@aglyn/plugins-outreach 1.0.0-beta.143

package/src/lib/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/outreach/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Outreach's SERVER half (AGL-2974), `@aglyn/plugins-outreach/server`.\n *\n * Every write to an `outreach*` collection is made here: the Firestore rules\n * refuse all of them to clients, so a mailbox, a sequence, an enrollment and a\n * credential only ever change through a handler registered below, behind the\n * session, entitlement and permission checks that handler makes.\n *\n * `outreach/ping` exists so the wiring is proven rather than assumed, as the\n * CRM's does: `plugins.config.json` names `registerOutreachConsoleApi` and the\n * `outreach` prefix, the generated server manifest loads this module, and the\n * console's `/api/[...pluginApi]` dispatcher reaches the handler — after its\n * own gates, which already refuse a request while `release_outreach` is off\n * for the caller. A first real route that also had to be the first wiring\n * test would be two things to debug at once.\n *\n * A route that reads or writes org data resolves the caller the way the CRM's\n * org routes do (`resolveOrgMembership` / `memberHasOrgPermission` from\n * `@aglyn/tenant-data-admin`) and asks `checkEntitlement(org, 'outreach')`\n * and `outreach.use` before it touches a document.\n */\n\nimport {\n  registerPluginApiRoute,\n  registerPluginPermissions,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport { OUTREACH_API_ROUTES } from './constants/api-routes'\nimport {\n  OUTREACH_PERMISSIONS,\n  OUTREACH_PLUGIN_ID,\n} from './constants/bundle-common'\nimport { registerOutreachMailboxRoutes } from './mailboxes/register-mailbox-routes'\nimport { registerOutreachRoutes } from './routes/register-routes'\n\n/**\n * No auth, no org, no data: it answers whether this server bundle was loaded\n * and its routes registered, which is a fact about the process rather than\n * about any workspace.\n */\nexport const outreachPingHandler: PluginApiHandler = (req, res) => {\n  if (req.method !== 'GET') {\n    res.setHeader('Allow', 'GET')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  res.status(200).json({ ok: true, plugin: OUTREACH_PLUGIN_ID })\n}\n\n/** Console API registration, named in `plugins.config.json` as `consoleApi`. */\nexport function registerOutreachConsoleApi(): void {\n  // The server resolves plugin permission keys from this registry, so a\n  // route's `outreach.use` check and the console's gate read the same tier\n  // defaults.\n  registerPluginPermissions(OUTREACH_PERMISSIONS)\n  registerPluginApiRoute(OUTREACH_API_ROUTES.ping, outreachPingHandler)\n  // Connect a Google mailbox, its settings, pause, test and disconnect\n  // (AGL-2978).\n  registerOutreachMailboxRoutes()\n  // Compliance settings, sequences, enrollment and enrollment actions\n  // (AGL-2980).\n  registerOutreachRoutes()\n  // The one-click unsubscribe every email carries (AGL-2981): a recipient\n  // link, so it answers whether or not Outreach is released to the\n  // organization now. Its module loads on the first request.\n  registerPluginApiRoute(\n    OUTREACH_API_ROUTES.unsubscribe,\n    {\n      web: async (request, context) =>\n        (await import('./runtime/platform-runtime-deps')).platformOutreachUnsubscribeRoute()(request, context),\n    },\n    { recipientLink: true },\n  )\n}\n\n// The transport the sending runtime reaches a connected mailbox through\n// (AGL-2978): open a mailbox's Gmail client, mark one reconnect-required,\n// send the engine's composed email through the one RFC 5322 writer, and read\n// a thread whole for the engine's reply and bounce classifier.\nexport {\n  markOutreachMailboxReconnectRequired,\n  openOutreachMailboxClient,\n  type OpenedOutreachMailbox,\n} from './mailboxes/mailbox-transport'\nexport {\n  GmailTransportError,\n  isReconnectRequired,\n  type GmailTransportErrorCode,\n} from './transport/gmail-errors'\nexport type {\n  GmailClient,\n  GmailFullThread,\n  GmailMessageMetadata,\n  GmailThread,\n} from './transport/gmail-client'\nexport {\n  buildRfc5322Message,\n  encodeGmailRawMessage,\n  LIST_UNSUBSCRIBE_ONE_CLICK,\n  Rfc5322MessageError,\n  type OutreachComposedMessage,\n  type OutreachMailAddress,\n} from './transport/rfc5322'\nexport {\n  sendComposedOutreachEmail,\n  sendOutreachMessage,\n  type OutreachSentMessage,\n  type SendOutreachMessageOptions,\n} from './transport/send-message'\n\n// The organization's compliance settings and do-not-contact list\n// (AGL-2980), for the sending runtime: the footer is read before every send,\n// the list is checked before every send, and a reply that opts out, an\n// unsubscribe and a hard bounce each put the address on it.\nexport {\n  outreachComplianceSettingsRef,\n  readOutreachComplianceSettingsDoc,\n  writeOutreachComplianceSettings,\n  type WriteOutreachComplianceSettingsInput,\n  type WriteOutreachComplianceSettingsResult,\n} from './storage/compliance-settings-store'\nexport {\n  addOutreachDoNotContact,\n  getOutreachDoNotContactEntry,\n  isOutreachDoNotContact,\n  lookupOutreachDoNotContact,\n  outreachDoNotContactCollection,\n  readOutreachDoNotContactEntry,\n  type AddOutreachDoNotContactInput,\n  type AddOutreachDoNotContactResult,\n} from './storage/do-not-contact-store'\n"],"names":["registerPluginApiRoute","registerPluginPermissions","OUTREACH_API_ROUTES","OUTREACH_PERMISSIONS","OUTREACH_PLUGIN_ID","registerOutreachMailboxRoutes","registerOutreachRoutes","outreachPingHandler","req","res","method","setHeader","status","json","error","ok","plugin","registerOutreachConsoleApi","ping","unsubscribe","web","request","context","platformOutreachUnsubscribeRoute","recipientLink","markOutreachMailboxReconnectRequired","openOutreachMailboxClient","GmailTransportError","isReconnectRequired","buildRfc5322Message","encodeGmailRawMessage","LIST_UNSUBSCRIBE_ONE_CLICK","Rfc5322MessageError","sendComposedOutreachEmail","sendOutreachMessage","outreachComplianceSettingsRef","readOutreachComplianceSettingsDoc","writeOutreachComplianceSettings","addOutreachDoNotContact","getOutreachDoNotContactEntry","isOutreachDoNotContact","lookupOutreachDoNotContact","outreachDoNotContactCollection","readOutreachDoNotContactEntry"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,SACEA,sBAAsB,EACtBC,yBAAyB,QAEpB,sBAAqB;AAC5B,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SACEC,oBAAoB,EACpBC,kBAAkB,QACb,+BAA2B;AAClC,SAASC,6BAA6B,QAAQ,yCAAqC;AACnF,SAASC,sBAAsB,QAAQ,8BAA0B;AAEjE;;;;CAIC,GACD,OAAO,MAAMC,sBAAwC,CAACC,KAAKC;IACzD,IAAID,IAAIE,MAAM,KAAK,OAAO;QACxBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACAL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEE,IAAI;QAAMC,QAAQZ;IAAmB;AAC9D,EAAC;AAED,8EAA8E,GAC9E,OAAO,SAASa;IACd,sEAAsE;IACtE,yEAAyE;IACzE,YAAY;IACZhB,0BAA0BE;IAC1BH,uBAAuBE,oBAAoBgB,IAAI,EAAEX;IACjD,qEAAqE;IACrE,cAAc;IACdF;IACA,oEAAoE;IACpE,cAAc;IACdC;IACA,wEAAwE;IACxE,iEAAiE;IACjE,2DAA2D;IAC3DN,uBACEE,oBAAoBiB,WAAW,EAC/B;QACEC,KAAK,OAAOC,SAASC,UACnB,AAAC,CAAA,MAAM,MAAM,CAAC,qCAAiC,EAAGC,gCAAgC,GAAGF,SAASC;IAClG,GACA;QAAEE,eAAe;IAAK;AAE1B;AAEA,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,+DAA+D;AAC/D,SACEC,oCAAoC,EACpCC,yBAAyB,QAEpB,mCAA+B;AACtC,SACEC,mBAAmB,EACnBC,mBAAmB,QAEd,8BAA0B;AAOjC,SACEC,mBAAmB,EACnBC,qBAAqB,EACrBC,0BAA0B,EAC1BC,mBAAmB,QAGd,yBAAqB;AAC5B,SACEC,yBAAyB,EACzBC,mBAAmB,QAGd,8BAA0B;AAEjC,iEAAiE;AACjE,6EAA6E;AAC7E,uEAAuE;AACvE,4DAA4D;AAC5D,SACEC,6BAA6B,EAC7BC,iCAAiC,EACjCC,+BAA+B,QAG1B,yCAAqC;AAC5C,SACEC,uBAAuB,EACvBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,6BAA6B,QAGxB,oCAAgC"}

package/src/lib/storage/compliance-settings-store.d.ts

@@ -0,0 +1,44 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type OutreachComplianceSettings, type OutreachComplianceSettingsDocument } from '../model/outreach.types';
+/** `orgs/{orgId}/outreachSettings/compliance`. */
+export declare function outreachComplianceSettingsRef(firestore: FirebaseFirestore.Firestore, orgId: string): FirebaseFirestore.DocumentReference;
+/**
+ * The organization's compliance settings, defaults applied — an
+ * organization that never saved them reads as no legal name, no address,
+ * and the United States alone.
+ */
+export declare function readOutreachComplianceSettingsDoc(firestore: FirebaseFirestore.Firestore, orgId: string): Promise<OutreachComplianceSettingsDocument>;
+export interface WriteOutreachComplianceSettingsInput {
+    orgId: string;
+    /** Already validated: `validateOutreachComplianceSettings(...).settings`. */
+    settings: OutreachComplianceSettings;
+    byUid: string;
+    nowMs: number;
+}
+export interface WriteOutreachComplianceSettingsResult {
+    settings: OutreachComplianceSettingsDocument;
+    /** False when the save said what was already stored, and nothing was written. */
+    changed: boolean;
+}
+/**
+ * Stores the settings when they differ from what is stored, in a
+ * transaction, so two members saving at once each compare against the
+ * other's write rather than both believing they changed nothing — and the
+ * activity line a change earns is written once per actual change.
+ */
+export declare function writeOutreachComplianceSettings(firestore: FirebaseFirestore.Firestore, input: WriteOutreachComplianceSettingsInput): Promise<WriteOutreachComplianceSettingsResult>;

package/src/lib/storage/compliance-settings-store.js

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Where the organization's compliance settings are kept (AGL-2980):
+ * `orgs/{orgId}/outreachSettings/compliance`, one document.
+ *
+ * SERVER ONLY. The rules let an Outreach member read the document and refuse
+ * every client write, so the settings route is the one writer and this is
+ * the one place that knows the path. The sending runtime reads it through
+ * {@link readOutreachComplianceSettingsDoc} before every send, because the
+ * footer is written from it and must say what the organization says now.
+ *
+ * Firestore is a parameter throughout, as in the CRM's server modules: the
+ * callers hold one, and a module that reached for the Admin app itself
+ * would drag it into every spec that only wants the arithmetic.
+ */ import { outreachComplianceSettingsEqual, readOutreachComplianceSettings } from "../model/compliance-settings.js";
+import { OUTREACH_COLLECTIONS, OUTREACH_COMPLIANCE_SETTINGS_ID } from "../model/outreach.types.js";
+/** `orgs/{orgId}/outreachSettings/compliance`. */ export function outreachComplianceSettingsRef(firestore, orgId) {
+    return firestore.collection('orgs').doc(orgId).collection(OUTREACH_COLLECTIONS.settings).doc(OUTREACH_COMPLIANCE_SETTINGS_ID);
+}
+/**
+ * The organization's compliance settings, defaults applied — an
+ * organization that never saved them reads as no legal name, no address,
+ * and the United States alone.
+ */ export async function readOutreachComplianceSettingsDoc(firestore, orgId) {
+    const snapshot = await outreachComplianceSettingsRef(firestore, orgId).get();
+    return readOutreachComplianceSettings(snapshot.exists ? snapshot.data() : null);
+}
+/**
+ * Stores the settings when they differ from what is stored, in a
+ * transaction, so two members saving at once each compare against the
+ * other's write rather than both believing they changed nothing — and the
+ * activity line a change earns is written once per actual change.
+ */ export async function writeOutreachComplianceSettings(firestore, input) {
+    const ref = outreachComplianceSettingsRef(firestore, input.orgId);
+    return firestore.runTransaction(async (transaction)=>{
+        const snapshot = await transaction.get(ref);
+        const current = readOutreachComplianceSettings(snapshot.exists ? snapshot.data() : null);
+        // A document that was never saved is a change even when the save
+        // restates the defaults: the organization has now said them.
+        if (snapshot.exists && outreachComplianceSettingsEqual(current, input.settings)) {
+            return {
+                settings: current,
+                changed: false
+            };
+        }
+        const next = {
+            legalName: input.settings.legalName,
+            brandName: input.settings.brandName,
+            postalAddress: input.settings.postalAddress,
+            allowedCountries: [
+                ...input.settings.allowedCountries
+            ],
+            updatedAtMs: input.nowMs,
+            updatedByUid: input.byUid
+        };
+        transaction.set(ref, next);
+        return {
+            settings: next,
+            changed: true
+        };
+    });
+}
+
+//# sourceMappingURL=compliance-settings-store.js.map

package/src/lib/storage/compliance-settings-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/storage/compliance-settings-store.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Where the organization's compliance settings are kept (AGL-2980):\n * `orgs/{orgId}/outreachSettings/compliance`, one document.\n *\n * SERVER ONLY. The rules let an Outreach member read the document and refuse\n * every client write, so the settings route is the one writer and this is\n * the one place that knows the path. The sending runtime reads it through\n * {@link readOutreachComplianceSettingsDoc} before every send, because the\n * footer is written from it and must say what the organization says now.\n *\n * Firestore is a parameter throughout, as in the CRM's server modules: the\n * callers hold one, and a module that reached for the Admin app itself\n * would drag it into every spec that only wants the arithmetic.\n */\n\nimport {\n  outreachComplianceSettingsEqual,\n  readOutreachComplianceSettings,\n} from '../model/compliance-settings'\nimport {\n  OUTREACH_COLLECTIONS,\n  OUTREACH_COMPLIANCE_SETTINGS_ID,\n  type OutreachComplianceSettings,\n  type OutreachComplianceSettingsDocument,\n} from '../model/outreach.types'\n\n/** `orgs/{orgId}/outreachSettings/compliance`. */\nexport function outreachComplianceSettingsRef(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): FirebaseFirestore.DocumentReference {\n  return firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection(OUTREACH_COLLECTIONS.settings)\n    .doc(OUTREACH_COMPLIANCE_SETTINGS_ID)\n}\n\n/**\n * The organization's compliance settings, defaults applied — an\n * organization that never saved them reads as no legal name, no address,\n * and the United States alone.\n */\nexport async function readOutreachComplianceSettingsDoc(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<OutreachComplianceSettingsDocument> {\n  const snapshot = await outreachComplianceSettingsRef(firestore, orgId).get()\n  return readOutreachComplianceSettings(snapshot.exists ? snapshot.data() : null)\n}\n\nexport interface WriteOutreachComplianceSettingsInput {\n  orgId: string\n  /** Already validated: `validateOutreachComplianceSettings(...).settings`. */\n  settings: OutreachComplianceSettings\n  byUid: string\n  nowMs: number\n}\n\nexport interface WriteOutreachComplianceSettingsResult {\n  settings: OutreachComplianceSettingsDocument\n  /** False when the save said what was already stored, and nothing was written. */\n  changed: boolean\n}\n\n/**\n * Stores the settings when they differ from what is stored, in a\n * transaction, so two members saving at once each compare against the\n * other's write rather than both believing they changed nothing — and the\n * activity line a change earns is written once per actual change.\n */\nexport async function writeOutreachComplianceSettings(\n  firestore: FirebaseFirestore.Firestore,\n  input: WriteOutreachComplianceSettingsInput,\n): Promise<WriteOutreachComplianceSettingsResult> {\n  const ref = outreachComplianceSettingsRef(firestore, input.orgId)\n  return firestore.runTransaction(async (transaction) => {\n    const snapshot = await transaction.get(ref)\n    const current = readOutreachComplianceSettings(snapshot.exists ? snapshot.data() : null)\n    // A document that was never saved is a change even when the save\n    // restates the defaults: the organization has now said them.\n    if (snapshot.exists && outreachComplianceSettingsEqual(current, input.settings)) {\n      return { settings: current, changed: false }\n    }\n    const next: OutreachComplianceSettingsDocument = {\n      legalName: input.settings.legalName,\n      brandName: input.settings.brandName,\n      postalAddress: input.settings.postalAddress,\n      allowedCountries: [...input.settings.allowedCountries],\n      updatedAtMs: input.nowMs,\n      updatedByUid: input.byUid,\n    }\n    transaction.set(ref, next)\n    return { settings: next, changed: true }\n  })\n}\n"],"names":["outreachComplianceSettingsEqual","readOutreachComplianceSettings","OUTREACH_COLLECTIONS","OUTREACH_COMPLIANCE_SETTINGS_ID","outreachComplianceSettingsRef","firestore","orgId","collection","doc","settings","readOutreachComplianceSettingsDoc","snapshot","get","exists","data","writeOutreachComplianceSettings","input","ref","runTransaction","transaction","current","changed","next","legalName","brandName","postalAddress","allowedCountries","updatedAtMs","nowMs","updatedByUid","byUid","set"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;CAaC,GAED,SACEA,+BAA+B,EAC/BC,8BAA8B,QACzB,kCAA8B;AACrC,SACEC,oBAAoB,EACpBC,+BAA+B,QAG1B,6BAAyB;AAEhC,gDAAgD,GAChD,OAAO,SAASC,8BACdC,SAAsC,EACtCC,KAAa;IAEb,OAAOD,UACJE,UAAU,CAAC,QACXC,GAAG,CAACF,OACJC,UAAU,CAACL,qBAAqBO,QAAQ,EACxCD,GAAG,CAACL;AACT;AAEA;;;;CAIC,GACD,OAAO,eAAeO,kCACpBL,SAAsC,EACtCC,KAAa;IAEb,MAAMK,WAAW,MAAMP,8BAA8BC,WAAWC,OAAOM,GAAG;IAC1E,OAAOX,+BAA+BU,SAASE,MAAM,GAAGF,SAASG,IAAI,KAAK;AAC5E;AAgBA;;;;;CAKC,GACD,OAAO,eAAeC,gCACpBV,SAAsC,EACtCW,KAA2C;IAE3C,MAAMC,MAAMb,8BAA8BC,WAAWW,MAAMV,KAAK;IAChE,OAAOD,UAAUa,cAAc,CAAC,OAAOC;QACrC,MAAMR,WAAW,MAAMQ,YAAYP,GAAG,CAACK;QACvC,MAAMG,UAAUnB,+BAA+BU,SAASE,MAAM,GAAGF,SAASG,IAAI,KAAK;QACnF,iEAAiE;QACjE,6DAA6D;QAC7D,IAAIH,SAASE,MAAM,IAAIb,gCAAgCoB,SAASJ,MAAMP,QAAQ,GAAG;YAC/E,OAAO;gBAAEA,UAAUW;gBAASC,SAAS;YAAM;QAC7C;QACA,MAAMC,OAA2C;YAC/CC,WAAWP,MAAMP,QAAQ,CAACc,SAAS;YACnCC,WAAWR,MAAMP,QAAQ,CAACe,SAAS;YACnCC,eAAeT,MAAMP,QAAQ,CAACgB,aAAa;YAC3CC,kBAAkB;mBAAIV,MAAMP,QAAQ,CAACiB,gBAAgB;aAAC;YACtDC,aAAaX,MAAMY,KAAK;YACxBC,cAAcb,MAAMc,KAAK;QAC3B;QACAX,YAAYY,GAAG,CAACd,KAAKK;QACrB,OAAO;YAAEb,UAAUa;YAAMD,SAAS;QAAK;IACzC;AACF"}

package/src/lib/storage/do-not-contact-store.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type OutreachDoNotContactEntry, type OutreachDoNotContactReason, type OutreachDoNotContactSource } from '../model/outreach.types';
+/** The longest detail an entry keeps. */
+export declare const OUTREACH_DO_NOT_CONTACT_DETAIL_MAX = 500;
+/** `orgs/{orgId}/outreachDoNotContact`. */
+export declare function outreachDoNotContactCollection(firestore: FirebaseFirestore.Firestore, orgId: string): FirebaseFirestore.CollectionReference;
+/** A stored entry held to its shape, or `null` for a document that is not one. */
+export declare function readOutreachDoNotContactEntry(key: string, data: Record<string, unknown> | undefined): OutreachDoNotContactEntry | null;
+/**
+ * Whether each address is on the list, in one round trip: `true` or `false`
+ * per address, or `null` for an address that cannot be keyed and for every
+ * address when the read failed. Keyed by the address exactly as given.
+ */
+export declare function lookupOutreachDoNotContact(firestore: FirebaseFirestore.Firestore, orgId: string, emails: readonly string[]): Promise<Map<string, boolean | null>>;
+/** Whether one address is on the list; `null` when that could not be told. */
+export declare function isOutreachDoNotContact(firestore: FirebaseFirestore.Firestore, orgId: string, email: string): Promise<boolean | null>;
+/** The entry an address has, or `null` when it has none. */
+export declare function getOutreachDoNotContactEntry(firestore: FirebaseFirestore.Firestore, orgId: string, email: string): Promise<OutreachDoNotContactEntry | null>;
+export interface AddOutreachDoNotContactInput {
+    orgId: string;
+    email: string;
+    reason: OutreachDoNotContactReason;
+    source: OutreachDoNotContactSource;
+    /** The member adding it; omit or `null` for the runtime. */
+    addedByUid?: string | null;
+    nowMs: number;
+    enrollmentId?: string | null;
+    sequenceId?: string | null;
+    detail?: string | null;
+}
+export interface AddOutreachDoNotContactResult {
+    key: string;
+    /** False when the address was on the list already; its entry is unchanged. */
+    created: boolean;
+    /** The entry as it stands: the new one, or the one that was already there. */
+    entry: OutreachDoNotContactEntry;
+}
+/**
+ * Puts an address on the list — see the module note for why a second add
+ * changes nothing. Throws for a value that is not an address, a reason or a
+ * source the list does not know, and a member-sourced add with no member:
+ * a list that could hold an entry nobody can explain is not evidence of
+ * anything.
+ */
+export declare function addOutreachDoNotContact(firestore: FirebaseFirestore.Firestore, input: AddOutreachDoNotContactInput): Promise<AddOutreachDoNotContactResult>;

package/src/lib/storage/do-not-contact-store.js

@@ -0,0 +1,168 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The organization's Outreach do-not-contact list (AGL-2980):
+ * `orgs/{orgId}/outreachDoNotContact/{key}`, one document per address.
+ *
+ * SERVER ONLY — the key hashes with `node:crypto`. Two kinds of caller, and
+ * the API is shaped for both:
+ *
+ * - The console's routes: the enrollment gates read the list for every
+ *   person being enrolled at once ({@link lookupOutreachDoNotContact}, one
+ *   `getAll`), and "Mark do-not-contact" on an enrollment adds an entry with
+ *   the member as its author.
+ * - The sending runtime: it re-reads the list for each person before each
+ *   send ({@link isOutreachDoNotContact}), and adds an entry when a reply
+ *   opts out, when the unsubscribe link is used and when an address bounces
+ *   for good, with `source: 'runtime'` and no member.
+ *
+ * ## Reads answer `null` when they could not be made
+ *
+ * `null` is not `false`. The gates read a `null` lookup as "we couldn't
+ * check" and refuse the person, which is the only safe reading of a list
+ * whose whole job is to stop mail: a person who asked not to be emailed must
+ * not be emailed because a read timed out.
+ *
+ * ## An entry is written once
+ *
+ * The first reason an address was added is the record of why it is there;
+ * a later add for the same address — an unsubscribe after a member already
+ * marked it — finds it on the list and changes nothing. `create()` makes
+ * that atomic without a transaction: two adds racing for one address cannot
+ * both write.
+ */ import { outreachDoNotContactKey } from "../engine/do-not-contact.js";
+import { OUTREACH_COLLECTIONS, OUTREACH_DO_NOT_CONTACT_REASONS, OUTREACH_DO_NOT_CONTACT_SOURCES } from "../model/outreach.types.js";
+/** The longest detail an entry keeps. */ export const OUTREACH_DO_NOT_CONTACT_DETAIL_MAX = 500;
+/** `getAll` takes this many references at most per call. */ const GET_ALL_CHUNK = 300;
+/** gRPC `ALREADY_EXISTS`, which `create()` rejects with when the document is there. */ const ALREADY_EXISTS = 6;
+/** `orgs/{orgId}/outreachDoNotContact`. */ export function outreachDoNotContactCollection(firestore, orgId) {
+    return firestore.collection('orgs').doc(orgId).collection(OUTREACH_COLLECTIONS.doNotContact);
+}
+/** A stored entry held to its shape, or `null` for a document that is not one. */ export function readOutreachDoNotContactEntry(key, data) {
+    if (!data) return null;
+    const reason = data['reason'];
+    const source = data['source'];
+    const text = (value)=>typeof value === 'string' && value ? value : null;
+    const addedAtMs = Number(data['addedAtMs']);
+    return {
+        key,
+        // An entry some other writer produced still keeps its address off the
+        // list's sends; only how it reads is defaulted.
+        reason: OUTREACH_DO_NOT_CONTACT_REASONS.includes(reason) ? reason : 'manual',
+        source: OUTREACH_DO_NOT_CONTACT_SOURCES.includes(source) ? source : 'member',
+        addedByUid: text(data['addedByUid']),
+        addedAtMs: Number.isFinite(addedAtMs) && addedAtMs > 0 ? addedAtMs : 0,
+        enrollmentId: text(data['enrollmentId']),
+        sequenceId: text(data['sequenceId']),
+        detail: text(data['detail'])
+    };
+}
+/**
+ * Whether each address is on the list, in one round trip: `true` or `false`
+ * per address, or `null` for an address that cannot be keyed and for every
+ * address when the read failed. Keyed by the address exactly as given.
+ */ export async function lookupOutreachDoNotContact(firestore, orgId, emails) {
+    const answers = new Map();
+    const keyed = [];
+    for (const email of emails){
+        const key = outreachDoNotContactKey(email);
+        if (key) keyed.push({
+            email,
+            key
+        });
+        else answers.set(email, null);
+    }
+    if (!keyed.length) return answers;
+    const list = outreachDoNotContactCollection(firestore, orgId);
+    try {
+        for(let start = 0; start < keyed.length; start += GET_ALL_CHUNK){
+            const chunk = keyed.slice(start, start + GET_ALL_CHUNK);
+            const snapshots = await firestore.getAll(...chunk.map((entry)=>list.doc(entry.key)));
+            chunk.forEach((entry, index)=>{
+                var _snapshots_index;
+                answers.set(entry.email, ((_snapshots_index = snapshots[index]) == null ? void 0 : _snapshots_index.exists) === true);
+            });
+        }
+    } catch (error) {
+        console.error('[outreach] do-not-contact lookup failed; reading as unchecked', error);
+        for (const entry of keyed)answers.set(entry.email, null);
+    }
+    return answers;
+}
+/** Whether one address is on the list; `null` when that could not be told. */ export async function isOutreachDoNotContact(firestore, orgId, email) {
+    var _get;
+    return (_get = (await lookupOutreachDoNotContact(firestore, orgId, [
+        email
+    ])).get(email)) != null ? _get : null;
+}
+/** The entry an address has, or `null` when it has none. */ export async function getOutreachDoNotContactEntry(firestore, orgId, email) {
+    const key = outreachDoNotContactKey(email);
+    if (!key) return null;
+    const snapshot = await outreachDoNotContactCollection(firestore, orgId).doc(key).get();
+    return snapshot.exists ? readOutreachDoNotContactEntry(key, snapshot.data()) : null;
+}
+/**
+ * Puts an address on the list — see the module note for why a second add
+ * changes nothing. Throws for a value that is not an address, a reason or a
+ * source the list does not know, and a member-sourced add with no member:
+ * a list that could hold an entry nobody can explain is not evidence of
+ * anything.
+ */ export async function addOutreachDoNotContact(firestore, input) {
+    var _input_detail;
+    const key = outreachDoNotContactKey(input.email);
+    if (!key) throw new Error('[outreach] cannot key a do-not-contact entry for that value');
+    if (!OUTREACH_DO_NOT_CONTACT_REASONS.includes(input.reason)) {
+        throw new Error(`[outreach] "${String(input.reason)}" is not a do-not-contact reason`);
+    }
+    if (!OUTREACH_DO_NOT_CONTACT_SOURCES.includes(input.source)) {
+        throw new Error(`[outreach] "${String(input.source)}" is not a do-not-contact source`);
+    }
+    const addedByUid = typeof input.addedByUid === 'string' && input.addedByUid ? input.addedByUid : null;
+    if (input.source === 'member' && !addedByUid) {
+        throw new Error('[outreach] a member-added do-not-contact entry names the member');
+    }
+    const detail = String((_input_detail = input.detail) != null ? _input_detail : '').replace(/\s+/g, ' ').trim();
+    const entry = {
+        key,
+        reason: input.reason,
+        source: input.source,
+        addedByUid,
+        addedAtMs: input.nowMs,
+        enrollmentId: input.enrollmentId || null,
+        sequenceId: input.sequenceId || null,
+        detail: detail ? detail.slice(0, OUTREACH_DO_NOT_CONTACT_DETAIL_MAX) : null
+    };
+    const ref = outreachDoNotContactCollection(firestore, input.orgId).doc(key);
+    try {
+        await ref.create(entry);
+        return {
+            key,
+            created: true,
+            entry
+        };
+    } catch (error) {
+        var _readOutreachDoNotContactEntry;
+        if ((error == null ? void 0 : error.code) !== ALREADY_EXISTS) throw error;
+        const existing = await ref.get();
+        return {
+            key,
+            created: false,
+            entry: (_readOutreachDoNotContactEntry = readOutreachDoNotContactEntry(key, existing.data())) != null ? _readOutreachDoNotContactEntry : entry
+        };
+    }
+}
+
+//# sourceMappingURL=do-not-contact-store.js.map

package/src/lib/storage/do-not-contact-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/storage/do-not-contact-store.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The organization's Outreach do-not-contact list (AGL-2980):\n * `orgs/{orgId}/outreachDoNotContact/{key}`, one document per address.\n *\n * SERVER ONLY — the key hashes with `node:crypto`. Two kinds of caller, and\n * the API is shaped for both:\n *\n * - The console's routes: the enrollment gates read the list for every\n *   person being enrolled at once ({@link lookupOutreachDoNotContact}, one\n *   `getAll`), and \"Mark do-not-contact\" on an enrollment adds an entry with\n *   the member as its author.\n * - The sending runtime: it re-reads the list for each person before each\n *   send ({@link isOutreachDoNotContact}), and adds an entry when a reply\n *   opts out, when the unsubscribe link is used and when an address bounces\n *   for good, with `source: 'runtime'` and no member.\n *\n * ## Reads answer `null` when they could not be made\n *\n * `null` is not `false`. The gates read a `null` lookup as \"we couldn't\n * check\" and refuse the person, which is the only safe reading of a list\n * whose whole job is to stop mail: a person who asked not to be emailed must\n * not be emailed because a read timed out.\n *\n * ## An entry is written once\n *\n * The first reason an address was added is the record of why it is there;\n * a later add for the same address — an unsubscribe after a member already\n * marked it — finds it on the list and changes nothing. `create()` makes\n * that atomic without a transaction: two adds racing for one address cannot\n * both write.\n */\n\nimport { outreachDoNotContactKey } from '../engine/do-not-contact'\nimport {\n  OUTREACH_COLLECTIONS,\n  OUTREACH_DO_NOT_CONTACT_REASONS,\n  OUTREACH_DO_NOT_CONTACT_SOURCES,\n  type OutreachDoNotContactEntry,\n  type OutreachDoNotContactReason,\n  type OutreachDoNotContactSource,\n} from '../model/outreach.types'\n\n/** The longest detail an entry keeps. */\nexport const OUTREACH_DO_NOT_CONTACT_DETAIL_MAX = 500\n\n/** `getAll` takes this many references at most per call. */\nconst GET_ALL_CHUNK = 300\n\n/** gRPC `ALREADY_EXISTS`, which `create()` rejects with when the document is there. */\nconst ALREADY_EXISTS = 6\n\n/** `orgs/{orgId}/outreachDoNotContact`. */\nexport function outreachDoNotContactCollection(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): FirebaseFirestore.CollectionReference {\n  return firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection(OUTREACH_COLLECTIONS.doNotContact)\n}\n\n/** A stored entry held to its shape, or `null` for a document that is not one. */\nexport function readOutreachDoNotContactEntry(\n  key: string,\n  data: Record<string, unknown> | undefined,\n): OutreachDoNotContactEntry | null {\n  if (!data) return null\n  const reason = data['reason']\n  const source = data['source']\n  const text = (value: unknown): string | null =>\n    typeof value === 'string' && value ? value : null\n  const addedAtMs = Number(data['addedAtMs'])\n  return {\n    key,\n    // An entry some other writer produced still keeps its address off the\n    // list's sends; only how it reads is defaulted.\n    reason: (OUTREACH_DO_NOT_CONTACT_REASONS as readonly unknown[]).includes(reason)\n      ? (reason as OutreachDoNotContactReason)\n      : 'manual',\n    source: (OUTREACH_DO_NOT_CONTACT_SOURCES as readonly unknown[]).includes(source)\n      ? (source as OutreachDoNotContactSource)\n      : 'member',\n    addedByUid: text(data['addedByUid']),\n    addedAtMs: Number.isFinite(addedAtMs) && addedAtMs > 0 ? addedAtMs : 0,\n    enrollmentId: text(data['enrollmentId']),\n    sequenceId: text(data['sequenceId']),\n    detail: text(data['detail']),\n  }\n}\n\n/**\n * Whether each address is on the list, in one round trip: `true` or `false`\n * per address, or `null` for an address that cannot be keyed and for every\n * address when the read failed. Keyed by the address exactly as given.\n */\nexport async function lookupOutreachDoNotContact(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  emails: readonly string[],\n): Promise<Map<string, boolean | null>> {\n  const answers = new Map<string, boolean | null>()\n  const keyed: Array<{ email: string; key: string }> = []\n  for (const email of emails) {\n    const key = outreachDoNotContactKey(email)\n    if (key) keyed.push({ email, key })\n    else answers.set(email, null)\n  }\n  if (!keyed.length) return answers\n  const list = outreachDoNotContactCollection(firestore, orgId)\n  try {\n    for (let start = 0; start < keyed.length; start += GET_ALL_CHUNK) {\n      const chunk = keyed.slice(start, start + GET_ALL_CHUNK)\n      const snapshots = await firestore.getAll(...chunk.map((entry) => list.doc(entry.key)))\n      chunk.forEach((entry, index) => {\n        answers.set(entry.email, snapshots[index]?.exists === true)\n      })\n    }\n  } catch (error) {\n    console.error('[outreach] do-not-contact lookup failed; reading as unchecked', error)\n    for (const entry of keyed) answers.set(entry.email, null)\n  }\n  return answers\n}\n\n/** Whether one address is on the list; `null` when that could not be told. */\nexport async function isOutreachDoNotContact(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  email: string,\n): Promise<boolean | null> {\n  return (await lookupOutreachDoNotContact(firestore, orgId, [email])).get(email) ?? null\n}\n\n/** The entry an address has, or `null` when it has none. */\nexport async function getOutreachDoNotContactEntry(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  email: string,\n): Promise<OutreachDoNotContactEntry | null> {\n  const key = outreachDoNotContactKey(email)\n  if (!key) return null\n  const snapshot = await outreachDoNotContactCollection(firestore, orgId).doc(key).get()\n  return snapshot.exists ? readOutreachDoNotContactEntry(key, snapshot.data()) : null\n}\n\nexport interface AddOutreachDoNotContactInput {\n  orgId: string\n  email: string\n  reason: OutreachDoNotContactReason\n  source: OutreachDoNotContactSource\n  /** The member adding it; omit or `null` for the runtime. */\n  addedByUid?: string | null\n  nowMs: number\n  enrollmentId?: string | null\n  sequenceId?: string | null\n  detail?: string | null\n}\n\nexport interface AddOutreachDoNotContactResult {\n  key: string\n  /** False when the address was on the list already; its entry is unchanged. */\n  created: boolean\n  /** The entry as it stands: the new one, or the one that was already there. */\n  entry: OutreachDoNotContactEntry\n}\n\n/**\n * Puts an address on the list — see the module note for why a second add\n * changes nothing. Throws for a value that is not an address, a reason or a\n * source the list does not know, and a member-sourced add with no member:\n * a list that could hold an entry nobody can explain is not evidence of\n * anything.\n */\nexport async function addOutreachDoNotContact(\n  firestore: FirebaseFirestore.Firestore,\n  input: AddOutreachDoNotContactInput,\n): Promise<AddOutreachDoNotContactResult> {\n  const key = outreachDoNotContactKey(input.email)\n  if (!key) throw new Error('[outreach] cannot key a do-not-contact entry for that value')\n  if (!(OUTREACH_DO_NOT_CONTACT_REASONS as readonly string[]).includes(input.reason)) {\n    throw new Error(`[outreach] \"${String(input.reason)}\" is not a do-not-contact reason`)\n  }\n  if (!(OUTREACH_DO_NOT_CONTACT_SOURCES as readonly string[]).includes(input.source)) {\n    throw new Error(`[outreach] \"${String(input.source)}\" is not a do-not-contact source`)\n  }\n  const addedByUid = typeof input.addedByUid === 'string' && input.addedByUid ? input.addedByUid : null\n  if (input.source === 'member' && !addedByUid) {\n    throw new Error('[outreach] a member-added do-not-contact entry names the member')\n  }\n  const detail = String(input.detail ?? '').replace(/\\s+/g, ' ').trim()\n  const entry: OutreachDoNotContactEntry = {\n    key,\n    reason: input.reason,\n    source: input.source,\n    addedByUid,\n    addedAtMs: input.nowMs,\n    enrollmentId: input.enrollmentId || null,\n    sequenceId: input.sequenceId || null,\n    detail: detail ? detail.slice(0, OUTREACH_DO_NOT_CONTACT_DETAIL_MAX) : null,\n  }\n  const ref = outreachDoNotContactCollection(firestore, input.orgId).doc(key)\n  try {\n    await ref.create(entry)\n    return { key, created: true, entry }\n  } catch (error) {\n    if ((error as { code?: unknown })?.code !== ALREADY_EXISTS) throw error\n    const existing = await ref.get()\n    return {\n      key,\n      created: false,\n      entry: readOutreachDoNotContactEntry(key, existing.data()) ?? entry,\n    }\n  }\n}\n"],"names":["outreachDoNotContactKey","OUTREACH_COLLECTIONS","OUTREACH_DO_NOT_CONTACT_REASONS","OUTREACH_DO_NOT_CONTACT_SOURCES","OUTREACH_DO_NOT_CONTACT_DETAIL_MAX","GET_ALL_CHUNK","ALREADY_EXISTS","outreachDoNotContactCollection","firestore","orgId","collection","doc","doNotContact","readOutreachDoNotContactEntry","key","data","reason","source","text","value","addedAtMs","Number","includes","addedByUid","isFinite","enrollmentId","sequenceId","detail","lookupOutreachDoNotContact","emails","answers","Map","keyed","email","push","set","length","list","start","chunk","slice","snapshots","getAll","map","entry","forEach","index","exists","error","console","isOutreachDoNotContact","get","getOutreachDoNotContactEntry","snapshot","addOutreachDoNotContact","input","Error","String","replace","trim","nowMs","ref","create","created","code","existing"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GAED,SAASA,uBAAuB,QAAQ,8BAA0B;AAClE,SACEC,oBAAoB,EACpBC,+BAA+B,EAC/BC,+BAA+B,QAI1B,6BAAyB;AAEhC,uCAAuC,GACvC,OAAO,MAAMC,qCAAqC,IAAG;AAErD,0DAA0D,GAC1D,MAAMC,gBAAgB;AAEtB,qFAAqF,GACrF,MAAMC,iBAAiB;AAEvB,yCAAyC,GACzC,OAAO,SAASC,+BACdC,SAAsC,EACtCC,KAAa;IAEb,OAAOD,UACJE,UAAU,CAAC,QACXC,GAAG,CAACF,OACJC,UAAU,CAACT,qBAAqBW,YAAY;AACjD;AAEA,gFAAgF,GAChF,OAAO,SAASC,8BACdC,GAAW,EACXC,IAAyC;IAEzC,IAAI,CAACA,MAAM,OAAO;IAClB,MAAMC,SAASD,IAAI,CAAC,SAAS;IAC7B,MAAME,SAASF,IAAI,CAAC,SAAS;IAC7B,MAAMG,OAAO,CAACC,QACZ,OAAOA,UAAU,YAAYA,QAAQA,QAAQ;IAC/C,MAAMC,YAAYC,OAAON,IAAI,CAAC,YAAY;IAC1C,OAAO;QACLD;QACA,sEAAsE;QACtE,gDAAgD;QAChDE,QAAQ,AAACd,gCAAuDoB,QAAQ,CAACN,UACpEA,SACD;QACJC,QAAQ,AAACd,gCAAuDmB,QAAQ,CAACL,UACpEA,SACD;QACJM,YAAYL,KAAKH,IAAI,CAAC,aAAa;QACnCK,WAAWC,OAAOG,QAAQ,CAACJ,cAAcA,YAAY,IAAIA,YAAY;QACrEK,cAAcP,KAAKH,IAAI,CAAC,eAAe;QACvCW,YAAYR,KAAKH,IAAI,CAAC,aAAa;QACnCY,QAAQT,KAAKH,IAAI,CAAC,SAAS;IAC7B;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAea,2BACpBpB,SAAsC,EACtCC,KAAa,EACboB,MAAyB;IAEzB,MAAMC,UAAU,IAAIC;IACpB,MAAMC,QAA+C,EAAE;IACvD,KAAK,MAAMC,SAASJ,OAAQ;QAC1B,MAAMf,MAAMd,wBAAwBiC;QACpC,IAAInB,KAAKkB,MAAME,IAAI,CAAC;YAAED;YAAOnB;QAAI;aAC5BgB,QAAQK,GAAG,CAACF,OAAO;IAC1B;IACA,IAAI,CAACD,MAAMI,MAAM,EAAE,OAAON;IAC1B,MAAMO,OAAO9B,+BAA+BC,WAAWC;IACvD,IAAI;QACF,IAAK,IAAI6B,QAAQ,GAAGA,QAAQN,MAAMI,MAAM,EAAEE,SAASjC,cAAe;YAChE,MAAMkC,QAAQP,MAAMQ,KAAK,CAACF,OAAOA,QAAQjC;YACzC,MAAMoC,YAAY,MAAMjC,UAAUkC,MAAM,IAAIH,MAAMI,GAAG,CAAC,CAACC,QAAUP,KAAK1B,GAAG,CAACiC,MAAM9B,GAAG;YACnFyB,MAAMM,OAAO,CAAC,CAACD,OAAOE;oBACKL;gBAAzBX,QAAQK,GAAG,CAACS,MAAMX,KAAK,EAAEQ,EAAAA,mBAAAA,SAAS,CAACK,MAAM,qBAAhBL,iBAAkBM,MAAM,MAAK;YACxD;QACF;IACF,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,iEAAiEA;QAC/E,KAAK,MAAMJ,SAASZ,MAAOF,QAAQK,GAAG,CAACS,MAAMX,KAAK,EAAE;IACtD;IACA,OAAOH;AACT;AAEA,4EAA4E,GAC5E,OAAO,eAAeoB,uBACpB1C,SAAsC,EACtCC,KAAa,EACbwB,KAAa;QAEN;IAAP,QAAO,OAAA,AAAC,CAAA,MAAML,2BAA2BpB,WAAWC,OAAO;QAACwB;KAAM,CAAA,EAAGkB,GAAG,CAAClB,kBAAlE,OAA4E;AACrF;AAEA,0DAA0D,GAC1D,OAAO,eAAemB,6BACpB5C,SAAsC,EACtCC,KAAa,EACbwB,KAAa;IAEb,MAAMnB,MAAMd,wBAAwBiC;IACpC,IAAI,CAACnB,KAAK,OAAO;IACjB,MAAMuC,WAAW,MAAM9C,+BAA+BC,WAAWC,OAAOE,GAAG,CAACG,KAAKqC,GAAG;IACpF,OAAOE,SAASN,MAAM,GAAGlC,8BAA8BC,KAAKuC,SAAStC,IAAI,MAAM;AACjF;AAuBA;;;;;;CAMC,GACD,OAAO,eAAeuC,wBACpB9C,SAAsC,EACtC+C,KAAmC;QAcbA;IAZtB,MAAMzC,MAAMd,wBAAwBuD,MAAMtB,KAAK;IAC/C,IAAI,CAACnB,KAAK,MAAM,IAAI0C,MAAM;IAC1B,IAAI,CAAC,AAACtD,gCAAsDoB,QAAQ,CAACiC,MAAMvC,MAAM,GAAG;QAClF,MAAM,IAAIwC,MAAM,CAAC,YAAY,EAAEC,OAAOF,MAAMvC,MAAM,EAAE,gCAAgC,CAAC;IACvF;IACA,IAAI,CAAC,AAACb,gCAAsDmB,QAAQ,CAACiC,MAAMtC,MAAM,GAAG;QAClF,MAAM,IAAIuC,MAAM,CAAC,YAAY,EAAEC,OAAOF,MAAMtC,MAAM,EAAE,gCAAgC,CAAC;IACvF;IACA,MAAMM,aAAa,OAAOgC,MAAMhC,UAAU,KAAK,YAAYgC,MAAMhC,UAAU,GAAGgC,MAAMhC,UAAU,GAAG;IACjG,IAAIgC,MAAMtC,MAAM,KAAK,YAAY,CAACM,YAAY;QAC5C,MAAM,IAAIiC,MAAM;IAClB;IACA,MAAM7B,SAAS8B,QAAOF,gBAAAA,MAAM5B,MAAM,YAAZ4B,gBAAgB,IAAIG,OAAO,CAAC,QAAQ,KAAKC,IAAI;IACnE,MAAMf,QAAmC;QACvC9B;QACAE,QAAQuC,MAAMvC,MAAM;QACpBC,QAAQsC,MAAMtC,MAAM;QACpBM;QACAH,WAAWmC,MAAMK,KAAK;QACtBnC,cAAc8B,MAAM9B,YAAY,IAAI;QACpCC,YAAY6B,MAAM7B,UAAU,IAAI;QAChCC,QAAQA,SAASA,OAAOa,KAAK,CAAC,GAAGpC,sCAAsC;IACzE;IACA,MAAMyD,MAAMtD,+BAA+BC,WAAW+C,MAAM9C,KAAK,EAAEE,GAAG,CAACG;IACvE,IAAI;QACF,MAAM+C,IAAIC,MAAM,CAAClB;QACjB,OAAO;YAAE9B;YAAKiD,SAAS;YAAMnB;QAAM;IACrC,EAAE,OAAOI,OAAO;YAMLnC;QALT,IAAI,CAACmC,yBAAD,AAACA,MAA8BgB,IAAI,MAAK1D,gBAAgB,MAAM0C;QAClE,MAAMiB,WAAW,MAAMJ,IAAIV,GAAG;QAC9B,OAAO;YACLrC;YACAiD,SAAS;YACTnB,KAAK,GAAE/B,iCAAAA,8BAA8BC,KAAKmD,SAASlD,IAAI,eAAhDF,iCAAuD+B;QAChE;IACF;AACF"}

package/src/lib/storage/outreach-records.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Where the org-scoped Outreach documents live, as the server reaches them
+ * (AGL-2980). Server only — the references are the Admin SDK's. Each
+ * document reads back into its model shape through `model/stored-records`,
+ * re-exported here for the routes.
+ */
+import { type OutreachOrgCollection } from '../model/outreach.types';
+export { readStoredOutreachEnrollment, readStoredOutreachMailbox, readStoredOutreachSequence, } from '../model/stored-records';
+/** `orgs/{orgId}/<collection>` for one of Outreach's org-scoped collections. */
+export declare function outreachOrgCollection(firestore: FirebaseFirestore.Firestore, orgId: string, collection: OutreachOrgCollection): FirebaseFirestore.CollectionReference;
+/**
+ * The id of one person's enrollment in one sequence. Deterministic, so a
+ * person is enrolled in a sequence once, ever: a second enroll finds the
+ * first document where a random id would have made a second, and a second
+ * run through the same emails is exactly what must not happen.
+ */
+export declare function outreachEnrollmentId(sequenceId: string, contactId: string): string;

package/src/lib/storage/outreach-records.js

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Where the org-scoped Outreach documents live, as the server reaches them
+ * (AGL-2980). Server only — the references are the Admin SDK's. Each
+ * document reads back into its model shape through `model/stored-records`,
+ * re-exported here for the routes.
+ */ import { OUTREACH_COLLECTIONS } from "../model/outreach.types.js";
+export { readStoredOutreachEnrollment, readStoredOutreachMailbox, readStoredOutreachSequence } from "../model/stored-records.js";
+/** `orgs/{orgId}/<collection>` for one of Outreach's org-scoped collections. */ export function outreachOrgCollection(firestore, orgId, collection) {
+    return firestore.collection('orgs').doc(orgId).collection(OUTREACH_COLLECTIONS[collection]);
+}
+/**
+ * The id of one person's enrollment in one sequence. Deterministic, so a
+ * person is enrolled in a sequence once, ever: a second enroll finds the
+ * first document where a random id would have made a second, and a second
+ * run through the same emails is exactly what must not happen.
+ */ export function outreachEnrollmentId(sequenceId, contactId) {
+    return `${sequenceId}_${contactId}`;
+}
+
+//# sourceMappingURL=outreach-records.js.map

package/src/lib/storage/outreach-records.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/storage/outreach-records.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Where the org-scoped Outreach documents live, as the server reaches them\n * (AGL-2980). Server only — the references are the Admin SDK's. Each\n * document reads back into its model shape through `model/stored-records`,\n * re-exported here for the routes.\n */\n\nimport { OUTREACH_COLLECTIONS, type OutreachOrgCollection } from '../model/outreach.types'\n\nexport {\n  readStoredOutreachEnrollment,\n  readStoredOutreachMailbox,\n  readStoredOutreachSequence,\n} from '../model/stored-records'\n\n/** `orgs/{orgId}/<collection>` for one of Outreach's org-scoped collections. */\nexport function outreachOrgCollection(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  collection: OutreachOrgCollection,\n): FirebaseFirestore.CollectionReference {\n  return firestore.collection('orgs').doc(orgId).collection(OUTREACH_COLLECTIONS[collection])\n}\n\n/**\n * The id of one person's enrollment in one sequence. Deterministic, so a\n * person is enrolled in a sequence once, ever: a second enroll finds the\n * first document where a random id would have made a second, and a second\n * run through the same emails is exactly what must not happen.\n */\nexport function outreachEnrollmentId(sequenceId: string, contactId: string): string {\n  return `${sequenceId}_${contactId}`\n}\n"],"names":["OUTREACH_COLLECTIONS","readStoredOutreachEnrollment","readStoredOutreachMailbox","readStoredOutreachSequence","outreachOrgCollection","firestore","orgId","collection","doc","outreachEnrollmentId","sequenceId","contactId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;CAKC,GAED,SAASA,oBAAoB,QAAoC,6BAAyB;AAE1F,SACEC,4BAA4B,EAC5BC,yBAAyB,EACzBC,0BAA0B,QACrB,6BAAyB;AAEhC,8EAA8E,GAC9E,OAAO,SAASC,sBACdC,SAAsC,EACtCC,KAAa,EACbC,UAAiC;IAEjC,OAAOF,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACF,OAAOC,UAAU,CAACP,oBAAoB,CAACO,WAAW;AAC5F;AAEA;;;;;CAKC,GACD,OAAO,SAASE,qBAAqBC,UAAkB,EAAEC,SAAiB;IACxE,OAAO,GAAGD,WAAW,CAAC,EAAEC,WAAW;AACrC"}

package/src/lib/subprocessors.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginEgressHostDeclaration, PluginEgressUseDeclaration, PluginSubprocessorsAnswer } from '@aglyn/aglyn/plugin-manager/plugin-subprocessors';
+/**
+ * The hosts this plugin's code names (AGL-2978), declared here rather than in
+ * the console's subprocessor inventory. Named under `subprocessors` in
+ * `plugins.config.json`; the manifest generator calls
+ * {@link outreachSubprocessors} and the inventory folds the answer in.
+ *
+ * A sequence sends a rep's one-to-one mail from the rep's OWN Google mailbox,
+ * through the Gmail API, under an OAuth grant the rep gives from their own
+ * Google account. `not-a-subprocessor` on the SECOND admissible reason: the
+ * mailbox provider is the customer's, engaged by the customer for their own
+ * mail, and a sequence acts in it at the rep's direction — Aglyn selects no
+ * mail vendor for this, any more than it selects the video host an author
+ * embeds. ⚑ A classification for legal to confirm when Sequences leaves staff
+ * preview; the consent screen is Internal to the aglyn.com Workspace until
+ * then.
+ *
+ * Google's token endpoint is already declared by the inventory, for the
+ * platform's own service-account exchange, so this plugin adds its use of it
+ * rather than a second declaration.
+ *
+ * Each host is read off the constant the transport calls, so a moved
+ * endpoint moves its declaration with it.
+ */
+/** The Gmail REST API: the rep's own mailbox. */
+export declare const OUTREACH_GMAIL_HOST: PluginEgressHostDeclaration;
+/** Google's consent address, which only the rep's browser opens. */
+export declare const OUTREACH_GOOGLE_CONSENT_HOST: PluginEgressHostDeclaration;
+/** Google's token and revocation endpoint, declared by the inventory. */
+export declare const OUTREACH_GOOGLE_TOKEN_USE: PluginEgressUseDeclaration;
+/** The plugin's `subprocessors` entry: no recipient of its own, two hosts and one use. */
+export declare function outreachSubprocessors(): PluginSubprocessorsAnswer;

package/src/lib/subprocessors.js

@@ -0,0 +1,70 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { GMAIL_API_BASE } from "./transport/gmail-client.js";
+import { GOOGLE_OAUTH_ENDPOINTS } from "./transport/google-oauth.js";
+/**
+ * The hosts this plugin's code names (AGL-2978), declared here rather than in
+ * the console's subprocessor inventory. Named under `subprocessors` in
+ * `plugins.config.json`; the manifest generator calls
+ * {@link outreachSubprocessors} and the inventory folds the answer in.
+ *
+ * A sequence sends a rep's one-to-one mail from the rep's OWN Google mailbox,
+ * through the Gmail API, under an OAuth grant the rep gives from their own
+ * Google account. `not-a-subprocessor` on the SECOND admissible reason: the
+ * mailbox provider is the customer's, engaged by the customer for their own
+ * mail, and a sequence acts in it at the rep's direction — Aglyn selects no
+ * mail vendor for this, any more than it selects the video host an author
+ * embeds. ⚑ A classification for legal to confirm when Sequences leaves staff
+ * preview; the consent screen is Internal to the aglyn.com Workspace until
+ * then.
+ *
+ * Google's token endpoint is already declared by the inventory, for the
+ * platform's own service-account exchange, so this plugin adds its use of it
+ * rather than a second declaration.
+ *
+ * Each host is read off the constant the transport calls, so a moved
+ * endpoint moves its declaration with it.
+ */ /** The Gmail REST API: the rep's own mailbox. */ export const OUTREACH_GMAIL_HOST = {
+    host: new URL(GMAIL_API_BASE).host,
+    disposition: 'not-a-subprocessor',
+    reason: "Customer-chosen destination. The Gmail REST API of the rep's own Google Workspace mailbox, which the rep connects in Sequences → Mailboxes (`libs/plugins/outreach/src/lib/transport/gmail-client.ts`): the account's profile and verified send-as addresses at connect, a plain-text test the rep sends to themselves, and — for the sending runtime (AGL-2981) — the sequence messages it sends, and the reads and searches of that same mailbox that find what came back: replies, out-of-office answers, bounces and unsubscribe requests. The provider is the one the customer runs its mail on; nothing is sent to a mailbox the rep did not connect.",
+    dataReceived: "The rep's own OAuth access token, and the mail the rep sends from their own mailbox — each recipient's address, the subject and the plain-text body. The runtime's searches carry the addresses of the people the rep is writing to, the rep's `+unsubscribe` address and the Message-IDs of mail it sent. What the runtime reads back is the rep's own mail: the ids of newly received messages, and whole messages — headers and plain-text or HTML bodies, delivery reports included — of the rep's sequence threads and of the replies, bounces and unsubscribe requests its searches find. No other customer record, and nothing about a site visitor."
+};
+/** Google's consent address, which only the rep's browser opens. */ export const OUTREACH_GOOGLE_CONSENT_HOST = {
+    host: new URL(GOOGLE_OAUTH_ENDPOINTS.authorize).host,
+    disposition: 'no-request',
+    reason: "Google's OAuth consent address, built by `buildGoogleAuthorizationUrl` in `libs/plugins/outreach/src/lib/transport/google-oauth.ts` and handed to the rep's own browser, which opens it to grant Sequences access to the rep's own mailbox. No server of ours requests it; the browser's visit is between the rep and their Google account.",
+    dataReceived: "Nothing from our servers. The rep's browser carries the OAuth client id, the requested scopes, a signed state, a PKCE challenge and a login hint — the rep's own sign-in address."
+};
+/** Google's token and revocation endpoint, declared by the inventory. */ export const OUTREACH_GOOGLE_TOKEN_USE = {
+    host: new URL(GOOGLE_OAUTH_ENDPOINTS.token).host,
+    reason: "Since AGL-2978 also the Sequences OAuth token endpoint for a rep's own Google mailbox grant — the code exchange at connect, the access-token refresh before each Gmail call, and the revocation on disconnect, org erasure or account erasure — which is the rep's own account at the rep's own provider, the same footing as `gmail.googleapis.com`.",
+    dataReceived: "For Sequences: the deployment's OAuth client credentials and, for the rep's own grant, the authorization code, PKCE verifier, refresh token and access token Google itself issued — credentials, never message content. ⚑ Legal to confirm the Annex III cell needs no change for the Sequences use."
+};
+/** The plugin's `subprocessors` entry: no recipient of its own, two hosts and one use. */ export function outreachSubprocessors() {
+    return {
+        subprocessors: [],
+        hosts: [
+            OUTREACH_GMAIL_HOST,
+            OUTREACH_GOOGLE_CONSENT_HOST
+        ],
+        uses: [
+            OUTREACH_GOOGLE_TOKEN_USE
+        ]
+    };
+}
+
+//# sourceMappingURL=subprocessors.js.map