@aglyn/plugins-outreach 1.0.0-beta.143

package/src/lib/runtime/timeline.js

@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { OUTREACH_PLUGIN_ID } from "../constants/bundle-common.js";
+/**
+ * OUTREACH ON THE CONTACT'S TIMELINE (AGL-2981).
+ *
+ * Every email a sequence sends, every reply it reads, and every task it
+ * asks of the rep goes onto the contact's record through the core's
+ * record-timeline seam — whichever plugin keeps the workspace's records —
+ * never by writing that plugin's documents. An email is filed once per
+ * `Message-ID`, under the id the capture address would file a forwarded copy
+ * by; a task once per the key given here.
+ *
+ * The timeline is bookkeeping beside the act: an email has already left
+ * when it is filed, so a writer that refuses or fails is logged and the
+ * send stands. A workspace with no record system files nothing.
+ */ /** The record system's word for a step's task kind. */ export const OUTREACH_TASK_KIND_TO_RECORD = {
+    call: 'call',
+    linkedin: 'todo',
+    todo: 'todo'
+};
+/** Files one email on a contact; never throws. */ export async function fileOutreachEmail(deps, input) {
+    const writer = deps.timeline();
+    if (!writer) return null;
+    try {
+        var _input_byName, _input_inReplyTo;
+        const written = await writer.logActivity({
+            orgId: input.orgId,
+            hostId: input.hostId,
+            link: {
+                contactId: input.contactId
+            },
+            sourcePluginId: OUTREACH_PLUGIN_ID,
+            kind: 'email',
+            atMs: input.atMs,
+            body: input.body,
+            byUid: input.byUid,
+            byName: (_input_byName = input.byName) != null ? _input_byName : null,
+            email: {
+                direction: input.direction,
+                subject: input.subject,
+                from: input.from,
+                to: input.to,
+                messageId: input.messageId,
+                inReplyTo: (_input_inReplyTo = input.inReplyTo) != null ? _input_inReplyTo : null
+            }
+        });
+        if (written.ok === false) console.warn(`[outreach] the record system did not file an email: ${written.error}`);
+        return written;
+    } catch (error) {
+        console.error('[outreach] filing an email on the record failed', error);
+        return null;
+    }
+}
+/**
+ * Files one task on a contact. Answers the record system's answer, `null`
+ * when the workspace keeps no records; a writer that THROWS is the caller's,
+ * which a step waits out rather than completing without its task.
+ */ export async function fileOutreachTask(deps, input) {
+    var _input_notes;
+    const writer = deps.timeline();
+    if (!writer) return null;
+    return writer.createTask({
+        orgId: input.orgId,
+        hostId: input.hostId,
+        link: {
+            contactId: input.contactId
+        },
+        sourcePluginId: OUTREACH_PLUGIN_ID,
+        dedupeKey: input.dedupeKey,
+        title: input.title,
+        notes: (_input_notes = input.notes) != null ? _input_notes : null,
+        kind: input.kind,
+        dueAtMs: input.dueAtMs,
+        assigneeUid: input.assigneeUid,
+        createdByUid: ''
+    });
+}
+
+//# sourceMappingURL=timeline.js.map

package/src/lib/runtime/timeline.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/timeline.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  PluginRecordTaskKind,\n  PluginRecordWrite,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-timeline'\nimport { OUTREACH_PLUGIN_ID } from '../constants/bundle-common'\nimport type { OutreachTaskKind } from '../model/outreach.types'\nimport type { OutreachRuntimeDeps } from './runtime-deps'\n\n/**\n * OUTREACH ON THE CONTACT'S TIMELINE (AGL-2981).\n *\n * Every email a sequence sends, every reply it reads, and every task it\n * asks of the rep goes onto the contact's record through the core's\n * record-timeline seam — whichever plugin keeps the workspace's records —\n * never by writing that plugin's documents. An email is filed once per\n * `Message-ID`, under the id the capture address would file a forwarded copy\n * by; a task once per the key given here.\n *\n * The timeline is bookkeeping beside the act: an email has already left\n * when it is filed, so a writer that refuses or fails is logged and the\n * send stands. A workspace with no record system files nothing.\n */\n\n/** The record system's word for a step's task kind. */\nexport const OUTREACH_TASK_KIND_TO_RECORD: Record<OutreachTaskKind, PluginRecordTaskKind> = {\n  call: 'call',\n  linkedin: 'todo',\n  todo: 'todo',\n}\n\n/** Files one email on a contact; never throws. */\nexport async function fileOutreachEmail(\n  deps: Pick<OutreachRuntimeDeps, 'timeline'>,\n  input: {\n    orgId: string\n    hostId: string\n    contactId: string\n    direction: 'outbound' | 'inbound'\n    subject: string\n    from: string\n    to: string | null\n    messageId: string\n    inReplyTo?: string | null\n    body: string\n    atMs: number\n    byUid: string\n    byName?: string | null\n  },\n): Promise<PluginRecordWrite | null> {\n  const writer = deps.timeline()\n  if (!writer) return null\n  try {\n    const written = await writer.logActivity({\n      orgId: input.orgId,\n      hostId: input.hostId,\n      link: { contactId: input.contactId },\n      sourcePluginId: OUTREACH_PLUGIN_ID,\n      kind: 'email',\n      atMs: input.atMs,\n      body: input.body,\n      byUid: input.byUid,\n      byName: input.byName ?? null,\n      email: {\n        direction: input.direction,\n        subject: input.subject,\n        from: input.from,\n        to: input.to,\n        messageId: input.messageId,\n        inReplyTo: input.inReplyTo ?? null,\n      },\n    })\n    if (written.ok === false) console.warn(`[outreach] the record system did not file an email: ${written.error}`)\n    return written\n  } catch (error) {\n    console.error('[outreach] filing an email on the record failed', error)\n    return null\n  }\n}\n\n/**\n * Files one task on a contact. Answers the record system's answer, `null`\n * when the workspace keeps no records; a writer that THROWS is the caller's,\n * which a step waits out rather than completing without its task.\n */\nexport async function fileOutreachTask(\n  deps: Pick<OutreachRuntimeDeps, 'timeline'>,\n  input: {\n    orgId: string\n    hostId: string\n    contactId: string\n    dedupeKey: string\n    title: string\n    notes?: string | null\n    kind: PluginRecordTaskKind\n    dueAtMs: number\n    assigneeUid: string\n  },\n): Promise<PluginRecordWrite | null> {\n  const writer = deps.timeline()\n  if (!writer) return null\n  return writer.createTask({\n    orgId: input.orgId,\n    hostId: input.hostId,\n    link: { contactId: input.contactId },\n    sourcePluginId: OUTREACH_PLUGIN_ID,\n    dedupeKey: input.dedupeKey,\n    title: input.title,\n    notes: input.notes ?? null,\n    kind: input.kind,\n    dueAtMs: input.dueAtMs,\n    assigneeUid: input.assigneeUid,\n    createdByUid: '',\n  })\n}\n"],"names":["OUTREACH_PLUGIN_ID","OUTREACH_TASK_KIND_TO_RECORD","call","linkedin","todo","fileOutreachEmail","deps","input","writer","timeline","written","logActivity","orgId","hostId","link","contactId","sourcePluginId","kind","atMs","body","byUid","byName","email","direction","subject","from","to","messageId","inReplyTo","ok","console","warn","error","fileOutreachTask","createTask","dedupeKey","title","notes","dueAtMs","assigneeUid","createdByUid"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAMD,SAASA,kBAAkB,QAAQ,gCAA4B;AAI/D;;;;;;;;;;;;;CAaC,GAED,qDAAqD,GACrD,OAAO,MAAMC,+BAA+E;IAC1FC,MAAM;IACNC,UAAU;IACVC,MAAM;AACR,EAAC;AAED,gDAAgD,GAChD,OAAO,eAAeC,kBACpBC,IAA2C,EAC3CC,KAcC;IAED,MAAMC,SAASF,KAAKG,QAAQ;IAC5B,IAAI,CAACD,QAAQ,OAAO;IACpB,IAAI;YAUQD,eAOKA;QAhBf,MAAMG,UAAU,MAAMF,OAAOG,WAAW,CAAC;YACvCC,OAAOL,MAAMK,KAAK;YAClBC,QAAQN,MAAMM,MAAM;YACpBC,MAAM;gBAAEC,WAAWR,MAAMQ,SAAS;YAAC;YACnCC,gBAAgBhB;YAChBiB,MAAM;YACNC,MAAMX,MAAMW,IAAI;YAChBC,MAAMZ,MAAMY,IAAI;YAChBC,OAAOb,MAAMa,KAAK;YAClBC,MAAM,GAAEd,gBAAAA,MAAMc,MAAM,YAAZd,gBAAgB;YACxBe,OAAO;gBACLC,WAAWhB,MAAMgB,SAAS;gBAC1BC,SAASjB,MAAMiB,OAAO;gBACtBC,MAAMlB,MAAMkB,IAAI;gBAChBC,IAAInB,MAAMmB,EAAE;gBACZC,WAAWpB,MAAMoB,SAAS;gBAC1BC,SAAS,GAAErB,mBAAAA,MAAMqB,SAAS,YAAfrB,mBAAmB;YAChC;QACF;QACA,IAAIG,QAAQmB,EAAE,KAAK,OAAOC,QAAQC,IAAI,CAAC,CAAC,oDAAoD,EAAErB,QAAQsB,KAAK,EAAE;QAC7G,OAAOtB;IACT,EAAE,OAAOsB,OAAO;QACdF,QAAQE,KAAK,CAAC,mDAAmDA;QACjE,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,iBACpB3B,IAA2C,EAC3CC,KAUC;QAWQA;IATT,MAAMC,SAASF,KAAKG,QAAQ;IAC5B,IAAI,CAACD,QAAQ,OAAO;IACpB,OAAOA,OAAO0B,UAAU,CAAC;QACvBtB,OAAOL,MAAMK,KAAK;QAClBC,QAAQN,MAAMM,MAAM;QACpBC,MAAM;YAAEC,WAAWR,MAAMQ,SAAS;QAAC;QACnCC,gBAAgBhB;QAChBmC,WAAW5B,MAAM4B,SAAS;QAC1BC,OAAO7B,MAAM6B,KAAK;QAClBC,KAAK,GAAE9B,eAAAA,MAAM8B,KAAK,YAAX9B,eAAe;QACtBU,MAAMV,MAAMU,IAAI;QAChBqB,SAAS/B,MAAM+B,OAAO;QACtBC,aAAahC,MAAMgC,WAAW;QAC9BC,cAAc;IAChB;AACF"}

package/src/lib/runtime/unsubscribe-link.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE WAY OUT EVERY OUTREACH EMAIL CARRIES (AGL-2981).
+ *
+ * Two, in the `List-Unsubscribe` header, beside the footer's "reply no":
+ *
+ * - a signed HTTPS link on the console, `/api/outreach/unsubscribe?t=…`,
+ *   which a mailbox provider POSTs with no person present (RFC 8058) and a
+ *   mail client opens for a person;
+ * - a `mailto:` at the rep's own mailbox, `<name>+unsubscribe@<domain>`,
+ *   which the sync reads as an opt-out from whoever writes to it.
+ *
+ * ## The token
+ *
+ * `<payload>.<signature>`: the payload is base64url JSON naming the
+ * organization and the enrollment, and the signature is the platform's
+ * signed-link HMAC under Outreach's own purpose, so no other link verifies
+ * as this one and this one verifies as no other. It carries no address —
+ * the enrollment names the person, and a URL that lands in logs should not.
+ *
+ * It does not expire. CAN-SPAM holds an opt-out open for thirty days after
+ * the send, and a link that stops working on day thirty-one helps nobody:
+ * the only thing that retires one is rotating the signing secret
+ * (`EMAIL_UNSUBSCRIBE_SECRET`, else `CRON_SECRET`).
+ */
+/** The purpose Outreach's links are signed under. */
+export declare const OUTREACH_UNSUBSCRIBE_PURPOSE = "outreach-unsubscribe";
+/** The link's path on the console. */
+export declare const OUTREACH_UNSUBSCRIBE_PATH: string;
+/** The subaddress a mailbox's `mailto:` unsubscribe is written to. */
+export declare const OUTREACH_UNSUBSCRIBE_SUBADDRESS = "unsubscribe";
+/** What a token names. */
+export interface OutreachUnsubscribeTarget {
+    orgId: string;
+    enrollmentId: string;
+}
+/** A token for one enrollment, or `null` when there is no secret to sign it with. */
+export declare function mintOutreachUnsubscribeToken(target: OutreachUnsubscribeTarget, secret?: string): string | null;
+/** What a token names, or `null` for one that is malformed or not ours. */
+export declare function readOutreachUnsubscribeToken(token: unknown, secret?: string): OutreachUnsubscribeTarget | null;
+/**
+ * The HTTPS link for one enrollment on the console at `origin`, or `null`
+ * when the origin is not HTTPS or there is no secret — no link rather than
+ * one that points at nothing.
+ */
+export declare function outreachUnsubscribeUrl(input: {
+    origin: string | null | undefined;
+    target: OutreachUnsubscribeTarget;
+    secret?: string;
+}): string | null;
+/**
+ * The `mailto:` unsubscribe at a mailbox: its account address with the
+ * `+unsubscribe` subaddress, which Google Workspace delivers to the same
+ * mailbox and the sync reads apart from the rep's other mail. `null` for an
+ * address that is not one.
+ */
+export declare function outreachUnsubscribeMailbox(accountEmail: string): {
+    address: string;
+    uri: string;
+} | null;

package/src/lib/runtime/unsubscribe-link.js

@@ -0,0 +1,121 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { normalizeContactEmail } from "@aglyn/aglyn/app-utils/contacts";
+import { signedLinkSignature, signedLinkSignatureMatches } from "@aglyn/tenant-data-admin/server/email-unsubscribe-link";
+import { OUTREACH_API_ROUTES } from "../constants/api-routes.js";
+/**
+ * THE WAY OUT EVERY OUTREACH EMAIL CARRIES (AGL-2981).
+ *
+ * Two, in the `List-Unsubscribe` header, beside the footer's "reply no":
+ *
+ * - a signed HTTPS link on the console, `/api/outreach/unsubscribe?t=…`,
+ *   which a mailbox provider POSTs with no person present (RFC 8058) and a
+ *   mail client opens for a person;
+ * - a `mailto:` at the rep's own mailbox, `<name>+unsubscribe@<domain>`,
+ *   which the sync reads as an opt-out from whoever writes to it.
+ *
+ * ## The token
+ *
+ * `<payload>.<signature>`: the payload is base64url JSON naming the
+ * organization and the enrollment, and the signature is the platform's
+ * signed-link HMAC under Outreach's own purpose, so no other link verifies
+ * as this one and this one verifies as no other. It carries no address —
+ * the enrollment names the person, and a URL that lands in logs should not.
+ *
+ * It does not expire. CAN-SPAM holds an opt-out open for thirty days after
+ * the send, and a link that stops working on day thirty-one helps nobody:
+ * the only thing that retires one is rotating the signing secret
+ * (`EMAIL_UNSUBSCRIBE_SECRET`, else `CRON_SECRET`).
+ */ /** The purpose Outreach's links are signed under. */ export const OUTREACH_UNSUBSCRIBE_PURPOSE = 'outreach-unsubscribe';
+/** The link's path on the console. */ export const OUTREACH_UNSUBSCRIBE_PATH = `/api/${OUTREACH_API_ROUTES.unsubscribe}`;
+/** The subaddress a mailbox's `mailto:` unsubscribe is written to. */ export const OUTREACH_UNSUBSCRIBE_SUBADDRESS = 'unsubscribe';
+/** A document id as a token may carry one. */ const DOCUMENT_ID = /^[A-Za-z0-9_-]{1,160}$/;
+const base64url = (text)=>Buffer.from(text, 'utf8').toString('base64url');
+/** A token for one enrollment, or `null` when there is no secret to sign it with. */ export function mintOutreachUnsubscribeToken(target, secret) {
+    if (!DOCUMENT_ID.test(target.orgId) || !DOCUMENT_ID.test(target.enrollmentId)) return null;
+    const payload = base64url(JSON.stringify({
+        v: 1,
+        o: target.orgId,
+        e: target.enrollmentId
+    }));
+    const signature = secret === undefined ? signedLinkSignature(OUTREACH_UNSUBSCRIBE_PURPOSE, payload) : signedLinkSignature(OUTREACH_UNSUBSCRIBE_PURPOSE, payload, secret);
+    return signature ? `${payload}.${signature}` : null;
+}
+/** What a token names, or `null` for one that is malformed or not ours. */ export function readOutreachUnsubscribeToken(token, secret) {
+    const raw = typeof token === 'string' ? token.trim() : '';
+    const dot = raw.indexOf('.');
+    if (dot <= 0 || raw.length > 1024) return null;
+    const payload = raw.slice(0, dot);
+    const signature = raw.slice(dot + 1);
+    if (!signedLinkSignatureMatches(_extends({
+        purpose: OUTREACH_UNSUBSCRIBE_PURPOSE,
+        payload,
+        signature
+    }, secret === undefined ? {} : {
+        secret
+    }))) {
+        return null;
+    }
+    try {
+        var _body_o, _body_e;
+        const body = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        const orgId = String((_body_o = body['o']) != null ? _body_o : '');
+        const enrollmentId = String((_body_e = body['e']) != null ? _body_e : '');
+        if (body['v'] !== 1 || !DOCUMENT_ID.test(orgId) || !DOCUMENT_ID.test(enrollmentId)) return null;
+        return {
+            orgId,
+            enrollmentId
+        };
+    } catch (unused) {
+        return null;
+    }
+}
+/**
+ * The HTTPS link for one enrollment on the console at `origin`, or `null`
+ * when the origin is not HTTPS or there is no secret — no link rather than
+ * one that points at nothing.
+ */ export function outreachUnsubscribeUrl(input) {
+    let origin;
+    try {
+        var _input_origin;
+        origin = new URL(String((_input_origin = input.origin) != null ? _input_origin : ''));
+    } catch (unused) {
+        return null;
+    }
+    if (origin.protocol !== 'https:') return null;
+    const token = mintOutreachUnsubscribeToken(input.target, input.secret);
+    return token ? `${origin.origin}${OUTREACH_UNSUBSCRIBE_PATH}?t=${token}` : null;
+}
+/**
+ * The `mailto:` unsubscribe at a mailbox: its account address with the
+ * `+unsubscribe` subaddress, which Google Workspace delivers to the same
+ * mailbox and the sync reads apart from the rep's other mail. `null` for an
+ * address that is not one.
+ */ export function outreachUnsubscribeMailbox(accountEmail) {
+    const email = normalizeContactEmail(accountEmail);
+    if (!email) return null;
+    const at = email.lastIndexOf('@');
+    const local = email.slice(0, at).split('+')[0];
+    if (!local) return null;
+    const address = `${local}+${OUTREACH_UNSUBSCRIBE_SUBADDRESS}@${email.slice(at + 1)}`;
+    return {
+        address,
+        uri: `mailto:${address}?subject=unsubscribe`
+    };
+}
+
+//# sourceMappingURL=unsubscribe-link.js.map

package/src/lib/runtime/unsubscribe-link.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/unsubscribe-link.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { normalizeContactEmail } from '@aglyn/aglyn/app-utils/contacts'\nimport {\n  signedLinkSignature,\n  signedLinkSignatureMatches,\n} from '@aglyn/tenant-data-admin/server/email-unsubscribe-link'\nimport { OUTREACH_API_ROUTES } from '../constants/api-routes'\n\n/**\n * THE WAY OUT EVERY OUTREACH EMAIL CARRIES (AGL-2981).\n *\n * Two, in the `List-Unsubscribe` header, beside the footer's \"reply no\":\n *\n * - a signed HTTPS link on the console, `/api/outreach/unsubscribe?t=…`,\n *   which a mailbox provider POSTs with no person present (RFC 8058) and a\n *   mail client opens for a person;\n * - a `mailto:` at the rep's own mailbox, `<name>+unsubscribe@<domain>`,\n *   which the sync reads as an opt-out from whoever writes to it.\n *\n * ## The token\n *\n * `<payload>.<signature>`: the payload is base64url JSON naming the\n * organization and the enrollment, and the signature is the platform's\n * signed-link HMAC under Outreach's own purpose, so no other link verifies\n * as this one and this one verifies as no other. It carries no address —\n * the enrollment names the person, and a URL that lands in logs should not.\n *\n * It does not expire. CAN-SPAM holds an opt-out open for thirty days after\n * the send, and a link that stops working on day thirty-one helps nobody:\n * the only thing that retires one is rotating the signing secret\n * (`EMAIL_UNSUBSCRIBE_SECRET`, else `CRON_SECRET`).\n */\n\n/** The purpose Outreach's links are signed under. */\nexport const OUTREACH_UNSUBSCRIBE_PURPOSE = 'outreach-unsubscribe'\n\n/** The link's path on the console. */\nexport const OUTREACH_UNSUBSCRIBE_PATH = `/api/${OUTREACH_API_ROUTES.unsubscribe}`\n\n/** The subaddress a mailbox's `mailto:` unsubscribe is written to. */\nexport const OUTREACH_UNSUBSCRIBE_SUBADDRESS = 'unsubscribe'\n\n/** What a token names. */\nexport interface OutreachUnsubscribeTarget {\n  orgId: string\n  enrollmentId: string\n}\n\n/** A document id as a token may carry one. */\nconst DOCUMENT_ID = /^[A-Za-z0-9_-]{1,160}$/\n\nconst base64url = (text: string): string => Buffer.from(text, 'utf8').toString('base64url')\n\n/** A token for one enrollment, or `null` when there is no secret to sign it with. */\nexport function mintOutreachUnsubscribeToken(\n  target: OutreachUnsubscribeTarget,\n  secret?: string,\n): string | null {\n  if (!DOCUMENT_ID.test(target.orgId) || !DOCUMENT_ID.test(target.enrollmentId)) return null\n  const payload = base64url(JSON.stringify({ v: 1, o: target.orgId, e: target.enrollmentId }))\n  const signature =\n    secret === undefined\n      ? signedLinkSignature(OUTREACH_UNSUBSCRIBE_PURPOSE, payload)\n      : signedLinkSignature(OUTREACH_UNSUBSCRIBE_PURPOSE, payload, secret)\n  return signature ? `${payload}.${signature}` : null\n}\n\n/** What a token names, or `null` for one that is malformed or not ours. */\nexport function readOutreachUnsubscribeToken(\n  token: unknown,\n  secret?: string,\n): OutreachUnsubscribeTarget | null {\n  const raw = typeof token === 'string' ? token.trim() : ''\n  const dot = raw.indexOf('.')\n  if (dot <= 0 || raw.length > 1024) return null\n  const payload = raw.slice(0, dot)\n  const signature = raw.slice(dot + 1)\n  if (\n    !signedLinkSignatureMatches({\n      purpose: OUTREACH_UNSUBSCRIBE_PURPOSE,\n      payload,\n      signature,\n      ...(secret === undefined ? {} : { secret }),\n    })\n  ) {\n    return null\n  }\n  try {\n    const body = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>\n    const orgId = String(body['o'] ?? '')\n    const enrollmentId = String(body['e'] ?? '')\n    if (body['v'] !== 1 || !DOCUMENT_ID.test(orgId) || !DOCUMENT_ID.test(enrollmentId)) return null\n    return { orgId, enrollmentId }\n  } catch {\n    return null\n  }\n}\n\n/**\n * The HTTPS link for one enrollment on the console at `origin`, or `null`\n * when the origin is not HTTPS or there is no secret — no link rather than\n * one that points at nothing.\n */\nexport function outreachUnsubscribeUrl(input: {\n  origin: string | null | undefined\n  target: OutreachUnsubscribeTarget\n  secret?: string\n}): string | null {\n  let origin: URL\n  try {\n    origin = new URL(String(input.origin ?? ''))\n  } catch {\n    return null\n  }\n  if (origin.protocol !== 'https:') return null\n  const token = mintOutreachUnsubscribeToken(input.target, input.secret)\n  return token ? `${origin.origin}${OUTREACH_UNSUBSCRIBE_PATH}?t=${token}` : null\n}\n\n/**\n * The `mailto:` unsubscribe at a mailbox: its account address with the\n * `+unsubscribe` subaddress, which Google Workspace delivers to the same\n * mailbox and the sync reads apart from the rep's other mail. `null` for an\n * address that is not one.\n */\nexport function outreachUnsubscribeMailbox(accountEmail: string): { address: string; uri: string } | null {\n  const email = normalizeContactEmail(accountEmail)\n  if (!email) return null\n  const at = email.lastIndexOf('@')\n  const local = email.slice(0, at).split('+')[0]\n  if (!local) return null\n  const address = `${local}+${OUTREACH_UNSUBSCRIBE_SUBADDRESS}@${email.slice(at + 1)}`\n  return { address, uri: `mailto:${address}?subject=unsubscribe` }\n}\n"],"names":["normalizeContactEmail","signedLinkSignature","signedLinkSignatureMatches","OUTREACH_API_ROUTES","OUTREACH_UNSUBSCRIBE_PURPOSE","OUTREACH_UNSUBSCRIBE_PATH","unsubscribe","OUTREACH_UNSUBSCRIBE_SUBADDRESS","DOCUMENT_ID","base64url","text","Buffer","from","toString","mintOutreachUnsubscribeToken","target","secret","test","orgId","enrollmentId","payload","JSON","stringify","v","o","e","signature","undefined","readOutreachUnsubscribeToken","token","raw","trim","dot","indexOf","length","slice","purpose","body","parse","String","outreachUnsubscribeUrl","input","origin","URL","protocol","outreachUnsubscribeMailbox","accountEmail","email","at","lastIndexOf","local","split","address","uri"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,qBAAqB,QAAQ,kCAAiC;AACvE,SACEC,mBAAmB,EACnBC,0BAA0B,QACrB,yDAAwD;AAC/D,SAASC,mBAAmB,QAAQ,6BAAyB;AAE7D;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,mDAAmD,GACnD,OAAO,MAAMC,+BAA+B,uBAAsB;AAElE,oCAAoC,GACpC,OAAO,MAAMC,4BAA4B,CAAC,KAAK,EAAEF,oBAAoBG,WAAW,EAAE,CAAA;AAElF,oEAAoE,GACpE,OAAO,MAAMC,kCAAkC,cAAa;AAQ5D,4CAA4C,GAC5C,MAAMC,cAAc;AAEpB,MAAMC,YAAY,CAACC,OAAyBC,OAAOC,IAAI,CAACF,MAAM,QAAQG,QAAQ,CAAC;AAE/E,mFAAmF,GACnF,OAAO,SAASC,6BACdC,MAAiC,EACjCC,MAAe;IAEf,IAAI,CAACR,YAAYS,IAAI,CAACF,OAAOG,KAAK,KAAK,CAACV,YAAYS,IAAI,CAACF,OAAOI,YAAY,GAAG,OAAO;IACtF,MAAMC,UAAUX,UAAUY,KAAKC,SAAS,CAAC;QAAEC,GAAG;QAAGC,GAAGT,OAAOG,KAAK;QAAEO,GAAGV,OAAOI,YAAY;IAAC;IACzF,MAAMO,YACJV,WAAWW,YACP1B,oBAAoBG,8BAA8BgB,WAClDnB,oBAAoBG,8BAA8BgB,SAASJ;IACjE,OAAOU,YAAY,GAAGN,QAAQ,CAAC,EAAEM,WAAW,GAAG;AACjD;AAEA,yEAAyE,GACzE,OAAO,SAASE,6BACdC,KAAc,EACdb,MAAe;IAEf,MAAMc,MAAM,OAAOD,UAAU,WAAWA,MAAME,IAAI,KAAK;IACvD,MAAMC,MAAMF,IAAIG,OAAO,CAAC;IACxB,IAAID,OAAO,KAAKF,IAAII,MAAM,GAAG,MAAM,OAAO;IAC1C,MAAMd,UAAUU,IAAIK,KAAK,CAAC,GAAGH;IAC7B,MAAMN,YAAYI,IAAIK,KAAK,CAACH,MAAM;IAClC,IACE,CAAC9B,2BAA2B;QAC1BkC,SAAShC;QACTgB;QACAM;OACIV,WAAWW,YAAY,CAAC,IAAI;QAAEX;IAAO,KAE3C;QACA,OAAO;IACT;IACA,IAAI;YAEmBqB,SACOA;QAF5B,MAAMA,OAAOhB,KAAKiB,KAAK,CAAC3B,OAAOC,IAAI,CAACQ,SAAS,aAAaP,QAAQ,CAAC;QACnE,MAAMK,QAAQqB,QAAOF,UAAAA,IAAI,CAAC,IAAI,YAATA,UAAa;QAClC,MAAMlB,eAAeoB,QAAOF,UAAAA,IAAI,CAAC,IAAI,YAATA,UAAa;QACzC,IAAIA,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC7B,YAAYS,IAAI,CAACC,UAAU,CAACV,YAAYS,IAAI,CAACE,eAAe,OAAO;QAC3F,OAAO;YAAED;YAAOC;QAAa;IAC/B,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASqB,uBAAuBC,KAItC;IACC,IAAIC;IACJ,IAAI;YACsBD;QAAxBC,SAAS,IAAIC,IAAIJ,QAAOE,gBAAAA,MAAMC,MAAM,YAAZD,gBAAgB;IAC1C,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAIC,OAAOE,QAAQ,KAAK,UAAU,OAAO;IACzC,MAAMf,QAAQf,6BAA6B2B,MAAM1B,MAAM,EAAE0B,MAAMzB,MAAM;IACrE,OAAOa,QAAQ,GAAGa,OAAOA,MAAM,GAAGrC,0BAA0B,GAAG,EAAEwB,OAAO,GAAG;AAC7E;AAEA;;;;;CAKC,GACD,OAAO,SAASgB,2BAA2BC,YAAoB;IAC7D,MAAMC,QAAQ/C,sBAAsB8C;IACpC,IAAI,CAACC,OAAO,OAAO;IACnB,MAAMC,KAAKD,MAAME,WAAW,CAAC;IAC7B,MAAMC,QAAQH,MAAMZ,KAAK,CAAC,GAAGa,IAAIG,KAAK,CAAC,IAAI,CAAC,EAAE;IAC9C,IAAI,CAACD,OAAO,OAAO;IACnB,MAAME,UAAU,GAAGF,MAAM,CAAC,EAAE3C,gCAAgC,CAAC,EAAEwC,MAAMZ,KAAK,CAACa,KAAK,IAAI;IACpF,OAAO;QAAEI;QAASC,KAAK,CAAC,OAAO,EAAED,QAAQ,oBAAoB,CAAC;IAAC;AACjE"}

package/src/lib/runtime/unsubscribe-route.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginWebApiHandler } from '@aglyn/aglyn/server';
+import type { OutreachRuntimeDeps } from './runtime-deps';
+/** The plain page both methods answer with. */
+export declare function outreachUnsubscribePage(input: {
+    title: string;
+    body: string;
+}, status?: number): Response;
+export declare function createOutreachUnsubscribeRoute(deps: Pick<OutreachRuntimeDeps, 'firestore' | 'now' | 'optOutOfSalesTopic'>): PluginWebApiHandler;

package/src/lib/runtime/unsubscribe-route.js

@@ -0,0 +1,103 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { readOutreachComplianceSettingsDoc } from "../storage/compliance-settings-store.js";
+import { outreachOrgCollection, readStoredOutreachEnrollment } from "../storage/outreach-records.js";
+import { recordOutreachOptOut } from "./enrollment-events.js";
+import { readOutreachUnsubscribeToken } from "./unsubscribe-link.js";
+/**
+ * ONE-CLICK UNSUBSCRIBE (AGL-2981): `GET` and `POST /api/outreach/unsubscribe?t=…`.
+ *
+ * The link in every Outreach email's `List-Unsubscribe` header. A mailbox
+ * provider POSTs it with `List-Unsubscribe=One-Click` and no person present
+ * (RFC 8058); a mail client that opens it for a person sends a GET. BOTH
+ * act, and both answer a plain page saying it is done.
+ *
+ * That GET acts is deliberate, and the opposite of the platform's newsletter
+ * links. A person who used their mail client's Unsubscribe command has asked
+ * already, and a second button would be a way out with a hurdle in it. The
+ * one caller that could fetch the link without asking — a link scanner — can
+ * only make a cold sequence stop writing to somebody, which is the direction
+ * cold email should err in.
+ *
+ * No sign-in: the signature in the token is the authority, and a token that
+ * does not verify changes nothing. It is registered as a recipient link, so
+ * it answers whether or not Outreach is released to the organization now —
+ * an opt-out outlives a paused rollout. Each act is idempotent: the link
+ * used twice changes nothing the first use did not.
+ *
+ * What it records is what a reply saying "stop" records: the organization's
+ * do-not-contact list, the site's `sales` topic, and every open enrollment
+ * of the address stopped. An enrollment that no longer exists belongs to a
+ * person or a workspace already erased, whose every site already refuses
+ * them; the page says the same thing either way, and reveals nothing.
+ */ const PAGE_HEADERS = {
+    'Content-Type': 'text/html; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'X-Robots-Tag': 'noindex',
+    'Referrer-Policy': 'no-referrer'
+};
+const escapeHtml = (value)=>value.replace(/[&<>"']/g, (character)=>`&#${character.charCodeAt(0)};`);
+/** The plain page both methods answer with. */ export function outreachUnsubscribePage(input, status = 200) {
+    const html = '<!doctype html><html lang="en"><head><meta charset="utf-8">' + '<meta name="viewport" content="width=device-width, initial-scale=1">' + // The reader's own colors, light or dark: the page has no theme to take.
+    '<meta name="color-scheme" content="light dark">' + `<title>${escapeHtml(input.title)}</title>` + '<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5}h1{font-size:1.5rem}</style>' + `</head><body><main><h1>${escapeHtml(input.title)}</h1><p>${escapeHtml(input.body)}</p></main></body></html>`;
+    return new Response(html, {
+        status,
+        headers: PAGE_HEADERS
+    });
+}
+export function createOutreachUnsubscribeRoute(deps) {
+    return async (request)=>{
+        if (request.method !== 'GET' && request.method !== 'POST') {
+            return new Response('Method not allowed', {
+                status: 405,
+                headers: {
+                    Allow: 'GET, POST'
+                }
+            });
+        }
+        const target = readOutreachUnsubscribeToken(new URL(request.url).searchParams.get('t'));
+        if (!target) {
+            return outreachUnsubscribePage({
+                title: 'This link doesn’t work',
+                body: 'This unsubscribe link isn’t valid. To stop these emails, reply to one of them with “no”.'
+            }, 400);
+        }
+        const firestore = deps.firestore();
+        const snapshot = await outreachOrgCollection(firestore, target.orgId, 'enrollments').doc(target.enrollmentId).get();
+        const enrollment = readStoredOutreachEnrollment(target.enrollmentId, snapshot.exists ? snapshot.data() : undefined);
+        if (enrollment) {
+            await recordOutreachOptOut(deps, {
+                orgId: target.orgId,
+                email: enrollment.email,
+                source: 'unsubscribe',
+                enrollment,
+                hostIds: [
+                    enrollment.hostId
+                ],
+                detail: request.method === 'POST' ? 'One-click unsubscribe.' : 'Used the unsubscribe link.',
+                nowMs: deps.now()
+            });
+        }
+        const settings = await readOutreachComplianceSettingsDoc(firestore, target.orgId).catch(()=>null);
+        const sender = (settings == null ? void 0 : settings.brandName) || (settings == null ? void 0 : settings.legalName) || 'The sender';
+        return outreachUnsubscribePage({
+            title: 'You’re unsubscribed',
+            body: `${sender} won’t send you any more of these emails.`
+        });
+    };
+}
+
+//# sourceMappingURL=unsubscribe-route.js.map

package/src/lib/runtime/unsubscribe-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/unsubscribe-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginWebApiHandler } from '@aglyn/aglyn/server'\nimport { readOutreachComplianceSettingsDoc } from '../storage/compliance-settings-store'\nimport { outreachOrgCollection, readStoredOutreachEnrollment } from '../storage/outreach-records'\nimport { recordOutreachOptOut } from './enrollment-events'\nimport type { OutreachRuntimeDeps } from './runtime-deps'\nimport { readOutreachUnsubscribeToken } from './unsubscribe-link'\n\n/**\n * ONE-CLICK UNSUBSCRIBE (AGL-2981): `GET` and `POST /api/outreach/unsubscribe?t=…`.\n *\n * The link in every Outreach email's `List-Unsubscribe` header. A mailbox\n * provider POSTs it with `List-Unsubscribe=One-Click` and no person present\n * (RFC 8058); a mail client that opens it for a person sends a GET. BOTH\n * act, and both answer a plain page saying it is done.\n *\n * That GET acts is deliberate, and the opposite of the platform's newsletter\n * links. A person who used their mail client's Unsubscribe command has asked\n * already, and a second button would be a way out with a hurdle in it. The\n * one caller that could fetch the link without asking — a link scanner — can\n * only make a cold sequence stop writing to somebody, which is the direction\n * cold email should err in.\n *\n * No sign-in: the signature in the token is the authority, and a token that\n * does not verify changes nothing. It is registered as a recipient link, so\n * it answers whether or not Outreach is released to the organization now —\n * an opt-out outlives a paused rollout. Each act is idempotent: the link\n * used twice changes nothing the first use did not.\n *\n * What it records is what a reply saying \"stop\" records: the organization's\n * do-not-contact list, the site's `sales` topic, and every open enrollment\n * of the address stopped. An enrollment that no longer exists belongs to a\n * person or a workspace already erased, whose every site already refuses\n * them; the page says the same thing either way, and reveals nothing.\n */\n\nconst PAGE_HEADERS = {\n  'Content-Type': 'text/html; charset=utf-8',\n  'Cache-Control': 'no-store',\n  'X-Robots-Tag': 'noindex',\n  'Referrer-Policy': 'no-referrer',\n}\n\nconst escapeHtml = (value: string) =>\n  value.replace(/[&<>\"']/g, (character) => `&#${character.charCodeAt(0)};`)\n\n/** The plain page both methods answer with. */\nexport function outreachUnsubscribePage(input: { title: string; body: string }, status = 200): Response {\n  const html =\n    '<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">' +\n    '<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">' +\n    // The reader's own colors, light or dark: the page has no theme to take.\n    '<meta name=\"color-scheme\" content=\"light dark\">' +\n    `<title>${escapeHtml(input.title)}</title>` +\n    '<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5}h1{font-size:1.5rem}</style>' +\n    `</head><body><main><h1>${escapeHtml(input.title)}</h1><p>${escapeHtml(input.body)}</p></main></body></html>`\n  return new Response(html, { status, headers: PAGE_HEADERS })\n}\n\nexport function createOutreachUnsubscribeRoute(\n  deps: Pick<OutreachRuntimeDeps, 'firestore' | 'now' | 'optOutOfSalesTopic'>,\n): PluginWebApiHandler {\n  return async (request) => {\n    if (request.method !== 'GET' && request.method !== 'POST') {\n      return new Response('Method not allowed', { status: 405, headers: { Allow: 'GET, POST' } })\n    }\n    const target = readOutreachUnsubscribeToken(new URL(request.url).searchParams.get('t'))\n    if (!target) {\n      return outreachUnsubscribePage(\n        {\n          title: 'This link doesn’t work',\n          body: 'This unsubscribe link isn’t valid. To stop these emails, reply to one of them with “no”.',\n        },\n        400,\n      )\n    }\n    const firestore = deps.firestore()\n    const snapshot = await outreachOrgCollection(firestore, target.orgId, 'enrollments').doc(target.enrollmentId).get()\n    const enrollment = readStoredOutreachEnrollment(target.enrollmentId, snapshot.exists ? snapshot.data() : undefined)\n    if (enrollment) {\n      await recordOutreachOptOut(deps, {\n        orgId: target.orgId,\n        email: enrollment.email,\n        source: 'unsubscribe',\n        enrollment,\n        hostIds: [enrollment.hostId],\n        detail: request.method === 'POST' ? 'One-click unsubscribe.' : 'Used the unsubscribe link.',\n        nowMs: deps.now(),\n      })\n    }\n    const settings = await readOutreachComplianceSettingsDoc(firestore, target.orgId).catch(() => null)\n    const sender = settings?.brandName || settings?.legalName || 'The sender'\n    return outreachUnsubscribePage({\n      title: 'You’re unsubscribed',\n      body: `${sender} won’t send you any more of these emails.`,\n    })\n  }\n}\n"],"names":["readOutreachComplianceSettingsDoc","outreachOrgCollection","readStoredOutreachEnrollment","recordOutreachOptOut","readOutreachUnsubscribeToken","PAGE_HEADERS","escapeHtml","value","replace","character","charCodeAt","outreachUnsubscribePage","input","status","html","title","body","Response","headers","createOutreachUnsubscribeRoute","deps","request","method","Allow","target","URL","url","searchParams","get","firestore","snapshot","orgId","doc","enrollmentId","enrollment","exists","data","undefined","email","source","hostIds","hostId","detail","nowMs","now","settings","catch","sender","brandName","legalName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,iCAAiC,QAAQ,0CAAsC;AACxF,SAASC,qBAAqB,EAAEC,4BAA4B,QAAQ,iCAA6B;AACjG,SAASC,oBAAoB,QAAQ,yBAAqB;AAE1D,SAASC,4BAA4B,QAAQ,wBAAoB;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GAED,MAAMC,eAAe;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;AACrB;AAEA,MAAMC,aAAa,CAACC,QAClBA,MAAMC,OAAO,CAAC,YAAY,CAACC,YAAc,CAAC,EAAE,EAAEA,UAAUC,UAAU,CAAC,GAAG,CAAC,CAAC;AAE1E,6CAA6C,GAC7C,OAAO,SAASC,wBAAwBC,KAAsC,EAAEC,SAAS,GAAG;IAC1F,MAAMC,OACJ,gEACA,yEACA,yEAAyE;IACzE,oDACA,CAAC,OAAO,EAAER,WAAWM,MAAMG,KAAK,EAAE,QAAQ,CAAC,GAC3C,8IACA,CAAC,uBAAuB,EAAET,WAAWM,MAAMG,KAAK,EAAE,QAAQ,EAAET,WAAWM,MAAMI,IAAI,EAAE,yBAAyB,CAAC;IAC/G,OAAO,IAAIC,SAASH,MAAM;QAAED;QAAQK,SAASb;IAAa;AAC5D;AAEA,OAAO,SAASc,+BACdC,IAA2E;IAE3E,OAAO,OAAOC;QACZ,IAAIA,QAAQC,MAAM,KAAK,SAASD,QAAQC,MAAM,KAAK,QAAQ;YACzD,OAAO,IAAIL,SAAS,sBAAsB;gBAAEJ,QAAQ;gBAAKK,SAAS;oBAAEK,OAAO;gBAAY;YAAE;QAC3F;QACA,MAAMC,SAASpB,6BAA6B,IAAIqB,IAAIJ,QAAQK,GAAG,EAAEC,YAAY,CAACC,GAAG,CAAC;QAClF,IAAI,CAACJ,QAAQ;YACX,OAAOb,wBACL;gBACEI,OAAO;gBACPC,MAAM;YACR,GACA;QAEJ;QACA,MAAMa,YAAYT,KAAKS,SAAS;QAChC,MAAMC,WAAW,MAAM7B,sBAAsB4B,WAAWL,OAAOO,KAAK,EAAE,eAAeC,GAAG,CAACR,OAAOS,YAAY,EAAEL,GAAG;QACjH,MAAMM,aAAahC,6BAA6BsB,OAAOS,YAAY,EAAEH,SAASK,MAAM,GAAGL,SAASM,IAAI,KAAKC;QACzG,IAAIH,YAAY;YACd,MAAM/B,qBAAqBiB,MAAM;gBAC/BW,OAAOP,OAAOO,KAAK;gBACnBO,OAAOJ,WAAWI,KAAK;gBACvBC,QAAQ;gBACRL;gBACAM,SAAS;oBAACN,WAAWO,MAAM;iBAAC;gBAC5BC,QAAQrB,QAAQC,MAAM,KAAK,SAAS,2BAA2B;gBAC/DqB,OAAOvB,KAAKwB,GAAG;YACjB;QACF;QACA,MAAMC,WAAW,MAAM7C,kCAAkC6B,WAAWL,OAAOO,KAAK,EAAEe,KAAK,CAAC,IAAM;QAC9F,MAAMC,SAASF,CAAAA,4BAAAA,SAAUG,SAAS,MAAIH,4BAAAA,SAAUI,SAAS,KAAI;QAC7D,OAAOtC,wBAAwB;YAC7BI,OAAO;YACPC,MAAM,GAAG+B,OAAO,yCAAyC,CAAC;QAC5D;IACF;AACF"}

package/src/lib/server.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Outreach's SERVER half (AGL-2974), `@aglyn/plugins-outreach/server`.
+ *
+ * Every write to an `outreach*` collection is made here: the Firestore rules
+ * refuse all of them to clients, so a mailbox, a sequence, an enrollment and a
+ * credential only ever change through a handler registered below, behind the
+ * session, entitlement and permission checks that handler makes.
+ *
+ * `outreach/ping` exists so the wiring is proven rather than assumed, as the
+ * CRM's does: `plugins.config.json` names `registerOutreachConsoleApi` and the
+ * `outreach` prefix, the generated server manifest loads this module, and the
+ * console's `/api/[...pluginApi]` dispatcher reaches the handler — after its
+ * own gates, which already refuse a request while `release_outreach` is off
+ * for the caller. A first real route that also had to be the first wiring
+ * test would be two things to debug at once.
+ *
+ * A route that reads or writes org data resolves the caller the way the CRM's
+ * org routes do (`resolveOrgMembership` / `memberHasOrgPermission` from
+ * `@aglyn/tenant-data-admin`) and asks `checkEntitlement(org, 'outreach')`
+ * and `outreach.use` before it touches a document.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * No auth, no org, no data: it answers whether this server bundle was loaded
+ * and its routes registered, which is a fact about the process rather than
+ * about any workspace.
+ */
+export declare const outreachPingHandler: PluginApiHandler;
+/** Console API registration, named in `plugins.config.json` as `consoleApi`. */
+export declare function registerOutreachConsoleApi(): void;
+export { markOutreachMailboxReconnectRequired, openOutreachMailboxClient, type OpenedOutreachMailbox, } from './mailboxes/mailbox-transport';
+export { GmailTransportError, isReconnectRequired, type GmailTransportErrorCode, } from './transport/gmail-errors';
+export type { GmailClient, GmailFullThread, GmailMessageMetadata, GmailThread, } from './transport/gmail-client';
+export { buildRfc5322Message, encodeGmailRawMessage, LIST_UNSUBSCRIBE_ONE_CLICK, Rfc5322MessageError, type OutreachComposedMessage, type OutreachMailAddress, } from './transport/rfc5322';
+export { sendComposedOutreachEmail, sendOutreachMessage, type OutreachSentMessage, type SendOutreachMessageOptions, } from './transport/send-message';
+export { outreachComplianceSettingsRef, readOutreachComplianceSettingsDoc, writeOutreachComplianceSettings, type WriteOutreachComplianceSettingsInput, type WriteOutreachComplianceSettingsResult, } from './storage/compliance-settings-store';
+export { addOutreachDoNotContact, getOutreachDoNotContactEntry, isOutreachDoNotContact, lookupOutreachDoNotContact, outreachDoNotContactCollection, readOutreachDoNotContactEntry, type AddOutreachDoNotContactInput, type AddOutreachDoNotContactResult, } from './storage/do-not-contact-store';

package/src/lib/server.js

@@ -0,0 +1,94 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Outreach's SERVER half (AGL-2974), `@aglyn/plugins-outreach/server`.
+ *
+ * Every write to an `outreach*` collection is made here: the Firestore rules
+ * refuse all of them to clients, so a mailbox, a sequence, an enrollment and a
+ * credential only ever change through a handler registered below, behind the
+ * session, entitlement and permission checks that handler makes.
+ *
+ * `outreach/ping` exists so the wiring is proven rather than assumed, as the
+ * CRM's does: `plugins.config.json` names `registerOutreachConsoleApi` and the
+ * `outreach` prefix, the generated server manifest loads this module, and the
+ * console's `/api/[...pluginApi]` dispatcher reaches the handler — after its
+ * own gates, which already refuse a request while `release_outreach` is off
+ * for the caller. A first real route that also had to be the first wiring
+ * test would be two things to debug at once.
+ *
+ * A route that reads or writes org data resolves the caller the way the CRM's
+ * org routes do (`resolveOrgMembership` / `memberHasOrgPermission` from
+ * `@aglyn/tenant-data-admin`) and asks `checkEntitlement(org, 'outreach')`
+ * and `outreach.use` before it touches a document.
+ */ import { registerPluginApiRoute, registerPluginPermissions } from "@aglyn/aglyn/server";
+import { OUTREACH_API_ROUTES } from "./constants/api-routes.js";
+import { OUTREACH_PERMISSIONS, OUTREACH_PLUGIN_ID } from "./constants/bundle-common.js";
+import { registerOutreachMailboxRoutes } from "./mailboxes/register-mailbox-routes.js";
+import { registerOutreachRoutes } from "./routes/register-routes.js";
+/**
+ * No auth, no org, no data: it answers whether this server bundle was loaded
+ * and its routes registered, which is a fact about the process rather than
+ * about any workspace.
+ */ export const outreachPingHandler = (req, res)=>{
+    if (req.method !== 'GET') {
+        res.setHeader('Allow', 'GET');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    res.status(200).json({
+        ok: true,
+        plugin: OUTREACH_PLUGIN_ID
+    });
+};
+/** Console API registration, named in `plugins.config.json` as `consoleApi`. */ export function registerOutreachConsoleApi() {
+    // The server resolves plugin permission keys from this registry, so a
+    // route's `outreach.use` check and the console's gate read the same tier
+    // defaults.
+    registerPluginPermissions(OUTREACH_PERMISSIONS);
+    registerPluginApiRoute(OUTREACH_API_ROUTES.ping, outreachPingHandler);
+    // Connect a Google mailbox, its settings, pause, test and disconnect
+    // (AGL-2978).
+    registerOutreachMailboxRoutes();
+    // Compliance settings, sequences, enrollment and enrollment actions
+    // (AGL-2980).
+    registerOutreachRoutes();
+    // The one-click unsubscribe every email carries (AGL-2981): a recipient
+    // link, so it answers whether or not Outreach is released to the
+    // organization now. Its module loads on the first request.
+    registerPluginApiRoute(OUTREACH_API_ROUTES.unsubscribe, {
+        web: async (request, context)=>(await import("./runtime/platform-runtime-deps.js")).platformOutreachUnsubscribeRoute()(request, context)
+    }, {
+        recipientLink: true
+    });
+}
+// The transport the sending runtime reaches a connected mailbox through
+// (AGL-2978): open a mailbox's Gmail client, mark one reconnect-required,
+// send the engine's composed email through the one RFC 5322 writer, and read
+// a thread whole for the engine's reply and bounce classifier.
+export { markOutreachMailboxReconnectRequired, openOutreachMailboxClient } from "./mailboxes/mailbox-transport.js";
+export { GmailTransportError, isReconnectRequired } from "./transport/gmail-errors.js";
+export { buildRfc5322Message, encodeGmailRawMessage, LIST_UNSUBSCRIBE_ONE_CLICK, Rfc5322MessageError } from "./transport/rfc5322.js";
+export { sendComposedOutreachEmail, sendOutreachMessage } from "./transport/send-message.js";
+// The organization's compliance settings and do-not-contact list
+// (AGL-2980), for the sending runtime: the footer is read before every send,
+// the list is checked before every send, and a reply that opts out, an
+// unsubscribe and a hard bounce each put the address on it.
+export { outreachComplianceSettingsRef, readOutreachComplianceSettingsDoc, writeOutreachComplianceSettings } from "./storage/compliance-settings-store.js";
+export { addOutreachDoNotContact, getOutreachDoNotContactEntry, isOutreachDoNotContact, lookupOutreachDoNotContact, outreachDoNotContactCollection, readOutreachDoNotContactEntry } from "./storage/do-not-contact-store.js";
+
+//# sourceMappingURL=server.js.map