@aglyn/plugins-outreach 1.0.0-beta.143

package/src/lib/routes/platform-deps.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { lockdownRefusal } from '@aglyn/tenant-data-admin/server/lockdown';
+import { logOrgActivity } from '@aglyn/tenant-data-admin/server/organizations';
+import { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions';
+/**
+ * The platform's heavier server modules the Outreach routes reach
+ * (AGL-2980): the permission resolver, the lockdown verdict, the activity
+ * log and the saved-view sweep.
+ *
+ * Imported here statically, and this module is loaded by
+ * `register-routes.ts` the first time a request needs one of them: the
+ * manifest loads Outreach's server bundle into every console API process
+ * whether or not an Outreach route is ever called, and `org-permissions`
+ * alone reaches the whole tenant data barrel. Loading them through one
+ * module of this plugin keeps every import of the platform's libraries a
+ * static one.
+ */
+export { lockdownRefusal, logOrgActivity, resolveOrgPermissions };
+/**
+ * Whether the member holds a CATALOG permission (`data.manage`) as the
+ * org's roles resolve it — custom role and per-member overrides included.
+ * A lookup that failed has not shown the member holds it.
+ */
+export declare function holdsOrgCatalogPermission(uid: string, orgId: string, key: string): Promise<boolean>;
+/**
+ * The addresses a saved Contacts view selects among one site's contacts,
+ * read by the dynamic-list sweep's own scan, and whether it reached the
+ * whole view.
+ */
+export declare function crmViewEmails(input: {
+    hostId: string;
+    viewId: string;
+}): Promise<{
+    emails: string[];
+    complete: boolean;
+}>;

package/src/lib/routes/platform-deps.js

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { collectDynamicListCandidates } from "@aglyn/tenant-data-admin/server/dynamic-list-materialize";
+import { lockdownRefusal } from "@aglyn/tenant-data-admin/server/lockdown";
+import { logOrgActivity, memberHasOrgPermission, resolveOrgMembership } from "@aglyn/tenant-data-admin/server/organizations";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+/**
+ * The platform's heavier server modules the Outreach routes reach
+ * (AGL-2980): the permission resolver, the lockdown verdict, the activity
+ * log and the saved-view sweep.
+ *
+ * Imported here statically, and this module is loaded by
+ * `register-routes.ts` the first time a request needs one of them: the
+ * manifest loads Outreach's server bundle into every console API process
+ * whether or not an Outreach route is ever called, and `org-permissions`
+ * alone reaches the whole tenant data barrel. Loading them through one
+ * module of this plugin keeps every import of the platform's libraries a
+ * static one.
+ */ export { lockdownRefusal, logOrgActivity, resolveOrgPermissions };
+/**
+ * Whether the member holds a CATALOG permission (`data.manage`) as the
+ * org's roles resolve it — custom role and per-member overrides included.
+ * A lookup that failed has not shown the member holds it.
+ */ export async function holdsOrgCatalogPermission(uid, orgId, key) {
+    try {
+        const membership = await resolveOrgMembership(uid, orgId);
+        if (!(membership == null ? void 0 : membership.member)) return false;
+        return await memberHasOrgPermission(orgId, membership.member, key) === true;
+    } catch (unused) {
+        return false;
+    }
+}
+/**
+ * The addresses a saved Contacts view selects among one site's contacts,
+ * read by the dynamic-list sweep's own scan, and whether it reached the
+ * whole view.
+ */ export async function crmViewEmails(input) {
+    const scan = await collectDynamicListCandidates({
+        hostId: input.hostId,
+        rule: {
+            sources: [
+                'contacts'
+            ],
+            viewId: input.viewId
+        }
+    });
+    return {
+        emails: scan.candidates.map((candidate)=>candidate.email),
+        complete: scan.complete
+    };
+}
+
+//# sourceMappingURL=platform-deps.js.map

package/src/lib/routes/platform-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/routes/platform-deps.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { collectDynamicListCandidates } from '@aglyn/tenant-data-admin/server/dynamic-list-materialize'\nimport { lockdownRefusal } from '@aglyn/tenant-data-admin/server/lockdown'\nimport {\n  logOrgActivity,\n  memberHasOrgPermission,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin/server/organizations'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\n\n/**\n * The platform's heavier server modules the Outreach routes reach\n * (AGL-2980): the permission resolver, the lockdown verdict, the activity\n * log and the saved-view sweep.\n *\n * Imported here statically, and this module is loaded by\n * `register-routes.ts` the first time a request needs one of them: the\n * manifest loads Outreach's server bundle into every console API process\n * whether or not an Outreach route is ever called, and `org-permissions`\n * alone reaches the whole tenant data barrel. Loading them through one\n * module of this plugin keeps every import of the platform's libraries a\n * static one.\n */\n\nexport { lockdownRefusal, logOrgActivity, resolveOrgPermissions }\n\n/**\n * Whether the member holds a CATALOG permission (`data.manage`) as the\n * org's roles resolve it — custom role and per-member overrides included.\n * A lookup that failed has not shown the member holds it.\n */\nexport async function holdsOrgCatalogPermission(uid: string, orgId: string, key: string): Promise<boolean> {\n  try {\n    const membership = await resolveOrgMembership(uid, orgId)\n    if (!membership?.member) return false\n    return (\n      (await memberHasOrgPermission(\n        orgId,\n        membership.member,\n        key as Parameters<typeof memberHasOrgPermission>[2],\n      )) === true\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * The addresses a saved Contacts view selects among one site's contacts,\n * read by the dynamic-list sweep's own scan, and whether it reached the\n * whole view.\n */\nexport async function crmViewEmails(input: {\n  hostId: string\n  viewId: string\n}): Promise<{ emails: string[]; complete: boolean }> {\n  const scan = await collectDynamicListCandidates({\n    hostId: input.hostId,\n    rule: { sources: ['contacts'], viewId: input.viewId },\n  })\n  return { emails: scan.candidates.map((candidate) => candidate.email), complete: scan.complete }\n}\n"],"names":["collectDynamicListCandidates","lockdownRefusal","logOrgActivity","memberHasOrgPermission","resolveOrgMembership","resolveOrgPermissions","holdsOrgCatalogPermission","uid","orgId","key","membership","member","crmViewEmails","input","scan","hostId","rule","sources","viewId","emails","candidates","map","candidate","email","complete"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,4BAA4B,QAAQ,2DAA0D;AACvG,SAASC,eAAe,QAAQ,2CAA0C;AAC1E,SACEC,cAAc,EACdC,sBAAsB,EACtBC,oBAAoB,QACf,gDAA+C;AACtD,SAASC,qBAAqB,QAAQ,wCAAuC;AAE7E;;;;;;;;;;;;CAYC,GAED,SAASJ,eAAe,EAAEC,cAAc,EAAEG,qBAAqB,GAAE;AAEjE;;;;CAIC,GACD,OAAO,eAAeC,0BAA0BC,GAAW,EAAEC,KAAa,EAAEC,GAAW;IACrF,IAAI;QACF,MAAMC,aAAa,MAAMN,qBAAqBG,KAAKC;QACnD,IAAI,EAACE,8BAAAA,WAAYC,MAAM,GAAE,OAAO;QAChC,OACE,AAAC,MAAMR,uBACLK,OACAE,WAAWC,MAAM,EACjBF,SACK;IAEX,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeG,cAAcC,KAGnC;IACC,MAAMC,OAAO,MAAMd,6BAA6B;QAC9Ce,QAAQF,MAAME,MAAM;QACpBC,MAAM;YAAEC,SAAS;gBAAC;aAAW;YAAEC,QAAQL,MAAMK,MAAM;QAAC;IACtD;IACA,OAAO;QAAEC,QAAQL,KAAKM,UAAU,CAACC,GAAG,CAAC,CAACC,YAAcA,UAAUC,KAAK;QAAGC,UAAUV,KAAKU,QAAQ;IAAC;AAChG"}

package/src/lib/routes/preview-routes.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginWebApiHandler } from '@aglyn/aglyn/server';
+import type { OutreachRouteDeps } from './route-deps';
+/**
+ * ONE EMAIL OF A SAVED SEQUENCE, AS A PERSON WOULD GET IT (AGL-2980):
+ * `outreach/preview`.
+ *
+ * Written from what is stored — the sequence, the CRM template a step names,
+ * the mailbox it sends as, the organization's footer — by the engine's own
+ * composer (`previewOutreachStep`), for a real contact with the personal
+ * line the rep is writing, or for a sample person. The enroll dialog shows
+ * it beside each person before Confirm, so the rep reads the sentence they
+ * wrote in the email it goes into.
+ *
+ * A real contact is read from the CRM, so naming one asks for `data.manage`
+ * as enrolling does; the sample person asks for nothing more.
+ */
+export declare function createOutreachPreviewRoute(deps: OutreachRouteDeps): PluginWebApiHandler;

package/src/lib/routes/preview-routes.js

@@ -0,0 +1,117 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { consentGroupForHost } from "@aglyn/aglyn/app-utils/consent-groups";
+import { normalizeContactEmail } from "@aglyn/aglyn/app-utils/contacts";
+import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
+import { normalizeCrmEmailTemplate } from "@aglyn/aglyn/app-utils/crm-email-templates";
+import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
+import { firstEmailStepIndex } from "../engine/sequence-validation.js";
+import { OUTREACH_SAMPLE_PERSON, outreachSampleMergeContext, previewOutreachStep } from "../model/step-preview.js";
+import { readOutreachComplianceSettingsDoc } from "../storage/compliance-settings-store.js";
+import { outreachOrgCollection, readStoredOutreachMailbox, readStoredOutreachSequence } from "../storage/outreach-records.js";
+import { OUTREACH_READS_PEOPLE } from "./enroll-routes.js";
+import { outreachRouteGate } from "./route-gate.js";
+import { outreachMethodNotAllowed, outreachOk, outreachRefusal, readOutreachDocumentId, readOutreachJsonBody } from "./route-http.js";
+/**
+ * ONE EMAIL OF A SAVED SEQUENCE, AS A PERSON WOULD GET IT (AGL-2980):
+ * `outreach/preview`.
+ *
+ * Written from what is stored — the sequence, the CRM template a step names,
+ * the mailbox it sends as, the organization's footer — by the engine's own
+ * composer (`previewOutreachStep`), for a real contact with the personal
+ * line the rep is writing, or for a sample person. The enroll dialog shows
+ * it beside each person before Confirm, so the rep reads the sentence they
+ * wrote in the email it goes into.
+ *
+ * A real contact is read from the CRM, so naming one asks for `data.manage`
+ * as enrolling does; the sample person asks for nothing more.
+ */ export function createOutreachPreviewRoute(deps) {
+    return async (request)=>{
+        var _host_get, _normalizeContactEmail, _ref, _ref1;
+        var _result_email, _result_email1;
+        if (request.method !== 'POST') return outreachMethodNotAllowed('POST');
+        const body = await readOutreachJsonBody(request);
+        const contactId = body['contactId'] === undefined ? null : readOutreachDocumentId(body['contactId']);
+        if (body['contactId'] !== undefined && !contactId) {
+            return outreachRefusal(400, 'invalid-request', 'Name the contact to preview for.');
+        }
+        const caller = await outreachRouteGate(request, body['orgId'], deps.gate, contactId ? [
+            OUTREACH_READS_PEOPLE
+        ] : []);
+        if (caller instanceof Response) return caller;
+        const sequenceId = readOutreachDocumentId(body['sequenceId']);
+        if (!sequenceId) return outreachRefusal(400, 'invalid-request', 'Name the sequence to preview.');
+        const firestore = deps.firestore();
+        const org = firestore.collection('orgs').doc(caller.orgId);
+        const snapshot = await outreachOrgCollection(firestore, caller.orgId, 'sequences').doc(sequenceId).get();
+        const sequence = readStoredOutreachSequence(sequenceId, snapshot.exists ? snapshot.data() : undefined);
+        if (!sequence) return outreachRefusal(404, 'sequence-not-found', 'That sequence no longer exists.');
+        const requested = body['stepIndex'];
+        const stepIndex = typeof requested === 'number' ? requested : firstEmailStepIndex(sequence.steps);
+        const step = sequence.steps[stepIndex];
+        if ((step == null ? void 0 : step.kind) !== 'email') {
+            return outreachRefusal(400, 'invalid-request', 'That step does not send an email.');
+        }
+        const [orgSettings, mailboxSnapshot, host, template, contact] = await Promise.all([
+            readOutreachComplianceSettingsDoc(firestore, caller.orgId),
+            sequence.mailboxId ? outreachOrgCollection(firestore, caller.orgId, 'mailboxes').doc(sequence.mailboxId).get() : null,
+            sequence.hostId ? firestore.collection('hosts').doc(sequence.hostId).get() : null,
+            step.templateId ? org.collection(CRM_COLLECTIONS.emailTemplates).doc(step.templateId).get() : null,
+            contactId ? org.collection('contacts').doc(contactId).get() : null
+        ]);
+        const contactData = (contact == null ? void 0 : contact.exists) ? contact.data() : null;
+        if (contactId && (!contactData || !visibleToHost(contactData['visibleTo'], sequence.hostId))) {
+            return outreachRefusal(404, 'contact-not-found', "That contact isn't in this sequence's site's CRM.");
+        }
+        const mailbox = readStoredOutreachMailbox(sequence.mailboxId, (mailboxSnapshot == null ? void 0 : mailboxSnapshot.exists) ? mailboxSnapshot.data() : undefined);
+        const sender = mailbox ? {
+            name: mailbox.displayName,
+            email: mailbox.sendAs || mailbox.email
+        } : null;
+        const siteName = (host == null ? void 0 : host.exists) ? String((_host_get = host.get('name')) != null ? _host_get : '') : '';
+        const merge = contactData ? {
+            contact: contactData,
+            contactGroupId: consentGroupForHost(caller.org, sequence.hostId).groupId,
+            sender,
+            site: {
+                name: siteName
+            }
+        } : outreachSampleMergeContext({
+            sender,
+            siteName
+        });
+        const personalLine = typeof body['personalLine'] === 'string' ? body['personalLine'] : contactData ? '' : OUTREACH_SAMPLE_PERSON.personalLine;
+        const result = previewOutreachStep({
+            steps: sequence.steps,
+            stepIndex,
+            orgSettings,
+            merge,
+            email: contactData ? (_normalizeContactEmail = normalizeContactEmail(contactData['email'])) != null ? _normalizeContactEmail : '' : OUTREACH_SAMPLE_PERSON.email,
+            personalLine,
+            templateBody: (template == null ? void 0 : template.exists) ? normalizeCrmEmailTemplate(template.data()).body : null
+        });
+        return outreachOk({
+            ok: true,
+            stepIndex,
+            subject: (_ref = (_result_email = result.email) == null ? void 0 : _result_email.subject) != null ? _ref : '',
+            text: (_ref1 = (_result_email1 = result.email) == null ? void 0 : _result_email1.text) != null ? _ref1 : '',
+            unresolvedFields: result.unresolvedFields,
+            error: result.error
+        });
+    };
+}
+
+//# sourceMappingURL=preview-routes.js.map

package/src/lib/routes/preview-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/routes/preview-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { consentGroupForHost } from '@aglyn/aglyn/app-utils/consent-groups'\nimport { normalizeContactEmail } from '@aglyn/aglyn/app-utils/contacts'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { normalizeCrmEmailTemplate } from '@aglyn/aglyn/app-utils/crm-email-templates'\nimport { visibleToHost } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport type { PluginWebApiHandler } from '@aglyn/aglyn/server'\nimport { firstEmailStepIndex } from '../engine/sequence-validation'\nimport type { OutreachPreviewResponse } from '../model/outreach-api'\nimport {\n  OUTREACH_SAMPLE_PERSON,\n  outreachSampleMergeContext,\n  previewOutreachStep,\n} from '../model/step-preview'\nimport { readOutreachComplianceSettingsDoc } from '../storage/compliance-settings-store'\nimport {\n  outreachOrgCollection,\n  readStoredOutreachMailbox,\n  readStoredOutreachSequence,\n} from '../storage/outreach-records'\nimport { OUTREACH_READS_PEOPLE } from './enroll-routes'\nimport type { OutreachRouteDeps } from './route-deps'\nimport { outreachRouteGate } from './route-gate'\nimport {\n  outreachMethodNotAllowed,\n  outreachOk,\n  outreachRefusal,\n  readOutreachDocumentId,\n  readOutreachJsonBody,\n} from './route-http'\n\n/**\n * ONE EMAIL OF A SAVED SEQUENCE, AS A PERSON WOULD GET IT (AGL-2980):\n * `outreach/preview`.\n *\n * Written from what is stored — the sequence, the CRM template a step names,\n * the mailbox it sends as, the organization's footer — by the engine's own\n * composer (`previewOutreachStep`), for a real contact with the personal\n * line the rep is writing, or for a sample person. The enroll dialog shows\n * it beside each person before Confirm, so the rep reads the sentence they\n * wrote in the email it goes into.\n *\n * A real contact is read from the CRM, so naming one asks for `data.manage`\n * as enrolling does; the sample person asks for nothing more.\n */\n\nexport function createOutreachPreviewRoute(deps: OutreachRouteDeps): PluginWebApiHandler {\n  return async (request) => {\n    if (request.method !== 'POST') return outreachMethodNotAllowed('POST')\n    const body = await readOutreachJsonBody(request)\n    const contactId = body['contactId'] === undefined ? null : readOutreachDocumentId(body['contactId'])\n    if (body['contactId'] !== undefined && !contactId) {\n      return outreachRefusal(400, 'invalid-request', 'Name the contact to preview for.')\n    }\n    const caller = await outreachRouteGate(\n      request,\n      body['orgId'],\n      deps.gate,\n      contactId ? [OUTREACH_READS_PEOPLE] : [],\n    )\n    if (caller instanceof Response) return caller\n    const sequenceId = readOutreachDocumentId(body['sequenceId'])\n    if (!sequenceId) return outreachRefusal(400, 'invalid-request', 'Name the sequence to preview.')\n    const firestore = deps.firestore()\n    const org = firestore.collection('orgs').doc(caller.orgId)\n    const snapshot = await outreachOrgCollection(firestore, caller.orgId, 'sequences').doc(sequenceId).get()\n    const sequence = readStoredOutreachSequence(sequenceId, snapshot.exists ? snapshot.data() : undefined)\n    if (!sequence) return outreachRefusal(404, 'sequence-not-found', 'That sequence no longer exists.')\n\n    const requested = body['stepIndex']\n    const stepIndex = typeof requested === 'number' ? requested : firstEmailStepIndex(sequence.steps)\n    const step = sequence.steps[stepIndex]\n    if (step?.kind !== 'email') {\n      return outreachRefusal(400, 'invalid-request', 'That step does not send an email.')\n    }\n\n    const [orgSettings, mailboxSnapshot, host, template, contact] = await Promise.all([\n      readOutreachComplianceSettingsDoc(firestore, caller.orgId),\n      sequence.mailboxId ? outreachOrgCollection(firestore, caller.orgId, 'mailboxes').doc(sequence.mailboxId).get() : null,\n      sequence.hostId ? firestore.collection('hosts').doc(sequence.hostId).get() : null,\n      step.templateId ? org.collection(CRM_COLLECTIONS.emailTemplates).doc(step.templateId).get() : null,\n      contactId ? org.collection('contacts').doc(contactId).get() : null,\n    ])\n    const contactData = contact?.exists ? (contact.data() as Record<string, unknown>) : null\n    if (\n      contactId &&\n      (!contactData || !visibleToHost(contactData['visibleTo'] as string[] | undefined, sequence.hostId))\n    ) {\n      return outreachRefusal(404, 'contact-not-found', \"That contact isn't in this sequence's site's CRM.\")\n    }\n    const mailbox = readStoredOutreachMailbox(\n      sequence.mailboxId,\n      mailboxSnapshot?.exists ? mailboxSnapshot.data() : undefined,\n    )\n    const sender = mailbox ? { name: mailbox.displayName, email: mailbox.sendAs || mailbox.email } : null\n    const siteName = host?.exists ? String(host.get('name') ?? '') : ''\n    const merge = contactData\n      ? {\n          contact: contactData,\n          contactGroupId: consentGroupForHost(caller.org, sequence.hostId).groupId,\n          sender,\n          site: { name: siteName },\n        }\n      : outreachSampleMergeContext({ sender, siteName })\n    const personalLine =\n      typeof body['personalLine'] === 'string'\n        ? body['personalLine']\n        : contactData\n          ? ''\n          : OUTREACH_SAMPLE_PERSON.personalLine\n    const result = previewOutreachStep({\n      steps: sequence.steps,\n      stepIndex,\n      orgSettings,\n      merge,\n      email: contactData ? (normalizeContactEmail(contactData['email']) ?? '') : OUTREACH_SAMPLE_PERSON.email,\n      personalLine,\n      templateBody: template?.exists\n        ? normalizeCrmEmailTemplate(template.data() as Record<string, unknown>).body\n        : null,\n    })\n    return outreachOk({\n      ok: true,\n      stepIndex,\n      subject: result.email?.subject ?? '',\n      text: result.email?.text ?? '',\n      unresolvedFields: result.unresolvedFields,\n      error: result.error,\n    } satisfies OutreachPreviewResponse)\n  }\n}\n"],"names":["consentGroupForHost","normalizeContactEmail","CRM_COLLECTIONS","normalizeCrmEmailTemplate","visibleToHost","firstEmailStepIndex","OUTREACH_SAMPLE_PERSON","outreachSampleMergeContext","previewOutreachStep","readOutreachComplianceSettingsDoc","outreachOrgCollection","readStoredOutreachMailbox","readStoredOutreachSequence","OUTREACH_READS_PEOPLE","outreachRouteGate","outreachMethodNotAllowed","outreachOk","outreachRefusal","readOutreachDocumentId","readOutreachJsonBody","createOutreachPreviewRoute","deps","request","host","result","method","body","contactId","undefined","caller","gate","Response","sequenceId","firestore","org","collection","doc","orgId","snapshot","get","sequence","exists","data","requested","stepIndex","steps","step","kind","orgSettings","mailboxSnapshot","template","contact","Promise","all","mailboxId","hostId","templateId","emailTemplates","contactData","mailbox","sender","name","displayName","email","sendAs","siteName","String","merge","contactGroupId","groupId","site","personalLine","templateBody","ok","subject","text","unresolvedFields","error"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,mBAAmB,QAAQ,wCAAuC;AAC3E,SAASC,qBAAqB,QAAQ,kCAAiC;AACvE,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,yBAAyB,QAAQ,6CAA4C;AACtF,SAASC,aAAa,QAAQ,sCAAqC;AAEnE,SAASC,mBAAmB,QAAQ,mCAA+B;AAEnE,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,mBAAmB,QACd,2BAAuB;AAC9B,SAASC,iCAAiC,QAAQ,0CAAsC;AACxF,SACEC,qBAAqB,EACrBC,yBAAyB,EACzBC,0BAA0B,QACrB,iCAA6B;AACpC,SAASC,qBAAqB,QAAQ,qBAAiB;AAEvD,SAASC,iBAAiB,QAAQ,kBAAc;AAChD,SACEC,wBAAwB,EACxBC,UAAU,EACVC,eAAe,EACfC,sBAAsB,EACtBC,oBAAoB,QACf,kBAAc;AAErB;;;;;;;;;;;;;CAaC,GAED,OAAO,SAASC,2BAA2BC,IAAuB;IAChE,OAAO,OAAOC;YAgD2BC,WAoBftB;YASbuB,eACHA;QA7ER,IAAIF,QAAQG,MAAM,KAAK,QAAQ,OAAOV,yBAAyB;QAC/D,MAAMW,OAAO,MAAMP,qBAAqBG;QACxC,MAAMK,YAAYD,IAAI,CAAC,YAAY,KAAKE,YAAY,OAAOV,uBAAuBQ,IAAI,CAAC,YAAY;QACnG,IAAIA,IAAI,CAAC,YAAY,KAAKE,aAAa,CAACD,WAAW;YACjD,OAAOV,gBAAgB,KAAK,mBAAmB;QACjD;QACA,MAAMY,SAAS,MAAMf,kBACnBQ,SACAI,IAAI,CAAC,QAAQ,EACbL,KAAKS,IAAI,EACTH,YAAY;YAACd;SAAsB,GAAG,EAAE;QAE1C,IAAIgB,kBAAkBE,UAAU,OAAOF;QACvC,MAAMG,aAAad,uBAAuBQ,IAAI,CAAC,aAAa;QAC5D,IAAI,CAACM,YAAY,OAAOf,gBAAgB,KAAK,mBAAmB;QAChE,MAAMgB,YAAYZ,KAAKY,SAAS;QAChC,MAAMC,MAAMD,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACP,OAAOQ,KAAK;QACzD,MAAMC,WAAW,MAAM5B,sBAAsBuB,WAAWJ,OAAOQ,KAAK,EAAE,aAAaD,GAAG,CAACJ,YAAYO,GAAG;QACtG,MAAMC,WAAW5B,2BAA2BoB,YAAYM,SAASG,MAAM,GAAGH,SAASI,IAAI,KAAKd;QAC5F,IAAI,CAACY,UAAU,OAAOvB,gBAAgB,KAAK,sBAAsB;QAEjE,MAAM0B,YAAYjB,IAAI,CAAC,YAAY;QACnC,MAAMkB,YAAY,OAAOD,cAAc,WAAWA,YAAYtC,oBAAoBmC,SAASK,KAAK;QAChG,MAAMC,OAAON,SAASK,KAAK,CAACD,UAAU;QACtC,IAAIE,CAAAA,wBAAAA,KAAMC,IAAI,MAAK,SAAS;YAC1B,OAAO9B,gBAAgB,KAAK,mBAAmB;QACjD;QAEA,MAAM,CAAC+B,aAAaC,iBAAiB1B,MAAM2B,UAAUC,QAAQ,GAAG,MAAMC,QAAQC,GAAG,CAAC;YAChF5C,kCAAkCwB,WAAWJ,OAAOQ,KAAK;YACzDG,SAASc,SAAS,GAAG5C,sBAAsBuB,WAAWJ,OAAOQ,KAAK,EAAE,aAAaD,GAAG,CAACI,SAASc,SAAS,EAAEf,GAAG,KAAK;YACjHC,SAASe,MAAM,GAAGtB,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACI,SAASe,MAAM,EAAEhB,GAAG,KAAK;YAC7EO,KAAKU,UAAU,GAAGtB,IAAIC,UAAU,CAACjC,gBAAgBuD,cAAc,EAAErB,GAAG,CAACU,KAAKU,UAAU,EAAEjB,GAAG,KAAK;YAC9FZ,YAAYO,IAAIC,UAAU,CAAC,YAAYC,GAAG,CAACT,WAAWY,GAAG,KAAK;SAC/D;QACD,MAAMmB,cAAcP,CAAAA,2BAAAA,QAASV,MAAM,IAAIU,QAAQT,IAAI,KAAiC;QACpF,IACEf,aACC,CAAA,CAAC+B,eAAe,CAACtD,cAAcsD,WAAW,CAAC,YAAY,EAA0BlB,SAASe,MAAM,CAAA,GACjG;YACA,OAAOtC,gBAAgB,KAAK,qBAAqB;QACnD;QACA,MAAM0C,UAAUhD,0BACd6B,SAASc,SAAS,EAClBL,CAAAA,mCAAAA,gBAAiBR,MAAM,IAAGQ,gBAAgBP,IAAI,KAAKd;QAErD,MAAMgC,SAASD,UAAU;YAAEE,MAAMF,QAAQG,WAAW;YAAEC,OAAOJ,QAAQK,MAAM,IAAIL,QAAQI,KAAK;QAAC,IAAI;QACjG,MAAME,WAAW1C,CAAAA,wBAAAA,KAAMkB,MAAM,IAAGyB,QAAO3C,YAAAA,KAAKgB,GAAG,CAAC,mBAAThB,YAAoB,MAAM;QACjE,MAAM4C,QAAQT,cACV;YACEP,SAASO;YACTU,gBAAgBpE,oBAAoB6B,OAAOK,GAAG,EAAEM,SAASe,MAAM,EAAEc,OAAO;YACxET;YACAU,MAAM;gBAAET,MAAMI;YAAS;QACzB,IACA1D,2BAA2B;YAAEqD;YAAQK;QAAS;QAClD,MAAMM,eACJ,OAAO7C,IAAI,CAAC,eAAe,KAAK,WAC5BA,IAAI,CAAC,eAAe,GACpBgC,cACE,KACApD,uBAAuBiE,YAAY;QAC3C,MAAM/C,SAAShB,oBAAoB;YACjCqC,OAAOL,SAASK,KAAK;YACrBD;YACAI;YACAmB;YACAJ,OAAOL,eAAezD,yBAAAA,sBAAsByD,WAAW,CAAC,QAAQ,aAA1CzD,yBAA+C,KAAMK,uBAAuByD,KAAK;YACvGQ;YACAC,cAActB,CAAAA,4BAAAA,SAAUT,MAAM,IAC1BtC,0BAA0B+C,SAASR,IAAI,IAA+BhB,IAAI,GAC1E;QACN;QACA,OAAOV,WAAW;YAChByD,IAAI;YACJ7B;YACA8B,OAAO,WAAElD,gBAAAA,OAAOuC,KAAK,qBAAZvC,cAAckD,OAAO,mBAAI;YAClCC,IAAI,YAAEnD,iBAAAA,OAAOuC,KAAK,qBAAZvC,eAAcmD,IAAI,oBAAI;YAC5BC,kBAAkBpD,OAAOoD,gBAAgB;YACzCC,OAAOrD,OAAOqD,KAAK;QACrB;IACF;AACF"}

package/src/lib/routes/register-routes.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type OutreachEnrollRouteDeps } from './enroll-routes';
+import type { OutreachRouteGateDeps } from './route-gate';
+/** The gate's reach into the platform. */
+export declare function defaultOutreachRouteGateDeps(): OutreachRouteGateDeps;
+export declare function defaultOutreachRouteDeps(): OutreachEnrollRouteDeps;
+export declare function registerOutreachRoutes(deps?: OutreachEnrollRouteDeps): void;

package/src/lib/routes/register-routes.js

@@ -0,0 +1,92 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginApiRoute } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { OUTREACH_API_ROUTES } from "../constants/api-routes.js";
+import { outreachOrgSubject } from "../mailboxes/register-mailbox-routes.js";
+import { createOutreachEnrollRoutes } from "./enroll-routes.js";
+import { createOutreachEnrollmentActionRoute } from "./enrollment-routes.js";
+import { createOutreachPreviewRoute } from "./preview-routes.js";
+import { createOutreachSequenceRoutes } from "./sequence-routes.js";
+import { createOutreachSettingsRoute } from "./settings-routes.js";
+/**
+ * Wires the settings, sequence and enrollment routes into the console
+ * dispatcher (AGL-2980) with the platform's own dependencies. Specs build
+ * their own.
+ *
+ * Every one names its organization (`orgId`, in the query or the JSON body)
+ * and none names a site, so each declares the mailbox routes' subject reader:
+ * the dispatcher's release gate then asks about that organization, and a
+ * `release_outreach` override for one organization reaches these routes as it
+ * reaches Mailboxes. Without it the gate reads the request as anonymous, which
+ * only a fully enabled flag or a staff session passes.
+ */ /** The platform's heavier modules, loaded the first time a request needs one. */ const platform = ()=>import("./platform-deps.js");
+/** The gate's reach into the platform. */ export function defaultOutreachRouteGateDeps() {
+    return {
+        verifyIdToken: (idToken)=>firebaseAdmin.app().auth().verifyIdToken(idToken),
+        resolveOrgPermissions: async (uid, context)=>(await platform()).resolveOrgPermissions(uid, context),
+        holdsOrgCatalogPermission: async (uid, orgId, key)=>(await platform()).holdsOrgCatalogPermission(uid, orgId, key),
+        readOrg: async (orgId)=>{
+            var _snapshot_data;
+            const snapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(orgId).get();
+            return snapshot.exists ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {} : null;
+        },
+        lockdownRefusal: async (options)=>(await platform()).lockdownRefusal(options)
+    };
+}
+export function defaultOutreachRouteDeps() {
+    return {
+        firestore: ()=>firebaseAdmin.app().firestore(),
+        gate: defaultOutreachRouteGateDeps(),
+        now: Date.now,
+        random: Math.random,
+        logOrgActivity: async (orgId, actor, action, target)=>(await platform()).logOrgActivity(orgId, actor, action, target),
+        crmViewEmails: async (input)=>(await platform()).crmViewEmails(input)
+    };
+}
+export function registerOutreachRoutes(deps = defaultOutreachRouteDeps()) {
+    const sequences = createOutreachSequenceRoutes(deps);
+    const enroll = createOutreachEnrollRoutes(deps);
+    const orgSubject = {
+        subject: outreachOrgSubject
+    };
+    registerPluginApiRoute(OUTREACH_API_ROUTES.settings, {
+        web: createOutreachSettingsRoute(deps)
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.sequencesSave, {
+        web: sequences.save
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.sequencesStatus, {
+        web: sequences.status
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.sequencesDelete, {
+        web: sequences.remove
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.enrollPreview, {
+        web: enroll.preview
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.enroll, {
+        web: enroll.confirm
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.enrollmentsAction, {
+        web: createOutreachEnrollmentActionRoute(deps)
+    }, orgSubject);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.preview, {
+        web: createOutreachPreviewRoute(deps)
+    }, orgSubject);
+}
+
+//# sourceMappingURL=register-routes.js.map

package/src/lib/routes/register-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/routes/register-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { OUTREACH_API_ROUTES } from '../constants/api-routes'\nimport { outreachOrgSubject } from '../mailboxes/register-mailbox-routes'\nimport { createOutreachEnrollRoutes, type OutreachEnrollRouteDeps } from './enroll-routes'\nimport { createOutreachEnrollmentActionRoute } from './enrollment-routes'\nimport { createOutreachPreviewRoute } from './preview-routes'\nimport type { OutreachRouteGateDeps } from './route-gate'\nimport { createOutreachSequenceRoutes } from './sequence-routes'\nimport { createOutreachSettingsRoute } from './settings-routes'\n\n/**\n * Wires the settings, sequence and enrollment routes into the console\n * dispatcher (AGL-2980) with the platform's own dependencies. Specs build\n * their own.\n *\n * Every one names its organization (`orgId`, in the query or the JSON body)\n * and none names a site, so each declares the mailbox routes' subject reader:\n * the dispatcher's release gate then asks about that organization, and a\n * `release_outreach` override for one organization reaches these routes as it\n * reaches Mailboxes. Without it the gate reads the request as anonymous, which\n * only a fully enabled flag or a staff session passes.\n */\n\n/** The platform's heavier modules, loaded the first time a request needs one. */\nconst platform = () => import('./platform-deps')\n\n/** The gate's reach into the platform. */\nexport function defaultOutreachRouteGateDeps(): OutreachRouteGateDeps {\n  return {\n    verifyIdToken: (idToken) => firebaseAdmin.app().auth().verifyIdToken(idToken),\n    resolveOrgPermissions: async (uid, context) => (await platform()).resolveOrgPermissions(uid, context),\n    holdsOrgCatalogPermission: async (uid, orgId, key) =>\n      (await platform()).holdsOrgCatalogPermission(uid, orgId, key),\n    readOrg: async (orgId) => {\n      const snapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(orgId).get()\n      return snapshot.exists ? (snapshot.data() ?? {}) : null\n    },\n    lockdownRefusal: async (options) => (await platform()).lockdownRefusal(options),\n  }\n}\n\nexport function defaultOutreachRouteDeps(): OutreachEnrollRouteDeps {\n  return {\n    firestore: () => firebaseAdmin.app().firestore(),\n    gate: defaultOutreachRouteGateDeps(),\n    now: Date.now,\n    random: Math.random,\n    logOrgActivity: async (orgId, actor, action, target) =>\n      (await platform()).logOrgActivity(orgId, actor, action, target),\n    crmViewEmails: async (input) => (await platform()).crmViewEmails(input),\n  }\n}\n\nexport function registerOutreachRoutes(\n  deps: OutreachEnrollRouteDeps = defaultOutreachRouteDeps(),\n): void {\n  const sequences = createOutreachSequenceRoutes(deps)\n  const enroll = createOutreachEnrollRoutes(deps)\n  const orgSubject = { subject: outreachOrgSubject }\n  registerPluginApiRoute(OUTREACH_API_ROUTES.settings, { web: createOutreachSettingsRoute(deps) }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.sequencesSave, { web: sequences.save }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.sequencesStatus, { web: sequences.status }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.sequencesDelete, { web: sequences.remove }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.enrollPreview, { web: enroll.preview }, orgSubject)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.enroll, { web: enroll.confirm }, orgSubject)\n  registerPluginApiRoute(\n    OUTREACH_API_ROUTES.enrollmentsAction,\n    { web: createOutreachEnrollmentActionRoute(deps) },\n    orgSubject,\n  )\n  registerPluginApiRoute(OUTREACH_API_ROUTES.preview, { web: createOutreachPreviewRoute(deps) }, orgSubject)\n}\n"],"names":["registerPluginApiRoute","firebaseAdmin","OUTREACH_API_ROUTES","outreachOrgSubject","createOutreachEnrollRoutes","createOutreachEnrollmentActionRoute","createOutreachPreviewRoute","createOutreachSequenceRoutes","createOutreachSettingsRoute","platform","defaultOutreachRouteGateDeps","verifyIdToken","idToken","app","auth","resolveOrgPermissions","uid","context","holdsOrgCatalogPermission","orgId","key","readOrg","snapshot","firestore","collection","doc","get","exists","data","lockdownRefusal","options","defaultOutreachRouteDeps","gate","now","Date","random","Math","logOrgActivity","actor","action","target","crmViewEmails","input","registerOutreachRoutes","deps","sequences","enroll","orgSubject","subject","settings","web","sequencesSave","save","sequencesStatus","status","sequencesDelete","remove","enrollPreview","preview","confirm","enrollmentsAction"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,mBAAmB,QAAQ,6BAAyB;AAC7D,SAASC,kBAAkB,QAAQ,0CAAsC;AACzE,SAASC,0BAA0B,QAAsC,qBAAiB;AAC1F,SAASC,mCAAmC,QAAQ,yBAAqB;AACzE,SAASC,0BAA0B,QAAQ,sBAAkB;AAE7D,SAASC,4BAA4B,QAAQ,uBAAmB;AAChE,SAASC,2BAA2B,QAAQ,uBAAmB;AAE/D;;;;;;;;;;;CAWC,GAED,+EAA+E,GAC/E,MAAMC,WAAW,IAAM,MAAM,CAAC;AAE9B,wCAAwC,GACxC,OAAO,SAASC;IACd,OAAO;QACLC,eAAe,CAACC,UAAYX,cAAcY,GAAG,GAAGC,IAAI,GAAGH,aAAa,CAACC;QACrEG,uBAAuB,OAAOC,KAAKC,UAAY,AAAC,CAAA,MAAMR,UAAS,EAAGM,qBAAqB,CAACC,KAAKC;QAC7FC,2BAA2B,OAAOF,KAAKG,OAAOC,MAC5C,AAAC,CAAA,MAAMX,UAAS,EAAGS,yBAAyB,CAACF,KAAKG,OAAOC;QAC3DC,SAAS,OAAOF;gBAEYG;YAD1B,MAAMA,WAAW,MAAMrB,cAAcY,GAAG,GAAGU,SAAS,GAAGC,UAAU,CAAC,QAAQC,GAAG,CAACN,OAAOO,GAAG;YACxF,OAAOJ,SAASK,MAAM,IAAIL,iBAAAA,SAASM,IAAI,cAAbN,iBAAmB,CAAC,IAAK;QACrD;QACAO,iBAAiB,OAAOC,UAAY,AAAC,CAAA,MAAMrB,UAAS,EAAGoB,eAAe,CAACC;IACzE;AACF;AAEA,OAAO,SAASC;IACd,OAAO;QACLR,WAAW,IAAMtB,cAAcY,GAAG,GAAGU,SAAS;QAC9CS,MAAMtB;QACNuB,KAAKC,KAAKD,GAAG;QACbE,QAAQC,KAAKD,MAAM;QACnBE,gBAAgB,OAAOlB,OAAOmB,OAAOC,QAAQC,SAC3C,AAAC,CAAA,MAAM/B,UAAS,EAAG4B,cAAc,CAAClB,OAAOmB,OAAOC,QAAQC;QAC1DC,eAAe,OAAOC,QAAU,AAAC,CAAA,MAAMjC,UAAS,EAAGgC,aAAa,CAACC;IACnE;AACF;AAEA,OAAO,SAASC,uBACdC,OAAgCb,0BAA0B;IAE1D,MAAMc,YAAYtC,6BAA6BqC;IAC/C,MAAME,SAAS1C,2BAA2BwC;IAC1C,MAAMG,aAAa;QAAEC,SAAS7C;IAAmB;IACjDH,uBAAuBE,oBAAoB+C,QAAQ,EAAE;QAAEC,KAAK1C,4BAA4BoC;IAAM,GAAGG;IACjG/C,uBAAuBE,oBAAoBiD,aAAa,EAAE;QAAED,KAAKL,UAAUO,IAAI;IAAC,GAAGL;IACnF/C,uBAAuBE,oBAAoBmD,eAAe,EAAE;QAAEH,KAAKL,UAAUS,MAAM;IAAC,GAAGP;IACvF/C,uBAAuBE,oBAAoBqD,eAAe,EAAE;QAAEL,KAAKL,UAAUW,MAAM;IAAC,GAAGT;IACvF/C,uBAAuBE,oBAAoBuD,aAAa,EAAE;QAAEP,KAAKJ,OAAOY,OAAO;IAAC,GAAGX;IACnF/C,uBAAuBE,oBAAoB4C,MAAM,EAAE;QAAEI,KAAKJ,OAAOa,OAAO;IAAC,GAAGZ;IAC5E/C,uBACEE,oBAAoB0D,iBAAiB,EACrC;QAAEV,KAAK7C,oCAAoCuC;IAAM,GACjDG;IAEF/C,uBAAuBE,oBAAoBwD,OAAO,EAAE;QAAER,KAAK5C,2BAA2BsC;IAAM,GAAGG;AACjG"}

package/src/lib/routes/route-deps.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { OutreachRouteGateDeps } from './route-gate';
+/**
+ * What the settings, sequence and enrollment routes reach outside this
+ * plugin (AGL-2980). The platform's own are `register-routes.ts`; specs
+ * build their own.
+ */
+/**
+ * The org activity target a sequence's rows are filed under: Outreach's own
+ * namespaced resource (`pluginId:noun`), which the feed reads as "Sequence".
+ * Core's target list names only core's resources, so a plugin's never joins
+ * it.
+ */
+export declare const OUTREACH_SEQUENCE_ACTIVITY_TARGET = "outreach:sequence";
+/** What an org activity line written by these routes points at. */
+export type OutreachActivityTarget = {
+    type: 'org';
+    id: string;
+} | {
+    type: typeof OUTREACH_SEQUENCE_ACTIVITY_TARGET;
+    id: string;
+    name: string;
+};
+export interface OutreachRouteDeps {
+    firestore(): FirebaseFirestore.Firestore;
+    gate: OutreachRouteGateDeps;
+    now(): number;
+    /** A source of numbers in `[0, 1)` — the scheduler's jitter. */
+    random(): number;
+    logOrgActivity(orgId: string, actor: {
+        uid: string;
+        email?: string | null;
+    }, action: string, target: OutreachActivityTarget): Promise<void>;
+}

package/src/lib/routes/route-deps.js

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * What the settings, sequence and enrollment routes reach outside this
+ * plugin (AGL-2980). The platform's own are `register-routes.ts`; specs
+ * build their own.
+ */ /**
+ * The org activity target a sequence's rows are filed under: Outreach's own
+ * namespaced resource (`pluginId:noun`), which the feed reads as "Sequence".
+ * Core's target list names only core's resources, so a plugin's never joins
+ * it.
+ */ export const OUTREACH_SEQUENCE_ACTIVITY_TARGET = 'outreach:sequence';
+
+//# sourceMappingURL=route-deps.js.map

package/src/lib/routes/route-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/routes/route-deps.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { OutreachRouteGateDeps } from './route-gate'\n\n/**\n * What the settings, sequence and enrollment routes reach outside this\n * plugin (AGL-2980). The platform's own are `register-routes.ts`; specs\n * build their own.\n */\n\n/**\n * The org activity target a sequence's rows are filed under: Outreach's own\n * namespaced resource (`pluginId:noun`), which the feed reads as \"Sequence\".\n * Core's target list names only core's resources, so a plugin's never joins\n * it.\n */\nexport const OUTREACH_SEQUENCE_ACTIVITY_TARGET = 'outreach:sequence'\n\n/** What an org activity line written by these routes points at. */\nexport type OutreachActivityTarget =\n  | { type: 'org'; id: string }\n  | { type: typeof OUTREACH_SEQUENCE_ACTIVITY_TARGET; id: string; name: string }\n\nexport interface OutreachRouteDeps {\n  firestore(): FirebaseFirestore.Firestore\n  gate: OutreachRouteGateDeps\n  now(): number\n  /** A source of numbers in `[0, 1)` — the scheduler's jitter. */\n  random(): number\n  logOrgActivity(\n    orgId: string,\n    actor: { uid: string; email?: string | null },\n    action: string,\n    target: OutreachActivityTarget,\n  ): Promise<void>\n}\n"],"names":["OUTREACH_SEQUENCE_ACTIVITY_TARGET"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAID;;;;CAIC,GAED;;;;;CAKC,GACD,OAAO,MAAMA,oCAAoC,oBAAmB"}

package/src/lib/routes/route-gate.d.ts

@@ -0,0 +1,94 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { DecodedIdToken } from 'firebase-admin/auth';
+/**
+ * THE GATE EVERY SETTINGS, SEQUENCE AND ENROLLMENT ROUTE CLIMBS (AGL-2980).
+ *
+ * The console dispatcher has already refused a request while
+ * `release_outreach` is off for it, an unverified account's token, a
+ * lockdown with no org in scope, and a caller over the console rate limit —
+ * every route here is registered under the `outreach/` prefix, which is what
+ * puts it behind those. What the dispatcher cannot know is anything about
+ * the member, so each rung below is this plugin's:
+ *
+ *   401  no bearer token, or one the verifier refused
+ *   403  the account's address is unverified (an impersonation session is exempt)
+ *   400  the request did not name an organization
+ *   403  not a member of it, a site collaborator without org-wide reach, or
+ *        without `outreach.use` — or without a permission the route adds
+ *   403  the organization does not hold the `outreach` entitlement
+ *   423  lockdown, now with the organization and the account in scope
+ *
+ * The reach is org-wide for the reason the rules give: a sequence enrolls
+ * people from every site of the organization, so none of it is a fact
+ * about the one site a collaborator was invited to.
+ *
+ * `resolveOrgPermissions` is always given the concrete org id. Called
+ * without one it resolves a caller with no org at all as that future org's
+ * owner, which is right for a fresh signup and wrong for every question
+ * asked here.
+ */
+export interface OutreachRouteGateDeps {
+    verifyIdToken(idToken: string): Promise<DecodedIdToken>;
+    resolveOrgPermissions(uid: string, context: {
+        orgId: string;
+    }): Promise<{
+        orgId: string | null;
+        /** `null` when the account is not on the organization's roster. */
+        role: string | null;
+        isOwner: boolean;
+        orgWide: boolean;
+        permissions: Partial<Record<string, boolean | undefined>>;
+    }>;
+    /**
+     * Whether the member holds a CATALOG permission (`data.manage`) as the
+     * org's roles resolve it. Asked separately because the map
+     * `resolveOrgPermissions` answers carries the legacy keys and the plugins'
+     * own, never a catalog key: read there, a catalog key refuses everyone.
+     */
+    holdsOrgCatalogPermission(uid: string, orgId: string, key: string): Promise<boolean>;
+    readOrg(orgId: string): Promise<Record<string, unknown> | null>;
+    lockdownRefusal(options: {
+        request: Request;
+        staff: boolean;
+        uid: string;
+        org: Record<string, unknown>;
+    }): Promise<Response | null>;
+}
+/** Who is asking, once the gate let them through. */
+export interface OutreachRouteCaller {
+    uid: string;
+    /** The account's sign-in address, lower-cased, when the token carries one. */
+    email: string | null;
+    staff: boolean;
+    orgId: string;
+    /** The organization document the entitlement was read from. */
+    org: Record<string, unknown>;
+    /** An owner or admin of the organization, who may send from any member's mailbox. */
+    isOrgAdmin: boolean;
+}
+/**
+ * A catalog permission a route asks for beyond `outreach.use`, with its
+ * refusal — `data.manage` for a route that reads the CRM's people, which
+ * the contacts' own rules gate on.
+ */
+export interface OutreachRouteExtraPermission {
+    key: string;
+    /** Why the route needs it, as the refusal says it. */
+    refusal: string;
+}
+export declare function outreachRouteGate(request: Request, rawOrgId: unknown, deps: OutreachRouteGateDeps, extra?: readonly OutreachRouteExtraPermission[]): Promise<Response | OutreachRouteCaller>;