@aglyn/plugins-outreach 1.0.0-beta.156 → 1.0.0-beta.158

package/src/lib/runtime/click-route.js

@@ -0,0 +1,108 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { readOutreachClickToken } from "./click-link.js";
+import { recordOutreachClick } from "./click-events.js";
+// The plain page both recipient-facing routes answer with: no theme, no
+// session, the reader's own colors. It lives beside the first route that
+// needed one rather than being copied for the second.
+import { outreachUnsubscribePage } from "./unsubscribe-route.js";
+/**
+ * A LINK IN A TRACKED SEQUENCE EMAIL (AGL-3239): `GET /api/outreach/click?t=…`.
+ *
+ * ## The redirect happens first, and it happens for everyone
+ *
+ * The destination is in the token, so answering needs no read: the handler
+ * verifies the signature, and the 302 goes out. Recording is awaited after
+ * the answer is built and never gates it — a Firestore that is slow or down
+ * costs a number, not a visit.
+ *
+ * A link scanner is redirected exactly as a person is. Refusing one, or
+ * answering it differently, is how a security gateway learns to report the
+ * link as broken and the message as suspicious; it is counted apart instead
+ * (`../engine/click-tracking.ts`).
+ *
+ * ## No session, and no release gate
+ *
+ * Registered as a recipient link, like the one-click unsubscribe. The
+ * signature in the token is the whole of the authority, and a link that is
+ * already in somebody's inbox has to keep working whether or not Outreach is
+ * released to that organization today.
+ *
+ * ## A token that does not verify is not followed
+ *
+ * There is nowhere to send them: the destination WAS the thing that failed
+ * the check. So it answers the same plain page the unsubscribe route
+ * answers, rather than guessing — an endpoint that redirects to an unsigned
+ * URL is an open redirect, whatever it is called.
+ *
+ * ## What the recipient's browser is told
+ *
+ * `no-store`, so a gateway's copy is never served to the person after it;
+ * `no-referrer`, so the destination never learns the token; and `noindex`,
+ * because a tracking link that reached a crawler should not be in an index.
+ */ const REDIRECT_HEADERS = {
+    'Cache-Control': 'no-store, no-cache, must-revalidate',
+    'Referrer-Policy': 'no-referrer',
+    'X-Robots-Tag': 'noindex, nofollow'
+};
+export function createOutreachClickRoute(deps) {
+    return async (request)=>{
+        // `HEAD` is answered because a gateway often sends one before the `GET`
+        // a person makes; it is redirected and counted as the machine it is.
+        if (request.method !== 'GET' && request.method !== 'HEAD') {
+            return new Response('Method not allowed', {
+                status: 405,
+                headers: {
+                    Allow: 'GET, HEAD'
+                }
+            });
+        }
+        const target = readOutreachClickToken(new URL(request.url).searchParams.get('t'));
+        if (!target) {
+            return outreachUnsubscribePage({
+                title: 'This link doesn’t work',
+                body: 'This link isn’t valid, or it has been changed since it was sent. Try opening it from the original email.'
+            }, 400);
+        }
+        /*
+     * Built by hand rather than with `Response.redirect`, which seals its
+     * headers: the three above are the point of the answer as much as the
+     * `Location` is. `target.url` is `URL.href` of an http(s) URL — the
+     * token reader will return nothing else — so it is a header value that
+     * cannot carry a newline into the response.
+     */ const redirect = new Response(null, {
+            status: 302,
+            headers: _extends({}, REDIRECT_HEADERS, {
+                Location: target.url
+            })
+        });
+        try {
+            await recordOutreachClick(deps, {
+                target,
+                method: request.method,
+                userAgent: request.headers.get('user-agent')
+            });
+        } catch (error) {
+            // The visit already has its answer. A click we failed to count is a
+            // missing number; a redirect we failed to send is a broken email.
+            console.error('[outreach] a click could not be recorded', error);
+        }
+        return redirect;
+    };
+}
+
+//# sourceMappingURL=click-route.js.map

package/src/lib/runtime/click-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/click-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginWebApiHandler } from '@aglyn/aglyn/server'\nimport { readOutreachClickToken } from './click-link'\nimport { recordOutreachClick } from './click-events'\nimport type { OutreachRuntimeDeps } from './runtime-deps'\n// The plain page both recipient-facing routes answer with: no theme, no\n// session, the reader's own colors. It lives beside the first route that\n// needed one rather than being copied for the second.\nimport { outreachUnsubscribePage } from './unsubscribe-route'\n\n/**\n * A LINK IN A TRACKED SEQUENCE EMAIL (AGL-3239): `GET /api/outreach/click?t=…`.\n *\n * ## The redirect happens first, and it happens for everyone\n *\n * The destination is in the token, so answering needs no read: the handler\n * verifies the signature, and the 302 goes out. Recording is awaited after\n * the answer is built and never gates it — a Firestore that is slow or down\n * costs a number, not a visit.\n *\n * A link scanner is redirected exactly as a person is. Refusing one, or\n * answering it differently, is how a security gateway learns to report the\n * link as broken and the message as suspicious; it is counted apart instead\n * (`../engine/click-tracking.ts`).\n *\n * ## No session, and no release gate\n *\n * Registered as a recipient link, like the one-click unsubscribe. The\n * signature in the token is the whole of the authority, and a link that is\n * already in somebody's inbox has to keep working whether or not Outreach is\n * released to that organization today.\n *\n * ## A token that does not verify is not followed\n *\n * There is nowhere to send them: the destination WAS the thing that failed\n * the check. So it answers the same plain page the unsubscribe route\n * answers, rather than guessing — an endpoint that redirects to an unsigned\n * URL is an open redirect, whatever it is called.\n *\n * ## What the recipient's browser is told\n *\n * `no-store`, so a gateway's copy is never served to the person after it;\n * `no-referrer`, so the destination never learns the token; and `noindex`,\n * because a tracking link that reached a crawler should not be in an index.\n */\n\nconst REDIRECT_HEADERS = {\n  'Cache-Control': 'no-store, no-cache, must-revalidate',\n  'Referrer-Policy': 'no-referrer',\n  'X-Robots-Tag': 'noindex, nofollow',\n}\n\nexport function createOutreachClickRoute(\n  deps: Pick<OutreachRuntimeDeps, 'firestore' | 'now' | 'timeline'>,\n): PluginWebApiHandler {\n  return async (request) => {\n    // `HEAD` is answered because a gateway often sends one before the `GET`\n    // a person makes; it is redirected and counted as the machine it is.\n    if (request.method !== 'GET' && request.method !== 'HEAD') {\n      return new Response('Method not allowed', { status: 405, headers: { Allow: 'GET, HEAD' } })\n    }\n    const target = readOutreachClickToken(new URL(request.url).searchParams.get('t'))\n    if (!target) {\n      return outreachUnsubscribePage(\n        {\n          title: 'This link doesn’t work',\n          body: 'This link isn’t valid, or it has been changed since it was sent. Try opening it from the original email.',\n        },\n        400,\n      )\n    }\n    /*\n     * Built by hand rather than with `Response.redirect`, which seals its\n     * headers: the three above are the point of the answer as much as the\n     * `Location` is. `target.url` is `URL.href` of an http(s) URL — the\n     * token reader will return nothing else — so it is a header value that\n     * cannot carry a newline into the response.\n     */\n    const redirect = new Response(null, {\n      status: 302,\n      headers: { ...REDIRECT_HEADERS, Location: target.url },\n    })\n    try {\n      await recordOutreachClick(deps, {\n        target,\n        method: request.method,\n        userAgent: request.headers.get('user-agent'),\n      })\n    } catch (error) {\n      // The visit already has its answer. A click we failed to count is a\n      // missing number; a redirect we failed to send is a broken email.\n      console.error('[outreach] a click could not be recorded', error)\n    }\n    return redirect\n  }\n}\n"],"names":["readOutreachClickToken","recordOutreachClick","outreachUnsubscribePage","REDIRECT_HEADERS","createOutreachClickRoute","deps","request","method","Response","status","headers","Allow","target","URL","url","searchParams","get","title","body","redirect","Location","userAgent","error","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,sBAAsB,QAAQ,kBAAc;AACrD,SAASC,mBAAmB,QAAQ,oBAAgB;AAEpD,wEAAwE;AACxE,yEAAyE;AACzE,sDAAsD;AACtD,SAASC,uBAAuB,QAAQ,yBAAqB;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GAED,MAAMC,mBAAmB;IACvB,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;AAClB;AAEA,OAAO,SAASC,yBACdC,IAAiE;IAEjE,OAAO,OAAOC;QACZ,wEAAwE;QACxE,qEAAqE;QACrE,IAAIA,QAAQC,MAAM,KAAK,SAASD,QAAQC,MAAM,KAAK,QAAQ;YACzD,OAAO,IAAIC,SAAS,sBAAsB;gBAAEC,QAAQ;gBAAKC,SAAS;oBAAEC,OAAO;gBAAY;YAAE;QAC3F;QACA,MAAMC,SAASZ,uBAAuB,IAAIa,IAAIP,QAAQQ,GAAG,EAAEC,YAAY,CAACC,GAAG,CAAC;QAC5E,IAAI,CAACJ,QAAQ;YACX,OAAOV,wBACL;gBACEe,OAAO;gBACPC,MAAM;YACR,GACA;QAEJ;QACA;;;;;;KAMC,GACD,MAAMC,WAAW,IAAIX,SAAS,MAAM;YAClCC,QAAQ;YACRC,SAAS,aAAKP;gBAAkBiB,UAAUR,OAAOE,GAAG;;QACtD;QACA,IAAI;YACF,MAAMb,oBAAoBI,MAAM;gBAC9BO;gBACAL,QAAQD,QAAQC,MAAM;gBACtBc,WAAWf,QAAQI,OAAO,CAACM,GAAG,CAAC;YACjC;QACF,EAAE,OAAOM,OAAO;YACd,oEAAoE;YACpE,kEAAkE;YAClEC,QAAQD,KAAK,CAAC,4CAA4CA;QAC5D;QACA,OAAOH;IACT;AACF"}

package/src/lib/runtime/platform-runtime-deps.d.ts

@@ -25,5 +25,7 @@ import type { OutreachRuntimeDeps } from './runtime-deps';
 export declare function platformOutreachRuntimeDeps(): OutreachRuntimeDeps;
 /** The unsubscribe route on the platform's own reach. */
 export declare function platformOutreachUnsubscribeRoute(): PluginWebApiHandler;
+/** The click-tracking redirect on the platform's own reach (AGL-3239). */
+export declare function platformOutreachClickRoute(): PluginWebApiHandler;
 /** The person eraser on the platform's own Firestore. */
 export declare function platformOutreachPersonEraser(): PluginPersonEraser;

package/src/lib/runtime/platform-runtime-deps.js

@@ -26,6 +26,8 @@ import { filterEnabledPluginsByReleaseFlags } from "@aglyn/tenant-data-admin/ser
 import { OUTREACH_PLUGIN_ID } from "../constants/bundle-common.js";
 import { openOutreachMailboxClient } from "../mailboxes/mailbox-transport.js";
 import { canonicalConsoleOrigin } from "../mailboxes/oauth-redirect.js";
+import { outreachClickUrl } from "./click-link.js";
+import { createOutreachClickRoute } from "./click-route.js";
 import { createOutreachPersonEraser } from "./person-erasure.js";
 import { outreachUnsubscribeUrl } from "./unsubscribe-link.js";
 import { createOutreachUnsubscribeRoute } from "./unsubscribe-route.js";
@@ -83,12 +85,19 @@ import { createOutreachUnsubscribeRoute } from "./unsubscribe-route.js";
         unsubscribeUrl: (target)=>outreachUnsubscribeUrl({
                 origin: canonicalConsoleOrigin(),
                 target
+            }),
+        clickUrl: (target)=>outreachClickUrl({
+                origin: canonicalConsoleOrigin(),
+                target
             })
     };
 }
 /** The unsubscribe route on the platform's own reach. */ export function platformOutreachUnsubscribeRoute() {
     return createOutreachUnsubscribeRoute(platformOutreachRuntimeDeps());
 }
+/** The click-tracking redirect on the platform's own reach (AGL-3239). */ export function platformOutreachClickRoute() {
+    return createOutreachClickRoute(platformOutreachRuntimeDeps());
+}
 /** The person eraser on the platform's own Firestore. */ export function platformOutreachPersonEraser() {
     return createOutreachPersonEraser({
         firestore: ()=>firebaseAdmin.app().firestore()

package/src/lib/runtime/platform-runtime-deps.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/platform-runtime-deps.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { EMAIL_TOPIC_SALES } from '@aglyn/aglyn/app-utils/email-topics'\nimport { checkEntitlement } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport { isPluginEnabled } from '@aglyn/aglyn/plugin-manager/enabled-plugins'\nimport { pluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plugin-record-timeline'\nimport { suppressEmail } from '@aglyn/tenant-data-admin/server/email-suppression'\nimport { recordTopicOptOut } from '@aglyn/tenant-data-admin/server/email-topic-confirmation'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { getLockdownVerdict } from '@aglyn/tenant-data-admin/server/lockdown'\nimport { logOrgActivity } from '@aglyn/tenant-data-admin/server/organizations'\nimport { filterEnabledPluginsByReleaseFlags } from '@aglyn/tenant-data-admin/server/release-flags'\nimport { OUTREACH_PLUGIN_ID } from '../constants/bundle-common'\nimport { openOutreachMailboxClient } from '../mailboxes/mailbox-transport'\nimport { canonicalConsoleOrigin } from '../mailboxes/oauth-redirect'\nimport type { PluginWebApiHandler } from '@aglyn/aglyn/server'\nimport type { PluginPersonEraser } from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport { createOutreachPersonEraser } from './person-erasure'\nimport type { OutreachRuntimeDeps } from './runtime-deps'\nimport { outreachUnsubscribeUrl } from './unsubscribe-link'\nimport { createOutreachUnsubscribeRoute } from './unsubscribe-route'\n\n/**\n * The platform's own reach for the sending runtime (AGL-2981). Loaded only\n * when a job runs or the unsubscribe route answers — never at boot — so the\n * console pays for these modules when Outreach does work.\n */\nexport function platformOutreachRuntimeDeps(): OutreachRuntimeDeps {\n  const firestore = () => firebaseAdmin.app().firestore()\n  return {\n    firestore,\n    now: Date.now,\n    random: Math.random,\n    openMailbox: (mailboxId) => openOutreachMailboxClient(firestore(), { mailboxId }),\n    async orgRefusal(orgId, org) {\n      if (!isPluginEnabled(org as { enabledPlugins?: string[] }, OUTREACH_PLUGIN_ID)) return 'plugin-disabled'\n      if (!checkEntitlement(org, 'outreach')) return 'not-entitled'\n      const released = await filterEnabledPluginsByReleaseFlags([OUTREACH_PLUGIN_ID], { orgId })\n      return released.length ? null : 'not-released'\n    },\n    async sendRefusal({ org, uid }) {\n      const locked = await getLockdownVerdict({ org, uid, intent: 'write' })\n      return locked ? `locked:${locked.scope}` : null\n    },\n    timeline: () => pluginRecordTimelineWriter()?.writer ?? null,\n    logOrgActivity: (orgId, actor, action, target) => logOrgActivity(orgId, actor, action, target),\n    async optOutOfSalesTopic({ hostId, email }) {\n      await recordTopicOptOut(hostId, email, EMAIL_TOPIC_SALES, { firestore: firestore() })\n    },\n    async suppressBouncedEmail({ email, hostId }) {\n      await suppressEmail({ email, reason: 'bounce', context: 'outreach', hostId, firestore: firestore() })\n    },\n    unsubscribeUrl: (target) => outreachUnsubscribeUrl({ origin: canonicalConsoleOrigin(), target }),\n  }\n}\n\n/** The unsubscribe route on the platform's own reach. */\nexport function platformOutreachUnsubscribeRoute(): PluginWebApiHandler {\n  return createOutreachUnsubscribeRoute(platformOutreachRuntimeDeps())\n}\n\n/** The person eraser on the platform's own Firestore. */\nexport function platformOutreachPersonEraser(): PluginPersonEraser {\n  return createOutreachPersonEraser({ firestore: () => firebaseAdmin.app().firestore() })\n}\n"],"names":["EMAIL_TOPIC_SALES","checkEntitlement","isPluginEnabled","pluginRecordTimelineWriter","suppressEmail","recordTopicOptOut","firebaseAdmin","getLockdownVerdict","logOrgActivity","filterEnabledPluginsByReleaseFlags","OUTREACH_PLUGIN_ID","openOutreachMailboxClient","canonicalConsoleOrigin","createOutreachPersonEraser","outreachUnsubscribeUrl","createOutreachUnsubscribeRoute","platformOutreachRuntimeDeps","firestore","app","now","Date","random","Math","openMailbox","mailboxId","orgRefusal","orgId","org","released","length","sendRefusal","uid","locked","intent","scope","timeline","writer","actor","action","target","optOutOfSalesTopic","hostId","email","suppressBouncedEmail","reason","context","unsubscribeUrl","origin","platformOutreachUnsubscribeRoute","platformOutreachPersonEraser"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,iBAAiB,QAAQ,sCAAqC;AACvE,SAASC,gBAAgB,QAAQ,2CAA0C;AAC3E,SAASC,eAAe,QAAQ,8CAA6C;AAC7E,SAASC,0BAA0B,QAAQ,qDAAoD;AAC/F,SAASC,aAAa,QAAQ,oDAAmD;AACjF,SAASC,iBAAiB,QAAQ,2DAA0D;AAC5F,SAASC,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,cAAc,QAAQ,gDAA+C;AAC9E,SAASC,kCAAkC,QAAQ,gDAA+C;AAClG,SAASC,kBAAkB,QAAQ,gCAA4B;AAC/D,SAASC,yBAAyB,QAAQ,oCAAgC;AAC1E,SAASC,sBAAsB,QAAQ,iCAA6B;AAGpE,SAASC,0BAA0B,QAAQ,sBAAkB;AAE7D,SAASC,sBAAsB,QAAQ,wBAAoB;AAC3D,SAASC,8BAA8B,QAAQ,yBAAqB;AAEpE;;;;CAIC,GACD,OAAO,SAASC;IACd,MAAMC,YAAY,IAAMX,cAAcY,GAAG,GAAGD,SAAS;IACrD,OAAO;QACLA;QACAE,KAAKC,KAAKD,GAAG;QACbE,QAAQC,KAAKD,MAAM;QACnBE,aAAa,CAACC,YAAcb,0BAA0BM,aAAa;gBAAEO;YAAU;QAC/E,MAAMC,YAAWC,KAAK,EAAEC,GAAG;YACzB,IAAI,CAACzB,gBAAgByB,KAAsCjB,qBAAqB,OAAO;YACvF,IAAI,CAACT,iBAAiB0B,KAAK,aAAa,OAAO;YAC/C,MAAMC,WAAW,MAAMnB,mCAAmC;gBAACC;aAAmB,EAAE;gBAAEgB;YAAM;YACxF,OAAOE,SAASC,MAAM,GAAG,OAAO;QAClC;QACA,MAAMC,aAAY,EAAEH,GAAG,EAAEI,GAAG,EAAE;YAC5B,MAAMC,SAAS,MAAMzB,mBAAmB;gBAAEoB;gBAAKI;gBAAKE,QAAQ;YAAQ;YACpE,OAAOD,SAAS,CAAC,OAAO,EAAEA,OAAOE,KAAK,EAAE,GAAG;QAC7C;QACAC,UAAU;;gBAAMhC;4BAAAA,8BAAAA,iDAAAA,4BAA8BiC,MAAM,mBAAI;;QACxD5B,gBAAgB,CAACkB,OAAOW,OAAOC,QAAQC,SAAW/B,eAAekB,OAAOW,OAAOC,QAAQC;QACvF,MAAMC,oBAAmB,EAAEC,MAAM,EAAEC,KAAK,EAAE;YACxC,MAAMrC,kBAAkBoC,QAAQC,OAAO1C,mBAAmB;gBAAEiB,WAAWA;YAAY;QACrF;QACA,MAAM0B,sBAAqB,EAAED,KAAK,EAAED,MAAM,EAAE;YAC1C,MAAMrC,cAAc;gBAAEsC;gBAAOE,QAAQ;gBAAUC,SAAS;gBAAYJ;gBAAQxB,WAAWA;YAAY;QACrG;QACA6B,gBAAgB,CAACP,SAAWzB,uBAAuB;gBAAEiC,QAAQnC;gBAA0B2B;YAAO;IAChG;AACF;AAEA,uDAAuD,GACvD,OAAO,SAASS;IACd,OAAOjC,+BAA+BC;AACxC;AAEA,uDAAuD,GACvD,OAAO,SAASiC;IACd,OAAOpC,2BAA2B;QAAEI,WAAW,IAAMX,cAAcY,GAAG,GAAGD,SAAS;IAAG;AACvF"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/platform-runtime-deps.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { EMAIL_TOPIC_SALES } from '@aglyn/aglyn/app-utils/email-topics'\nimport { checkEntitlement } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport { isPluginEnabled } from '@aglyn/aglyn/plugin-manager/enabled-plugins'\nimport { pluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plugin-record-timeline'\nimport { suppressEmail } from '@aglyn/tenant-data-admin/server/email-suppression'\nimport { recordTopicOptOut } from '@aglyn/tenant-data-admin/server/email-topic-confirmation'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { getLockdownVerdict } from '@aglyn/tenant-data-admin/server/lockdown'\nimport { logOrgActivity } from '@aglyn/tenant-data-admin/server/organizations'\nimport { filterEnabledPluginsByReleaseFlags } from '@aglyn/tenant-data-admin/server/release-flags'\nimport { OUTREACH_PLUGIN_ID } from '../constants/bundle-common'\nimport { openOutreachMailboxClient } from '../mailboxes/mailbox-transport'\nimport { canonicalConsoleOrigin } from '../mailboxes/oauth-redirect'\nimport type { PluginWebApiHandler } from '@aglyn/aglyn/server'\nimport type { PluginPersonEraser } from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport { outreachClickUrl } from './click-link'\nimport { createOutreachClickRoute } from './click-route'\nimport { createOutreachPersonEraser } from './person-erasure'\nimport type { OutreachRuntimeDeps } from './runtime-deps'\nimport { outreachUnsubscribeUrl } from './unsubscribe-link'\nimport { createOutreachUnsubscribeRoute } from './unsubscribe-route'\n\n/**\n * The platform's own reach for the sending runtime (AGL-2981). Loaded only\n * when a job runs or the unsubscribe route answers — never at boot — so the\n * console pays for these modules when Outreach does work.\n */\nexport function platformOutreachRuntimeDeps(): OutreachRuntimeDeps {\n  const firestore = () => firebaseAdmin.app().firestore()\n  return {\n    firestore,\n    now: Date.now,\n    random: Math.random,\n    openMailbox: (mailboxId) => openOutreachMailboxClient(firestore(), { mailboxId }),\n    async orgRefusal(orgId, org) {\n      if (!isPluginEnabled(org as { enabledPlugins?: string[] }, OUTREACH_PLUGIN_ID)) return 'plugin-disabled'\n      if (!checkEntitlement(org, 'outreach')) return 'not-entitled'\n      const released = await filterEnabledPluginsByReleaseFlags([OUTREACH_PLUGIN_ID], { orgId })\n      return released.length ? null : 'not-released'\n    },\n    async sendRefusal({ org, uid }) {\n      const locked = await getLockdownVerdict({ org, uid, intent: 'write' })\n      return locked ? `locked:${locked.scope}` : null\n    },\n    timeline: () => pluginRecordTimelineWriter()?.writer ?? null,\n    logOrgActivity: (orgId, actor, action, target) => logOrgActivity(orgId, actor, action, target),\n    async optOutOfSalesTopic({ hostId, email }) {\n      await recordTopicOptOut(hostId, email, EMAIL_TOPIC_SALES, { firestore: firestore() })\n    },\n    async suppressBouncedEmail({ email, hostId }) {\n      await suppressEmail({ email, reason: 'bounce', context: 'outreach', hostId, firestore: firestore() })\n    },\n    unsubscribeUrl: (target) => outreachUnsubscribeUrl({ origin: canonicalConsoleOrigin(), target }),\n    clickUrl: (target) => outreachClickUrl({ origin: canonicalConsoleOrigin(), target }),\n  }\n}\n\n/** The unsubscribe route on the platform's own reach. */\nexport function platformOutreachUnsubscribeRoute(): PluginWebApiHandler {\n  return createOutreachUnsubscribeRoute(platformOutreachRuntimeDeps())\n}\n\n/** The click-tracking redirect on the platform's own reach (AGL-3239). */\nexport function platformOutreachClickRoute(): PluginWebApiHandler {\n  return createOutreachClickRoute(platformOutreachRuntimeDeps())\n}\n\n/** The person eraser on the platform's own Firestore. */\nexport function platformOutreachPersonEraser(): PluginPersonEraser {\n  return createOutreachPersonEraser({ firestore: () => firebaseAdmin.app().firestore() })\n}\n"],"names":["EMAIL_TOPIC_SALES","checkEntitlement","isPluginEnabled","pluginRecordTimelineWriter","suppressEmail","recordTopicOptOut","firebaseAdmin","getLockdownVerdict","logOrgActivity","filterEnabledPluginsByReleaseFlags","OUTREACH_PLUGIN_ID","openOutreachMailboxClient","canonicalConsoleOrigin","outreachClickUrl","createOutreachClickRoute","createOutreachPersonEraser","outreachUnsubscribeUrl","createOutreachUnsubscribeRoute","platformOutreachRuntimeDeps","firestore","app","now","Date","random","Math","openMailbox","mailboxId","orgRefusal","orgId","org","released","length","sendRefusal","uid","locked","intent","scope","timeline","writer","actor","action","target","optOutOfSalesTopic","hostId","email","suppressBouncedEmail","reason","context","unsubscribeUrl","origin","clickUrl","platformOutreachUnsubscribeRoute","platformOutreachClickRoute","platformOutreachPersonEraser"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,iBAAiB,QAAQ,sCAAqC;AACvE,SAASC,gBAAgB,QAAQ,2CAA0C;AAC3E,SAASC,eAAe,QAAQ,8CAA6C;AAC7E,SAASC,0BAA0B,QAAQ,qDAAoD;AAC/F,SAASC,aAAa,QAAQ,oDAAmD;AACjF,SAASC,iBAAiB,QAAQ,2DAA0D;AAC5F,SAASC,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,cAAc,QAAQ,gDAA+C;AAC9E,SAASC,kCAAkC,QAAQ,gDAA+C;AAClG,SAASC,kBAAkB,QAAQ,gCAA4B;AAC/D,SAASC,yBAAyB,QAAQ,oCAAgC;AAC1E,SAASC,sBAAsB,QAAQ,iCAA6B;AAGpE,SAASC,gBAAgB,QAAQ,kBAAc;AAC/C,SAASC,wBAAwB,QAAQ,mBAAe;AACxD,SAASC,0BAA0B,QAAQ,sBAAkB;AAE7D,SAASC,sBAAsB,QAAQ,wBAAoB;AAC3D,SAASC,8BAA8B,QAAQ,yBAAqB;AAEpE;;;;CAIC,GACD,OAAO,SAASC;IACd,MAAMC,YAAY,IAAMb,cAAcc,GAAG,GAAGD,SAAS;IACrD,OAAO;QACLA;QACAE,KAAKC,KAAKD,GAAG;QACbE,QAAQC,KAAKD,MAAM;QACnBE,aAAa,CAACC,YAAcf,0BAA0BQ,aAAa;gBAAEO;YAAU;QAC/E,MAAMC,YAAWC,KAAK,EAAEC,GAAG;YACzB,IAAI,CAAC3B,gBAAgB2B,KAAsCnB,qBAAqB,OAAO;YACvF,IAAI,CAACT,iBAAiB4B,KAAK,aAAa,OAAO;YAC/C,MAAMC,WAAW,MAAMrB,mCAAmC;gBAACC;aAAmB,EAAE;gBAAEkB;YAAM;YACxF,OAAOE,SAASC,MAAM,GAAG,OAAO;QAClC;QACA,MAAMC,aAAY,EAAEH,GAAG,EAAEI,GAAG,EAAE;YAC5B,MAAMC,SAAS,MAAM3B,mBAAmB;gBAAEsB;gBAAKI;gBAAKE,QAAQ;YAAQ;YACpE,OAAOD,SAAS,CAAC,OAAO,EAAEA,OAAOE,KAAK,EAAE,GAAG;QAC7C;QACAC,UAAU;;gBAAMlC;4BAAAA,8BAAAA,iDAAAA,4BAA8BmC,MAAM,mBAAI;;QACxD9B,gBAAgB,CAACoB,OAAOW,OAAOC,QAAQC,SAAWjC,eAAeoB,OAAOW,OAAOC,QAAQC;QACvF,MAAMC,oBAAmB,EAAEC,MAAM,EAAEC,KAAK,EAAE;YACxC,MAAMvC,kBAAkBsC,QAAQC,OAAO5C,mBAAmB;gBAAEmB,WAAWA;YAAY;QACrF;QACA,MAAM0B,sBAAqB,EAAED,KAAK,EAAED,MAAM,EAAE;YAC1C,MAAMvC,cAAc;gBAAEwC;gBAAOE,QAAQ;gBAAUC,SAAS;gBAAYJ;gBAAQxB,WAAWA;YAAY;QACrG;QACA6B,gBAAgB,CAACP,SAAWzB,uBAAuB;gBAAEiC,QAAQrC;gBAA0B6B;YAAO;QAC9FS,UAAU,CAACT,SAAW5B,iBAAiB;gBAAEoC,QAAQrC;gBAA0B6B;YAAO;IACpF;AACF;AAEA,uDAAuD,GACvD,OAAO,SAASU;IACd,OAAOlC,+BAA+BC;AACxC;AAEA,wEAAwE,GACxE,OAAO,SAASkC;IACd,OAAOtC,yBAAyBI;AAClC;AAEA,uDAAuD,GACvD,OAAO,SAASmC;IACd,OAAOtC,2BAA2B;QAAEI,WAAW,IAAMb,cAAcc,GAAG,GAAGD,SAAS;IAAG;AACvF"}

package/src/lib/runtime/runtime-deps.d.ts

@@ -16,6 +16,7 @@
  */
 import type { PluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plugin-record-timeline';
 import type { OpenedOutreachMailbox } from '../mailboxes/mailbox-transport';
+import type { OutreachClickTarget } from './click-link';
 import type { OutreachUnsubscribeTarget } from './unsubscribe-link';
 /**
  * EVERYTHING THE SENDING RUNTIME REACHES OUTSIDE ITS OWN DOCUMENTS (AGL-2981).
@@ -74,4 +75,14 @@ export interface OutreachRuntimeDeps {
     }): Promise<void>;
     /** The signed one-click link for an enrollment, or `null` when none can be minted. */
     unsubscribeUrl(target: OutreachUnsubscribeTarget): string | null;
+    /**
+     * The signed tracking link for one link in one email, or `null` when none
+     * can be minted (AGL-3239) — no console origin, no signing secret, or a
+     * destination we will not sign.
+     *
+     * A `null` is not an error: the link goes out as the step wrote it, and
+     * that click is not counted. An email whose links do not work is worse
+     * than an email we cannot measure.
+     */
+    clickUrl(target: OutreachClickTarget): string | null;
 }

package/src/lib/runtime/runtime-deps.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/runtime-deps.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plugin-record-timeline'\nimport type { OpenedOutreachMailbox } from '../mailboxes/mailbox-transport'\nimport type { OutreachUnsubscribeTarget } from './unsubscribe-link'\n\n/**\n * EVERYTHING THE SENDING RUNTIME REACHES OUTSIDE ITS OWN DOCUMENTS (AGL-2981).\n *\n * The send and sync jobs and the unsubscribe route read and write Outreach's\n * collections through the Firestore they are handed, and reach everything\n * else through these: the mailbox's Gmail, the record system, the platform's\n * suppression and topic lists, the activity feed and the gates that decide\n * whether Outreach may act for a workspace at all. The platform's own are\n * `platform-runtime-deps.ts`; the emulator specs hand in a fake Gmail and\n * recorders, so no test reaches Google or sends mail.\n */\n\n/** A target an org activity line written by the runtime points at. */\nexport interface OutreachRuntimeActivityTarget {\n  type: `${string}:${string}`\n  id: string\n  name: string\n}\n\nexport interface OutreachRuntimeDeps {\n  firestore(): FirebaseFirestore.Firestore\n  now(): number\n  /** A source of numbers in `[0, 1)` — the scheduler's jitter. */\n  random(): number\n  /** Opens a mailbox's Gmail client from its sealed grant. */\n  openMailbox(mailboxId: string): Promise<OpenedOutreachMailbox>\n  /**\n   * Why Outreach may not act for this workspace now, or `null` when it may:\n   * the plugin switched on and entitled, and its release flag on for the\n   * organization.\n   */\n  orgRefusal(orgId: string, org: Record<string, unknown>): Promise<string | null>\n  /**\n   * Why nothing may be sent as this member now — a lockdown of the platform,\n   * the workspace or the member — or `null`.\n   */\n  sendRefusal(input: { orgId: string; org: Record<string, unknown>; uid: string }): Promise<string | null>\n  /** The workspace's record system on the timeline seam, when a plugin keeps one. */\n  timeline(): PluginRecordTimelineWriter | null\n  logOrgActivity(\n    orgId: string,\n    actor: { uid: string | null; email?: string | null },\n    action: string,\n    target: OutreachRuntimeActivityTarget,\n  ): Promise<void>\n  /** Takes an address off one site's `sales` email topic. */\n  optOutOfSalesTopic(input: { hostId: string; email: string }): Promise<void>\n  /** Files a hard bounce on the platform's suppression list. */\n  suppressBouncedEmail(input: { email: string; hostId: string | null }): Promise<void>\n  /** The signed one-click link for an enrollment, or `null` when none can be minted. */\n  unsubscribeUrl(target: OutreachUnsubscribeTarget): string | null\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAyBD,WAgCC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/runtime/runtime-deps.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plugin-record-timeline'\nimport type { OpenedOutreachMailbox } from '../mailboxes/mailbox-transport'\nimport type { OutreachClickTarget } from './click-link'\nimport type { OutreachUnsubscribeTarget } from './unsubscribe-link'\n\n/**\n * EVERYTHING THE SENDING RUNTIME REACHES OUTSIDE ITS OWN DOCUMENTS (AGL-2981).\n *\n * The send and sync jobs and the unsubscribe route read and write Outreach's\n * collections through the Firestore they are handed, and reach everything\n * else through these: the mailbox's Gmail, the record system, the platform's\n * suppression and topic lists, the activity feed and the gates that decide\n * whether Outreach may act for a workspace at all. The platform's own are\n * `platform-runtime-deps.ts`; the emulator specs hand in a fake Gmail and\n * recorders, so no test reaches Google or sends mail.\n */\n\n/** A target an org activity line written by the runtime points at. */\nexport interface OutreachRuntimeActivityTarget {\n  type: `${string}:${string}`\n  id: string\n  name: string\n}\n\nexport interface OutreachRuntimeDeps {\n  firestore(): FirebaseFirestore.Firestore\n  now(): number\n  /** A source of numbers in `[0, 1)` — the scheduler's jitter. */\n  random(): number\n  /** Opens a mailbox's Gmail client from its sealed grant. */\n  openMailbox(mailboxId: string): Promise<OpenedOutreachMailbox>\n  /**\n   * Why Outreach may not act for this workspace now, or `null` when it may:\n   * the plugin switched on and entitled, and its release flag on for the\n   * organization.\n   */\n  orgRefusal(orgId: string, org: Record<string, unknown>): Promise<string | null>\n  /**\n   * Why nothing may be sent as this member now — a lockdown of the platform,\n   * the workspace or the member — or `null`.\n   */\n  sendRefusal(input: { orgId: string; org: Record<string, unknown>; uid: string }): Promise<string | null>\n  /** The workspace's record system on the timeline seam, when a plugin keeps one. */\n  timeline(): PluginRecordTimelineWriter | null\n  logOrgActivity(\n    orgId: string,\n    actor: { uid: string | null; email?: string | null },\n    action: string,\n    target: OutreachRuntimeActivityTarget,\n  ): Promise<void>\n  /** Takes an address off one site's `sales` email topic. */\n  optOutOfSalesTopic(input: { hostId: string; email: string }): Promise<void>\n  /** Files a hard bounce on the platform's suppression list. */\n  suppressBouncedEmail(input: { email: string; hostId: string | null }): Promise<void>\n  /** The signed one-click link for an enrollment, or `null` when none can be minted. */\n  unsubscribeUrl(target: OutreachUnsubscribeTarget): string | null\n  /**\n   * The signed tracking link for one link in one email, or `null` when none\n   * can be minted (AGL-3239) — no console origin, no signing secret, or a\n   * destination we will not sign.\n   *\n   * A `null` is not an error: the link goes out as the step wrote it, and\n   * that click is not counted. An email whose links do not work is worse\n   * than an email we cannot measure.\n   */\n  clickUrl(target: OutreachClickTarget): string | null\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GA0BD,WA0CC"}

package/src/lib/runtime/send-job.js

@@ -17,6 +17,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  */ import { consentGroupForHost } from "@aglyn/aglyn/app-utils/consent-groups";
 import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
 import { normalizeCrmEmailTemplate } from "@aglyn/aglyn/app-utils/crm-email-templates";
+import { FieldValue } from "firebase-admin/firestore";
 import { randomUUID } from "node:crypto";
 import { composeOutreachEmail } from "../engine/compose.js";
 import { planOutreachStepCompletion } from "../engine/enrollment-state.js";
@@ -401,8 +402,15 @@ async function openClient(deps, firestore, run) {
     const enrollmentRef = outreachOrgCollection(firestore, run.orgId, 'enrollments').doc(input.enrollment.id);
     const boxRef = mailboxRef(firestore, run.orgId, run.mailbox.id);
     const nowMs = deps.now();
-    return firestore.runTransaction(async (transaction)=>{
-        var _stored_stepRecords, _plan_patch;
+    /*
+   * Whether this is the FIRST email this person has had from the sequence
+   * (AGL-3239), decided from the same read the step is recorded against and
+   * so re-decided on every transaction retry. It is what `stats.people`
+   * counts: the denominator of every engagement rate, and the thing
+   * `stats.sent` is not, since one person takes several steps.
+   */ let firstEmail = false;
+    const completed = await firestore.runTransaction(async (transaction)=>{
+        var _stored_stepRecords, _stored_stepRecords1, _plan_patch;
         const [current, box] = await Promise.all([
             transaction.get(enrollmentRef),
             input.sent ? transaction.get(boxRef) : Promise.resolve(null)
@@ -413,6 +421,7 @@ async function openClient(deps, firestore, run) {
         // The step RAN, whatever happened to the enrollment while it did — a
         // member paused it, a reply stopped it — so it is recorded as run, and a
         // resume never sends it twice.
+        firstEmail = input.sent !== null && !((_stored_stepRecords = stored.stepRecords) != null ? _stored_stepRecords : []).some((record)=>record.kind === 'email');
         const plan = planOutreachStepCompletion({
             enrollment: _extends({}, stored, {
                 status: 'active'
@@ -426,7 +435,7 @@ async function openClient(deps, firestore, run) {
         const patch = _extends({
             sendClaim: null,
             stepRecords: [
-                ...(_stored_stepRecords = stored.stepRecords) != null ? _stored_stepRecords : [],
+                ...(_stored_stepRecords1 = stored.stepRecords) != null ? _stored_stepRecords1 : [],
                 input.record
             ].slice(-20),
             updatedAtMs: nowMs
@@ -465,6 +474,42 @@ async function openClient(deps, firestore, run) {
         }
         return true;
     });
+    if (completed && input.sent) {
+        var _ref;
+        var _input_record_links;
+        await bumpOutreachSequenceStats(firestore, {
+            orgId: run.orgId,
+            sequenceId: input.sequence.id,
+            firstEmail,
+            trackedLinks: (_ref = (_input_record_links = input.record.links) == null ? void 0 : _input_record_links.length) != null ? _ref : 0
+        });
+    }
+    return completed;
+}
+/**
+ * The sequence's send counters (AGL-3239), written outside the enrollment's
+ * transaction.
+ *
+ * One sequence holds every enrollment, so a transaction over it would
+ * serialise every recipient against every other; `FieldValue.increment` is a
+ * blind write with nothing to contend on. It is bookkeeping beside the act,
+ * so a failure is logged and the send stands — the email has already left.
+ *
+ * `clickTracked` is stamped by the first send that actually carried a
+ * rewritten link, never by the SETTING: a sequence with the setting on whose
+ * emails have no links in them measured nothing, and the report must say
+ * "not measured" for it rather than publish a 0% click rate.
+ */ async function bumpOutreachSequenceStats(firestore, input) {
+    if (!input.sequenceId) return;
+    await outreachOrgCollection(firestore, input.orgId, 'sequences').doc(input.sequenceId).update(_extends({
+        'stats.sent': FieldValue.increment(1)
+    }, input.firstEmail ? {
+        'stats.people': FieldValue.increment(1)
+    } : {}, input.trackedLinks > 0 ? {
+        'stats.clickTracked': true
+    } : {})).catch((error)=>{
+        console.warn('[outreach] a send could not be counted on its sequence', error);
+    });
 }
 /** One task step: the rep's task on the contact, then the step recorded. */ async function runTaskStep(deps, firestore, run, candidate) {
     const enrollment = candidate.enrollment;
@@ -591,10 +636,23 @@ async function runEmailStep(deps, firestore, run, input) {
     }
     const step = sequence.steps[enrollment.stepIndex];
     const sender = senderOf(mailbox);
+    /*
+   * Click tracking is the sequence's own setting (AGL-3239) and is read
+   * here, per send, rather than once per run: a member turning it off
+   * applies to the next email, not to the next hour. A link the minter
+   * cannot sign is left exactly as the step wrote it.
+   */ const rewriteLink = sequence.settings.trackClicks ? (link)=>deps.clickUrl({
+            orgId: run.orgId,
+            enrollmentId: enrollment.id,
+            stepIndex: enrollment.stepIndex,
+            linkIndex: link.index,
+            url: link.url
+        }) : null;
     const composed = composeOutreachEmail({
         sequence,
         enrollment,
         orgSettings: run.settings,
+        rewriteLink,
         merge: {
             // For a lead, the contact-shaped view of it (`leadAsContact`), so a
             // step written with `{{contact.*}}` reads the lead; `{{lead.*}}` reads
@@ -700,7 +758,7 @@ async function runEmailStep(deps, firestore, run, input) {
         console.error(`[outreach] a send from a mailbox failed (${code}); its sends wait for the next run`);
         return;
     }
-    const record = {
+    const record = _extends({
         stepIndex: enrollment.stepIndex,
         stepId: (_ref = step == null ? void 0 : step.id) != null ? _ref : '',
         kind: 'email',
@@ -709,7 +767,9 @@ async function runEmailStep(deps, firestore, run, input) {
         gmailThreadId: sent.threadId,
         messageId: sent.messageId,
         subject: sent.subject
-    };
+    }, composed.email.trackedLinks.length ? {
+        links: composed.email.trackedLinks
+    } : {});
     await completeStep(deps, firestore, run, {
         enrollment,
         sequence,