@aglyn/plugins-outreach 1.0.0-beta.143

package/src/lib/mailboxes/outreach-config.d.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type SecretBoxKeyring } from '@aglyn/shared-util-tools/secret-box';
+/**
+ * THE ONE MODULE THAT READS OUTREACH'S CREDENTIALS FROM THE ENVIRONMENT
+ * (AGL-2978).
+ *
+ * - `GOOGLE_OUTREACH_CLIENT_ID` and `GOOGLE_OUTREACH_CLIENT_SECRET` — the
+ *   OAuth client a rep's Google account grants mailbox access to.
+ * - `OUTREACH_TOKEN_KEY` — 32 random bytes, base64, sealing every stored
+ *   refresh token. A comma-separated list rotates: the first key seals, the
+ *   rest only open, and a token opened under an older key is sealed again
+ *   under the first.
+ *
+ * ## Console-only, structurally
+ *
+ * The client secret and the token key together are the power to send as
+ * every connected rep, so neither may be reachable from the tenant runtime,
+ * which serves the public internet. They are read here and nowhere else; this
+ * module is imported only by Outreach's server half and its console-only
+ * declarations; and those are loaded only by the console's server manifests.
+ * `outreach-credential-isolation.spec.ts`, beside this plugin's other specs,
+ * holds all three facts, the way `sending-domain-credential-isolation.spec.ts`
+ * holds the Resend domains key's.
+ *
+ * Read in the bracket form, so Next never inlines a value into a build.
+ */
+/** The env vars, named once for the refusal that lists what is missing. */
+export declare const OUTREACH_ENV: {
+    readonly clientId: "GOOGLE_OUTREACH_CLIENT_ID";
+    readonly clientSecret: "GOOGLE_OUTREACH_CLIENT_SECRET";
+    readonly tokenKey: "OUTREACH_TOKEN_KEY";
+};
+export interface OutreachGoogleConfig {
+    clientId: string;
+    clientSecret: string;
+    keyring: SecretBoxKeyring;
+}
+export type OutreachGoogleConfigResult = {
+    configured: true;
+    config: OutreachGoogleConfig;
+} | {
+    configured: false;
+    /** The env var names that are unset or unusable — never their values. */
+    missing: string[];
+};
+/** The sentence every route and the panel use for an unconfigured deployment. */
+export declare const OUTREACH_NOT_CONFIGURED_MESSAGE = "Connecting a Google mailbox is not configured on this deployment.";
+/** Reads the three variables. Never throws; an unusable key counts as missing. */
+export declare function readOutreachGoogleConfig(): OutreachGoogleConfigResult;

package/src/lib/mailboxes/outreach-config.js

@@ -0,0 +1,77 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { parseSecretBoxKeyring } from "@aglyn/shared-util-tools/secret-box";
+/**
+ * THE ONE MODULE THAT READS OUTREACH'S CREDENTIALS FROM THE ENVIRONMENT
+ * (AGL-2978).
+ *
+ * - `GOOGLE_OUTREACH_CLIENT_ID` and `GOOGLE_OUTREACH_CLIENT_SECRET` — the
+ *   OAuth client a rep's Google account grants mailbox access to.
+ * - `OUTREACH_TOKEN_KEY` — 32 random bytes, base64, sealing every stored
+ *   refresh token. A comma-separated list rotates: the first key seals, the
+ *   rest only open, and a token opened under an older key is sealed again
+ *   under the first.
+ *
+ * ## Console-only, structurally
+ *
+ * The client secret and the token key together are the power to send as
+ * every connected rep, so neither may be reachable from the tenant runtime,
+ * which serves the public internet. They are read here and nowhere else; this
+ * module is imported only by Outreach's server half and its console-only
+ * declarations; and those are loaded only by the console's server manifests.
+ * `outreach-credential-isolation.spec.ts`, beside this plugin's other specs,
+ * holds all three facts, the way `sending-domain-credential-isolation.spec.ts`
+ * holds the Resend domains key's.
+ *
+ * Read in the bracket form, so Next never inlines a value into a build.
+ */ /** The env vars, named once for the refusal that lists what is missing. */ export const OUTREACH_ENV = {
+    clientId: 'GOOGLE_OUTREACH_CLIENT_ID',
+    clientSecret: 'GOOGLE_OUTREACH_CLIENT_SECRET',
+    tokenKey: 'OUTREACH_TOKEN_KEY'
+};
+/** The sentence every route and the panel use for an unconfigured deployment. */ export const OUTREACH_NOT_CONFIGURED_MESSAGE = 'Connecting a Google mailbox is not configured on this deployment.';
+/** Reads the three variables. Never throws; an unusable key counts as missing. */ export function readOutreachGoogleConfig() {
+    var _process_env_GOOGLE_OUTREACH_CLIENT_ID, _process_env_GOOGLE_OUTREACH_CLIENT_SECRET, _process_env_OUTREACH_TOKEN_KEY;
+    const clientId = String((_process_env_GOOGLE_OUTREACH_CLIENT_ID = process.env['GOOGLE_OUTREACH_CLIENT_ID']) != null ? _process_env_GOOGLE_OUTREACH_CLIENT_ID : '').trim();
+    const clientSecret = String((_process_env_GOOGLE_OUTREACH_CLIENT_SECRET = process.env['GOOGLE_OUTREACH_CLIENT_SECRET']) != null ? _process_env_GOOGLE_OUTREACH_CLIENT_SECRET : '').trim();
+    const tokenKey = String((_process_env_OUTREACH_TOKEN_KEY = process.env['OUTREACH_TOKEN_KEY']) != null ? _process_env_OUTREACH_TOKEN_KEY : '').trim();
+    const missing = [];
+    if (!clientId) missing.push(OUTREACH_ENV.clientId);
+    if (!clientSecret) missing.push(OUTREACH_ENV.clientSecret);
+    let keyring = null;
+    if (tokenKey) {
+        try {
+            keyring = parseSecretBoxKeyring(tokenKey);
+        } catch (unused) {
+            keyring = null;
+        }
+    }
+    if (!keyring) missing.push(OUTREACH_ENV.tokenKey);
+    if (missing.length || !keyring) return {
+        configured: false,
+        missing
+    };
+    return {
+        configured: true,
+        config: {
+            clientId,
+            clientSecret,
+            keyring
+        }
+    };
+}
+
+//# sourceMappingURL=outreach-config.js.map

package/src/lib/mailboxes/outreach-config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/outreach-config.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  parseSecretBoxKeyring,\n  type SecretBoxKeyring,\n} from '@aglyn/shared-util-tools/secret-box'\n\n/**\n * THE ONE MODULE THAT READS OUTREACH'S CREDENTIALS FROM THE ENVIRONMENT\n * (AGL-2978).\n *\n * - `GOOGLE_OUTREACH_CLIENT_ID` and `GOOGLE_OUTREACH_CLIENT_SECRET` — the\n *   OAuth client a rep's Google account grants mailbox access to.\n * - `OUTREACH_TOKEN_KEY` — 32 random bytes, base64, sealing every stored\n *   refresh token. A comma-separated list rotates: the first key seals, the\n *   rest only open, and a token opened under an older key is sealed again\n *   under the first.\n *\n * ## Console-only, structurally\n *\n * The client secret and the token key together are the power to send as\n * every connected rep, so neither may be reachable from the tenant runtime,\n * which serves the public internet. They are read here and nowhere else; this\n * module is imported only by Outreach's server half and its console-only\n * declarations; and those are loaded only by the console's server manifests.\n * `outreach-credential-isolation.spec.ts`, beside this plugin's other specs,\n * holds all three facts, the way `sending-domain-credential-isolation.spec.ts`\n * holds the Resend domains key's.\n *\n * Read in the bracket form, so Next never inlines a value into a build.\n */\n\n/** The env vars, named once for the refusal that lists what is missing. */\nexport const OUTREACH_ENV = {\n  clientId: 'GOOGLE_OUTREACH_CLIENT_ID',\n  clientSecret: 'GOOGLE_OUTREACH_CLIENT_SECRET',\n  tokenKey: 'OUTREACH_TOKEN_KEY',\n} as const\n\nexport interface OutreachGoogleConfig {\n  clientId: string\n  clientSecret: string\n  keyring: SecretBoxKeyring\n}\n\nexport type OutreachGoogleConfigResult =\n  | { configured: true; config: OutreachGoogleConfig }\n  | {\n      configured: false\n      /** The env var names that are unset or unusable — never their values. */\n      missing: string[]\n    }\n\n/** The sentence every route and the panel use for an unconfigured deployment. */\nexport const OUTREACH_NOT_CONFIGURED_MESSAGE =\n  'Connecting a Google mailbox is not configured on this deployment.'\n\n/** Reads the three variables. Never throws; an unusable key counts as missing. */\nexport function readOutreachGoogleConfig(): OutreachGoogleConfigResult {\n  const clientId = String(process.env['GOOGLE_OUTREACH_CLIENT_ID'] ?? '').trim()\n  const clientSecret = String(process.env['GOOGLE_OUTREACH_CLIENT_SECRET'] ?? '').trim()\n  const tokenKey = String(process.env['OUTREACH_TOKEN_KEY'] ?? '').trim()\n\n  const missing: string[] = []\n  if (!clientId) missing.push(OUTREACH_ENV.clientId)\n  if (!clientSecret) missing.push(OUTREACH_ENV.clientSecret)\n  let keyring: SecretBoxKeyring | null = null\n  if (tokenKey) {\n    try {\n      keyring = parseSecretBoxKeyring(tokenKey)\n    } catch {\n      keyring = null\n    }\n  }\n  if (!keyring) missing.push(OUTREACH_ENV.tokenKey)\n\n  if (missing.length || !keyring) return { configured: false, missing }\n  return { configured: true, config: { clientId, clientSecret, keyring } }\n}\n"],"names":["parseSecretBoxKeyring","OUTREACH_ENV","clientId","clientSecret","tokenKey","OUTREACH_NOT_CONFIGURED_MESSAGE","readOutreachGoogleConfig","process","String","env","trim","missing","push","keyring","length","configured","config"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,qBAAqB,QAEhB,sCAAqC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,yEAAyE,GACzE,OAAO,MAAMC,eAAe;IAC1BC,UAAU;IACVC,cAAc;IACdC,UAAU;AACZ,EAAU;AAgBV,+EAA+E,GAC/E,OAAO,MAAMC,kCACX,oEAAmE;AAErE,gFAAgF,GAChF,OAAO,SAASC;QACUC,wCACIA,4CACJA;IAFxB,MAAML,WAAWM,QAAOD,yCAAAA,QAAQE,GAAG,CAAC,4BAA4B,YAAxCF,yCAA4C,IAAIG,IAAI;IAC5E,MAAMP,eAAeK,QAAOD,6CAAAA,QAAQE,GAAG,CAAC,gCAAgC,YAA5CF,6CAAgD,IAAIG,IAAI;IACpF,MAAMN,WAAWI,QAAOD,kCAAAA,QAAQE,GAAG,CAAC,qBAAqB,YAAjCF,kCAAqC,IAAIG,IAAI;IAErE,MAAMC,UAAoB,EAAE;IAC5B,IAAI,CAACT,UAAUS,QAAQC,IAAI,CAACX,aAAaC,QAAQ;IACjD,IAAI,CAACC,cAAcQ,QAAQC,IAAI,CAACX,aAAaE,YAAY;IACzD,IAAIU,UAAmC;IACvC,IAAIT,UAAU;QACZ,IAAI;YACFS,UAAUb,sBAAsBI;QAClC,EAAE,eAAM;YACNS,UAAU;QACZ;IACF;IACA,IAAI,CAACA,SAASF,QAAQC,IAAI,CAACX,aAAaG,QAAQ;IAEhD,IAAIO,QAAQG,MAAM,IAAI,CAACD,SAAS,OAAO;QAAEE,YAAY;QAAOJ;IAAQ;IACpE,OAAO;QAAEI,YAAY;QAAMC,QAAQ;YAAEd;YAAUC;YAAcU;QAAQ;IAAE;AACzE"}

package/src/lib/mailboxes/register-mailbox-routes.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiRequestSubject } from '@aglyn/aglyn/server';
+import { type OutreachMailboxRouteDeps } from './mailbox-routes';
+/**
+ * Wires the mailbox routes into the console dispatcher (AGL-2978), with the
+ * production dependencies and each route's release subject.
+ */
+/**
+ * The platform's own dependencies. Specs build their own.
+ *
+ * The permission resolver, the lockdown verdict, the rate limiter, the
+ * activity log and the alias store are imported when a request first needs
+ * them rather than when the bundle registers: `org-permissions` reaches the
+ * whole tenant data barrel, and the manifest loads this bundle into every
+ * console API process whether or not a mailbox route is ever called.
+ */
+export declare function defaultOutreachMailboxRouteDeps(): OutreachMailboxRouteDeps;
+/**
+ * The org an authenticated mailbox request names — query or JSON body — for
+ * the release gate. Unverified, exactly as a `hostId` is: the gate only
+ * chooses which organization's rollout to read, and the route's own gate
+ * refuses anyone who is not a member of it.
+ */
+export declare function outreachOrgSubject(request: Request): Promise<PluginApiRequestSubject | null>;
+/**
+ * The org AND member Google's redirect is for, read off the signed state.
+ * Only a state whose signature verifies names anyone; an expired one still
+ * does, so the rep who took too long lands on a page that says so rather than
+ * on a 404.
+ */
+export declare function outreachOAuthCallbackSubject(request: Request): PluginApiRequestSubject | null;
+export declare function registerOutreachMailboxRoutes(deps?: OutreachMailboxRouteDeps): void;

package/src/lib/mailboxes/register-mailbox-routes.js

@@ -0,0 +1,135 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginApiRoute } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { tokenSigningSecret } from "@aglyn/tenant-data-admin/server/media-signing";
+import { OUTREACH_API_ROUTES } from "../constants/api-routes.js";
+import { readOrgId } from "./mailbox-gate.js";
+import { createOutreachMailboxRoutes } from "./mailbox-routes.js";
+import { readOutreachOAuthState } from "./oauth-state.js";
+import { outreachOAuthRedirectUri } from "./oauth-redirect.js";
+import { readOutreachGoogleConfig } from "./outreach-config.js";
+/**
+ * Wires the mailbox routes into the console dispatcher (AGL-2978), with the
+ * production dependencies and each route's release subject.
+ */ /**
+ * The platform's own dependencies. Specs build their own.
+ *
+ * The permission resolver, the lockdown verdict, the rate limiter, the
+ * activity log and the alias store are imported when a request first needs
+ * them rather than when the bundle registers: `org-permissions` reaches the
+ * whole tenant data barrel, and the manifest loads this bundle into every
+ * console API process whether or not a mailbox route is ever called.
+ */ export function defaultOutreachMailboxRouteDeps() {
+    return {
+        firestore: ()=>firebaseAdmin.app().firestore(),
+        gate: {
+            verifyIdToken: (idToken)=>firebaseAdmin.app().auth().verifyIdToken(idToken),
+            resolveOrgPermissions: async (uid, context)=>(await import("@aglyn/tenant-runtime/org-permissions")).resolveOrgPermissions(uid, context),
+            readOrg: async (orgId)=>{
+                var _snapshot_data;
+                const snapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(orgId).get();
+                return snapshot.exists ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {} : null;
+            },
+            lockdownRefusal: async (options)=>(await import("@aglyn/tenant-data-admin/server/lockdown")).lockdownRefusal(options)
+        },
+        readConfig: readOutreachGoogleConfig,
+        stateSigningConfigured: ()=>{
+            try {
+                return Boolean(tokenSigningSecret());
+            } catch (unused) {
+                return false;
+            }
+        },
+        redirectUri: outreachOAuthRedirectUri,
+        now: Date.now,
+        transport: {},
+        consumeRateLimit: async (key, options)=>(await import("@aglyn/tenant-data-admin/server/rate-limit-store")).consumeRateLimit(key, options),
+        logOrgActivity: async (orgId, actor, action, target)=>(await import("@aglyn/tenant-data-admin/server/organizations")).logOrgActivity(orgId, actor, action, target),
+        confirmAliasesByProvider: async (firestore, input)=>(await import("@aglyn/tenant-data-admin/server/member-email-aliases")).confirmMemberEmailAliasesByProvider(firestore, input)
+    };
+}
+/**
+ * The org an authenticated mailbox request names — query or JSON body — for
+ * the release gate. Unverified, exactly as a `hostId` is: the gate only
+ * chooses which organization's rollout to read, and the route's own gate
+ * refuses anyone who is not a member of it.
+ */ export async function outreachOrgSubject(request) {
+    const fromQuery = readOrgId(new URL(request.url).searchParams.get('orgId'));
+    if (fromQuery) return {
+        orgId: fromQuery
+    };
+    if (request.method === 'GET' || request.method === 'HEAD') return null;
+    const body = await request.json().catch(()=>null);
+    const orgId = readOrgId(body == null ? void 0 : body.orgId);
+    return orgId ? {
+        orgId
+    } : null;
+}
+/**
+ * The org AND member Google's redirect is for, read off the signed state.
+ * Only a state whose signature verifies names anyone; an expired one still
+ * does, so the rep who took too long lands on a page that says so rather than
+ * on a 404.
+ */ export function outreachOAuthCallbackSubject(request) {
+    const read = readOutreachOAuthState(new URL(request.url).searchParams.get('state'), Date.now());
+    if (read.ok) return {
+        orgId: read.claims.orgId,
+        uid: read.claims.uid
+    };
+    if (read.ok === false && read.refusal === 'state-expired') {
+        const { claims } = read;
+        return {
+            orgId: claims.orgId,
+            uid: claims.uid
+        };
+    }
+    return null;
+}
+export function registerOutreachMailboxRoutes(deps = defaultOutreachMailboxRouteDeps()) {
+    const routes = createOutreachMailboxRoutes(deps);
+    const orgSubject = {
+        subject: outreachOrgSubject
+    };
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesAvailability, {
+        web: routes.availability
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesConnect, {
+        web: routes.connect
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesOAuthCallback, {
+        web: routes.oauthCallback
+    }, {
+        subject: outreachOAuthCallbackSubject
+    });
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesConnectComplete, {
+        web: routes.connectComplete
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesSettings, {
+        web: routes.settings
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesStatus, {
+        web: routes.status
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesTest, {
+        web: routes.test
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesDisconnect, {
+        web: routes.disconnect
+    }, orgSubject);
+}
+
+//# sourceMappingURL=register-mailbox-routes.js.map

package/src/lib/mailboxes/register-mailbox-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/register-mailbox-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginApiRoute,\n  type PluginApiRequestSubject,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { tokenSigningSecret } from '@aglyn/tenant-data-admin/server/media-signing'\nimport { OUTREACH_API_ROUTES } from '../constants/api-routes'\nimport { readOrgId } from './mailbox-gate'\nimport {\n  createOutreachMailboxRoutes,\n  type OutreachMailboxRouteDeps,\n} from './mailbox-routes'\nimport { readOutreachOAuthState } from './oauth-state'\nimport { outreachOAuthRedirectUri } from './oauth-redirect'\nimport { readOutreachGoogleConfig } from './outreach-config'\n\n/**\n * Wires the mailbox routes into the console dispatcher (AGL-2978), with the\n * production dependencies and each route's release subject.\n */\n\n/**\n * The platform's own dependencies. Specs build their own.\n *\n * The permission resolver, the lockdown verdict, the rate limiter, the\n * activity log and the alias store are imported when a request first needs\n * them rather than when the bundle registers: `org-permissions` reaches the\n * whole tenant data barrel, and the manifest loads this bundle into every\n * console API process whether or not a mailbox route is ever called.\n */\nexport function defaultOutreachMailboxRouteDeps(): OutreachMailboxRouteDeps {\n  return {\n    firestore: () => firebaseAdmin.app().firestore(),\n    gate: {\n      verifyIdToken: (idToken) => firebaseAdmin.app().auth().verifyIdToken(idToken),\n      resolveOrgPermissions: async (uid, context) =>\n        (await import('@aglyn/tenant-runtime/org-permissions')).resolveOrgPermissions(uid, context),\n      readOrg: async (orgId) => {\n        const snapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(orgId).get()\n        return snapshot.exists ? (snapshot.data() ?? {}) : null\n      },\n      lockdownRefusal: async (options) =>\n        (await import('@aglyn/tenant-data-admin/server/lockdown')).lockdownRefusal(options),\n    },\n    readConfig: readOutreachGoogleConfig,\n    stateSigningConfigured: () => {\n      try {\n        return Boolean(tokenSigningSecret())\n      } catch {\n        return false\n      }\n    },\n    redirectUri: outreachOAuthRedirectUri,\n    now: Date.now,\n    transport: {},\n    consumeRateLimit: async (key, options) =>\n      (await import('@aglyn/tenant-data-admin/server/rate-limit-store')).consumeRateLimit(key, options),\n    logOrgActivity: async (orgId, actor, action, target) =>\n      (await import('@aglyn/tenant-data-admin/server/organizations')).logOrgActivity(orgId, actor, action, target),\n    confirmAliasesByProvider: async (firestore, input) =>\n      (await import('@aglyn/tenant-data-admin/server/member-email-aliases')).confirmMemberEmailAliasesByProvider(\n        firestore,\n        input,\n      ),\n  }\n}\n\n/**\n * The org an authenticated mailbox request names — query or JSON body — for\n * the release gate. Unverified, exactly as a `hostId` is: the gate only\n * chooses which organization's rollout to read, and the route's own gate\n * refuses anyone who is not a member of it.\n */\nexport async function outreachOrgSubject(request: Request): Promise<PluginApiRequestSubject | null> {\n  const fromQuery = readOrgId(new URL(request.url).searchParams.get('orgId'))\n  if (fromQuery) return { orgId: fromQuery }\n  if (request.method === 'GET' || request.method === 'HEAD') return null\n  const body = (await request.json().catch(() => null)) as { orgId?: unknown } | null\n  const orgId = readOrgId(body?.orgId)\n  return orgId ? { orgId } : null\n}\n\n/**\n * The org AND member Google's redirect is for, read off the signed state.\n * Only a state whose signature verifies names anyone; an expired one still\n * does, so the rep who took too long lands on a page that says so rather than\n * on a 404.\n */\nexport function outreachOAuthCallbackSubject(request: Request): PluginApiRequestSubject | null {\n  const read = readOutreachOAuthState(new URL(request.url).searchParams.get('state'), Date.now())\n  if (read.ok) return { orgId: read.claims.orgId, uid: read.claims.uid }\n  if (read.ok === false && read.refusal === 'state-expired') {\n    const { claims } = read as { claims: { orgId: string; uid: string } }\n    return { orgId: claims.orgId, uid: claims.uid }\n  }\n  return null\n}\n\nexport function registerOutreachMailboxRoutes(\n  deps: OutreachMailboxRouteDeps = defaultOutreachMailboxRouteDeps(),\n): void {\n  const routes = createOutreachMailboxRoutes(deps)\n  const orgSubject = { subject: outreachOrgSubject }\n  registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesAvailability, { web: routes.availability }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesConnect, { web: routes.connect }, orgSubject)\n  registerPluginApiRoute(\n    OUTREACH_API_ROUTES.mailboxesOAuthCallback,\n    { web: routes.oauthCallback },\n    { subject: outreachOAuthCallbackSubject },\n  )\n  registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesConnectComplete, { web: routes.connectComplete }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesSettings, { web: routes.settings }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesStatus, { web: routes.status }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesTest, { web: routes.test }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.mailboxesDisconnect, { web: routes.disconnect }, orgSubject)\n}\n"],"names":["registerPluginApiRoute","firebaseAdmin","tokenSigningSecret","OUTREACH_API_ROUTES","readOrgId","createOutreachMailboxRoutes","readOutreachOAuthState","outreachOAuthRedirectUri","readOutreachGoogleConfig","defaultOutreachMailboxRouteDeps","firestore","app","gate","verifyIdToken","idToken","auth","resolveOrgPermissions","uid","context","readOrg","orgId","snapshot","collection","doc","get","exists","data","lockdownRefusal","options","readConfig","stateSigningConfigured","Boolean","redirectUri","now","Date","transport","consumeRateLimit","key","logOrgActivity","actor","action","target","confirmAliasesByProvider","input","confirmMemberEmailAliasesByProvider","outreachOrgSubject","request","fromQuery","URL","url","searchParams","method","body","json","catch","outreachOAuthCallbackSubject","read","ok","claims","refusal","registerOutreachMailboxRoutes","deps","routes","orgSubject","subject","mailboxesAvailability","web","availability","mailboxesConnect","connect","mailboxesOAuthCallback","oauthCallback","mailboxesConnectComplete","connectComplete","mailboxesSettings","settings","mailboxesStatus","status","mailboxesTest","test","mailboxesDisconnect","disconnect"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,sBAAsB,QAEjB,sBAAqB;AAC5B,SAASC,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,kBAAkB,QAAQ,gDAA+C;AAClF,SAASC,mBAAmB,QAAQ,6BAAyB;AAC7D,SAASC,SAAS,QAAQ,oBAAgB;AAC1C,SACEC,2BAA2B,QAEtB,sBAAkB;AACzB,SAASC,sBAAsB,QAAQ,mBAAe;AACtD,SAASC,wBAAwB,QAAQ,sBAAkB;AAC3D,SAASC,wBAAwB,QAAQ,uBAAmB;AAE5D;;;CAGC,GAED;;;;;;;;CAQC,GACD,OAAO,SAASC;IACd,OAAO;QACLC,WAAW,IAAMT,cAAcU,GAAG,GAAGD,SAAS;QAC9CE,MAAM;YACJC,eAAe,CAACC,UAAYb,cAAcU,GAAG,GAAGI,IAAI,GAAGF,aAAa,CAACC;YACrEE,uBAAuB,OAAOC,KAAKC,UACjC,AAAC,CAAA,MAAM,MAAM,CAAC,wCAAuC,EAAGF,qBAAqB,CAACC,KAAKC;YACrFC,SAAS,OAAOC;oBAEYC;gBAD1B,MAAMA,WAAW,MAAMpB,cAAcU,GAAG,GAAGD,SAAS,GAAGY,UAAU,CAAC,QAAQC,GAAG,CAACH,OAAOI,GAAG;gBACxF,OAAOH,SAASI,MAAM,IAAIJ,iBAAAA,SAASK,IAAI,cAAbL,iBAAmB,CAAC,IAAK;YACrD;YACAM,iBAAiB,OAAOC,UACtB,AAAC,CAAA,MAAM,MAAM,CAAC,2CAA0C,EAAGD,eAAe,CAACC;QAC/E;QACAC,YAAYrB;QACZsB,wBAAwB;YACtB,IAAI;gBACF,OAAOC,QAAQ7B;YACjB,EAAE,eAAM;gBACN,OAAO;YACT;QACF;QACA8B,aAAazB;QACb0B,KAAKC,KAAKD,GAAG;QACbE,WAAW,CAAC;QACZC,kBAAkB,OAAOC,KAAKT,UAC5B,AAAC,CAAA,MAAM,MAAM,CAAC,mDAAkD,EAAGQ,gBAAgB,CAACC,KAAKT;QAC3FU,gBAAgB,OAAOlB,OAAOmB,OAAOC,QAAQC,SAC3C,AAAC,CAAA,MAAM,MAAM,CAAC,gDAA+C,EAAGH,cAAc,CAAClB,OAAOmB,OAAOC,QAAQC;QACvGC,0BAA0B,OAAOhC,WAAWiC,QAC1C,AAAC,CAAA,MAAM,MAAM,CAAC,uDAAsD,EAAGC,mCAAmC,CACxGlC,WACAiC;IAEN;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeE,mBAAmBC,OAAgB;IACvD,MAAMC,YAAY3C,UAAU,IAAI4C,IAAIF,QAAQG,GAAG,EAAEC,YAAY,CAAC1B,GAAG,CAAC;IAClE,IAAIuB,WAAW,OAAO;QAAE3B,OAAO2B;IAAU;IACzC,IAAID,QAAQK,MAAM,KAAK,SAASL,QAAQK,MAAM,KAAK,QAAQ,OAAO;IAClE,MAAMC,OAAQ,MAAMN,QAAQO,IAAI,GAAGC,KAAK,CAAC,IAAM;IAC/C,MAAMlC,QAAQhB,UAAUgD,wBAAAA,KAAMhC,KAAK;IACnC,OAAOA,QAAQ;QAAEA;IAAM,IAAI;AAC7B;AAEA;;;;;CAKC,GACD,OAAO,SAASmC,6BAA6BT,OAAgB;IAC3D,MAAMU,OAAOlD,uBAAuB,IAAI0C,IAAIF,QAAQG,GAAG,EAAEC,YAAY,CAAC1B,GAAG,CAAC,UAAUU,KAAKD,GAAG;IAC5F,IAAIuB,KAAKC,EAAE,EAAE,OAAO;QAAErC,OAAOoC,KAAKE,MAAM,CAACtC,KAAK;QAAEH,KAAKuC,KAAKE,MAAM,CAACzC,GAAG;IAAC;IACrE,IAAIuC,KAAKC,EAAE,KAAK,SAASD,KAAKG,OAAO,KAAK,iBAAiB;QACzD,MAAM,EAAED,MAAM,EAAE,GAAGF;QACnB,OAAO;YAAEpC,OAAOsC,OAAOtC,KAAK;YAAEH,KAAKyC,OAAOzC,GAAG;QAAC;IAChD;IACA,OAAO;AACT;AAEA,OAAO,SAAS2C,8BACdC,OAAiCpD,iCAAiC;IAElE,MAAMqD,SAASzD,4BAA4BwD;IAC3C,MAAME,aAAa;QAAEC,SAASnB;IAAmB;IACjD7C,uBAAuBG,oBAAoB8D,qBAAqB,EAAE;QAAEC,KAAKJ,OAAOK,YAAY;IAAC,GAAGJ;IAChG/D,uBAAuBG,oBAAoBiE,gBAAgB,EAAE;QAAEF,KAAKJ,OAAOO,OAAO;IAAC,GAAGN;IACtF/D,uBACEG,oBAAoBmE,sBAAsB,EAC1C;QAAEJ,KAAKJ,OAAOS,aAAa;IAAC,GAC5B;QAAEP,SAAST;IAA6B;IAE1CvD,uBAAuBG,oBAAoBqE,wBAAwB,EAAE;QAAEN,KAAKJ,OAAOW,eAAe;IAAC,GAAGV;IACtG/D,uBAAuBG,oBAAoBuE,iBAAiB,EAAE;QAAER,KAAKJ,OAAOa,QAAQ;IAAC,GAAGZ;IACxF/D,uBAAuBG,oBAAoByE,eAAe,EAAE;QAAEV,KAAKJ,OAAOe,MAAM;IAAC,GAAGd;IACpF/D,uBAAuBG,oBAAoB2E,aAAa,EAAE;QAAEZ,KAAKJ,OAAOiB,IAAI;IAAC,GAAGhB;IAChF/D,uBAAuBG,oBAAoB6E,mBAAmB,EAAE;QAAEd,KAAKJ,OAAOmB,UAAU;IAAC,GAAGlB;AAC9F"}

package/src/lib/model/compliance-settings.d.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type OutreachComplianceSettings, type OutreachComplianceSettingsDocument } from './outreach.types';
+/** The longest legal name the footer prints. */
+export declare const OUTREACH_LEGAL_NAME_MAX = 120;
+/** The longest brand name the solicitation sentence uses. */
+export declare const OUTREACH_BRAND_NAME_MAX = 120;
+/** The longest postal address, all of its lines together. */
+export declare const OUTREACH_POSTAL_ADDRESS_MAX = 300;
+/** The most lines a postal address is written over. */
+export declare const OUTREACH_POSTAL_ADDRESS_MAX_LINES = 6;
+/**
+ * Every ISO-3166-1 alpha-2 code assigned to a country or territory, sorted.
+ *
+ * A fixed list rather than whatever `Intl` can name: `Intl.DisplayNames`
+ * also names `EU`, `UN`, `ZZ` and retired codes such as `YU`, none of which
+ * a recipient's address can be in.
+ */
+export declare const OUTREACH_COUNTRY_CODES: readonly string[];
+/** Whether `code` is an assigned country code, uppercase. */
+export declare function isOutreachCountryCode(code: unknown): boolean;
+/**
+ * A country's English name as a list shows it — "United States", "Canada" —
+ * or the code where the runtime cannot name regions.
+ */
+export declare function outreachCountryLabel(code: string): string;
+/** One country as the picker offers it. */
+export interface OutreachCountryOption {
+    code: string;
+    name: string;
+}
+/** Every country, by name, for the picker. */
+export declare function outreachCountryOptions(): OutreachCountryOption[];
+/**
+ * A stored compliance document read into its shape, defaults applied: the
+ * United States alone when no countries were ever saved. A list that was
+ * saved is read as saved, codes that are not countries dropped, so an
+ * emptied list reads as nobody rather than as the default.
+ */
+export declare function readOutreachComplianceSettings(raw: unknown): OutreachComplianceSettingsDocument;
+/** A field the Compliance page shows an issue beside. */
+export type OutreachComplianceField = 'legalName' | 'brandName' | 'postalAddress' | 'allowedCountries';
+export interface OutreachComplianceIssue {
+    field: OutreachComplianceField;
+    message: string;
+}
+export interface OutreachComplianceValidation {
+    /** The settings as they would be stored: trimmed, one-lined, codes uppercased. */
+    settings: OutreachComplianceSettings;
+    /** Every reason the save is refused; empty when it may be saved. */
+    issues: OutreachComplianceIssue[];
+}
+/**
+ * What a save stores, and every reason it is refused — see the module note
+ * for why an empty legal name or postal address is not one of them.
+ */
+export declare function validateOutreachComplianceSettings(input: unknown): OutreachComplianceValidation;
+/** Whether two settings say the same thing — what makes a save a change. */
+export declare function outreachComplianceSettingsEqual(a: OutreachComplianceSettings, b: OutreachComplianceSettings): boolean;
+/**
+ * The countries a sequence may send to under its organization's ceiling:
+ * the sequence's own, in its order, less any the organization does not allow.
+ */
+export declare function effectiveOutreachAllowedCountries(sequenceCountries: readonly string[] | null | undefined, orgCountries: readonly string[] | null | undefined): string[];

package/src/lib/model/compliance-settings.js

@@ -0,0 +1,155 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * THE ORGANIZATION'S COMPLIANCE SETTINGS, AS DATA (AGL-2980).
+ *
+ * What the Compliance page edits and the settings route stores: the legal
+ * name and postal address every email's footer prints, the brand name its
+ * solicitation sentence uses, and the countries Outreach may send to at
+ * all. Client-safe — the page validates as the person types with the same
+ * function the route refuses a save with, so the two cannot disagree.
+ *
+ * Empty is allowed. An organization can save its countries before it has a
+ * postal address; what an empty address stops is ACTIVATION
+ * (`validateOutreachSequenceActivation`) and every send
+ * (`composeOutreachFooter`), and the page says so beside the field.
+ *==========================================*/ import { normalizeOutreachAllowedCountries } from "../engine/sequence-validation.js";
+import { OUTREACH_DEFAULT_ALLOWED_COUNTRIES } from "./outreach.types.js";
+/** The longest legal name the footer prints. */ export const OUTREACH_LEGAL_NAME_MAX = 120;
+/** The longest brand name the solicitation sentence uses. */ export const OUTREACH_BRAND_NAME_MAX = 120;
+/** The longest postal address, all of its lines together. */ export const OUTREACH_POSTAL_ADDRESS_MAX = 300;
+/** The most lines a postal address is written over. */ export const OUTREACH_POSTAL_ADDRESS_MAX_LINES = 6;
+/**
+ * Every ISO-3166-1 alpha-2 code assigned to a country or territory, sorted.
+ *
+ * A fixed list rather than whatever `Intl` can name: `Intl.DisplayNames`
+ * also names `EU`, `UN`, `ZZ` and retired codes such as `YU`, none of which
+ * a recipient's address can be in.
+ */ export const OUTREACH_COUNTRY_CODES = ('AD AE AF AG AI AL AM AO AQ AR AS AT AU AW AX AZ BA BB BD BE BF BG BH BI ' + 'BJ BL BM BN BO BQ BR BS BT BV BW BY BZ CA CC CD CF CG CH CI CK CL CM CN ' + 'CO CR CU CV CW CX CY CZ DE DJ DK DM DO DZ EC EE EG EH ER ES ET FI FJ FK ' + 'FM FO FR GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS GT GU GW GY HK HM ' + 'HN HR HT HU ID IE IL IM IN IO IQ IR IS IT JE JM JO JP KE KG KH KI KM KN ' + 'KP KR KW KY KZ LA LB LC LI LK LR LS LT LU LV LY MA MC MD ME MF MG MH MK ' + 'ML MM MN MO MP MQ MR MS MT MU MV MW MX MY MZ NA NC NE NF NG NI NL NO NP ' + 'NR NU NZ OM PA PE PF PG PH PK PL PM PN PR PS PT PW PY QA RE RO RS RU RW ' + 'SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV SX SY SZ TC TD TF ' + 'TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG UM US UY UZ VA VC VE VG VI ' + 'VN VU WF WS YE YT ZA ZM ZW').split(' ');
+const COUNTRY_CODES = new Set(OUTREACH_COUNTRY_CODES);
+/** Whether `code` is an assigned country code, uppercase. */ export function isOutreachCountryCode(code) {
+    return typeof code === 'string' && COUNTRY_CODES.has(code);
+}
+let regionNames;
+/**
+ * A country's English name as a list shows it — "United States", "Canada" —
+ * or the code where the runtime cannot name regions.
+ */ export function outreachCountryLabel(code) {
+    if (regionNames === undefined) {
+        try {
+            regionNames = new Intl.DisplayNames([
+                'en'
+            ], {
+                type: 'region'
+            });
+        } catch (unused) {
+            regionNames = null;
+        }
+    }
+    try {
+        var _ref;
+        return (_ref = regionNames == null ? void 0 : regionNames.of(code)) != null ? _ref : code;
+    } catch (unused) {
+        return code;
+    }
+}
+/** Every country, by name, for the picker. */ export function outreachCountryOptions() {
+    return OUTREACH_COUNTRY_CODES.map((code)=>({
+            code,
+            name: outreachCountryLabel(code)
+        })).sort((a, b)=>a.name.localeCompare(b.name, 'en'));
+}
+const text = (value)=>typeof value === 'string' ? value : '';
+/** One line: whitespace collapsed, ends trimmed. */ const oneLine = (value)=>text(value).replace(/\s+/g, ' ').trim();
+/** The lines of an address, each settled, the empty ones dropped. */ function addressLines(value) {
+    return text(value).split(/\r\n|\r|\n/).map(oneLine).filter(Boolean);
+}
+/**
+ * A stored compliance document read into its shape, defaults applied: the
+ * United States alone when no countries were ever saved. A list that was
+ * saved is read as saved, codes that are not countries dropped, so an
+ * emptied list reads as nobody rather than as the default.
+ */ export function readOutreachComplianceSettings(raw) {
+    const data = raw && typeof raw === 'object' ? raw : {};
+    const countries = data['allowedCountries'];
+    const updatedAtMs = Number(data['updatedAtMs']);
+    return {
+        legalName: oneLine(data['legalName']),
+        brandName: oneLine(data['brandName']),
+        postalAddress: addressLines(data['postalAddress']).join('\n'),
+        allowedCountries: Array.isArray(countries) ? normalizeOutreachAllowedCountries(countries).filter(isOutreachCountryCode) : [
+            ...OUTREACH_DEFAULT_ALLOWED_COUNTRIES
+        ],
+        updatedAtMs: Number.isFinite(updatedAtMs) && updatedAtMs > 0 ? updatedAtMs : 0,
+        updatedByUid: typeof data['updatedByUid'] === 'string' && data['updatedByUid'] ? data['updatedByUid'] : null
+    };
+}
+/**
+ * What a save stores, and every reason it is refused — see the module note
+ * for why an empty legal name or postal address is not one of them.
+ */ export function validateOutreachComplianceSettings(input) {
+    const data = input && typeof input === 'object' ? input : {};
+    const issues = [];
+    const issue = (field, message)=>issues.push({
+            field,
+            message
+        });
+    const legalName = oneLine(data['legalName']);
+    if (legalName.length > OUTREACH_LEGAL_NAME_MAX) {
+        issue('legalName', `Keep the legal name under ${OUTREACH_LEGAL_NAME_MAX} characters.`);
+    }
+    const brandName = oneLine(data['brandName']);
+    if (brandName.length > OUTREACH_BRAND_NAME_MAX) {
+        issue('brandName', `Keep the brand name under ${OUTREACH_BRAND_NAME_MAX} characters.`);
+    }
+    const lines = addressLines(data['postalAddress']);
+    const postalAddress = lines.join('\n');
+    if (lines.length > OUTREACH_POSTAL_ADDRESS_MAX_LINES) {
+        issue('postalAddress', `Write the address on ${OUTREACH_POSTAL_ADDRESS_MAX_LINES} lines or fewer.`);
+    }
+    if (postalAddress.length > OUTREACH_POSTAL_ADDRESS_MAX) {
+        issue('postalAddress', `Keep the address under ${OUTREACH_POSTAL_ADDRESS_MAX} characters.`);
+    }
+    const rawCountries = data['allowedCountries'];
+    const allowedCountries = normalizeOutreachAllowedCountries(rawCountries);
+    const unknown = (Array.isArray(rawCountries) ? rawCountries : []).map((entry)=>text(entry).trim().toUpperCase()).filter((code)=>!isOutreachCountryCode(code));
+    if (!Array.isArray(rawCountries) || !allowedCountries.length) {
+        issue('allowedCountries', 'Choose at least one country a sequence may send to.');
+    } else if (unknown.length) {
+        issue('allowedCountries', `${unknown.map((code)=>`"${code}"`).join(', ')} ${unknown.length === 1 ? "isn't a country code" : "aren't country codes"}.`);
+    }
+    return {
+        settings: {
+            legalName,
+            brandName,
+            postalAddress,
+            allowedCountries: allowedCountries.filter(isOutreachCountryCode)
+        },
+        issues
+    };
+}
+/** Whether two settings say the same thing — what makes a save a change. */ export function outreachComplianceSettingsEqual(a, b) {
+    return a.legalName === b.legalName && a.brandName === b.brandName && a.postalAddress === b.postalAddress && a.allowedCountries.length === b.allowedCountries.length && a.allowedCountries.every((code, index)=>code === b.allowedCountries[index]);
+}
+/**
+ * The countries a sequence may send to under its organization's ceiling:
+ * the sequence's own, in its order, less any the organization does not allow.
+ */ export function effectiveOutreachAllowedCountries(sequenceCountries, orgCountries) {
+    const allowed = new Set(orgCountries != null ? orgCountries : []);
+    return (sequenceCountries != null ? sequenceCountries : []).filter((code)=>allowed.has(code));
+}
+
+//# sourceMappingURL=compliance-settings.js.map

package/src/lib/model/compliance-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/model/compliance-settings.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE ORGANIZATION'S COMPLIANCE SETTINGS, AS DATA (AGL-2980).\n *\n * What the Compliance page edits and the settings route stores: the legal\n * name and postal address every email's footer prints, the brand name its\n * solicitation sentence uses, and the countries Outreach may send to at\n * all. Client-safe — the page validates as the person types with the same\n * function the route refuses a save with, so the two cannot disagree.\n *\n * Empty is allowed. An organization can save its countries before it has a\n * postal address; what an empty address stops is ACTIVATION\n * (`validateOutreachSequenceActivation`) and every send\n * (`composeOutreachFooter`), and the page says so beside the field.\n *==========================================*/\n\nimport { normalizeOutreachAllowedCountries } from '../engine/sequence-validation'\nimport {\n  OUTREACH_DEFAULT_ALLOWED_COUNTRIES,\n  type OutreachComplianceSettings,\n  type OutreachComplianceSettingsDocument,\n} from './outreach.types'\n\n/** The longest legal name the footer prints. */\nexport const OUTREACH_LEGAL_NAME_MAX = 120\n\n/** The longest brand name the solicitation sentence uses. */\nexport const OUTREACH_BRAND_NAME_MAX = 120\n\n/** The longest postal address, all of its lines together. */\nexport const OUTREACH_POSTAL_ADDRESS_MAX = 300\n\n/** The most lines a postal address is written over. */\nexport const OUTREACH_POSTAL_ADDRESS_MAX_LINES = 6\n\n/**\n * Every ISO-3166-1 alpha-2 code assigned to a country or territory, sorted.\n *\n * A fixed list rather than whatever `Intl` can name: `Intl.DisplayNames`\n * also names `EU`, `UN`, `ZZ` and retired codes such as `YU`, none of which\n * a recipient's address can be in.\n */\nexport const OUTREACH_COUNTRY_CODES: readonly string[] = (\n  'AD AE AF AG AI AL AM AO AQ AR AS AT AU AW AX AZ BA BB BD BE BF BG BH BI ' +\n  'BJ BL BM BN BO BQ BR BS BT BV BW BY BZ CA CC CD CF CG CH CI CK CL CM CN ' +\n  'CO CR CU CV CW CX CY CZ DE DJ DK DM DO DZ EC EE EG EH ER ES ET FI FJ FK ' +\n  'FM FO FR GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS GT GU GW GY HK HM ' +\n  'HN HR HT HU ID IE IL IM IN IO IQ IR IS IT JE JM JO JP KE KG KH KI KM KN ' +\n  'KP KR KW KY KZ LA LB LC LI LK LR LS LT LU LV LY MA MC MD ME MF MG MH MK ' +\n  'ML MM MN MO MP MQ MR MS MT MU MV MW MX MY MZ NA NC NE NF NG NI NL NO NP ' +\n  'NR NU NZ OM PA PE PF PG PH PK PL PM PN PR PS PT PW PY QA RE RO RS RU RW ' +\n  'SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV SX SY SZ TC TD TF ' +\n  'TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG UM US UY UZ VA VC VE VG VI ' +\n  'VN VU WF WS YE YT ZA ZM ZW'\n).split(' ')\n\nconst COUNTRY_CODES = new Set(OUTREACH_COUNTRY_CODES)\n\n/** Whether `code` is an assigned country code, uppercase. */\nexport function isOutreachCountryCode(code: unknown): boolean {\n  return typeof code === 'string' && COUNTRY_CODES.has(code)\n}\n\nlet regionNames: Intl.DisplayNames | null | undefined\n\n/**\n * A country's English name as a list shows it — \"United States\", \"Canada\" —\n * or the code where the runtime cannot name regions.\n */\nexport function outreachCountryLabel(code: string): string {\n  if (regionNames === undefined) {\n    try {\n      regionNames = new Intl.DisplayNames(['en'], { type: 'region' })\n    } catch {\n      regionNames = null\n    }\n  }\n  try {\n    return regionNames?.of(code) ?? code\n  } catch {\n    return code\n  }\n}\n\n/** One country as the picker offers it. */\nexport interface OutreachCountryOption {\n  code: string\n  name: string\n}\n\n/** Every country, by name, for the picker. */\nexport function outreachCountryOptions(): OutreachCountryOption[] {\n  return OUTREACH_COUNTRY_CODES.map((code) => ({\n    code,\n    name: outreachCountryLabel(code),\n  })).sort((a, b) => a.name.localeCompare(b.name, 'en'))\n}\n\nconst text = (value: unknown): string => (typeof value === 'string' ? value : '')\n\n/** One line: whitespace collapsed, ends trimmed. */\nconst oneLine = (value: unknown): string => text(value).replace(/\\s+/g, ' ').trim()\n\n/** The lines of an address, each settled, the empty ones dropped. */\nfunction addressLines(value: unknown): string[] {\n  return text(value)\n    .split(/\\r\\n|\\r|\\n/)\n    .map(oneLine)\n    .filter(Boolean)\n}\n\n/**\n * A stored compliance document read into its shape, defaults applied: the\n * United States alone when no countries were ever saved. A list that was\n * saved is read as saved, codes that are not countries dropped, so an\n * emptied list reads as nobody rather than as the default.\n */\nexport function readOutreachComplianceSettings(\n  raw: unknown,\n): OutreachComplianceSettingsDocument {\n  const data = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>\n  const countries = data['allowedCountries']\n  const updatedAtMs = Number(data['updatedAtMs'])\n  return {\n    legalName: oneLine(data['legalName']),\n    brandName: oneLine(data['brandName']),\n    postalAddress: addressLines(data['postalAddress']).join('\\n'),\n    allowedCountries: Array.isArray(countries)\n      ? normalizeOutreachAllowedCountries(countries).filter(isOutreachCountryCode)\n      : [...OUTREACH_DEFAULT_ALLOWED_COUNTRIES],\n    updatedAtMs: Number.isFinite(updatedAtMs) && updatedAtMs > 0 ? updatedAtMs : 0,\n    updatedByUid:\n      typeof data['updatedByUid'] === 'string' && data['updatedByUid']\n        ? data['updatedByUid']\n        : null,\n  }\n}\n\n/** A field the Compliance page shows an issue beside. */\nexport type OutreachComplianceField =\n  | 'legalName'\n  | 'brandName'\n  | 'postalAddress'\n  | 'allowedCountries'\n\nexport interface OutreachComplianceIssue {\n  field: OutreachComplianceField\n  message: string\n}\n\nexport interface OutreachComplianceValidation {\n  /** The settings as they would be stored: trimmed, one-lined, codes uppercased. */\n  settings: OutreachComplianceSettings\n  /** Every reason the save is refused; empty when it may be saved. */\n  issues: OutreachComplianceIssue[]\n}\n\n/**\n * What a save stores, and every reason it is refused — see the module note\n * for why an empty legal name or postal address is not one of them.\n */\nexport function validateOutreachComplianceSettings(\n  input: unknown,\n): OutreachComplianceValidation {\n  const data = (input && typeof input === 'object' ? input : {}) as Record<string, unknown>\n  const issues: OutreachComplianceIssue[] = []\n  const issue = (field: OutreachComplianceField, message: string) =>\n    issues.push({ field, message })\n\n  const legalName = oneLine(data['legalName'])\n  if (legalName.length > OUTREACH_LEGAL_NAME_MAX) {\n    issue('legalName', `Keep the legal name under ${OUTREACH_LEGAL_NAME_MAX} characters.`)\n  }\n  const brandName = oneLine(data['brandName'])\n  if (brandName.length > OUTREACH_BRAND_NAME_MAX) {\n    issue('brandName', `Keep the brand name under ${OUTREACH_BRAND_NAME_MAX} characters.`)\n  }\n  const lines = addressLines(data['postalAddress'])\n  const postalAddress = lines.join('\\n')\n  if (lines.length > OUTREACH_POSTAL_ADDRESS_MAX_LINES) {\n    issue(\n      'postalAddress',\n      `Write the address on ${OUTREACH_POSTAL_ADDRESS_MAX_LINES} lines or fewer.`,\n    )\n  }\n  if (postalAddress.length > OUTREACH_POSTAL_ADDRESS_MAX) {\n    issue(\n      'postalAddress',\n      `Keep the address under ${OUTREACH_POSTAL_ADDRESS_MAX} characters.`,\n    )\n  }\n\n  const rawCountries = data['allowedCountries']\n  const allowedCountries = normalizeOutreachAllowedCountries(rawCountries)\n  const unknown = (Array.isArray(rawCountries) ? rawCountries : [])\n    .map((entry) => text(entry).trim().toUpperCase())\n    .filter((code) => !isOutreachCountryCode(code))\n  if (!Array.isArray(rawCountries) || !allowedCountries.length) {\n    issue('allowedCountries', 'Choose at least one country a sequence may send to.')\n  } else if (unknown.length) {\n    issue(\n      'allowedCountries',\n      `${unknown.map((code) => `\"${code}\"`).join(', ')} ${unknown.length === 1 ? \"isn't a country code\" : \"aren't country codes\"}.`,\n    )\n  }\n\n  return {\n    settings: {\n      legalName,\n      brandName,\n      postalAddress,\n      allowedCountries: allowedCountries.filter(isOutreachCountryCode),\n    },\n    issues,\n  }\n}\n\n/** Whether two settings say the same thing — what makes a save a change. */\nexport function outreachComplianceSettingsEqual(\n  a: OutreachComplianceSettings,\n  b: OutreachComplianceSettings,\n): boolean {\n  return (\n    a.legalName === b.legalName &&\n    a.brandName === b.brandName &&\n    a.postalAddress === b.postalAddress &&\n    a.allowedCountries.length === b.allowedCountries.length &&\n    a.allowedCountries.every((code, index) => code === b.allowedCountries[index])\n  )\n}\n\n/**\n * The countries a sequence may send to under its organization's ceiling:\n * the sequence's own, in its order, less any the organization does not allow.\n */\nexport function effectiveOutreachAllowedCountries(\n  sequenceCountries: readonly string[] | null | undefined,\n  orgCountries: readonly string[] | null | undefined,\n): string[] {\n  const allowed = new Set(orgCountries ?? [])\n  return (sequenceCountries ?? []).filter((code) => allowed.has(code))\n}\n"],"names":["normalizeOutreachAllowedCountries","OUTREACH_DEFAULT_ALLOWED_COUNTRIES","OUTREACH_LEGAL_NAME_MAX","OUTREACH_BRAND_NAME_MAX","OUTREACH_POSTAL_ADDRESS_MAX","OUTREACH_POSTAL_ADDRESS_MAX_LINES","OUTREACH_COUNTRY_CODES","split","COUNTRY_CODES","Set","isOutreachCountryCode","code","has","regionNames","outreachCountryLabel","undefined","Intl","DisplayNames","type","of","outreachCountryOptions","map","name","sort","a","b","localeCompare","text","value","oneLine","replace","trim","addressLines","filter","Boolean","readOutreachComplianceSettings","raw","data","countries","updatedAtMs","Number","legalName","brandName","postalAddress","join","allowedCountries","Array","isArray","isFinite","updatedByUid","validateOutreachComplianceSettings","input","issues","issue","field","message","push","length","lines","rawCountries","unknown","entry","toUpperCase","settings","outreachComplianceSettingsEqual","every","index","effectiveOutreachAllowedCountries","sequenceCountries","orgCountries","allowed"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;4CAa4C,GAE5C,SAASA,iCAAiC,QAAQ,mCAA+B;AACjF,SACEC,kCAAkC,QAG7B,sBAAkB;AAEzB,8CAA8C,GAC9C,OAAO,MAAMC,0BAA0B,IAAG;AAE1C,2DAA2D,GAC3D,OAAO,MAAMC,0BAA0B,IAAG;AAE1C,2DAA2D,GAC3D,OAAO,MAAMC,8BAA8B,IAAG;AAE9C,qDAAqD,GACrD,OAAO,MAAMC,oCAAoC,EAAC;AAElD;;;;;;CAMC,GACD,OAAO,MAAMC,yBAA4C,AACvD,CAAA,6EACA,6EACA,6EACA,6EACA,6EACA,6EACA,6EACA,6EACA,6EACA,6EACA,4BAA2B,EAC3BC,KAAK,CAAC,KAAI;AAEZ,MAAMC,gBAAgB,IAAIC,IAAIH;AAE9B,2DAA2D,GAC3D,OAAO,SAASI,sBAAsBC,IAAa;IACjD,OAAO,OAAOA,SAAS,YAAYH,cAAcI,GAAG,CAACD;AACvD;AAEA,IAAIE;AAEJ;;;CAGC,GACD,OAAO,SAASC,qBAAqBH,IAAY;IAC/C,IAAIE,gBAAgBE,WAAW;QAC7B,IAAI;YACFF,cAAc,IAAIG,KAAKC,YAAY,CAAC;gBAAC;aAAK,EAAE;gBAAEC,MAAM;YAAS;QAC/D,EAAE,eAAM;YACNL,cAAc;QAChB;IACF;IACA,IAAI;;QACF,eAAOA,+BAAAA,YAAaM,EAAE,CAACR,wBAASA;IAClC,EAAE,eAAM;QACN,OAAOA;IACT;AACF;AAQA,4CAA4C,GAC5C,OAAO,SAASS;IACd,OAAOd,uBAAuBe,GAAG,CAAC,CAACV,OAAU,CAAA;YAC3CA;YACAW,MAAMR,qBAAqBH;QAC7B,CAAA,GAAIY,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEF,IAAI,CAACI,aAAa,CAACD,EAAEH,IAAI,EAAE;AAClD;AAEA,MAAMK,OAAO,CAACC,QAA4B,OAAOA,UAAU,WAAWA,QAAQ;AAE9E,kDAAkD,GAClD,MAAMC,UAAU,CAACD,QAA2BD,KAAKC,OAAOE,OAAO,CAAC,QAAQ,KAAKC,IAAI;AAEjF,mEAAmE,GACnE,SAASC,aAAaJ,KAAc;IAClC,OAAOD,KAAKC,OACTrB,KAAK,CAAC,cACNc,GAAG,CAACQ,SACJI,MAAM,CAACC;AACZ;AAEA;;;;;CAKC,GACD,OAAO,SAASC,+BACdC,GAAY;IAEZ,MAAMC,OAAQD,OAAO,OAAOA,QAAQ,WAAWA,MAAM,CAAC;IACtD,MAAME,YAAYD,IAAI,CAAC,mBAAmB;IAC1C,MAAME,cAAcC,OAAOH,IAAI,CAAC,cAAc;IAC9C,OAAO;QACLI,WAAWZ,QAAQQ,IAAI,CAAC,YAAY;QACpCK,WAAWb,QAAQQ,IAAI,CAAC,YAAY;QACpCM,eAAeX,aAAaK,IAAI,CAAC,gBAAgB,EAAEO,IAAI,CAAC;QACxDC,kBAAkBC,MAAMC,OAAO,CAACT,aAC5BtC,kCAAkCsC,WAAWL,MAAM,CAACvB,yBACpD;eAAIT;SAAmC;QAC3CsC,aAAaC,OAAOQ,QAAQ,CAACT,gBAAgBA,cAAc,IAAIA,cAAc;QAC7EU,cACE,OAAOZ,IAAI,CAAC,eAAe,KAAK,YAAYA,IAAI,CAAC,eAAe,GAC5DA,IAAI,CAAC,eAAe,GACpB;IACR;AACF;AAqBA;;;CAGC,GACD,OAAO,SAASa,mCACdC,KAAc;IAEd,MAAMd,OAAQc,SAAS,OAAOA,UAAU,WAAWA,QAAQ,CAAC;IAC5D,MAAMC,SAAoC,EAAE;IAC5C,MAAMC,QAAQ,CAACC,OAAgCC,UAC7CH,OAAOI,IAAI,CAAC;YAAEF;YAAOC;QAAQ;IAE/B,MAAMd,YAAYZ,QAAQQ,IAAI,CAAC,YAAY;IAC3C,IAAII,UAAUgB,MAAM,GAAGvD,yBAAyB;QAC9CmD,MAAM,aAAa,CAAC,0BAA0B,EAAEnD,wBAAwB,YAAY,CAAC;IACvF;IACA,MAAMwC,YAAYb,QAAQQ,IAAI,CAAC,YAAY;IAC3C,IAAIK,UAAUe,MAAM,GAAGtD,yBAAyB;QAC9CkD,MAAM,aAAa,CAAC,0BAA0B,EAAElD,wBAAwB,YAAY,CAAC;IACvF;IACA,MAAMuD,QAAQ1B,aAAaK,IAAI,CAAC,gBAAgB;IAChD,MAAMM,gBAAgBe,MAAMd,IAAI,CAAC;IACjC,IAAIc,MAAMD,MAAM,GAAGpD,mCAAmC;QACpDgD,MACE,iBACA,CAAC,qBAAqB,EAAEhD,kCAAkC,gBAAgB,CAAC;IAE/E;IACA,IAAIsC,cAAcc,MAAM,GAAGrD,6BAA6B;QACtDiD,MACE,iBACA,CAAC,uBAAuB,EAAEjD,4BAA4B,YAAY,CAAC;IAEvE;IAEA,MAAMuD,eAAetB,IAAI,CAAC,mBAAmB;IAC7C,MAAMQ,mBAAmB7C,kCAAkC2D;IAC3D,MAAMC,UAAU,AAACd,CAAAA,MAAMC,OAAO,CAACY,gBAAgBA,eAAe,EAAE,AAAD,EAC5DtC,GAAG,CAAC,CAACwC,QAAUlC,KAAKkC,OAAO9B,IAAI,GAAG+B,WAAW,IAC7C7B,MAAM,CAAC,CAACtB,OAAS,CAACD,sBAAsBC;IAC3C,IAAI,CAACmC,MAAMC,OAAO,CAACY,iBAAiB,CAACd,iBAAiBY,MAAM,EAAE;QAC5DJ,MAAM,oBAAoB;IAC5B,OAAO,IAAIO,QAAQH,MAAM,EAAE;QACzBJ,MACE,oBACA,GAAGO,QAAQvC,GAAG,CAAC,CAACV,OAAS,CAAC,CAAC,EAAEA,KAAK,CAAC,CAAC,EAAEiC,IAAI,CAAC,MAAM,CAAC,EAAEgB,QAAQH,MAAM,KAAK,IAAI,yBAAyB,uBAAuB,CAAC,CAAC;IAEjI;IAEA,OAAO;QACLM,UAAU;YACRtB;YACAC;YACAC;YACAE,kBAAkBA,iBAAiBZ,MAAM,CAACvB;QAC5C;QACA0C;IACF;AACF;AAEA,0EAA0E,GAC1E,OAAO,SAASY,gCACdxC,CAA6B,EAC7BC,CAA6B;IAE7B,OACED,EAAEiB,SAAS,KAAKhB,EAAEgB,SAAS,IAC3BjB,EAAEkB,SAAS,KAAKjB,EAAEiB,SAAS,IAC3BlB,EAAEmB,aAAa,KAAKlB,EAAEkB,aAAa,IACnCnB,EAAEqB,gBAAgB,CAACY,MAAM,KAAKhC,EAAEoB,gBAAgB,CAACY,MAAM,IACvDjC,EAAEqB,gBAAgB,CAACoB,KAAK,CAAC,CAACtD,MAAMuD,QAAUvD,SAASc,EAAEoB,gBAAgB,CAACqB,MAAM;AAEhF;AAEA;;;CAGC,GACD,OAAO,SAASC,kCACdC,iBAAuD,EACvDC,YAAkD;IAElD,MAAMC,UAAU,IAAI7D,IAAI4D,uBAAAA,eAAgB,EAAE;IAC1C,OAAO,CAACD,4BAAAA,oBAAqB,EAAE,EAAEnC,MAAM,CAAC,CAACtB,OAAS2D,QAAQ1D,GAAG,CAACD;AAChE"}