@aglyn/plugins-outreach 1.0.0-beta.143

package/src/lib/enrollment/enroll-people.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/enrollment/enroll-people.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * WHO CAN BE ENROLLED, AND WHAT THE REP STILL OWES (AGL-2980).\n *\n * The enroll dialog shows every person a view or a search named, each\n * marked eligible, blocked, or waiting on the rep; Confirm asks the same\n * question again, on the server, with what the rep supplied. Both answers\n * come from the engine's `evaluateOutreachGates` — this module only reads\n * the people and asks it the right questions.\n *\n * ## Three questions of one pure function\n *\n * The gates refuse a cold contact until the rep writes a personal line and\n * ticks the attestations, and refuse an address in an unknown country until\n * the rep confirms it is a US business address. So a preview asks:\n *\n *   1. as the person stands, with nothing confirmed — allowed means\n *      ELIGIBLE;\n *   2. as if the rep confirmed everything they can — refused means BLOCKED,\n *      for the reasons that remain, which no tick can clear;\n *   3. otherwise the person is WAITING ON THE REP, for what (1) found\n *      missing.\n *\n * The confirmation in (2) is hypothetical and never stored: Confirm stamps\n * only what the rep ticked, with their uid and the time, and asks again.\n *\n * ## One enrollment per person per sequence, ever\n *\n * The enrollment's id is the sequence and the contact\n * (`outreachEnrollmentId`), and it is written with `create()`. A person who\n * finished, replied or was stopped is not sent the same emails a second\n * time by being enrolled again, and two members confirming the same person\n * at once write one enrollment.\n *==========================================*/\n\nimport { normalizeContactEmail, contactDisplayName, readContactFacet } from '@aglyn/aglyn/app-utils/contacts'\nimport { visibleToHost } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport {\n  evaluateOutreachGates,\n  type OutreachGateBlock,\n  type OutreachGateLookups,\n} from '../engine/gates'\nimport { outreachAttestationsFrom } from '../engine/enrollment-state'\nimport {\n  OUTREACH_ATTESTATION_KINDS,\n  type OutreachAttestationKind,\n  type OutreachAttestations,\n  type OutreachSequenceSettings,\n} from '../model/outreach.types'\nimport type { OutreachEnrollBlock, OutreachEnrollPreviewPerson } from '../model/outreach-api'\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/** One person as the preview and the enroll read them. */\nexport interface OutreachEnrollCandidate {\n  contactId: string\n  /** The contact document, or `null` when it no longer exists. */\n  contact: Record<string, unknown> | null\n  /** Whether the sequence's site may see the contact. */\n  visible: boolean\n  /** The name the sequence's site knows them by; `''` for none. */\n  name: string\n  /** The primary address, normalized, or `null` when there is none. */\n  email: string | null\n  /** The company the contact is filed under at that site, when there is one. */\n  company: Record<string, unknown> | null\n}\n\n/** `getAll` takes this many references at most per call. */\nconst GET_ALL_CHUNK = 300\n\nasync function getAllChunked(\n  firestore: Firestore,\n  refs: readonly FirebaseFirestore.DocumentReference[],\n): Promise<FirebaseFirestore.DocumentSnapshot[]> {\n  const snapshots: FirebaseFirestore.DocumentSnapshot[] = []\n  for (let start = 0; start < refs.length; start += GET_ALL_CHUNK) {\n    snapshots.push(...(await firestore.getAll(...refs.slice(start, start + GET_ALL_CHUNK))))\n  }\n  return snapshots\n}\n\n/**\n * The contacts, as the sequence's site knows them, and the company each is\n * filed under there — two batched reads for everyone.\n */\nexport async function readOutreachEnrollCandidates(\n  firestore: Firestore,\n  input: { orgId: string; hostId: string; contactGroupId: string; contactIds: readonly string[] },\n): Promise<OutreachEnrollCandidate[]> {\n  if (!input.contactIds.length) return []\n  const org = firestore.collection('orgs').doc(input.orgId)\n  const snapshots = await getAllChunked(\n    firestore,\n    input.contactIds.map((id) => org.collection('contacts').doc(id)),\n  )\n  const read = input.contactIds.map((contactId, index) => {\n    const data = snapshots[index]?.exists ? (snapshots[index].data() as Record<string, unknown>) : null\n    return {\n      contactId,\n      contact: data,\n      visible: data ? visibleToHost(data['visibleTo'] as string[] | undefined, input.hostId) : false,\n      name: data ? contactDisplayName(data, input.contactGroupId).trim() : '',\n      email: data ? normalizeContactEmail(data['email']) : null,\n      companyId: data ? String(readContactFacet(data, input.contactGroupId).companyId ?? '') : '',\n    }\n  })\n  const companyIds = [...new Set(read.map((entry) => entry.companyId).filter(Boolean))]\n  const companies = new Map<string, Record<string, unknown>>()\n  if (companyIds.length) {\n    const found = await getAllChunked(\n      firestore,\n      companyIds.map((id) => org.collection('companies').doc(id)),\n    )\n    found.forEach((snapshot, index) => {\n      if (snapshot.exists) companies.set(companyIds[index], snapshot.data() as Record<string, unknown>)\n    })\n  }\n  return read.map(({ companyId, ...candidate }) => ({\n    ...candidate,\n    company: companyId ? (companies.get(companyId) ?? null) : null,\n  }))\n}\n\n/** What stands in the way before the gates are asked anything. */\nexport function outreachCandidateBlocks(\n  candidate: OutreachEnrollCandidate,\n  facts: { siteName: string; alreadyInSequence: boolean },\n): OutreachEnrollBlock[] {\n  if (!candidate.contact) {\n    return [{ code: 'contact_missing', reason: 'This contact no longer exists in the CRM.' }]\n  }\n  const blocks: OutreachEnrollBlock[] = []\n  if (!candidate.visible) {\n    blocks.push({\n      code: 'not_in_site',\n      reason: `This contact isn't in ${facts.siteName || \"this sequence's site\"}'s CRM.`,\n    })\n  }\n  if (!candidate.email) {\n    blocks.push({ code: 'no_email', reason: 'This contact has no email address.' })\n  }\n  if (facts.alreadyInSequence) {\n    blocks.push({\n      code: 'already_in_sequence',\n      reason: \"This person has already been in this sequence, so they won't be sent its emails again.\",\n    })\n  }\n  return blocks\n}\n\n/** Every attestation, stamped for a hypothetical question only — never stored. */\nconst EVERYTHING_CONFIRMED: OutreachAttestations = Object.fromEntries(\n  OUTREACH_ATTESTATION_KINDS.map((kind) => [kind, { uid: 'preview', atMs: 1 }]),\n)\n\nconst blocksOf = (blocks: readonly OutreachGateBlock[]): OutreachEnrollBlock[] =>\n  blocks.map(({ code, reason }) => ({ code, reason }))\n\nexport interface OutreachGateQuestion {\n  candidate: OutreachEnrollCandidate\n  lookups: OutreachGateLookups\n  /** The sequence's settings, its countries already capped by the organization's. */\n  settings: OutreachSequenceSettings\n  contactGroupId: string\n}\n\n/** Where one person stands before the rep confirms anything — see the module note. */\nexport function previewOutreachPerson(\n  question: OutreachGateQuestion,\n  facts: { siteName: string; alreadyInSequence: boolean },\n): OutreachEnrollPreviewPerson {\n  const { candidate } = question\n  const person = {\n    contactId: candidate.contactId,\n    name: candidate.name,\n    email: candidate.email,\n  }\n  const early = outreachCandidateBlocks(candidate, facts)\n  if (early.length) {\n    return {\n      ...person,\n      cold: false,\n      country: null,\n      status: 'blocked',\n      blocks: early,\n      requires: { personalLine: false, attestations: [] },\n    }\n  }\n  const ask = (personalLine: string, attestations: OutreachAttestations) =>\n    evaluateOutreachGates({\n      email: candidate.email ?? '',\n      contact: candidate.contact,\n      contactGroupId: question.contactGroupId,\n      company: candidate.company,\n      settings: question.settings,\n      personalLine,\n      attestations,\n      lookups: question.lookups,\n    })\n  const asIs = ask('', {})\n  const known = { cold: asIs.cold, country: asIs.country.country }\n  if (asIs.allowed) {\n    return {\n      ...person,\n      ...known,\n      status: 'eligible',\n      blocks: [],\n      requires: { personalLine: false, attestations: [] },\n    }\n  }\n  // The line is only checked for being present, so any sentence stands in.\n  const confirmed = ask('A personal line.', EVERYTHING_CONFIRMED)\n  if (!confirmed.allowed) {\n    return {\n      ...person,\n      ...known,\n      status: 'blocked',\n      blocks: blocksOf(confirmed.blocks),\n      requires: { personalLine: false, attestations: [] },\n    }\n  }\n  const attestations: OutreachAttestationKind[] = asIs.cold\n    ? [...asIs.missingAttestations]\n    : asIs.blocks.some((block) => block.code === 'country_unknown')\n      ? ['us_business_address']\n      : []\n  return {\n    ...person,\n    ...known,\n    status: 'needs_confirmation',\n    blocks: [],\n    requires: {\n      personalLine: asIs.blocks.some((block) => block.code === 'personal_line_missing'),\n      attestations,\n    },\n  }\n}\n\nexport interface OutreachEnrollDecision {\n  allowed: boolean\n  blocks: OutreachEnrollBlock[]\n  cold: boolean\n  /** The address as the gates normalized it. */\n  email: string | null\n  /** What the rep confirmed, stamped with who and when. */\n  attestations: OutreachAttestations\n}\n\n/** Confirm's answer for one person, with what the rep supplied — see the module note. */\nexport function decideOutreachEnrollment(\n  question: OutreachGateQuestion,\n  facts: { siteName: string; alreadyInSequence: boolean },\n  supplied: {\n    personalLine: string\n    attestations: readonly unknown[]\n    uid: string\n    nowMs: number\n  },\n): OutreachEnrollDecision {\n  const attestations = outreachAttestationsFrom(supplied.attestations, supplied.uid, supplied.nowMs)\n  const early = outreachCandidateBlocks(question.candidate, facts)\n  if (early.length) {\n    return { allowed: false, blocks: early, cold: false, email: question.candidate.email, attestations }\n  }\n  const result = evaluateOutreachGates({\n    email: question.candidate.email ?? '',\n    contact: question.candidate.contact,\n    contactGroupId: question.contactGroupId,\n    company: question.candidate.company,\n    settings: question.settings,\n    personalLine: supplied.personalLine,\n    attestations,\n    lookups: question.lookups,\n  })\n  return {\n    allowed: result.allowed,\n    blocks: blocksOf(result.blocks),\n    cold: result.cold,\n    email: result.email,\n    attestations,\n  }\n}\n"],"names":["normalizeContactEmail","contactDisplayName","readContactFacet","visibleToHost","evaluateOutreachGates","outreachAttestationsFrom","OUTREACH_ATTESTATION_KINDS","GET_ALL_CHUNK","getAllChunked","firestore","refs","snapshots","start","length","push","getAll","slice","readOutreachEnrollCandidates","input","contactIds","org","collection","doc","orgId","map","id","read","contactId","index","data","exists","contact","visible","hostId","name","contactGroupId","trim","email","companyId","String","companyIds","Set","entry","filter","Boolean","companies","Map","found","forEach","snapshot","set","candidate","company","get","outreachCandidateBlocks","facts","code","reason","blocks","siteName","alreadyInSequence","EVERYTHING_CONFIRMED","Object","fromEntries","kind","uid","atMs","blocksOf","previewOutreachPerson","question","person","early","cold","country","status","requires","personalLine","attestations","ask","settings","lookups","asIs","known","allowed","confirmed","missingAttestations","some","block","decideOutreachEnrollment","supplied","nowMs","result"],"mappings":";;AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAgC4C,GAE5C,SAASA,qBAAqB,EAAEC,kBAAkB,EAAEC,gBAAgB,QAAQ,kCAAiC;AAC7G,SAASC,aAAa,QAAQ,sCAAqC;AACnE,SACEC,qBAAqB,QAGhB,qBAAiB;AACxB,SAASC,wBAAwB,QAAQ,gCAA4B;AACrE,SACEC,0BAA0B,QAIrB,6BAAyB;AAoBhC,0DAA0D,GAC1D,MAAMC,gBAAgB;AAEtB,eAAeC,cACbC,SAAoB,EACpBC,IAAoD;IAEpD,MAAMC,YAAkD,EAAE;IAC1D,IAAK,IAAIC,QAAQ,GAAGA,QAAQF,KAAKG,MAAM,EAAED,SAASL,cAAe;QAC/DI,UAAUG,IAAI,IAAK,MAAML,UAAUM,MAAM,IAAIL,KAAKM,KAAK,CAACJ,OAAOA,QAAQL;IACzE;IACA,OAAOI;AACT;AAEA;;;CAGC,GACD,OAAO,eAAeM,6BACpBR,SAAoB,EACpBS,KAA+F;IAE/F,IAAI,CAACA,MAAMC,UAAU,CAACN,MAAM,EAAE,OAAO,EAAE;IACvC,MAAMO,MAAMX,UAAUY,UAAU,CAAC,QAAQC,GAAG,CAACJ,MAAMK,KAAK;IACxD,MAAMZ,YAAY,MAAMH,cACtBC,WACAS,MAAMC,UAAU,CAACK,GAAG,CAAC,CAACC,KAAOL,IAAIC,UAAU,CAAC,YAAYC,GAAG,CAACG;IAE9D,MAAMC,OAAOR,MAAMC,UAAU,CAACK,GAAG,CAAC,CAACG,WAAWC;YAQjB1B;YAPdS;QAAb,MAAMkB,OAAOlB,EAAAA,mBAAAA,SAAS,CAACiB,MAAM,qBAAhBjB,iBAAkBmB,MAAM,IAAInB,SAAS,CAACiB,MAAM,CAACC,IAAI,KAAiC;QAC/F,OAAO;YACLF;YACAI,SAASF;YACTG,SAASH,OAAO1B,cAAc0B,IAAI,CAAC,YAAY,EAA0BX,MAAMe,MAAM,IAAI;YACzFC,MAAML,OAAO5B,mBAAmB4B,MAAMX,MAAMiB,cAAc,EAAEC,IAAI,KAAK;YACrEC,OAAOR,OAAO7B,sBAAsB6B,IAAI,CAAC,QAAQ,IAAI;YACrDS,WAAWT,OAAOU,QAAOrC,8BAAAA,iBAAiB2B,MAAMX,MAAMiB,cAAc,EAAEG,SAAS,YAAtDpC,8BAA0D,MAAM;QAC3F;IACF;IACA,MAAMsC,aAAa;WAAI,IAAIC,IAAIf,KAAKF,GAAG,CAAC,CAACkB,QAAUA,MAAMJ,SAAS,EAAEK,MAAM,CAACC;KAAU;IACrF,MAAMC,YAAY,IAAIC;IACtB,IAAIN,WAAW3B,MAAM,EAAE;QACrB,MAAMkC,QAAQ,MAAMvC,cAClBC,WACA+B,WAAWhB,GAAG,CAAC,CAACC,KAAOL,IAAIC,UAAU,CAAC,aAAaC,GAAG,CAACG;QAEzDsB,MAAMC,OAAO,CAAC,CAACC,UAAUrB;YACvB,IAAIqB,SAASnB,MAAM,EAAEe,UAAUK,GAAG,CAACV,UAAU,CAACZ,MAAM,EAAEqB,SAASpB,IAAI;QACrE;IACF;IACA,OAAOH,KAAKF,GAAG,CAAC;YAAC,EAAEc,SAAS,EAAgB,OAAXa;;;YAETN;eAF0B,aAC7CM;YACHC,SAASd,aAAaO,iBAAAA,UAAUQ,GAAG,CAACf,sBAAdO,iBAA4B,OAAQ;;;AAE9D;AAEA,gEAAgE,GAChE,OAAO,SAASS,wBACdH,SAAkC,EAClCI,KAAuD;IAEvD,IAAI,CAACJ,UAAUpB,OAAO,EAAE;QACtB,OAAO;YAAC;gBAAEyB,MAAM;gBAAmBC,QAAQ;YAA4C;SAAE;IAC3F;IACA,MAAMC,SAAgC,EAAE;IACxC,IAAI,CAACP,UAAUnB,OAAO,EAAE;QACtB0B,OAAO5C,IAAI,CAAC;YACV0C,MAAM;YACNC,QAAQ,CAAC,sBAAsB,EAAEF,MAAMI,QAAQ,IAAI,uBAAuB,OAAO,CAAC;QACpF;IACF;IACA,IAAI,CAACR,UAAUd,KAAK,EAAE;QACpBqB,OAAO5C,IAAI,CAAC;YAAE0C,MAAM;YAAYC,QAAQ;QAAqC;IAC/E;IACA,IAAIF,MAAMK,iBAAiB,EAAE;QAC3BF,OAAO5C,IAAI,CAAC;YACV0C,MAAM;YACNC,QAAQ;QACV;IACF;IACA,OAAOC;AACT;AAEA,gFAAgF,GAChF,MAAMG,uBAA6CC,OAAOC,WAAW,CACnEzD,2BAA2BkB,GAAG,CAAC,CAACwC,OAAS;QAACA;QAAM;YAAEC,KAAK;YAAWC,MAAM;QAAE;KAAE;AAG9E,MAAMC,WAAW,CAACT,SAChBA,OAAOlC,GAAG,CAAC,CAAC,EAAEgC,IAAI,EAAEC,MAAM,EAAE,GAAM,CAAA;YAAED;YAAMC;QAAO,CAAA;AAUnD,oFAAoF,GACpF,OAAO,SAASW,sBACdC,QAA8B,EAC9Bd,KAAuD;IAEvD,MAAM,EAAEJ,SAAS,EAAE,GAAGkB;IACtB,MAAMC,SAAS;QACb3C,WAAWwB,UAAUxB,SAAS;QAC9BO,MAAMiB,UAAUjB,IAAI;QACpBG,OAAOc,UAAUd,KAAK;IACxB;IACA,MAAMkC,QAAQjB,wBAAwBH,WAAWI;IACjD,IAAIgB,MAAM1D,MAAM,EAAE;QAChB,OAAO,aACFyD;YACHE,MAAM;YACNC,SAAS;YACTC,QAAQ;YACRhB,QAAQa;YACRI,UAAU;gBAAEC,cAAc;gBAAOC,cAAc,EAAE;YAAC;;IAEtD;IACA,MAAMC,MAAM,CAACF,cAAsBC;YAExB1B;eADT/C,sBAAsB;YACpBiC,KAAK,GAAEc,mBAAAA,UAAUd,KAAK,YAAfc,mBAAmB;YAC1BpB,SAASoB,UAAUpB,OAAO;YAC1BI,gBAAgBkC,SAASlC,cAAc;YACvCiB,SAASD,UAAUC,OAAO;YAC1B2B,UAAUV,SAASU,QAAQ;YAC3BH;YACAC;YACAG,SAASX,SAASW,OAAO;QAC3B;;IACF,MAAMC,OAAOH,IAAI,IAAI,CAAC;IACtB,MAAMI,QAAQ;QAAEV,MAAMS,KAAKT,IAAI;QAAEC,SAASQ,KAAKR,OAAO,CAACA,OAAO;IAAC;IAC/D,IAAIQ,KAAKE,OAAO,EAAE;QAChB,OAAO,aACFb,QACAY;YACHR,QAAQ;YACRhB,QAAQ,EAAE;YACViB,UAAU;gBAAEC,cAAc;gBAAOC,cAAc,EAAE;YAAC;;IAEtD;IACA,yEAAyE;IACzE,MAAMO,YAAYN,IAAI,oBAAoBjB;IAC1C,IAAI,CAACuB,UAAUD,OAAO,EAAE;QACtB,OAAO,aACFb,QACAY;YACHR,QAAQ;YACRhB,QAAQS,SAASiB,UAAU1B,MAAM;YACjCiB,UAAU;gBAAEC,cAAc;gBAAOC,cAAc,EAAE;YAAC;;IAEtD;IACA,MAAMA,eAA0CI,KAAKT,IAAI,GACrD;WAAIS,KAAKI,mBAAmB;KAAC,GAC7BJ,KAAKvB,MAAM,CAAC4B,IAAI,CAAC,CAACC,QAAUA,MAAM/B,IAAI,KAAK,qBACzC;QAAC;KAAsB,GACvB,EAAE;IACR,OAAO,aACFc,QACAY;QACHR,QAAQ;QACRhB,QAAQ,EAAE;QACViB,UAAU;YACRC,cAAcK,KAAKvB,MAAM,CAAC4B,IAAI,CAAC,CAACC,QAAUA,MAAM/B,IAAI,KAAK;YACzDqB;QACF;;AAEJ;AAYA,uFAAuF,GACvF,OAAO,SAASW,yBACdnB,QAA8B,EAC9Bd,KAAuD,EACvDkC,QAKC;QAQQpB;IANT,MAAMQ,eAAexE,yBAAyBoF,SAASZ,YAAY,EAAEY,SAASxB,GAAG,EAAEwB,SAASC,KAAK;IACjG,MAAMnB,QAAQjB,wBAAwBe,SAASlB,SAAS,EAAEI;IAC1D,IAAIgB,MAAM1D,MAAM,EAAE;QAChB,OAAO;YAAEsE,SAAS;YAAOzB,QAAQa;YAAOC,MAAM;YAAOnC,OAAOgC,SAASlB,SAAS,CAACd,KAAK;YAAEwC;QAAa;IACrG;IACA,MAAMc,SAASvF,sBAAsB;QACnCiC,KAAK,GAAEgC,4BAAAA,SAASlB,SAAS,CAACd,KAAK,YAAxBgC,4BAA4B;QACnCtC,SAASsC,SAASlB,SAAS,CAACpB,OAAO;QACnCI,gBAAgBkC,SAASlC,cAAc;QACvCiB,SAASiB,SAASlB,SAAS,CAACC,OAAO;QACnC2B,UAAUV,SAASU,QAAQ;QAC3BH,cAAca,SAASb,YAAY;QACnCC;QACAG,SAASX,SAASW,OAAO;IAC3B;IACA,OAAO;QACLG,SAASQ,OAAOR,OAAO;QACvBzB,QAAQS,SAASwB,OAAOjC,MAAM;QAC9Bc,MAAMmB,OAAOnB,IAAI;QACjBnC,OAAOsD,OAAOtD,KAAK;QACnBwC;IACF;AACF"}

package/src/lib/enrollment/gate-lookups.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { OutreachGateLookups } from '../engine/gates';
+/** One person to look up: the contact, and the address the steps go to. */
+export interface OutreachGateLookupPerson {
+    contactId: string;
+    email: string;
+}
+export interface ReadOutreachGateLookupsInput {
+    orgId: string;
+    /** The sequence's site: whose suppression list and topic opt-outs apply. */
+    hostId: string;
+    people: readonly OutreachGateLookupPerson[];
+}
+type Firestore = FirebaseFirestore.Firestore;
+/** Every lookup the gates take, for each person, keyed by contact id. */
+export declare function readOutreachGateLookups(firestore: Firestore, input: ReadOutreachGateLookupsInput): Promise<Map<string, OutreachGateLookups>>;
+export {};

package/src/lib/enrollment/gate-lookups.js

@@ -0,0 +1,154 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE LOOKUPS THE ENROLLMENT GATES DECIDE ON (AGL-2980).
+ *
+ * `evaluateOutreachGates` is pure: it reads a contact as stored and the
+ * RESULTS of the reads the runtime makes. This is those reads, for many
+ * people at once — the enroll preview asks about everyone a view names in
+ * one pass, and the sending runtime asks about one person before each send
+ * with the same function, so the two can never consult different lists.
+ *
+ * Server only. Every list keyed by address is read with one `getAll` over
+ * `personKey` ids — the suppression lists, the sales topic opt-outs, the
+ * do-not-contact list — so a lookup costs one round trip however many
+ * people it covers, and needs no index that could go missing. The roster
+ * is read once. The two per-person facts that are queries — the person's
+ * other enrollments and whether they ever wrote in — are equality filters
+ * on single fields.
+ *
+ * ## A read that failed is `null`, and `null` refuses
+ *
+ * Each lookup is caught on its own and answers `null` for everyone it
+ * covered, which the gates read as "we couldn't check" and refuse: a
+ * person who asked not to be emailed must not be emailed because a read
+ * timed out. One failed list does not blank the others.
+ */ import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
+import { EMAIL_TOPIC_SALES, readTopicSubscriptionState, TOPIC_OPT_OUTS_SUBCOLLECTION } from "@aglyn/aglyn/app-utils/email-topics";
+import { personKey } from "@aglyn/aglyn/app-utils/person-key";
+import { loadCrmInboundRoster } from "@aglyn/tenant-data-admin/server/crm-inbound-email";
+import { EMAIL_SUPPRESSIONS_COLLECTION, HOST_SUPPRESSIONS_SUBCOLLECTION } from "@aglyn/tenant-data-admin/server/email-suppression";
+import { lookupOutreachDoNotContact } from "../storage/do-not-contact-store.js";
+import { outreachOrgCollection } from "../storage/outreach-records.js";
+/** `getAll` takes this many references at most per call. */ const GET_ALL_CHUNK = 300;
+async function getAllChunked(firestore, refs) {
+    const snapshots = [];
+    for(let start = 0; start < refs.length; start += GET_ALL_CHUNK){
+        snapshots.push(...await firestore.getAll(...refs.slice(start, start + GET_ALL_CHUNK)));
+    }
+    return snapshots;
+}
+/**
+ * One keyed list, read for every person at once: `answer` turns each
+ * person's document into their answer. An address that cannot be keyed has
+ * no document anywhere and is answered as unchecked, and so is everyone
+ * when the read fails.
+ */ async function keyedLookup(firestore, people, collection, answer, label) {
+    const answers = new Map();
+    const keyed = [];
+    for (const person of people){
+        const key = personKey(person.email);
+        if (key) keyed.push({
+            contactId: person.contactId,
+            key
+        });
+        else answers.set(person.contactId, null);
+    }
+    if (!keyed.length) return answers;
+    try {
+        const snapshots = await getAllChunked(firestore, keyed.map((entry)=>collection(entry.key)));
+        keyed.forEach((entry, index)=>answers.set(entry.contactId, answer(snapshots[index])));
+    } catch (error) {
+        console.error(`[outreach] ${label} lookup failed; reading as unchecked`, error);
+        for (const entry of keyed)answers.set(entry.contactId, null);
+    }
+    return answers;
+}
+/** Every lookup the gates take, for each person, keyed by contact id. */ export async function readOutreachGateLookups(firestore, input) {
+    const { orgId, hostId, people } = input;
+    const host = firestore.collection('hosts').doc(hostId);
+    const enrollments = outreachOrgCollection(firestore, orgId, 'enrollments');
+    const activities = firestore.collection('orgs').doc(orgId).collection(CRM_COLLECTIONS.activities);
+    const [platform, site, sales, doNotContact, roster, perPerson] = await Promise.all([
+        keyedLookup(firestore, people, (key)=>firestore.collection(EMAIL_SUPPRESSIONS_COLLECTION).doc(key), // A released record no longer suppresses.
+        (snapshot)=>snapshot.exists && !snapshot.get('releasedAt'), 'platform suppression'),
+        keyedLookup(firestore, people, (key)=>host.collection(HOST_SUPPRESSIONS_SUBCOLLECTION).doc(key), (snapshot)=>snapshot.exists, 'site suppression'),
+        keyedLookup(firestore, people, (key)=>host.collection(TOPIC_OPT_OUTS_SUBCOLLECTION).doc(key), (snapshot)=>{
+            var _ref;
+            return readTopicSubscriptionState(((_ref = snapshot.exists ? snapshot.get('topics') : null) != null ? _ref : {})[EMAIL_TOPIC_SALES]);
+        }, 'sales topic'),
+        lookupOutreachDoNotContact(firestore, orgId, people.map((person)=>person.email)),
+        loadCrmInboundRoster(firestore, orgId).catch((error)=>{
+            console.error('[outreach] roster lookup failed; reading as unchecked', error);
+            return null;
+        }),
+        Promise.all(people.map(async (person)=>{
+            const open = await Promise.all([
+                enrollments.where('contactId', '==', person.contactId).get(),
+                enrollments.where('email', '==', person.email).get()
+            ]).then(([byContact, byEmail])=>{
+                const found = new Map();
+                for (const doc of [
+                    ...byContact.docs,
+                    ...byEmail.docs
+                ]){
+                    var _doc_get;
+                    found.set(doc.id, {
+                        id: doc.id,
+                        sequenceId: String((_doc_get = doc.get('sequenceId')) != null ? _doc_get : ''),
+                        status: doc.get('status')
+                    });
+                }
+                return [
+                    ...found.values()
+                ];
+            }).catch((error)=>{
+                console.error('[outreach] enrollment lookup failed; reading as unchecked', error);
+                return null;
+            });
+            const inbound = await activities.where('contactId', '==', person.contactId).where('direction', '==', 'inbound').limit(1).get().then((snapshot)=>!snapshot.empty).catch((error)=>{
+                console.error('[outreach] inbound email lookup failed; reading as cold', error);
+                return null;
+            });
+            return {
+                contactId: person.contactId,
+                open,
+                inbound
+            };
+        }))
+    ]);
+    const byPerson = new Map(perPerson.map((entry)=>[
+            entry.contactId,
+            entry
+        ]));
+    const lookups = new Map();
+    for (const person of people){
+        var _platform_get, _site_get, _sales_get, _doNotContact_get, _ref, _ref1;
+        const own = byPerson.get(person.contactId);
+        lookups.set(person.contactId, {
+            platformSuppressed: (_platform_get = platform.get(person.contactId)) != null ? _platform_get : null,
+            hostSuppressed: (_site_get = site.get(person.contactId)) != null ? _site_get : null,
+            salesTopicState: (_sales_get = sales.get(person.contactId)) != null ? _sales_get : null,
+            doNotContact: (_doNotContact_get = doNotContact.get(person.email)) != null ? _doNotContact_get : null,
+            workspaceMembers: roster,
+            openEnrollments: (_ref = own == null ? void 0 : own.open) != null ? _ref : null,
+            hasInboundEmail: (_ref1 = own == null ? void 0 : own.inbound) != null ? _ref1 : null
+        });
+    }
+    return lookups;
+}
+
+//# sourceMappingURL=gate-lookups.js.map

package/src/lib/enrollment/gate-lookups.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/enrollment/gate-lookups.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE LOOKUPS THE ENROLLMENT GATES DECIDE ON (AGL-2980).\n *\n * `evaluateOutreachGates` is pure: it reads a contact as stored and the\n * RESULTS of the reads the runtime makes. This is those reads, for many\n * people at once — the enroll preview asks about everyone a view names in\n * one pass, and the sending runtime asks about one person before each send\n * with the same function, so the two can never consult different lists.\n *\n * Server only. Every list keyed by address is read with one `getAll` over\n * `personKey` ids — the suppression lists, the sales topic opt-outs, the\n * do-not-contact list — so a lookup costs one round trip however many\n * people it covers, and needs no index that could go missing. The roster\n * is read once. The two per-person facts that are queries — the person's\n * other enrollments and whether they ever wrote in — are equality filters\n * on single fields.\n *\n * ## A read that failed is `null`, and `null` refuses\n *\n * Each lookup is caught on its own and answers `null` for everyone it\n * covered, which the gates read as \"we couldn't check\" and refuse: a\n * person who asked not to be emailed must not be emailed because a read\n * timed out. One failed list does not blank the others.\n */\n\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport {\n  EMAIL_TOPIC_SALES,\n  readTopicSubscriptionState,\n  TOPIC_OPT_OUTS_SUBCOLLECTION,\n  type TopicSubscriptionState,\n} from '@aglyn/aglyn/app-utils/email-topics'\nimport type { MemberAddresses } from '@aglyn/aglyn/app-utils/member-email-aliases'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport { loadCrmInboundRoster } from '@aglyn/tenant-data-admin/server/crm-inbound-email'\nimport {\n  EMAIL_SUPPRESSIONS_COLLECTION,\n  HOST_SUPPRESSIONS_SUBCOLLECTION,\n} from '@aglyn/tenant-data-admin/server/email-suppression'\nimport type { OutreachGateLookups } from '../engine/gates'\nimport type { OutreachEnrollmentStatus } from '../model/outreach.types'\nimport { lookupOutreachDoNotContact } from '../storage/do-not-contact-store'\nimport { outreachOrgCollection } from '../storage/outreach-records'\n\n/** One person to look up: the contact, and the address the steps go to. */\nexport interface OutreachGateLookupPerson {\n  contactId: string\n  email: string\n}\n\nexport interface ReadOutreachGateLookupsInput {\n  orgId: string\n  /** The sequence's site: whose suppression list and topic opt-outs apply. */\n  hostId: string\n  people: readonly OutreachGateLookupPerson[]\n}\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/** `getAll` takes this many references at most per call. */\nconst GET_ALL_CHUNK = 300\n\nasync function getAllChunked(\n  firestore: Firestore,\n  refs: readonly FirebaseFirestore.DocumentReference[],\n): Promise<FirebaseFirestore.DocumentSnapshot[]> {\n  const snapshots: FirebaseFirestore.DocumentSnapshot[] = []\n  for (let start = 0; start < refs.length; start += GET_ALL_CHUNK) {\n    snapshots.push(...(await firestore.getAll(...refs.slice(start, start + GET_ALL_CHUNK))))\n  }\n  return snapshots\n}\n\n/**\n * One keyed list, read for every person at once: `answer` turns each\n * person's document into their answer. An address that cannot be keyed has\n * no document anywhere and is answered as unchecked, and so is everyone\n * when the read fails.\n */\nasync function keyedLookup<T>(\n  firestore: Firestore,\n  people: readonly OutreachGateLookupPerson[],\n  collection: (key: string) => FirebaseFirestore.DocumentReference,\n  answer: (snapshot: FirebaseFirestore.DocumentSnapshot) => T,\n  label: string,\n): Promise<Map<string, T | null>> {\n  const answers = new Map<string, T | null>()\n  const keyed: Array<{ contactId: string; key: string }> = []\n  for (const person of people) {\n    const key = personKey(person.email)\n    if (key) keyed.push({ contactId: person.contactId, key })\n    else answers.set(person.contactId, null)\n  }\n  if (!keyed.length) return answers\n  try {\n    const snapshots = await getAllChunked(\n      firestore,\n      keyed.map((entry) => collection(entry.key)),\n    )\n    keyed.forEach((entry, index) => answers.set(entry.contactId, answer(snapshots[index])))\n  } catch (error) {\n    console.error(`[outreach] ${label} lookup failed; reading as unchecked`, error)\n    for (const entry of keyed) answers.set(entry.contactId, null)\n  }\n  return answers\n}\n\n/** Every lookup the gates take, for each person, keyed by contact id. */\nexport async function readOutreachGateLookups(\n  firestore: Firestore,\n  input: ReadOutreachGateLookupsInput,\n): Promise<Map<string, OutreachGateLookups>> {\n  const { orgId, hostId, people } = input\n  const host = firestore.collection('hosts').doc(hostId)\n  const enrollments = outreachOrgCollection(firestore, orgId, 'enrollments')\n  const activities = firestore.collection('orgs').doc(orgId).collection(CRM_COLLECTIONS.activities)\n\n  const [platform, site, sales, doNotContact, roster, perPerson] = await Promise.all([\n    keyedLookup(\n      firestore,\n      people,\n      (key) => firestore.collection(EMAIL_SUPPRESSIONS_COLLECTION).doc(key),\n      // A released record no longer suppresses.\n      (snapshot) => snapshot.exists && !snapshot.get('releasedAt'),\n      'platform suppression',\n    ),\n    keyedLookup(\n      firestore,\n      people,\n      (key) => host.collection(HOST_SUPPRESSIONS_SUBCOLLECTION).doc(key),\n      (snapshot) => snapshot.exists,\n      'site suppression',\n    ),\n    keyedLookup<TopicSubscriptionState>(\n      firestore,\n      people,\n      (key) => host.collection(TOPIC_OPT_OUTS_SUBCOLLECTION).doc(key),\n      (snapshot) =>\n        readTopicSubscriptionState(\n          ((snapshot.exists ? snapshot.get('topics') : null) ?? {})[EMAIL_TOPIC_SALES],\n        ),\n      'sales topic',\n    ),\n    lookupOutreachDoNotContact(\n      firestore,\n      orgId,\n      people.map((person) => person.email),\n    ),\n    loadCrmInboundRoster(firestore, orgId).catch((error: unknown): MemberAddresses[] | null => {\n      console.error('[outreach] roster lookup failed; reading as unchecked', error)\n      return null\n    }),\n    Promise.all(\n      people.map(async (person) => {\n        const open = await Promise.all([\n          enrollments.where('contactId', '==', person.contactId).get(),\n          enrollments.where('email', '==', person.email).get(),\n        ])\n          .then(([byContact, byEmail]) => {\n            const found = new Map<string, { id: string; sequenceId: string; status: OutreachEnrollmentStatus }>()\n            for (const doc of [...byContact.docs, ...byEmail.docs]) {\n              found.set(doc.id, {\n                id: doc.id,\n                sequenceId: String(doc.get('sequenceId') ?? ''),\n                status: doc.get('status') as OutreachEnrollmentStatus,\n              })\n            }\n            return [...found.values()]\n          })\n          .catch((error: unknown) => {\n            console.error('[outreach] enrollment lookup failed; reading as unchecked', error)\n            return null\n          })\n        const inbound = await activities\n          .where('contactId', '==', person.contactId)\n          .where('direction', '==', 'inbound')\n          .limit(1)\n          .get()\n          .then((snapshot) => !snapshot.empty)\n          .catch((error: unknown) => {\n            console.error('[outreach] inbound email lookup failed; reading as cold', error)\n            return null\n          })\n        return { contactId: person.contactId, open, inbound }\n      }),\n    ),\n  ])\n\n  const byPerson = new Map(perPerson.map((entry) => [entry.contactId, entry]))\n  const lookups = new Map<string, OutreachGateLookups>()\n  for (const person of people) {\n    const own = byPerson.get(person.contactId)\n    lookups.set(person.contactId, {\n      platformSuppressed: platform.get(person.contactId) ?? null,\n      hostSuppressed: site.get(person.contactId) ?? null,\n      salesTopicState: sales.get(person.contactId) ?? null,\n      doNotContact: doNotContact.get(person.email) ?? null,\n      workspaceMembers: roster,\n      openEnrollments: own?.open ?? null,\n      hasInboundEmail: own?.inbound ?? null,\n    })\n  }\n  return lookups\n}\n"],"names":["CRM_COLLECTIONS","EMAIL_TOPIC_SALES","readTopicSubscriptionState","TOPIC_OPT_OUTS_SUBCOLLECTION","personKey","loadCrmInboundRoster","EMAIL_SUPPRESSIONS_COLLECTION","HOST_SUPPRESSIONS_SUBCOLLECTION","lookupOutreachDoNotContact","outreachOrgCollection","GET_ALL_CHUNK","getAllChunked","firestore","refs","snapshots","start","length","push","getAll","slice","keyedLookup","people","collection","answer","label","answers","Map","keyed","person","key","email","contactId","set","map","entry","forEach","index","error","console","readOutreachGateLookups","input","orgId","hostId","host","doc","enrollments","activities","platform","site","sales","doNotContact","roster","perPerson","Promise","all","snapshot","exists","get","catch","open","where","then","byContact","byEmail","found","docs","id","sequenceId","String","status","values","inbound","limit","empty","byPerson","lookups","own","platformSuppressed","hostSuppressed","salesTopicState","workspaceMembers","openEnrollments","hasInboundEmail"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,SAASA,eAAe,QAAQ,6BAA4B;AAC5D,SACEC,iBAAiB,EACjBC,0BAA0B,EAC1BC,4BAA4B,QAEvB,sCAAqC;AAE5C,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SAASC,oBAAoB,QAAQ,oDAAmD;AACxF,SACEC,6BAA6B,EAC7BC,+BAA+B,QAC1B,oDAAmD;AAG1D,SAASC,0BAA0B,QAAQ,qCAAiC;AAC5E,SAASC,qBAAqB,QAAQ,iCAA6B;AAiBnE,0DAA0D,GAC1D,MAAMC,gBAAgB;AAEtB,eAAeC,cACbC,SAAoB,EACpBC,IAAoD;IAEpD,MAAMC,YAAkD,EAAE;IAC1D,IAAK,IAAIC,QAAQ,GAAGA,QAAQF,KAAKG,MAAM,EAAED,SAASL,cAAe;QAC/DI,UAAUG,IAAI,IAAK,MAAML,UAAUM,MAAM,IAAIL,KAAKM,KAAK,CAACJ,OAAOA,QAAQL;IACzE;IACA,OAAOI;AACT;AAEA;;;;;CAKC,GACD,eAAeM,YACbR,SAAoB,EACpBS,MAA2C,EAC3CC,UAAgE,EAChEC,MAA2D,EAC3DC,KAAa;IAEb,MAAMC,UAAU,IAAIC;IACpB,MAAMC,QAAmD,EAAE;IAC3D,KAAK,MAAMC,UAAUP,OAAQ;QAC3B,MAAMQ,MAAMzB,UAAUwB,OAAOE,KAAK;QAClC,IAAID,KAAKF,MAAMV,IAAI,CAAC;YAAEc,WAAWH,OAAOG,SAAS;YAAEF;QAAI;aAClDJ,QAAQO,GAAG,CAACJ,OAAOG,SAAS,EAAE;IACrC;IACA,IAAI,CAACJ,MAAMX,MAAM,EAAE,OAAOS;IAC1B,IAAI;QACF,MAAMX,YAAY,MAAMH,cACtBC,WACAe,MAAMM,GAAG,CAAC,CAACC,QAAUZ,WAAWY,MAAML,GAAG;QAE3CF,MAAMQ,OAAO,CAAC,CAACD,OAAOE,QAAUX,QAAQO,GAAG,CAACE,MAAMH,SAAS,EAAER,OAAOT,SAAS,CAACsB,MAAM;IACtF,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,CAAC,WAAW,EAAEb,MAAM,oCAAoC,CAAC,EAAEa;QACzE,KAAK,MAAMH,SAASP,MAAOF,QAAQO,GAAG,CAACE,MAAMH,SAAS,EAAE;IAC1D;IACA,OAAON;AACT;AAEA,uEAAuE,GACvE,OAAO,eAAec,wBACpB3B,SAAoB,EACpB4B,KAAmC;IAEnC,MAAM,EAAEC,KAAK,EAAEC,MAAM,EAAErB,MAAM,EAAE,GAAGmB;IAClC,MAAMG,OAAO/B,UAAUU,UAAU,CAAC,SAASsB,GAAG,CAACF;IAC/C,MAAMG,cAAcpC,sBAAsBG,WAAW6B,OAAO;IAC5D,MAAMK,aAAalC,UAAUU,UAAU,CAAC,QAAQsB,GAAG,CAACH,OAAOnB,UAAU,CAACtB,gBAAgB8C,UAAU;IAEhG,MAAM,CAACC,UAAUC,MAAMC,OAAOC,cAAcC,QAAQC,UAAU,GAAG,MAAMC,QAAQC,GAAG,CAAC;QACjFlC,YACER,WACAS,QACA,CAACQ,MAAQjB,UAAUU,UAAU,CAAChB,+BAA+BsC,GAAG,CAACf,MACjE,0CAA0C;QAC1C,CAAC0B,WAAaA,SAASC,MAAM,IAAI,CAACD,SAASE,GAAG,CAAC,eAC/C;QAEFrC,YACER,WACAS,QACA,CAACQ,MAAQc,KAAKrB,UAAU,CAACf,iCAAiCqC,GAAG,CAACf,MAC9D,CAAC0B,WAAaA,SAASC,MAAM,EAC7B;QAEFpC,YACER,WACAS,QACA,CAACQ,MAAQc,KAAKrB,UAAU,CAACnB,8BAA8ByC,GAAG,CAACf,MAC3D,CAAC0B;gBAEKA;mBADJrD,2BACE,EAAEqD,OAAAA,SAASC,MAAM,GAAGD,SAASE,GAAG,CAAC,YAAY,gBAA3CF,OAAoD,CAAC,EAAE,CAACtD,kBAAkB;WAEhF;QAEFO,2BACEI,WACA6B,OACApB,OAAOY,GAAG,CAAC,CAACL,SAAWA,OAAOE,KAAK;QAErCzB,qBAAqBO,WAAW6B,OAAOiB,KAAK,CAAC,CAACrB;YAC5CC,QAAQD,KAAK,CAAC,yDAAyDA;YACvE,OAAO;QACT;QACAgB,QAAQC,GAAG,CACTjC,OAAOY,GAAG,CAAC,OAAOL;YAChB,MAAM+B,OAAO,MAAMN,QAAQC,GAAG,CAAC;gBAC7BT,YAAYe,KAAK,CAAC,aAAa,MAAMhC,OAAOG,SAAS,EAAE0B,GAAG;gBAC1DZ,YAAYe,KAAK,CAAC,SAAS,MAAMhC,OAAOE,KAAK,EAAE2B,GAAG;aACnD,EACEI,IAAI,CAAC,CAAC,CAACC,WAAWC,QAAQ;gBACzB,MAAMC,QAAQ,IAAItC;gBAClB,KAAK,MAAMkB,OAAO;uBAAIkB,UAAUG,IAAI;uBAAKF,QAAQE,IAAI;iBAAC,CAAE;wBAGjCrB;oBAFrBoB,MAAMhC,GAAG,CAACY,IAAIsB,EAAE,EAAE;wBAChBA,IAAItB,IAAIsB,EAAE;wBACVC,YAAYC,QAAOxB,WAAAA,IAAIa,GAAG,CAAC,yBAARb,WAAyB;wBAC5CyB,QAAQzB,IAAIa,GAAG,CAAC;oBAClB;gBACF;gBACA,OAAO;uBAAIO,MAAMM,MAAM;iBAAG;YAC5B,GACCZ,KAAK,CAAC,CAACrB;gBACNC,QAAQD,KAAK,CAAC,6DAA6DA;gBAC3E,OAAO;YACT;YACF,MAAMkC,UAAU,MAAMzB,WACnBc,KAAK,CAAC,aAAa,MAAMhC,OAAOG,SAAS,EACzC6B,KAAK,CAAC,aAAa,MAAM,WACzBY,KAAK,CAAC,GACNf,GAAG,GACHI,IAAI,CAAC,CAACN,WAAa,CAACA,SAASkB,KAAK,EAClCf,KAAK,CAAC,CAACrB;gBACNC,QAAQD,KAAK,CAAC,2DAA2DA;gBACzE,OAAO;YACT;YACF,OAAO;gBAAEN,WAAWH,OAAOG,SAAS;gBAAE4B;gBAAMY;YAAQ;QACtD;KAEH;IAED,MAAMG,WAAW,IAAIhD,IAAI0B,UAAUnB,GAAG,CAAC,CAACC,QAAU;YAACA,MAAMH,SAAS;YAAEG;SAAM;IAC1E,MAAMyC,UAAU,IAAIjD;IACpB,KAAK,MAAME,UAAUP,OAAQ;YAGL0B,eACJC,WACCC,YACHC;QALhB,MAAM0B,MAAMF,SAASjB,GAAG,CAAC7B,OAAOG,SAAS;QACzC4C,QAAQ3C,GAAG,CAACJ,OAAOG,SAAS,EAAE;YAC5B8C,kBAAkB,GAAE9B,gBAAAA,SAASU,GAAG,CAAC7B,OAAOG,SAAS,aAA7BgB,gBAAkC;YACtD+B,cAAc,GAAE9B,YAAAA,KAAKS,GAAG,CAAC7B,OAAOG,SAAS,aAAzBiB,YAA8B;YAC9C+B,eAAe,GAAE9B,aAAAA,MAAMQ,GAAG,CAAC7B,OAAOG,SAAS,aAA1BkB,aAA+B;YAChDC,YAAY,GAAEA,oBAAAA,aAAaO,GAAG,CAAC7B,OAAOE,KAAK,aAA7BoB,oBAAkC;YAChD8B,kBAAkB7B;YAClB8B,eAAe,UAAEL,uBAAAA,IAAKjB,IAAI,mBAAI;YAC9BuB,eAAe,WAAEN,uBAAAA,IAAKL,OAAO,oBAAI;QACnC;IACF;IACA,OAAOI;AACT"}

package/src/lib/mailboxes/mailbox-api.d.ts

@@ -0,0 +1,126 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { OutreachMailbox, OutreachSendWindow } from '../model/outreach.types';
+/**
+ * THE MAILBOX ROUTES' CONTRACT (AGL-2978): what the Mailboxes panel sends,
+ * what the routes answer, and the fragment a connect comes back through.
+ * Client-safe — types, constants and two string functions.
+ */
+/** Every reason a mailbox route refuses with, for a caller to branch on. */
+export type OutreachApiRefusalReason = 'unauthenticated' | 'email-unverified' | 'org-required' | 'not-a-member' | 'not-org-wide' | 'permission' | 'entitlement' | 'not-configured' | 'method-not-allowed' | 'invalid-request' | 'mailbox-not-found' | 'not-your-mailbox' | 'mailbox-limit' | 'state-invalid' | 'state-expired' | 'state-user-mismatch' | 'state-org-mismatch' | 'state-replayed' | 'state-superseded' | 'code-rejected' | 'refresh-token-missing' | 'scopes-missing' | 'identity-unverified' | 'account-mismatch' | 'reconnect-required' | 'invalid-settings' | 'rate-limited' | 'google-unavailable';
+export interface OutreachApiRefusal {
+    error: string;
+    reason: OutreachApiRefusalReason;
+}
+/** `GET outreach/mailboxes/availability` */
+export interface OutreachMailboxAvailability {
+    configured: boolean;
+    /**
+     * Whether the viewer is an organization owner or admin, who may change,
+     * pause and disconnect any member's mailbox. The routes decide this on
+     * every call; the panel reads it to offer only what will be allowed.
+     */
+    canManageAll: boolean;
+}
+/** `POST outreach/mailboxes/connect` */
+export interface OutreachConnectRequest {
+    orgId: string;
+}
+export interface OutreachConnectResponse {
+    /** Google's consent address; the browser goes there. */
+    url: string;
+}
+/** `POST outreach/mailboxes/connect/complete` */
+export interface OutreachConnectCompleteRequest {
+    orgId: string;
+    code: string;
+    state: string;
+    /** The browser's IANA timezone, for a new mailbox's sending window. */
+    timezone?: string;
+}
+export interface OutreachConnectCompleteResponse {
+    ok: true;
+    mailbox: OutreachMailbox;
+    /** False when an existing mailbox for the account was reconnected. */
+    created: boolean;
+    /** Pending addresses of the member's that Gmail's send-as list confirmed. */
+    confirmedAliases: string[];
+}
+/** `POST outreach/mailboxes/settings` — every field but the ids is optional. */
+export interface OutreachMailboxSettingsRequest {
+    orgId: string;
+    mailboxId: string;
+    sendAs?: string;
+    displayName?: string;
+    dailyCap?: number;
+    window?: OutreachSendWindow;
+    timezone?: string;
+}
+/** `POST outreach/mailboxes/status` */
+export interface OutreachMailboxStatusRequest {
+    orgId: string;
+    mailboxId: string;
+    paused: boolean;
+}
+export interface OutreachMailboxResponse {
+    ok: true;
+    mailbox: OutreachMailbox;
+}
+/** `POST outreach/mailboxes/test` */
+export interface OutreachMailboxTestResponse {
+    ok: true;
+    /** The account's own address the test went to. */
+    sentTo: string;
+    gmailMessageId: string;
+    sentAtMs: number;
+}
+/** `POST outreach/mailboxes/disconnect` */
+export interface OutreachMailboxDisconnectResponse {
+    ok: true;
+    /**
+     * What became of the grant at Google: `revoked`, `already-invalid`,
+     * `kept-for-other-mailbox` when another mailbox still uses the account,
+     * or `failed` when Google could not be told — the stored grant is deleted
+     * either way.
+     */
+    revocation: 'revoked' | 'already-invalid' | 'kept-for-other-mailbox' | 'failed';
+}
+/**
+ * The fragment key a connect returns through (AGL-2978).
+ *
+ * Google redirects to the callback route with the authorization code in the
+ * query; the callback moves it into the FRAGMENT of the Mailboxes page, which
+ * no server receives — not in a request line, not in a `Referer` — and the
+ * page takes it out of the address bar before it finishes the connect with
+ * the member's own session. The cross-domain session handoff uses the
+ * fragment for the same reason.
+ */
+export declare const OUTREACH_CONNECT_FRAGMENT_KEY = "outreachConnect";
+/** Why a connect came back without a code. */
+export type OutreachConnectReturnError = 'access_denied' | 'expired' | 'google_error';
+export type OutreachConnectReturn = {
+    kind: 'code';
+    code: string;
+    state: string;
+} | {
+    kind: 'error';
+    reason: OutreachConnectReturnError;
+};
+/** The fragment for a connect's return, without the leading `#`. */
+export declare function buildConnectReturnFragment(value: OutreachConnectReturn): string;
+/** A connect's return read off a location hash, or `null` when it carries none. */
+export declare function parseConnectReturnFragment(hash: string | null | undefined): OutreachConnectReturn | null;

package/src/lib/mailboxes/mailbox-api.js

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The fragment key a connect returns through (AGL-2978).
+ *
+ * Google redirects to the callback route with the authorization code in the
+ * query; the callback moves it into the FRAGMENT of the Mailboxes page, which
+ * no server receives — not in a request line, not in a `Referer` — and the
+ * page takes it out of the address bar before it finishes the connect with
+ * the member's own session. The cross-domain session handoff uses the
+ * fragment for the same reason.
+ */ export const OUTREACH_CONNECT_FRAGMENT_KEY = 'outreachConnect';
+/** The fragment for a connect's return, without the leading `#`. */ export function buildConnectReturnFragment(value) {
+    const params = new URLSearchParams();
+    if (value.kind === 'code') {
+        params.set(OUTREACH_CONNECT_FRAGMENT_KEY, 'code');
+        params.set('code', value.code);
+        params.set('state', value.state);
+    } else {
+        params.set(OUTREACH_CONNECT_FRAGMENT_KEY, 'error');
+        params.set('reason', value.reason);
+    }
+    return params.toString();
+}
+const RETURN_ERRORS = [
+    'access_denied',
+    'expired',
+    'google_error'
+];
+/** A connect's return read off a location hash, or `null` when it carries none. */ export function parseConnectReturnFragment(hash) {
+    const params = new URLSearchParams(String(hash != null ? hash : '').replace(/^#/, ''));
+    const kind = params.get(OUTREACH_CONNECT_FRAGMENT_KEY);
+    if (kind === 'code') {
+        var _params_get, _params_get1;
+        const code = (_params_get = params.get('code')) != null ? _params_get : '';
+        const state = (_params_get1 = params.get('state')) != null ? _params_get1 : '';
+        return code && state ? {
+            kind: 'code',
+            code,
+            state
+        } : null;
+    }
+    if (kind === 'error') {
+        const reason = params.get('reason');
+        return {
+            kind: 'error',
+            reason: reason && RETURN_ERRORS.includes(reason) ? reason : 'google_error'
+        };
+    }
+    return null;
+}
+
+//# sourceMappingURL=mailbox-api.js.map

package/src/lib/mailboxes/mailbox-api.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/mailbox-api.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { OutreachMailbox, OutreachSendWindow } from '../model/outreach.types'\n\n/**\n * THE MAILBOX ROUTES' CONTRACT (AGL-2978): what the Mailboxes panel sends,\n * what the routes answer, and the fragment a connect comes back through.\n * Client-safe — types, constants and two string functions.\n */\n\n/** Every reason a mailbox route refuses with, for a caller to branch on. */\nexport type OutreachApiRefusalReason =\n  | 'unauthenticated'\n  | 'email-unverified'\n  | 'org-required'\n  | 'not-a-member'\n  | 'not-org-wide'\n  | 'permission'\n  | 'entitlement'\n  | 'not-configured'\n  | 'method-not-allowed'\n  | 'invalid-request'\n  | 'mailbox-not-found'\n  | 'not-your-mailbox'\n  | 'mailbox-limit'\n  | 'state-invalid'\n  | 'state-expired'\n  | 'state-user-mismatch'\n  | 'state-org-mismatch'\n  | 'state-replayed'\n  | 'state-superseded'\n  | 'code-rejected'\n  | 'refresh-token-missing'\n  | 'scopes-missing'\n  | 'identity-unverified'\n  | 'account-mismatch'\n  | 'reconnect-required'\n  | 'invalid-settings'\n  | 'rate-limited'\n  | 'google-unavailable'\n\nexport interface OutreachApiRefusal {\n  error: string\n  reason: OutreachApiRefusalReason\n}\n\n/** `GET outreach/mailboxes/availability` */\nexport interface OutreachMailboxAvailability {\n  configured: boolean\n  /**\n   * Whether the viewer is an organization owner or admin, who may change,\n   * pause and disconnect any member's mailbox. The routes decide this on\n   * every call; the panel reads it to offer only what will be allowed.\n   */\n  canManageAll: boolean\n}\n\n/** `POST outreach/mailboxes/connect` */\nexport interface OutreachConnectRequest {\n  orgId: string\n}\nexport interface OutreachConnectResponse {\n  /** Google's consent address; the browser goes there. */\n  url: string\n}\n\n/** `POST outreach/mailboxes/connect/complete` */\nexport interface OutreachConnectCompleteRequest {\n  orgId: string\n  code: string\n  state: string\n  /** The browser's IANA timezone, for a new mailbox's sending window. */\n  timezone?: string\n}\nexport interface OutreachConnectCompleteResponse {\n  ok: true\n  mailbox: OutreachMailbox\n  /** False when an existing mailbox for the account was reconnected. */\n  created: boolean\n  /** Pending addresses of the member's that Gmail's send-as list confirmed. */\n  confirmedAliases: string[]\n}\n\n/** `POST outreach/mailboxes/settings` — every field but the ids is optional. */\nexport interface OutreachMailboxSettingsRequest {\n  orgId: string\n  mailboxId: string\n  sendAs?: string\n  displayName?: string\n  dailyCap?: number\n  window?: OutreachSendWindow\n  timezone?: string\n}\n\n/** `POST outreach/mailboxes/status` */\nexport interface OutreachMailboxStatusRequest {\n  orgId: string\n  mailboxId: string\n  paused: boolean\n}\n\nexport interface OutreachMailboxResponse {\n  ok: true\n  mailbox: OutreachMailbox\n}\n\n/** `POST outreach/mailboxes/test` */\nexport interface OutreachMailboxTestResponse {\n  ok: true\n  /** The account's own address the test went to. */\n  sentTo: string\n  gmailMessageId: string\n  sentAtMs: number\n}\n\n/** `POST outreach/mailboxes/disconnect` */\nexport interface OutreachMailboxDisconnectResponse {\n  ok: true\n  /**\n   * What became of the grant at Google: `revoked`, `already-invalid`,\n   * `kept-for-other-mailbox` when another mailbox still uses the account,\n   * or `failed` when Google could not be told — the stored grant is deleted\n   * either way.\n   */\n  revocation: 'revoked' | 'already-invalid' | 'kept-for-other-mailbox' | 'failed'\n}\n\n/**\n * The fragment key a connect returns through (AGL-2978).\n *\n * Google redirects to the callback route with the authorization code in the\n * query; the callback moves it into the FRAGMENT of the Mailboxes page, which\n * no server receives — not in a request line, not in a `Referer` — and the\n * page takes it out of the address bar before it finishes the connect with\n * the member's own session. The cross-domain session handoff uses the\n * fragment for the same reason.\n */\nexport const OUTREACH_CONNECT_FRAGMENT_KEY = 'outreachConnect'\n\n/** Why a connect came back without a code. */\nexport type OutreachConnectReturnError = 'access_denied' | 'expired' | 'google_error'\n\nexport type OutreachConnectReturn =\n  | { kind: 'code'; code: string; state: string }\n  | { kind: 'error'; reason: OutreachConnectReturnError }\n\n/** The fragment for a connect's return, without the leading `#`. */\nexport function buildConnectReturnFragment(value: OutreachConnectReturn): string {\n  const params = new URLSearchParams()\n  if (value.kind === 'code') {\n    params.set(OUTREACH_CONNECT_FRAGMENT_KEY, 'code')\n    params.set('code', value.code)\n    params.set('state', value.state)\n  } else {\n    params.set(OUTREACH_CONNECT_FRAGMENT_KEY, 'error')\n    params.set('reason', value.reason)\n  }\n  return params.toString()\n}\n\nconst RETURN_ERRORS: readonly OutreachConnectReturnError[] = ['access_denied', 'expired', 'google_error']\n\n/** A connect's return read off a location hash, or `null` when it carries none. */\nexport function parseConnectReturnFragment(hash: string | null | undefined): OutreachConnectReturn | null {\n  const params = new URLSearchParams(String(hash ?? '').replace(/^#/, ''))\n  const kind = params.get(OUTREACH_CONNECT_FRAGMENT_KEY)\n  if (kind === 'code') {\n    const code = params.get('code') ?? ''\n    const state = params.get('state') ?? ''\n    return code && state ? { kind: 'code', code, state } : null\n  }\n  if (kind === 'error') {\n    const reason = params.get('reason') as OutreachConnectReturnError | null\n    return { kind: 'error', reason: reason && RETURN_ERRORS.includes(reason) ? reason : 'google_error' }\n  }\n  return null\n}\n"],"names":["OUTREACH_CONNECT_FRAGMENT_KEY","buildConnectReturnFragment","value","params","URLSearchParams","kind","set","code","state","reason","toString","RETURN_ERRORS","parseConnectReturnFragment","hash","String","replace","get","includes"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GA+HD;;;;;;;;;CASC,GACD,OAAO,MAAMA,gCAAgC,kBAAiB;AAS9D,kEAAkE,GAClE,OAAO,SAASC,2BAA2BC,KAA4B;IACrE,MAAMC,SAAS,IAAIC;IACnB,IAAIF,MAAMG,IAAI,KAAK,QAAQ;QACzBF,OAAOG,GAAG,CAACN,+BAA+B;QAC1CG,OAAOG,GAAG,CAAC,QAAQJ,MAAMK,IAAI;QAC7BJ,OAAOG,GAAG,CAAC,SAASJ,MAAMM,KAAK;IACjC,OAAO;QACLL,OAAOG,GAAG,CAACN,+BAA+B;QAC1CG,OAAOG,GAAG,CAAC,UAAUJ,MAAMO,MAAM;IACnC;IACA,OAAON,OAAOO,QAAQ;AACxB;AAEA,MAAMC,gBAAuD;IAAC;IAAiB;IAAW;CAAe;AAEzG,iFAAiF,GACjF,OAAO,SAASC,2BAA2BC,IAA+B;IACxE,MAAMV,SAAS,IAAIC,gBAAgBU,OAAOD,eAAAA,OAAQ,IAAIE,OAAO,CAAC,MAAM;IACpE,MAAMV,OAAOF,OAAOa,GAAG,CAAChB;IACxB,IAAIK,SAAS,QAAQ;YACNF,aACCA;QADd,MAAMI,QAAOJ,cAAAA,OAAOa,GAAG,CAAC,mBAAXb,cAAsB;QACnC,MAAMK,SAAQL,eAAAA,OAAOa,GAAG,CAAC,oBAAXb,eAAuB;QACrC,OAAOI,QAAQC,QAAQ;YAAEH,MAAM;YAAQE;YAAMC;QAAM,IAAI;IACzD;IACA,IAAIH,SAAS,SAAS;QACpB,MAAMI,SAASN,OAAOa,GAAG,CAAC;QAC1B,OAAO;YAAEX,MAAM;YAASI,QAAQA,UAAUE,cAAcM,QAAQ,CAACR,UAAUA,SAAS;QAAe;IACrG;IACA,OAAO;AACT"}

package/src/lib/mailboxes/mailbox-credentials.d.ts

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type SecretBoxKeyring } from '@aglyn/shared-util-tools/secret-box';
+import { type OutreachMailboxCredentials } from '../model/outreach.types';
+/**
+ * A MAILBOX'S GRANT AT REST (AGL-2978): `outreachMailboxCredentials/{mailboxId}`.
+ *
+ * The refresh token is the only secret, and it is stored only sealed —
+ * AES-256-GCM under `OUTREACH_TOKEN_KEY` through the shared secret box, bound
+ * to this document by the seal's context, so a sealed token copied into
+ * another mailbox's credential refuses to open there. Every other field is
+ * bookkeeping a reader needs without the key: which account, which scopes,
+ * which member, which key sealed it.
+ *
+ * Sealed fields carry `token` in their names. The personal-data export
+ * redacts by field name first, and a neutral name would be judged by its
+ * value's shape alone.
+ */
+/** A connected Google mailbox's stored credential. */
+export interface OutreachGoogleMailboxCredentials extends OutreachMailboxCredentials {
+    provider: 'google';
+    /** The member who connected the mailbox. */
+    connectedByUid: string;
+    /** Google's stable account id (`sub`), so one account's grants can be found. */
+    providerAccountId: string;
+    /** The account's address, as Google verified it. */
+    email: string;
+    /** The scopes Google granted, as it listed them. */
+    scopes: string[];
+    /** The refresh token, sealed — see the module comment. */
+    sealedRefreshToken: string;
+    /** The id of the key that sealed it, for rotation. */
+    tokenKeyId: string;
+}
+/** The context a mailbox's refresh token is sealed under. */
+export declare function refreshTokenSealContext(mailboxId: string): string;
+/** Seals a refresh token for one mailbox under the keyring's current key. */
+export declare function sealMailboxRefreshToken(refreshToken: string, mailboxId: string, keyring: SecretBoxKeyring): {
+    sealedRefreshToken: string;
+    tokenKeyId: string;
+};
+/**
+ * Opens a stored credential's refresh token. Throws `SecretBoxError` when it
+ * cannot be opened — a missing or rotated-away key, or a tampered value.
+ */
+export declare function openMailboxRefreshToken(credential: Pick<OutreachGoogleMailboxCredentials, 'mailboxId' | 'sealedRefreshToken'>, keyring: SecretBoxKeyring): {
+    refreshToken: string;
+    needsReseal: boolean;
+};
+/**
+ * The id a member's mailbox for one Google account has in one organization.
+ *
+ * Derived rather than random, so connecting the same account again updates
+ * the same mailbox instead of adding a second one, and two members — or two
+ * organizations — connecting one account never share an id. The credential
+ * collection is top-level, keyed by this id, so it must be unique across
+ * every organization, which is why the org is part of it.
+ */
+export declare function outreachMailboxId(orgId: string, uid: string, providerAccountId: string): string;
+export declare function mailboxCredentialsRef(firestore: FirebaseFirestore.Firestore, mailboxId: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
+export declare function mailboxRef(firestore: FirebaseFirestore.Firestore, orgId: string, mailboxId: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
+/** A stored credential read defensively, or `null` when it is not one. */
+export declare function readMailboxCredentials(data: unknown): OutreachGoogleMailboxCredentials | null;
+/**
+ * How many OTHER stored credentials hold a grant for the same Google account.
+ *
+ * Google's revocation ends the whole grant this client holds for an account,
+ * not one token, so revoking while another mailbox still uses the account —
+ * the same shared inbox connected by two members, or one account connected
+ * in two organizations — would silently break that mailbox. A disconnect or
+ * an erasure asks this first and leaves the grant alone while it is shared.
+ *
+ * An erasure names what it is ending anyway — a whole organization's
+ * credentials, or every one of a person's — and those are not counted.
+ */
+export declare function countOtherCredentialsForAccount(firestore: FirebaseFirestore.Firestore, input: {
+    providerAccountId: string;
+    mailboxId: string;
+    excludeOrgId?: string;
+    excludeMailboxIds?: ReadonlySet<string>;
+}): Promise<number>;