constants would evaluate in whichever\n * order the loader happened to reach them.\n */\n\nimport { registerEmailDesignDraftWriter } from './server-email-drafts'\nimport { registerEmailSuppressionsApi } from './server-suppressions'\nimport { registerEmailListImportApi } from './server-list-import'\nimport {\n  LIST_MEMBER_BATCH_MAX,\n  readAddresses,\n  resolveAddresses,\n  resolveListContext,\n} from './server-list-gate'\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentBasis,\n  dynamicListRuleIsEmpty,\n  normalizeDynamicListRule,\n  readMarketingBasis,\n  registerPluginApiRoute,\n  type AssignmentRefusal,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  collectDynamicListCandidates,\n  enrollListMember,\n  firebaseAdmin,\n} from '@aglyn/tenant-data-admin'\nimport { registerSubscriptionTopicIndex } from './server-topic-index'\n\n/** `source` stamped on every membership these routes write. */\nexport const CONSOLE_ADD_SOURCE = 'console:list-add'\n\n/*\n * Re-exported, not redefined. `@aglyn/plugins-email/server` has published\n * these names since the add path shipped, and the console panel and its specs\n * import them from there; moving the gate must not move the plugin's public\n * surface with it.\n */\nexport {\n  LIST_MEMBER_BATCH_MAX,\n  resolveAddresses,\n  resolveListContext,\n  type AddressResolution,\n  type AddressVerdict,\n  type ListContext,\n  type ResolvedBatch,\n} from './server-list-gate'\n\n\n/**\n * `POST email/list-members-preview` — what adding these addresses would do.\n *\n * Reads only, and reached by an explicit act — typing an address or pasting a\n * column — never on mount. It exists because the answer needs three things\n * the browser cannot have: the org's contacts (rules put them behind org-wide\n * membership, which the acting console session may not hold) and both\n * suppression lists. Computing any of it client-side would be a second copy\n * of the rule, on the surface whose whole job is to tell the operator the\n * truth about what is about to happen.\n *\n * It takes no attestation and has nowhere to put one. The preview answers\n * what is TRUE about each person, which is the input to the operator's\n * decision rather than a function of it — a preview whose numbers moved as\n * the box was ticked would not be a count anybody could stand behind.\n */\nexport const emailListMembersPreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const { verdicts, optedIn, needAttestation, refused } =\n      await resolveAddresses({\n        hostId: context.hostId,\n        inputs: requested.emails,\n      })\n    /*\n     * Named fields rather than a spread of the resolution.\n     *\n     * The resolution carries the consent RECORDS it was computed from, for the\n     * write path's use — raw stored basis, provenance, the account behind an\n     * operator assertion. None of that is the browser's, and a spread would\n     * put all of it on the wire the moment a field was added to the internal\n     * shape. What the surface needs is the verdicts and the counts.\n     */\n    return res.status(200).json({\n      listName: context.listName,\n      verdicts,\n      optedIn,\n      needAttestation,\n      refused,\n    })\n  } catch (error) {\n    console.error('[email] list member preview failed', error)\n    return res.status(500).json({ error: 'The addresses could not be checked.' })\n  }\n}\n\n/**\n * `POST email/list-members-add` — put these addresses on the list.\n *\n * Body: `{ hostId, listId, email | emails[], name?, attestConsent? }`.\n * `attestConsent` is the operator STATING that they have these people's\n * permission; it is not a way to name a basis, because the pass-through basis\n * is derived server-side from each person's own record.\n *\n * ## One attestation, for the count the operator was shown\n *\n * The batch carries a single assertion because it is a single act: an\n * operator pasting a column is making one claim about where that column came\n * from. What makes that safe is that the claim is applied per address by the\n * same function the preview ran, so it reaches only the addresses that\n * actually need it — an address with a stored opt-in keeps its own basis and\n * its own date, and an address nothing can enroll is refused with the\n * attestation on the table.\n *\n * ## Partial success is the honest answer\n *\n * A batch where one address is suppressed and forty are fine is not a failed\n * request. Every address comes back with what happened to it, so 200 here\n * means \"the request was processed\", never \"everybody was added\" — the caller\n * reads the per-address verdicts, which is why they are returned rather than\n * a count.\n */\nexport const emailListMembersAddHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  const attested = req.body?.attestConsent === true\n  const name = String(req.body?.name ?? '').trim()\n\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const nowMs = Date.now()\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: requested.emails,\n    })\n\n    const results = []\n    for (const verdict of resolution.verdicts) {\n      if (verdict.refusal || !verdict.email) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: verdict.refusal,\n          error: verdict.summary,\n        })\n        continue\n      }\n      /*\n       * The ONE place a basis is decided, and the only place the attestation\n       * is consulted.\n       *\n       * `resolveAddresses` has already answered the questions that are facts\n       * about the person; this answers the question that is about the\n       * operator, per address, from the consent record that resolution read.\n       * `no-basis` — an address with nothing on record and nobody asserting\n       * anything — is refused HERE and only here.\n       */\n      const decision = assignmentBasis({\n        stored: resolution.stored.get(verdict.email) ?? readMarketingBasis(null, resolution.group),\n        attested,\n        actingUid: context.uid,\n        nowMs,\n      })\n      if ('refusal' in decision) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: decision.refusal,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[decision.refusal],\n        })\n        continue\n      }\n      const enrollment = await enrollListMember({\n        listRef: context.listRef,\n        group: resolution.group,\n        email: verdict.email,\n        ...(name && requested.emails.length === 1 ? { name } : {}),\n        source: CONSOLE_ADD_SOURCE,\n        // Never `'rule'`: the dynamic-list materializer reconciles its own\n        // rows away when a person stops matching, and a decision somebody\n        // made by hand is not a rule match that lapsed.\n        via: 'manual',\n        consent: decision,\n        // A pass-through carries the person's grants as their record holds\n        // them (AGL-3320); an attestation carries none and is this site's.\n        ...(decision.basis === 'contact-opt-in'\n          ? { grantEntries: resolution.grants.get(verdict.email) ?? {} }\n          : {}),\n      })\n      if (enrollment.enrolled === false) {\n        /*\n         * The membership itself records a refusal the CRM record did not.\n         * `enrollListMember` is the only writer of the collection and holds\n         * the row, so it is the backstop for every enrollment route; reaching\n         * it here means the two records disagree, and the refusal wins.\n         */\n        const reason: AssignmentRefusal =\n          enrollment.refusal === 'declined' ? 'declined' : 'unroutable-address'\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[reason],\n        })\n        continue\n      }\n      results.push({\n        input: verdict.input,\n        email: verdict.email,\n        enrolled: true,\n        memberId: enrollment.memberId,\n        created: enrollment.created,\n        basis: decision.basis,\n      })\n    }\n\n    return res.status(200).json({\n      listName: context.listName,\n      added: results.filter((result) => result.enrolled).length,\n      results,\n    })\n  } catch (error) {\n    console.error('[email] list member add failed', error)\n    return res.status(500).json({ error: 'The addresses could not be added.' })\n  }\n}\n\n/**\n * WHO A SET OF FILTERS FINDS, and what would happen if you added them.\n *\n * ## The gap it fills\n *\n * The filters behind a list could only ever be MATERIALIZED — the sweep wrote\n * the matching people straight into the membership. A merchant could not ask\n * \"who is this\" without committing to it, and a fixed list could not use the\n * filters at all: its only way to gain a member was somebody typing or pasting\n * an address. This answers the question without writing anything.\n *\n * ## It is the same consent gate, not a second one\n *\n * The addresses the scan finds are put through {@link resolveAddresses} — the\n * exact function `email/list-members-preview` uses — so a suppressed address\n * is reported as refused here, and somebody with no opt-in on record is\n * reported as needing an attestation here, before any of them is offered for\n * adding. That is deliberate and load-bearing: a bulk path that skipped the\n * check would be a way to fill a list with people the one-at-a-time path\n * refuses, which is the defect class this product already has a register entry\n * for. The ADD still goes through `email/list-members-add`, which re-runs\n * every check server-side, so this preview is an honest readout rather than a\n * permission.\n *\n * ## What it will not do\n *\n * It writes nothing, it enrolls nobody, and it compares no count against any\n * limit. The batch cap below bounds how many addresses it hands back for a\n * single add — the scan itself still reports how many people it MATCHED, so a\n * merchant is told the audience is larger than one batch rather than shown a\n * truncated number as if it were the whole.\n */\nexport const emailListRulePreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const rule = normalizeDynamicListRule(req.body?.rule)\n    if (dynamicListRuleIsEmpty(rule)) {\n      /*\n       * Not an error, and not an empty result either. A rule with no source\n       * matches nobody by construction, and reporting that as \"0 people\" is\n       * indistinguishable from a rule that ran and found none — which is the\n       * confusion the `empty` flag exists to prevent everywhere else.\n       */\n      return res.status(200).json({\n        matched: 0,\n        truncated: false,\n        complete: true,\n        empty: true,\n        emails: [],\n        verdicts: [],\n        optedIn: 0,\n        needAttestation: 0,\n        refused: 0,\n      })\n    }\n    const scan = await collectDynamicListCandidates({\n      hostId: context.hostId,\n      rule,\n    })\n    /*\n     * The addresses, in the scan's own order, capped at what one add can\n     * carry. `matched` is reported separately and is NOT this length: a\n     * merchant looking at a 400-person audience must be told it is 400 even\n     * when the button in front of them adds 100.\n     */\n    const emails = scan.candidates\n      .map((candidate) => candidate.email)\n      .filter(Boolean)\n    const batch = emails.slice(0, LIST_MEMBER_BATCH_MAX)\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: batch,\n    })\n    return res.status(200).json({\n      listName: context.listName,\n      matched: emails.length,\n      /*\n       * Two different reasons a readout can be short of the truth, reported\n       * apart: `truncated` is this batch being smaller than the match, and\n       * `complete: false` is the SCAN having run out of budget, so `matched`\n       * is itself a floor.\n       */\n      truncated: emails.length > batch.length,\n      complete: scan.complete,\n      empty: false,\n      emails: batch,\n      verdicts: resolution.verdicts,\n      optedIn: resolution.optedIn,\n      needAttestation: resolution.needAttestation,\n      refused: resolution.refused,\n    })\n  } catch (error) {\n    console.error('[email] list rule preview failed', error)\n    return res\n      .status(500)\n      .json({ error: 'The audience could not be worked out.' })\n  }\n}\n\n/**\n * Console API registration.\n *\n * None of these is on the machine-path exemption list in\n * `plugin-api-rate-limit.ts`, so each is counted against the console\n * dispatcher's per-subject budget — the ceiling that bounds a surface which\n * puts a person into a marketing audience, and which scans a whole contact\n * silo to work out who that would be.\n *\n * The limiter these are counted by is the CONSOLE one,\n * `consoleApiRateLimitRefusal`. The visitor limiter is a different limiter on\n * a different dispatcher: `visitorWriteRateLimitRefusal` is installed only in\n * `apps/tenant`, and no request to these routes has ever passed through it.\n * The two share a counter and an exemption list and nothing else — the console\n * key is the authenticated subject, because on an authenticated surface a\n * per-(site, IP) bucket both isolates nothing the identity has not already\n * isolated and hands one operator a fresh budget per site.\n */\nexport function registerEmailConsoleApi(): void {\n  // The email design writer another plugin reaches through the core's\n  // resource-drafts seam (AGL-2912). Registered here alone: the AI jobs that\n  // write through it run only on the console, inline and on the beat\n  // (AGL-3026).\n  registerEmailDesignDraftWriter()\n  // The org's topic catalog, as the tenant surface publishes it: the console\n  // runs sends under a stream too.\n  registerSubscriptionTopicIndex(() => firebaseAdmin.app().firestore())\n  registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler)\n  registerPluginApiRoute(\n    'email/list-members-preview',\n    emailListMembersPreviewHandler,\n  )\n  registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler)\n  // The importer is four routes over one staged job, so it has its own\n  // module — but not its own gate: it reaches this file's `resolveListContext`\n  // and `resolveAddresses` rather than a bulk-shaped copy of them, which is\n  // the whole reason an import cannot enroll somebody the add path refuses.\n  registerEmailListImportApi()\n  // Suppressions live in their own module: they are a per-SITE list gated on\n  // the site role, where list membership is an ORG audience gated on org-wide\n  // access, and one file holding both gates is one file for the wrong one to\n  // be copied out of.\n  registerEmailSuppressionsApi()\n}\n"],"names":["registerEmailDesignDraftWriter","registerEmailSuppressionsApi","registerEmailListImportApi","LIST_MEMBER_BATCH_MAX","readAddresses","resolveAddresses","resolveListContext","ASSIGNMENT_REFUSAL_MESSAGES","assignmentBasis","dynamicListRuleIsEmpty","normalizeDynamicListRule","readMarketingBasis","registerPluginApiRoute","collectDynamicListCandidates","enrollListMember","firebaseAdmin","registerSubscriptionTopicIndex","CONSOLE_ADD_SOURCE","emailListMembersPreviewHandler","req","res","method","status","json","error","requested","context","ok","body","verdicts","optedIn","needAttestation","refused","hostId","inputs","emails","listName","console","emailListMembersAddHandler","attested","attestConsent","name","String","trim","nowMs","Date","now","resolution","results","verdict","refusal","email","push","input","enrolled","reason","summary","decision","stored","get","group","actingUid","uid","enrollment","listRef","length","source","via","consent","basis","grantEntries","grants","memberId","created","added","filter","result","emailListRulePreviewHandler","rule","matched","truncated","complete","empty","scan","candidates","map","candidate","Boolean","batch","slice","registerEmailConsoleApi","app","firestore"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GAED,SAASA,8BAA8B,QAAQ,2BAAuB;AACtE,SAASC,4BAA4B,QAAQ,2BAAuB;AACpE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SACEC,qBAAqB,EACrBC,aAAa,EACbC,gBAAgB,EAChBC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,2BAA2B,EAC3BC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,kBAAkB,EAClBC,sBAAsB,QAGjB,sBAAqB;AAC5B,SACEC,4BAA4B,EAC5BC,gBAAgB,EAChBC,aAAa,QACR,2BAA0B;AACjC,SAASC,8BAA8B,QAAQ,0BAAsB;AAErE,6DAA6D,GAC7D,OAAO,MAAMC,qBAAqB,mBAAkB;AAEpD;;;;;CAKC,GACD,SACEd,qBAAqB,EACrBE,gBAAgB,EAChBC,kBAAkB,QAKb,wBAAoB;AAG3B;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMY,iCAAmD,OAC9DC,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYrB,cAAce;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,IAAI;QACF,MAAME,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAM,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,eAAe,EAAEC,OAAO,EAAE,GACnD,MAAM3B,iBAAiB;YACrB4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QACF;;;;;;;;KAQC,GACD,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BP;YACAC;YACAC;YACAC;QACF;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,sCAAsCA;QACpD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsC;IAC7E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,MAAMc,6BAA+C,OAC1DnB,KACAC;;QASiBD,WACGA;IARpB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYrB,cAAce;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,MAAMe,WAAWpB,EAAAA,YAAAA,IAAIS,IAAI,qBAART,UAAUqB,aAAa,MAAK;IAC7C,MAAMC,OAAOC,gBAAOvB,aAAAA,IAAIS,IAAI,qBAART,WAAUsB,IAAI,mBAAI,IAAIE,IAAI;IAE9C,IAAI;QACF,MAAMjB,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMgB,QAAQC,KAAKC,GAAG;QACtB,MAAMC,aAAa,MAAM1C,iBAAiB;YACxC4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QAEA,MAAMa,UAAU,EAAE;QAClB,KAAK,MAAMC,WAAWF,WAAWlB,QAAQ,CAAE;gBAsB/BkB,wBA6BYA;YAlDtB,IAAIE,QAAQC,OAAO,IAAI,CAACD,QAAQE,KAAK,EAAE;gBACrCH,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQN,QAAQC,OAAO;oBACvB1B,OAAOyB,QAAQO,OAAO;gBACxB;gBACA;YACF;YACA;;;;;;;;;OASC,GACD,MAAMC,WAAWjD,gBAAgB;gBAC/BkD,MAAM,GAAEX,yBAAAA,WAAWW,MAAM,CAACC,GAAG,CAACV,QAAQE,KAAK,aAAnCJ,yBAAwCpC,mBAAmB,MAAMoC,WAAWa,KAAK;gBACzFrB;gBACAsB,WAAWnC,QAAQoC,GAAG;gBACtBlB;YACF;YACA,IAAI,aAAaa,UAAU;gBACzBT,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQE,SAASP,OAAO;oBACxB1B,OAAOjB,2BAA2B,CAACkD,SAASP,OAAO,CAAC;gBACtD;gBACA;YACF;YACA,MAAMa,aAAa,MAAMjD,iBAAiB;gBACxCkD,SAAStC,QAAQsC,OAAO;gBACxBJ,OAAOb,WAAWa,KAAK;gBACvBT,OAAOF,QAAQE,KAAK;eAChBV,QAAQhB,UAAUU,MAAM,CAAC8B,MAAM,KAAK,IAAI;gBAAExB;YAAK,IAAI,CAAC;gBACxDyB,QAAQjD;gBACR,mEAAmE;gBACnE,kEAAkE;gBAClE,gDAAgD;gBAChDkD,KAAK;gBACLC,SAASX;eAGLA,SAASY,KAAK,KAAK,mBACnB;gBAAEC,YAAY,GAAEvB,yBAAAA,WAAWwB,MAAM,CAACZ,GAAG,CAACV,QAAQE,KAAK,aAAnCJ,yBAAwC,CAAC;YAAE,IAC3D,CAAC;YAEP,IAAIgB,WAAWT,QAAQ,KAAK,OAAO;gBACjC;;;;;SAKC,GACD,MAAMC,SACJQ,WAAWb,OAAO,KAAK,aAAa,aAAa;gBACnDF,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC;oBACA/B,OAAOjB,2BAA2B,CAACgD,OAAO;gBAC5C;gBACA;YACF;YACAP,QAAQI,IAAI,CAAC;gBACXC,OAAOJ,QAAQI,KAAK;gBACpBF,OAAOF,QAAQE,KAAK;gBACpBG,UAAU;gBACVkB,UAAUT,WAAWS,QAAQ;gBAC7BC,SAASV,WAAWU,OAAO;gBAC3BJ,OAAOZ,SAASY,KAAK;YACvB;QACF;QAEA,OAAOjD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BsC,OAAO1B,QAAQ2B,MAAM,CAAC,CAACC,SAAWA,OAAOtB,QAAQ,EAAEW,MAAM;YACzDjB;QACF;IACF,EAAE,OAAOxB,OAAO;QACda,QAAQb,KAAK,CAAC,kCAAkCA;QAChD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMqD,8BAAgD,OAC3D1D,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI;YAKoCL;QAJtC,MAAMO,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMkD,OAAOpE,0BAAyBS,YAAAA,IAAIS,IAAI,qBAART,UAAU2D,IAAI;QACpD,IAAIrE,uBAAuBqE,OAAO;YAChC;;;;;OAKC,GACD,OAAO1D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BwD,SAAS;gBACTC,WAAW;gBACXC,UAAU;gBACVC,OAAO;gBACP/C,QAAQ,EAAE;gBACVN,UAAU,EAAE;gBACZC,SAAS;gBACTC,iBAAiB;gBACjBC,SAAS;YACX;QACF;QACA,MAAMmD,OAAO,MAAMtE,6BAA6B;YAC9CoB,QAAQP,QAAQO,MAAM;YACtB6C;QACF;QACA;;;;;KAKC,GACD,MAAM3C,SAASgD,KAAKC,UAAU,CAC3BC,GAAG,CAAC,CAACC,YAAcA,UAAUnC,KAAK,EAClCwB,MAAM,CAACY;QACV,MAAMC,QAAQrD,OAAOsD,KAAK,CAAC,GAAGtF;QAC9B,MAAM4C,aAAa,MAAM1C,iBAAiB;YACxC4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQsD;QACV;QACA,OAAOpE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1B2C,SAAS5C,OAAO8B,MAAM;YACtB;;;;;OAKC,GACDe,WAAW7C,OAAO8B,MAAM,GAAGuB,MAAMvB,MAAM;YACvCgB,UAAUE,KAAKF,QAAQ;YACvBC,OAAO;YACP/C,QAAQqD;YACR3D,UAAUkB,WAAWlB,QAAQ;YAC7BC,SAASiB,WAAWjB,OAAO;YAC3BC,iBAAiBgB,WAAWhB,eAAe;YAC3CC,SAASe,WAAWf,OAAO;QAC7B;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,oCAAoCA;QAClD,OAAOJ,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAwC;IAC3D;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASkE;IACd,oEAAoE;IACpE,2EAA2E;IAC3E,mEAAmE;IACnE,cAAc;IACd1F;IACA,2EAA2E;IAC3E,iCAAiC;IACjCgB,+BAA+B,IAAMD,cAAc4E,GAAG,GAAGC,SAAS;IAClEhF,uBAAuB,2BAA2BiE;IAClDjE,uBACE,8BACAM;IAEFN,uBAAuB,0BAA0B0B;IACjD,qEAAqE;IACrE,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1EpC;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,oBAAoB;IACpBD;AACF"}
+{"version":3,"sources":["../../../../../../libs/plugins/email/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Putting somebody on an email list from the Emails console.\n *\n * The audience card could create a list and delete a list and nothing else:\n * no way to see who was on one, no way to add anybody, no way to take anybody\n * off. Every member document in production arrived from a capture surface —\n * the newsletter handler, the workflow `enrollList` step, the dynamic-list\n * materializer, the Inbox assignment — so the one act a merchant most expects\n * of a list, \"add this person\", was the one act the product refused.\n *\n * ## Why this is a route and not a client write\n *\n * Rules put `orgs/{orgId}/lists/{listId}/members` behind org-wide membership,\n * and until now that block allowed a client CREATE. Nothing used it, and it\n * was the whole feature waiting to be built wrong: a browser that can write a\n * member document can write `marketingConsent: true` beside an address it has\n * never checked, which is a consent record minted by pressing a button. The\n * rules now deny client create and update on that collection, and this route\n * is the writer — through `enrollListMember`, which owns the document id, and\n * through the shared `enrollment-basis`, which owns the basis.\n *\n * ## The same policy the Inbox uses, not a second one\n *\n * `assignmentBasis` and `assignmentReadout` are imported from the framework,\n * where they moved when this became their second caller. There is no third\n * consent basis and no console-only override: a stored `declined` refuses\n * here exactly as it refuses there, an attestation is recorded with the\n * account that made it, and a stored opt-in is carried across with the date\n * the PERSON set rather than the date somebody pressed Add.\n *\n * ## Reads only, until the operator has seen the count\n *\n * `email/list-members-preview` writes nothing. It answers, per address, what\n * would happen and why, so the attestation the operator gives on the second\n * call is given with the numbers in front of them. Both routes run the SAME\n * resolution over the SAME inputs — `resolveAddresses` — so the summary they\n * were shown is the summary that acts.\n *\n * ## Finding people is a read, and it uses the same gate\n *\n * `email/list-rule-preview` answers \"who do these filters select\" without\n * writing anything, so a fixed list can be filled from a search rather than\n * from somebody typing addresses one at a time. It runs the addresses it finds\n * through `resolveAddresses` as well — a bulk path that reached the membership\n * without the suppression check and the attestation would be a way to enroll\n * exactly the people the single-address path refuses.\n *\n * ## The gate itself is `server-list-gate.ts`\n *\n * Who may change a list's membership, and what is true about each address, are\n * asked by these two routes and by the file importer (the list-member transfer\n * resource, `transfer/list-members.server.ts`). They live in a module of their\n * own so the importer shares this file's answer rather than importing this\n * file — which would be a cycle, and a cycle whose module-level constants\n * would evaluate in whichever order the loader happened to reach them.\n */\n\nimport { registerEmailDesignDraftWriter } from './server-email-drafts'\nimport { registerEmailSuppressionsApi } from './server-suppressions'\nimport { registerEmailListImportApi } from './server-list-import'\nimport {\n  LIST_MEMBER_BATCH_MAX,\n  readAddresses,\n  resolveAddresses,\n  resolveListContext,\n} from './server-list-gate'\nimport {\n  ASSIGNMENT_REFUSAL_MESSAGES,\n  assignmentBasis,\n  dynamicListRuleIsEmpty,\n  normalizeDynamicListRule,\n  readMarketingBasis,\n  registerPluginApiRoute,\n  type AssignmentRefusal,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport {\n  collectDynamicListCandidates,\n  enrollListMember,\n  firebaseAdmin,\n} from '@aglyn/tenant-data-admin'\nimport { registerSubscriptionTopicIndex } from './server-topic-index'\n\n/** `source` stamped on every membership these routes write. */\nexport const CONSOLE_ADD_SOURCE = 'console:list-add'\n\n/*\n * Re-exported, not redefined. `@aglyn/plugins-email/server` has published\n * these names since the add path shipped, and the console panel and its specs\n * import them from there; moving the gate must not move the plugin's public\n * surface with it.\n */\nexport {\n  LIST_MEMBER_BATCH_MAX,\n  resolveAddresses,\n  resolveListContext,\n  type AddressResolution,\n  type AddressVerdict,\n  type ListContext,\n  type ResolvedBatch,\n} from './server-list-gate'\n\n\n/**\n * `POST email/list-members-preview` — what adding these addresses would do.\n *\n * Reads only, and reached by an explicit act — typing an address or pasting a\n * column — never on mount. It exists because the answer needs three things\n * the browser cannot have: the org's contacts (rules put them behind org-wide\n * membership, which the acting console session may not hold) and both\n * suppression lists. Computing any of it client-side would be a second copy\n * of the rule, on the surface whose whole job is to tell the operator the\n * truth about what is about to happen.\n *\n * It takes no attestation and has nowhere to put one. The preview answers\n * what is TRUE about each person, which is the input to the operator's\n * decision rather than a function of it — a preview whose numbers moved as\n * the box was ticked would not be a count anybody could stand behind.\n */\nexport const emailListMembersPreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const { verdicts, optedIn, needAttestation, refused } =\n      await resolveAddresses({\n        hostId: context.hostId,\n        inputs: requested.emails,\n      })\n    /*\n     * Named fields rather than a spread of the resolution.\n     *\n     * The resolution carries the consent RECORDS it was computed from, for the\n     * write path's use — raw stored basis, provenance, the account behind an\n     * operator assertion. None of that is the browser's, and a spread would\n     * put all of it on the wire the moment a field was added to the internal\n     * shape. What the surface needs is the verdicts and the counts.\n     */\n    return res.status(200).json({\n      listName: context.listName,\n      verdicts,\n      optedIn,\n      needAttestation,\n      refused,\n    })\n  } catch (error) {\n    console.error('[email] list member preview failed', error)\n    return res.status(500).json({ error: 'The addresses could not be checked.' })\n  }\n}\n\n/**\n * `POST email/list-members-add` — put these addresses on the list.\n *\n * Body: `{ hostId, listId, email | emails[], name?, attestConsent? }`.\n * `attestConsent` is the operator STATING that they have these people's\n * permission; it is not a way to name a basis, because the pass-through basis\n * is derived server-side from each person's own record.\n *\n * ## One attestation, for the count the operator was shown\n *\n * The batch carries a single assertion because it is a single act: an\n * operator pasting a column is making one claim about where that column came\n * from. What makes that safe is that the claim is applied per address by the\n * same function the preview ran, so it reaches only the addresses that\n * actually need it — an address with a stored opt-in keeps its own basis and\n * its own date, and an address nothing can enroll is refused with the\n * attestation on the table.\n *\n * ## Partial success is the honest answer\n *\n * A batch where one address is suppressed and forty are fine is not a failed\n * request. Every address comes back with what happened to it, so 200 here\n * means \"the request was processed\", never \"everybody was added\" — the caller\n * reads the per-address verdicts, which is why they are returned rather than\n * a count.\n */\nexport const emailListMembersAddHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const requested = readAddresses(req)\n  if ('error' in requested) {\n    return res.status(400).json({ error: requested.error })\n  }\n  const attested = req.body?.attestConsent === true\n  const name = String(req.body?.name ?? '').trim()\n\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const nowMs = Date.now()\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: requested.emails,\n    })\n\n    const results = []\n    for (const verdict of resolution.verdicts) {\n      if (verdict.refusal || !verdict.email) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: verdict.refusal,\n          error: verdict.summary,\n        })\n        continue\n      }\n      /*\n       * The ONE place a basis is decided, and the only place the attestation\n       * is consulted.\n       *\n       * `resolveAddresses` has already answered the questions that are facts\n       * about the person; this answers the question that is about the\n       * operator, per address, from the consent record that resolution read.\n       * `no-basis` — an address with nothing on record and nobody asserting\n       * anything — is refused HERE and only here.\n       */\n      const decision = assignmentBasis({\n        stored: resolution.stored.get(verdict.email) ?? readMarketingBasis(null, resolution.group),\n        attested,\n        actingUid: context.uid,\n        nowMs,\n      })\n      if ('refusal' in decision) {\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason: decision.refusal,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[decision.refusal],\n        })\n        continue\n      }\n      const enrollment = await enrollListMember({\n        listRef: context.listRef,\n        group: resolution.group,\n        email: verdict.email,\n        ...(name && requested.emails.length === 1 ? { name } : {}),\n        source: CONSOLE_ADD_SOURCE,\n        // Never `'rule'`: the dynamic-list materializer reconciles its own\n        // rows away when a person stops matching, and a decision somebody\n        // made by hand is not a rule match that lapsed.\n        via: 'manual',\n        consent: decision,\n        // A pass-through carries the person's grants as their record holds\n        // them (AGL-3320); an attestation carries none and is this site's.\n        ...(decision.basis === 'contact-opt-in'\n          ? { grantEntries: resolution.grants.get(verdict.email) ?? {} }\n          : {}),\n      })\n      if (enrollment.enrolled === false) {\n        /*\n         * The membership itself records a refusal the CRM record did not.\n         * `enrollListMember` is the only writer of the collection and holds\n         * the row, so it is the backstop for every enrollment route; reaching\n         * it here means the two records disagree, and the refusal wins.\n         */\n        const reason: AssignmentRefusal =\n          enrollment.refusal === 'declined' ? 'declined' : 'unroutable-address'\n        results.push({\n          input: verdict.input,\n          email: verdict.email,\n          enrolled: false,\n          reason,\n          error: ASSIGNMENT_REFUSAL_MESSAGES[reason],\n        })\n        continue\n      }\n      results.push({\n        input: verdict.input,\n        email: verdict.email,\n        enrolled: true,\n        memberId: enrollment.memberId,\n        created: enrollment.created,\n        basis: decision.basis,\n      })\n    }\n\n    return res.status(200).json({\n      listName: context.listName,\n      added: results.filter((result) => result.enrolled).length,\n      results,\n    })\n  } catch (error) {\n    console.error('[email] list member add failed', error)\n    return res.status(500).json({ error: 'The addresses could not be added.' })\n  }\n}\n\n/**\n * WHO A SET OF FILTERS FINDS, and what would happen if you added them.\n *\n * ## The gap it fills\n *\n * The filters behind a list could only ever be MATERIALIZED — the sweep wrote\n * the matching people straight into the membership. A merchant could not ask\n * \"who is this\" without committing to it, and a fixed list could not use the\n * filters at all: its only way to gain a member was somebody typing or pasting\n * an address. This answers the question without writing anything.\n *\n * ## It is the same consent gate, not a second one\n *\n * The addresses the scan finds are put through {@link resolveAddresses} — the\n * exact function `email/list-members-preview` uses — so a suppressed address\n * is reported as refused here, and somebody with no opt-in on record is\n * reported as needing an attestation here, before any of them is offered for\n * adding. That is deliberate and load-bearing: a bulk path that skipped the\n * check would be a way to fill a list with people the one-at-a-time path\n * refuses, which is the defect class this product already has a register entry\n * for. The ADD still goes through `email/list-members-add`, which re-runs\n * every check server-side, so this preview is an honest readout rather than a\n * permission.\n *\n * ## What it will not do\n *\n * It writes nothing, it enrolls nobody, and it compares no count against any\n * limit. The batch cap below bounds how many addresses it hands back for a\n * single add — the scan itself still reports how many people it MATCHED, so a\n * merchant is told the audience is larger than one batch rather than shown a\n * truncated number as if it were the whole.\n */\nexport const emailListRulePreviewHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  try {\n    const context = await resolveListContext(req)\n    if (context.ok === false) {\n      return res.status(context.status).json(context.body)\n    }\n    const rule = normalizeDynamicListRule(req.body?.rule)\n    if (dynamicListRuleIsEmpty(rule)) {\n      /*\n       * Not an error, and not an empty result either. A rule with no source\n       * matches nobody by construction, and reporting that as \"0 people\" is\n       * indistinguishable from a rule that ran and found none — which is the\n       * confusion the `empty` flag exists to prevent everywhere else.\n       */\n      return res.status(200).json({\n        matched: 0,\n        truncated: false,\n        complete: true,\n        empty: true,\n        emails: [],\n        verdicts: [],\n        optedIn: 0,\n        needAttestation: 0,\n        refused: 0,\n      })\n    }\n    const scan = await collectDynamicListCandidates({\n      hostId: context.hostId,\n      rule,\n    })\n    /*\n     * The addresses, in the scan's own order, capped at what one add can\n     * carry. `matched` is reported separately and is NOT this length: a\n     * merchant looking at a 400-person audience must be told it is 400 even\n     * when the button in front of them adds 100.\n     */\n    const emails = scan.candidates\n      .map((candidate) => candidate.email)\n      .filter(Boolean)\n    const batch = emails.slice(0, LIST_MEMBER_BATCH_MAX)\n    const resolution = await resolveAddresses({\n      hostId: context.hostId,\n      inputs: batch,\n    })\n    return res.status(200).json({\n      listName: context.listName,\n      matched: emails.length,\n      /*\n       * Two different reasons a readout can be short of the truth, reported\n       * apart: `truncated` is this batch being smaller than the match, and\n       * `complete: false` is the SCAN having run out of budget, so `matched`\n       * is itself a floor.\n       */\n      truncated: emails.length > batch.length,\n      complete: scan.complete,\n      empty: false,\n      emails: batch,\n      verdicts: resolution.verdicts,\n      optedIn: resolution.optedIn,\n      needAttestation: resolution.needAttestation,\n      refused: resolution.refused,\n    })\n  } catch (error) {\n    console.error('[email] list rule preview failed', error)\n    return res\n      .status(500)\n      .json({ error: 'The audience could not be worked out.' })\n  }\n}\n\n/**\n * Console API registration.\n *\n * None of these is on the machine-path exemption list in\n * `plugin-api-rate-limit.ts`, so each is counted against the console\n * dispatcher's per-subject budget — the ceiling that bounds a surface which\n * puts a person into a marketing audience, and which scans a whole contact\n * silo to work out who that would be.\n *\n * The limiter these are counted by is the CONSOLE one,\n * `consoleApiRateLimitRefusal`. The visitor limiter is a different limiter on\n * a different dispatcher: `visitorWriteRateLimitRefusal` is installed only in\n * `apps/tenant`, and no request to these routes has ever passed through it.\n * The two share a counter and an exemption list and nothing else — the console\n * key is the authenticated subject, because on an authenticated surface a\n * per-(site, IP) bucket both isolates nothing the identity has not already\n * isolated and hands one operator a fresh budget per site.\n */\nexport function registerEmailConsoleApi(): void {\n  // The email design writer another plugin reaches through the core's\n  // resource-drafts seam (AGL-2912). Registered here alone: the AI jobs that\n  // write through it run only on the console, inline and on the beat\n  // (AGL-3026).\n  registerEmailDesignDraftWriter()\n  // The org's topic catalog, as the tenant surface publishes it: the console\n  // runs sends under a stream too.\n  registerSubscriptionTopicIndex(() => firebaseAdmin.app().firestore())\n  registerPluginApiRoute('email/list-rule-preview', emailListRulePreviewHandler)\n  registerPluginApiRoute(\n    'email/list-members-preview',\n    emailListMembersPreviewHandler,\n  )\n  registerPluginApiRoute('email/list-members-add', emailListMembersAddHandler)\n  // The importer runs on the transfer framework (its resource registers from\n  // the console declarations), and its permission step reads what the dry\n  // run found through this one route — behind `resolveListContext`, the gate\n  // the import's own writes reach through `resolveAddresses` too.\n  registerEmailListImportApi()\n  // Suppressions live in their own module: they are a per-SITE list gated on\n  // the site role, where list membership is an ORG audience gated on org-wide\n  // access, and one file holding both gates is one file for the wrong one to\n  // be copied out of.\n  registerEmailSuppressionsApi()\n}\n"],"names":["registerEmailDesignDraftWriter","registerEmailSuppressionsApi","registerEmailListImportApi","LIST_MEMBER_BATCH_MAX","readAddresses","resolveAddresses","resolveListContext","ASSIGNMENT_REFUSAL_MESSAGES","assignmentBasis","dynamicListRuleIsEmpty","normalizeDynamicListRule","readMarketingBasis","registerPluginApiRoute","collectDynamicListCandidates","enrollListMember","firebaseAdmin","registerSubscriptionTopicIndex","CONSOLE_ADD_SOURCE","emailListMembersPreviewHandler","req","res","method","status","json","error","requested","context","ok","body","verdicts","optedIn","needAttestation","refused","hostId","inputs","emails","listName","console","emailListMembersAddHandler","attested","attestConsent","name","String","trim","nowMs","Date","now","resolution","results","verdict","refusal","email","push","input","enrolled","reason","summary","decision","stored","get","group","actingUid","uid","enrollment","listRef","length","source","via","consent","basis","grantEntries","grants","memberId","created","added","filter","result","emailListRulePreviewHandler","rule","matched","truncated","complete","empty","scan","candidates","map","candidate","Boolean","batch","slice","registerEmailConsoleApi","app","firestore"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GAED,SAASA,8BAA8B,QAAQ,2BAAuB;AACtE,SAASC,4BAA4B,QAAQ,2BAAuB;AACpE,SAASC,0BAA0B,QAAQ,0BAAsB;AACjE,SACEC,qBAAqB,EACrBC,aAAa,EACbC,gBAAgB,EAChBC,kBAAkB,QACb,wBAAoB;AAC3B,SACEC,2BAA2B,EAC3BC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,kBAAkB,EAClBC,sBAAsB,QAGjB,sBAAqB;AAC5B,SACEC,4BAA4B,EAC5BC,gBAAgB,EAChBC,aAAa,QACR,2BAA0B;AACjC,SAASC,8BAA8B,QAAQ,0BAAsB;AAErE,6DAA6D,GAC7D,OAAO,MAAMC,qBAAqB,mBAAkB;AAEpD;;;;;CAKC,GACD,SACEd,qBAAqB,EACrBE,gBAAgB,EAChBC,kBAAkB,QAKb,wBAAoB;AAG3B;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMY,iCAAmD,OAC9DC,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYrB,cAAce;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,IAAI;QACF,MAAME,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAM,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,eAAe,EAAEC,OAAO,EAAE,GACnD,MAAM3B,iBAAiB;YACrB4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QACF;;;;;;;;KAQC,GACD,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BP;YACAC;YACAC;YACAC;QACF;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,sCAAsCA;QACpD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsC;IAC7E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,MAAMc,6BAA+C,OAC1DnB,KACAC;;QASiBD,WACGA;IARpB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYrB,cAAce;IAChC,IAAI,WAAWM,WAAW;QACxB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOC,UAAUD,KAAK;QAAC;IACvD;IACA,MAAMe,WAAWpB,EAAAA,YAAAA,IAAIS,IAAI,qBAART,UAAUqB,aAAa,MAAK;IAC7C,MAAMC,OAAOC,gBAAOvB,aAAAA,IAAIS,IAAI,qBAART,WAAUsB,IAAI,mBAAI,IAAIE,IAAI;IAE9C,IAAI;QACF,MAAMjB,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMgB,QAAQC,KAAKC,GAAG;QACtB,MAAMC,aAAa,MAAM1C,iBAAiB;YACxC4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQT,UAAUU,MAAM;QAC1B;QAEA,MAAMa,UAAU,EAAE;QAClB,KAAK,MAAMC,WAAWF,WAAWlB,QAAQ,CAAE;gBAsB/BkB,wBA6BYA;YAlDtB,IAAIE,QAAQC,OAAO,IAAI,CAACD,QAAQE,KAAK,EAAE;gBACrCH,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQN,QAAQC,OAAO;oBACvB1B,OAAOyB,QAAQO,OAAO;gBACxB;gBACA;YACF;YACA;;;;;;;;;OASC,GACD,MAAMC,WAAWjD,gBAAgB;gBAC/BkD,MAAM,GAAEX,yBAAAA,WAAWW,MAAM,CAACC,GAAG,CAACV,QAAQE,KAAK,aAAnCJ,yBAAwCpC,mBAAmB,MAAMoC,WAAWa,KAAK;gBACzFrB;gBACAsB,WAAWnC,QAAQoC,GAAG;gBACtBlB;YACF;YACA,IAAI,aAAaa,UAAU;gBACzBT,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC,QAAQE,SAASP,OAAO;oBACxB1B,OAAOjB,2BAA2B,CAACkD,SAASP,OAAO,CAAC;gBACtD;gBACA;YACF;YACA,MAAMa,aAAa,MAAMjD,iBAAiB;gBACxCkD,SAAStC,QAAQsC,OAAO;gBACxBJ,OAAOb,WAAWa,KAAK;gBACvBT,OAAOF,QAAQE,KAAK;eAChBV,QAAQhB,UAAUU,MAAM,CAAC8B,MAAM,KAAK,IAAI;gBAAExB;YAAK,IAAI,CAAC;gBACxDyB,QAAQjD;gBACR,mEAAmE;gBACnE,kEAAkE;gBAClE,gDAAgD;gBAChDkD,KAAK;gBACLC,SAASX;eAGLA,SAASY,KAAK,KAAK,mBACnB;gBAAEC,YAAY,GAAEvB,yBAAAA,WAAWwB,MAAM,CAACZ,GAAG,CAACV,QAAQE,KAAK,aAAnCJ,yBAAwC,CAAC;YAAE,IAC3D,CAAC;YAEP,IAAIgB,WAAWT,QAAQ,KAAK,OAAO;gBACjC;;;;;SAKC,GACD,MAAMC,SACJQ,WAAWb,OAAO,KAAK,aAAa,aAAa;gBACnDF,QAAQI,IAAI,CAAC;oBACXC,OAAOJ,QAAQI,KAAK;oBACpBF,OAAOF,QAAQE,KAAK;oBACpBG,UAAU;oBACVC;oBACA/B,OAAOjB,2BAA2B,CAACgD,OAAO;gBAC5C;gBACA;YACF;YACAP,QAAQI,IAAI,CAAC;gBACXC,OAAOJ,QAAQI,KAAK;gBACpBF,OAAOF,QAAQE,KAAK;gBACpBG,UAAU;gBACVkB,UAAUT,WAAWS,QAAQ;gBAC7BC,SAASV,WAAWU,OAAO;gBAC3BJ,OAAOZ,SAASY,KAAK;YACvB;QACF;QAEA,OAAOjD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1BsC,OAAO1B,QAAQ2B,MAAM,CAAC,CAACC,SAAWA,OAAOtB,QAAQ,EAAEW,MAAM;YACzDjB;QACF;IACF,EAAE,OAAOxB,OAAO;QACda,QAAQb,KAAK,CAAC,kCAAkCA;QAChD,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IAC3E;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMqD,8BAAgD,OAC3D1D,KACAC;IAEA,IAAID,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,IAAI;YAKoCL;QAJtC,MAAMO,UAAU,MAAMpB,mBAAmBa;QACzC,IAAIO,QAAQC,EAAE,KAAK,OAAO;YACxB,OAAOP,IAAIE,MAAM,CAACI,QAAQJ,MAAM,EAAEC,IAAI,CAACG,QAAQE,IAAI;QACrD;QACA,MAAMkD,OAAOpE,0BAAyBS,YAAAA,IAAIS,IAAI,qBAART,UAAU2D,IAAI;QACpD,IAAIrE,uBAAuBqE,OAAO;YAChC;;;;;OAKC,GACD,OAAO1D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BwD,SAAS;gBACTC,WAAW;gBACXC,UAAU;gBACVC,OAAO;gBACP/C,QAAQ,EAAE;gBACVN,UAAU,EAAE;gBACZC,SAAS;gBACTC,iBAAiB;gBACjBC,SAAS;YACX;QACF;QACA,MAAMmD,OAAO,MAAMtE,6BAA6B;YAC9CoB,QAAQP,QAAQO,MAAM;YACtB6C;QACF;QACA;;;;;KAKC,GACD,MAAM3C,SAASgD,KAAKC,UAAU,CAC3BC,GAAG,CAAC,CAACC,YAAcA,UAAUnC,KAAK,EAClCwB,MAAM,CAACY;QACV,MAAMC,QAAQrD,OAAOsD,KAAK,CAAC,GAAGtF;QAC9B,MAAM4C,aAAa,MAAM1C,iBAAiB;YACxC4B,QAAQP,QAAQO,MAAM;YACtBC,QAAQsD;QACV;QACA,OAAOpE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1Ba,UAAUV,QAAQU,QAAQ;YAC1B2C,SAAS5C,OAAO8B,MAAM;YACtB;;;;;OAKC,GACDe,WAAW7C,OAAO8B,MAAM,GAAGuB,MAAMvB,MAAM;YACvCgB,UAAUE,KAAKF,QAAQ;YACvBC,OAAO;YACP/C,QAAQqD;YACR3D,UAAUkB,WAAWlB,QAAQ;YAC7BC,SAASiB,WAAWjB,OAAO;YAC3BC,iBAAiBgB,WAAWhB,eAAe;YAC3CC,SAASe,WAAWf,OAAO;QAC7B;IACF,EAAE,OAAOR,OAAO;QACda,QAAQb,KAAK,CAAC,oCAAoCA;QAClD,OAAOJ,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAwC;IAC3D;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASkE;IACd,oEAAoE;IACpE,2EAA2E;IAC3E,mEAAmE;IACnE,cAAc;IACd1F;IACA,2EAA2E;IAC3E,iCAAiC;IACjCgB,+BAA+B,IAAMD,cAAc4E,GAAG,GAAGC,SAAS;IAClEhF,uBAAuB,2BAA2BiE;IAClDjE,uBACE,8BACAM;IAEFN,uBAAuB,0BAA0B0B;IACjD,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,gEAAgE;IAChEpC;IACA,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,oBAAoB;IACpBD;AACF"}

package/src/lib/server-list-gate.d.ts

@@ -93,6 +93,13 @@ export type ListContext = {
  * release flag that has not reached this org, all 404 before a handler runs.
  */
 export declare function resolveListContext(req: Parameters<PluginApiHandler>[0]): Promise<ListContext>;
+/**
+ * Whether an org member may change who is on the organization's lists: an
+ * org-wide owner, admin or editor whose membership is not suspended. The one
+ * answer the list routes and the list-member import ask (see
+ * {@link resolveListContext} for why a site role is not enough).
+ */
+export declare function isOrgWideListWriter(member: unknown): boolean;
 /** What would happen to one address, and why. */
 export interface AddressVerdict {
     /** Exactly what the operator typed, so a bad line can be pointed at. */

package/src/lib/server-list-gate.js

@@ -141,9 +141,7 @@ import { refusalsOf, withRetainedRefusals } from "@aglyn/aglyn/app-utils/retaine
         };
     }
     const membership = await resolveOrgMembership(decoded.uid, orgId).catch(()=>null);
-    const member = membership == null ? void 0 : membership.member;
-    const orgWideWriter = isOrgWideMember(member) && ((member == null ? void 0 : member.role) === 'owner' || (member == null ? void 0 : member.role) === 'admin' || (member == null ? void 0 : member.role) === 'editor') && (member == null ? void 0 : member.orgSuspended) !== true;
-    if (!orgWideWriter) {
+    if (!isOrgWideListWriter(membership == null ? void 0 : membership.member)) {
         return {
             ok: false,
             status: 403,
@@ -174,6 +172,15 @@ import { refusalsOf, withRetainedRefusals } from "@aglyn/aglyn/app-utils/retaine
         listName: String((_listSnapshot_get = listSnapshot.get('name')) != null ? _listSnapshot_get : listId)
     };
 }
+/**
+ * Whether an org member may change who is on the organization's lists: an
+ * org-wide owner, admin or editor whose membership is not suspended. The one
+ * answer the list routes and the list-member import ask (see
+ * {@link resolveListContext} for why a site role is not enough).
+ */ export function isOrgWideListWriter(member) {
+    const entry = member;
+    return isOrgWideMember(entry) && ((entry == null ? void 0 : entry.role) === 'owner' || (entry == null ? void 0 : entry.role) === 'admin' || (entry == null ? void 0 : entry.role) === 'editor') && (entry == null ? void 0 : entry.orgSuspended) !== true;
+}
 /**
  * Every address, normalized, deduplicated and put through the policy.
  *