@aglyn/plugins-outreach 1.0.0-beta.199 → 1.0.0-beta.201

package/src/lib/engine/mail-gateway.d.ts

@@ -14,84 +14,29 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-export type OutreachMailGateway = 'barracuda' | 'proofpoint' | 'mimecast' | 'google' | 'microsoft' | 'other' | 'none';
-export declare const OUTREACH_MAIL_GATEWAYS: readonly OutreachMailGateway[];
+import { classifyMailGateway, isMailGatewayFronted, type MailGateway, mailGatewayChip, type MailGatewayChip, type MailGatewayChipTone, mailGatewayDay, type MailGatewayDayCounts, mailGatewayHolds, mailGatewayOfHost, type MailGatewayStanding, mailGatewayWindow, pruneMailGatewayDays } from '@aglyn/shared-util-email/mail-gateway';
+export type OutreachMailGateway = MailGateway;
+export type OutreachGatewayDayCounts = MailGatewayDayCounts;
+export type OutreachGatewayStanding = MailGatewayStanding;
+export type OutreachGatewayChipTone = MailGatewayChipTone;
+export type OutreachGatewayChip = MailGatewayChip;
+export declare const OUTREACH_MAIL_GATEWAYS: readonly MailGateway[];
 /** The gateway as the Check-people chip and the enrollment row name it. */
-export declare const OUTREACH_MAIL_GATEWAY_LABELS: Record<OutreachMailGateway, string>;
-/**
- * The security gateways that stand in front of a whole company's mail and
- * refuse a sender for everyone behind them: the ones the enroll dialog
- * counts as "gateway-fronted".
- */
-export declare const OUTREACH_GATEWAY_FRONTED: readonly OutreachMailGateway[];
-/** Blocks in the window, with no delivery beside them, that hold the next send. */
+export declare const OUTREACH_MAIL_GATEWAY_LABELS: Record<MailGateway, string>;
+/** The security gateways the enroll dialog counts as "gateway-fronted". */
+export declare const OUTREACH_GATEWAY_FRONTED: readonly MailGateway[];
 export declare const OUTREACH_GATEWAY_HOLD_BLOCKS = 2;
-/** The days the hold is judged over. */
 export declare const OUTREACH_GATEWAY_WINDOW_DAYS = 30;
-/** The days the Check-people chip counts. */
 export declare const OUTREACH_GATEWAY_CHIP_DAYS = 7;
-/** How long a domain's MX answer is trusted before it is looked up again. */
 export declare const OUTREACH_DOMAIN_INTEL_TTL_MS: number;
-/** A send with no bounce this long after it counts as delivered. */
 export declare const OUTREACH_GATEWAY_DELIVERED_AFTER_MS: number;
-/**
- * The gateway ONE host names, or `null` when it names none of the known
- * ones — a Remote-MTA in a bounce, or one MX exchange.
- */
-export declare function outreachMailGatewayOfHost(host: unknown): OutreachMailGateway | null;
-/**
- * The gateway a domain's MX records name — see the module note. A domain
- * whose exchanges name more than one is read as the first named one in MX
- * order (the list is handed over lowest-priority-first); one that names
- * none is `other`; an empty list is `none`.
- */
-export declare function classifyOutreachMailGateway(mxHosts: readonly string[]): OutreachMailGateway;
-/** Whether the gateway is one of the security gateways that refuse a sender for a whole company. */
-export declare function isOutreachGatewayFronted(gateway: OutreachMailGateway | null | undefined): boolean;
-/** The counts one UTC day holds on a gateway's ledger. */
-export interface OutreachGatewayDayCounts {
-    sent: number;
-    delivered: number;
-    blocked: number;
-}
-/** `YYYY-MM-DD` in UTC: the day a ledger entry is filed under. */
-export declare function outreachGatewayDay(atMs: number): string;
-/** The ledger's counts summed over the last `days` UTC days, today included. */
-export declare function outreachGatewayWindow(days: Record<string, Partial<OutreachGatewayDayCounts>> | null | undefined, nowMs: number, windowDays: number): OutreachGatewayDayCounts;
-/** The ledger's days with everything older than `keepDays` dropped. */
-export declare function pruneOutreachGatewayDays<T>(days: Record<string, T> | null | undefined, nowMs: number, keepDays: number): Record<string, T>;
-/**
- * What the gates and the enroll dialog know about the gateway in front of
- * one address: which it is, and what it did with this organization's mail
- * over the chip's week and the hold's month.
- */
-export interface OutreachGatewayStanding {
-    gateway: OutreachMailGateway;
-    /** Blocks and deliveries in the last {@link OUTREACH_GATEWAY_CHIP_DAYS} days. */
-    blocked7: number;
-    delivered7: number;
-    /** Blocks and deliveries in the last {@link OUTREACH_GATEWAY_WINDOW_DAYS} days. */
-    blocked30: number;
-    delivered30: number;
-}
-/**
- * Whether the gateway holds the next send — see the module note. A named
- * gateway only: `other` is many exchanges, and `none` blocks instead.
- */
-export declare function outreachGatewayHolds(standing: Pick<OutreachGatewayStanding, 'gateway' | 'blocked30' | 'delivered30'>): boolean;
+export declare const outreachMailGatewayOfHost: typeof mailGatewayOfHost;
+export declare const classifyOutreachMailGateway: typeof classifyMailGateway;
+export declare const isOutreachGatewayFronted: typeof isMailGatewayFronted;
+export declare const outreachGatewayDay: typeof mailGatewayDay;
+export declare const outreachGatewayWindow: typeof mailGatewayWindow;
+export declare const pruneOutreachGatewayDays: typeof pruneMailGatewayDays;
+export declare const outreachGatewayHolds: typeof mailGatewayHolds;
+export declare const outreachGatewayChip: typeof mailGatewayChip;
 /** The sentence the hold is written with, on the enrollment and in the engine's reason. */
 export declare function outreachGatewayHoldReason(gateway: OutreachMailGateway, blocked30: number): string;
-/** The chip's tone: what color the Check-people step gives it. */
-export type OutreachGatewayChipTone = 'refused' | 'delivered' | 'neutral' | 'blocked';
-export interface OutreachGatewayChip {
-    label: string;
-    tone: OutreachGatewayChipTone;
-}
-/**
- * The Check-people chip for one person, or `null` when there is nothing
- * worth a chip: an unrecognized exchange with no verdict this week. Red for
- * a gateway that refused this week, green for one that delivered, neutral
- * for the hosted providers and the security gateways with no verdict yet,
- * and blocked for a domain with no MX.
- */
-export declare function outreachGatewayChip(standing: OutreachGatewayStanding | null | undefined): OutreachGatewayChip | null;

package/src/lib/engine/mail-gateway.js

@@ -14,213 +14,39 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ /*==========================================
- * THE MX RECORD PREDICTS THE GATEWAY, AND THE GATEWAY'S HISTORY PREDICTS
- * THE BLOCK (AGL-3326).
- *
- * Two Barracuda gateways refused the same sender three days apart, and each
- * refusal was read only after the email had left: a hard bounce, a paused
- * mailbox, ten first emails still queued. Both domains had Barracuda ESS as
- * their MX, and a third enrolled domain with the same MX was stopped by hand
- * before it sent. So the signal is cheap and it is available BEFORE a send:
- * the domain's MX names the gateway in front of it, and what that gateway
- * has done with this organization's mail lately says what it will do next.
- *
- * ## The kinds
- *
- * A gateway is named by the MX host's suffix. `barracuda`, `proofpoint`
- * and `mimecast` are the security gateways that refuse a SENDER on policy
- * and reputation; `google` and `microsoft` are the two hosted providers,
- * which judge mail one message at a time; `other` is every self-hosted or
- * unrecognized exchange; `none` is a domain with no MX at all, which cannot
- * receive mail and blocks the enrollment outright.
- *
- * ## The ledger and the hold
- *
- * Every send, every delivery and every block is counted per gateway per
- * organization, by UTC day, and a gateway that has REFUSED this
- * organization twice in the last {@link OUTREACH_GATEWAY_WINDOW_DAYS} days
- * without delivering once holds the next send into it: nothing goes into a
- * gateway that has refused us twice unless a member says so. `other` never
- * holds, because it is a bucket of unrelated exchanges rather than one
- * gateway; `none` blocks instead.
- *==========================================*/ export const OUTREACH_MAIL_GATEWAYS = [
-    'barracuda',
-    'proofpoint',
-    'mimecast',
-    'google',
-    'microsoft',
-    'other',
-    'none'
-];
-/** The gateway as the Check-people chip and the enrollment row name it. */ export const OUTREACH_MAIL_GATEWAY_LABELS = {
-    barracuda: 'Barracuda',
-    proofpoint: 'Proofpoint',
-    mimecast: 'Mimecast',
-    google: 'Google Workspace',
-    microsoft: 'Microsoft 365',
-    other: 'Other mail gateway',
-    none: 'No MX record'
-};
-/**
- * The security gateways that stand in front of a whole company's mail and
- * refuse a sender for everyone behind them: the ones the enroll dialog
- * counts as "gateway-fronted".
- */ export const OUTREACH_GATEWAY_FRONTED = [
-    'barracuda',
-    'proofpoint',
-    'mimecast'
-];
-/** Blocks in the window, with no delivery beside them, that hold the next send. */ export const OUTREACH_GATEWAY_HOLD_BLOCKS = 2;
-/** The days the hold is judged over. */ export const OUTREACH_GATEWAY_WINDOW_DAYS = 30;
-/** The days the Check-people chip counts. */ export const OUTREACH_GATEWAY_CHIP_DAYS = 7;
-/** How long a domain's MX answer is trusted before it is looked up again. */ export const OUTREACH_DOMAIN_INTEL_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-/** A send with no bounce this long after it counts as delivered. */ export const OUTREACH_GATEWAY_DELIVERED_AFTER_MS = 24 * 60 * 60 * 1000;
-/** The MX host suffixes each named gateway answers as, lowercase, no trailing dot. */ const GATEWAY_HOST_SUFFIXES = [
-    [
-        'barracuda',
-        [
-            '.ess.barracudanetworks.com',
-            '.barracudanetworks.com'
-        ]
-    ],
-    [
-        'proofpoint',
-        [
-            '.pphosted.com',
-            '.ppe-hosted.com',
-            '.proofpoint.com'
-        ]
-    ],
-    [
-        'mimecast',
-        [
-            '.mimecast.com',
-            '.mimecast.co.za',
-            '.mimecast-offshore.com'
-        ]
-    ],
-    [
-        'google',
-        [
-            '.google.com',
-            '.googlemail.com',
-            '.gmail.com'
-        ]
-    ],
-    [
-        'microsoft',
-        [
-            '.mail.protection.outlook.com',
-            '.outlook.com',
-            '.protection.outlook.com'
-        ]
-    ]
-];
-/** A host as the suffix table reads it: lowercase, trimmed, no trailing dot. */ function normalizeHost(host) {
-    return String(host != null ? host : '').trim().toLowerCase().replace(/\.$/, '');
-}
-/**
- * The gateway ONE host names, or `null` when it names none of the known
- * ones — a Remote-MTA in a bounce, or one MX exchange.
- */ export function outreachMailGatewayOfHost(host) {
-    const name = normalizeHost(host);
-    if (!name) return null;
-    for (const [gateway, suffixes] of GATEWAY_HOST_SUFFIXES){
-        if (suffixes.some((suffix)=>name === suffix.slice(1) || name.endsWith(suffix))) return gateway;
-    }
-    return null;
-}
-/**
- * The gateway a domain's MX records name — see the module note. A domain
- * whose exchanges name more than one is read as the first named one in MX
- * order (the list is handed over lowest-priority-first); one that names
- * none is `other`; an empty list is `none`.
- */ export function classifyOutreachMailGateway(mxHosts) {
-    const hosts = mxHosts.map(normalizeHost).filter(Boolean);
-    // A lone "." (or an empty exchange) is RFC 7505's null MX: the domain
-    // says outright that it takes no mail.
-    if (!hosts.length) return 'none';
-    for (const host of hosts){
-        const gateway = outreachMailGatewayOfHost(host);
-        if (gateway) return gateway;
-    }
-    return 'other';
-}
-/** Whether the gateway is one of the security gateways that refuse a sender for a whole company. */ export function isOutreachGatewayFronted(gateway) {
-    return gateway !== null && gateway !== undefined && OUTREACH_GATEWAY_FRONTED.includes(gateway);
-}
-/** `YYYY-MM-DD` in UTC: the day a ledger entry is filed under. */ export function outreachGatewayDay(atMs) {
-    return new Date(atMs).toISOString().slice(0, 10);
-}
-const count = (value)=>{
-    const number = Number(value);
-    return Number.isFinite(number) ? Math.max(0, Math.floor(number)) : 0;
-};
-/** The ledger's counts summed over the last `days` UTC days, today included. */ export function outreachGatewayWindow(days, nowMs, windowDays) {
-    const summed = {
-        sent: 0,
-        delivered: 0,
-        blocked: 0
-    };
-    if (!days) return summed;
-    const oldest = outreachGatewayDay(nowMs - (windowDays - 1) * 86400000);
-    const newest = outreachGatewayDay(nowMs);
-    for (const [day, counts] of Object.entries(days)){
-        if (day < oldest || day > newest) continue;
-        summed.sent += count(counts == null ? void 0 : counts.sent);
-        summed.delivered += count(counts == null ? void 0 : counts.delivered);
-        summed.blocked += count(counts == null ? void 0 : counts.blocked);
-    }
-    return summed;
-}
-/** The ledger's days with everything older than `keepDays` dropped. */ export function pruneOutreachGatewayDays(days, nowMs, keepDays) {
-    const oldest = outreachGatewayDay(nowMs - (keepDays - 1) * 86400000);
-    return Object.fromEntries(Object.entries(days != null ? days : {}).filter(([day])=>day >= oldest));
-}
-/**
- * Whether the gateway holds the next send — see the module note. A named
- * gateway only: `other` is many exchanges, and `none` blocks instead.
- */ export function outreachGatewayHolds(standing) {
-    if (standing.gateway === 'other' || standing.gateway === 'none') return false;
-    return count(standing.blocked30) >= OUTREACH_GATEWAY_HOLD_BLOCKS && count(standing.delivered30) === 0;
-}
+ * THE MAIL GATEWAY, AS SEQUENCES NAMES IT (AGL-3326).
+ *
+ * The engine is the platform's — `@aglyn/shared-util-email`'s
+ * `mail-gateway` (AGL-3328), which the Resend path reads too, so one table
+ * names a gateway and one rule holds a send for both. What stays here is
+ * the vocabulary Sequences already speaks, and the one sentence it adds: a
+ * held enrollment is resumed by a member.
+ *
+ * ## The hold, as Sequences applies it
+ *
+ * A gateway that REFUSED the mailbox's sending domain twice in the last
+ * {@link OUTREACH_GATEWAY_WINDOW_DAYS} days without delivering once holds
+ * the next send into it: nothing goes into a gateway that has refused us
+ * twice unless a member says so. `other` never holds; `none` blocks instead.
+ *==========================================*/ import { classifyMailGateway, isMailGatewayFronted, MAIL_DOMAIN_INTEL_TTL_MS, MAIL_GATEWAY_CHIP_DAYS, MAIL_GATEWAY_DELIVERED_AFTER_MS, MAIL_GATEWAY_HOLD_BLOCKS, MAIL_GATEWAY_LABELS, MAIL_GATEWAY_WINDOW_DAYS, MAIL_GATEWAYS, MAIL_GATEWAYS_FRONTED, mailGatewayChip, mailGatewayDay, mailGatewayHolds, mailGatewayHoldSentence, mailGatewayOfHost, mailGatewayWindow, pruneMailGatewayDays } from "@aglyn/shared-util-email/mail-gateway";
+export const OUTREACH_MAIL_GATEWAYS = MAIL_GATEWAYS;
+/** The gateway as the Check-people chip and the enrollment row name it. */ export const OUTREACH_MAIL_GATEWAY_LABELS = MAIL_GATEWAY_LABELS;
+/** The security gateways the enroll dialog counts as "gateway-fronted". */ export const OUTREACH_GATEWAY_FRONTED = MAIL_GATEWAYS_FRONTED;
+export const OUTREACH_GATEWAY_HOLD_BLOCKS = MAIL_GATEWAY_HOLD_BLOCKS;
+export const OUTREACH_GATEWAY_WINDOW_DAYS = MAIL_GATEWAY_WINDOW_DAYS;
+export const OUTREACH_GATEWAY_CHIP_DAYS = MAIL_GATEWAY_CHIP_DAYS;
+export const OUTREACH_DOMAIN_INTEL_TTL_MS = MAIL_DOMAIN_INTEL_TTL_MS;
+export const OUTREACH_GATEWAY_DELIVERED_AFTER_MS = MAIL_GATEWAY_DELIVERED_AFTER_MS;
+export const outreachMailGatewayOfHost = mailGatewayOfHost;
+export const classifyOutreachMailGateway = classifyMailGateway;
+export const isOutreachGatewayFronted = isMailGatewayFronted;
+export const outreachGatewayDay = mailGatewayDay;
+export const outreachGatewayWindow = mailGatewayWindow;
+export const pruneOutreachGatewayDays = pruneMailGatewayDays;
+export const outreachGatewayHolds = mailGatewayHolds;
+export const outreachGatewayChip = mailGatewayChip;
 /** The sentence the hold is written with, on the enrollment and in the engine's reason. */ export function outreachGatewayHoldReason(gateway, blocked30) {
-    const name = OUTREACH_MAIL_GATEWAY_LABELS[gateway];
-    return `${name} refused this sender ${blocked30 === 2 ? 'twice' : `${blocked30} times`} in the last ` + `${OUTREACH_GATEWAY_WINDOW_DAYS} days and delivered nothing, so this email is held. ` + 'Resume the enrollment to send it anyway.';
-}
-/**
- * The Check-people chip for one person, or `null` when there is nothing
- * worth a chip: an unrecognized exchange with no verdict this week. Red for
- * a gateway that refused this week, green for one that delivered, neutral
- * for the hosted providers and the security gateways with no verdict yet,
- * and blocked for a domain with no MX.
- */ export function outreachGatewayChip(standing) {
-    if (!standing) return null;
-    const name = OUTREACH_MAIL_GATEWAY_LABELS[standing.gateway];
-    if (standing.gateway === 'none') return {
-        label: 'No MX record — cannot receive mail',
-        tone: 'blocked'
-    };
-    const blocked = count(standing.blocked7);
-    const delivered = count(standing.delivered7);
-    const settled = blocked + delivered;
-    if (blocked > 0) {
-        return {
-            label: `${name} · ${blocked} of ${settled} ${settled === 1 ? 'send' : 'sends'} refused this week`,
-            tone: 'refused'
-        };
-    }
-    if (delivered > 0) {
-        return {
-            label: `${name} · ${delivered} of ${settled} delivered this week`,
-            tone: 'delivered'
-        };
-    }
-    if (standing.gateway === 'other') return null;
-    return {
-        label: name,
-        tone: 'neutral'
-    };
+    return `${mailGatewayHoldSentence(gateway, blocked30)}, so this email is held. Resume the enrollment to send it anyway.`;
 }
 
 //# sourceMappingURL=mail-gateway.js.map

package/src/lib/engine/mail-gateway.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/mail-gateway.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE MX RECORD PREDICTS THE GATEWAY, AND THE GATEWAY'S HISTORY PREDICTS\n * THE BLOCK (AGL-3326).\n *\n * Two Barracuda gateways refused the same sender three days apart, and each\n * refusal was read only after the email had left: a hard bounce, a paused\n * mailbox, ten first emails still queued. Both domains had Barracuda ESS as\n * their MX, and a third enrolled domain with the same MX was stopped by hand\n * before it sent. So the signal is cheap and it is available BEFORE a send:\n * the domain's MX names the gateway in front of it, and what that gateway\n * has done with this organization's mail lately says what it will do next.\n *\n * ## The kinds\n *\n * A gateway is named by the MX host's suffix. `barracuda`, `proofpoint`\n * and `mimecast` are the security gateways that refuse a SENDER on policy\n * and reputation; `google` and `microsoft` are the two hosted providers,\n * which judge mail one message at a time; `other` is every self-hosted or\n * unrecognized exchange; `none` is a domain with no MX at all, which cannot\n * receive mail and blocks the enrollment outright.\n *\n * ## The ledger and the hold\n *\n * Every send, every delivery and every block is counted per gateway per\n * organization, by UTC day, and a gateway that has REFUSED this\n * organization twice in the last {@link OUTREACH_GATEWAY_WINDOW_DAYS} days\n * without delivering once holds the next send into it: nothing goes into a\n * gateway that has refused us twice unless a member says so. `other` never\n * holds, because it is a bucket of unrelated exchanges rather than one\n * gateway; `none` blocks instead.\n *==========================================*/\n\nexport type OutreachMailGateway =\n  | 'barracuda'\n  | 'proofpoint'\n  | 'mimecast'\n  | 'google'\n  | 'microsoft'\n  | 'other'\n  | 'none'\n\nexport const OUTREACH_MAIL_GATEWAYS: readonly OutreachMailGateway[] = [\n  'barracuda',\n  'proofpoint',\n  'mimecast',\n  'google',\n  'microsoft',\n  'other',\n  'none',\n]\n\n/** The gateway as the Check-people chip and the enrollment row name it. */\nexport const OUTREACH_MAIL_GATEWAY_LABELS: Record<OutreachMailGateway, string> = {\n  barracuda: 'Barracuda',\n  proofpoint: 'Proofpoint',\n  mimecast: 'Mimecast',\n  google: 'Google Workspace',\n  microsoft: 'Microsoft 365',\n  other: 'Other mail gateway',\n  none: 'No MX record',\n}\n\n/**\n * The security gateways that stand in front of a whole company's mail and\n * refuse a sender for everyone behind them: the ones the enroll dialog\n * counts as \"gateway-fronted\".\n */\nexport const OUTREACH_GATEWAY_FRONTED: readonly OutreachMailGateway[] = ['barracuda', 'proofpoint', 'mimecast']\n\n/** Blocks in the window, with no delivery beside them, that hold the next send. */\nexport const OUTREACH_GATEWAY_HOLD_BLOCKS = 2\n\n/** The days the hold is judged over. */\nexport const OUTREACH_GATEWAY_WINDOW_DAYS = 30\n\n/** The days the Check-people chip counts. */\nexport const OUTREACH_GATEWAY_CHIP_DAYS = 7\n\n/** How long a domain's MX answer is trusted before it is looked up again. */\nexport const OUTREACH_DOMAIN_INTEL_TTL_MS = 7 * 24 * 60 * 60 * 1000\n\n/** A send with no bounce this long after it counts as delivered. */\nexport const OUTREACH_GATEWAY_DELIVERED_AFTER_MS = 24 * 60 * 60 * 1000\n\n/** The MX host suffixes each named gateway answers as, lowercase, no trailing dot. */\nconst GATEWAY_HOST_SUFFIXES: ReadonlyArray<readonly [OutreachMailGateway, readonly string[]]> = [\n  ['barracuda', ['.ess.barracudanetworks.com', '.barracudanetworks.com']],\n  ['proofpoint', ['.pphosted.com', '.ppe-hosted.com', '.proofpoint.com']],\n  ['mimecast', ['.mimecast.com', '.mimecast.co.za', '.mimecast-offshore.com']],\n  ['google', ['.google.com', '.googlemail.com', '.gmail.com']],\n  ['microsoft', ['.mail.protection.outlook.com', '.outlook.com', '.protection.outlook.com']],\n]\n\n/** A host as the suffix table reads it: lowercase, trimmed, no trailing dot. */\nfunction normalizeHost(host: unknown): string {\n  return String(host ?? '')\n    .trim()\n    .toLowerCase()\n    .replace(/\\.$/, '')\n}\n\n/**\n * The gateway ONE host names, or `null` when it names none of the known\n * ones — a Remote-MTA in a bounce, or one MX exchange.\n */\nexport function outreachMailGatewayOfHost(host: unknown): OutreachMailGateway | null {\n  const name = normalizeHost(host)\n  if (!name) return null\n  for (const [gateway, suffixes] of GATEWAY_HOST_SUFFIXES) {\n    if (suffixes.some((suffix) => name === suffix.slice(1) || name.endsWith(suffix))) return gateway\n  }\n  return null\n}\n\n/**\n * The gateway a domain's MX records name — see the module note. A domain\n * whose exchanges name more than one is read as the first named one in MX\n * order (the list is handed over lowest-priority-first); one that names\n * none is `other`; an empty list is `none`.\n */\nexport function classifyOutreachMailGateway(mxHosts: readonly string[]): OutreachMailGateway {\n  const hosts = mxHosts.map(normalizeHost).filter(Boolean)\n  // A lone \".\" (or an empty exchange) is RFC 7505's null MX: the domain\n  // says outright that it takes no mail.\n  if (!hosts.length) return 'none'\n  for (const host of hosts) {\n    const gateway = outreachMailGatewayOfHost(host)\n    if (gateway) return gateway\n  }\n  return 'other'\n}\n\n/** Whether the gateway is one of the security gateways that refuse a sender for a whole company. */\nexport function isOutreachGatewayFronted(gateway: OutreachMailGateway | null | undefined): boolean {\n  return gateway !== null && gateway !== undefined && OUTREACH_GATEWAY_FRONTED.includes(gateway)\n}\n\n/** The counts one UTC day holds on a gateway's ledger. */\nexport interface OutreachGatewayDayCounts {\n  sent: number\n  delivered: number\n  blocked: number\n}\n\n/** `YYYY-MM-DD` in UTC: the day a ledger entry is filed under. */\nexport function outreachGatewayDay(atMs: number): string {\n  return new Date(atMs).toISOString().slice(0, 10)\n}\n\nconst count = (value: unknown): number => {\n  const number = Number(value)\n  return Number.isFinite(number) ? Math.max(0, Math.floor(number)) : 0\n}\n\n/** The ledger's counts summed over the last `days` UTC days, today included. */\nexport function outreachGatewayWindow(\n  days: Record<string, Partial<OutreachGatewayDayCounts>> | null | undefined,\n  nowMs: number,\n  windowDays: number,\n): OutreachGatewayDayCounts {\n  const summed: OutreachGatewayDayCounts = { sent: 0, delivered: 0, blocked: 0 }\n  if (!days) return summed\n  const oldest = outreachGatewayDay(nowMs - (windowDays - 1) * 86_400_000)\n  const newest = outreachGatewayDay(nowMs)\n  for (const [day, counts] of Object.entries(days)) {\n    if (day < oldest || day > newest) continue\n    summed.sent += count(counts?.sent)\n    summed.delivered += count(counts?.delivered)\n    summed.blocked += count(counts?.blocked)\n  }\n  return summed\n}\n\n/** The ledger's days with everything older than `keepDays` dropped. */\nexport function pruneOutreachGatewayDays<T>(\n  days: Record<string, T> | null | undefined,\n  nowMs: number,\n  keepDays: number,\n): Record<string, T> {\n  const oldest = outreachGatewayDay(nowMs - (keepDays - 1) * 86_400_000)\n  return Object.fromEntries(Object.entries(days ?? {}).filter(([day]) => day >= oldest))\n}\n\n/**\n * What the gates and the enroll dialog know about the gateway in front of\n * one address: which it is, and what it did with this organization's mail\n * over the chip's week and the hold's month.\n */\nexport interface OutreachGatewayStanding {\n  gateway: OutreachMailGateway\n  /** Blocks and deliveries in the last {@link OUTREACH_GATEWAY_CHIP_DAYS} days. */\n  blocked7: number\n  delivered7: number\n  /** Blocks and deliveries in the last {@link OUTREACH_GATEWAY_WINDOW_DAYS} days. */\n  blocked30: number\n  delivered30: number\n}\n\n/**\n * Whether the gateway holds the next send — see the module note. A named\n * gateway only: `other` is many exchanges, and `none` blocks instead.\n */\nexport function outreachGatewayHolds(standing: Pick<OutreachGatewayStanding, 'gateway' | 'blocked30' | 'delivered30'>): boolean {\n  if (standing.gateway === 'other' || standing.gateway === 'none') return false\n  return count(standing.blocked30) >= OUTREACH_GATEWAY_HOLD_BLOCKS && count(standing.delivered30) === 0\n}\n\n/** The sentence the hold is written with, on the enrollment and in the engine's reason. */\nexport function outreachGatewayHoldReason(gateway: OutreachMailGateway, blocked30: number): string {\n  const name = OUTREACH_MAIL_GATEWAY_LABELS[gateway]\n  return (\n    `${name} refused this sender ${blocked30 === 2 ? 'twice' : `${blocked30} times`} in the last ` +\n    `${OUTREACH_GATEWAY_WINDOW_DAYS} days and delivered nothing, so this email is held. ` +\n    'Resume the enrollment to send it anyway.'\n  )\n}\n\n/** The chip's tone: what color the Check-people step gives it. */\nexport type OutreachGatewayChipTone = 'refused' | 'delivered' | 'neutral' | 'blocked'\n\nexport interface OutreachGatewayChip {\n  label: string\n  tone: OutreachGatewayChipTone\n}\n\n/**\n * The Check-people chip for one person, or `null` when there is nothing\n * worth a chip: an unrecognized exchange with no verdict this week. Red for\n * a gateway that refused this week, green for one that delivered, neutral\n * for the hosted providers and the security gateways with no verdict yet,\n * and blocked for a domain with no MX.\n */\nexport function outreachGatewayChip(standing: OutreachGatewayStanding | null | undefined): OutreachGatewayChip | null {\n  if (!standing) return null\n  const name = OUTREACH_MAIL_GATEWAY_LABELS[standing.gateway]\n  if (standing.gateway === 'none') return { label: 'No MX record — cannot receive mail', tone: 'blocked' }\n  const blocked = count(standing.blocked7)\n  const delivered = count(standing.delivered7)\n  const settled = blocked + delivered\n  if (blocked > 0) {\n    return {\n      label: `${name} · ${blocked} of ${settled} ${settled === 1 ? 'send' : 'sends'} refused this week`,\n      tone: 'refused',\n    }\n  }\n  if (delivered > 0) {\n    return { label: `${name} · ${delivered} of ${settled} delivered this week`, tone: 'delivered' }\n  }\n  if (standing.gateway === 'other') return null\n  return { label: name, tone: 'neutral' }\n}\n"],"names":["OUTREACH_MAIL_GATEWAYS","OUTREACH_MAIL_GATEWAY_LABELS","barracuda","proofpoint","mimecast","google","microsoft","other","none","OUTREACH_GATEWAY_FRONTED","OUTREACH_GATEWAY_HOLD_BLOCKS","OUTREACH_GATEWAY_WINDOW_DAYS","OUTREACH_GATEWAY_CHIP_DAYS","OUTREACH_DOMAIN_INTEL_TTL_MS","OUTREACH_GATEWAY_DELIVERED_AFTER_MS","GATEWAY_HOST_SUFFIXES","normalizeHost","host","String","trim","toLowerCase","replace","outreachMailGatewayOfHost","name","gateway","suffixes","some","suffix","slice","endsWith","classifyOutreachMailGateway","mxHosts","hosts","map","filter","Boolean","length","isOutreachGatewayFronted","undefined","includes","outreachGatewayDay","atMs","Date","toISOString","count","value","number","Number","isFinite","Math","max","floor","outreachGatewayWindow","days","nowMs","windowDays","summed","sent","delivered","blocked","oldest","newest","day","counts","Object","entries","pruneOutreachGatewayDays","keepDays","fromEntries","outreachGatewayHolds","standing","blocked30","delivered30","outreachGatewayHoldReason","outreachGatewayChip","label","tone","blocked7","delivered7","settled"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CA8B4C,GAW5C,OAAO,MAAMA,yBAAyD;IACpE;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED,yEAAyE,GACzE,OAAO,MAAMC,+BAAoE;IAC/EC,WAAW;IACXC,YAAY;IACZC,UAAU;IACVC,QAAQ;IACRC,WAAW;IACXC,OAAO;IACPC,MAAM;AACR,EAAC;AAED;;;;CAIC,GACD,OAAO,MAAMC,2BAA2D;IAAC;IAAa;IAAc;CAAW,CAAA;AAE/G,iFAAiF,GACjF,OAAO,MAAMC,+BAA+B,EAAC;AAE7C,sCAAsC,GACtC,OAAO,MAAMC,+BAA+B,GAAE;AAE9C,2CAA2C,GAC3C,OAAO,MAAMC,6BAA6B,EAAC;AAE3C,2EAA2E,GAC3E,OAAO,MAAMC,+BAA+B,IAAI,KAAK,KAAK,KAAK,KAAI;AAEnE,kEAAkE,GAClE,OAAO,MAAMC,sCAAsC,KAAK,KAAK,KAAK,KAAI;AAEtE,oFAAoF,GACpF,MAAMC,wBAA0F;IAC9F;QAAC;QAAa;YAAC;YAA8B;SAAyB;KAAC;IACvE;QAAC;QAAc;YAAC;YAAiB;YAAmB;SAAkB;KAAC;IACvE;QAAC;QAAY;YAAC;YAAiB;YAAmB;SAAyB;KAAC;IAC5E;QAAC;QAAU;YAAC;YAAe;YAAmB;SAAa;KAAC;IAC5D;QAAC;QAAa;YAAC;YAAgC;YAAgB;SAA0B;KAAC;CAC3F;AAED,8EAA8E,GAC9E,SAASC,cAAcC,IAAa;IAClC,OAAOC,OAAOD,eAAAA,OAAQ,IACnBE,IAAI,GACJC,WAAW,GACXC,OAAO,CAAC,OAAO;AACpB;AAEA;;;CAGC,GACD,OAAO,SAASC,0BAA0BL,IAAa;IACrD,MAAMM,OAAOP,cAAcC;IAC3B,IAAI,CAACM,MAAM,OAAO;IAClB,KAAK,MAAM,CAACC,SAASC,SAAS,IAAIV,sBAAuB;QACvD,IAAIU,SAASC,IAAI,CAAC,CAACC,SAAWJ,SAASI,OAAOC,KAAK,CAAC,MAAML,KAAKM,QAAQ,CAACF,UAAU,OAAOH;IAC3F;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASM,4BAA4BC,OAA0B;IACpE,MAAMC,QAAQD,QAAQE,GAAG,CAACjB,eAAekB,MAAM,CAACC;IAChD,sEAAsE;IACtE,uCAAuC;IACvC,IAAI,CAACH,MAAMI,MAAM,EAAE,OAAO;IAC1B,KAAK,MAAMnB,QAAQe,MAAO;QACxB,MAAMR,UAAUF,0BAA0BL;QAC1C,IAAIO,SAAS,OAAOA;IACtB;IACA,OAAO;AACT;AAEA,kGAAkG,GAClG,OAAO,SAASa,yBAAyBb,OAA+C;IACtF,OAAOA,YAAY,QAAQA,YAAYc,aAAa7B,yBAAyB8B,QAAQ,CAACf;AACxF;AASA,gEAAgE,GAChE,OAAO,SAASgB,mBAAmBC,IAAY;IAC7C,OAAO,IAAIC,KAAKD,MAAME,WAAW,GAAGf,KAAK,CAAC,GAAG;AAC/C;AAEA,MAAMgB,QAAQ,CAACC;IACb,MAAMC,SAASC,OAAOF;IACtB,OAAOE,OAAOC,QAAQ,CAACF,UAAUG,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACL,WAAW;AACrE;AAEA,8EAA8E,GAC9E,OAAO,SAASM,sBACdC,IAA0E,EAC1EC,KAAa,EACbC,UAAkB;IAElB,MAAMC,SAAmC;QAAEC,MAAM;QAAGC,WAAW;QAAGC,SAAS;IAAE;IAC7E,IAAI,CAACN,MAAM,OAAOG;IAClB,MAAMI,SAASpB,mBAAmBc,QAAQ,AAACC,CAAAA,aAAa,CAAA,IAAK;IAC7D,MAAMM,SAASrB,mBAAmBc;IAClC,KAAK,MAAM,CAACQ,KAAKC,OAAO,IAAIC,OAAOC,OAAO,CAACZ,MAAO;QAChD,IAAIS,MAAMF,UAAUE,MAAMD,QAAQ;QAClCL,OAAOC,IAAI,IAAIb,MAAMmB,0BAAAA,OAAQN,IAAI;QACjCD,OAAOE,SAAS,IAAId,MAAMmB,0BAAAA,OAAQL,SAAS;QAC3CF,OAAOG,OAAO,IAAIf,MAAMmB,0BAAAA,OAAQJ,OAAO;IACzC;IACA,OAAOH;AACT;AAEA,qEAAqE,GACrE,OAAO,SAASU,yBACdb,IAA0C,EAC1CC,KAAa,EACba,QAAgB;IAEhB,MAAMP,SAASpB,mBAAmBc,QAAQ,AAACa,CAAAA,WAAW,CAAA,IAAK;IAC3D,OAAOH,OAAOI,WAAW,CAACJ,OAAOC,OAAO,CAACZ,eAAAA,OAAQ,CAAC,GAAGnB,MAAM,CAAC,CAAC,CAAC4B,IAAI,GAAKA,OAAOF;AAChF;AAiBA;;;CAGC,GACD,OAAO,SAASS,qBAAqBC,QAAgF;IACnH,IAAIA,SAAS9C,OAAO,KAAK,WAAW8C,SAAS9C,OAAO,KAAK,QAAQ,OAAO;IACxE,OAAOoB,MAAM0B,SAASC,SAAS,KAAK7D,gCAAgCkC,MAAM0B,SAASE,WAAW,MAAM;AACtG;AAEA,yFAAyF,GACzF,OAAO,SAASC,0BAA0BjD,OAA4B,EAAE+C,SAAiB;IACvF,MAAMhD,OAAOtB,4BAA4B,CAACuB,QAAQ;IAClD,OACE,GAAGD,KAAK,qBAAqB,EAAEgD,cAAc,IAAI,UAAU,GAAGA,UAAU,MAAM,CAAC,CAAC,aAAa,CAAC,GAC9F,GAAG5D,6BAA6B,oDAAoD,CAAC,GACrF;AAEJ;AAUA;;;;;;CAMC,GACD,OAAO,SAAS+D,oBAAoBJ,QAAoD;IACtF,IAAI,CAACA,UAAU,OAAO;IACtB,MAAM/C,OAAOtB,4BAA4B,CAACqE,SAAS9C,OAAO,CAAC;IAC3D,IAAI8C,SAAS9C,OAAO,KAAK,QAAQ,OAAO;QAAEmD,OAAO;QAAsCC,MAAM;IAAU;IACvG,MAAMjB,UAAUf,MAAM0B,SAASO,QAAQ;IACvC,MAAMnB,YAAYd,MAAM0B,SAASQ,UAAU;IAC3C,MAAMC,UAAUpB,UAAUD;IAC1B,IAAIC,UAAU,GAAG;QACf,OAAO;YACLgB,OAAO,GAAGpD,KAAK,GAAG,EAAEoC,QAAQ,IAAI,EAAEoB,QAAQ,CAAC,EAAEA,YAAY,IAAI,SAAS,QAAQ,kBAAkB,CAAC;YACjGH,MAAM;QACR;IACF;IACA,IAAIlB,YAAY,GAAG;QACjB,OAAO;YAAEiB,OAAO,GAAGpD,KAAK,GAAG,EAAEmC,UAAU,IAAI,EAAEqB,QAAQ,oBAAoB,CAAC;YAAEH,MAAM;QAAY;IAChG;IACA,IAAIN,SAAS9C,OAAO,KAAK,SAAS,OAAO;IACzC,OAAO;QAAEmD,OAAOpD;QAAMqD,MAAM;IAAU;AACxC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/mail-gateway.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE MAIL GATEWAY, AS SEQUENCES NAMES IT (AGL-3326).\n *\n * The engine is the platform's — `@aglyn/shared-util-email`'s\n * `mail-gateway` (AGL-3328), which the Resend path reads too, so one table\n * names a gateway and one rule holds a send for both. What stays here is\n * the vocabulary Sequences already speaks, and the one sentence it adds: a\n * held enrollment is resumed by a member.\n *\n * ## The hold, as Sequences applies it\n *\n * A gateway that REFUSED the mailbox's sending domain twice in the last\n * {@link OUTREACH_GATEWAY_WINDOW_DAYS} days without delivering once holds\n * the next send into it: nothing goes into a gateway that has refused us\n * twice unless a member says so. `other` never holds; `none` blocks instead.\n *==========================================*/\n\nimport {\n  classifyMailGateway,\n  isMailGatewayFronted,\n  MAIL_DOMAIN_INTEL_TTL_MS,\n  MAIL_GATEWAY_CHIP_DAYS,\n  MAIL_GATEWAY_DELIVERED_AFTER_MS,\n  MAIL_GATEWAY_HOLD_BLOCKS,\n  MAIL_GATEWAY_LABELS,\n  MAIL_GATEWAY_WINDOW_DAYS,\n  MAIL_GATEWAYS,\n  MAIL_GATEWAYS_FRONTED,\n  type MailGateway,\n  mailGatewayChip,\n  type MailGatewayChip,\n  type MailGatewayChipTone,\n  mailGatewayDay,\n  type MailGatewayDayCounts,\n  mailGatewayHolds,\n  mailGatewayHoldSentence,\n  mailGatewayOfHost,\n  type MailGatewayStanding,\n  mailGatewayWindow,\n  pruneMailGatewayDays,\n} from '@aglyn/shared-util-email/mail-gateway'\n\nexport type OutreachMailGateway = MailGateway\nexport type OutreachGatewayDayCounts = MailGatewayDayCounts\nexport type OutreachGatewayStanding = MailGatewayStanding\nexport type OutreachGatewayChipTone = MailGatewayChipTone\nexport type OutreachGatewayChip = MailGatewayChip\n\nexport const OUTREACH_MAIL_GATEWAYS = MAIL_GATEWAYS\n/** The gateway as the Check-people chip and the enrollment row name it. */\nexport const OUTREACH_MAIL_GATEWAY_LABELS = MAIL_GATEWAY_LABELS\n/** The security gateways the enroll dialog counts as \"gateway-fronted\". */\nexport const OUTREACH_GATEWAY_FRONTED = MAIL_GATEWAYS_FRONTED\nexport const OUTREACH_GATEWAY_HOLD_BLOCKS = MAIL_GATEWAY_HOLD_BLOCKS\nexport const OUTREACH_GATEWAY_WINDOW_DAYS = MAIL_GATEWAY_WINDOW_DAYS\nexport const OUTREACH_GATEWAY_CHIP_DAYS = MAIL_GATEWAY_CHIP_DAYS\nexport const OUTREACH_DOMAIN_INTEL_TTL_MS = MAIL_DOMAIN_INTEL_TTL_MS\nexport const OUTREACH_GATEWAY_DELIVERED_AFTER_MS = MAIL_GATEWAY_DELIVERED_AFTER_MS\n\nexport const outreachMailGatewayOfHost = mailGatewayOfHost\nexport const classifyOutreachMailGateway = classifyMailGateway\nexport const isOutreachGatewayFronted = isMailGatewayFronted\nexport const outreachGatewayDay = mailGatewayDay\nexport const outreachGatewayWindow = mailGatewayWindow\nexport const pruneOutreachGatewayDays = pruneMailGatewayDays\nexport const outreachGatewayHolds = mailGatewayHolds\nexport const outreachGatewayChip = mailGatewayChip\n\n/** The sentence the hold is written with, on the enrollment and in the engine's reason. */\nexport function outreachGatewayHoldReason(gateway: OutreachMailGateway, blocked30: number): string {\n  return `${mailGatewayHoldSentence(gateway, blocked30)}, so this email is held. Resume the enrollment to send it anyway.`\n}\n"],"names":["classifyMailGateway","isMailGatewayFronted","MAIL_DOMAIN_INTEL_TTL_MS","MAIL_GATEWAY_CHIP_DAYS","MAIL_GATEWAY_DELIVERED_AFTER_MS","MAIL_GATEWAY_HOLD_BLOCKS","MAIL_GATEWAY_LABELS","MAIL_GATEWAY_WINDOW_DAYS","MAIL_GATEWAYS","MAIL_GATEWAYS_FRONTED","mailGatewayChip","mailGatewayDay","mailGatewayHolds","mailGatewayHoldSentence","mailGatewayOfHost","mailGatewayWindow","pruneMailGatewayDays","OUTREACH_MAIL_GATEWAYS","OUTREACH_MAIL_GATEWAY_LABELS","OUTREACH_GATEWAY_FRONTED","OUTREACH_GATEWAY_HOLD_BLOCKS","OUTREACH_GATEWAY_WINDOW_DAYS","OUTREACH_GATEWAY_CHIP_DAYS","OUTREACH_DOMAIN_INTEL_TTL_MS","OUTREACH_GATEWAY_DELIVERED_AFTER_MS","outreachMailGatewayOfHost","classifyOutreachMailGateway","isOutreachGatewayFronted","outreachGatewayDay","outreachGatewayWindow","pruneOutreachGatewayDays","outreachGatewayHolds","outreachGatewayChip","outreachGatewayHoldReason","gateway","blocked30"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;4CAe4C,GAE5C,SACEA,mBAAmB,EACnBC,oBAAoB,EACpBC,wBAAwB,EACxBC,sBAAsB,EACtBC,+BAA+B,EAC/BC,wBAAwB,EACxBC,mBAAmB,EACnBC,wBAAwB,EACxBC,aAAa,EACbC,qBAAqB,EAErBC,eAAe,EAGfC,cAAc,EAEdC,gBAAgB,EAChBC,uBAAuB,EACvBC,iBAAiB,EAEjBC,iBAAiB,EACjBC,oBAAoB,QACf,wCAAuC;AAQ9C,OAAO,MAAMC,yBAAyBT,cAAa;AACnD,yEAAyE,GACzE,OAAO,MAAMU,+BAA+BZ,oBAAmB;AAC/D,yEAAyE,GACzE,OAAO,MAAMa,2BAA2BV,sBAAqB;AAC7D,OAAO,MAAMW,+BAA+Bf,yBAAwB;AACpE,OAAO,MAAMgB,+BAA+Bd,yBAAwB;AACpE,OAAO,MAAMe,6BAA6BnB,uBAAsB;AAChE,OAAO,MAAMoB,+BAA+BrB,yBAAwB;AACpE,OAAO,MAAMsB,sCAAsCpB,gCAA+B;AAElF,OAAO,MAAMqB,4BAA4BX,kBAAiB;AAC1D,OAAO,MAAMY,8BAA8B1B,oBAAmB;AAC9D,OAAO,MAAM2B,2BAA2B1B,qBAAoB;AAC5D,OAAO,MAAM2B,qBAAqBjB,eAAc;AAChD,OAAO,MAAMkB,wBAAwBd,kBAAiB;AACtD,OAAO,MAAMe,2BAA2Bd,qBAAoB;AAC5D,OAAO,MAAMe,uBAAuBnB,iBAAgB;AACpD,OAAO,MAAMoB,sBAAsBtB,gBAAe;AAElD,yFAAyF,GACzF,OAAO,SAASuB,0BAA0BC,OAA4B,EAAEC,SAAiB;IACvF,OAAO,GAAGtB,wBAAwBqB,SAASC,WAAW,iEAAiE,CAAC;AAC1H"}

package/src/lib/enrollment/enrollment-search.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { OutreachEnrollment } from '../model/outreach.types';
+/**
+ * What a sequence's enrollments table searches an enrollment by (AGL-3321):
+ * every prefix of each word of the person's name, and of their address, its
+ * domain and each piece of either — the same address derivation the
+ * platform's suppression search uses — so "casey", "morgan" and "example"
+ * all find Casey Morgan at casey.morgan@example.com.
+ *
+ * Both halves are captured once, at enrollment, and never rewritten (an
+ * erasure deletes the enrollment rather than editing it), so the enroll
+ * route stamps this on the document it creates and nothing else has to.
+ * `tools/scripts/backfill-outreach-list-search.mjs` restates it for the
+ * enrollments made before it; both are held to
+ * `tools/scripts/lib/outreach-search-tokens.fixtures.json`.
+ */
+export declare function outreachEnrollmentSearchTokens(enrollment: Pick<OutreachEnrollment, 'contactName' | 'email'>): string[];

package/src/lib/enrollment/enrollment-search.js

@@ -0,0 +1,40 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { nameSearchTokens } from "@aglyn/aglyn/app-utils/name-search";
+import { emailSearchTokens } from "@aglyn/tenant-data-admin/server/email-suppression";
+/**
+ * What a sequence's enrollments table searches an enrollment by (AGL-3321):
+ * every prefix of each word of the person's name, and of their address, its
+ * domain and each piece of either — the same address derivation the
+ * platform's suppression search uses — so "casey", "morgan" and "example"
+ * all find Casey Morgan at casey.morgan@example.com.
+ *
+ * Both halves are captured once, at enrollment, and never rewritten (an
+ * erasure deletes the enrollment rather than editing it), so the enroll
+ * route stamps this on the document it creates and nothing else has to.
+ * `tools/scripts/backfill-outreach-list-search.mjs` restates it for the
+ * enrollments made before it; both are held to
+ * `tools/scripts/lib/outreach-search-tokens.fixtures.json`.
+ */ export function outreachEnrollmentSearchTokens(enrollment) {
+    return [
+        ...new Set([
+            ...nameSearchTokens(enrollment.contactName),
+            ...emailSearchTokens(enrollment.email)
+        ])
+    ];
+}
+
+//# sourceMappingURL=enrollment-search.js.map

package/src/lib/enrollment/enrollment-search.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/enrollment/enrollment-search.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { nameSearchTokens } from '@aglyn/aglyn/app-utils/name-search'\nimport { emailSearchTokens } from '@aglyn/tenant-data-admin/server/email-suppression'\nimport type { OutreachEnrollment } from '../model/outreach.types'\n\n/**\n * What a sequence's enrollments table searches an enrollment by (AGL-3321):\n * every prefix of each word of the person's name, and of their address, its\n * domain and each piece of either — the same address derivation the\n * platform's suppression search uses — so \"casey\", \"morgan\" and \"example\"\n * all find Casey Morgan at casey.morgan@example.com.\n *\n * Both halves are captured once, at enrollment, and never rewritten (an\n * erasure deletes the enrollment rather than editing it), so the enroll\n * route stamps this on the document it creates and nothing else has to.\n * `tools/scripts/backfill-outreach-list-search.mjs` restates it for the\n * enrollments made before it; both are held to\n * `tools/scripts/lib/outreach-search-tokens.fixtures.json`.\n */\nexport function outreachEnrollmentSearchTokens(\n  enrollment: Pick<OutreachEnrollment, 'contactName' | 'email'>,\n): string[] {\n  return [\n    ...new Set([\n      ...nameSearchTokens(enrollment.contactName),\n      ...emailSearchTokens(enrollment.email),\n    ]),\n  ]\n}\n"],"names":["nameSearchTokens","emailSearchTokens","outreachEnrollmentSearchTokens","enrollment","Set","contactName","email"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,QAAQ,qCAAoC;AACrE,SAASC,iBAAiB,QAAQ,oDAAmD;AAGrF;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,+BACdC,UAA6D;IAE7D,OAAO;WACF,IAAIC,IAAI;eACNJ,iBAAiBG,WAAWE,WAAW;eACvCJ,kBAAkBE,WAAWG,KAAK;SACtC;KACF;AACH"}

package/src/lib/model/do-not-contact-domain-list-query.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type ListQueryDeclaration } from '@aglyn/shared-ui-jsx/const/list-query-plan';
+import type { OutreachDoNotContactDomainEntry } from './outreach.types';
+/** The array the search box reads, stamped by the one writer that adds a domain. */
+export declare const OUTREACH_DOMAIN_SEARCH_TOKENS = "searchTokens";
+export declare const OUTREACH_DO_NOT_CONTACT_DOMAIN_LIST_QUERY: ListQueryDeclaration;
+/**
+ * What the domains list searches an entry by: every prefix of the domain
+ * whole and of each shorter domain inside it, of each of its labels, and of
+ * each word of its detail — so "acme", "acme.com" and "mail.ac" all find
+ * `mail.acme.com`, and "barracuda" finds the domain a gateway block filed.
+ * An entry is created once and never edited, so its one writer stamps this
+ * and `tools/scripts/backfill-outreach-list-search.mjs` restates it for the
+ * entries made before it; both are held to
+ * `tools/scripts/lib/outreach-search-tokens.fixtures.json`.
+ */
+export declare function outreachDomainSearchTokens(entry: Pick<OutreachDoNotContactDomainEntry, 'domain' | 'detail'>): string[];

package/src/lib/model/do-not-contact-domain-list-query.js

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { nameSearchTokens } from "@aglyn/aglyn/app-utils/name-search";
+import { LIST_QUERY_ID_PATH } from "@aglyn/shared-ui-jsx/const/list-query-plan";
+/*
+ * WHAT THE DO-NOT-CONTACT DOMAINS LIST ASKS FIRESTORE (AGL-3321).
+ *
+ * One query over `orgs/{orgId}/outreachDoNotContactDomains`, alphabetical —
+ * the document id IS the domain — paged by that query:
+ *
+ *   domain  `equals` one domain, on the `domain` field every entry carries
+ *           beside its id, lower-cased the way every domain is written; a
+ *           prefix is the search box's job, which reads every label;
+ *   reason  the stored reason, which every entry carries;
+ *   added   the list's ONE range: when the entry was added, which every
+ *           entry carries; a range leads the order, so while it applies
+ *           the list is newest added first;
+ *   search  `searchTokens`: the domain, each shorter domain inside it and
+ *           each of its labels, and the words of its detail, stamped when
+ *           the entry is created.
+ *
+ * Without the range every shape is equalities and the one array clause,
+ * ordered by the document id, which Firestore serves by merging
+ * single-field indexes. The range's order needs one composite per
+ * equality field beside it: `reason` and `searchTokens`.
+ */ /** The array the search box reads, stamped by the one writer that adds a domain. */ export const OUTREACH_DOMAIN_SEARCH_TOKENS = 'searchTokens';
+export const OUTREACH_DO_NOT_CONTACT_DOMAIN_LIST_QUERY = {
+    fields: [
+        {
+            column: 'domain',
+            kind: 'text',
+            path: 'domain',
+            lowerPath: 'domain',
+            operators: [
+                'equals'
+            ]
+        },
+        {
+            column: 'reason',
+            kind: 'exact',
+            path: 'reason',
+            presence: 'always',
+            operators: [
+                'equals',
+                'isAnyOf'
+            ]
+        },
+        {
+            column: 'addedAtMs',
+            kind: 'date',
+            path: 'addedAtMs',
+            storedAs: 'millis',
+            presence: 'always',
+            operators: [
+                'is',
+                'after',
+                'onOrAfter',
+                'before',
+                'onOrBefore'
+            ]
+        }
+    ],
+    sorts: [
+        {
+            path: LIST_QUERY_ID_PATH,
+            direction: 'asc'
+        }
+    ],
+    search: {
+        tokensPath: OUTREACH_DOMAIN_SEARCH_TOKENS
+    }
+};
+/**
+ * What the domains list searches an entry by: every prefix of the domain
+ * whole and of each shorter domain inside it, of each of its labels, and of
+ * each word of its detail — so "acme", "acme.com" and "mail.ac" all find
+ * `mail.acme.com`, and "barracuda" finds the domain a gateway block filed.
+ * An entry is created once and never edited, so its one writer stamps this
+ * and `tools/scripts/backfill-outreach-list-search.mjs` restates it for the
+ * entries made before it; both are held to
+ * `tools/scripts/lib/outreach-search-tokens.fixtures.json`.
+ */ export function outreachDomainSearchTokens(entry) {
+    var _entry_domain, _entry_detail;
+    const domain = String((_entry_domain = entry.domain) != null ? _entry_domain : '');
+    const labels = domain.split('.');
+    const within = labels.map((_, at)=>labels.slice(at).join('.'));
+    return nameSearchTokens([
+        ...within,
+        ...domain.split(/[.-]+/),
+        (_entry_detail = entry.detail) != null ? _entry_detail : ''
+    ].join(' '));
+}
+
+//# sourceMappingURL=do-not-contact-domain-list-query.js.map