@aglyn/plugins-outreach 1.0.0-beta.178 → 1.0.0-beta.180

package/README.md

@@ -96,9 +96,10 @@ console alone — each run opens a rep's sealed grant:
 
 | module | does |
 | -- | -- |
-| `runtime/send-job` | `outreach-send`: due enrollments claimed in a transaction that reserves the mailbox's day, gates asked again, the email composed with its unsubscribe link and sent, the step recorded and filed on the contact's timeline; task steps file the rep's task |
+| `runtime/send-job` | `outreach-send`: due enrollments claimed in a transaction that reserves the mailbox's day, gates asked again, the email composed — with the `List-Unsubscribe` header when the sequence turns it on (AGL-3296), and its links' `outreachLinks` documents written first when it tracks clicks (AGL-3297) — and sent, the step recorded and filed on the contact's timeline; task steps file the rep's task |
 | `runtime/sync-job` | `outreach-sync`: replies, out-of-office answers, opt-outs and bounces read with `format=full` and classified by the engine; the mailbox's health evidence and its automatic pause |
 | `runtime/unsubscribe-link`, `runtime/unsubscribe-route` | the signed one-click link (`GET` and RFC 8058 `POST /api/outreach/unsubscribe`), a recipient link that outlives a paused rollout, and the `+unsubscribe` mailto |
+| `runtime/click-link`, `runtime/click-route` | click tracking: the short link every send carries (`GET /api/outreach/l/<id>`, resolved through the top-level `outreachLinks` document, AGL-3297) and the signed `GET /api/outreach/click?t=…` link older emails carry; both recipient links, redirect first, then the click counted once per person with scanners kept apart |
 | `runtime/enrollment-events` | status changes as the engine's events, and an opt-out recorded on every list |
 | `runtime/mailbox-notices` | the owner told, once, when a mailbox pauses itself or needs reconnecting |
 | `runtime/timeline` | the contact's timeline, through the core's record-timeline seam |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/plugins-outreach",
-  "version": "1.0.0-beta.178",
+  "version": "1.0.0-beta.180",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,18 +25,18 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.178",
-    "@aglyn/shared-data-mdi": "1.0.0-beta.178",
-    "@aglyn/shared-ui-email-campaigns": "1.0.0-beta.178",
-    "@aglyn/shared-ui-jsx": "1.0.0-beta.178",
-    "@aglyn/shared-ui-next": "1.0.0-beta.178",
-    "@aglyn/shared-ui-snackstack": "1.0.0-beta.178",
-    "@aglyn/shared-util-http": "1.0.0-beta.178",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.178",
-    "@aglyn/shared-util-tools": "1.0.0-beta.178",
-    "@aglyn/tenant-data-admin": "1.0.0-beta.178",
-    "@aglyn/tenant-feature-instance": "1.0.0-beta.178",
-    "@aglyn/tenant-runtime": "1.0.0-beta.178",
+    "@aglyn/aglyn": "1.0.0-beta.180",
+    "@aglyn/shared-data-mdi": "1.0.0-beta.180",
+    "@aglyn/shared-ui-email-campaigns": "1.0.0-beta.180",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.180",
+    "@aglyn/shared-ui-next": "1.0.0-beta.180",
+    "@aglyn/shared-ui-snackstack": "1.0.0-beta.180",
+    "@aglyn/shared-util-http": "1.0.0-beta.180",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.180",
+    "@aglyn/shared-util-tools": "1.0.0-beta.180",
+    "@aglyn/tenant-data-admin": "1.0.0-beta.180",
+    "@aglyn/tenant-feature-instance": "1.0.0-beta.180",
+    "@aglyn/tenant-runtime": "1.0.0-beta.180",
     "@swc/helpers": "0.5.23"
   },
   "peerDependencies": {

package/src/lib/constants/api-routes.d.ts

@@ -79,4 +79,12 @@ export declare const OUTREACH_API_ROUTES: {
      * not stop working when a rollout is paused.
      */
     readonly click: "outreach/click";
+    /**
+     * `GET` — the short tracking link (AGL-3297): `outreach/l/<id>`, where the
+     * id names a stored `outreachLinks` document holding the destination. It
+     * replaced the signed `click` link for every send since; `click` keeps
+     * answering the links already in inboxes. A recipient link, for `click`'s
+     * reasons.
+     */
+    readonly shortLink: "outreach/l/:linkId";
 };

package/src/lib/constants/api-routes.js

@@ -63,7 +63,14 @@
    * one: no session, and it answers whether or not Outreach is released to
    * the organization now, because a link in an email that already left must
    * not stop working when a rollout is paused.
-   */ click: 'outreach/click'
+   */ click: 'outreach/click',
+    /**
+   * `GET` — the short tracking link (AGL-3297): `outreach/l/<id>`, where the
+   * id names a stored `outreachLinks` document holding the destination. It
+   * replaced the signed `click` link for every send since; `click` keeps
+   * answering the links already in inboxes. A recipient link, for `click`'s
+   * reasons.
+   */ shortLink: 'outreach/l/:linkId'
 };
 
 //# sourceMappingURL=api-routes.js.map

package/src/lib/constants/api-routes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/constants/api-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Outreach's console API routes, as the dispatcher keys them (AGL-2974).\n *\n * One table both halves import, because the server registers the path and the\n * client fetches it, and a route spelled twice is a route that 404s the day\n * one spelling changes. Every path sits under the `outreach` prefix that\n * `plugins.config.json` gives this plugin, which is what lets the console's\n * `/api/[...pluginApi]` dispatcher gate a request on the plugin being enabled\n * and released before the handler runs. Client-safe: constants only.\n */\nexport const OUTREACH_API_ROUTES = {\n  /** `GET` — proves the server bundle loaded and registered; see `server.ts`. */\n  ping: 'outreach/ping',\n  // Mailboxes (AGL-2978). Every one names its org (`orgId`, query or body)\n  // so the dispatcher's release gate asks about that organization.\n  /** `GET ?orgId` — whether this deployment can connect a Google mailbox. */\n  mailboxesAvailability: 'outreach/mailboxes/availability',\n  /** `POST` — Google's consent address for a new connect. */\n  mailboxesConnect: 'outreach/mailboxes/connect',\n  /**\n   * `GET` — Google's redirect back. It carries no bearer token: the signed\n   * state names the org and the member, and the route hands the code to the\n   * Mailboxes page in a fragment rather than acting on it.\n   */\n  mailboxesOAuthCallback: 'outreach/mailboxes/oauth/callback',\n  /** `POST` — finishes a connect with the member's own session. */\n  mailboxesConnectComplete: 'outreach/mailboxes/connect/complete',\n  /** `POST` — send-as, display name, daily cap, sending window, timezone. */\n  mailboxesSettings: 'outreach/mailboxes/settings',\n  /** `POST` — pause or resume. */\n  mailboxesStatus: 'outreach/mailboxes/status',\n  /** `POST` — a plain-text test to the account's own address. */\n  mailboxesTest: 'outreach/mailboxes/test',\n  /** `POST` — revoke the grant at Google and delete the mailbox. */\n  mailboxesDisconnect: 'outreach/mailboxes/disconnect',\n  // Settings, sequences and enrollments (AGL-2980). Every one names its org\n  // (`orgId`, query or body); the contract is `model/outreach-api.ts`.\n  /** `GET ?orgId` — the compliance settings; `POST` — save them. */\n  settings: 'outreach/settings',\n  /** `POST` — create a sequence, or save an edit to one. */\n  sequencesSave: 'outreach/sequences/save',\n  /** `POST` — activate, pause or archive a sequence. */\n  sequencesStatus: 'outreach/sequences/status',\n  /** `POST` — delete a draft nobody was enrolled in. */\n  sequencesDelete: 'outreach/sequences/delete',\n  /** `POST` — who a saved view or a search would enroll, and where each stands. */\n  enrollPreview: 'outreach/enroll/preview',\n  /** `POST` — enroll them, every gate checked again. */\n  enroll: 'outreach/enroll',\n  /** `POST` — pause, resume, stop, or mark do-not-contact. */\n  enrollmentsAction: 'outreach/enrollments/action',\n  /**\n   * `GET ?orgId` — the domains on the organization's do-not-contact list\n   * (AGL-3244); `POST` — add one, or take one off.\n   */\n  doNotContactDomains: 'outreach/do-not-contact/domains',\n  /** `POST` — one email of a saved sequence, for a contact or a sample person. */\n  preview: 'outreach/preview',\n  // The one route a RECIPIENT reaches (AGL-2981): no session, a signed\n  // token instead, and registered as a recipient link so it answers whether\n  // or not Outreach is released for the organization now.\n  /** `GET` and the RFC 8058 one-click `POST` — `?t=<signed token>`. */\n  unsubscribe: 'outreach/unsubscribe',\n  /**\n   * `GET` — a link in a tracked sequence email (AGL-3239). `?t=<signed\n   * token>`; answers a redirect to the destination the token names, and\n   * records the click afterwards. A recipient link like the unsubscribe\n   * one: no session, and it answers whether or not Outreach is released to\n   * the organization now, because a link in an email that already left must\n   * not stop working when a rollout is paused.\n   */\n  click: 'outreach/click',\n} as const\n"],"names":["OUTREACH_API_ROUTES","ping","mailboxesAvailability","mailboxesConnect","mailboxesOAuthCallback","mailboxesConnectComplete","mailboxesSettings","mailboxesStatus","mailboxesTest","mailboxesDisconnect","settings","sequencesSave","sequencesStatus","sequencesDelete","enrollPreview","enroll","enrollmentsAction","doNotContactDomains","preview","unsubscribe","click"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAsB;IACjC,6EAA6E,GAC7EC,MAAM;IACN,yEAAyE;IACzE,iEAAiE;IACjE,yEAAyE,GACzEC,uBAAuB;IACvB,yDAAyD,GACzDC,kBAAkB;IAClB;;;;GAIC,GACDC,wBAAwB;IACxB,+DAA+D,GAC/DC,0BAA0B;IAC1B,yEAAyE,GACzEC,mBAAmB;IACnB,8BAA8B,GAC9BC,iBAAiB;IACjB,6DAA6D,GAC7DC,eAAe;IACf,gEAAgE,GAChEC,qBAAqB;IACrB,0EAA0E;IAC1E,qEAAqE;IACrE,gEAAgE,GAChEC,UAAU;IACV,wDAAwD,GACxDC,eAAe;IACf,oDAAoD,GACpDC,iBAAiB;IACjB,oDAAoD,GACpDC,iBAAiB;IACjB,+EAA+E,GAC/EC,eAAe;IACf,oDAAoD,GACpDC,QAAQ;IACR,0DAA0D,GAC1DC,mBAAmB;IACnB;;;GAGC,GACDC,qBAAqB;IACrB,8EAA8E,GAC9EC,SAAS;IACT,qEAAqE;IACrE,0EAA0E;IAC1E,wDAAwD;IACxD,mEAAmE,GACnEC,aAAa;IACb;;;;;;;GAOC,GACDC,OAAO;AACT,EAAU"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/constants/api-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Outreach's console API routes, as the dispatcher keys them (AGL-2974).\n *\n * One table both halves import, because the server registers the path and the\n * client fetches it, and a route spelled twice is a route that 404s the day\n * one spelling changes. Every path sits under the `outreach` prefix that\n * `plugins.config.json` gives this plugin, which is what lets the console's\n * `/api/[...pluginApi]` dispatcher gate a request on the plugin being enabled\n * and released before the handler runs. Client-safe: constants only.\n */\nexport const OUTREACH_API_ROUTES = {\n  /** `GET` — proves the server bundle loaded and registered; see `server.ts`. */\n  ping: 'outreach/ping',\n  // Mailboxes (AGL-2978). Every one names its org (`orgId`, query or body)\n  // so the dispatcher's release gate asks about that organization.\n  /** `GET ?orgId` — whether this deployment can connect a Google mailbox. */\n  mailboxesAvailability: 'outreach/mailboxes/availability',\n  /** `POST` — Google's consent address for a new connect. */\n  mailboxesConnect: 'outreach/mailboxes/connect',\n  /**\n   * `GET` — Google's redirect back. It carries no bearer token: the signed\n   * state names the org and the member, and the route hands the code to the\n   * Mailboxes page in a fragment rather than acting on it.\n   */\n  mailboxesOAuthCallback: 'outreach/mailboxes/oauth/callback',\n  /** `POST` — finishes a connect with the member's own session. */\n  mailboxesConnectComplete: 'outreach/mailboxes/connect/complete',\n  /** `POST` — send-as, display name, daily cap, sending window, timezone. */\n  mailboxesSettings: 'outreach/mailboxes/settings',\n  /** `POST` — pause or resume. */\n  mailboxesStatus: 'outreach/mailboxes/status',\n  /** `POST` — a plain-text test to the account's own address. */\n  mailboxesTest: 'outreach/mailboxes/test',\n  /** `POST` — revoke the grant at Google and delete the mailbox. */\n  mailboxesDisconnect: 'outreach/mailboxes/disconnect',\n  // Settings, sequences and enrollments (AGL-2980). Every one names its org\n  // (`orgId`, query or body); the contract is `model/outreach-api.ts`.\n  /** `GET ?orgId` — the compliance settings; `POST` — save them. */\n  settings: 'outreach/settings',\n  /** `POST` — create a sequence, or save an edit to one. */\n  sequencesSave: 'outreach/sequences/save',\n  /** `POST` — activate, pause or archive a sequence. */\n  sequencesStatus: 'outreach/sequences/status',\n  /** `POST` — delete a draft nobody was enrolled in. */\n  sequencesDelete: 'outreach/sequences/delete',\n  /** `POST` — who a saved view or a search would enroll, and where each stands. */\n  enrollPreview: 'outreach/enroll/preview',\n  /** `POST` — enroll them, every gate checked again. */\n  enroll: 'outreach/enroll',\n  /** `POST` — pause, resume, stop, or mark do-not-contact. */\n  enrollmentsAction: 'outreach/enrollments/action',\n  /**\n   * `GET ?orgId` — the domains on the organization's do-not-contact list\n   * (AGL-3244); `POST` — add one, or take one off.\n   */\n  doNotContactDomains: 'outreach/do-not-contact/domains',\n  /** `POST` — one email of a saved sequence, for a contact or a sample person. */\n  preview: 'outreach/preview',\n  // The one route a RECIPIENT reaches (AGL-2981): no session, a signed\n  // token instead, and registered as a recipient link so it answers whether\n  // or not Outreach is released for the organization now.\n  /** `GET` and the RFC 8058 one-click `POST` — `?t=<signed token>`. */\n  unsubscribe: 'outreach/unsubscribe',\n  /**\n   * `GET` — a link in a tracked sequence email (AGL-3239). `?t=<signed\n   * token>`; answers a redirect to the destination the token names, and\n   * records the click afterwards. A recipient link like the unsubscribe\n   * one: no session, and it answers whether or not Outreach is released to\n   * the organization now, because a link in an email that already left must\n   * not stop working when a rollout is paused.\n   */\n  click: 'outreach/click',\n  /**\n   * `GET` — the short tracking link (AGL-3297): `outreach/l/<id>`, where the\n   * id names a stored `outreachLinks` document holding the destination. It\n   * replaced the signed `click` link for every send since; `click` keeps\n   * answering the links already in inboxes. A recipient link, for `click`'s\n   * reasons.\n   */\n  shortLink: 'outreach/l/:linkId',\n} as const\n"],"names":["OUTREACH_API_ROUTES","ping","mailboxesAvailability","mailboxesConnect","mailboxesOAuthCallback","mailboxesConnectComplete","mailboxesSettings","mailboxesStatus","mailboxesTest","mailboxesDisconnect","settings","sequencesSave","sequencesStatus","sequencesDelete","enrollPreview","enroll","enrollmentsAction","doNotContactDomains","preview","unsubscribe","click","shortLink"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAsB;IACjC,6EAA6E,GAC7EC,MAAM;IACN,yEAAyE;IACzE,iEAAiE;IACjE,yEAAyE,GACzEC,uBAAuB;IACvB,yDAAyD,GACzDC,kBAAkB;IAClB;;;;GAIC,GACDC,wBAAwB;IACxB,+DAA+D,GAC/DC,0BAA0B;IAC1B,yEAAyE,GACzEC,mBAAmB;IACnB,8BAA8B,GAC9BC,iBAAiB;IACjB,6DAA6D,GAC7DC,eAAe;IACf,gEAAgE,GAChEC,qBAAqB;IACrB,0EAA0E;IAC1E,qEAAqE;IACrE,gEAAgE,GAChEC,UAAU;IACV,wDAAwD,GACxDC,eAAe;IACf,oDAAoD,GACpDC,iBAAiB;IACjB,oDAAoD,GACpDC,iBAAiB;IACjB,+EAA+E,GAC/EC,eAAe;IACf,oDAAoD,GACpDC,QAAQ;IACR,0DAA0D,GAC1DC,mBAAmB;IACnB;;;GAGC,GACDC,qBAAqB;IACrB,8EAA8E,GAC9EC,SAAS;IACT,qEAAqE;IACrE,0EAA0E;IAC1E,wDAAwD;IACxD,mEAAmE,GACnEC,aAAa;IACb;;;;;;;GAOC,GACDC,OAAO;IACP;;;;;;GAMC,GACDC,WAAW;AACb,EAAU"}

package/src/lib/model/outreach.types.d.ts

@@ -37,11 +37,12 @@
 /**
  * Where Outreach keeps its records.
  *
- * Five collections under the organization, and one at the top level. The
+ * Six collections under the organization, and two at the top level. The
  * org-scoped ones are erased with the org, whose erasure deletes the whole
- * `orgs/{orgId}` tree. The top-level one holds credentials, so it is keyed by
- * an `orgId` FIELD that a path-scoped delete of `orgs/{orgId}` cannot see:
- * the org erasure sweeps it by that field
+ * `orgs/{orgId}` tree. The top-level ones — credentials, and the short
+ * tracking links (AGL-3297) — are keyed by an `orgId` FIELD that a
+ * path-scoped delete of `orgs/{orgId}` cannot see: the org erasure sweeps
+ * them by that field
  * (`libs/tenant/data/admin/src/lib/server/erase.ts` names it as a literal,
  * which the boundary forces, and `outreach.types.spec.ts` holds the two
  * spellings together, along with the rules').
@@ -76,9 +77,17 @@ export declare const OUTREACH_COLLECTIONS: {
      * token material never shares a readable path with the mailbox it serves.
      */
     readonly mailboxCredentials: "outreachMailboxCredentials";
+    /**
+     * `outreachLinks/{linkId}` — what one short tracking link in a sent email
+     * points at (AGL-3297): the organization, the enrollment, the step, the
+     * link's index and the destination. TOP-LEVEL so the link's id alone
+     * resolves it with one read, keyed by an `orgId` FIELD that the org
+     * erasure sweeps, and closed to every client.
+     */
+    readonly links: "outreachLinks";
 };
 /** The org-scoped collections, by their {@link OUTREACH_COLLECTIONS} key. */
-export type OutreachOrgCollection = Exclude<keyof typeof OUTREACH_COLLECTIONS, 'mailboxCredentials'>;
+export type OutreachOrgCollection = Exclude<keyof typeof OUTREACH_COLLECTIONS, 'mailboxCredentials' | 'links'>;
 /** `orgs/{orgId}/<collection>` for one of the org-scoped collections. */
 export declare function outreachOrgCollectionPath(orgId: string, collection: OutreachOrgCollection): string;
 /** Stamped by the server on every write. */

package/src/lib/model/outreach.types.js

@@ -35,11 +35,12 @@
  */ /**
  * Where Outreach keeps its records.
  *
- * Five collections under the organization, and one at the top level. The
+ * Six collections under the organization, and two at the top level. The
  * org-scoped ones are erased with the org, whose erasure deletes the whole
- * `orgs/{orgId}` tree. The top-level one holds credentials, so it is keyed by
- * an `orgId` FIELD that a path-scoped delete of `orgs/{orgId}` cannot see:
- * the org erasure sweeps it by that field
+ * `orgs/{orgId}` tree. The top-level ones — credentials, and the short
+ * tracking links (AGL-3297) — are keyed by an `orgId` FIELD that a
+ * path-scoped delete of `orgs/{orgId}` cannot see: the org erasure sweeps
+ * them by that field
  * (`libs/tenant/data/admin/src/lib/server/erase.ts` names it as a literal,
  * which the boundary forces, and `outreach.types.spec.ts` holds the two
  * spellings together, along with the rules').
@@ -65,7 +66,14 @@
    * `outreachMailboxCredentials/{mailboxId}` — the provider grant behind a
    * mailbox. TOP-LEVEL and closed to every client, staff included, so the
    * token material never shares a readable path with the mailbox it serves.
-   */ mailboxCredentials: 'outreachMailboxCredentials'
+   */ mailboxCredentials: 'outreachMailboxCredentials',
+    /**
+   * `outreachLinks/{linkId}` — what one short tracking link in a sent email
+   * points at (AGL-3297): the organization, the enrollment, the step, the
+   * link's index and the destination. TOP-LEVEL so the link's id alone
+   * resolves it with one read, keyed by an `orgId` FIELD that the org
+   * erasure sweeps, and closed to every client.
+   */ links: 'outreachLinks'
 };
 /** `orgs/{orgId}/<collection>` for one of the org-scoped collections. */ export function outreachOrgCollectionPath(orgId, collection) {
     return `orgs/${orgId}/${OUTREACH_COLLECTIONS[collection]}`;

package/src/lib/model/outreach.types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/model/outreach.types.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE OUTREACH DOCUMENT MODEL (AGL-2974).\n *\n * One file both halves import — the console reads these documents, the server\n * routes write them — so a field is spelled once. Client-safe: types and\n * constants only, nothing that reaches Firestore.\n *\n * EVERY DOCUMENT HERE IS SERVER-WRITTEN. The Firestore rules let an\n * org-wide member holding `outreach.use` READ the org collections on a\n * workspace that carries `features.outreach`, and refuse every client write,\n * because these documents are the sending engine's state: a client that\n * could write a mailbox could lift its daily cap, and one that could write\n * an enrollment could send a step twice. The credential collection is closed\n * to clients entirely.\n *\n * Lean on purpose. Each type carries what the mailbox and sequence work is\n * known to need and nothing speculative; a field is added where the code\n * that reads it lands. Times are epoch milliseconds throughout, the unit\n * `nextDueAtMs` has to be compared in.\n */\n\n/**\n * Where Outreach keeps its records.\n *\n * Five collections under the organization, and one at the top level. The\n * org-scoped ones are erased with the org, whose erasure deletes the whole\n * `orgs/{orgId}` tree. The top-level one holds credentials, so it is keyed by\n * an `orgId` FIELD that a path-scoped delete of `orgs/{orgId}` cannot see:\n * the org erasure sweeps it by that field\n * (`libs/tenant/data/admin/src/lib/server/erase.ts` names it as a literal,\n * which the boundary forces, and `outreach.types.spec.ts` holds the two\n * spellings together, along with the rules').\n */\nexport const OUTREACH_COLLECTIONS = {\n  /** `orgs/{orgId}/outreachMailboxes/{mailboxId}` — a connected mailbox. */\n  mailboxes: 'outreachMailboxes',\n  /** `orgs/{orgId}/outreachSequences/{sequenceId}` — the steps to send. */\n  sequences: 'outreachSequences',\n  /** `orgs/{orgId}/outreachEnrollments/{enrollmentId}` — one person in one sequence. */\n  enrollments: 'outreachEnrollments',\n  /**\n   * `orgs/{orgId}/outreachSettings/{settingsId}` — the organization's own\n   * Outreach settings, one document per concern. `compliance` holds who\n   * every email says sent it and the countries Outreach may send to.\n   */\n  settings: 'outreachSettings',\n  /**\n   * `orgs/{orgId}/outreachDoNotContact/{key}` — the addresses Outreach never\n   * emails for this organization, keyed by `outreachDoNotContactKey`.\n   */\n  doNotContact: 'outreachDoNotContact',\n  /**\n   * `orgs/{orgId}/outreachDoNotContactDomains/{domain}` — the domains\n   * Outreach never emails for this organization (AGL-3244), keyed by the\n   * domain itself: a domain names a company, not a person.\n   */\n  doNotContactDomains: 'outreachDoNotContactDomains',\n  /**\n   * `outreachMailboxCredentials/{mailboxId}` — the provider grant behind a\n   * mailbox. TOP-LEVEL and closed to every client, staff included, so the\n   * token material never shares a readable path with the mailbox it serves.\n   */\n  mailboxCredentials: 'outreachMailboxCredentials',\n} as const\n\n/** The org-scoped collections, by their {@link OUTREACH_COLLECTIONS} key. */\nexport type OutreachOrgCollection = Exclude<\n  keyof typeof OUTREACH_COLLECTIONS,\n  'mailboxCredentials'\n>\n\n/** `orgs/{orgId}/<collection>` for one of the org-scoped collections. */\nexport function outreachOrgCollectionPath(\n  orgId: string,\n  collection: OutreachOrgCollection,\n): string {\n  return `orgs/${orgId}/${OUTREACH_COLLECTIONS[collection]}`\n}\n\n/** Stamped by the server on every write. */\nexport interface OutreachTimestamps {\n  createdAtMs: number\n  updatedAtMs: number\n}\n\n/** The mail providers a mailbox can be connected through. */\nexport const OUTREACH_MAILBOX_PROVIDERS = ['google'] as const\nexport type OutreachMailboxProvider =\n  (typeof OUTREACH_MAILBOX_PROVIDERS)[number]\n\n/**\n * Where a mailbox stands.\n *\n * - `connected` — the grant works and the mailbox may send.\n * - `paused` — a member stopped it; enrollments on it wait.\n * - `reconnect_required` — the provider refused the grant (revoked, expired,\n *   password changed); nothing sends until the rep connects it again.\n * - `disconnected` — a member removed it; its credential is gone.\n */\nexport const OUTREACH_MAILBOX_STATUSES = [\n  'connected',\n  'paused',\n  'reconnect_required',\n  'disconnected',\n] as const\nexport type OutreachMailboxStatus = (typeof OUTREACH_MAILBOX_STATUSES)[number]\n\n/**\n * The hours a mailbox sends in, in its own {@link OutreachMailbox.timezone}.\n * A step that comes due outside the window waits for the next opening.\n */\nexport interface OutreachSendWindow {\n  /** Days of the week it sends on, `0` Sunday through `6` Saturday. */\n  days: number[]\n  /** Minutes after local midnight the window opens, inclusive. */\n  startMinute: number\n  /** Minutes after local midnight the window closes, exclusive. */\n  endMinute: number\n}\n\n/**\n * One mailbox-local day's sending, as the health panel sums it (AGL-2978).\n */\nexport interface OutreachMailboxDailyHealth {\n  sent: number\n  bounces: number\n  replies: number\n}\n\n/**\n * The counters a mailbox's sending is judged by.\n *\n * `sentToday` is what `dailyCap` refuses against, and it belongs to one\n * mailbox-local day — `sentOnDay` — so a counter from yesterday is read as\n * zero rather than as today's spend.\n */\nexport interface OutreachMailboxHealth {\n  sentToday: number\n  /** The local day (`YYYY-MM-DD` in the mailbox's timezone) `sentToday` counts. */\n  sentOnDay: string | null\n  /** Hard bounces on mail this mailbox sent. */\n  bounces: number\n  /** Replies detected on Outreach threads. */\n  replies: number\n  lastSentAtMs: number | null\n  /** The last provider error, kept until a later send succeeds. */\n  lastErrorAtMs: number | null\n  lastErrorCode: string | null\n  /**\n   * Per mailbox-local day (`YYYY-MM-DD`), the sends, bounces and replies\n   * counted on it (AGL-2978). The Mailboxes panel shows the last seven days\n   * summed; the sending runtime increments the day it counts on and may drop\n   * days older than a week. Absent, or empty, until the first send.\n   */\n  daily?: Record<string, OutreachMailboxDailyHealth>\n  /**\n   * The mailbox's most recent sends, newest last, at most\n   * `OUTREACH_BOUNCE_RATE_WINDOW_SENDS` of them, each marked when a hard\n   * bounce came back for it (AGL-2981): the window the bounce-rate pause is\n   * judged over. A send is named by a digest of its `Message-ID`, never by\n   * its recipient.\n   */\n  recentSends?: OutreachRecentSend[]\n  /** When a reply last called this mailbox's email spam (AGL-2981). */\n  lastComplaintAtMs?: number | null\n}\n\n/** One send in {@link OutreachMailboxHealth.recentSends}. */\nexport interface OutreachRecentSend {\n  /** A digest of the send's `Message-ID`: what a bounce is matched to. */\n  id: string\n  atMs: number\n  bounced: boolean\n}\n\n/** Why a mailbox paused itself (AGL-2981): the engine's health decision, kept. */\nexport interface OutreachMailboxAutoPause {\n  reason: 'bounces_today' | 'bounce_rate' | 'complaint'\n  /** The sentence the mailbox's card shows. */\n  message: string\n  atMs: number\n  /** For a complaint, when resuming stops being premature; `null` otherwise. */\n  untilMs: number | null\n}\n\n/** Where a mailbox's reply and bounce sync has read to (AGL-2981). */\nexport interface OutreachMailboxSync {\n  /** Everything received before this was read by an earlier run, epoch ms. */\n  throughMs: number\n  /** Gmail ids of messages outside any enrollment's thread already handled. */\n  handledMessageIds: string[]\n}\n\n/**\n * An address a connected Google account may send as, which Gmail has\n * verified — its own address, or an alias whose ownership Gmail confirmed\n * (AGL-2978). Only these are offered as a mailbox's `sendAs`.\n */\nexport interface OutreachSendAsAddress {\n  email: string\n  /** The name Gmail holds for the address, `''` when it holds none. */\n  displayName: string\n  /** The account's own address. */\n  isPrimary: boolean\n  /** The address Gmail sends as by default. */\n  isDefault: boolean\n}\n\n/**\n * A rep's own mailbox, connected to send Outreach mail\n * (`orgs/{orgId}/outreachMailboxes/{id}`).\n *\n * Its grant lives in {@link OutreachMailboxCredentials} under the same id.\n */\nexport interface OutreachMailbox extends OutreachTimestamps {\n  id: string\n  provider: OutreachMailboxProvider\n  /** The account's own address. */\n  email: string\n  /** The address mail goes out as: the account's, or an alias it may send as. */\n  sendAs: string\n  /**\n   * The verified addresses `sendAs` may be, as Gmail listed them at the last\n   * connect (AGL-2978). A changed alias shows up here on the next reconnect.\n   */\n  sendAsOptions: OutreachSendAsAddress[]\n  /** The From name recipients see. */\n  displayName: string\n  status: OutreachMailboxStatus\n  /** The most mail it sends in one local day, ramp included. */\n  dailyCap: number\n  window: OutreachSendWindow\n  /** IANA zone the window and the day boundary are read in. */\n  timezone: string\n  /**\n   * When the warm-up ramp began, or `null` for a mailbox sending at its full\n   * cap. The ramp is measured from here, not from connection, so a paused\n   * mailbox can restart it.\n   */\n  rampStartedAtMs: number | null\n  health: OutreachMailboxHealth\n  /** The member who connected it, and whose mail it is. */\n  connectedByUid: string\n  /** When the grant behind it was last connected (AGL-2978). */\n  connectedAtMs: number\n  /**\n   * Set when the mailbox paused ITSELF on its health (AGL-2981), and cleared\n   * when a member pauses or resumes it; absent otherwise.\n   */\n  autoPause?: OutreachMailboxAutoPause | null\n  /** The reply and bounce sync's place in the mailbox (AGL-2981). */\n  sync?: OutreachMailboxSync | null\n}\n\n/**\n * The provider grant behind one mailbox\n * (`outreachMailboxCredentials/{mailboxId}`).\n *\n * Only the fields every reader relies on are declared here; the token\n * material is added by the code that stores it. `orgId` is REQUIRED, not\n * decorative: the org erasure finds these documents by it, and a credential\n * written without one would outlive its workspace.\n *\n * NAME EVERY SEALED FIELD WITH A SECRET WORD — `refreshToken`,\n * `tokenCiphertext`. The personal-data export discloses these documents with\n * secrets redacted, and its redaction reads field names first: a name\n * carrying `token`, `secret` or `credential` is withheld whatever its value,\n * while a neutral name such as `ciphertext` is judged by the value's shape\n * alone and can be disclosed.\n */\nexport interface OutreachMailboxCredentials extends OutreachTimestamps {\n  /** The mailbox id, which is also this document's id. */\n  id: string\n  orgId: string\n  mailboxId: string\n  provider: OutreachMailboxProvider\n}\n\n/** A sequence's lifecycle. Only an `active` sequence advances its enrollments. */\nexport const OUTREACH_SEQUENCE_STATUSES = [\n  'draft',\n  'active',\n  'paused',\n  'archived',\n] as const\nexport type OutreachSequenceStatus =\n  (typeof OUTREACH_SEQUENCE_STATUSES)[number]\n\n/*==========================================\n * SEQUENCES (AGL-2979).\n *\n * The limits are the outbound playbook's: a person gets at most four emails\n * from one sequence, spaced by business days, and the tasks between them are\n * the rep's own touches — a LinkedIn note, a call. The engine\n * (`../engine/sequence-validation.ts`) holds a stored sequence to them.\n *==========================================*/\n\n/** The most steps one sequence holds, emails and tasks together. */\nexport const OUTREACH_MAX_STEPS = 8\n\n/** The most of those steps that send an email. */\nexport const OUTREACH_MAX_EMAIL_STEPS = 4\n\n/** The longest wait one step may carry, in business days. */\nexport const OUTREACH_MAX_STEP_DELAY_BUSINESS_DAYS = 30\n\n/**\n * The shortest wait before an email that follows an earlier email. The first\n * email may wait `0` — \"the next opening of the window\", or the same day as\n * a task before it — and so may a task, but each later email waits at least\n * this long after the step before it.\n */\nexport const OUTREACH_MIN_EMAIL_FOLLOW_UP_BUSINESS_DAYS = 1\n\n/**\n * One email step.\n *\n * Steps are a union on `kind`, so a later kind joins without reshaping the\n * ones already stored.\n */\nexport interface OutreachEmailStep {\n  /** Stable within the sequence, so an edit that reorders steps is traceable. */\n  id: string\n  kind: 'email'\n  /**\n   * Business days to wait after the previous step, counted in the mailbox's\n   * zone — after enrollment for the first step, where `0` means the next\n   * opening of the sending window.\n   */\n  delayBusinessDays: number\n  /**\n   * The subject, merge fields allowed. Required on the first email and on\n   * any email that starts a new thread; an in-thread email is sent as `Re:`\n   * the thread's own subject, so its field is not read.\n   */\n  subject: string\n  /**\n   * Whether the email goes out as a reply in the thread the earlier emails\n   * started. True by default for every email after the first; the first\n   * email always starts the thread, whatever this says.\n   */\n  replyInThread: boolean\n  /** Plain text with merge fields, as its author wrote it; `''` when `templateId` is set. */\n  body: string\n  /**\n   * A CRM email template (`orgs/{orgId}/crmEmailTemplates/{id}`) whose body\n   * is sent instead of `body`, or `null`. Only the body is taken from it: the\n   * step's own subject is the one that is sent.\n   */\n  templateId: string | null\n}\n\n/** The rep's own touches a task step asks for. */\nexport const OUTREACH_TASK_KINDS = ['linkedin', 'call', 'todo'] as const\nexport type OutreachTaskKind = (typeof OUTREACH_TASK_KINDS)[number]\n\nexport const OUTREACH_TASK_KIND_LABELS: Record<OutreachTaskKind, string> = {\n  linkedin: 'LinkedIn',\n  call: 'Call',\n  todo: 'To-do',\n}\n\n/** One task step: a CRM task for the rep, created when the step comes due. */\nexport interface OutreachTaskStep {\n  id: string\n  kind: 'task'\n  taskKind: OutreachTaskKind\n  /** What the task says, e.g. \"Connect on LinkedIn\". */\n  title: string\n  /** Business days after the previous step; `0` is the same day. */\n  delayBusinessDays: number\n}\n\nexport type OutreachSequenceStep = OutreachEmailStep | OutreachTaskStep\n\n/** The countries a new sequence sends to: the United States alone. */\nexport const OUTREACH_DEFAULT_ALLOWED_COUNTRIES: readonly string[] = ['US']\n\n/** Behavior a sequence applies to every enrollment in it. */\nexport interface OutreachSequenceSettings {\n  /**\n   * The hours this sequence sends in, replacing its mailbox's own window;\n   * `null` sends in the mailbox's. Read in the mailbox's zone either way.\n   */\n  window: OutreachSendWindow | null\n  /**\n   * ISO-3166-1 alpha-2 codes a recipient may be in, uppercase. Default\n   * {@link OUTREACH_DEFAULT_ALLOWED_COUNTRIES}: Canada, the United Kingdom\n   * and most of the EU need a consent basis a cold email does not have.\n   */\n  allowedCountries: string[]\n  /** Whether a contact who is already a customer may be enrolled. Default `false`. */\n  allowCustomers: boolean\n  /**\n   * Whether the links in this sequence's emails are rewritten so clicks are\n   * counted (AGL-3239). Default `false`, and `false` on every sequence\n   * written before the setting existed: turning it on changes what the\n   * recipient sees in the body, which is not a change to make on anyone's\n   * behalf.\n   *\n   * It buys the one engagement number a plain-text sequence can honestly\n   * report. It costs a visible link: the destination in the body becomes a\n   * signed link on the console that forwards to it. There is no equivalent\n   * setting for opens, because a pixel needs an HTML part — see\n   * `../engine/click-tracking.ts`.\n   */\n  trackClicks: boolean\n  /**\n   * Whether this sequence's emails carry `List-Unsubscribe` and\n   * `List-Unsubscribe-Post` (RFC 8058) (AGL-3296). Default `false`, and\n   * `false` on every sequence written before the setting existed.\n   *\n   * On, mail clients draw their own unsubscribe button — Apple Mail as \"This\n   * message is from a mailing list\" — which is the easiest way out for the\n   * recipient and makes a one-to-one email read as bulk. Off, the footer's\n   * \"reply 'no'\" line is the way out; the footer and its postal address are\n   * mandatory either way, and the reply classifier stops on a \"no\". The\n   * Gmail/Yahoo one-click requirement binds bulk senders (5,000 a day), not a\n   * mailbox sending a sequence.\n   */\n  listUnsubscribe: boolean\n}\n\n/*==========================================\n * WHAT A SEQUENCE MEASURED (AGL-3239).\n *\n * Counters on the sequence document, incremented by the sending runtime and\n * by the click route. They are NOT derived from the enrollments on read: the\n * console lists enrollments a page at a time, so a rollup taken over what is\n * loaded would report the first page's numbers as the sequence's.\n *\n * Every field is optional and every absence means \"not recorded\", never\n * zero. The distinction is the whole of `campaign-report.ts`'s honesty and\n * it is kept here for the same reason: a sequence that ran before this\n * existed has no counters, and reporting its click rate as 0% would publish\n * a fact about our schema as a fact about its recipients.\n *=========================================*/\n\n/**\n * The per-destination click rollup under one sequence:\n * `orgs/{orgId}/outreachSequences/{id}/reports/links`.\n *\n * One document per sequence, holding a bounded map — the campaign rollup's\n * own shape and its own cap, so \"a link\" means the same thing in a rep's\n * report and a marketer's. Here rather than beside the writer, because the\n * console's listener is a browser module and the writer is not.\n */\nexport const OUTREACH_LINK_ROLLUP_PATH = ['reports', 'links'] as const\n\n/** The counters one sequence is judged by. */\nexport interface OutreachSequenceStats {\n  /** Email steps that left. One person getting four emails counts four. */\n  sent?: number\n  /**\n   * Distinct enrollments that have had at least one email — the denominator\n   * of every engagement rate, and the thing `sent` is not.\n   */\n  people?: number\n  /**\n   * At least one email of this sequence went out with its links rewritten.\n   *\n   * Absent is NOT false; it is \"never recorded\", which is what every\n   * sequence sent before the setting existed reads as. Either way the report\n   * withholds the click rate rather than showing 0% — see\n   * {@link OutreachSequenceStats} above.\n   */\n  clickTracked?: boolean\n  /** Click EVENTS judged a person's. One reader clicking twice counts two. */\n  clicks?: number\n  /** Enrollments whose FIRST human click was seen: the rate's numerator. */\n  uniqueClicks?: number\n  /**\n   * Clicks a link scanner or a security gateway made, counted apart and\n   * never in the rate (`../engine/click-tracking.ts`). Shown, not hidden:\n   * a large number here is the reader's evidence that the small number\n   * beside it is the real one.\n   */\n  machineClicks?: number\n  /** When a person last followed a link. */\n  lastClickAtMs?: number | null\n}\n\n/** What one enrollment did with the links it was sent (AGL-3239). */\nexport interface OutreachEnrollmentEngagement {\n  /** Click events judged this person's, machines excluded. */\n  clicks: number\n  /** The first, which is what makes them one of the sequence's `uniqueClicks`. */\n  firstClickAtMs: number | null\n  lastClickAtMs: number | null\n  /** The destination they followed last, as `campaignLinkKey` reduces it. */\n  lastClickUrl: string | null\n  /** Clicks on this person's links that were a machine's. */\n  machineClicks: number\n}\n\n/** An ordered set of steps sent from one mailbox (`orgs/{orgId}/outreachSequences/{id}`). */\nexport interface OutreachSequence extends OutreachTimestamps {\n  id: string\n  name: string\n  /** The site whose CRM the enrolled people are records of. */\n  hostId: string\n  /**\n   * The mailbox every email step is sent from. A setting of the sequence,\n   * kept beside `settings` rather than inside it because enrollments and a\n   * mailbox's own screens select sequences by it.\n   */\n  mailboxId: string\n  steps: OutreachSequenceStep[]\n  settings: OutreachSequenceSettings\n  status: OutreachSequenceStatus\n  /**\n   * The campaigns the sequence is in (AGL-3254): container ids from the\n   * org's `emailCampaigns`, under the field every campaign member carries\n   * (`CAMPAIGN_MEMBERSHIP_FIELD`). Everyone enrolled gains them on their\n   * own record at enroll time, and what the sequence produces is credited\n   * to them. Absent on a sequence saved before it could join one.\n   */\n  campaignIds?: string[]\n  /**\n   * What it measured (AGL-3239). Absent until the first email leaves, and\n   * absent forever on a sequence that finished before the counters existed.\n   */\n  stats?: OutreachSequenceStats\n}\n\n/*==========================================\n * ENROLLMENTS (AGL-2979).\n *==========================================*/\n\n/**\n * Where one person's run through a sequence stands.\n *\n * `active` sends and `paused` waits. The rest end the sending, and each says\n * why: `finished` sent every step, `replied` heard back, `bounced` reached a\n * mailbox that does not exist, `opted_out` was asked to stop, `stopped` was\n * ended by a member or a gate, `failed` could not be sent. The transitions\n * between them are the engine's (`../engine/enrollment-state.ts`).\n */\nexport const OUTREACH_ENROLLMENT_STATUSES = [\n  'active',\n  'paused',\n  'finished',\n  'replied',\n  'bounced',\n  'opted_out',\n  'stopped',\n  'failed',\n] as const\nexport type OutreachEnrollmentStatus =\n  (typeof OUTREACH_ENROLLMENT_STATUSES)[number]\n\n/**\n * Why an enrollment is not `active`, recorded beside the status. `finished`\n * needs none; each other status allows the reasons\n * `OUTREACH_STOP_REASONS_BY_STATUS` names.\n */\nexport const OUTREACH_STOP_REASONS = [\n  /** A person wrote back in the thread. */\n  'reply',\n  /** The recipient's server refused the address for good. */\n  'hard_bounce',\n  /** A reply asked not to be emailed again. */\n  'opt_out_reply',\n  /** The unsubscribe link or header was used. */\n  'unsubscribe',\n  /** The address is on the organization's do-not-contact list. */\n  'do_not_contact',\n  /** A gate refused the next send — the person became a customer, say. */\n  'gate',\n  /** A member paused or stopped it. */\n  'manual',\n  /** The sequence was archived with the person still in it. */\n  'sequence_archived',\n  /** The provider refused the send for good, or the email could not be composed. */\n  'send_failed',\n] as const\nexport type OutreachStopReason = (typeof OUTREACH_STOP_REASONS)[number]\n\n/** The statuses a stop reason is recorded with, and the reasons each allows. */\nexport const OUTREACH_STOP_REASONS_BY_STATUS: Readonly<\n  Record<\n    Exclude<OutreachEnrollmentStatus, 'active' | 'finished'>,\n    readonly OutreachStopReason[]\n  >\n> = {\n  paused: ['manual'],\n  replied: ['reply'],\n  bounced: ['hard_bounce'],\n  opted_out: ['opt_out_reply', 'unsubscribe', 'do_not_contact'],\n  stopped: ['manual', 'gate', 'sequence_archived'],\n  failed: ['send_failed'],\n}\n\n/**\n * What a rep confirms before a COLD contact is enrolled — one with no\n * inbound capture behind them — each recorded with who confirmed it and\n * when, because each is a fact only the rep can know:\n *\n * - `us_business_address`: the address is a business address in the US;\n * - `published_or_given`: they or their company published it, or they gave\n *   it to us — never guessed from a name or bought on a list;\n * - `verified_deliverable`: a verifier said it accepts mail.\n */\nexport const OUTREACH_ATTESTATION_KINDS = [\n  'us_business_address',\n  'published_or_given',\n  'verified_deliverable',\n] as const\nexport type OutreachAttestationKind = (typeof OUTREACH_ATTESTATION_KINDS)[number]\n\n/** The sentence a rep ticks for each attestation. */\nexport const OUTREACH_ATTESTATION_LABELS: Record<OutreachAttestationKind, string> = {\n  us_business_address: 'This is a US business address',\n  published_or_given:\n    'They or their company published this address, or they gave it to us',\n  verified_deliverable: 'This address was verified as deliverable',\n}\n\n/** One confirmation, as stored. */\nexport interface OutreachAttestation {\n  /** The member who confirmed it. */\n  uid: string\n  atMs: number\n}\n\n/** The confirmations an enrollment carries, by kind. */\nexport type OutreachAttestations = Partial<\n  Record<OutreachAttestationKind, OutreachAttestation>\n>\n\n/** The longest personal line an enrollment keeps: one sentence, not a letter. */\nexport const OUTREACH_PERSONAL_LINE_MAX = 300\n\n/**\n * Which CRM record an enrollment names (AGL-3234). A person is a LEAD until\n * somebody qualifies them and a CONTACT after, and a sequence works either:\n * an enrollment made on a lead follows the lead to the contact it becomes,\n * so the thread and the steps carry on as one enrollment.\n */\nexport const OUTREACH_ENROLLMENT_TARGETS = ['contact', 'lead'] as const\nexport type OutreachEnrollmentTarget = (typeof OUTREACH_ENROLLMENT_TARGETS)[number]\n\n/** One person in one sequence (`orgs/{orgId}/outreachEnrollments/{id}`). */\nexport interface OutreachEnrollment extends OutreachTimestamps {\n  id: string\n  sequenceId: string\n  /**\n   * The record the person is (AGL-3234): `contact` for a CRM contact,\n   * `lead` for a lead the sequence's site holds. A stored enrollment with\n   * no target is a contact's — every enrollment was, before leads could be\n   * sequenced.\n   */\n  target: OutreachEnrollmentTarget\n  /**\n   * The CRM contact the person is — `''` while the enrollment targets a\n   * lead that has not converted. Filled in, beside `target: 'contact'`, the\n   * moment the lead becomes a contact.\n   */\n  contactId: string\n  /**\n   * `hosts/{hostId}/leads/{leadId}` — the person key — for an enrollment\n   * made on a lead; kept once the lead converts, so the lead's page still\n   * lists the sequence. `null` for an enrollment made on a contact.\n   */\n  leadId: string | null\n  /**\n   * The person's name as the sending site knew it at enrollment, `''` when\n   * it had none — what the enrollments table shows beside the address,\n   * without a read of every record on the page (AGL-2980).\n   */\n  contactName: string\n  /** The address the steps go to, normalized, captured at enrollment. */\n  email: string\n  hostId: string\n  mailboxId: string\n  /** The index into `steps` of the NEXT step to run. */\n  stepIndex: number\n  /** When that step comes due, or `null` when nothing is waiting. */\n  nextDueAtMs: number | null\n  status: OutreachEnrollmentStatus\n  /** Why the status is not `active`; `null` while active and once finished. */\n  stopReason: OutreachStopReason | null\n  /** Plain-language detail: the gate's reason, the bounce's diagnostic. */\n  stopDetail: string | null\n  stoppedAtMs: number | null\n  /** The member who paused or stopped it; `null` when the engine did. */\n  stoppedByUid: string | null\n  /**\n   * The rep's signal sentence — why this person, now — merged into the\n   * steps as `{{enrollment.personalLine}}`. Required for a cold contact.\n   */\n  personalLine: string\n  /** Whether the contact was cold (no inbound capture) when enrolled. */\n  cold: boolean\n  attestations: OutreachAttestations\n  /** The member who enrolled the person. */\n  enrolledByUid: string\n  /** The provider thread the next in-thread email is sent into, once one exists. */\n  gmailThreadId: string | null\n  /** Every provider thread this enrollment has sent into, oldest first — what reply sync watches. */\n  gmailThreadIds: string[]\n  /** The subject the current thread was started with, as sent. */\n  threadSubject: string | null\n  /**\n   * The `Message-ID`s of the emails sent into the current thread, oldest\n   * first, angle brackets included: the next in-thread email answers the\n   * last and names them all in `References`.\n   */\n  messageIds: string[]\n  /** When the last step ran. */\n  lastSentAtMs: number | null\n  /**\n   * A sending run's hold on the step it is running (AGL-2981): taken in a\n   * transaction before the step runs, cleared when it is recorded. Absent\n   * or `null` while no run holds one.\n   */\n  sendClaim?: OutreachSendClaim | null\n  /** Every step the runtime ran, oldest first (AGL-2981). */\n  stepRecords?: OutreachStepRecord[]\n  /** Gmail ids of this enrollment's thread messages the sync has handled, the last hundred. */\n  syncedMessageIds?: string[]\n  /**\n   * What this person did with the links they were sent (AGL-3239). Absent\n   * until their first click, which is why the table reads an absence as\n   * \"no clicks\" only for a sequence that tracks them at all.\n   */\n  engagement?: OutreachEnrollmentEngagement\n  /**\n   * The sequence's campaigns as they stood when the person was enrolled\n   * (AGL-3254): what every outcome of this enrollment is credited to. A\n   * campaign the sequence joins later does not claim the people already\n   * in it, and one it leaves keeps what it was credited with.\n   */\n  campaignIds?: string[]\n}\n\n/** A sending run's claim on one enrollment's step (AGL-2981). */\nexport interface OutreachSendClaim {\n  /** The run that holds it. */\n  token: string\n  atMs: number\n  stepIndex: number\n  /**\n   * The `Message-ID` an email step goes out with, minted before the send, so\n   * a claim a run died holding is settled by looking for the message rather\n   * than by sending it again. `null` for a task step.\n   */\n  messageId: string | null\n}\n\n/** One step the runtime ran for an enrollment (AGL-2981). */\nexport interface OutreachStepRecord {\n  stepIndex: number\n  stepId: string\n  kind: 'email' | 'task'\n  atMs: number\n  /** Gmail's id for the sent message. */\n  gmailMessageId?: string\n  /** Gmail's thread the message went into. */\n  gmailThreadId?: string\n  /** The `Message-ID` it went out with, angle brackets included. */\n  messageId?: string\n  /** The subject as sent. */\n  subject?: string\n  /** The record system's task for a task step; `null` when none could be filed. */\n  taskId?: string | null\n  /**\n   * The destinations this email's links were rewritten to point at, in the\n   * order a click token indexes them (AGL-3239). Absent on a step that\n   * carried no links, and on every step sent before tracking existed.\n   *\n   * Kept so the console can say WHICH link a person followed without the\n   * token having to carry the URL back to us, and so a rewritten body can be\n   * read afterwards for what it actually offered them.\n   */\n  links?: string[]\n}\n\n/*==========================================\n * ORGANIZATION SETTINGS (AGL-2979).\n *==========================================*/\n\n/**\n * What every Outreach email's footer says about who sent it — the\n * identification and the postal address CAN-SPAM requires on commercial\n * mail. The composer refuses to write an email without a legal name and a\n * postal address, and a sequence cannot be activated without them.\n */\nexport interface OutreachOrgSettings {\n  /** The organization's legal name, as the footer prints it: \"Example Co LLC\". */\n  legalName: string\n  /**\n   * The name the solicitation sentence uses when it is not the legal name:\n   * \"This is a sales email from Example Co.\" `''` uses the legal\n   * name.\n   */\n  brandName: string\n  /**\n   * A valid physical postal address: a street address, a USPS PO box, or a\n   * private mailbox registered with the USPS. Line breaks are printed as\n   * commas.\n   */\n  postalAddress: string\n}\n\n/** The id of the compliance document in the `settings` collection. */\nexport const OUTREACH_COMPLIANCE_SETTINGS_ID = 'compliance'\n\n/**\n * The organization's Outreach compliance settings\n * (`orgs/{orgId}/outreachSettings/compliance`): the footer's sender identity,\n * and the countries Outreach may send to at all.\n *\n * `allowedCountries` is a CEILING over every sequence's own list — a\n * sequence sends only to the countries both name — so narrowing it here\n * narrows every sequence at once, without editing any of them. Default\n * {@link OUTREACH_DEFAULT_ALLOWED_COUNTRIES}.\n */\nexport interface OutreachComplianceSettings extends OutreachOrgSettings {\n  /** ISO-3166-1 alpha-2 codes, uppercase, in the order they were chosen. */\n  allowedCountries: string[]\n}\n\n/** The compliance settings as stored, with who changed them last. */\nexport interface OutreachComplianceSettingsDocument\n  extends OutreachComplianceSettings {\n  /** `0` until the organization first saves them. */\n  updatedAtMs: number\n  updatedByUid: string | null\n}\n\n/*==========================================\n * DO NOT CONTACT (AGL-2980).\n *\n * The organization's own list of addresses Outreach never emails, whoever\n * enrolls them and from whichever site. A member adds one by hand; the\n * sending runtime adds one when a reply asks to be left alone, when the\n * unsubscribe link is used, and when an address bounces for good.\n *\n * AN ENTRY CARRIES NO ADDRESS. Its id is `outreachDoNotContactKey(email)` —\n * the same hash the platform's suppression lists key by — and that is all a\n * lookup needs, since every caller holds the address it is about to use.\n * So the list keeps working after a person is erased from the workspace,\n * which is exactly when a promise not to email them must still hold, while\n * holding nothing that identifies them.\n *==========================================*/\n\n/** Why an address is on the list. */\nexport const OUTREACH_DO_NOT_CONTACT_REASONS = [\n  /** A member put it there. */\n  'manual',\n  /** A reply asked not to be emailed again. */\n  'opt_out_reply',\n  /** The unsubscribe link or header was used. */\n  'unsubscribe',\n  /** Mail to it bounced for good. */\n  'hard_bounce',\n  /**\n   * The recipient organization's mail gateway refused the sender outright\n   * (AGL-3244) — a Barracuda, Proofpoint or Mimecast policy block — which is\n   * a verdict on the whole domain, and is filed against it.\n   */\n  'gateway_block',\n] as const\nexport type OutreachDoNotContactReason =\n  (typeof OUTREACH_DO_NOT_CONTACT_REASONS)[number]\n\n/** What put an address on the list: a member, or the sending runtime. */\nexport const OUTREACH_DO_NOT_CONTACT_SOURCES = ['member', 'runtime'] as const\nexport type OutreachDoNotContactSource =\n  (typeof OUTREACH_DO_NOT_CONTACT_SOURCES)[number]\n\n/** One address on the list (`orgs/{orgId}/outreachDoNotContact/{key}`). */\nexport interface OutreachDoNotContactEntry {\n  /** `outreachDoNotContactKey` of the address, which is also the document id. */\n  key: string\n  reason: OutreachDoNotContactReason\n  source: OutreachDoNotContactSource\n  /** The member who added it; `null` when the runtime did. */\n  addedByUid: string | null\n  addedAtMs: number\n  /** The enrollment that led here, when one did. */\n  enrollmentId: string | null\n  /** That enrollment's sequence. */\n  sequenceId: string | null\n  /** Plain-language detail: why the member added it, the bounce's diagnostic. */\n  detail: string | null\n}\n\n/**\n * One domain on the list (`orgs/{orgId}/outreachDoNotContactDomains/{domain}`)\n * (AGL-3244): no address at it is emailed, whoever enrolls them.\n *\n * Unlike an address entry it CARRIES THE DOMAIN, in clear, because the\n * Compliance page lists it and a member takes it off by name; a domain is a\n * company's, not a person's, and a person erasure leaves it alone. A member\n * adds one by hand; the sending runtime adds one when a hard bounce reads\n * as the domain's mail gateway refusing the sender rather than one address\n * being unknown.\n */\nexport interface OutreachDoNotContactDomainEntry {\n  /** The domain, lower-cased, which is also the document id. */\n  domain: string\n  reason: OutreachDoNotContactReason\n  source: OutreachDoNotContactSource\n  /** The member who added it; `null` when the runtime did. */\n  addedByUid: string | null\n  addedAtMs: number\n  /** The enrollment whose bounce led here, when one did. */\n  enrollmentId: string | null\n  /** That enrollment's sequence. */\n  sequenceId: string | null\n  /** Plain-language detail: the member's note, or the bounce's diagnostic. */\n  detail: string | null\n}\n"],"names":["OUTREACH_COLLECTIONS","mailboxes","sequences","enrollments","settings","doNotContact","doNotContactDomains","mailboxCredentials","outreachOrgCollectionPath","orgId","collection","OUTREACH_MAILBOX_PROVIDERS","OUTREACH_MAILBOX_STATUSES","OUTREACH_SEQUENCE_STATUSES","OUTREACH_MAX_STEPS","OUTREACH_MAX_EMAIL_STEPS","OUTREACH_MAX_STEP_DELAY_BUSINESS_DAYS","OUTREACH_MIN_EMAIL_FOLLOW_UP_BUSINESS_DAYS","OUTREACH_TASK_KINDS","OUTREACH_TASK_KIND_LABELS","linkedin","call","todo","OUTREACH_DEFAULT_ALLOWED_COUNTRIES","OUTREACH_LINK_ROLLUP_PATH","OUTREACH_ENROLLMENT_STATUSES","OUTREACH_STOP_REASONS","OUTREACH_STOP_REASONS_BY_STATUS","paused","replied","bounced","opted_out","stopped","failed","OUTREACH_ATTESTATION_KINDS","OUTREACH_ATTESTATION_LABELS","us_business_address","published_or_given","verified_deliverable","OUTREACH_PERSONAL_LINE_MAX","OUTREACH_ENROLLMENT_TARGETS","OUTREACH_COMPLIANCE_SETTINGS_ID","OUTREACH_DO_NOT_CONTACT_REASONS","OUTREACH_DO_NOT_CONTACT_SOURCES"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;CAmBC,GAED;;;;;;;;;;;CAWC,GACD,OAAO,MAAMA,uBAAuB;IAClC,wEAAwE,GACxEC,WAAW;IACX,uEAAuE,GACvEC,WAAW;IACX,oFAAoF,GACpFC,aAAa;IACb;;;;GAIC,GACDC,UAAU;IACV;;;GAGC,GACDC,cAAc;IACd;;;;GAIC,GACDC,qBAAqB;IACrB;;;;GAIC,GACDC,oBAAoB;AACtB,EAAU;AAQV,uEAAuE,GACvE,OAAO,SAASC,0BACdC,KAAa,EACbC,UAAiC;IAEjC,OAAO,CAAC,KAAK,EAAED,MAAM,CAAC,EAAET,oBAAoB,CAACU,WAAW,EAAE;AAC5D;AAQA,2DAA2D,GAC3D,OAAO,MAAMC,6BAA6B;IAAC;CAAS,CAAS;AAI7D;;;;;;;;CAQC,GACD,OAAO,MAAMC,4BAA4B;IACvC;IACA;IACA;IACA;CACD,CAAS;AA8KV,gFAAgF,GAChF,OAAO,MAAMC,6BAA6B;IACxC;IACA;IACA;IACA;CACD,CAAS;AAIV;;;;;;;4CAO4C,GAE5C,kEAAkE,GAClE,OAAO,MAAMC,qBAAqB,EAAC;AAEnC,gDAAgD,GAChD,OAAO,MAAMC,2BAA2B,EAAC;AAEzC,2DAA2D,GAC3D,OAAO,MAAMC,wCAAwC,GAAE;AAEvD;;;;;CAKC,GACD,OAAO,MAAMC,6CAA6C,EAAC;AAwC3D,gDAAgD,GAChD,OAAO,MAAMC,sBAAsB;IAAC;IAAY;IAAQ;CAAO,CAAS;AAGxE,OAAO,MAAMC,4BAA8D;IACzEC,UAAU;IACVC,MAAM;IACNC,MAAM;AACR,EAAC;AAeD,oEAAoE,GACpE,OAAO,MAAMC,qCAAwD;IAAC;CAAK,CAAA;AA+C3E;;;;;;;;;;;;;2CAa2C,GAE3C;;;;;;;;CAQC,GACD,OAAO,MAAMC,4BAA4B;IAAC;IAAW;CAAQ,CAAS;AA8EtE;;4CAE4C,GAE5C;;;;;;;;CAQC,GACD,OAAO,MAAMC,+BAA+B;IAC1C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AAIV;;;;CAIC,GACD,OAAO,MAAMC,wBAAwB;IACnC,uCAAuC,GACvC;IACA,yDAAyD,GACzD;IACA,2CAA2C,GAC3C;IACA,6CAA6C,GAC7C;IACA,8DAA8D,GAC9D;IACA,sEAAsE,GACtE;IACA,mCAAmC,GACnC;IACA,2DAA2D,GAC3D;IACA,gFAAgF,GAChF;CACD,CAAS;AAGV,8EAA8E,GAC9E,OAAO,MAAMC,kCAKT;IACFC,QAAQ;QAAC;KAAS;IAClBC,SAAS;QAAC;KAAQ;IAClBC,SAAS;QAAC;KAAc;IACxBC,WAAW;QAAC;QAAiB;QAAe;KAAiB;IAC7DC,SAAS;QAAC;QAAU;QAAQ;KAAoB;IAChDC,QAAQ;QAAC;KAAc;AACzB,EAAC;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,6BAA6B;IACxC;IACA;IACA;CACD,CAAS;AAGV,mDAAmD,GACnD,OAAO,MAAMC,8BAAuE;IAClFC,qBAAqB;IACrBC,oBACE;IACFC,sBAAsB;AACxB,EAAC;AAcD,+EAA+E,GAC/E,OAAO,MAAMC,6BAA6B,IAAG;AAE7C;;;;;CAKC,GACD,OAAO,MAAMC,8BAA8B;IAAC;IAAW;CAAO,CAAS;AAsKvE,oEAAoE,GACpE,OAAO,MAAMC,kCAAkC,aAAY;AAyB3D;;;;;;;;;;;;;;4CAc4C,GAE5C,mCAAmC,GACnC,OAAO,MAAMC,kCAAkC;IAC7C,2BAA2B,GAC3B;IACA,2CAA2C,GAC3C;IACA,6CAA6C,GAC7C;IACA,iCAAiC,GACjC;IACA;;;;GAIC,GACD;CACD,CAAS;AAIV,uEAAuE,GACvE,OAAO,MAAMC,kCAAkC;IAAC;IAAU;CAAU,CAAS"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/model/outreach.types.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE OUTREACH DOCUMENT MODEL (AGL-2974).\n *\n * One file both halves import — the console reads these documents, the server\n * routes write them — so a field is spelled once. Client-safe: types and\n * constants only, nothing that reaches Firestore.\n *\n * EVERY DOCUMENT HERE IS SERVER-WRITTEN. The Firestore rules let an\n * org-wide member holding `outreach.use` READ the org collections on a\n * workspace that carries `features.outreach`, and refuse every client write,\n * because these documents are the sending engine's state: a client that\n * could write a mailbox could lift its daily cap, and one that could write\n * an enrollment could send a step twice. The credential collection is closed\n * to clients entirely.\n *\n * Lean on purpose. Each type carries what the mailbox and sequence work is\n * known to need and nothing speculative; a field is added where the code\n * that reads it lands. Times are epoch milliseconds throughout, the unit\n * `nextDueAtMs` has to be compared in.\n */\n\n/**\n * Where Outreach keeps its records.\n *\n * Six collections under the organization, and two at the top level. The\n * org-scoped ones are erased with the org, whose erasure deletes the whole\n * `orgs/{orgId}` tree. The top-level ones — credentials, and the short\n * tracking links (AGL-3297) — are keyed by an `orgId` FIELD that a\n * path-scoped delete of `orgs/{orgId}` cannot see: the org erasure sweeps\n * them by that field\n * (`libs/tenant/data/admin/src/lib/server/erase.ts` names it as a literal,\n * which the boundary forces, and `outreach.types.spec.ts` holds the two\n * spellings together, along with the rules').\n */\nexport const OUTREACH_COLLECTIONS = {\n  /** `orgs/{orgId}/outreachMailboxes/{mailboxId}` — a connected mailbox. */\n  mailboxes: 'outreachMailboxes',\n  /** `orgs/{orgId}/outreachSequences/{sequenceId}` — the steps to send. */\n  sequences: 'outreachSequences',\n  /** `orgs/{orgId}/outreachEnrollments/{enrollmentId}` — one person in one sequence. */\n  enrollments: 'outreachEnrollments',\n  /**\n   * `orgs/{orgId}/outreachSettings/{settingsId}` — the organization's own\n   * Outreach settings, one document per concern. `compliance` holds who\n   * every email says sent it and the countries Outreach may send to.\n   */\n  settings: 'outreachSettings',\n  /**\n   * `orgs/{orgId}/outreachDoNotContact/{key}` — the addresses Outreach never\n   * emails for this organization, keyed by `outreachDoNotContactKey`.\n   */\n  doNotContact: 'outreachDoNotContact',\n  /**\n   * `orgs/{orgId}/outreachDoNotContactDomains/{domain}` — the domains\n   * Outreach never emails for this organization (AGL-3244), keyed by the\n   * domain itself: a domain names a company, not a person.\n   */\n  doNotContactDomains: 'outreachDoNotContactDomains',\n  /**\n   * `outreachMailboxCredentials/{mailboxId}` — the provider grant behind a\n   * mailbox. TOP-LEVEL and closed to every client, staff included, so the\n   * token material never shares a readable path with the mailbox it serves.\n   */\n  mailboxCredentials: 'outreachMailboxCredentials',\n  /**\n   * `outreachLinks/{linkId}` — what one short tracking link in a sent email\n   * points at (AGL-3297): the organization, the enrollment, the step, the\n   * link's index and the destination. TOP-LEVEL so the link's id alone\n   * resolves it with one read, keyed by an `orgId` FIELD that the org\n   * erasure sweeps, and closed to every client.\n   */\n  links: 'outreachLinks',\n} as const\n\n/** The org-scoped collections, by their {@link OUTREACH_COLLECTIONS} key. */\nexport type OutreachOrgCollection = Exclude<\n  keyof typeof OUTREACH_COLLECTIONS,\n  'mailboxCredentials' | 'links'\n>\n\n/** `orgs/{orgId}/<collection>` for one of the org-scoped collections. */\nexport function outreachOrgCollectionPath(\n  orgId: string,\n  collection: OutreachOrgCollection,\n): string {\n  return `orgs/${orgId}/${OUTREACH_COLLECTIONS[collection]}`\n}\n\n/** Stamped by the server on every write. */\nexport interface OutreachTimestamps {\n  createdAtMs: number\n  updatedAtMs: number\n}\n\n/** The mail providers a mailbox can be connected through. */\nexport const OUTREACH_MAILBOX_PROVIDERS = ['google'] as const\nexport type OutreachMailboxProvider =\n  (typeof OUTREACH_MAILBOX_PROVIDERS)[number]\n\n/**\n * Where a mailbox stands.\n *\n * - `connected` — the grant works and the mailbox may send.\n * - `paused` — a member stopped it; enrollments on it wait.\n * - `reconnect_required` — the provider refused the grant (revoked, expired,\n *   password changed); nothing sends until the rep connects it again.\n * - `disconnected` — a member removed it; its credential is gone.\n */\nexport const OUTREACH_MAILBOX_STATUSES = [\n  'connected',\n  'paused',\n  'reconnect_required',\n  'disconnected',\n] as const\nexport type OutreachMailboxStatus = (typeof OUTREACH_MAILBOX_STATUSES)[number]\n\n/**\n * The hours a mailbox sends in, in its own {@link OutreachMailbox.timezone}.\n * A step that comes due outside the window waits for the next opening.\n */\nexport interface OutreachSendWindow {\n  /** Days of the week it sends on, `0` Sunday through `6` Saturday. */\n  days: number[]\n  /** Minutes after local midnight the window opens, inclusive. */\n  startMinute: number\n  /** Minutes after local midnight the window closes, exclusive. */\n  endMinute: number\n}\n\n/**\n * One mailbox-local day's sending, as the health panel sums it (AGL-2978).\n */\nexport interface OutreachMailboxDailyHealth {\n  sent: number\n  bounces: number\n  replies: number\n}\n\n/**\n * The counters a mailbox's sending is judged by.\n *\n * `sentToday` is what `dailyCap` refuses against, and it belongs to one\n * mailbox-local day — `sentOnDay` — so a counter from yesterday is read as\n * zero rather than as today's spend.\n */\nexport interface OutreachMailboxHealth {\n  sentToday: number\n  /** The local day (`YYYY-MM-DD` in the mailbox's timezone) `sentToday` counts. */\n  sentOnDay: string | null\n  /** Hard bounces on mail this mailbox sent. */\n  bounces: number\n  /** Replies detected on Outreach threads. */\n  replies: number\n  lastSentAtMs: number | null\n  /** The last provider error, kept until a later send succeeds. */\n  lastErrorAtMs: number | null\n  lastErrorCode: string | null\n  /**\n   * Per mailbox-local day (`YYYY-MM-DD`), the sends, bounces and replies\n   * counted on it (AGL-2978). The Mailboxes panel shows the last seven days\n   * summed; the sending runtime increments the day it counts on and may drop\n   * days older than a week. Absent, or empty, until the first send.\n   */\n  daily?: Record<string, OutreachMailboxDailyHealth>\n  /**\n   * The mailbox's most recent sends, newest last, at most\n   * `OUTREACH_BOUNCE_RATE_WINDOW_SENDS` of them, each marked when a hard\n   * bounce came back for it (AGL-2981): the window the bounce-rate pause is\n   * judged over. A send is named by a digest of its `Message-ID`, never by\n   * its recipient.\n   */\n  recentSends?: OutreachRecentSend[]\n  /** When a reply last called this mailbox's email spam (AGL-2981). */\n  lastComplaintAtMs?: number | null\n}\n\n/** One send in {@link OutreachMailboxHealth.recentSends}. */\nexport interface OutreachRecentSend {\n  /** A digest of the send's `Message-ID`: what a bounce is matched to. */\n  id: string\n  atMs: number\n  bounced: boolean\n}\n\n/** Why a mailbox paused itself (AGL-2981): the engine's health decision, kept. */\nexport interface OutreachMailboxAutoPause {\n  reason: 'bounces_today' | 'bounce_rate' | 'complaint'\n  /** The sentence the mailbox's card shows. */\n  message: string\n  atMs: number\n  /** For a complaint, when resuming stops being premature; `null` otherwise. */\n  untilMs: number | null\n}\n\n/** Where a mailbox's reply and bounce sync has read to (AGL-2981). */\nexport interface OutreachMailboxSync {\n  /** Everything received before this was read by an earlier run, epoch ms. */\n  throughMs: number\n  /** Gmail ids of messages outside any enrollment's thread already handled. */\n  handledMessageIds: string[]\n}\n\n/**\n * An address a connected Google account may send as, which Gmail has\n * verified — its own address, or an alias whose ownership Gmail confirmed\n * (AGL-2978). Only these are offered as a mailbox's `sendAs`.\n */\nexport interface OutreachSendAsAddress {\n  email: string\n  /** The name Gmail holds for the address, `''` when it holds none. */\n  displayName: string\n  /** The account's own address. */\n  isPrimary: boolean\n  /** The address Gmail sends as by default. */\n  isDefault: boolean\n}\n\n/**\n * A rep's own mailbox, connected to send Outreach mail\n * (`orgs/{orgId}/outreachMailboxes/{id}`).\n *\n * Its grant lives in {@link OutreachMailboxCredentials} under the same id.\n */\nexport interface OutreachMailbox extends OutreachTimestamps {\n  id: string\n  provider: OutreachMailboxProvider\n  /** The account's own address. */\n  email: string\n  /** The address mail goes out as: the account's, or an alias it may send as. */\n  sendAs: string\n  /**\n   * The verified addresses `sendAs` may be, as Gmail listed them at the last\n   * connect (AGL-2978). A changed alias shows up here on the next reconnect.\n   */\n  sendAsOptions: OutreachSendAsAddress[]\n  /** The From name recipients see. */\n  displayName: string\n  status: OutreachMailboxStatus\n  /** The most mail it sends in one local day, ramp included. */\n  dailyCap: number\n  window: OutreachSendWindow\n  /** IANA zone the window and the day boundary are read in. */\n  timezone: string\n  /**\n   * When the warm-up ramp began, or `null` for a mailbox sending at its full\n   * cap. The ramp is measured from here, not from connection, so a paused\n   * mailbox can restart it.\n   */\n  rampStartedAtMs: number | null\n  health: OutreachMailboxHealth\n  /** The member who connected it, and whose mail it is. */\n  connectedByUid: string\n  /** When the grant behind it was last connected (AGL-2978). */\n  connectedAtMs: number\n  /**\n   * Set when the mailbox paused ITSELF on its health (AGL-2981), and cleared\n   * when a member pauses or resumes it; absent otherwise.\n   */\n  autoPause?: OutreachMailboxAutoPause | null\n  /** The reply and bounce sync's place in the mailbox (AGL-2981). */\n  sync?: OutreachMailboxSync | null\n}\n\n/**\n * The provider grant behind one mailbox\n * (`outreachMailboxCredentials/{mailboxId}`).\n *\n * Only the fields every reader relies on are declared here; the token\n * material is added by the code that stores it. `orgId` is REQUIRED, not\n * decorative: the org erasure finds these documents by it, and a credential\n * written without one would outlive its workspace.\n *\n * NAME EVERY SEALED FIELD WITH A SECRET WORD — `refreshToken`,\n * `tokenCiphertext`. The personal-data export discloses these documents with\n * secrets redacted, and its redaction reads field names first: a name\n * carrying `token`, `secret` or `credential` is withheld whatever its value,\n * while a neutral name such as `ciphertext` is judged by the value's shape\n * alone and can be disclosed.\n */\nexport interface OutreachMailboxCredentials extends OutreachTimestamps {\n  /** The mailbox id, which is also this document's id. */\n  id: string\n  orgId: string\n  mailboxId: string\n  provider: OutreachMailboxProvider\n}\n\n/** A sequence's lifecycle. Only an `active` sequence advances its enrollments. */\nexport const OUTREACH_SEQUENCE_STATUSES = [\n  'draft',\n  'active',\n  'paused',\n  'archived',\n] as const\nexport type OutreachSequenceStatus =\n  (typeof OUTREACH_SEQUENCE_STATUSES)[number]\n\n/*==========================================\n * SEQUENCES (AGL-2979).\n *\n * The limits are the outbound playbook's: a person gets at most four emails\n * from one sequence, spaced by business days, and the tasks between them are\n * the rep's own touches — a LinkedIn note, a call. The engine\n * (`../engine/sequence-validation.ts`) holds a stored sequence to them.\n *==========================================*/\n\n/** The most steps one sequence holds, emails and tasks together. */\nexport const OUTREACH_MAX_STEPS = 8\n\n/** The most of those steps that send an email. */\nexport const OUTREACH_MAX_EMAIL_STEPS = 4\n\n/** The longest wait one step may carry, in business days. */\nexport const OUTREACH_MAX_STEP_DELAY_BUSINESS_DAYS = 30\n\n/**\n * The shortest wait before an email that follows an earlier email. The first\n * email may wait `0` — \"the next opening of the window\", or the same day as\n * a task before it — and so may a task, but each later email waits at least\n * this long after the step before it.\n */\nexport const OUTREACH_MIN_EMAIL_FOLLOW_UP_BUSINESS_DAYS = 1\n\n/**\n * One email step.\n *\n * Steps are a union on `kind`, so a later kind joins without reshaping the\n * ones already stored.\n */\nexport interface OutreachEmailStep {\n  /** Stable within the sequence, so an edit that reorders steps is traceable. */\n  id: string\n  kind: 'email'\n  /**\n   * Business days to wait after the previous step, counted in the mailbox's\n   * zone — after enrollment for the first step, where `0` means the next\n   * opening of the sending window.\n   */\n  delayBusinessDays: number\n  /**\n   * The subject, merge fields allowed. Required on the first email and on\n   * any email that starts a new thread; an in-thread email is sent as `Re:`\n   * the thread's own subject, so its field is not read.\n   */\n  subject: string\n  /**\n   * Whether the email goes out as a reply in the thread the earlier emails\n   * started. True by default for every email after the first; the first\n   * email always starts the thread, whatever this says.\n   */\n  replyInThread: boolean\n  /** Plain text with merge fields, as its author wrote it; `''` when `templateId` is set. */\n  body: string\n  /**\n   * A CRM email template (`orgs/{orgId}/crmEmailTemplates/{id}`) whose body\n   * is sent instead of `body`, or `null`. Only the body is taken from it: the\n   * step's own subject is the one that is sent.\n   */\n  templateId: string | null\n}\n\n/** The rep's own touches a task step asks for. */\nexport const OUTREACH_TASK_KINDS = ['linkedin', 'call', 'todo'] as const\nexport type OutreachTaskKind = (typeof OUTREACH_TASK_KINDS)[number]\n\nexport const OUTREACH_TASK_KIND_LABELS: Record<OutreachTaskKind, string> = {\n  linkedin: 'LinkedIn',\n  call: 'Call',\n  todo: 'To-do',\n}\n\n/** One task step: a CRM task for the rep, created when the step comes due. */\nexport interface OutreachTaskStep {\n  id: string\n  kind: 'task'\n  taskKind: OutreachTaskKind\n  /** What the task says, e.g. \"Connect on LinkedIn\". */\n  title: string\n  /** Business days after the previous step; `0` is the same day. */\n  delayBusinessDays: number\n}\n\nexport type OutreachSequenceStep = OutreachEmailStep | OutreachTaskStep\n\n/** The countries a new sequence sends to: the United States alone. */\nexport const OUTREACH_DEFAULT_ALLOWED_COUNTRIES: readonly string[] = ['US']\n\n/** Behavior a sequence applies to every enrollment in it. */\nexport interface OutreachSequenceSettings {\n  /**\n   * The hours this sequence sends in, replacing its mailbox's own window;\n   * `null` sends in the mailbox's. Read in the mailbox's zone either way.\n   */\n  window: OutreachSendWindow | null\n  /**\n   * ISO-3166-1 alpha-2 codes a recipient may be in, uppercase. Default\n   * {@link OUTREACH_DEFAULT_ALLOWED_COUNTRIES}: Canada, the United Kingdom\n   * and most of the EU need a consent basis a cold email does not have.\n   */\n  allowedCountries: string[]\n  /** Whether a contact who is already a customer may be enrolled. Default `false`. */\n  allowCustomers: boolean\n  /**\n   * Whether the links in this sequence's emails are rewritten so clicks are\n   * counted (AGL-3239). Default `false`, and `false` on every sequence\n   * written before the setting existed: turning it on changes what the\n   * recipient sees in the body, which is not a change to make on anyone's\n   * behalf.\n   *\n   * It buys the one engagement number a plain-text sequence can honestly\n   * report. It costs a visible link: the destination in the body becomes a\n   * signed link on the console that forwards to it. There is no equivalent\n   * setting for opens, because a pixel needs an HTML part — see\n   * `../engine/click-tracking.ts`.\n   */\n  trackClicks: boolean\n  /**\n   * Whether this sequence's emails carry `List-Unsubscribe` and\n   * `List-Unsubscribe-Post` (RFC 8058) (AGL-3296). Default `false`, and\n   * `false` on every sequence written before the setting existed.\n   *\n   * On, mail clients draw their own unsubscribe button — Apple Mail as \"This\n   * message is from a mailing list\" — which is the easiest way out for the\n   * recipient and makes a one-to-one email read as bulk. Off, the footer's\n   * \"reply 'no'\" line is the way out; the footer and its postal address are\n   * mandatory either way, and the reply classifier stops on a \"no\". The\n   * Gmail/Yahoo one-click requirement binds bulk senders (5,000 a day), not a\n   * mailbox sending a sequence.\n   */\n  listUnsubscribe: boolean\n}\n\n/*==========================================\n * WHAT A SEQUENCE MEASURED (AGL-3239).\n *\n * Counters on the sequence document, incremented by the sending runtime and\n * by the click route. They are NOT derived from the enrollments on read: the\n * console lists enrollments a page at a time, so a rollup taken over what is\n * loaded would report the first page's numbers as the sequence's.\n *\n * Every field is optional and every absence means \"not recorded\", never\n * zero. The distinction is the whole of `campaign-report.ts`'s honesty and\n * it is kept here for the same reason: a sequence that ran before this\n * existed has no counters, and reporting its click rate as 0% would publish\n * a fact about our schema as a fact about its recipients.\n *=========================================*/\n\n/**\n * The per-destination click rollup under one sequence:\n * `orgs/{orgId}/outreachSequences/{id}/reports/links`.\n *\n * One document per sequence, holding a bounded map — the campaign rollup's\n * own shape and its own cap, so \"a link\" means the same thing in a rep's\n * report and a marketer's. Here rather than beside the writer, because the\n * console's listener is a browser module and the writer is not.\n */\nexport const OUTREACH_LINK_ROLLUP_PATH = ['reports', 'links'] as const\n\n/** The counters one sequence is judged by. */\nexport interface OutreachSequenceStats {\n  /** Email steps that left. One person getting four emails counts four. */\n  sent?: number\n  /**\n   * Distinct enrollments that have had at least one email — the denominator\n   * of every engagement rate, and the thing `sent` is not.\n   */\n  people?: number\n  /**\n   * At least one email of this sequence went out with its links rewritten.\n   *\n   * Absent is NOT false; it is \"never recorded\", which is what every\n   * sequence sent before the setting existed reads as. Either way the report\n   * withholds the click rate rather than showing 0% — see\n   * {@link OutreachSequenceStats} above.\n   */\n  clickTracked?: boolean\n  /** Click EVENTS judged a person's. One reader clicking twice counts two. */\n  clicks?: number\n  /** Enrollments whose FIRST human click was seen: the rate's numerator. */\n  uniqueClicks?: number\n  /**\n   * Clicks a link scanner or a security gateway made, counted apart and\n   * never in the rate (`../engine/click-tracking.ts`). Shown, not hidden:\n   * a large number here is the reader's evidence that the small number\n   * beside it is the real one.\n   */\n  machineClicks?: number\n  /** When a person last followed a link. */\n  lastClickAtMs?: number | null\n}\n\n/** What one enrollment did with the links it was sent (AGL-3239). */\nexport interface OutreachEnrollmentEngagement {\n  /** Click events judged this person's, machines excluded. */\n  clicks: number\n  /** The first, which is what makes them one of the sequence's `uniqueClicks`. */\n  firstClickAtMs: number | null\n  lastClickAtMs: number | null\n  /** The destination they followed last, as `campaignLinkKey` reduces it. */\n  lastClickUrl: string | null\n  /** Clicks on this person's links that were a machine's. */\n  machineClicks: number\n}\n\n/** An ordered set of steps sent from one mailbox (`orgs/{orgId}/outreachSequences/{id}`). */\nexport interface OutreachSequence extends OutreachTimestamps {\n  id: string\n  name: string\n  /** The site whose CRM the enrolled people are records of. */\n  hostId: string\n  /**\n   * The mailbox every email step is sent from. A setting of the sequence,\n   * kept beside `settings` rather than inside it because enrollments and a\n   * mailbox's own screens select sequences by it.\n   */\n  mailboxId: string\n  steps: OutreachSequenceStep[]\n  settings: OutreachSequenceSettings\n  status: OutreachSequenceStatus\n  /**\n   * The campaigns the sequence is in (AGL-3254): container ids from the\n   * org's `emailCampaigns`, under the field every campaign member carries\n   * (`CAMPAIGN_MEMBERSHIP_FIELD`). Everyone enrolled gains them on their\n   * own record at enroll time, and what the sequence produces is credited\n   * to them. Absent on a sequence saved before it could join one.\n   */\n  campaignIds?: string[]\n  /**\n   * What it measured (AGL-3239). Absent until the first email leaves, and\n   * absent forever on a sequence that finished before the counters existed.\n   */\n  stats?: OutreachSequenceStats\n}\n\n/*==========================================\n * ENROLLMENTS (AGL-2979).\n *==========================================*/\n\n/**\n * Where one person's run through a sequence stands.\n *\n * `active` sends and `paused` waits. The rest end the sending, and each says\n * why: `finished` sent every step, `replied` heard back, `bounced` reached a\n * mailbox that does not exist, `opted_out` was asked to stop, `stopped` was\n * ended by a member or a gate, `failed` could not be sent. The transitions\n * between them are the engine's (`../engine/enrollment-state.ts`).\n */\nexport const OUTREACH_ENROLLMENT_STATUSES = [\n  'active',\n  'paused',\n  'finished',\n  'replied',\n  'bounced',\n  'opted_out',\n  'stopped',\n  'failed',\n] as const\nexport type OutreachEnrollmentStatus =\n  (typeof OUTREACH_ENROLLMENT_STATUSES)[number]\n\n/**\n * Why an enrollment is not `active`, recorded beside the status. `finished`\n * needs none; each other status allows the reasons\n * `OUTREACH_STOP_REASONS_BY_STATUS` names.\n */\nexport const OUTREACH_STOP_REASONS = [\n  /** A person wrote back in the thread. */\n  'reply',\n  /** The recipient's server refused the address for good. */\n  'hard_bounce',\n  /** A reply asked not to be emailed again. */\n  'opt_out_reply',\n  /** The unsubscribe link or header was used. */\n  'unsubscribe',\n  /** The address is on the organization's do-not-contact list. */\n  'do_not_contact',\n  /** A gate refused the next send — the person became a customer, say. */\n  'gate',\n  /** A member paused or stopped it. */\n  'manual',\n  /** The sequence was archived with the person still in it. */\n  'sequence_archived',\n  /** The provider refused the send for good, or the email could not be composed. */\n  'send_failed',\n] as const\nexport type OutreachStopReason = (typeof OUTREACH_STOP_REASONS)[number]\n\n/** The statuses a stop reason is recorded with, and the reasons each allows. */\nexport const OUTREACH_STOP_REASONS_BY_STATUS: Readonly<\n  Record<\n    Exclude<OutreachEnrollmentStatus, 'active' | 'finished'>,\n    readonly OutreachStopReason[]\n  >\n> = {\n  paused: ['manual'],\n  replied: ['reply'],\n  bounced: ['hard_bounce'],\n  opted_out: ['opt_out_reply', 'unsubscribe', 'do_not_contact'],\n  stopped: ['manual', 'gate', 'sequence_archived'],\n  failed: ['send_failed'],\n}\n\n/**\n * What a rep confirms before a COLD contact is enrolled — one with no\n * inbound capture behind them — each recorded with who confirmed it and\n * when, because each is a fact only the rep can know:\n *\n * - `us_business_address`: the address is a business address in the US;\n * - `published_or_given`: they or their company published it, or they gave\n *   it to us — never guessed from a name or bought on a list;\n * - `verified_deliverable`: a verifier said it accepts mail.\n */\nexport const OUTREACH_ATTESTATION_KINDS = [\n  'us_business_address',\n  'published_or_given',\n  'verified_deliverable',\n] as const\nexport type OutreachAttestationKind = (typeof OUTREACH_ATTESTATION_KINDS)[number]\n\n/** The sentence a rep ticks for each attestation. */\nexport const OUTREACH_ATTESTATION_LABELS: Record<OutreachAttestationKind, string> = {\n  us_business_address: 'This is a US business address',\n  published_or_given:\n    'They or their company published this address, or they gave it to us',\n  verified_deliverable: 'This address was verified as deliverable',\n}\n\n/** One confirmation, as stored. */\nexport interface OutreachAttestation {\n  /** The member who confirmed it. */\n  uid: string\n  atMs: number\n}\n\n/** The confirmations an enrollment carries, by kind. */\nexport type OutreachAttestations = Partial<\n  Record<OutreachAttestationKind, OutreachAttestation>\n>\n\n/** The longest personal line an enrollment keeps: one sentence, not a letter. */\nexport const OUTREACH_PERSONAL_LINE_MAX = 300\n\n/**\n * Which CRM record an enrollment names (AGL-3234). A person is a LEAD until\n * somebody qualifies them and a CONTACT after, and a sequence works either:\n * an enrollment made on a lead follows the lead to the contact it becomes,\n * so the thread and the steps carry on as one enrollment.\n */\nexport const OUTREACH_ENROLLMENT_TARGETS = ['contact', 'lead'] as const\nexport type OutreachEnrollmentTarget = (typeof OUTREACH_ENROLLMENT_TARGETS)[number]\n\n/** One person in one sequence (`orgs/{orgId}/outreachEnrollments/{id}`). */\nexport interface OutreachEnrollment extends OutreachTimestamps {\n  id: string\n  sequenceId: string\n  /**\n   * The record the person is (AGL-3234): `contact` for a CRM contact,\n   * `lead` for a lead the sequence's site holds. A stored enrollment with\n   * no target is a contact's — every enrollment was, before leads could be\n   * sequenced.\n   */\n  target: OutreachEnrollmentTarget\n  /**\n   * The CRM contact the person is — `''` while the enrollment targets a\n   * lead that has not converted. Filled in, beside `target: 'contact'`, the\n   * moment the lead becomes a contact.\n   */\n  contactId: string\n  /**\n   * `hosts/{hostId}/leads/{leadId}` — the person key — for an enrollment\n   * made on a lead; kept once the lead converts, so the lead's page still\n   * lists the sequence. `null` for an enrollment made on a contact.\n   */\n  leadId: string | null\n  /**\n   * The person's name as the sending site knew it at enrollment, `''` when\n   * it had none — what the enrollments table shows beside the address,\n   * without a read of every record on the page (AGL-2980).\n   */\n  contactName: string\n  /** The address the steps go to, normalized, captured at enrollment. */\n  email: string\n  hostId: string\n  mailboxId: string\n  /** The index into `steps` of the NEXT step to run. */\n  stepIndex: number\n  /** When that step comes due, or `null` when nothing is waiting. */\n  nextDueAtMs: number | null\n  status: OutreachEnrollmentStatus\n  /** Why the status is not `active`; `null` while active and once finished. */\n  stopReason: OutreachStopReason | null\n  /** Plain-language detail: the gate's reason, the bounce's diagnostic. */\n  stopDetail: string | null\n  stoppedAtMs: number | null\n  /** The member who paused or stopped it; `null` when the engine did. */\n  stoppedByUid: string | null\n  /**\n   * The rep's signal sentence — why this person, now — merged into the\n   * steps as `{{enrollment.personalLine}}`. Required for a cold contact.\n   */\n  personalLine: string\n  /** Whether the contact was cold (no inbound capture) when enrolled. */\n  cold: boolean\n  attestations: OutreachAttestations\n  /** The member who enrolled the person. */\n  enrolledByUid: string\n  /** The provider thread the next in-thread email is sent into, once one exists. */\n  gmailThreadId: string | null\n  /** Every provider thread this enrollment has sent into, oldest first — what reply sync watches. */\n  gmailThreadIds: string[]\n  /** The subject the current thread was started with, as sent. */\n  threadSubject: string | null\n  /**\n   * The `Message-ID`s of the emails sent into the current thread, oldest\n   * first, angle brackets included: the next in-thread email answers the\n   * last and names them all in `References`.\n   */\n  messageIds: string[]\n  /** When the last step ran. */\n  lastSentAtMs: number | null\n  /**\n   * A sending run's hold on the step it is running (AGL-2981): taken in a\n   * transaction before the step runs, cleared when it is recorded. Absent\n   * or `null` while no run holds one.\n   */\n  sendClaim?: OutreachSendClaim | null\n  /** Every step the runtime ran, oldest first (AGL-2981). */\n  stepRecords?: OutreachStepRecord[]\n  /** Gmail ids of this enrollment's thread messages the sync has handled, the last hundred. */\n  syncedMessageIds?: string[]\n  /**\n   * What this person did with the links they were sent (AGL-3239). Absent\n   * until their first click, which is why the table reads an absence as\n   * \"no clicks\" only for a sequence that tracks them at all.\n   */\n  engagement?: OutreachEnrollmentEngagement\n  /**\n   * The sequence's campaigns as they stood when the person was enrolled\n   * (AGL-3254): what every outcome of this enrollment is credited to. A\n   * campaign the sequence joins later does not claim the people already\n   * in it, and one it leaves keeps what it was credited with.\n   */\n  campaignIds?: string[]\n}\n\n/** A sending run's claim on one enrollment's step (AGL-2981). */\nexport interface OutreachSendClaim {\n  /** The run that holds it. */\n  token: string\n  atMs: number\n  stepIndex: number\n  /**\n   * The `Message-ID` an email step goes out with, minted before the send, so\n   * a claim a run died holding is settled by looking for the message rather\n   * than by sending it again. `null` for a task step.\n   */\n  messageId: string | null\n}\n\n/** One step the runtime ran for an enrollment (AGL-2981). */\nexport interface OutreachStepRecord {\n  stepIndex: number\n  stepId: string\n  kind: 'email' | 'task'\n  atMs: number\n  /** Gmail's id for the sent message. */\n  gmailMessageId?: string\n  /** Gmail's thread the message went into. */\n  gmailThreadId?: string\n  /** The `Message-ID` it went out with, angle brackets included. */\n  messageId?: string\n  /** The subject as sent. */\n  subject?: string\n  /** The record system's task for a task step; `null` when none could be filed. */\n  taskId?: string | null\n  /**\n   * The destinations this email's links were rewritten to point at, in the\n   * order a click token indexes them (AGL-3239). Absent on a step that\n   * carried no links, and on every step sent before tracking existed.\n   *\n   * Kept so the console can say WHICH link a person followed without the\n   * token having to carry the URL back to us, and so a rewritten body can be\n   * read afterwards for what it actually offered them.\n   */\n  links?: string[]\n}\n\n/*==========================================\n * ORGANIZATION SETTINGS (AGL-2979).\n *==========================================*/\n\n/**\n * What every Outreach email's footer says about who sent it — the\n * identification and the postal address CAN-SPAM requires on commercial\n * mail. The composer refuses to write an email without a legal name and a\n * postal address, and a sequence cannot be activated without them.\n */\nexport interface OutreachOrgSettings {\n  /** The organization's legal name, as the footer prints it: \"Example Co LLC\". */\n  legalName: string\n  /**\n   * The name the solicitation sentence uses when it is not the legal name:\n   * \"This is a sales email from Example Co.\" `''` uses the legal\n   * name.\n   */\n  brandName: string\n  /**\n   * A valid physical postal address: a street address, a USPS PO box, or a\n   * private mailbox registered with the USPS. Line breaks are printed as\n   * commas.\n   */\n  postalAddress: string\n}\n\n/** The id of the compliance document in the `settings` collection. */\nexport const OUTREACH_COMPLIANCE_SETTINGS_ID = 'compliance'\n\n/**\n * The organization's Outreach compliance settings\n * (`orgs/{orgId}/outreachSettings/compliance`): the footer's sender identity,\n * and the countries Outreach may send to at all.\n *\n * `allowedCountries` is a CEILING over every sequence's own list — a\n * sequence sends only to the countries both name — so narrowing it here\n * narrows every sequence at once, without editing any of them. Default\n * {@link OUTREACH_DEFAULT_ALLOWED_COUNTRIES}.\n */\nexport interface OutreachComplianceSettings extends OutreachOrgSettings {\n  /** ISO-3166-1 alpha-2 codes, uppercase, in the order they were chosen. */\n  allowedCountries: string[]\n}\n\n/** The compliance settings as stored, with who changed them last. */\nexport interface OutreachComplianceSettingsDocument\n  extends OutreachComplianceSettings {\n  /** `0` until the organization first saves them. */\n  updatedAtMs: number\n  updatedByUid: string | null\n}\n\n/*==========================================\n * DO NOT CONTACT (AGL-2980).\n *\n * The organization's own list of addresses Outreach never emails, whoever\n * enrolls them and from whichever site. A member adds one by hand; the\n * sending runtime adds one when a reply asks to be left alone, when the\n * unsubscribe link is used, and when an address bounces for good.\n *\n * AN ENTRY CARRIES NO ADDRESS. Its id is `outreachDoNotContactKey(email)` —\n * the same hash the platform's suppression lists key by — and that is all a\n * lookup needs, since every caller holds the address it is about to use.\n * So the list keeps working after a person is erased from the workspace,\n * which is exactly when a promise not to email them must still hold, while\n * holding nothing that identifies them.\n *==========================================*/\n\n/** Why an address is on the list. */\nexport const OUTREACH_DO_NOT_CONTACT_REASONS = [\n  /** A member put it there. */\n  'manual',\n  /** A reply asked not to be emailed again. */\n  'opt_out_reply',\n  /** The unsubscribe link or header was used. */\n  'unsubscribe',\n  /** Mail to it bounced for good. */\n  'hard_bounce',\n  /**\n   * The recipient organization's mail gateway refused the sender outright\n   * (AGL-3244) — a Barracuda, Proofpoint or Mimecast policy block — which is\n   * a verdict on the whole domain, and is filed against it.\n   */\n  'gateway_block',\n] as const\nexport type OutreachDoNotContactReason =\n  (typeof OUTREACH_DO_NOT_CONTACT_REASONS)[number]\n\n/** What put an address on the list: a member, or the sending runtime. */\nexport const OUTREACH_DO_NOT_CONTACT_SOURCES = ['member', 'runtime'] as const\nexport type OutreachDoNotContactSource =\n  (typeof OUTREACH_DO_NOT_CONTACT_SOURCES)[number]\n\n/** One address on the list (`orgs/{orgId}/outreachDoNotContact/{key}`). */\nexport interface OutreachDoNotContactEntry {\n  /** `outreachDoNotContactKey` of the address, which is also the document id. */\n  key: string\n  reason: OutreachDoNotContactReason\n  source: OutreachDoNotContactSource\n  /** The member who added it; `null` when the runtime did. */\n  addedByUid: string | null\n  addedAtMs: number\n  /** The enrollment that led here, when one did. */\n  enrollmentId: string | null\n  /** That enrollment's sequence. */\n  sequenceId: string | null\n  /** Plain-language detail: why the member added it, the bounce's diagnostic. */\n  detail: string | null\n}\n\n/**\n * One domain on the list (`orgs/{orgId}/outreachDoNotContactDomains/{domain}`)\n * (AGL-3244): no address at it is emailed, whoever enrolls them.\n *\n * Unlike an address entry it CARRIES THE DOMAIN, in clear, because the\n * Compliance page lists it and a member takes it off by name; a domain is a\n * company's, not a person's, and a person erasure leaves it alone. A member\n * adds one by hand; the sending runtime adds one when a hard bounce reads\n * as the domain's mail gateway refusing the sender rather than one address\n * being unknown.\n */\nexport interface OutreachDoNotContactDomainEntry {\n  /** The domain, lower-cased, which is also the document id. */\n  domain: string\n  reason: OutreachDoNotContactReason\n  source: OutreachDoNotContactSource\n  /** The member who added it; `null` when the runtime did. */\n  addedByUid: string | null\n  addedAtMs: number\n  /** The enrollment whose bounce led here, when one did. */\n  enrollmentId: string | null\n  /** That enrollment's sequence. */\n  sequenceId: string | null\n  /** Plain-language detail: the member's note, or the bounce's diagnostic. */\n  detail: string | null\n}\n"],"names":["OUTREACH_COLLECTIONS","mailboxes","sequences","enrollments","settings","doNotContact","doNotContactDomains","mailboxCredentials","links","outreachOrgCollectionPath","orgId","collection","OUTREACH_MAILBOX_PROVIDERS","OUTREACH_MAILBOX_STATUSES","OUTREACH_SEQUENCE_STATUSES","OUTREACH_MAX_STEPS","OUTREACH_MAX_EMAIL_STEPS","OUTREACH_MAX_STEP_DELAY_BUSINESS_DAYS","OUTREACH_MIN_EMAIL_FOLLOW_UP_BUSINESS_DAYS","OUTREACH_TASK_KINDS","OUTREACH_TASK_KIND_LABELS","linkedin","call","todo","OUTREACH_DEFAULT_ALLOWED_COUNTRIES","OUTREACH_LINK_ROLLUP_PATH","OUTREACH_ENROLLMENT_STATUSES","OUTREACH_STOP_REASONS","OUTREACH_STOP_REASONS_BY_STATUS","paused","replied","bounced","opted_out","stopped","failed","OUTREACH_ATTESTATION_KINDS","OUTREACH_ATTESTATION_LABELS","us_business_address","published_or_given","verified_deliverable","OUTREACH_PERSONAL_LINE_MAX","OUTREACH_ENROLLMENT_TARGETS","OUTREACH_COMPLIANCE_SETTINGS_ID","OUTREACH_DO_NOT_CONTACT_REASONS","OUTREACH_DO_NOT_CONTACT_SOURCES"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;CAmBC,GAED;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMA,uBAAuB;IAClC,wEAAwE,GACxEC,WAAW;IACX,uEAAuE,GACvEC,WAAW;IACX,oFAAoF,GACpFC,aAAa;IACb;;;;GAIC,GACDC,UAAU;IACV;;;GAGC,GACDC,cAAc;IACd;;;;GAIC,GACDC,qBAAqB;IACrB;;;;GAIC,GACDC,oBAAoB;IACpB;;;;;;GAMC,GACDC,OAAO;AACT,EAAU;AAQV,uEAAuE,GACvE,OAAO,SAASC,0BACdC,KAAa,EACbC,UAAiC;IAEjC,OAAO,CAAC,KAAK,EAAED,MAAM,CAAC,EAAEV,oBAAoB,CAACW,WAAW,EAAE;AAC5D;AAQA,2DAA2D,GAC3D,OAAO,MAAMC,6BAA6B;IAAC;CAAS,CAAS;AAI7D;;;;;;;;CAQC,GACD,OAAO,MAAMC,4BAA4B;IACvC;IACA;IACA;IACA;CACD,CAAS;AA8KV,gFAAgF,GAChF,OAAO,MAAMC,6BAA6B;IACxC;IACA;IACA;IACA;CACD,CAAS;AAIV;;;;;;;4CAO4C,GAE5C,kEAAkE,GAClE,OAAO,MAAMC,qBAAqB,EAAC;AAEnC,gDAAgD,GAChD,OAAO,MAAMC,2BAA2B,EAAC;AAEzC,2DAA2D,GAC3D,OAAO,MAAMC,wCAAwC,GAAE;AAEvD;;;;;CAKC,GACD,OAAO,MAAMC,6CAA6C,EAAC;AAwC3D,gDAAgD,GAChD,OAAO,MAAMC,sBAAsB;IAAC;IAAY;IAAQ;CAAO,CAAS;AAGxE,OAAO,MAAMC,4BAA8D;IACzEC,UAAU;IACVC,MAAM;IACNC,MAAM;AACR,EAAC;AAeD,oEAAoE,GACpE,OAAO,MAAMC,qCAAwD;IAAC;CAAK,CAAA;AA+C3E;;;;;;;;;;;;;2CAa2C,GAE3C;;;;;;;;CAQC,GACD,OAAO,MAAMC,4BAA4B;IAAC;IAAW;CAAQ,CAAS;AA8EtE;;4CAE4C,GAE5C;;;;;;;;CAQC,GACD,OAAO,MAAMC,+BAA+B;IAC1C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AAIV;;;;CAIC,GACD,OAAO,MAAMC,wBAAwB;IACnC,uCAAuC,GACvC;IACA,yDAAyD,GACzD;IACA,2CAA2C,GAC3C;IACA,6CAA6C,GAC7C;IACA,8DAA8D,GAC9D;IACA,sEAAsE,GACtE;IACA,mCAAmC,GACnC;IACA,2DAA2D,GAC3D;IACA,gFAAgF,GAChF;CACD,CAAS;AAGV,8EAA8E,GAC9E,OAAO,MAAMC,kCAKT;IACFC,QAAQ;QAAC;KAAS;IAClBC,SAAS;QAAC;KAAQ;IAClBC,SAAS;QAAC;KAAc;IACxBC,WAAW;QAAC;QAAiB;QAAe;KAAiB;IAC7DC,SAAS;QAAC;QAAU;QAAQ;KAAoB;IAChDC,QAAQ;QAAC;KAAc;AACzB,EAAC;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,6BAA6B;IACxC;IACA;IACA;CACD,CAAS;AAGV,mDAAmD,GACnD,OAAO,MAAMC,8BAAuE;IAClFC,qBAAqB;IACrBC,oBACE;IACFC,sBAAsB;AACxB,EAAC;AAcD,+EAA+E,GAC/E,OAAO,MAAMC,6BAA6B,IAAG;AAE7C;;;;;CAKC,GACD,OAAO,MAAMC,8BAA8B;IAAC;IAAW;CAAO,CAAS;AAsKvE,oEAAoE,GACpE,OAAO,MAAMC,kCAAkC,aAAY;AAyB3D;;;;;;;;;;;;;;4CAc4C,GAE5C,mCAAmC,GACnC,OAAO,MAAMC,kCAAkC;IAC7C,2BAA2B,GAC3B;IACA,2CAA2C,GAC3C;IACA,6CAA6C,GAC7C;IACA,iCAAiC,GACjC;IACA;;;;GAIC,GACD;CACD,CAAS;AAIV,uEAAuE,GACvE,OAAO,MAAMC,kCAAkC;IAAC;IAAU;CAAU,CAAS"}

package/src/lib/runtime/click-link.d.ts

@@ -15,45 +15,54 @@
  * limitations under the License.
  */
 /**
- * THE LINK A TRACKED SEQUENCE EMAIL CARRIES IN PLACE OF YOURS (AGL-3239).
+ * THE LINK A TRACKED SEQUENCE EMAIL CARRIES IN PLACE OF YOURS (AGL-3239,
+ * AGL-3297).
  *
- * `/api/outreach/click?t=…` on the console, minted exactly as the one-click
- * unsubscribe link is and for the same reasons: `<payload>.<signature>`,
- * where the payload is base64url JSON and the signature is the platform's
- * signed-link HMAC under Outreach's own purpose. No other link verifies as
- * this one and this one verifies as no other.
+ * ## Short, and stored
  *
- * ## The destination is IN the token
+ * Every send since AGL-3297 carries `/api/outreach/l/<id>`: a random
+ * {@link OUTREACH_LINK_ID_LENGTH}-character id naming an `outreachLinks`
+ * document that holds the organization, the enrollment, the step, the link's
+ * index and the destination. The send writes those documents before the
+ * email leaves, and the route reads one to answer.
  *
- * The alternative — an index into the enrollment's stored step record — mints
- * a shorter link, and it was rejected. A link in an email has to keep working
- * after the enrollment is gone: a person erased from the workspace, a
- * sequence deleted, a workspace closed. With the destination in the token the
- * redirect needs no read at all to answer, and the RECORDING is what becomes
- * best-effort — bookkeeping beside the act, which is the same order
- * `runtime/timeline.ts` puts them in.
+ * The first design put all of that in a signed token instead, so the
+ * redirect needed no read. It cost a ~350-character link, which in a
+ * one-to-one plain-text email reads as bulk marketing — the whole thing a
+ * sequence is not. A read per click is the cheaper of the two.
  *
- * It costs a long link, which in a cold plain-text email is a real cost and
- * is why a sequence's `trackClicks` setting is off by default.
+ * The signed links already in inboxes keep working: the `click` route still
+ * verifies and follows them, and {@link readOutreachClickToken} stays for it.
+ * Nothing mints one any more.
  *
  * ## It cannot be turned into an open redirect
  *
- * The signature covers the destination, so the only URLs this route will
- * forward to are ones a send of ours signed, and the only URLs a send signs
- * are the ones written in that sequence's own step. Anything else fails the
- * check and is refused rather than followed.
+ * The destination comes only from the stored document, which only the
+ * sending runtime writes, and only for a URL written in that sequence's own
+ * step; clients cannot read or write the collection at all. An id that names
+ * no document is refused rather than followed. For the signed links, the
+ * signature covers the destination, to the same end.
  *
  * ## It names ids, never an address
  *
  * A tracking URL lands in the recipient's history, in their gateway's logs
- * and in ours. It carries the organization, the enrollment, the step and the
- * link's index — the enrollment names the person, and that lookup is ours to
- * make, not a bystander's to read off a URL.
+ * and in ours. The short link carries nothing but a random id; the stored
+ * document names the enrollment, which names the person — a lookup that is
+ * ours to make, not a bystander's to read off a URL.
+ *
+ * ## The id is unguessable
+ *
+ * Ten characters of base 62 from the platform's CSPRNG — about 59.5 bits. A
+ * guess that lands resolves to a destination someone else was sent, and
+ * would count a click that is recorded as the one it is (see
+ * `click-events.ts`); it grants nothing else.
  */
 /** The purpose Outreach's click links are signed under. */
 export declare const OUTREACH_CLICK_PURPOSE = "outreach-click";
-/** The link's path on the console. */
+/** The signed link's path on the console — answered, no longer minted. */
 export declare const OUTREACH_CLICK_PATH: string;
+/** The short link's path on the console, before the id (AGL-3297). */
+export declare const OUTREACH_SHORT_LINK_PATH: string;
 /**
  * The longest destination a tracking link will carry.
  *
@@ -92,3 +101,37 @@ export declare function outreachClickUrl(input: {
     target: OutreachClickTarget;
     secret?: string;
 }): string | null;
+/** How many characters a short link's id has. */
+export declare const OUTREACH_LINK_ID_LENGTH = 10;
+/** Whether a value is shaped like a short link's id. */
+export declare function isOutreachLinkId(value: unknown): value is string;
+/**
+ * A fresh short link id: base 62 from the CSPRNG, by rejection sampling so
+ * every character is equally likely (62 does not divide 256).
+ */
+export declare function newOutreachLinkId(random?: (size: number) => Uint8Array): string;
+/** What an `outreachLinks/{id}` document holds. */
+export interface OutreachStoredLink extends OutreachClickTarget {
+    v: 1;
+    createdAtMs: number;
+}
+/**
+ * The document for one link, or `null` when the target is not one we would
+ * follow — the same checks the signed token applied at minting.
+ */
+export declare function outreachStoredLink(target: OutreachClickTarget, nowMs: number): OutreachStoredLink | null;
+/**
+ * What a stored link names, or `null` for a document that is missing or not
+ * one we will act on. Checked on the way OUT, as the token is: the document
+ * was written by us, and these say it is still one we will follow.
+ */
+export declare function readOutreachStoredLink(data: unknown): OutreachClickTarget | null;
+/**
+ * The short link for an id on the console at `origin`, or `null` when the
+ * origin is not HTTPS or the id is not one — no link rather than one that
+ * points at nothing. A `null` leaves the destination the step wrote.
+ */
+export declare function outreachShortLinkUrl(input: {
+    origin: string | null | undefined;
+    linkId: string;
+}): string | null;