@aglyn/plugins-outreach 1.0.0-beta.155 → 1.0.0-beta.157

package/src/lib/constants/api-routes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/constants/api-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Outreach's console API routes, as the dispatcher keys them (AGL-2974).\n *\n * One table both halves import, because the server registers the path and the\n * client fetches it, and a route spelled twice is a route that 404s the day\n * one spelling changes. Every path sits under the `outreach` prefix that\n * `plugins.config.json` gives this plugin, which is what lets the console's\n * `/api/[...pluginApi]` dispatcher gate a request on the plugin being enabled\n * and released before the handler runs. Client-safe: constants only.\n */\nexport const OUTREACH_API_ROUTES = {\n  /** `GET` — proves the server bundle loaded and registered; see `server.ts`. */\n  ping: 'outreach/ping',\n  // Mailboxes (AGL-2978). Every one names its org (`orgId`, query or body)\n  // so the dispatcher's release gate asks about that organization.\n  /** `GET ?orgId` — whether this deployment can connect a Google mailbox. */\n  mailboxesAvailability: 'outreach/mailboxes/availability',\n  /** `POST` — Google's consent address for a new connect. */\n  mailboxesConnect: 'outreach/mailboxes/connect',\n  /**\n   * `GET` — Google's redirect back. It carries no bearer token: the signed\n   * state names the org and the member, and the route hands the code to the\n   * Mailboxes page in a fragment rather than acting on it.\n   */\n  mailboxesOAuthCallback: 'outreach/mailboxes/oauth/callback',\n  /** `POST` — finishes a connect with the member's own session. */\n  mailboxesConnectComplete: 'outreach/mailboxes/connect/complete',\n  /** `POST` — send-as, display name, daily cap, sending window, timezone. */\n  mailboxesSettings: 'outreach/mailboxes/settings',\n  /** `POST` — pause or resume. */\n  mailboxesStatus: 'outreach/mailboxes/status',\n  /** `POST` — a plain-text test to the account's own address. */\n  mailboxesTest: 'outreach/mailboxes/test',\n  /** `POST` — revoke the grant at Google and delete the mailbox. */\n  mailboxesDisconnect: 'outreach/mailboxes/disconnect',\n  // Settings, sequences and enrollments (AGL-2980). Every one names its org\n  // (`orgId`, query or body); the contract is `model/outreach-api.ts`.\n  /** `GET ?orgId` — the compliance settings; `POST` — save them. */\n  settings: 'outreach/settings',\n  /** `POST` — create a sequence, or save an edit to one. */\n  sequencesSave: 'outreach/sequences/save',\n  /** `POST` — activate, pause or archive a sequence. */\n  sequencesStatus: 'outreach/sequences/status',\n  /** `POST` — delete a draft nobody was enrolled in. */\n  sequencesDelete: 'outreach/sequences/delete',\n  /** `POST` — who a saved view or a search would enroll, and where each stands. */\n  enrollPreview: 'outreach/enroll/preview',\n  /** `POST` — enroll them, every gate checked again. */\n  enroll: 'outreach/enroll',\n  /** `POST` — pause, resume, stop, or mark do-not-contact. */\n  enrollmentsAction: 'outreach/enrollments/action',\n  /** `POST` — one email of a saved sequence, for a contact or a sample person. */\n  preview: 'outreach/preview',\n  // The one route a RECIPIENT reaches (AGL-2981): no session, a signed\n  // token instead, and registered as a recipient link so it answers whether\n  // or not Outreach is released for the organization now.\n  /** `GET` and the RFC 8058 one-click `POST` — `?t=<signed token>`. */\n  unsubscribe: 'outreach/unsubscribe',\n} as const\n"],"names":["OUTREACH_API_ROUTES","ping","mailboxesAvailability","mailboxesConnect","mailboxesOAuthCallback","mailboxesConnectComplete","mailboxesSettings","mailboxesStatus","mailboxesTest","mailboxesDisconnect","settings","sequencesSave","sequencesStatus","sequencesDelete","enrollPreview","enroll","enrollmentsAction","preview","unsubscribe"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAsB;IACjC,6EAA6E,GAC7EC,MAAM;IACN,yEAAyE;IACzE,iEAAiE;IACjE,yEAAyE,GACzEC,uBAAuB;IACvB,yDAAyD,GACzDC,kBAAkB;IAClB;;;;GAIC,GACDC,wBAAwB;IACxB,+DAA+D,GAC/DC,0BAA0B;IAC1B,yEAAyE,GACzEC,mBAAmB;IACnB,8BAA8B,GAC9BC,iBAAiB;IACjB,6DAA6D,GAC7DC,eAAe;IACf,gEAAgE,GAChEC,qBAAqB;IACrB,0EAA0E;IAC1E,qEAAqE;IACrE,gEAAgE,GAChEC,UAAU;IACV,wDAAwD,GACxDC,eAAe;IACf,oDAAoD,GACpDC,iBAAiB;IACjB,oDAAoD,GACpDC,iBAAiB;IACjB,+EAA+E,GAC/EC,eAAe;IACf,oDAAoD,GACpDC,QAAQ;IACR,0DAA0D,GAC1DC,mBAAmB;IACnB,8EAA8E,GAC9EC,SAAS;IACT,qEAAqE;IACrE,0EAA0E;IAC1E,wDAAwD;IACxD,mEAAmE,GACnEC,aAAa;AACf,EAAU"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/constants/api-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Outreach's console API routes, as the dispatcher keys them (AGL-2974).\n *\n * One table both halves import, because the server registers the path and the\n * client fetches it, and a route spelled twice is a route that 404s the day\n * one spelling changes. Every path sits under the `outreach` prefix that\n * `plugins.config.json` gives this plugin, which is what lets the console's\n * `/api/[...pluginApi]` dispatcher gate a request on the plugin being enabled\n * and released before the handler runs. Client-safe: constants only.\n */\nexport const OUTREACH_API_ROUTES = {\n  /** `GET` — proves the server bundle loaded and registered; see `server.ts`. */\n  ping: 'outreach/ping',\n  // Mailboxes (AGL-2978). Every one names its org (`orgId`, query or body)\n  // so the dispatcher's release gate asks about that organization.\n  /** `GET ?orgId` — whether this deployment can connect a Google mailbox. */\n  mailboxesAvailability: 'outreach/mailboxes/availability',\n  /** `POST` — Google's consent address for a new connect. */\n  mailboxesConnect: 'outreach/mailboxes/connect',\n  /**\n   * `GET` — Google's redirect back. It carries no bearer token: the signed\n   * state names the org and the member, and the route hands the code to the\n   * Mailboxes page in a fragment rather than acting on it.\n   */\n  mailboxesOAuthCallback: 'outreach/mailboxes/oauth/callback',\n  /** `POST` — finishes a connect with the member's own session. */\n  mailboxesConnectComplete: 'outreach/mailboxes/connect/complete',\n  /** `POST` — send-as, display name, daily cap, sending window, timezone. */\n  mailboxesSettings: 'outreach/mailboxes/settings',\n  /** `POST` — pause or resume. */\n  mailboxesStatus: 'outreach/mailboxes/status',\n  /** `POST` — a plain-text test to the account's own address. */\n  mailboxesTest: 'outreach/mailboxes/test',\n  /** `POST` — revoke the grant at Google and delete the mailbox. */\n  mailboxesDisconnect: 'outreach/mailboxes/disconnect',\n  // Settings, sequences and enrollments (AGL-2980). Every one names its org\n  // (`orgId`, query or body); the contract is `model/outreach-api.ts`.\n  /** `GET ?orgId` — the compliance settings; `POST` — save them. */\n  settings: 'outreach/settings',\n  /** `POST` — create a sequence, or save an edit to one. */\n  sequencesSave: 'outreach/sequences/save',\n  /** `POST` — activate, pause or archive a sequence. */\n  sequencesStatus: 'outreach/sequences/status',\n  /** `POST` — delete a draft nobody was enrolled in. */\n  sequencesDelete: 'outreach/sequences/delete',\n  /** `POST` — who a saved view or a search would enroll, and where each stands. */\n  enrollPreview: 'outreach/enroll/preview',\n  /** `POST` — enroll them, every gate checked again. */\n  enroll: 'outreach/enroll',\n  /** `POST` — pause, resume, stop, or mark do-not-contact. */\n  enrollmentsAction: 'outreach/enrollments/action',\n  /** `POST` — one email of a saved sequence, for a contact or a sample person. */\n  preview: 'outreach/preview',\n  // The one route a RECIPIENT reaches (AGL-2981): no session, a signed\n  // token instead, and registered as a recipient link so it answers whether\n  // or not Outreach is released for the organization now.\n  /** `GET` and the RFC 8058 one-click `POST` — `?t=<signed token>`. */\n  unsubscribe: 'outreach/unsubscribe',\n  /**\n   * `GET` — a link in a tracked sequence email (AGL-3239). `?t=<signed\n   * token>`; answers a redirect to the destination the token names, and\n   * records the click afterwards. A recipient link like the unsubscribe\n   * one: no session, and it answers whether or not Outreach is released to\n   * the organization now, because a link in an email that already left must\n   * not stop working when a rollout is paused.\n   */\n  click: 'outreach/click',\n} as const\n"],"names":["OUTREACH_API_ROUTES","ping","mailboxesAvailability","mailboxesConnect","mailboxesOAuthCallback","mailboxesConnectComplete","mailboxesSettings","mailboxesStatus","mailboxesTest","mailboxesDisconnect","settings","sequencesSave","sequencesStatus","sequencesDelete","enrollPreview","enroll","enrollmentsAction","preview","unsubscribe","click"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAsB;IACjC,6EAA6E,GAC7EC,MAAM;IACN,yEAAyE;IACzE,iEAAiE;IACjE,yEAAyE,GACzEC,uBAAuB;IACvB,yDAAyD,GACzDC,kBAAkB;IAClB;;;;GAIC,GACDC,wBAAwB;IACxB,+DAA+D,GAC/DC,0BAA0B;IAC1B,yEAAyE,GACzEC,mBAAmB;IACnB,8BAA8B,GAC9BC,iBAAiB;IACjB,6DAA6D,GAC7DC,eAAe;IACf,gEAAgE,GAChEC,qBAAqB;IACrB,0EAA0E;IAC1E,qEAAqE;IACrE,gEAAgE,GAChEC,UAAU;IACV,wDAAwD,GACxDC,eAAe;IACf,oDAAoD,GACpDC,iBAAiB;IACjB,oDAAoD,GACpDC,iBAAiB;IACjB,+EAA+E,GAC/EC,eAAe;IACf,oDAAoD,GACpDC,QAAQ;IACR,0DAA0D,GAC1DC,mBAAmB;IACnB,8EAA8E,GAC9EC,SAAS;IACT,qEAAqE;IACrE,0EAA0E;IAC1E,wDAAwD;IACxD,mEAAmE,GACnEC,aAAa;IACb;;;;;;;GAOC,GACDC,OAAO;AACT,EAAU"}

package/src/lib/engine/click-tracking.d.ts

@@ -0,0 +1,98 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A URL as it appears in a plain-text body, with where it was found.
+ *
+ * `end` is exclusive, so `text.slice(start, end)` is exactly `url`.
+ */
+export interface OutreachBodyLink {
+    url: string;
+    start: number;
+    end: number;
+}
+/**
+ * Every http(s) URL in a plain-text body, in the order they appear.
+ *
+ * Duplicates are returned as the separate occurrences they are: the same
+ * destination written twice is two links to rewrite, and each gets its own
+ * index so a click says which one was followed.
+ */
+export declare function outreachBodyLinks(text: string): OutreachBodyLink[];
+/** What {@link rewriteOutreachBodyLinks} produced. */
+export interface OutreachRewrittenBody {
+    text: string;
+    /**
+     * The destinations that were rewritten, in the order their tracking links
+     * were minted — the index a click token names.
+     *
+     * Empty when nothing was rewritten, which is what a body with no links, a
+     * sequence with tracking off, and a minter that could not sign all read as.
+     */
+    links: string[];
+}
+/**
+ * Rewrites every link in a plain-text body to a tracking link.
+ *
+ * @param text The rendered step body, footer NOT yet appended.
+ * @param mint Answers the tracking URL for the link at `index`, or `null` to
+ *   leave that one alone. A minter that cannot sign returns `null` for every
+ *   link and the body goes out exactly as it was written — an email whose
+ *   links do not work is far worse than an email we cannot measure.
+ */
+export declare function rewriteOutreachBodyLinks(text: string, mint: (link: {
+    url: string;
+    index: number;
+}) => string | null): OutreachRewrittenBody;
+/**
+ * How soon after a send a click is a machine's however it identifies itself.
+ *
+ * A scanner fetches as the message is delivered. A person has to receive the
+ * mail, notice it and read it, and thirty seconds is faster than anyone does
+ * that on a cold email — while being long enough to stay wrong only in the
+ * rarest case, which is a rate that reads a little low rather than a rate
+ * that reads triple.
+ */
+export declare const OUTREACH_CLICK_HUMAN_DELAY_MS = 30000;
+/** Why a click was read as a machine's, or `null` when it was a person's. */
+export type OutreachClickMachineReason = 'agent' | 'too_soon' | 'method';
+/** What one request to a tracking link was. */
+export interface OutreachClickJudgement {
+    /** Whether it counts toward the click rate. */
+    human: boolean;
+    /** Why it does not; `null` when it does. */
+    machineReason: OutreachClickMachineReason | null;
+}
+/**
+ * Whether one request to a tracking link is a person's.
+ *
+ * Read before the redirect is *recorded*, never before it is *answered*: a
+ * machine is forwarded to the destination exactly as a person is, because a
+ * scanner that gets a refusal reports the link as broken and the mail as
+ * suspicious.
+ *
+ * @param input.method The HTTP method. A `HEAD` is a fetch of the headers
+ *   alone, which no mail client does for a person following a link.
+ * @param input.userAgent The request's agent, `''` when it sent none — which
+ *   is itself a machine, since every browser sends one.
+ * @param input.sinceSentMs Milliseconds between the send and this request,
+ *   or `null` when the send it belongs to could not be found.
+ */
+export declare function judgeOutreachClick(input: {
+    method: string;
+    userAgent: string | null | undefined;
+    sinceSentMs: number | null;
+}): OutreachClickJudgement;

package/src/lib/engine/click-tracking.js

@@ -0,0 +1,252 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * CLICKS, IN A PLAIN-TEXT EMAIL (AGL-3239).
+ *
+ * A marketing campaign gets its opens and clicks from Resend, which rewrites
+ * the links and injects a pixel into the HTML part before the message leaves.
+ * A sequence has neither half of that: it goes out through the rep's own
+ * Gmail, and it goes out as plain text on purpose.
+ *
+ * ## Why there is no open rate here, and never a zero one
+ *
+ * An open is measured by a pixel, a pixel is an `<img>`, and an `<img>` needs
+ * an HTML part. Giving cold one-to-one email a multipart HTML body is the
+ * deliverability posture this plugin was built to avoid, so opens are not
+ * measured at all — and the report SAYS SO rather than rendering 0%, exactly
+ * as `campaign-report.ts` withholds a rate whose denominator was never
+ * recorded. A zero that could only ever have been zero measures our sending
+ * code, not the recipient.
+ *
+ * A click needs no HTML. It needs the destination in the body to be a link of
+ * ours that forwards to theirs, which is what this module writes.
+ *
+ * ## What it will and will not rewrite
+ *
+ * Only bare `http:`/`https:` URLs, and only in the STEP'S OWN BODY — the
+ * rewrite runs on the rendered body before the footer is appended, so the
+ * organization's legal name, its postal address and the way out are never
+ * touched. `mailto:` is left alone: the opt-out address is the one link in a
+ * cold email that must not route through us.
+ *==========================================*/ /**
+ * A URL as it appears in a plain-text body, with where it was found.
+ *
+ * `end` is exclusive, so `text.slice(start, end)` is exactly `url`.
+ */ /**
+ * Trailing characters a sentence puts after a URL that are not part of it.
+ *
+ * A plain-text body is prose, so a link is routinely followed by a full stop,
+ * a comma or a closing bracket. Taking those into the URL would rewrite a
+ * destination nobody wrote and forward the recipient to a 404.
+ */ const TRAILING_PUNCTUATION = /[.,;:!?'"]+$/;
+/**
+ * A bare http(s) URL, up to the first whitespace or bracket that never
+ * belongs in one.
+ *
+ * `(` and `)` are NOT excluded, because a real path can contain them — a
+ * Wikipedia article is the everyday example — and {@link trimUrlEnd}
+ * decides which trailing one is the URL's and which is the sentence's.
+ */ const URL_PATTERN = /https?:\/\/[^\s<>[\]{}"']+/gi;
+/**
+ * Trims what the sentence put after the URL, not what the URL contains.
+ *
+ * A closing bracket is the URL's when the URL opened one, and the
+ * sentence's when it did not — which is the usual case, a link inside a
+ * parenthetical. Counted rather than merely looked for, so a link that is
+ * both parenthesised AND contains brackets loses exactly the outer one.
+ */ function trimUrlEnd(raw) {
+    let url = raw.replace(TRAILING_PUNCTUATION, '');
+    while(url.endsWith(')')){
+        const opened = url.split('(').length - 1;
+        const closed = url.split(')').length - 1;
+        if (closed <= opened) break;
+        url = url.slice(0, -1).replace(TRAILING_PUNCTUATION, '');
+    }
+    return url;
+}
+/**
+ * Every http(s) URL in a plain-text body, in the order they appear.
+ *
+ * Duplicates are returned as the separate occurrences they are: the same
+ * destination written twice is two links to rewrite, and each gets its own
+ * index so a click says which one was followed.
+ */ export function outreachBodyLinks(text) {
+    const body = String(text != null ? text : '');
+    const links = [];
+    for (const match of body.matchAll(URL_PATTERN)){
+        var _match_index;
+        const start = (_match_index = match.index) != null ? _match_index : 0;
+        const url = trimUrlEnd(match[0]);
+        if (!url) continue;
+        let parsed;
+        try {
+            parsed = new URL(url);
+        } catch (unused) {
+            continue;
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') continue;
+        links.push({
+            url,
+            start,
+            end: start + url.length
+        });
+    }
+    return links;
+}
+/**
+ * Rewrites every link in a plain-text body to a tracking link.
+ *
+ * @param text The rendered step body, footer NOT yet appended.
+ * @param mint Answers the tracking URL for the link at `index`, or `null` to
+ *   leave that one alone. A minter that cannot sign returns `null` for every
+ *   link and the body goes out exactly as it was written — an email whose
+ *   links do not work is far worse than an email we cannot measure.
+ */ export function rewriteOutreachBodyLinks(text, mint) {
+    const body = String(text != null ? text : '');
+    const found = outreachBodyLinks(body);
+    if (!found.length) return {
+        text: body,
+        links: []
+    };
+    const links = [];
+    let out = '';
+    let cursor = 0;
+    for (const link of found){
+        // The index a token carries is the index in `links`, which counts only
+        // the links that were actually rewritten. A minter that skips one must
+        // not shift the numbering of the ones after it.
+        const tracked = mint({
+            url: link.url,
+            index: links.length
+        });
+        out += body.slice(cursor, link.start);
+        if (tracked) {
+            out += tracked;
+            links.push(link.url);
+        } else {
+            out += link.url;
+        }
+        cursor = link.end;
+    }
+    return {
+        text: out + body.slice(cursor),
+        links
+    };
+}
+/*==========================================
+ * WHO CLICKED: A PERSON, OR A MACHINE.
+ *
+ * Every corporate mailbox now runs the links in an incoming email before the
+ * recipient ever sees it — Microsoft Defender's Safe Links, Proofpoint,
+ * Mimecast, Barracuda, and Gmail's own scanning. Each of those fetches is a
+ * click by any definition a redirect handler can apply, and on cold B2B mail
+ * they outnumber the human ones.
+ *
+ * Counting them is how a sequence reports a 60% click rate on an email
+ * nobody read. So they are counted APART: `clicks` and `uniqueClicks` are
+ * the human ones and carry the rate, `machineClicks` is kept beside them and
+ * shown, because a number withheld silently is the other way to mislead.
+ *
+ * This is the same judgement `campaign-revenue.ts` records about Apple's Mail
+ * Privacy Protection inflating opens — stated on the screen rather than
+ * quietly corrected away.
+ *==========================================*/ /**
+ * How soon after a send a click is a machine's however it identifies itself.
+ *
+ * A scanner fetches as the message is delivered. A person has to receive the
+ * mail, notice it and read it, and thirty seconds is faster than anyone does
+ * that on a cold email — while being long enough to stay wrong only in the
+ * rarest case, which is a rate that reads a little low rather than a rate
+ * that reads triple.
+ */ export const OUTREACH_CLICK_HUMAN_DELAY_MS = 30000;
+/**
+ * Agents that say what they are. Matched case-insensitively as substrings of
+ * the user agent, so a version bump does not un-match one.
+ *
+ * Absence from this list is not evidence of a person — most scanners
+ * impersonate a browser, which is what {@link OUTREACH_CLICK_HUMAN_DELAY_MS}
+ * is for.
+ */ const MACHINE_AGENTS = [
+    'bot',
+    'crawler',
+    'spider',
+    'slurp',
+    'preview',
+    'scanner',
+    'curl',
+    'wget',
+    'python-requests',
+    'java/',
+    'go-http-client',
+    'okhttp',
+    'headlesschrome',
+    'phantomjs',
+    'proofpoint',
+    'mimecast',
+    'barracuda',
+    'symantec',
+    'forcepoint',
+    'microsoft office',
+    'ms-office',
+    'bingpreview',
+    'skypeuripreview',
+    'google-safety',
+    'googleimageproxy',
+    'apache-httpclient',
+    'axios',
+    'node-fetch',
+    'urlresolver',
+    'safelinks'
+];
+/**
+ * Whether one request to a tracking link is a person's.
+ *
+ * Read before the redirect is *recorded*, never before it is *answered*: a
+ * machine is forwarded to the destination exactly as a person is, because a
+ * scanner that gets a refusal reports the link as broken and the mail as
+ * suspicious.
+ *
+ * @param input.method The HTTP method. A `HEAD` is a fetch of the headers
+ *   alone, which no mail client does for a person following a link.
+ * @param input.userAgent The request's agent, `''` when it sent none — which
+ *   is itself a machine, since every browser sends one.
+ * @param input.sinceSentMs Milliseconds between the send and this request,
+ *   or `null` when the send it belongs to could not be found.
+ */ export function judgeOutreachClick(input) {
+    var _input_method, _input_userAgent;
+    const machine = (machineReason)=>({
+            human: false,
+            machineReason
+        });
+    if (String((_input_method = input.method) != null ? _input_method : '').toUpperCase() === 'HEAD') return machine('method');
+    const agent = String((_input_userAgent = input.userAgent) != null ? _input_userAgent : '').trim().toLowerCase();
+    if (!agent) return machine('agent');
+    if (MACHINE_AGENTS.some((needle)=>agent.includes(needle))) return machine('agent');
+    /*
+   * A click that arrives BEFORE the send it belongs to is a clock disagreeing
+   * with itself, not a time traveller, and it is read as a person's: the one
+   * thing worse than counting a scanner is refusing to count a real reply to
+   * an email because two machines are a second apart.
+   */ if (input.sinceSentMs !== null && input.sinceSentMs >= 0 && input.sinceSentMs < OUTREACH_CLICK_HUMAN_DELAY_MS) {
+        return machine('too_soon');
+    }
+    return {
+        human: true,
+        machineReason: null
+    };
+}
+
+//# sourceMappingURL=click-tracking.js.map

package/src/lib/engine/click-tracking.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/click-tracking.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * CLICKS, IN A PLAIN-TEXT EMAIL (AGL-3239).\n *\n * A marketing campaign gets its opens and clicks from Resend, which rewrites\n * the links and injects a pixel into the HTML part before the message leaves.\n * A sequence has neither half of that: it goes out through the rep's own\n * Gmail, and it goes out as plain text on purpose.\n *\n * ## Why there is no open rate here, and never a zero one\n *\n * An open is measured by a pixel, a pixel is an `<img>`, and an `<img>` needs\n * an HTML part. Giving cold one-to-one email a multipart HTML body is the\n * deliverability posture this plugin was built to avoid, so opens are not\n * measured at all — and the report SAYS SO rather than rendering 0%, exactly\n * as `campaign-report.ts` withholds a rate whose denominator was never\n * recorded. A zero that could only ever have been zero measures our sending\n * code, not the recipient.\n *\n * A click needs no HTML. It needs the destination in the body to be a link of\n * ours that forwards to theirs, which is what this module writes.\n *\n * ## What it will and will not rewrite\n *\n * Only bare `http:`/`https:` URLs, and only in the STEP'S OWN BODY — the\n * rewrite runs on the rendered body before the footer is appended, so the\n * organization's legal name, its postal address and the way out are never\n * touched. `mailto:` is left alone: the opt-out address is the one link in a\n * cold email that must not route through us.\n *==========================================*/\n\n/**\n * A URL as it appears in a plain-text body, with where it was found.\n *\n * `end` is exclusive, so `text.slice(start, end)` is exactly `url`.\n */\nexport interface OutreachBodyLink {\n  url: string\n  start: number\n  end: number\n}\n\n/**\n * Trailing characters a sentence puts after a URL that are not part of it.\n *\n * A plain-text body is prose, so a link is routinely followed by a full stop,\n * a comma or a closing bracket. Taking those into the URL would rewrite a\n * destination nobody wrote and forward the recipient to a 404.\n */\nconst TRAILING_PUNCTUATION = /[.,;:!?'\"]+$/\n\n/**\n * A bare http(s) URL, up to the first whitespace or bracket that never\n * belongs in one.\n *\n * `(` and `)` are NOT excluded, because a real path can contain them — a\n * Wikipedia article is the everyday example — and {@link trimUrlEnd}\n * decides which trailing one is the URL's and which is the sentence's.\n */\nconst URL_PATTERN = /https?:\\/\\/[^\\s<>[\\]{}\"']+/gi\n\n/**\n * Trims what the sentence put after the URL, not what the URL contains.\n *\n * A closing bracket is the URL's when the URL opened one, and the\n * sentence's when it did not — which is the usual case, a link inside a\n * parenthetical. Counted rather than merely looked for, so a link that is\n * both parenthesised AND contains brackets loses exactly the outer one.\n */\nfunction trimUrlEnd(raw: string): string {\n  let url = raw.replace(TRAILING_PUNCTUATION, '')\n  while (url.endsWith(')')) {\n    const opened = url.split('(').length - 1\n    const closed = url.split(')').length - 1\n    if (closed <= opened) break\n    url = url.slice(0, -1).replace(TRAILING_PUNCTUATION, '')\n  }\n  return url\n}\n\n/**\n * Every http(s) URL in a plain-text body, in the order they appear.\n *\n * Duplicates are returned as the separate occurrences they are: the same\n * destination written twice is two links to rewrite, and each gets its own\n * index so a click says which one was followed.\n */\nexport function outreachBodyLinks(text: string): OutreachBodyLink[] {\n  const body = String(text ?? '')\n  const links: OutreachBodyLink[] = []\n  for (const match of body.matchAll(URL_PATTERN)) {\n    const start = match.index ?? 0\n    const url = trimUrlEnd(match[0])\n    if (!url) continue\n    let parsed: URL\n    try {\n      parsed = new URL(url)\n    } catch {\n      continue\n    }\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') continue\n    links.push({ url, start, end: start + url.length })\n  }\n  return links\n}\n\n/** What {@link rewriteOutreachBodyLinks} produced. */\nexport interface OutreachRewrittenBody {\n  text: string\n  /**\n   * The destinations that were rewritten, in the order their tracking links\n   * were minted — the index a click token names.\n   *\n   * Empty when nothing was rewritten, which is what a body with no links, a\n   * sequence with tracking off, and a minter that could not sign all read as.\n   */\n  links: string[]\n}\n\n/**\n * Rewrites every link in a plain-text body to a tracking link.\n *\n * @param text The rendered step body, footer NOT yet appended.\n * @param mint Answers the tracking URL for the link at `index`, or `null` to\n *   leave that one alone. A minter that cannot sign returns `null` for every\n *   link and the body goes out exactly as it was written — an email whose\n *   links do not work is far worse than an email we cannot measure.\n */\nexport function rewriteOutreachBodyLinks(\n  text: string,\n  mint: (link: { url: string; index: number }) => string | null,\n): OutreachRewrittenBody {\n  const body = String(text ?? '')\n  const found = outreachBodyLinks(body)\n  if (!found.length) return { text: body, links: [] }\n  const links: string[] = []\n  let out = ''\n  let cursor = 0\n  for (const link of found) {\n    // The index a token carries is the index in `links`, which counts only\n    // the links that were actually rewritten. A minter that skips one must\n    // not shift the numbering of the ones after it.\n    const tracked = mint({ url: link.url, index: links.length })\n    out += body.slice(cursor, link.start)\n    if (tracked) {\n      out += tracked\n      links.push(link.url)\n    } else {\n      out += link.url\n    }\n    cursor = link.end\n  }\n  return { text: out + body.slice(cursor), links }\n}\n\n/*==========================================\n * WHO CLICKED: A PERSON, OR A MACHINE.\n *\n * Every corporate mailbox now runs the links in an incoming email before the\n * recipient ever sees it — Microsoft Defender's Safe Links, Proofpoint,\n * Mimecast, Barracuda, and Gmail's own scanning. Each of those fetches is a\n * click by any definition a redirect handler can apply, and on cold B2B mail\n * they outnumber the human ones.\n *\n * Counting them is how a sequence reports a 60% click rate on an email\n * nobody read. So they are counted APART: `clicks` and `uniqueClicks` are\n * the human ones and carry the rate, `machineClicks` is kept beside them and\n * shown, because a number withheld silently is the other way to mislead.\n *\n * This is the same judgement `campaign-revenue.ts` records about Apple's Mail\n * Privacy Protection inflating opens — stated on the screen rather than\n * quietly corrected away.\n *==========================================*/\n\n/**\n * How soon after a send a click is a machine's however it identifies itself.\n *\n * A scanner fetches as the message is delivered. A person has to receive the\n * mail, notice it and read it, and thirty seconds is faster than anyone does\n * that on a cold email — while being long enough to stay wrong only in the\n * rarest case, which is a rate that reads a little low rather than a rate\n * that reads triple.\n */\nexport const OUTREACH_CLICK_HUMAN_DELAY_MS = 30_000\n\n/**\n * Agents that say what they are. Matched case-insensitively as substrings of\n * the user agent, so a version bump does not un-match one.\n *\n * Absence from this list is not evidence of a person — most scanners\n * impersonate a browser, which is what {@link OUTREACH_CLICK_HUMAN_DELAY_MS}\n * is for.\n */\nconst MACHINE_AGENTS = [\n  'bot',\n  'crawler',\n  'spider',\n  'slurp',\n  'preview',\n  'scanner',\n  'curl',\n  'wget',\n  'python-requests',\n  'java/',\n  'go-http-client',\n  'okhttp',\n  'headlesschrome',\n  'phantomjs',\n  'proofpoint',\n  'mimecast',\n  'barracuda',\n  'symantec',\n  'forcepoint',\n  'microsoft office',\n  'ms-office',\n  'bingpreview',\n  'skypeuripreview',\n  'google-safety',\n  'googleimageproxy',\n  'apache-httpclient',\n  'axios',\n  'node-fetch',\n  'urlresolver',\n  'safelinks',\n]\n\n/** Why a click was read as a machine's, or `null` when it was a person's. */\nexport type OutreachClickMachineReason = 'agent' | 'too_soon' | 'method'\n\n/** What one request to a tracking link was. */\nexport interface OutreachClickJudgement {\n  /** Whether it counts toward the click rate. */\n  human: boolean\n  /** Why it does not; `null` when it does. */\n  machineReason: OutreachClickMachineReason | null\n}\n\n/**\n * Whether one request to a tracking link is a person's.\n *\n * Read before the redirect is *recorded*, never before it is *answered*: a\n * machine is forwarded to the destination exactly as a person is, because a\n * scanner that gets a refusal reports the link as broken and the mail as\n * suspicious.\n *\n * @param input.method The HTTP method. A `HEAD` is a fetch of the headers\n *   alone, which no mail client does for a person following a link.\n * @param input.userAgent The request's agent, `''` when it sent none — which\n *   is itself a machine, since every browser sends one.\n * @param input.sinceSentMs Milliseconds between the send and this request,\n *   or `null` when the send it belongs to could not be found.\n */\nexport function judgeOutreachClick(input: {\n  method: string\n  userAgent: string | null | undefined\n  sinceSentMs: number | null\n}): OutreachClickJudgement {\n  const machine = (machineReason: OutreachClickMachineReason): OutreachClickJudgement => ({\n    human: false,\n    machineReason,\n  })\n  if (String(input.method ?? '').toUpperCase() === 'HEAD') return machine('method')\n  const agent = String(input.userAgent ?? '').trim().toLowerCase()\n  if (!agent) return machine('agent')\n  if (MACHINE_AGENTS.some((needle) => agent.includes(needle))) return machine('agent')\n  /*\n   * A click that arrives BEFORE the send it belongs to is a clock disagreeing\n   * with itself, not a time traveller, and it is read as a person's: the one\n   * thing worse than counting a scanner is refusing to count a real reply to\n   * an email because two machines are a second apart.\n   */\n  if (input.sinceSentMs !== null && input.sinceSentMs >= 0 && input.sinceSentMs < OUTREACH_CLICK_HUMAN_DELAY_MS) {\n    return machine('too_soon')\n  }\n  return { human: true, machineReason: null }\n}\n"],"names":["TRAILING_PUNCTUATION","URL_PATTERN","trimUrlEnd","raw","url","replace","endsWith","opened","split","length","closed","slice","outreachBodyLinks","text","body","String","links","match","matchAll","start","index","parsed","URL","protocol","push","end","rewriteOutreachBodyLinks","mint","found","out","cursor","link","tracked","OUTREACH_CLICK_HUMAN_DELAY_MS","MACHINE_AGENTS","judgeOutreachClick","input","machine","machineReason","human","method","toUpperCase","agent","userAgent","trim","toLowerCase","some","needle","includes","sinceSentMs"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CA4B4C,GAE5C;;;;CAIC,GAOD;;;;;;CAMC,GACD,MAAMA,uBAAuB;AAE7B;;;;;;;CAOC,GACD,MAAMC,cAAc;AAEpB;;;;;;;CAOC,GACD,SAASC,WAAWC,GAAW;IAC7B,IAAIC,MAAMD,IAAIE,OAAO,CAACL,sBAAsB;IAC5C,MAAOI,IAAIE,QAAQ,CAAC,KAAM;QACxB,MAAMC,SAASH,IAAII,KAAK,CAAC,KAAKC,MAAM,GAAG;QACvC,MAAMC,SAASN,IAAII,KAAK,CAAC,KAAKC,MAAM,GAAG;QACvC,IAAIC,UAAUH,QAAQ;QACtBH,MAAMA,IAAIO,KAAK,CAAC,GAAG,CAAC,GAAGN,OAAO,CAACL,sBAAsB;IACvD;IACA,OAAOI;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASQ,kBAAkBC,IAAY;IAC5C,MAAMC,OAAOC,OAAOF,eAAAA,OAAQ;IAC5B,MAAMG,QAA4B,EAAE;IACpC,KAAK,MAAMC,SAASH,KAAKI,QAAQ,CAACjB,aAAc;YAChCgB;QAAd,MAAME,SAAQF,eAAAA,MAAMG,KAAK,YAAXH,eAAe;QAC7B,MAAMb,MAAMF,WAAWe,KAAK,CAAC,EAAE;QAC/B,IAAI,CAACb,KAAK;QACV,IAAIiB;QACJ,IAAI;YACFA,SAAS,IAAIC,IAAIlB;QACnB,EAAE,eAAM;YACN;QACF;QACA,IAAIiB,OAAOE,QAAQ,KAAK,WAAWF,OAAOE,QAAQ,KAAK,UAAU;QACjEP,MAAMQ,IAAI,CAAC;YAAEpB;YAAKe;YAAOM,KAAKN,QAAQf,IAAIK,MAAM;QAAC;IACnD;IACA,OAAOO;AACT;AAeA;;;;;;;;CAQC,GACD,OAAO,SAASU,yBACdb,IAAY,EACZc,IAA6D;IAE7D,MAAMb,OAAOC,OAAOF,eAAAA,OAAQ;IAC5B,MAAMe,QAAQhB,kBAAkBE;IAChC,IAAI,CAACc,MAAMnB,MAAM,EAAE,OAAO;QAAEI,MAAMC;QAAME,OAAO,EAAE;IAAC;IAClD,MAAMA,QAAkB,EAAE;IAC1B,IAAIa,MAAM;IACV,IAAIC,SAAS;IACb,KAAK,MAAMC,QAAQH,MAAO;QACxB,uEAAuE;QACvE,uEAAuE;QACvE,gDAAgD;QAChD,MAAMI,UAAUL,KAAK;YAAEvB,KAAK2B,KAAK3B,GAAG;YAAEgB,OAAOJ,MAAMP,MAAM;QAAC;QAC1DoB,OAAOf,KAAKH,KAAK,CAACmB,QAAQC,KAAKZ,KAAK;QACpC,IAAIa,SAAS;YACXH,OAAOG;YACPhB,MAAMQ,IAAI,CAACO,KAAK3B,GAAG;QACrB,OAAO;YACLyB,OAAOE,KAAK3B,GAAG;QACjB;QACA0B,SAASC,KAAKN,GAAG;IACnB;IACA,OAAO;QAAEZ,MAAMgB,MAAMf,KAAKH,KAAK,CAACmB;QAASd;IAAM;AACjD;AAEA;;;;;;;;;;;;;;;;;4CAiB4C,GAE5C;;;;;;;;CAQC,GACD,OAAO,MAAMiB,gCAAgC,MAAM;AAEnD;;;;;;;CAOC,GACD,MAAMC,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAaD;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,mBAAmBC,KAIlC;QAKYA,eACUA;IALrB,MAAMC,UAAU,CAACC,gBAAuE,CAAA;YACtFC,OAAO;YACPD;QACF,CAAA;IACA,IAAIvB,QAAOqB,gBAAAA,MAAMI,MAAM,YAAZJ,gBAAgB,IAAIK,WAAW,OAAO,QAAQ,OAAOJ,QAAQ;IACxE,MAAMK,QAAQ3B,QAAOqB,mBAAAA,MAAMO,SAAS,YAAfP,mBAAmB,IAAIQ,IAAI,GAAGC,WAAW;IAC9D,IAAI,CAACH,OAAO,OAAOL,QAAQ;IAC3B,IAAIH,eAAeY,IAAI,CAAC,CAACC,SAAWL,MAAMM,QAAQ,CAACD,UAAU,OAAOV,QAAQ;IAC5E;;;;;GAKC,GACD,IAAID,MAAMa,WAAW,KAAK,QAAQb,MAAMa,WAAW,IAAI,KAAKb,MAAMa,WAAW,GAAGhB,+BAA+B;QAC7G,OAAOI,QAAQ;IACjB;IACA,OAAO;QAAEE,OAAO;QAAMD,eAAe;IAAK;AAC5C"}

package/src/lib/engine/compose.d.ts

@@ -45,6 +45,13 @@ export interface ComposedOutreachEmail {
     listUnsubscribeUrl?: string;
     /** A `mailto:` URI for `List-Unsubscribe`. */
     listUnsubscribeMailto?: string;
+    /**
+     * The destinations whose links were rewritten for click tracking, in the
+     * order a click token indexes them (AGL-3239). Empty when the sequence
+     * does not track clicks, when the body carries no links, and when no
+     * tracking link could be minted.
+     */
+    trackedLinks: string[];
 }
 export type OutreachComposeErrorCode = 'missing_postal_address' | 'missing_legal_name' | 'not_an_email_step' | 'invalid_recipient' | 'missing_subject' | 'subject_reply_prefix' | 'missing_body' | 'missing_thread' | 'invalid_unsubscribe_url' | 'invalid_unsubscribe_mailto';
 export interface OutreachComposeError {
@@ -68,6 +75,23 @@ export interface ComposeOutreachEmailInput {
     listUnsubscribeUrl?: string | null;
     /** An address, or a `mailto:` URI, that unsubscribes whoever writes to it. */
     listUnsubscribeMailto?: string | null;
+    /**
+     * Answers the tracking link for one link in the body, or `null` to leave
+     * that one as it was written (AGL-3239).
+     *
+     * Absent leaves every link alone, which is what a sequence with
+     * `trackClicks` off passes and what every caller that is not the sending
+     * runtime passes — a PREVIEW must show the rep the body their recipient
+     * reads, and minting a live tracking link for a preview would count the
+     * rep's own click against the sequence.
+     *
+     * It runs on the step's rendered body and never on the footer, so the
+     * organization's identification and the way out are never rewritten.
+     */
+    rewriteLink?: ((link: {
+        url: string;
+        index: number;
+    }) => string | null) | null;
 }
 export interface OutreachComposeResult {
     email: ComposedOutreachEmail | null;

package/src/lib/engine/compose.js

@@ -53,6 +53,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
 import { CRM_EMAIL_SUBJECT_MAX } from "@aglyn/aglyn/app-utils/crm";
 import { resolveCrmMergeFields } from "@aglyn/aglyn/app-utils/crm-email-templates";
 import { crmThreadSubject } from "@aglyn/aglyn/app-utils/crm-inbound";
+import { rewriteOutreachBodyLinks } from "./click-tracking.js";
 import { normalizeOutreachPersonalLine } from "./gates.js";
 import { isInThreadEmailStep, OUTREACH_PERSONAL_LINE_FIELD, outreachSubjectHasReplyPrefix } from "./sequence-validation.js";
 /** The way out every email offers, word for word. */ export const OUTREACH_OPT_OUT_LINE = 'Not interested? Reply "no" and I won\'t email again.';
@@ -171,7 +172,8 @@ const refuse = (code, message)=>({
     const email = {
         to,
         subject: '',
-        text: ''
+        text: '',
+        trackedLinks: []
     };
     if (isInThreadEmailStep(steps, stepIndex)) {
         var _input_enrollment_messageIds, _input_enrollment_gmailThreadId;
@@ -197,7 +199,18 @@ const refuse = (code, message)=>({
     const source = step.templateId ? String((_input_templateBody = input.templateBody) != null ? _input_templateBody : '') : String((_step_body = step.body) != null ? _step_body : '');
     const body = render(source).replace(/\r\n?/g, '\n').split('\n').map((line)=>line.replace(/[ \t]+$/, '')).join('\n').replace(/^\n+|\n+$/g, '');
     if (!body.trim()) return refuse('missing_body', 'This email has no body.');
-    email.text = `${body}\n\n${footer}`;
+    /*
+   * Click tracking rewrites the STEP'S links and nothing else (AGL-3239):
+   * it runs here, on the rendered body, before the footer is appended. The
+   * footer's opt-out `mailto:` and the organization's own identification are
+   * never rewritten, and the one-click unsubscribe link never appears in a
+   * body at all — it rides in `List-Unsubscribe`.
+   */ const tracked = input.rewriteLink ? rewriteOutreachBodyLinks(body, input.rewriteLink) : {
+        text: body,
+        links: []
+    };
+    email.trackedLinks = tracked.links;
+    email.text = `${tracked.text}\n\n${footer}`;
     const url = unsubscribeUrl(input.listUnsubscribeUrl);
     if (url === null) {
         return refuse('invalid_unsubscribe_url', 'The unsubscribe link must be an https URL.');

package/src/lib/engine/compose.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/compose.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * WHAT EXACTLY IS SENT (AGL-2979).\n *\n * The composer turns a step, an enrollment and the organization's settings\n * into the message the transport sends: the recipient, the subject, the\n * plain text, and the headers that thread it and let the recipient leave.\n * The transport adds the From line and the MIME; nothing here knows either.\n *\n * ## The footer is not optional\n *\n * Every email ends with the organization's legal name, its postal address,\n * a sentence saying the email is a sales email, and the way out — reply\n * \"no\". Those are what CAN-SPAM requires of a commercial email (16 CFR 316:\n * identifiable as a solicitation, no fixed phrase), and\n * the composer appends them itself, after the merge, as literal text: no\n * template can leave them off, and no merge field can rewrite them. With no\n * postal address or no legal name, it refuses to compose at all.\n *\n * ## Threading\n *\n * An email after the first is a reply in the thread unless its step says\n * otherwise: `Re:` and the thread's own subject, `In-Reply-To` the last\n * message sent into the thread, `References` every one of them, and the\n * provider thread to send into. A `Re:` on an email that answers nothing is\n * a deception, so a reply step with no thread to answer is refused rather\n * than sent with a borrowed one, and a subject that starts with `Re:` or\n * `Fwd:` on an email that starts a thread is refused too.\n *\n * ## Merge fields\n *\n * The CRM's own resolver fills them, from the documents the runtime already\n * read, and the enrollment's personal line joins them as\n * `{{enrollment.personalLine}}` through the resolver's `extra` fields.\n * Fields that render empty are returned beside the message, for the\n * runtime to decide whether \"Hi ,\" is worth sending.\n *==========================================*/\n\nimport { normalizeContactEmail } from '@aglyn/aglyn/app-utils/contacts'\nimport { CRM_EMAIL_SUBJECT_MAX } from '@aglyn/aglyn/app-utils/crm'\nimport {\n  type CrmMergeContext,\n  resolveCrmMergeFields,\n} from '@aglyn/aglyn/app-utils/crm-email-templates'\nimport { crmThreadSubject } from '@aglyn/aglyn/app-utils/crm-inbound'\nimport type {\n  OutreachEnrollment,\n  OutreachOrgSettings,\n  OutreachSequence,\n} from '../model/outreach.types'\nimport { normalizeOutreachPersonalLine } from './gates'\nimport {\n  isInThreadEmailStep,\n  OUTREACH_PERSONAL_LINE_FIELD,\n  outreachSubjectHasReplyPrefix,\n} from './sequence-validation'\n\n/** The way out every email offers, word for word. */\nexport const OUTREACH_OPT_OUT_LINE = 'Not interested? Reply \"no\" and I won\\'t email again.'\n\n/**\n * The sentence that says what the email is. \"Sales email\", not \"business\n * solicitation\": an inbox-placement test on 2026-09-19 named the latter\n * phrase as a spam trigger, and the law asks that the email be identifiable\n * as a solicitation, not for any particular words (AGL-3228).\n */\nexport function outreachSolicitationStatement(senderName: string): string {\n  return `This is a sales email from ${senderName}.`\n}\n\n/**\n * The message the transport sends. Header values are single lines already;\n * the text uses `\\n` line breaks, which the transport writes as CRLF.\n */\nexport interface ComposedOutreachEmail {\n  /** The recipient's address, normalized. */\n  to: string\n  subject: string\n  /** The plain-text body, footer included. */\n  text: string\n  /** The provider thread a reply step is sent into. */\n  threadId?: string\n  /** The `Message-ID` this email answers, angle brackets included. */\n  inReplyTo?: string\n  /** Every `Message-ID` in the thread so far, oldest first, space-separated. */\n  references?: string\n  /** The one-click unsubscribe URL, for `List-Unsubscribe` with `List-Unsubscribe-Post`. */\n  listUnsubscribeUrl?: string\n  /** A `mailto:` URI for `List-Unsubscribe`. */\n  listUnsubscribeMailto?: string\n}\n\nexport type OutreachComposeErrorCode =\n  | 'missing_postal_address'\n  | 'missing_legal_name'\n  | 'not_an_email_step'\n  | 'invalid_recipient'\n  | 'missing_subject'\n  | 'subject_reply_prefix'\n  | 'missing_body'\n  | 'missing_thread'\n  | 'invalid_unsubscribe_url'\n  | 'invalid_unsubscribe_mailto'\n\nexport interface OutreachComposeError {\n  code: OutreachComposeErrorCode\n  message: string\n}\n\nexport interface ComposeOutreachEmailInput {\n  sequence: Pick<OutreachSequence, 'steps'>\n  enrollment: Pick<\n    OutreachEnrollment,\n    'email' | 'stepIndex' | 'personalLine' | 'threadSubject' | 'messageIds' | 'gmailThreadId'\n  >\n  orgSettings: Pick<OutreachOrgSettings, 'legalName' | 'brandName' | 'postalAddress'> | null | undefined\n  /**\n   * What the CRM resolver reads: the contact, the sending site's group id,\n   * the sender (the mailbox's display name and address), the site. Its\n   * `extra` may carry fields of the caller's own; the personal line is added\n   * here.\n   */\n  merge: CrmMergeContext | null | undefined\n  /** The CRM template's body, read by the caller, when the step names a template. */\n  templateBody?: string | null\n  /** The signed one-click unsubscribe URL, minted by the runtime. */\n  listUnsubscribeUrl?: string | null\n  /** An address, or a `mailto:` URI, that unsubscribes whoever writes to it. */\n  listUnsubscribeMailto?: string | null\n}\n\nexport interface OutreachComposeResult {\n  email: ComposedOutreachEmail | null\n  error: OutreachComposeError | null\n  /** Merge fields that rendered empty, unique, in order of appearance. */\n  unresolvedFields: string[]\n}\n\nconst oneLine = (value: unknown): string =>\n  typeof value === 'string' ? value.replace(/\\s+/g, ' ').trim() : ''\n\n/**\n * The footer every email ends with, or the reason it cannot be written.\n *\n * The postal address may be stored over several lines; the footer prints it\n * on one, the parts separated by commas.\n */\nexport function composeOutreachFooter(\n  settings: Pick<OutreachOrgSettings, 'legalName' | 'brandName' | 'postalAddress'> | null | undefined,\n): { footer: string | null; error: OutreachComposeError | null } {\n  const postalAddress = String(settings?.postalAddress ?? '')\n    .split(/\\r\\n|\\r|\\n/)\n    .map((line) => oneLine(line).replace(/,+$/, ''))\n    .filter(Boolean)\n    .join(', ')\n  if (!postalAddress) {\n    return {\n      footer: null,\n      error: {\n        code: 'missing_postal_address',\n        message:\n          \"This email can't be sent without your organization's postal address. Add it in Sequences settings.\",\n      },\n    }\n  }\n  const legalName = oneLine(settings?.legalName)\n  if (!legalName) {\n    return {\n      footer: null,\n      error: {\n        code: 'missing_legal_name',\n        message:\n          \"This email can't be sent without your organization's legal name. Add it in Sequences settings.\",\n      },\n    }\n  }\n  const senderName = oneLine(settings?.brandName) || legalName\n  return {\n    footer: `${legalName} · ${postalAddress}\\n${outreachSolicitationStatement(senderName)} ${OUTREACH_OPT_OUT_LINE}`,\n    error: null,\n  }\n}\n\n/** A `Message-ID` in its header form — `<id@host>` — or `null` for one that is not. */\nexport function outreachMessageIdHeader(value: unknown): string | null {\n  const bare = String(value ?? '').trim().replace(/^<+/, '').replace(/>+$/, '')\n  if (!bare || /[\\s<>]/.test(bare)) return null\n  return `<${bare}>`\n}\n\nfunction unsubscribeUrl(value: unknown): string | null | undefined {\n  const raw = String(value ?? '').trim()\n  if (!raw) return undefined\n  if (/[\\r\\n]/.test(raw)) return null\n  try {\n    const url = new URL(raw)\n    return url.protocol === 'https:' ? url.href : null\n  } catch {\n    return null\n  }\n}\n\nfunction unsubscribeMailto(value: unknown): string | null | undefined {\n  const raw = String(value ?? '').trim()\n  if (!raw) return undefined\n  if (/[\\r\\n]/.test(raw)) return null\n  if (!/^mailto:/i.test(raw)) {\n    const address = normalizeContactEmail(raw)\n    return address ? `mailto:${address}?subject=unsubscribe` : null\n  }\n  let target = raw.slice('mailto:'.length).split('?')[0]\n  try {\n    target = decodeURIComponent(target)\n  } catch {\n    return null\n  }\n  return normalizeContactEmail(target) ? raw : null\n}\n\nconst refuse = (\n  code: OutreachComposeErrorCode,\n  message: string,\n): OutreachComposeResult => ({ email: null, error: { code, message }, unresolvedFields: [] })\n\n/** The email one step sends to one person — see the module note. */\nexport function composeOutreachEmail(input: ComposeOutreachEmailInput): OutreachComposeResult {\n  const { footer, error } = composeOutreachFooter(input.orgSettings)\n  if (error) return { email: null, error, unresolvedFields: [] }\n\n  const steps = input.sequence?.steps ?? []\n  const stepIndex = input.enrollment?.stepIndex\n  const step = steps[stepIndex]\n  if (step?.kind !== 'email') {\n    return refuse('not_an_email_step', 'The step this enrollment is on does not send an email.')\n  }\n  const to = normalizeContactEmail(input.enrollment.email)\n  if (!to) {\n    return refuse('invalid_recipient', \"This enrollment's address isn't a valid email address.\")\n  }\n\n  const context: CrmMergeContext = {\n    ...(input.merge ?? {}),\n    extra: {\n      ...(input.merge?.extra ?? {}),\n      [OUTREACH_PERSONAL_LINE_FIELD]: normalizeOutreachPersonalLine(input.enrollment.personalLine),\n    },\n  }\n  const unresolved: string[] = []\n  const render = (text: string): string => {\n    const result = resolveCrmMergeFields(text, context)\n    for (const key of result.unresolved) if (!unresolved.includes(key)) unresolved.push(key)\n    return result.text\n  }\n\n  const email: ComposedOutreachEmail = { to, subject: '', text: '' }\n  if (isInThreadEmailStep(steps, stepIndex)) {\n    const threadSubject = crmThreadSubject(input.enrollment.threadSubject)\n    const messageIds = (input.enrollment.messageIds ?? [])\n      .map(outreachMessageIdHeader)\n      .filter((id): id is string => id !== null)\n    const threadId = String(input.enrollment.gmailThreadId ?? '').trim()\n    if (!threadSubject || !messageIds.length || !threadId) {\n      return refuse(\n        'missing_thread',\n        'This email replies in the thread, and no earlier email in the thread was sent.',\n      )\n    }\n    email.subject = `Re: ${threadSubject}`.slice(0, CRM_EMAIL_SUBJECT_MAX)\n    email.threadId = threadId\n    email.inReplyTo = messageIds[messageIds.length - 1]\n    email.references = messageIds.join(' ')\n  } else {\n    const subject = oneLine(render(String(step.subject ?? '')))\n    if (!subject) return refuse('missing_subject', 'This email has no subject.')\n    if (outreachSubjectHasReplyPrefix(subject)) {\n      return refuse(\n        'subject_reply_prefix',\n        'This email starts a thread, so its subject may not begin with \"Re:\" or \"Fwd:\".',\n      )\n    }\n    email.subject = subject.slice(0, CRM_EMAIL_SUBJECT_MAX)\n  }\n\n  const source = step.templateId ? String(input.templateBody ?? '') : String(step.body ?? '')\n  const body = render(source)\n    .replace(/\\r\\n?/g, '\\n')\n    .split('\\n')\n    .map((line) => line.replace(/[ \\t]+$/, ''))\n    .join('\\n')\n    .replace(/^\\n+|\\n+$/g, '')\n  if (!body.trim()) return refuse('missing_body', 'This email has no body.')\n  email.text = `${body}\\n\\n${footer}`\n\n  const url = unsubscribeUrl(input.listUnsubscribeUrl)\n  if (url === null) {\n    return refuse('invalid_unsubscribe_url', 'The unsubscribe link must be an https URL.')\n  }\n  if (url) email.listUnsubscribeUrl = url\n  const mailto = unsubscribeMailto(input.listUnsubscribeMailto)\n  if (mailto === null) {\n    return refuse('invalid_unsubscribe_mailto', 'The unsubscribe address is not an email address.')\n  }\n  if (mailto) email.listUnsubscribeMailto = mailto\n\n  return { email, error: null, unresolvedFields: unresolved }\n}\n"],"names":["normalizeContactEmail","CRM_EMAIL_SUBJECT_MAX","resolveCrmMergeFields","crmThreadSubject","normalizeOutreachPersonalLine","isInThreadEmailStep","OUTREACH_PERSONAL_LINE_FIELD","outreachSubjectHasReplyPrefix","OUTREACH_OPT_OUT_LINE","outreachSolicitationStatement","senderName","oneLine","value","replace","trim","composeOutreachFooter","settings","postalAddress","String","split","map","line","filter","Boolean","join","footer","error","code","message","legalName","brandName","outreachMessageIdHeader","bare","test","unsubscribeUrl","raw","undefined","url","URL","protocol","href","unsubscribeMailto","address","target","slice","length","decodeURIComponent","refuse","email","unresolvedFields","composeOutreachEmail","input","step","orgSettings","steps","sequence","stepIndex","enrollment","kind","to","context","merge","extra","personalLine","unresolved","render","text","result","key","includes","push","subject","threadSubject","messageIds","id","threadId","gmailThreadId","inReplyTo","references","source","templateId","templateBody","body","listUnsubscribeUrl","mailto","listUnsubscribeMailto"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAmC4C,GAE5C,SAASA,qBAAqB,QAAQ,kCAAiC;AACvE,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAEEC,qBAAqB,QAChB,6CAA4C;AACnD,SAASC,gBAAgB,QAAQ,qCAAoC;AAMrE,SAASC,6BAA6B,QAAQ,aAAS;AACvD,SACEC,mBAAmB,EACnBC,4BAA4B,EAC5BC,6BAA6B,QACxB,2BAAuB;AAE9B,mDAAmD,GACnD,OAAO,MAAMC,wBAAwB,uDAAsD;AAE3F;;;;;CAKC,GACD,OAAO,SAASC,8BAA8BC,UAAkB;IAC9D,OAAO,CAAC,2BAA2B,EAAEA,WAAW,CAAC,CAAC;AACpD;AAsEA,MAAMC,UAAU,CAACC,QACf,OAAOA,UAAU,WAAWA,MAAMC,OAAO,CAAC,QAAQ,KAAKC,IAAI,KAAK;AAElE;;;;;CAKC,GACD,OAAO,SAASC,sBACdC,QAAmG;;IAEnG,MAAMC,gBAAgBC,eAAOF,4BAAAA,SAAUC,aAAa,mBAAI,IACrDE,KAAK,CAAC,cACNC,GAAG,CAAC,CAACC,OAASV,QAAQU,MAAMR,OAAO,CAAC,OAAO,KAC3CS,MAAM,CAACC,SACPC,IAAI,CAAC;IACR,IAAI,CAACP,eAAe;QAClB,OAAO;YACLQ,QAAQ;YACRC,OAAO;gBACLC,MAAM;gBACNC,SACE;YACJ;QACF;IACF;IACA,MAAMC,YAAYlB,QAAQK,4BAAAA,SAAUa,SAAS;IAC7C,IAAI,CAACA,WAAW;QACd,OAAO;YACLJ,QAAQ;YACRC,OAAO;gBACLC,MAAM;gBACNC,SACE;YACJ;QACF;IACF;IACA,MAAMlB,aAAaC,QAAQK,4BAAAA,SAAUc,SAAS,KAAKD;IACnD,OAAO;QACLJ,QAAQ,GAAGI,UAAU,GAAG,EAAEZ,cAAc,EAAE,EAAER,8BAA8BC,YAAY,CAAC,EAAEF,uBAAuB;QAChHkB,OAAO;IACT;AACF;AAEA,qFAAqF,GACrF,OAAO,SAASK,wBAAwBnB,KAAc;IACpD,MAAMoB,OAAOd,OAAON,gBAAAA,QAAS,IAAIE,IAAI,GAAGD,OAAO,CAAC,OAAO,IAAIA,OAAO,CAAC,OAAO;IAC1E,IAAI,CAACmB,QAAQ,SAASC,IAAI,CAACD,OAAO,OAAO;IACzC,OAAO,CAAC,CAAC,EAAEA,KAAK,CAAC,CAAC;AACpB;AAEA,SAASE,eAAetB,KAAc;IACpC,MAAMuB,MAAMjB,OAAON,gBAAAA,QAAS,IAAIE,IAAI;IACpC,IAAI,CAACqB,KAAK,OAAOC;IACjB,IAAI,SAASH,IAAI,CAACE,MAAM,OAAO;IAC/B,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIH;QACpB,OAAOE,IAAIE,QAAQ,KAAK,WAAWF,IAAIG,IAAI,GAAG;IAChD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,SAASC,kBAAkB7B,KAAc;IACvC,MAAMuB,MAAMjB,OAAON,gBAAAA,QAAS,IAAIE,IAAI;IACpC,IAAI,CAACqB,KAAK,OAAOC;IACjB,IAAI,SAASH,IAAI,CAACE,MAAM,OAAO;IAC/B,IAAI,CAAC,YAAYF,IAAI,CAACE,MAAM;QAC1B,MAAMO,UAAU1C,sBAAsBmC;QACtC,OAAOO,UAAU,CAAC,OAAO,EAAEA,QAAQ,oBAAoB,CAAC,GAAG;IAC7D;IACA,IAAIC,SAASR,IAAIS,KAAK,CAAC,UAAUC,MAAM,EAAE1B,KAAK,CAAC,IAAI,CAAC,EAAE;IACtD,IAAI;QACFwB,SAASG,mBAAmBH;IAC9B,EAAE,eAAM;QACN,OAAO;IACT;IACA,OAAO3C,sBAAsB2C,UAAUR,MAAM;AAC/C;AAEA,MAAMY,SAAS,CACbpB,MACAC,UAC2B,CAAA;QAAEoB,OAAO;QAAMtB,OAAO;YAAEC;YAAMC;QAAQ;QAAGqB,kBAAkB,EAAE;IAAC,CAAA;AAE3F,kEAAkE,GAClE,OAAO,SAASC,qBAAqBC,KAAgC;cAgB7DA,qBA0CkCA,qBAAmCC;QAtD7DD,iBACIA,mBAaVA;IAjBR,MAAM,EAAE1B,MAAM,EAAEC,KAAK,EAAE,GAAGX,sBAAsBoC,MAAME,WAAW;IACjE,IAAI3B,OAAO,OAAO;QAAEsB,OAAO;QAAMtB;QAAOuB,kBAAkB,EAAE;IAAC;IAE7D,MAAMK,iBAAQH,kBAAAA,MAAMI,QAAQ,qBAAdJ,gBAAgBG,KAAK,mBAAI,EAAE;IACzC,MAAME,aAAYL,oBAAAA,MAAMM,UAAU,qBAAhBN,kBAAkBK,SAAS;IAC7C,MAAMJ,OAAOE,KAAK,CAACE,UAAU;IAC7B,IAAIJ,CAAAA,wBAAAA,KAAMM,IAAI,MAAK,SAAS;QAC1B,OAAOX,OAAO,qBAAqB;IACrC;IACA,MAAMY,KAAK3D,sBAAsBmD,MAAMM,UAAU,CAACT,KAAK;IACvD,IAAI,CAACW,IAAI;QACP,OAAOZ,OAAO,qBAAqB;IACrC;IAEA,MAAMa,UAA2B,cAC3BT,eAAAA,MAAMU,KAAK,YAAXV,eAAe,CAAC;QACpBW,OAAO,uBACDX,gBAAAA,MAAMU,KAAK,qBAAXV,cAAaW,KAAK,oBAAI,CAAC;YAC3B,CAACxD,6BAA6B,EAAEF,8BAA8B+C,MAAMM,UAAU,CAACM,YAAY;;;IAG/F,MAAMC,aAAuB,EAAE;IAC/B,MAAMC,SAAS,CAACC;QACd,MAAMC,SAASjE,sBAAsBgE,MAAMN;QAC3C,KAAK,MAAMQ,OAAOD,OAAOH,UAAU,CAAE,IAAI,CAACA,WAAWK,QAAQ,CAACD,MAAMJ,WAAWM,IAAI,CAACF;QACpF,OAAOD,OAAOD,IAAI;IACpB;IAEA,MAAMlB,QAA+B;QAAEW;QAAIY,SAAS;QAAIL,MAAM;IAAG;IACjE,IAAI7D,oBAAoBiD,OAAOE,YAAY;YAErBL,8BAGIA;QAJxB,MAAMqB,gBAAgBrE,iBAAiBgD,MAAMM,UAAU,CAACe,aAAa;QACrE,MAAMC,aAAa,EAACtB,+BAAAA,MAAMM,UAAU,CAACgB,UAAU,YAA3BtB,+BAA+B,EAAE,EAClD/B,GAAG,CAACW,yBACJT,MAAM,CAAC,CAACoD,KAAqBA,OAAO;QACvC,MAAMC,WAAWzD,QAAOiC,kCAAAA,MAAMM,UAAU,CAACmB,aAAa,YAA9BzB,kCAAkC,IAAIrC,IAAI;QAClE,IAAI,CAAC0D,iBAAiB,CAACC,WAAW5B,MAAM,IAAI,CAAC8B,UAAU;YACrD,OAAO5B,OACL,kBACA;QAEJ;QACAC,MAAMuB,OAAO,GAAG,CAAC,IAAI,EAAEC,eAAe,CAAC5B,KAAK,CAAC,GAAG3C;QAChD+C,MAAM2B,QAAQ,GAAGA;QACjB3B,MAAM6B,SAAS,GAAGJ,UAAU,CAACA,WAAW5B,MAAM,GAAG,EAAE;QACnDG,MAAM8B,UAAU,GAAGL,WAAWjD,IAAI,CAAC;IACrC,OAAO;YACiC4B;QAAtC,MAAMmB,UAAU5D,QAAQsD,OAAO/C,QAAOkC,gBAAAA,KAAKmB,OAAO,YAAZnB,gBAAgB;QACtD,IAAI,CAACmB,SAAS,OAAOxB,OAAO,mBAAmB;QAC/C,IAAIxC,8BAA8BgE,UAAU;YAC1C,OAAOxB,OACL,wBACA;QAEJ;QACAC,MAAMuB,OAAO,GAAGA,QAAQ3B,KAAK,CAAC,GAAG3C;IACnC;IAEA,MAAM8E,SAAS3B,KAAK4B,UAAU,GAAG9D,QAAOiC,sBAAAA,MAAM8B,YAAY,YAAlB9B,sBAAsB,MAAMjC,QAAOkC,aAAAA,KAAK8B,IAAI,YAAT9B,aAAa;IACxF,MAAM8B,OAAOjB,OAAOc,QACjBlE,OAAO,CAAC,UAAU,MAClBM,KAAK,CAAC,MACNC,GAAG,CAAC,CAACC,OAASA,KAAKR,OAAO,CAAC,WAAW,KACtCW,IAAI,CAAC,MACLX,OAAO,CAAC,cAAc;IACzB,IAAI,CAACqE,KAAKpE,IAAI,IAAI,OAAOiC,OAAO,gBAAgB;IAChDC,MAAMkB,IAAI,GAAG,GAAGgB,KAAK,IAAI,EAAEzD,QAAQ;IAEnC,MAAMY,MAAMH,eAAeiB,MAAMgC,kBAAkB;IACnD,IAAI9C,QAAQ,MAAM;QAChB,OAAOU,OAAO,2BAA2B;IAC3C;IACA,IAAIV,KAAKW,MAAMmC,kBAAkB,GAAG9C;IACpC,MAAM+C,SAAS3C,kBAAkBU,MAAMkC,qBAAqB;IAC5D,IAAID,WAAW,MAAM;QACnB,OAAOrC,OAAO,8BAA8B;IAC9C;IACA,IAAIqC,QAAQpC,MAAMqC,qBAAqB,GAAGD;IAE1C,OAAO;QAAEpC;QAAOtB,OAAO;QAAMuB,kBAAkBe;IAAW;AAC5D"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/compose.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * WHAT EXACTLY IS SENT (AGL-2979).\n *\n * The composer turns a step, an enrollment and the organization's settings\n * into the message the transport sends: the recipient, the subject, the\n * plain text, and the headers that thread it and let the recipient leave.\n * The transport adds the From line and the MIME; nothing here knows either.\n *\n * ## The footer is not optional\n *\n * Every email ends with the organization's legal name, its postal address,\n * a sentence saying the email is a sales email, and the way out — reply\n * \"no\". Those are what CAN-SPAM requires of a commercial email (16 CFR 316:\n * identifiable as a solicitation, no fixed phrase), and\n * the composer appends them itself, after the merge, as literal text: no\n * template can leave them off, and no merge field can rewrite them. With no\n * postal address or no legal name, it refuses to compose at all.\n *\n * ## Threading\n *\n * An email after the first is a reply in the thread unless its step says\n * otherwise: `Re:` and the thread's own subject, `In-Reply-To` the last\n * message sent into the thread, `References` every one of them, and the\n * provider thread to send into. A `Re:` on an email that answers nothing is\n * a deception, so a reply step with no thread to answer is refused rather\n * than sent with a borrowed one, and a subject that starts with `Re:` or\n * `Fwd:` on an email that starts a thread is refused too.\n *\n * ## Merge fields\n *\n * The CRM's own resolver fills them, from the documents the runtime already\n * read, and the enrollment's personal line joins them as\n * `{{enrollment.personalLine}}` through the resolver's `extra` fields.\n * Fields that render empty are returned beside the message, for the\n * runtime to decide whether \"Hi ,\" is worth sending.\n *==========================================*/\n\nimport { normalizeContactEmail } from '@aglyn/aglyn/app-utils/contacts'\nimport { CRM_EMAIL_SUBJECT_MAX } from '@aglyn/aglyn/app-utils/crm'\nimport {\n  type CrmMergeContext,\n  resolveCrmMergeFields,\n} from '@aglyn/aglyn/app-utils/crm-email-templates'\nimport { crmThreadSubject } from '@aglyn/aglyn/app-utils/crm-inbound'\nimport type {\n  OutreachEnrollment,\n  OutreachOrgSettings,\n  OutreachSequence,\n} from '../model/outreach.types'\nimport { rewriteOutreachBodyLinks } from './click-tracking'\nimport { normalizeOutreachPersonalLine } from './gates'\nimport {\n  isInThreadEmailStep,\n  OUTREACH_PERSONAL_LINE_FIELD,\n  outreachSubjectHasReplyPrefix,\n} from './sequence-validation'\n\n/** The way out every email offers, word for word. */\nexport const OUTREACH_OPT_OUT_LINE = 'Not interested? Reply \"no\" and I won\\'t email again.'\n\n/**\n * The sentence that says what the email is. \"Sales email\", not \"business\n * solicitation\": an inbox-placement test on 2026-09-19 named the latter\n * phrase as a spam trigger, and the law asks that the email be identifiable\n * as a solicitation, not for any particular words (AGL-3228).\n */\nexport function outreachSolicitationStatement(senderName: string): string {\n  return `This is a sales email from ${senderName}.`\n}\n\n/**\n * The message the transport sends. Header values are single lines already;\n * the text uses `\\n` line breaks, which the transport writes as CRLF.\n */\nexport interface ComposedOutreachEmail {\n  /** The recipient's address, normalized. */\n  to: string\n  subject: string\n  /** The plain-text body, footer included. */\n  text: string\n  /** The provider thread a reply step is sent into. */\n  threadId?: string\n  /** The `Message-ID` this email answers, angle brackets included. */\n  inReplyTo?: string\n  /** Every `Message-ID` in the thread so far, oldest first, space-separated. */\n  references?: string\n  /** The one-click unsubscribe URL, for `List-Unsubscribe` with `List-Unsubscribe-Post`. */\n  listUnsubscribeUrl?: string\n  /** A `mailto:` URI for `List-Unsubscribe`. */\n  listUnsubscribeMailto?: string\n  /**\n   * The destinations whose links were rewritten for click tracking, in the\n   * order a click token indexes them (AGL-3239). Empty when the sequence\n   * does not track clicks, when the body carries no links, and when no\n   * tracking link could be minted.\n   */\n  trackedLinks: string[]\n}\n\nexport type OutreachComposeErrorCode =\n  | 'missing_postal_address'\n  | 'missing_legal_name'\n  | 'not_an_email_step'\n  | 'invalid_recipient'\n  | 'missing_subject'\n  | 'subject_reply_prefix'\n  | 'missing_body'\n  | 'missing_thread'\n  | 'invalid_unsubscribe_url'\n  | 'invalid_unsubscribe_mailto'\n\nexport interface OutreachComposeError {\n  code: OutreachComposeErrorCode\n  message: string\n}\n\nexport interface ComposeOutreachEmailInput {\n  sequence: Pick<OutreachSequence, 'steps'>\n  enrollment: Pick<\n    OutreachEnrollment,\n    'email' | 'stepIndex' | 'personalLine' | 'threadSubject' | 'messageIds' | 'gmailThreadId'\n  >\n  orgSettings: Pick<OutreachOrgSettings, 'legalName' | 'brandName' | 'postalAddress'> | null | undefined\n  /**\n   * What the CRM resolver reads: the contact, the sending site's group id,\n   * the sender (the mailbox's display name and address), the site. Its\n   * `extra` may carry fields of the caller's own; the personal line is added\n   * here.\n   */\n  merge: CrmMergeContext | null | undefined\n  /** The CRM template's body, read by the caller, when the step names a template. */\n  templateBody?: string | null\n  /** The signed one-click unsubscribe URL, minted by the runtime. */\n  listUnsubscribeUrl?: string | null\n  /** An address, or a `mailto:` URI, that unsubscribes whoever writes to it. */\n  listUnsubscribeMailto?: string | null\n  /**\n   * Answers the tracking link for one link in the body, or `null` to leave\n   * that one as it was written (AGL-3239).\n   *\n   * Absent leaves every link alone, which is what a sequence with\n   * `trackClicks` off passes and what every caller that is not the sending\n   * runtime passes — a PREVIEW must show the rep the body their recipient\n   * reads, and minting a live tracking link for a preview would count the\n   * rep's own click against the sequence.\n   *\n   * It runs on the step's rendered body and never on the footer, so the\n   * organization's identification and the way out are never rewritten.\n   */\n  rewriteLink?: ((link: { url: string; index: number }) => string | null) | null\n}\n\nexport interface OutreachComposeResult {\n  email: ComposedOutreachEmail | null\n  error: OutreachComposeError | null\n  /** Merge fields that rendered empty, unique, in order of appearance. */\n  unresolvedFields: string[]\n}\n\nconst oneLine = (value: unknown): string =>\n  typeof value === 'string' ? value.replace(/\\s+/g, ' ').trim() : ''\n\n/**\n * The footer every email ends with, or the reason it cannot be written.\n *\n * The postal address may be stored over several lines; the footer prints it\n * on one, the parts separated by commas.\n */\nexport function composeOutreachFooter(\n  settings: Pick<OutreachOrgSettings, 'legalName' | 'brandName' | 'postalAddress'> | null | undefined,\n): { footer: string | null; error: OutreachComposeError | null } {\n  const postalAddress = String(settings?.postalAddress ?? '')\n    .split(/\\r\\n|\\r|\\n/)\n    .map((line) => oneLine(line).replace(/,+$/, ''))\n    .filter(Boolean)\n    .join(', ')\n  if (!postalAddress) {\n    return {\n      footer: null,\n      error: {\n        code: 'missing_postal_address',\n        message:\n          \"This email can't be sent without your organization's postal address. Add it in Sequences settings.\",\n      },\n    }\n  }\n  const legalName = oneLine(settings?.legalName)\n  if (!legalName) {\n    return {\n      footer: null,\n      error: {\n        code: 'missing_legal_name',\n        message:\n          \"This email can't be sent without your organization's legal name. Add it in Sequences settings.\",\n      },\n    }\n  }\n  const senderName = oneLine(settings?.brandName) || legalName\n  return {\n    footer: `${legalName} · ${postalAddress}\\n${outreachSolicitationStatement(senderName)} ${OUTREACH_OPT_OUT_LINE}`,\n    error: null,\n  }\n}\n\n/** A `Message-ID` in its header form — `<id@host>` — or `null` for one that is not. */\nexport function outreachMessageIdHeader(value: unknown): string | null {\n  const bare = String(value ?? '').trim().replace(/^<+/, '').replace(/>+$/, '')\n  if (!bare || /[\\s<>]/.test(bare)) return null\n  return `<${bare}>`\n}\n\nfunction unsubscribeUrl(value: unknown): string | null | undefined {\n  const raw = String(value ?? '').trim()\n  if (!raw) return undefined\n  if (/[\\r\\n]/.test(raw)) return null\n  try {\n    const url = new URL(raw)\n    return url.protocol === 'https:' ? url.href : null\n  } catch {\n    return null\n  }\n}\n\nfunction unsubscribeMailto(value: unknown): string | null | undefined {\n  const raw = String(value ?? '').trim()\n  if (!raw) return undefined\n  if (/[\\r\\n]/.test(raw)) return null\n  if (!/^mailto:/i.test(raw)) {\n    const address = normalizeContactEmail(raw)\n    return address ? `mailto:${address}?subject=unsubscribe` : null\n  }\n  let target = raw.slice('mailto:'.length).split('?')[0]\n  try {\n    target = decodeURIComponent(target)\n  } catch {\n    return null\n  }\n  return normalizeContactEmail(target) ? raw : null\n}\n\nconst refuse = (\n  code: OutreachComposeErrorCode,\n  message: string,\n): OutreachComposeResult => ({ email: null, error: { code, message }, unresolvedFields: [] })\n\n/** The email one step sends to one person — see the module note. */\nexport function composeOutreachEmail(input: ComposeOutreachEmailInput): OutreachComposeResult {\n  const { footer, error } = composeOutreachFooter(input.orgSettings)\n  if (error) return { email: null, error, unresolvedFields: [] }\n\n  const steps = input.sequence?.steps ?? []\n  const stepIndex = input.enrollment?.stepIndex\n  const step = steps[stepIndex]\n  if (step?.kind !== 'email') {\n    return refuse('not_an_email_step', 'The step this enrollment is on does not send an email.')\n  }\n  const to = normalizeContactEmail(input.enrollment.email)\n  if (!to) {\n    return refuse('invalid_recipient', \"This enrollment's address isn't a valid email address.\")\n  }\n\n  const context: CrmMergeContext = {\n    ...(input.merge ?? {}),\n    extra: {\n      ...(input.merge?.extra ?? {}),\n      [OUTREACH_PERSONAL_LINE_FIELD]: normalizeOutreachPersonalLine(input.enrollment.personalLine),\n    },\n  }\n  const unresolved: string[] = []\n  const render = (text: string): string => {\n    const result = resolveCrmMergeFields(text, context)\n    for (const key of result.unresolved) if (!unresolved.includes(key)) unresolved.push(key)\n    return result.text\n  }\n\n  const email: ComposedOutreachEmail = { to, subject: '', text: '', trackedLinks: [] }\n  if (isInThreadEmailStep(steps, stepIndex)) {\n    const threadSubject = crmThreadSubject(input.enrollment.threadSubject)\n    const messageIds = (input.enrollment.messageIds ?? [])\n      .map(outreachMessageIdHeader)\n      .filter((id): id is string => id !== null)\n    const threadId = String(input.enrollment.gmailThreadId ?? '').trim()\n    if (!threadSubject || !messageIds.length || !threadId) {\n      return refuse(\n        'missing_thread',\n        'This email replies in the thread, and no earlier email in the thread was sent.',\n      )\n    }\n    email.subject = `Re: ${threadSubject}`.slice(0, CRM_EMAIL_SUBJECT_MAX)\n    email.threadId = threadId\n    email.inReplyTo = messageIds[messageIds.length - 1]\n    email.references = messageIds.join(' ')\n  } else {\n    const subject = oneLine(render(String(step.subject ?? '')))\n    if (!subject) return refuse('missing_subject', 'This email has no subject.')\n    if (outreachSubjectHasReplyPrefix(subject)) {\n      return refuse(\n        'subject_reply_prefix',\n        'This email starts a thread, so its subject may not begin with \"Re:\" or \"Fwd:\".',\n      )\n    }\n    email.subject = subject.slice(0, CRM_EMAIL_SUBJECT_MAX)\n  }\n\n  const source = step.templateId ? String(input.templateBody ?? '') : String(step.body ?? '')\n  const body = render(source)\n    .replace(/\\r\\n?/g, '\\n')\n    .split('\\n')\n    .map((line) => line.replace(/[ \\t]+$/, ''))\n    .join('\\n')\n    .replace(/^\\n+|\\n+$/g, '')\n  if (!body.trim()) return refuse('missing_body', 'This email has no body.')\n  /*\n   * Click tracking rewrites the STEP'S links and nothing else (AGL-3239):\n   * it runs here, on the rendered body, before the footer is appended. The\n   * footer's opt-out `mailto:` and the organization's own identification are\n   * never rewritten, and the one-click unsubscribe link never appears in a\n   * body at all — it rides in `List-Unsubscribe`.\n   */\n  const tracked = input.rewriteLink\n    ? rewriteOutreachBodyLinks(body, input.rewriteLink)\n    : { text: body, links: [] }\n  email.trackedLinks = tracked.links\n  email.text = `${tracked.text}\\n\\n${footer}`\n\n  const url = unsubscribeUrl(input.listUnsubscribeUrl)\n  if (url === null) {\n    return refuse('invalid_unsubscribe_url', 'The unsubscribe link must be an https URL.')\n  }\n  if (url) email.listUnsubscribeUrl = url\n  const mailto = unsubscribeMailto(input.listUnsubscribeMailto)\n  if (mailto === null) {\n    return refuse('invalid_unsubscribe_mailto', 'The unsubscribe address is not an email address.')\n  }\n  if (mailto) email.listUnsubscribeMailto = mailto\n\n  return { email, error: null, unresolvedFields: unresolved }\n}\n"],"names":["normalizeContactEmail","CRM_EMAIL_SUBJECT_MAX","resolveCrmMergeFields","crmThreadSubject","rewriteOutreachBodyLinks","normalizeOutreachPersonalLine","isInThreadEmailStep","OUTREACH_PERSONAL_LINE_FIELD","outreachSubjectHasReplyPrefix","OUTREACH_OPT_OUT_LINE","outreachSolicitationStatement","senderName","oneLine","value","replace","trim","composeOutreachFooter","settings","postalAddress","String","split","map","line","filter","Boolean","join","footer","error","code","message","legalName","brandName","outreachMessageIdHeader","bare","test","unsubscribeUrl","raw","undefined","url","URL","protocol","href","unsubscribeMailto","address","target","slice","length","decodeURIComponent","refuse","email","unresolvedFields","composeOutreachEmail","input","step","orgSettings","steps","sequence","stepIndex","enrollment","kind","to","context","merge","extra","personalLine","unresolved","render","text","result","key","includes","push","subject","trackedLinks","threadSubject","messageIds","id","threadId","gmailThreadId","inReplyTo","references","source","templateId","templateBody","body","tracked","rewriteLink","links","listUnsubscribeUrl","mailto","listUnsubscribeMailto"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAmC4C,GAE5C,SAASA,qBAAqB,QAAQ,kCAAiC;AACvE,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAEEC,qBAAqB,QAChB,6CAA4C;AACnD,SAASC,gBAAgB,QAAQ,qCAAoC;AAMrE,SAASC,wBAAwB,QAAQ,sBAAkB;AAC3D,SAASC,6BAA6B,QAAQ,aAAS;AACvD,SACEC,mBAAmB,EACnBC,4BAA4B,EAC5BC,6BAA6B,QACxB,2BAAuB;AAE9B,mDAAmD,GACnD,OAAO,MAAMC,wBAAwB,uDAAsD;AAE3F;;;;;CAKC,GACD,OAAO,SAASC,8BAA8BC,UAAkB;IAC9D,OAAO,CAAC,2BAA2B,EAAEA,WAAW,CAAC,CAAC;AACpD;AA2FA,MAAMC,UAAU,CAACC,QACf,OAAOA,UAAU,WAAWA,MAAMC,OAAO,CAAC,QAAQ,KAAKC,IAAI,KAAK;AAElE;;;;;CAKC,GACD,OAAO,SAASC,sBACdC,QAAmG;;IAEnG,MAAMC,gBAAgBC,eAAOF,4BAAAA,SAAUC,aAAa,mBAAI,IACrDE,KAAK,CAAC,cACNC,GAAG,CAAC,CAACC,OAASV,QAAQU,MAAMR,OAAO,CAAC,OAAO,KAC3CS,MAAM,CAACC,SACPC,IAAI,CAAC;IACR,IAAI,CAACP,eAAe;QAClB,OAAO;YACLQ,QAAQ;YACRC,OAAO;gBACLC,MAAM;gBACNC,SACE;YACJ;QACF;IACF;IACA,MAAMC,YAAYlB,QAAQK,4BAAAA,SAAUa,SAAS;IAC7C,IAAI,CAACA,WAAW;QACd,OAAO;YACLJ,QAAQ;YACRC,OAAO;gBACLC,MAAM;gBACNC,SACE;YACJ;QACF;IACF;IACA,MAAMlB,aAAaC,QAAQK,4BAAAA,SAAUc,SAAS,KAAKD;IACnD,OAAO;QACLJ,QAAQ,GAAGI,UAAU,GAAG,EAAEZ,cAAc,EAAE,EAAER,8BAA8BC,YAAY,CAAC,EAAEF,uBAAuB;QAChHkB,OAAO;IACT;AACF;AAEA,qFAAqF,GACrF,OAAO,SAASK,wBAAwBnB,KAAc;IACpD,MAAMoB,OAAOd,OAAON,gBAAAA,QAAS,IAAIE,IAAI,GAAGD,OAAO,CAAC,OAAO,IAAIA,OAAO,CAAC,OAAO;IAC1E,IAAI,CAACmB,QAAQ,SAASC,IAAI,CAACD,OAAO,OAAO;IACzC,OAAO,CAAC,CAAC,EAAEA,KAAK,CAAC,CAAC;AACpB;AAEA,SAASE,eAAetB,KAAc;IACpC,MAAMuB,MAAMjB,OAAON,gBAAAA,QAAS,IAAIE,IAAI;IACpC,IAAI,CAACqB,KAAK,OAAOC;IACjB,IAAI,SAASH,IAAI,CAACE,MAAM,OAAO;IAC/B,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIH;QACpB,OAAOE,IAAIE,QAAQ,KAAK,WAAWF,IAAIG,IAAI,GAAG;IAChD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,SAASC,kBAAkB7B,KAAc;IACvC,MAAMuB,MAAMjB,OAAON,gBAAAA,QAAS,IAAIE,IAAI;IACpC,IAAI,CAACqB,KAAK,OAAOC;IACjB,IAAI,SAASH,IAAI,CAACE,MAAM,OAAO;IAC/B,IAAI,CAAC,YAAYF,IAAI,CAACE,MAAM;QAC1B,MAAMO,UAAU3C,sBAAsBoC;QACtC,OAAOO,UAAU,CAAC,OAAO,EAAEA,QAAQ,oBAAoB,CAAC,GAAG;IAC7D;IACA,IAAIC,SAASR,IAAIS,KAAK,CAAC,UAAUC,MAAM,EAAE1B,KAAK,CAAC,IAAI,CAAC,EAAE;IACtD,IAAI;QACFwB,SAASG,mBAAmBH;IAC9B,EAAE,eAAM;QACN,OAAO;IACT;IACA,OAAO5C,sBAAsB4C,UAAUR,MAAM;AAC/C;AAEA,MAAMY,SAAS,CACbpB,MACAC,UAC2B,CAAA;QAAEoB,OAAO;QAAMtB,OAAO;YAAEC;YAAMC;QAAQ;QAAGqB,kBAAkB,EAAE;IAAC,CAAA;AAE3F,kEAAkE,GAClE,OAAO,SAASC,qBAAqBC,KAAgC;cAgB7DA,qBA0CkCA,qBAAmCC;QAtD7DD,iBACIA,mBAaVA;IAjBR,MAAM,EAAE1B,MAAM,EAAEC,KAAK,EAAE,GAAGX,sBAAsBoC,MAAME,WAAW;IACjE,IAAI3B,OAAO,OAAO;QAAEsB,OAAO;QAAMtB;QAAOuB,kBAAkB,EAAE;IAAC;IAE7D,MAAMK,iBAAQH,kBAAAA,MAAMI,QAAQ,qBAAdJ,gBAAgBG,KAAK,mBAAI,EAAE;IACzC,MAAME,aAAYL,oBAAAA,MAAMM,UAAU,qBAAhBN,kBAAkBK,SAAS;IAC7C,MAAMJ,OAAOE,KAAK,CAACE,UAAU;IAC7B,IAAIJ,CAAAA,wBAAAA,KAAMM,IAAI,MAAK,SAAS;QAC1B,OAAOX,OAAO,qBAAqB;IACrC;IACA,MAAMY,KAAK5D,sBAAsBoD,MAAMM,UAAU,CAACT,KAAK;IACvD,IAAI,CAACW,IAAI;QACP,OAAOZ,OAAO,qBAAqB;IACrC;IAEA,MAAMa,UAA2B,cAC3BT,eAAAA,MAAMU,KAAK,YAAXV,eAAe,CAAC;QACpBW,OAAO,uBACDX,gBAAAA,MAAMU,KAAK,qBAAXV,cAAaW,KAAK,oBAAI,CAAC;YAC3B,CAACxD,6BAA6B,EAAEF,8BAA8B+C,MAAMM,UAAU,CAACM,YAAY;;;IAG/F,MAAMC,aAAuB,EAAE;IAC/B,MAAMC,SAAS,CAACC;QACd,MAAMC,SAASlE,sBAAsBiE,MAAMN;QAC3C,KAAK,MAAMQ,OAAOD,OAAOH,UAAU,CAAE,IAAI,CAACA,WAAWK,QAAQ,CAACD,MAAMJ,WAAWM,IAAI,CAACF;QACpF,OAAOD,OAAOD,IAAI;IACpB;IAEA,MAAMlB,QAA+B;QAAEW;QAAIY,SAAS;QAAIL,MAAM;QAAIM,cAAc,EAAE;IAAC;IACnF,IAAInE,oBAAoBiD,OAAOE,YAAY;YAErBL,8BAGIA;QAJxB,MAAMsB,gBAAgBvE,iBAAiBiD,MAAMM,UAAU,CAACgB,aAAa;QACrE,MAAMC,aAAa,EAACvB,+BAAAA,MAAMM,UAAU,CAACiB,UAAU,YAA3BvB,+BAA+B,EAAE,EAClD/B,GAAG,CAACW,yBACJT,MAAM,CAAC,CAACqD,KAAqBA,OAAO;QACvC,MAAMC,WAAW1D,QAAOiC,kCAAAA,MAAMM,UAAU,CAACoB,aAAa,YAA9B1B,kCAAkC,IAAIrC,IAAI;QAClE,IAAI,CAAC2D,iBAAiB,CAACC,WAAW7B,MAAM,IAAI,CAAC+B,UAAU;YACrD,OAAO7B,OACL,kBACA;QAEJ;QACAC,MAAMuB,OAAO,GAAG,CAAC,IAAI,EAAEE,eAAe,CAAC7B,KAAK,CAAC,GAAG5C;QAChDgD,MAAM4B,QAAQ,GAAGA;QACjB5B,MAAM8B,SAAS,GAAGJ,UAAU,CAACA,WAAW7B,MAAM,GAAG,EAAE;QACnDG,MAAM+B,UAAU,GAAGL,WAAWlD,IAAI,CAAC;IACrC,OAAO;YACiC4B;QAAtC,MAAMmB,UAAU5D,QAAQsD,OAAO/C,QAAOkC,gBAAAA,KAAKmB,OAAO,YAAZnB,gBAAgB;QACtD,IAAI,CAACmB,SAAS,OAAOxB,OAAO,mBAAmB;QAC/C,IAAIxC,8BAA8BgE,UAAU;YAC1C,OAAOxB,OACL,wBACA;QAEJ;QACAC,MAAMuB,OAAO,GAAGA,QAAQ3B,KAAK,CAAC,GAAG5C;IACnC;IAEA,MAAMgF,SAAS5B,KAAK6B,UAAU,GAAG/D,QAAOiC,sBAAAA,MAAM+B,YAAY,YAAlB/B,sBAAsB,MAAMjC,QAAOkC,aAAAA,KAAK+B,IAAI,YAAT/B,aAAa;IACxF,MAAM+B,OAAOlB,OAAOe,QACjBnE,OAAO,CAAC,UAAU,MAClBM,KAAK,CAAC,MACNC,GAAG,CAAC,CAACC,OAASA,KAAKR,OAAO,CAAC,WAAW,KACtCW,IAAI,CAAC,MACLX,OAAO,CAAC,cAAc;IACzB,IAAI,CAACsE,KAAKrE,IAAI,IAAI,OAAOiC,OAAO,gBAAgB;IAChD;;;;;;GAMC,GACD,MAAMqC,UAAUjC,MAAMkC,WAAW,GAC7BlF,yBAAyBgF,MAAMhC,MAAMkC,WAAW,IAChD;QAAEnB,MAAMiB;QAAMG,OAAO,EAAE;IAAC;IAC5BtC,MAAMwB,YAAY,GAAGY,QAAQE,KAAK;IAClCtC,MAAMkB,IAAI,GAAG,GAAGkB,QAAQlB,IAAI,CAAC,IAAI,EAAEzC,QAAQ;IAE3C,MAAMY,MAAMH,eAAeiB,MAAMoC,kBAAkB;IACnD,IAAIlD,QAAQ,MAAM;QAChB,OAAOU,OAAO,2BAA2B;IAC3C;IACA,IAAIV,KAAKW,MAAMuC,kBAAkB,GAAGlD;IACpC,MAAMmD,SAAS/C,kBAAkBU,MAAMsC,qBAAqB;IAC5D,IAAID,WAAW,MAAM;QACnB,OAAOzC,OAAO,8BAA8B;IAC9C;IACA,IAAIyC,QAAQxC,MAAMyC,qBAAqB,GAAGD;IAE1C,OAAO;QAAExC;QAAOtB,OAAO;QAAMuB,kBAAkBe;IAAW;AAC5D"}

package/src/lib/engine/sequence-validation.js

@@ -135,7 +135,10 @@ const WEEKDAY_NAMES = [
         allowedCountries: Array.isArray(data['allowedCountries']) ? countries : [
             ...OUTREACH_DEFAULT_ALLOWED_COUNTRIES
         ],
-        allowCustomers: data['allowCustomers'] === true
+        allowCustomers: data['allowCustomers'] === true,
+        // Absent is off (AGL-3239). Every sequence written before the setting
+        // existed reads as untracked, which is what it was.
+        trackClicks: data['trackClicks'] === true
     };
 }
 export function validateOutreachSequenceSettings(settings, path = 'settings') {